Linux patch 4.17.194.17-214.17

2 files changed, 10958 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 18871875..b1dd52b9 100644
--- a/0000_README
+++ b/0000_README
@@ -115,6 +115,10 @@ Patch:  1017_linux-4.17.18.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.17.18
 
+Patch:  1018_linux-4.17.19.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.17.19
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1018_linux-4.17.19.patch b/1018_linux-4.17.19.patch
new file mode 100644
index 00000000..aac0886e
--- /dev/null
+++ b/1018_linux-4.17.19.patch
@@ -0,0 +1,10954 @@
+diff --git a/Makefile b/Makefile
+index 429a1fe0b40b..32c83a163544 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 17
+-SUBLEVEL = 18
++SUBLEVEL = 19
+ EXTRAVERSION =
+ NAME = Merciless Moray
+ 
+@@ -356,9 +356,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
+ 	  else if [ -x /bin/bash ]; then echo /bin/bash; \
+ 	  else echo sh; fi ; fi)
+ 
+-HOST_LFS_CFLAGS := $(shell getconf LFS_CFLAGS)
+-HOST_LFS_LDFLAGS := $(shell getconf LFS_LDFLAGS)
+-HOST_LFS_LIBS := $(shell getconf LFS_LIBS)
++HOST_LFS_CFLAGS := $(shell getconf LFS_CFLAGS 2>/dev/null)
++HOST_LFS_LDFLAGS := $(shell getconf LFS_LDFLAGS 2>/dev/null)
++HOST_LFS_LIBS := $(shell getconf LFS_LIBS 2>/dev/null)
+ 
+ HOSTCC       = gcc
+ HOSTCXX      = g++
+diff --git a/arch/arc/Makefile b/arch/arc/Makefile
+index d37f49d6a27f..6c1b20dd76ad 100644
+--- a/arch/arc/Makefile
++++ b/arch/arc/Makefile
+@@ -16,7 +16,7 @@ endif
+ 
+ KBUILD_DEFCONFIG := nsim_700_defconfig
+ 
+-cflags-y	+= -fno-common -pipe -fno-builtin -D__linux__
++cflags-y	+= -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
+ cflags-$(CONFIG_ISA_ARCOMPACT)	+= -mA7
+ cflags-$(CONFIG_ISA_ARCV2)	+= -mcpu=archs
+ 
+@@ -140,16 +140,3 @@ dtbs: scripts
+ 
+ archclean:
+ 	$(Q)$(MAKE) $(clean)=$(boot)
+-
+-# Hacks to enable final link due to absence of link-time branch relexation
+-# and gcc choosing optimal(shorter) branches at -O3
+-#
+-# vineetg Feb 2010: -mlong-calls switched off for overall kernel build
+-# However lib/decompress_inflate.o (.init.text) calls
+-# zlib_inflate_workspacesize (.text) causing relocation errors.
+-# Thus forcing all exten calls in this file to be long calls
+-export CFLAGS_decompress_inflate.o = -mmedium-calls
+-export CFLAGS_initramfs.o = -mmedium-calls
+-ifdef CONFIG_SMP
+-export CFLAGS_core.o = -mmedium-calls
+-endif
+diff --git a/arch/arc/include/asm/mach_desc.h b/arch/arc/include/asm/mach_desc.h
+index c28e6c347b49..871f3cb16af9 100644
+--- a/arch/arc/include/asm/mach_desc.h
++++ b/arch/arc/include/asm/mach_desc.h
+@@ -34,9 +34,7 @@ struct machine_desc {
+ 	const char		*name;
+ 	const char		**dt_compat;
+ 	void			(*init_early)(void);
+-#ifdef CONFIG_SMP
+ 	void			(*init_per_cpu)(unsigned int);
+-#endif
+ 	void			(*init_machine)(void);
+ 	void			(*init_late)(void);
+ 
+diff --git a/arch/arc/kernel/irq.c b/arch/arc/kernel/irq.c
+index 538b36afe89e..62b185057c04 100644
+--- a/arch/arc/kernel/irq.c
++++ b/arch/arc/kernel/irq.c
+@@ -31,10 +31,10 @@ void __init init_IRQ(void)
+ 	/* a SMP H/w block could do IPI IRQ request here */
+ 	if (plat_smp_ops.init_per_cpu)
+ 		plat_smp_ops.init_per_cpu(smp_processor_id());
++#endif
+ 
+ 	if (machine_desc->init_per_cpu)
+ 		machine_desc->init_per_cpu(smp_processor_id());
+-#endif
+ }
+ 
+ /*
+diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
+index 5ac3b547453f..4674541eba3f 100644
+--- a/arch/arc/kernel/process.c
++++ b/arch/arc/kernel/process.c
+@@ -47,7 +47,8 @@ SYSCALL_DEFINE0(arc_gettls)
+ SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new)
+ {
+ 	struct pt_regs *regs = current_pt_regs();
+-	int uval = -EFAULT;
++	u32 uval;
++	int ret;
+ 
+ 	/*
+ 	 * This is only for old cores lacking LLOCK/SCOND, which by defintion
+@@ -60,23 +61,47 @@ SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new)
+ 	/* Z indicates to userspace if operation succeded */
+ 	regs->status32 &= ~STATUS_Z_MASK;
+ 
+-	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
+-		return -EFAULT;
++	ret = access_ok(VERIFY_WRITE, uaddr, sizeof(*uaddr));
++	if (!ret)
++		 goto fail;
+ 
++again:
+ 	preempt_disable();
+ 
+-	if (__get_user(uval, uaddr))
+-		goto done;
++	ret = __get_user(uval, uaddr);
++	if (ret)
++		 goto fault;
+ 
+-	if (uval == expected) {
+-		if (!__put_user(new, uaddr))
+-			regs->status32 |= STATUS_Z_MASK;
+-	}
++	if (uval != expected)
++		 goto out;
+ 
+-done:
+-	preempt_enable();
++	ret = __put_user(new, uaddr);
++	if (ret)
++		 goto fault;
++
++	regs->status32 |= STATUS_Z_MASK;
+ 
++out:
++	preempt_enable();
+ 	return uval;
++
++fault:
++	preempt_enable();
++
++	if (unlikely(ret != -EFAULT))
++		 goto fail;
++
++	down_read(&current->mm->mmap_sem);
++	ret = fixup_user_fault(current, current->mm, (unsigned long) uaddr,
++			       FAULT_FLAG_WRITE, NULL);
++	up_read(&current->mm->mmap_sem);
++
++	if (likely(!ret))
++		 goto again;
++
++fail:
++	force_sig(SIGSEGV, current);
++	return ret;
+ }
+ 
+ #ifdef CONFIG_ISA_ARCV2
+diff --git a/arch/arc/plat-hsdk/platform.c b/arch/arc/plat-hsdk/platform.c
+index 2958aedb649a..2588b842407c 100644
+--- a/arch/arc/plat-hsdk/platform.c
++++ b/arch/arc/plat-hsdk/platform.c
+@@ -42,6 +42,66 @@ static void __init hsdk_init_per_cpu(unsigned int cpu)
+ #define SDIO_UHS_REG_EXT	(SDIO_BASE + 0x108)
+ #define SDIO_UHS_REG_EXT_DIV_2	(2 << 30)
+ 
++#define HSDK_GPIO_INTC          (ARC_PERIPHERAL_BASE + 0x3000)
++
++static void __init hsdk_enable_gpio_intc_wire(void)
++{
++	/*
++	 * Peripherals on CPU Card are wired to cpu intc via intermediate
++	 * DW APB GPIO blocks (mainly for debouncing)
++	 *
++	 *         ---------------------
++	 *        |  snps,archs-intc  |
++	 *        ---------------------
++	 *                  |
++	 *        ----------------------
++	 *        | snps,archs-idu-intc |
++	 *        ----------------------
++	 *         |   |     |   |    |
++	 *         | [eth] [USB]    [... other peripherals]
++	 *         |
++	 * -------------------
++	 * | snps,dw-apb-intc |
++	 * -------------------
++	 *  |      |   |   |
++	 * [Bt] [HAPS]   [... other peripherals]
++	 *
++	 * Current implementation of "irq-dw-apb-ictl" driver doesn't work well
++	 * with stacked INTCs. In particular problem happens if its master INTC
++	 * not yet instantiated. See discussion here -
++	 * https://lkml.org/lkml/2015/3/4/755
++	 *
++	 * So setup the first gpio block as a passive pass thru and hide it from
++	 * DT hardware topology - connect intc directly to cpu intc
++	 * The GPIO "wire" needs to be init nevertheless (here)
++	 *
++	 * One side adv is that peripheral interrupt handling avoids one nested
++	 * intc ISR hop
++	 *
++	 * According to HSDK User's Manual [1], "Table 2 Interrupt Mapping"
++	 * we have the following GPIO input lines used as sources of interrupt:
++	 * - GPIO[0] - Bluetooth interrupt of RS9113 module
++	 * - GPIO[2] - HAPS interrupt (on HapsTrak 3 connector)
++	 * - GPIO[3] - Audio codec (MAX9880A) interrupt
++	 * - GPIO[8-23] - Available on Arduino and PMOD_x headers
++	 * For now there's no use of Arduino and PMOD_x headers in Linux
++	 * use-case so we only enable lines 0, 2 and 3.
++	 *
++	 * [1] https://github.com/foss-for-synopsys-dwc-arc-processors/ARC-Development-Systems-Forum/wiki/docs/ARC_HSDK_User_Guide.pdf
++	 */
++#define GPIO_INTEN              (HSDK_GPIO_INTC + 0x30)
++#define GPIO_INTMASK            (HSDK_GPIO_INTC + 0x34)
++#define GPIO_INTTYPE_LEVEL      (HSDK_GPIO_INTC + 0x38)
++#define GPIO_INT_POLARITY       (HSDK_GPIO_INTC + 0x3c)
++#define GPIO_INT_CONNECTED_MASK	0x0d
++
++	iowrite32(0xffffffff, (void __iomem *) GPIO_INTMASK);
++	iowrite32(~GPIO_INT_CONNECTED_MASK, (void __iomem *) GPIO_INTMASK);
++	iowrite32(0x00000000, (void __iomem *) GPIO_INTTYPE_LEVEL);
++	iowrite32(0xffffffff, (void __iomem *) GPIO_INT_POLARITY);
++	iowrite32(GPIO_INT_CONNECTED_MASK, (void __iomem *) GPIO_INTEN);
++}
++
+ static void __init hsdk_init_early(void)
+ {
+ 	/*
+@@ -62,6 +122,8 @@ static void __init hsdk_init_early(void)
+ 	 * minimum possible div-by-2.
+ 	 */
+ 	iowrite32(SDIO_UHS_REG_EXT_DIV_2, (void __iomem *) SDIO_UHS_REG_EXT);
++
++	hsdk_enable_gpio_intc_wire();
+ }
+ 
+ static const char *hsdk_compat[] __initconst = {
+diff --git a/arch/arm/boot/dts/am3517.dtsi b/arch/arm/boot/dts/am3517.dtsi
+index 4b6062b631b1..23ea381d363f 100644
+--- a/arch/arm/boot/dts/am3517.dtsi
++++ b/arch/arm/boot/dts/am3517.dtsi
+@@ -91,6 +91,11 @@
+ 	};
+ };
+ 
++/* Table Table 5-79 of the TRM shows 480ab000 is reserved */
++&usb_otg_hs {
++	status = "disabled";
++};
++
+ &iva {
+ 	status = "disabled";
+ };
+diff --git a/arch/arm/boot/dts/am437x-sk-evm.dts b/arch/arm/boot/dts/am437x-sk-evm.dts
+index 4118802b7fea..f17ed89da06b 100644
+--- a/arch/arm/boot/dts/am437x-sk-evm.dts
++++ b/arch/arm/boot/dts/am437x-sk-evm.dts
+@@ -537,6 +537,8 @@
+ 
+ 		touchscreen-size-x = <480>;
+ 		touchscreen-size-y = <272>;
++
++		wakeup-source;
+ 	};
+ 
+ 	tlv320aic3106: tlv320aic3106@1b {
+diff --git a/arch/arm/boot/dts/armada-385-synology-ds116.dts b/arch/arm/boot/dts/armada-385-synology-ds116.dts
+index 6782ce481ac9..d8769956cbfc 100644
+--- a/arch/arm/boot/dts/armada-385-synology-ds116.dts
++++ b/arch/arm/boot/dts/armada-385-synology-ds116.dts
+@@ -139,7 +139,7 @@
+ 					      3700 5
+ 					      3900 6
+ 					      4000 7>;
+-			cooling-cells = <2>;
++			#cooling-cells = <2>;
+ 		};
+ 
+ 		gpio-leds {
+diff --git a/arch/arm/boot/dts/bcm-cygnus.dtsi b/arch/arm/boot/dts/bcm-cygnus.dtsi
+index 9fe4f5a6379e..2c4df2d2d4a6 100644
+--- a/arch/arm/boot/dts/bcm-cygnus.dtsi
++++ b/arch/arm/boot/dts/bcm-cygnus.dtsi
+@@ -216,7 +216,7 @@
+ 			reg = <0x18008000 0x100>;
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			interrupts = <GIC_SPI 85 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
+ 			clock-frequency = <100000>;
+ 			status = "disabled";
+ 		};
+@@ -245,7 +245,7 @@
+ 			reg = <0x1800b000 0x100>;
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			interrupts = <GIC_SPI 86 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
+ 			clock-frequency = <100000>;
+ 			status = "disabled";
+ 		};
+@@ -256,7 +256,7 @@
+ 
+ 			#interrupt-cells = <1>;
+ 			interrupt-map-mask = <0 0 0 0>;
+-			interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_NONE>;
++			interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 			linux,pci-domain = <0>;
+ 
+@@ -278,10 +278,10 @@
+ 				compatible = "brcm,iproc-msi";
+ 				msi-controller;
+ 				interrupt-parent = <&gic>;
+-				interrupts = <GIC_SPI 96 IRQ_TYPE_NONE>,
+-					     <GIC_SPI 97 IRQ_TYPE_NONE>,
+-					     <GIC_SPI 98 IRQ_TYPE_NONE>,
+-					     <GIC_SPI 99 IRQ_TYPE_NONE>;
++				interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 99 IRQ_TYPE_LEVEL_HIGH>;
+ 			};
+ 		};
+ 
+@@ -291,7 +291,7 @@
+ 
+ 			#interrupt-cells = <1>;
+ 			interrupt-map-mask = <0 0 0 0>;
+-			interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_NONE>;
++			interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 			linux,pci-domain = <1>;
+ 
+@@ -313,10 +313,10 @@
+ 				compatible = "brcm,iproc-msi";
+ 				msi-controller;
+ 				interrupt-parent = <&gic>;
+-				interrupts = <GIC_SPI 102 IRQ_TYPE_NONE>,
+-					     <GIC_SPI 103 IRQ_TYPE_NONE>,
+-					     <GIC_SPI 104 IRQ_TYPE_NONE>,
+-					     <GIC_SPI 105 IRQ_TYPE_NONE>;
++				interrupts = <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>;
+ 			};
+ 		};
+ 
+diff --git a/arch/arm/boot/dts/bcm-hr2.dtsi b/arch/arm/boot/dts/bcm-hr2.dtsi
+index 3f9cedd8011f..3084a7c95733 100644
+--- a/arch/arm/boot/dts/bcm-hr2.dtsi
++++ b/arch/arm/boot/dts/bcm-hr2.dtsi
+@@ -264,7 +264,7 @@
+ 			reg = <0x38000 0x50>;
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			interrupts = <GIC_SPI 95 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 95 IRQ_TYPE_LEVEL_HIGH>;
+ 			clock-frequency = <100000>;
+ 		};
+ 
+@@ -279,7 +279,7 @@
+ 			reg = <0x3b000 0x50>;
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			interrupts = <GIC_SPI 96 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>;
+ 			clock-frequency = <100000>;
+ 		};
+ 	};
+@@ -300,7 +300,7 @@
+ 
+ 		#interrupt-cells = <1>;
+ 		interrupt-map-mask = <0 0 0 0>;
+-		interrupt-map = <0 0 0 0 &gic GIC_SPI 186 IRQ_TYPE_NONE>;
++		interrupt-map = <0 0 0 0 &gic GIC_SPI 186 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 		linux,pci-domain = <0>;
+ 
+@@ -322,10 +322,10 @@
+ 			compatible = "brcm,iproc-msi";
+ 			msi-controller;
+ 			interrupt-parent = <&gic>;
+-			interrupts = <GIC_SPI 182 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 183 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 184 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 185 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 182 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 183 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 184 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 185 IRQ_TYPE_LEVEL_HIGH>;
+ 			brcm,pcie-msi-inten;
+ 		};
+ 	};
+@@ -336,7 +336,7 @@
+ 
+ 		#interrupt-cells = <1>;
+ 		interrupt-map-mask = <0 0 0 0>;
+-		interrupt-map = <0 0 0 0 &gic GIC_SPI 192 IRQ_TYPE_NONE>;
++		interrupt-map = <0 0 0 0 &gic GIC_SPI 192 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 		linux,pci-domain = <1>;
+ 
+@@ -358,10 +358,10 @@
+ 			compatible = "brcm,iproc-msi";
+ 			msi-controller;
+ 			interrupt-parent = <&gic>;
+-			interrupts = <GIC_SPI 188 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 189 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 190 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 191 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 188 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 189 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 190 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 191 IRQ_TYPE_LEVEL_HIGH>;
+ 			brcm,pcie-msi-inten;
+ 		};
+ 	};
+diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi
+index dcc55aa84583..09ba85046322 100644
+--- a/arch/arm/boot/dts/bcm-nsp.dtsi
++++ b/arch/arm/boot/dts/bcm-nsp.dtsi
+@@ -391,7 +391,7 @@
+ 			reg = <0x38000 0x50>;
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			interrupts = <GIC_SPI 89 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>;
+ 			clock-frequency = <100000>;
+ 			dma-coherent;
+ 			status = "disabled";
+@@ -496,7 +496,7 @@
+ 
+ 		#interrupt-cells = <1>;
+ 		interrupt-map-mask = <0 0 0 0>;
+-		interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_NONE>;
++		interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 		linux,pci-domain = <0>;
+ 
+@@ -519,10 +519,10 @@
+ 			compatible = "brcm,iproc-msi";
+ 			msi-controller;
+ 			interrupt-parent = <&gic>;
+-			interrupts = <GIC_SPI 127 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 128 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 129 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 130 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 127 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 128 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 129 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>;
+ 			brcm,pcie-msi-inten;
+ 		};
+ 	};
+@@ -533,7 +533,7 @@
+ 
+ 		#interrupt-cells = <1>;
+ 		interrupt-map-mask = <0 0 0 0>;
+-		interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_NONE>;
++		interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 		linux,pci-domain = <1>;
+ 
+@@ -556,10 +556,10 @@
+ 			compatible = "brcm,iproc-msi";
+ 			msi-controller;
+ 			interrupt-parent = <&gic>;
+-			interrupts = <GIC_SPI 133 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 134 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 135 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 136 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
+ 			brcm,pcie-msi-inten;
+ 		};
+ 	};
+@@ -570,7 +570,7 @@
+ 
+ 		#interrupt-cells = <1>;
+ 		interrupt-map-mask = <0 0 0 0>;
+-		interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_NONE>;
++		interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 		linux,pci-domain = <2>;
+ 
+@@ -593,10 +593,10 @@
+ 			compatible = "brcm,iproc-msi";
+ 			msi-controller;
+ 			interrupt-parent = <&gic>;
+-			interrupts = <GIC_SPI 139 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 140 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 141 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 142 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 139 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>;
+ 			brcm,pcie-msi-inten;
+ 		};
+ 	};
+diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
+index 9a076c409f4e..ef995e50ee12 100644
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -365,7 +365,7 @@
+ 	i2c0: i2c@18009000 {
+ 		compatible = "brcm,iproc-i2c";
+ 		reg = <0x18009000 0x50>;
+-		interrupts = <GIC_SPI 121 IRQ_TYPE_NONE>;
++		interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		clock-frequency = <100000>;
+diff --git a/arch/arm/boot/dts/da850.dtsi b/arch/arm/boot/dts/da850.dtsi
+index 12010002dbdb..a8500f062706 100644
+--- a/arch/arm/boot/dts/da850.dtsi
++++ b/arch/arm/boot/dts/da850.dtsi
+@@ -539,11 +539,7 @@
+ 			gpio-controller;
+ 			#gpio-cells = <2>;
+ 			reg = <0x226000 0x1000>;
+-			interrupts = <42 IRQ_TYPE_EDGE_BOTH
+-				43 IRQ_TYPE_EDGE_BOTH 44 IRQ_TYPE_EDGE_BOTH
+-				45 IRQ_TYPE_EDGE_BOTH 46 IRQ_TYPE_EDGE_BOTH
+-				47 IRQ_TYPE_EDGE_BOTH 48 IRQ_TYPE_EDGE_BOTH
+-				49 IRQ_TYPE_EDGE_BOTH 50 IRQ_TYPE_EDGE_BOTH>;
++			interrupts = <42 43 44 45 46 47 48 49 50>;
+ 			ti,ngpio = <144>;
+ 			ti,davinci-gpio-unbanked = <0>;
+ 			status = "disabled";
+diff --git a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+index 911f7f0e3cea..e000e27f595b 100644
+--- a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+@@ -672,7 +672,7 @@
+ 			dsa,member = <0 0>;
+ 			eeprom-length = <512>;
+ 			interrupt-parent = <&gpio6>;
+-			interrupts = <3 IRQ_TYPE_EDGE_FALLING>;
++			interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
+ 			interrupt-controller;
+ 			#interrupt-cells = <2>;
+ 
+diff --git a/arch/arm/boot/dts/omap4-droid4-xt894.dts b/arch/arm/boot/dts/omap4-droid4-xt894.dts
+index bdf73cbcec3a..e7c3c563ff8f 100644
+--- a/arch/arm/boot/dts/omap4-droid4-xt894.dts
++++ b/arch/arm/boot/dts/omap4-droid4-xt894.dts
+@@ -159,13 +159,7 @@
+ 
+ 		dais = <&mcbsp2_port>, <&mcbsp3_port>;
+ 	};
+-};
+-
+-&dss {
+-	status = "okay";
+-};
+ 
+-&gpio6 {
+ 	pwm8: dmtimer-pwm-8 {
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&vibrator_direction_pin>;
+@@ -192,7 +186,10 @@
+ 		pwm-names = "enable", "direction";
+ 		direction-duty-cycle-ns = <10000000>;
+ 	};
++};
+ 
++&dss {
++	status = "okay";
+ };
+ 
+ &dsi1 {
+diff --git a/arch/arm/configs/imx_v4_v5_defconfig b/arch/arm/configs/imx_v4_v5_defconfig
+index 054591dc9a00..4cd2f4a2bff4 100644
+--- a/arch/arm/configs/imx_v4_v5_defconfig
++++ b/arch/arm/configs/imx_v4_v5_defconfig
+@@ -141,9 +141,11 @@ CONFIG_USB_STORAGE=y
+ CONFIG_USB_CHIPIDEA=y
+ CONFIG_USB_CHIPIDEA_UDC=y
+ CONFIG_USB_CHIPIDEA_HOST=y
++CONFIG_USB_CHIPIDEA_ULPI=y
+ CONFIG_NOP_USB_XCEIV=y
+ CONFIG_USB_GADGET=y
+ CONFIG_USB_ETH=m
++CONFIG_USB_ULPI_BUS=y
+ CONFIG_MMC=y
+ CONFIG_MMC_SDHCI=y
+ CONFIG_MMC_SDHCI_PLTFM=y
+diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig
+index 3a308437b088..19c924de353b 100644
+--- a/arch/arm/configs/imx_v6_v7_defconfig
++++ b/arch/arm/configs/imx_v6_v7_defconfig
+@@ -294,6 +294,7 @@ CONFIG_USB_STORAGE=y
+ CONFIG_USB_CHIPIDEA=y
+ CONFIG_USB_CHIPIDEA_UDC=y
+ CONFIG_USB_CHIPIDEA_HOST=y
++CONFIG_USB_CHIPIDEA_ULPI=y
+ CONFIG_USB_SERIAL=m
+ CONFIG_USB_SERIAL_GENERIC=y
+ CONFIG_USB_SERIAL_FTDI_SIO=m
+@@ -330,6 +331,7 @@ CONFIG_USB_GADGETFS=m
+ CONFIG_USB_FUNCTIONFS=m
+ CONFIG_USB_MASS_STORAGE=m
+ CONFIG_USB_G_SERIAL=m
++CONFIG_USB_ULPI_BUS=y
+ CONFIG_MMC=y
+ CONFIG_MMC_SDHCI=y
+ CONFIG_MMC_SDHCI_PLTFM=y
+diff --git a/arch/arm/crypto/speck-neon-core.S b/arch/arm/crypto/speck-neon-core.S
+index 3c1e203e53b9..57caa742016e 100644
+--- a/arch/arm/crypto/speck-neon-core.S
++++ b/arch/arm/crypto/speck-neon-core.S
+@@ -272,9 +272,11 @@
+ 	 * Allocate stack space to store 128 bytes worth of tweaks.  For
+ 	 * performance, this space is aligned to a 16-byte boundary so that we
+ 	 * can use the load/store instructions that declare 16-byte alignment.
++	 * For Thumb2 compatibility, don't do the 'bic' directly on 'sp'.
+ 	 */
+-	sub		sp, #128
+-	bic		sp, #0xf
++	sub		r12, sp, #128
++	bic		r12, #0xf
++	mov		sp, r12
+ 
+ .if \n == 64
+ 	// Load first tweak
+diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c
+index 158ed9a1483f..826bd634d098 100644
+--- a/arch/arm/mach-davinci/board-da850-evm.c
++++ b/arch/arm/mach-davinci/board-da850-evm.c
+@@ -773,7 +773,7 @@ static struct gpiod_lookup_table mmc_gpios_table = {
+ 		GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_CD_PIN, "cd",
+ 			    GPIO_ACTIVE_LOW),
+ 		GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_WP_PIN, "wp",
+-			    GPIO_ACTIVE_LOW),
++			    GPIO_ACTIVE_HIGH),
+ 	},
+ };
+ 
+diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c
+index 69df3620eca5..1c73694c871a 100644
+--- a/arch/arm/mach-omap2/omap-smp.c
++++ b/arch/arm/mach-omap2/omap-smp.c
+@@ -109,6 +109,45 @@ void omap5_erratum_workaround_801819(void)
+ static inline void omap5_erratum_workaround_801819(void) { }
+ #endif
+ 
++#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
++/*
++ * Configure ACR and enable ACTLR[0] (Enable invalidates of BTB with
++ * ICIALLU) to activate the workaround for secondary Core.
++ * NOTE: it is assumed that the primary core's configuration is done
++ * by the boot loader (kernel will detect a misconfiguration and complain
++ * if this is not done).
++ *
++ * In General Purpose(GP) devices, ACR bit settings can only be done
++ * by ROM code in "secure world" using the smc call and there is no
++ * option to update the "firmware" on such devices. This also works for
++ * High security(HS) devices, as a backup option in case the
++ * "update" is not done in the "security firmware".
++ */
++static void omap5_secondary_harden_predictor(void)
++{
++	u32 acr, acr_mask;
++
++	asm volatile ("mrc p15, 0, %0, c1, c0, 1" : "=r" (acr));
++
++	/*
++	 * ACTLR[0] (Enable invalidates of BTB with ICIALLU)
++	 */
++	acr_mask = BIT(0);
++
++	/* Do we already have it done.. if yes, skip expensive smc */
++	if ((acr & acr_mask) == acr_mask)
++		return;
++
++	acr |= acr_mask;
++	omap_smc1(OMAP5_DRA7_MON_SET_ACR_INDEX, acr);
++
++	pr_debug("%s: ARM ACR setup for CVE_2017_5715 applied on CPU%d\n",
++		 __func__, smp_processor_id());
++}
++#else
++static inline void omap5_secondary_harden_predictor(void) { }
++#endif
++
+ static void omap4_secondary_init(unsigned int cpu)
+ {
+ 	/*
+@@ -131,6 +170,8 @@ static void omap4_secondary_init(unsigned int cpu)
+ 		set_cntfreq();
+ 		/* Configure ACR to disable streaming WA for 801819 */
+ 		omap5_erratum_workaround_801819();
++		/* Enable ACR to allow for ICUALLU workaround */
++		omap5_secondary_harden_predictor();
+ 	}
+ 
+ 	/*
+diff --git a/arch/arm/mach-pxa/irq.c b/arch/arm/mach-pxa/irq.c
+index 9c10248fadcc..4e8c2116808e 100644
+--- a/arch/arm/mach-pxa/irq.c
++++ b/arch/arm/mach-pxa/irq.c
+@@ -185,7 +185,7 @@ static int pxa_irq_suspend(void)
+ {
+ 	int i;
+ 
+-	for (i = 0; i < pxa_internal_irq_nr / 32; i++) {
++	for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) {
+ 		void __iomem *base = irq_base(i);
+ 
+ 		saved_icmr[i] = __raw_readl(base + ICMR);
+@@ -204,7 +204,7 @@ static void pxa_irq_resume(void)
+ {
+ 	int i;
+ 
+-	for (i = 0; i < pxa_internal_irq_nr / 32; i++) {
++	for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) {
+ 		void __iomem *base = irq_base(i);
+ 
+ 		__raw_writel(saved_icmr[i], base + ICMR);
+diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
+index c186474422f3..0cc8e04295a4 100644
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -736,20 +736,29 @@ static int __mark_rodata_ro(void *unused)
+ 	return 0;
+ }
+ 
++static int kernel_set_to_readonly __read_mostly;
++
+ void mark_rodata_ro(void)
+ {
++	kernel_set_to_readonly = 1;
+ 	stop_machine(__mark_rodata_ro, NULL, NULL);
+ 	debug_checkwx();
+ }
+ 
+ void set_kernel_text_rw(void)
+ {
++	if (!kernel_set_to_readonly)
++		return;
++
+ 	set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), false,
+ 				current->active_mm);
+ }
+ 
+ void set_kernel_text_ro(void)
+ {
++	if (!kernel_set_to_readonly)
++		return;
++
+ 	set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), true,
+ 				current->active_mm);
+ }
+diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts b/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts
+index 57eedced5a51..f7300cb6970f 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts
+@@ -19,9 +19,22 @@
+ 
+ &ethmac {
+ 	status = "okay";
+-	phy-mode = "rgmii";
+ 	pinctrl-0 = <&eth_rgmii_y_pins>;
+ 	pinctrl-names = "default";
++	phy-handle = <&eth_phy0>;
++	phy-mode = "rgmii";
++
++	mdio {
++		compatible = "snps,dwmac-mdio";
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		eth_phy0: ethernet-phy@0 {
++			/* Realtek RTL8211F (0x001cc916) */
++			reg = <0>;
++			eee-broken-1000t;
++		};
++	};
+ };
+ 
+ &uart_A {
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi
+index eb327664a4d8..6aaafff674f9 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi
+@@ -6,7 +6,7 @@
+ 
+ &apb {
+ 	mali: gpu@c0000 {
+-		compatible = "amlogic,meson-gxbb-mali", "arm,mali-450";
++		compatible = "amlogic,meson-gxl-mali", "arm,mali-450";
+ 		reg = <0x0 0xc0000 0x0 0x40000>;
+ 		interrupts = <GIC_SPI 160 IRQ_TYPE_LEVEL_HIGH>,
+ 			     <GIC_SPI 161 IRQ_TYPE_LEVEL_HIGH>,
+diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+index 4a2a6af8e752..4057197048dc 100644
+--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+@@ -118,7 +118,7 @@
+ 
+ 		#interrupt-cells = <1>;
+ 		interrupt-map-mask = <0 0 0 0>;
+-		interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 281 IRQ_TYPE_NONE>;
++		interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 281 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 		linux,pci-domain = <0>;
+ 
+@@ -149,7 +149,7 @@
+ 
+ 		#interrupt-cells = <1>;
+ 		interrupt-map-mask = <0 0 0 0>;
+-		interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 305 IRQ_TYPE_NONE>;
++		interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 305 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 		linux,pci-domain = <4>;
+ 
+@@ -566,7 +566,7 @@
+ 			reg = <0x66080000 0x100>;
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			interrupts = <GIC_SPI 394 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 394 IRQ_TYPE_LEVEL_HIGH>;
+ 			clock-frequency = <100000>;
+ 			status = "disabled";
+ 		};
+@@ -594,7 +594,7 @@
+ 			reg = <0x660b0000 0x100>;
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			interrupts = <GIC_SPI 395 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 395 IRQ_TYPE_LEVEL_HIGH>;
+ 			clock-frequency = <100000>;
+ 			status = "disabled";
+ 		};
+diff --git a/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts b/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts
+index eb6f08cdbd79..77efa28c4dd5 100644
+--- a/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts
++++ b/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts
+@@ -43,6 +43,10 @@
+ 	enet-phy-lane-swap;
+ };
+ 
++&sdio0 {
++	mmc-ddr-1_8v;
++};
++
+ &uart2 {
+ 	status = "okay";
+ };
+diff --git a/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts b/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts
+index 5084b037320f..55ba495ef56e 100644
+--- a/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts
++++ b/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts
+@@ -42,3 +42,7 @@
+ &gphy0 {
+ 	enet-phy-lane-swap;
+ };
++
++&sdio0 {
++	mmc-ddr-1_8v;
++};
+diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
+index 99aaff0b6d72..b203152ad67c 100644
+--- a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
+@@ -409,7 +409,7 @@
+ 			reg = <0x000b0000 0x100>;
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			interrupts = <GIC_SPI 177 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 177 IRQ_TYPE_LEVEL_HIGH>;
+ 			clock-frequency = <100000>;
+ 			status = "disabled";
+ 		};
+@@ -453,7 +453,7 @@
+ 			reg = <0x000e0000 0x100>;
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			interrupts = <GIC_SPI 178 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 178 IRQ_TYPE_LEVEL_HIGH>;
+ 			clock-frequency = <100000>;
+ 			status = "disabled";
+ 		};
+diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+index 66b318e1de80..aef814b2dc9e 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -1191,14 +1191,14 @@
+ 
+ 				port@0 {
+ 					reg = <0>;
+-					etf_out: endpoint {
++					etf_in: endpoint {
+ 						slave-mode;
+ 						remote-endpoint = <&funnel0_out>;
+ 					};
+ 				};
+ 				port@1 {
+ 					reg = <0>;
+-					etf_in: endpoint {
++					etf_out: endpoint {
+ 						remote-endpoint = <&replicator_in>;
+ 					};
+ 				};
+diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts b/arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts
+index 9b4dc41703e3..ae3b5adf32df 100644
+--- a/arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts
++++ b/arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts
+@@ -54,7 +54,7 @@
+ 	sound {
+ 		compatible = "audio-graph-card";
+ 		label = "UniPhier LD11";
+-		widgets = "Headphone", "Headphone Jack";
++		widgets = "Headphone", "Headphones";
+ 		dais = <&i2s_port2
+ 			&i2s_port3
+ 			&i2s_port4
+diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts b/arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts
+index fe6608ea3277..7919233c9ce2 100644
+--- a/arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts
++++ b/arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts
+@@ -54,7 +54,7 @@
+ 	sound {
+ 		compatible = "audio-graph-card";
+ 		label = "UniPhier LD20";
+-		widgets = "Headphone", "Headphone Jack";
++		widgets = "Headphone", "Headphones";
+ 		dais = <&i2s_port2
+ 			&i2s_port3
+ 			&i2s_port4
+diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
+index a91933b1e2e6..4b650ec1d7dd 100644
+--- a/arch/arm64/include/asm/alternative.h
++++ b/arch/arm64/include/asm/alternative.h
+@@ -28,7 +28,12 @@ typedef void (*alternative_cb_t)(struct alt_instr *alt,
+ 				 __le32 *origptr, __le32 *updptr, int nr_inst);
+ 
+ void __init apply_alternatives_all(void);
+-void apply_alternatives(void *start, size_t length);
++
++#ifdef CONFIG_MODULES
++void apply_alternatives_module(void *start, size_t length);
++#else
++static inline void apply_alternatives_module(void *start, size_t length) { }
++#endif
+ 
+ #define ALTINSTR_ENTRY(feature,cb)					      \
+ 	" .word 661b - .\n"				/* label           */ \
+diff --git a/arch/arm64/kernel/alternative.c b/arch/arm64/kernel/alternative.c
+index 5c4bce4ac381..36fb069fd049 100644
+--- a/arch/arm64/kernel/alternative.c
++++ b/arch/arm64/kernel/alternative.c
+@@ -122,7 +122,30 @@ static void patch_alternative(struct alt_instr *alt,
+ 	}
+ }
+ 
+-static void __apply_alternatives(void *alt_region, bool use_linear_alias)
++/*
++ * We provide our own, private D-cache cleaning function so that we don't
++ * accidentally call into the cache.S code, which is patched by us at
++ * runtime.
++ */
++static void clean_dcache_range_nopatch(u64 start, u64 end)
++{
++	u64 cur, d_size, ctr_el0;
++
++	ctr_el0 = read_sanitised_ftr_reg(SYS_CTR_EL0);
++	d_size = 4 << cpuid_feature_extract_unsigned_field(ctr_el0,
++							   CTR_DMINLINE_SHIFT);
++	cur = start & ~(d_size - 1);
++	do {
++		/*
++		 * We must clean+invalidate to the PoC in order to avoid
++		 * Cortex-A53 errata 826319, 827319, 824069 and 819472
++		 * (this corresponds to ARM64_WORKAROUND_CLEAN_CACHE)
++		 */
++		asm volatile("dc civac, %0" : : "r" (cur) : "memory");
++	} while (cur += d_size, cur < end);
++}
++
++static void __apply_alternatives(void *alt_region, bool is_module)
+ {
+ 	struct alt_instr *alt;
+ 	struct alt_region *region = alt_region;
+@@ -145,7 +168,7 @@ static void __apply_alternatives(void *alt_region, bool use_linear_alias)
+ 		pr_info_once("patching kernel code\n");
+ 
+ 		origptr = ALT_ORIG_PTR(alt);
+-		updptr = use_linear_alias ? lm_alias(origptr) : origptr;
++		updptr = is_module ? origptr : lm_alias(origptr);
+ 		nr_inst = alt->orig_len / AARCH64_INSN_SIZE;
+ 
+ 		if (alt->cpufeature < ARM64_CB_PATCH)
+@@ -155,8 +178,20 @@ static void __apply_alternatives(void *alt_region, bool use_linear_alias)
+ 
+ 		alt_cb(alt, origptr, updptr, nr_inst);
+ 
+-		flush_icache_range((uintptr_t)origptr,
+-				   (uintptr_t)(origptr + nr_inst));
++		if (!is_module) {
++			clean_dcache_range_nopatch((u64)origptr,
++						   (u64)(origptr + nr_inst));
++		}
++	}
++
++	/*
++	 * The core module code takes care of cache maintenance in
++	 * flush_module_icache().
++	 */
++	if (!is_module) {
++		dsb(ish);
++		__flush_icache_all();
++		isb();
+ 	}
+ }
+ 
+@@ -178,7 +213,7 @@ static int __apply_alternatives_multi_stop(void *unused)
+ 		isb();
+ 	} else {
+ 		BUG_ON(alternatives_applied);
+-		__apply_alternatives(&region, true);
++		__apply_alternatives(&region, false);
+ 		/* Barriers provided by the cache flushing */
+ 		WRITE_ONCE(alternatives_applied, 1);
+ 	}
+@@ -192,12 +227,14 @@ void __init apply_alternatives_all(void)
+ 	stop_machine(__apply_alternatives_multi_stop, NULL, cpu_online_mask);
+ }
+ 
+-void apply_alternatives(void *start, size_t length)
++#ifdef CONFIG_MODULES
++void apply_alternatives_module(void *start, size_t length)
+ {
+ 	struct alt_region region = {
+ 		.begin	= start,
+ 		.end	= start + length,
+ 	};
+ 
+-	__apply_alternatives(&region, false);
++	__apply_alternatives(&region, true);
+ }
++#endif
+diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c
+index 155fd91e78f4..f0f27aeefb73 100644
+--- a/arch/arm64/kernel/module.c
++++ b/arch/arm64/kernel/module.c
+@@ -448,9 +448,8 @@ int module_finalize(const Elf_Ehdr *hdr,
+ 	const char *secstrs = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
+ 
+ 	for (s = sechdrs, se = sechdrs + hdr->e_shnum; s < se; s++) {
+-		if (strcmp(".altinstructions", secstrs + s->sh_name) == 0) {
+-			apply_alternatives((void *)s->sh_addr, s->sh_size);
+-		}
++		if (strcmp(".altinstructions", secstrs + s->sh_name) == 0)
++			apply_alternatives_module((void *)s->sh_addr, s->sh_size);
+ #ifdef CONFIG_ARM64_MODULE_PLTS
+ 		if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE) &&
+ 		    !strcmp(".text.ftrace_trampoline", secstrs + s->sh_name))
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index f3e2e3aec0b0..2faa9863d2e5 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -179,7 +179,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+  * This is the secondary CPU boot entry.  We're using this CPUs
+  * idle thread stack, but a set of temporary page tables.
+  */
+-asmlinkage void secondary_start_kernel(void)
++asmlinkage notrace void secondary_start_kernel(void)
+ {
+ 	u64 mpidr = read_cpuid_mpidr() & MPIDR_HWID_BITMASK;
+ 	struct mm_struct *mm = &init_mm;
+diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
+index a96ec0181818..4ed7ffa26d27 100644
+--- a/arch/arm64/mm/dma-mapping.c
++++ b/arch/arm64/mm/dma-mapping.c
+@@ -588,13 +588,14 @@ static void *__iommu_alloc_attrs(struct device *dev, size_t size,
+ 						    size >> PAGE_SHIFT);
+ 			return NULL;
+ 		}
+-		if (!coherent)
+-			__dma_flush_area(page_to_virt(page), iosize);
+-
+ 		addr = dma_common_contiguous_remap(page, size, VM_USERMAP,
+ 						   prot,
+ 						   __builtin_return_address(0));
+-		if (!addr) {
++		if (addr) {
++			memset(addr, 0, size);
++			if (!coherent)
++				__dma_flush_area(page_to_virt(page), iosize);
++		} else {
+ 			iommu_dma_unmap_page(dev, *handle, iosize, 0, attrs);
+ 			dma_release_from_contiguous(dev, page,
+ 						    size >> PAGE_SHIFT);
+diff --git a/arch/ia64/kernel/perfmon.c b/arch/ia64/kernel/perfmon.c
+index 8fb280e33114..b483152875b5 100644
+--- a/arch/ia64/kernel/perfmon.c
++++ b/arch/ia64/kernel/perfmon.c
+@@ -2278,17 +2278,15 @@ pfm_smpl_buffer_alloc(struct task_struct *task, struct file *filp, pfm_context_t
+ 	DPRINT(("smpl_buf @%p\n", smpl_buf));
+ 
+ 	/* allocate vma */
+-	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++	vma = vm_area_alloc(mm);
+ 	if (!vma) {
+ 		DPRINT(("Cannot allocate vma\n"));
+ 		goto error_kmem;
+ 	}
+-	INIT_LIST_HEAD(&vma->anon_vma_chain);
+ 
+ 	/*
+ 	 * partially initialize the vma for the sampling buffer
+ 	 */
+-	vma->vm_mm	     = mm;
+ 	vma->vm_file	     = get_file(filp);
+ 	vma->vm_flags	     = VM_READ|VM_MAYREAD|VM_DONTEXPAND|VM_DONTDUMP;
+ 	vma->vm_page_prot    = PAGE_READONLY; /* XXX may need to change */
+@@ -2346,7 +2344,7 @@ pfm_smpl_buffer_alloc(struct task_struct *task, struct file *filp, pfm_context_t
+ 	return 0;
+ 
+ error:
+-	kmem_cache_free(vm_area_cachep, vma);
++	vm_area_free(vma);
+ error_kmem:
+ 	pfm_rvfree(smpl_buf, size);
+ 
+diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
+index 18278b448530..bdb14a369137 100644
+--- a/arch/ia64/mm/init.c
++++ b/arch/ia64/mm/init.c
+@@ -114,10 +114,8 @@ ia64_init_addr_space (void)
+ 	 * the problem.  When the process attempts to write to the register backing store
+ 	 * for the first time, it will get a SEGFAULT in this case.
+ 	 */
+-	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++	vma = vm_area_alloc(current->mm);
+ 	if (vma) {
+-		INIT_LIST_HEAD(&vma->anon_vma_chain);
+-		vma->vm_mm = current->mm;
+ 		vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
+ 		vma->vm_end = vma->vm_start + PAGE_SIZE;
+ 		vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
+@@ -125,7 +123,7 @@ ia64_init_addr_space (void)
+ 		down_write(&current->mm->mmap_sem);
+ 		if (insert_vm_struct(current->mm, vma)) {
+ 			up_write(&current->mm->mmap_sem);
+-			kmem_cache_free(vm_area_cachep, vma);
++			vm_area_free(vma);
+ 			return;
+ 		}
+ 		up_write(&current->mm->mmap_sem);
+@@ -133,10 +131,8 @@ ia64_init_addr_space (void)
+ 
+ 	/* map NaT-page at address zero to speed up speculative dereferencing of NULL: */
+ 	if (!(current->personality & MMAP_PAGE_ZERO)) {
+-		vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++		vma = vm_area_alloc(current->mm);
+ 		if (vma) {
+-			INIT_LIST_HEAD(&vma->anon_vma_chain);
+-			vma->vm_mm = current->mm;
+ 			vma->vm_end = PAGE_SIZE;
+ 			vma->vm_page_prot = __pgprot(pgprot_val(PAGE_READONLY) | _PAGE_MA_NAT);
+ 			vma->vm_flags = VM_READ | VM_MAYREAD | VM_IO |
+@@ -144,7 +140,7 @@ ia64_init_addr_space (void)
+ 			down_write(&current->mm->mmap_sem);
+ 			if (insert_vm_struct(current->mm, vma)) {
+ 				up_write(&current->mm->mmap_sem);
+-				kmem_cache_free(vm_area_cachep, vma);
++				vm_area_free(vma);
+ 				return;
+ 			}
+ 			up_write(&current->mm->mmap_sem);
+diff --git a/arch/m68k/include/asm/mcf_pgalloc.h b/arch/m68k/include/asm/mcf_pgalloc.h
+index 8b707c249026..12fe700632f4 100644
+--- a/arch/m68k/include/asm/mcf_pgalloc.h
++++ b/arch/m68k/include/asm/mcf_pgalloc.h
+@@ -44,6 +44,7 @@ extern inline pmd_t *pmd_alloc_kernel(pgd_t *pgd, unsigned long address)
+ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t page,
+ 				  unsigned long address)
+ {
++	pgtable_page_dtor(page);
+ 	__free_page(page);
+ }
+ 
+@@ -74,8 +75,9 @@ static inline struct page *pte_alloc_one(struct mm_struct *mm,
+ 	return page;
+ }
+ 
+-extern inline void pte_free(struct mm_struct *mm, struct page *page)
++static inline void pte_free(struct mm_struct *mm, struct page *page)
+ {
++	pgtable_page_dtor(page);
+ 	__free_page(page);
+ }
+ 
+diff --git a/arch/nds32/kernel/setup.c b/arch/nds32/kernel/setup.c
+index 2f5b2ccebe47..63a1a5ef5219 100644
+--- a/arch/nds32/kernel/setup.c
++++ b/arch/nds32/kernel/setup.c
+@@ -278,7 +278,8 @@ static void __init setup_memory(void)
+ 
+ void __init setup_arch(char **cmdline_p)
+ {
+-	early_init_devtree( __dtb_start);
++	early_init_devtree(__atags_pointer ? \
++		phys_to_virt(__atags_pointer) : __dtb_start);
+ 
+ 	setup_cpuinfo();
+ 
+diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
+index 690d55272ba6..0c826ad6e994 100644
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -277,12 +277,6 @@ EXCEPTION_ENTRY(_data_page_fault_handler)
+ 	l.addi  r3,r1,0                    // pt_regs
+ 	/* r4 set be EXCEPTION_HANDLE */   // effective address of fault
+ 
+-	/*
+-	 * __PHX__: TODO
+-	 *
+-	 * all this can be written much simpler. look at
+-	 * DTLB miss handler in the CONFIG_GUARD_PROTECTED_CORE part
+-	 */
+ #ifdef CONFIG_OPENRISC_NO_SPR_SR_DSX
+ 	l.lwz   r6,PT_PC(r3)               // address of an offending insn
+ 	l.lwz   r6,0(r6)                   // instruction that caused pf
+@@ -314,7 +308,7 @@ EXCEPTION_ENTRY(_data_page_fault_handler)
+ 
+ #else
+ 
+-	l.lwz   r6,PT_SR(r3)               // SR
++	l.mfspr r6,r0,SPR_SR               // SR
+ 	l.andi  r6,r6,SPR_SR_DSX           // check for delay slot exception
+ 	l.sfne  r6,r0                      // exception happened in delay slot
+ 	l.bnf   7f
+diff --git a/arch/openrisc/kernel/head.S b/arch/openrisc/kernel/head.S
+index fb02b2a1d6f2..9fc6b60140f0 100644
+--- a/arch/openrisc/kernel/head.S
++++ b/arch/openrisc/kernel/head.S
+@@ -210,8 +210,7 @@
+  *	 r4  - EEAR     exception EA
+  *	 r10 - current	pointing to current_thread_info struct
+  *	 r12 - syscall  0, since we didn't come from syscall
+- *	 r13 - temp	it actually contains new SR, not needed anymore
+- *	 r31 - handler	address of the handler we'll jump to
++ *	 r30 - handler	address of the handler we'll jump to
+  *
+  *	 handler has to save remaining registers to the exception
+  *	 ksp frame *before* tainting them!
+@@ -244,6 +243,7 @@
+ 	/* r1 is KSP, r30 is __pa(KSP) */			;\
+ 	tophys  (r30,r1)					;\
+ 	l.sw    PT_GPR12(r30),r12				;\
++	/* r4 use for tmp before EA */				;\
+ 	l.mfspr r12,r0,SPR_EPCR_BASE				;\
+ 	l.sw    PT_PC(r30),r12					;\
+ 	l.mfspr r12,r0,SPR_ESR_BASE				;\
+@@ -263,7 +263,10 @@
+ 	/* r12 == 1 if we come from syscall */			;\
+ 	CLEAR_GPR(r12)						;\
+ 	/* ----- turn on MMU ----- */				;\
+-	l.ori	r30,r0,(EXCEPTION_SR)				;\
++	/* Carry DSX into exception SR */			;\
++	l.mfspr r30,r0,SPR_SR					;\
++	l.andi	r30,r30,SPR_SR_DSX				;\
++	l.ori	r30,r30,(EXCEPTION_SR)				;\
+ 	l.mtspr	r0,r30,SPR_ESR_BASE				;\
+ 	/* r30:	EA address of handler */			;\
+ 	LOAD_SYMBOL_2_GPR(r30,handler)				;\
+diff --git a/arch/openrisc/kernel/traps.c b/arch/openrisc/kernel/traps.c
+index 113c175fe469..f35b485555db 100644
+--- a/arch/openrisc/kernel/traps.c
++++ b/arch/openrisc/kernel/traps.c
+@@ -317,7 +317,7 @@ static inline int in_delay_slot(struct pt_regs *regs)
+ 		return 0;
+ 	}
+ #else
+-	return regs->sr & SPR_SR_DSX;
++	return mfspr(SPR_SR) & SPR_SR_DSX;
+ #endif
+ }
+ 
+diff --git a/arch/parisc/include/asm/spinlock.h b/arch/parisc/include/asm/spinlock.h
+index 6f84b6acc86e..8a63515f03bf 100644
+--- a/arch/parisc/include/asm/spinlock.h
++++ b/arch/parisc/include/asm/spinlock.h
+@@ -20,7 +20,6 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *x,
+ {
+ 	volatile unsigned int *a;
+ 
+-	mb();
+ 	a = __ldcw_align(x);
+ 	while (__ldcw(a) == 0)
+ 		while (*a == 0)
+@@ -30,17 +29,16 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *x,
+ 				local_irq_disable();
+ 			} else
+ 				cpu_relax();
+-	mb();
+ }
+ #define arch_spin_lock_flags arch_spin_lock_flags
+ 
+ static inline void arch_spin_unlock(arch_spinlock_t *x)
+ {
+ 	volatile unsigned int *a;
+-	mb();
++
+ 	a = __ldcw_align(x);
+-	*a = 1;
+ 	mb();
++	*a = 1;
+ }
+ 
+ static inline int arch_spin_trylock(arch_spinlock_t *x)
+@@ -48,10 +46,8 @@ static inline int arch_spin_trylock(arch_spinlock_t *x)
+ 	volatile unsigned int *a;
+ 	int ret;
+ 
+-	mb();
+ 	a = __ldcw_align(x);
+         ret = __ldcw(a) != 0;
+-	mb();
+ 
+ 	return ret;
+ }
+diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
+index 4886a6db42e9..5f7e57fcaeef 100644
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -629,12 +629,12 @@ cas_action:
+ 	stw	%r1, 4(%sr2,%r20)
+ #endif
+ 	/* The load and store could fail */
+-1:	ldw,ma	0(%r26), %r28
++1:	ldw	0(%r26), %r28
+ 	sub,<>	%r28, %r25, %r0
+-2:	stw,ma	%r24, 0(%r26)
++2:	stw	%r24, 0(%r26)
+ 	/* Free lock */
+ 	sync
+-	stw,ma	%r20, 0(%sr2,%r20)
++	stw	%r20, 0(%sr2,%r20)
+ #if ENABLE_LWS_DEBUG
+ 	/* Clear thread register indicator */
+ 	stw	%r0, 4(%sr2,%r20)
+@@ -798,30 +798,30 @@ cas2_action:
+ 	ldo	1(%r0),%r28
+ 
+ 	/* 8bit CAS */
+-13:	ldb,ma	0(%r26), %r29
++13:	ldb	0(%r26), %r29
+ 	sub,=	%r29, %r25, %r0
+ 	b,n	cas2_end
+-14:	stb,ma	%r24, 0(%r26)
++14:	stb	%r24, 0(%r26)
+ 	b	cas2_end
+ 	copy	%r0, %r28
+ 	nop
+ 	nop
+ 
+ 	/* 16bit CAS */
+-15:	ldh,ma	0(%r26), %r29
++15:	ldh	0(%r26), %r29
+ 	sub,=	%r29, %r25, %r0
+ 	b,n	cas2_end
+-16:	sth,ma	%r24, 0(%r26)
++16:	sth	%r24, 0(%r26)
+ 	b	cas2_end
+ 	copy	%r0, %r28
+ 	nop
+ 	nop
+ 
+ 	/* 32bit CAS */
+-17:	ldw,ma	0(%r26), %r29
++17:	ldw	0(%r26), %r29
+ 	sub,=	%r29, %r25, %r0
+ 	b,n	cas2_end
+-18:	stw,ma	%r24, 0(%r26)
++18:	stw	%r24, 0(%r26)
+ 	b	cas2_end
+ 	copy	%r0, %r28
+ 	nop
+@@ -829,10 +829,10 @@ cas2_action:
+ 
+ 	/* 64bit CAS */
+ #ifdef CONFIG_64BIT
+-19:	ldd,ma	0(%r26), %r29
++19:	ldd	0(%r26), %r29
+ 	sub,*=	%r29, %r25, %r0
+ 	b,n	cas2_end
+-20:	std,ma	%r24, 0(%r26)
++20:	std	%r24, 0(%r26)
+ 	copy	%r0, %r28
+ #else
+ 	/* Compare first word */
+@@ -851,7 +851,7 @@ cas2_action:
+ cas2_end:
+ 	/* Free lock */
+ 	sync
+-	stw,ma	%r20, 0(%sr2,%r20)
++	stw	%r20, 0(%sr2,%r20)
+ 	/* Enable interrupts */
+ 	ssm	PSW_SM_I, %r0
+ 	/* Return to userspace, set no error */
+diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
+index 9ca7148b5881..6d6cf14009cf 100644
+--- a/arch/powerpc/kernel/smp.c
++++ b/arch/powerpc/kernel/smp.c
+@@ -579,9 +579,6 @@ static void nmi_stop_this_cpu(struct pt_regs *regs)
+ 	nmi_ipi_busy_count--;
+ 	nmi_ipi_unlock();
+ 
+-	/* Remove this CPU */
+-	set_cpu_online(smp_processor_id(), false);
+-
+ 	spin_begin();
+ 	while (1)
+ 		spin_cpu_relax();
+@@ -596,9 +593,6 @@ void smp_send_stop(void)
+ 
+ static void stop_this_cpu(void *dummy)
+ {
+-	/* Remove this CPU */
+-	set_cpu_online(smp_processor_id(), false);
+-
+ 	hard_irq_disable();
+ 	spin_begin();
+ 	while (1)
+diff --git a/arch/riscv/kernel/irq.c b/arch/riscv/kernel/irq.c
+index b74cbfbce2d0..7bcdaed15703 100644
+--- a/arch/riscv/kernel/irq.c
++++ b/arch/riscv/kernel/irq.c
+@@ -16,10 +16,6 @@
+ #include <linux/irqchip.h>
+ #include <linux/irqdomain.h>
+ 
+-#ifdef CONFIG_RISCV_INTC
+-#include <linux/irqchip/irq-riscv-intc.h>
+-#endif
+-
+ void __init init_IRQ(void)
+ {
+ 	irqchip_init();
+diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
+index 5dddba301d0a..ac7600b8709a 100644
+--- a/arch/riscv/kernel/module.c
++++ b/arch/riscv/kernel/module.c
+@@ -252,14 +252,14 @@ static int apply_r_riscv_align_rela(struct module *me, u32 *location,
+ static int apply_r_riscv_add32_rela(struct module *me, u32 *location,
+ 				    Elf_Addr v)
+ {
+-	*(u32 *)location += (*(u32 *)v);
++	*(u32 *)location += (u32)v;
+ 	return 0;
+ }
+ 
+ static int apply_r_riscv_sub32_rela(struct module *me, u32 *location,
+ 				    Elf_Addr v)
+ {
+-	*(u32 *)location -= (*(u32 *)v);
++	*(u32 *)location -= (u32)v;
+ 	return 0;
+ }
+ 
+diff --git a/arch/riscv/kernel/ptrace.c b/arch/riscv/kernel/ptrace.c
+index ba3e80712797..9f82a7e34c64 100644
+--- a/arch/riscv/kernel/ptrace.c
++++ b/arch/riscv/kernel/ptrace.c
+@@ -50,7 +50,7 @@ static int riscv_gpr_set(struct task_struct *target,
+ 	struct pt_regs *regs;
+ 
+ 	regs = task_pt_regs(target);
+-	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &regs, 0, -1);
++	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, regs, 0, -1);
+ 	return ret;
+ }
+ 
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index dd2bcf0e7d00..7b08b0ffa2c7 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -1391,6 +1391,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
+ 		goto free_addrs;
+ 	}
+ 	if (bpf_jit_prog(&jit, fp)) {
++		bpf_jit_binary_free(header);
+ 		fp = orig_fp;
+ 		goto free_addrs;
+ 	}
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index d7a9dea8563d..377d50509653 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -980,6 +980,7 @@ static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves)
+ 
+ extern unsigned long arch_align_stack(unsigned long sp);
+ extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
++extern void free_kernel_image_pages(void *begin, void *end);
+ 
+ void default_idle(void);
+ #ifdef	CONFIG_XEN
+diff --git a/arch/x86/include/asm/set_memory.h b/arch/x86/include/asm/set_memory.h
+index bd090367236c..34cffcef7375 100644
+--- a/arch/x86/include/asm/set_memory.h
++++ b/arch/x86/include/asm/set_memory.h
+@@ -46,6 +46,7 @@ int set_memory_np(unsigned long addr, int numpages);
+ int set_memory_4k(unsigned long addr, int numpages);
+ int set_memory_encrypted(unsigned long addr, int numpages);
+ int set_memory_decrypted(unsigned long addr, int numpages);
++int set_memory_np_noalias(unsigned long addr, int numpages);
+ 
+ int set_memory_array_uc(unsigned long *addr, int addrinarray);
+ int set_memory_array_wc(unsigned long *addr, int addrinarray);
+diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
+index 1c2cfa0644aa..97ccf4c3b45b 100644
+--- a/arch/x86/kernel/cpu/microcode/intel.c
++++ b/arch/x86/kernel/cpu/microcode/intel.c
+@@ -190,8 +190,11 @@ static void save_microcode_patch(void *data, unsigned int size)
+ 			p = memdup_patch(data, size);
+ 			if (!p)
+ 				pr_err("Error allocating buffer %p\n", data);
+-			else
++			else {
+ 				list_replace(&iter->plist, &p->plist);
++				kfree(iter->data);
++				kfree(iter);
++			}
+ 		}
+ 	}
+ 
+diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
+index d79a18b4cf9d..4c53d12ca933 100644
+--- a/arch/x86/kernel/kvmclock.c
++++ b/arch/x86/kernel/kvmclock.c
+@@ -138,6 +138,7 @@ static unsigned long kvm_get_tsc_khz(void)
+ 	src = &hv_clock[cpu].pvti;
+ 	tsc_khz = pvclock_tsc_khz(src);
+ 	put_cpu();
++	setup_force_cpu_cap(X86_FEATURE_TSC_KNOWN_FREQ);
+ 	return tsc_khz;
+ }
+ 
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index f5d30c68fd09..f02ecaf97904 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -222,6 +222,11 @@ static void notrace start_secondary(void *unused)
+ #ifdef CONFIG_X86_32
+ 	/* switch away from the initial page table */
+ 	load_cr3(swapper_pg_dir);
++	/*
++	 * Initialize the CR4 shadow before doing anything that could
++	 * try to read it.
++	 */
++	cr4_init_shadow();
+ 	__flush_tlb_all();
+ #endif
+ 	load_current_idt();
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 12cad70acc3b..71dd00a140d2 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -11791,7 +11791,6 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, bool from_vmentry)
+ {
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 	struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+-	u32 msr_entry_idx;
+ 	u32 exit_qual;
+ 	int r;
+ 
+@@ -11813,10 +11812,10 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, bool from_vmentry)
+ 	nested_get_vmcs12_pages(vcpu, vmcs12);
+ 
+ 	r = EXIT_REASON_MSR_LOAD_FAIL;
+-	msr_entry_idx = nested_vmx_load_msr(vcpu,
+-					    vmcs12->vm_entry_msr_load_addr,
+-					    vmcs12->vm_entry_msr_load_count);
+-	if (msr_entry_idx)
++	exit_qual = nested_vmx_load_msr(vcpu,
++					vmcs12->vm_entry_msr_load_addr,
++					vmcs12->vm_entry_msr_load_count);
++	if (exit_qual)
+ 		goto fail;
+ 
+ 	/*
+diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
+index 83241eb71cd4..acfab322fbe0 100644
+--- a/arch/x86/mm/init.c
++++ b/arch/x86/mm/init.c
+@@ -775,13 +775,44 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
+ 	}
+ }
+ 
++/*
++ * begin/end can be in the direct map or the "high kernel mapping"
++ * used for the kernel image only.  free_init_pages() will do the
++ * right thing for either kind of address.
++ */
++void free_kernel_image_pages(void *begin, void *end)
++{
++	unsigned long begin_ul = (unsigned long)begin;
++	unsigned long end_ul = (unsigned long)end;
++	unsigned long len_pages = (end_ul - begin_ul) >> PAGE_SHIFT;
++
++
++	free_init_pages("unused kernel image", begin_ul, end_ul);
++
++	/*
++	 * PTI maps some of the kernel into userspace.  For performance,
++	 * this includes some kernel areas that do not contain secrets.
++	 * Those areas might be adjacent to the parts of the kernel image
++	 * being freed, which may contain secrets.  Remove the "high kernel
++	 * image mapping" for these freed areas, ensuring they are not even
++	 * potentially vulnerable to Meltdown regardless of the specific
++	 * optimizations PTI is currently using.
++	 *
++	 * The "noalias" prevents unmapping the direct map alias which is
++	 * needed to access the freed pages.
++	 *
++	 * This is only valid for 64bit kernels. 32bit has only one mapping
++	 * which can't be treated in this way for obvious reasons.
++	 */
++	if (IS_ENABLED(CONFIG_X86_64) && cpu_feature_enabled(X86_FEATURE_PTI))
++		set_memory_np_noalias(begin_ul, len_pages);
++}
++
+ void __ref free_initmem(void)
+ {
+ 	e820__reallocate_tables();
+ 
+-	free_init_pages("unused kernel",
+-			(unsigned long)(&__init_begin),
+-			(unsigned long)(&__init_end));
++	free_kernel_image_pages(&__init_begin, &__init_end);
+ }
+ 
+ #ifdef CONFIG_BLK_DEV_INITRD
+diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
+index 20d8bf5fbceb..3060e1dda2ad 100644
+--- a/arch/x86/mm/init_64.c
++++ b/arch/x86/mm/init_64.c
+@@ -1283,12 +1283,8 @@ void mark_rodata_ro(void)
+ 	set_memory_ro(start, (end-start) >> PAGE_SHIFT);
+ #endif
+ 
+-	free_init_pages("unused kernel",
+-			(unsigned long) __va(__pa_symbol(text_end)),
+-			(unsigned long) __va(__pa_symbol(rodata_start)));
+-	free_init_pages("unused kernel",
+-			(unsigned long) __va(__pa_symbol(rodata_end)),
+-			(unsigned long) __va(__pa_symbol(_sdata)));
++	free_kernel_image_pages((void *)text_end, (void *)rodata_start);
++	free_kernel_image_pages((void *)rodata_end, (void *)_sdata);
+ 
+ 	debug_checkwx();
+ 
+diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
+index 29505724202a..8d6c34fe49be 100644
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -53,6 +53,7 @@ static DEFINE_SPINLOCK(cpa_lock);
+ #define CPA_FLUSHTLB 1
+ #define CPA_ARRAY 2
+ #define CPA_PAGES_ARRAY 4
++#define CPA_NO_CHECK_ALIAS 8 /* Do not search for aliases */
+ 
+ #ifdef CONFIG_PROC_FS
+ static unsigned long direct_pages_count[PG_LEVEL_NUM];
+@@ -1486,6 +1487,9 @@ static int change_page_attr_set_clr(unsigned long *addr, int numpages,
+ 
+ 	/* No alias checking for _NX bit modifications */
+ 	checkalias = (pgprot_val(mask_set) | pgprot_val(mask_clr)) != _PAGE_NX;
++	/* Has caller explicitly disabled alias checking? */
++	if (in_flag & CPA_NO_CHECK_ALIAS)
++		checkalias = 0;
+ 
+ 	ret = __change_page_attr_set_clr(&cpa, checkalias);
+ 
+@@ -1772,6 +1776,15 @@ int set_memory_np(unsigned long addr, int numpages)
+ 	return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_PRESENT), 0);
+ }
+ 
++int set_memory_np_noalias(unsigned long addr, int numpages)
++{
++	int cpa_flags = CPA_NO_CHECK_ALIAS;
++
++	return change_page_attr_set_clr(&addr, numpages, __pgprot(0),
++					__pgprot(_PAGE_PRESENT), 0,
++					cpa_flags, NULL);
++}
++
+ int set_memory_4k(unsigned long addr, int numpages)
+ {
+ 	return change_page_attr_set_clr(&addr, numpages, __pgprot(0),
+diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
+index 3080e18cb859..62b5f3f21b4b 100644
+--- a/block/blk-mq-debugfs.c
++++ b/block/blk-mq-debugfs.c
+@@ -357,7 +357,7 @@ static const char *const blk_mq_rq_state_name_array[] = {
+ 
+ static const char *blk_mq_rq_state_name(enum mq_rq_state rq_state)
+ {
+-	if (WARN_ON_ONCE((unsigned int)rq_state >
++	if (WARN_ON_ONCE((unsigned int)rq_state >=
+ 			 ARRAY_SIZE(blk_mq_rq_state_name_array)))
+ 		return "(?)";
+ 	return blk_mq_rq_state_name_array[rq_state];
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 90ffd8151c57..ed9b11e6b997 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1174,6 +1174,9 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx **hctx,
+ 
+ #define BLK_MQ_RESOURCE_DELAY	3		/* ms units */
+ 
++/*
++ * Returns true if we did some work AND can potentially do more.
++ */
+ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
+ 			     bool got_budget)
+ {
+@@ -1304,8 +1307,17 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
+ 			blk_mq_run_hw_queue(hctx, true);
+ 		else if (needs_restart && (ret == BLK_STS_RESOURCE))
+ 			blk_mq_delay_run_hw_queue(hctx, BLK_MQ_RESOURCE_DELAY);
++
++		return false;
+ 	}
+ 
++	/*
++	 * If the host/device is unable to accept more work, inform the
++	 * caller of that.
++	 */
++	if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE)
++		return false;
++
+ 	return (queued + errors) != 0;
+ }
+ 
+diff --git a/block/sed-opal.c b/block/sed-opal.c
+index 945f4b8610e0..e0de4dd448b3 100644
+--- a/block/sed-opal.c
++++ b/block/sed-opal.c
+@@ -877,7 +877,7 @@ static size_t response_get_string(const struct parsed_resp *resp, int n,
+ 		return 0;
+ 	}
+ 
+-	if (n > resp->num) {
++	if (n >= resp->num) {
+ 		pr_debug("Response has %d tokens. Can't access %d\n",
+ 			 resp->num, n);
+ 		return 0;
+@@ -916,7 +916,7 @@ static u64 response_get_u64(const struct parsed_resp *resp, int n)
+ 		return 0;
+ 	}
+ 
+-	if (n > resp->num) {
++	if (n >= resp->num) {
+ 		pr_debug("Response has %d tokens. Can't access %d\n",
+ 			 resp->num, n);
+ 		return 0;
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 30a572956557..70a0f8b2f6c1 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -2031,6 +2031,17 @@ static inline void acpi_ec_query_exit(void)
+ 	}
+ }
+ 
++static const struct dmi_system_id acpi_ec_no_wakeup[] = {
++	{
++		.ident = "Thinkpad X1 Carbon 6th",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_FAMILY, "Thinkpad X1 Carbon 6th"),
++		},
++	},
++	{ },
++};
++
+ int __init acpi_ec_init(void)
+ {
+ 	int result;
+@@ -2041,6 +2052,15 @@ int __init acpi_ec_init(void)
+ 	if (result)
+ 		return result;
+ 
++	/*
++	 * Disable EC wakeup on following systems to prevent periodic
++	 * wakeup from EC GPE.
++	 */
++	if (dmi_check_system(acpi_ec_no_wakeup)) {
++		ec_no_wakeup = true;
++		pr_debug("Disabling EC wakeup on suspend-to-idle\n");
++	}
++
+ 	/* Drivers must be started after acpi_ec_query_init() */
+ 	dsdt_fail = acpi_bus_register_driver(&acpi_ec_driver);
+ 	/*
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 964106d173bd..3b1651426e12 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -408,6 +408,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+ 	const guid_t *guid;
+ 	int rc, i;
+ 
++	if (cmd_rc)
++		*cmd_rc = -EINVAL;
+ 	func = cmd;
+ 	if (cmd == ND_CMD_CALL) {
+ 		call_pkg = buf;
+@@ -518,6 +520,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+ 		 * If we return an error (like elsewhere) then caller wouldn't
+ 		 * be able to rely upon data returned to make calculation.
+ 		 */
++		if (cmd_rc)
++			*cmd_rc = 0;
+ 		return 0;
+ 	}
+ 
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index e5d90977caec..5e4befdd8562 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -35,6 +35,7 @@
+ #include <linux/kernel.h>
+ #include <linux/gfp.h>
+ #include <linux/module.h>
++#include <linux/nospec.h>
+ #include <linux/blkdev.h>
+ #include <linux/delay.h>
+ #include <linux/interrupt.h>
+@@ -1146,10 +1147,12 @@ static ssize_t ahci_led_store(struct ata_port *ap, const char *buf,
+ 
+ 	/* get the slot number from the message */
+ 	pmp = (state & EM_MSG_LED_PMP_SLOT) >> 8;
+-	if (pmp < EM_MAX_SLOTS)
++	if (pmp < EM_MAX_SLOTS) {
++		pmp = array_index_nospec(pmp, EM_MAX_SLOTS);
+ 		emp = &pp->em_priv[pmp];
+-	else
++	} else {
+ 		return -EINVAL;
++	}
+ 
+ 	/* mask off the activity bits if we are in sw_activity
+ 	 * mode, user should turn off sw_activity before setting
+diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
+index a500e738d929..f0ccb0a2b3bf 100644
+--- a/drivers/block/drbd/drbd_req.c
++++ b/drivers/block/drbd/drbd_req.c
+@@ -1244,8 +1244,8 @@ drbd_request_prepare(struct drbd_device *device, struct bio *bio, unsigned long
+ 	_drbd_start_io_acct(device, req);
+ 
+ 	/* process discards always from our submitter thread */
+-	if ((bio_op(bio) & REQ_OP_WRITE_ZEROES) ||
+-	    (bio_op(bio) & REQ_OP_DISCARD))
++	if (bio_op(bio) == REQ_OP_WRITE_ZEROES ||
++	    bio_op(bio) == REQ_OP_DISCARD)
+ 		goto queue_for_submitter_thread;
+ 
+ 	if (rw == WRITE && req->private_bio && req->i.size
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 64278f472efe..a1c0c1d1f264 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -76,6 +76,7 @@ struct link_dead_args {
+ #define NBD_HAS_CONFIG_REF		4
+ #define NBD_BOUND			5
+ #define NBD_DESTROY_ON_DISCONNECT	6
++#define NBD_DISCONNECT_ON_CLOSE 	7
+ 
+ struct nbd_config {
+ 	u32 flags;
+@@ -138,6 +139,7 @@ static void nbd_config_put(struct nbd_device *nbd);
+ static void nbd_connect_reply(struct genl_info *info, int index);
+ static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info);
+ static void nbd_dead_link_work(struct work_struct *work);
++static void nbd_disconnect_and_put(struct nbd_device *nbd);
+ 
+ static inline struct device *nbd_to_dev(struct nbd_device *nbd)
+ {
+@@ -1291,6 +1293,12 @@ out:
+ static void nbd_release(struct gendisk *disk, fmode_t mode)
+ {
+ 	struct nbd_device *nbd = disk->private_data;
++	struct block_device *bdev = bdget_disk(disk, 0);
++
++	if (test_bit(NBD_DISCONNECT_ON_CLOSE, &nbd->config->runtime_flags) &&
++			bdev->bd_openers == 0)
++		nbd_disconnect_and_put(nbd);
++
+ 	nbd_config_put(nbd);
+ 	nbd_put(nbd);
+ }
+@@ -1690,6 +1698,10 @@ again:
+ 				&config->runtime_flags);
+ 			put_dev = true;
+ 		}
++		if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) {
++			set_bit(NBD_DISCONNECT_ON_CLOSE,
++				&config->runtime_flags);
++		}
+ 	}
+ 
+ 	if (info->attrs[NBD_ATTR_SOCKETS]) {
+@@ -1734,6 +1746,16 @@ out:
+ 	return ret;
+ }
+ 
++static void nbd_disconnect_and_put(struct nbd_device *nbd)
++{
++	mutex_lock(&nbd->config_lock);
++	nbd_disconnect(nbd);
++	mutex_unlock(&nbd->config_lock);
++	if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
++			       &nbd->config->runtime_flags))
++		nbd_config_put(nbd);
++}
++
+ static int nbd_genl_disconnect(struct sk_buff *skb, struct genl_info *info)
+ {
+ 	struct nbd_device *nbd;
+@@ -1766,12 +1788,7 @@ static int nbd_genl_disconnect(struct sk_buff *skb, struct genl_info *info)
+ 		nbd_put(nbd);
+ 		return 0;
+ 	}
+-	mutex_lock(&nbd->config_lock);
+-	nbd_disconnect(nbd);
+-	mutex_unlock(&nbd->config_lock);
+-	if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
+-			       &nbd->config->runtime_flags))
+-		nbd_config_put(nbd);
++	nbd_disconnect_and_put(nbd);
+ 	nbd_config_put(nbd);
+ 	nbd_put(nbd);
+ 	return 0;
+@@ -1782,7 +1799,7 @@ static int nbd_genl_reconfigure(struct sk_buff *skb, struct genl_info *info)
+ 	struct nbd_device *nbd = NULL;
+ 	struct nbd_config *config;
+ 	int index;
+-	int ret = -EINVAL;
++	int ret = 0;
+ 	bool put_dev = false;
+ 
+ 	if (!netlink_capable(skb, CAP_SYS_ADMIN))
+@@ -1822,6 +1839,7 @@ static int nbd_genl_reconfigure(struct sk_buff *skb, struct genl_info *info)
+ 	    !nbd->task_recv) {
+ 		dev_err(nbd_to_dev(nbd),
+ 			"not configured, cannot reconfigure\n");
++		ret = -EINVAL;
+ 		goto out;
+ 	}
+ 
+@@ -1846,6 +1864,14 @@ static int nbd_genl_reconfigure(struct sk_buff *skb, struct genl_info *info)
+ 					       &config->runtime_flags))
+ 				refcount_inc(&nbd->refs);
+ 		}
++
++		if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) {
++			set_bit(NBD_DISCONNECT_ON_CLOSE,
++					&config->runtime_flags);
++		} else {
++			clear_bit(NBD_DISCONNECT_ON_CLOSE,
++					&config->runtime_flags);
++		}
+ 	}
+ 
+ 	if (info->attrs[NBD_ATTR_SOCKETS]) {
+diff --git a/drivers/char/ipmi/kcs_bmc.c b/drivers/char/ipmi/kcs_bmc.c
+index fbfc05e3f3d1..bb882ab161fe 100644
+--- a/drivers/char/ipmi/kcs_bmc.c
++++ b/drivers/char/ipmi/kcs_bmc.c
+@@ -210,34 +210,23 @@ static void kcs_bmc_handle_cmd(struct kcs_bmc *kcs_bmc)
+ int kcs_bmc_handle_event(struct kcs_bmc *kcs_bmc)
+ {
+ 	unsigned long flags;
+-	int ret = 0;
++	int ret = -ENODATA;
+ 	u8 status;
+ 
+ 	spin_lock_irqsave(&kcs_bmc->lock, flags);
+ 
+-	if (!kcs_bmc->running) {
+-		kcs_force_abort(kcs_bmc);
+-		ret = -ENODEV;
+-		goto out_unlock;
+-	}
+-
+-	status = read_status(kcs_bmc) & (KCS_STATUS_IBF | KCS_STATUS_CMD_DAT);
+-
+-	switch (status) {
+-	case KCS_STATUS_IBF | KCS_STATUS_CMD_DAT:
+-		kcs_bmc_handle_cmd(kcs_bmc);
+-		break;
+-
+-	case KCS_STATUS_IBF:
+-		kcs_bmc_handle_data(kcs_bmc);
+-		break;
++	status = read_status(kcs_bmc);
++	if (status & KCS_STATUS_IBF) {
++		if (!kcs_bmc->running)
++			kcs_force_abort(kcs_bmc);
++		else if (status & KCS_STATUS_CMD_DAT)
++			kcs_bmc_handle_cmd(kcs_bmc);
++		else
++			kcs_bmc_handle_data(kcs_bmc);
+ 
+-	default:
+-		ret = -ENODATA;
+-		break;
++		ret = 0;
+ 	}
+ 
+-out_unlock:
+ 	spin_unlock_irqrestore(&kcs_bmc->lock, flags);
+ 
+ 	return ret;
+diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile
+index de6d06ac790b..23a7fdcfc4e0 100644
+--- a/drivers/clk/Makefile
++++ b/drivers/clk/Makefile
+@@ -94,7 +94,7 @@ obj-$(CONFIG_ARCH_SPRD)			+= sprd/
+ obj-$(CONFIG_ARCH_STI)			+= st/
+ obj-$(CONFIG_ARCH_STRATIX10)		+= socfpga/
+ obj-$(CONFIG_ARCH_SUNXI)		+= sunxi/
+-obj-$(CONFIG_ARCH_SUNXI)		+= sunxi-ng/
++obj-$(CONFIG_SUNXI_CCU)			+= sunxi-ng/
+ obj-$(CONFIG_ARCH_TEGRA)		+= tegra/
+ obj-y					+= ti/
+ obj-$(CONFIG_CLK_UNIPHIER)		+= uniphier/
+diff --git a/drivers/clk/davinci/da8xx-cfgchip.c b/drivers/clk/davinci/da8xx-cfgchip.c
+index c971111d2601..20a120aa147e 100644
+--- a/drivers/clk/davinci/da8xx-cfgchip.c
++++ b/drivers/clk/davinci/da8xx-cfgchip.c
+@@ -672,7 +672,7 @@ static int of_da8xx_usb_phy_clk_init(struct device *dev, struct regmap *regmap)
+ 
+ 	usb1 = da8xx_cfgchip_register_usb1_clk48(dev, regmap);
+ 	if (IS_ERR(usb1)) {
+-		if (PTR_ERR(usb0) == -EPROBE_DEFER)
++		if (PTR_ERR(usb1) == -EPROBE_DEFER)
+ 			return -EPROBE_DEFER;
+ 
+ 		dev_warn(dev, "Failed to register usb1_clk48 (%ld)\n",
+diff --git a/drivers/clk/sunxi-ng/Makefile b/drivers/clk/sunxi-ng/Makefile
+index 128a40ee5c5e..9ac0fb948101 100644
+--- a/drivers/clk/sunxi-ng/Makefile
++++ b/drivers/clk/sunxi-ng/Makefile
+@@ -1,24 +1,24 @@
+ # SPDX-License-Identifier: GPL-2.0
+ # Common objects
+-lib-$(CONFIG_SUNXI_CCU)		+= ccu_common.o
+-lib-$(CONFIG_SUNXI_CCU)		+= ccu_mmc_timing.o
+-lib-$(CONFIG_SUNXI_CCU)		+= ccu_reset.o
++obj-y				+= ccu_common.o
++obj-y				+= ccu_mmc_timing.o
++obj-y				+= ccu_reset.o
+ 
+ # Base clock types
+-lib-$(CONFIG_SUNXI_CCU)		+= ccu_div.o
+-lib-$(CONFIG_SUNXI_CCU)		+= ccu_frac.o
+-lib-$(CONFIG_SUNXI_CCU)		+= ccu_gate.o
+-lib-$(CONFIG_SUNXI_CCU)		+= ccu_mux.o
+-lib-$(CONFIG_SUNXI_CCU)		+= ccu_mult.o
+-lib-$(CONFIG_SUNXI_CCU)		+= ccu_phase.o
+-lib-$(CONFIG_SUNXI_CCU)		+= ccu_sdm.o
++obj-y				+= ccu_div.o
++obj-y				+= ccu_frac.o
++obj-y				+= ccu_gate.o
++obj-y				+= ccu_mux.o
++obj-y				+= ccu_mult.o
++obj-y				+= ccu_phase.o
++obj-y				+= ccu_sdm.o
+ 
+ # Multi-factor clocks
+-lib-$(CONFIG_SUNXI_CCU)		+= ccu_nk.o
+-lib-$(CONFIG_SUNXI_CCU)		+= ccu_nkm.o
+-lib-$(CONFIG_SUNXI_CCU)		+= ccu_nkmp.o
+-lib-$(CONFIG_SUNXI_CCU)		+= ccu_nm.o
+-lib-$(CONFIG_SUNXI_CCU)		+= ccu_mp.o
++obj-y				+= ccu_nk.o
++obj-y				+= ccu_nkm.o
++obj-y				+= ccu_nkmp.o
++obj-y				+= ccu_nm.o
++obj-y				+= ccu_mp.o
+ 
+ # SoC support
+ obj-$(CONFIG_SUN50I_A64_CCU)	+= ccu-sun50i-a64.o
+@@ -37,12 +37,3 @@ obj-$(CONFIG_SUN8I_R40_CCU)	+= ccu-sun8i-r40.o
+ obj-$(CONFIG_SUN9I_A80_CCU)	+= ccu-sun9i-a80.o
+ obj-$(CONFIG_SUN9I_A80_CCU)	+= ccu-sun9i-a80-de.o
+ obj-$(CONFIG_SUN9I_A80_CCU)	+= ccu-sun9i-a80-usb.o
+-
+-# The lib-y file goals is supposed to work only in arch/*/lib or lib/. In our
+-# case, we want to use that goal, but even though lib.a will be properly
+-# generated, it will not be linked in, eventually resulting in a linker error
+-# for missing symbols.
+-#
+-# We can work around that by explicitly adding lib.a to the obj-y goal. This is
+-# an undocumented behaviour, but works well for now.
+-obj-$(CONFIG_SUNXI_CCU)		+= lib.a
+diff --git a/drivers/clocksource/timer-stm32.c b/drivers/clocksource/timer-stm32.c
+index e5cdc3af684c..2717f88c7904 100644
+--- a/drivers/clocksource/timer-stm32.c
++++ b/drivers/clocksource/timer-stm32.c
+@@ -304,8 +304,10 @@ static int __init stm32_timer_init(struct device_node *node)
+ 
+ 	to->private_data = kzalloc(sizeof(struct stm32_timer_private),
+ 				   GFP_KERNEL);
+-	if (!to->private_data)
++	if (!to->private_data) {
++		ret = -ENOMEM;
+ 		goto deinit;
++	}
+ 
+ 	rstc = of_reset_control_get(node, NULL);
+ 	if (!IS_ERR(rstc)) {
+diff --git a/drivers/dax/device.c b/drivers/dax/device.c
+index aff2c1594220..a26b7016367a 100644
+--- a/drivers/dax/device.c
++++ b/drivers/dax/device.c
+@@ -189,14 +189,16 @@ static int check_vma(struct dev_dax *dev_dax, struct vm_area_struct *vma,
+ 
+ 	/* prevent private mappings from being established */
+ 	if ((vma->vm_flags & VM_MAYSHARE) != VM_MAYSHARE) {
+-		dev_info(dev, "%s: %s: fail, attempted private mapping\n",
++		dev_info_ratelimited(dev,
++				"%s: %s: fail, attempted private mapping\n",
+ 				current->comm, func);
+ 		return -EINVAL;
+ 	}
+ 
+ 	mask = dax_region->align - 1;
+ 	if (vma->vm_start & mask || vma->vm_end & mask) {
+-		dev_info(dev, "%s: %s: fail, unaligned vma (%#lx - %#lx, %#lx)\n",
++		dev_info_ratelimited(dev,
++				"%s: %s: fail, unaligned vma (%#lx - %#lx, %#lx)\n",
+ 				current->comm, func, vma->vm_start, vma->vm_end,
+ 				mask);
+ 		return -EINVAL;
+@@ -204,13 +206,15 @@ static int check_vma(struct dev_dax *dev_dax, struct vm_area_struct *vma,
+ 
+ 	if ((dax_region->pfn_flags & (PFN_DEV|PFN_MAP)) == PFN_DEV
+ 			&& (vma->vm_flags & VM_DONTCOPY) == 0) {
+-		dev_info(dev, "%s: %s: fail, dax range requires MADV_DONTFORK\n",
++		dev_info_ratelimited(dev,
++				"%s: %s: fail, dax range requires MADV_DONTFORK\n",
+ 				current->comm, func);
+ 		return -EINVAL;
+ 	}
+ 
+ 	if (!vma_is_dax(vma)) {
+-		dev_info(dev, "%s: %s: fail, vma is not DAX capable\n",
++		dev_info_ratelimited(dev,
++				"%s: %s: fail, vma is not DAX capable\n",
+ 				current->comm, func);
+ 		return -EINVAL;
+ 	}
+diff --git a/drivers/dma/k3dma.c b/drivers/dma/k3dma.c
+index 26b67455208f..e27adc4ab59d 100644
+--- a/drivers/dma/k3dma.c
++++ b/drivers/dma/k3dma.c
+@@ -794,7 +794,7 @@ static struct dma_chan *k3_of_dma_simple_xlate(struct of_phandle_args *dma_spec,
+ 	struct k3_dma_dev *d = ofdma->of_dma_data;
+ 	unsigned int request = dma_spec->args[0];
+ 
+-	if (request > d->dma_requests)
++	if (request >= d->dma_requests)
+ 		return NULL;
+ 
+ 	return dma_get_slave_channel(&(d->chans[request].vc.chan));
+diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c
+index d21c19822feb..56399bd45179 100644
+--- a/drivers/dma/omap-dma.c
++++ b/drivers/dma/omap-dma.c
+@@ -1485,7 +1485,11 @@ static int omap_dma_probe(struct platform_device *pdev)
+ 	od->ddev.src_addr_widths = OMAP_DMA_BUSWIDTHS;
+ 	od->ddev.dst_addr_widths = OMAP_DMA_BUSWIDTHS;
+ 	od->ddev.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
+-	od->ddev.residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
++	if (__dma_omap15xx(od->plat->dma_attr))
++		od->ddev.residue_granularity =
++				DMA_RESIDUE_GRANULARITY_DESCRIPTOR;
++	else
++		od->ddev.residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
+ 	od->ddev.max_burst = SZ_16M - 1; /* CCEN: 24bit unsigned */
+ 	od->ddev.dev = &pdev->dev;
+ 	INIT_LIST_HEAD(&od->ddev.channels);
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index de1fd59fe136..96a8ab3cec27 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2924,7 +2924,7 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
+ 	pd->src_addr_widths = PL330_DMA_BUSWIDTHS;
+ 	pd->dst_addr_widths = PL330_DMA_BUSWIDTHS;
+ 	pd->directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
+-	pd->residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT;
++	pd->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
+ 	pd->max_burst = ((pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP) ?
+ 			 1 : PL330_MAX_BURST);
+ 
+diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
+index 3bb82e511eca..7d3edd713932 100644
+--- a/drivers/edac/edac_mc.c
++++ b/drivers/edac/edac_mc.c
+@@ -215,6 +215,7 @@ const char * const edac_mem_types[] = {
+ 	[MEM_LRDDR3]	= "Load-Reduced-DDR3-RAM",
+ 	[MEM_DDR4]	= "Unbuffered-DDR4",
+ 	[MEM_RDDR4]	= "Registered-DDR4",
++	[MEM_LRDDR4]	= "Load-Reduced-DDR4-RAM",
+ 	[MEM_NVDIMM]	= "Non-volatile-RAM",
+ };
+ EXPORT_SYMBOL_GPL(edac_mem_types);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+index 361975cf45a9..11e7eadf1166 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+@@ -31,7 +31,7 @@
+ #include <linux/power_supply.h>
+ #include <linux/hwmon.h>
+ #include <linux/hwmon-sysfs.h>
+-
++#include <linux/nospec.h>
+ 
+ static int amdgpu_debugfs_pm_init(struct amdgpu_device *adev);
+ 
+@@ -309,6 +309,7 @@ static ssize_t amdgpu_set_pp_force_state(struct device *dev,
+ 			count = -EINVAL;
+ 			goto fail;
+ 		}
++		idx = array_index_nospec(idx, ARRAY_SIZE(data.states));
+ 
+ 		amdgpu_dpm_get_pp_num_states(adev, &data);
+ 		state = data.states[idx];
+diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+index ac9617269a2f..085f0ba564df 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+@@ -899,7 +899,7 @@ static const struct amdgpu_ring_funcs vce_v3_0_ring_phys_funcs = {
+ 	.emit_frame_size =
+ 		4 + /* vce_v3_0_emit_pipeline_sync */
+ 		6, /* amdgpu_vce_ring_emit_fence x1 no user fence */
+-	.emit_ib_size = 5, /* vce_v3_0_ring_emit_ib */
++	.emit_ib_size = 4, /* amdgpu_vce_ring_emit_ib */
+ 	.emit_ib = amdgpu_vce_ring_emit_ib,
+ 	.emit_fence = amdgpu_vce_ring_emit_fence,
+ 	.test_ring = amdgpu_vce_ring_test_ring,
+@@ -923,7 +923,7 @@ static const struct amdgpu_ring_funcs vce_v3_0_ring_vm_funcs = {
+ 		6 + /* vce_v3_0_emit_vm_flush */
+ 		4 + /* vce_v3_0_emit_pipeline_sync */
+ 		6 + 6, /* amdgpu_vce_ring_emit_fence x2 vm fence */
+-	.emit_ib_size = 4, /* amdgpu_vce_ring_emit_ib */
++	.emit_ib_size = 5, /* vce_v3_0_ring_emit_ib */
+ 	.emit_ib = vce_v3_0_ring_emit_ib,
+ 	.emit_vm_flush = vce_v3_0_emit_vm_flush,
+ 	.emit_pipeline_sync = vce_v3_0_emit_pipeline_sync,
+diff --git a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
+index 3092f76bdb75..6531ee7f3af4 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
+@@ -678,9 +678,22 @@ bool dce100_validate_bandwidth(
+ 	struct dc  *dc,
+ 	struct dc_state *context)
+ {
+-	/* TODO implement when needed but for now hardcode max value*/
+-	context->bw.dce.dispclk_khz = 681000;
+-	context->bw.dce.yclk_khz = 250000 * MEMORY_TYPE_MULTIPLIER;
++	int i;
++	bool at_least_one_pipe = false;
++
++	for (i = 0; i < dc->res_pool->pipe_count; i++) {
++		if (context->res_ctx.pipe_ctx[i].stream)
++			at_least_one_pipe = true;
++	}
++
++	if (at_least_one_pipe) {
++		/* TODO implement when needed but for now hardcode max value*/
++		context->bw.dce.dispclk_khz = 681000;
++		context->bw.dce.yclk_khz = 250000 * MEMORY_TYPE_MULTIPLIER;
++	} else {
++		context->bw.dce.dispclk_khz = 0;
++		context->bw.dce.yclk_khz = 0;
++	}
+ 
+ 	return true;
+ }
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
+index 200de46bd06b..0d497d0f6056 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
+@@ -82,6 +82,7 @@ static void vega12_set_default_registry_data(struct pp_hwmgr *hwmgr)
+ 
+ 	data->registry_data.disallowed_features = 0x0;
+ 	data->registry_data.od_state_in_dc_support = 0;
++	data->registry_data.thermal_support = 1;
+ 	data->registry_data.skip_baco_hardware = 0;
+ 
+ 	data->registry_data.log_avfs_param = 0;
+diff --git a/drivers/gpu/drm/arm/malidp_drv.c b/drivers/gpu/drm/arm/malidp_drv.c
+index 8d20faa198cf..0a788d76ed5f 100644
+--- a/drivers/gpu/drm/arm/malidp_drv.c
++++ b/drivers/gpu/drm/arm/malidp_drv.c
+@@ -278,7 +278,6 @@ static int malidp_init(struct drm_device *drm)
+ 
+ static void malidp_fini(struct drm_device *drm)
+ {
+-	drm_atomic_helper_shutdown(drm);
+ 	drm_mode_config_cleanup(drm);
+ }
+ 
+@@ -646,6 +645,7 @@ vblank_fail:
+ 	malidp_de_irq_fini(drm);
+ 	drm->irq_enabled = false;
+ irq_init_fail:
++	drm_atomic_helper_shutdown(drm);
+ 	component_unbind_all(dev, drm);
+ bind_fail:
+ 	of_node_put(malidp->crtc.port);
+@@ -681,6 +681,7 @@ static void malidp_unbind(struct device *dev)
+ 	malidp_se_irq_fini(drm);
+ 	malidp_de_irq_fini(drm);
+ 	drm->irq_enabled = false;
++	drm_atomic_helper_shutdown(drm);
+ 	component_unbind_all(dev, drm);
+ 	of_node_put(malidp->crtc.port);
+ 	malidp->crtc.port = NULL;
+diff --git a/drivers/gpu/drm/arm/malidp_hw.c b/drivers/gpu/drm/arm/malidp_hw.c
+index d789b46dc817..069783e715f1 100644
+--- a/drivers/gpu/drm/arm/malidp_hw.c
++++ b/drivers/gpu/drm/arm/malidp_hw.c
+@@ -634,7 +634,8 @@ const struct malidp_hw malidp_device[MALIDP_MAX_DEVICES] = {
+ 				.vsync_irq = MALIDP500_DE_IRQ_VSYNC,
+ 			},
+ 			.se_irq_map = {
+-				.irq_mask = MALIDP500_SE_IRQ_CONF_MODE,
++				.irq_mask = MALIDP500_SE_IRQ_CONF_MODE |
++					    MALIDP500_SE_IRQ_GLOBAL,
+ 				.vsync_irq = 0,
+ 			},
+ 			.dc_irq_map = {
+diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
+index 7a44897c50fe..29409a65d864 100644
+--- a/drivers/gpu/drm/arm/malidp_planes.c
++++ b/drivers/gpu/drm/arm/malidp_planes.c
+@@ -23,6 +23,7 @@
+ 
+ /* Layer specific register offsets */
+ #define MALIDP_LAYER_FORMAT		0x000
++#define   LAYER_FORMAT_MASK		0x3f
+ #define MALIDP_LAYER_CONTROL		0x004
+ #define   LAYER_ENABLE			(1 << 0)
+ #define   LAYER_FLOWCFG_MASK		7
+@@ -235,8 +236,8 @@ static int malidp_de_plane_check(struct drm_plane *plane,
+ 	if (state->rotation & MALIDP_ROTATED_MASK) {
+ 		int val;
+ 
+-		val = mp->hwdev->hw->rotmem_required(mp->hwdev, state->crtc_h,
+-						     state->crtc_w,
++		val = mp->hwdev->hw->rotmem_required(mp->hwdev, state->crtc_w,
++						     state->crtc_h,
+ 						     fb->format->format);
+ 		if (val < 0)
+ 			return val;
+@@ -337,7 +338,9 @@ static void malidp_de_plane_update(struct drm_plane *plane,
+ 	dest_w = plane->state->crtc_w;
+ 	dest_h = plane->state->crtc_h;
+ 
+-	malidp_hw_write(mp->hwdev, ms->format, mp->layer->base);
++	val = malidp_hw_read(mp->hwdev, mp->layer->base);
++	val = (val & ~LAYER_FORMAT_MASK) | ms->format;
++	malidp_hw_write(mp->hwdev, val, mp->layer->base);
+ 
+ 	for (i = 0; i < ms->n_planes; i++) {
+ 		/* calculate the offset for the layer's plane registers */
+diff --git a/drivers/gpu/drm/armada/armada_crtc.c b/drivers/gpu/drm/armada/armada_crtc.c
+index 03eeee11dd5b..42a40daff132 100644
+--- a/drivers/gpu/drm/armada/armada_crtc.c
++++ b/drivers/gpu/drm/armada/armada_crtc.c
+@@ -519,8 +519,9 @@ static irqreturn_t armada_drm_irq(int irq, void *arg)
+ 	u32 v, stat = readl_relaxed(dcrtc->base + LCD_SPU_IRQ_ISR);
+ 
+ 	/*
+-	 * This is rediculous - rather than writing bits to clear, we
+-	 * have to set the actual status register value.  This is racy.
++	 * Reading the ISR appears to clear bits provided CLEAN_SPU_IRQ_ISR
++	 * is set.  Writing has some other effect to acknowledge the IRQ -
++	 * without this, we only get a single IRQ.
+ 	 */
+ 	writel_relaxed(0, dcrtc->base + LCD_SPU_IRQ_ISR);
+ 
+@@ -1116,16 +1117,22 @@ armada_drm_crtc_set_property(struct drm_crtc *crtc,
+ static int armada_drm_crtc_enable_vblank(struct drm_crtc *crtc)
+ {
+ 	struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc);
++	unsigned long flags;
+ 
++	spin_lock_irqsave(&dcrtc->irq_lock, flags);
+ 	armada_drm_crtc_enable_irq(dcrtc, VSYNC_IRQ_ENA);
++	spin_unlock_irqrestore(&dcrtc->irq_lock, flags);
+ 	return 0;
+ }
+ 
+ static void armada_drm_crtc_disable_vblank(struct drm_crtc *crtc)
+ {
+ 	struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc);
++	unsigned long flags;
+ 
++	spin_lock_irqsave(&dcrtc->irq_lock, flags);
+ 	armada_drm_crtc_disable_irq(dcrtc, VSYNC_IRQ_ENA);
++	spin_unlock_irqrestore(&dcrtc->irq_lock, flags);
+ }
+ 
+ static const struct drm_crtc_funcs armada_crtc_funcs = {
+@@ -1415,6 +1422,7 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev,
+ 		       CFG_PDWN64x66, dcrtc->base + LCD_SPU_SRAM_PARA1);
+ 	writel_relaxed(0x2032ff81, dcrtc->base + LCD_SPU_DMA_CTRL1);
+ 	writel_relaxed(dcrtc->irq_ena, dcrtc->base + LCD_SPU_IRQ_ENA);
++	readl_relaxed(dcrtc->base + LCD_SPU_IRQ_ISR);
+ 	writel_relaxed(0, dcrtc->base + LCD_SPU_IRQ_ISR);
+ 
+ 	ret = devm_request_irq(dev, irq, armada_drm_irq, 0, "armada_drm_crtc",
+diff --git a/drivers/gpu/drm/armada/armada_hw.h b/drivers/gpu/drm/armada/armada_hw.h
+index 27319a8335e2..345dc4d0851e 100644
+--- a/drivers/gpu/drm/armada/armada_hw.h
++++ b/drivers/gpu/drm/armada/armada_hw.h
+@@ -160,6 +160,7 @@ enum {
+ 	CFG_ALPHAM_GRA		= 0x1 << 16,
+ 	CFG_ALPHAM_CFG		= 0x2 << 16,
+ 	CFG_ALPHA_MASK		= 0xff << 8,
++#define CFG_ALPHA(x)		((x) << 8)
+ 	CFG_PIXCMD_MASK		= 0xff,
+ };
+ 
+diff --git a/drivers/gpu/drm/armada/armada_overlay.c b/drivers/gpu/drm/armada/armada_overlay.c
+index c391955009d6..afa7ded3ae31 100644
+--- a/drivers/gpu/drm/armada/armada_overlay.c
++++ b/drivers/gpu/drm/armada/armada_overlay.c
+@@ -28,6 +28,7 @@ struct armada_ovl_plane_properties {
+ 	uint16_t contrast;
+ 	uint16_t saturation;
+ 	uint32_t colorkey_mode;
++	uint32_t colorkey_enable;
+ };
+ 
+ struct armada_ovl_plane {
+@@ -54,11 +55,13 @@ armada_ovl_update_attr(struct armada_ovl_plane_properties *prop,
+ 	writel_relaxed(0x00002000, dcrtc->base + LCD_SPU_CBSH_HUE);
+ 
+ 	spin_lock_irq(&dcrtc->irq_lock);
+-	armada_updatel(prop->colorkey_mode | CFG_ALPHAM_GRA,
+-		     CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
+-		     dcrtc->base + LCD_SPU_DMA_CTRL1);
+-
+-	armada_updatel(ADV_GRACOLORKEY, 0, dcrtc->base + LCD_SPU_ADV_REG);
++	armada_updatel(prop->colorkey_mode,
++		       CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
++		       dcrtc->base + LCD_SPU_DMA_CTRL1);
++	if (dcrtc->variant->has_spu_adv_reg)
++		armada_updatel(prop->colorkey_enable,
++			       ADV_GRACOLORKEY | ADV_VIDCOLORKEY,
++			       dcrtc->base + LCD_SPU_ADV_REG);
+ 	spin_unlock_irq(&dcrtc->irq_lock);
+ }
+ 
+@@ -321,8 +324,17 @@ static int armada_ovl_plane_set_property(struct drm_plane *plane,
+ 		dplane->prop.colorkey_vb |= K2B(val);
+ 		update_attr = true;
+ 	} else if (property == priv->colorkey_mode_prop) {
+-		dplane->prop.colorkey_mode &= ~CFG_CKMODE_MASK;
+-		dplane->prop.colorkey_mode |= CFG_CKMODE(val);
++		if (val == CKMODE_DISABLE) {
++			dplane->prop.colorkey_mode =
++				CFG_CKMODE(CKMODE_DISABLE) |
++				CFG_ALPHAM_CFG | CFG_ALPHA(255);
++			dplane->prop.colorkey_enable = 0;
++		} else {
++			dplane->prop.colorkey_mode =
++				CFG_CKMODE(val) |
++				CFG_ALPHAM_GRA | CFG_ALPHA(0);
++			dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
++		}
+ 		update_attr = true;
+ 	} else if (property == priv->brightness_prop) {
+ 		dplane->prop.brightness = val - 256;
+@@ -453,7 +465,9 @@ int armada_overlay_plane_create(struct drm_device *dev, unsigned long crtcs)
+ 	dplane->prop.colorkey_yr = 0xfefefe00;
+ 	dplane->prop.colorkey_ug = 0x01010100;
+ 	dplane->prop.colorkey_vb = 0x01010100;
+-	dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB);
++	dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB) |
++				     CFG_ALPHAM_GRA | CFG_ALPHA(0);
++	dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
+ 	dplane->prop.brightness = 0;
+ 	dplane->prop.contrast = 0x4000;
+ 	dplane->prop.saturation = 0x4000;
+diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c
+index 7ab36042a822..f1b33fc79fbb 100644
+--- a/drivers/gpu/drm/bridge/sil-sii8620.c
++++ b/drivers/gpu/drm/bridge/sil-sii8620.c
+@@ -36,8 +36,11 @@
+ 
+ #define SII8620_BURST_BUF_LEN 288
+ #define VAL_RX_HDMI_CTRL2_DEFVAL VAL_RX_HDMI_CTRL2_IDLE_CNT(3)
+-#define MHL1_MAX_LCLK 225000
+-#define MHL3_MAX_LCLK 600000
++
++#define MHL1_MAX_PCLK 75000
++#define MHL1_MAX_PCLK_PP_MODE 150000
++#define MHL3_MAX_PCLK 200000
++#define MHL3_MAX_PCLK_PP_MODE 300000
+ 
+ enum sii8620_mode {
+ 	CM_DISCONNECTED,
+@@ -807,6 +810,7 @@ static void sii8620_burst_rx_all(struct sii8620 *ctx)
+ static void sii8620_fetch_edid(struct sii8620 *ctx)
+ {
+ 	u8 lm_ddc, ddc_cmd, int3, cbus;
++	unsigned long timeout;
+ 	int fetched, i;
+ 	int edid_len = EDID_LENGTH;
+ 	u8 *edid;
+@@ -856,23 +860,31 @@ static void sii8620_fetch_edid(struct sii8620 *ctx)
+ 			REG_DDC_CMD, ddc_cmd | VAL_DDC_CMD_ENH_DDC_READ_NO_ACK
+ 		);
+ 
+-		do {
+-			int3 = sii8620_readb(ctx, REG_INTR3);
++		int3 = 0;
++		timeout = jiffies + msecs_to_jiffies(200);
++		for (;;) {
+ 			cbus = sii8620_readb(ctx, REG_CBUS_STATUS);
+-
+-			if (int3 & BIT_DDC_CMD_DONE)
+-				break;
+-
+-			if (!(cbus & BIT_CBUS_STATUS_CBUS_CONNECTED)) {
++			if (~cbus & BIT_CBUS_STATUS_CBUS_CONNECTED) {
++				kfree(edid);
++				edid = NULL;
++				goto end;
++			}
++			if (int3 & BIT_DDC_CMD_DONE) {
++				if (sii8620_readb(ctx, REG_DDC_DOUT_CNT)
++				    >= FETCH_SIZE)
++					break;
++			} else {
++				int3 = sii8620_readb(ctx, REG_INTR3);
++			}
++			if (time_is_before_jiffies(timeout)) {
++				ctx->error = -ETIMEDOUT;
++				dev_err(ctx->dev, "timeout during EDID read\n");
+ 				kfree(edid);
+ 				edid = NULL;
+ 				goto end;
+ 			}
+-		} while (1);
+-
+-		sii8620_readb(ctx, REG_DDC_STATUS);
+-		while (sii8620_readb(ctx, REG_DDC_DOUT_CNT) < FETCH_SIZE)
+ 			usleep_range(10, 20);
++		}
+ 
+ 		sii8620_read_buf(ctx, REG_DDC_DATA, edid + fetched, FETCH_SIZE);
+ 		if (fetched + FETCH_SIZE == EDID_LENGTH) {
+@@ -1055,23 +1067,23 @@ static void sii8620_set_format(struct sii8620 *ctx)
+ 				BIT_M3_P0CTRL_MHL3_P0_PIXEL_MODE_PACKED,
+ 				ctx->use_packed_pixel ? ~0 : 0);
+ 	} else {
+-		if (ctx->use_packed_pixel)
++		if (ctx->use_packed_pixel) {
+ 			sii8620_write_seq_static(ctx,
+ 				REG_VID_MODE, BIT_VID_MODE_M1080P,
+ 				REG_MHL_TOP_CTL, BIT_MHL_TOP_CTL_MHL_PP_SEL | 1,
+ 				REG_MHLTX_CTL6, 0x60
+ 			);
+-		else
++		} else {
+ 			sii8620_write_seq_static(ctx,
+ 				REG_VID_MODE, 0,
+ 				REG_MHL_TOP_CTL, 1,
+ 				REG_MHLTX_CTL6, 0xa0
+ 			);
++		}
+ 	}
+ 
+ 	if (ctx->use_packed_pixel)
+-		out_fmt = VAL_TPI_FORMAT(YCBCR422, FULL) |
+-			BIT_TPI_OUTPUT_CSCMODE709;
++		out_fmt = VAL_TPI_FORMAT(YCBCR422, FULL);
+ 	else
+ 		out_fmt = VAL_TPI_FORMAT(RGB, FULL);
+ 
+@@ -1216,7 +1228,7 @@ static void sii8620_start_video(struct sii8620 *ctx)
+ 		int clk = ctx->pixel_clock * (ctx->use_packed_pixel ? 2 : 3);
+ 		int i;
+ 
+-		for (i = 0; i < ARRAY_SIZE(clk_spec); ++i)
++		for (i = 0; i < ARRAY_SIZE(clk_spec) - 1; ++i)
+ 			if (clk < clk_spec[i].max_clk)
+ 				break;
+ 
+@@ -2268,17 +2280,43 @@ static void sii8620_detach(struct drm_bridge *bridge)
+ 	rc_unregister_device(ctx->rc_dev);
+ }
+ 
++static int sii8620_is_packing_required(struct sii8620 *ctx,
++				       const struct drm_display_mode *mode)
++{
++	int max_pclk, max_pclk_pp_mode;
++
++	if (sii8620_is_mhl3(ctx)) {
++		max_pclk = MHL3_MAX_PCLK;
++		max_pclk_pp_mode = MHL3_MAX_PCLK_PP_MODE;
++	} else {
++		max_pclk = MHL1_MAX_PCLK;
++		max_pclk_pp_mode = MHL1_MAX_PCLK_PP_MODE;
++	}
++
++	if (mode->clock < max_pclk)
++		return 0;
++	else if (mode->clock < max_pclk_pp_mode)
++		return 1;
++	else
++		return -1;
++}
++
+ static enum drm_mode_status sii8620_mode_valid(struct drm_bridge *bridge,
+ 					 const struct drm_display_mode *mode)
+ {
+ 	struct sii8620 *ctx = bridge_to_sii8620(bridge);
++	int pack_required = sii8620_is_packing_required(ctx, mode);
+ 	bool can_pack = ctx->devcap[MHL_DCAP_VID_LINK_MODE] &
+ 			MHL_DCAP_VID_LINK_PPIXEL;
+-	unsigned int max_pclk = sii8620_is_mhl3(ctx) ? MHL3_MAX_LCLK :
+-						       MHL1_MAX_LCLK;
+-	max_pclk /= can_pack ? 2 : 3;
+ 
+-	return (mode->clock > max_pclk) ? MODE_CLOCK_HIGH : MODE_OK;
++	switch (pack_required) {
++	case 0:
++		return MODE_OK;
++	case 1:
++		return (can_pack) ? MODE_OK : MODE_CLOCK_HIGH;
++	default:
++		return MODE_CLOCK_HIGH;
++	}
+ }
+ 
+ static bool sii8620_mode_fixup(struct drm_bridge *bridge,
+@@ -2286,43 +2324,16 @@ static bool sii8620_mode_fixup(struct drm_bridge *bridge,
+ 			       struct drm_display_mode *adjusted_mode)
+ {
+ 	struct sii8620 *ctx = bridge_to_sii8620(bridge);
+-	int max_lclk;
+-	bool ret = true;
+ 
+ 	mutex_lock(&ctx->lock);
+ 
+-	max_lclk = sii8620_is_mhl3(ctx) ? MHL3_MAX_LCLK : MHL1_MAX_LCLK;
+-	if (max_lclk > 3 * adjusted_mode->clock) {
+-		ctx->use_packed_pixel = 0;
+-		goto end;
+-	}
+-	if ((ctx->devcap[MHL_DCAP_VID_LINK_MODE] & MHL_DCAP_VID_LINK_PPIXEL) &&
+-	    max_lclk > 2 * adjusted_mode->clock) {
+-		ctx->use_packed_pixel = 1;
+-		goto end;
+-	}
+-	ret = false;
+-end:
+-	if (ret) {
+-		u8 vic = drm_match_cea_mode(adjusted_mode);
+-
+-		if (!vic) {
+-			union hdmi_infoframe frm;
+-			u8 mhl_vic[] = { 0, 95, 94, 93, 98 };
+-
+-			/* FIXME: We need the connector here */
+-			drm_hdmi_vendor_infoframe_from_display_mode(
+-				&frm.vendor.hdmi, NULL, adjusted_mode);
+-			vic = frm.vendor.hdmi.vic;
+-			if (vic >= ARRAY_SIZE(mhl_vic))
+-				vic = 0;
+-			vic = mhl_vic[vic];
+-		}
+-		ctx->video_code = vic;
+-		ctx->pixel_clock = adjusted_mode->clock;
+-	}
++	ctx->use_packed_pixel = sii8620_is_packing_required(ctx, adjusted_mode);
++	ctx->video_code = drm_match_cea_mode(adjusted_mode);
++	ctx->pixel_clock = adjusted_mode->clock;
++
+ 	mutex_unlock(&ctx->lock);
+-	return ret;
++
++	return true;
+ }
+ 
+ static const struct drm_bridge_funcs sii8620_bridge_funcs = {
+diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+index 1c330f2a7a5d..7acfd0ed79cb 100644
+--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
++++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+@@ -260,7 +260,7 @@ static void decon_win_set_pixfmt(struct decon_context *ctx, unsigned int win,
+ 	unsigned long val;
+ 
+ 	val = readl(ctx->addr + DECON_WINCONx(win));
+-	val &= ~WINCONx_BPPMODE_MASK;
++	val &= WINCONx_ENWIN_F;
+ 
+ 	switch (fb->format->format) {
+ 	case DRM_FORMAT_XRGB1555:
+@@ -351,8 +351,8 @@ static void decon_update_plane(struct exynos_drm_crtc *crtc,
+ 		writel(val, ctx->addr + DECON_VIDOSDxB(win));
+ 	}
+ 
+-	val = VIDOSD_Wx_ALPHA_R_F(0x0) | VIDOSD_Wx_ALPHA_G_F(0x0) |
+-		VIDOSD_Wx_ALPHA_B_F(0x0);
++	val = VIDOSD_Wx_ALPHA_R_F(0xff) | VIDOSD_Wx_ALPHA_G_F(0xff) |
++		VIDOSD_Wx_ALPHA_B_F(0xff);
+ 	writel(val, ctx->addr + DECON_VIDOSDxC(win));
+ 
+ 	val = VIDOSD_Wx_ALPHA_R_F(0x0) | VIDOSD_Wx_ALPHA_G_F(0x0) |
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+index 0506b2b17ac1..48f913d8208c 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+@@ -532,21 +532,25 @@ static int gsc_src_set_fmt(struct device *dev, u32 fmt)
+ 			GSC_IN_CHROMA_ORDER_CRCB);
+ 		break;
+ 	case DRM_FORMAT_NV21:
++		cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_2P);
++		break;
+ 	case DRM_FORMAT_NV61:
+-		cfg |= (GSC_IN_CHROMA_ORDER_CRCB |
+-			GSC_IN_YUV420_2P);
++		cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV422_2P);
+ 		break;
+ 	case DRM_FORMAT_YUV422:
+ 		cfg |= GSC_IN_YUV422_3P;
+ 		break;
+ 	case DRM_FORMAT_YUV420:
++		cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_3P);
++		break;
+ 	case DRM_FORMAT_YVU420:
+-		cfg |= GSC_IN_YUV420_3P;
++		cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_3P);
+ 		break;
+ 	case DRM_FORMAT_NV12:
++		cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_2P);
++		break;
+ 	case DRM_FORMAT_NV16:
+-		cfg |= (GSC_IN_CHROMA_ORDER_CBCR |
+-			GSC_IN_YUV420_2P);
++		cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV422_2P);
+ 		break;
+ 	default:
+ 		dev_err(ippdrv->dev, "invalid target yuv order 0x%x.\n", fmt);
+@@ -806,18 +810,25 @@ static int gsc_dst_set_fmt(struct device *dev, u32 fmt)
+ 			GSC_OUT_CHROMA_ORDER_CRCB);
+ 		break;
+ 	case DRM_FORMAT_NV21:
+-	case DRM_FORMAT_NV61:
+ 		cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_2P);
+ 		break;
++	case DRM_FORMAT_NV61:
++		cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV422_2P);
++		break;
+ 	case DRM_FORMAT_YUV422:
++		cfg |= GSC_OUT_YUV422_3P;
++		break;
+ 	case DRM_FORMAT_YUV420:
++		cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_3P);
++		break;
+ 	case DRM_FORMAT_YVU420:
+-		cfg |= GSC_OUT_YUV420_3P;
++		cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_3P);
+ 		break;
+ 	case DRM_FORMAT_NV12:
++		cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_2P);
++		break;
+ 	case DRM_FORMAT_NV16:
+-		cfg |= (GSC_OUT_CHROMA_ORDER_CBCR |
+-			GSC_OUT_YUV420_2P);
++		cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV422_2P);
+ 		break;
+ 	default:
+ 		dev_err(ippdrv->dev, "invalid target yuv order 0x%x.\n", fmt);
+diff --git a/drivers/gpu/drm/exynos/regs-gsc.h b/drivers/gpu/drm/exynos/regs-gsc.h
+index 4704a993cbb7..16b39734115c 100644
+--- a/drivers/gpu/drm/exynos/regs-gsc.h
++++ b/drivers/gpu/drm/exynos/regs-gsc.h
+@@ -138,6 +138,7 @@
+ #define GSC_OUT_YUV420_3P		(3 << 4)
+ #define GSC_OUT_YUV422_1P		(4 << 4)
+ #define GSC_OUT_YUV422_2P		(5 << 4)
++#define GSC_OUT_YUV422_3P		(6 << 4)
+ #define GSC_OUT_YUV444			(7 << 4)
+ #define GSC_OUT_TILE_TYPE_MASK		(1 << 2)
+ #define GSC_OUT_TILE_C_16x8		(0 << 2)
+diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
+index 1466d8769ec9..857a647fabf2 100644
+--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
++++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
+@@ -43,6 +43,8 @@
+ #include <linux/mdev.h>
+ #include <linux/debugfs.h>
+ 
++#include <linux/nospec.h>
++
+ #include "i915_drv.h"
+ #include "gvt.h"
+ 
+@@ -1064,7 +1066,8 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd,
+ 	} else if (cmd == VFIO_DEVICE_GET_REGION_INFO) {
+ 		struct vfio_region_info info;
+ 		struct vfio_info_cap caps = { .buf = NULL, .size = 0 };
+-		int i, ret;
++		unsigned int i;
++		int ret;
+ 		struct vfio_region_info_cap_sparse_mmap *sparse = NULL;
+ 		size_t size;
+ 		int nr_areas = 1;
+@@ -1149,6 +1152,10 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd,
+ 				if (info.index >= VFIO_PCI_NUM_REGIONS +
+ 						vgpu->vdev.num_regions)
+ 					return -EINVAL;
++				info.index =
++					array_index_nospec(info.index,
++							VFIO_PCI_NUM_REGIONS +
++							vgpu->vdev.num_regions);
+ 
+ 				i = info.index - VFIO_PCI_NUM_REGIONS;
+ 
+diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
+index 707e02c80f18..95dfd169ef57 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
+@@ -617,7 +617,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli,
+ 		struct nouveau_bo *nvbo;
+ 		uint32_t data;
+ 
+-		if (unlikely(r->bo_index > req->nr_buffers)) {
++		if (unlikely(r->bo_index >= req->nr_buffers)) {
+ 			NV_PRINTK(err, cli, "reloc bo index invalid\n");
+ 			ret = -EINVAL;
+ 			break;
+@@ -627,7 +627,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli,
+ 		if (b->presumed.valid)
+ 			continue;
+ 
+-		if (unlikely(r->reloc_bo_index > req->nr_buffers)) {
++		if (unlikely(r->reloc_bo_index >= req->nr_buffers)) {
+ 			NV_PRINTK(err, cli, "reloc container bo index invalid\n");
+ 			ret = -EINVAL;
+ 			break;
+diff --git a/drivers/gpu/drm/sun4i/Makefile b/drivers/gpu/drm/sun4i/Makefile
+index 330843ce4280..a27ade6cf2bf 100644
+--- a/drivers/gpu/drm/sun4i/Makefile
++++ b/drivers/gpu/drm/sun4i/Makefile
+@@ -29,7 +29,10 @@ obj-$(CONFIG_DRM_SUN4I)		+= sun4i-tcon.o
+ obj-$(CONFIG_DRM_SUN4I)		+= sun4i_tv.o
+ obj-$(CONFIG_DRM_SUN4I)		+= sun6i_drc.o
+ 
+-obj-$(CONFIG_DRM_SUN4I_BACKEND)	+= sun4i-backend.o sun4i-frontend.o
++obj-$(CONFIG_DRM_SUN4I_BACKEND)	+= sun4i-backend.o
++ifdef CONFIG_DRM_SUN4I_BACKEND
++obj-$(CONFIG_DRM_SUN4I)		+= sun4i-frontend.o
++endif
+ obj-$(CONFIG_DRM_SUN4I_HDMI)	+= sun4i-drm-hdmi.o
+ obj-$(CONFIG_DRM_SUN8I_DW_HDMI)	+= sun8i-drm-hdmi.o
+ obj-$(CONFIG_DRM_SUN8I_MIXER)	+= sun8i-mixer.o
+diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
+index 7afe2f635f74..500b7c5b6672 100644
+--- a/drivers/gpu/drm/tegra/drm.c
++++ b/drivers/gpu/drm/tegra/drm.c
+@@ -436,7 +436,7 @@ int tegra_drm_submit(struct tegra_drm_context *context,
+ 		 * unaligned offset is malformed and cause commands stream
+ 		 * corruption on the buffer address relocation.
+ 		 */
+-		if (offset & 3 || offset >= obj->gem.size) {
++		if (offset & 3 || offset > obj->gem.size) {
+ 			err = -EINVAL;
+ 			goto fail;
+ 		}
+diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c
+index f1d5f76e9c33..d88073e7d22d 100644
+--- a/drivers/gpu/host1x/dev.c
++++ b/drivers/gpu/host1x/dev.c
+@@ -218,6 +218,9 @@ static int host1x_probe(struct platform_device *pdev)
+ 		return err;
+ 	}
+ 
++	if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL))
++		goto skip_iommu;
++
+ 	host->group = iommu_group_get(&pdev->dev);
+ 	if (host->group) {
+ 		struct iommu_domain_geometry *geometry;
+diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c
+index db509ab8874e..acd99783bbca 100644
+--- a/drivers/gpu/host1x/job.c
++++ b/drivers/gpu/host1x/job.c
+@@ -686,7 +686,8 @@ void host1x_job_unpin(struct host1x_job *job)
+ 	for (i = 0; i < job->num_unpins; i++) {
+ 		struct host1x_job_unpin_data *unpin = &job->unpins[i];
+ 
+-		if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && host->domain) {
++		if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) &&
++		    unpin->size && host->domain) {
+ 			iommu_unmap(host->domain, job->addr_phys[i],
+ 				    unpin->size);
+ 			free_iova(&host->iova,
+diff --git a/drivers/hid/hid-google-hammer.c b/drivers/hid/hid-google-hammer.c
+index 7b8e17b03cb8..6bf4da7ad63a 100644
+--- a/drivers/hid/hid-google-hammer.c
++++ b/drivers/hid/hid-google-hammer.c
+@@ -124,6 +124,8 @@ static const struct hid_device_id hammer_devices[] = {
+ 		     USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_STAFF) },
+ 	{ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ 		     USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_WAND) },
++	{ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
++		     USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_WHISKERS) },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(hid, hammer_devices);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 46f5ecd11bf7..5a8b3362cf65 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -452,6 +452,7 @@
+ #define USB_DEVICE_ID_GOOGLE_TOUCH_ROSE	0x5028
+ #define USB_DEVICE_ID_GOOGLE_STAFF	0x502b
+ #define USB_DEVICE_ID_GOOGLE_WAND	0x502d
++#define USB_DEVICE_ID_GOOGLE_WHISKERS	0x5030
+ 
+ #define USB_VENDOR_ID_GOTOP		0x08f2
+ #define USB_DEVICE_ID_SUPER_Q2		0x007f
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 5f947ec20dcb..815a7b0b88cd 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -3361,8 +3361,14 @@ void wacom_setup_device_quirks(struct wacom *wacom)
+ 			if (features->type >= INTUOSHT && features->type <= BAMBOO_PT)
+ 				features->device_type |= WACOM_DEVICETYPE_PAD;
+ 
+-			features->x_max = 4096;
+-			features->y_max = 4096;
++			if (features->type == INTUOSHT2) {
++				features->x_max = features->x_max / 10;
++				features->y_max = features->y_max / 10;
++			}
++			else {
++				features->x_max = 4096;
++				features->y_max = 4096;
++			}
+ 		}
+ 		else if (features->pktlen == WACOM_PKGLEN_BBTOUCH) {
+ 			features->device_type |= WACOM_DEVICETYPE_PAD;
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index bf3bb7e1adab..9d3ef879dc51 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -1074,6 +1074,13 @@ static struct dmi_system_id i8k_blacklist_fan_support_dmi_table[] __initdata = {
+ 			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Vostro 3360"),
+ 		},
+ 	},
++	{
++		.ident = "Dell XPS13 9333",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "XPS13 9333"),
++		},
++	},
+ 	{ }
+ };
+ 
+diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
+index aebce560bfaf..b14eb73bc3c9 100644
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -4175,7 +4175,7 @@ static int nct6775_probe(struct platform_device *pdev)
+ 	 * The temperature is already monitored if the respective bit in <mask>
+ 	 * is set.
+ 	 */
+-	for (i = 0; i < 32; i++) {
++	for (i = 0; i < 31; i++) {
+ 		if (!(data->temp_mask & BIT(i + 1)))
+ 			continue;
+ 		if (!reg_temp_alternate[i])
+diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
+index 6fca5e64cffb..f83405d3e8c2 100644
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -677,9 +677,6 @@ static int i2c_imx_dma_read(struct imx_i2c_struct *i2c_imx,
+ 	struct imx_i2c_dma *dma = i2c_imx->dma;
+ 	struct device *dev = &i2c_imx->adapter.dev;
+ 
+-	temp = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR);
+-	temp |= I2CR_DMAEN;
+-	imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR);
+ 
+ 	dma->chan_using = dma->chan_rx;
+ 	dma->dma_transfer_dir = DMA_DEV_TO_MEM;
+@@ -792,6 +789,7 @@ static int i2c_imx_read(struct imx_i2c_struct *i2c_imx, struct i2c_msg *msgs, bo
+ 	int i, result;
+ 	unsigned int temp;
+ 	int block_data = msgs->flags & I2C_M_RECV_LEN;
++	int use_dma = i2c_imx->dma && msgs->len >= DMA_THRESHOLD && !block_data;
+ 
+ 	dev_dbg(&i2c_imx->adapter.dev,
+ 		"<%s> write slave address: addr=0x%x\n",
+@@ -818,12 +816,14 @@ static int i2c_imx_read(struct imx_i2c_struct *i2c_imx, struct i2c_msg *msgs, bo
+ 	 */
+ 	if ((msgs->len - 1) || block_data)
+ 		temp &= ~I2CR_TXAK;
++	if (use_dma)
++		temp |= I2CR_DMAEN;
+ 	imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR);
+ 	imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR); /* dummy read */
+ 
+ 	dev_dbg(&i2c_imx->adapter.dev, "<%s> read data\n", __func__);
+ 
+-	if (i2c_imx->dma && msgs->len >= DMA_THRESHOLD && !block_data)
++	if (use_dma)
+ 		return i2c_imx_dma_read(i2c_imx, msgs, is_lastmsg);
+ 
+ 	/* read data */
+diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
+index 7c3b4740b94b..b8f303dea305 100644
+--- a/drivers/i2c/i2c-core-acpi.c
++++ b/drivers/i2c/i2c-core-acpi.c
+@@ -482,11 +482,16 @@ static int acpi_gsb_i2c_write_bytes(struct i2c_client *client,
+ 	msgs[0].buf = buffer;
+ 
+ 	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
+-	if (ret < 0)
+-		dev_err(&client->adapter->dev, "i2c write failed\n");
+ 
+ 	kfree(buffer);
+-	return ret;
++
++	if (ret < 0) {
++		dev_err(&client->adapter->dev, "i2c write failed: %d\n", ret);
++		return ret;
++	}
++
++	/* 1 transfer must have completed successfully */
++	return (ret == 1) ? 0 : -EIO;
+ }
+ 
+ static acpi_status
+diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
+index 5ec3e41b65f2..fe87d27779d9 100644
+--- a/drivers/iio/pressure/bmp280-core.c
++++ b/drivers/iio/pressure/bmp280-core.c
+@@ -415,10 +415,9 @@ static int bmp280_read_humid(struct bmp280_data *data, int *val, int *val2)
+ 	}
+ 	comp_humidity = bmp280_compensate_humidity(data, adc_humidity);
+ 
+-	*val = comp_humidity;
+-	*val2 = 1024;
++	*val = comp_humidity * 1000 / 1024;
+ 
+-	return IIO_VAL_FRACTIONAL;
++	return IIO_VAL_INT;
+ }
+ 
+ static int bmp280_read_raw(struct iio_dev *indio_dev,
+diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
+index ed1f253faf97..c7c85c22e4e3 100644
+--- a/drivers/infiniband/hw/mlx4/mr.c
++++ b/drivers/infiniband/hw/mlx4/mr.c
+@@ -486,8 +486,11 @@ int mlx4_ib_rereg_user_mr(struct ib_mr *mr, int flags,
+ 	}
+ 
+ 	if (flags & IB_MR_REREG_ACCESS) {
+-		if (ib_access_writable(mr_access_flags) && !mmr->umem->writable)
+-			return -EPERM;
++		if (ib_access_writable(mr_access_flags) &&
++		    !mmr->umem->writable) {
++			err = -EPERM;
++			goto release_mpt_entry;
++		}
+ 
+ 		err = mlx4_mr_hw_change_access(dev->dev, *pmpt_entry,
+ 					       convert_access(mr_access_flags));
+diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
+index 3c7522d025f2..93d67d97c279 100644
+--- a/drivers/infiniband/hw/mlx5/srq.c
++++ b/drivers/infiniband/hw/mlx5/srq.c
+@@ -266,18 +266,24 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
+ 
+ 	desc_size = sizeof(struct mlx5_wqe_srq_next_seg) +
+ 		    srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg);
+-	if (desc_size == 0 || srq->msrq.max_gs > desc_size)
+-		return ERR_PTR(-EINVAL);
++	if (desc_size == 0 || srq->msrq.max_gs > desc_size) {
++		err = -EINVAL;
++		goto err_srq;
++	}
+ 	desc_size = roundup_pow_of_two(desc_size);
+ 	desc_size = max_t(size_t, 32, desc_size);
+-	if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg))
+-		return ERR_PTR(-EINVAL);
++	if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg)) {
++		err = -EINVAL;
++		goto err_srq;
++	}
+ 	srq->msrq.max_avail_gather = (desc_size - sizeof(struct mlx5_wqe_srq_next_seg)) /
+ 		sizeof(struct mlx5_wqe_data_seg);
+ 	srq->msrq.wqe_shift = ilog2(desc_size);
+ 	buf_size = srq->msrq.max * desc_size;
+-	if (buf_size < desc_size)
+-		return ERR_PTR(-EINVAL);
++	if (buf_size < desc_size) {
++		err = -EINVAL;
++		goto err_srq;
++	}
+ 	in.type = init_attr->srq_type;
+ 
+ 	if (pd->uobject)
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index 3f9afc02d166..f86223aca7b8 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -1957,6 +1957,9 @@ int qedr_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ 	}
+ 
+ 	if (attr_mask & (IB_QP_AV | IB_QP_PATH_MTU)) {
++		if (rdma_protocol_iwarp(&dev->ibdev, 1))
++			return -EINVAL;
++
+ 		if (attr_mask & IB_QP_PATH_MTU) {
+ 			if (attr->path_mtu < IB_MTU_256 ||
+ 			    attr->path_mtu > IB_MTU_4096) {
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index 785199990457..d048ac13e65b 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -645,6 +645,9 @@ next_wqe:
+ 		} else {
+ 			goto exit;
+ 		}
++		if ((wqe->wr.send_flags & IB_SEND_SIGNALED) ||
++		    qp->sq_sig_type == IB_SIGNAL_ALL_WR)
++			rxe_run_task(&qp->comp.task, 1);
+ 		qp->req.wqe_index = next_index(qp->sq.queue,
+ 						qp->req.wqe_index);
+ 		goto next_wqe;
+@@ -709,6 +712,7 @@ next_wqe:
+ 
+ 	if (fill_packet(qp, wqe, &pkt, skb, payload)) {
+ 		pr_debug("qp#%d Error during fill packet\n", qp_num(qp));
++		kfree_skb(skb);
+ 		goto err;
+ 	}
+ 
+@@ -740,7 +744,6 @@ next_wqe:
+ 	goto next_wqe;
+ 
+ err:
+-	kfree_skb(skb);
+ 	wqe->status = IB_WC_LOC_PROT_ERR;
+ 	wqe->state = wqe_state_error;
+ 	__rxe_do_task(&qp->comp.task);
+diff --git a/drivers/input/rmi4/rmi_2d_sensor.c b/drivers/input/rmi4/rmi_2d_sensor.c
+index 8bb866c7b985..8eeffa066022 100644
+--- a/drivers/input/rmi4/rmi_2d_sensor.c
++++ b/drivers/input/rmi4/rmi_2d_sensor.c
+@@ -32,15 +32,15 @@ void rmi_2d_sensor_abs_process(struct rmi_2d_sensor *sensor,
+ 	if (obj->type == RMI_2D_OBJECT_NONE)
+ 		return;
+ 
+-	if (axis_align->swap_axes)
+-		swap(obj->x, obj->y);
+-
+ 	if (axis_align->flip_x)
+ 		obj->x = sensor->max_x - obj->x;
+ 
+ 	if (axis_align->flip_y)
+ 		obj->y = sensor->max_y - obj->y;
+ 
++	if (axis_align->swap_axes)
++		swap(obj->x, obj->y);
++
+ 	/*
+ 	 * Here checking if X offset or y offset are specified is
+ 	 * redundant. We just add the offsets or clip the values.
+@@ -120,15 +120,15 @@ void rmi_2d_sensor_rel_report(struct rmi_2d_sensor *sensor, int x, int y)
+ 	x = min(RMI_2D_REL_POS_MAX, max(RMI_2D_REL_POS_MIN, (int)x));
+ 	y = min(RMI_2D_REL_POS_MAX, max(RMI_2D_REL_POS_MIN, (int)y));
+ 
+-	if (axis_align->swap_axes)
+-		swap(x, y);
+-
+ 	if (axis_align->flip_x)
+ 		x = min(RMI_2D_REL_POS_MAX, -x);
+ 
+ 	if (axis_align->flip_y)
+ 		y = min(RMI_2D_REL_POS_MAX, -y);
+ 
++	if (axis_align->swap_axes)
++		swap(x, y);
++
+ 	if (x || y) {
+ 		input_report_rel(sensor->input, REL_X, x);
+ 		input_report_rel(sensor->input, REL_Y, y);
+@@ -141,17 +141,10 @@ static void rmi_2d_sensor_set_input_params(struct rmi_2d_sensor *sensor)
+ 	struct input_dev *input = sensor->input;
+ 	int res_x;
+ 	int res_y;
++	int max_x, max_y;
+ 	int input_flags = 0;
+ 
+ 	if (sensor->report_abs) {
+-		if (sensor->axis_align.swap_axes) {
+-			swap(sensor->max_x, sensor->max_y);
+-			swap(sensor->axis_align.clip_x_low,
+-			     sensor->axis_align.clip_y_low);
+-			swap(sensor->axis_align.clip_x_high,
+-			     sensor->axis_align.clip_y_high);
+-		}
+-
+ 		sensor->min_x = sensor->axis_align.clip_x_low;
+ 		if (sensor->axis_align.clip_x_high)
+ 			sensor->max_x = min(sensor->max_x,
+@@ -163,14 +156,19 @@ static void rmi_2d_sensor_set_input_params(struct rmi_2d_sensor *sensor)
+ 				sensor->axis_align.clip_y_high);
+ 
+ 		set_bit(EV_ABS, input->evbit);
+-		input_set_abs_params(input, ABS_MT_POSITION_X, 0, sensor->max_x,
+-					0, 0);
+-		input_set_abs_params(input, ABS_MT_POSITION_Y, 0, sensor->max_y,
+-					0, 0);
++
++		max_x = sensor->max_x;
++		max_y = sensor->max_y;
++		if (sensor->axis_align.swap_axes)
++			swap(max_x, max_y);
++		input_set_abs_params(input, ABS_MT_POSITION_X, 0, max_x, 0, 0);
++		input_set_abs_params(input, ABS_MT_POSITION_Y, 0, max_y, 0, 0);
+ 
+ 		if (sensor->x_mm && sensor->y_mm) {
+ 			res_x = (sensor->max_x - sensor->min_x) / sensor->x_mm;
+ 			res_y = (sensor->max_y - sensor->min_y) / sensor->y_mm;
++			if (sensor->axis_align.swap_axes)
++				swap(res_x, res_y);
+ 
+ 			input_abs_set_res(input, ABS_X, res_x);
+ 			input_abs_set_res(input, ABS_Y, res_y);
+diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
+index 1ff38aff9f29..29dd8a9939b1 100644
+--- a/drivers/irqchip/irq-gic-v2m.c
++++ b/drivers/irqchip/irq-gic-v2m.c
+@@ -199,7 +199,7 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ 
+ fail:
+ 	irq_domain_free_irqs_parent(domain, virq, nr_irqs);
+-	gicv2m_unalloc_msi(v2m, hwirq, get_count_order(nr_irqs));
++	gicv2m_unalloc_msi(v2m, hwirq, nr_irqs);
+ 	return err;
+ }
+ 
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index ab16968fced8..bb1580077054 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -3405,6 +3405,16 @@ static int redist_disable_lpis(void)
+ 	u64 timeout = USEC_PER_SEC;
+ 	u64 val;
+ 
++	/*
++	 * If coming via a CPU hotplug event, we don't need to disable
++	 * LPIs before trying to re-enable them. They are already
++	 * configured and all is well in the world. Detect this case
++	 * by checking the allocation of the pending table for the
++	 * current CPU.
++	 */
++	if (gic_data_rdist()->pend_page)
++		return 0;
++
+ 	if (!gic_rdists_supports_plpis()) {
+ 		pr_info("CPU%d: LPIs not supported\n", smp_processor_id());
+ 		return -ENXIO;
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 3c60774c8430..61dffc7bf6bf 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3892,6 +3892,13 @@ static int raid10_run(struct mddev *mddev)
+ 			    disk->rdev->saved_raid_disk < 0)
+ 				conf->fullsync = 1;
+ 		}
++
++		if (disk->replacement &&
++		    !test_bit(In_sync, &disk->replacement->flags) &&
++		    disk->replacement->saved_raid_disk < 0) {
++			conf->fullsync = 1;
++		}
++
+ 		disk->recovery_disabled = mddev->recovery_disabled - 1;
+ 	}
+ 
+diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
+index aaaeaae01e1d..eeff2285fb8b 100644
+--- a/drivers/mtd/devices/mtd_dataflash.c
++++ b/drivers/mtd/devices/mtd_dataflash.c
+@@ -733,8 +733,8 @@ static struct flash_info dataflash_data[] = {
+ 	{ "AT45DB642x",  0x1f2800, 8192, 1056, 11, SUP_POW2PS},
+ 	{ "at45db642d",  0x1f2800, 8192, 1024, 10, SUP_POW2PS | IS_POW2PS},
+ 
+-	{ "AT45DB641E",  0x1f28000100, 32768, 264, 9, SUP_EXTID | SUP_POW2PS},
+-	{ "at45db641e",  0x1f28000100, 32768, 256, 8, SUP_EXTID | SUP_POW2PS | IS_POW2PS},
++	{ "AT45DB641E",  0x1f28000100ULL, 32768, 264, 9, SUP_EXTID | SUP_POW2PS},
++	{ "at45db641e",  0x1f28000100ULL, 32768, 256, 8, SUP_EXTID | SUP_POW2PS | IS_POW2PS},
+ };
+ 
+ static struct flash_info *jedec_lookup(struct spi_device *spi,
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+index d847e1b9c37b..be1506169076 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+@@ -1533,6 +1533,7 @@ struct bnx2x {
+ 	struct link_vars	link_vars;
+ 	u32			link_cnt;
+ 	struct bnx2x_link_report_data last_reported_link;
++	bool			force_link_down;
+ 
+ 	struct mdio_if_info	mdio;
+ 
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index 95871576ab92..e7b305efa3fe 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -1261,6 +1261,11 @@ void __bnx2x_link_report(struct bnx2x *bp)
+ {
+ 	struct bnx2x_link_report_data cur_data;
+ 
++	if (bp->force_link_down) {
++		bp->link_vars.link_up = 0;
++		return;
++	}
++
+ 	/* reread mf_cfg */
+ 	if (IS_PF(bp) && !CHIP_IS_E1(bp))
+ 		bnx2x_read_mf_cfg(bp);
+@@ -2817,6 +2822,7 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
+ 		bp->pending_max = 0;
+ 	}
+ 
++	bp->force_link_down = false;
+ 	if (bp->port.pmf) {
+ 		rc = bnx2x_initial_phy_init(bp, load_mode);
+ 		if (rc)
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index c766ae23bc74..89484efbaba4 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -10279,6 +10279,12 @@ static void bnx2x_sp_rtnl_task(struct work_struct *work)
+ 		bp->sp_rtnl_state = 0;
+ 		smp_mb();
+ 
++		/* Immediately indicate link as down */
++		bp->link_vars.link_up = 0;
++		bp->force_link_down = true;
++		netif_carrier_off(bp->dev);
++		BNX2X_ERR("Indicating link is down due to Tx-timeout\n");
++
+ 		bnx2x_nic_unload(bp, UNLOAD_NORMAL, true);
+ 		/* When ret value shows failure of allocation failure,
+ 		 * the nic is rebooted again. If open still fails, a error
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 401e58939795..cb026e500127 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -5915,7 +5915,7 @@ unsigned int bnxt_get_max_func_irqs(struct bnxt *bp)
+ 	return min_t(unsigned int, hw_resc->max_irqs, hw_resc->max_cp_rings);
+ }
+ 
+-void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max_irqs)
++static void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max_irqs)
+ {
+ 	bp->hw_resc.max_irqs = max_irqs;
+ }
+@@ -6875,7 +6875,7 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
+ 		rc = bnxt_request_irq(bp);
+ 		if (rc) {
+ 			netdev_err(bp->dev, "bnxt_request_irq err: %x\n", rc);
+-			goto open_err;
++			goto open_err_irq;
+ 		}
+ 	}
+ 
+@@ -6913,6 +6913,8 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
+ 
+ open_err:
+ 	bnxt_disable_napi(bp);
++
++open_err_irq:
+ 	bnxt_del_napi(bp);
+ 
+ open_err_free_mem:
+@@ -8467,11 +8469,11 @@ int bnxt_get_max_rings(struct bnxt *bp, int *max_rx, int *max_tx, bool shared)
+ 	int rx, tx, cp;
+ 
+ 	_bnxt_get_max_rings(bp, &rx, &tx, &cp);
++	*max_rx = rx;
++	*max_tx = tx;
+ 	if (!rx || !tx || !cp)
+ 		return -ENOMEM;
+ 
+-	*max_rx = rx;
+-	*max_tx = tx;
+ 	return bnxt_trim_rings(bp, max_rx, max_tx, cp, shared);
+ }
+ 
+@@ -8485,8 +8487,11 @@ static int bnxt_get_dflt_rings(struct bnxt *bp, int *max_rx, int *max_tx,
+ 		/* Not enough rings, try disabling agg rings. */
+ 		bp->flags &= ~BNXT_FLAG_AGG_RINGS;
+ 		rc = bnxt_get_max_rings(bp, max_rx, max_tx, shared);
+-		if (rc)
++		if (rc) {
++			/* set BNXT_FLAG_AGG_RINGS back for consistency */
++			bp->flags |= BNXT_FLAG_AGG_RINGS;
+ 			return rc;
++		}
+ 		bp->flags |= BNXT_FLAG_NO_AGG_RINGS;
+ 		bp->dev->hw_features &= ~(NETIF_F_LRO | NETIF_F_GRO_HW);
+ 		bp->dev->features &= ~(NETIF_F_LRO | NETIF_F_GRO_HW);
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index 3d55d3b56865..79bce5dcf7fe 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -1455,7 +1455,6 @@ void bnxt_set_max_func_stat_ctxs(struct bnxt *bp, unsigned int max);
+ unsigned int bnxt_get_max_func_cp_rings(struct bnxt *bp);
+ void bnxt_set_max_func_cp_rings(struct bnxt *bp, unsigned int max);
+ unsigned int bnxt_get_max_func_irqs(struct bnxt *bp);
+-void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max);
+ int bnxt_get_avail_msix(struct bnxt *bp, int num);
+ int bnxt_reserve_rings(struct bnxt *bp);
+ void bnxt_tx_disable(struct bnxt *bp);
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+index 795f45024c20..491bd40a254d 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+@@ -27,6 +27,15 @@
+ #define BNXT_FID_INVALID			0xffff
+ #define VLAN_TCI(vid, prio)	((vid) | ((prio) << VLAN_PRIO_SHIFT))
+ 
++#define is_vlan_pcp_wildcarded(vlan_tci_mask)	\
++	((ntohs(vlan_tci_mask) & VLAN_PRIO_MASK) == 0x0000)
++#define is_vlan_pcp_exactmatch(vlan_tci_mask)	\
++	((ntohs(vlan_tci_mask) & VLAN_PRIO_MASK) == VLAN_PRIO_MASK)
++#define is_vlan_pcp_zero(vlan_tci)	\
++	((ntohs(vlan_tci) & VLAN_PRIO_MASK) == 0x0000)
++#define is_vid_exactmatch(vlan_tci_mask)	\
++	((ntohs(vlan_tci_mask) & VLAN_VID_MASK) == VLAN_VID_MASK)
++
+ /* Return the dst fid of the func for flow forwarding
+  * For PFs: src_fid is the fid of the PF
+  * For VF-reps: src_fid the fid of the VF
+@@ -389,6 +398,21 @@ static bool is_exactmatch(void *mask, int len)
+ 	return true;
+ }
+ 
++static bool is_vlan_tci_allowed(__be16  vlan_tci_mask,
++				__be16  vlan_tci)
++{
++	/* VLAN priority must be either exactly zero or fully wildcarded and
++	 * VLAN id must be exact match.
++	 */
++	if (is_vid_exactmatch(vlan_tci_mask) &&
++	    ((is_vlan_pcp_exactmatch(vlan_tci_mask) &&
++	      is_vlan_pcp_zero(vlan_tci)) ||
++	     is_vlan_pcp_wildcarded(vlan_tci_mask)))
++		return true;
++
++	return false;
++}
++
+ static bool bits_set(void *key, int len)
+ {
+ 	const u8 *p = key;
+@@ -803,9 +827,9 @@ static bool bnxt_tc_can_offload(struct bnxt *bp, struct bnxt_tc_flow *flow)
+ 	/* Currently VLAN fields cannot be partial wildcard */
+ 	if (bits_set(&flow->l2_key.inner_vlan_tci,
+ 		     sizeof(flow->l2_key.inner_vlan_tci)) &&
+-	    !is_exactmatch(&flow->l2_mask.inner_vlan_tci,
+-			   sizeof(flow->l2_mask.inner_vlan_tci))) {
+-		netdev_info(bp->dev, "Wildcard match unsupported for VLAN TCI\n");
++	    !is_vlan_tci_allowed(flow->l2_mask.inner_vlan_tci,
++				 flow->l2_key.inner_vlan_tci)) {
++		netdev_info(bp->dev, "Unsupported VLAN TCI\n");
+ 		return false;
+ 	}
+ 	if (bits_set(&flow->l2_key.inner_vlan_tpid,
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+index 347e4f946eb2..840f6e505f73 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+@@ -169,7 +169,6 @@ static int bnxt_req_msix_vecs(struct bnxt_en_dev *edev, int ulp_id,
+ 		edev->ulp_tbl[ulp_id].msix_requested = avail_msix;
+ 	}
+ 	bnxt_fill_msix_vecs(bp, ent);
+-	bnxt_set_max_func_irqs(bp, bnxt_get_max_func_irqs(bp) - avail_msix);
+ 	bnxt_set_max_func_cp_rings(bp, max_cp_rings - avail_msix);
+ 	edev->flags |= BNXT_EN_FLAG_MSIX_REQUESTED;
+ 	return avail_msix;
+@@ -192,7 +191,6 @@ static int bnxt_free_msix_vecs(struct bnxt_en_dev *edev, int ulp_id)
+ 	msix_requested = edev->ulp_tbl[ulp_id].msix_requested;
+ 	bnxt_set_max_func_cp_rings(bp, max_cp_rings + msix_requested);
+ 	edev->ulp_tbl[ulp_id].msix_requested = 0;
+-	bnxt_set_max_func_irqs(bp, bnxt_get_max_func_irqs(bp) + msix_requested);
+ 	edev->flags &= ~BNXT_EN_FLAG_MSIX_REQUESTED;
+ 	if (netif_running(dev)) {
+ 		bnxt_close_nic(bp, true, false);
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 068f991395dc..01032f37a308 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -1818,13 +1818,7 @@ static void macb_free_consistent(struct macb *bp)
+ 	struct macb_queue *queue;
+ 	unsigned int q;
+ 
+-	queue = &bp->queues[0];
+ 	bp->macbgem_ops.mog_free_rx_buffers(bp);
+-	if (queue->rx_ring) {
+-		dma_free_coherent(&bp->pdev->dev, RX_RING_BYTES(bp),
+-				queue->rx_ring, queue->rx_ring_dma);
+-		queue->rx_ring = NULL;
+-	}
+ 
+ 	for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
+ 		kfree(queue->tx_skb);
+@@ -1834,6 +1828,11 @@ static void macb_free_consistent(struct macb *bp)
+ 					  queue->tx_ring, queue->tx_ring_dma);
+ 			queue->tx_ring = NULL;
+ 		}
++		if (queue->rx_ring) {
++			dma_free_coherent(&bp->pdev->dev, RX_RING_BYTES(bp),
++					  queue->rx_ring, queue->rx_ring_dma);
++			queue->rx_ring = NULL;
++		}
+ 	}
+ }
+ 
+diff --git a/drivers/net/ethernet/cavium/Kconfig b/drivers/net/ethernet/cavium/Kconfig
+index 043e3c11c42b..92d88c5f76fb 100644
+--- a/drivers/net/ethernet/cavium/Kconfig
++++ b/drivers/net/ethernet/cavium/Kconfig
+@@ -15,7 +15,7 @@ if NET_VENDOR_CAVIUM
+ 
+ config THUNDER_NIC_PF
+ 	tristate "Thunder Physical function driver"
+-	depends on 64BIT
++	depends on 64BIT && PCI
+ 	select THUNDER_NIC_BGX
+ 	---help---
+ 	  This driver supports Thunder's NIC physical function.
+@@ -28,13 +28,13 @@ config THUNDER_NIC_PF
+ config THUNDER_NIC_VF
+ 	tristate "Thunder Virtual function driver"
+ 	imply CAVIUM_PTP
+-	depends on 64BIT
++	depends on 64BIT && PCI
+ 	---help---
+ 	  This driver supports Thunder's NIC virtual function
+ 
+ config	THUNDER_NIC_BGX
+ 	tristate "Thunder MAC interface driver (BGX)"
+-	depends on 64BIT
++	depends on 64BIT && PCI
+ 	select PHYLIB
+ 	select MDIO_THUNDER
+ 	select THUNDER_NIC_RGX
+@@ -44,7 +44,7 @@ config	THUNDER_NIC_BGX
+ 
+ config	THUNDER_NIC_RGX
+ 	tristate "Thunder MAC interface driver (RGX)"
+-	depends on 64BIT
++	depends on 64BIT && PCI
+ 	select PHYLIB
+ 	select MDIO_THUNDER
+ 	---help---
+@@ -53,7 +53,7 @@ config	THUNDER_NIC_RGX
+ 
+ config CAVIUM_PTP
+ 	tristate "Cavium PTP coprocessor as PTP clock"
+-	depends on 64BIT
++	depends on 64BIT && PCI
+ 	imply PTP_1588_CLOCK
+ 	default y
+ 	---help---
+@@ -65,7 +65,7 @@ config CAVIUM_PTP
+ 
+ config LIQUIDIO
+ 	tristate "Cavium LiquidIO support"
+-	depends on 64BIT
++	depends on 64BIT && PCI
+ 	depends on MAY_USE_DEVLINK
+ 	imply PTP_1588_CLOCK
+ 	select FW_LOADER
+diff --git a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+index 3f6afb54a5eb..bb43ddb7539e 100644
+--- a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
++++ b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+@@ -643,13 +643,21 @@ static int octeon_mgmt_set_mac_address(struct net_device *netdev, void *addr)
+ static int octeon_mgmt_change_mtu(struct net_device *netdev, int new_mtu)
+ {
+ 	struct octeon_mgmt *p = netdev_priv(netdev);
+-	int size_without_fcs = new_mtu + OCTEON_MGMT_RX_HEADROOM;
++	int max_packet = new_mtu + ETH_HLEN + ETH_FCS_LEN;
+ 
+ 	netdev->mtu = new_mtu;
+ 
+-	cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, size_without_fcs);
++	/* HW lifts the limit if the frame is VLAN tagged
++	 * (+4 bytes per each tag, up to two tags)
++	 */
++	cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, max_packet);
++	/* Set the hardware to truncate packets larger than the MTU. The jabber
++	 * register must be set to a multiple of 8 bytes, so round up. JABBER is
++	 * an unconditional limit, so we need to account for two possible VLAN
++	 * tags.
++	 */
+ 	cvmx_write_csr(p->agl + AGL_GMX_RX_JABBER,
+-		       (size_without_fcs + 7) & 0xfff8);
++		       (max_packet + 7 + VLAN_HLEN * 2) & 0xfff8);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+index 72c83496e01f..da73bf702e15 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+@@ -263,7 +263,7 @@ static void dcb_tx_queue_prio_enable(struct net_device *dev, int enable)
+ 				"Can't %s DCB Priority on port %d, TX Queue %d: err=%d\n",
+ 				enable ? "set" : "unset", pi->port_id, i, -err);
+ 		else
+-			txq->dcb_prio = value;
++			txq->dcb_prio = enable ? value : 0;
+ 	}
+ }
+ 
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+index 7cb3ef466cc7..c7a94aacc664 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -8526,7 +8526,7 @@ static int t4_get_flash_params(struct adapter *adap)
+ 	};
+ 
+ 	unsigned int part, manufacturer;
+-	unsigned int density, size;
++	unsigned int density, size = 0;
+ 	u32 flashid = 0;
+ 	int ret;
+ 
+@@ -8596,11 +8596,6 @@ static int t4_get_flash_params(struct adapter *adap)
+ 		case 0x22: /* 256MB */
+ 			size = 1 << 28;
+ 			break;
+-
+-		default:
+-			dev_err(adap->pdev_dev, "Micron Flash Part has bad size, ID = %#x, Density code = %#x\n",
+-				flashid, density);
+-			return -EINVAL;
+ 		}
+ 		break;
+ 	}
+@@ -8616,10 +8611,6 @@ static int t4_get_flash_params(struct adapter *adap)
+ 		case 0x17: /* 64MB */
+ 			size = 1 << 26;
+ 			break;
+-		default:
+-			dev_err(adap->pdev_dev, "ISSI Flash Part has bad size, ID = %#x, Density code = %#x\n",
+-				flashid, density);
+-			return -EINVAL;
+ 		}
+ 		break;
+ 	}
+@@ -8635,10 +8626,6 @@ static int t4_get_flash_params(struct adapter *adap)
+ 		case 0x18: /* 16MB */
+ 			size = 1 << 24;
+ 			break;
+-		default:
+-			dev_err(adap->pdev_dev, "Macronix Flash Part has bad size, ID = %#x, Density code = %#x\n",
+-				flashid, density);
+-			return -EINVAL;
+ 		}
+ 		break;
+ 	}
+@@ -8654,17 +8641,21 @@ static int t4_get_flash_params(struct adapter *adap)
+ 		case 0x18: /* 16MB */
+ 			size = 1 << 24;
+ 			break;
+-		default:
+-			dev_err(adap->pdev_dev, "Winbond Flash Part has bad size, ID = %#x, Density code = %#x\n",
+-				flashid, density);
+-			return -EINVAL;
+ 		}
+ 		break;
+ 	}
+-	default:
+-		dev_err(adap->pdev_dev, "Unsupported Flash Part, ID = %#x\n",
+-			flashid);
+-		return -EINVAL;
++	}
++
++	/* If we didn't recognize the FLASH part, that's no real issue: the
++	 * Hardware/Software contract says that Hardware will _*ALWAYS*_
++	 * use a FLASH part which is at least 4MB in size and has 64KB
++	 * sectors.  The unrecognized FLASH part is likely to be much larger
++	 * than 4MB, but that's all we really need.
++	 */
++	if (size == 0) {
++		dev_warn(adap->pdev_dev, "Unknown Flash Part, ID = %#x, assuming 4MB\n",
++			 flashid);
++		size = 1 << 22;
+ 	}
+ 
+ 	/* Store decoded Flash size and fall through into vetting code. */
+diff --git a/drivers/net/ethernet/cisco/enic/enic_clsf.c b/drivers/net/ethernet/cisco/enic/enic_clsf.c
+index 973c1fb70d09..99038dfc7fbe 100644
+--- a/drivers/net/ethernet/cisco/enic/enic_clsf.c
++++ b/drivers/net/ethernet/cisco/enic/enic_clsf.c
+@@ -79,7 +79,6 @@ void enic_rfs_flw_tbl_init(struct enic *enic)
+ 	enic->rfs_h.max = enic->config.num_arfs;
+ 	enic->rfs_h.free = enic->rfs_h.max;
+ 	enic->rfs_h.toclean = 0;
+-	enic_rfs_timer_start(enic);
+ }
+ 
+ void enic_rfs_flw_tbl_free(struct enic *enic)
+@@ -88,7 +87,6 @@ void enic_rfs_flw_tbl_free(struct enic *enic)
+ 
+ 	enic_rfs_timer_stop(enic);
+ 	spin_lock_bh(&enic->rfs_h.lock);
+-	enic->rfs_h.free = 0;
+ 	for (i = 0; i < (1 << ENIC_RFS_FLW_BITSHIFT); i++) {
+ 		struct hlist_head *hhead;
+ 		struct hlist_node *tmp;
+@@ -99,6 +97,7 @@ void enic_rfs_flw_tbl_free(struct enic *enic)
+ 			enic_delfltr(enic, n->fltr_id);
+ 			hlist_del(&n->node);
+ 			kfree(n);
++			enic->rfs_h.free++;
+ 		}
+ 	}
+ 	spin_unlock_bh(&enic->rfs_h.lock);
+diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
+index 454e57ef047a..84eac2b0837d 100644
+--- a/drivers/net/ethernet/cisco/enic/enic_main.c
++++ b/drivers/net/ethernet/cisco/enic/enic_main.c
+@@ -1971,7 +1971,7 @@ static int enic_open(struct net_device *netdev)
+ 		vnic_intr_unmask(&enic->intr[i]);
+ 
+ 	enic_notify_timer_start(enic);
+-	enic_rfs_flw_tbl_init(enic);
++	enic_rfs_timer_start(enic);
+ 
+ 	return 0;
+ 
+@@ -2895,6 +2895,7 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 
+ 	timer_setup(&enic->notify_timer, enic_notify_timer, 0);
+ 
++	enic_rfs_flw_tbl_init(enic);
+ 	enic_set_rx_coal_setting(enic);
+ 	INIT_WORK(&enic->reset, enic_reset);
+ 	INIT_WORK(&enic->tx_hang_reset, enic_tx_hang_reset);
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index fd43f98ddbe7..38498cfa405e 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -125,6 +125,9 @@ MODULE_PARM_DESC(tx_timeout, "The Tx timeout in ms");
+ /* Default alignment for start of data in an Rx FD */
+ #define DPAA_FD_DATA_ALIGNMENT  16
+ 
++/* The DPAA requires 256 bytes reserved and mapped for the SGT */
++#define DPAA_SGT_SIZE 256
++
+ /* Values for the L3R field of the FM Parse Results
+  */
+ /* L3 Type field: First IP Present IPv4 */
+@@ -1617,8 +1620,8 @@ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
+ 
+ 	if (unlikely(qm_fd_get_format(fd) == qm_fd_sg)) {
+ 		nr_frags = skb_shinfo(skb)->nr_frags;
+-		dma_unmap_single(dev, addr, qm_fd_get_offset(fd) +
+-				 sizeof(struct qm_sg_entry) * (1 + nr_frags),
++		dma_unmap_single(dev, addr,
++				 qm_fd_get_offset(fd) + DPAA_SGT_SIZE,
+ 				 dma_dir);
+ 
+ 		/* The sgt buffer has been allocated with netdev_alloc_frag(),
+@@ -1903,8 +1906,7 @@ static int skb_to_sg_fd(struct dpaa_priv *priv,
+ 	void *sgt_buf;
+ 
+ 	/* get a page frag to store the SGTable */
+-	sz = SKB_DATA_ALIGN(priv->tx_headroom +
+-		sizeof(struct qm_sg_entry) * (1 + nr_frags));
++	sz = SKB_DATA_ALIGN(priv->tx_headroom + DPAA_SGT_SIZE);
+ 	sgt_buf = netdev_alloc_frag(sz);
+ 	if (unlikely(!sgt_buf)) {
+ 		netdev_err(net_dev, "netdev_alloc_frag() failed for size %d\n",
+@@ -1972,9 +1974,8 @@ static int skb_to_sg_fd(struct dpaa_priv *priv,
+ 	skbh = (struct sk_buff **)buffer_start;
+ 	*skbh = skb;
+ 
+-	addr = dma_map_single(dev, buffer_start, priv->tx_headroom +
+-			      sizeof(struct qm_sg_entry) * (1 + nr_frags),
+-			      dma_dir);
++	addr = dma_map_single(dev, buffer_start,
++			      priv->tx_headroom + DPAA_SGT_SIZE, dma_dir);
+ 	if (unlikely(dma_mapping_error(dev, addr))) {
+ 		dev_err(dev, "DMA mapping failed");
+ 		err = -EINVAL;
+diff --git a/drivers/net/ethernet/freescale/fman/fman_port.c b/drivers/net/ethernet/freescale/fman/fman_port.c
+index 6552d68ea6e1..4aa47bc8b02f 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_port.c
++++ b/drivers/net/ethernet/freescale/fman/fman_port.c
+@@ -324,6 +324,10 @@ struct fman_port_qmi_regs {
+ #define HWP_HXS_PHE_REPORT 0x00000800
+ #define HWP_HXS_PCAC_PSTAT 0x00000100
+ #define HWP_HXS_PCAC_PSTOP 0x00000001
++#define HWP_HXS_TCP_OFFSET 0xA
++#define HWP_HXS_UDP_OFFSET 0xB
++#define HWP_HXS_SH_PAD_REM 0x80000000
++
+ struct fman_port_hwp_regs {
+ 	struct {
+ 		u32 ssa; /* Soft Sequence Attachment */
+@@ -728,6 +732,10 @@ static void init_hwp(struct fman_port *port)
+ 		iowrite32be(0xffffffff, &regs->pmda[i].lcv);
+ 	}
+ 
++	/* Short packet padding removal from checksum calculation */
++	iowrite32be(HWP_HXS_SH_PAD_REM, &regs->pmda[HWP_HXS_TCP_OFFSET].ssa);
++	iowrite32be(HWP_HXS_SH_PAD_REM, &regs->pmda[HWP_HXS_UDP_OFFSET].ssa);
++
+ 	start_port_hwp(port);
+ }
+ 
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 5ec1185808e5..65aa7a6e33a2 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -319,7 +319,8 @@ static void replenish_rx_pool(struct ibmvnic_adapter *adapter,
+ 	return;
+ 
+ failure:
+-	dev_info(dev, "replenish pools failure\n");
++	if (lpar_rc != H_PARAMETER && lpar_rc != H_CLOSED)
++		dev_err_ratelimited(dev, "rx: replenish packet buffer failed\n");
+ 	pool->free_map[pool->next_free] = index;
+ 	pool->rx_buff[index].skb = NULL;
+ 
+@@ -1594,7 +1595,8 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
+ 				      &tx_crq);
+ 	}
+ 	if (lpar_rc != H_SUCCESS) {
+-		dev_err(dev, "tx failed with code %ld\n", lpar_rc);
++		if (lpar_rc != H_CLOSED && lpar_rc != H_PARAMETER)
++			dev_err_ratelimited(dev, "tx: send failed\n");
+ 		dev_kfree_skb_any(skb);
+ 		tx_buff->skb = NULL;
+ 
+@@ -1799,8 +1801,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
+ 
+ 		rc = ibmvnic_login(netdev);
+ 		if (rc) {
+-			adapter->state = VNIC_PROBED;
+-			return 0;
++			adapter->state = reset_state;
++			return rc;
+ 		}
+ 
+ 		if (adapter->reset_reason == VNIC_RESET_CHANGE_PARAM ||
+@@ -3085,6 +3087,25 @@ static union ibmvnic_crq *ibmvnic_next_crq(struct ibmvnic_adapter *adapter)
+ 	return crq;
+ }
+ 
++static void print_subcrq_error(struct device *dev, int rc, const char *func)
++{
++	switch (rc) {
++	case H_PARAMETER:
++		dev_warn_ratelimited(dev,
++				     "%s failed: Send request is malformed or adapter failover pending. (rc=%d)\n",
++				     func, rc);
++		break;
++	case H_CLOSED:
++		dev_warn_ratelimited(dev,
++				     "%s failed: Backing queue closed. Adapter is down or failover pending. (rc=%d)\n",
++				     func, rc);
++		break;
++	default:
++		dev_err_ratelimited(dev, "%s failed: (rc=%d)\n", func, rc);
++		break;
++	}
++}
++
+ static int send_subcrq(struct ibmvnic_adapter *adapter, u64 remote_handle,
+ 		       union sub_crq *sub_crq)
+ {
+@@ -3111,11 +3132,8 @@ static int send_subcrq(struct ibmvnic_adapter *adapter, u64 remote_handle,
+ 				cpu_to_be64(u64_crq[2]),
+ 				cpu_to_be64(u64_crq[3]));
+ 
+-	if (rc) {
+-		if (rc == H_CLOSED)
+-			dev_warn(dev, "CRQ Queue closed\n");
+-		dev_err(dev, "Send error (rc=%d)\n", rc);
+-	}
++	if (rc)
++		print_subcrq_error(dev, rc, __func__);
+ 
+ 	return rc;
+ }
+@@ -3133,11 +3151,8 @@ static int send_subcrq_indirect(struct ibmvnic_adapter *adapter,
+ 				cpu_to_be64(remote_handle),
+ 				ioba, num_entries);
+ 
+-	if (rc) {
+-		if (rc == H_CLOSED)
+-			dev_warn(dev, "CRQ Queue closed\n");
+-		dev_err(dev, "Send (indirect) error (rc=%d)\n", rc);
+-	}
++	if (rc)
++		print_subcrq_error(dev, rc, __func__);
+ 
+ 	return rc;
+ }
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+index 633be93f3dbb..b8f1f904e5c2 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+@@ -1897,7 +1897,12 @@ s32 ixgbe_set_rar_generic(struct ixgbe_hw *hw, u32 index, u8 *addr, u32 vmdq,
+ 	if (enable_addr != 0)
+ 		rar_high |= IXGBE_RAH_AV;
+ 
++	/* Record lower 32 bits of MAC address and then make
++	 * sure that write is flushed to hardware before writing
++	 * the upper 16 bits and setting the valid bit.
++	 */
+ 	IXGBE_WRITE_REG(hw, IXGBE_RAL(index), rar_low);
++	IXGBE_WRITE_FLUSH(hw);
+ 	IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
+ 
+ 	return 0;
+@@ -1929,8 +1934,13 @@ s32 ixgbe_clear_rar_generic(struct ixgbe_hw *hw, u32 index)
+ 	rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(index));
+ 	rar_high &= ~(0x0000FFFF | IXGBE_RAH_AV);
+ 
+-	IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
++	/* Clear the address valid bit and upper 16 bits of the address
++	 * before clearing the lower bits. This way we aren't updating
++	 * a live filter.
++	 */
+ 	IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
++	IXGBE_WRITE_FLUSH(hw);
++	IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
+ 
+ 	/* clear VMDq pool/queue selection for this RAR */
+ 	hw->mac.ops.clear_vmdq(hw, index, IXGBE_CLEAR_VMDQ_ALL);
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+index cead23e3db0c..eea4b6f0efe5 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+@@ -759,7 +759,7 @@ int ixgbe_ipsec_tx(struct ixgbe_ring *tx_ring,
+ 	}
+ 
+ 	itd->sa_idx = xs->xso.offload_handle - IXGBE_IPSEC_BASE_TX_INDEX;
+-	if (unlikely(itd->sa_idx > IXGBE_IPSEC_MAX_SA_COUNT)) {
++	if (unlikely(itd->sa_idx >= IXGBE_IPSEC_MAX_SA_COUNT)) {
+ 		netdev_err(tx_ring->netdev, "%s: bad sa_idx=%d handle=%lu\n",
+ 			   __func__, itd->sa_idx, xs->xso.offload_handle);
+ 		return 0;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+index 4f52f87cf210..b6624e218962 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+@@ -1594,17 +1594,15 @@ static void esw_disable_vport(struct mlx5_eswitch *esw, int vport_num)
+ }
+ 
+ /* Public E-Switch API */
+-#define ESW_ALLOWED(esw) ((esw) && MLX5_VPORT_MANAGER((esw)->dev))
++#define ESW_ALLOWED(esw) ((esw) && MLX5_ESWITCH_MANAGER((esw)->dev))
++
+ 
+ int mlx5_eswitch_enable_sriov(struct mlx5_eswitch *esw, int nvfs, int mode)
+ {
+ 	int err;
+ 	int i, enabled_events;
+ 
+-	if (!ESW_ALLOWED(esw))
+-		return 0;
+-
+-	if (!MLX5_ESWITCH_MANAGER(esw->dev) ||
++	if (!ESW_ALLOWED(esw) ||
+ 	    !MLX5_CAP_ESW_FLOWTABLE_FDB(esw->dev, ft_support)) {
+ 		esw_warn(esw->dev, "E-Switch FDB is not supported, aborting ...\n");
+ 		return -EOPNOTSUPP;
+@@ -1806,7 +1804,7 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
+ 	u64 node_guid;
+ 	int err = 0;
+ 
+-	if (!ESW_ALLOWED(esw))
++	if (!MLX5_CAP_GEN(esw->dev, vport_group_manager))
+ 		return -EPERM;
+ 	if (!LEGAL_VPORT(esw, vport) || is_multicast_ether_addr(mac))
+ 		return -EINVAL;
+@@ -1883,7 +1881,7 @@ int mlx5_eswitch_get_vport_config(struct mlx5_eswitch *esw,
+ {
+ 	struct mlx5_vport *evport;
+ 
+-	if (!ESW_ALLOWED(esw))
++	if (!MLX5_CAP_GEN(esw->dev, vport_group_manager))
+ 		return -EPERM;
+ 	if (!LEGAL_VPORT(esw, vport))
+ 		return -EINVAL;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
+index 177e076b8d17..1f3ccb435b06 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
+@@ -549,8 +549,6 @@ int mlx5_modify_nic_vport_node_guid(struct mlx5_core_dev *mdev,
+ 		return -EINVAL;
+ 	if (!MLX5_CAP_GEN(mdev, vport_group_manager))
+ 		return -EACCES;
+-	if (!MLX5_CAP_ESW(mdev, nic_vport_node_guid_modify))
+-		return -EOPNOTSUPP;
+ 
+ 	in = kvzalloc(inlen, GFP_KERNEL);
+ 	if (!in)
+diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.c b/drivers/net/ethernet/netronome/nfp/bpf/main.c
+index 1a781281c57a..a86ae1318043 100644
+--- a/drivers/net/ethernet/netronome/nfp/bpf/main.c
++++ b/drivers/net/ethernet/netronome/nfp/bpf/main.c
+@@ -73,10 +73,10 @@ nfp_bpf_xdp_offload(struct nfp_app *app, struct nfp_net *nn,
+ 
+ 	ret = nfp_net_bpf_offload(nn, prog, running, extack);
+ 	/* Stop offload if replace not possible */
+-	if (ret && prog)
+-		nfp_bpf_xdp_offload(app, nn, NULL, extack);
++	if (ret)
++		return ret;
+ 
+-	nn->dp.bpf_offload_xdp = prog && !ret;
++	nn->dp.bpf_offload_xdp = !!prog;
+ 	return ret;
+ }
+ 
+diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c
+index cd34097b79f1..37a6d7822a38 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c
++++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c
+@@ -232,7 +232,7 @@ struct nfp_nffw_info *nfp_nffw_info_open(struct nfp_cpp *cpp)
+ 	err = nfp_cpp_read(cpp, nfp_resource_cpp_id(state->res),
+ 			   nfp_resource_address(state->res),
+ 			   fwinf, sizeof(*fwinf));
+-	if (err < sizeof(*fwinf))
++	if (err < (int)sizeof(*fwinf))
+ 		goto err_release;
+ 
+ 	if (!nffw_res_flg_init_get(fwinf))
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+index e82986df9b8e..6292c38ef597 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+@@ -255,9 +255,8 @@ qed_dcbx_get_app_protocol_type(struct qed_hwfn *p_hwfn,
+ 		*type = DCBX_PROTOCOL_ROCE_V2;
+ 	} else {
+ 		*type = DCBX_MAX_PROTOCOL_TYPE;
+-		DP_ERR(p_hwfn,
+-		       "No action required, App TLV id = 0x%x app_prio_bitmap = 0x%x\n",
+-		       id, app_prio_bitmap);
++		DP_ERR(p_hwfn, "No action required, App TLV entry = 0x%x\n",
++		       app_prio_bitmap);
+ 		return false;
+ 	}
+ 
+@@ -1469,8 +1468,8 @@ static u8 qed_dcbnl_getcap(struct qed_dev *cdev, int capid, u8 *cap)
+ 		*cap = 0x80;
+ 		break;
+ 	case DCB_CAP_ATTR_DCBX:
+-		*cap = (DCB_CAP_DCBX_LLD_MANAGED | DCB_CAP_DCBX_VER_CEE |
+-			DCB_CAP_DCBX_VER_IEEE | DCB_CAP_DCBX_STATIC);
++		*cap = (DCB_CAP_DCBX_VER_CEE | DCB_CAP_DCBX_VER_IEEE |
++			DCB_CAP_DCBX_STATIC);
+ 		break;
+ 	default:
+ 		*cap = false;
+@@ -1538,8 +1537,6 @@ static u8 qed_dcbnl_getdcbx(struct qed_dev *cdev)
+ 	if (!dcbx_info)
+ 		return 0;
+ 
+-	if (dcbx_info->operational.enabled)
+-		mode |= DCB_CAP_DCBX_LLD_MANAGED;
+ 	if (dcbx_info->operational.ieee)
+ 		mode |= DCB_CAP_DCBX_VER_IEEE;
+ 	if (dcbx_info->operational.cee)
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c
+index 4926c5532fba..13641096a002 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
+@@ -6663,7 +6663,7 @@ static enum dbg_status qed_parse_mcp_trace_buf(u8 *trace_buf,
+ 		format_idx = header & MFW_TRACE_EVENTID_MASK;
+ 
+ 		/* Skip message if its index doesn't exist in the meta data */
+-		if (format_idx > s_mcp_trace_meta.formats_num) {
++		if (format_idx >= s_mcp_trace_meta.formats_num) {
+ 			u8 format_size =
+ 				(u8)((header & MFW_TRACE_PRM_SIZE_MASK) >>
+ 				     MFW_TRACE_PRM_SIZE_SHIFT);
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+index 468c59d2e491..fa0598cf0ad6 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -201,8 +201,9 @@ void qed_ll2b_complete_rx_packet(void *cxt, struct qed_ll2_comp_rx_data *data)
+ 
+ 	skb = build_skb(buffer->data, 0);
+ 	if (!skb) {
+-		rc = -ENOMEM;
+-		goto out_post;
++		DP_INFO(cdev, "Failed to build SKB\n");
++		kfree(buffer->data);
++		goto out_post1;
+ 	}
+ 
+ 	data->u.placement_offset += NET_SKB_PAD;
+@@ -224,8 +225,14 @@ void qed_ll2b_complete_rx_packet(void *cxt, struct qed_ll2_comp_rx_data *data)
+ 		cdev->ll2->cbs->rx_cb(cdev->ll2->cb_cookie, skb,
+ 				      data->opaque_data_0,
+ 				      data->opaque_data_1);
++	} else {
++		DP_VERBOSE(p_hwfn, (NETIF_MSG_RX_STATUS | NETIF_MSG_PKTDATA |
++				    QED_MSG_LL2 | QED_MSG_STORAGE),
++			   "Dropping the packet\n");
++		kfree(buffer->data);
+ 	}
+ 
++out_post1:
+ 	/* Update Buffer information and update FW producer */
+ 	buffer->data = new_data;
+ 	buffer->phys_addr = new_phys_addr;
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
+index 261f21d6b0b0..30e9718fefbb 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
+@@ -566,8 +566,16 @@ static irqreturn_t qed_single_int(int irq, void *dev_instance)
+ 		/* Fastpath interrupts */
+ 		for (j = 0; j < 64; j++) {
+ 			if ((0x2ULL << j) & status) {
+-				hwfn->simd_proto_handler[j].func(
+-					hwfn->simd_proto_handler[j].token);
++				struct qed_simd_fp_handler *p_handler =
++					&hwfn->simd_proto_handler[j];
++
++				if (p_handler->func)
++					p_handler->func(p_handler->token);
++				else
++					DP_NOTICE(hwfn,
++						  "Not calling fastpath handler as it is NULL [handler #%d, status 0x%llx]\n",
++						  j, status);
++
+ 				status &= ~(0x2ULL << j);
+ 				rc = IRQ_HANDLED;
+ 			}
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+index 891f03a7a33d..8d7b9bb910f2 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+@@ -1128,6 +1128,8 @@ static ssize_t qlcnic_83xx_sysfs_flash_write_handler(struct file *filp,
+ 	struct qlcnic_adapter *adapter = dev_get_drvdata(dev);
+ 
+ 	ret = kstrtoul(buf, 16, &data);
++	if (ret)
++		return ret;
+ 
+ 	switch (data) {
+ 	case QLC_83XX_FLASH_SECTOR_ERASE_CMD:
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
+index 5803cd6db406..206f0266463e 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -658,7 +658,7 @@ qcaspi_netdev_open(struct net_device *dev)
+ 		return ret;
+ 	}
+ 
+-	netif_start_queue(qca->net_dev);
++	/* SPI thread takes care of TX queue */
+ 
+ 	return 0;
+ }
+@@ -760,6 +760,9 @@ qcaspi_netdev_tx_timeout(struct net_device *dev)
+ 	qca->net_dev->stats.tx_errors++;
+ 	/* Trigger tx queue flush and QCA7000 reset */
+ 	qca->sync = QCASPI_SYNC_UNKNOWN;
++
++	if (qca->spi_thread)
++		wake_up_process(qca->spi_thread);
+ }
+ 
+ static int
+@@ -878,22 +881,22 @@ qca_spi_probe(struct spi_device *spi)
+ 
+ 	if ((qcaspi_clkspeed < QCASPI_CLK_SPEED_MIN) ||
+ 	    (qcaspi_clkspeed > QCASPI_CLK_SPEED_MAX)) {
+-		dev_info(&spi->dev, "Invalid clkspeed: %d\n",
+-			 qcaspi_clkspeed);
++		dev_err(&spi->dev, "Invalid clkspeed: %d\n",
++			qcaspi_clkspeed);
+ 		return -EINVAL;
+ 	}
+ 
+ 	if ((qcaspi_burst_len < QCASPI_BURST_LEN_MIN) ||
+ 	    (qcaspi_burst_len > QCASPI_BURST_LEN_MAX)) {
+-		dev_info(&spi->dev, "Invalid burst len: %d\n",
+-			 qcaspi_burst_len);
++		dev_err(&spi->dev, "Invalid burst len: %d\n",
++			qcaspi_burst_len);
+ 		return -EINVAL;
+ 	}
+ 
+ 	if ((qcaspi_pluggable < QCASPI_PLUGGABLE_MIN) ||
+ 	    (qcaspi_pluggable > QCASPI_PLUGGABLE_MAX)) {
+-		dev_info(&spi->dev, "Invalid pluggable: %d\n",
+-			 qcaspi_pluggable);
++		dev_err(&spi->dev, "Invalid pluggable: %d\n",
++			qcaspi_pluggable);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -955,8 +958,8 @@ qca_spi_probe(struct spi_device *spi)
+ 	}
+ 
+ 	if (register_netdev(qcaspi_devs)) {
+-		dev_info(&spi->dev, "Unable to register net device %s\n",
+-			 qcaspi_devs->name);
++		dev_err(&spi->dev, "Unable to register net device %s\n",
++			qcaspi_devs->name);
+ 		free_netdev(qcaspi_devs);
+ 		return -EFAULT;
+ 	}
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index d3c6ce074571..07cc71cc9b76 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -8345,6 +8345,7 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 		NETIF_F_HW_VLAN_CTAG_RX;
+ 	dev->vlan_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO |
+ 		NETIF_F_HIGHDMA;
++	dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+ 
+ 	tp->cp_cmd |= RxChkSum | RxVlan;
+ 
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index 68f122140966..40266fe01186 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -980,6 +980,13 @@ static void ravb_adjust_link(struct net_device *ndev)
+ 	struct ravb_private *priv = netdev_priv(ndev);
+ 	struct phy_device *phydev = ndev->phydev;
+ 	bool new_state = false;
++	unsigned long flags;
++
++	spin_lock_irqsave(&priv->lock, flags);
++
++	/* Disable TX and RX right over here, if E-MAC change is ignored */
++	if (priv->no_avb_link)
++		ravb_rcv_snd_disable(ndev);
+ 
+ 	if (phydev->link) {
+ 		if (phydev->duplex != priv->duplex) {
+@@ -997,18 +1004,21 @@ static void ravb_adjust_link(struct net_device *ndev)
+ 			ravb_modify(ndev, ECMR, ECMR_TXF, 0);
+ 			new_state = true;
+ 			priv->link = phydev->link;
+-			if (priv->no_avb_link)
+-				ravb_rcv_snd_enable(ndev);
+ 		}
+ 	} else if (priv->link) {
+ 		new_state = true;
+ 		priv->link = 0;
+ 		priv->speed = 0;
+ 		priv->duplex = -1;
+-		if (priv->no_avb_link)
+-			ravb_rcv_snd_disable(ndev);
+ 	}
+ 
++	/* Enable TX and RX right over here, if E-MAC change is ignored */
++	if (priv->no_avb_link && phydev->link)
++		ravb_rcv_snd_enable(ndev);
++
++	mmiowb();
++	spin_unlock_irqrestore(&priv->lock, flags);
++
+ 	if (new_state && netif_msg_link(priv))
+ 		phy_print_status(phydev);
+ }
+@@ -1115,52 +1125,18 @@ static int ravb_get_link_ksettings(struct net_device *ndev,
+ static int ravb_set_link_ksettings(struct net_device *ndev,
+ 				   const struct ethtool_link_ksettings *cmd)
+ {
+-	struct ravb_private *priv = netdev_priv(ndev);
+-	unsigned long flags;
+-	int error;
+-
+ 	if (!ndev->phydev)
+ 		return -ENODEV;
+ 
+-	spin_lock_irqsave(&priv->lock, flags);
+-
+-	/* Disable TX and RX */
+-	ravb_rcv_snd_disable(ndev);
+-
+-	error = phy_ethtool_ksettings_set(ndev->phydev, cmd);
+-	if (error)
+-		goto error_exit;
+-
+-	if (cmd->base.duplex == DUPLEX_FULL)
+-		priv->duplex = 1;
+-	else
+-		priv->duplex = 0;
+-
+-	ravb_set_duplex(ndev);
+-
+-error_exit:
+-	mdelay(1);
+-
+-	/* Enable TX and RX */
+-	ravb_rcv_snd_enable(ndev);
+-
+-	mmiowb();
+-	spin_unlock_irqrestore(&priv->lock, flags);
+-
+-	return error;
++	return phy_ethtool_ksettings_set(ndev->phydev, cmd);
+ }
+ 
+ static int ravb_nway_reset(struct net_device *ndev)
+ {
+-	struct ravb_private *priv = netdev_priv(ndev);
+ 	int error = -ENODEV;
+-	unsigned long flags;
+ 
+-	if (ndev->phydev) {
+-		spin_lock_irqsave(&priv->lock, flags);
++	if (ndev->phydev)
+ 		error = phy_start_aneg(ndev->phydev);
+-		spin_unlock_irqrestore(&priv->lock, flags);
+-	}
+ 
+ 	return error;
+ }
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index b6b90a6314e3..d14914495a65 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -1855,8 +1855,15 @@ static void sh_eth_adjust_link(struct net_device *ndev)
+ {
+ 	struct sh_eth_private *mdp = netdev_priv(ndev);
+ 	struct phy_device *phydev = ndev->phydev;
++	unsigned long flags;
+ 	int new_state = 0;
+ 
++	spin_lock_irqsave(&mdp->lock, flags);
++
++	/* Disable TX and RX right over here, if E-MAC change is ignored */
++	if (mdp->cd->no_psr || mdp->no_ether_link)
++		sh_eth_rcv_snd_disable(ndev);
++
+ 	if (phydev->link) {
+ 		if (phydev->duplex != mdp->duplex) {
+ 			new_state = 1;
+@@ -1875,18 +1882,21 @@ static void sh_eth_adjust_link(struct net_device *ndev)
+ 			sh_eth_modify(ndev, ECMR, ECMR_TXF, 0);
+ 			new_state = 1;
+ 			mdp->link = phydev->link;
+-			if (mdp->cd->no_psr || mdp->no_ether_link)
+-				sh_eth_rcv_snd_enable(ndev);
+ 		}
+ 	} else if (mdp->link) {
+ 		new_state = 1;
+ 		mdp->link = 0;
+ 		mdp->speed = 0;
+ 		mdp->duplex = -1;
+-		if (mdp->cd->no_psr || mdp->no_ether_link)
+-			sh_eth_rcv_snd_disable(ndev);
+ 	}
+ 
++	/* Enable TX and RX right over here, if E-MAC change is ignored */
++	if ((mdp->cd->no_psr || mdp->no_ether_link) && phydev->link)
++		sh_eth_rcv_snd_enable(ndev);
++
++	mmiowb();
++	spin_unlock_irqrestore(&mdp->lock, flags);
++
+ 	if (new_state && netif_msg_link(mdp))
+ 		phy_print_status(phydev);
+ }
+@@ -1977,39 +1987,10 @@ static int sh_eth_get_link_ksettings(struct net_device *ndev,
+ static int sh_eth_set_link_ksettings(struct net_device *ndev,
+ 				     const struct ethtool_link_ksettings *cmd)
+ {
+-	struct sh_eth_private *mdp = netdev_priv(ndev);
+-	unsigned long flags;
+-	int ret;
+-
+ 	if (!ndev->phydev)
+ 		return -ENODEV;
+ 
+-	spin_lock_irqsave(&mdp->lock, flags);
+-
+-	/* disable tx and rx */
+-	sh_eth_rcv_snd_disable(ndev);
+-
+-	ret = phy_ethtool_ksettings_set(ndev->phydev, cmd);
+-	if (ret)
+-		goto error_exit;
+-
+-	if (cmd->base.duplex == DUPLEX_FULL)
+-		mdp->duplex = 1;
+-	else
+-		mdp->duplex = 0;
+-
+-	if (mdp->cd->set_duplex)
+-		mdp->cd->set_duplex(ndev);
+-
+-error_exit:
+-	mdelay(1);
+-
+-	/* enable tx and rx */
+-	sh_eth_rcv_snd_enable(ndev);
+-
+-	spin_unlock_irqrestore(&mdp->lock, flags);
+-
+-	return ret;
++	return phy_ethtool_ksettings_set(ndev->phydev, cmd);
+ }
+ 
+ /* If it is ever necessary to increase SH_ETH_REG_DUMP_MAX_REGS, the
+@@ -2193,18 +2174,10 @@ static void sh_eth_get_regs(struct net_device *ndev, struct ethtool_regs *regs,
+ 
+ static int sh_eth_nway_reset(struct net_device *ndev)
+ {
+-	struct sh_eth_private *mdp = netdev_priv(ndev);
+-	unsigned long flags;
+-	int ret;
+-
+ 	if (!ndev->phydev)
+ 		return -ENODEV;
+ 
+-	spin_lock_irqsave(&mdp->lock, flags);
+-	ret = phy_start_aneg(ndev->phydev);
+-	spin_unlock_irqrestore(&mdp->lock, flags);
+-
+-	return ret;
++	return phy_start_aneg(ndev->phydev);
+ }
+ 
+ static u32 sh_eth_get_msglevel(struct net_device *ndev)
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index d90a7b1f4088..56ff390e6795 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -4288,9 +4288,9 @@ static int efx_ef10_filter_pri(struct efx_ef10_filter_table *table,
+ 	return -EPROTONOSUPPORT;
+ }
+ 
+-static s32 efx_ef10_filter_insert(struct efx_nic *efx,
+-				  struct efx_filter_spec *spec,
+-				  bool replace_equal)
++static s32 efx_ef10_filter_insert_locked(struct efx_nic *efx,
++					 struct efx_filter_spec *spec,
++					 bool replace_equal)
+ {
+ 	DECLARE_BITMAP(mc_rem_map, EFX_EF10_FILTER_SEARCH_LIMIT);
+ 	struct efx_ef10_nic_data *nic_data = efx->nic_data;
+@@ -4307,7 +4307,7 @@ static s32 efx_ef10_filter_insert(struct efx_nic *efx,
+ 	bool is_mc_recip;
+ 	s32 rc;
+ 
+-	down_read(&efx->filter_sem);
++	WARN_ON(!rwsem_is_locked(&efx->filter_sem));
+ 	table = efx->filter_state;
+ 	down_write(&table->lock);
+ 
+@@ -4498,10 +4498,22 @@ out_unlock:
+ 	if (rss_locked)
+ 		mutex_unlock(&efx->rss_lock);
+ 	up_write(&table->lock);
+-	up_read(&efx->filter_sem);
+ 	return rc;
+ }
+ 
++static s32 efx_ef10_filter_insert(struct efx_nic *efx,
++				  struct efx_filter_spec *spec,
++				  bool replace_equal)
++{
++	s32 ret;
++
++	down_read(&efx->filter_sem);
++	ret = efx_ef10_filter_insert_locked(efx, spec, replace_equal);
++	up_read(&efx->filter_sem);
++
++	return ret;
++}
++
+ static void efx_ef10_filter_update_rx_scatter(struct efx_nic *efx)
+ {
+ 	/* no need to do anything here on EF10 */
+@@ -5284,7 +5296,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
+ 		EFX_WARN_ON_PARANOID(ids[i] != EFX_EF10_FILTER_ID_INVALID);
+ 		efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
+ 		efx_filter_set_eth_local(&spec, vlan->vid, addr_list[i].addr);
+-		rc = efx_ef10_filter_insert(efx, &spec, true);
++		rc = efx_ef10_filter_insert_locked(efx, &spec, true);
+ 		if (rc < 0) {
+ 			if (rollback) {
+ 				netif_info(efx, drv, efx->net_dev,
+@@ -5313,7 +5325,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
+ 		efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
+ 		eth_broadcast_addr(baddr);
+ 		efx_filter_set_eth_local(&spec, vlan->vid, baddr);
+-		rc = efx_ef10_filter_insert(efx, &spec, true);
++		rc = efx_ef10_filter_insert_locked(efx, &spec, true);
+ 		if (rc < 0) {
+ 			netif_warn(efx, drv, efx->net_dev,
+ 				   "Broadcast filter insert failed rc=%d\n", rc);
+@@ -5369,7 +5381,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
+ 	if (vlan->vid != EFX_FILTER_VID_UNSPEC)
+ 		efx_filter_set_eth_local(&spec, vlan->vid, NULL);
+ 
+-	rc = efx_ef10_filter_insert(efx, &spec, true);
++	rc = efx_ef10_filter_insert_locked(efx, &spec, true);
+ 	if (rc < 0) {
+ 		const char *um = multicast ? "Multicast" : "Unicast";
+ 		const char *encap_name = "";
+@@ -5429,7 +5441,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
+ 					   filter_flags, 0);
+ 			eth_broadcast_addr(baddr);
+ 			efx_filter_set_eth_local(&spec, vlan->vid, baddr);
+-			rc = efx_ef10_filter_insert(efx, &spec, true);
++			rc = efx_ef10_filter_insert_locked(efx, &spec, true);
+ 			if (rc < 0) {
+ 				netif_warn(efx, drv, efx->net_dev,
+ 					   "Broadcast filter insert failed rc=%d\n",
+diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
+index a4ebd8715494..bf41157cc712 100644
+--- a/drivers/net/ethernet/sfc/efx.c
++++ b/drivers/net/ethernet/sfc/efx.c
+@@ -1840,12 +1840,6 @@ static void efx_remove_filters(struct efx_nic *efx)
+ 	up_write(&efx->filter_sem);
+ }
+ 
+-static void efx_restore_filters(struct efx_nic *efx)
+-{
+-	down_read(&efx->filter_sem);
+-	efx->type->filter_table_restore(efx);
+-	up_read(&efx->filter_sem);
+-}
+ 
+ /**************************************************************************
+  *
+@@ -2657,6 +2651,7 @@ void efx_reset_down(struct efx_nic *efx, enum reset_type method)
+ 	efx_disable_interrupts(efx);
+ 
+ 	mutex_lock(&efx->mac_lock);
++	down_write(&efx->filter_sem);
+ 	mutex_lock(&efx->rss_lock);
+ 	if (efx->port_initialized && method != RESET_TYPE_INVISIBLE &&
+ 	    method != RESET_TYPE_DATAPATH)
+@@ -2714,9 +2709,8 @@ int efx_reset_up(struct efx_nic *efx, enum reset_type method, bool ok)
+ 	if (efx->type->rx_restore_rss_contexts)
+ 		efx->type->rx_restore_rss_contexts(efx);
+ 	mutex_unlock(&efx->rss_lock);
+-	down_read(&efx->filter_sem);
+-	efx_restore_filters(efx);
+-	up_read(&efx->filter_sem);
++	efx->type->filter_table_restore(efx);
++	up_write(&efx->filter_sem);
+ 	if (efx->type->sriov_reset)
+ 		efx->type->sriov_reset(efx);
+ 
+@@ -2733,6 +2727,7 @@ fail:
+ 	efx->port_initialized = false;
+ 
+ 	mutex_unlock(&efx->rss_lock);
++	up_write(&efx->filter_sem);
+ 	mutex_unlock(&efx->mac_lock);
+ 
+ 	return rc;
+@@ -3440,7 +3435,9 @@ static int efx_pci_probe_main(struct efx_nic *efx)
+ 
+ 	efx_init_napi(efx);
+ 
++	down_write(&efx->filter_sem);
+ 	rc = efx->type->init(efx);
++	up_write(&efx->filter_sem);
+ 	if (rc) {
+ 		netif_err(efx, probe, efx->net_dev,
+ 			  "failed to initialise NIC\n");
+@@ -3729,7 +3726,9 @@ static int efx_pm_resume(struct device *dev)
+ 	rc = efx->type->reset(efx, RESET_TYPE_ALL);
+ 	if (rc)
+ 		return rc;
++	down_write(&efx->filter_sem);
+ 	rc = efx->type->init(efx);
++	up_write(&efx->filter_sem);
+ 	if (rc)
+ 		return rc;
+ 	rc = efx_pm_thaw(dev);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig
+index e28c0d2c58e9..bf4acebb6bcd 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
++++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
+@@ -111,7 +111,7 @@ config DWMAC_ROCKCHIP
+ config DWMAC_SOCFPGA
+ 	tristate "SOCFPGA dwmac support"
+ 	default ARCH_SOCFPGA
+-	depends on OF && (ARCH_SOCFPGA || COMPILE_TEST)
++	depends on OF && (ARCH_SOCFPGA || ARCH_STRATIX10 || COMPILE_TEST)
+ 	select MFD_SYSCON
+ 	help
+ 	  Support for ethernet controller on Altera SOCFPGA
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+index 6e359572b9f0..5b3b06a0a3bf 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+@@ -55,6 +55,7 @@ struct socfpga_dwmac {
+ 	struct	device *dev;
+ 	struct regmap *sys_mgr_base_addr;
+ 	struct reset_control *stmmac_rst;
++	struct reset_control *stmmac_ocp_rst;
+ 	void __iomem *splitter_base;
+ 	bool f2h_ptp_ref_clk;
+ 	struct tse_pcs pcs;
+@@ -262,8 +263,8 @@ static int socfpga_dwmac_set_phy_mode(struct socfpga_dwmac *dwmac)
+ 		val = SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_GMII_MII;
+ 
+ 	/* Assert reset to the enet controller before changing the phy mode */
+-	if (dwmac->stmmac_rst)
+-		reset_control_assert(dwmac->stmmac_rst);
++	reset_control_assert(dwmac->stmmac_ocp_rst);
++	reset_control_assert(dwmac->stmmac_rst);
+ 
+ 	regmap_read(sys_mgr_base_addr, reg_offset, &ctrl);
+ 	ctrl &= ~(SYSMGR_EMACGRP_CTRL_PHYSEL_MASK << reg_shift);
+@@ -288,8 +289,8 @@ static int socfpga_dwmac_set_phy_mode(struct socfpga_dwmac *dwmac)
+ 	/* Deassert reset for the phy configuration to be sampled by
+ 	 * the enet controller, and operation to start in requested mode
+ 	 */
+-	if (dwmac->stmmac_rst)
+-		reset_control_deassert(dwmac->stmmac_rst);
++	reset_control_deassert(dwmac->stmmac_ocp_rst);
++	reset_control_deassert(dwmac->stmmac_rst);
+ 	if (phymode == PHY_INTERFACE_MODE_SGMII) {
+ 		if (tse_pcs_init(dwmac->pcs.tse_pcs_base, &dwmac->pcs) != 0) {
+ 			dev_err(dwmac->dev, "Unable to initialize TSE PCS");
+@@ -324,6 +325,15 @@ static int socfpga_dwmac_probe(struct platform_device *pdev)
+ 		goto err_remove_config_dt;
+ 	}
+ 
++	dwmac->stmmac_ocp_rst = devm_reset_control_get_optional(dev, "stmmaceth-ocp");
++	if (IS_ERR(dwmac->stmmac_ocp_rst)) {
++		ret = PTR_ERR(dwmac->stmmac_ocp_rst);
++		dev_err(dev, "error getting reset control of ocp %d\n", ret);
++		goto err_remove_config_dt;
++	}
++
++	reset_control_deassert(dwmac->stmmac_ocp_rst);
++
+ 	ret = socfpga_dwmac_parse_data(dwmac, dev);
+ 	if (ret) {
+ 		dev_err(dev, "Unable to parse OF data\n");
+diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
+index 1480c094b57d..a817fad26a7b 100644
+--- a/drivers/net/ethernet/ti/davinci_emac.c
++++ b/drivers/net/ethernet/ti/davinci_emac.c
+@@ -1387,6 +1387,10 @@ static int emac_devioctl(struct net_device *ndev, struct ifreq *ifrq, int cmd)
+ 
+ static int match_first_device(struct device *dev, void *data)
+ {
++	if (dev->parent && dev->parent->of_node)
++		return of_device_is_compatible(dev->parent->of_node,
++					       "ti,davinci_mdio");
++
+ 	return !strncmp(dev_name(dev), "davinci_mdio", 12);
+ }
+ 
+diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
+index dfabbae72efd..4a22e169b5a5 100644
+--- a/drivers/net/hamradio/bpqether.c
++++ b/drivers/net/hamradio/bpqether.c
+@@ -89,10 +89,6 @@
+ static const char banner[] __initconst = KERN_INFO \
+ 	"AX.25: bpqether driver version 004\n";
+ 
+-static char bcast_addr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
+-
+-static char bpq_eth_addr[6];
+-
+ static int bpq_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *);
+ static int bpq_device_event(struct notifier_block *, unsigned long, void *);
+ 
+@@ -515,8 +511,8 @@ static int bpq_new_device(struct net_device *edev)
+ 	bpq->ethdev = edev;
+ 	bpq->axdev = ndev;
+ 
+-	memcpy(bpq->dest_addr, bcast_addr, sizeof(bpq_eth_addr));
+-	memcpy(bpq->acpt_addr, bcast_addr, sizeof(bpq_eth_addr));
++	eth_broadcast_addr(bpq->dest_addr);
++	eth_broadcast_addr(bpq->acpt_addr);
+ 
+ 	err = register_netdevice(ndev);
+ 	if (err)
+diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
+index f362cda85425..fde0cddac71a 100644
+--- a/drivers/net/hyperv/rndis_filter.c
++++ b/drivers/net/hyperv/rndis_filter.c
+@@ -1307,6 +1307,7 @@ out:
+ 	/* setting up multiple channels failed */
+ 	net_device->max_chn = 1;
+ 	net_device->num_chn = 1;
++	return 0;
+ 
+ err_dev_remv:
+ 	rndis_filter_device_remove(dev, net_device);
+diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
+index 64f1b1e77bc0..23a52b9293f3 100644
+--- a/drivers/net/ieee802154/adf7242.c
++++ b/drivers/net/ieee802154/adf7242.c
+@@ -275,6 +275,8 @@ struct adf7242_local {
+ 	struct spi_message stat_msg;
+ 	struct spi_transfer stat_xfer;
+ 	struct dentry *debugfs_root;
++	struct delayed_work work;
++	struct workqueue_struct *wqueue;
+ 	unsigned long flags;
+ 	int tx_stat;
+ 	bool promiscuous;
+@@ -575,10 +577,26 @@ static int adf7242_cmd_rx(struct adf7242_local *lp)
+ 	/* Wait until the ACK is sent */
+ 	adf7242_wait_status(lp, RC_STATUS_PHY_RDY, RC_STATUS_MASK, __LINE__);
+ 	adf7242_clear_irqstat(lp);
++	mod_delayed_work(lp->wqueue, &lp->work, msecs_to_jiffies(400));
+ 
+ 	return adf7242_cmd(lp, CMD_RC_RX);
+ }
+ 
++static void adf7242_rx_cal_work(struct work_struct *work)
++{
++	struct adf7242_local *lp =
++	container_of(work, struct adf7242_local, work.work);
++
++	/* Reissuing RC_RX every 400ms - to adjust for offset
++	 * drift in receiver (datasheet page 61, OCL section)
++	 */
++
++	if (!test_bit(FLAG_XMIT, &lp->flags)) {
++		adf7242_cmd(lp, CMD_RC_PHY_RDY);
++		adf7242_cmd_rx(lp);
++	}
++}
++
+ static int adf7242_set_txpower(struct ieee802154_hw *hw, int mbm)
+ {
+ 	struct adf7242_local *lp = hw->priv;
+@@ -686,7 +704,7 @@ static int adf7242_start(struct ieee802154_hw *hw)
+ 	enable_irq(lp->spi->irq);
+ 	set_bit(FLAG_START, &lp->flags);
+ 
+-	return adf7242_cmd(lp, CMD_RC_RX);
++	return adf7242_cmd_rx(lp);
+ }
+ 
+ static void adf7242_stop(struct ieee802154_hw *hw)
+@@ -694,6 +712,7 @@ static void adf7242_stop(struct ieee802154_hw *hw)
+ 	struct adf7242_local *lp = hw->priv;
+ 
+ 	disable_irq(lp->spi->irq);
++	cancel_delayed_work_sync(&lp->work);
+ 	adf7242_cmd(lp, CMD_RC_IDLE);
+ 	clear_bit(FLAG_START, &lp->flags);
+ 	adf7242_clear_irqstat(lp);
+@@ -719,7 +738,10 @@ static int adf7242_channel(struct ieee802154_hw *hw, u8 page, u8 channel)
+ 	adf7242_write_reg(lp, REG_CH_FREQ1, freq >> 8);
+ 	adf7242_write_reg(lp, REG_CH_FREQ2, freq >> 16);
+ 
+-	return adf7242_cmd(lp, CMD_RC_RX);
++	if (test_bit(FLAG_START, &lp->flags))
++		return adf7242_cmd_rx(lp);
++	else
++		return adf7242_cmd(lp, CMD_RC_PHY_RDY);
+ }
+ 
+ static int adf7242_set_hw_addr_filt(struct ieee802154_hw *hw,
+@@ -814,6 +836,7 @@ static int adf7242_xmit(struct ieee802154_hw *hw, struct sk_buff *skb)
+ 	/* ensure existing instances of the IRQ handler have completed */
+ 	disable_irq(lp->spi->irq);
+ 	set_bit(FLAG_XMIT, &lp->flags);
++	cancel_delayed_work_sync(&lp->work);
+ 	reinit_completion(&lp->tx_complete);
+ 	adf7242_cmd(lp, CMD_RC_PHY_RDY);
+ 	adf7242_clear_irqstat(lp);
+@@ -952,6 +975,7 @@ static irqreturn_t adf7242_isr(int irq, void *data)
+ 	unsigned int xmit;
+ 	u8 irq1;
+ 
++	mod_delayed_work(lp->wqueue, &lp->work, msecs_to_jiffies(400));
+ 	adf7242_read_reg(lp, REG_IRQ1_SRC1, &irq1);
+ 
+ 	if (!(irq1 & (IRQ_RX_PKT_RCVD | IRQ_CSMA_CA)))
+@@ -1241,6 +1265,9 @@ static int adf7242_probe(struct spi_device *spi)
+ 	spi_message_add_tail(&lp->stat_xfer, &lp->stat_msg);
+ 
+ 	spi_set_drvdata(spi, lp);
++	INIT_DELAYED_WORK(&lp->work, adf7242_rx_cal_work);
++	lp->wqueue = alloc_ordered_workqueue(dev_name(&spi->dev),
++					     WQ_MEM_RECLAIM);
+ 
+ 	ret = adf7242_hw_init(lp);
+ 	if (ret)
+@@ -1284,6 +1311,9 @@ static int adf7242_remove(struct spi_device *spi)
+ 	if (!IS_ERR_OR_NULL(lp->debugfs_root))
+ 		debugfs_remove_recursive(lp->debugfs_root);
+ 
++	cancel_delayed_work_sync(&lp->work);
++	destroy_workqueue(lp->wqueue);
++
+ 	ieee802154_unregister_hw(lp->hw);
+ 	mutex_destroy(&lp->bmux);
+ 	ieee802154_free_hw(lp->hw);
+diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
+index 77abedf0b524..3d9e91579866 100644
+--- a/drivers/net/ieee802154/at86rf230.c
++++ b/drivers/net/ieee802154/at86rf230.c
+@@ -940,7 +940,7 @@ at86rf230_xmit(struct ieee802154_hw *hw, struct sk_buff *skb)
+ static int
+ at86rf230_ed(struct ieee802154_hw *hw, u8 *level)
+ {
+-	BUG_ON(!level);
++	WARN_ON(!level);
+ 	*level = 0xbe;
+ 	return 0;
+ }
+@@ -1121,8 +1121,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw,
+ 	if (changed & IEEE802154_AFILT_SADDR_CHANGED) {
+ 		u16 addr = le16_to_cpu(filt->short_addr);
+ 
+-		dev_vdbg(&lp->spi->dev,
+-			 "at86rf230_set_hw_addr_filt called for saddr\n");
++		dev_vdbg(&lp->spi->dev, "%s called for saddr\n", __func__);
+ 		__at86rf230_write(lp, RG_SHORT_ADDR_0, addr);
+ 		__at86rf230_write(lp, RG_SHORT_ADDR_1, addr >> 8);
+ 	}
+@@ -1130,8 +1129,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw,
+ 	if (changed & IEEE802154_AFILT_PANID_CHANGED) {
+ 		u16 pan = le16_to_cpu(filt->pan_id);
+ 
+-		dev_vdbg(&lp->spi->dev,
+-			 "at86rf230_set_hw_addr_filt called for pan id\n");
++		dev_vdbg(&lp->spi->dev, "%s called for pan id\n", __func__);
+ 		__at86rf230_write(lp, RG_PAN_ID_0, pan);
+ 		__at86rf230_write(lp, RG_PAN_ID_1, pan >> 8);
+ 	}
+@@ -1140,15 +1138,13 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw,
+ 		u8 i, addr[8];
+ 
+ 		memcpy(addr, &filt->ieee_addr, 8);
+-		dev_vdbg(&lp->spi->dev,
+-			 "at86rf230_set_hw_addr_filt called for IEEE addr\n");
++		dev_vdbg(&lp->spi->dev, "%s called for IEEE addr\n", __func__);
+ 		for (i = 0; i < 8; i++)
+ 			__at86rf230_write(lp, RG_IEEE_ADDR_0 + i, addr[i]);
+ 	}
+ 
+ 	if (changed & IEEE802154_AFILT_PANC_CHANGED) {
+-		dev_vdbg(&lp->spi->dev,
+-			 "at86rf230_set_hw_addr_filt called for panc change\n");
++		dev_vdbg(&lp->spi->dev, "%s called for panc change\n", __func__);
+ 		if (filt->pan_coord)
+ 			at86rf230_write_subreg(lp, SR_AACK_I_AM_COORD, 1);
+ 		else
+@@ -1252,7 +1248,6 @@ at86rf230_set_cca_mode(struct ieee802154_hw *hw,
+ 	return at86rf230_write_subreg(lp, SR_CCA_MODE, val);
+ }
+ 
+-
+ static int
+ at86rf230_set_cca_ed_level(struct ieee802154_hw *hw, s32 mbm)
+ {
+diff --git a/drivers/net/ieee802154/fakelb.c b/drivers/net/ieee802154/fakelb.c
+index 0d673f7682ee..176395e4b7bb 100644
+--- a/drivers/net/ieee802154/fakelb.c
++++ b/drivers/net/ieee802154/fakelb.c
+@@ -49,7 +49,7 @@ struct fakelb_phy {
+ 
+ static int fakelb_hw_ed(struct ieee802154_hw *hw, u8 *level)
+ {
+-	BUG_ON(!level);
++	WARN_ON(!level);
+ 	*level = 0xbe;
+ 
+ 	return 0;
+diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c
+index de0d7f28a181..e428277781ac 100644
+--- a/drivers/net/ieee802154/mcr20a.c
++++ b/drivers/net/ieee802154/mcr20a.c
+@@ -15,10 +15,11 @@
+  */
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+-#include <linux/gpio.h>
++#include <linux/gpio/consumer.h>
+ #include <linux/spi/spi.h>
+ #include <linux/workqueue.h>
+ #include <linux/interrupt.h>
++#include <linux/irq.h>
+ #include <linux/skbuff.h>
+ #include <linux/of_gpio.h>
+ #include <linux/regmap.h>
+diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
+index 6641fd5355e0..6511b1309940 100644
+--- a/drivers/net/ipvlan/ipvlan_main.c
++++ b/drivers/net/ipvlan/ipvlan_main.c
+@@ -75,10 +75,23 @@ static int ipvlan_set_port_mode(struct ipvl_port *port, u16 nval)
+ {
+ 	struct ipvl_dev *ipvlan;
+ 	struct net_device *mdev = port->dev;
+-	int err = 0;
++	unsigned int flags;
++	int err;
+ 
+ 	ASSERT_RTNL();
+ 	if (port->mode != nval) {
++		list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
++			flags = ipvlan->dev->flags;
++			if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S) {
++				err = dev_change_flags(ipvlan->dev,
++						       flags | IFF_NOARP);
++			} else {
++				err = dev_change_flags(ipvlan->dev,
++						       flags & ~IFF_NOARP);
++			}
++			if (unlikely(err))
++				goto fail;
++		}
+ 		if (nval == IPVLAN_MODE_L3S) {
+ 			/* New mode is L3S */
+ 			err = ipvlan_register_nf_hook(read_pnet(&port->pnet));
+@@ -86,21 +99,28 @@ static int ipvlan_set_port_mode(struct ipvl_port *port, u16 nval)
+ 				mdev->l3mdev_ops = &ipvl_l3mdev_ops;
+ 				mdev->priv_flags |= IFF_L3MDEV_MASTER;
+ 			} else
+-				return err;
++				goto fail;
+ 		} else if (port->mode == IPVLAN_MODE_L3S) {
+ 			/* Old mode was L3S */
+ 			mdev->priv_flags &= ~IFF_L3MDEV_MASTER;
+ 			ipvlan_unregister_nf_hook(read_pnet(&port->pnet));
+ 			mdev->l3mdev_ops = NULL;
+ 		}
+-		list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
+-			if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S)
+-				ipvlan->dev->flags |= IFF_NOARP;
+-			else
+-				ipvlan->dev->flags &= ~IFF_NOARP;
+-		}
+ 		port->mode = nval;
+ 	}
++	return 0;
++
++fail:
++	/* Undo the flags changes that have been done so far. */
++	list_for_each_entry_continue_reverse(ipvlan, &port->ipvlans, pnode) {
++		flags = ipvlan->dev->flags;
++		if (port->mode == IPVLAN_MODE_L3 ||
++		    port->mode == IPVLAN_MODE_L3S)
++			dev_change_flags(ipvlan->dev, flags | IFF_NOARP);
++		else
++			dev_change_flags(ipvlan->dev, flags & ~IFF_NOARP);
++	}
++
+ 	return err;
+ }
+ 
+diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
+index 25e2a099b71c..adb2ec74ffc0 100644
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -130,8 +130,9 @@
+ #define MII_88E1318S_PHY_WOL_CTRL_CLEAR_WOL_STATUS		BIT(12)
+ #define MII_88E1318S_PHY_WOL_CTRL_MAGIC_PACKET_MATCH_ENABLE	BIT(14)
+ 
+-#define MII_88E1121_PHY_LED_CTRL	16
++#define MII_PHY_LED_CTRL	        16
+ #define MII_88E1121_PHY_LED_DEF		0x0030
++#define MII_88E1510_PHY_LED_DEF		0x1177
+ 
+ #define MII_M1011_PHY_STATUS		0x11
+ #define MII_M1011_PHY_STATUS_1000	0x8000
+@@ -632,8 +633,40 @@ error:
+ 	return err;
+ }
+ 
++static void marvell_config_led(struct phy_device *phydev)
++{
++	u16 def_config;
++	int err;
++
++	switch (MARVELL_PHY_FAMILY_ID(phydev->phy_id)) {
++	/* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */
++	case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1121R):
++	case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1318S):
++		def_config = MII_88E1121_PHY_LED_DEF;
++		break;
++	/* Default PHY LED config:
++	 * LED[0] .. 1000Mbps Link
++	 * LED[1] .. 100Mbps Link
++	 * LED[2] .. Blink, Activity
++	 */
++	case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1510):
++		def_config = MII_88E1510_PHY_LED_DEF;
++		break;
++	default:
++		return;
++	}
++
++	err = phy_write_paged(phydev, MII_MARVELL_LED_PAGE, MII_PHY_LED_CTRL,
++			      def_config);
++	if (err < 0)
++		pr_warn("Fail to config marvell phy LED.\n");
++}
++
+ static int marvell_config_init(struct phy_device *phydev)
+ {
++	/* Set defalut LED */
++	marvell_config_led(phydev);
++
+ 	/* Set registers from marvell,reg-init DT property */
+ 	return marvell_of_reg_init(phydev);
+ }
+@@ -813,21 +846,6 @@ static int m88e1111_config_init(struct phy_device *phydev)
+ 	return genphy_soft_reset(phydev);
+ }
+ 
+-static int m88e1121_config_init(struct phy_device *phydev)
+-{
+-	int err;
+-
+-	/* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */
+-	err = phy_write_paged(phydev, MII_MARVELL_LED_PAGE,
+-			      MII_88E1121_PHY_LED_CTRL,
+-			      MII_88E1121_PHY_LED_DEF);
+-	if (err < 0)
+-		return err;
+-
+-	/* Set marvell,reg-init configuration from device tree */
+-	return marvell_config_init(phydev);
+-}
+-
+ static int m88e1318_config_init(struct phy_device *phydev)
+ {
+ 	if (phy_interrupt_is_valid(phydev)) {
+@@ -841,7 +859,7 @@ static int m88e1318_config_init(struct phy_device *phydev)
+ 			return err;
+ 	}
+ 
+-	return m88e1121_config_init(phydev);
++	return marvell_config_init(phydev);
+ }
+ 
+ static int m88e1510_config_init(struct phy_device *phydev)
+@@ -2090,7 +2108,7 @@ static struct phy_driver marvell_drivers[] = {
+ 		.features = PHY_GBIT_FEATURES,
+ 		.flags = PHY_HAS_INTERRUPT,
+ 		.probe = &m88e1121_probe,
+-		.config_init = &m88e1121_config_init,
++		.config_init = &marvell_config_init,
+ 		.config_aneg = &m88e1121_config_aneg,
+ 		.read_status = &marvell_read_status,
+ 		.ack_interrupt = &marvell_ack_interrupt,
+diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
+index d437f4f5ed52..740655261e5b 100644
+--- a/drivers/net/phy/sfp-bus.c
++++ b/drivers/net/phy/sfp-bus.c
+@@ -349,7 +349,6 @@ static int sfp_register_bus(struct sfp_bus *bus)
+ 	}
+ 	if (bus->started)
+ 		bus->socket_ops->start(bus->sfp);
+-	bus->netdev->sfp_bus = bus;
+ 	bus->registered = true;
+ 	return 0;
+ }
+@@ -364,7 +363,6 @@ static void sfp_unregister_bus(struct sfp_bus *bus)
+ 		if (bus->phydev && ops && ops->disconnect_phy)
+ 			ops->disconnect_phy(bus->upstream);
+ 	}
+-	bus->netdev->sfp_bus = NULL;
+ 	bus->registered = false;
+ }
+ 
+@@ -436,6 +434,14 @@ void sfp_upstream_stop(struct sfp_bus *bus)
+ }
+ EXPORT_SYMBOL_GPL(sfp_upstream_stop);
+ 
++static void sfp_upstream_clear(struct sfp_bus *bus)
++{
++	bus->upstream_ops = NULL;
++	bus->upstream = NULL;
++	bus->netdev->sfp_bus = NULL;
++	bus->netdev = NULL;
++}
++
+ /**
+  * sfp_register_upstream() - Register the neighbouring device
+  * @fwnode: firmware node for the SFP bus
+@@ -461,9 +467,13 @@ struct sfp_bus *sfp_register_upstream(struct fwnode_handle *fwnode,
+ 		bus->upstream_ops = ops;
+ 		bus->upstream = upstream;
+ 		bus->netdev = ndev;
++		ndev->sfp_bus = bus;
+ 
+-		if (bus->sfp)
++		if (bus->sfp) {
+ 			ret = sfp_register_bus(bus);
++			if (ret)
++				sfp_upstream_clear(bus);
++		}
+ 		rtnl_unlock();
+ 	}
+ 
+@@ -488,8 +498,7 @@ void sfp_unregister_upstream(struct sfp_bus *bus)
+ 	rtnl_lock();
+ 	if (bus->sfp)
+ 		sfp_unregister_bus(bus);
+-	bus->upstream = NULL;
+-	bus->netdev = NULL;
++	sfp_upstream_clear(bus);
+ 	rtnl_unlock();
+ 
+ 	sfp_bus_put(bus);
+@@ -561,6 +570,13 @@ void sfp_module_remove(struct sfp_bus *bus)
+ }
+ EXPORT_SYMBOL_GPL(sfp_module_remove);
+ 
++static void sfp_socket_clear(struct sfp_bus *bus)
++{
++	bus->sfp_dev = NULL;
++	bus->sfp = NULL;
++	bus->socket_ops = NULL;
++}
++
+ struct sfp_bus *sfp_register_socket(struct device *dev, struct sfp *sfp,
+ 				    const struct sfp_socket_ops *ops)
+ {
+@@ -573,8 +589,11 @@ struct sfp_bus *sfp_register_socket(struct device *dev, struct sfp *sfp,
+ 		bus->sfp = sfp;
+ 		bus->socket_ops = ops;
+ 
+-		if (bus->netdev)
++		if (bus->netdev) {
+ 			ret = sfp_register_bus(bus);
++			if (ret)
++				sfp_socket_clear(bus);
++		}
+ 		rtnl_unlock();
+ 	}
+ 
+@@ -592,9 +611,7 @@ void sfp_unregister_socket(struct sfp_bus *bus)
+ 	rtnl_lock();
+ 	if (bus->netdev)
+ 		sfp_unregister_bus(bus);
+-	bus->sfp_dev = NULL;
+-	bus->sfp = NULL;
+-	bus->socket_ops = NULL;
++	sfp_socket_clear(bus);
+ 	rtnl_unlock();
+ 
+ 	sfp_bus_put(bus);
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index 5f565bd574da..48ba80a8ca5c 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -681,7 +681,7 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ 		   (netdev->flags & IFF_ALLMULTI)) {
+ 		rx_creg &= 0xfffe;
+ 		rx_creg |= 0x0002;
+-		dev_info(&netdev->dev, "%s: allmulti set\n", netdev->name);
++		dev_dbg(&netdev->dev, "%s: allmulti set\n", netdev->name);
+ 	} else {
+ 		/* ~RX_MULTICAST, ~RX_PROMISCUOUS */
+ 		rx_creg &= 0x00fc;
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index 7a6a1fe79309..05553d252446 100644
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -82,6 +82,9 @@ static bool turbo_mode = true;
+ module_param(turbo_mode, bool, 0644);
+ MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction");
+ 
++static int smsc75xx_link_ok_nopm(struct usbnet *dev);
++static int smsc75xx_phy_gig_workaround(struct usbnet *dev);
++
+ static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index,
+ 					    u32 *data, int in_pm)
+ {
+@@ -852,6 +855,9 @@ static int smsc75xx_phy_initialize(struct usbnet *dev)
+ 		return -EIO;
+ 	}
+ 
++	/* phy workaround for gig link */
++	smsc75xx_phy_gig_workaround(dev);
++
+ 	smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
+ 		ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP |
+ 		ADVERTISE_PAUSE_ASYM);
+@@ -987,6 +993,62 @@ static int smsc75xx_wait_ready(struct usbnet *dev, int in_pm)
+ 	return -EIO;
+ }
+ 
++static int smsc75xx_phy_gig_workaround(struct usbnet *dev)
++{
++	struct mii_if_info *mii = &dev->mii;
++	int ret = 0, timeout = 0;
++	u32 buf, link_up = 0;
++
++	/* Set the phy in Gig loopback */
++	smsc75xx_mdio_write(dev->net, mii->phy_id, MII_BMCR, 0x4040);
++
++	/* Wait for the link up */
++	do {
++		link_up = smsc75xx_link_ok_nopm(dev);
++		usleep_range(10000, 20000);
++		timeout++;
++	} while ((!link_up) && (timeout < 1000));
++
++	if (timeout >= 1000) {
++		netdev_warn(dev->net, "Timeout waiting for PHY link up\n");
++		return -EIO;
++	}
++
++	/* phy reset */
++	ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
++	if (ret < 0) {
++		netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ret);
++		return ret;
++	}
++
++	buf |= PMT_CTL_PHY_RST;
++
++	ret = smsc75xx_write_reg(dev, PMT_CTL, buf);
++	if (ret < 0) {
++		netdev_warn(dev->net, "Failed to write PMT_CTL: %d\n", ret);
++		return ret;
++	}
++
++	timeout = 0;
++	do {
++		usleep_range(10000, 20000);
++		ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
++		if (ret < 0) {
++			netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n",
++				    ret);
++			return ret;
++		}
++		timeout++;
++	} while ((buf & PMT_CTL_PHY_RST) && (timeout < 100));
++
++	if (timeout >= 100) {
++		netdev_warn(dev->net, "timeout waiting for PHY Reset\n");
++		return -EIO;
++	}
++
++	return 0;
++}
++
+ static int smsc75xx_reset(struct usbnet *dev)
+ {
+ 	struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]);
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index bf05a3689558..9fb89f3b8c59 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -6018,8 +6018,19 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
+ 			   ath10k_mac_max_vht_nss(vht_mcs_mask)));
+ 
+ 	if (changed & IEEE80211_RC_BW_CHANGED) {
+-		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM peer bw %d\n",
+-			   sta->addr, bw);
++		enum wmi_phy_mode mode;
++
++		mode = chan_to_phymode(&def);
++		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM peer bw %d phymode %d\n",
++				sta->addr, bw, mode);
++
++		err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
++				WMI_PEER_PHYMODE, mode);
++		if (err) {
++			ath10k_warn(ar, "failed to update STA %pM peer phymode %d: %d\n",
++					sta->addr, mode, err);
++			goto exit;
++		}
+ 
+ 		err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
+ 						WMI_PEER_CHAN_WIDTH, bw);
+@@ -6060,6 +6071,7 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
+ 				    sta->addr);
+ 	}
+ 
++exit:
+ 	mutex_unlock(&ar->conf_mutex);
+ }
+ 
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
+index 7fde22ea2ffa..d0a380d81d74 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.h
++++ b/drivers/net/wireless/ath/ath10k/wmi.h
+@@ -6098,6 +6098,7 @@ enum wmi_peer_param {
+ 	WMI_PEER_NSS        = 0x5,
+ 	WMI_PEER_USE_4ADDR  = 0x6,
+ 	WMI_PEER_DEBUG      = 0xa,
++	WMI_PEER_PHYMODE    = 0xd,
+ 	WMI_PEER_DUMMY_VAR  = 0xff, /* dummy parameter for STA PS workaround */
+ };
+ 
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 1037df7297bb..32f2f8b63970 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4294,6 +4294,13 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+ 	if (bus) {
++		/* Stop watchdog task */
++		if (bus->watchdog_tsk) {
++			send_sig(SIGTERM, bus->watchdog_tsk, 1);
++			kthread_stop(bus->watchdog_tsk);
++			bus->watchdog_tsk = NULL;
++		}
++
+ 		/* De-register interrupt handler */
+ 		brcmf_sdiod_intr_unregister(bus->sdiodev);
+ 
+diff --git a/drivers/nfc/pn533/usb.c b/drivers/nfc/pn533/usb.c
+index d5553c47014f..5d823e965883 100644
+--- a/drivers/nfc/pn533/usb.c
++++ b/drivers/nfc/pn533/usb.c
+@@ -74,7 +74,7 @@ static void pn533_recv_response(struct urb *urb)
+ 	struct sk_buff *skb = NULL;
+ 
+ 	if (!urb->status) {
+-		skb = alloc_skb(urb->actual_length, GFP_KERNEL);
++		skb = alloc_skb(urb->actual_length, GFP_ATOMIC);
+ 		if (!skb) {
+ 			nfc_err(&phy->udev->dev, "failed to alloc memory\n");
+ 		} else {
+@@ -186,7 +186,7 @@ static int pn533_usb_send_frame(struct pn533 *dev,
+ 
+ 	if (dev->protocol_type == PN533_PROTO_REQ_RESP) {
+ 		/* request for response for sent packet directly */
+-		rc = pn533_submit_urb_for_response(phy, GFP_ATOMIC);
++		rc = pn533_submit_urb_for_response(phy, GFP_KERNEL);
+ 		if (rc)
+ 			goto error;
+ 	} else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) {
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index b9ca782fe82d..620f837c1234 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -100,6 +100,22 @@ static struct class *nvme_subsys_class;
+ static void nvme_ns_remove(struct nvme_ns *ns);
+ static int nvme_revalidate_disk(struct gendisk *disk);
+ static void nvme_put_subsystem(struct nvme_subsystem *subsys);
++static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl,
++					   unsigned nsid);
++
++static void nvme_set_queue_dying(struct nvme_ns *ns)
++{
++	/*
++	 * Revalidating a dead namespace sets capacity to 0. This will end
++	 * buffered writers dirtying pages that can't be synced.
++	 */
++	if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags))
++		return;
++	revalidate_disk(ns->disk);
++	blk_set_queue_dying(ns->queue);
++	/* Forcibly unquiesce queues to avoid blocking dispatch */
++	blk_mq_unquiesce_queue(ns->queue);
++}
+ 
+ int nvme_reset_ctrl(struct nvme_ctrl *ctrl)
+ {
+@@ -1130,19 +1146,15 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
+ 
+ static void nvme_update_formats(struct nvme_ctrl *ctrl)
+ {
+-	struct nvme_ns *ns, *next;
+-	LIST_HEAD(rm_list);
++	struct nvme_ns *ns;
+ 
+-	down_write(&ctrl->namespaces_rwsem);
+-	list_for_each_entry(ns, &ctrl->namespaces, list) {
+-		if (ns->disk && nvme_revalidate_disk(ns->disk)) {
+-			list_move_tail(&ns->list, &rm_list);
+-		}
+-	}
+-	up_write(&ctrl->namespaces_rwsem);
++	down_read(&ctrl->namespaces_rwsem);
++	list_for_each_entry(ns, &ctrl->namespaces, list)
++		if (ns->disk && nvme_revalidate_disk(ns->disk))
++			nvme_set_queue_dying(ns);
++	up_read(&ctrl->namespaces_rwsem);
+ 
+-	list_for_each_entry_safe(ns, next, &rm_list, list)
+-		nvme_ns_remove(ns);
++	nvme_remove_invalid_namespaces(ctrl, NVME_NSID_ALL);
+ }
+ 
+ static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
+@@ -1197,7 +1209,7 @@ static int nvme_user_cmd(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
+ 	effects = nvme_passthru_start(ctrl, ns, cmd.opcode);
+ 	status = nvme_submit_user_cmd(ns ? ns->queue : ctrl->admin_q, &c,
+ 			(void __user *)(uintptr_t)cmd.addr, cmd.data_len,
+-			(void __user *)(uintptr_t)cmd.metadata, cmd.metadata,
++			(void __user *)(uintptr_t)cmd.metadata, cmd.metadata_len,
+ 			0, &cmd.result, timeout);
+ 	nvme_passthru_end(ctrl, effects);
+ 
+@@ -3110,7 +3122,7 @@ static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl,
+ 
+ 	down_write(&ctrl->namespaces_rwsem);
+ 	list_for_each_entry_safe(ns, next, &ctrl->namespaces, list) {
+-		if (ns->head->ns_id > nsid)
++		if (ns->head->ns_id > nsid || test_bit(NVME_NS_DEAD, &ns->flags))
+ 			list_move_tail(&ns->list, &rm_list);
+ 	}
+ 	up_write(&ctrl->namespaces_rwsem);
+@@ -3488,19 +3500,9 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
+ 	if (ctrl->admin_q)
+ 		blk_mq_unquiesce_queue(ctrl->admin_q);
+ 
+-	list_for_each_entry(ns, &ctrl->namespaces, list) {
+-		/*
+-		 * Revalidating a dead namespace sets capacity to 0. This will
+-		 * end buffered writers dirtying pages that can't be synced.
+-		 */
+-		if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags))
+-			continue;
+-		revalidate_disk(ns->disk);
+-		blk_set_queue_dying(ns->queue);
++	list_for_each_entry(ns, &ctrl->namespaces, list)
++		nvme_set_queue_dying(ns);
+ 
+-		/* Forcibly unquiesce queues to avoid blocking dispatch */
+-		blk_mq_unquiesce_queue(ns->queue);
+-	}
+ 	up_read(&ctrl->namespaces_rwsem);
+ }
+ EXPORT_SYMBOL_GPL(nvme_kill_queues);
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 0483c33a3567..de9c3762a994 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2291,6 +2291,7 @@ static void nvme_remove_dead_ctrl(struct nvme_dev *dev, int status)
+ 
+ 	nvme_get_ctrl(&dev->ctrl);
+ 	nvme_dev_disable(dev, false);
++	nvme_kill_queues(&dev->ctrl);
+ 	if (!queue_work(nvme_wq, &dev->remove_work))
+ 		nvme_put_ctrl(&dev->ctrl);
+ }
+@@ -2407,7 +2408,6 @@ static void nvme_remove_dead_ctrl_work(struct work_struct *work)
+ 	struct nvme_dev *dev = container_of(work, struct nvme_dev, remove_work);
+ 	struct pci_dev *pdev = to_pci_dev(dev->dev);
+ 
+-	nvme_kill_queues(&dev->ctrl);
+ 	if (pci_get_drvdata(pdev))
+ 		device_release_driver(&pdev->dev);
+ 	nvme_put_ctrl(&dev->ctrl);
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 2181299ce8f5..d1e8aa04d313 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -734,7 +734,6 @@ out:
+ static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl,
+ 		bool remove)
+ {
+-	nvme_rdma_stop_queue(&ctrl->queues[0]);
+ 	if (remove) {
+ 		blk_cleanup_queue(ctrl->ctrl.admin_q);
+ 		nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset);
+@@ -819,7 +818,6 @@ out_free_queue:
+ static void nvme_rdma_destroy_io_queues(struct nvme_rdma_ctrl *ctrl,
+ 		bool remove)
+ {
+-	nvme_rdma_stop_io_queues(ctrl);
+ 	if (remove) {
+ 		blk_cleanup_queue(ctrl->ctrl.connect_q);
+ 		nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.tagset);
+@@ -888,9 +886,9 @@ static void nvme_rdma_free_ctrl(struct nvme_ctrl *nctrl)
+ 	list_del(&ctrl->list);
+ 	mutex_unlock(&nvme_rdma_ctrl_mutex);
+ 
+-	kfree(ctrl->queues);
+ 	nvmf_free_options(nctrl->opts);
+ free_ctrl:
++	kfree(ctrl->queues);
+ 	kfree(ctrl);
+ }
+ 
+@@ -949,6 +947,7 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
+ 	return;
+ 
+ destroy_admin:
++	nvme_rdma_stop_queue(&ctrl->queues[0]);
+ 	nvme_rdma_destroy_admin_queue(ctrl, false);
+ requeue:
+ 	dev_info(ctrl->ctrl.device, "Failed reconnect attempt %d\n",
+@@ -965,12 +964,14 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
+ 
+ 	if (ctrl->ctrl.queue_count > 1) {
+ 		nvme_stop_queues(&ctrl->ctrl);
++		nvme_rdma_stop_io_queues(ctrl);
+ 		blk_mq_tagset_busy_iter(&ctrl->tag_set,
+ 					nvme_cancel_request, &ctrl->ctrl);
+ 		nvme_rdma_destroy_io_queues(ctrl, false);
+ 	}
+ 
+ 	blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
++	nvme_rdma_stop_queue(&ctrl->queues[0]);
+ 	blk_mq_tagset_busy_iter(&ctrl->admin_tag_set,
+ 				nvme_cancel_request, &ctrl->ctrl);
+ 	nvme_rdma_destroy_admin_queue(ctrl, false);
+@@ -1720,6 +1721,7 @@ static void nvme_rdma_shutdown_ctrl(struct nvme_rdma_ctrl *ctrl, bool shutdown)
+ {
+ 	if (ctrl->ctrl.queue_count > 1) {
+ 		nvme_stop_queues(&ctrl->ctrl);
++		nvme_rdma_stop_io_queues(ctrl);
+ 		blk_mq_tagset_busy_iter(&ctrl->tag_set,
+ 					nvme_cancel_request, &ctrl->ctrl);
+ 		nvme_rdma_destroy_io_queues(ctrl, shutdown);
+@@ -1731,6 +1733,7 @@ static void nvme_rdma_shutdown_ctrl(struct nvme_rdma_ctrl *ctrl, bool shutdown)
+ 		nvme_disable_ctrl(&ctrl->ctrl, ctrl->ctrl.cap);
+ 
+ 	blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
++	nvme_rdma_stop_queue(&ctrl->queues[0]);
+ 	blk_mq_tagset_busy_iter(&ctrl->admin_tag_set,
+ 				nvme_cancel_request, &ctrl->ctrl);
+ 	blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
+@@ -1916,11 +1919,6 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
+ 		goto out_free_ctrl;
+ 	}
+ 
+-	ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_rdma_ctrl_ops,
+-				0 /* no quirks, we're perfect! */);
+-	if (ret)
+-		goto out_free_ctrl;
+-
+ 	INIT_DELAYED_WORK(&ctrl->reconnect_work,
+ 			nvme_rdma_reconnect_ctrl_work);
+ 	INIT_WORK(&ctrl->err_work, nvme_rdma_error_recovery_work);
+@@ -1934,14 +1932,19 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
+ 	ctrl->queues = kcalloc(ctrl->ctrl.queue_count, sizeof(*ctrl->queues),
+ 				GFP_KERNEL);
+ 	if (!ctrl->queues)
+-		goto out_uninit_ctrl;
++		goto out_free_ctrl;
++
++	ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_rdma_ctrl_ops,
++				0 /* no quirks, we're perfect! */);
++	if (ret)
++		goto out_kfree_queues;
+ 
+ 	changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING);
+ 	WARN_ON_ONCE(!changed);
+ 
+ 	ret = nvme_rdma_configure_admin_queue(ctrl, true);
+ 	if (ret)
+-		goto out_kfree_queues;
++		goto out_uninit_ctrl;
+ 
+ 	/* sanity check icdoff */
+ 	if (ctrl->ctrl.icdoff) {
+@@ -1996,15 +1999,16 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
+ 	return &ctrl->ctrl;
+ 
+ out_remove_admin_queue:
++	nvme_rdma_stop_queue(&ctrl->queues[0]);
+ 	nvme_rdma_destroy_admin_queue(ctrl, true);
+-out_kfree_queues:
+-	kfree(ctrl->queues);
+ out_uninit_ctrl:
+ 	nvme_uninit_ctrl(&ctrl->ctrl);
+ 	nvme_put_ctrl(&ctrl->ctrl);
+ 	if (ret > 0)
+ 		ret = -EIO;
+ 	return ERR_PTR(ret);
++out_kfree_queues:
++	kfree(ctrl->queues);
+ out_free_ctrl:
+ 	kfree(ctrl);
+ 	return ERR_PTR(ret);
+diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
+index e95424f172fd..0547d5f7d3ba 100644
+--- a/drivers/nvme/target/core.c
++++ b/drivers/nvme/target/core.c
+@@ -624,6 +624,14 @@ static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl)
+ 	}
+ 
+ 	ctrl->csts = NVME_CSTS_RDY;
++
++	/*
++	 * Controllers that are not yet enabled should not really enforce the
++	 * keep alive timeout, but we still want to track a timeout and cleanup
++	 * in case a host died before it enabled the controller.  Hence, simply
++	 * reset the keep alive timer when the controller is enabled.
++	 */
++	mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
+ }
+ 
+ static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl)
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index 1e28597138c8..2d23479b9053 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -924,6 +924,10 @@ struct nvmem_cell *nvmem_cell_get(struct device *dev, const char *cell_id)
+ 			return cell;
+ 	}
+ 
++	/* NULL cell_id only allowed for device tree; invalid otherwise */
++	if (!cell_id)
++		return ERR_PTR(-EINVAL);
++
+ 	return nvmem_cell_get_from_list(cell_id);
+ }
+ EXPORT_SYMBOL_GPL(nvmem_cell_get);
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 848f549164cd..466e3c8582f0 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -102,7 +102,7 @@ static u32 phandle_cache_mask;
+  *   - the phandle lookup overhead reduction provided by the cache
+  *     will likely be less
+  */
+-static void of_populate_phandle_cache(void)
++void of_populate_phandle_cache(void)
+ {
+ 	unsigned long flags;
+ 	u32 cache_entries;
+@@ -134,8 +134,7 @@ out:
+ 	raw_spin_unlock_irqrestore(&devtree_lock, flags);
+ }
+ 
+-#ifndef CONFIG_MODULES
+-static int __init of_free_phandle_cache(void)
++int of_free_phandle_cache(void)
+ {
+ 	unsigned long flags;
+ 
+@@ -148,6 +147,7 @@ static int __init of_free_phandle_cache(void)
+ 
+ 	return 0;
+ }
++#if !defined(CONFIG_MODULES)
+ late_initcall_sync(of_free_phandle_cache);
+ #endif
+ 
+diff --git a/drivers/of/of_private.h b/drivers/of/of_private.h
+index 891d780c076a..216175d11d3d 100644
+--- a/drivers/of/of_private.h
++++ b/drivers/of/of_private.h
+@@ -79,6 +79,8 @@ int of_resolve_phandles(struct device_node *tree);
+ #if defined(CONFIG_OF_OVERLAY)
+ void of_overlay_mutex_lock(void);
+ void of_overlay_mutex_unlock(void);
++int of_free_phandle_cache(void);
++void of_populate_phandle_cache(void);
+ #else
+ static inline void of_overlay_mutex_lock(void) {};
+ static inline void of_overlay_mutex_unlock(void) {};
+diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
+index 7baa53e5b1d7..eda57ef12fd0 100644
+--- a/drivers/of/overlay.c
++++ b/drivers/of/overlay.c
+@@ -804,6 +804,8 @@ static int of_overlay_apply(const void *fdt, struct device_node *tree,
+ 		goto err_free_overlay_changeset;
+ 	}
+ 
++	of_populate_phandle_cache();
++
+ 	ret = __of_changeset_apply_notify(&ovcs->cset);
+ 	if (ret)
+ 		pr_err("overlay changeset entry notify error %d\n", ret);
+@@ -1046,8 +1048,17 @@ int of_overlay_remove(int *ovcs_id)
+ 
+ 	list_del(&ovcs->ovcs_list);
+ 
++	/*
++	 * Disable phandle cache.  Avoids race condition that would arise
++	 * from removing cache entry when the associated node is deleted.
++	 */
++	of_free_phandle_cache();
++
+ 	ret_apply = 0;
+ 	ret = __of_changeset_revert_entries(&ovcs->cset, &ret_apply);
++
++	of_populate_phandle_cache();
++
+ 	if (ret) {
+ 		if (ret_apply)
+ 			devicetree_state_flags |= DTSF_REVERT_FAIL;
+diff --git a/drivers/pci/dwc/pcie-designware-host.c b/drivers/pci/dwc/pcie-designware-host.c
+index 6c409079d514..35a2df4ddf20 100644
+--- a/drivers/pci/dwc/pcie-designware-host.c
++++ b/drivers/pci/dwc/pcie-designware-host.c
+@@ -355,7 +355,8 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ 	resource_list_for_each_entry_safe(win, tmp, &bridge->windows) {
+ 		switch (resource_type(win->res)) {
+ 		case IORESOURCE_IO:
+-			ret = pci_remap_iospace(win->res, pp->io_base);
++			ret = devm_pci_remap_iospace(dev, win->res,
++						     pp->io_base);
+ 			if (ret) {
+ 				dev_warn(dev, "error %d: failed to map resource %pR\n",
+ 					 ret, win->res);
+diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c
+index 9abf549631b4..d0867a311f42 100644
+--- a/drivers/pci/host/pci-aardvark.c
++++ b/drivers/pci/host/pci-aardvark.c
+@@ -848,7 +848,7 @@ static int advk_pcie_parse_request_of_pci_ranges(struct advk_pcie *pcie)
+ 					     0,	0xF8000000, 0,
+ 					     lower_32_bits(res->start),
+ 					     OB_PCIE_IO);
+-			err = pci_remap_iospace(res, iobase);
++			err = devm_pci_remap_iospace(dev, res, iobase);
+ 			if (err) {
+ 				dev_warn(dev, "error %d: failed to map resource %pR\n",
+ 					 err, res);
+diff --git a/drivers/pci/host/pci-ftpci100.c b/drivers/pci/host/pci-ftpci100.c
+index 5008fd87956a..0e966219d66d 100644
+--- a/drivers/pci/host/pci-ftpci100.c
++++ b/drivers/pci/host/pci-ftpci100.c
+@@ -353,11 +353,13 @@ static int faraday_pci_setup_cascaded_irq(struct faraday_pci *p)
+ 	irq = of_irq_get(intc, 0);
+ 	if (irq <= 0) {
+ 		dev_err(p->dev, "failed to get parent IRQ\n");
++		of_node_put(intc);
+ 		return irq ?: -EINVAL;
+ 	}
+ 
+ 	p->irqdomain = irq_domain_add_linear(intc, PCI_NUM_INTX,
+ 					     &faraday_pci_irqdomain_ops, p);
++	of_node_put(intc);
+ 	if (!p->irqdomain) {
+ 		dev_err(p->dev, "failed to create Gemini PCI IRQ domain\n");
+ 		return -EINVAL;
+@@ -499,7 +501,7 @@ static int faraday_pci_probe(struct platform_device *pdev)
+ 				dev_err(dev, "illegal IO mem size\n");
+ 				return -EINVAL;
+ 			}
+-			ret = pci_remap_iospace(io, io_base);
++			ret = devm_pci_remap_iospace(dev, io, io_base);
+ 			if (ret) {
+ 				dev_warn(dev, "error %d: failed to map resource %pR\n",
+ 					 ret, io);
+diff --git a/drivers/pci/host/pci-v3-semi.c b/drivers/pci/host/pci-v3-semi.c
+index 0a4dea796663..3381bf29b59f 100644
+--- a/drivers/pci/host/pci-v3-semi.c
++++ b/drivers/pci/host/pci-v3-semi.c
+@@ -535,7 +535,7 @@ static int v3_pci_setup_resource(struct v3_pci *v3,
+ 		v3->io_bus_addr = io->start - win->offset;
+ 		dev_dbg(dev, "I/O window %pR, bus addr %pap\n",
+ 			io, &v3->io_bus_addr);
+-		ret = pci_remap_iospace(io, io_base);
++		ret = devm_pci_remap_iospace(dev, io, io_base);
+ 		if (ret) {
+ 			dev_warn(dev,
+ 				 "error %d: failed to map resource %pR\n",
+diff --git a/drivers/pci/host/pci-versatile.c b/drivers/pci/host/pci-versatile.c
+index 5b3876f5312b..df9408c4873a 100644
+--- a/drivers/pci/host/pci-versatile.c
++++ b/drivers/pci/host/pci-versatile.c
+@@ -81,7 +81,7 @@ static int versatile_pci_parse_request_of_pci_ranges(struct device *dev,
+ 
+ 		switch (resource_type(res)) {
+ 		case IORESOURCE_IO:
+-			err = pci_remap_iospace(res, iobase);
++			err = devm_pci_remap_iospace(dev, res, iobase);
+ 			if (err) {
+ 				dev_warn(dev, "error %d: failed to map resource %pR\n",
+ 					 err, res);
+diff --git a/drivers/pci/host/pci-xgene.c b/drivers/pci/host/pci-xgene.c
+index 0a0d7ee6d3c9..e256d94cafb3 100644
+--- a/drivers/pci/host/pci-xgene.c
++++ b/drivers/pci/host/pci-xgene.c
+@@ -421,7 +421,7 @@ static int xgene_pcie_map_ranges(struct xgene_pcie_port *port,
+ 		case IORESOURCE_IO:
+ 			xgene_pcie_setup_ob_reg(port, res, OMR3BARL, io_base,
+ 						res->start - window->offset);
+-			ret = pci_remap_iospace(res, io_base);
++			ret = devm_pci_remap_iospace(dev, res, io_base);
+ 			if (ret < 0)
+ 				return ret;
+ 			break;
+diff --git a/drivers/pci/host/pcie-mediatek.c b/drivers/pci/host/pcie-mediatek.c
+index a8b20c5012a9..35e9fd028da4 100644
+--- a/drivers/pci/host/pcie-mediatek.c
++++ b/drivers/pci/host/pcie-mediatek.c
+@@ -1063,7 +1063,7 @@ static int mtk_pcie_request_resources(struct mtk_pcie *pcie)
+ 	if (err < 0)
+ 		return err;
+ 
+-	pci_remap_iospace(&pcie->pio, pcie->io.start);
++	devm_pci_remap_iospace(dev, &pcie->pio, pcie->io.start);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/pci/host/pcie-xilinx-nwl.c b/drivers/pci/host/pcie-xilinx-nwl.c
+index 4839ae578711..62545e510389 100644
+--- a/drivers/pci/host/pcie-xilinx-nwl.c
++++ b/drivers/pci/host/pcie-xilinx-nwl.c
+@@ -557,7 +557,7 @@ static int nwl_pcie_init_irq_domain(struct nwl_pcie *pcie)
+ 							PCI_NUM_INTX,
+ 							&legacy_domain_ops,
+ 							pcie);
+-
++	of_node_put(legacy_intc_node);
+ 	if (!pcie->legacy_irq_domain) {
+ 		dev_err(dev, "failed to create IRQ domain\n");
+ 		return -ENOMEM;
+diff --git a/drivers/pci/host/pcie-xilinx.c b/drivers/pci/host/pcie-xilinx.c
+index 0ad188effc09..fd9c73dd347b 100644
+--- a/drivers/pci/host/pcie-xilinx.c
++++ b/drivers/pci/host/pcie-xilinx.c
+@@ -507,6 +507,7 @@ static int xilinx_pcie_init_irq_domain(struct xilinx_pcie_port *port)
+ 	port->leg_domain = irq_domain_add_linear(pcie_intc_node, PCI_NUM_INTX,
+ 						 &intx_domain_ops,
+ 						 port);
++	of_node_put(pcie_intc_node);
+ 	if (!port->leg_domain) {
+ 		dev_err(dev, "Failed to get a INTx IRQ domain\n");
+ 		return -ENODEV;
+diff --git a/drivers/pci/hotplug/pci_hotplug_core.c b/drivers/pci/hotplug/pci_hotplug_core.c
+index af92fed46ab7..fd93783a87b0 100644
+--- a/drivers/pci/hotplug/pci_hotplug_core.c
++++ b/drivers/pci/hotplug/pci_hotplug_core.c
+@@ -438,8 +438,17 @@ int __pci_hp_register(struct hotplug_slot *slot, struct pci_bus *bus,
+ 	list_add(&slot->slot_list, &pci_hotplug_slot_list);
+ 
+ 	result = fs_add_slot(pci_slot);
++	if (result)
++		goto err_list_del;
++
+ 	kobject_uevent(&pci_slot->kobj, KOBJ_ADD);
+ 	dbg("Added slot %s to the list\n", name);
++	goto out;
++
++err_list_del:
++	list_del(&slot->slot_list);
++	pci_slot->hotplug = NULL;
++	pci_destroy_slot(pci_slot);
+ out:
+ 	mutex_unlock(&pci_hp_mutex);
+ 	return result;
+diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
+index 5f892065585e..fca87a1a2b22 100644
+--- a/drivers/pci/hotplug/pciehp.h
++++ b/drivers/pci/hotplug/pciehp.h
+@@ -119,6 +119,7 @@ int pciehp_unconfigure_device(struct slot *p_slot);
+ void pciehp_queue_pushbutton_work(struct work_struct *work);
+ struct controller *pcie_init(struct pcie_device *dev);
+ int pcie_init_notification(struct controller *ctrl);
++void pcie_shutdown_notification(struct controller *ctrl);
+ int pciehp_enable_slot(struct slot *p_slot);
+ int pciehp_disable_slot(struct slot *p_slot);
+ void pcie_reenable_notification(struct controller *ctrl);
+diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
+index 44a6a63802d5..2ba59fc94827 100644
+--- a/drivers/pci/hotplug/pciehp_core.c
++++ b/drivers/pci/hotplug/pciehp_core.c
+@@ -62,6 +62,12 @@ static int reset_slot(struct hotplug_slot *slot, int probe);
+  */
+ static void release_slot(struct hotplug_slot *hotplug_slot)
+ {
++	struct slot *slot = hotplug_slot->private;
++
++	/* queued work needs hotplug_slot name */
++	cancel_delayed_work(&slot->work);
++	drain_workqueue(slot->wq);
++
+ 	kfree(hotplug_slot->ops);
+ 	kfree(hotplug_slot->info);
+ 	kfree(hotplug_slot);
+@@ -264,6 +270,7 @@ static void pciehp_remove(struct pcie_device *dev)
+ {
+ 	struct controller *ctrl = get_service_data(dev);
+ 
++	pcie_shutdown_notification(ctrl);
+ 	cleanup_slot(ctrl);
+ 	pciehp_release_ctrl(ctrl);
+ }
+diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
+index 98ea75aa32c7..6635ae13962f 100644
+--- a/drivers/pci/hotplug/pciehp_hpc.c
++++ b/drivers/pci/hotplug/pciehp_hpc.c
+@@ -545,8 +545,6 @@ static irqreturn_t pciehp_isr(int irq, void *dev_id)
+ {
+ 	struct controller *ctrl = (struct controller *)dev_id;
+ 	struct pci_dev *pdev = ctrl_dev(ctrl);
+-	struct pci_bus *subordinate = pdev->subordinate;
+-	struct pci_dev *dev;
+ 	struct slot *slot = ctrl->slot;
+ 	u16 status, events;
+ 	u8 present;
+@@ -594,14 +592,9 @@ static irqreturn_t pciehp_isr(int irq, void *dev_id)
+ 		wake_up(&ctrl->queue);
+ 	}
+ 
+-	if (subordinate) {
+-		list_for_each_entry(dev, &subordinate->devices, bus_list) {
+-			if (dev->ignore_hotplug) {
+-				ctrl_dbg(ctrl, "ignoring hotplug event %#06x (%s requested no hotplug)\n",
+-					 events, pci_name(dev));
+-				return IRQ_HANDLED;
+-			}
+-		}
++	if (pdev->ignore_hotplug) {
++		ctrl_dbg(ctrl, "ignoring hotplug event %#06x\n", events);
++		return IRQ_HANDLED;
+ 	}
+ 
+ 	/* Check Attention Button Pressed */
+@@ -771,7 +764,7 @@ int pcie_init_notification(struct controller *ctrl)
+ 	return 0;
+ }
+ 
+-static void pcie_shutdown_notification(struct controller *ctrl)
++void pcie_shutdown_notification(struct controller *ctrl)
+ {
+ 	if (ctrl->notification_enabled) {
+ 		pcie_disable_notification(ctrl);
+@@ -806,7 +799,7 @@ abort:
+ static void pcie_cleanup_slot(struct controller *ctrl)
+ {
+ 	struct slot *slot = ctrl->slot;
+-	cancel_delayed_work(&slot->work);
++
+ 	destroy_workqueue(slot->wq);
+ 	kfree(slot);
+ }
+@@ -898,7 +891,6 @@ abort:
+ 
+ void pciehp_release_ctrl(struct controller *ctrl)
+ {
+-	pcie_shutdown_notification(ctrl);
+ 	pcie_cleanup_slot(ctrl);
+ 	kfree(ctrl);
+ }
+diff --git a/drivers/pci/of.c b/drivers/pci/of.c
+index a28355c273ae..f8bcfe209464 100644
+--- a/drivers/pci/of.c
++++ b/drivers/pci/of.c
+@@ -617,7 +617,7 @@ int pci_parse_request_of_pci_ranges(struct device *dev,
+ 
+ 		switch (resource_type(res)) {
+ 		case IORESOURCE_IO:
+-			err = pci_remap_iospace(res, iobase);
++			err = devm_pci_remap_iospace(dev, res, iobase);
+ 			if (err) {
+ 				dev_warn(dev, "error %d: failed to map resource %pR\n",
+ 					 err, res);
+diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
+index 054974055ea4..41d24b273d6f 100644
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -601,13 +601,11 @@ static bool acpi_pci_need_resume(struct pci_dev *dev)
+ 	/*
+ 	 * In some cases (eg. Samsung 305V4A) leaving a bridge in suspend over
+ 	 * system-wide suspend/resume confuses the platform firmware, so avoid
+-	 * doing that, unless the bridge has a driver that should take care of
+-	 * the PM handling.  According to Section 16.1.6 of ACPI 6.2, endpoint
++	 * doing that.  According to Section 16.1.6 of ACPI 6.2, endpoint
+ 	 * devices are expected to be in D3 before invoking the S3 entry path
+ 	 * from the firmware, so they should not be affected by this issue.
+ 	 */
+-	if (pci_is_bridge(dev) && !dev->driver &&
+-	    acpi_target_system_state() != ACPI_STATE_S0)
++	if (pci_is_bridge(dev) && acpi_target_system_state() != ACPI_STATE_S0)
+ 		return true;
+ 
+ 	if (!adev || !acpi_device_power_manageable(adev))
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index dbfe7c4f3776..04ce05f9c2cb 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1163,6 +1163,33 @@ static void pci_restore_config_space(struct pci_dev *pdev)
+ 	}
+ }
+ 
++static void pci_restore_rebar_state(struct pci_dev *pdev)
++{
++	unsigned int pos, nbars, i;
++	u32 ctrl;
++
++	pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_REBAR);
++	if (!pos)
++		return;
++
++	pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
++	nbars = (ctrl & PCI_REBAR_CTRL_NBAR_MASK) >>
++		    PCI_REBAR_CTRL_NBAR_SHIFT;
++
++	for (i = 0; i < nbars; i++, pos += 8) {
++		struct resource *res;
++		int bar_idx, size;
++
++		pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
++		bar_idx = ctrl & PCI_REBAR_CTRL_BAR_IDX;
++		res = pdev->resource + bar_idx;
++		size = order_base_2((resource_size(res) >> 20) | 1) - 1;
++		ctrl &= ~PCI_REBAR_CTRL_BAR_SIZE;
++		ctrl |= size << 8;
++		pci_write_config_dword(pdev, pos + PCI_REBAR_CTRL, ctrl);
++	}
++}
++
+ /**
+  * pci_restore_state - Restore the saved state of a PCI device
+  * @dev: - PCI device that we're dealing with
+@@ -1178,6 +1205,7 @@ void pci_restore_state(struct pci_dev *dev)
+ 	pci_restore_pri_state(dev);
+ 	pci_restore_ats_state(dev);
+ 	pci_restore_vc_state(dev);
++	pci_restore_rebar_state(dev);
+ 
+ 	pci_cleanup_aer_error_status_regs(dev);
+ 
+@@ -3573,6 +3601,44 @@ void pci_unmap_iospace(struct resource *res)
+ }
+ EXPORT_SYMBOL(pci_unmap_iospace);
+ 
++static void devm_pci_unmap_iospace(struct device *dev, void *ptr)
++{
++	struct resource **res = ptr;
++
++	pci_unmap_iospace(*res);
++}
++
++/**
++ * devm_pci_remap_iospace - Managed pci_remap_iospace()
++ * @dev: Generic device to remap IO address for
++ * @res: Resource describing the I/O space
++ * @phys_addr: physical address of range to be mapped
++ *
++ * Managed pci_remap_iospace().  Map is automatically unmapped on driver
++ * detach.
++ */
++int devm_pci_remap_iospace(struct device *dev, const struct resource *res,
++			   phys_addr_t phys_addr)
++{
++	const struct resource **ptr;
++	int error;
++
++	ptr = devres_alloc(devm_pci_unmap_iospace, sizeof(*ptr), GFP_KERNEL);
++	if (!ptr)
++		return -ENOMEM;
++
++	error = pci_remap_iospace(res, phys_addr);
++	if (error) {
++		devres_free(ptr);
++	} else	{
++		*ptr = res;
++		devres_add(dev, ptr);
++	}
++
++	return error;
++}
++EXPORT_SYMBOL(devm_pci_remap_iospace);
++
+ /**
+  * devm_pci_remap_cfgspace - Managed pci_remap_cfgspace()
+  * @dev: Generic device to remap IO address for
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index d21686ad3ce5..979fd599fc66 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -1677,6 +1677,10 @@ static void pci_configure_mps(struct pci_dev *dev)
+ 	if (!pci_is_pcie(dev) || !bridge || !pci_is_pcie(bridge))
+ 		return;
+ 
++	/* MPS and MRRS fields are of type 'RsvdP' for VFs, short-circuit out */
++	if (dev->is_virtfn)
++		return;
++
+ 	mps = pcie_get_mps(dev);
+ 	p_mps = pcie_get_mps(bridge);
+ 
+diff --git a/drivers/perf/xgene_pmu.c b/drivers/perf/xgene_pmu.c
+index 6bdb1dad805f..0e31f1392a53 100644
+--- a/drivers/perf/xgene_pmu.c
++++ b/drivers/perf/xgene_pmu.c
+@@ -1463,7 +1463,7 @@ static char *xgene_pmu_dev_name(struct device *dev, u32 type, int id)
+ 	case PMU_TYPE_IOB:
+ 		return devm_kasprintf(dev, GFP_KERNEL, "iob%d", id);
+ 	case PMU_TYPE_IOB_SLOW:
+-		return devm_kasprintf(dev, GFP_KERNEL, "iob-slow%d", id);
++		return devm_kasprintf(dev, GFP_KERNEL, "iob_slow%d", id);
+ 	case PMU_TYPE_MCB:
+ 		return devm_kasprintf(dev, GFP_KERNEL, "mcb%d", id);
+ 	case PMU_TYPE_MC:
+diff --git a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
+index 35c17653c694..87618a4e90e4 100644
+--- a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
++++ b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
+@@ -460,8 +460,8 @@ static int nsp_pinmux_enable(struct pinctrl_dev *pctrl_dev,
+ 	const struct nsp_pin_function *func;
+ 	const struct nsp_pin_group *grp;
+ 
+-	if (grp_select > pinctrl->num_groups ||
+-		func_select > pinctrl->num_functions)
++	if (grp_select >= pinctrl->num_groups ||
++	    func_select >= pinctrl->num_functions)
+ 		return -EINVAL;
+ 
+ 	func = &pinctrl->functions[func_select];
+@@ -577,6 +577,8 @@ static int nsp_pinmux_probe(struct platform_device *pdev)
+ 		return PTR_ERR(pinctrl->base0);
+ 
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
++	if (!res)
++		return -EINVAL;
+ 	pinctrl->base1 = devm_ioremap_nocache(&pdev->dev, res->start,
+ 					      resource_size(res));
+ 	if (!pinctrl->base1) {
+diff --git a/drivers/pinctrl/pinctrl-ingenic.c b/drivers/pinctrl/pinctrl-ingenic.c
+index ac38a3f9f86b..4699b55a0990 100644
+--- a/drivers/pinctrl/pinctrl-ingenic.c
++++ b/drivers/pinctrl/pinctrl-ingenic.c
+@@ -536,7 +536,7 @@ static int ingenic_pinmux_gpio_set_direction(struct pinctrl_dev *pctldev,
+ 		ingenic_config_pin(jzpc, pin, JZ4770_GPIO_PAT1, input);
+ 	} else {
+ 		ingenic_config_pin(jzpc, pin, JZ4740_GPIO_SELECT, false);
+-		ingenic_config_pin(jzpc, pin, JZ4740_GPIO_DIR, input);
++		ingenic_config_pin(jzpc, pin, JZ4740_GPIO_DIR, !input);
+ 		ingenic_config_pin(jzpc, pin, JZ4740_GPIO_FUNC, false);
+ 	}
+ 
+diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
+index c52c6723374b..d3f4b6e91f49 100644
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -2170,7 +2170,7 @@ static int __init dell_init(void)
+ 		dell_fill_request(&buffer, token->location, 0, 0, 0);
+ 		ret = dell_send_request(&buffer,
+ 					CLASS_TOKEN_READ, SELECT_TOKEN_AC);
+-		if (ret)
++		if (ret == 0)
+ 			max_intensity = buffer.output[3];
+ 	}
+ 
+diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
+index 6d4012dd6922..bac1eeb3d312 100644
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -265,8 +265,10 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ 			return err;
+ 
+ 		/* full-function RTCs won't have such missing fields */
+-		if (rtc_valid_tm(&alarm->time) == 0)
++		if (rtc_valid_tm(&alarm->time) == 0) {
++			rtc_add_offset(rtc, &alarm->time);
+ 			return 0;
++		}
+ 
+ 		/* get the "after" timestamp, to detect wrapped fields */
+ 		err = rtc_read_time(rtc, &now);
+@@ -409,7 +411,6 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ 	if (err)
+ 		return err;
+ 
+-	rtc_subtract_offset(rtc, &alarm->time);
+ 	scheduled = rtc_tm_to_time64(&alarm->time);
+ 
+ 	/* Make sure we're not setting alarms in the past */
+@@ -426,6 +427,8 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ 	 * over right here, before we set the alarm.
+ 	 */
+ 
++	rtc_subtract_offset(rtc, &alarm->time);
++
+ 	if (!rtc->ops)
+ 		err = -ENODEV;
+ 	else if (!rtc->ops->set_alarm)
+@@ -467,7 +470,6 @@ int rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ 
+ 	mutex_unlock(&rtc->ops_lock);
+ 
+-	rtc_add_offset(rtc, &alarm->time);
+ 	return err;
+ }
+ EXPORT_SYMBOL_GPL(rtc_set_alarm);
+diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c
+index ea6a2d0b2894..770fa9cfc310 100644
+--- a/drivers/s390/cio/vfio_ccw_drv.c
++++ b/drivers/s390/cio/vfio_ccw_drv.c
+@@ -177,6 +177,7 @@ static int vfio_ccw_sch_event(struct subchannel *sch, int process)
+ {
+ 	struct vfio_ccw_private *private = dev_get_drvdata(&sch->dev);
+ 	unsigned long flags;
++	int rc = -EAGAIN;
+ 
+ 	spin_lock_irqsave(sch->lock, flags);
+ 	if (!device_is_registered(&sch->dev))
+@@ -187,6 +188,7 @@ static int vfio_ccw_sch_event(struct subchannel *sch, int process)
+ 
+ 	if (cio_update_schib(sch)) {
+ 		vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER);
++		rc = 0;
+ 		goto out_unlock;
+ 	}
+ 
+@@ -195,11 +197,12 @@ static int vfio_ccw_sch_event(struct subchannel *sch, int process)
+ 		private->state = private->mdev ? VFIO_CCW_STATE_IDLE :
+ 				 VFIO_CCW_STATE_STANDBY;
+ 	}
++	rc = 0;
+ 
+ out_unlock:
+ 	spin_unlock_irqrestore(sch->lock, flags);
+ 
+-	return 0;
++	return rc;
+ }
+ 
+ static struct css_device_id vfio_ccw_sch_ids[] = {
+diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
+index b7f75339683e..a05c53a44973 100644
+--- a/drivers/s390/net/qeth_core.h
++++ b/drivers/s390/net/qeth_core.h
+@@ -1003,7 +1003,7 @@ struct qeth_cmd_buffer *qeth_get_setassparms_cmd(struct qeth_card *,
+ 						 __u16, __u16,
+ 						 enum qeth_prot_versions);
+ int qeth_set_features(struct net_device *, netdev_features_t);
+-void qeth_recover_features(struct net_device *dev);
++void qeth_enable_hw_features(struct net_device *dev);
+ netdev_features_t qeth_fix_features(struct net_device *, netdev_features_t);
+ netdev_features_t qeth_features_check(struct sk_buff *skb,
+ 				      struct net_device *dev,
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index b2eebcffd502..32075de2f1e5 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -6432,28 +6432,27 @@ static int qeth_set_ipa_tso(struct qeth_card *card, int on)
+ #define QETH_HW_FEATURES (NETIF_F_RXCSUM | NETIF_F_IP_CSUM | NETIF_F_TSO)
+ 
+ /**
+- * qeth_recover_features() - Restore device features after recovery
+- * @dev:	the recovering net_device
+- *
+- * Caller must hold rtnl lock.
++ * qeth_enable_hw_features() - (Re-)Enable HW functions for device features
++ * @dev:	a net_device
+  */
+-void qeth_recover_features(struct net_device *dev)
++void qeth_enable_hw_features(struct net_device *dev)
+ {
+-	netdev_features_t features = dev->features;
+ 	struct qeth_card *card = dev->ml_priv;
++	netdev_features_t features;
+ 
++	rtnl_lock();
++	features = dev->features;
+ 	/* force-off any feature that needs an IPA sequence.
+ 	 * netdev_update_features() will restart them.
+ 	 */
+ 	dev->features &= ~QETH_HW_FEATURES;
+ 	netdev_update_features(dev);
+-
+-	if (features == dev->features)
+-		return;
+-	dev_warn(&card->gdev->dev,
+-		 "Device recovery failed to restore all offload features\n");
++	if (features != dev->features)
++		dev_warn(&card->gdev->dev,
++			 "Device recovery failed to restore all offload features\n");
++	rtnl_unlock();
+ }
+-EXPORT_SYMBOL_GPL(qeth_recover_features);
++EXPORT_SYMBOL_GPL(qeth_enable_hw_features);
+ 
+ int qeth_set_features(struct net_device *dev, netdev_features_t features)
+ {
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index 16dc8b83ca6f..525c82ba923c 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -1130,6 +1130,8 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode)
+ 		netif_carrier_off(card->dev);
+ 
+ 	qeth_set_allowed_threads(card, 0xffffffff, 0);
++
++	qeth_enable_hw_features(card->dev);
+ 	if (recover_flag == CARD_STATE_RECOVER) {
+ 		if (recovery_mode &&
+ 		    card->info.type != QETH_CARD_TYPE_OSN) {
+@@ -1141,9 +1143,6 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode)
+ 		}
+ 		/* this also sets saved unicast addresses */
+ 		qeth_l2_set_rx_mode(card->dev);
+-		rtnl_lock();
+-		qeth_recover_features(card->dev);
+-		rtnl_unlock();
+ 	}
+ 	/* let user_space know that device is online */
+ 	kobject_uevent(&gdev->dev.kobj, KOBJ_CHANGE);
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index c1a16a74aa83..8de498befde2 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -2792,6 +2792,8 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
+ 		netif_carrier_on(card->dev);
+ 	else
+ 		netif_carrier_off(card->dev);
++
++	qeth_enable_hw_features(card->dev);
+ 	if (recover_flag == CARD_STATE_RECOVER) {
+ 		rtnl_lock();
+ 		if (recovery_mode)
+@@ -2799,7 +2801,6 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
+ 		else
+ 			dev_open(card->dev);
+ 		qeth_l3_set_rx_mode(card->dev);
+-		qeth_recover_features(card->dev);
+ 		rtnl_unlock();
+ 	}
+ 	qeth_trace_features(card);
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index b92f86acb8bb..d37e8dd538f2 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -3438,11 +3438,11 @@ static void hpsa_get_enclosure_info(struct ctlr_info *h,
+ 	struct ext_report_lun_entry *rle = &rlep->LUN[rle_index];
+ 	u16 bmic_device_index = 0;
+ 
+-	bmic_device_index = GET_BMIC_DRIVE_NUMBER(&rle->lunid[0]);
+-
+-	encl_dev->sas_address =
++	encl_dev->eli =
+ 		hpsa_get_enclosure_logical_identifier(h, scsi3addr);
+ 
++	bmic_device_index = GET_BMIC_DRIVE_NUMBER(&rle->lunid[0]);
++
+ 	if (encl_dev->target == -1 || encl_dev->lun == -1) {
+ 		rc = IO_OK;
+ 		goto out;
+@@ -9695,7 +9695,24 @@ hpsa_sas_get_linkerrors(struct sas_phy *phy)
+ static int
+ hpsa_sas_get_enclosure_identifier(struct sas_rphy *rphy, u64 *identifier)
+ {
+-	*identifier = rphy->identify.sas_address;
++	struct Scsi_Host *shost = phy_to_shost(rphy);
++	struct ctlr_info *h;
++	struct hpsa_scsi_dev_t *sd;
++
++	if (!shost)
++		return -ENXIO;
++
++	h = shost_to_hba(shost);
++
++	if (!h)
++		return -ENXIO;
++
++	sd = hpsa_find_device_by_sas_rphy(h, rphy);
++	if (!sd)
++		return -ENXIO;
++
++	*identifier = sd->eli;
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
+index fb9f5e7f8209..59e023696fff 100644
+--- a/drivers/scsi/hpsa.h
++++ b/drivers/scsi/hpsa.h
+@@ -68,6 +68,7 @@ struct hpsa_scsi_dev_t {
+ #define RAID_CTLR_LUNID "\0\0\0\0\0\0\0\0"
+ 	unsigned char device_id[16];    /* from inquiry pg. 0x83 */
+ 	u64 sas_address;
++	u64 eli;			/* from report diags. */
+ 	unsigned char vendor[8];        /* bytes 8-15 of inquiry data */
+ 	unsigned char model[16];        /* bytes 16-31 of inquiry data */
+ 	unsigned char rev;		/* byte 2 of inquiry data */
+diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
+index 5015b8fbbfc5..b62239b548c4 100644
+--- a/drivers/scsi/qedf/qedf_main.c
++++ b/drivers/scsi/qedf/qedf_main.c
+@@ -3241,6 +3241,11 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
+ 
+ 	init_completion(&qedf->flogi_compl);
+ 
++	status = qed_ops->common->update_drv_state(qedf->cdev, true);
++	if (status)
++		QEDF_ERR(&(qedf->dbg_ctx),
++			"Failed to send drv state to MFW.\n");
++
+ 	memset(&link_params, 0, sizeof(struct qed_link_params));
+ 	link_params.link_up = true;
+ 	status = qed_ops->common->set_link(qedf->cdev, &link_params);
+@@ -3289,6 +3294,7 @@ static int qedf_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ static void __qedf_remove(struct pci_dev *pdev, int mode)
+ {
+ 	struct qedf_ctx *qedf;
++	int rc;
+ 
+ 	if (!pdev) {
+ 		QEDF_ERR(NULL, "pdev is NULL.\n");
+@@ -3383,6 +3389,12 @@ static void __qedf_remove(struct pci_dev *pdev, int mode)
+ 		qed_ops->common->set_power_state(qedf->cdev, PCI_D0);
+ 		pci_set_drvdata(pdev, NULL);
+ 	}
++
++	rc = qed_ops->common->update_drv_state(qedf->cdev, false);
++	if (rc)
++		QEDF_ERR(&(qedf->dbg_ctx),
++			"Failed to send drv state to MFW.\n");
++
+ 	qed_ops->common->slowpath_stop(qedf->cdev);
+ 	qed_ops->common->remove(qedf->cdev);
+ 
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index 4da3592aec0f..1e674eb6dd17 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -2075,6 +2075,7 @@ kset_free:
+ static void __qedi_remove(struct pci_dev *pdev, int mode)
+ {
+ 	struct qedi_ctx *qedi = pci_get_drvdata(pdev);
++	int rval;
+ 
+ 	if (qedi->tmf_thread) {
+ 		flush_workqueue(qedi->tmf_thread);
+@@ -2104,6 +2105,10 @@ static void __qedi_remove(struct pci_dev *pdev, int mode)
+ 	if (mode == QEDI_MODE_NORMAL)
+ 		qedi_free_iscsi_pf_param(qedi);
+ 
++	rval = qedi_ops->common->update_drv_state(qedi->cdev, false);
++	if (rval)
++		QEDI_ERR(&qedi->dbg_ctx, "Failed to send drv state to MFW\n");
++
+ 	if (!test_bit(QEDI_IN_OFFLINE, &qedi->flags)) {
+ 		qedi_ops->common->slowpath_stop(qedi->cdev);
+ 		qedi_ops->common->remove(qedi->cdev);
+@@ -2378,6 +2383,12 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
+ 		if (qedi_setup_boot_info(qedi))
+ 			QEDI_ERR(&qedi->dbg_ctx,
+ 				 "No iSCSI boot target configured\n");
++
++		rc = qedi_ops->common->update_drv_state(qedi->cdev, true);
++		if (rc)
++			QEDI_ERR(&qedi->dbg_ctx,
++				 "Failed to send drv state to MFW\n");
++
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/scsi/xen-scsifront.c b/drivers/scsi/xen-scsifront.c
+index 36f59a1be7e9..61389bdc7926 100644
+--- a/drivers/scsi/xen-scsifront.c
++++ b/drivers/scsi/xen-scsifront.c
+@@ -654,10 +654,17 @@ static int scsifront_dev_reset_handler(struct scsi_cmnd *sc)
+ static int scsifront_sdev_configure(struct scsi_device *sdev)
+ {
+ 	struct vscsifrnt_info *info = shost_priv(sdev->host);
++	int err;
+ 
+-	if (info && current == info->curr)
+-		xenbus_printf(XBT_NIL, info->dev->nodename,
++	if (info && current == info->curr) {
++		err = xenbus_printf(XBT_NIL, info->dev->nodename,
+ 			      info->dev_state_path, "%d", XenbusStateConnected);
++		if (err) {
++			xenbus_dev_error(info->dev, err,
++				"%s: writing dev_state_path", __func__);
++			return err;
++		}
++	}
+ 
+ 	return 0;
+ }
+@@ -665,10 +672,15 @@ static int scsifront_sdev_configure(struct scsi_device *sdev)
+ static void scsifront_sdev_destroy(struct scsi_device *sdev)
+ {
+ 	struct vscsifrnt_info *info = shost_priv(sdev->host);
++	int err;
+ 
+-	if (info && current == info->curr)
+-		xenbus_printf(XBT_NIL, info->dev->nodename,
++	if (info && current == info->curr) {
++		err = xenbus_printf(XBT_NIL, info->dev->nodename,
+ 			      info->dev_state_path, "%d", XenbusStateClosed);
++		if (err)
++			xenbus_dev_error(info->dev, err,
++				"%s: writing dev_state_path", __func__);
++	}
+ }
+ 
+ static struct scsi_host_template scsifront_sht = {
+@@ -1003,9 +1015,12 @@ static void scsifront_do_lun_hotplug(struct vscsifrnt_info *info, int op)
+ 
+ 			if (scsi_add_device(info->host, chn, tgt, lun)) {
+ 				dev_err(&dev->dev, "scsi_add_device\n");
+-				xenbus_printf(XBT_NIL, dev->nodename,
++				err = xenbus_printf(XBT_NIL, dev->nodename,
+ 					      info->dev_state_path,
+ 					      "%d", XenbusStateClosed);
++				if (err)
++					xenbus_dev_error(dev, err,
++						"%s: writing dev_state_path", __func__);
+ 			}
+ 			break;
+ 		case VSCSIFRONT_OP_DEL_LUN:
+@@ -1019,10 +1034,14 @@ static void scsifront_do_lun_hotplug(struct vscsifrnt_info *info, int op)
+ 			}
+ 			break;
+ 		case VSCSIFRONT_OP_READD_LUN:
+-			if (device_state == XenbusStateConnected)
+-				xenbus_printf(XBT_NIL, dev->nodename,
++			if (device_state == XenbusStateConnected) {
++				err = xenbus_printf(XBT_NIL, dev->nodename,
+ 					      info->dev_state_path,
+ 					      "%d", XenbusStateConnected);
++				if (err)
++					xenbus_dev_error(dev, err,
++						"%s: writing dev_state_path", __func__);
++			}
+ 			break;
+ 		default:
+ 			break;
+diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c
+index c4d35f32af8d..f86f0ebab06a 100644
+--- a/drivers/soc/imx/gpc.c
++++ b/drivers/soc/imx/gpc.c
+@@ -27,9 +27,16 @@
+ #define GPC_PGC_SW2ISO_SHIFT	0x8
+ #define GPC_PGC_SW_SHIFT	0x0
+ 
++#define GPC_PGC_PCI_PDN		0x200
++#define GPC_PGC_PCI_SR		0x20c
++
+ #define GPC_PGC_GPU_PDN		0x260
+ #define GPC_PGC_GPU_PUPSCR	0x264
+ #define GPC_PGC_GPU_PDNSCR	0x268
++#define GPC_PGC_GPU_SR		0x26c
++
++#define GPC_PGC_DISP_PDN	0x240
++#define GPC_PGC_DISP_SR		0x24c
+ 
+ #define GPU_VPU_PUP_REQ		BIT(1)
+ #define GPU_VPU_PDN_REQ		BIT(0)
+@@ -318,10 +325,24 @@ static const struct of_device_id imx_gpc_dt_ids[] = {
+ 	{ }
+ };
+ 
++static const struct regmap_range yes_ranges[] = {
++	regmap_reg_range(GPC_CNTR, GPC_CNTR),
++	regmap_reg_range(GPC_PGC_PCI_PDN, GPC_PGC_PCI_SR),
++	regmap_reg_range(GPC_PGC_GPU_PDN, GPC_PGC_GPU_SR),
++	regmap_reg_range(GPC_PGC_DISP_PDN, GPC_PGC_DISP_SR),
++};
++
++static const struct regmap_access_table access_table = {
++	.yes_ranges	= yes_ranges,
++	.n_yes_ranges	= ARRAY_SIZE(yes_ranges),
++};
++
+ static const struct regmap_config imx_gpc_regmap_config = {
+ 	.reg_bits = 32,
+ 	.val_bits = 32,
+ 	.reg_stride = 4,
++	.rd_table = &access_table,
++	.wr_table = &access_table,
+ 	.max_register = 0x2ac,
+ };
+ 
+diff --git a/drivers/soc/imx/gpcv2.c b/drivers/soc/imx/gpcv2.c
+index f4e3bd40c72e..6ef18cf8f243 100644
+--- a/drivers/soc/imx/gpcv2.c
++++ b/drivers/soc/imx/gpcv2.c
+@@ -39,10 +39,15 @@
+ 
+ #define GPC_M4_PU_PDN_FLG		0x1bc
+ 
+-
+-#define PGC_MIPI			4
+-#define PGC_PCIE			5
+-#define PGC_USB_HSIC			8
++/*
++ * The PGC offset values in Reference Manual
++ * (Rev. 1, 01/2018 and the older ones) GPC chapter's
++ * GPC_PGC memory map are incorrect, below offset
++ * values are from design RTL.
++ */
++#define PGC_MIPI			16
++#define PGC_PCIE			17
++#define PGC_USB_HSIC			20
+ #define GPC_PGC_CTRL(n)			(0x800 + (n) * 0x40)
+ #define GPC_PGC_SR(n)			(GPC_PGC_CTRL(n) + 0xc)
+ 
+diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
+index b0e2c4847a5d..678406e0948b 100644
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -625,7 +625,7 @@ int ptm_open_peer(struct file *master, struct tty_struct *tty, int flags)
+ 	if (tty->driver != ptm_driver)
+ 		return -EIO;
+ 
+-	fd = get_unused_fd_flags(0);
++	fd = get_unused_fd_flags(flags);
+ 	if (fd < 0) {
+ 		retval = fd;
+ 		goto err;
+diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
+index af45aa3222b5..4638d9b066be 100644
+--- a/drivers/usb/chipidea/host.c
++++ b/drivers/usb/chipidea/host.c
+@@ -124,8 +124,11 @@ static int host_start(struct ci_hdrc *ci)
+ 
+ 	hcd->power_budget = ci->platdata->power_budget;
+ 	hcd->tpl_support = ci->platdata->tpl_support;
+-	if (ci->phy || ci->usb_phy)
++	if (ci->phy || ci->usb_phy) {
+ 		hcd->skip_phy_initialization = 1;
++		if (ci->usb_phy)
++			hcd->usb_phy = ci->usb_phy;
++	}
+ 
+ 	ehci = hcd_to_ehci(hcd);
+ 	ehci->caps = ci->hw_bank.cap;
+diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
+index a666e0758a99..143309341e11 100644
+--- a/drivers/usb/dwc2/core.h
++++ b/drivers/usb/dwc2/core.h
+@@ -915,6 +915,7 @@ struct dwc2_hregs_backup {
+  * @frame_list_sz:      Frame list size
+  * @desc_gen_cache:     Kmem cache for generic descriptors
+  * @desc_hsisoc_cache:  Kmem cache for hs isochronous descriptors
++ * @unaligned_cache:    Kmem cache for DMA mode to handle non-aligned buf
+  *
+  * These are for peripheral mode:
+  *
+@@ -1061,6 +1062,8 @@ struct dwc2_hsotg {
+ 	u32 frame_list_sz;
+ 	struct kmem_cache *desc_gen_cache;
+ 	struct kmem_cache *desc_hsisoc_cache;
++	struct kmem_cache *unaligned_cache;
++#define DWC2_KMEM_UNALIGNED_BUF_SIZE 1024
+ 
+ #endif /* CONFIG_USB_DWC2_HOST || CONFIG_USB_DWC2_DUAL_ROLE */
+ 
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index 83cb5577a52f..22240f8fe4ad 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -808,6 +808,7 @@ static int dwc2_gadget_fill_isoc_desc(struct dwc2_hsotg_ep *hs_ep,
+ 	u32 index;
+ 	u32 maxsize = 0;
+ 	u32 mask = 0;
++	u8 pid = 0;
+ 
+ 	maxsize = dwc2_gadget_get_desc_params(hs_ep, &mask);
+ 	if (len > maxsize) {
+@@ -853,7 +854,11 @@ static int dwc2_gadget_fill_isoc_desc(struct dwc2_hsotg_ep *hs_ep,
+ 			 ((len << DEV_DMA_NBYTES_SHIFT) & mask));
+ 
+ 	if (hs_ep->dir_in) {
+-		desc->status |= ((hs_ep->mc << DEV_DMA_ISOC_PID_SHIFT) &
++		if (len)
++			pid = DIV_ROUND_UP(len, hs_ep->ep.maxpacket);
++		else
++			pid = 1;
++		desc->status |= ((pid << DEV_DMA_ISOC_PID_SHIFT) &
+ 				 DEV_DMA_ISOC_PID_MASK) |
+ 				((len % hs_ep->ep.maxpacket) ?
+ 				 DEV_DMA_SHORT : 0) |
+@@ -892,6 +897,7 @@ static void dwc2_gadget_start_isoc_ddma(struct dwc2_hsotg_ep *hs_ep)
+ 	u32 ctrl;
+ 
+ 	if (list_empty(&hs_ep->queue)) {
++		hs_ep->target_frame = TARGET_FRAME_INITIAL;
+ 		dev_dbg(hsotg->dev, "%s: No requests in queue\n", __func__);
+ 		return;
+ 	}
+@@ -4720,9 +4726,11 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg)
+ 	}
+ 
+ 	ret = usb_add_gadget_udc(dev, &hsotg->gadget);
+-	if (ret)
++	if (ret) {
++		dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep,
++					   hsotg->ctrl_req);
+ 		return ret;
+-
++	}
+ 	dwc2_hsotg_dump(hsotg);
+ 
+ 	return 0;
+@@ -4735,6 +4743,7 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg)
+ int dwc2_hsotg_remove(struct dwc2_hsotg *hsotg)
+ {
+ 	usb_del_gadget_udc(&hsotg->gadget);
++	dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep, hsotg->ctrl_req);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 3a5f0005fae5..0d66ec3f59a2 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -1567,11 +1567,20 @@ static void dwc2_hc_start_transfer(struct dwc2_hsotg *hsotg,
+ 	}
+ 
+ 	if (hsotg->params.host_dma) {
+-		dwc2_writel((u32)chan->xfer_dma,
+-			    hsotg->regs + HCDMA(chan->hc_num));
++		dma_addr_t dma_addr;
++
++		if (chan->align_buf) {
++			if (dbg_hc(chan))
++				dev_vdbg(hsotg->dev, "align_buf\n");
++			dma_addr = chan->align_buf;
++		} else {
++			dma_addr = chan->xfer_dma;
++		}
++		dwc2_writel((u32)dma_addr, hsotg->regs + HCDMA(chan->hc_num));
++
+ 		if (dbg_hc(chan))
+ 			dev_vdbg(hsotg->dev, "Wrote %08lx to HCDMA(%d)\n",
+-				 (unsigned long)chan->xfer_dma, chan->hc_num);
++				 (unsigned long)dma_addr, chan->hc_num);
+ 	}
+ 
+ 	/* Start the split */
+@@ -2625,6 +2634,35 @@ static void dwc2_hc_init_xfer(struct dwc2_hsotg *hsotg,
+ 	}
+ }
+ 
++static int dwc2_alloc_split_dma_aligned_buf(struct dwc2_hsotg *hsotg,
++					    struct dwc2_qh *qh,
++					    struct dwc2_host_chan *chan)
++{
++	if (!hsotg->unaligned_cache ||
++	    chan->max_packet > DWC2_KMEM_UNALIGNED_BUF_SIZE)
++		return -ENOMEM;
++
++	if (!qh->dw_align_buf) {
++		qh->dw_align_buf = kmem_cache_alloc(hsotg->unaligned_cache,
++						    GFP_ATOMIC | GFP_DMA);
++		if (!qh->dw_align_buf)
++			return -ENOMEM;
++	}
++
++	qh->dw_align_buf_dma = dma_map_single(hsotg->dev, qh->dw_align_buf,
++					      DWC2_KMEM_UNALIGNED_BUF_SIZE,
++					      DMA_FROM_DEVICE);
++
++	if (dma_mapping_error(hsotg->dev, qh->dw_align_buf_dma)) {
++		dev_err(hsotg->dev, "can't map align_buf\n");
++		chan->align_buf = 0;
++		return -EINVAL;
++	}
++
++	chan->align_buf = qh->dw_align_buf_dma;
++	return 0;
++}
++
+ #define DWC2_USB_DMA_ALIGN 4
+ 
+ static void dwc2_free_dma_aligned_buffer(struct urb *urb)
+@@ -2804,6 +2842,32 @@ static int dwc2_assign_and_init_hc(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh)
+ 	/* Set the transfer attributes */
+ 	dwc2_hc_init_xfer(hsotg, chan, qtd);
+ 
++	/* For non-dword aligned buffers */
++	if (hsotg->params.host_dma && qh->do_split &&
++	    chan->ep_is_in && (chan->xfer_dma & 0x3)) {
++		dev_vdbg(hsotg->dev, "Non-aligned buffer\n");
++		if (dwc2_alloc_split_dma_aligned_buf(hsotg, qh, chan)) {
++			dev_err(hsotg->dev,
++				"Failed to allocate memory to handle non-aligned buffer\n");
++			/* Add channel back to free list */
++			chan->align_buf = 0;
++			chan->multi_count = 0;
++			list_add_tail(&chan->hc_list_entry,
++				      &hsotg->free_hc_list);
++			qtd->in_process = 0;
++			qh->channel = NULL;
++			return -ENOMEM;
++		}
++	} else {
++		/*
++		 * We assume that DMA is always aligned in non-split
++		 * case or split out case. Warn if not.
++		 */
++		WARN_ON_ONCE(hsotg->params.host_dma &&
++			     (chan->xfer_dma & 0x3));
++		chan->align_buf = 0;
++	}
++
+ 	if (chan->ep_type == USB_ENDPOINT_XFER_INT ||
+ 	    chan->ep_type == USB_ENDPOINT_XFER_ISOC)
+ 		/*
+@@ -5248,6 +5312,19 @@ int dwc2_hcd_init(struct dwc2_hsotg *hsotg)
+ 		}
+ 	}
+ 
++	if (hsotg->params.host_dma) {
++		/*
++		 * Create kmem caches to handle non-aligned buffer
++		 * in Buffer DMA mode.
++		 */
++		hsotg->unaligned_cache = kmem_cache_create("dwc2-unaligned-dma",
++						DWC2_KMEM_UNALIGNED_BUF_SIZE, 4,
++						SLAB_CACHE_DMA, NULL);
++		if (!hsotg->unaligned_cache)
++			dev_err(hsotg->dev,
++				"unable to create dwc2 unaligned cache\n");
++	}
++
+ 	hsotg->otg_port = 1;
+ 	hsotg->frame_list = NULL;
+ 	hsotg->frame_list_dma = 0;
+@@ -5282,8 +5359,9 @@ int dwc2_hcd_init(struct dwc2_hsotg *hsotg)
+ 	return 0;
+ 
+ error4:
+-	kmem_cache_destroy(hsotg->desc_gen_cache);
++	kmem_cache_destroy(hsotg->unaligned_cache);
+ 	kmem_cache_destroy(hsotg->desc_hsisoc_cache);
++	kmem_cache_destroy(hsotg->desc_gen_cache);
+ error3:
+ 	dwc2_hcd_release(hsotg);
+ error2:
+@@ -5324,8 +5402,9 @@ void dwc2_hcd_remove(struct dwc2_hsotg *hsotg)
+ 	usb_remove_hcd(hcd);
+ 	hsotg->priv = NULL;
+ 
+-	kmem_cache_destroy(hsotg->desc_gen_cache);
++	kmem_cache_destroy(hsotg->unaligned_cache);
+ 	kmem_cache_destroy(hsotg->desc_hsisoc_cache);
++	kmem_cache_destroy(hsotg->desc_gen_cache);
+ 
+ 	dwc2_hcd_release(hsotg);
+ 	usb_put_hcd(hcd);
+@@ -5437,7 +5516,7 @@ int dwc2_host_enter_hibernation(struct dwc2_hsotg *hsotg)
+ 	dwc2_writel(hprt0, hsotg->regs + HPRT0);
+ 
+ 	/* Wait for the HPRT0.PrtSusp register field to be set */
+-	if (dwc2_hsotg_wait_bit_set(hsotg, HPRT0, HPRT0_SUSP, 300))
++	if (dwc2_hsotg_wait_bit_set(hsotg, HPRT0, HPRT0_SUSP, 3000))
+ 		dev_warn(hsotg->dev, "Suspend wasn't generated\n");
+ 
+ 	/*
+@@ -5618,6 +5697,8 @@ int dwc2_host_exit_hibernation(struct dwc2_hsotg *hsotg, int rem_wakeup,
+ 		return ret;
+ 	}
+ 
++	dwc2_hcd_rem_wakeup(hsotg);
++
+ 	hsotg->hibernated = 0;
+ 	hsotg->bus_suspended = 0;
+ 	hsotg->lx_state = DWC2_L0;
+diff --git a/drivers/usb/dwc2/hcd.h b/drivers/usb/dwc2/hcd.h
+index 96a9da5fb202..5b5b9e6f2feb 100644
+--- a/drivers/usb/dwc2/hcd.h
++++ b/drivers/usb/dwc2/hcd.h
+@@ -76,6 +76,8 @@ struct dwc2_qh;
+  *                      (micro)frame
+  * @xfer_buf:           Pointer to current transfer buffer position
+  * @xfer_dma:           DMA address of xfer_buf
++ * @align_buf:          In Buffer DMA mode this will be used if xfer_buf is not
++ *                      DWORD aligned
+  * @xfer_len:           Total number of bytes to transfer
+  * @xfer_count:         Number of bytes transferred so far
+  * @start_pkt_count:    Packet count at start of transfer
+@@ -133,6 +135,7 @@ struct dwc2_host_chan {
+ 
+ 	u8 *xfer_buf;
+ 	dma_addr_t xfer_dma;
++	dma_addr_t align_buf;
+ 	u32 xfer_len;
+ 	u32 xfer_count;
+ 	u16 start_pkt_count;
+@@ -303,6 +306,9 @@ struct dwc2_hs_transfer_time {
+  *                           is tightly packed.
+  * @ls_duration_us:     Duration on the low speed bus schedule.
+  * @ntd:                Actual number of transfer descriptors in a list
++ * @dw_align_buf:       Used instead of original buffer if its physical address
++ *                      is not dword-aligned
++ * @dw_align_buf_dma:   DMA address for dw_align_buf
+  * @qtd_list:           List of QTDs for this QH
+  * @channel:            Host channel currently processing transfers for this QH
+  * @qh_list_entry:      Entry for QH in either the periodic or non-periodic
+@@ -350,6 +356,8 @@ struct dwc2_qh {
+ 	struct dwc2_hs_transfer_time hs_transfers[DWC2_HS_SCHEDULE_UFRAMES];
+ 	u32 ls_start_schedule_slice;
+ 	u16 ntd;
++	u8 *dw_align_buf;
++	dma_addr_t dw_align_buf_dma;
+ 	struct list_head qtd_list;
+ 	struct dwc2_host_chan *channel;
+ 	struct list_head qh_list_entry;
+diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
+index a5dfd9d8bd9a..9751785ec561 100644
+--- a/drivers/usb/dwc2/hcd_intr.c
++++ b/drivers/usb/dwc2/hcd_intr.c
+@@ -930,14 +930,21 @@ static int dwc2_xfercomp_isoc_split_in(struct dwc2_hsotg *hsotg,
+ 	frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+ 	len = dwc2_get_actual_xfer_length(hsotg, chan, chnum, qtd,
+ 					  DWC2_HC_XFER_COMPLETE, NULL);
+-	if (!len) {
++	if (!len && !qtd->isoc_split_offset) {
+ 		qtd->complete_split = 0;
+-		qtd->isoc_split_offset = 0;
+ 		return 0;
+ 	}
+ 
+ 	frame_desc->actual_length += len;
+ 
++	if (chan->align_buf) {
++		dev_vdbg(hsotg->dev, "non-aligned buffer\n");
++		dma_unmap_single(hsotg->dev, chan->qh->dw_align_buf_dma,
++				 DWC2_KMEM_UNALIGNED_BUF_SIZE, DMA_FROM_DEVICE);
++		memcpy(qtd->urb->buf + (chan->xfer_dma - qtd->urb->dma),
++		       chan->qh->dw_align_buf, len);
++	}
++
+ 	qtd->isoc_split_offset += len;
+ 
+ 	hctsiz = dwc2_readl(hsotg->regs + HCTSIZ(chnum));
+diff --git a/drivers/usb/dwc2/hcd_queue.c b/drivers/usb/dwc2/hcd_queue.c
+index 6baa75da7907..7995106c98e8 100644
+--- a/drivers/usb/dwc2/hcd_queue.c
++++ b/drivers/usb/dwc2/hcd_queue.c
+@@ -1695,6 +1695,9 @@ void dwc2_hcd_qh_free(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh)
+ 
+ 	if (qh->desc_list)
+ 		dwc2_hcd_qh_free_ddma(hsotg, qh);
++	else if (hsotg->unaligned_cache && qh->dw_align_buf)
++		kmem_cache_free(hsotg->unaligned_cache, qh->dw_align_buf);
++
+ 	kfree(qh);
+ }
+ 
+diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
+index cb2ee96fd3e8..048922d549dd 100644
+--- a/drivers/usb/dwc3/dwc3-of-simple.c
++++ b/drivers/usb/dwc3/dwc3-of-simple.c
+@@ -165,8 +165,9 @@ static int dwc3_of_simple_remove(struct platform_device *pdev)
+ 
+ 	reset_control_put(simple->resets);
+ 
+-	pm_runtime_put_sync(dev);
+ 	pm_runtime_disable(dev);
++	pm_runtime_put_noidle(dev);
++	pm_runtime_set_suspended(dev);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index c961a94d136b..f57e7c94b8e5 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -34,6 +34,7 @@
+ #define PCI_DEVICE_ID_INTEL_GLK			0x31aa
+ #define PCI_DEVICE_ID_INTEL_CNPLP		0x9dee
+ #define PCI_DEVICE_ID_INTEL_CNPH		0xa36e
++#define PCI_DEVICE_ID_INTEL_ICLLP		0x34ee
+ 
+ #define PCI_INTEL_BXT_DSM_GUID		"732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
+ #define PCI_INTEL_BXT_FUNC_PMU_PWR	4
+@@ -289,6 +290,7 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_GLK), },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPLP), },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPH), },
++	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICLLP), },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
+ 	{  }	/* Terminating Entry */
+ };
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index 330c591fd7d6..afd6c977beec 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -1719,6 +1719,8 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+ 		 */
+ 		if (w_value && !f->get_alt)
+ 			break;
++
++		spin_lock(&cdev->lock);
+ 		value = f->set_alt(f, w_index, w_value);
+ 		if (value == USB_GADGET_DELAYED_STATUS) {
+ 			DBG(cdev,
+@@ -1728,6 +1730,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+ 			DBG(cdev, "delayed_status count %d\n",
+ 					cdev->delayed_status);
+ 		}
++		spin_unlock(&cdev->lock);
+ 		break;
+ 	case USB_REQ_GET_INTERFACE:
+ 		if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 7e57439ac282..32fdc79cd73b 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -215,6 +215,7 @@ struct ffs_io_data {
+ 
+ 	struct mm_struct *mm;
+ 	struct work_struct work;
++	struct work_struct cancellation_work;
+ 
+ 	struct usb_ep *ep;
+ 	struct usb_request *req;
+@@ -1072,22 +1073,31 @@ ffs_epfile_open(struct inode *inode, struct file *file)
+ 	return 0;
+ }
+ 
++static void ffs_aio_cancel_worker(struct work_struct *work)
++{
++	struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,
++						   cancellation_work);
++
++	ENTER();
++
++	usb_ep_dequeue(io_data->ep, io_data->req);
++}
++
+ static int ffs_aio_cancel(struct kiocb *kiocb)
+ {
+ 	struct ffs_io_data *io_data = kiocb->private;
+-	struct ffs_epfile *epfile = kiocb->ki_filp->private_data;
++	struct ffs_data *ffs = io_data->ffs;
+ 	int value;
+ 
+ 	ENTER();
+ 
+-	spin_lock_irq(&epfile->ffs->eps_lock);
+-
+-	if (likely(io_data && io_data->ep && io_data->req))
+-		value = usb_ep_dequeue(io_data->ep, io_data->req);
+-	else
++	if (likely(io_data && io_data->ep && io_data->req)) {
++		INIT_WORK(&io_data->cancellation_work, ffs_aio_cancel_worker);
++		queue_work(ffs->io_completion_wq, &io_data->cancellation_work);
++		value = -EINPROGRESS;
++	} else {
+ 		value = -EINVAL;
+-
+-	spin_unlock_irq(&epfile->ffs->eps_lock);
++	}
+ 
+ 	return value;
+ }
+diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c
+index c359bae7b754..18925c0dde59 100644
+--- a/drivers/usb/host/xhci-dbgcap.c
++++ b/drivers/usb/host/xhci-dbgcap.c
+@@ -507,16 +507,18 @@ static int xhci_do_dbc_start(struct xhci_hcd *xhci)
+ 	return 0;
+ }
+ 
+-static void xhci_do_dbc_stop(struct xhci_hcd *xhci)
++static int xhci_do_dbc_stop(struct xhci_hcd *xhci)
+ {
+ 	struct xhci_dbc		*dbc = xhci->dbc;
+ 
+ 	if (dbc->state == DS_DISABLED)
+-		return;
++		return -1;
+ 
+ 	writel(0, &dbc->regs->control);
+ 	xhci_dbc_mem_cleanup(xhci);
+ 	dbc->state = DS_DISABLED;
++
++	return 0;
+ }
+ 
+ static int xhci_dbc_start(struct xhci_hcd *xhci)
+@@ -543,6 +545,7 @@ static int xhci_dbc_start(struct xhci_hcd *xhci)
+ 
+ static void xhci_dbc_stop(struct xhci_hcd *xhci)
+ {
++	int ret;
+ 	unsigned long		flags;
+ 	struct xhci_dbc		*dbc = xhci->dbc;
+ 	struct dbc_port		*port = &dbc->port;
+@@ -555,10 +558,11 @@ static void xhci_dbc_stop(struct xhci_hcd *xhci)
+ 		xhci_dbc_tty_unregister_device(xhci);
+ 
+ 	spin_lock_irqsave(&dbc->lock, flags);
+-	xhci_do_dbc_stop(xhci);
++	ret = xhci_do_dbc_stop(xhci);
+ 	spin_unlock_irqrestore(&dbc->lock, flags);
+ 
+-	pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller);
++	if (!ret)
++		pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller);
+ }
+ 
+ static void
+diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
+index 2c076ea80522..1ed87cee8d21 100644
+--- a/drivers/usb/host/xhci-tegra.c
++++ b/drivers/usb/host/xhci-tegra.c
+@@ -479,7 +479,7 @@ static void tegra_xusb_mbox_handle(struct tegra_xusb *tegra,
+ 	unsigned long mask;
+ 	unsigned int port;
+ 	bool idle, enable;
+-	int err;
++	int err = 0;
+ 
+ 	memset(&rsp, 0, sizeof(rsp));
+ 
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 5fb4319d7fd1..ae56eac34fc7 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1014,8 +1014,13 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ 		command = readl(&xhci->op_regs->command);
+ 		command |= CMD_CRS;
+ 		writel(command, &xhci->op_regs->command);
++		/*
++		 * Some controllers take up to 55+ ms to complete the controller
++		 * restore so setting the timeout to 100ms. Xhci specification
++		 * doesn't mention any timeout value.
++		 */
+ 		if (xhci_handshake(&xhci->op_regs->status,
+-			      STS_RESTORE, 0, 10 * 1000)) {
++			      STS_RESTORE, 0, 100 * 1000)) {
+ 			xhci_warn(xhci, "WARN: xHC restore state timeout\n");
+ 			spin_unlock_irq(&xhci->lock);
+ 			return -ETIMEDOUT;
+diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
+index 9b29b67191bc..58b6598f8e10 100644
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -2543,7 +2543,8 @@ static void run_state_machine(struct tcpm_port *port)
+ 		    tcpm_port_is_sink(port) &&
+ 		    time_is_after_jiffies(port->delayed_runtime)) {
+ 			tcpm_set_state(port, SNK_DISCOVERY,
+-				       port->delayed_runtime - jiffies);
++				       jiffies_to_msecs(port->delayed_runtime -
++							jiffies));
+ 			break;
+ 		}
+ 		tcpm_set_state(port, unattached_state(port), 0);
+diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
+index 8835065029d3..c93d8ef8df34 100644
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -289,8 +289,15 @@ static void sysrq_handler(struct xenbus_watch *watch, const char *path,
+ 		return;
+ 	}
+ 
+-	if (sysrq_key != '\0')
+-		xenbus_printf(xbt, "control", "sysrq", "%c", '\0');
++	if (sysrq_key != '\0') {
++		err = xenbus_printf(xbt, "control", "sysrq", "%c", '\0');
++		if (err) {
++			pr_err("%s: Error %d writing sysrq in control/sysrq\n",
++			       __func__, err);
++			xenbus_transaction_end(xbt, 1);
++			return;
++		}
++	}
+ 
+ 	err = xenbus_transaction_end(xbt, 0);
+ 	if (err == -EAGAIN)
+@@ -342,7 +349,12 @@ static int setup_shutdown_watcher(void)
+ 			continue;
+ 		snprintf(node, FEATURE_PATH_SIZE, "feature-%s",
+ 			 shutdown_handlers[idx].command);
+-		xenbus_printf(XBT_NIL, "control", node, "%u", 1);
++		err = xenbus_printf(XBT_NIL, "control", node, "%u", 1);
++		if (err) {
++			pr_err("%s: Error %d writing %s\n", __func__,
++				err, node);
++			return err;
++		}
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
+index 7bc88fd43cfc..e2f3e8b0fba9 100644
+--- a/drivers/xen/xen-scsiback.c
++++ b/drivers/xen/xen-scsiback.c
+@@ -1012,6 +1012,7 @@ static void scsiback_do_add_lun(struct vscsibk_info *info, const char *state,
+ {
+ 	struct v2p_entry *entry;
+ 	unsigned long flags;
++	int err;
+ 
+ 	if (try) {
+ 		spin_lock_irqsave(&info->v2p_lock, flags);
+@@ -1027,8 +1028,11 @@ static void scsiback_do_add_lun(struct vscsibk_info *info, const char *state,
+ 			scsiback_del_translation_entry(info, vir);
+ 		}
+ 	} else if (!try) {
+-		xenbus_printf(XBT_NIL, info->dev->nodename, state,
++		err = xenbus_printf(XBT_NIL, info->dev->nodename, state,
+ 			      "%d", XenbusStateClosed);
++		if (err)
++			xenbus_dev_error(info->dev, err,
++				"%s: writing %s", __func__, state);
+ 	}
+ }
+ 
+@@ -1067,8 +1071,11 @@ static void scsiback_do_1lun_hotplug(struct vscsibk_info *info, int op,
+ 	snprintf(str, sizeof(str), "vscsi-devs/%s/p-dev", ent);
+ 	val = xenbus_read(XBT_NIL, dev->nodename, str, NULL);
+ 	if (IS_ERR(val)) {
+-		xenbus_printf(XBT_NIL, dev->nodename, state,
++		err = xenbus_printf(XBT_NIL, dev->nodename, state,
+ 			      "%d", XenbusStateClosed);
++		if (err)
++			xenbus_dev_error(info->dev, err,
++				"%s: writing %s", __func__, state);
+ 		return;
+ 	}
+ 	strlcpy(phy, val, VSCSI_NAMELEN);
+@@ -1079,8 +1086,11 @@ static void scsiback_do_1lun_hotplug(struct vscsibk_info *info, int op,
+ 	err = xenbus_scanf(XBT_NIL, dev->nodename, str, "%u:%u:%u:%u",
+ 			   &vir.hst, &vir.chn, &vir.tgt, &vir.lun);
+ 	if (XENBUS_EXIST_ERR(err)) {
+-		xenbus_printf(XBT_NIL, dev->nodename, state,
++		err = xenbus_printf(XBT_NIL, dev->nodename, state,
+ 			      "%d", XenbusStateClosed);
++		if (err)
++			xenbus_dev_error(info->dev, err,
++				"%s: writing %s", __func__, state);
+ 		return;
+ 	}
+ 
+diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
+index ad8a69ba7f13..7391b123a17a 100644
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -1151,11 +1151,6 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check)
+ 		return ret;
+ 	}
+ 
+-	if (sctx->is_dev_replace && !is_metadata && !have_csum) {
+-		sblocks_for_recheck = NULL;
+-		goto nodatasum_case;
+-	}
+-
+ 	/*
+ 	 * read all mirrors one after the other. This includes to
+ 	 * re-read the extent or metadata block that failed (that was
+@@ -1268,13 +1263,19 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check)
+ 		goto out;
+ 	}
+ 
+-	if (!is_metadata && !have_csum) {
++	/*
++	 * NOTE: Even for nodatasum case, it's still possible that it's a
++	 * compressed data extent, thus scrub_fixup_nodatasum(), which write
++	 * inode page cache onto disk, could cause serious data corruption.
++	 *
++	 * So here we could only read from disk, and hope our recovery could
++	 * reach disk before the newer write.
++	 */
++	if (0 && !is_metadata && !have_csum) {
+ 		struct scrub_fixup_nodatasum *fixup_nodatasum;
+ 
+ 		WARN_ON(sctx->is_dev_replace);
+ 
+-nodatasum_case:
+-
+ 		/*
+ 		 * !is_metadata and !have_csum, this means that the data
+ 		 * might not be COWed, that it might be modified
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index ae056927080d..6b6868d0cdcc 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -1123,6 +1123,7 @@ static struct dentry *splice_dentry(struct dentry *dn, struct inode *in)
+ 	if (IS_ERR(realdn)) {
+ 		pr_err("splice_dentry error %ld %p inode %p ino %llx.%llx\n",
+ 		       PTR_ERR(realdn), dn, in, ceph_vinop(in));
++		dput(dn);
+ 		dn = realdn; /* note realdn contains the error */
+ 		goto out;
+ 	} else if (realdn) {
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 71013c5268b9..9c8d5f12546b 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -923,8 +923,9 @@ SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data)
+ 	req->PreviousSessionId = sess_data->previous_session;
+ 
+ 	req->Flags = 0; /* MBZ */
+-	/* to enable echos and oplocks */
+-	req->sync_hdr.CreditRequest = cpu_to_le16(3);
++
++	/* enough to enable echos and oplocks and one max size write */
++	req->sync_hdr.CreditRequest = cpu_to_le16(130);
+ 
+ 	/* only one of SMB2 signing flags may be set in SMB2 request */
+ 	if (server->sign)
+diff --git a/fs/exec.c b/fs/exec.c
+index 183059c427b9..7d00f8ceba3f 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -290,7 +290,7 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
+ 	struct vm_area_struct *vma = NULL;
+ 	struct mm_struct *mm = bprm->mm;
+ 
+-	bprm->vma = vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++	bprm->vma = vma = vm_area_alloc(mm);
+ 	if (!vma)
+ 		return -ENOMEM;
+ 
+@@ -298,7 +298,6 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
+ 		err = -EINTR;
+ 		goto err_free;
+ 	}
+-	vma->vm_mm = mm;
+ 
+ 	/*
+ 	 * Place the stack at the largest stack address the architecture
+@@ -311,7 +310,6 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
+ 	vma->vm_start = vma->vm_end - PAGE_SIZE;
+ 	vma->vm_flags = VM_SOFTDIRTY | VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
+ 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+-	INIT_LIST_HEAD(&vma->anon_vma_chain);
+ 
+ 	err = insert_vm_struct(mm, vma);
+ 	if (err)
+@@ -326,7 +324,7 @@ err:
+ 	up_write(&mm->mmap_sem);
+ err_free:
+ 	bprm->vma = NULL;
+-	kmem_cache_free(vm_area_cachep, vma);
++	vm_area_free(vma);
+ 	return err;
+ }
+ 
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 39187e7b3748..050838f03328 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -14,6 +14,7 @@
+ #include <linux/log2.h>
+ #include <linux/module.h>
+ #include <linux/slab.h>
++#include <linux/nospec.h>
+ #include <linux/backing-dev.h>
+ #include <trace/events/ext4.h>
+ 
+@@ -2140,7 +2141,8 @@ ext4_mb_regular_allocator(struct ext4_allocation_context *ac)
+ 		 * This should tell if fe_len is exactly power of 2
+ 		 */
+ 		if ((ac->ac_g_ex.fe_len & (~(1 << (i - 1)))) == 0)
+-			ac->ac_2order = i - 1;
++			ac->ac_2order = array_index_nospec(i - 1,
++							   sb->s_blocksize_bits + 2);
+ 	}
+ 
+ 	/* if stream allocation is enabled, use global goal */
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 2d94eb9cd386..0f6291675123 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -8620,6 +8620,8 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
+ 
+ 	dprintk("--> %s tk_status => %d\n", __func__, -task->tk_status);
+ 
++	nfs4_sequence_free_slot(&lgp->res.seq_res);
++
+ 	switch (nfs4err) {
+ 	case 0:
+ 		goto out;
+@@ -8684,7 +8686,6 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
+ 		goto out;
+ 	}
+ 
+-	nfs4_sequence_free_slot(&lgp->res.seq_res);
+ 	err = nfs4_handle_exception(server, nfs4err, exception);
+ 	if (!status) {
+ 		if (exception->retry)
+@@ -8810,20 +8811,22 @@ nfs4_proc_layoutget(struct nfs4_layoutget *lgp, long *timeout, gfp_t gfp_flags)
+ 	if (IS_ERR(task))
+ 		return ERR_CAST(task);
+ 	status = rpc_wait_for_completion_task(task);
+-	if (status == 0) {
++	if (status != 0)
++		goto out;
++
++	/* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
++	if (task->tk_status < 0 || lgp->res.layoutp->len == 0) {
+ 		status = nfs4_layoutget_handle_exception(task, lgp, &exception);
+ 		*timeout = exception.timeout;
+-	}
+-
++	} else
++		lseg = pnfs_layout_process(lgp);
++out:
+ 	trace_nfs4_layoutget(lgp->args.ctx,
+ 			&lgp->args.range,
+ 			&lgp->res.range,
+ 			&lgp->res.stateid,
+ 			status);
+ 
+-	/* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
+-	if (status == 0 && lgp->res.layoutp->len)
+-		lseg = pnfs_layout_process(lgp);
+ 	rpc_put_task(task);
+ 	dprintk("<-- %s status=%d\n", __func__, status);
+ 	if (status)
+diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
+index 5dbf5324bdda..8fb367c5bdd7 100644
+--- a/fs/reiserfs/xattr.c
++++ b/fs/reiserfs/xattr.c
+@@ -792,8 +792,10 @@ static int listxattr_filler(struct dir_context *ctx, const char *name,
+ 			return 0;
+ 		size = namelen + 1;
+ 		if (b->buf) {
+-			if (size > b->size)
++			if (b->pos + size > b->size) {
++				b->pos = -ERANGE;
+ 				return -ERANGE;
++			}
+ 			memcpy(b->buf + b->pos, name, namelen);
+ 			b->buf[b->pos + namelen] = 0;
+ 		}
+diff --git a/include/linux/fsl/guts.h b/include/linux/fsl/guts.h
+index 3efa3b861d44..941b11811f85 100644
+--- a/include/linux/fsl/guts.h
++++ b/include/linux/fsl/guts.h
+@@ -16,6 +16,7 @@
+ #define __FSL_GUTS_H__
+ 
+ #include <linux/types.h>
++#include <linux/io.h>
+ 
+ /**
+  * Global Utility Registers.
+diff --git a/include/linux/kthread.h b/include/linux/kthread.h
+index 2803264c512f..c1961761311d 100644
+--- a/include/linux/kthread.h
++++ b/include/linux/kthread.h
+@@ -62,7 +62,6 @@ void *kthread_probe_data(struct task_struct *k);
+ int kthread_park(struct task_struct *k);
+ void kthread_unpark(struct task_struct *k);
+ void kthread_parkme(void);
+-void kthread_park_complete(struct task_struct *k);
+ 
+ int kthreadd(void *unused);
+ extern struct task_struct *kthreadd_task;
+diff --git a/include/linux/marvell_phy.h b/include/linux/marvell_phy.h
+index 4f5f8c21e283..1eb6f244588d 100644
+--- a/include/linux/marvell_phy.h
++++ b/include/linux/marvell_phy.h
+@@ -27,6 +27,8 @@
+  */
+ #define MARVELL_PHY_ID_88E6390		0x01410f90
+ 
++#define MARVELL_PHY_FAMILY_ID(id)	((id) >> 4)
++
+ /* struct phy_device dev_flags definitions */
+ #define MARVELL_PHY_M1145_FLAGS_RESISTANCE	0x00000001
+ #define MARVELL_PHY_M1118_DNS323_LEDS		0x00000002
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index edab43d2bec8..28477ff9cf04 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -154,7 +154,9 @@ extern int overcommit_kbytes_handler(struct ctl_table *, int, void __user *,
+  * mmap() functions).
+  */
+ 
+-extern struct kmem_cache *vm_area_cachep;
++struct vm_area_struct *vm_area_alloc(struct mm_struct *);
++struct vm_area_struct *vm_area_dup(struct vm_area_struct *);
++void vm_area_free(struct vm_area_struct *);
+ 
+ #ifndef CONFIG_MMU
+ extern struct rb_root nommu_region_tree;
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 73178a2fcee0..27f9bdd7e46d 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -1236,6 +1236,8 @@ int pci_register_io_range(struct fwnode_handle *fwnode, phys_addr_t addr,
+ unsigned long pci_address_to_pio(phys_addr_t addr);
+ phys_addr_t pci_pio_to_address(unsigned long pio);
+ int pci_remap_iospace(const struct resource *res, phys_addr_t phys_addr);
++int devm_pci_remap_iospace(struct device *dev, const struct resource *res,
++			   phys_addr_t phys_addr);
+ void pci_unmap_iospace(struct resource *res);
+ void __iomem *devm_pci_remap_cfgspace(struct device *dev,
+ 				      resource_size_t offset,
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index ca3f3eae8980..5c32faa4af99 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -117,7 +117,7 @@ struct task_group;
+  * the comment with set_special_state().
+  */
+ #define is_special_task_state(state)				\
+-	((state) & (__TASK_STOPPED | __TASK_TRACED | TASK_DEAD))
++	((state) & (__TASK_STOPPED | __TASK_TRACED | TASK_PARKED | TASK_DEAD))
+ 
+ #define __set_current_state(state_value)			\
+ 	do {							\
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index aeebbbb9e0bd..62b6bfcce152 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -354,14 +354,7 @@ struct ipv6_txoptions *ipv6_dup_options(struct sock *sk,
+ struct ipv6_txoptions *ipv6_renew_options(struct sock *sk,
+ 					  struct ipv6_txoptions *opt,
+ 					  int newtype,
+-					  struct ipv6_opt_hdr __user *newopt,
+-					  int newoptlen);
+-struct ipv6_txoptions *
+-ipv6_renew_options_kern(struct sock *sk,
+-			struct ipv6_txoptions *opt,
+-			int newtype,
+-			struct ipv6_opt_hdr *newopt,
+-			int newoptlen);
++					  struct ipv6_opt_hdr *newopt);
+ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
+ 					  struct ipv6_txoptions *opt);
+ 
+diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
+index 47e35cce3b64..a71264d75d7f 100644
+--- a/include/net/net_namespace.h
++++ b/include/net/net_namespace.h
+@@ -128,6 +128,7 @@ struct net {
+ #endif
+ #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
+ 	struct netns_nf_frag	nf_frag;
++	struct ctl_table_header *nf_frag_frags_hdr;
+ #endif
+ 	struct sock		*nfnl;
+ 	struct sock		*nfnl_stash;
+diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
+index c29f09cfc9d7..5ce433f9e88a 100644
+--- a/include/net/netns/ipv6.h
++++ b/include/net/netns/ipv6.h
+@@ -107,7 +107,6 @@ struct netns_ipv6 {
+ 
+ #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
+ struct netns_nf_frag {
+-	struct netns_sysctl_ipv6 sysctl;
+ 	struct netns_frags	frags;
+ };
+ #endif
+diff --git a/include/net/tc_act/tc_csum.h b/include/net/tc_act/tc_csum.h
+index 9470fd7e4350..32d2454c0479 100644
+--- a/include/net/tc_act/tc_csum.h
++++ b/include/net/tc_act/tc_csum.h
+@@ -7,7 +7,6 @@
+ #include <linux/tc_act/tc_csum.h>
+ 
+ struct tcf_csum_params {
+-	int action;
+ 	u32 update_flags;
+ 	struct rcu_head rcu;
+ };
+diff --git a/include/net/tc_act/tc_tunnel_key.h b/include/net/tc_act/tc_tunnel_key.h
+index efef0b4b1b2b..46b8c7f1c8d5 100644
+--- a/include/net/tc_act/tc_tunnel_key.h
++++ b/include/net/tc_act/tc_tunnel_key.h
+@@ -18,7 +18,6 @@
+ struct tcf_tunnel_key_params {
+ 	struct rcu_head		rcu;
+ 	int			tcft_action;
+-	int			action;
+ 	struct metadata_dst     *tcft_enc_metadata;
+ };
+ 
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 5ccc4ec646cb..b0639f336976 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -907,8 +907,6 @@ enum tcp_ca_event {
+ 	CA_EVENT_LOSS,		/* loss timeout */
+ 	CA_EVENT_ECN_NO_CE,	/* ECT set, but not CE marked */
+ 	CA_EVENT_ECN_IS_CE,	/* received CE marked IP packet */
+-	CA_EVENT_DELAYED_ACK,	/* Delayed ack is sent */
+-	CA_EVENT_NON_DELAYED_ACK,
+ };
+ 
+ /* Information about inbound ACK, passed to cong_ops->in_ack_event() */
+diff --git a/include/uapi/linux/nbd.h b/include/uapi/linux/nbd.h
+index 85a3fb65e40a..20d6cc91435d 100644
+--- a/include/uapi/linux/nbd.h
++++ b/include/uapi/linux/nbd.h
+@@ -53,6 +53,9 @@ enum {
+ /* These are client behavior specific flags. */
+ #define NBD_CFLAG_DESTROY_ON_DISCONNECT	(1 << 0) /* delete the nbd device on
+ 						    disconnect. */
++#define NBD_CFLAG_DISCONNECT_ON_CLOSE (1 << 1) /* disconnect the nbd device on
++						*  close by last opener.
++						*/
+ 
+ /* userspace doesn't need the nbd_device structure */
+ 
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index b76828f23b49..3bd61b004418 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -743,13 +743,15 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
+ 				 * old element will be freed immediately.
+ 				 * Otherwise return an error
+ 				 */
+-				atomic_dec(&htab->count);
+-				return ERR_PTR(-E2BIG);
++				l_new = ERR_PTR(-E2BIG);
++				goto dec_count;
+ 			}
+ 		l_new = kmalloc_node(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN,
+ 				     htab->map.numa_node);
+-		if (!l_new)
+-			return ERR_PTR(-ENOMEM);
++		if (!l_new) {
++			l_new = ERR_PTR(-ENOMEM);
++			goto dec_count;
++		}
+ 	}
+ 
+ 	memcpy(l_new->key, key, key_size);
+@@ -762,7 +764,8 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
+ 						  GFP_ATOMIC | __GFP_NOWARN);
+ 			if (!pptr) {
+ 				kfree(l_new);
+-				return ERR_PTR(-ENOMEM);
++				l_new = ERR_PTR(-ENOMEM);
++				goto dec_count;
+ 			}
+ 		}
+ 
+@@ -776,6 +779,9 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
+ 
+ 	l_new->hash = hash;
+ 	return l_new;
++dec_count:
++	atomic_dec(&htab->count);
++	return l_new;
+ }
+ 
+ static int check_flags(struct bpf_htab *htab, struct htab_elem *l_old,
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 5ad558e6f8fe..b9d9b39d4afc 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -303,11 +303,38 @@ struct kmem_cache *files_cachep;
+ struct kmem_cache *fs_cachep;
+ 
+ /* SLAB cache for vm_area_struct structures */
+-struct kmem_cache *vm_area_cachep;
++static struct kmem_cache *vm_area_cachep;
+ 
+ /* SLAB cache for mm_struct structures (tsk->mm) */
+ static struct kmem_cache *mm_cachep;
+ 
++struct vm_area_struct *vm_area_alloc(struct mm_struct *mm)
++{
++	struct vm_area_struct *vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++
++	if (vma) {
++		vma->vm_mm = mm;
++		INIT_LIST_HEAD(&vma->anon_vma_chain);
++	}
++	return vma;
++}
++
++struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig)
++{
++	struct vm_area_struct *new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
++
++	if (new) {
++		*new = *orig;
++		INIT_LIST_HEAD(&new->anon_vma_chain);
++	}
++	return new;
++}
++
++void vm_area_free(struct vm_area_struct *vma)
++{
++	kmem_cache_free(vm_area_cachep, vma);
++}
++
+ static void account_kernel_stack(struct task_struct *tsk, int account)
+ {
+ 	void *stack = task_stack_page(tsk);
+@@ -455,11 +482,9 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm,
+ 				goto fail_nomem;
+ 			charge = len;
+ 		}
+-		tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
++		tmp = vm_area_dup(mpnt);
+ 		if (!tmp)
+ 			goto fail_nomem;
+-		*tmp = *mpnt;
+-		INIT_LIST_HEAD(&tmp->anon_vma_chain);
+ 		retval = vma_dup_policy(mpnt, tmp);
+ 		if (retval)
+ 			goto fail_nomem_policy;
+@@ -539,7 +564,7 @@ fail_uprobe_end:
+ fail_nomem_anon_vma_fork:
+ 	mpol_put(vma_policy(tmp));
+ fail_nomem_policy:
+-	kmem_cache_free(vm_area_cachep, tmp);
++	vm_area_free(tmp);
+ fail_nomem:
+ 	retval = -ENOMEM;
+ 	vm_unacct_memory(charge);
+diff --git a/kernel/kthread.c b/kernel/kthread.c
+index 1a481ae12dec..486dedbd9af5 100644
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -177,9 +177,20 @@ void *kthread_probe_data(struct task_struct *task)
+ static void __kthread_parkme(struct kthread *self)
+ {
+ 	for (;;) {
+-		set_current_state(TASK_PARKED);
++		/*
++		 * TASK_PARKED is a special state; we must serialize against
++		 * possible pending wakeups to avoid store-store collisions on
++		 * task->state.
++		 *
++		 * Such a collision might possibly result in the task state
++		 * changin from TASK_PARKED and us failing the
++		 * wait_task_inactive() in kthread_park().
++		 */
++		set_special_state(TASK_PARKED);
+ 		if (!test_bit(KTHREAD_SHOULD_PARK, &self->flags))
+ 			break;
++
++		complete_all(&self->parked);
+ 		schedule();
+ 	}
+ 	__set_current_state(TASK_RUNNING);
+@@ -191,11 +202,6 @@ void kthread_parkme(void)
+ }
+ EXPORT_SYMBOL_GPL(kthread_parkme);
+ 
+-void kthread_park_complete(struct task_struct *k)
+-{
+-	complete_all(&to_kthread(k)->parked);
+-}
+-
+ static int kthread(void *_create)
+ {
+ 	/* Copy data: it's on kthread's stack */
+@@ -467,6 +473,9 @@ void kthread_unpark(struct task_struct *k)
+ 
+ 	reinit_completion(&kthread->parked);
+ 	clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
++	/*
++	 * __kthread_parkme() will either see !SHOULD_PARK or get the wakeup.
++	 */
+ 	wake_up_state(k, TASK_PARKED);
+ }
+ EXPORT_SYMBOL_GPL(kthread_unpark);
+@@ -493,7 +502,16 @@ int kthread_park(struct task_struct *k)
+ 	set_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
+ 	if (k != current) {
+ 		wake_up_process(k);
++		/*
++		 * Wait for __kthread_parkme() to complete(), this means we
++		 * _will_ have TASK_PARKED and are about to call schedule().
++		 */
+ 		wait_for_completion(&kthread->parked);
++		/*
++		 * Now wait for that schedule() to complete and the task to
++		 * get scheduled out.
++		 */
++		WARN_ON_ONCE(!wait_task_inactive(k, TASK_PARKED));
+ 	}
+ 
+ 	return 0;
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index 023386338269..7184cea3ca10 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -1261,11 +1261,11 @@ unsigned long lockdep_count_forward_deps(struct lock_class *class)
+ 	this.parent = NULL;
+ 	this.class = class;
+ 
+-	local_irq_save(flags);
++	raw_local_irq_save(flags);
+ 	arch_spin_lock(&lockdep_lock);
+ 	ret = __lockdep_count_forward_deps(&this);
+ 	arch_spin_unlock(&lockdep_lock);
+-	local_irq_restore(flags);
++	raw_local_irq_restore(flags);
+ 
+ 	return ret;
+ }
+@@ -1288,11 +1288,11 @@ unsigned long lockdep_count_backward_deps(struct lock_class *class)
+ 	this.parent = NULL;
+ 	this.class = class;
+ 
+-	local_irq_save(flags);
++	raw_local_irq_save(flags);
+ 	arch_spin_lock(&lockdep_lock);
+ 	ret = __lockdep_count_backward_deps(&this);
+ 	arch_spin_unlock(&lockdep_lock);
+-	local_irq_restore(flags);
++	raw_local_irq_restore(flags);
+ 
+ 	return ret;
+ }
+@@ -4407,7 +4407,7 @@ void debug_check_no_locks_freed(const void *mem_from, unsigned long mem_len)
+ 	if (unlikely(!debug_locks))
+ 		return;
+ 
+-	local_irq_save(flags);
++	raw_local_irq_save(flags);
+ 	for (i = 0; i < curr->lockdep_depth; i++) {
+ 		hlock = curr->held_locks + i;
+ 
+@@ -4418,7 +4418,7 @@ void debug_check_no_locks_freed(const void *mem_from, unsigned long mem_len)
+ 		print_freed_lock_bug(curr, mem_from, mem_from + mem_len, hlock);
+ 		break;
+ 	}
+-	local_irq_restore(flags);
++	raw_local_irq_restore(flags);
+ }
+ EXPORT_SYMBOL_GPL(debug_check_no_locks_freed);
+ 
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index ec945451b9ef..0b817812f17f 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -7,7 +7,6 @@
+  */
+ #include "sched.h"
+ 
+-#include <linux/kthread.h>
+ #include <linux/nospec.h>
+ 
+ #include <asm/switch_to.h>
+@@ -2738,28 +2737,20 @@ static struct rq *finish_task_switch(struct task_struct *prev)
+ 		membarrier_mm_sync_core_before_usermode(mm);
+ 		mmdrop(mm);
+ 	}
+-	if (unlikely(prev_state & (TASK_DEAD|TASK_PARKED))) {
+-		switch (prev_state) {
+-		case TASK_DEAD:
+-			if (prev->sched_class->task_dead)
+-				prev->sched_class->task_dead(prev);
++	if (unlikely(prev_state == TASK_DEAD)) {
++		if (prev->sched_class->task_dead)
++			prev->sched_class->task_dead(prev);
+ 
+-			/*
+-			 * Remove function-return probe instances associated with this
+-			 * task and put them back on the free list.
+-			 */
+-			kprobe_flush_task(prev);
+-
+-			/* Task is done with its stack. */
+-			put_task_stack(prev);
++		/*
++		 * Remove function-return probe instances associated with this
++		 * task and put them back on the free list.
++		 */
++		kprobe_flush_task(prev);
+ 
+-			put_task_struct(prev);
+-			break;
++		/* Task is done with its stack. */
++		put_task_stack(prev);
+ 
+-		case TASK_PARKED:
+-			kthread_park_complete(prev);
+-			break;
+-		}
++		put_task_struct(prev);
+ 	}
+ 
+ 	tick_nohz_task_switch();
+@@ -3127,7 +3118,9 @@ static void sched_tick_remote(struct work_struct *work)
+ 	struct tick_work *twork = container_of(dwork, struct tick_work, work);
+ 	int cpu = twork->cpu;
+ 	struct rq *rq = cpu_rq(cpu);
++	struct task_struct *curr;
+ 	struct rq_flags rf;
++	u64 delta;
+ 
+ 	/*
+ 	 * Handle the tick only if it appears the remote CPU is running in full
+@@ -3136,24 +3129,28 @@ static void sched_tick_remote(struct work_struct *work)
+ 	 * statistics and checks timeslices in a time-independent way, regardless
+ 	 * of when exactly it is running.
+ 	 */
+-	if (!idle_cpu(cpu) && tick_nohz_tick_stopped_cpu(cpu)) {
+-		struct task_struct *curr;
+-		u64 delta;
++	if (idle_cpu(cpu) || !tick_nohz_tick_stopped_cpu(cpu))
++		goto out_requeue;
+ 
+-		rq_lock_irq(rq, &rf);
+-		update_rq_clock(rq);
+-		curr = rq->curr;
+-		delta = rq_clock_task(rq) - curr->se.exec_start;
++	rq_lock_irq(rq, &rf);
++	curr = rq->curr;
++	if (is_idle_task(curr))
++		goto out_unlock;
+ 
+-		/*
+-		 * Make sure the next tick runs within a reasonable
+-		 * amount of time.
+-		 */
+-		WARN_ON_ONCE(delta > (u64)NSEC_PER_SEC * 3);
+-		curr->sched_class->task_tick(rq, curr, 0);
+-		rq_unlock_irq(rq, &rf);
+-	}
++	update_rq_clock(rq);
++	delta = rq_clock_task(rq) - curr->se.exec_start;
++
++	/*
++	 * Make sure the next tick runs within a reasonable
++	 * amount of time.
++	 */
++	WARN_ON_ONCE(delta > (u64)NSEC_PER_SEC * 3);
++	curr->sched_class->task_tick(rq, curr, 0);
++
++out_unlock:
++	rq_unlock_irq(rq, &rf);
+ 
++out_requeue:
+ 	/*
+ 	 * Run the remote tick once per second (1Hz). This arbitrary
+ 	 * frequency is large enough to avoid overload but short enough
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 8b50eea4b607..b5fbdde6afa9 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -2296,8 +2296,17 @@ static void switched_from_dl(struct rq *rq, struct task_struct *p)
+ 	if (task_on_rq_queued(p) && p->dl.dl_runtime)
+ 		task_non_contending(p);
+ 
+-	if (!task_on_rq_queued(p))
++	if (!task_on_rq_queued(p)) {
++		/*
++		 * Inactive timer is armed. However, p is leaving DEADLINE and
++		 * might migrate away from this rq while continuing to run on
++		 * some other class. We need to remove its contribution from
++		 * this rq running_bw now, or sub_rq_bw (below) will complain.
++		 */
++		if (p->dl.dl_non_contending)
++			sub_running_bw(&p->dl, &rq->dl);
+ 		sub_rq_bw(&p->dl, &rq->dl);
++	}
+ 
+ 	/*
+ 	 * We cannot use inactive_task_timer() to invoke sub_running_bw()
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 183068d22849..9b0c02ec7517 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -3941,18 +3941,10 @@ util_est_dequeue(struct cfs_rq *cfs_rq, struct task_struct *p, bool task_sleep)
+ 	if (!sched_feat(UTIL_EST))
+ 		return;
+ 
+-	/*
+-	 * Update root cfs_rq's estimated utilization
+-	 *
+-	 * If *p is the last task then the root cfs_rq's estimated utilization
+-	 * of a CPU is 0 by definition.
+-	 */
+-	ue.enqueued = 0;
+-	if (cfs_rq->nr_running) {
+-		ue.enqueued  = cfs_rq->avg.util_est.enqueued;
+-		ue.enqueued -= min_t(unsigned int, ue.enqueued,
+-				     (_task_util_est(p) | UTIL_AVG_UNCHANGED));
+-	}
++	/* Update root cfs_rq's estimated utilization */
++	ue.enqueued  = cfs_rq->avg.util_est.enqueued;
++	ue.enqueued -= min_t(unsigned int, ue.enqueued,
++			     (_task_util_est(p) | UTIL_AVG_UNCHANGED));
+ 	WRITE_ONCE(cfs_rq->avg.util_est.enqueued, ue.enqueued);
+ 
+ 	/*
+@@ -4549,6 +4541,7 @@ void __refill_cfs_bandwidth_runtime(struct cfs_bandwidth *cfs_b)
+ 	now = sched_clock_cpu(smp_processor_id());
+ 	cfs_b->runtime = cfs_b->quota;
+ 	cfs_b->runtime_expires = now + ktime_to_ns(cfs_b->period);
++	cfs_b->expires_seq++;
+ }
+ 
+ static inline struct cfs_bandwidth *tg_cfs_bandwidth(struct task_group *tg)
+@@ -4571,6 +4564,7 @@ static int assign_cfs_rq_runtime(struct cfs_rq *cfs_rq)
+ 	struct task_group *tg = cfs_rq->tg;
+ 	struct cfs_bandwidth *cfs_b = tg_cfs_bandwidth(tg);
+ 	u64 amount = 0, min_amount, expires;
++	int expires_seq;
+ 
+ 	/* note: this is a positive sum as runtime_remaining <= 0 */
+ 	min_amount = sched_cfs_bandwidth_slice() - cfs_rq->runtime_remaining;
+@@ -4587,6 +4581,7 @@ static int assign_cfs_rq_runtime(struct cfs_rq *cfs_rq)
+ 			cfs_b->idle = 0;
+ 		}
+ 	}
++	expires_seq = cfs_b->expires_seq;
+ 	expires = cfs_b->runtime_expires;
+ 	raw_spin_unlock(&cfs_b->lock);
+ 
+@@ -4596,8 +4591,10 @@ static int assign_cfs_rq_runtime(struct cfs_rq *cfs_rq)
+ 	 * spread between our sched_clock and the one on which runtime was
+ 	 * issued.
+ 	 */
+-	if ((s64)(expires - cfs_rq->runtime_expires) > 0)
++	if (cfs_rq->expires_seq != expires_seq) {
++		cfs_rq->expires_seq = expires_seq;
+ 		cfs_rq->runtime_expires = expires;
++	}
+ 
+ 	return cfs_rq->runtime_remaining > 0;
+ }
+@@ -4623,12 +4620,9 @@ static void expire_cfs_rq_runtime(struct cfs_rq *cfs_rq)
+ 	 * has not truly expired.
+ 	 *
+ 	 * Fortunately we can check determine whether this the case by checking
+-	 * whether the global deadline has advanced. It is valid to compare
+-	 * cfs_b->runtime_expires without any locks since we only care about
+-	 * exact equality, so a partial write will still work.
++	 * whether the global deadline(cfs_b->expires_seq) has advanced.
+ 	 */
+-
+-	if (cfs_rq->runtime_expires != cfs_b->runtime_expires) {
++	if (cfs_rq->expires_seq == cfs_b->expires_seq) {
+ 		/* extend local deadline, drift is bounded above by 2 ticks */
+ 		cfs_rq->runtime_expires += TICK_NSEC;
+ 	} else {
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index cb467c221b15..7548b373d1c5 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -334,9 +334,10 @@ struct cfs_bandwidth {
+ 	u64			runtime;
+ 	s64			hierarchical_quota;
+ 	u64			runtime_expires;
++	int			expires_seq;
+ 
+-	int			idle;
+-	int			period_active;
++	short			idle;
++	short			period_active;
+ 	struct hrtimer		period_timer;
+ 	struct hrtimer		slack_timer;
+ 	struct list_head	throttled_cfs_rq;
+@@ -551,6 +552,7 @@ struct cfs_rq {
+ 
+ #ifdef CONFIG_CFS_BANDWIDTH
+ 	int			runtime_enabled;
++	int			expires_seq;
+ 	u64			runtime_expires;
+ 	s64			runtime_remaining;
+ 
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index a583b6494b95..214820a14edf 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2962,6 +2962,7 @@ out_nobuffer:
+ }
+ EXPORT_SYMBOL_GPL(trace_vbprintk);
+ 
++__printf(3, 0)
+ static int
+ __trace_array_vprintk(struct ring_buffer *buffer,
+ 		      unsigned long ip, const char *fmt, va_list args)
+@@ -3016,12 +3017,14 @@ out_nobuffer:
+ 	return len;
+ }
+ 
++__printf(3, 0)
+ int trace_array_vprintk(struct trace_array *tr,
+ 			unsigned long ip, const char *fmt, va_list args)
+ {
+ 	return __trace_array_vprintk(tr->trace_buffer.buffer, ip, fmt, args);
+ }
+ 
++__printf(3, 0)
+ int trace_array_printk(struct trace_array *tr,
+ 		       unsigned long ip, const char *fmt, ...)
+ {
+@@ -3037,6 +3040,7 @@ int trace_array_printk(struct trace_array *tr,
+ 	return ret;
+ }
+ 
++__printf(3, 4)
+ int trace_array_printk_buf(struct ring_buffer *buffer,
+ 			   unsigned long ip, const char *fmt, ...)
+ {
+@@ -3052,6 +3056,7 @@ int trace_array_printk_buf(struct ring_buffer *buffer,
+ 	return ret;
+ }
+ 
++__printf(2, 0)
+ int trace_vprintk(unsigned long ip, const char *fmt, va_list args)
+ {
+ 	return trace_array_vprintk(&global_trace, ip, fmt, args);
+diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
+index f185455b3406..c3bd5209da38 100644
+--- a/mm/kasan/kasan.c
++++ b/mm/kasan/kasan.c
+@@ -619,12 +619,13 @@ void kasan_kfree_large(void *ptr, unsigned long ip)
+ int kasan_module_alloc(void *addr, size_t size)
+ {
+ 	void *ret;
++	size_t scaled_size;
+ 	size_t shadow_size;
+ 	unsigned long shadow_start;
+ 
+ 	shadow_start = (unsigned long)kasan_mem_to_shadow(addr);
+-	shadow_size = round_up(size >> KASAN_SHADOW_SCALE_SHIFT,
+-			PAGE_SIZE);
++	scaled_size = (size + KASAN_SHADOW_MASK) >> KASAN_SHADOW_SCALE_SHIFT;
++	shadow_size = round_up(scaled_size, PAGE_SIZE);
+ 
+ 	if (WARN_ON(!PAGE_ALIGNED(shadow_start)))
+ 		return -EINVAL;
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 540cfab8c2c4..55d68c24e742 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -182,7 +182,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
+ 	if (vma->vm_file)
+ 		fput(vma->vm_file);
+ 	mpol_put(vma_policy(vma));
+-	kmem_cache_free(vm_area_cachep, vma);
++	vm_area_free(vma);
+ 	return next;
+ }
+ 
+@@ -911,7 +911,7 @@ again:
+ 			anon_vma_merge(vma, next);
+ 		mm->map_count--;
+ 		mpol_put(vma_policy(next));
+-		kmem_cache_free(vm_area_cachep, next);
++		vm_area_free(next);
+ 		/*
+ 		 * In mprotect's case 6 (see comments on vma_merge),
+ 		 * we must remove another next too. It would clutter
+@@ -1729,19 +1729,17 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+ 	 * specific mapper. the address has already been validated, but
+ 	 * not unmapped, but the maps are removed from the list.
+ 	 */
+-	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++	vma = vm_area_alloc(mm);
+ 	if (!vma) {
+ 		error = -ENOMEM;
+ 		goto unacct_error;
+ 	}
+ 
+-	vma->vm_mm = mm;
+ 	vma->vm_start = addr;
+ 	vma->vm_end = addr + len;
+ 	vma->vm_flags = vm_flags;
+ 	vma->vm_page_prot = vm_get_page_prot(vm_flags);
+ 	vma->vm_pgoff = pgoff;
+-	INIT_LIST_HEAD(&vma->anon_vma_chain);
+ 
+ 	if (file) {
+ 		if (vm_flags & VM_DENYWRITE) {
+@@ -1832,7 +1830,7 @@ allow_write_and_free_vma:
+ 	if (vm_flags & VM_DENYWRITE)
+ 		allow_write_access(file);
+ free_vma:
+-	kmem_cache_free(vm_area_cachep, vma);
++	vm_area_free(vma);
+ unacct_error:
+ 	if (charged)
+ 		vm_unacct_memory(charged);
+@@ -2620,15 +2618,10 @@ int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+ 			return err;
+ 	}
+ 
+-	new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
++	new = vm_area_dup(vma);
+ 	if (!new)
+ 		return -ENOMEM;
+ 
+-	/* most fields are the same, copy all, and then fixup */
+-	*new = *vma;
+-
+-	INIT_LIST_HEAD(&new->anon_vma_chain);
+-
+ 	if (new_below)
+ 		new->vm_end = addr;
+ 	else {
+@@ -2669,7 +2662,7 @@ int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+  out_free_mpol:
+ 	mpol_put(vma_policy(new));
+  out_free_vma:
+-	kmem_cache_free(vm_area_cachep, new);
++	vm_area_free(new);
+ 	return err;
+ }
+ 
+@@ -2984,14 +2977,12 @@ static int do_brk_flags(unsigned long addr, unsigned long len, unsigned long fla
+ 	/*
+ 	 * create a vma struct for an anonymous mapping
+ 	 */
+-	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++	vma = vm_area_alloc(mm);
+ 	if (!vma) {
+ 		vm_unacct_memory(len >> PAGE_SHIFT);
+ 		return -ENOMEM;
+ 	}
+ 
+-	INIT_LIST_HEAD(&vma->anon_vma_chain);
+-	vma->vm_mm = mm;
+ 	vma->vm_start = addr;
+ 	vma->vm_end = addr + len;
+ 	vma->vm_pgoff = pgoff;
+@@ -3202,16 +3193,14 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+ 		}
+ 		*need_rmap_locks = (new_vma->vm_pgoff <= vma->vm_pgoff);
+ 	} else {
+-		new_vma = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
++		new_vma = vm_area_dup(vma);
+ 		if (!new_vma)
+ 			goto out;
+-		*new_vma = *vma;
+ 		new_vma->vm_start = addr;
+ 		new_vma->vm_end = addr + len;
+ 		new_vma->vm_pgoff = pgoff;
+ 		if (vma_dup_policy(vma, new_vma))
+ 			goto out_free_vma;
+-		INIT_LIST_HEAD(&new_vma->anon_vma_chain);
+ 		if (anon_vma_clone(new_vma, vma))
+ 			goto out_free_mempol;
+ 		if (new_vma->vm_file)
+@@ -3226,7 +3215,7 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+ out_free_mempol:
+ 	mpol_put(vma_policy(new_vma));
+ out_free_vma:
+-	kmem_cache_free(vm_area_cachep, new_vma);
++	vm_area_free(new_vma);
+ out:
+ 	return NULL;
+ }
+@@ -3350,12 +3339,10 @@ static struct vm_area_struct *__install_special_mapping(
+ 	int ret;
+ 	struct vm_area_struct *vma;
+ 
+-	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++	vma = vm_area_alloc(mm);
+ 	if (unlikely(vma == NULL))
+ 		return ERR_PTR(-ENOMEM);
+ 
+-	INIT_LIST_HEAD(&vma->anon_vma_chain);
+-	vma->vm_mm = mm;
+ 	vma->vm_start = addr;
+ 	vma->vm_end = addr + len;
+ 
+@@ -3376,7 +3363,7 @@ static struct vm_area_struct *__install_special_mapping(
+ 	return vma;
+ 
+ out:
+-	kmem_cache_free(vm_area_cachep, vma);
++	vm_area_free(vma);
+ 	return ERR_PTR(ret);
+ }
+ 
+diff --git a/mm/nommu.c b/mm/nommu.c
+index 13723736d38f..b7a2aa7f7c0f 100644
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -769,7 +769,7 @@ static void delete_vma(struct mm_struct *mm, struct vm_area_struct *vma)
+ 	if (vma->vm_file)
+ 		fput(vma->vm_file);
+ 	put_nommu_region(vma->vm_region);
+-	kmem_cache_free(vm_area_cachep, vma);
++	vm_area_free(vma);
+ }
+ 
+ /*
+@@ -1204,7 +1204,7 @@ unsigned long do_mmap(struct file *file,
+ 	if (!region)
+ 		goto error_getting_region;
+ 
+-	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++	vma = vm_area_alloc(current->mm);
+ 	if (!vma)
+ 		goto error_getting_vma;
+ 
+@@ -1212,7 +1212,6 @@ unsigned long do_mmap(struct file *file,
+ 	region->vm_flags = vm_flags;
+ 	region->vm_pgoff = pgoff;
+ 
+-	INIT_LIST_HEAD(&vma->anon_vma_chain);
+ 	vma->vm_flags = vm_flags;
+ 	vma->vm_pgoff = pgoff;
+ 
+@@ -1368,7 +1367,7 @@ error:
+ 	kmem_cache_free(vm_region_jar, region);
+ 	if (vma->vm_file)
+ 		fput(vma->vm_file);
+-	kmem_cache_free(vm_area_cachep, vma);
++	vm_area_free(vma);
+ 	return ret;
+ 
+ sharing_violation:
+@@ -1469,14 +1468,13 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+ 	if (!region)
+ 		return -ENOMEM;
+ 
+-	new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
++	new = vm_area_dup(vma);
+ 	if (!new) {
+ 		kmem_cache_free(vm_region_jar, region);
+ 		return -ENOMEM;
+ 	}
+ 
+ 	/* most fields are the same, copy all, and then fixup */
+-	*new = *vma;
+ 	*region = *vma->vm_region;
+ 	new->vm_region = region;
+ 
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 7b841a764dd0..e27bc10467c4 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -6933,9 +6933,21 @@ unsigned long free_reserved_area(void *start, void *end, int poison, char *s)
+ 	start = (void *)PAGE_ALIGN((unsigned long)start);
+ 	end = (void *)((unsigned long)end & PAGE_MASK);
+ 	for (pos = start; pos < end; pos += PAGE_SIZE, pages++) {
++		struct page *page = virt_to_page(pos);
++		void *direct_map_addr;
++
++		/*
++		 * 'direct_map_addr' might be different from 'pos'
++		 * because some architectures' virt_to_page()
++		 * work with aliases.  Getting the direct map
++		 * address ensures that we get a _writeable_
++		 * alias for the memset().
++		 */
++		direct_map_addr = page_address(page);
+ 		if ((unsigned int)poison <= 0xFF)
+-			memset(pos, poison, PAGE_SIZE);
+-		free_reserved_page(virt_to_page(pos));
++			memset(direct_map_addr, poison, PAGE_SIZE);
++
++		free_reserved_page(page);
+ 	}
+ 
+ 	if (pages && s)
+diff --git a/net/9p/client.c b/net/9p/client.c
+index 21e6df1cc70f..0ad6993aaa9b 100644
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -228,7 +228,8 @@ static int parse_opts(char *opts, struct p9_client *clnt)
+ 	}
+ 
+ free_and_return:
+-	v9fs_put_trans(clnt->trans_mod);
++	if (ret)
++		v9fs_put_trans(clnt->trans_mod);
+ 	kfree(tmp_options);
+ 	return ret;
+ }
+diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
+index be09a9883825..73bf6a93a3cf 100644
+--- a/net/batman-adv/bat_iv_ogm.c
++++ b/net/batman-adv/bat_iv_ogm.c
+@@ -2732,7 +2732,7 @@ static int batadv_iv_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
+ {
+ 	struct batadv_neigh_ifinfo *router_ifinfo = NULL;
+ 	struct batadv_neigh_node *router;
+-	struct batadv_gw_node *curr_gw;
++	struct batadv_gw_node *curr_gw = NULL;
+ 	int ret = 0;
+ 	void *hdr;
+ 
+@@ -2780,6 +2780,8 @@ static int batadv_iv_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
+ 	ret = 0;
+ 
+ out:
++	if (curr_gw)
++		batadv_gw_node_put(curr_gw);
+ 	if (router_ifinfo)
+ 		batadv_neigh_ifinfo_put(router_ifinfo);
+ 	if (router)
+diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c
+index ec93337ee259..6baec4e68898 100644
+--- a/net/batman-adv/bat_v.c
++++ b/net/batman-adv/bat_v.c
+@@ -927,7 +927,7 @@ static int batadv_v_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
+ {
+ 	struct batadv_neigh_ifinfo *router_ifinfo = NULL;
+ 	struct batadv_neigh_node *router;
+-	struct batadv_gw_node *curr_gw;
++	struct batadv_gw_node *curr_gw = NULL;
+ 	int ret = 0;
+ 	void *hdr;
+ 
+@@ -995,6 +995,8 @@ static int batadv_v_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
+ 	ret = 0;
+ 
+ out:
++	if (curr_gw)
++		batadv_gw_node_put(curr_gw);
+ 	if (router_ifinfo)
+ 		batadv_neigh_ifinfo_put(router_ifinfo);
+ 	if (router)
+diff --git a/net/batman-adv/debugfs.c b/net/batman-adv/debugfs.c
+index 4229b01ac7b5..87479c60670e 100644
+--- a/net/batman-adv/debugfs.c
++++ b/net/batman-adv/debugfs.c
+@@ -19,6 +19,7 @@
+ #include "debugfs.h"
+ #include "main.h"
+ 
++#include <linux/dcache.h>
+ #include <linux/debugfs.h>
+ #include <linux/err.h>
+ #include <linux/errno.h>
+@@ -343,6 +344,25 @@ out:
+ 	return -ENOMEM;
+ }
+ 
++/**
++ * batadv_debugfs_rename_hardif() - Fix debugfs path for renamed hardif
++ * @hard_iface: hard interface which was renamed
++ */
++void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface)
++{
++	const char *name = hard_iface->net_dev->name;
++	struct dentry *dir;
++	struct dentry *d;
++
++	dir = hard_iface->debug_dir;
++	if (!dir)
++		return;
++
++	d = debugfs_rename(dir->d_parent, dir, dir->d_parent, name);
++	if (!d)
++		pr_err("Can't rename debugfs dir to %s\n", name);
++}
++
+ /**
+  * batadv_debugfs_del_hardif() - delete the base directory for a hard interface
+  *  in debugfs.
+@@ -413,6 +433,26 @@ out:
+ 	return -ENOMEM;
+ }
+ 
++/**
++ * batadv_debugfs_rename_meshif() - Fix debugfs path for renamed softif
++ * @dev: net_device which was renamed
++ */
++void batadv_debugfs_rename_meshif(struct net_device *dev)
++{
++	struct batadv_priv *bat_priv = netdev_priv(dev);
++	const char *name = dev->name;
++	struct dentry *dir;
++	struct dentry *d;
++
++	dir = bat_priv->debug_dir;
++	if (!dir)
++		return;
++
++	d = debugfs_rename(dir->d_parent, dir, dir->d_parent, name);
++	if (!d)
++		pr_err("Can't rename debugfs dir to %s\n", name);
++}
++
+ /**
+  * batadv_debugfs_del_meshif() - Remove interface dependent debugfs entries
+  * @dev: netdev struct of the soft interface
+diff --git a/net/batman-adv/debugfs.h b/net/batman-adv/debugfs.h
+index 37b069698b04..08a592ffbee5 100644
+--- a/net/batman-adv/debugfs.h
++++ b/net/batman-adv/debugfs.h
+@@ -30,8 +30,10 @@ struct net_device;
+ void batadv_debugfs_init(void);
+ void batadv_debugfs_destroy(void);
+ int batadv_debugfs_add_meshif(struct net_device *dev);
++void batadv_debugfs_rename_meshif(struct net_device *dev);
+ void batadv_debugfs_del_meshif(struct net_device *dev);
+ int batadv_debugfs_add_hardif(struct batadv_hard_iface *hard_iface);
++void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface);
+ void batadv_debugfs_del_hardif(struct batadv_hard_iface *hard_iface);
+ 
+ #else
+@@ -49,6 +51,10 @@ static inline int batadv_debugfs_add_meshif(struct net_device *dev)
+ 	return 0;
+ }
+ 
++static inline void batadv_debugfs_rename_meshif(struct net_device *dev)
++{
++}
++
+ static inline void batadv_debugfs_del_meshif(struct net_device *dev)
+ {
+ }
+@@ -59,6 +65,11 @@ int batadv_debugfs_add_hardif(struct batadv_hard_iface *hard_iface)
+ 	return 0;
+ }
+ 
++static inline
++void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface)
++{
++}
++
+ static inline
+ void batadv_debugfs_del_hardif(struct batadv_hard_iface *hard_iface)
+ {
+diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
+index c405d15befd6..2f0d42f2f913 100644
+--- a/net/batman-adv/hard-interface.c
++++ b/net/batman-adv/hard-interface.c
+@@ -989,6 +989,32 @@ void batadv_hardif_remove_interfaces(void)
+ 	rtnl_unlock();
+ }
+ 
++/**
++ * batadv_hard_if_event_softif() - Handle events for soft interfaces
++ * @event: NETDEV_* event to handle
++ * @net_dev: net_device which generated an event
++ *
++ * Return: NOTIFY_* result
++ */
++static int batadv_hard_if_event_softif(unsigned long event,
++				       struct net_device *net_dev)
++{
++	struct batadv_priv *bat_priv;
++
++	switch (event) {
++	case NETDEV_REGISTER:
++		batadv_sysfs_add_meshif(net_dev);
++		bat_priv = netdev_priv(net_dev);
++		batadv_softif_create_vlan(bat_priv, BATADV_NO_FLAGS);
++		break;
++	case NETDEV_CHANGENAME:
++		batadv_debugfs_rename_meshif(net_dev);
++		break;
++	}
++
++	return NOTIFY_DONE;
++}
++
+ static int batadv_hard_if_event(struct notifier_block *this,
+ 				unsigned long event, void *ptr)
+ {
+@@ -997,12 +1023,8 @@ static int batadv_hard_if_event(struct notifier_block *this,
+ 	struct batadv_hard_iface *primary_if = NULL;
+ 	struct batadv_priv *bat_priv;
+ 
+-	if (batadv_softif_is_valid(net_dev) && event == NETDEV_REGISTER) {
+-		batadv_sysfs_add_meshif(net_dev);
+-		bat_priv = netdev_priv(net_dev);
+-		batadv_softif_create_vlan(bat_priv, BATADV_NO_FLAGS);
+-		return NOTIFY_DONE;
+-	}
++	if (batadv_softif_is_valid(net_dev))
++		return batadv_hard_if_event_softif(event, net_dev);
+ 
+ 	hard_iface = batadv_hardif_get_by_netdev(net_dev);
+ 	if (!hard_iface && (event == NETDEV_REGISTER ||
+@@ -1051,6 +1073,9 @@ static int batadv_hard_if_event(struct notifier_block *this,
+ 		if (batadv_is_wifi_hardif(hard_iface))
+ 			hard_iface->num_bcasts = BATADV_NUM_BCASTS_WIRELESS;
+ 		break;
++	case NETDEV_CHANGENAME:
++		batadv_debugfs_rename_hardif(hard_iface);
++		break;
+ 	default:
+ 		break;
+ 	}
+diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
+index 3986551397ca..12a2b7d21376 100644
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -1705,7 +1705,9 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv,
+ 		ether_addr_copy(common->addr, tt_addr);
+ 		common->vid = vid;
+ 
+-		common->flags = flags;
++		if (!is_multicast_ether_addr(common->addr))
++			common->flags = flags & (~BATADV_TT_SYNC_MASK);
++
+ 		tt_global_entry->roam_at = 0;
+ 		/* node must store current time in case of roaming. This is
+ 		 * needed to purge this entry out on timeout (if nobody claims
+@@ -1768,7 +1770,8 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv,
+ 		 * TT_CLIENT_TEMP, therefore they have to be copied in the
+ 		 * client entry
+ 		 */
+-		common->flags |= flags & (~BATADV_TT_SYNC_MASK);
++		if (!is_multicast_ether_addr(common->addr))
++			common->flags |= flags & (~BATADV_TT_SYNC_MASK);
+ 
+ 		/* If there is the BATADV_TT_CLIENT_ROAM flag set, there is only
+ 		 * one originator left in the list and we previously received a
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 1ccc2a2ac2e9..2d6b23e39833 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -8608,7 +8608,8 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
+ 		/* We get here if we can't use the current device name */
+ 		if (!pat)
+ 			goto out;
+-		if (dev_get_valid_name(net, dev, pat) < 0)
++		err = dev_get_valid_name(net, dev, pat);
++		if (err < 0)
+ 			goto out;
+ 	}
+ 
+@@ -8620,7 +8621,6 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
+ 	dev_close(dev);
+ 
+ 	/* And unlink it from device chain */
+-	err = -ENODEV;
+ 	unlist_netdevice(dev);
+ 
+ 	synchronize_net();
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 201ff36b17a8..a491dbb0a955 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2516,7 +2516,8 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff)
+ 
+ static u32 __bpf_skb_max_len(const struct sk_buff *skb)
+ {
+-	return skb->dev->mtu + skb->dev->hard_header_len;
++	return skb->dev ? skb->dev->mtu + skb->dev->hard_header_len :
++			  SKB_MAX_ALLOC;
+ }
+ 
+ static int bpf_skb_adjust_net(struct sk_buff *skb, s32 len_diff)
+diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
+index 275449b0d633..3297e7fa9945 100644
+--- a/net/ieee802154/6lowpan/core.c
++++ b/net/ieee802154/6lowpan/core.c
+@@ -90,12 +90,18 @@ static int lowpan_neigh_construct(struct net_device *dev, struct neighbour *n)
+ 	return 0;
+ }
+ 
++static int lowpan_get_iflink(const struct net_device *dev)
++{
++	return lowpan_802154_dev(dev)->wdev->ifindex;
++}
++
+ static const struct net_device_ops lowpan_netdev_ops = {
+ 	.ndo_init		= lowpan_dev_init,
+ 	.ndo_start_xmit		= lowpan_xmit,
+ 	.ndo_open		= lowpan_open,
+ 	.ndo_stop		= lowpan_stop,
+ 	.ndo_neigh_construct    = lowpan_neigh_construct,
++	.ndo_get_iflink         = lowpan_get_iflink,
+ };
+ 
+ static void lowpan_setup(struct net_device *ldev)
+diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
+index eeb6646aa892..0d70608cc2e1 100644
+--- a/net/ipv4/inet_fragment.c
++++ b/net/ipv4/inet_fragment.c
+@@ -90,7 +90,7 @@ static void inet_frags_free_cb(void *ptr, void *arg)
+ 
+ void inet_frags_exit_net(struct netns_frags *nf)
+ {
+-	nf->low_thresh = 0; /* prevent creation of new frags */
++	nf->high_thresh = 0; /* prevent creation of new frags */
+ 
+ 	rhashtable_free_and_destroy(&nf->rhashtable, inet_frags_free_cb, NULL);
+ }
+diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
+index f6130704f052..1bf71e36f545 100644
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -1895,6 +1895,7 @@ static struct xt_match ipt_builtin_mt[] __read_mostly = {
+ 		.checkentry = icmp_checkentry,
+ 		.proto      = IPPROTO_ICMP,
+ 		.family     = NFPROTO_IPV4,
++		.me	    = THIS_MODULE,
+ 	},
+ };
+ 
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 58e316cf6607..14c26a747e50 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -1845,7 +1845,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
+ 			 * shouldn't happen.
+ 			 */
+ 			if (WARN(before(*seq, TCP_SKB_CB(skb)->seq),
+-				 "recvmsg bug: copied %X seq %X rcvnxt %X fl %X\n",
++				 "TCP recvmsg seq # bug: copied %X, seq %X, rcvnxt %X, fl %X\n",
+ 				 *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt,
+ 				 flags))
+ 				break;
+@@ -1860,7 +1860,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
+ 			if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+ 				goto found_fin_ok;
+ 			WARN(!(flags & MSG_PEEK),
+-			     "recvmsg bug 2: copied %X seq %X rcvnxt %X fl %X\n",
++			     "TCP recvmsg seq # bug 2: copied %X, seq %X, rcvnxt %X, fl %X\n",
+ 			     *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, flags);
+ 		}
+ 
+diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
+index 1a9b88c8cf72..8b637f9f23a2 100644
+--- a/net/ipv4/tcp_dctcp.c
++++ b/net/ipv4/tcp_dctcp.c
+@@ -55,7 +55,6 @@ struct dctcp {
+ 	u32 dctcp_alpha;
+ 	u32 next_seq;
+ 	u32 ce_state;
+-	u32 delayed_ack_reserved;
+ 	u32 loss_cwnd;
+ };
+ 
+@@ -96,7 +95,6 @@ static void dctcp_init(struct sock *sk)
+ 
+ 		ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA);
+ 
+-		ca->delayed_ack_reserved = 0;
+ 		ca->loss_cwnd = 0;
+ 		ca->ce_state = 0;
+ 
+@@ -230,25 +228,6 @@ static void dctcp_state(struct sock *sk, u8 new_state)
+ 	}
+ }
+ 
+-static void dctcp_update_ack_reserved(struct sock *sk, enum tcp_ca_event ev)
+-{
+-	struct dctcp *ca = inet_csk_ca(sk);
+-
+-	switch (ev) {
+-	case CA_EVENT_DELAYED_ACK:
+-		if (!ca->delayed_ack_reserved)
+-			ca->delayed_ack_reserved = 1;
+-		break;
+-	case CA_EVENT_NON_DELAYED_ACK:
+-		if (ca->delayed_ack_reserved)
+-			ca->delayed_ack_reserved = 0;
+-		break;
+-	default:
+-		/* Don't care for the rest. */
+-		break;
+-	}
+-}
+-
+ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
+ {
+ 	switch (ev) {
+@@ -258,10 +237,6 @@ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
+ 	case CA_EVENT_ECN_NO_CE:
+ 		dctcp_ce_state_1_to_0(sk);
+ 		break;
+-	case CA_EVENT_DELAYED_ACK:
+-	case CA_EVENT_NON_DELAYED_ACK:
+-		dctcp_update_ack_reserved(sk, ev);
+-		break;
+ 	default:
+ 		/* Don't care for the rest. */
+ 		break;
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 3049d10a1476..5a689b07bad7 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -3545,8 +3545,6 @@ void tcp_send_delayed_ack(struct sock *sk)
+ 	int ato = icsk->icsk_ack.ato;
+ 	unsigned long timeout;
+ 
+-	tcp_ca_event(sk, CA_EVENT_DELAYED_ACK);
+-
+ 	if (ato > TCP_DELACK_MIN) {
+ 		const struct tcp_sock *tp = tcp_sk(sk);
+ 		int max_ato = HZ / 2;
+@@ -3603,8 +3601,6 @@ void __tcp_send_ack(struct sock *sk, u32 rcv_nxt)
+ 	if (sk->sk_state == TCP_CLOSE)
+ 		return;
+ 
+-	tcp_ca_event(sk, CA_EVENT_NON_DELAYED_ACK);
+-
+ 	/* We are not putting this on the write queue, so
+ 	 * tcp_transmit_skb() will set the ownership to this
+ 	 * sock.
+diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
+index 1323b9679cf7..1c0bb9fb76e6 100644
+--- a/net/ipv6/calipso.c
++++ b/net/ipv6/calipso.c
+@@ -799,8 +799,7 @@ static int calipso_opt_update(struct sock *sk, struct ipv6_opt_hdr *hop)
+ {
+ 	struct ipv6_txoptions *old = txopt_get(inet6_sk(sk)), *txopts;
+ 
+-	txopts = ipv6_renew_options_kern(sk, old, IPV6_HOPOPTS,
+-					 hop, hop ? ipv6_optlen(hop) : 0);
++	txopts = ipv6_renew_options(sk, old, IPV6_HOPOPTS, hop);
+ 	txopt_put(old);
+ 	if (IS_ERR(txopts))
+ 		return PTR_ERR(txopts);
+@@ -1222,8 +1221,7 @@ static int calipso_req_setattr(struct request_sock *req,
+ 	if (IS_ERR(new))
+ 		return PTR_ERR(new);
+ 
+-	txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS,
+-					 new, new ? ipv6_optlen(new) : 0);
++	txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new);
+ 
+ 	kfree(new);
+ 
+@@ -1260,8 +1258,7 @@ static void calipso_req_delattr(struct request_sock *req)
+ 	if (calipso_opt_del(req_inet->ipv6_opt->hopopt, &new))
+ 		return; /* Nothing to do */
+ 
+-	txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS,
+-					 new, new ? ipv6_optlen(new) : 0);
++	txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new);
+ 
+ 	if (!IS_ERR(txopts)) {
+ 		txopts = xchg(&req_inet->ipv6_opt, txopts);
+diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
+index bc68eb661970..07a4d4232231 100644
+--- a/net/ipv6/exthdrs.c
++++ b/net/ipv6/exthdrs.c
+@@ -1028,29 +1028,21 @@ ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
+ }
+ EXPORT_SYMBOL_GPL(ipv6_dup_options);
+ 
+-static int ipv6_renew_option(void *ohdr,
+-			     struct ipv6_opt_hdr __user *newopt, int newoptlen,
+-			     int inherit,
+-			     struct ipv6_opt_hdr **hdr,
+-			     char **p)
++static void ipv6_renew_option(int renewtype,
++			      struct ipv6_opt_hdr **dest,
++			      struct ipv6_opt_hdr *old,
++			      struct ipv6_opt_hdr *new,
++			      int newtype, char **p)
+ {
+-	if (inherit) {
+-		if (ohdr) {
+-			memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
+-			*hdr = (struct ipv6_opt_hdr *)*p;
+-			*p += CMSG_ALIGN(ipv6_optlen(*hdr));
+-		}
+-	} else {
+-		if (newopt) {
+-			if (copy_from_user(*p, newopt, newoptlen))
+-				return -EFAULT;
+-			*hdr = (struct ipv6_opt_hdr *)*p;
+-			if (ipv6_optlen(*hdr) > newoptlen)
+-				return -EINVAL;
+-			*p += CMSG_ALIGN(newoptlen);
+-		}
+-	}
+-	return 0;
++	struct ipv6_opt_hdr *src;
++
++	src = (renewtype == newtype ? new : old);
++	if (!src)
++		return;
++
++	memcpy(*p, src, ipv6_optlen(src));
++	*dest = (struct ipv6_opt_hdr *)*p;
++	*p += CMSG_ALIGN(ipv6_optlen(*dest));
+ }
+ 
+ /**
+@@ -1076,13 +1068,11 @@ static int ipv6_renew_option(void *ohdr,
+  */
+ struct ipv6_txoptions *
+ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
+-		   int newtype,
+-		   struct ipv6_opt_hdr __user *newopt, int newoptlen)
++		   int newtype, struct ipv6_opt_hdr *newopt)
+ {
+ 	int tot_len = 0;
+ 	char *p;
+ 	struct ipv6_txoptions *opt2;
+-	int err;
+ 
+ 	if (opt) {
+ 		if (newtype != IPV6_HOPOPTS && opt->hopopt)
+@@ -1095,8 +1085,8 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
+ 			tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
+ 	}
+ 
+-	if (newopt && newoptlen)
+-		tot_len += CMSG_ALIGN(newoptlen);
++	if (newopt)
++		tot_len += CMSG_ALIGN(ipv6_optlen(newopt));
+ 
+ 	if (!tot_len)
+ 		return NULL;
+@@ -1111,29 +1101,19 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
+ 	opt2->tot_len = tot_len;
+ 	p = (char *)(opt2 + 1);
+ 
+-	err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
+-				newtype != IPV6_HOPOPTS,
+-				&opt2->hopopt, &p);
+-	if (err)
+-		goto out;
+-
+-	err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
+-				newtype != IPV6_RTHDRDSTOPTS,
+-				&opt2->dst0opt, &p);
+-	if (err)
+-		goto out;
+-
+-	err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
+-				newtype != IPV6_RTHDR,
+-				(struct ipv6_opt_hdr **)&opt2->srcrt, &p);
+-	if (err)
+-		goto out;
+-
+-	err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
+-				newtype != IPV6_DSTOPTS,
+-				&opt2->dst1opt, &p);
+-	if (err)
+-		goto out;
++	ipv6_renew_option(IPV6_HOPOPTS, &opt2->hopopt,
++			  (opt ? opt->hopopt : NULL),
++			  newopt, newtype, &p);
++	ipv6_renew_option(IPV6_RTHDRDSTOPTS, &opt2->dst0opt,
++			  (opt ? opt->dst0opt : NULL),
++			  newopt, newtype, &p);
++	ipv6_renew_option(IPV6_RTHDR,
++			  (struct ipv6_opt_hdr **)&opt2->srcrt,
++			  (opt ? (struct ipv6_opt_hdr *)opt->srcrt : NULL),
++			  newopt, newtype, &p);
++	ipv6_renew_option(IPV6_DSTOPTS, &opt2->dst1opt,
++			  (opt ? opt->dst1opt : NULL),
++			  newopt, newtype, &p);
+ 
+ 	opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
+ 			  (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
+@@ -1141,37 +1121,6 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
+ 	opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
+ 
+ 	return opt2;
+-out:
+-	sock_kfree_s(sk, opt2, opt2->tot_len);
+-	return ERR_PTR(err);
+-}
+-
+-/**
+- * ipv6_renew_options_kern - replace a specific ext hdr with a new one.
+- *
+- * @sk: sock from which to allocate memory
+- * @opt: original options
+- * @newtype: option type to replace in @opt
+- * @newopt: new option of type @newtype to replace (kernel-mem)
+- * @newoptlen: length of @newopt
+- *
+- * See ipv6_renew_options().  The difference is that @newopt is
+- * kernel memory, rather than user memory.
+- */
+-struct ipv6_txoptions *
+-ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt,
+-			int newtype, struct ipv6_opt_hdr *newopt,
+-			int newoptlen)
+-{
+-	struct ipv6_txoptions *ret_val;
+-	const mm_segment_t old_fs = get_fs();
+-
+-	set_fs(KERNEL_DS);
+-	ret_val = ipv6_renew_options(sk, opt, newtype,
+-				     (struct ipv6_opt_hdr __user *)newopt,
+-				     newoptlen);
+-	set_fs(old_fs);
+-	return ret_val;
+ }
+ 
+ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index 4d780c7f0130..c95c3486d904 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -398,6 +398,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ 	case IPV6_DSTOPTS:
+ 	{
+ 		struct ipv6_txoptions *opt;
++		struct ipv6_opt_hdr *new = NULL;
++
++		/* hop-by-hop / destination options are privileged option */
++		retv = -EPERM;
++		if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
++			break;
+ 
+ 		/* remove any sticky options header with a zero option
+ 		 * length, per RFC3542.
+@@ -409,17 +415,22 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ 		else if (optlen < sizeof(struct ipv6_opt_hdr) ||
+ 			 optlen & 0x7 || optlen > 8 * 255)
+ 			goto e_inval;
+-
+-		/* hop-by-hop / destination options are privileged option */
+-		retv = -EPERM;
+-		if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
+-			break;
++		else {
++			new = memdup_user(optval, optlen);
++			if (IS_ERR(new)) {
++				retv = PTR_ERR(new);
++				break;
++			}
++			if (unlikely(ipv6_optlen(new) > optlen)) {
++				kfree(new);
++				goto e_inval;
++			}
++		}
+ 
+ 		opt = rcu_dereference_protected(np->opt,
+ 						lockdep_sock_is_held(sk));
+-		opt = ipv6_renew_options(sk, opt, optname,
+-					 (struct ipv6_opt_hdr __user *)optval,
+-					 optlen);
++		opt = ipv6_renew_options(sk, opt, optname, new);
++		kfree(new);
+ 		if (IS_ERR(opt)) {
+ 			retv = PTR_ERR(opt);
+ 			break;
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index 0604a737eecf..a23cfd922509 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -2081,7 +2081,8 @@ void ipv6_mc_dad_complete(struct inet6_dev *idev)
+ 		mld_send_initial_cr(idev);
+ 		idev->mc_dad_count--;
+ 		if (idev->mc_dad_count)
+-			mld_dad_start_timer(idev, idev->mc_maxdelay);
++			mld_dad_start_timer(idev,
++					    unsolicited_report_interval(idev));
+ 	}
+ }
+ 
+@@ -2093,7 +2094,8 @@ static void mld_dad_timer_expire(struct timer_list *t)
+ 	if (idev->mc_dad_count) {
+ 		idev->mc_dad_count--;
+ 		if (idev->mc_dad_count)
+-			mld_dad_start_timer(idev, idev->mc_maxdelay);
++			mld_dad_start_timer(idev,
++					    unsolicited_report_interval(idev));
+ 	}
+ 	in6_dev_put(idev);
+ }
+@@ -2451,7 +2453,8 @@ static void mld_ifc_timer_expire(struct timer_list *t)
+ 	if (idev->mc_ifc_count) {
+ 		idev->mc_ifc_count--;
+ 		if (idev->mc_ifc_count)
+-			mld_ifc_start_timer(idev, idev->mc_maxdelay);
++			mld_ifc_start_timer(idev,
++					    unsolicited_report_interval(idev));
+ 	}
+ 	in6_dev_put(idev);
+ }
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index 685c2168f524..1e518cedffea 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -1907,6 +1907,7 @@ static struct xt_match ip6t_builtin_mt[] __read_mostly = {
+ 		.checkentry = icmp6_checkentry,
+ 		.proto      = IPPROTO_ICMPV6,
+ 		.family     = NFPROTO_IPV6,
++		.me	    = THIS_MODULE,
+ 	},
+ };
+ 
+diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
+index eeb4d3098ff4..e4d9e6976d3c 100644
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -107,7 +107,7 @@ static int nf_ct_frag6_sysctl_register(struct net *net)
+ 	if (hdr == NULL)
+ 		goto err_reg;
+ 
+-	net->nf_frag.sysctl.frags_hdr = hdr;
++	net->nf_frag_frags_hdr = hdr;
+ 	return 0;
+ 
+ err_reg:
+@@ -121,8 +121,8 @@ static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net)
+ {
+ 	struct ctl_table *table;
+ 
+-	table = net->nf_frag.sysctl.frags_hdr->ctl_table_arg;
+-	unregister_net_sysctl_table(net->nf_frag.sysctl.frags_hdr);
++	table = net->nf_frag_frags_hdr->ctl_table_arg;
++	unregister_net_sysctl_table(net->nf_frag_frags_hdr);
+ 	if (!net_eq(net, &init_net))
+ 		kfree(table);
+ }
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 05a265cd573d..7404a5114597 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4800,7 +4800,9 @@ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
+ 	skb_reset_network_header(skb);
+ 	skb_reset_mac_header(skb);
+ 
++	local_bh_disable();
+ 	__ieee80211_subif_start_xmit(skb, skb->dev, flags);
++	local_bh_enable();
+ 
+ 	return 0;
+ }
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 41ff04ee2554..6b2fa4870237 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1972,7 +1972,7 @@ int nf_conntrack_set_hashsize(const char *val, const struct kernel_param *kp)
+ 		return -EOPNOTSUPP;
+ 
+ 	/* On boot, we can set this without any fancy locking. */
+-	if (!nf_conntrack_htable_size)
++	if (!nf_conntrack_hash)
+ 		return param_set_uint(val, kp);
+ 
+ 	rc = kstrtouint(val, 0, &hashsize);
+diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
+index 551a1eddf0fa..a75b11c39312 100644
+--- a/net/netfilter/nf_conntrack_helper.c
++++ b/net/netfilter/nf_conntrack_helper.c
+@@ -465,6 +465,11 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
+ 
+ 	nf_ct_expect_iterate_destroy(expect_iter_me, NULL);
+ 	nf_ct_iterate_destroy(unhelp, me);
++
++	/* Maybe someone has gotten the helper already when unhelp above.
++	 * So need to wait it.
++	 */
++	synchronize_rcu();
+ }
+ EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister);
+ 
+diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
+index abe647d5b8c6..9ce6336d1e55 100644
+--- a/net/netfilter/nf_conntrack_proto_dccp.c
++++ b/net/netfilter/nf_conntrack_proto_dccp.c
+@@ -243,14 +243,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] =
+ 		 * We currently ignore Sync packets
+ 		 *
+ 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
+-			sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
++			sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+ 		},
+ 		[DCCP_PKT_SYNCACK] = {
+ 		/*
+ 		 * We currently ignore SyncAck packets
+ 		 *
+ 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
+-			sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
++			sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+ 		},
+ 	},
+ 	[CT_DCCP_ROLE_SERVER] = {
+@@ -371,14 +371,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] =
+ 		 * We currently ignore Sync packets
+ 		 *
+ 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
+-			sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
++			sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+ 		},
+ 		[DCCP_PKT_SYNCACK] = {
+ 		/*
+ 		 * We currently ignore SyncAck packets
+ 		 *
+ 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
+-			sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
++			sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+ 		},
+ 	},
+ };
+diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
+index a82dfb8f8790..d60589747afb 100644
+--- a/net/netfilter/nf_log.c
++++ b/net/netfilter/nf_log.c
+@@ -439,6 +439,10 @@ static int nf_log_proc_dostring(struct ctl_table *table, int write,
+ 	if (write) {
+ 		struct ctl_table tmp = *table;
+ 
++		/* proc_dostring() can append to existing strings, so we need to
++		 * initialize it as an empty string.
++		 */
++		buf[0] = '\0';
+ 		tmp.data = buf;
+ 		r = proc_dostring(&tmp, write, buffer, lenp, ppos);
+ 		if (r)
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index 1d99a1efdafc..0210b40a529a 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -825,10 +825,18 @@ nft_target_select_ops(const struct nft_ctx *ctx,
+ 	rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
+ 	family = ctx->family;
+ 
++	if (strcmp(tg_name, XT_ERROR_TARGET) == 0 ||
++	    strcmp(tg_name, XT_STANDARD_TARGET) == 0 ||
++	    strcmp(tg_name, "standard") == 0)
++		return ERR_PTR(-EINVAL);
++
+ 	/* Re-use the existing target if it's already loaded. */
+ 	list_for_each_entry(nft_target, &nft_target_list, head) {
+ 		struct xt_target *target = nft_target->ops.data;
+ 
++		if (!target->target)
++			continue;
++
+ 		if (nft_target_cmp(target, tg_name, rev, family))
+ 			return &nft_target->ops;
+ 	}
+@@ -837,6 +845,11 @@ nft_target_select_ops(const struct nft_ctx *ctx,
+ 	if (IS_ERR(target))
+ 		return ERR_PTR(-ENOENT);
+ 
++	if (!target->target) {
++		err = -EINVAL;
++		goto err;
++	}
++
+ 	if (target->targetsize > nla_len(tb[NFTA_TARGET_INFO])) {
+ 		err = -EINVAL;
+ 		goto err;
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index cb0f02785749..af663a27c191 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2910,6 +2910,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ 			goto out_free;
+ 	} else if (reserve) {
+ 		skb_reserve(skb, -reserve);
++		if (len < reserve)
++			skb_reset_network_header(skb);
+ 	}
+ 
+ 	/* Returns -EFAULT on error */
+@@ -4256,6 +4258,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 	}
+ 
+ 	if (req->tp_block_nr) {
++		unsigned int min_frame_size;
++
+ 		/* Sanity tests and some calculations */
+ 		err = -EBUSY;
+ 		if (unlikely(rb->pg_vec))
+@@ -4278,12 +4282,12 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 			goto out;
+ 		if (unlikely(!PAGE_ALIGNED(req->tp_block_size)))
+ 			goto out;
++		min_frame_size = po->tp_hdrlen + po->tp_reserve;
+ 		if (po->tp_version >= TPACKET_V3 &&
+-		    req->tp_block_size <=
+-		    BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr))
++		    req->tp_block_size <
++		    BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + min_frame_size)
+ 			goto out;
+-		if (unlikely(req->tp_frame_size < po->tp_hdrlen +
+-					po->tp_reserve))
++		if (unlikely(req->tp_frame_size < min_frame_size))
+ 			goto out;
+ 		if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
+ 			goto out;
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index 2aa07b547b16..86e1e37eb4e8 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -191,8 +191,13 @@ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb,
+ 	hdr->type = cpu_to_le32(type);
+ 	hdr->src_node_id = cpu_to_le32(from->sq_node);
+ 	hdr->src_port_id = cpu_to_le32(from->sq_port);
+-	hdr->dst_node_id = cpu_to_le32(to->sq_node);
+-	hdr->dst_port_id = cpu_to_le32(to->sq_port);
++	if (to->sq_port == QRTR_PORT_CTRL) {
++		hdr->dst_node_id = cpu_to_le32(node->nid);
++		hdr->dst_port_id = cpu_to_le32(QRTR_NODE_BCAST);
++	} else {
++		hdr->dst_node_id = cpu_to_le32(to->sq_node);
++		hdr->dst_port_id = cpu_to_le32(to->sq_port);
++	}
+ 
+ 	hdr->size = cpu_to_le32(len);
+ 	hdr->confirm_rx = 0;
+@@ -764,6 +769,10 @@ static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ 	node = NULL;
+ 	if (addr->sq_node == QRTR_NODE_BCAST) {
+ 		enqueue_fn = qrtr_bcast_enqueue;
++		if (addr->sq_port != QRTR_PORT_CTRL) {
++			release_sock(sk);
++			return -ENOTCONN;
++		}
+ 	} else if (addr->sq_node == ipc->us.sq_node) {
+ 		enqueue_fn = qrtr_local_enqueue;
+ 	} else {
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index abef75da89a7..cfb05953b0e5 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -659,11 +659,19 @@ static void rds_conn_info(struct socket *sock, unsigned int len,
+ 
+ int rds_conn_init(void)
+ {
++	int ret;
++
++	ret = rds_loop_net_init(); /* register pernet callback */
++	if (ret)
++		return ret;
++
+ 	rds_conn_slab = kmem_cache_create("rds_connection",
+ 					  sizeof(struct rds_connection),
+ 					  0, 0, NULL);
+-	if (!rds_conn_slab)
++	if (!rds_conn_slab) {
++		rds_loop_net_exit();
+ 		return -ENOMEM;
++	}
+ 
+ 	rds_info_register_func(RDS_INFO_CONNECTIONS, rds_conn_info);
+ 	rds_info_register_func(RDS_INFO_SEND_MESSAGES,
+@@ -676,6 +684,7 @@ int rds_conn_init(void)
+ 
+ void rds_conn_exit(void)
+ {
++	rds_loop_net_exit(); /* unregister pernet callback */
+ 	rds_loop_exit();
+ 
+ 	WARN_ON(!hlist_empty(rds_conn_hash));
+diff --git a/net/rds/loop.c b/net/rds/loop.c
+index dac6218a460e..feea1f96ee2a 100644
+--- a/net/rds/loop.c
++++ b/net/rds/loop.c
+@@ -33,6 +33,8 @@
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/in.h>
++#include <net/net_namespace.h>
++#include <net/netns/generic.h>
+ 
+ #include "rds_single_path.h"
+ #include "rds.h"
+@@ -40,6 +42,17 @@
+ 
+ static DEFINE_SPINLOCK(loop_conns_lock);
+ static LIST_HEAD(loop_conns);
++static atomic_t rds_loop_unloading = ATOMIC_INIT(0);
++
++static void rds_loop_set_unloading(void)
++{
++	atomic_set(&rds_loop_unloading, 1);
++}
++
++static bool rds_loop_is_unloading(struct rds_connection *conn)
++{
++	return atomic_read(&rds_loop_unloading) != 0;
++}
+ 
+ /*
+  * This 'loopback' transport is a special case for flows that originate
+@@ -165,6 +178,8 @@ void rds_loop_exit(void)
+ 	struct rds_loop_connection *lc, *_lc;
+ 	LIST_HEAD(tmp_list);
+ 
++	rds_loop_set_unloading();
++	synchronize_rcu();
+ 	/* avoid calling conn_destroy with irqs off */
+ 	spin_lock_irq(&loop_conns_lock);
+ 	list_splice(&loop_conns, &tmp_list);
+@@ -177,6 +192,46 @@ void rds_loop_exit(void)
+ 	}
+ }
+ 
++static void rds_loop_kill_conns(struct net *net)
++{
++	struct rds_loop_connection *lc, *_lc;
++	LIST_HEAD(tmp_list);
++
++	spin_lock_irq(&loop_conns_lock);
++	list_for_each_entry_safe(lc, _lc, &loop_conns, loop_node)  {
++		struct net *c_net = read_pnet(&lc->conn->c_net);
++
++		if (net != c_net)
++			continue;
++		list_move_tail(&lc->loop_node, &tmp_list);
++	}
++	spin_unlock_irq(&loop_conns_lock);
++
++	list_for_each_entry_safe(lc, _lc, &tmp_list, loop_node) {
++		WARN_ON(lc->conn->c_passive);
++		rds_conn_destroy(lc->conn);
++	}
++}
++
++static void __net_exit rds_loop_exit_net(struct net *net)
++{
++	rds_loop_kill_conns(net);
++}
++
++static struct pernet_operations rds_loop_net_ops = {
++	.exit = rds_loop_exit_net,
++};
++
++int rds_loop_net_init(void)
++{
++	return register_pernet_device(&rds_loop_net_ops);
++}
++
++void rds_loop_net_exit(void)
++{
++	unregister_pernet_device(&rds_loop_net_ops);
++}
++
+ /*
+  * This is missing .xmit_* because loop doesn't go through generic
+  * rds_send_xmit() and doesn't call rds_recv_incoming().  .listen_stop and
+@@ -194,4 +249,5 @@ struct rds_transport rds_loop_transport = {
+ 	.inc_free		= rds_loop_inc_free,
+ 	.t_name			= "loopback",
+ 	.t_type			= RDS_TRANS_LOOP,
++	.t_unloading		= rds_loop_is_unloading,
+ };
+diff --git a/net/rds/loop.h b/net/rds/loop.h
+index 469fa4b2da4f..bbc8cdd030df 100644
+--- a/net/rds/loop.h
++++ b/net/rds/loop.h
+@@ -5,6 +5,8 @@
+ /* loop.c */
+ extern struct rds_transport rds_loop_transport;
+ 
++int rds_loop_net_init(void);
++void rds_loop_net_exit(void);
+ void rds_loop_exit(void);
+ 
+ #endif
+diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
+index 7e28b2ce1437..e65cc4d35cee 100644
+--- a/net/sched/act_csum.c
++++ b/net/sched/act_csum.c
+@@ -91,7 +91,7 @@ static int tcf_csum_init(struct net *net, struct nlattr *nla,
+ 	}
+ 	params_old = rtnl_dereference(p->params);
+ 
+-	params_new->action = parm->action;
++	p->tcf_action = parm->action;
+ 	params_new->update_flags = parm->update_flags;
+ 	rcu_assign_pointer(p->params, params_new);
+ 	if (params_old)
+@@ -561,7 +561,7 @@ static int tcf_csum(struct sk_buff *skb, const struct tc_action *a,
+ 	tcf_lastuse_update(&p->tcf_tm);
+ 	bstats_cpu_update(this_cpu_ptr(p->common.cpu_bstats), skb);
+ 
+-	action = params->action;
++	action = READ_ONCE(p->tcf_action);
+ 	if (unlikely(action == TC_ACT_SHOT))
+ 		goto drop_stats;
+ 
+@@ -599,11 +599,11 @@ static int tcf_csum_dump(struct sk_buff *skb, struct tc_action *a, int bind,
+ 		.index   = p->tcf_index,
+ 		.refcnt  = p->tcf_refcnt - ref,
+ 		.bindcnt = p->tcf_bindcnt - bind,
++		.action  = p->tcf_action,
+ 	};
+ 	struct tcf_t t;
+ 
+ 	params = rtnl_dereference(p->params);
+-	opt.action = params->action;
+ 	opt.update_flags = params->update_flags;
+ 
+ 	if (nla_put(skb, TCA_CSUM_PARMS, sizeof(opt), &opt))
+diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
+index 626dac81a48a..9bc6c2ae98a5 100644
+--- a/net/sched/act_tunnel_key.c
++++ b/net/sched/act_tunnel_key.c
+@@ -36,7 +36,7 @@ static int tunnel_key_act(struct sk_buff *skb, const struct tc_action *a,
+ 
+ 	tcf_lastuse_update(&t->tcf_tm);
+ 	bstats_cpu_update(this_cpu_ptr(t->common.cpu_bstats), skb);
+-	action = params->action;
++	action = READ_ONCE(t->tcf_action);
+ 
+ 	switch (params->tcft_action) {
+ 	case TCA_TUNNEL_KEY_ACT_RELEASE:
+@@ -182,7 +182,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
+ 
+ 	params_old = rtnl_dereference(t->params);
+ 
+-	params_new->action = parm->action;
++	t->tcf_action = parm->action;
+ 	params_new->tcft_action = parm->t_action;
+ 	params_new->tcft_enc_metadata = metadata;
+ 
+@@ -254,13 +254,13 @@ static int tunnel_key_dump(struct sk_buff *skb, struct tc_action *a,
+ 		.index    = t->tcf_index,
+ 		.refcnt   = t->tcf_refcnt - ref,
+ 		.bindcnt  = t->tcf_bindcnt - bind,
++		.action   = t->tcf_action,
+ 	};
+ 	struct tcf_t tm;
+ 
+ 	params = rtnl_dereference(t->params);
+ 
+ 	opt.t_action = params->tcft_action;
+-	opt.action = params->action;
+ 
+ 	if (nla_put(skb, TCA_TUNNEL_KEY_PARMS, sizeof(opt), &opt))
+ 		goto nla_put_failure;
+diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
+index be296d633e95..ded86c449c49 100644
+--- a/net/sctp/chunk.c
++++ b/net/sctp/chunk.c
+@@ -247,7 +247,9 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
+ 	/* Account for a different sized first fragment */
+ 	if (msg_len >= first_len) {
+ 		msg->can_delay = 0;
+-		SCTP_INC_STATS(sock_net(asoc->base.sk), SCTP_MIB_FRAGUSRMSGS);
++		if (msg_len > first_len)
++			SCTP_INC_STATS(sock_net(asoc->base.sk),
++				       SCTP_MIB_FRAGUSRMSGS);
+ 	} else {
+ 		/* Which may be the only one... */
+ 		first_len = msg_len;
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index 544bab42f925..9c5f447fa366 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -1231,8 +1231,7 @@ static int smc_shutdown(struct socket *sock, int how)
+ 	lock_sock(sk);
+ 
+ 	rc = -ENOTCONN;
+-	if ((sk->sk_state != SMC_LISTEN) &&
+-	    (sk->sk_state != SMC_ACTIVE) &&
++	if ((sk->sk_state != SMC_ACTIVE) &&
+ 	    (sk->sk_state != SMC_PEERCLOSEWAIT1) &&
+ 	    (sk->sk_state != SMC_PEERCLOSEWAIT2) &&
+ 	    (sk->sk_state != SMC_APPCLOSEWAIT1) &&
+diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
+index 3a988c22f627..49062e752cbf 100644
+--- a/net/smc/smc_clc.c
++++ b/net/smc/smc_clc.c
+@@ -250,6 +250,7 @@ out:
+ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
+ 		     u8 expected_type)
+ {
++	long rcvtimeo = smc->clcsock->sk->sk_rcvtimeo;
+ 	struct sock *clc_sk = smc->clcsock->sk;
+ 	struct smc_clc_msg_hdr *clcm = buf;
+ 	struct msghdr msg = {NULL, 0};
+@@ -306,7 +307,6 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
+ 	memset(&msg, 0, sizeof(struct msghdr));
+ 	iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &vec, 1, datlen);
+ 	krflags = MSG_WAITALL;
+-	smc->clcsock->sk->sk_rcvtimeo = CLC_WAIT_TIME;
+ 	len = sock_recvmsg(smc->clcsock, &msg, krflags);
+ 	if (len < datlen || !smc_clc_msg_hdr_valid(clcm)) {
+ 		smc->sk.sk_err = EPROTO;
+@@ -322,6 +322,7 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
+ 	}
+ 
+ out:
++	smc->clcsock->sk->sk_rcvtimeo = rcvtimeo;
+ 	return reason_code;
+ }
+ 
+diff --git a/net/tipc/discover.c b/net/tipc/discover.c
+index 9f666e0650e2..2830709957bd 100644
+--- a/net/tipc/discover.c
++++ b/net/tipc/discover.c
+@@ -133,6 +133,8 @@ static void disc_dupl_alert(struct tipc_bearer *b, u32 node_addr,
+ }
+ 
+ /* tipc_disc_addr_trial(): - handle an address uniqueness trial from peer
++ * Returns true if message should be dropped by caller, i.e., if it is a
++ * trial message or we are inside trial period. Otherwise false.
+  */
+ static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d,
+ 				     struct tipc_media_addr *maddr,
+@@ -168,8 +170,9 @@ static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d,
+ 		msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
+ 	}
+ 
++	/* Accept regular link requests/responses only after trial period */
+ 	if (mtyp != DSC_TRIAL_MSG)
+-		return false;
++		return trial;
+ 
+ 	sugg_addr = tipc_node_try_addr(net, peer_id, src);
+ 	if (sugg_addr)
+@@ -284,7 +287,6 @@ static void tipc_disc_timeout(struct timer_list *t)
+ {
+ 	struct tipc_discoverer *d = from_timer(d, t, timer);
+ 	struct tipc_net *tn = tipc_net(d->net);
+-	u32 self = tipc_own_addr(d->net);
+ 	struct tipc_media_addr maddr;
+ 	struct sk_buff *skb = NULL;
+ 	struct net *net = d->net;
+@@ -298,12 +300,14 @@ static void tipc_disc_timeout(struct timer_list *t)
+ 		goto exit;
+ 	}
+ 
+-	/* Did we just leave the address trial period ? */
+-	if (!self && !time_before(jiffies, tn->addr_trial_end)) {
+-		self = tn->trial_addr;
+-		tipc_net_finalize(net, self);
+-		msg_set_prevnode(buf_msg(d->skb), self);
++	/* Trial period over ? */
++	if (!time_before(jiffies, tn->addr_trial_end)) {
++		/* Did we just leave it ? */
++		if (!tipc_own_addr(net))
++			tipc_net_finalize(net, tn->trial_addr);
++
+ 		msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
++		msg_set_prevnode(buf_msg(d->skb), tipc_own_addr(net));
+ 	}
+ 
+ 	/* Adjust timeout interval according to discovery phase */
+diff --git a/net/tipc/net.c b/net/tipc/net.c
+index 4fbaa0464405..a7f6964c3a4b 100644
+--- a/net/tipc/net.c
++++ b/net/tipc/net.c
+@@ -121,12 +121,17 @@ int tipc_net_init(struct net *net, u8 *node_id, u32 addr)
+ 
+ void tipc_net_finalize(struct net *net, u32 addr)
+ {
+-	tipc_set_node_addr(net, addr);
+-	smp_mb();
+-	tipc_named_reinit(net);
+-	tipc_sk_reinit(net);
+-	tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
+-			     TIPC_CLUSTER_SCOPE, 0, addr);
++	struct tipc_net *tn = tipc_net(net);
++
++	spin_lock_bh(&tn->node_list_lock);
++	if (!tipc_own_addr(net)) {
++		tipc_set_node_addr(net, addr);
++		tipc_named_reinit(net);
++		tipc_sk_reinit(net);
++		tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
++				     TIPC_CLUSTER_SCOPE, 0, addr);
++	}
++	spin_unlock_bh(&tn->node_list_lock);
+ }
+ 
+ void tipc_net_stop(struct net *net)
+diff --git a/net/tipc/node.c b/net/tipc/node.c
+index f29549de9245..aa09c515775f 100644
+--- a/net/tipc/node.c
++++ b/net/tipc/node.c
+@@ -776,6 +776,7 @@ static u32 tipc_node_suggest_addr(struct net *net, u32 addr)
+ }
+ 
+ /* tipc_node_try_addr(): Check if addr can be used by peer, suggest other if not
++ * Returns suggested address if any, otherwise 0
+  */
+ u32 tipc_node_try_addr(struct net *net, u8 *id, u32 addr)
+ {
+@@ -798,12 +799,14 @@ u32 tipc_node_try_addr(struct net *net, u8 *id, u32 addr)
+ 	if (n) {
+ 		addr = n->addr;
+ 		tipc_node_put(n);
++		return addr;
+ 	}
+-	/* Even this node may be in trial phase */
++
++	/* Even this node may be in conflict */
+ 	if (tn->trial_addr == addr)
+ 		return tipc_node_suggest_addr(net, addr);
+ 
+-	return addr;
++	return 0;
+ }
+ 
+ void tipc_node_check_dest(struct net *net, u32 addr,
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 60708a4ebed4..237e227c9707 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -705,6 +705,10 @@ static int decrypt_skb(struct sock *sk, struct sk_buff *skb,
+ 	nsg = skb_to_sgvec(skb, &sgin[1],
+ 			   rxm->offset + tls_ctx->rx.prepend_size,
+ 			   rxm->full_len - tls_ctx->rx.prepend_size);
++	if (nsg < 0) {
++		ret = nsg;
++		goto out;
++	}
+ 
+ 	tls_make_aad(ctx->rx_aad_ciphertext,
+ 		     rxm->full_len - tls_ctx->rx.overhead_size,
+@@ -716,6 +720,7 @@ static int decrypt_skb(struct sock *sk, struct sk_buff *skb,
+ 				rxm->full_len - tls_ctx->rx.overhead_size,
+ 				skb, sk->sk_allocation);
+ 
++out:
+ 	if (sgin != &sgin_arr[0])
+ 		kfree(sgin);
+ 
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 7c5135a92d76..f8e4371a1129 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -6061,7 +6061,7 @@ do {									    \
+ 				  nl80211_check_s32);
+ 	/*
+ 	 * Check HT operation mode based on
+-	 * IEEE 802.11 2012 8.4.2.59 HT Operation element.
++	 * IEEE 802.11-2016 9.4.2.57 HT Operation element.
+ 	 */
+ 	if (tb[NL80211_MESHCONF_HT_OPMODE]) {
+ 		ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
+@@ -6071,22 +6071,9 @@ do {									    \
+ 				  IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
+ 			return -EINVAL;
+ 
+-		if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
+-		    (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
+-			return -EINVAL;
++		/* NON_HT_STA bit is reserved, but some programs set it */
++		ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
+ 
+-		switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
+-		case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
+-		case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
+-			if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
+-				return -EINVAL;
+-			break;
+-		case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
+-		case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
+-			if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
+-				return -EINVAL;
+-			break;
+-		}
+ 		cfg->ht_opmode = ht_opmode;
+ 		mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
+ 	}
+@@ -10716,9 +10703,12 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
+ 				    rem) {
+ 			u8 *mask_pat;
+ 
+-			nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
+-					 nl80211_packet_pattern_policy,
+-					 info->extack);
++			err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
++					       nl80211_packet_pattern_policy,
++					       info->extack);
++			if (err)
++				goto error;
++
+ 			err = -EINVAL;
+ 			if (!pat_tb[NL80211_PKTPAT_MASK] ||
+ 			    !pat_tb[NL80211_PKTPAT_PATTERN])
+@@ -10967,8 +10957,11 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
+ 			    rem) {
+ 		u8 *mask_pat;
+ 
+-		nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
+-				 nl80211_packet_pattern_policy, NULL);
++		err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
++				       nl80211_packet_pattern_policy, NULL);
++		if (err)
++			return err;
++
+ 		if (!pat_tb[NL80211_PKTPAT_MASK] ||
+ 		    !pat_tb[NL80211_PKTPAT_PATTERN])
+ 			return -EINVAL;
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 080035f056d9..1e50b70ad668 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -1671,9 +1671,11 @@ static inline unsigned int userpolicy_type_attrsize(void)
+ #ifdef CONFIG_XFRM_SUB_POLICY
+ static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
+ {
+-	struct xfrm_userpolicy_type upt = {
+-		.type = type,
+-	};
++	struct xfrm_userpolicy_type upt;
++
++	/* Sadly there are two holes in struct xfrm_userpolicy_type */
++	memset(&upt, 0, sizeof(upt));
++	upt.type = type;
+ 
+ 	return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
+ }
+diff --git a/samples/bpf/parse_varlen.c b/samples/bpf/parse_varlen.c
+index 95c16324760c..0b6f22feb2c9 100644
+--- a/samples/bpf/parse_varlen.c
++++ b/samples/bpf/parse_varlen.c
+@@ -6,6 +6,7 @@
+  */
+ #define KBUILD_MODNAME "foo"
+ #include <linux/if_ether.h>
++#include <linux/if_vlan.h>
+ #include <linux/ip.h>
+ #include <linux/ipv6.h>
+ #include <linux/in.h>
+@@ -108,11 +109,6 @@ static int parse_ipv6(void *data, uint64_t nh_off, void *data_end)
+ 	return 0;
+ }
+ 
+-struct vlan_hdr {
+-	uint16_t h_vlan_TCI;
+-	uint16_t h_vlan_encapsulated_proto;
+-};
+-
+ SEC("varlen")
+ int handle_ingress(struct __sk_buff *skb)
+ {
+diff --git a/samples/bpf/test_overhead_user.c b/samples/bpf/test_overhead_user.c
+index e1d35e07a10e..da71dcc21634 100644
+--- a/samples/bpf/test_overhead_user.c
++++ b/samples/bpf/test_overhead_user.c
+@@ -6,6 +6,7 @@
+  */
+ #define _GNU_SOURCE
+ #include <sched.h>
++#include <errno.h>
+ #include <stdio.h>
+ #include <sys/types.h>
+ #include <asm/unistd.h>
+@@ -44,8 +45,13 @@ static void test_task_rename(int cpu)
+ 		exit(1);
+ 	}
+ 	start_time = time_get_ns();
+-	for (i = 0; i < MAX_CNT; i++)
+-		write(fd, buf, sizeof(buf));
++	for (i = 0; i < MAX_CNT; i++) {
++		if (write(fd, buf, sizeof(buf)) < 0) {
++			printf("task rename failed: %s\n", strerror(errno));
++			close(fd);
++			return;
++		}
++	}
+ 	printf("task_rename:%d: %lld events per sec\n",
+ 	       cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time));
+ 	close(fd);
+@@ -63,8 +69,13 @@ static void test_urandom_read(int cpu)
+ 		exit(1);
+ 	}
+ 	start_time = time_get_ns();
+-	for (i = 0; i < MAX_CNT; i++)
+-		read(fd, buf, sizeof(buf));
++	for (i = 0; i < MAX_CNT; i++) {
++		if (read(fd, buf, sizeof(buf)) < 0) {
++			printf("failed to read from /dev/urandom: %s\n", strerror(errno));
++			close(fd);
++			return;
++		}
++	}
+ 	printf("urandom_read:%d: %lld events per sec\n",
+ 	       cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time));
+ 	close(fd);
+diff --git a/samples/bpf/trace_event_user.c b/samples/bpf/trace_event_user.c
+index 56f7a259a7c9..ff2b8dae25ec 100644
+--- a/samples/bpf/trace_event_user.c
++++ b/samples/bpf/trace_event_user.c
+@@ -121,6 +121,16 @@ static void print_stacks(void)
+ 	}
+ }
+ 
++static inline int generate_load(void)
++{
++	if (system("dd if=/dev/zero of=/dev/null count=5000k status=none") < 0) {
++		printf("failed to generate some load with dd: %s\n", strerror(errno));
++		return -1;
++	}
++
++	return 0;
++}
++
+ static void test_perf_event_all_cpu(struct perf_event_attr *attr)
+ {
+ 	int nr_cpus = sysconf(_SC_NPROCESSORS_CONF);
+@@ -141,7 +151,11 @@ static void test_perf_event_all_cpu(struct perf_event_attr *attr)
+ 		assert(ioctl(pmu_fd[i], PERF_EVENT_IOC_SET_BPF, prog_fd[0]) == 0);
+ 		assert(ioctl(pmu_fd[i], PERF_EVENT_IOC_ENABLE) == 0);
+ 	}
+-	system("dd if=/dev/zero of=/dev/null count=5000k status=none");
++
++	if (generate_load() < 0) {
++		error = 1;
++		goto all_cpu_err;
++	}
+ 	print_stacks();
+ all_cpu_err:
+ 	for (i--; i >= 0; i--) {
+@@ -155,7 +169,7 @@ all_cpu_err:
+ 
+ static void test_perf_event_task(struct perf_event_attr *attr)
+ {
+-	int pmu_fd;
++	int pmu_fd, error = 0;
+ 
+ 	/* per task perf event, enable inherit so the "dd ..." command can be traced properly.
+ 	 * Enabling inherit will cause bpf_perf_prog_read_time helper failure.
+@@ -170,10 +184,17 @@ static void test_perf_event_task(struct perf_event_attr *attr)
+ 	}
+ 	assert(ioctl(pmu_fd, PERF_EVENT_IOC_SET_BPF, prog_fd[0]) == 0);
+ 	assert(ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE) == 0);
+-	system("dd if=/dev/zero of=/dev/null count=5000k status=none");
++
++	if (generate_load() < 0) {
++		error = 1;
++		goto err;
++	}
+ 	print_stacks();
++err:
+ 	ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
+ 	close(pmu_fd);
++	if (error)
++		int_exit(0);
+ }
+ 
+ static void test_bpf_perf_event(void)
+diff --git a/samples/bpf/xdp2skb_meta.sh b/samples/bpf/xdp2skb_meta.sh
+index b9c9549c4c27..4bde9d066c46 100755
+--- a/samples/bpf/xdp2skb_meta.sh
++++ b/samples/bpf/xdp2skb_meta.sh
+@@ -16,8 +16,8 @@
+ BPF_FILE=xdp2skb_meta_kern.o
+ DIR=$(dirname $0)
+ 
+-export TC=/usr/sbin/tc
+-export IP=/usr/sbin/ip
++[ -z "$TC" ] && TC=tc
++[ -z "$IP" ] && IP=ip
+ 
+ function usage() {
+     echo ""
+@@ -53,7 +53,7 @@ function _call_cmd() {
+     local allow_fail="$2"
+     shift 2
+     if [[ -n "$VERBOSE" ]]; then
+-	echo "$(basename $cmd) $@"
++	echo "$cmd $@"
+     fi
+     if [[ -n "$DRYRUN" ]]; then
+ 	return
+diff --git a/scripts/kconfig/zconf.y b/scripts/kconfig/zconf.y
+index ad6305b0f40c..f8f7cea86d7a 100644
+--- a/scripts/kconfig/zconf.y
++++ b/scripts/kconfig/zconf.y
+@@ -31,7 +31,7 @@ struct symbol *symbol_hash[SYMBOL_HASHSIZE];
+ static struct menu *current_menu, *current_entry;
+ 
+ %}
+-%expect 32
++%expect 31
+ 
+ %union
+ {
+@@ -345,7 +345,7 @@ choice_block:
+ 
+ /* if entry */
+ 
+-if_entry: T_IF expr nl
++if_entry: T_IF expr T_EOL
+ {
+ 	printd(DEBUG_PARSE, "%s:%d:if\n", zconf_curname(), zconf_lineno());
+ 	menu_add_entry(NULL);
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 0b414836bebd..60419cc2b7b8 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -2296,6 +2296,7 @@ static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
+ 	struct smack_known *skp = smk_of_task_struct(p);
+ 
+ 	isp->smk_inode = skp;
++	isp->smk_flags |= SMK_INODE_INSTANT;
+ }
+ 
+ /*
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index ee8d0d86f0df..6fd4b074b206 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -2004,7 +2004,8 @@ static int snd_seq_ioctl_query_next_client(struct snd_seq_client *client,
+ 	struct snd_seq_client *cptr = NULL;
+ 
+ 	/* search for next client */
+-	info->client++;
++	if (info->client < INT_MAX)
++		info->client++;
+ 	if (info->client < 0)
+ 		info->client = 0;
+ 	for (; info->client < SNDRV_SEQ_MAX_CLIENTS; info->client++) {
+diff --git a/tools/build/Build.include b/tools/build/Build.include
+index d9048f145f97..950c1504ca37 100644
+--- a/tools/build/Build.include
++++ b/tools/build/Build.include
+@@ -98,4 +98,4 @@ cxx_flags = -Wp,-MD,$(depfile) -Wp,-MT,$@ $(CXXFLAGS) -D"BUILD_STR(s)=\#s" $(CXX
+ ###
+ ## HOSTCC C flags
+ 
+-host_c_flags = -Wp,-MD,$(depfile) -Wp,-MT,$@ $(CHOSTFLAGS) -D"BUILD_STR(s)=\#s" $(CHOSTFLAGS_$(basetarget).o) $(CHOSTFLAGS_$(obj))
++host_c_flags = -Wp,-MD,$(depfile) -Wp,-MT,$@ $(HOSTCFLAGS) -D"BUILD_STR(s)=\#s" $(HOSTCFLAGS_$(basetarget).o) $(HOSTCFLAGS_$(obj))
+diff --git a/tools/build/Makefile b/tools/build/Makefile
+index 5eb4b5ad79cb..5edf65e684ab 100644
+--- a/tools/build/Makefile
++++ b/tools/build/Makefile
+@@ -43,7 +43,7 @@ $(OUTPUT)fixdep-in.o: FORCE
+ 	$(Q)$(MAKE) $(build)=fixdep
+ 
+ $(OUTPUT)fixdep: $(OUTPUT)fixdep-in.o
+-	$(QUIET_LINK)$(HOSTCC) $(LDFLAGS) -o $@ $<
++	$(QUIET_LINK)$(HOSTCC) $(HOSTLDFLAGS) -o $@ $<
+ 
+ FORCE:
+ 
+diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
+index 4e60e105583e..0d1acb704f64 100644
+--- a/tools/objtool/elf.c
++++ b/tools/objtool/elf.c
+@@ -302,19 +302,34 @@ static int read_symbols(struct elf *elf)
+ 				continue;
+ 			sym->pfunc = sym->cfunc = sym;
+ 			coldstr = strstr(sym->name, ".cold.");
+-			if (coldstr) {
+-				coldstr[0] = '\0';
+-				pfunc = find_symbol_by_name(elf, sym->name);
+-				coldstr[0] = '.';
+-
+-				if (!pfunc) {
+-					WARN("%s(): can't find parent function",
+-					     sym->name);
+-					goto err;
+-				}
+-
+-				sym->pfunc = pfunc;
+-				pfunc->cfunc = sym;
++			if (!coldstr)
++				continue;
++
++			coldstr[0] = '\0';
++			pfunc = find_symbol_by_name(elf, sym->name);
++			coldstr[0] = '.';
++
++			if (!pfunc) {
++				WARN("%s(): can't find parent function",
++				     sym->name);
++				goto err;
++			}
++
++			sym->pfunc = pfunc;
++			pfunc->cfunc = sym;
++
++			/*
++			 * Unfortunately, -fnoreorder-functions puts the child
++			 * inside the parent.  Remove the overlap so we can
++			 * have sane assumptions.
++			 *
++			 * Note that pfunc->len now no longer matches
++			 * pfunc->sym.st_size.
++			 */
++			if (sym->sec == pfunc->sec &&
++			    sym->offset >= pfunc->offset &&
++			    sym->offset + sym->len == pfunc->offset + pfunc->len) {
++				pfunc->len -= sym->len;
+ 			}
+ 		}
+ 	}
+diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
+index ae7dc46e8f8a..46d69c5d2ec3 100644
+--- a/tools/perf/Makefile.config
++++ b/tools/perf/Makefile.config
+@@ -207,8 +207,7 @@ ifdef PYTHON_CONFIG
+   PYTHON_EMBED_LDOPTS := $(shell $(PYTHON_CONFIG_SQ) --ldflags 2>/dev/null)
+   PYTHON_EMBED_LDFLAGS := $(call strip-libs,$(PYTHON_EMBED_LDOPTS))
+   PYTHON_EMBED_LIBADD := $(call grep-libs,$(PYTHON_EMBED_LDOPTS)) -lutil
+-  PYTHON_EMBED_CCOPTS := $(shell $(PYTHON_CONFIG_SQ) --cflags 2>/dev/null)
+-  PYTHON_EMBED_CCOPTS := $(filter-out -specs=%,$(PYTHON_EMBED_CCOPTS))
++  PYTHON_EMBED_CCOPTS := $(shell $(PYTHON_CONFIG_SQ) --includes 2>/dev/null)
+   FLAGS_PYTHON_EMBED := $(PYTHON_EMBED_CCOPTS) $(PYTHON_EMBED_LDOPTS)
+ endif
+ 
+diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+index 0c370f81e002..bd630c222e65 100644
+--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c
++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+@@ -243,7 +243,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain)
+ 	u64 ip;
+ 	u64 skip_slot = -1;
+ 
+-	if (chain->nr < 3)
++	if (!chain || chain->nr < 3)
+ 		return skip_slot;
+ 
+ 	ip = chain->ips[2];
+diff --git a/tools/perf/arch/x86/util/perf_regs.c b/tools/perf/arch/x86/util/perf_regs.c
+index 4b2caf6d48e7..fead6b3b4206 100644
+--- a/tools/perf/arch/x86/util/perf_regs.c
++++ b/tools/perf/arch/x86/util/perf_regs.c
+@@ -226,7 +226,7 @@ int arch_sdt_arg_parse_op(char *old_op, char **new_op)
+ 		else if (rm[2].rm_so != rm[2].rm_eo)
+ 			prefix[0] = '+';
+ 		else
+-			strncpy(prefix, "+0", 2);
++			scnprintf(prefix, sizeof(prefix), "+0");
+ 	}
+ 
+ 	/* Rename register */
+diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
+index 63eb49082774..44195514b19e 100644
+--- a/tools/perf/bench/numa.c
++++ b/tools/perf/bench/numa.c
+@@ -1098,7 +1098,7 @@ static void *worker_thread(void *__tdata)
+ 	u8 *global_data;
+ 	u8 *process_data;
+ 	u8 *thread_data;
+-	u64 bytes_done;
++	u64 bytes_done, secs;
+ 	long work_done;
+ 	u32 l;
+ 	struct rusage rusage;
+@@ -1254,7 +1254,8 @@ static void *worker_thread(void *__tdata)
+ 	timersub(&stop, &start0, &diff);
+ 	td->runtime_ns = diff.tv_sec * NSEC_PER_SEC;
+ 	td->runtime_ns += diff.tv_usec * NSEC_PER_USEC;
+-	td->speed_gbs = bytes_done / (td->runtime_ns / NSEC_PER_SEC) / 1e9;
++	secs = td->runtime_ns / NSEC_PER_SEC;
++	td->speed_gbs = secs ? bytes_done / secs / 1e9 : 0;
+ 
+ 	getrusage(RUSAGE_THREAD, &rusage);
+ 	td->system_time_ns = rusage.ru_stime.tv_sec * NSEC_PER_SEC;
+diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c
+index 51709a961496..3eeb6420ceea 100644
+--- a/tools/perf/builtin-annotate.c
++++ b/tools/perf/builtin-annotate.c
+@@ -283,6 +283,15 @@ out_put:
+ 	return ret;
+ }
+ 
++static int process_feature_event(struct perf_tool *tool,
++				 union perf_event *event,
++				 struct perf_session *session)
++{
++	if (event->feat.feat_id < HEADER_LAST_FEATURE)
++		return perf_event__process_feature(tool, event, session);
++	return 0;
++}
++
+ static int hist_entry__tty_annotate(struct hist_entry *he,
+ 				    struct perf_evsel *evsel,
+ 				    struct perf_annotate *ann)
+@@ -471,7 +480,7 @@ int cmd_annotate(int argc, const char **argv)
+ 			.attr	= perf_event__process_attr,
+ 			.build_id = perf_event__process_build_id,
+ 			.tracing_data   = perf_event__process_tracing_data,
+-			.feature	= perf_event__process_feature,
++			.feature	= process_feature_event,
+ 			.ordered_events = true,
+ 			.ordering_requires_timestamps = true,
+ 		},
+diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
+index 0f198f6d9b77..e5f0782b225d 100644
+--- a/tools/perf/builtin-report.c
++++ b/tools/perf/builtin-report.c
+@@ -226,7 +226,8 @@ static int process_feature_event(struct perf_tool *tool,
+ 	}
+ 
+ 	/*
+-	 * All features are received, we can force the
++	 * (feat_id = HEADER_LAST_FEATURE) is the end marker which
++	 * means all features are received, now we can force the
+ 	 * group if needed.
+ 	 */
+ 	setup_forced_leader(rep, session->evlist);
+diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
+index e0a9845b6cbc..553715ac8320 100644
+--- a/tools/perf/builtin-script.c
++++ b/tools/perf/builtin-script.c
+@@ -1832,6 +1832,7 @@ static int process_attr(struct perf_tool *tool, union perf_event *event,
+ 	struct perf_evlist *evlist;
+ 	struct perf_evsel *evsel, *pos;
+ 	int err;
++	static struct perf_evsel_script *es;
+ 
+ 	err = perf_event__process_attr(tool, event, pevlist);
+ 	if (err)
+@@ -1840,6 +1841,19 @@ static int process_attr(struct perf_tool *tool, union perf_event *event,
+ 	evlist = *pevlist;
+ 	evsel = perf_evlist__last(*pevlist);
+ 
++	if (!evsel->priv) {
++		if (scr->per_event_dump) {
++			evsel->priv = perf_evsel_script__new(evsel,
++						scr->session->data);
++		} else {
++			es = zalloc(sizeof(*es));
++			if (!es)
++				return -ENOMEM;
++			es->fp = stdout;
++			evsel->priv = es;
++		}
++	}
++
+ 	if (evsel->attr.type >= PERF_TYPE_MAX &&
+ 	    evsel->attr.type != PERF_TYPE_SYNTH)
+ 		return 0;
+@@ -3028,6 +3042,15 @@ int process_cpu_map_event(struct perf_tool *tool __maybe_unused,
+ 	return set_maps(script);
+ }
+ 
++static int process_feature_event(struct perf_tool *tool,
++				 union perf_event *event,
++				 struct perf_session *session)
++{
++	if (event->feat.feat_id < HEADER_LAST_FEATURE)
++		return perf_event__process_feature(tool, event, session);
++	return 0;
++}
++
+ #ifdef HAVE_AUXTRACE_SUPPORT
+ static int perf_script__process_auxtrace_info(struct perf_tool *tool,
+ 					      union perf_event *event,
+@@ -3072,7 +3095,7 @@ int cmd_script(int argc, const char **argv)
+ 			.attr		 = process_attr,
+ 			.event_update   = perf_event__process_event_update,
+ 			.tracing_data	 = perf_event__process_tracing_data,
+-			.feature	 = perf_event__process_feature,
++			.feature	 = process_feature_event,
+ 			.build_id	 = perf_event__process_build_id,
+ 			.id_index	 = perf_event__process_id_index,
+ 			.auxtrace_info	 = perf_script__process_auxtrace_info,
+diff --git a/tools/perf/jvmti/jvmti_agent.c b/tools/perf/jvmti/jvmti_agent.c
+index 0c6d1002b524..ac1bcdc17dae 100644
+--- a/tools/perf/jvmti/jvmti_agent.c
++++ b/tools/perf/jvmti/jvmti_agent.c
+@@ -35,6 +35,7 @@
+ #include <sys/mman.h>
+ #include <syscall.h> /* for gettid() */
+ #include <err.h>
++#include <linux/kernel.h>
+ 
+ #include "jvmti_agent.h"
+ #include "../util/jitdump.h"
+@@ -249,7 +250,7 @@ void *jvmti_open(void)
+ 	/*
+ 	 * jitdump file name
+ 	 */
+-	snprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid());
++	scnprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid());
+ 
+ 	fd = open(dump_path, O_CREAT|O_TRUNC|O_RDWR, 0666);
+ 	if (fd == -1)
+diff --git a/tools/perf/pmu-events/Build b/tools/perf/pmu-events/Build
+index 17783913d330..215ba30b8534 100644
+--- a/tools/perf/pmu-events/Build
++++ b/tools/perf/pmu-events/Build
+@@ -1,7 +1,7 @@
+ hostprogs := jevents
+ 
+ jevents-y	+= json.o jsmn.o jevents.o
+-CHOSTFLAGS_jevents.o	= -I$(srctree)/tools/include
++HOSTCFLAGS_jevents.o	= -I$(srctree)/tools/include
+ pmu-events-y	+= pmu-events.o
+ JDIR		=  pmu-events/arch/$(SRCARCH)
+ JSON		=  $(shell [ -d $(JDIR) ] &&				\
+diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c
+index cac8f8889bc3..6a858355091d 100644
+--- a/tools/perf/tests/builtin-test.c
++++ b/tools/perf/tests/builtin-test.c
+@@ -422,7 +422,7 @@ static const char *shell_test__description(char *description, size_t size,
+ 
+ #define for_each_shell_test(dir, base, ent)	\
+ 	while ((ent = readdir(dir)) != NULL)	\
+-		if (!is_directory(base, ent))
++		if (!is_directory(base, ent) && ent->d_name[0] != '.')
+ 
+ static const char *shell_tests__dir(char *path, size_t size)
+ {
+diff --git a/tools/perf/tests/parse-events.c b/tools/perf/tests/parse-events.c
+index 18b06444f230..1509ef2c10c8 100644
+--- a/tools/perf/tests/parse-events.c
++++ b/tools/perf/tests/parse-events.c
+@@ -1672,6 +1672,7 @@ static struct terms_test test__terms[] = {
+ 
+ static int test_event(struct evlist_test *e)
+ {
++	struct parse_events_error err = { .idx = 0, };
+ 	struct perf_evlist *evlist;
+ 	int ret;
+ 
+@@ -1679,10 +1680,11 @@ static int test_event(struct evlist_test *e)
+ 	if (evlist == NULL)
+ 		return -ENOMEM;
+ 
+-	ret = parse_events(evlist, e->name, NULL);
++	ret = parse_events(evlist, e->name, &err);
+ 	if (ret) {
+-		pr_debug("failed to parse event '%s', err %d\n",
+-			 e->name, ret);
++		pr_debug("failed to parse event '%s', err %d, str '%s'\n",
++			 e->name, ret, err.str);
++		parse_events_print_error(&err, e->name);
+ 	} else {
+ 		ret = e->check(evlist);
+ 	}
+diff --git a/tools/perf/tests/topology.c b/tools/perf/tests/topology.c
+index 40e30a26b23c..9497d02f69e6 100644
+--- a/tools/perf/tests/topology.c
++++ b/tools/perf/tests/topology.c
+@@ -45,6 +45,7 @@ static int session_write_header(char *path)
+ 
+ 	perf_header__set_feat(&session->header, HEADER_CPU_TOPOLOGY);
+ 	perf_header__set_feat(&session->header, HEADER_NRCPUS);
++	perf_header__set_feat(&session->header, HEADER_ARCH);
+ 
+ 	session->header.data_size += DATA_SIZE;
+ 
+diff --git a/tools/perf/util/c++/clang.cpp b/tools/perf/util/c++/clang.cpp
+index bf31ceab33bd..89512504551b 100644
+--- a/tools/perf/util/c++/clang.cpp
++++ b/tools/perf/util/c++/clang.cpp
+@@ -146,8 +146,15 @@ getBPFObjectFromModule(llvm::Module *Module)
+ 	raw_svector_ostream ostream(*Buffer);
+ 
+ 	legacy::PassManager PM;
+-	if (TargetMachine->addPassesToEmitFile(PM, ostream,
+-					       TargetMachine::CGFT_ObjectFile)) {
++	bool NotAdded;
++#if CLANG_VERSION_MAJOR < 7
++	NotAdded = TargetMachine->addPassesToEmitFile(PM, ostream,
++						      TargetMachine::CGFT_ObjectFile);
++#else
++	NotAdded = TargetMachine->addPassesToEmitFile(PM, ostream, nullptr,
++						      TargetMachine::CGFT_ObjectFile);
++#endif
++	if (NotAdded) {
+ 		llvm::errs() << "TargetMachine can't emit a file of this type\n";
+ 		return std::unique_ptr<llvm::SmallVectorImpl<char>>(nullptr);;
+ 	}
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index a8bff2178fbc..9d3907db0802 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -2113,6 +2113,7 @@ static int process_cpu_topology(struct feat_fd *ff, void *data __maybe_unused)
+ 	int cpu_nr = ff->ph->env.nr_cpus_avail;
+ 	u64 size = 0;
+ 	struct perf_header *ph = ff->ph;
++	bool do_core_id_test = true;
+ 
+ 	ph->env.cpu = calloc(cpu_nr, sizeof(*ph->env.cpu));
+ 	if (!ph->env.cpu)
+@@ -2167,6 +2168,13 @@ static int process_cpu_topology(struct feat_fd *ff, void *data __maybe_unused)
+ 		return 0;
+ 	}
+ 
++	/* On s390 the socket_id number is not related to the numbers of cpus.
++	 * The socket_id number might be higher than the numbers of cpus.
++	 * This depends on the configuration.
++	 */
++	if (ph->env.arch && !strncmp(ph->env.arch, "s390", 4))
++		do_core_id_test = false;
++
+ 	for (i = 0; i < (u32)cpu_nr; i++) {
+ 		if (do_read_u32(ff, &nr))
+ 			goto free_cpu;
+@@ -2176,7 +2184,7 @@ static int process_cpu_topology(struct feat_fd *ff, void *data __maybe_unused)
+ 		if (do_read_u32(ff, &nr))
+ 			goto free_cpu;
+ 
+-		if (nr != (u32)-1 && nr > (u32)cpu_nr) {
++		if (do_core_id_test && nr != (u32)-1 && nr > (u32)cpu_nr) {
+ 			pr_debug("socket_id number is too big."
+ 				 "You may need to upgrade the perf tool.\n");
+ 			goto free_cpu;
+@@ -3442,7 +3450,7 @@ int perf_event__process_feature(struct perf_tool *tool,
+ 		pr_warning("invalid record type %d in pipe-mode\n", type);
+ 		return 0;
+ 	}
+-	if (feat == HEADER_RESERVED || feat > HEADER_LAST_FEATURE) {
++	if (feat == HEADER_RESERVED || feat >= HEADER_LAST_FEATURE) {
+ 		pr_warning("invalid record type %d in pipe-mode\n", type);
+ 		return -1;
+ 	}
+diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c
+index 1cca0a2fa641..c3c0ce8cdc55 100644
+--- a/tools/perf/util/llvm-utils.c
++++ b/tools/perf/util/llvm-utils.c
+@@ -265,16 +265,16 @@ static const char *kinc_fetch_script =
+ "#!/usr/bin/env sh\n"
+ "if ! test -d \"$KBUILD_DIR\"\n"
+ "then\n"
+-"	exit -1\n"
++"	exit 1\n"
+ "fi\n"
+ "if ! test -f \"$KBUILD_DIR/include/generated/autoconf.h\"\n"
+ "then\n"
+-"	exit -1\n"
++"	exit 1\n"
+ "fi\n"
+ "TMPDIR=`mktemp -d`\n"
+ "if test -z \"$TMPDIR\"\n"
+ "then\n"
+-"    exit -1\n"
++"    exit 1\n"
+ "fi\n"
+ "cat << EOF > $TMPDIR/Makefile\n"
+ "obj-y := dummy.o\n"
+diff --git a/tools/perf/util/parse-events.y b/tools/perf/util/parse-events.y
+index 155d2570274f..da8fe57691b8 100644
+--- a/tools/perf/util/parse-events.y
++++ b/tools/perf/util/parse-events.y
+@@ -227,11 +227,16 @@ event_def: event_pmu |
+ event_pmu:
+ PE_NAME opt_pmu_config
+ {
++	struct parse_events_state *parse_state = _parse_state;
++	struct parse_events_error *error = parse_state->error;
+ 	struct list_head *list, *orig_terms, *terms;
+ 
+ 	if (parse_events_copy_term_list($2, &orig_terms))
+ 		YYABORT;
+ 
++	if (error)
++		error->idx = @1.first_column;
++
+ 	ALLOC_LIST(list);
+ 	if (parse_events_add_pmu(_parse_state, list, $1, $2, false, false)) {
+ 		struct perf_pmu *pmu = NULL;
+diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
+index 7f8afacd08ee..39894b96b5d6 100644
+--- a/tools/perf/util/scripting-engines/trace-event-python.c
++++ b/tools/perf/util/scripting-engines/trace-event-python.c
+@@ -676,14 +676,11 @@ static void python_process_tracepoint(struct perf_sample *sample,
+ 	if (_PyTuple_Resize(&t, n) == -1)
+ 		Py_FatalError("error resizing Python tuple");
+ 
+-	if (!dict) {
++	if (!dict)
+ 		call_object(handler, t, handler_name);
+-	} else {
++	else
+ 		call_object(handler, t, default_handler_name);
+-		Py_DECREF(dict);
+-	}
+ 
+-	Py_XDECREF(all_entries_dict);
+ 	Py_DECREF(t);
+ }
+ 
+@@ -1003,7 +1000,6 @@ static void python_process_general_event(struct perf_sample *sample,
+ 
+ 	call_object(handler, t, handler_name);
+ 
+-	Py_DECREF(dict);
+ 	Py_DECREF(t);
+ }
+ 
+diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
+index 4ea385be528f..51b7ce7b9ad3 100644
+--- a/tools/testing/nvdimm/test/nfit.c
++++ b/tools/testing/nvdimm/test/nfit.c
+@@ -1989,8 +1989,7 @@ static void nfit_test0_setup(struct nfit_test *t)
+ 	pcap->header.type = ACPI_NFIT_TYPE_CAPABILITIES;
+ 	pcap->header.length = sizeof(*pcap);
+ 	pcap->highest_capability = 1;
+-	pcap->capabilities = ACPI_NFIT_CAPABILITY_CACHE_FLUSH |
+-		ACPI_NFIT_CAPABILITY_MEM_FLUSH;
++	pcap->capabilities = ACPI_NFIT_CAPABILITY_MEM_FLUSH;
+ 	offset += pcap->header.length;
+ 
+ 	if (t->setup_hotplug) {
+diff --git a/tools/testing/selftests/bpf/test_kmod.sh b/tools/testing/selftests/bpf/test_kmod.sh
+index 35669ccd4d23..9df0d2ac45f8 100755
+--- a/tools/testing/selftests/bpf/test_kmod.sh
++++ b/tools/testing/selftests/bpf/test_kmod.sh
+@@ -1,6 +1,15 @@
+ #!/bin/sh
+ # SPDX-License-Identifier: GPL-2.0
+ 
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
++msg="skip all tests:"
++if [ "$(id -u)" != "0" ]; then
++	echo $msg please run this as root >&2
++	exit $ksft_skip
++fi
++
+ SRC_TREE=../../../../
+ 
+ test_run()
+diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py
+index e78aad0a68bb..be800d0e7a84 100755
+--- a/tools/testing/selftests/bpf/test_offload.py
++++ b/tools/testing/selftests/bpf/test_offload.py
+@@ -163,6 +163,10 @@ def bpftool(args, JSON=True, ns="", fail=True):
+ 
+ def bpftool_prog_list(expected=None, ns=""):
+     _, progs = bpftool("prog show", JSON=True, ns=ns, fail=True)
++    # Remove the base progs
++    for p in base_progs:
++        if p in progs:
++            progs.remove(p)
+     if expected is not None:
+         if len(progs) != expected:
+             fail(True, "%d BPF programs loaded, expected %d" %
+@@ -171,6 +175,10 @@ def bpftool_prog_list(expected=None, ns=""):
+ 
+ def bpftool_map_list(expected=None, ns=""):
+     _, maps = bpftool("map show", JSON=True, ns=ns, fail=True)
++    # Remove the base maps
++    for m in base_maps:
++        if m in maps:
++            maps.remove(m)
+     if expected is not None:
+         if len(maps) != expected:
+             fail(True, "%d BPF maps loaded, expected %d" %
+@@ -585,8 +593,8 @@ skip(os.getuid() != 0, "test must be run as root")
+ # Check tools
+ ret, progs = bpftool("prog", fail=False)
+ skip(ret != 0, "bpftool not installed")
+-# Check no BPF programs are loaded
+-skip(len(progs) != 0, "BPF programs already loaded on the system")
++base_progs = progs
++_, base_maps = bpftool("map")
+ 
+ # Check netdevsim
+ ret, out = cmd("modprobe netdevsim", fail=False)
+diff --git a/tools/testing/selftests/net/config b/tools/testing/selftests/net/config
+index 7ba089b33e8b..cd3a2f1545b5 100644
+--- a/tools/testing/selftests/net/config
++++ b/tools/testing/selftests/net/config
+@@ -12,3 +12,5 @@ CONFIG_NET_IPVTI=y
+ CONFIG_INET6_XFRM_MODE_TUNNEL=y
+ CONFIG_IPV6_VTI=y
+ CONFIG_DUMMY=y
++CONFIG_BRIDGE=y
++CONFIG_VLAN_8021Q=y
+diff --git a/tools/testing/selftests/pstore/pstore_post_reboot_tests b/tools/testing/selftests/pstore/pstore_post_reboot_tests
+index 6ccb154cb4aa..22f8df1ad7d4 100755
+--- a/tools/testing/selftests/pstore/pstore_post_reboot_tests
++++ b/tools/testing/selftests/pstore/pstore_post_reboot_tests
+@@ -7,13 +7,16 @@
+ #
+ # Released under the terms of the GPL v2.
+ 
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
+ . ./common_tests
+ 
+ if [ -e $REBOOT_FLAG  ]; then
+     rm $REBOOT_FLAG
+ else
+     prlog "pstore_crash_test has not been executed yet. we skip further tests."
+-    exit 0
++    exit $ksft_skip
+ fi
+ 
+ prlog -n "Mounting pstore filesystem ... "
+diff --git a/tools/testing/selftests/static_keys/test_static_keys.sh b/tools/testing/selftests/static_keys/test_static_keys.sh
+index 24cff498b31a..fc9f8cde7d42 100755
+--- a/tools/testing/selftests/static_keys/test_static_keys.sh
++++ b/tools/testing/selftests/static_keys/test_static_keys.sh
+@@ -2,6 +2,19 @@
+ # SPDX-License-Identifier: GPL-2.0
+ # Runs static keys kernel module tests
+ 
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
++if ! /sbin/modprobe -q -n test_static_key_base; then
++	echo "static_key: module test_static_key_base is not found [SKIP]"
++	exit $ksft_skip
++fi
++
++if ! /sbin/modprobe -q -n test_static_keys; then
++	echo "static_key: module test_static_keys is not found [SKIP]"
++	exit $ksft_skip
++fi
++
+ if /sbin/modprobe -q test_static_key_base; then
+ 	if /sbin/modprobe -q test_static_keys; then
+ 		echo "static_key: ok"
+diff --git a/tools/testing/selftests/sync/config b/tools/testing/selftests/sync/config
+new file mode 100644
+index 000000000000..1ab7e8130db2
+--- /dev/null
++++ b/tools/testing/selftests/sync/config
+@@ -0,0 +1,4 @@
++CONFIG_STAGING=y
++CONFIG_ANDROID=y
++CONFIG_SYNC=y
++CONFIG_SW_SYNC=y
+diff --git a/tools/testing/selftests/sysctl/sysctl.sh b/tools/testing/selftests/sysctl/sysctl.sh
+index ec232c3cfcaa..584eb8ea780a 100755
+--- a/tools/testing/selftests/sysctl/sysctl.sh
++++ b/tools/testing/selftests/sysctl/sysctl.sh
+@@ -14,6 +14,9 @@
+ 
+ # This performs a series tests against the proc sysctl interface.
+ 
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
+ TEST_NAME="sysctl"
+ TEST_DRIVER="test_${TEST_NAME}"
+ TEST_DIR=$(dirname $0)
+@@ -41,7 +44,7 @@ test_modprobe()
+                echo "$0: $DIR not present" >&2
+                echo "You must have the following enabled in your kernel:" >&2
+                cat $TEST_DIR/config >&2
+-               exit 1
++               exit $ksft_skip
+        fi
+ }
+ 
+@@ -98,28 +101,30 @@ test_reqs()
+ 	uid=$(id -u)
+ 	if [ $uid -ne 0 ]; then
+ 		echo $msg must be run as root >&2
+-		exit 0
++		exit $ksft_skip
+ 	fi
+ 
+ 	if ! which perl 2> /dev/null > /dev/null; then
+ 		echo "$0: You need perl installed"
+-		exit 1
++		exit $ksft_skip
+ 	fi
+ 	if ! which getconf 2> /dev/null > /dev/null; then
+ 		echo "$0: You need getconf installed"
+-		exit 1
++		exit $ksft_skip
+ 	fi
+ 	if ! which diff 2> /dev/null > /dev/null; then
+ 		echo "$0: You need diff installed"
+-		exit 1
++		exit $ksft_skip
+ 	fi
+ }
+ 
+ function load_req_mod()
+ {
+-	trap "test_modprobe" EXIT
+-
+ 	if [ ! -d $DIR ]; then
++		if ! modprobe -q -n $TEST_DRIVER; then
++			echo "$0: module $TEST_DRIVER not found [SKIP]"
++			exit $ksft_skip
++		fi
+ 		modprobe $TEST_DRIVER
+ 		if [ $? -ne 0 ]; then
+ 			exit
+@@ -765,6 +770,7 @@ function parse_args()
+ test_reqs
+ allow_user_defaults
+ check_production_sysctl_writes_strict
++test_modprobe
+ load_req_mod
+ 
+ trap "test_finish" EXIT
+diff --git a/tools/testing/selftests/user/test_user_copy.sh b/tools/testing/selftests/user/test_user_copy.sh
+index d60506fc77f8..f9b31a57439b 100755
+--- a/tools/testing/selftests/user/test_user_copy.sh
++++ b/tools/testing/selftests/user/test_user_copy.sh
+@@ -2,6 +2,13 @@
+ # SPDX-License-Identifier: GPL-2.0
+ # Runs copy_to/from_user infrastructure using test_user_copy kernel module
+ 
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
++if ! /sbin/modprobe -q -n test_user_copy; then
++	echo "user: module test_user_copy is not found [SKIP]"
++	exit $ksft_skip
++fi
+ if /sbin/modprobe -q test_user_copy; then
+ 	/sbin/modprobe -q -r test_user_copy
+ 	echo "user_copy: ok"
+diff --git a/tools/testing/selftests/vm/compaction_test.c b/tools/testing/selftests/vm/compaction_test.c
+index 1097f04e4d80..bcec71250873 100644
+--- a/tools/testing/selftests/vm/compaction_test.c
++++ b/tools/testing/selftests/vm/compaction_test.c
+@@ -16,6 +16,8 @@
+ #include <unistd.h>
+ #include <string.h>
+ 
++#include "../kselftest.h"
++
+ #define MAP_SIZE 1048576
+ 
+ struct map_list {
+@@ -169,7 +171,7 @@ int main(int argc, char **argv)
+ 		printf("Either the sysctl compact_unevictable_allowed is not\n"
+ 		       "set to 1 or couldn't read the proc file.\n"
+ 		       "Skipping the test\n");
+-		return 0;
++		return KSFT_SKIP;
+ 	}
+ 
+ 	lim.rlim_cur = RLIM_INFINITY;
+diff --git a/tools/testing/selftests/vm/mlock2-tests.c b/tools/testing/selftests/vm/mlock2-tests.c
+index 4997b9222cfa..637b6d0ac0d0 100644
+--- a/tools/testing/selftests/vm/mlock2-tests.c
++++ b/tools/testing/selftests/vm/mlock2-tests.c
+@@ -9,6 +9,8 @@
+ #include <stdbool.h>
+ #include "mlock2.h"
+ 
++#include "../kselftest.h"
++
+ struct vm_boundaries {
+ 	unsigned long start;
+ 	unsigned long end;
+@@ -303,7 +305,7 @@ static int test_mlock_lock()
+ 	if (mlock2_(map, 2 * page_size, 0)) {
+ 		if (errno == ENOSYS) {
+ 			printf("Cannot call new mlock family, skipping test\n");
+-			_exit(0);
++			_exit(KSFT_SKIP);
+ 		}
+ 		perror("mlock2(0)");
+ 		goto unmap;
+@@ -412,7 +414,7 @@ static int test_mlock_onfault()
+ 	if (mlock2_(map, 2 * page_size, MLOCK_ONFAULT)) {
+ 		if (errno == ENOSYS) {
+ 			printf("Cannot call new mlock family, skipping test\n");
+-			_exit(0);
++			_exit(KSFT_SKIP);
+ 		}
+ 		perror("mlock2(MLOCK_ONFAULT)");
+ 		goto unmap;
+@@ -425,7 +427,7 @@ static int test_mlock_onfault()
+ 	if (munlock(map, 2 * page_size)) {
+ 		if (errno == ENOSYS) {
+ 			printf("Cannot call new mlock family, skipping test\n");
+-			_exit(0);
++			_exit(KSFT_SKIP);
+ 		}
+ 		perror("munlock()");
+ 		goto unmap;
+@@ -457,7 +459,7 @@ static int test_lock_onfault_of_present()
+ 	if (mlock2_(map, 2 * page_size, MLOCK_ONFAULT)) {
+ 		if (errno == ENOSYS) {
+ 			printf("Cannot call new mlock family, skipping test\n");
+-			_exit(0);
++			_exit(KSFT_SKIP);
+ 		}
+ 		perror("mlock2(MLOCK_ONFAULT)");
+ 		goto unmap;
+@@ -583,7 +585,7 @@ static int test_vma_management(bool call_mlock)
+ 	if (call_mlock && mlock2_(map, 3 * page_size, MLOCK_ONFAULT)) {
+ 		if (errno == ENOSYS) {
+ 			printf("Cannot call new mlock family, skipping test\n");
+-			_exit(0);
++			_exit(KSFT_SKIP);
+ 		}
+ 		perror("mlock(ONFAULT)\n");
+ 		goto out;
+diff --git a/tools/testing/selftests/vm/run_vmtests b/tools/testing/selftests/vm/run_vmtests
+index 22d564673830..88cbe5575f0c 100755
+--- a/tools/testing/selftests/vm/run_vmtests
++++ b/tools/testing/selftests/vm/run_vmtests
+@@ -2,6 +2,9 @@
+ # SPDX-License-Identifier: GPL-2.0
+ #please run as root
+ 
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
+ mnt=./huge
+ exitcode=0
+ 
+@@ -36,7 +39,7 @@ if [ -n "$freepgs" ] && [ -n "$hpgsize_KB" ]; then
+ 		echo $(( $lackpgs + $nr_hugepgs )) > /proc/sys/vm/nr_hugepages
+ 		if [ $? -ne 0 ]; then
+ 			echo "Please run this test as root"
+-			exit 1
++			exit $ksft_skip
+ 		fi
+ 		while read name size unit; do
+ 			if [ "$name" = "HugePages_Free:" ]; then
+diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c
+index de2f9ec8a87f..7b8171e3128a 100644
+--- a/tools/testing/selftests/vm/userfaultfd.c
++++ b/tools/testing/selftests/vm/userfaultfd.c
+@@ -69,6 +69,8 @@
+ #include <setjmp.h>
+ #include <stdbool.h>
+ 
++#include "../kselftest.h"
++
+ #ifdef __NR_userfaultfd
+ 
+ static unsigned long nr_cpus, nr_pages, nr_pages_per_cpu, page_size;
+@@ -1322,7 +1324,7 @@ int main(int argc, char **argv)
+ int main(void)
+ {
+ 	printf("skip: Skipping userfaultfd test (missing __NR_userfaultfd)\n");
+-	return 0;
++	return KSFT_SKIP;
+ }
+ 
+ #endif /* __NR_userfaultfd */
+diff --git a/tools/testing/selftests/x86/sigreturn.c b/tools/testing/selftests/x86/sigreturn.c
+index 246145b84a12..4d9dc3f2fd70 100644
+--- a/tools/testing/selftests/x86/sigreturn.c
++++ b/tools/testing/selftests/x86/sigreturn.c
+@@ -610,21 +610,41 @@ static int test_valid_sigreturn(int cs_bits, bool use_16bit_ss, int force_ss)
+ 	 */
+ 	for (int i = 0; i < NGREG; i++) {
+ 		greg_t req = requested_regs[i], res = resulting_regs[i];
++
+ 		if (i == REG_TRAPNO || i == REG_IP)
+ 			continue;	/* don't care */
+-		if (i == REG_SP) {
+-			printf("\tSP: %llx -> %llx\n", (unsigned long long)req,
+-			       (unsigned long long)res);
+ 
++		if (i == REG_SP) {
+ 			/*
+-			 * In many circumstances, the high 32 bits of rsp
+-			 * are zeroed.  For example, we could be a real
+-			 * 32-bit program, or we could hit any of a number
+-			 * of poorly-documented IRET or segmented ESP
+-			 * oddities.  If this happens, it's okay.
++			 * If we were using a 16-bit stack segment, then
++			 * the kernel is a bit stuck: IRET only restores
++			 * the low 16 bits of ESP/RSP if SS is 16-bit.
++			 * The kernel uses a hack to restore bits 31:16,
++			 * but that hack doesn't help with bits 63:32.
++			 * On Intel CPUs, bits 63:32 end up zeroed, and, on
++			 * AMD CPUs, they leak the high bits of the kernel
++			 * espfix64 stack pointer.  There's very little that
++			 * the kernel can do about it.
++			 *
++			 * Similarly, if we are returning to a 32-bit context,
++			 * the CPU will often lose the high 32 bits of RSP.
+ 			 */
+-			if (res == (req & 0xFFFFFFFF))
+-				continue;  /* OK; not expected to work */
++
++			if (res == req)
++				continue;
++
++			if (cs_bits != 64 && ((res ^ req) & 0xFFFFFFFF) == 0) {
++				printf("[NOTE]\tSP: %llx -> %llx\n",
++				       (unsigned long long)req,
++				       (unsigned long long)res);
++				continue;
++			}
++
++			printf("[FAIL]\tSP mismatch: requested 0x%llx; got 0x%llx\n",
++			       (unsigned long long)requested_regs[i],
++			       (unsigned long long)resulting_regs[i]);
++			nerrs++;
++			continue;
+ 		}
+ 
+ 		bool ignore_reg = false;
+@@ -654,25 +674,18 @@ static int test_valid_sigreturn(int cs_bits, bool use_16bit_ss, int force_ss)
+ #endif
+ 
+ 		/* Sanity check on the kernel */
+-		if (i == REG_CX && requested_regs[i] != resulting_regs[i]) {
++		if (i == REG_CX && req != res) {
+ 			printf("[FAIL]\tCX (saved SP) mismatch: requested 0x%llx; got 0x%llx\n",
+-			       (unsigned long long)requested_regs[i],
+-			       (unsigned long long)resulting_regs[i]);
++			       (unsigned long long)req,
++			       (unsigned long long)res);
+ 			nerrs++;
+ 			continue;
+ 		}
+ 
+-		if (requested_regs[i] != resulting_regs[i] && !ignore_reg) {
+-			/*
+-			 * SP is particularly interesting here.  The
+-			 * usual cause of failures is that we hit the
+-			 * nasty IRET case of returning to a 16-bit SS,
+-			 * in which case bits 16:31 of the *kernel*
+-			 * stack pointer persist in ESP.
+-			 */
++		if (req != res && !ignore_reg) {
+ 			printf("[FAIL]\tReg %d mismatch: requested 0x%llx; got 0x%llx\n",
+-			       i, (unsigned long long)requested_regs[i],
+-			       (unsigned long long)resulting_regs[i]);
++			       i, (unsigned long long)req,
++			       (unsigned long long)res);
+ 			nerrs++;
+ 		}
+ 	}
+diff --git a/tools/testing/selftests/zram/zram.sh b/tools/testing/selftests/zram/zram.sh
+index 754de7da426a..232e958ec454 100755
+--- a/tools/testing/selftests/zram/zram.sh
++++ b/tools/testing/selftests/zram/zram.sh
+@@ -2,6 +2,9 @@
+ # SPDX-License-Identifier: GPL-2.0
+ TCID="zram.sh"
+ 
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
+ . ./zram_lib.sh
+ 
+ run_zram () {
+@@ -24,5 +27,5 @@ elif [ -b /dev/zram0 ]; then
+ else
+ 	echo "$TCID : No zram.ko module or /dev/zram0 device file not found"
+ 	echo "$TCID : CONFIG_ZRAM is not set"
+-	exit 1
++	exit $ksft_skip
+ fi
+diff --git a/tools/testing/selftests/zram/zram_lib.sh b/tools/testing/selftests/zram/zram_lib.sh
+index f6a9c73e7a44..9e73a4fb9b0a 100755
+--- a/tools/testing/selftests/zram/zram_lib.sh
++++ b/tools/testing/selftests/zram/zram_lib.sh
+@@ -18,6 +18,9 @@ MODULE=0
+ dev_makeswap=-1
+ dev_mounted=-1
+ 
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
+ trap INT
+ 
+ check_prereqs()
+@@ -27,7 +30,7 @@ check_prereqs()
+ 
+ 	if [ $uid -ne 0 ]; then
+ 		echo $msg must be run as root >&2
+-		exit 0
++		exit $ksft_skip
+ 	fi
+ }
+ 
+diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
+index bdcf8e7a6161..72fc688c3e9d 100644
+--- a/virt/kvm/arm/vgic/vgic-v3.c
++++ b/virt/kvm/arm/vgic/vgic-v3.c
+@@ -552,11 +552,6 @@ int vgic_v3_probe(const struct gic_kvm_info *info)
+ 		pr_warn("GICV physical address 0x%llx not page aligned\n",
+ 			(unsigned long long)info->vcpu.start);
+ 		kvm_vgic_global_state.vcpu_base = 0;
+-	} else if (!PAGE_ALIGNED(resource_size(&info->vcpu))) {
+-		pr_warn("GICV size 0x%llx not a multiple of page size 0x%lx\n",
+-			(unsigned long long)resource_size(&info->vcpu),
+-			PAGE_SIZE);
+-		kvm_vgic_global_state.vcpu_base = 0;
+ 	} else {
+ 		kvm_vgic_global_state.vcpu_base = info->vcpu.start;
+ 		kvm_vgic_global_state.can_emulate_gicv2 = true;