Linux patch 4.9.1244.9-128

2 files changed, 4075 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 41e03949..a65a30ed 100644
--- a/0000_README
+++ b/0000_README
@@ -535,6 +535,10 @@ Patch:  1122_linux-4.9.123.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.123
 
+Patch:  1123_linux-4.9.124.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.124
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1123_linux-4.9.124.patch b/1123_linux-4.9.124.patch
new file mode 100644
index 00000000..212c43c7
--- /dev/null
+++ b/1123_linux-4.9.124.patch
@@ -0,0 +1,4071 @@
+diff --git a/Makefile b/Makefile
+index b11e375bb18e..53d57acfc17e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 123
++SUBLEVEL = 124
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/arc/Makefile b/arch/arc/Makefile
+index 19cce226d1a8..8447eed836ef 100644
+--- a/arch/arc/Makefile
++++ b/arch/arc/Makefile
+@@ -18,7 +18,7 @@ endif
+ 
+ KBUILD_DEFCONFIG := nsim_700_defconfig
+ 
+-cflags-y	+= -fno-common -pipe -fno-builtin -D__linux__
++cflags-y	+= -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
+ cflags-$(CONFIG_ISA_ARCOMPACT)	+= -mA7
+ cflags-$(CONFIG_ISA_ARCV2)	+= -mcpu=archs
+ 
+@@ -141,16 +141,3 @@ dtbs: scripts
+ 
+ archclean:
+ 	$(Q)$(MAKE) $(clean)=$(boot)
+-
+-# Hacks to enable final link due to absence of link-time branch relexation
+-# and gcc choosing optimal(shorter) branches at -O3
+-#
+-# vineetg Feb 2010: -mlong-calls switched off for overall kernel build
+-# However lib/decompress_inflate.o (.init.text) calls
+-# zlib_inflate_workspacesize (.text) causing relocation errors.
+-# Thus forcing all exten calls in this file to be long calls
+-export CFLAGS_decompress_inflate.o = -mmedium-calls
+-export CFLAGS_initramfs.o = -mmedium-calls
+-ifdef CONFIG_SMP
+-export CFLAGS_core.o = -mmedium-calls
+-endif
+diff --git a/arch/arc/include/asm/mach_desc.h b/arch/arc/include/asm/mach_desc.h
+index c28e6c347b49..871f3cb16af9 100644
+--- a/arch/arc/include/asm/mach_desc.h
++++ b/arch/arc/include/asm/mach_desc.h
+@@ -34,9 +34,7 @@ struct machine_desc {
+ 	const char		*name;
+ 	const char		**dt_compat;
+ 	void			(*init_early)(void);
+-#ifdef CONFIG_SMP
+ 	void			(*init_per_cpu)(unsigned int);
+-#endif
+ 	void			(*init_machine)(void);
+ 	void			(*init_late)(void);
+ 
+diff --git a/arch/arc/kernel/irq.c b/arch/arc/kernel/irq.c
+index 538b36afe89e..62b185057c04 100644
+--- a/arch/arc/kernel/irq.c
++++ b/arch/arc/kernel/irq.c
+@@ -31,10 +31,10 @@ void __init init_IRQ(void)
+ 	/* a SMP H/w block could do IPI IRQ request here */
+ 	if (plat_smp_ops.init_per_cpu)
+ 		plat_smp_ops.init_per_cpu(smp_processor_id());
++#endif
+ 
+ 	if (machine_desc->init_per_cpu)
+ 		machine_desc->init_per_cpu(smp_processor_id());
+-#endif
+ }
+ 
+ /*
+diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
+index a41a79a4f4fe..0e8c0151a390 100644
+--- a/arch/arc/kernel/process.c
++++ b/arch/arc/kernel/process.c
+@@ -44,7 +44,8 @@ SYSCALL_DEFINE0(arc_gettls)
+ SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new)
+ {
+ 	struct pt_regs *regs = current_pt_regs();
+-	int uval = -EFAULT;
++	u32 uval;
++	int ret;
+ 
+ 	/*
+ 	 * This is only for old cores lacking LLOCK/SCOND, which by defintion
+@@ -57,23 +58,47 @@ SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new)
+ 	/* Z indicates to userspace if operation succeded */
+ 	regs->status32 &= ~STATUS_Z_MASK;
+ 
+-	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
+-		return -EFAULT;
++	ret = access_ok(VERIFY_WRITE, uaddr, sizeof(*uaddr));
++	if (!ret)
++		 goto fail;
+ 
++again:
+ 	preempt_disable();
+ 
+-	if (__get_user(uval, uaddr))
+-		goto done;
++	ret = __get_user(uval, uaddr);
++	if (ret)
++		 goto fault;
+ 
+-	if (uval == expected) {
+-		if (!__put_user(new, uaddr))
+-			regs->status32 |= STATUS_Z_MASK;
+-	}
++	if (uval != expected)
++		 goto out;
+ 
+-done:
+-	preempt_enable();
++	ret = __put_user(new, uaddr);
++	if (ret)
++		 goto fault;
++
++	regs->status32 |= STATUS_Z_MASK;
+ 
++out:
++	preempt_enable();
+ 	return uval;
++
++fault:
++	preempt_enable();
++
++	if (unlikely(ret != -EFAULT))
++		 goto fail;
++
++	down_read(&current->mm->mmap_sem);
++	ret = fixup_user_fault(current, current->mm, (unsigned long) uaddr,
++			       FAULT_FLAG_WRITE, NULL);
++	up_read(&current->mm->mmap_sem);
++
++	if (likely(!ret))
++		 goto again;
++
++fail:
++	force_sig(SIGSEGV, current);
++	return ret;
+ }
+ 
+ void arch_cpu_idle(void)
+diff --git a/arch/arm/boot/dts/am3517.dtsi b/arch/arm/boot/dts/am3517.dtsi
+index 0db19d39d24c..d022b6b03273 100644
+--- a/arch/arm/boot/dts/am3517.dtsi
++++ b/arch/arm/boot/dts/am3517.dtsi
+@@ -74,6 +74,11 @@
+ 	};
+ };
+ 
++/* Table Table 5-79 of the TRM shows 480ab000 is reserved */
++&usb_otg_hs {
++	status = "disabled";
++};
++
+ &iva {
+ 	status = "disabled";
+ };
+diff --git a/arch/arm/boot/dts/am437x-sk-evm.dts b/arch/arm/boot/dts/am437x-sk-evm.dts
+index 319d94205350..6482ada22015 100644
+--- a/arch/arm/boot/dts/am437x-sk-evm.dts
++++ b/arch/arm/boot/dts/am437x-sk-evm.dts
+@@ -533,6 +533,8 @@
+ 
+ 		touchscreen-size-x = <480>;
+ 		touchscreen-size-y = <272>;
++
++		wakeup-source;
+ 	};
+ 
+ 	tlv320aic3106: tlv320aic3106@1b {
+diff --git a/arch/arm/boot/dts/bcm-cygnus.dtsi b/arch/arm/boot/dts/bcm-cygnus.dtsi
+index fabc9f36c408..5ad61537990e 100644
+--- a/arch/arm/boot/dts/bcm-cygnus.dtsi
++++ b/arch/arm/boot/dts/bcm-cygnus.dtsi
+@@ -128,7 +128,7 @@
+ 			reg = <0x18008000 0x100>;
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			interrupts = <GIC_SPI 85 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
+ 			clock-frequency = <100000>;
+ 			status = "disabled";
+ 		};
+@@ -157,7 +157,7 @@
+ 			reg = <0x1800b000 0x100>;
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			interrupts = <GIC_SPI 86 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
+ 			clock-frequency = <100000>;
+ 			status = "disabled";
+ 		};
+@@ -168,7 +168,7 @@
+ 
+ 			#interrupt-cells = <1>;
+ 			interrupt-map-mask = <0 0 0 0>;
+-			interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_NONE>;
++			interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 			linux,pci-domain = <0>;
+ 
+@@ -190,10 +190,10 @@
+ 				compatible = "brcm,iproc-msi";
+ 				msi-controller;
+ 				interrupt-parent = <&gic>;
+-				interrupts = <GIC_SPI 96 IRQ_TYPE_NONE>,
+-					     <GIC_SPI 97 IRQ_TYPE_NONE>,
+-					     <GIC_SPI 98 IRQ_TYPE_NONE>,
+-					     <GIC_SPI 99 IRQ_TYPE_NONE>;
++				interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 99 IRQ_TYPE_LEVEL_HIGH>;
+ 			};
+ 		};
+ 
+@@ -203,7 +203,7 @@
+ 
+ 			#interrupt-cells = <1>;
+ 			interrupt-map-mask = <0 0 0 0>;
+-			interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_NONE>;
++			interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 			linux,pci-domain = <1>;
+ 
+@@ -225,10 +225,10 @@
+ 				compatible = "brcm,iproc-msi";
+ 				msi-controller;
+ 				interrupt-parent = <&gic>;
+-				interrupts = <GIC_SPI 102 IRQ_TYPE_NONE>,
+-					     <GIC_SPI 103 IRQ_TYPE_NONE>,
+-					     <GIC_SPI 104 IRQ_TYPE_NONE>,
+-					     <GIC_SPI 105 IRQ_TYPE_NONE>;
++				interrupts = <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>;
+ 			};
+ 		};
+ 
+diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi
+index 65e0db1d3bd7..6e3d3b50824e 100644
+--- a/arch/arm/boot/dts/bcm-nsp.dtsi
++++ b/arch/arm/boot/dts/bcm-nsp.dtsi
+@@ -288,7 +288,7 @@
+ 			reg = <0x38000 0x50>;
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			interrupts = <GIC_SPI 89 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>;
+ 			clock-frequency = <100000>;
+ 		};
+ 
+@@ -375,7 +375,7 @@
+ 
+ 		#interrupt-cells = <1>;
+ 		interrupt-map-mask = <0 0 0 0>;
+-		interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_NONE>;
++		interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 		linux,pci-domain = <0>;
+ 
+@@ -397,10 +397,10 @@
+ 			compatible = "brcm,iproc-msi";
+ 			msi-controller;
+ 			interrupt-parent = <&gic>;
+-			interrupts = <GIC_SPI 127 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 128 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 129 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 130 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 127 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 128 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 129 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>;
+ 			brcm,pcie-msi-inten;
+ 		};
+ 	};
+@@ -411,7 +411,7 @@
+ 
+ 		#interrupt-cells = <1>;
+ 		interrupt-map-mask = <0 0 0 0>;
+-		interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_NONE>;
++		interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 		linux,pci-domain = <1>;
+ 
+@@ -433,10 +433,10 @@
+ 			compatible = "brcm,iproc-msi";
+ 			msi-controller;
+ 			interrupt-parent = <&gic>;
+-			interrupts = <GIC_SPI 133 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 134 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 135 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 136 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
+ 			brcm,pcie-msi-inten;
+ 		};
+ 	};
+@@ -447,7 +447,7 @@
+ 
+ 		#interrupt-cells = <1>;
+ 		interrupt-map-mask = <0 0 0 0>;
+-		interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_NONE>;
++		interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 		linux,pci-domain = <2>;
+ 
+@@ -469,10 +469,10 @@
+ 			compatible = "brcm,iproc-msi";
+ 			msi-controller;
+ 			interrupt-parent = <&gic>;
+-			interrupts = <GIC_SPI 139 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 140 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 141 IRQ_TYPE_NONE>,
+-				     <GIC_SPI 142 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 139 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>;
+ 			brcm,pcie-msi-inten;
+ 		};
+ 	};
+diff --git a/arch/arm/boot/dts/da850.dtsi b/arch/arm/boot/dts/da850.dtsi
+index f79e1b91c680..51ab92fa7a6a 100644
+--- a/arch/arm/boot/dts/da850.dtsi
++++ b/arch/arm/boot/dts/da850.dtsi
+@@ -377,11 +377,7 @@
+ 			gpio-controller;
+ 			#gpio-cells = <2>;
+ 			reg = <0x226000 0x1000>;
+-			interrupts = <42 IRQ_TYPE_EDGE_BOTH
+-				43 IRQ_TYPE_EDGE_BOTH 44 IRQ_TYPE_EDGE_BOTH
+-				45 IRQ_TYPE_EDGE_BOTH 46 IRQ_TYPE_EDGE_BOTH
+-				47 IRQ_TYPE_EDGE_BOTH 48 IRQ_TYPE_EDGE_BOTH
+-				49 IRQ_TYPE_EDGE_BOTH 50 IRQ_TYPE_EDGE_BOTH>;
++			interrupts = <42 43 44 45 46 47 48 49 50>;
+ 			ti,ngpio = <144>;
+ 			ti,davinci-gpio-unbanked = <0>;
+ 			status = "disabled";
+diff --git a/arch/arm/configs/imx_v4_v5_defconfig b/arch/arm/configs/imx_v4_v5_defconfig
+index 5f013c9fc1ed..8290c9ace6e9 100644
+--- a/arch/arm/configs/imx_v4_v5_defconfig
++++ b/arch/arm/configs/imx_v4_v5_defconfig
+@@ -145,9 +145,11 @@ CONFIG_USB_STORAGE=y
+ CONFIG_USB_CHIPIDEA=y
+ CONFIG_USB_CHIPIDEA_UDC=y
+ CONFIG_USB_CHIPIDEA_HOST=y
++CONFIG_USB_CHIPIDEA_ULPI=y
+ CONFIG_NOP_USB_XCEIV=y
+ CONFIG_USB_GADGET=y
+ CONFIG_USB_ETH=m
++CONFIG_USB_ULPI_BUS=y
+ CONFIG_MMC=y
+ CONFIG_MMC_SDHCI=y
+ CONFIG_MMC_SDHCI_PLTFM=y
+diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig
+index 8ec4dbbb50b0..6b7d4f535984 100644
+--- a/arch/arm/configs/imx_v6_v7_defconfig
++++ b/arch/arm/configs/imx_v6_v7_defconfig
+@@ -271,6 +271,7 @@ CONFIG_USB_STORAGE=y
+ CONFIG_USB_CHIPIDEA=y
+ CONFIG_USB_CHIPIDEA_UDC=y
+ CONFIG_USB_CHIPIDEA_HOST=y
++CONFIG_USB_CHIPIDEA_ULPI=y
+ CONFIG_USB_SERIAL=m
+ CONFIG_USB_SERIAL_GENERIC=y
+ CONFIG_USB_SERIAL_FTDI_SIO=m
+@@ -307,6 +308,7 @@ CONFIG_USB_GADGETFS=m
+ CONFIG_USB_FUNCTIONFS=m
+ CONFIG_USB_MASS_STORAGE=m
+ CONFIG_USB_G_SERIAL=m
++CONFIG_USB_ULPI_BUS=y
+ CONFIG_MMC=y
+ CONFIG_MMC_SDHCI=y
+ CONFIG_MMC_SDHCI_PLTFM=y
+diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c
+index b4de3da6dffa..f7f36da80f40 100644
+--- a/arch/arm/mach-omap2/omap-smp.c
++++ b/arch/arm/mach-omap2/omap-smp.c
+@@ -104,6 +104,45 @@ void omap5_erratum_workaround_801819(void)
+ static inline void omap5_erratum_workaround_801819(void) { }
+ #endif
+ 
++#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
++/*
++ * Configure ACR and enable ACTLR[0] (Enable invalidates of BTB with
++ * ICIALLU) to activate the workaround for secondary Core.
++ * NOTE: it is assumed that the primary core's configuration is done
++ * by the boot loader (kernel will detect a misconfiguration and complain
++ * if this is not done).
++ *
++ * In General Purpose(GP) devices, ACR bit settings can only be done
++ * by ROM code in "secure world" using the smc call and there is no
++ * option to update the "firmware" on such devices. This also works for
++ * High security(HS) devices, as a backup option in case the
++ * "update" is not done in the "security firmware".
++ */
++static void omap5_secondary_harden_predictor(void)
++{
++	u32 acr, acr_mask;
++
++	asm volatile ("mrc p15, 0, %0, c1, c0, 1" : "=r" (acr));
++
++	/*
++	 * ACTLR[0] (Enable invalidates of BTB with ICIALLU)
++	 */
++	acr_mask = BIT(0);
++
++	/* Do we already have it done.. if yes, skip expensive smc */
++	if ((acr & acr_mask) == acr_mask)
++		return;
++
++	acr |= acr_mask;
++	omap_smc1(OMAP5_DRA7_MON_SET_ACR_INDEX, acr);
++
++	pr_debug("%s: ARM ACR setup for CVE_2017_5715 applied on CPU%d\n",
++		 __func__, smp_processor_id());
++}
++#else
++static inline void omap5_secondary_harden_predictor(void) { }
++#endif
++
+ static void omap4_secondary_init(unsigned int cpu)
+ {
+ 	/*
+@@ -126,6 +165,8 @@ static void omap4_secondary_init(unsigned int cpu)
+ 		set_cntfreq();
+ 		/* Configure ACR to disable streaming WA for 801819 */
+ 		omap5_erratum_workaround_801819();
++		/* Enable ACR to allow for ICUALLU workaround */
++		omap5_secondary_harden_predictor();
+ 	}
+ 
+ 	/*
+diff --git a/arch/arm/mach-pxa/irq.c b/arch/arm/mach-pxa/irq.c
+index 9c10248fadcc..4e8c2116808e 100644
+--- a/arch/arm/mach-pxa/irq.c
++++ b/arch/arm/mach-pxa/irq.c
+@@ -185,7 +185,7 @@ static int pxa_irq_suspend(void)
+ {
+ 	int i;
+ 
+-	for (i = 0; i < pxa_internal_irq_nr / 32; i++) {
++	for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) {
+ 		void __iomem *base = irq_base(i);
+ 
+ 		saved_icmr[i] = __raw_readl(base + ICMR);
+@@ -204,7 +204,7 @@ static void pxa_irq_resume(void)
+ {
+ 	int i;
+ 
+-	for (i = 0; i < pxa_internal_irq_nr / 32; i++) {
++	for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) {
+ 		void __iomem *base = irq_base(i);
+ 
+ 		__raw_writel(saved_icmr[i], base + ICMR);
+diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
+index 4c587ad8bfe3..1565d6b67163 100644
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -722,19 +722,28 @@ int __mark_rodata_ro(void *unused)
+ 	return 0;
+ }
+ 
++static int kernel_set_to_readonly __read_mostly;
++
+ void mark_rodata_ro(void)
+ {
++	kernel_set_to_readonly = 1;
+ 	stop_machine(__mark_rodata_ro, NULL, NULL);
+ }
+ 
+ void set_kernel_text_rw(void)
+ {
++	if (!kernel_set_to_readonly)
++		return;
++
+ 	set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), false,
+ 				current->active_mm);
+ }
+ 
+ void set_kernel_text_ro(void)
+ {
++	if (!kernel_set_to_readonly)
++		return;
++
+ 	set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), true,
+ 				current->active_mm);
+ }
+diff --git a/arch/arm64/boot/dts/broadcom/ns2.dtsi b/arch/arm64/boot/dts/broadcom/ns2.dtsi
+index a16b1b3f9fc6..8a94ec8035d3 100644
+--- a/arch/arm64/boot/dts/broadcom/ns2.dtsi
++++ b/arch/arm64/boot/dts/broadcom/ns2.dtsi
+@@ -393,7 +393,7 @@
+ 			reg = <0x66080000 0x100>;
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			interrupts = <GIC_SPI 394 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 394 IRQ_TYPE_LEVEL_HIGH>;
+ 			clock-frequency = <100000>;
+ 			status = "disabled";
+ 		};
+@@ -421,7 +421,7 @@
+ 			reg = <0x660b0000 0x100>;
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			interrupts = <GIC_SPI 395 IRQ_TYPE_NONE>;
++			interrupts = <GIC_SPI 395 IRQ_TYPE_LEVEL_HIGH>;
+ 			clock-frequency = <100000>;
+ 			status = "disabled";
+ 		};
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index a70f7d3361c4..cfd33f18f437 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -205,7 +205,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+  * This is the secondary CPU boot entry.  We're using this CPUs
+  * idle thread stack, but a set of temporary page tables.
+  */
+-asmlinkage void secondary_start_kernel(void)
++asmlinkage notrace void secondary_start_kernel(void)
+ {
+ 	struct mm_struct *mm = &init_mm;
+ 	unsigned int cpu = smp_processor_id();
+diff --git a/arch/m68k/include/asm/mcf_pgalloc.h b/arch/m68k/include/asm/mcf_pgalloc.h
+index fb95aed5f428..dac7564a48da 100644
+--- a/arch/m68k/include/asm/mcf_pgalloc.h
++++ b/arch/m68k/include/asm/mcf_pgalloc.h
+@@ -43,6 +43,7 @@ extern inline pmd_t *pmd_alloc_kernel(pgd_t *pgd, unsigned long address)
+ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t page,
+ 				  unsigned long address)
+ {
++	pgtable_page_dtor(page);
+ 	__free_page(page);
+ }
+ 
+@@ -73,8 +74,9 @@ static inline struct page *pte_alloc_one(struct mm_struct *mm,
+ 	return page;
+ }
+ 
+-extern inline void pte_free(struct mm_struct *mm, struct page *page)
++static inline void pte_free(struct mm_struct *mm, struct page *page)
+ {
++	pgtable_page_dtor(page);
+ 	__free_page(page);
+ }
+ 
+diff --git a/arch/parisc/include/asm/spinlock.h b/arch/parisc/include/asm/spinlock.h
+index e32936cd7f10..7031483b110c 100644
+--- a/arch/parisc/include/asm/spinlock.h
++++ b/arch/parisc/include/asm/spinlock.h
+@@ -26,7 +26,6 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *x,
+ {
+ 	volatile unsigned int *a;
+ 
+-	mb();
+ 	a = __ldcw_align(x);
+ 	while (__ldcw(a) == 0)
+ 		while (*a == 0)
+@@ -36,16 +35,15 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *x,
+ 				local_irq_disable();
+ 			} else
+ 				cpu_relax();
+-	mb();
+ }
+ 
+ static inline void arch_spin_unlock(arch_spinlock_t *x)
+ {
+ 	volatile unsigned int *a;
+-	mb();
++
+ 	a = __ldcw_align(x);
+-	*a = 1;
+ 	mb();
++	*a = 1;
+ }
+ 
+ static inline int arch_spin_trylock(arch_spinlock_t *x)
+@@ -53,10 +51,8 @@ static inline int arch_spin_trylock(arch_spinlock_t *x)
+ 	volatile unsigned int *a;
+ 	int ret;
+ 
+-	mb();
+ 	a = __ldcw_align(x);
+         ret = __ldcw(a) != 0;
+-	mb();
+ 
+ 	return ret;
+ }
+diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
+index 4886a6db42e9..5f7e57fcaeef 100644
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -629,12 +629,12 @@ cas_action:
+ 	stw	%r1, 4(%sr2,%r20)
+ #endif
+ 	/* The load and store could fail */
+-1:	ldw,ma	0(%r26), %r28
++1:	ldw	0(%r26), %r28
+ 	sub,<>	%r28, %r25, %r0
+-2:	stw,ma	%r24, 0(%r26)
++2:	stw	%r24, 0(%r26)
+ 	/* Free lock */
+ 	sync
+-	stw,ma	%r20, 0(%sr2,%r20)
++	stw	%r20, 0(%sr2,%r20)
+ #if ENABLE_LWS_DEBUG
+ 	/* Clear thread register indicator */
+ 	stw	%r0, 4(%sr2,%r20)
+@@ -798,30 +798,30 @@ cas2_action:
+ 	ldo	1(%r0),%r28
+ 
+ 	/* 8bit CAS */
+-13:	ldb,ma	0(%r26), %r29
++13:	ldb	0(%r26), %r29
+ 	sub,=	%r29, %r25, %r0
+ 	b,n	cas2_end
+-14:	stb,ma	%r24, 0(%r26)
++14:	stb	%r24, 0(%r26)
+ 	b	cas2_end
+ 	copy	%r0, %r28
+ 	nop
+ 	nop
+ 
+ 	/* 16bit CAS */
+-15:	ldh,ma	0(%r26), %r29
++15:	ldh	0(%r26), %r29
+ 	sub,=	%r29, %r25, %r0
+ 	b,n	cas2_end
+-16:	sth,ma	%r24, 0(%r26)
++16:	sth	%r24, 0(%r26)
+ 	b	cas2_end
+ 	copy	%r0, %r28
+ 	nop
+ 	nop
+ 
+ 	/* 32bit CAS */
+-17:	ldw,ma	0(%r26), %r29
++17:	ldw	0(%r26), %r29
+ 	sub,=	%r29, %r25, %r0
+ 	b,n	cas2_end
+-18:	stw,ma	%r24, 0(%r26)
++18:	stw	%r24, 0(%r26)
+ 	b	cas2_end
+ 	copy	%r0, %r28
+ 	nop
+@@ -829,10 +829,10 @@ cas2_action:
+ 
+ 	/* 64bit CAS */
+ #ifdef CONFIG_64BIT
+-19:	ldd,ma	0(%r26), %r29
++19:	ldd	0(%r26), %r29
+ 	sub,*=	%r29, %r25, %r0
+ 	b,n	cas2_end
+-20:	std,ma	%r24, 0(%r26)
++20:	std	%r24, 0(%r26)
+ 	copy	%r0, %r28
+ #else
+ 	/* Compare first word */
+@@ -851,7 +851,7 @@ cas2_action:
+ cas2_end:
+ 	/* Free lock */
+ 	sync
+-	stw,ma	%r20, 0(%sr2,%r20)
++	stw	%r20, 0(%sr2,%r20)
+ 	/* Enable interrupts */
+ 	ssm	PSW_SM_I, %r0
+ 	/* Return to userspace, set no error */
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index e7ce2577f0c9..949a871e9506 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -1386,6 +1386,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
+ 		goto free_addrs;
+ 	}
+ 	if (bpf_jit_prog(&jit, fp)) {
++		bpf_jit_binary_free(header);
+ 		fp = orig_fp;
+ 		goto free_addrs;
+ 	}
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index d58d8dcb8245..76c1d85e749b 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -774,7 +774,7 @@ ENTRY(\sym)
+ 
+ 	call	\do_sym
+ 
+-	jmp	error_exit			/* %ebx: no swapgs flag */
++	jmp	error_exit
+ 	.endif
+ END(\sym)
+ .endm
+@@ -1043,7 +1043,6 @@ END(paranoid_exit)
+ 
+ /*
+  * Save all registers in pt_regs, and switch gs if needed.
+- * Return: EBX=0: came from user mode; EBX=1: otherwise
+  */
+ ENTRY(error_entry)
+ 	cld
+@@ -1056,7 +1055,6 @@ ENTRY(error_entry)
+ 	 * the kernel CR3 here.
+ 	 */
+ 	SWITCH_KERNEL_CR3
+-	xorl	%ebx, %ebx
+ 	testb	$3, CS+8(%rsp)
+ 	jz	.Lerror_kernelspace
+ 
+@@ -1087,7 +1085,6 @@ ENTRY(error_entry)
+ 	 * for these here too.
+ 	 */
+ .Lerror_kernelspace:
+-	incl	%ebx
+ 	leaq	native_irq_return_iret(%rip), %rcx
+ 	cmpq	%rcx, RIP+8(%rsp)
+ 	je	.Lerror_bad_iret
+@@ -1119,28 +1116,19 @@ ENTRY(error_entry)
+ 
+ 	/*
+ 	 * Pretend that the exception came from user mode: set up pt_regs
+-	 * as if we faulted immediately after IRET and clear EBX so that
+-	 * error_exit knows that we will be returning to user mode.
++	 * as if we faulted immediately after IRET.
+ 	 */
+ 	mov	%rsp, %rdi
+ 	call	fixup_bad_iret
+ 	mov	%rax, %rsp
+-	decl	%ebx
+ 	jmp	.Lerror_entry_from_usermode_after_swapgs
+ END(error_entry)
+ 
+-
+-/*
+- * On entry, EBX is a "return to kernel mode" flag:
+- *   1: already in kernel mode, don't need SWAPGS
+- *   0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode
+- */
+ ENTRY(error_exit)
+-	movl	%ebx, %eax
+ 	DISABLE_INTERRUPTS(CLBR_NONE)
+ 	TRACE_IRQS_OFF
+-	testl	%eax, %eax
+-	jnz	retint_kernel
++	testb	$3, CS(%rsp)
++	jz	retint_kernel
+ 	jmp	retint_user
+ END(error_exit)
+ 
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 3874eec972cd..ef32e5766a01 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -201,6 +201,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+ 	const u8 *uuid;
+ 	int rc, i;
+ 
++	if (cmd_rc)
++		*cmd_rc = -EINVAL;
+ 	func = cmd;
+ 	if (cmd == ND_CMD_CALL) {
+ 		call_pkg = buf;
+@@ -288,6 +290,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+ 		 * If we return an error (like elsewhere) then caller wouldn't
+ 		 * be able to rely upon data returned to make calculation.
+ 		 */
++		if (cmd_rc)
++			*cmd_rc = 0;
+ 		return 0;
+ 	}
+ 
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index 0d028ead99e8..d81b984b72e4 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -35,6 +35,7 @@
+ #include <linux/kernel.h>
+ #include <linux/gfp.h>
+ #include <linux/module.h>
++#include <linux/nospec.h>
+ #include <linux/blkdev.h>
+ #include <linux/delay.h>
+ #include <linux/interrupt.h>
+@@ -1124,10 +1125,12 @@ static ssize_t ahci_led_store(struct ata_port *ap, const char *buf,
+ 
+ 	/* get the slot number from the message */
+ 	pmp = (state & EM_MSG_LED_PMP_SLOT) >> 8;
+-	if (pmp < EM_MAX_SLOTS)
++	if (pmp < EM_MAX_SLOTS) {
++		pmp = array_index_nospec(pmp, EM_MAX_SLOTS);
+ 		emp = &pp->em_priv[pmp];
+-	else
++	} else {
+ 		return -EINVAL;
++	}
+ 
+ 	/* mask off the activity bits if we are in sw_activity
+ 	 * mode, user should turn off sw_activity before setting
+diff --git a/drivers/dma/k3dma.c b/drivers/dma/k3dma.c
+index aabcb7934b05..cd7f67b2545c 100644
+--- a/drivers/dma/k3dma.c
++++ b/drivers/dma/k3dma.c
+@@ -792,7 +792,7 @@ static struct dma_chan *k3_of_dma_simple_xlate(struct of_phandle_args *dma_spec,
+ 	struct k3_dma_dev *d = ofdma->of_dma_data;
+ 	unsigned int request = dma_spec->args[0];
+ 
+-	if (request > d->dma_requests)
++	if (request >= d->dma_requests)
+ 		return NULL;
+ 
+ 	return dma_get_slave_channel(&(d->chans[request].vc.chan));
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index 2c449bdacb91..b9dad4e40bb8 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2951,7 +2951,7 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
+ 	pd->src_addr_widths = PL330_DMA_BUSWIDTHS;
+ 	pd->dst_addr_widths = PL330_DMA_BUSWIDTHS;
+ 	pd->directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
+-	pd->residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT;
++	pd->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
+ 	pd->max_burst = ((pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP) ?
+ 			 1 : PL330_MAX_BURST);
+ 
+diff --git a/drivers/gpu/drm/arm/malidp_hw.c b/drivers/gpu/drm/arm/malidp_hw.c
+index a6132f1d58c1..5eee325feb29 100644
+--- a/drivers/gpu/drm/arm/malidp_hw.c
++++ b/drivers/gpu/drm/arm/malidp_hw.c
+@@ -432,7 +432,8 @@ const struct malidp_hw_device malidp_device[MALIDP_MAX_DEVICES] = {
+ 				.vsync_irq = MALIDP500_DE_IRQ_VSYNC,
+ 			},
+ 			.se_irq_map = {
+-				.irq_mask = MALIDP500_SE_IRQ_CONF_MODE,
++				.irq_mask = MALIDP500_SE_IRQ_CONF_MODE |
++					    MALIDP500_SE_IRQ_GLOBAL,
+ 				.vsync_irq = 0,
+ 			},
+ 			.dc_irq_map = {
+diff --git a/drivers/gpu/drm/armada/armada_hw.h b/drivers/gpu/drm/armada/armada_hw.h
+index 27319a8335e2..345dc4d0851e 100644
+--- a/drivers/gpu/drm/armada/armada_hw.h
++++ b/drivers/gpu/drm/armada/armada_hw.h
+@@ -160,6 +160,7 @@ enum {
+ 	CFG_ALPHAM_GRA		= 0x1 << 16,
+ 	CFG_ALPHAM_CFG		= 0x2 << 16,
+ 	CFG_ALPHA_MASK		= 0xff << 8,
++#define CFG_ALPHA(x)		((x) << 8)
+ 	CFG_PIXCMD_MASK		= 0xff,
+ };
+ 
+diff --git a/drivers/gpu/drm/armada/armada_overlay.c b/drivers/gpu/drm/armada/armada_overlay.c
+index 152b4e716269..6a9bba7206df 100644
+--- a/drivers/gpu/drm/armada/armada_overlay.c
++++ b/drivers/gpu/drm/armada/armada_overlay.c
+@@ -27,6 +27,7 @@ struct armada_ovl_plane_properties {
+ 	uint16_t contrast;
+ 	uint16_t saturation;
+ 	uint32_t colorkey_mode;
++	uint32_t colorkey_enable;
+ };
+ 
+ struct armada_ovl_plane {
+@@ -62,11 +63,13 @@ armada_ovl_update_attr(struct armada_ovl_plane_properties *prop,
+ 	writel_relaxed(0x00002000, dcrtc->base + LCD_SPU_CBSH_HUE);
+ 
+ 	spin_lock_irq(&dcrtc->irq_lock);
+-	armada_updatel(prop->colorkey_mode | CFG_ALPHAM_GRA,
+-		     CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
+-		     dcrtc->base + LCD_SPU_DMA_CTRL1);
+-
+-	armada_updatel(ADV_GRACOLORKEY, 0, dcrtc->base + LCD_SPU_ADV_REG);
++	armada_updatel(prop->colorkey_mode,
++		       CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
++		       dcrtc->base + LCD_SPU_DMA_CTRL1);
++	if (dcrtc->variant->has_spu_adv_reg)
++		armada_updatel(prop->colorkey_enable,
++			       ADV_GRACOLORKEY | ADV_VIDCOLORKEY,
++			       dcrtc->base + LCD_SPU_ADV_REG);
+ 	spin_unlock_irq(&dcrtc->irq_lock);
+ }
+ 
+@@ -340,8 +343,17 @@ static int armada_ovl_plane_set_property(struct drm_plane *plane,
+ 		dplane->prop.colorkey_vb |= K2B(val);
+ 		update_attr = true;
+ 	} else if (property == priv->colorkey_mode_prop) {
+-		dplane->prop.colorkey_mode &= ~CFG_CKMODE_MASK;
+-		dplane->prop.colorkey_mode |= CFG_CKMODE(val);
++		if (val == CKMODE_DISABLE) {
++			dplane->prop.colorkey_mode =
++				CFG_CKMODE(CKMODE_DISABLE) |
++				CFG_ALPHAM_CFG | CFG_ALPHA(255);
++			dplane->prop.colorkey_enable = 0;
++		} else {
++			dplane->prop.colorkey_mode =
++				CFG_CKMODE(val) |
++				CFG_ALPHAM_GRA | CFG_ALPHA(0);
++			dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
++		}
+ 		update_attr = true;
+ 	} else if (property == priv->brightness_prop) {
+ 		dplane->prop.brightness = val - 256;
+@@ -470,7 +482,9 @@ int armada_overlay_plane_create(struct drm_device *dev, unsigned long crtcs)
+ 	dplane->prop.colorkey_yr = 0xfefefe00;
+ 	dplane->prop.colorkey_ug = 0x01010100;
+ 	dplane->prop.colorkey_vb = 0x01010100;
+-	dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB);
++	dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB) |
++				     CFG_ALPHAM_GRA | CFG_ALPHA(0);
++	dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
+ 	dplane->prop.brightness = 0;
+ 	dplane->prop.contrast = 0x4000;
+ 	dplane->prop.saturation = 0x4000;
+diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+index 6dd09c306bc1..bdcc6ec3c67b 100644
+--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
++++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+@@ -199,7 +199,7 @@ static void decon_win_set_pixfmt(struct decon_context *ctx, unsigned int win,
+ 	unsigned long val;
+ 
+ 	val = readl(ctx->addr + DECON_WINCONx(win));
+-	val &= ~WINCONx_BPPMODE_MASK;
++	val &= WINCONx_ENWIN_F;
+ 
+ 	switch (fb->pixel_format) {
+ 	case DRM_FORMAT_XRGB1555:
+@@ -291,8 +291,8 @@ static void decon_update_plane(struct exynos_drm_crtc *crtc,
+ 		COORDINATE_Y(state->crtc.y + state->crtc.h - 1);
+ 	writel(val, ctx->addr + DECON_VIDOSDxB(win));
+ 
+-	val = VIDOSD_Wx_ALPHA_R_F(0x0) | VIDOSD_Wx_ALPHA_G_F(0x0) |
+-		VIDOSD_Wx_ALPHA_B_F(0x0);
++	val = VIDOSD_Wx_ALPHA_R_F(0xff) | VIDOSD_Wx_ALPHA_G_F(0xff) |
++		VIDOSD_Wx_ALPHA_B_F(0xff);
+ 	writel(val, ctx->addr + DECON_VIDOSDxC(win));
+ 
+ 	val = VIDOSD_Wx_ALPHA_R_F(0x0) | VIDOSD_Wx_ALPHA_G_F(0x0) |
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+index 52a9d269484e..4c81c79b15ea 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+@@ -532,21 +532,25 @@ static int gsc_src_set_fmt(struct device *dev, u32 fmt)
+ 			GSC_IN_CHROMA_ORDER_CRCB);
+ 		break;
+ 	case DRM_FORMAT_NV21:
++		cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_2P);
++		break;
+ 	case DRM_FORMAT_NV61:
+-		cfg |= (GSC_IN_CHROMA_ORDER_CRCB |
+-			GSC_IN_YUV420_2P);
++		cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV422_2P);
+ 		break;
+ 	case DRM_FORMAT_YUV422:
+ 		cfg |= GSC_IN_YUV422_3P;
+ 		break;
+ 	case DRM_FORMAT_YUV420:
++		cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_3P);
++		break;
+ 	case DRM_FORMAT_YVU420:
+-		cfg |= GSC_IN_YUV420_3P;
++		cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_3P);
+ 		break;
+ 	case DRM_FORMAT_NV12:
++		cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_2P);
++		break;
+ 	case DRM_FORMAT_NV16:
+-		cfg |= (GSC_IN_CHROMA_ORDER_CBCR |
+-			GSC_IN_YUV420_2P);
++		cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV422_2P);
+ 		break;
+ 	default:
+ 		dev_err(ippdrv->dev, "invalid target yuv order 0x%x.\n", fmt);
+@@ -806,18 +810,25 @@ static int gsc_dst_set_fmt(struct device *dev, u32 fmt)
+ 			GSC_OUT_CHROMA_ORDER_CRCB);
+ 		break;
+ 	case DRM_FORMAT_NV21:
+-	case DRM_FORMAT_NV61:
+ 		cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_2P);
+ 		break;
++	case DRM_FORMAT_NV61:
++		cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV422_2P);
++		break;
+ 	case DRM_FORMAT_YUV422:
++		cfg |= GSC_OUT_YUV422_3P;
++		break;
+ 	case DRM_FORMAT_YUV420:
++		cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_3P);
++		break;
+ 	case DRM_FORMAT_YVU420:
+-		cfg |= GSC_OUT_YUV420_3P;
++		cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_3P);
+ 		break;
+ 	case DRM_FORMAT_NV12:
++		cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_2P);
++		break;
+ 	case DRM_FORMAT_NV16:
+-		cfg |= (GSC_OUT_CHROMA_ORDER_CBCR |
+-			GSC_OUT_YUV420_2P);
++		cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV422_2P);
+ 		break;
+ 	default:
+ 		dev_err(ippdrv->dev, "invalid target yuv order 0x%x.\n", fmt);
+diff --git a/drivers/gpu/drm/exynos/regs-gsc.h b/drivers/gpu/drm/exynos/regs-gsc.h
+index 4704a993cbb7..16b39734115c 100644
+--- a/drivers/gpu/drm/exynos/regs-gsc.h
++++ b/drivers/gpu/drm/exynos/regs-gsc.h
+@@ -138,6 +138,7 @@
+ #define GSC_OUT_YUV420_3P		(3 << 4)
+ #define GSC_OUT_YUV422_1P		(4 << 4)
+ #define GSC_OUT_YUV422_2P		(5 << 4)
++#define GSC_OUT_YUV422_3P		(6 << 4)
+ #define GSC_OUT_YUV444			(7 << 4)
+ #define GSC_OUT_TILE_TYPE_MASK		(1 << 2)
+ #define GSC_OUT_TILE_C_16x8		(0 << 2)
+diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
+index 909f69a302ee..505dca48b9f8 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
+@@ -601,7 +601,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli,
+ 		struct nouveau_bo *nvbo;
+ 		uint32_t data;
+ 
+-		if (unlikely(r->bo_index > req->nr_buffers)) {
++		if (unlikely(r->bo_index >= req->nr_buffers)) {
+ 			NV_PRINTK(err, cli, "reloc bo index invalid\n");
+ 			ret = -EINVAL;
+ 			break;
+@@ -611,7 +611,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli,
+ 		if (b->presumed.valid)
+ 			continue;
+ 
+-		if (unlikely(r->reloc_bo_index > req->nr_buffers)) {
++		if (unlikely(r->reloc_bo_index >= req->nr_buffers)) {
+ 			NV_PRINTK(err, cli, "reloc container bo index invalid\n");
+ 			ret = -EINVAL;
+ 			break;
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index db951c4fd6dd..b1ad378cb2a6 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2429,8 +2429,14 @@ void wacom_setup_device_quirks(struct wacom *wacom)
+ 			if (features->type >= INTUOSHT && features->type <= BAMBOO_PT)
+ 				features->device_type |= WACOM_DEVICETYPE_PAD;
+ 
+-			features->x_max = 4096;
+-			features->y_max = 4096;
++			if (features->type == INTUOSHT2) {
++				features->x_max = features->x_max / 10;
++				features->y_max = features->y_max / 10;
++			}
++			else {
++				features->x_max = 4096;
++				features->y_max = 4096;
++			}
+ 		}
+ 		else if (features->pktlen == WACOM_PKGLEN_BBTOUCH) {
+ 			features->device_type |= WACOM_DEVICETYPE_PAD;
+diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
+index 4d297d554e52..c4188308cefa 100644
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -665,9 +665,6 @@ static int i2c_imx_dma_read(struct imx_i2c_struct *i2c_imx,
+ 	struct imx_i2c_dma *dma = i2c_imx->dma;
+ 	struct device *dev = &i2c_imx->adapter.dev;
+ 
+-	temp = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR);
+-	temp |= I2CR_DMAEN;
+-	imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR);
+ 
+ 	dma->chan_using = dma->chan_rx;
+ 	dma->dma_transfer_dir = DMA_DEV_TO_MEM;
+@@ -780,6 +777,7 @@ static int i2c_imx_read(struct imx_i2c_struct *i2c_imx, struct i2c_msg *msgs, bo
+ 	int i, result;
+ 	unsigned int temp;
+ 	int block_data = msgs->flags & I2C_M_RECV_LEN;
++	int use_dma = i2c_imx->dma && msgs->len >= DMA_THRESHOLD && !block_data;
+ 
+ 	dev_dbg(&i2c_imx->adapter.dev,
+ 		"<%s> write slave address: addr=0x%x\n",
+@@ -806,12 +804,14 @@ static int i2c_imx_read(struct imx_i2c_struct *i2c_imx, struct i2c_msg *msgs, bo
+ 	 */
+ 	if ((msgs->len - 1) || block_data)
+ 		temp &= ~I2CR_TXAK;
++	if (use_dma)
++		temp |= I2CR_DMAEN;
+ 	imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR);
+ 	imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR); /* dummy read */
+ 
+ 	dev_dbg(&i2c_imx->adapter.dev, "<%s> read data\n", __func__);
+ 
+-	if (i2c_imx->dma && msgs->len >= DMA_THRESHOLD && !block_data)
++	if (use_dma)
+ 		return i2c_imx_dma_read(i2c_imx, msgs, is_lastmsg);
+ 
+ 	/* read data */
+diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
+index 19aa957bd454..c9263acc190b 100644
+--- a/drivers/iio/pressure/bmp280-core.c
++++ b/drivers/iio/pressure/bmp280-core.c
+@@ -347,10 +347,9 @@ static int bmp280_read_humid(struct bmp280_data *data, int *val, int *val2)
+ 	adc_humidity = be16_to_cpu(tmp);
+ 	comp_humidity = bmp280_compensate_humidity(data, adc_humidity);
+ 
+-	*val = comp_humidity;
+-	*val2 = 1024;
++	*val = comp_humidity * 1000 / 1024;
+ 
+-	return IIO_VAL_FRACTIONAL;
++	return IIO_VAL_INT;
+ }
+ 
+ static int bmp280_read_raw(struct iio_dev *indio_dev,
+diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
+index 5c1dbe2f8757..d6e5002edb92 100644
+--- a/drivers/infiniband/hw/mlx5/srq.c
++++ b/drivers/infiniband/hw/mlx5/srq.c
+@@ -268,18 +268,24 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
+ 
+ 	desc_size = sizeof(struct mlx5_wqe_srq_next_seg) +
+ 		    srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg);
+-	if (desc_size == 0 || srq->msrq.max_gs > desc_size)
+-		return ERR_PTR(-EINVAL);
++	if (desc_size == 0 || srq->msrq.max_gs > desc_size) {
++		err = -EINVAL;
++		goto err_srq;
++	}
+ 	desc_size = roundup_pow_of_two(desc_size);
+ 	desc_size = max_t(size_t, 32, desc_size);
+-	if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg))
+-		return ERR_PTR(-EINVAL);
++	if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg)) {
++		err = -EINVAL;
++		goto err_srq;
++	}
+ 	srq->msrq.max_avail_gather = (desc_size - sizeof(struct mlx5_wqe_srq_next_seg)) /
+ 		sizeof(struct mlx5_wqe_data_seg);
+ 	srq->msrq.wqe_shift = ilog2(desc_size);
+ 	buf_size = srq->msrq.max * desc_size;
+-	if (buf_size < desc_size)
+-		return ERR_PTR(-EINVAL);
++	if (buf_size < desc_size) {
++		err = -EINVAL;
++		goto err_srq;
++	}
+ 	in.type = init_attr->srq_type;
+ 
+ 	if (pd->uobject)
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index 5b0ca35c06ab..47219ebd8ff2 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -648,6 +648,9 @@ next_wqe:
+ 		} else {
+ 			goto exit;
+ 		}
++		if ((wqe->wr.send_flags & IB_SEND_SIGNALED) ||
++		    qp->sq_sig_type == IB_SIGNAL_ALL_WR)
++			rxe_run_task(&qp->comp.task, 1);
+ 		qp->req.wqe_index = next_index(qp->sq.queue,
+ 						qp->req.wqe_index);
+ 		goto next_wqe;
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index b138b5cba286..6da66c3acd46 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3734,6 +3734,13 @@ static int raid10_run(struct mddev *mddev)
+ 			    disk->rdev->saved_raid_disk < 0)
+ 				conf->fullsync = 1;
+ 		}
++
++		if (disk->replacement &&
++		    !test_bit(In_sync, &disk->replacement->flags) &&
++		    disk->replacement->saved_raid_disk < 0) {
++			conf->fullsync = 1;
++		}
++
+ 		disk->recovery_disabled = mddev->recovery_disabled - 1;
+ 	}
+ 
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+index 7dd7490fdac1..f3f2d66432ab 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+@@ -1529,6 +1529,7 @@ struct bnx2x {
+ 	struct link_vars	link_vars;
+ 	u32			link_cnt;
+ 	struct bnx2x_link_report_data last_reported_link;
++	bool			force_link_down;
+ 
+ 	struct mdio_if_info	mdio;
+ 
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index 31287cec6e3a..2cd1dcd77559 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -1265,6 +1265,11 @@ void __bnx2x_link_report(struct bnx2x *bp)
+ {
+ 	struct bnx2x_link_report_data cur_data;
+ 
++	if (bp->force_link_down) {
++		bp->link_vars.link_up = 0;
++		return;
++	}
++
+ 	/* reread mf_cfg */
+ 	if (IS_PF(bp) && !CHIP_IS_E1(bp))
+ 		bnx2x_read_mf_cfg(bp);
+@@ -2822,6 +2827,7 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
+ 		bp->pending_max = 0;
+ 	}
+ 
++	bp->force_link_down = false;
+ 	if (bp->port.pmf) {
+ 		rc = bnx2x_initial_phy_init(bp, load_mode);
+ 		if (rc)
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 554c4086b3c6..54dab4eac804 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -10279,6 +10279,12 @@ static void bnx2x_sp_rtnl_task(struct work_struct *work)
+ 		bp->sp_rtnl_state = 0;
+ 		smp_mb();
+ 
++		/* Immediately indicate link as down */
++		bp->link_vars.link_up = 0;
++		bp->force_link_down = true;
++		netif_carrier_off(bp->dev);
++		BNX2X_ERR("Indicating link is down due to Tx-timeout\n");
++
+ 		bnx2x_nic_unload(bp, UNLOAD_NORMAL, true);
+ 		bnx2x_nic_load(bp, LOAD_NORMAL);
+ 
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 8777c3a4c095..72297b76944f 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -5560,7 +5560,7 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
+ 		rc = bnxt_request_irq(bp);
+ 		if (rc) {
+ 			netdev_err(bp->dev, "bnxt_request_irq err: %x\n", rc);
+-			goto open_err;
++			goto open_err_irq;
+ 		}
+ 	}
+ 
+@@ -5593,6 +5593,8 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
+ 
+ open_err:
+ 	bnxt_disable_napi(bp);
++
++open_err_irq:
+ 	bnxt_del_napi(bp);
+ 
+ open_err_free_mem:
+@@ -6862,11 +6864,11 @@ int bnxt_get_max_rings(struct bnxt *bp, int *max_rx, int *max_tx, bool shared)
+ 	int rx, tx, cp;
+ 
+ 	_bnxt_get_max_rings(bp, &rx, &tx, &cp);
++	*max_rx = rx;
++	*max_tx = tx;
+ 	if (!rx || !tx || !cp)
+ 		return -ENOMEM;
+ 
+-	*max_rx = rx;
+-	*max_tx = tx;
+ 	return bnxt_trim_rings(bp, max_rx, max_tx, cp, shared);
+ }
+ 
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+index c395b21cb57b..c71a52a2f801 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+@@ -274,7 +274,7 @@ static void dcb_tx_queue_prio_enable(struct net_device *dev, int enable)
+ 				"Can't %s DCB Priority on port %d, TX Queue %d: err=%d\n",
+ 				enable ? "set" : "unset", pi->port_id, i, -err);
+ 		else
+-			txq->dcb_prio = value;
++			txq->dcb_prio = enable ? value : 0;
+ 	}
+ }
+ 
+diff --git a/drivers/net/ethernet/cisco/enic/enic_clsf.c b/drivers/net/ethernet/cisco/enic/enic_clsf.c
+index 3c677ed3c29e..4d9014d5b36d 100644
+--- a/drivers/net/ethernet/cisco/enic/enic_clsf.c
++++ b/drivers/net/ethernet/cisco/enic/enic_clsf.c
+@@ -78,7 +78,6 @@ void enic_rfs_flw_tbl_init(struct enic *enic)
+ 	enic->rfs_h.max = enic->config.num_arfs;
+ 	enic->rfs_h.free = enic->rfs_h.max;
+ 	enic->rfs_h.toclean = 0;
+-	enic_rfs_timer_start(enic);
+ }
+ 
+ void enic_rfs_flw_tbl_free(struct enic *enic)
+@@ -87,7 +86,6 @@ void enic_rfs_flw_tbl_free(struct enic *enic)
+ 
+ 	enic_rfs_timer_stop(enic);
+ 	spin_lock_bh(&enic->rfs_h.lock);
+-	enic->rfs_h.free = 0;
+ 	for (i = 0; i < (1 << ENIC_RFS_FLW_BITSHIFT); i++) {
+ 		struct hlist_head *hhead;
+ 		struct hlist_node *tmp;
+@@ -98,6 +96,7 @@ void enic_rfs_flw_tbl_free(struct enic *enic)
+ 			enic_delfltr(enic, n->fltr_id);
+ 			hlist_del(&n->node);
+ 			kfree(n);
++			enic->rfs_h.free++;
+ 		}
+ 	}
+ 	spin_unlock_bh(&enic->rfs_h.lock);
+diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
+index 99f593be26e2..2e9bab45d419 100644
+--- a/drivers/net/ethernet/cisco/enic/enic_main.c
++++ b/drivers/net/ethernet/cisco/enic/enic_main.c
+@@ -1760,7 +1760,7 @@ static int enic_open(struct net_device *netdev)
+ 		vnic_intr_unmask(&enic->intr[i]);
+ 
+ 	enic_notify_timer_start(enic);
+-	enic_rfs_flw_tbl_init(enic);
++	enic_rfs_timer_start(enic);
+ 
+ 	return 0;
+ 
+@@ -2692,6 +2692,7 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	enic->notify_timer.function = enic_notify_timer;
+ 	enic->notify_timer.data = (unsigned long)enic;
+ 
++	enic_rfs_flw_tbl_init(enic);
+ 	enic_set_rx_coal_setting(enic);
+ 	INIT_WORK(&enic->reset, enic_reset);
+ 	INIT_WORK(&enic->tx_hang_reset, enic_tx_hang_reset);
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+index ad3362293cbd..0d2baec546e1 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+@@ -1847,7 +1847,12 @@ s32 ixgbe_set_rar_generic(struct ixgbe_hw *hw, u32 index, u8 *addr, u32 vmdq,
+ 	if (enable_addr != 0)
+ 		rar_high |= IXGBE_RAH_AV;
+ 
++	/* Record lower 32 bits of MAC address and then make
++	 * sure that write is flushed to hardware before writing
++	 * the upper 16 bits and setting the valid bit.
++	 */
+ 	IXGBE_WRITE_REG(hw, IXGBE_RAL(index), rar_low);
++	IXGBE_WRITE_FLUSH(hw);
+ 	IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
+ 
+ 	return 0;
+@@ -1879,8 +1884,13 @@ s32 ixgbe_clear_rar_generic(struct ixgbe_hw *hw, u32 index)
+ 	rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(index));
+ 	rar_high &= ~(0x0000FFFF | IXGBE_RAH_AV);
+ 
+-	IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
++	/* Clear the address valid bit and upper 16 bits of the address
++	 * before clearing the lower bits. This way we aren't updating
++	 * a live filter.
++	 */
+ 	IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
++	IXGBE_WRITE_FLUSH(hw);
++	IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
+ 
+ 	/* clear VMDq pool/queue selection for this RAR */
+ 	hw->mac.ops.clear_vmdq(hw, index, IXGBE_CLEAR_VMDQ_ALL);
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
+index f36bd0bd37da..1ed13a165e58 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
+@@ -502,8 +502,16 @@ static irqreturn_t qed_single_int(int irq, void *dev_instance)
+ 		/* Fastpath interrupts */
+ 		for (j = 0; j < 64; j++) {
+ 			if ((0x2ULL << j) & status) {
+-				hwfn->simd_proto_handler[j].func(
+-					hwfn->simd_proto_handler[j].token);
++				struct qed_simd_fp_handler *p_handler =
++					&hwfn->simd_proto_handler[j];
++
++				if (p_handler->func)
++					p_handler->func(p_handler->token);
++				else
++					DP_NOTICE(hwfn,
++						  "Not calling fastpath handler as it is NULL [handler #%d, status 0x%llx]\n",
++						  j, status);
++
+ 				status &= ~(0x2ULL << j);
+ 				rc = IRQ_HANDLED;
+ 			}
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+index ccbb04503b27..b53a18e365c2 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+@@ -1128,6 +1128,8 @@ static ssize_t qlcnic_83xx_sysfs_flash_write_handler(struct file *filp,
+ 	struct qlcnic_adapter *adapter = dev_get_drvdata(dev);
+ 
+ 	ret = kstrtoul(buf, 16, &data);
++	if (ret)
++		return ret;
+ 
+ 	switch (data) {
+ 	case QLC_83XX_FLASH_SECTOR_ERASE_CMD:
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
+index 8bbb55f31909..21f546587e3d 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -635,7 +635,7 @@ qcaspi_netdev_open(struct net_device *dev)
+ 		return ret;
+ 	}
+ 
+-	netif_start_queue(qca->net_dev);
++	/* SPI thread takes care of TX queue */
+ 
+ 	return 0;
+ }
+@@ -739,6 +739,9 @@ qcaspi_netdev_tx_timeout(struct net_device *dev)
+ 	qca->net_dev->stats.tx_errors++;
+ 	/* Trigger tx queue flush and QCA7000 reset */
+ 	qca->sync = QCASPI_SYNC_UNKNOWN;
++
++	if (qca->spi_thread)
++		wake_up_process(qca->spi_thread);
+ }
+ 
+ static int
+@@ -865,22 +868,22 @@ qca_spi_probe(struct spi_device *spi)
+ 
+ 	if ((qcaspi_clkspeed < QCASPI_CLK_SPEED_MIN) ||
+ 	    (qcaspi_clkspeed > QCASPI_CLK_SPEED_MAX)) {
+-		dev_info(&spi->dev, "Invalid clkspeed: %d\n",
+-			 qcaspi_clkspeed);
++		dev_err(&spi->dev, "Invalid clkspeed: %d\n",
++			qcaspi_clkspeed);
+ 		return -EINVAL;
+ 	}
+ 
+ 	if ((qcaspi_burst_len < QCASPI_BURST_LEN_MIN) ||
+ 	    (qcaspi_burst_len > QCASPI_BURST_LEN_MAX)) {
+-		dev_info(&spi->dev, "Invalid burst len: %d\n",
+-			 qcaspi_burst_len);
++		dev_err(&spi->dev, "Invalid burst len: %d\n",
++			qcaspi_burst_len);
+ 		return -EINVAL;
+ 	}
+ 
+ 	if ((qcaspi_pluggable < QCASPI_PLUGGABLE_MIN) ||
+ 	    (qcaspi_pluggable > QCASPI_PLUGGABLE_MAX)) {
+-		dev_info(&spi->dev, "Invalid pluggable: %d\n",
+-			 qcaspi_pluggable);
++		dev_err(&spi->dev, "Invalid pluggable: %d\n",
++			qcaspi_pluggable);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -941,8 +944,8 @@ qca_spi_probe(struct spi_device *spi)
+ 	}
+ 
+ 	if (register_netdev(qcaspi_devs)) {
+-		dev_info(&spi->dev, "Unable to register net device %s\n",
+-			 qcaspi_devs->name);
++		dev_err(&spi->dev, "Unable to register net device %s\n",
++			qcaspi_devs->name);
+ 		free_netdev(qcaspi_devs);
+ 		return -EFAULT;
+ 	}
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index 10d3a9f6349e..307ecd500dac 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -955,6 +955,13 @@ static void ravb_adjust_link(struct net_device *ndev)
+ 	struct ravb_private *priv = netdev_priv(ndev);
+ 	struct phy_device *phydev = ndev->phydev;
+ 	bool new_state = false;
++	unsigned long flags;
++
++	spin_lock_irqsave(&priv->lock, flags);
++
++	/* Disable TX and RX right over here, if E-MAC change is ignored */
++	if (priv->no_avb_link)
++		ravb_rcv_snd_disable(ndev);
+ 
+ 	if (phydev->link) {
+ 		if (phydev->duplex != priv->duplex) {
+@@ -972,18 +979,21 @@ static void ravb_adjust_link(struct net_device *ndev)
+ 			ravb_modify(ndev, ECMR, ECMR_TXF, 0);
+ 			new_state = true;
+ 			priv->link = phydev->link;
+-			if (priv->no_avb_link)
+-				ravb_rcv_snd_enable(ndev);
+ 		}
+ 	} else if (priv->link) {
+ 		new_state = true;
+ 		priv->link = 0;
+ 		priv->speed = 0;
+ 		priv->duplex = -1;
+-		if (priv->no_avb_link)
+-			ravb_rcv_snd_disable(ndev);
+ 	}
+ 
++	/* Enable TX and RX right over here, if E-MAC change is ignored */
++	if (priv->no_avb_link && phydev->link)
++		ravb_rcv_snd_enable(ndev);
++
++	mmiowb();
++	spin_unlock_irqrestore(&priv->lock, flags);
++
+ 	if (new_state && netif_msg_link(priv))
+ 		phy_print_status(phydev);
+ }
+@@ -1085,52 +1095,18 @@ static int ravb_get_link_ksettings(struct net_device *ndev,
+ static int ravb_set_link_ksettings(struct net_device *ndev,
+ 				   const struct ethtool_link_ksettings *cmd)
+ {
+-	struct ravb_private *priv = netdev_priv(ndev);
+-	unsigned long flags;
+-	int error;
+-
+ 	if (!ndev->phydev)
+ 		return -ENODEV;
+ 
+-	spin_lock_irqsave(&priv->lock, flags);
+-
+-	/* Disable TX and RX */
+-	ravb_rcv_snd_disable(ndev);
+-
+-	error = phy_ethtool_ksettings_set(ndev->phydev, cmd);
+-	if (error)
+-		goto error_exit;
+-
+-	if (cmd->base.duplex == DUPLEX_FULL)
+-		priv->duplex = 1;
+-	else
+-		priv->duplex = 0;
+-
+-	ravb_set_duplex(ndev);
+-
+-error_exit:
+-	mdelay(1);
+-
+-	/* Enable TX and RX */
+-	ravb_rcv_snd_enable(ndev);
+-
+-	mmiowb();
+-	spin_unlock_irqrestore(&priv->lock, flags);
+-
+-	return error;
++	return phy_ethtool_ksettings_set(ndev->phydev, cmd);
+ }
+ 
+ static int ravb_nway_reset(struct net_device *ndev)
+ {
+-	struct ravb_private *priv = netdev_priv(ndev);
+ 	int error = -ENODEV;
+-	unsigned long flags;
+ 
+-	if (ndev->phydev) {
+-		spin_lock_irqsave(&priv->lock, flags);
++	if (ndev->phydev)
+ 		error = phy_start_aneg(ndev->phydev);
+-		spin_unlock_irqrestore(&priv->lock, flags);
+-	}
+ 
+ 	return error;
+ }
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index c8fd99b3ca29..c59e8fe37069 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -1743,8 +1743,15 @@ static void sh_eth_adjust_link(struct net_device *ndev)
+ {
+ 	struct sh_eth_private *mdp = netdev_priv(ndev);
+ 	struct phy_device *phydev = ndev->phydev;
++	unsigned long flags;
+ 	int new_state = 0;
+ 
++	spin_lock_irqsave(&mdp->lock, flags);
++
++	/* Disable TX and RX right over here, if E-MAC change is ignored */
++	if (mdp->cd->no_psr || mdp->no_ether_link)
++		sh_eth_rcv_snd_disable(ndev);
++
+ 	if (phydev->link) {
+ 		if (phydev->duplex != mdp->duplex) {
+ 			new_state = 1;
+@@ -1763,18 +1770,21 @@ static void sh_eth_adjust_link(struct net_device *ndev)
+ 			sh_eth_modify(ndev, ECMR, ECMR_TXF, 0);
+ 			new_state = 1;
+ 			mdp->link = phydev->link;
+-			if (mdp->cd->no_psr || mdp->no_ether_link)
+-				sh_eth_rcv_snd_enable(ndev);
+ 		}
+ 	} else if (mdp->link) {
+ 		new_state = 1;
+ 		mdp->link = 0;
+ 		mdp->speed = 0;
+ 		mdp->duplex = -1;
+-		if (mdp->cd->no_psr || mdp->no_ether_link)
+-			sh_eth_rcv_snd_disable(ndev);
+ 	}
+ 
++	/* Enable TX and RX right over here, if E-MAC change is ignored */
++	if ((mdp->cd->no_psr || mdp->no_ether_link) && phydev->link)
++		sh_eth_rcv_snd_enable(ndev);
++
++	mmiowb();
++	spin_unlock_irqrestore(&mdp->lock, flags);
++
+ 	if (new_state && netif_msg_link(mdp))
+ 		phy_print_status(phydev);
+ }
+@@ -1856,39 +1866,10 @@ static int sh_eth_get_link_ksettings(struct net_device *ndev,
+ static int sh_eth_set_link_ksettings(struct net_device *ndev,
+ 				     const struct ethtool_link_ksettings *cmd)
+ {
+-	struct sh_eth_private *mdp = netdev_priv(ndev);
+-	unsigned long flags;
+-	int ret;
+-
+ 	if (!ndev->phydev)
+ 		return -ENODEV;
+ 
+-	spin_lock_irqsave(&mdp->lock, flags);
+-
+-	/* disable tx and rx */
+-	sh_eth_rcv_snd_disable(ndev);
+-
+-	ret = phy_ethtool_ksettings_set(ndev->phydev, cmd);
+-	if (ret)
+-		goto error_exit;
+-
+-	if (cmd->base.duplex == DUPLEX_FULL)
+-		mdp->duplex = 1;
+-	else
+-		mdp->duplex = 0;
+-
+-	if (mdp->cd->set_duplex)
+-		mdp->cd->set_duplex(ndev);
+-
+-error_exit:
+-	mdelay(1);
+-
+-	/* enable tx and rx */
+-	sh_eth_rcv_snd_enable(ndev);
+-
+-	spin_unlock_irqrestore(&mdp->lock, flags);
+-
+-	return ret;
++	return phy_ethtool_ksettings_set(ndev->phydev, cmd);
+ }
+ 
+ /* If it is ever necessary to increase SH_ETH_REG_DUMP_MAX_REGS, the
+@@ -2079,18 +2060,10 @@ static void sh_eth_get_regs(struct net_device *ndev, struct ethtool_regs *regs,
+ 
+ static int sh_eth_nway_reset(struct net_device *ndev)
+ {
+-	struct sh_eth_private *mdp = netdev_priv(ndev);
+-	unsigned long flags;
+-	int ret;
+-
+ 	if (!ndev->phydev)
+ 		return -ENODEV;
+ 
+-	spin_lock_irqsave(&mdp->lock, flags);
+-	ret = phy_start_aneg(ndev->phydev);
+-	spin_unlock_irqrestore(&mdp->lock, flags);
+-
+-	return ret;
++	return phy_start_aneg(ndev->phydev);
+ }
+ 
+ static u32 sh_eth_get_msglevel(struct net_device *ndev)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig
+index 4b78168a5f3c..0d03682faffb 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
++++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
+@@ -83,7 +83,7 @@ config DWMAC_ROCKCHIP
+ config DWMAC_SOCFPGA
+ 	tristate "SOCFPGA dwmac support"
+ 	default ARCH_SOCFPGA
+-	depends on OF && (ARCH_SOCFPGA || COMPILE_TEST)
++	depends on OF && (ARCH_SOCFPGA || ARCH_STRATIX10 || COMPILE_TEST)
+ 	select MFD_SYSCON
+ 	help
+ 	  Support for ethernet controller on Altera SOCFPGA
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+index 0c420e97de1e..c3a78c113424 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+@@ -55,6 +55,7 @@ struct socfpga_dwmac {
+ 	struct	device *dev;
+ 	struct regmap *sys_mgr_base_addr;
+ 	struct reset_control *stmmac_rst;
++	struct reset_control *stmmac_ocp_rst;
+ 	void __iomem *splitter_base;
+ 	bool f2h_ptp_ref_clk;
+ 	struct tse_pcs pcs;
+@@ -262,8 +263,8 @@ static int socfpga_dwmac_set_phy_mode(struct socfpga_dwmac *dwmac)
+ 		val = SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_GMII_MII;
+ 
+ 	/* Assert reset to the enet controller before changing the phy mode */
+-	if (dwmac->stmmac_rst)
+-		reset_control_assert(dwmac->stmmac_rst);
++	reset_control_assert(dwmac->stmmac_ocp_rst);
++	reset_control_assert(dwmac->stmmac_rst);
+ 
+ 	regmap_read(sys_mgr_base_addr, reg_offset, &ctrl);
+ 	ctrl &= ~(SYSMGR_EMACGRP_CTRL_PHYSEL_MASK << reg_shift);
+@@ -285,8 +286,8 @@ static int socfpga_dwmac_set_phy_mode(struct socfpga_dwmac *dwmac)
+ 	/* Deassert reset for the phy configuration to be sampled by
+ 	 * the enet controller, and operation to start in requested mode
+ 	 */
+-	if (dwmac->stmmac_rst)
+-		reset_control_deassert(dwmac->stmmac_rst);
++	reset_control_deassert(dwmac->stmmac_ocp_rst);
++	reset_control_deassert(dwmac->stmmac_rst);
+ 	if (phymode == PHY_INTERFACE_MODE_SGMII) {
+ 		if (tse_pcs_init(dwmac->pcs.tse_pcs_base, &dwmac->pcs) != 0) {
+ 			dev_err(dwmac->dev, "Unable to initialize TSE PCS");
+@@ -321,6 +322,15 @@ static int socfpga_dwmac_probe(struct platform_device *pdev)
+ 		goto err_remove_config_dt;
+ 	}
+ 
++	dwmac->stmmac_ocp_rst = devm_reset_control_get_optional(dev, "stmmaceth-ocp");
++	if (IS_ERR(dwmac->stmmac_ocp_rst)) {
++		ret = PTR_ERR(dwmac->stmmac_ocp_rst);
++		dev_err(dev, "error getting reset control of ocp %d\n", ret);
++		goto err_remove_config_dt;
++	}
++
++	reset_control_deassert(dwmac->stmmac_ocp_rst);
++
+ 	ret = socfpga_dwmac_parse_data(dwmac, dev);
+ 	if (ret) {
+ 		dev_err(dev, "Unable to parse OF data\n");
+diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
+index 481c7bf0395b..413cf14dbacd 100644
+--- a/drivers/net/ethernet/ti/davinci_emac.c
++++ b/drivers/net/ethernet/ti/davinci_emac.c
+@@ -1387,6 +1387,10 @@ static int emac_devioctl(struct net_device *ndev, struct ifreq *ifrq, int cmd)
+ 
+ static int match_first_device(struct device *dev, void *data)
+ {
++	if (dev->parent && dev->parent->of_node)
++		return of_device_is_compatible(dev->parent->of_node,
++					       "ti,davinci_mdio");
++
+ 	return !strncmp(dev_name(dev), "davinci_mdio", 12);
+ }
+ 
+diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
+index 622ab3ab9e93..f5e0983ae2a1 100644
+--- a/drivers/net/hamradio/bpqether.c
++++ b/drivers/net/hamradio/bpqether.c
+@@ -89,10 +89,6 @@
+ static const char banner[] __initconst = KERN_INFO \
+ 	"AX.25: bpqether driver version 004\n";
+ 
+-static char bcast_addr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
+-
+-static char bpq_eth_addr[6];
+-
+ static int bpq_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *);
+ static int bpq_device_event(struct notifier_block *, unsigned long, void *);
+ 
+@@ -515,8 +511,8 @@ static int bpq_new_device(struct net_device *edev)
+ 	bpq->ethdev = edev;
+ 	bpq->axdev = ndev;
+ 
+-	memcpy(bpq->dest_addr, bcast_addr, sizeof(bpq_eth_addr));
+-	memcpy(bpq->acpt_addr, bcast_addr, sizeof(bpq_eth_addr));
++	eth_broadcast_addr(bpq->dest_addr);
++	eth_broadcast_addr(bpq->acpt_addr);
+ 
+ 	err = register_netdevice(ndev);
+ 	if (err)
+diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
+index 9f10da60e02d..ce3b7fb7eda0 100644
+--- a/drivers/net/ieee802154/at86rf230.c
++++ b/drivers/net/ieee802154/at86rf230.c
+@@ -941,7 +941,7 @@ at86rf230_xmit(struct ieee802154_hw *hw, struct sk_buff *skb)
+ static int
+ at86rf230_ed(struct ieee802154_hw *hw, u8 *level)
+ {
+-	BUG_ON(!level);
++	WARN_ON(!level);
+ 	*level = 0xbe;
+ 	return 0;
+ }
+@@ -1117,8 +1117,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw,
+ 	if (changed & IEEE802154_AFILT_SADDR_CHANGED) {
+ 		u16 addr = le16_to_cpu(filt->short_addr);
+ 
+-		dev_vdbg(&lp->spi->dev,
+-			 "at86rf230_set_hw_addr_filt called for saddr\n");
++		dev_vdbg(&lp->spi->dev, "%s called for saddr\n", __func__);
+ 		__at86rf230_write(lp, RG_SHORT_ADDR_0, addr);
+ 		__at86rf230_write(lp, RG_SHORT_ADDR_1, addr >> 8);
+ 	}
+@@ -1126,8 +1125,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw,
+ 	if (changed & IEEE802154_AFILT_PANID_CHANGED) {
+ 		u16 pan = le16_to_cpu(filt->pan_id);
+ 
+-		dev_vdbg(&lp->spi->dev,
+-			 "at86rf230_set_hw_addr_filt called for pan id\n");
++		dev_vdbg(&lp->spi->dev, "%s called for pan id\n", __func__);
+ 		__at86rf230_write(lp, RG_PAN_ID_0, pan);
+ 		__at86rf230_write(lp, RG_PAN_ID_1, pan >> 8);
+ 	}
+@@ -1136,15 +1134,13 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw,
+ 		u8 i, addr[8];
+ 
+ 		memcpy(addr, &filt->ieee_addr, 8);
+-		dev_vdbg(&lp->spi->dev,
+-			 "at86rf230_set_hw_addr_filt called for IEEE addr\n");
++		dev_vdbg(&lp->spi->dev, "%s called for IEEE addr\n", __func__);
+ 		for (i = 0; i < 8; i++)
+ 			__at86rf230_write(lp, RG_IEEE_ADDR_0 + i, addr[i]);
+ 	}
+ 
+ 	if (changed & IEEE802154_AFILT_PANC_CHANGED) {
+-		dev_vdbg(&lp->spi->dev,
+-			 "at86rf230_set_hw_addr_filt called for panc change\n");
++		dev_vdbg(&lp->spi->dev, "%s called for panc change\n", __func__);
+ 		if (filt->pan_coord)
+ 			at86rf230_write_subreg(lp, SR_AACK_I_AM_COORD, 1);
+ 		else
+@@ -1248,7 +1244,6 @@ at86rf230_set_cca_mode(struct ieee802154_hw *hw,
+ 	return at86rf230_write_subreg(lp, SR_CCA_MODE, val);
+ }
+ 
+-
+ static int
+ at86rf230_set_cca_ed_level(struct ieee802154_hw *hw, s32 mbm)
+ {
+diff --git a/drivers/net/ieee802154/fakelb.c b/drivers/net/ieee802154/fakelb.c
+index ec387efb61d0..685398191995 100644
+--- a/drivers/net/ieee802154/fakelb.c
++++ b/drivers/net/ieee802154/fakelb.c
+@@ -49,7 +49,7 @@ struct fakelb_phy {
+ 
+ static int fakelb_hw_ed(struct ieee802154_hw *hw, u8 *level)
+ {
+-	BUG_ON(!level);
++	WARN_ON(!level);
+ 	*level = 0xbe;
+ 
+ 	return 0;
+diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
+index 24eb5755604f..b299277361b7 100644
+--- a/drivers/net/ipvlan/ipvlan_main.c
++++ b/drivers/net/ipvlan/ipvlan_main.c
+@@ -63,10 +63,23 @@ static int ipvlan_set_port_mode(struct ipvl_port *port, u16 nval)
+ {
+ 	struct ipvl_dev *ipvlan;
+ 	struct net_device *mdev = port->dev;
+-	int err = 0;
++	unsigned int flags;
++	int err;
+ 
+ 	ASSERT_RTNL();
+ 	if (port->mode != nval) {
++		list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
++			flags = ipvlan->dev->flags;
++			if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S) {
++				err = dev_change_flags(ipvlan->dev,
++						       flags | IFF_NOARP);
++			} else {
++				err = dev_change_flags(ipvlan->dev,
++						       flags & ~IFF_NOARP);
++			}
++			if (unlikely(err))
++				goto fail;
++		}
+ 		if (nval == IPVLAN_MODE_L3S) {
+ 			/* New mode is L3S */
+ 			err = ipvlan_register_nf_hook();
+@@ -74,21 +87,28 @@ static int ipvlan_set_port_mode(struct ipvl_port *port, u16 nval)
+ 				mdev->l3mdev_ops = &ipvl_l3mdev_ops;
+ 				mdev->priv_flags |= IFF_L3MDEV_MASTER;
+ 			} else
+-				return err;
++				goto fail;
+ 		} else if (port->mode == IPVLAN_MODE_L3S) {
+ 			/* Old mode was L3S */
+ 			mdev->priv_flags &= ~IFF_L3MDEV_MASTER;
+ 			ipvlan_unregister_nf_hook();
+ 			mdev->l3mdev_ops = NULL;
+ 		}
+-		list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
+-			if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S)
+-				ipvlan->dev->flags |= IFF_NOARP;
+-			else
+-				ipvlan->dev->flags &= ~IFF_NOARP;
+-		}
+ 		port->mode = nval;
+ 	}
++	return 0;
++
++fail:
++	/* Undo the flags changes that have been done so far. */
++	list_for_each_entry_continue_reverse(ipvlan, &port->ipvlans, pnode) {
++		flags = ipvlan->dev->flags;
++		if (port->mode == IPVLAN_MODE_L3 ||
++		    port->mode == IPVLAN_MODE_L3S)
++			dev_change_flags(ipvlan->dev, flags | IFF_NOARP);
++		else
++			dev_change_flags(ipvlan->dev, flags & ~IFF_NOARP);
++	}
++
+ 	return err;
+ }
+ 
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index dc4f7ea95c9b..9504800217ed 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -681,7 +681,7 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ 		   (netdev->flags & IFF_ALLMULTI)) {
+ 		rx_creg &= 0xfffe;
+ 		rx_creg |= 0x0002;
+-		dev_info(&netdev->dev, "%s: allmulti set\n", netdev->name);
++		dev_dbg(&netdev->dev, "%s: allmulti set\n", netdev->name);
+ 	} else {
+ 		/* ~RX_MULTICAST, ~RX_PROMISCUOUS */
+ 		rx_creg &= 0x00fc;
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index 2cc0f28f4fd2..03d04011d653 100644
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -82,6 +82,9 @@ static bool turbo_mode = true;
+ module_param(turbo_mode, bool, 0644);
+ MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction");
+ 
++static int smsc75xx_link_ok_nopm(struct usbnet *dev);
++static int smsc75xx_phy_gig_workaround(struct usbnet *dev);
++
+ static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index,
+ 					    u32 *data, int in_pm)
+ {
+@@ -852,6 +855,9 @@ static int smsc75xx_phy_initialize(struct usbnet *dev)
+ 		return -EIO;
+ 	}
+ 
++	/* phy workaround for gig link */
++	smsc75xx_phy_gig_workaround(dev);
++
+ 	smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
+ 		ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP |
+ 		ADVERTISE_PAUSE_ASYM);
+@@ -990,6 +996,62 @@ static int smsc75xx_wait_ready(struct usbnet *dev, int in_pm)
+ 	return -EIO;
+ }
+ 
++static int smsc75xx_phy_gig_workaround(struct usbnet *dev)
++{
++	struct mii_if_info *mii = &dev->mii;
++	int ret = 0, timeout = 0;
++	u32 buf, link_up = 0;
++
++	/* Set the phy in Gig loopback */
++	smsc75xx_mdio_write(dev->net, mii->phy_id, MII_BMCR, 0x4040);
++
++	/* Wait for the link up */
++	do {
++		link_up = smsc75xx_link_ok_nopm(dev);
++		usleep_range(10000, 20000);
++		timeout++;
++	} while ((!link_up) && (timeout < 1000));
++
++	if (timeout >= 1000) {
++		netdev_warn(dev->net, "Timeout waiting for PHY link up\n");
++		return -EIO;
++	}
++
++	/* phy reset */
++	ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
++	if (ret < 0) {
++		netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ret);
++		return ret;
++	}
++
++	buf |= PMT_CTL_PHY_RST;
++
++	ret = smsc75xx_write_reg(dev, PMT_CTL, buf);
++	if (ret < 0) {
++		netdev_warn(dev->net, "Failed to write PMT_CTL: %d\n", ret);
++		return ret;
++	}
++
++	timeout = 0;
++	do {
++		usleep_range(10000, 20000);
++		ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
++		if (ret < 0) {
++			netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n",
++				    ret);
++			return ret;
++		}
++		timeout++;
++	} while ((buf & PMT_CTL_PHY_RST) && (timeout < 100));
++
++	if (timeout >= 100) {
++		netdev_warn(dev->net, "timeout waiting for PHY Reset\n");
++		return -EIO;
++	}
++
++	return 0;
++}
++
+ static int smsc75xx_reset(struct usbnet *dev)
+ {
+ 	struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index d46f086e6360..de52d826eb24 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4229,6 +4229,13 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+ 	if (bus) {
++		/* Stop watchdog task */
++		if (bus->watchdog_tsk) {
++			send_sig(SIGTERM, bus->watchdog_tsk, 1);
++			kthread_stop(bus->watchdog_tsk);
++			bus->watchdog_tsk = NULL;
++		}
++
+ 		/* De-register interrupt handler */
+ 		brcmf_sdiod_intr_unregister(bus->sdiodev);
+ 
+diff --git a/drivers/nfc/pn533/usb.c b/drivers/nfc/pn533/usb.c
+index 33ed78be2750..3a897f57cac5 100644
+--- a/drivers/nfc/pn533/usb.c
++++ b/drivers/nfc/pn533/usb.c
+@@ -71,7 +71,7 @@ static void pn533_recv_response(struct urb *urb)
+ 	struct sk_buff *skb = NULL;
+ 
+ 	if (!urb->status) {
+-		skb = alloc_skb(urb->actual_length, GFP_KERNEL);
++		skb = alloc_skb(urb->actual_length, GFP_ATOMIC);
+ 		if (!skb) {
+ 			nfc_err(&phy->udev->dev, "failed to alloc memory\n");
+ 		} else {
+@@ -180,7 +180,7 @@ static int pn533_usb_send_frame(struct pn533 *dev,
+ 
+ 	if (dev->protocol_type == PN533_PROTO_REQ_RESP) {
+ 		/* request for response for sent packet directly */
+-		rc = pn533_submit_urb_for_response(phy, GFP_ATOMIC);
++		rc = pn533_submit_urb_for_response(phy, GFP_KERNEL);
+ 		if (rc)
+ 			goto error;
+ 	} else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) {
+diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
+index 64b40a12abcf..f12753eb3216 100644
+--- a/drivers/nvme/target/core.c
++++ b/drivers/nvme/target/core.c
+@@ -578,6 +578,14 @@ static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl)
+ 	}
+ 
+ 	ctrl->csts = NVME_CSTS_RDY;
++
++	/*
++	 * Controllers that are not yet enabled should not really enforce the
++	 * keep alive timeout, but we still want to track a timeout and cleanup
++	 * in case a host died before it enabled the controller.  Hence, simply
++	 * reset the keep alive timer when the controller is enabled.
++	 */
++	mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
+ }
+ 
+ static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl)
+diff --git a/drivers/pci/host/pci-host-common.c b/drivers/pci/host/pci-host-common.c
+index e3c48b5deb93..5c90d7be2184 100644
+--- a/drivers/pci/host/pci-host-common.c
++++ b/drivers/pci/host/pci-host-common.c
+@@ -45,7 +45,7 @@ static int gen_pci_parse_request_of_pci_ranges(struct device *dev,
+ 
+ 		switch (resource_type(res)) {
+ 		case IORESOURCE_IO:
+-			err = pci_remap_iospace(res, iobase);
++			err = devm_pci_remap_iospace(dev, res, iobase);
+ 			if (err) {
+ 				dev_warn(dev, "error %d: failed to map resource %pR\n",
+ 					 err, res);
+diff --git a/drivers/pci/host/pci-versatile.c b/drivers/pci/host/pci-versatile.c
+index b7dc07002f13..4096cce0ef0e 100644
+--- a/drivers/pci/host/pci-versatile.c
++++ b/drivers/pci/host/pci-versatile.c
+@@ -89,7 +89,7 @@ static int versatile_pci_parse_request_of_pci_ranges(struct device *dev,
+ 
+ 		switch (resource_type(res)) {
+ 		case IORESOURCE_IO:
+-			err = pci_remap_iospace(res, iobase);
++			err = devm_pci_remap_iospace(dev, res, iobase);
+ 			if (err) {
+ 				dev_warn(dev, "error %d: failed to map resource %pR\n",
+ 					 err, res);
+diff --git a/drivers/pci/host/pcie-rcar.c b/drivers/pci/host/pcie-rcar.c
+index 62700d1896f4..d6196f7b1d58 100644
+--- a/drivers/pci/host/pcie-rcar.c
++++ b/drivers/pci/host/pcie-rcar.c
+@@ -1102,7 +1102,7 @@ static int rcar_pcie_parse_request_of_pci_ranges(struct rcar_pcie *pci)
+ 		struct resource *res = win->res;
+ 
+ 		if (resource_type(res) == IORESOURCE_IO) {
+-			err = pci_remap_iospace(res, iobase);
++			err = devm_pci_remap_iospace(dev, res, iobase);
+ 			if (err) {
+ 				dev_warn(dev, "error %d: failed to map resource %pR\n",
+ 					 err, res);
+diff --git a/drivers/pci/host/pcie-xilinx-nwl.c b/drivers/pci/host/pcie-xilinx-nwl.c
+index 43eaa4afab94..94fdd295aae2 100644
+--- a/drivers/pci/host/pcie-xilinx-nwl.c
++++ b/drivers/pci/host/pcie-xilinx-nwl.c
+@@ -532,7 +532,7 @@ static int nwl_pcie_init_irq_domain(struct nwl_pcie *pcie)
+ 							INTX_NUM,
+ 							&legacy_domain_ops,
+ 							pcie);
+-
++	of_node_put(legacy_intc_node);
+ 	if (!pcie->legacy_irq_domain) {
+ 		dev_err(dev, "failed to create IRQ domain\n");
+ 		return -ENOMEM;
+diff --git a/drivers/pci/host/pcie-xilinx.c b/drivers/pci/host/pcie-xilinx.c
+index c8616fadccf1..61332f4d51c3 100644
+--- a/drivers/pci/host/pcie-xilinx.c
++++ b/drivers/pci/host/pcie-xilinx.c
+@@ -527,6 +527,7 @@ static int xilinx_pcie_init_irq_domain(struct xilinx_pcie_port *port)
+ 	port->leg_domain = irq_domain_add_linear(pcie_intc_node, 4,
+ 						 &intx_domain_ops,
+ 						 port);
++	of_node_put(pcie_intc_node);
+ 	if (!port->leg_domain) {
+ 		dev_err(dev, "Failed to get a INTx IRQ domain\n");
+ 		return -ENODEV;
+diff --git a/drivers/pci/hotplug/pci_hotplug_core.c b/drivers/pci/hotplug/pci_hotplug_core.c
+index fea0b8b33589..0a3b3f72c94b 100644
+--- a/drivers/pci/hotplug/pci_hotplug_core.c
++++ b/drivers/pci/hotplug/pci_hotplug_core.c
+@@ -455,8 +455,17 @@ int __pci_hp_register(struct hotplug_slot *slot, struct pci_bus *bus,
+ 	list_add(&slot->slot_list, &pci_hotplug_slot_list);
+ 
+ 	result = fs_add_slot(pci_slot);
++	if (result)
++		goto err_list_del;
++
+ 	kobject_uevent(&pci_slot->kobj, KOBJ_ADD);
+ 	dbg("Added slot %s to the list\n", name);
++	goto out;
++
++err_list_del:
++	list_del(&slot->slot_list);
++	pci_slot->hotplug = NULL;
++	pci_destroy_slot(pci_slot);
+ out:
+ 	mutex_unlock(&pci_hp_mutex);
+ 	return result;
+diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
+index 2bba8481beb1..56c0b60df25e 100644
+--- a/drivers/pci/hotplug/pciehp.h
++++ b/drivers/pci/hotplug/pciehp.h
+@@ -132,6 +132,7 @@ int pciehp_unconfigure_device(struct slot *p_slot);
+ void pciehp_queue_pushbutton_work(struct work_struct *work);
+ struct controller *pcie_init(struct pcie_device *dev);
+ int pcie_init_notification(struct controller *ctrl);
++void pcie_shutdown_notification(struct controller *ctrl);
+ int pciehp_enable_slot(struct slot *p_slot);
+ int pciehp_disable_slot(struct slot *p_slot);
+ void pcie_reenable_notification(struct controller *ctrl);
+diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
+index 6620b1095046..a7485bc1e975 100644
+--- a/drivers/pci/hotplug/pciehp_core.c
++++ b/drivers/pci/hotplug/pciehp_core.c
+@@ -76,6 +76,12 @@ static int reset_slot(struct hotplug_slot *slot, int probe);
+  */
+ static void release_slot(struct hotplug_slot *hotplug_slot)
+ {
++	struct slot *slot = hotplug_slot->private;
++
++	/* queued work needs hotplug_slot name */
++	cancel_delayed_work(&slot->work);
++	drain_workqueue(slot->wq);
++
+ 	kfree(hotplug_slot->ops);
+ 	kfree(hotplug_slot->info);
+ 	kfree(hotplug_slot);
+@@ -278,6 +284,7 @@ static void pciehp_remove(struct pcie_device *dev)
+ {
+ 	struct controller *ctrl = get_service_data(dev);
+ 
++	pcie_shutdown_notification(ctrl);
+ 	cleanup_slot(ctrl);
+ 	pciehp_release_ctrl(ctrl);
+ }
+diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
+index 8d811ea353c8..8b8b096167d7 100644
+--- a/drivers/pci/hotplug/pciehp_hpc.c
++++ b/drivers/pci/hotplug/pciehp_hpc.c
+@@ -562,8 +562,6 @@ static irqreturn_t pciehp_isr(int irq, void *dev_id)
+ {
+ 	struct controller *ctrl = (struct controller *)dev_id;
+ 	struct pci_dev *pdev = ctrl_dev(ctrl);
+-	struct pci_bus *subordinate = pdev->subordinate;
+-	struct pci_dev *dev;
+ 	struct slot *slot = ctrl->slot;
+ 	u16 status, events;
+ 	u8 present;
+@@ -611,14 +609,9 @@ static irqreturn_t pciehp_isr(int irq, void *dev_id)
+ 		wake_up(&ctrl->queue);
+ 	}
+ 
+-	if (subordinate) {
+-		list_for_each_entry(dev, &subordinate->devices, bus_list) {
+-			if (dev->ignore_hotplug) {
+-				ctrl_dbg(ctrl, "ignoring hotplug event %#06x (%s requested no hotplug)\n",
+-					 events, pci_name(dev));
+-				return IRQ_HANDLED;
+-			}
+-		}
++	if (pdev->ignore_hotplug) {
++		ctrl_dbg(ctrl, "ignoring hotplug event %#06x\n", events);
++		return IRQ_HANDLED;
+ 	}
+ 
+ 	/* Check Attention Button Pressed */
+@@ -786,7 +779,7 @@ int pcie_init_notification(struct controller *ctrl)
+ 	return 0;
+ }
+ 
+-static void pcie_shutdown_notification(struct controller *ctrl)
++void pcie_shutdown_notification(struct controller *ctrl)
+ {
+ 	if (ctrl->notification_enabled) {
+ 		pcie_disable_notification(ctrl);
+@@ -821,7 +814,7 @@ abort:
+ static void pcie_cleanup_slot(struct controller *ctrl)
+ {
+ 	struct slot *slot = ctrl->slot;
+-	cancel_delayed_work(&slot->work);
++
+ 	destroy_workqueue(slot->wq);
+ 	kfree(slot);
+ }
+@@ -902,7 +895,6 @@ abort:
+ 
+ void pciehp_release_ctrl(struct controller *ctrl)
+ {
+-	pcie_shutdown_notification(ctrl);
+ 	pcie_cleanup_slot(ctrl);
+ 	kfree(ctrl);
+ }
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 9c13aeeeb973..6b3c5c4cbb37 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -3407,6 +3407,44 @@ void pci_unmap_iospace(struct resource *res)
+ #endif
+ }
+ 
++static void devm_pci_unmap_iospace(struct device *dev, void *ptr)
++{
++	struct resource **res = ptr;
++
++	pci_unmap_iospace(*res);
++}
++
++/**
++ * devm_pci_remap_iospace - Managed pci_remap_iospace()
++ * @dev: Generic device to remap IO address for
++ * @res: Resource describing the I/O space
++ * @phys_addr: physical address of range to be mapped
++ *
++ * Managed pci_remap_iospace().  Map is automatically unmapped on driver
++ * detach.
++ */
++int devm_pci_remap_iospace(struct device *dev, const struct resource *res,
++			   phys_addr_t phys_addr)
++{
++	const struct resource **ptr;
++	int error;
++
++	ptr = devres_alloc(devm_pci_unmap_iospace, sizeof(*ptr), GFP_KERNEL);
++	if (!ptr)
++		return -ENOMEM;
++
++	error = pci_remap_iospace(res, phys_addr);
++	if (error) {
++		devres_free(ptr);
++	} else	{
++		*ptr = res;
++		devres_add(dev, ptr);
++	}
++
++	return error;
++}
++EXPORT_SYMBOL(devm_pci_remap_iospace);
++
+ static void __pci_set_master(struct pci_dev *dev, bool enable)
+ {
+ 	u16 old_cmd, cmd;
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 56340abe4fc6..16611cf3aba4 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -1363,6 +1363,10 @@ static void pci_configure_mps(struct pci_dev *dev)
+ 	if (!pci_is_pcie(dev) || !bridge || !pci_is_pcie(bridge))
+ 		return;
+ 
++	/* MPS and MRRS fields are of type 'RsvdP' for VFs, short-circuit out */
++	if (dev->is_virtfn)
++		return;
++
+ 	mps = pcie_get_mps(dev);
+ 	p_mps = pcie_get_mps(bridge);
+ 
+diff --git a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
+index 35c17653c694..87618a4e90e4 100644
+--- a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
++++ b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
+@@ -460,8 +460,8 @@ static int nsp_pinmux_enable(struct pinctrl_dev *pctrl_dev,
+ 	const struct nsp_pin_function *func;
+ 	const struct nsp_pin_group *grp;
+ 
+-	if (grp_select > pinctrl->num_groups ||
+-		func_select > pinctrl->num_functions)
++	if (grp_select >= pinctrl->num_groups ||
++	    func_select >= pinctrl->num_functions)
+ 		return -EINVAL;
+ 
+ 	func = &pinctrl->functions[func_select];
+@@ -577,6 +577,8 @@ static int nsp_pinmux_probe(struct platform_device *pdev)
+ 		return PTR_ERR(pinctrl->base0);
+ 
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
++	if (!res)
++		return -EINVAL;
+ 	pinctrl->base1 = devm_ioremap_nocache(&pdev->dev, res->start,
+ 					      resource_size(res));
+ 	if (!pinctrl->base1) {
+diff --git a/drivers/scsi/xen-scsifront.c b/drivers/scsi/xen-scsifront.c
+index 9dc8687bf048..e1b32ed0aa20 100644
+--- a/drivers/scsi/xen-scsifront.c
++++ b/drivers/scsi/xen-scsifront.c
+@@ -676,10 +676,17 @@ static int scsifront_dev_reset_handler(struct scsi_cmnd *sc)
+ static int scsifront_sdev_configure(struct scsi_device *sdev)
+ {
+ 	struct vscsifrnt_info *info = shost_priv(sdev->host);
++	int err;
+ 
+-	if (info && current == info->curr)
+-		xenbus_printf(XBT_NIL, info->dev->nodename,
++	if (info && current == info->curr) {
++		err = xenbus_printf(XBT_NIL, info->dev->nodename,
+ 			      info->dev_state_path, "%d", XenbusStateConnected);
++		if (err) {
++			xenbus_dev_error(info->dev, err,
++				"%s: writing dev_state_path", __func__);
++			return err;
++		}
++	}
+ 
+ 	return 0;
+ }
+@@ -687,10 +694,15 @@ static int scsifront_sdev_configure(struct scsi_device *sdev)
+ static void scsifront_sdev_destroy(struct scsi_device *sdev)
+ {
+ 	struct vscsifrnt_info *info = shost_priv(sdev->host);
++	int err;
+ 
+-	if (info && current == info->curr)
+-		xenbus_printf(XBT_NIL, info->dev->nodename,
++	if (info && current == info->curr) {
++		err = xenbus_printf(XBT_NIL, info->dev->nodename,
+ 			      info->dev_state_path, "%d", XenbusStateClosed);
++		if (err)
++			xenbus_dev_error(info->dev, err,
++				"%s: writing dev_state_path", __func__);
++	}
+ }
+ 
+ static struct scsi_host_template scsifront_sht = {
+@@ -1025,9 +1037,12 @@ static void scsifront_do_lun_hotplug(struct vscsifrnt_info *info, int op)
+ 
+ 			if (scsi_add_device(info->host, chn, tgt, lun)) {
+ 				dev_err(&dev->dev, "scsi_add_device\n");
+-				xenbus_printf(XBT_NIL, dev->nodename,
++				err = xenbus_printf(XBT_NIL, dev->nodename,
+ 					      info->dev_state_path,
+ 					      "%d", XenbusStateClosed);
++				if (err)
++					xenbus_dev_error(dev, err,
++						"%s: writing dev_state_path", __func__);
+ 			}
+ 			break;
+ 		case VSCSIFRONT_OP_DEL_LUN:
+@@ -1041,10 +1056,14 @@ static void scsifront_do_lun_hotplug(struct vscsifrnt_info *info, int op)
+ 			}
+ 			break;
+ 		case VSCSIFRONT_OP_READD_LUN:
+-			if (device_state == XenbusStateConnected)
+-				xenbus_printf(XBT_NIL, dev->nodename,
++			if (device_state == XenbusStateConnected) {
++				err = xenbus_printf(XBT_NIL, dev->nodename,
+ 					      info->dev_state_path,
+ 					      "%d", XenbusStateConnected);
++				if (err)
++					xenbus_dev_error(dev, err,
++						"%s: writing dev_state_path", __func__);
++			}
+ 			break;
+ 		default:
+ 			break;
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index 09921ef07ac5..3ae27b6ed07c 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -3948,9 +3948,11 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg, int irq)
+ 	}
+ 
+ 	ret = usb_add_gadget_udc(dev, &hsotg->gadget);
+-	if (ret)
++	if (ret) {
++		dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep,
++					   hsotg->ctrl_req);
+ 		return ret;
+-
++	}
+ 	dwc2_hsotg_dump(hsotg);
+ 
+ 	return 0;
+@@ -3963,6 +3965,7 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg, int irq)
+ int dwc2_hsotg_remove(struct dwc2_hsotg *hsotg)
+ {
+ 	usb_del_gadget_udc(&hsotg->gadget);
++	dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep, hsotg->ctrl_req);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
+index 906f223542ee..8066fa9ac97b 100644
+--- a/drivers/usb/dwc2/hcd_intr.c
++++ b/drivers/usb/dwc2/hcd_intr.c
+@@ -922,9 +922,8 @@ static int dwc2_xfercomp_isoc_split_in(struct dwc2_hsotg *hsotg,
+ 	frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+ 	len = dwc2_get_actual_xfer_length(hsotg, chan, chnum, qtd,
+ 					  DWC2_HC_XFER_COMPLETE, NULL);
+-	if (!len) {
++	if (!len && !qtd->isoc_split_offset) {
+ 		qtd->complete_split = 0;
+-		qtd->isoc_split_offset = 0;
+ 		return 0;
+ 	}
+ 
+diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
+index a3e2200f5b5f..58526932d2b6 100644
+--- a/drivers/usb/dwc3/dwc3-of-simple.c
++++ b/drivers/usb/dwc3/dwc3-of-simple.c
+@@ -132,8 +132,9 @@ static int dwc3_of_simple_remove(struct platform_device *pdev)
+ 
+ 	of_platform_depopulate(dev);
+ 
+-	pm_runtime_put_sync(dev);
+ 	pm_runtime_disable(dev);
++	pm_runtime_put_noidle(dev);
++	pm_runtime_set_suspended(dev);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index ca97f5b36e1b..2c022a08f163 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -1712,6 +1712,8 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+ 		 */
+ 		if (w_value && !f->get_alt)
+ 			break;
++
++		spin_lock(&cdev->lock);
+ 		value = f->set_alt(f, w_index, w_value);
+ 		if (value == USB_GADGET_DELAYED_STATUS) {
+ 			DBG(cdev,
+@@ -1721,6 +1723,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+ 			DBG(cdev, "delayed_status count %d\n",
+ 					cdev->delayed_status);
+ 		}
++		spin_unlock(&cdev->lock);
+ 		break;
+ 	case USB_REQ_GET_INTERFACE:
+ 		if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
+diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
+index a59fafb4b329..97d57a94776a 100644
+--- a/drivers/usb/host/xhci-tegra.c
++++ b/drivers/usb/host/xhci-tegra.c
+@@ -482,7 +482,7 @@ static void tegra_xusb_mbox_handle(struct tegra_xusb *tegra,
+ 	unsigned long mask;
+ 	unsigned int port;
+ 	bool idle, enable;
+-	int err;
++	int err = 0;
+ 
+ 	memset(&rsp, 0, sizeof(rsp));
+ 
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 81f25213cb41..c190fabd1875 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1056,8 +1056,13 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ 		command = readl(&xhci->op_regs->command);
+ 		command |= CMD_CRS;
+ 		writel(command, &xhci->op_regs->command);
++		/*
++		 * Some controllers take up to 55+ ms to complete the controller
++		 * restore so setting the timeout to 100ms. Xhci specification
++		 * doesn't mention any timeout value.
++		 */
+ 		if (xhci_handshake(&xhci->op_regs->status,
+-			      STS_RESTORE, 0, 10 * 1000)) {
++			      STS_RESTORE, 0, 100 * 1000)) {
+ 			xhci_warn(xhci, "WARN: xHC restore state timeout\n");
+ 			spin_unlock_irq(&xhci->lock);
+ 			return -ETIMEDOUT;
+diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
+index 9122ba25bb00..7abaaa5f0f67 100644
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -291,8 +291,15 @@ static void sysrq_handler(struct xenbus_watch *watch, const char **vec,
+ 		return;
+ 	}
+ 
+-	if (sysrq_key != '\0')
+-		xenbus_printf(xbt, "control", "sysrq", "%c", '\0');
++	if (sysrq_key != '\0') {
++		err = xenbus_printf(xbt, "control", "sysrq", "%c", '\0');
++		if (err) {
++			pr_err("%s: Error %d writing sysrq in control/sysrq\n",
++			       __func__, err);
++			xenbus_transaction_end(xbt, 1);
++			return;
++		}
++	}
+ 
+ 	err = xenbus_transaction_end(xbt, 0);
+ 	if (err == -EAGAIN)
+@@ -344,7 +351,12 @@ static int setup_shutdown_watcher(void)
+ 			continue;
+ 		snprintf(node, FEATURE_PATH_SIZE, "feature-%s",
+ 			 shutdown_handlers[idx].command);
+-		xenbus_printf(XBT_NIL, "control", node, "%u", 1);
++		err = xenbus_printf(XBT_NIL, "control", node, "%u", 1);
++		if (err) {
++			pr_err("%s: Error %d writing %s\n", __func__,
++				err, node);
++			return err;
++		}
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
+index 980f32817305..992cb8fa272c 100644
+--- a/drivers/xen/xen-scsiback.c
++++ b/drivers/xen/xen-scsiback.c
+@@ -1014,6 +1014,7 @@ static void scsiback_do_add_lun(struct vscsibk_info *info, const char *state,
+ {
+ 	struct v2p_entry *entry;
+ 	unsigned long flags;
++	int err;
+ 
+ 	if (try) {
+ 		spin_lock_irqsave(&info->v2p_lock, flags);
+@@ -1029,8 +1030,11 @@ static void scsiback_do_add_lun(struct vscsibk_info *info, const char *state,
+ 			scsiback_del_translation_entry(info, vir);
+ 		}
+ 	} else if (!try) {
+-		xenbus_printf(XBT_NIL, info->dev->nodename, state,
++		err = xenbus_printf(XBT_NIL, info->dev->nodename, state,
+ 			      "%d", XenbusStateClosed);
++		if (err)
++			xenbus_dev_error(info->dev, err,
++				"%s: writing %s", __func__, state);
+ 	}
+ }
+ 
+@@ -1069,8 +1073,11 @@ static void scsiback_do_1lun_hotplug(struct vscsibk_info *info, int op,
+ 	snprintf(str, sizeof(str), "vscsi-devs/%s/p-dev", ent);
+ 	val = xenbus_read(XBT_NIL, dev->nodename, str, NULL);
+ 	if (IS_ERR(val)) {
+-		xenbus_printf(XBT_NIL, dev->nodename, state,
++		err = xenbus_printf(XBT_NIL, dev->nodename, state,
+ 			      "%d", XenbusStateClosed);
++		if (err)
++			xenbus_dev_error(info->dev, err,
++				"%s: writing %s", __func__, state);
+ 		return;
+ 	}
+ 	strlcpy(phy, val, VSCSI_NAMELEN);
+@@ -1081,8 +1088,11 @@ static void scsiback_do_1lun_hotplug(struct vscsibk_info *info, int op,
+ 	err = xenbus_scanf(XBT_NIL, dev->nodename, str, "%u:%u:%u:%u",
+ 			   &vir.hst, &vir.chn, &vir.tgt, &vir.lun);
+ 	if (XENBUS_EXIST_ERR(err)) {
+-		xenbus_printf(XBT_NIL, dev->nodename, state,
++		err = xenbus_printf(XBT_NIL, dev->nodename, state,
+ 			      "%d", XenbusStateClosed);
++		if (err)
++			xenbus_dev_error(info->dev, err,
++				"%s: writing %s", __func__, state);
+ 		return;
+ 	}
+ 
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 4a6df2ce0f76..1f754336f801 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -1077,6 +1077,7 @@ static struct dentry *splice_dentry(struct dentry *dn, struct inode *in)
+ 	if (IS_ERR(realdn)) {
+ 		pr_err("splice_dentry error %ld %p inode %p ino %llx.%llx\n",
+ 		       PTR_ERR(realdn), dn, in, ceph_vinop(in));
++		dput(dn);
+ 		dn = realdn; /* note realdn contains the error */
+ 		goto out;
+ 	} else if (realdn) {
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 53e1890660a2..a49d0e5d7baf 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -26,6 +26,7 @@
+ #include <linux/log2.h>
+ #include <linux/module.h>
+ #include <linux/slab.h>
++#include <linux/nospec.h>
+ #include <linux/backing-dev.h>
+ #include <trace/events/ext4.h>
+ 
+@@ -2144,7 +2145,8 @@ ext4_mb_regular_allocator(struct ext4_allocation_context *ac)
+ 		 * This should tell if fe_len is exactly power of 2
+ 		 */
+ 		if ((ac->ac_g_ex.fe_len & (~(1 << (i - 1)))) == 0)
+-			ac->ac_2order = i - 1;
++			ac->ac_2order = array_index_nospec(i - 1,
++							   sb->s_blocksize_bits + 2);
+ 	}
+ 
+ 	/* if stream allocation is enabled, use global goal */
+diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
+index e87aa21c30de..06a9fae202a7 100644
+--- a/fs/reiserfs/xattr.c
++++ b/fs/reiserfs/xattr.c
+@@ -791,8 +791,10 @@ static int listxattr_filler(struct dir_context *ctx, const char *name,
+ 			return 0;
+ 		size = namelen + 1;
+ 		if (b->buf) {
+-			if (size > b->size)
++			if (b->pos + size > b->size) {
++				b->pos = -ERANGE;
+ 				return -ERANGE;
++			}
+ 			memcpy(b->buf + b->pos, name, namelen);
+ 			b->buf[b->pos + namelen] = 0;
+ 		}
+diff --git a/include/linux/fsl/guts.h b/include/linux/fsl/guts.h
+index 649e9171a9b3..270eef7d2267 100644
+--- a/include/linux/fsl/guts.h
++++ b/include/linux/fsl/guts.h
+@@ -16,6 +16,7 @@
+ #define __FSL_GUTS_H__
+ 
+ #include <linux/types.h>
++#include <linux/io.h>
+ 
+ /**
+  * Global Utility Registers.
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 36522905685b..78c9f4a91d94 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -1190,6 +1190,8 @@ int pci_register_io_range(phys_addr_t addr, resource_size_t size);
+ unsigned long pci_address_to_pio(phys_addr_t addr);
+ phys_addr_t pci_pio_to_address(unsigned long pio);
+ int pci_remap_iospace(const struct resource *res, phys_addr_t phys_addr);
++int devm_pci_remap_iospace(struct device *dev, const struct resource *res,
++			   phys_addr_t phys_addr);
+ void pci_unmap_iospace(struct resource *res);
+ 
+ static inline pci_bus_addr_t pci_bus_address(struct pci_dev *pdev, int bar)
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index 407087d686a7..64b0e9df31c7 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -312,14 +312,7 @@ struct ipv6_txoptions *ipv6_dup_options(struct sock *sk,
+ struct ipv6_txoptions *ipv6_renew_options(struct sock *sk,
+ 					  struct ipv6_txoptions *opt,
+ 					  int newtype,
+-					  struct ipv6_opt_hdr __user *newopt,
+-					  int newoptlen);
+-struct ipv6_txoptions *
+-ipv6_renew_options_kern(struct sock *sk,
+-			struct ipv6_txoptions *opt,
+-			int newtype,
+-			struct ipv6_opt_hdr *newopt,
+-			int newoptlen);
++					  struct ipv6_opt_hdr *newopt);
+ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
+ 					  struct ipv6_txoptions *opt);
+ 
+diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
+index 23102da24dd9..c05db6ff2515 100644
+--- a/include/net/net_namespace.h
++++ b/include/net/net_namespace.h
+@@ -116,6 +116,7 @@ struct net {
+ #endif
+ #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
+ 	struct netns_nf_frag	nf_frag;
++	struct ctl_table_header *nf_frag_frags_hdr;
+ #endif
+ 	struct sock		*nfnl;
+ 	struct sock		*nfnl_stash;
+diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
+index 10d0848f5b8a..5cae575db07b 100644
+--- a/include/net/netns/ipv6.h
++++ b/include/net/netns/ipv6.h
+@@ -89,7 +89,6 @@ struct netns_ipv6 {
+ 
+ #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
+ struct netns_nf_frag {
+-	struct netns_sysctl_ipv6 sysctl;
+ 	struct netns_frags	frags;
+ };
+ #endif
+diff --git a/include/net/tc_act/tc_tunnel_key.h b/include/net/tc_act/tc_tunnel_key.h
+index 253f8da6c2a6..2dcd80d62206 100644
+--- a/include/net/tc_act/tc_tunnel_key.h
++++ b/include/net/tc_act/tc_tunnel_key.h
+@@ -16,7 +16,6 @@
+ struct tcf_tunnel_key_params {
+ 	struct rcu_head		rcu;
+ 	int			tcft_action;
+-	int			action;
+ 	struct metadata_dst     *tcft_enc_metadata;
+ };
+ 
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 97d210535cdd..c3f4f6a9e6c3 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -850,8 +850,6 @@ enum tcp_ca_event {
+ 	CA_EVENT_LOSS,		/* loss timeout */
+ 	CA_EVENT_ECN_NO_CE,	/* ECT set, but not CE marked */
+ 	CA_EVENT_ECN_IS_CE,	/* received CE marked IP packet */
+-	CA_EVENT_DELAYED_ACK,	/* Delayed ack is sent */
+-	CA_EVENT_NON_DELAYED_ACK,
+ };
+ 
+ /* Information about inbound ACK, passed to cong_ops->in_ack_event() */
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index 6599c7f3071d..61a15e538435 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -1240,11 +1240,11 @@ unsigned long lockdep_count_forward_deps(struct lock_class *class)
+ 	this.parent = NULL;
+ 	this.class = class;
+ 
+-	local_irq_save(flags);
++	raw_local_irq_save(flags);
+ 	arch_spin_lock(&lockdep_lock);
+ 	ret = __lockdep_count_forward_deps(&this);
+ 	arch_spin_unlock(&lockdep_lock);
+-	local_irq_restore(flags);
++	raw_local_irq_restore(flags);
+ 
+ 	return ret;
+ }
+@@ -1267,11 +1267,11 @@ unsigned long lockdep_count_backward_deps(struct lock_class *class)
+ 	this.parent = NULL;
+ 	this.class = class;
+ 
+-	local_irq_save(flags);
++	raw_local_irq_save(flags);
+ 	arch_spin_lock(&lockdep_lock);
+ 	ret = __lockdep_count_backward_deps(&this);
+ 	arch_spin_unlock(&lockdep_lock);
+-	local_irq_restore(flags);
++	raw_local_irq_restore(flags);
+ 
+ 	return ret;
+ }
+@@ -4273,7 +4273,7 @@ void debug_check_no_locks_freed(const void *mem_from, unsigned long mem_len)
+ 	if (unlikely(!debug_locks))
+ 		return;
+ 
+-	local_irq_save(flags);
++	raw_local_irq_save(flags);
+ 	for (i = 0; i < curr->lockdep_depth; i++) {
+ 		hlock = curr->held_locks + i;
+ 
+@@ -4284,7 +4284,7 @@ void debug_check_no_locks_freed(const void *mem_from, unsigned long mem_len)
+ 		print_freed_lock_bug(curr, mem_from, mem_from + mem_len, hlock);
+ 		break;
+ 	}
+-	local_irq_restore(flags);
++	raw_local_irq_restore(flags);
+ }
+ EXPORT_SYMBOL_GPL(debug_check_no_locks_freed);
+ 
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 901c7f15f6e2..148c2210a2b8 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2525,6 +2525,7 @@ out_nobuffer:
+ }
+ EXPORT_SYMBOL_GPL(trace_vbprintk);
+ 
++__printf(3, 0)
+ static int
+ __trace_array_vprintk(struct ring_buffer *buffer,
+ 		      unsigned long ip, const char *fmt, va_list args)
+@@ -2579,12 +2580,14 @@ out_nobuffer:
+ 	return len;
+ }
+ 
++__printf(3, 0)
+ int trace_array_vprintk(struct trace_array *tr,
+ 			unsigned long ip, const char *fmt, va_list args)
+ {
+ 	return __trace_array_vprintk(tr->trace_buffer.buffer, ip, fmt, args);
+ }
+ 
++__printf(3, 0)
+ int trace_array_printk(struct trace_array *tr,
+ 		       unsigned long ip, const char *fmt, ...)
+ {
+@@ -2600,6 +2603,7 @@ int trace_array_printk(struct trace_array *tr,
+ 	return ret;
+ }
+ 
++__printf(3, 4)
+ int trace_array_printk_buf(struct ring_buffer *buffer,
+ 			   unsigned long ip, const char *fmt, ...)
+ {
+@@ -2615,6 +2619,7 @@ int trace_array_printk_buf(struct ring_buffer *buffer,
+ 	return ret;
+ }
+ 
++__printf(2, 0)
+ int trace_vprintk(unsigned long ip, const char *fmt, va_list args)
+ {
+ 	return trace_array_vprintk(&global_trace, ip, fmt, args);
+diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
+index 73c258129257..4ce386c44cf1 100644
+--- a/mm/kasan/kasan.c
++++ b/mm/kasan/kasan.c
+@@ -660,12 +660,13 @@ void kasan_kfree_large(const void *ptr)
+ int kasan_module_alloc(void *addr, size_t size)
+ {
+ 	void *ret;
++	size_t scaled_size;
+ 	size_t shadow_size;
+ 	unsigned long shadow_start;
+ 
+ 	shadow_start = (unsigned long)kasan_mem_to_shadow(addr);
+-	shadow_size = round_up(size >> KASAN_SHADOW_SCALE_SHIFT,
+-			PAGE_SIZE);
++	scaled_size = (size + KASAN_SHADOW_MASK) >> KASAN_SHADOW_SCALE_SHIFT;
++	shadow_size = round_up(scaled_size, PAGE_SIZE);
+ 
+ 	if (WARN_ON(!PAGE_ALIGNED(shadow_start)))
+ 		return -EINVAL;
+diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
+index 946f1c269b1f..1ae8c59fcb2d 100644
+--- a/net/batman-adv/bat_iv_ogm.c
++++ b/net/batman-adv/bat_iv_ogm.c
+@@ -2704,7 +2704,7 @@ static int batadv_iv_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
+ {
+ 	struct batadv_neigh_ifinfo *router_ifinfo = NULL;
+ 	struct batadv_neigh_node *router;
+-	struct batadv_gw_node *curr_gw;
++	struct batadv_gw_node *curr_gw = NULL;
+ 	int ret = 0;
+ 	void *hdr;
+ 
+@@ -2752,6 +2752,8 @@ static int batadv_iv_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
+ 	ret = 0;
+ 
+ out:
++	if (curr_gw)
++		batadv_gw_node_put(curr_gw);
+ 	if (router_ifinfo)
+ 		batadv_neigh_ifinfo_put(router_ifinfo);
+ 	if (router)
+diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c
+index ed4ddf2059a6..4348118e7eac 100644
+--- a/net/batman-adv/bat_v.c
++++ b/net/batman-adv/bat_v.c
+@@ -919,7 +919,7 @@ static int batadv_v_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
+ {
+ 	struct batadv_neigh_ifinfo *router_ifinfo = NULL;
+ 	struct batadv_neigh_node *router;
+-	struct batadv_gw_node *curr_gw;
++	struct batadv_gw_node *curr_gw = NULL;
+ 	int ret = 0;
+ 	void *hdr;
+ 
+@@ -987,6 +987,8 @@ static int batadv_v_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
+ 	ret = 0;
+ 
+ out:
++	if (curr_gw)
++		batadv_gw_node_put(curr_gw);
+ 	if (router_ifinfo)
+ 		batadv_neigh_ifinfo_put(router_ifinfo);
+ 	if (router)
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 5407d5f7b2d0..b85e789044d5 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -7945,7 +7945,8 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
+ 		/* We get here if we can't use the current device name */
+ 		if (!pat)
+ 			goto out;
+-		if (dev_get_valid_name(net, dev, pat) < 0)
++		err = dev_get_valid_name(net, dev, pat);
++		if (err < 0)
+ 			goto out;
+ 	}
+ 
+@@ -7957,7 +7958,6 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
+ 	dev_close(dev);
+ 
+ 	/* And unlink it from device chain */
+-	err = -ENODEV;
+ 	unlist_netdevice(dev);
+ 
+ 	synchronize_net();
+diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
+index 83af5339e582..ba8bd24eb8b6 100644
+--- a/net/ieee802154/6lowpan/core.c
++++ b/net/ieee802154/6lowpan/core.c
+@@ -90,12 +90,18 @@ static int lowpan_neigh_construct(struct net_device *dev, struct neighbour *n)
+ 	return 0;
+ }
+ 
++static int lowpan_get_iflink(const struct net_device *dev)
++{
++	return lowpan_802154_dev(dev)->wdev->ifindex;
++}
++
+ static const struct net_device_ops lowpan_netdev_ops = {
+ 	.ndo_init		= lowpan_dev_init,
+ 	.ndo_start_xmit		= lowpan_xmit,
+ 	.ndo_open		= lowpan_open,
+ 	.ndo_stop		= lowpan_stop,
+ 	.ndo_neigh_construct    = lowpan_neigh_construct,
++	.ndo_get_iflink         = lowpan_get_iflink,
+ };
+ 
+ static void lowpan_setup(struct net_device *ldev)
+diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
+index 06aa4948d0c0..4822459e8f42 100644
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -1913,6 +1913,7 @@ static struct xt_match ipt_builtin_mt[] __read_mostly = {
+ 		.checkentry = icmp_checkentry,
+ 		.proto      = IPPROTO_ICMP,
+ 		.family     = NFPROTO_IPV4,
++		.me	    = THIS_MODULE,
+ 	},
+ };
+ 
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 8f15eae3325b..9de77d946f5a 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -1696,7 +1696,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
+ 			 * shouldn't happen.
+ 			 */
+ 			if (WARN(before(*seq, TCP_SKB_CB(skb)->seq),
+-				 "recvmsg bug: copied %X seq %X rcvnxt %X fl %X\n",
++				 "TCP recvmsg seq # bug: copied %X, seq %X, rcvnxt %X, fl %X\n",
+ 				 *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt,
+ 				 flags))
+ 				break;
+@@ -1711,7 +1711,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
+ 			if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+ 				goto found_fin_ok;
+ 			WARN(!(flags & MSG_PEEK),
+-			     "recvmsg bug 2: copied %X seq %X rcvnxt %X fl %X\n",
++			     "TCP recvmsg seq # bug 2: copied %X, seq %X, rcvnxt %X, fl %X\n",
+ 			     *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, flags);
+ 		}
+ 
+diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
+index 8905a0aec8ee..a08cedf9d286 100644
+--- a/net/ipv4/tcp_dctcp.c
++++ b/net/ipv4/tcp_dctcp.c
+@@ -55,7 +55,6 @@ struct dctcp {
+ 	u32 dctcp_alpha;
+ 	u32 next_seq;
+ 	u32 ce_state;
+-	u32 delayed_ack_reserved;
+ 	u32 loss_cwnd;
+ };
+ 
+@@ -96,7 +95,6 @@ static void dctcp_init(struct sock *sk)
+ 
+ 		ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA);
+ 
+-		ca->delayed_ack_reserved = 0;
+ 		ca->loss_cwnd = 0;
+ 		ca->ce_state = 0;
+ 
+@@ -230,25 +228,6 @@ static void dctcp_state(struct sock *sk, u8 new_state)
+ 	}
+ }
+ 
+-static void dctcp_update_ack_reserved(struct sock *sk, enum tcp_ca_event ev)
+-{
+-	struct dctcp *ca = inet_csk_ca(sk);
+-
+-	switch (ev) {
+-	case CA_EVENT_DELAYED_ACK:
+-		if (!ca->delayed_ack_reserved)
+-			ca->delayed_ack_reserved = 1;
+-		break;
+-	case CA_EVENT_NON_DELAYED_ACK:
+-		if (ca->delayed_ack_reserved)
+-			ca->delayed_ack_reserved = 0;
+-		break;
+-	default:
+-		/* Don't care for the rest. */
+-		break;
+-	}
+-}
+-
+ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
+ {
+ 	switch (ev) {
+@@ -258,10 +237,6 @@ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
+ 	case CA_EVENT_ECN_NO_CE:
+ 		dctcp_ce_state_1_to_0(sk);
+ 		break;
+-	case CA_EVENT_DELAYED_ACK:
+-	case CA_EVENT_NON_DELAYED_ACK:
+-		dctcp_update_ack_reserved(sk, ev);
+-		break;
+ 	default:
+ 		/* Don't care for the rest. */
+ 		break;
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 5f916953b28e..bd68f073570b 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -3444,8 +3444,6 @@ void tcp_send_delayed_ack(struct sock *sk)
+ 	int ato = icsk->icsk_ack.ato;
+ 	unsigned long timeout;
+ 
+-	tcp_ca_event(sk, CA_EVENT_DELAYED_ACK);
+-
+ 	if (ato > TCP_DELACK_MIN) {
+ 		const struct tcp_sock *tp = tcp_sk(sk);
+ 		int max_ato = HZ / 2;
+@@ -3502,8 +3500,6 @@ void __tcp_send_ack(struct sock *sk, u32 rcv_nxt)
+ 	if (sk->sk_state == TCP_CLOSE)
+ 		return;
+ 
+-	tcp_ca_event(sk, CA_EVENT_NON_DELAYED_ACK);
+-
+ 	/* We are not putting this on the write queue, so
+ 	 * tcp_transmit_skb() will set the ownership to this
+ 	 * sock.
+diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
+index 8d772fea1dde..9742abf5ac26 100644
+--- a/net/ipv6/calipso.c
++++ b/net/ipv6/calipso.c
+@@ -799,8 +799,7 @@ static int calipso_opt_update(struct sock *sk, struct ipv6_opt_hdr *hop)
+ {
+ 	struct ipv6_txoptions *old = txopt_get(inet6_sk(sk)), *txopts;
+ 
+-	txopts = ipv6_renew_options_kern(sk, old, IPV6_HOPOPTS,
+-					 hop, hop ? ipv6_optlen(hop) : 0);
++	txopts = ipv6_renew_options(sk, old, IPV6_HOPOPTS, hop);
+ 	txopt_put(old);
+ 	if (IS_ERR(txopts))
+ 		return PTR_ERR(txopts);
+@@ -1222,8 +1221,7 @@ static int calipso_req_setattr(struct request_sock *req,
+ 	if (IS_ERR(new))
+ 		return PTR_ERR(new);
+ 
+-	txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS,
+-					 new, new ? ipv6_optlen(new) : 0);
++	txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new);
+ 
+ 	kfree(new);
+ 
+@@ -1260,8 +1258,7 @@ static void calipso_req_delattr(struct request_sock *req)
+ 	if (calipso_opt_del(req_inet->ipv6_opt->hopopt, &new))
+ 		return; /* Nothing to do */
+ 
+-	txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS,
+-					 new, new ? ipv6_optlen(new) : 0);
++	txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new);
+ 
+ 	if (!IS_ERR(txopts)) {
+ 		txopts = xchg(&req_inet->ipv6_opt, txopts);
+diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
+index 139ceb68bd37..b909c772453f 100644
+--- a/net/ipv6/exthdrs.c
++++ b/net/ipv6/exthdrs.c
+@@ -760,29 +760,21 @@ ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
+ }
+ EXPORT_SYMBOL_GPL(ipv6_dup_options);
+ 
+-static int ipv6_renew_option(void *ohdr,
+-			     struct ipv6_opt_hdr __user *newopt, int newoptlen,
+-			     int inherit,
+-			     struct ipv6_opt_hdr **hdr,
+-			     char **p)
++static void ipv6_renew_option(int renewtype,
++			      struct ipv6_opt_hdr **dest,
++			      struct ipv6_opt_hdr *old,
++			      struct ipv6_opt_hdr *new,
++			      int newtype, char **p)
+ {
+-	if (inherit) {
+-		if (ohdr) {
+-			memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
+-			*hdr = (struct ipv6_opt_hdr *)*p;
+-			*p += CMSG_ALIGN(ipv6_optlen(*hdr));
+-		}
+-	} else {
+-		if (newopt) {
+-			if (copy_from_user(*p, newopt, newoptlen))
+-				return -EFAULT;
+-			*hdr = (struct ipv6_opt_hdr *)*p;
+-			if (ipv6_optlen(*hdr) > newoptlen)
+-				return -EINVAL;
+-			*p += CMSG_ALIGN(newoptlen);
+-		}
+-	}
+-	return 0;
++	struct ipv6_opt_hdr *src;
++
++	src = (renewtype == newtype ? new : old);
++	if (!src)
++		return;
++
++	memcpy(*p, src, ipv6_optlen(src));
++	*dest = (struct ipv6_opt_hdr *)*p;
++	*p += CMSG_ALIGN(ipv6_optlen(*dest));
+ }
+ 
+ /**
+@@ -808,13 +800,11 @@ static int ipv6_renew_option(void *ohdr,
+  */
+ struct ipv6_txoptions *
+ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
+-		   int newtype,
+-		   struct ipv6_opt_hdr __user *newopt, int newoptlen)
++		   int newtype, struct ipv6_opt_hdr *newopt)
+ {
+ 	int tot_len = 0;
+ 	char *p;
+ 	struct ipv6_txoptions *opt2;
+-	int err;
+ 
+ 	if (opt) {
+ 		if (newtype != IPV6_HOPOPTS && opt->hopopt)
+@@ -827,8 +817,8 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
+ 			tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
+ 	}
+ 
+-	if (newopt && newoptlen)
+-		tot_len += CMSG_ALIGN(newoptlen);
++	if (newopt)
++		tot_len += CMSG_ALIGN(ipv6_optlen(newopt));
+ 
+ 	if (!tot_len)
+ 		return NULL;
+@@ -843,29 +833,19 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
+ 	opt2->tot_len = tot_len;
+ 	p = (char *)(opt2 + 1);
+ 
+-	err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
+-				newtype != IPV6_HOPOPTS,
+-				&opt2->hopopt, &p);
+-	if (err)
+-		goto out;
+-
+-	err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
+-				newtype != IPV6_RTHDRDSTOPTS,
+-				&opt2->dst0opt, &p);
+-	if (err)
+-		goto out;
+-
+-	err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
+-				newtype != IPV6_RTHDR,
+-				(struct ipv6_opt_hdr **)&opt2->srcrt, &p);
+-	if (err)
+-		goto out;
+-
+-	err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
+-				newtype != IPV6_DSTOPTS,
+-				&opt2->dst1opt, &p);
+-	if (err)
+-		goto out;
++	ipv6_renew_option(IPV6_HOPOPTS, &opt2->hopopt,
++			  (opt ? opt->hopopt : NULL),
++			  newopt, newtype, &p);
++	ipv6_renew_option(IPV6_RTHDRDSTOPTS, &opt2->dst0opt,
++			  (opt ? opt->dst0opt : NULL),
++			  newopt, newtype, &p);
++	ipv6_renew_option(IPV6_RTHDR,
++			  (struct ipv6_opt_hdr **)&opt2->srcrt,
++			  (opt ? (struct ipv6_opt_hdr *)opt->srcrt : NULL),
++			  newopt, newtype, &p);
++	ipv6_renew_option(IPV6_DSTOPTS, &opt2->dst1opt,
++			  (opt ? opt->dst1opt : NULL),
++			  newopt, newtype, &p);
+ 
+ 	opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
+ 			  (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
+@@ -873,37 +853,6 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
+ 	opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
+ 
+ 	return opt2;
+-out:
+-	sock_kfree_s(sk, opt2, opt2->tot_len);
+-	return ERR_PTR(err);
+-}
+-
+-/**
+- * ipv6_renew_options_kern - replace a specific ext hdr with a new one.
+- *
+- * @sk: sock from which to allocate memory
+- * @opt: original options
+- * @newtype: option type to replace in @opt
+- * @newopt: new option of type @newtype to replace (kernel-mem)
+- * @newoptlen: length of @newopt
+- *
+- * See ipv6_renew_options().  The difference is that @newopt is
+- * kernel memory, rather than user memory.
+- */
+-struct ipv6_txoptions *
+-ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt,
+-			int newtype, struct ipv6_opt_hdr *newopt,
+-			int newoptlen)
+-{
+-	struct ipv6_txoptions *ret_val;
+-	const mm_segment_t old_fs = get_fs();
+-
+-	set_fs(KERNEL_DS);
+-	ret_val = ipv6_renew_options(sk, opt, newtype,
+-				     (struct ipv6_opt_hdr __user *)newopt,
+-				     newoptlen);
+-	set_fs(old_fs);
+-	return ret_val;
+ }
+ 
+ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index c66b9a87e995..81fd35ed8732 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -390,6 +390,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ 	case IPV6_DSTOPTS:
+ 	{
+ 		struct ipv6_txoptions *opt;
++		struct ipv6_opt_hdr *new = NULL;
++
++		/* hop-by-hop / destination options are privileged option */
++		retv = -EPERM;
++		if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
++			break;
+ 
+ 		/* remove any sticky options header with a zero option
+ 		 * length, per RFC3542.
+@@ -401,17 +407,22 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ 		else if (optlen < sizeof(struct ipv6_opt_hdr) ||
+ 			 optlen & 0x7 || optlen > 8 * 255)
+ 			goto e_inval;
+-
+-		/* hop-by-hop / destination options are privileged option */
+-		retv = -EPERM;
+-		if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
+-			break;
++		else {
++			new = memdup_user(optval, optlen);
++			if (IS_ERR(new)) {
++				retv = PTR_ERR(new);
++				break;
++			}
++			if (unlikely(ipv6_optlen(new) > optlen)) {
++				kfree(new);
++				goto e_inval;
++			}
++		}
+ 
+ 		opt = rcu_dereference_protected(np->opt,
+ 						lockdep_sock_is_held(sk));
+-		opt = ipv6_renew_options(sk, opt, optname,
+-					 (struct ipv6_opt_hdr __user *)optval,
+-					 optlen);
++		opt = ipv6_renew_options(sk, opt, optname, new);
++		kfree(new);
+ 		if (IS_ERR(opt)) {
+ 			retv = PTR_ERR(opt);
+ 			break;
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index 918c161e5b55..6c54c76847bf 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -2084,7 +2084,8 @@ void ipv6_mc_dad_complete(struct inet6_dev *idev)
+ 		mld_send_initial_cr(idev);
+ 		idev->mc_dad_count--;
+ 		if (idev->mc_dad_count)
+-			mld_dad_start_timer(idev, idev->mc_maxdelay);
++			mld_dad_start_timer(idev,
++					    unsolicited_report_interval(idev));
+ 	}
+ }
+ 
+@@ -2096,7 +2097,8 @@ static void mld_dad_timer_expire(unsigned long data)
+ 	if (idev->mc_dad_count) {
+ 		idev->mc_dad_count--;
+ 		if (idev->mc_dad_count)
+-			mld_dad_start_timer(idev, idev->mc_maxdelay);
++			mld_dad_start_timer(idev,
++					    unsolicited_report_interval(idev));
+ 	}
+ 	in6_dev_put(idev);
+ }
+@@ -2454,7 +2456,8 @@ static void mld_ifc_timer_expire(unsigned long data)
+ 	if (idev->mc_ifc_count) {
+ 		idev->mc_ifc_count--;
+ 		if (idev->mc_ifc_count)
+-			mld_ifc_start_timer(idev, idev->mc_maxdelay);
++			mld_ifc_start_timer(idev,
++					    unsolicited_report_interval(idev));
+ 	}
+ 	in6_dev_put(idev);
+ }
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index 180f19526a80..21cad30e4546 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -1934,6 +1934,7 @@ static struct xt_match ip6t_builtin_mt[] __read_mostly = {
+ 		.checkentry = icmp6_checkentry,
+ 		.proto      = IPPROTO_ICMPV6,
+ 		.family     = NFPROTO_IPV6,
++		.me	    = THIS_MODULE,
+ 	},
+ };
+ 
+diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
+index 722a9db8c6a7..ee33a6743f3b 100644
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -117,7 +117,7 @@ static int nf_ct_frag6_sysctl_register(struct net *net)
+ 	if (hdr == NULL)
+ 		goto err_reg;
+ 
+-	net->nf_frag.sysctl.frags_hdr = hdr;
++	net->nf_frag_frags_hdr = hdr;
+ 	return 0;
+ 
+ err_reg:
+@@ -131,8 +131,8 @@ static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net)
+ {
+ 	struct ctl_table *table;
+ 
+-	table = net->nf_frag.sysctl.frags_hdr->ctl_table_arg;
+-	unregister_net_sysctl_table(net->nf_frag.sysctl.frags_hdr);
++	table = net->nf_frag_frags_hdr->ctl_table_arg;
++	unregister_net_sysctl_table(net->nf_frag_frags_hdr);
+ 	if (!net_eq(net, &init_net))
+ 		kfree(table);
+ }
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 2039fd7daf4e..db3586ba1211 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1822,7 +1822,7 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
+ 		return -EOPNOTSUPP;
+ 
+ 	/* On boot, we can set this without any fancy locking. */
+-	if (!nf_conntrack_htable_size)
++	if (!nf_conntrack_hash)
+ 		return param_set_uint(val, kp);
+ 
+ 	rc = kstrtouint(val, 0, &hashsize);
+diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
+index a45bee52dccc..d5560ae8c4b3 100644
+--- a/net/netfilter/nf_conntrack_proto_dccp.c
++++ b/net/netfilter/nf_conntrack_proto_dccp.c
+@@ -244,14 +244,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] =
+ 		 * We currently ignore Sync packets
+ 		 *
+ 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
+-			sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
++			sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+ 		},
+ 		[DCCP_PKT_SYNCACK] = {
+ 		/*
+ 		 * We currently ignore SyncAck packets
+ 		 *
+ 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
+-			sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
++			sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+ 		},
+ 	},
+ 	[CT_DCCP_ROLE_SERVER] = {
+@@ -372,14 +372,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] =
+ 		 * We currently ignore Sync packets
+ 		 *
+ 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
+-			sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
++			sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+ 		},
+ 		[DCCP_PKT_SYNCACK] = {
+ 		/*
+ 		 * We currently ignore SyncAck packets
+ 		 *
+ 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
+-			sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
++			sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+ 		},
+ 	},
+ };
+diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
+index e02fed784cd0..42938f9c467e 100644
+--- a/net/netfilter/nf_log.c
++++ b/net/netfilter/nf_log.c
+@@ -426,6 +426,10 @@ static int nf_log_proc_dostring(struct ctl_table *table, int write,
+ 	if (write) {
+ 		struct ctl_table tmp = *table;
+ 
++		/* proc_dostring() can append to existing strings, so we need to
++		 * initialize it as an empty string.
++		 */
++		buf[0] = '\0';
+ 		tmp.data = buf;
+ 		r = proc_dostring(&tmp, write, buffer, lenp, ppos);
+ 		if (r)
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index ea601f7ca2f8..24412e8f4061 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2917,6 +2917,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ 			goto out_free;
+ 	} else if (reserve) {
+ 		skb_reserve(skb, -reserve);
++		if (len < reserve)
++			skb_reset_network_header(skb);
+ 	}
+ 
+ 	/* Returns -EFAULT on error */
+@@ -4273,6 +4275,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 	}
+ 
+ 	if (req->tp_block_nr) {
++		unsigned int min_frame_size;
++
+ 		/* Sanity tests and some calculations */
+ 		err = -EBUSY;
+ 		if (unlikely(rb->pg_vec))
+@@ -4295,12 +4299,12 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 			goto out;
+ 		if (unlikely(!PAGE_ALIGNED(req->tp_block_size)))
+ 			goto out;
++		min_frame_size = po->tp_hdrlen + po->tp_reserve;
+ 		if (po->tp_version >= TPACKET_V3 &&
+-		    req->tp_block_size <=
+-		    BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr))
++		    req->tp_block_size <
++		    BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + min_frame_size)
+ 			goto out;
+-		if (unlikely(req->tp_frame_size < po->tp_hdrlen +
+-					po->tp_reserve))
++		if (unlikely(req->tp_frame_size < min_frame_size))
+ 			goto out;
+ 		if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
+ 			goto out;
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index ae5ac175b2be..7b670a9a375e 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -621,6 +621,10 @@ static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ 	node = NULL;
+ 	if (addr->sq_node == QRTR_NODE_BCAST) {
+ 		enqueue_fn = qrtr_bcast_enqueue;
++		if (addr->sq_port != QRTR_PORT_CTRL) {
++			release_sock(sk);
++			return -ENOTCONN;
++		}
+ 	} else if (addr->sq_node == ipc->us.sq_node) {
+ 		enqueue_fn = qrtr_local_enqueue;
+ 	} else {
+diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
+index 901fb8bb9dce..41835f6e86bc 100644
+--- a/net/sched/act_tunnel_key.c
++++ b/net/sched/act_tunnel_key.c
+@@ -39,7 +39,7 @@ static int tunnel_key_act(struct sk_buff *skb, const struct tc_action *a,
+ 
+ 	tcf_lastuse_update(&t->tcf_tm);
+ 	bstats_cpu_update(this_cpu_ptr(t->common.cpu_bstats), skb);
+-	action = params->action;
++	action = READ_ONCE(t->tcf_action);
+ 
+ 	switch (params->tcft_action) {
+ 	case TCA_TUNNEL_KEY_ACT_RELEASE:
+@@ -170,7 +170,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
+ 
+ 	params_old = rtnl_dereference(t->params);
+ 
+-	params_new->action = parm->action;
++	t->tcf_action = parm->action;
+ 	params_new->tcft_action = parm->t_action;
+ 	params_new->tcft_enc_metadata = metadata;
+ 
+@@ -242,13 +242,13 @@ static int tunnel_key_dump(struct sk_buff *skb, struct tc_action *a,
+ 		.index    = t->tcf_index,
+ 		.refcnt   = t->tcf_refcnt - ref,
+ 		.bindcnt  = t->tcf_bindcnt - bind,
++		.action   = t->tcf_action,
+ 	};
+ 	struct tcf_t tm;
+ 
+ 	params = rtnl_dereference(t->params);
+ 
+ 	opt.t_action = params->tcft_action;
+-	opt.action = params->action;
+ 
+ 	if (nla_put(skb, TCA_TUNNEL_KEY_PARMS, sizeof(opt), &opt))
+ 		goto nla_put_failure;
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 36280e114959..5b75468b5acd 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -5847,7 +5847,7 @@ do {									    \
+ 				  nl80211_check_s32);
+ 	/*
+ 	 * Check HT operation mode based on
+-	 * IEEE 802.11 2012 8.4.2.59 HT Operation element.
++	 * IEEE 802.11-2016 9.4.2.57 HT Operation element.
+ 	 */
+ 	if (tb[NL80211_MESHCONF_HT_OPMODE]) {
+ 		ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
+@@ -5857,22 +5857,9 @@ do {									    \
+ 				  IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
+ 			return -EINVAL;
+ 
+-		if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
+-		    (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
+-			return -EINVAL;
++		/* NON_HT_STA bit is reserved, but some programs set it */
++		ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
+ 
+-		switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
+-		case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
+-		case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
+-			if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
+-				return -EINVAL;
+-			break;
+-		case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
+-		case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
+-			if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
+-				return -EINVAL;
+-			break;
+-		}
+ 		cfg->ht_opmode = ht_opmode;
+ 		mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
+ 	}
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 6a029358bfd1..bb61956c0f9c 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -1628,9 +1628,11 @@ static inline size_t userpolicy_type_attrsize(void)
+ #ifdef CONFIG_XFRM_SUB_POLICY
+ static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
+ {
+-	struct xfrm_userpolicy_type upt = {
+-		.type = type,
+-	};
++	struct xfrm_userpolicy_type upt;
++
++	/* Sadly there are two holes in struct xfrm_userpolicy_type */
++	memset(&upt, 0, sizeof(upt));
++	upt.type = type;
+ 
+ 	return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
+ }
+diff --git a/samples/bpf/parse_varlen.c b/samples/bpf/parse_varlen.c
+index 95c16324760c..0b6f22feb2c9 100644
+--- a/samples/bpf/parse_varlen.c
++++ b/samples/bpf/parse_varlen.c
+@@ -6,6 +6,7 @@
+  */
+ #define KBUILD_MODNAME "foo"
+ #include <linux/if_ether.h>
++#include <linux/if_vlan.h>
+ #include <linux/ip.h>
+ #include <linux/ipv6.h>
+ #include <linux/in.h>
+@@ -108,11 +109,6 @@ static int parse_ipv6(void *data, uint64_t nh_off, void *data_end)
+ 	return 0;
+ }
+ 
+-struct vlan_hdr {
+-	uint16_t h_vlan_TCI;
+-	uint16_t h_vlan_encapsulated_proto;
+-};
+-
+ SEC("varlen")
+ int handle_ingress(struct __sk_buff *skb)
+ {
+diff --git a/samples/bpf/test_overhead_user.c b/samples/bpf/test_overhead_user.c
+index d291167fd3c7..7dad9a3168e1 100644
+--- a/samples/bpf/test_overhead_user.c
++++ b/samples/bpf/test_overhead_user.c
+@@ -6,6 +6,7 @@
+  */
+ #define _GNU_SOURCE
+ #include <sched.h>
++#include <errno.h>
+ #include <stdio.h>
+ #include <sys/types.h>
+ #include <asm/unistd.h>
+@@ -44,8 +45,13 @@ static void test_task_rename(int cpu)
+ 		exit(1);
+ 	}
+ 	start_time = time_get_ns();
+-	for (i = 0; i < MAX_CNT; i++)
+-		write(fd, buf, sizeof(buf));
++	for (i = 0; i < MAX_CNT; i++) {
++		if (write(fd, buf, sizeof(buf)) < 0) {
++			printf("task rename failed: %s\n", strerror(errno));
++			close(fd);
++			return;
++		}
++	}
+ 	printf("task_rename:%d: %lld events per sec\n",
+ 	       cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time));
+ 	close(fd);
+@@ -63,8 +69,13 @@ static void test_urandom_read(int cpu)
+ 		exit(1);
+ 	}
+ 	start_time = time_get_ns();
+-	for (i = 0; i < MAX_CNT; i++)
+-		read(fd, buf, sizeof(buf));
++	for (i = 0; i < MAX_CNT; i++) {
++		if (read(fd, buf, sizeof(buf)) < 0) {
++			printf("failed to read from /dev/urandom: %s\n", strerror(errno));
++			close(fd);
++			return;
++		}
++	}
+ 	printf("urandom_read:%d: %lld events per sec\n",
+ 	       cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time));
+ 	close(fd);
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index a8a7fbc377f6..ca3ea985c100 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -2307,6 +2307,7 @@ static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
+ 	struct smack_known *skp = smk_of_task_struct(p);
+ 
+ 	isp->smk_inode = skp;
++	isp->smk_flags |= SMK_INODE_INSTANT;
+ }
+ 
+ /*
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index ecd1c5fc8db8..965473d4129c 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -2002,7 +2002,8 @@ static int snd_seq_ioctl_query_next_client(struct snd_seq_client *client,
+ 	struct snd_seq_client *cptr = NULL;
+ 
+ 	/* search for next client */
+-	info->client++;
++	if (info->client < INT_MAX)
++		info->client++;
+ 	if (info->client < 0)
+ 		info->client = 0;
+ 	for (; info->client < SNDRV_SEQ_MAX_CLIENTS; info->client++) {
+diff --git a/tools/build/Makefile b/tools/build/Makefile
+index 8332959fbca4..20d9ae11b6e1 100644
+--- a/tools/build/Makefile
++++ b/tools/build/Makefile
+@@ -42,7 +42,7 @@ $(OUTPUT)fixdep-in.o: FORCE
+ 	$(Q)$(MAKE) $(build)=fixdep
+ 
+ $(OUTPUT)fixdep: $(OUTPUT)fixdep-in.o
+-	$(QUIET_LINK)$(HOSTCC) $(LDFLAGS) -o $@ $<
++	$(QUIET_LINK)$(HOSTCC) $(HOSTLDFLAGS) -o $@ $<
+ 
+ FORCE:
+ 
+diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
+index 4e60e105583e..0d1acb704f64 100644
+--- a/tools/objtool/elf.c
++++ b/tools/objtool/elf.c
+@@ -302,19 +302,34 @@ static int read_symbols(struct elf *elf)
+ 				continue;
+ 			sym->pfunc = sym->cfunc = sym;
+ 			coldstr = strstr(sym->name, ".cold.");
+-			if (coldstr) {
+-				coldstr[0] = '\0';
+-				pfunc = find_symbol_by_name(elf, sym->name);
+-				coldstr[0] = '.';
+-
+-				if (!pfunc) {
+-					WARN("%s(): can't find parent function",
+-					     sym->name);
+-					goto err;
+-				}
+-
+-				sym->pfunc = pfunc;
+-				pfunc->cfunc = sym;
++			if (!coldstr)
++				continue;
++
++			coldstr[0] = '\0';
++			pfunc = find_symbol_by_name(elf, sym->name);
++			coldstr[0] = '.';
++
++			if (!pfunc) {
++				WARN("%s(): can't find parent function",
++				     sym->name);
++				goto err;
++			}
++
++			sym->pfunc = pfunc;
++			pfunc->cfunc = sym;
++
++			/*
++			 * Unfortunately, -fnoreorder-functions puts the child
++			 * inside the parent.  Remove the overlap so we can
++			 * have sane assumptions.
++			 *
++			 * Note that pfunc->len now no longer matches
++			 * pfunc->sym.st_size.
++			 */
++			if (sym->sec == pfunc->sec &&
++			    sym->offset >= pfunc->offset &&
++			    sym->offset + sym->len == pfunc->offset + pfunc->len) {
++				pfunc->len -= sym->len;
+ 			}
+ 		}
+ 	}
+diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+index 0c370f81e002..bd630c222e65 100644
+--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c
++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+@@ -243,7 +243,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain)
+ 	u64 ip;
+ 	u64 skip_slot = -1;
+ 
+-	if (chain->nr < 3)
++	if (!chain || chain->nr < 3)
+ 		return skip_slot;
+ 
+ 	ip = chain->ips[2];
+diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
+index 23cce5e5197a..ee9565a033f4 100644
+--- a/tools/perf/bench/numa.c
++++ b/tools/perf/bench/numa.c
+@@ -1093,7 +1093,7 @@ static void *worker_thread(void *__tdata)
+ 	u8 *global_data;
+ 	u8 *process_data;
+ 	u8 *thread_data;
+-	u64 bytes_done;
++	u64 bytes_done, secs;
+ 	long work_done;
+ 	u32 l;
+ 	struct rusage rusage;
+@@ -1249,7 +1249,8 @@ static void *worker_thread(void *__tdata)
+ 	timersub(&stop, &start0, &diff);
+ 	td->runtime_ns = diff.tv_sec * NSEC_PER_SEC;
+ 	td->runtime_ns += diff.tv_usec * NSEC_PER_USEC;
+-	td->speed_gbs = bytes_done / (td->runtime_ns / NSEC_PER_SEC) / 1e9;
++	secs = td->runtime_ns / NSEC_PER_SEC;
++	td->speed_gbs = secs ? bytes_done / secs / 1e9 : 0;
+ 
+ 	getrusage(RUSAGE_THREAD, &rusage);
+ 	td->system_time_ns = rusage.ru_stime.tv_sec * NSEC_PER_SEC;
+diff --git a/tools/perf/tests/topology.c b/tools/perf/tests/topology.c
+index 98fe69ac553c..3e7cdefb0817 100644
+--- a/tools/perf/tests/topology.c
++++ b/tools/perf/tests/topology.c
+@@ -42,6 +42,7 @@ static int session_write_header(char *path)
+ 
+ 	perf_header__set_feat(&session->header, HEADER_CPU_TOPOLOGY);
+ 	perf_header__set_feat(&session->header, HEADER_NRCPUS);
++	perf_header__set_feat(&session->header, HEADER_ARCH);
+ 
+ 	session->header.data_size += DATA_SIZE;
+ 
+diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c
+index bf7216b8731d..621f6527b790 100644
+--- a/tools/perf/util/llvm-utils.c
++++ b/tools/perf/util/llvm-utils.c
+@@ -260,16 +260,16 @@ static const char *kinc_fetch_script =
+ "#!/usr/bin/env sh\n"
+ "if ! test -d \"$KBUILD_DIR\"\n"
+ "then\n"
+-"	exit -1\n"
++"	exit 1\n"
+ "fi\n"
+ "if ! test -f \"$KBUILD_DIR/include/generated/autoconf.h\"\n"
+ "then\n"
+-"	exit -1\n"
++"	exit 1\n"
+ "fi\n"
+ "TMPDIR=`mktemp -d`\n"
+ "if test -z \"$TMPDIR\"\n"
+ "then\n"
+-"    exit -1\n"
++"    exit 1\n"
+ "fi\n"
+ "cat << EOF > $TMPDIR/Makefile\n"
+ "obj-y := dummy.o\n"
+diff --git a/tools/testing/selftests/pstore/pstore_post_reboot_tests b/tools/testing/selftests/pstore/pstore_post_reboot_tests
+index 6ccb154cb4aa..22f8df1ad7d4 100755
+--- a/tools/testing/selftests/pstore/pstore_post_reboot_tests
++++ b/tools/testing/selftests/pstore/pstore_post_reboot_tests
+@@ -7,13 +7,16 @@
+ #
+ # Released under the terms of the GPL v2.
+ 
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
+ . ./common_tests
+ 
+ if [ -e $REBOOT_FLAG  ]; then
+     rm $REBOOT_FLAG
+ else
+     prlog "pstore_crash_test has not been executed yet. we skip further tests."
+-    exit 0
++    exit $ksft_skip
+ fi
+ 
+ prlog -n "Mounting pstore filesystem ... "
+diff --git a/tools/testing/selftests/static_keys/test_static_keys.sh b/tools/testing/selftests/static_keys/test_static_keys.sh
+index 1261e3fa1e3a..5bba7796fb34 100755
+--- a/tools/testing/selftests/static_keys/test_static_keys.sh
++++ b/tools/testing/selftests/static_keys/test_static_keys.sh
+@@ -1,6 +1,19 @@
+ #!/bin/sh
+ # Runs static keys kernel module tests
+ 
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
++if ! /sbin/modprobe -q -n test_static_key_base; then
++	echo "static_key: module test_static_key_base is not found [SKIP]"
++	exit $ksft_skip
++fi
++
++if ! /sbin/modprobe -q -n test_static_keys; then
++	echo "static_key: module test_static_keys is not found [SKIP]"
++	exit $ksft_skip
++fi
++
+ if /sbin/modprobe -q test_static_key_base; then
+ 	if /sbin/modprobe -q test_static_keys; then
+ 		echo "static_key: ok"
+diff --git a/tools/testing/selftests/sync/config b/tools/testing/selftests/sync/config
+new file mode 100644
+index 000000000000..1ab7e8130db2
+--- /dev/null
++++ b/tools/testing/selftests/sync/config
+@@ -0,0 +1,4 @@
++CONFIG_STAGING=y
++CONFIG_ANDROID=y
++CONFIG_SYNC=y
++CONFIG_SW_SYNC=y
+diff --git a/tools/testing/selftests/user/test_user_copy.sh b/tools/testing/selftests/user/test_user_copy.sh
+index 350107f40c1d..0409270f998c 100755
+--- a/tools/testing/selftests/user/test_user_copy.sh
++++ b/tools/testing/selftests/user/test_user_copy.sh
+@@ -1,6 +1,13 @@
+ #!/bin/sh
+ # Runs copy_to/from_user infrastructure using test_user_copy kernel module
+ 
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
++if ! /sbin/modprobe -q -n test_user_copy; then
++	echo "user: module test_user_copy is not found [SKIP]"
++	exit $ksft_skip
++fi
+ if /sbin/modprobe -q test_user_copy; then
+ 	/sbin/modprobe -q -r test_user_copy
+ 	echo "user_copy: ok"
+diff --git a/tools/testing/selftests/x86/sigreturn.c b/tools/testing/selftests/x86/sigreturn.c
+index 246145b84a12..4d9dc3f2fd70 100644
+--- a/tools/testing/selftests/x86/sigreturn.c
++++ b/tools/testing/selftests/x86/sigreturn.c
+@@ -610,21 +610,41 @@ static int test_valid_sigreturn(int cs_bits, bool use_16bit_ss, int force_ss)
+ 	 */
+ 	for (int i = 0; i < NGREG; i++) {
+ 		greg_t req = requested_regs[i], res = resulting_regs[i];
++
+ 		if (i == REG_TRAPNO || i == REG_IP)
+ 			continue;	/* don't care */
+-		if (i == REG_SP) {
+-			printf("\tSP: %llx -> %llx\n", (unsigned long long)req,
+-			       (unsigned long long)res);
+ 
++		if (i == REG_SP) {
+ 			/*
+-			 * In many circumstances, the high 32 bits of rsp
+-			 * are zeroed.  For example, we could be a real
+-			 * 32-bit program, or we could hit any of a number
+-			 * of poorly-documented IRET or segmented ESP
+-			 * oddities.  If this happens, it's okay.
++			 * If we were using a 16-bit stack segment, then
++			 * the kernel is a bit stuck: IRET only restores
++			 * the low 16 bits of ESP/RSP if SS is 16-bit.
++			 * The kernel uses a hack to restore bits 31:16,
++			 * but that hack doesn't help with bits 63:32.
++			 * On Intel CPUs, bits 63:32 end up zeroed, and, on
++			 * AMD CPUs, they leak the high bits of the kernel
++			 * espfix64 stack pointer.  There's very little that
++			 * the kernel can do about it.
++			 *
++			 * Similarly, if we are returning to a 32-bit context,
++			 * the CPU will often lose the high 32 bits of RSP.
+ 			 */
+-			if (res == (req & 0xFFFFFFFF))
+-				continue;  /* OK; not expected to work */
++
++			if (res == req)
++				continue;
++
++			if (cs_bits != 64 && ((res ^ req) & 0xFFFFFFFF) == 0) {
++				printf("[NOTE]\tSP: %llx -> %llx\n",
++				       (unsigned long long)req,
++				       (unsigned long long)res);
++				continue;
++			}
++
++			printf("[FAIL]\tSP mismatch: requested 0x%llx; got 0x%llx\n",
++			       (unsigned long long)requested_regs[i],
++			       (unsigned long long)resulting_regs[i]);
++			nerrs++;
++			continue;
+ 		}
+ 
+ 		bool ignore_reg = false;
+@@ -654,25 +674,18 @@ static int test_valid_sigreturn(int cs_bits, bool use_16bit_ss, int force_ss)
+ #endif
+ 
+ 		/* Sanity check on the kernel */
+-		if (i == REG_CX && requested_regs[i] != resulting_regs[i]) {
++		if (i == REG_CX && req != res) {
+ 			printf("[FAIL]\tCX (saved SP) mismatch: requested 0x%llx; got 0x%llx\n",
+-			       (unsigned long long)requested_regs[i],
+-			       (unsigned long long)resulting_regs[i]);
++			       (unsigned long long)req,
++			       (unsigned long long)res);
+ 			nerrs++;
+ 			continue;
+ 		}
+ 
+-		if (requested_regs[i] != resulting_regs[i] && !ignore_reg) {
+-			/*
+-			 * SP is particularly interesting here.  The
+-			 * usual cause of failures is that we hit the
+-			 * nasty IRET case of returning to a 16-bit SS,
+-			 * in which case bits 16:31 of the *kernel*
+-			 * stack pointer persist in ESP.
+-			 */
++		if (req != res && !ignore_reg) {
+ 			printf("[FAIL]\tReg %d mismatch: requested 0x%llx; got 0x%llx\n",
+-			       i, (unsigned long long)requested_regs[i],
+-			       (unsigned long long)resulting_regs[i]);
++			       i, (unsigned long long)req,
++			       (unsigned long long)res);
+ 			nerrs++;
+ 		}
+ 	}
+diff --git a/tools/testing/selftests/zram/zram.sh b/tools/testing/selftests/zram/zram.sh
+index 683a292e3290..9399c4aeaa26 100755
+--- a/tools/testing/selftests/zram/zram.sh
++++ b/tools/testing/selftests/zram/zram.sh
+@@ -1,6 +1,9 @@
+ #!/bin/bash
+ TCID="zram.sh"
+ 
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
+ . ./zram_lib.sh
+ 
+ run_zram () {
+@@ -23,5 +26,5 @@ elif [ -b /dev/zram0 ]; then
+ else
+ 	echo "$TCID : No zram.ko module or /dev/zram0 device file not found"
+ 	echo "$TCID : CONFIG_ZRAM is not set"
+-	exit 1
++	exit $ksft_skip
+ fi
+diff --git a/tools/testing/selftests/zram/zram_lib.sh b/tools/testing/selftests/zram/zram_lib.sh
+index f6a9c73e7a44..9e73a4fb9b0a 100755
+--- a/tools/testing/selftests/zram/zram_lib.sh
++++ b/tools/testing/selftests/zram/zram_lib.sh
+@@ -18,6 +18,9 @@ MODULE=0
+ dev_makeswap=-1
+ dev_mounted=-1
+ 
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
+ trap INT
+ 
+ check_prereqs()
+@@ -27,7 +30,7 @@ check_prereqs()
+ 
+ 	if [ $uid -ne 0 ]; then
+ 		echo $msg must be run as root >&2
+-		exit 0
++		exit $ksft_skip
+ 	fi
+ }
+ 
+diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
+index f1320063db28..c7924718990e 100644
+--- a/virt/kvm/arm/vgic/vgic-v3.c
++++ b/virt/kvm/arm/vgic/vgic-v3.c
+@@ -337,11 +337,6 @@ int vgic_v3_probe(const struct gic_kvm_info *info)
+ 		pr_warn("GICV physical address 0x%llx not page aligned\n",
+ 			(unsigned long long)info->vcpu.start);
+ 		kvm_vgic_global_state.vcpu_base = 0;
+-	} else if (!PAGE_ALIGNED(resource_size(&info->vcpu))) {
+-		pr_warn("GICV size 0x%llx not a multiple of page size 0x%lx\n",
+-			(unsigned long long)resource_size(&info->vcpu),
+-			PAGE_SIZE);
+-		kvm_vgic_global_state.vcpu_base = 0;
+ 	} else {
+ 		kvm_vgic_global_state.vcpu_base = info->vcpu.start;
+ 		kvm_vgic_global_state.can_emulate_gicv2 = true;
+diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
+index 3f24eb1e8554..16e17ea06e1e 100644
+--- a/virt/kvm/eventfd.c
++++ b/virt/kvm/eventfd.c
+@@ -405,11 +405,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
+ 	if (events & POLLIN)
+ 		schedule_work(&irqfd->inject);
+ 
+-	/*
+-	 * do not drop the file until the irqfd is fully initialized, otherwise
+-	 * we might race against the POLLHUP
+-	 */
+-	fdput(f);
+ #ifdef CONFIG_HAVE_KVM_IRQ_BYPASS
+ 	if (kvm_arch_has_irq_bypass()) {
+ 		irqfd->consumer.token = (void *)irqfd->eventfd;
+@@ -425,6 +420,12 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
+ #endif
+ 
+ 	srcu_read_unlock(&kvm->irq_srcu, idx);
++
++	/*
++	 * do not drop the file until the irqfd is fully initialized, otherwise
++	 * we might race against the POLLHUP
++	 */
++	fdput(f);
+ 	return 0;
+ 
+ fail: