[gentoo-commits] proj/linux-patches:5.2 commit in: /

[Mike Pagano]

commit:     26fab6b6424908ae47ad7e488177505589c3bc52
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Aug 29 14:27:12 2019 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Aug 29 14:27:12 2019 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=26fab6b6

Linux patch 5.2.11

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README             |    4 +
 1010_linux-5.2.11.patch | 6480 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 6484 insertions(+)

diff --git a/0000_README b/0000_README
index 2056b84..374124c 100644
--- a/0000_README
+++ b/0000_README
@@ -83,6 +83,10 @@ Patch:  1009_linux-5.2.10.patch
 From:   https://www.kernel.org
 Desc:   Linux 5.2.10
 
+Patch:  1010_linux-5.2.11.patch
+From:   https://www.kernel.org
+Desc:   Linux 5.2.11
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1010_linux-5.2.11.patch b/1010_linux-5.2.11.patch
new file mode 100644
index 0000000..4df5b0e
--- /dev/null
+++ b/1010_linux-5.2.11.patch
@@ -0,0 +1,6480 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 0d40729d080f..cb17fde4164f 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -4055,6 +4055,13 @@
+ 			Run specified binary instead of /init from the ramdisk,
+ 			used for early userspace startup. See initrd.
+ 
++	rdrand=		[X86]
++			force - Override the decision by the kernel to hide the
++				advertisement of RDRAND support (this affects
++				certain AMD processors because of buggy BIOS
++				support, specifically around the suspend/resume
++				path).
++
+ 	rdt=		[HW,X86,RDT]
+ 			Turn on/off individual RDT features. List is:
+ 			cmt, mbmtotal, mbmlocal, l3cat, l3cdp, l2cat, l2cdp,
+diff --git a/Documentation/devicetree/bindings/riscv/sifive.yaml b/Documentation/devicetree/bindings/riscv/sifive.yaml
+index 9d17dc2f3f84..3ab532713dc1 100644
+--- a/Documentation/devicetree/bindings/riscv/sifive.yaml
++++ b/Documentation/devicetree/bindings/riscv/sifive.yaml
+@@ -19,7 +19,7 @@ properties:
+   compatible:
+     items:
+       - enum:
+-          - sifive,freedom-unleashed-a00
++          - sifive,hifive-unleashed-a00
+       - const: sifive,fu540-c000
+       - const: sifive,fu540
+ ...
+diff --git a/Makefile b/Makefile
+index 35fee16d5006..a3b26dcfc5c8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 2
+-SUBLEVEL = 10
++SUBLEVEL = 11
+ EXTRAVERSION =
+ NAME = Bobtail Squid
+ 
+diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c
+index d2806bcff8bb..07745ee022a1 100644
+--- a/arch/arm/kvm/coproc.c
++++ b/arch/arm/kvm/coproc.c
+@@ -651,13 +651,22 @@ int kvm_handle_cp14_64(struct kvm_vcpu *vcpu, struct kvm_run *run)
+ }
+ 
+ static void reset_coproc_regs(struct kvm_vcpu *vcpu,
+-			      const struct coproc_reg *table, size_t num)
++			      const struct coproc_reg *table, size_t num,
++			      unsigned long *bmap)
+ {
+ 	unsigned long i;
+ 
+ 	for (i = 0; i < num; i++)
+-		if (table[i].reset)
++		if (table[i].reset) {
++			int reg = table[i].reg;
++
+ 			table[i].reset(vcpu, &table[i]);
++			if (reg > 0 && reg < NR_CP15_REGS) {
++				set_bit(reg, bmap);
++				if (table[i].is_64bit)
++					set_bit(reg + 1, bmap);
++			}
++		}
+ }
+ 
+ static struct coproc_params decode_32bit_hsr(struct kvm_vcpu *vcpu)
+@@ -1432,17 +1441,15 @@ void kvm_reset_coprocs(struct kvm_vcpu *vcpu)
+ {
+ 	size_t num;
+ 	const struct coproc_reg *table;
+-
+-	/* Catch someone adding a register without putting in reset entry. */
+-	memset(vcpu->arch.ctxt.cp15, 0x42, sizeof(vcpu->arch.ctxt.cp15));
++	DECLARE_BITMAP(bmap, NR_CP15_REGS) = { 0, };
+ 
+ 	/* Generic chip reset first (so target could override). */
+-	reset_coproc_regs(vcpu, cp15_regs, ARRAY_SIZE(cp15_regs));
++	reset_coproc_regs(vcpu, cp15_regs, ARRAY_SIZE(cp15_regs), bmap);
+ 
+ 	table = get_target_table(vcpu->arch.target, &num);
+-	reset_coproc_regs(vcpu, table, num);
++	reset_coproc_regs(vcpu, table, num, bmap);
+ 
+ 	for (num = 1; num < NR_CP15_REGS; num++)
+-		WARN(vcpu_cp15(vcpu, num) == 0x42424242,
++		WARN(!test_bit(num, bmap),
+ 		     "Didn't reset vcpu_cp15(vcpu, %zi)", num);
+ }
+diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
+index ce933f296049..5b7085ca213d 100644
+--- a/arch/arm64/kvm/sys_regs.c
++++ b/arch/arm64/kvm/sys_regs.c
+@@ -632,7 +632,7 @@ static void reset_pmcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
+ 	 */
+ 	val = ((pmcr & ~ARMV8_PMU_PMCR_MASK)
+ 	       | (ARMV8_PMU_PMCR_MASK & 0xdecafbad)) & (~ARMV8_PMU_PMCR_E);
+-	__vcpu_sys_reg(vcpu, PMCR_EL0) = val;
++	__vcpu_sys_reg(vcpu, r->reg) = val;
+ }
+ 
+ static bool check_pmu_access_disabled(struct kvm_vcpu *vcpu, u64 flags)
+@@ -981,13 +981,13 @@ static bool access_pmuserenr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
+ /* Silly macro to expand the DBG{BCR,BVR,WVR,WCR}n_EL1 registers in one go */
+ #define DBG_BCR_BVR_WCR_WVR_EL1(n)					\
+ 	{ SYS_DESC(SYS_DBGBVRn_EL1(n)),					\
+-	  trap_bvr, reset_bvr, n, 0, get_bvr, set_bvr },		\
++	  trap_bvr, reset_bvr, 0, 0, get_bvr, set_bvr },		\
+ 	{ SYS_DESC(SYS_DBGBCRn_EL1(n)),					\
+-	  trap_bcr, reset_bcr, n, 0, get_bcr, set_bcr },		\
++	  trap_bcr, reset_bcr, 0, 0, get_bcr, set_bcr },		\
+ 	{ SYS_DESC(SYS_DBGWVRn_EL1(n)),					\
+-	  trap_wvr, reset_wvr, n, 0,  get_wvr, set_wvr },		\
++	  trap_wvr, reset_wvr, 0, 0,  get_wvr, set_wvr },		\
+ 	{ SYS_DESC(SYS_DBGWCRn_EL1(n)),					\
+-	  trap_wcr, reset_wcr, n, 0,  get_wcr, set_wcr }
++	  trap_wcr, reset_wcr, 0, 0,  get_wcr, set_wcr }
+ 
+ /* Macro to expand the PMEVCNTRn_EL0 register */
+ #define PMU_PMEVCNTR_EL0(n)						\
+@@ -1540,7 +1540,7 @@ static const struct sys_reg_desc sys_reg_descs[] = {
+ 	{ SYS_DESC(SYS_CSSELR_EL1), access_csselr, reset_unknown, CSSELR_EL1 },
+ 	{ SYS_DESC(SYS_CTR_EL0), access_ctr },
+ 
+-	{ SYS_DESC(SYS_PMCR_EL0), access_pmcr, reset_pmcr, },
++	{ SYS_DESC(SYS_PMCR_EL0), access_pmcr, reset_pmcr, PMCR_EL0 },
+ 	{ SYS_DESC(SYS_PMCNTENSET_EL0), access_pmcnten, reset_unknown, PMCNTENSET_EL0 },
+ 	{ SYS_DESC(SYS_PMCNTENCLR_EL0), access_pmcnten, NULL, PMCNTENSET_EL0 },
+ 	{ SYS_DESC(SYS_PMOVSCLR_EL0), access_pmovs, NULL, PMOVSSET_EL0 },
+@@ -2254,13 +2254,19 @@ static int emulate_sys_reg(struct kvm_vcpu *vcpu,
+ }
+ 
+ static void reset_sys_reg_descs(struct kvm_vcpu *vcpu,
+-			      const struct sys_reg_desc *table, size_t num)
++				const struct sys_reg_desc *table, size_t num,
++				unsigned long *bmap)
+ {
+ 	unsigned long i;
+ 
+ 	for (i = 0; i < num; i++)
+-		if (table[i].reset)
++		if (table[i].reset) {
++			int reg = table[i].reg;
++
+ 			table[i].reset(vcpu, &table[i]);
++			if (reg > 0 && reg < NR_SYS_REGS)
++				set_bit(reg, bmap);
++		}
+ }
+ 
+ /**
+@@ -2774,18 +2780,16 @@ void kvm_reset_sys_regs(struct kvm_vcpu *vcpu)
+ {
+ 	size_t num;
+ 	const struct sys_reg_desc *table;
+-
+-	/* Catch someone adding a register without putting in reset entry. */
+-	memset(&vcpu->arch.ctxt.sys_regs, 0x42, sizeof(vcpu->arch.ctxt.sys_regs));
++	DECLARE_BITMAP(bmap, NR_SYS_REGS) = { 0, };
+ 
+ 	/* Generic chip reset first (so target could override). */
+-	reset_sys_reg_descs(vcpu, sys_reg_descs, ARRAY_SIZE(sys_reg_descs));
++	reset_sys_reg_descs(vcpu, sys_reg_descs, ARRAY_SIZE(sys_reg_descs), bmap);
+ 
+ 	table = get_target_table(vcpu->arch.target, true, &num);
+-	reset_sys_reg_descs(vcpu, table, num);
++	reset_sys_reg_descs(vcpu, table, num, bmap);
+ 
+ 	for (num = 1; num < NR_SYS_REGS; num++) {
+-		if (WARN(__vcpu_sys_reg(vcpu, num) == 0x4242424242424242,
++		if (WARN(!test_bit(num, bmap),
+ 			 "Didn't reset __vcpu_sys_reg(%zi)\n", num))
+ 			break;
+ 	}
+diff --git a/arch/mips/kernel/cacheinfo.c b/arch/mips/kernel/cacheinfo.c
+index e0dd66881da6..f777e44653d5 100644
+--- a/arch/mips/kernel/cacheinfo.c
++++ b/arch/mips/kernel/cacheinfo.c
+@@ -69,6 +69,8 @@ static int __populate_cache_leaves(unsigned int cpu)
+ 	if (c->tcache.waysize)
+ 		populate_cache(tcache, this_leaf, 3, CACHE_TYPE_UNIFIED);
+ 
++	this_cpu_ci->cpu_map_populated = true;
++
+ 	return 0;
+ }
+ 
+diff --git a/arch/mips/kernel/i8253.c b/arch/mips/kernel/i8253.c
+index 5f209f111e59..df7ddd246eaa 100644
+--- a/arch/mips/kernel/i8253.c
++++ b/arch/mips/kernel/i8253.c
+@@ -32,7 +32,8 @@ void __init setup_pit_timer(void)
+ 
+ static int __init init_pit_clocksource(void)
+ {
+-	if (num_possible_cpus() > 1) /* PIT does not scale! */
++	if (num_possible_cpus() > 1 || /* PIT does not scale! */
++	    !clockevent_state_periodic(&i8253_clockevent))
+ 		return 0;
+ 
+ 	return clocksource_i8253_init();
+diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
+index 1ad4089dd110..d4d096f80f4b 100644
+--- a/arch/powerpc/kernel/misc_64.S
++++ b/arch/powerpc/kernel/misc_64.S
+@@ -130,7 +130,7 @@ _GLOBAL_TOC(flush_dcache_range)
+ 	subf	r8,r6,r4		/* compute length */
+ 	add	r8,r8,r5		/* ensure we get enough */
+ 	lwz	r9,DCACHEL1LOGBLOCKSIZE(r10)	/* Get log-2 of dcache block size */
+-	srw.	r8,r8,r9		/* compute line count */
++	srd.	r8,r8,r9		/* compute line count */
+ 	beqlr				/* nothing to do? */
+ 	mtctr	r8
+ 0:	dcbst	0,r6
+@@ -148,7 +148,7 @@ _GLOBAL(flush_inval_dcache_range)
+ 	subf	r8,r6,r4		/* compute length */
+ 	add	r8,r8,r5		/* ensure we get enough */
+ 	lwz	r9,DCACHEL1LOGBLOCKSIZE(r10)/* Get log-2 of dcache block size */
+-	srw.	r8,r8,r9		/* compute line count */
++	srd.	r8,r8,r9		/* compute line count */
+ 	beqlr				/* nothing to do? */
+ 	sync
+ 	isync
+diff --git a/arch/s390/boot/ipl_parm.c b/arch/s390/boot/ipl_parm.c
+index 3c49bde8aa5e..b8aa6a9f937b 100644
+--- a/arch/s390/boot/ipl_parm.c
++++ b/arch/s390/boot/ipl_parm.c
+@@ -48,9 +48,7 @@ void store_ipl_parmblock(void)
+ {
+ 	int rc;
+ 
+-	uv_set_shared(__pa(&ipl_block));
+ 	rc = __diag308(DIAG308_STORE, &ipl_block);
+-	uv_remove_shared(__pa(&ipl_block));
+ 	if (rc == DIAG308_RC_OK &&
+ 	    ipl_block.hdr.version <= IPL_MAX_SUPPORTED_VERSION)
+ 		ipl_block_valid = 1;
+diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
+index 2c0a515428d6..6837affc19e8 100644
+--- a/arch/s390/kernel/ipl.c
++++ b/arch/s390/kernel/ipl.c
+@@ -31,7 +31,6 @@
+ #include <asm/os_info.h>
+ #include <asm/sections.h>
+ #include <asm/boot_data.h>
+-#include <asm/uv.h>
+ #include "entry.h"
+ 
+ #define IPL_PARM_BLOCK_VERSION 0
+@@ -892,21 +891,15 @@ static void __reipl_run(void *unused)
+ {
+ 	switch (reipl_type) {
+ 	case IPL_TYPE_CCW:
+-		uv_set_shared(__pa(reipl_block_ccw));
+ 		diag308(DIAG308_SET, reipl_block_ccw);
+-		uv_remove_shared(__pa(reipl_block_ccw));
+ 		diag308(DIAG308_LOAD_CLEAR, NULL);
+ 		break;
+ 	case IPL_TYPE_FCP:
+-		uv_set_shared(__pa(reipl_block_fcp));
+ 		diag308(DIAG308_SET, reipl_block_fcp);
+-		uv_remove_shared(__pa(reipl_block_fcp));
+ 		diag308(DIAG308_LOAD_CLEAR, NULL);
+ 		break;
+ 	case IPL_TYPE_NSS:
+-		uv_set_shared(__pa(reipl_block_nss));
+ 		diag308(DIAG308_SET, reipl_block_nss);
+-		uv_remove_shared(__pa(reipl_block_nss));
+ 		diag308(DIAG308_LOAD_CLEAR, NULL);
+ 		break;
+ 	case IPL_TYPE_UNKNOWN:
+@@ -1176,9 +1169,7 @@ static struct kset *dump_kset;
+ 
+ static void diag308_dump(void *dump_block)
+ {
+-	uv_set_shared(__pa(dump_block));
+ 	diag308(DIAG308_SET, dump_block);
+-	uv_remove_shared(__pa(dump_block));
+ 	while (1) {
+ 		if (diag308(DIAG308_LOAD_NORMAL_DUMP, NULL) != 0x302)
+ 			break;
+diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
+index 49d55327de0b..7e0eb4020917 100644
+--- a/arch/s390/kernel/vmlinux.lds.S
++++ b/arch/s390/kernel/vmlinux.lds.S
+@@ -32,10 +32,9 @@ PHDRS {
+ SECTIONS
+ {
+ 	. = 0x100000;
+-	_stext = .;		/* Start of text section */
+ 	.text : {
+-		/* Text and read-only data */
+-		_text = .;
++		_stext = .;		/* Start of text section */
++		_text = .;		/* Text and read-only data */
+ 		HEAD_TEXT
+ 		TEXT_TEXT
+ 		SCHED_TEXT
+@@ -47,11 +46,10 @@ SECTIONS
+ 		*(.text.*_indirect_*)
+ 		*(.fixup)
+ 		*(.gnu.warning)
++		. = ALIGN(PAGE_SIZE);
++		_etext = .;		/* End of text section */
+ 	} :text = 0x0700
+ 
+-	. = ALIGN(PAGE_SIZE);
+-	_etext = .;		/* End of text section */
+-
+ 	NOTES :text :note
+ 
+ 	.dummy : { *(.dummy) } :data
+diff --git a/arch/s390/mm/dump_pagetables.c b/arch/s390/mm/dump_pagetables.c
+index 3b93ba0b5d8d..5d67b81c704a 100644
+--- a/arch/s390/mm/dump_pagetables.c
++++ b/arch/s390/mm/dump_pagetables.c
+@@ -161,9 +161,9 @@ static void walk_pmd_level(struct seq_file *m, struct pg_state *st,
+ 	}
+ #endif
+ 
+-	for (i = 0; i < PTRS_PER_PMD && addr < max_addr; i++) {
++	pmd = pmd_offset(pud, addr);
++	for (i = 0; i < PTRS_PER_PMD && addr < max_addr; i++, pmd++) {
+ 		st->current_address = addr;
+-		pmd = pmd_offset(pud, addr);
+ 		if (!pmd_none(*pmd)) {
+ 			if (pmd_large(*pmd)) {
+ 				prot = pmd_val(*pmd) &
+@@ -192,9 +192,9 @@ static void walk_pud_level(struct seq_file *m, struct pg_state *st,
+ 	}
+ #endif
+ 
+-	for (i = 0; i < PTRS_PER_PUD && addr < max_addr; i++) {
++	pud = pud_offset(p4d, addr);
++	for (i = 0; i < PTRS_PER_PUD && addr < max_addr; i++, pud++) {
+ 		st->current_address = addr;
+-		pud = pud_offset(p4d, addr);
+ 		if (!pud_none(*pud))
+ 			if (pud_large(*pud)) {
+ 				prot = pud_val(*pud) &
+@@ -222,9 +222,9 @@ static void walk_p4d_level(struct seq_file *m, struct pg_state *st,
+ 	}
+ #endif
+ 
+-	for (i = 0; i < PTRS_PER_P4D && addr < max_addr; i++) {
++	p4d = p4d_offset(pgd, addr);
++	for (i = 0; i < PTRS_PER_P4D && addr < max_addr; i++, p4d++) {
+ 		st->current_address = addr;
+-		p4d = p4d_offset(pgd, addr);
+ 		if (!p4d_none(*p4d))
+ 			walk_pud_level(m, st, p4d, addr);
+ 		else
+diff --git a/arch/x86/include/asm/bootparam_utils.h b/arch/x86/include/asm/bootparam_utils.h
+index f6f6ef436599..b16a6c7da6eb 100644
+--- a/arch/x86/include/asm/bootparam_utils.h
++++ b/arch/x86/include/asm/bootparam_utils.h
+@@ -18,6 +18,20 @@
+  * Note: efi_info is commonly left uninitialized, but that field has a
+  * private magic, so it is better to leave it unchanged.
+  */
++
++#define sizeof_mbr(type, member) ({ sizeof(((type *)0)->member); })
++
++#define BOOT_PARAM_PRESERVE(struct_member)				\
++	{								\
++		.start = offsetof(struct boot_params, struct_member),	\
++		.len   = sizeof_mbr(struct boot_params, struct_member),	\
++	}
++
++struct boot_params_to_save {
++	unsigned int start;
++	unsigned int len;
++};
++
+ static void sanitize_boot_params(struct boot_params *boot_params)
+ {
+ 	/* 
+@@ -35,21 +49,40 @@ static void sanitize_boot_params(struct boot_params *boot_params)
+ 	 * problems again.
+ 	 */
+ 	if (boot_params->sentinel) {
+-		/* fields in boot_params are left uninitialized, clear them */
+-		boot_params->acpi_rsdp_addr = 0;
+-		memset(&boot_params->ext_ramdisk_image, 0,
+-		       (char *)&boot_params->efi_info -
+-			(char *)&boot_params->ext_ramdisk_image);
+-		memset(&boot_params->kbd_status, 0,
+-		       (char *)&boot_params->hdr -
+-		       (char *)&boot_params->kbd_status);
+-		memset(&boot_params->_pad7[0], 0,
+-		       (char *)&boot_params->edd_mbr_sig_buffer[0] -
+-			(char *)&boot_params->_pad7[0]);
+-		memset(&boot_params->_pad8[0], 0,
+-		       (char *)&boot_params->eddbuf[0] -
+-			(char *)&boot_params->_pad8[0]);
+-		memset(&boot_params->_pad9[0], 0, sizeof(boot_params->_pad9));
++		static struct boot_params scratch;
++		char *bp_base = (char *)boot_params;
++		char *save_base = (char *)&scratch;
++		int i;
++
++		const struct boot_params_to_save to_save[] = {
++			BOOT_PARAM_PRESERVE(screen_info),
++			BOOT_PARAM_PRESERVE(apm_bios_info),
++			BOOT_PARAM_PRESERVE(tboot_addr),
++			BOOT_PARAM_PRESERVE(ist_info),
++			BOOT_PARAM_PRESERVE(hd0_info),
++			BOOT_PARAM_PRESERVE(hd1_info),
++			BOOT_PARAM_PRESERVE(sys_desc_table),
++			BOOT_PARAM_PRESERVE(olpc_ofw_header),
++			BOOT_PARAM_PRESERVE(efi_info),
++			BOOT_PARAM_PRESERVE(alt_mem_k),
++			BOOT_PARAM_PRESERVE(scratch),
++			BOOT_PARAM_PRESERVE(e820_entries),
++			BOOT_PARAM_PRESERVE(eddbuf_entries),
++			BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries),
++			BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer),
++			BOOT_PARAM_PRESERVE(hdr),
++			BOOT_PARAM_PRESERVE(e820_table),
++			BOOT_PARAM_PRESERVE(eddbuf),
++		};
++
++		memset(&scratch, 0, sizeof(scratch));
++
++		for (i = 0; i < ARRAY_SIZE(to_save); i++) {
++			memcpy(save_base + to_save[i].start,
++			       bp_base + to_save[i].start, to_save[i].len);
++		}
++
++		memcpy(boot_params, save_base, sizeof(*boot_params));
+ 	}
+ }
+ 
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index 979ef971cc78..41e41ec5d646 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -372,6 +372,7 @@
+ #define MSR_AMD64_PATCH_LEVEL		0x0000008b
+ #define MSR_AMD64_TSC_RATIO		0xc0000104
+ #define MSR_AMD64_NB_CFG		0xc001001f
++#define MSR_AMD64_CPUID_FN_1		0xc0011004
+ #define MSR_AMD64_PATCH_LOADER		0xc0010020
+ #define MSR_AMD64_OSVW_ID_LENGTH	0xc0010140
+ #define MSR_AMD64_OSVW_STATUS		0xc0010141
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index 109f974f9835..80bc209c0708 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -192,7 +192,7 @@
+ 	"    	lfence;\n"					\
+ 	"       jmp    902b;\n"					\
+ 	"       .align 16\n"					\
+-	"903:	addl   $4, %%esp;\n"				\
++	"903:	lea    4(%%esp), %%esp;\n"			\
+ 	"       pushl  %[thunk_target];\n"			\
+ 	"       ret;\n"						\
+ 	"       .align 16\n"					\
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 530cf1fd68a2..2f067b443326 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -722,7 +722,7 @@ static __initdata unsigned long lapic_cal_pm1, lapic_cal_pm2;
+ static __initdata unsigned long lapic_cal_j1, lapic_cal_j2;
+ 
+ /*
+- * Temporary interrupt handler.
++ * Temporary interrupt handler and polled calibration function.
+  */
+ static void __init lapic_cal_handler(struct clock_event_device *dev)
+ {
+@@ -824,7 +824,8 @@ static int __init lapic_init_clockevent(void)
+ static int __init calibrate_APIC_clock(void)
+ {
+ 	struct clock_event_device *levt = this_cpu_ptr(&lapic_events);
+-	void (*real_handler)(struct clock_event_device *dev);
++	u64 tsc_perj = 0, tsc_start = 0;
++	unsigned long jif_start;
+ 	unsigned long deltaj;
+ 	long delta, deltatsc;
+ 	int pm_referenced = 0;
+@@ -851,28 +852,64 @@ static int __init calibrate_APIC_clock(void)
+ 	apic_printk(APIC_VERBOSE, "Using local APIC timer interrupts.\n"
+ 		    "calibrating APIC timer ...\n");
+ 
++	/*
++	 * There are platforms w/o global clockevent devices. Instead of
++	 * making the calibration conditional on that, use a polling based
++	 * approach everywhere.
++	 */
+ 	local_irq_disable();
+ 
+-	/* Replace the global interrupt handler */
+-	real_handler = global_clock_event->event_handler;
+-	global_clock_event->event_handler = lapic_cal_handler;
+-
+ 	/*
+ 	 * Setup the APIC counter to maximum. There is no way the lapic
+ 	 * can underflow in the 100ms detection time frame
+ 	 */
+ 	__setup_APIC_LVTT(0xffffffff, 0, 0);
+ 
+-	/* Let the interrupts run */
++	/*
++	 * Methods to terminate the calibration loop:
++	 *  1) Global clockevent if available (jiffies)
++	 *  2) TSC if available and frequency is known
++	 */
++	jif_start = READ_ONCE(jiffies);
++
++	if (tsc_khz) {
++		tsc_start = rdtsc();
++		tsc_perj = div_u64((u64)tsc_khz * 1000, HZ);
++	}
++
++	/*
++	 * Enable interrupts so the tick can fire, if a global
++	 * clockevent device is available
++	 */
+ 	local_irq_enable();
+ 
+-	while (lapic_cal_loops <= LAPIC_CAL_LOOPS)
+-		cpu_relax();
++	while (lapic_cal_loops <= LAPIC_CAL_LOOPS) {
++		/* Wait for a tick to elapse */
++		while (1) {
++			if (tsc_khz) {
++				u64 tsc_now = rdtsc();
++				if ((tsc_now - tsc_start) >= tsc_perj) {
++					tsc_start += tsc_perj;
++					break;
++				}
++			} else {
++				unsigned long jif_now = READ_ONCE(jiffies);
+ 
+-	local_irq_disable();
++				if (time_after(jif_now, jif_start)) {
++					jif_start = jif_now;
++					break;
++				}
++			}
++			cpu_relax();
++		}
+ 
+-	/* Restore the real event handler */
+-	global_clock_event->event_handler = real_handler;
++		/* Invoke the calibration routine */
++		local_irq_disable();
++		lapic_cal_handler(NULL);
++		local_irq_enable();
++	}
++
++	local_irq_disable();
+ 
+ 	/* Build delta t1-t2 as apic timer counts down */
+ 	delta = lapic_cal_t1 - lapic_cal_t2;
+@@ -916,10 +953,11 @@ static int __init calibrate_APIC_clock(void)
+ 	levt->features &= ~CLOCK_EVT_FEAT_DUMMY;
+ 
+ 	/*
+-	 * PM timer calibration failed or not turned on
+-	 * so lets try APIC timer based calibration
++	 * PM timer calibration failed or not turned on so lets try APIC
++	 * timer based calibration, if a global clockevent device is
++	 * available.
+ 	 */
+-	if (!pm_referenced) {
++	if (!pm_referenced && global_clock_event) {
+ 		apic_printk(APIC_VERBOSE, "... verify APIC timer\n");
+ 
+ 		/*
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 8d4e50428b68..68c363c341bf 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -804,6 +804,64 @@ static void init_amd_ln(struct cpuinfo_x86 *c)
+ 	msr_set_bit(MSR_AMD64_DE_CFG, 31);
+ }
+ 
++static bool rdrand_force;
++
++static int __init rdrand_cmdline(char *str)
++{
++	if (!str)
++		return -EINVAL;
++
++	if (!strcmp(str, "force"))
++		rdrand_force = true;
++	else
++		return -EINVAL;
++
++	return 0;
++}
++early_param("rdrand", rdrand_cmdline);
++
++static void clear_rdrand_cpuid_bit(struct cpuinfo_x86 *c)
++{
++	/*
++	 * Saving of the MSR used to hide the RDRAND support during
++	 * suspend/resume is done by arch/x86/power/cpu.c, which is
++	 * dependent on CONFIG_PM_SLEEP.
++	 */
++	if (!IS_ENABLED(CONFIG_PM_SLEEP))
++		return;
++
++	/*
++	 * The nordrand option can clear X86_FEATURE_RDRAND, so check for
++	 * RDRAND support using the CPUID function directly.
++	 */
++	if (!(cpuid_ecx(1) & BIT(30)) || rdrand_force)
++		return;
++
++	msr_clear_bit(MSR_AMD64_CPUID_FN_1, 62);
++
++	/*
++	 * Verify that the CPUID change has occurred in case the kernel is
++	 * running virtualized and the hypervisor doesn't support the MSR.
++	 */
++	if (cpuid_ecx(1) & BIT(30)) {
++		pr_info_once("BIOS may not properly restore RDRAND after suspend, but hypervisor does not support hiding RDRAND via CPUID.\n");
++		return;
++	}
++
++	clear_cpu_cap(c, X86_FEATURE_RDRAND);
++	pr_info_once("BIOS may not properly restore RDRAND after suspend, hiding RDRAND via CPUID. Use rdrand=force to reenable.\n");
++}
++
++static void init_amd_jg(struct cpuinfo_x86 *c)
++{
++	/*
++	 * Some BIOS implementations do not restore proper RDRAND support
++	 * across suspend and resume. Check on whether to hide the RDRAND
++	 * instruction support via CPUID.
++	 */
++	clear_rdrand_cpuid_bit(c);
++}
++
+ static void init_amd_bd(struct cpuinfo_x86 *c)
+ {
+ 	u64 value;
+@@ -818,6 +876,13 @@ static void init_amd_bd(struct cpuinfo_x86 *c)
+ 			wrmsrl_safe(MSR_F15H_IC_CFG, value);
+ 		}
+ 	}
++
++	/*
++	 * Some BIOS implementations do not restore proper RDRAND support
++	 * across suspend and resume. Check on whether to hide the RDRAND
++	 * instruction support via CPUID.
++	 */
++	clear_rdrand_cpuid_bit(c);
+ }
+ 
+ static void init_amd_zn(struct cpuinfo_x86 *c)
+@@ -860,6 +925,7 @@ static void init_amd(struct cpuinfo_x86 *c)
+ 	case 0x10: init_amd_gh(c); break;
+ 	case 0x12: init_amd_ln(c); break;
+ 	case 0x15: init_amd_bd(c); break;
++	case 0x16: init_amd_jg(c); break;
+ 	case 0x17: init_amd_zn(c); break;
+ 	}
+ 
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 8d95c81b2c82..01f04db1fa61 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -5649,38 +5649,7 @@ static void kvm_mmu_invalidate_zap_pages_in_memslot(struct kvm *kvm,
+ 			struct kvm_memory_slot *slot,
+ 			struct kvm_page_track_notifier_node *node)
+ {
+-	struct kvm_mmu_page *sp;
+-	LIST_HEAD(invalid_list);
+-	unsigned long i;
+-	bool flush;
+-	gfn_t gfn;
+-
+-	spin_lock(&kvm->mmu_lock);
+-
+-	if (list_empty(&kvm->arch.active_mmu_pages))
+-		goto out_unlock;
+-
+-	flush = slot_handle_all_level(kvm, slot, kvm_zap_rmapp, false);
+-
+-	for (i = 0; i < slot->npages; i++) {
+-		gfn = slot->base_gfn + i;
+-
+-		for_each_valid_sp(kvm, sp, gfn) {
+-			if (sp->gfn != gfn)
+-				continue;
+-
+-			kvm_mmu_prepare_zap_page(kvm, sp, &invalid_list);
+-		}
+-		if (need_resched() || spin_needbreak(&kvm->mmu_lock)) {
+-			kvm_mmu_remote_flush_or_zap(kvm, &invalid_list, flush);
+-			flush = false;
+-			cond_resched_lock(&kvm->mmu_lock);
+-		}
+-	}
+-	kvm_mmu_remote_flush_or_zap(kvm, &invalid_list, flush);
+-
+-out_unlock:
+-	spin_unlock(&kvm->mmu_lock);
++	kvm_mmu_zap_all(kvm);
+ }
+ 
+ void kvm_mmu_init_vm(struct kvm *kvm)
+diff --git a/arch/x86/lib/cpu.c b/arch/x86/lib/cpu.c
+index 04967cdce5d1..7ad68917a51e 100644
+--- a/arch/x86/lib/cpu.c
++++ b/arch/x86/lib/cpu.c
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ #include <linux/types.h>
+ #include <linux/export.h>
++#include <asm/cpu.h>
+ 
+ unsigned int x86_family(unsigned int sig)
+ {
+diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
+index 24b079e94bc2..c9ef6a7a4a1a 100644
+--- a/arch/x86/power/cpu.c
++++ b/arch/x86/power/cpu.c
+@@ -12,6 +12,7 @@
+ #include <linux/smp.h>
+ #include <linux/perf_event.h>
+ #include <linux/tboot.h>
++#include <linux/dmi.h>
+ 
+ #include <asm/pgtable.h>
+ #include <asm/proto.h>
+@@ -23,7 +24,7 @@
+ #include <asm/debugreg.h>
+ #include <asm/cpu.h>
+ #include <asm/mmu_context.h>
+-#include <linux/dmi.h>
++#include <asm/cpu_device_id.h>
+ 
+ #ifdef CONFIG_X86_32
+ __visible unsigned long saved_context_ebx;
+@@ -397,15 +398,14 @@ static int __init bsp_pm_check_init(void)
+ 
+ core_initcall(bsp_pm_check_init);
+ 
+-static int msr_init_context(const u32 *msr_id, const int total_num)
++static int msr_build_context(const u32 *msr_id, const int num)
+ {
+-	int i = 0;
++	struct saved_msrs *saved_msrs = &saved_context.saved_msrs;
+ 	struct saved_msr *msr_array;
++	int total_num;
++	int i, j;
+ 
+-	if (saved_context.saved_msrs.array || saved_context.saved_msrs.num > 0) {
+-		pr_err("x86/pm: MSR quirk already applied, please check your DMI match table.\n");
+-		return -EINVAL;
+-	}
++	total_num = saved_msrs->num + num;
+ 
+ 	msr_array = kmalloc_array(total_num, sizeof(struct saved_msr), GFP_KERNEL);
+ 	if (!msr_array) {
+@@ -413,19 +413,30 @@ static int msr_init_context(const u32 *msr_id, const int total_num)
+ 		return -ENOMEM;
+ 	}
+ 
+-	for (i = 0; i < total_num; i++) {
+-		msr_array[i].info.msr_no	= msr_id[i];
++	if (saved_msrs->array) {
++		/*
++		 * Multiple callbacks can invoke this function, so copy any
++		 * MSR save requests from previous invocations.
++		 */
++		memcpy(msr_array, saved_msrs->array,
++		       sizeof(struct saved_msr) * saved_msrs->num);
++
++		kfree(saved_msrs->array);
++	}
++
++	for (i = saved_msrs->num, j = 0; i < total_num; i++, j++) {
++		msr_array[i].info.msr_no	= msr_id[j];
+ 		msr_array[i].valid		= false;
+ 		msr_array[i].info.reg.q		= 0;
+ 	}
+-	saved_context.saved_msrs.num	= total_num;
+-	saved_context.saved_msrs.array	= msr_array;
++	saved_msrs->num   = total_num;
++	saved_msrs->array = msr_array;
+ 
+ 	return 0;
+ }
+ 
+ /*
+- * The following section is a quirk framework for problematic BIOSen:
++ * The following sections are a quirk framework for problematic BIOSen:
+  * Sometimes MSRs are modified by the BIOSen after suspended to
+  * RAM, this might cause unexpected behavior after wakeup.
+  * Thus we save/restore these specified MSRs across suspend/resume
+@@ -440,7 +451,7 @@ static int msr_initialize_bdw(const struct dmi_system_id *d)
+ 	u32 bdw_msr_id[] = { MSR_IA32_THERM_CONTROL };
+ 
+ 	pr_info("x86/pm: %s detected, MSR saving is needed during suspending.\n", d->ident);
+-	return msr_init_context(bdw_msr_id, ARRAY_SIZE(bdw_msr_id));
++	return msr_build_context(bdw_msr_id, ARRAY_SIZE(bdw_msr_id));
+ }
+ 
+ static const struct dmi_system_id msr_save_dmi_table[] = {
+@@ -455,9 +466,58 @@ static const struct dmi_system_id msr_save_dmi_table[] = {
+ 	{}
+ };
+ 
++static int msr_save_cpuid_features(const struct x86_cpu_id *c)
++{
++	u32 cpuid_msr_id[] = {
++		MSR_AMD64_CPUID_FN_1,
++	};
++
++	pr_info("x86/pm: family %#hx cpu detected, MSR saving is needed during suspending.\n",
++		c->family);
++
++	return msr_build_context(cpuid_msr_id, ARRAY_SIZE(cpuid_msr_id));
++}
++
++static const struct x86_cpu_id msr_save_cpu_table[] = {
++	{
++		.vendor = X86_VENDOR_AMD,
++		.family = 0x15,
++		.model = X86_MODEL_ANY,
++		.feature = X86_FEATURE_ANY,
++		.driver_data = (kernel_ulong_t)msr_save_cpuid_features,
++	},
++	{
++		.vendor = X86_VENDOR_AMD,
++		.family = 0x16,
++		.model = X86_MODEL_ANY,
++		.feature = X86_FEATURE_ANY,
++		.driver_data = (kernel_ulong_t)msr_save_cpuid_features,
++	},
++	{}
++};
++
++typedef int (*pm_cpu_match_t)(const struct x86_cpu_id *);
++static int pm_cpu_check(const struct x86_cpu_id *c)
++{
++	const struct x86_cpu_id *m;
++	int ret = 0;
++
++	m = x86_match_cpu(msr_save_cpu_table);
++	if (m) {
++		pm_cpu_match_t fn;
++
++		fn = (pm_cpu_match_t)m->driver_data;
++		ret = fn(m);
++	}
++
++	return ret;
++}
++
+ static int pm_check_save_msr(void)
+ {
+ 	dmi_check_system(msr_save_dmi_table);
++	pm_cpu_check(msr_save_cpu_table);
++
+ 	return 0;
+ }
+ 
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 404e776aa36d..b528710364e9 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -2085,9 +2085,14 @@ static void bfq_request_merged(struct request_queue *q, struct request *req,
+ 	    blk_rq_pos(container_of(rb_prev(&req->rb_node),
+ 				    struct request, rb_node))) {
+ 		struct bfq_queue *bfqq = bfq_init_rq(req);
+-		struct bfq_data *bfqd = bfqq->bfqd;
++		struct bfq_data *bfqd;
+ 		struct request *prev, *next_rq;
+ 
++		if (!bfqq)
++			return;
++
++		bfqd = bfqq->bfqd;
++
+ 		/* Reposition request in its sort_list */
+ 		elv_rb_del(&bfqq->sort_list, req);
+ 		elv_rb_add(&bfqq->sort_list, req);
+@@ -2134,6 +2139,9 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq,
+ 	struct bfq_queue *bfqq = bfq_init_rq(rq),
+ 		*next_bfqq = bfq_init_rq(next);
+ 
++	if (!bfqq)
++		return;
++
+ 	/*
+ 	 * If next and rq belong to the same bfq_queue and next is older
+ 	 * than rq, then reposition rq in the fifo (by substituting next
+@@ -5061,12 +5069,12 @@ static void bfq_insert_request(struct blk_mq_hw_ctx *hctx, struct request *rq,
+ 
+ 	spin_lock_irq(&bfqd->lock);
+ 	bfqq = bfq_init_rq(rq);
+-	if (at_head || blk_rq_is_passthrough(rq)) {
++	if (!bfqq || at_head || blk_rq_is_passthrough(rq)) {
+ 		if (at_head)
+ 			list_add(&rq->queuelist, &bfqd->dispatch);
+ 		else
+ 			list_add_tail(&rq->queuelist, &bfqd->dispatch);
+-	} else { /* bfqq is assumed to be non null here */
++	} else {
+ 		idle_timer_disabled = __bfq_insert_request(bfqd, rq);
+ 		/*
+ 		 * Update bfqq, because, if a queue merge has occurred
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 391ac0503dc0..76d0f9de767b 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -1786,6 +1786,21 @@ nothing_to_do:
+ 	return 1;
+ }
+ 
++static bool ata_check_nblocks(struct scsi_cmnd *scmd, u32 n_blocks)
++{
++	struct request *rq = scmd->request;
++	u32 req_blocks;
++
++	if (!blk_rq_is_passthrough(rq))
++		return true;
++
++	req_blocks = blk_rq_bytes(rq) / scmd->device->sector_size;
++	if (n_blocks > req_blocks)
++		return false;
++
++	return true;
++}
++
+ /**
+  *	ata_scsi_rw_xlat - Translate SCSI r/w command into an ATA one
+  *	@qc: Storage for translated ATA taskfile
+@@ -1830,6 +1845,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
+ 		scsi_10_lba_len(cdb, &block, &n_block);
+ 		if (cdb[1] & (1 << 3))
+ 			tf_flags |= ATA_TFLAG_FUA;
++		if (!ata_check_nblocks(scmd, n_block))
++			goto invalid_fld;
+ 		break;
+ 	case READ_6:
+ 	case WRITE_6:
+@@ -1844,6 +1861,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
+ 		 */
+ 		if (!n_block)
+ 			n_block = 256;
++		if (!ata_check_nblocks(scmd, n_block))
++			goto invalid_fld;
+ 		break;
+ 	case READ_16:
+ 	case WRITE_16:
+@@ -1854,6 +1873,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
+ 		scsi_16_lba_len(cdb, &block, &n_block);
+ 		if (cdb[1] & (1 << 3))
+ 			tf_flags |= ATA_TFLAG_FUA;
++		if (!ata_check_nblocks(scmd, n_block))
++			goto invalid_fld;
+ 		break;
+ 	default:
+ 		DPRINTK("no-byte command\n");
+diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
+index 10aa27882142..4f115adb4ee8 100644
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -658,6 +658,10 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
+ 	unsigned int offset;
+ 	unsigned char *buf;
+ 
++	if (!qc->cursg) {
++		qc->curbytes = qc->nbytes;
++		return;
++	}
+ 	if (qc->curbytes == qc->nbytes - qc->sect_size)
+ 		ap->hsm_task_state = HSM_ST_LAST;
+ 
+@@ -683,6 +687,8 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
+ 
+ 	if (qc->cursg_ofs == qc->cursg->length) {
+ 		qc->cursg = sg_next(qc->cursg);
++		if (!qc->cursg)
++			ap->hsm_task_state = HSM_ST_LAST;
+ 		qc->cursg_ofs = 0;
+ 	}
+ }
+diff --git a/drivers/ata/pata_rb532_cf.c b/drivers/ata/pata_rb532_cf.c
+index 7c37f2ff09e4..deae466395de 100644
+--- a/drivers/ata/pata_rb532_cf.c
++++ b/drivers/ata/pata_rb532_cf.c
+@@ -158,7 +158,6 @@ static int rb532_pata_driver_probe(struct platform_device *pdev)
+ static int rb532_pata_driver_remove(struct platform_device *pdev)
+ {
+ 	struct ata_host *ah = platform_get_drvdata(pdev);
+-	struct rb532_cf_info *info = ah->private_data;
+ 
+ 	ata_host_detach(ah);
+ 
+diff --git a/drivers/block/aoe/aoedev.c b/drivers/block/aoe/aoedev.c
+index 5b49f1b33ebe..e2ea2356da06 100644
+--- a/drivers/block/aoe/aoedev.c
++++ b/drivers/block/aoe/aoedev.c
+@@ -323,10 +323,14 @@ flush(const char __user *str, size_t cnt, int exiting)
+ 	}
+ 
+ 	flush_scheduled_work();
+-	/* pass one: without sleeping, do aoedev_downdev */
++	/* pass one: do aoedev_downdev, which might sleep */
++restart1:
+ 	spin_lock_irqsave(&devlist_lock, flags);
+ 	for (d = devlist; d; d = d->next) {
+ 		spin_lock(&d->lock);
++		if (d->flags & DEVFL_TKILL)
++			goto cont;
++
+ 		if (exiting) {
+ 			/* unconditionally take each device down */
+ 		} else if (specified) {
+@@ -338,8 +342,11 @@ flush(const char __user *str, size_t cnt, int exiting)
+ 		|| d->ref)
+ 			goto cont;
+ 
++		spin_unlock(&d->lock);
++		spin_unlock_irqrestore(&devlist_lock, flags);
+ 		aoedev_downdev(d);
+ 		d->flags |= DEVFL_TKILL;
++		goto restart1;
+ cont:
+ 		spin_unlock(&d->lock);
+ 	}
+@@ -348,7 +355,7 @@ cont:
+ 	/* pass two: call freedev, which might sleep,
+ 	 * for aoedevs marked with DEVFL_TKILL
+ 	 */
+-restart:
++restart2:
+ 	spin_lock_irqsave(&devlist_lock, flags);
+ 	for (d = devlist; d; d = d->next) {
+ 		spin_lock(&d->lock);
+@@ -357,7 +364,7 @@ restart:
+ 			spin_unlock(&d->lock);
+ 			spin_unlock_irqrestore(&devlist_lock, flags);
+ 			freedev(d);
+-			goto restart;
++			goto restart2;
+ 		}
+ 		spin_unlock(&d->lock);
+ 	}
+diff --git a/drivers/clk/socfpga/clk-periph-s10.c b/drivers/clk/socfpga/clk-periph-s10.c
+index 5c50e723ecae..1a191eeeebba 100644
+--- a/drivers/clk/socfpga/clk-periph-s10.c
++++ b/drivers/clk/socfpga/clk-periph-s10.c
+@@ -38,7 +38,7 @@ static unsigned long clk_peri_cnt_clk_recalc_rate(struct clk_hw *hwclk,
+ 	if (socfpgaclk->fixed_div) {
+ 		div = socfpgaclk->fixed_div;
+ 	} else {
+-		if (!socfpgaclk->bypass_reg)
++		if (socfpgaclk->hw.reg)
+ 			div = ((readl(socfpgaclk->hw.reg) & 0x7ff) + 1);
+ 	}
+ 
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 4f333d6f2e23..7f9f75201138 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -1091,9 +1091,11 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ 		if (test_bit(FLAG_ACTIVE_LOW, &desc->flags))
+ 			lineinfo.flags |= GPIOLINE_FLAG_ACTIVE_LOW;
+ 		if (test_bit(FLAG_OPEN_DRAIN, &desc->flags))
+-			lineinfo.flags |= GPIOLINE_FLAG_OPEN_DRAIN;
++			lineinfo.flags |= (GPIOLINE_FLAG_OPEN_DRAIN |
++					   GPIOLINE_FLAG_IS_OUT);
+ 		if (test_bit(FLAG_OPEN_SOURCE, &desc->flags))
+-			lineinfo.flags |= GPIOLINE_FLAG_OPEN_SOURCE;
++			lineinfo.flags |= (GPIOLINE_FLAG_OPEN_SOURCE |
++					   GPIOLINE_FLAG_IS_OUT);
+ 
+ 		if (copy_to_user(ip, &lineinfo, sizeof(lineinfo)))
+ 			return -EFAULT;
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+index 02955e6e9dd9..c21ef99cc590 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+@@ -1317,6 +1317,39 @@ static int gfx_v8_0_rlc_init(struct amdgpu_device *adev)
+ 	return 0;
+ }
+ 
++static int gfx_v8_0_csb_vram_pin(struct amdgpu_device *adev)
++{
++	int r;
++
++	r = amdgpu_bo_reserve(adev->gfx.rlc.clear_state_obj, false);
++	if (unlikely(r != 0))
++		return r;
++
++	r = amdgpu_bo_pin(adev->gfx.rlc.clear_state_obj,
++			AMDGPU_GEM_DOMAIN_VRAM);
++	if (!r)
++		adev->gfx.rlc.clear_state_gpu_addr =
++			amdgpu_bo_gpu_offset(adev->gfx.rlc.clear_state_obj);
++
++	amdgpu_bo_unreserve(adev->gfx.rlc.clear_state_obj);
++
++	return r;
++}
++
++static void gfx_v8_0_csb_vram_unpin(struct amdgpu_device *adev)
++{
++	int r;
++
++	if (!adev->gfx.rlc.clear_state_obj)
++		return;
++
++	r = amdgpu_bo_reserve(adev->gfx.rlc.clear_state_obj, true);
++	if (likely(r == 0)) {
++		amdgpu_bo_unpin(adev->gfx.rlc.clear_state_obj);
++		amdgpu_bo_unreserve(adev->gfx.rlc.clear_state_obj);
++	}
++}
++
+ static void gfx_v8_0_mec_fini(struct amdgpu_device *adev)
+ {
+ 	amdgpu_bo_free_kernel(&adev->gfx.mec.hpd_eop_obj, NULL, NULL);
+@@ -4777,6 +4810,10 @@ static int gfx_v8_0_hw_init(void *handle)
+ 	gfx_v8_0_init_golden_registers(adev);
+ 	gfx_v8_0_constants_init(adev);
+ 
++	r = gfx_v8_0_csb_vram_pin(adev);
++	if (r)
++		return r;
++
+ 	r = adev->gfx.rlc.funcs->resume(adev);
+ 	if (r)
+ 		return r;
+@@ -4893,6 +4930,9 @@ static int gfx_v8_0_hw_fini(void *handle)
+ 	else
+ 		pr_err("rlc is busy, skip halt rlc\n");
+ 	amdgpu_gfx_rlc_exit_safe_mode(adev);
++
++	gfx_v8_0_csb_vram_unpin(adev);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index 2f7f0a2e4a6c..0332177c0302 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -596,6 +596,10 @@ static void gfx_v9_0_check_if_need_gfxoff(struct amdgpu_device *adev)
+ 		    (adev->gfx.rlc_feature_version < 1) ||
+ 		    !adev->gfx.rlc.is_rlc_v2_1)
+ 			adev->pm.pp_feature &= ~PP_GFXOFF_MASK;
++		if (adev->pm.pp_feature & PP_GFXOFF_MASK)
++			adev->pg_flags |= AMD_PG_SUPPORT_GFX_PG |
++				AMD_PG_SUPPORT_CP |
++				AMD_PG_SUPPORT_RLC_SMU_HS;
+ 		break;
+ 	default:
+ 		break;
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
+index b7e594c2bfb4..84c34712e39e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
+@@ -949,11 +949,6 @@ static int soc15_common_early_init(void *handle)
+ 
+ 			adev->pg_flags = AMD_PG_SUPPORT_SDMA | AMD_PG_SUPPORT_VCN;
+ 		}
+-
+-		if (adev->pm.pp_feature & PP_GFXOFF_MASK)
+-			adev->pg_flags |= AMD_PG_SUPPORT_GFX_PG |
+-				AMD_PG_SUPPORT_CP |
+-				AMD_PG_SUPPORT_RLC_SMU_HS;
+ 		break;
+ 	default:
+ 		/* FIXME: not supported yet */
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
+index b4e7404fe660..a11637b0f6cc 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
+@@ -40,8 +40,7 @@ nvkm_i2c_aux_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ 		u8 *ptr = msg->buf;
+ 
+ 		while (remaining) {
+-			u8 cnt = (remaining > 16) ? 16 : remaining;
+-			u8 cmd;
++			u8 cnt, retries, cmd;
+ 
+ 			if (msg->flags & I2C_M_RD)
+ 				cmd = 1;
+@@ -51,10 +50,19 @@ nvkm_i2c_aux_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ 			if (mcnt || remaining > 16)
+ 				cmd |= 4; /* MOT */
+ 
+-			ret = aux->func->xfer(aux, true, cmd, msg->addr, ptr, &cnt);
+-			if (ret < 0) {
+-				nvkm_i2c_aux_release(aux);
+-				return ret;
++			for (retries = 0, cnt = 0;
++			     retries < 32 && !cnt;
++			     retries++) {
++				cnt = min_t(u8, remaining, 16);
++				ret = aux->func->xfer(aux, true, cmd,
++						      msg->addr, ptr, &cnt);
++				if (ret < 0)
++					goto out;
++			}
++			if (!cnt) {
++				AUX_TRACE(aux, "no data after 32 retries");
++				ret = -EIO;
++				goto out;
+ 			}
+ 
+ 			ptr += cnt;
+@@ -64,8 +72,10 @@ nvkm_i2c_aux_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ 		msg++;
+ 	}
+ 
++	ret = num;
++out:
+ 	nvkm_i2c_aux_release(aux);
+-	return num;
++	return ret;
+ }
+ 
+ static u32
+diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+index 95e5c517a15f..9aae3d8e99ef 100644
+--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
++++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+@@ -432,7 +432,7 @@ static int rockchip_dp_resume(struct device *dev)
+ 
+ static const struct dev_pm_ops rockchip_dp_pm_ops = {
+ #ifdef CONFIG_PM_SLEEP
+-	.suspend = rockchip_dp_suspend,
++	.suspend_late = rockchip_dp_suspend,
+ 	.resume_early = rockchip_dp_resume,
+ #endif
+ };
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+index e4e09d47c5c0..59e9d05ab928 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+@@ -389,8 +389,10 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
+ 		break;
+ 	}
+ 
+-	if (retries == RETRIES)
++	if (retries == RETRIES) {
++		kfree(reply);
+ 		return -EINVAL;
++	}
+ 
+ 	*msg_len = reply_len;
+ 	*msg     = reply;
+diff --git a/drivers/hid/hid-a4tech.c b/drivers/hid/hid-a4tech.c
+index 98bf694626f7..3a8c4a5971f7 100644
+--- a/drivers/hid/hid-a4tech.c
++++ b/drivers/hid/hid-a4tech.c
+@@ -23,12 +23,36 @@
+ #define A4_2WHEEL_MOUSE_HACK_7	0x01
+ #define A4_2WHEEL_MOUSE_HACK_B8	0x02
+ 
++#define A4_WHEEL_ORIENTATION	(HID_UP_GENDESK | 0x000000b8)
++
+ struct a4tech_sc {
+ 	unsigned long quirks;
+ 	unsigned int hw_wheel;
+ 	__s32 delayed_value;
+ };
+ 
++static int a4_input_mapping(struct hid_device *hdev, struct hid_input *hi,
++			    struct hid_field *field, struct hid_usage *usage,
++			    unsigned long **bit, int *max)
++{
++	struct a4tech_sc *a4 = hid_get_drvdata(hdev);
++
++	if (a4->quirks & A4_2WHEEL_MOUSE_HACK_B8 &&
++	    usage->hid == A4_WHEEL_ORIENTATION) {
++		/*
++		 * We do not want to have this usage mapped to anything as it's
++		 * nonstandard and doesn't really behave like an HID report.
++		 * It's only selecting the orientation (vertical/horizontal) of
++		 * the previous mouse wheel report. The input_events will be
++		 * generated once both reports are recorded in a4_event().
++		 */
++		return -1;
++	}
++
++	return 0;
++
++}
++
+ static int a4_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+ 		struct hid_field *field, struct hid_usage *usage,
+ 		unsigned long **bit, int *max)
+@@ -52,8 +76,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
+ 	struct a4tech_sc *a4 = hid_get_drvdata(hdev);
+ 	struct input_dev *input;
+ 
+-	if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput ||
+-			!usage->type)
++	if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput)
+ 		return 0;
+ 
+ 	input = field->hidinput->input;
+@@ -64,7 +87,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
+ 			return 1;
+ 		}
+ 
+-		if (usage->hid == 0x000100b8) {
++		if (usage->hid == A4_WHEEL_ORIENTATION) {
+ 			input_event(input, EV_REL, value ? REL_HWHEEL :
+ 					REL_WHEEL, a4->delayed_value);
+ 			input_event(input, EV_REL, value ? REL_HWHEEL_HI_RES :
+@@ -131,6 +154,7 @@ MODULE_DEVICE_TABLE(hid, a4_devices);
+ static struct hid_driver a4_driver = {
+ 	.name = "a4tech",
+ 	.id_table = a4_devices,
++	.input_mapping = a4_input_mapping,
+ 	.input_mapped = a4_input_mapped,
+ 	.event = a4_event,
+ 	.probe = a4_probe,
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 34a812025b94..76aa474e92c1 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -990,6 +990,7 @@
+ #define USB_DEVICE_ID_SAITEK_RAT7	0x0cd7
+ #define USB_DEVICE_ID_SAITEK_RAT9	0x0cfa
+ #define USB_DEVICE_ID_SAITEK_MMO7	0x0cd0
++#define USB_DEVICE_ID_SAITEK_X52	0x075c
+ 
+ #define USB_VENDOR_ID_SAMSUNG		0x0419
+ #define USB_DEVICE_ID_SAMSUNG_IR_REMOTE	0x0001
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index cf05816a601f..34e2b3f9d540 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -3749,15 +3749,45 @@ static const struct hid_device_id hidpp_devices[] = {
+ 
+ 	{ L27MHZ_DEVICE(HID_ANY_ID) },
+ 
+-	{ /* Logitech G403 Gaming Mouse over USB */
++	{ /* Logitech G203/Prodigy Gaming Mouse */
++	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC084) },
++	{ /* Logitech G302 Gaming Mouse */
++	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07F) },
++	{ /* Logitech G303 Gaming Mouse */
++	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC080) },
++	{ /* Logitech G400 Gaming Mouse */
++	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07E) },
++	{ /* Logitech G403 Wireless Gaming Mouse over USB */
+ 	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC082) },
++	{ /* Logitech G403 Gaming Mouse */
++	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC083) },
++	{ /* Logitech G403 Hero Gaming Mouse over USB */
++	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC08F) },
++	{ /* Logitech G502 Proteus Core Gaming Mouse */
++	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07D) },
++	{ /* Logitech G502 Proteus Spectrum Gaming Mouse over USB */
++	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC332) },
++	{ /* Logitech G502 Hero Gaming Mouse over USB */
++	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC08B) },
+ 	{ /* Logitech G700 Gaming Mouse over USB */
+ 	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC06B) },
++	{ /* Logitech G700s Gaming Mouse over USB */
++	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07C) },
++	{ /* Logitech G703 Gaming Mouse over USB */
++	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC087) },
++	{ /* Logitech G703 Hero Gaming Mouse over USB */
++	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC090) },
+ 	{ /* Logitech G900 Gaming Mouse over USB */
+ 	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC081) },
++	{ /* Logitech G903 Gaming Mouse over USB */
++	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC086) },
++	{ /* Logitech G903 Hero Gaming Mouse over USB */
++	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC091) },
+ 	{ /* Logitech G920 Wheel over USB */
+ 	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL),
+ 		.driver_data = HIDPP_QUIRK_CLASS_G920 | HIDPP_QUIRK_FORCE_OUTPUT_REPORTS},
++	{ /* Logitech G Pro Gaming Mouse over USB */
++	  HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC088) },
+ 
+ 	{ /* MX5000 keyboard over Bluetooth */
+ 	  HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb305),
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 5b669f7d653f..4fe2c3ab76f9 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -141,6 +141,7 @@ static const struct hid_device_id hid_quirks[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPAD), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPORT), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD), HID_QUIRK_BADPAD },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB), HID_QUIRK_NOGET },
+diff --git a/drivers/hid/hid-tmff.c b/drivers/hid/hid-tmff.c
+index e12f2588ddeb..bdfc5ff3b2c5 100644
+--- a/drivers/hid/hid-tmff.c
++++ b/drivers/hid/hid-tmff.c
+@@ -22,6 +22,8 @@
+ 
+ #include "hid-ids.h"
+ 
++#define THRUSTMASTER_DEVICE_ID_2_IN_1_DT	0xb320
++
+ static const signed short ff_rumble[] = {
+ 	FF_RUMBLE,
+ 	-1
+@@ -76,6 +78,7 @@ static int tmff_play(struct input_dev *dev, void *data,
+ 	struct hid_field *ff_field = tmff->ff_field;
+ 	int x, y;
+ 	int left, right;	/* Rumbling */
++	int motor_swap;
+ 
+ 	switch (effect->type) {
+ 	case FF_CONSTANT:
+@@ -100,6 +103,13 @@ static int tmff_play(struct input_dev *dev, void *data,
+ 					ff_field->logical_minimum,
+ 					ff_field->logical_maximum);
+ 
++		/* 2-in-1 strong motor is left */
++		if (hid->product == THRUSTMASTER_DEVICE_ID_2_IN_1_DT) {
++			motor_swap = left;
++			left = right;
++			right = motor_swap;
++		}
++
+ 		dbg_hid("(left,right)=(%08x, %08x)\n", left, right);
+ 		ff_field->value[0] = left;
+ 		ff_field->value[1] = right;
+@@ -226,6 +236,8 @@ static const struct hid_device_id tm_devices[] = {
+ 		.driver_data = (unsigned long)ff_rumble },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304),   /* FireStorm Dual Power 2 (and 3) */
+ 		.driver_data = (unsigned long)ff_rumble },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, THRUSTMASTER_DEVICE_ID_2_IN_1_DT),   /* Dual Trigger 2-in-1 */
++		.driver_data = (unsigned long)ff_rumble },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb323),   /* Dual Trigger 3-in-1 (PC Mode) */
+ 		.driver_data = (unsigned long)ff_rumble },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb324),   /* Dual Trigger 3-in-1 (PS3 Mode) */
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 926c597f5f46..53ed51adb8ac 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -846,6 +846,8 @@ static int wacom_intuos_general(struct wacom_wac *wacom)
+ 		y >>= 1;
+ 		distance >>= 1;
+ 	}
++	if (features->type == INTUOSHT2)
++		distance = features->distance_max - distance;
+ 	input_report_abs(input, ABS_X, x);
+ 	input_report_abs(input, ABS_Y, y);
+ 	input_report_abs(input, ABS_DISTANCE, distance);
+@@ -1059,7 +1061,7 @@ static int wacom_remote_irq(struct wacom_wac *wacom_wac, size_t len)
+ 	input_report_key(input, BTN_BASE2, (data[11] & 0x02));
+ 
+ 	if (data[12] & 0x80)
+-		input_report_abs(input, ABS_WHEEL, (data[12] & 0x7f));
++		input_report_abs(input, ABS_WHEEL, (data[12] & 0x7f) - 1);
+ 	else
+ 		input_report_abs(input, ABS_WHEEL, 0);
+ 
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index 5f9505a087f6..23f358cb7f49 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -26,7 +26,7 @@
+ 
+ static unsigned long virt_to_hvpfn(void *addr)
+ {
+-	unsigned long paddr;
++	phys_addr_t paddr;
+ 
+ 	if (is_vmalloc_addr(addr))
+ 		paddr = page_to_phys(vmalloc_to_page(addr)) +
+diff --git a/drivers/infiniband/hw/hfi1/tid_rdma.c b/drivers/infiniband/hw/hfi1/tid_rdma.c
+index fe7e7097e00a..7e9527ab6d64 100644
+--- a/drivers/infiniband/hw/hfi1/tid_rdma.c
++++ b/drivers/infiniband/hw/hfi1/tid_rdma.c
+@@ -2576,18 +2576,9 @@ void hfi1_kern_read_tid_flow_free(struct rvt_qp *qp)
+ 	hfi1_kern_clear_hw_flow(priv->rcd, qp);
+ }
+ 
+-static bool tid_rdma_tid_err(struct hfi1_ctxtdata *rcd,
+-			     struct hfi1_packet *packet, u8 rcv_type,
+-			     u8 opcode)
++static bool tid_rdma_tid_err(struct hfi1_packet *packet, u8 rcv_type)
+ {
+ 	struct rvt_qp *qp = packet->qp;
+-	struct hfi1_qp_priv *qpriv = qp->priv;
+-	u32 ipsn;
+-	struct ib_other_headers *ohdr = packet->ohdr;
+-	struct rvt_ack_entry *e;
+-	struct tid_rdma_request *req;
+-	struct rvt_dev_info *rdi = ib_to_rvt(qp->ibqp.device);
+-	u32 i;
+ 
+ 	if (rcv_type >= RHF_RCV_TYPE_IB)
+ 		goto done;
+@@ -2604,41 +2595,9 @@ static bool tid_rdma_tid_err(struct hfi1_ctxtdata *rcd,
+ 	if (rcv_type == RHF_RCV_TYPE_EAGER) {
+ 		hfi1_restart_rc(qp, qp->s_last_psn + 1, 1);
+ 		hfi1_schedule_send(qp);
+-		goto done_unlock;
+-	}
+-
+-	/*
+-	 * For TID READ response, error out QP after freeing the tid
+-	 * resources.
+-	 */
+-	if (opcode == TID_OP(READ_RESP)) {
+-		ipsn = mask_psn(be32_to_cpu(ohdr->u.tid_rdma.r_rsp.verbs_psn));
+-		if (cmp_psn(ipsn, qp->s_last_psn) > 0 &&
+-		    cmp_psn(ipsn, qp->s_psn) < 0) {
+-			hfi1_kern_read_tid_flow_free(qp);
+-			spin_unlock(&qp->s_lock);
+-			rvt_rc_error(qp, IB_WC_LOC_QP_OP_ERR);
+-			goto done;
+-		}
+-		goto done_unlock;
+-	}
+-
+-	/*
+-	 * Error out the qp for TID RDMA WRITE
+-	 */
+-	hfi1_kern_clear_hw_flow(qpriv->rcd, qp);
+-	for (i = 0; i < rvt_max_atomic(rdi); i++) {
+-		e = &qp->s_ack_queue[i];
+-		if (e->opcode == TID_OP(WRITE_REQ)) {
+-			req = ack_to_tid_req(e);
+-			hfi1_kern_exp_rcv_clear_all(req);
+-		}
+ 	}
+-	spin_unlock(&qp->s_lock);
+-	rvt_rc_error(qp, IB_WC_LOC_LEN_ERR);
+-	goto done;
+ 
+-done_unlock:
++	/* Since no payload is delivered, just drop the packet */
+ 	spin_unlock(&qp->s_lock);
+ done:
+ 	return true;
+@@ -2689,12 +2648,12 @@ static bool handle_read_kdeth_eflags(struct hfi1_ctxtdata *rcd,
+ 	u32 fpsn;
+ 
+ 	lockdep_assert_held(&qp->r_lock);
++	spin_lock(&qp->s_lock);
+ 	/* If the psn is out of valid range, drop the packet */
+ 	if (cmp_psn(ibpsn, qp->s_last_psn) < 0 ||
+ 	    cmp_psn(ibpsn, qp->s_psn) > 0)
+-		return ret;
++		goto s_unlock;
+ 
+-	spin_lock(&qp->s_lock);
+ 	/*
+ 	 * Note that NAKs implicitly ACK outstanding SEND and RDMA write
+ 	 * requests and implicitly NAK RDMA read and atomic requests issued
+@@ -2742,9 +2701,12 @@ static bool handle_read_kdeth_eflags(struct hfi1_ctxtdata *rcd,
+ 
+ 		wqe = do_rc_completion(qp, wqe, ibp);
+ 		if (qp->s_acked == qp->s_tail)
+-			break;
++			goto s_unlock;
+ 	}
+ 
++	if (qp->s_acked == qp->s_tail)
++		goto s_unlock;
++
+ 	/* Handle the eflags for the request */
+ 	if (wqe->wr.opcode != IB_WR_TID_RDMA_READ)
+ 		goto s_unlock;
+@@ -2924,7 +2886,7 @@ bool hfi1_handle_kdeth_eflags(struct hfi1_ctxtdata *rcd,
+ 		if (lnh == HFI1_LRH_GRH)
+ 			goto r_unlock;
+ 
+-		if (tid_rdma_tid_err(rcd, packet, rcv_type, opcode))
++		if (tid_rdma_tid_err(packet, rcv_type))
+ 			goto r_unlock;
+ 	}
+ 
+@@ -2944,8 +2906,15 @@ bool hfi1_handle_kdeth_eflags(struct hfi1_ctxtdata *rcd,
+ 	 */
+ 	spin_lock(&qp->s_lock);
+ 	qpriv = qp->priv;
++	if (qpriv->r_tid_tail == HFI1_QP_WQE_INVALID ||
++	    qpriv->r_tid_tail == qpriv->r_tid_head)
++		goto unlock;
+ 	e = &qp->s_ack_queue[qpriv->r_tid_tail];
++	if (e->opcode != TID_OP(WRITE_REQ))
++		goto unlock;
+ 	req = ack_to_tid_req(e);
++	if (req->comp_seg == req->cur_seg)
++		goto unlock;
+ 	flow = &req->flows[req->clear_tail];
+ 	trace_hfi1_eflags_err_write(qp, rcv_type, rte, psn);
+ 	trace_hfi1_rsp_handle_kdeth_eflags(qp, psn);
+@@ -4511,7 +4480,7 @@ void hfi1_rc_rcv_tid_rdma_ack(struct hfi1_packet *packet)
+ 	struct rvt_swqe *wqe;
+ 	struct tid_rdma_request *req;
+ 	struct tid_rdma_flow *flow;
+-	u32 aeth, psn, req_psn, ack_psn, fspsn, resync_psn, ack_kpsn;
++	u32 aeth, psn, req_psn, ack_psn, flpsn, resync_psn, ack_kpsn;
+ 	unsigned long flags;
+ 	u16 fidx;
+ 
+@@ -4540,6 +4509,9 @@ void hfi1_rc_rcv_tid_rdma_ack(struct hfi1_packet *packet)
+ 		ack_kpsn--;
+ 	}
+ 
++	if (unlikely(qp->s_acked == qp->s_tail))
++		goto ack_op_err;
++
+ 	wqe = rvt_get_swqe_ptr(qp, qp->s_acked);
+ 
+ 	if (wqe->wr.opcode != IB_WR_TID_RDMA_WRITE)
+@@ -4552,7 +4524,8 @@ void hfi1_rc_rcv_tid_rdma_ack(struct hfi1_packet *packet)
+ 	trace_hfi1_tid_flow_rcv_tid_ack(qp, req->acked_tail, flow);
+ 
+ 	/* Drop stale ACK/NAK */
+-	if (cmp_psn(psn, full_flow_psn(flow, flow->flow_state.spsn)) < 0)
++	if (cmp_psn(psn, full_flow_psn(flow, flow->flow_state.spsn)) < 0 ||
++	    cmp_psn(req_psn, flow->flow_state.resp_ib_psn) < 0)
+ 		goto ack_op_err;
+ 
+ 	while (cmp_psn(ack_kpsn,
+@@ -4714,8 +4687,12 @@ done:
+ 		switch ((aeth >> IB_AETH_CREDIT_SHIFT) &
+ 			IB_AETH_CREDIT_MASK) {
+ 		case 0: /* PSN sequence error */
++			if (!req->flows)
++				break;
+ 			flow = &req->flows[req->acked_tail];
+-			fspsn = full_flow_psn(flow, flow->flow_state.spsn);
++			flpsn = full_flow_psn(flow, flow->flow_state.lpsn);
++			if (cmp_psn(psn, flpsn) > 0)
++				break;
+ 			trace_hfi1_tid_flow_rcv_tid_ack(qp, req->acked_tail,
+ 							flow);
+ 			req->r_ack_psn = mask_psn(be32_to_cpu(ohdr->bth[2]));
+diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
+index 0e224232f746..008a74a1ed44 100644
+--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
++++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
+@@ -1394,6 +1394,7 @@ start_isoc_chain(struct usb_fifo *fifo, int num_packets_per_urb,
+ 				printk(KERN_DEBUG
+ 				       "%s: %s: alloc urb for fifo %i failed",
+ 				       hw->name, __func__, fifo->fifonum);
++				continue;
+ 			}
+ 			fifo->iso[i].owner_fifo = (struct usb_fifo *) fifo;
+ 			fifo->iso[i].indx = i;
+@@ -1692,13 +1693,23 @@ hfcsusb_stop_endpoint(struct hfcsusb *hw, int channel)
+ static int
+ setup_hfcsusb(struct hfcsusb *hw)
+ {
++	void *dmabuf = kmalloc(sizeof(u_char), GFP_KERNEL);
+ 	u_char b;
++	int ret;
+ 
+ 	if (debug & DBG_HFC_CALL_TRACE)
+ 		printk(KERN_DEBUG "%s: %s\n", hw->name, __func__);
+ 
++	if (!dmabuf)
++		return -ENOMEM;
++
++	ret = read_reg_atomic(hw, HFCUSB_CHIP_ID, dmabuf);
++
++	memcpy(&b, dmabuf, sizeof(u_char));
++	kfree(dmabuf);
++
+ 	/* check the chip id */
+-	if (read_reg_atomic(hw, HFCUSB_CHIP_ID, &b) != 1) {
++	if (ret != 1) {
+ 		printk(KERN_DEBUG "%s: %s: cannot read chip id\n",
+ 		       hw->name, __func__);
+ 		return 1;
+diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
+index b6b5acc92ca2..2a48ea3f1b30 100644
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -1599,7 +1599,9 @@ dm_bufio_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+ 	unsigned long freed;
+ 
+ 	c = container_of(shrink, struct dm_bufio_client, shrinker);
+-	if (!dm_bufio_trylock(c))
++	if (sc->gfp_mask & __GFP_FS)
++		dm_bufio_lock(c);
++	else if (!dm_bufio_trylock(c))
+ 		return SHRINK_STOP;
+ 
+ 	freed  = __scan(c, sc->nr_to_scan, sc->gfp_mask);
+diff --git a/drivers/md/dm-dust.c b/drivers/md/dm-dust.c
+index 845f376a72d9..8288887b7f94 100644
+--- a/drivers/md/dm-dust.c
++++ b/drivers/md/dm-dust.c
+@@ -25,6 +25,7 @@ struct dust_device {
+ 	unsigned long long badblock_count;
+ 	spinlock_t dust_lock;
+ 	unsigned int blksz;
++	int sect_per_block_shift;
+ 	unsigned int sect_per_block;
+ 	sector_t start;
+ 	bool fail_read_on_bb:1;
+@@ -79,7 +80,7 @@ static int dust_remove_block(struct dust_device *dd, unsigned long long block)
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&dd->dust_lock, flags);
+-	bblock = dust_rb_search(&dd->badblocklist, block * dd->sect_per_block);
++	bblock = dust_rb_search(&dd->badblocklist, block);
+ 
+ 	if (bblock == NULL) {
+ 		if (!dd->quiet_mode) {
+@@ -113,7 +114,7 @@ static int dust_add_block(struct dust_device *dd, unsigned long long block)
+ 	}
+ 
+ 	spin_lock_irqsave(&dd->dust_lock, flags);
+-	bblock->bb = block * dd->sect_per_block;
++	bblock->bb = block;
+ 	if (!dust_rb_insert(&dd->badblocklist, bblock)) {
+ 		if (!dd->quiet_mode) {
+ 			DMERR("%s: block %llu already in badblocklist",
+@@ -138,7 +139,7 @@ static int dust_query_block(struct dust_device *dd, unsigned long long block)
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&dd->dust_lock, flags);
+-	bblock = dust_rb_search(&dd->badblocklist, block * dd->sect_per_block);
++	bblock = dust_rb_search(&dd->badblocklist, block);
+ 	if (bblock != NULL)
+ 		DMINFO("%s: block %llu found in badblocklist", __func__, block);
+ 	else
+@@ -165,6 +166,7 @@ static int dust_map_read(struct dust_device *dd, sector_t thisblock,
+ 	int ret = DM_MAPIO_REMAPPED;
+ 
+ 	if (fail_read_on_bb) {
++		thisblock >>= dd->sect_per_block_shift;
+ 		spin_lock_irqsave(&dd->dust_lock, flags);
+ 		ret = __dust_map_read(dd, thisblock);
+ 		spin_unlock_irqrestore(&dd->dust_lock, flags);
+@@ -195,6 +197,7 @@ static int dust_map_write(struct dust_device *dd, sector_t thisblock,
+ 	unsigned long flags;
+ 
+ 	if (fail_read_on_bb) {
++		thisblock >>= dd->sect_per_block_shift;
+ 		spin_lock_irqsave(&dd->dust_lock, flags);
+ 		__dust_map_write(dd, thisblock);
+ 		spin_unlock_irqrestore(&dd->dust_lock, flags);
+@@ -331,6 +334,8 @@ static int dust_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ 	dd->blksz = blksz;
+ 	dd->start = tmp;
+ 
++	dd->sect_per_block_shift = __ffs(sect_per_block);
++
+ 	/*
+ 	 * Whether to fail a read on a "bad" block.
+ 	 * Defaults to false; enabled later by message.
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 44e76cda087a..29a5e5b4c63c 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -1940,7 +1940,22 @@ offload_to_thread:
+ 			queue_work(ic->wait_wq, &dio->work);
+ 			return;
+ 		}
++		if (journal_read_pos != NOT_FOUND)
++			dio->range.n_sectors = ic->sectors_per_block;
+ 		wait_and_add_new_range(ic, &dio->range);
++		/*
++		 * wait_and_add_new_range drops the spinlock, so the journal
++		 * may have been changed arbitrarily. We need to recheck.
++		 * To simplify the code, we restrict I/O size to just one block.
++		 */
++		if (journal_read_pos != NOT_FOUND) {
++			sector_t next_sector;
++			unsigned new_pos = find_journal_node(ic, dio->range.logical_sector, &next_sector);
++			if (unlikely(new_pos != journal_read_pos)) {
++				remove_range_unlocked(ic, &dio->range);
++				goto retry;
++			}
++		}
+ 	}
+ 	spin_unlock_irq(&ic->endio_wait.lock);
+ 
+diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c
+index 671c24332802..3f694d9061ec 100644
+--- a/drivers/md/dm-kcopyd.c
++++ b/drivers/md/dm-kcopyd.c
+@@ -548,8 +548,10 @@ static int run_io_job(struct kcopyd_job *job)
+ 	 * no point in continuing.
+ 	 */
+ 	if (test_bit(DM_KCOPYD_WRITE_SEQ, &job->flags) &&
+-	    job->master_job->write_err)
++	    job->master_job->write_err) {
++		job->write_err = job->master_job->write_err;
+ 		return -EIO;
++	}
+ 
+ 	io_job_start(job->kc->throttle);
+ 
+@@ -601,6 +603,7 @@ static int process_jobs(struct list_head *jobs, struct dm_kcopyd_client *kc,
+ 			else
+ 				job->read_err = 1;
+ 			push(&kc->complete_jobs, job);
++			wake(kc);
+ 			break;
+ 		}
+ 
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index 9fdef6897316..01aaac2c15be 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -3194,7 +3194,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ 			  */
+ 			r = rs_prepare_reshape(rs);
+ 			if (r)
+-				return r;
++				goto bad;
+ 
+ 			/* Reshaping ain't recovery, so disable recovery */
+ 			rs_setup_recovery(rs, MaxSector);
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index ec8b27e20de3..c840c587083b 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -1334,7 +1334,7 @@ void dm_table_event(struct dm_table *t)
+ }
+ EXPORT_SYMBOL(dm_table_event);
+ 
+-sector_t dm_table_get_size(struct dm_table *t)
++inline sector_t dm_table_get_size(struct dm_table *t)
+ {
+ 	return t->num_targets ? (t->highs[t->num_targets - 1] + 1) : 0;
+ }
+@@ -1359,6 +1359,9 @@ struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector)
+ 	unsigned int l, n = 0, k = 0;
+ 	sector_t *node;
+ 
++	if (unlikely(sector >= dm_table_get_size(t)))
++		return &t->targets[t->num_targets];
++
+ 	for (l = 0; l < t->depth; l++) {
+ 		n = get_child(n, k);
+ 		node = get_node(t, l, n);
+diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
+index 4cdde7a02e94..7e8d7fc99410 100644
+--- a/drivers/md/dm-zoned-metadata.c
++++ b/drivers/md/dm-zoned-metadata.c
+@@ -401,15 +401,18 @@ static struct dmz_mblock *dmz_get_mblock_slow(struct dmz_metadata *zmd,
+ 	sector_t block = zmd->sb[zmd->mblk_primary].block + mblk_no;
+ 	struct bio *bio;
+ 
++	if (dmz_bdev_is_dying(zmd->dev))
++		return ERR_PTR(-EIO);
++
+ 	/* Get a new block and a BIO to read it */
+ 	mblk = dmz_alloc_mblock(zmd, mblk_no);
+ 	if (!mblk)
+-		return NULL;
++		return ERR_PTR(-ENOMEM);
+ 
+ 	bio = bio_alloc(GFP_NOIO, 1);
+ 	if (!bio) {
+ 		dmz_free_mblock(zmd, mblk);
+-		return NULL;
++		return ERR_PTR(-ENOMEM);
+ 	}
+ 
+ 	spin_lock(&zmd->mblk_lock);
+@@ -540,8 +543,8 @@ static struct dmz_mblock *dmz_get_mblock(struct dmz_metadata *zmd,
+ 	if (!mblk) {
+ 		/* Cache miss: read the block from disk */
+ 		mblk = dmz_get_mblock_slow(zmd, mblk_no);
+-		if (!mblk)
+-			return ERR_PTR(-ENOMEM);
++		if (IS_ERR(mblk))
++			return mblk;
+ 	}
+ 
+ 	/* Wait for on-going read I/O and check for error */
+@@ -569,16 +572,19 @@ static void dmz_dirty_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk)
+ /*
+  * Issue a metadata block write BIO.
+  */
+-static void dmz_write_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk,
+-			     unsigned int set)
++static int dmz_write_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk,
++			    unsigned int set)
+ {
+ 	sector_t block = zmd->sb[set].block + mblk->no;
+ 	struct bio *bio;
+ 
++	if (dmz_bdev_is_dying(zmd->dev))
++		return -EIO;
++
+ 	bio = bio_alloc(GFP_NOIO, 1);
+ 	if (!bio) {
+ 		set_bit(DMZ_META_ERROR, &mblk->state);
+-		return;
++		return -ENOMEM;
+ 	}
+ 
+ 	set_bit(DMZ_META_WRITING, &mblk->state);
+@@ -590,6 +596,8 @@ static void dmz_write_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk,
+ 	bio_set_op_attrs(bio, REQ_OP_WRITE, REQ_META | REQ_PRIO);
+ 	bio_add_page(bio, mblk->page, DMZ_BLOCK_SIZE, 0);
+ 	submit_bio(bio);
++
++	return 0;
+ }
+ 
+ /*
+@@ -601,6 +609,9 @@ static int dmz_rdwr_block(struct dmz_metadata *zmd, int op, sector_t block,
+ 	struct bio *bio;
+ 	int ret;
+ 
++	if (dmz_bdev_is_dying(zmd->dev))
++		return -EIO;
++
+ 	bio = bio_alloc(GFP_NOIO, 1);
+ 	if (!bio)
+ 		return -ENOMEM;
+@@ -658,22 +669,29 @@ static int dmz_write_dirty_mblocks(struct dmz_metadata *zmd,
+ {
+ 	struct dmz_mblock *mblk;
+ 	struct blk_plug plug;
+-	int ret = 0;
++	int ret = 0, nr_mblks_submitted = 0;
+ 
+ 	/* Issue writes */
+ 	blk_start_plug(&plug);
+-	list_for_each_entry(mblk, write_list, link)
+-		dmz_write_mblock(zmd, mblk, set);
++	list_for_each_entry(mblk, write_list, link) {
++		ret = dmz_write_mblock(zmd, mblk, set);
++		if (ret)
++			break;
++		nr_mblks_submitted++;
++	}
+ 	blk_finish_plug(&plug);
+ 
+ 	/* Wait for completion */
+ 	list_for_each_entry(mblk, write_list, link) {
++		if (!nr_mblks_submitted)
++			break;
+ 		wait_on_bit_io(&mblk->state, DMZ_META_WRITING,
+ 			       TASK_UNINTERRUPTIBLE);
+ 		if (test_bit(DMZ_META_ERROR, &mblk->state)) {
+ 			clear_bit(DMZ_META_ERROR, &mblk->state);
+ 			ret = -EIO;
+ 		}
++		nr_mblks_submitted--;
+ 	}
+ 
+ 	/* Flush drive cache (this will also sync data) */
+@@ -735,6 +753,11 @@ int dmz_flush_metadata(struct dmz_metadata *zmd)
+ 	 */
+ 	dmz_lock_flush(zmd);
+ 
++	if (dmz_bdev_is_dying(zmd->dev)) {
++		ret = -EIO;
++		goto out;
++	}
++
+ 	/* Get dirty blocks */
+ 	spin_lock(&zmd->mblk_lock);
+ 	list_splice_init(&zmd->mblk_dirty_list, &write_list);
+@@ -1534,7 +1557,7 @@ static struct dm_zone *dmz_get_rnd_zone_for_reclaim(struct dmz_metadata *zmd)
+ 	struct dm_zone *zone;
+ 
+ 	if (list_empty(&zmd->map_rnd_list))
+-		return NULL;
++		return ERR_PTR(-EBUSY);
+ 
+ 	list_for_each_entry(zone, &zmd->map_rnd_list, link) {
+ 		if (dmz_is_buf(zone))
+@@ -1545,7 +1568,7 @@ static struct dm_zone *dmz_get_rnd_zone_for_reclaim(struct dmz_metadata *zmd)
+ 			return dzone;
+ 	}
+ 
+-	return NULL;
++	return ERR_PTR(-EBUSY);
+ }
+ 
+ /*
+@@ -1556,7 +1579,7 @@ static struct dm_zone *dmz_get_seq_zone_for_reclaim(struct dmz_metadata *zmd)
+ 	struct dm_zone *zone;
+ 
+ 	if (list_empty(&zmd->map_seq_list))
+-		return NULL;
++		return ERR_PTR(-EBUSY);
+ 
+ 	list_for_each_entry(zone, &zmd->map_seq_list, link) {
+ 		if (!zone->bzone)
+@@ -1565,7 +1588,7 @@ static struct dm_zone *dmz_get_seq_zone_for_reclaim(struct dmz_metadata *zmd)
+ 			return zone;
+ 	}
+ 
+-	return NULL;
++	return ERR_PTR(-EBUSY);
+ }
+ 
+ /*
+@@ -1623,6 +1646,10 @@ again:
+ 		/* Alloate a random zone */
+ 		dzone = dmz_alloc_zone(zmd, DMZ_ALLOC_RND);
+ 		if (!dzone) {
++			if (dmz_bdev_is_dying(zmd->dev)) {
++				dzone = ERR_PTR(-EIO);
++				goto out;
++			}
+ 			dmz_wait_for_free_zones(zmd);
+ 			goto again;
+ 		}
+@@ -1720,6 +1747,10 @@ again:
+ 	/* Alloate a random zone */
+ 	bzone = dmz_alloc_zone(zmd, DMZ_ALLOC_RND);
+ 	if (!bzone) {
++		if (dmz_bdev_is_dying(zmd->dev)) {
++			bzone = ERR_PTR(-EIO);
++			goto out;
++		}
+ 		dmz_wait_for_free_zones(zmd);
+ 		goto again;
+ 	}
+diff --git a/drivers/md/dm-zoned-reclaim.c b/drivers/md/dm-zoned-reclaim.c
+index edf4b95eb075..9470b8f77a33 100644
+--- a/drivers/md/dm-zoned-reclaim.c
++++ b/drivers/md/dm-zoned-reclaim.c
+@@ -37,7 +37,7 @@ enum {
+ /*
+  * Number of seconds of target BIO inactivity to consider the target idle.
+  */
+-#define DMZ_IDLE_PERIOD		(10UL * HZ)
++#define DMZ_IDLE_PERIOD			(10UL * HZ)
+ 
+ /*
+  * Percentage of unmapped (free) random zones below which reclaim starts
+@@ -134,6 +134,9 @@ static int dmz_reclaim_copy(struct dmz_reclaim *zrc,
+ 		set_bit(DM_KCOPYD_WRITE_SEQ, &flags);
+ 
+ 	while (block < end_block) {
++		if (dev->flags & DMZ_BDEV_DYING)
++			return -EIO;
++
+ 		/* Get a valid region from the source zone */
+ 		ret = dmz_first_valid_block(zmd, src_zone, &block);
+ 		if (ret <= 0)
+@@ -215,7 +218,7 @@ static int dmz_reclaim_buf(struct dmz_reclaim *zrc, struct dm_zone *dzone)
+ 
+ 	dmz_unlock_flush(zmd);
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ /*
+@@ -259,7 +262,7 @@ static int dmz_reclaim_seq_data(struct dmz_reclaim *zrc, struct dm_zone *dzone)
+ 
+ 	dmz_unlock_flush(zmd);
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ /*
+@@ -312,7 +315,7 @@ static int dmz_reclaim_rnd_data(struct dmz_reclaim *zrc, struct dm_zone *dzone)
+ 
+ 	dmz_unlock_flush(zmd);
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ /*
+@@ -334,7 +337,7 @@ static void dmz_reclaim_empty(struct dmz_reclaim *zrc, struct dm_zone *dzone)
+ /*
+  * Find a candidate zone for reclaim and process it.
+  */
+-static void dmz_reclaim(struct dmz_reclaim *zrc)
++static int dmz_do_reclaim(struct dmz_reclaim *zrc)
+ {
+ 	struct dmz_metadata *zmd = zrc->metadata;
+ 	struct dm_zone *dzone;
+@@ -344,8 +347,8 @@ static void dmz_reclaim(struct dmz_reclaim *zrc)
+ 
+ 	/* Get a data zone */
+ 	dzone = dmz_get_zone_for_reclaim(zmd);
+-	if (!dzone)
+-		return;
++	if (IS_ERR(dzone))
++		return PTR_ERR(dzone);
+ 
+ 	start = jiffies;
+ 
+@@ -391,13 +394,20 @@ static void dmz_reclaim(struct dmz_reclaim *zrc)
+ out:
+ 	if (ret) {
+ 		dmz_unlock_zone_reclaim(dzone);
+-		return;
++		return ret;
+ 	}
+ 
+-	(void) dmz_flush_metadata(zrc->metadata);
++	ret = dmz_flush_metadata(zrc->metadata);
++	if (ret) {
++		dmz_dev_debug(zrc->dev,
++			      "Metadata flush for zone %u failed, err %d\n",
++			      dmz_id(zmd, rzone), ret);
++		return ret;
++	}
+ 
+ 	dmz_dev_debug(zrc->dev, "Reclaimed zone %u in %u ms",
+ 		      dmz_id(zmd, rzone), jiffies_to_msecs(jiffies - start));
++	return 0;
+ }
+ 
+ /*
+@@ -442,6 +452,10 @@ static void dmz_reclaim_work(struct work_struct *work)
+ 	struct dmz_metadata *zmd = zrc->metadata;
+ 	unsigned int nr_rnd, nr_unmap_rnd;
+ 	unsigned int p_unmap_rnd;
++	int ret;
++
++	if (dmz_bdev_is_dying(zrc->dev))
++		return;
+ 
+ 	if (!dmz_should_reclaim(zrc)) {
+ 		mod_delayed_work(zrc->wq, &zrc->work, DMZ_IDLE_PERIOD);
+@@ -471,7 +485,17 @@ static void dmz_reclaim_work(struct work_struct *work)
+ 		      (dmz_target_idle(zrc) ? "Idle" : "Busy"),
+ 		      p_unmap_rnd, nr_unmap_rnd, nr_rnd);
+ 
+-	dmz_reclaim(zrc);
++	ret = dmz_do_reclaim(zrc);
++	if (ret) {
++		dmz_dev_debug(zrc->dev, "Reclaim error %d\n", ret);
++		if (ret == -EIO)
++			/*
++			 * LLD might be performing some error handling sequence
++			 * at the underlying device. To not interfere, do not
++			 * attempt to schedule the next reclaim run immediately.
++			 */
++			return;
++	}
+ 
+ 	dmz_schedule_reclaim(zrc);
+ }
+diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c
+index 51d029bbb740..ff3fd011796e 100644
+--- a/drivers/md/dm-zoned-target.c
++++ b/drivers/md/dm-zoned-target.c
+@@ -133,6 +133,8 @@ static int dmz_submit_bio(struct dmz_target *dmz, struct dm_zone *zone,
+ 
+ 	refcount_inc(&bioctx->ref);
+ 	generic_make_request(clone);
++	if (clone->bi_status == BLK_STS_IOERR)
++		return -EIO;
+ 
+ 	if (bio_op(bio) == REQ_OP_WRITE && dmz_is_seq(zone))
+ 		zone->wp_block += nr_blocks;
+@@ -277,8 +279,8 @@ static int dmz_handle_buffered_write(struct dmz_target *dmz,
+ 
+ 	/* Get the buffer zone. One will be allocated if needed */
+ 	bzone = dmz_get_chunk_buffer(zmd, zone);
+-	if (!bzone)
+-		return -ENOSPC;
++	if (IS_ERR(bzone))
++		return PTR_ERR(bzone);
+ 
+ 	if (dmz_is_readonly(bzone))
+ 		return -EROFS;
+@@ -389,6 +391,11 @@ static void dmz_handle_bio(struct dmz_target *dmz, struct dm_chunk_work *cw,
+ 
+ 	dmz_lock_metadata(zmd);
+ 
++	if (dmz->dev->flags & DMZ_BDEV_DYING) {
++		ret = -EIO;
++		goto out;
++	}
++
+ 	/*
+ 	 * Get the data zone mapping the chunk. There may be no
+ 	 * mapping for read and discard. If a mapping is obtained,
+@@ -493,6 +500,8 @@ static void dmz_flush_work(struct work_struct *work)
+ 
+ 	/* Flush dirty metadata blocks */
+ 	ret = dmz_flush_metadata(dmz->metadata);
++	if (ret)
++		dmz_dev_debug(dmz->dev, "Metadata flush failed, rc=%d\n", ret);
+ 
+ 	/* Process queued flush requests */
+ 	while (1) {
+@@ -513,22 +522,24 @@ static void dmz_flush_work(struct work_struct *work)
+  * Get a chunk work and start it to process a new BIO.
+  * If the BIO chunk has no work yet, create one.
+  */
+-static void dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
++static int dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
+ {
+ 	unsigned int chunk = dmz_bio_chunk(dmz->dev, bio);
+ 	struct dm_chunk_work *cw;
++	int ret = 0;
+ 
+ 	mutex_lock(&dmz->chunk_lock);
+ 
+ 	/* Get the BIO chunk work. If one is not active yet, create one */
+ 	cw = radix_tree_lookup(&dmz->chunk_rxtree, chunk);
+ 	if (!cw) {
+-		int ret;
+ 
+ 		/* Create a new chunk work */
+ 		cw = kmalloc(sizeof(struct dm_chunk_work), GFP_NOIO);
+-		if (!cw)
++		if (unlikely(!cw)) {
++			ret = -ENOMEM;
+ 			goto out;
++		}
+ 
+ 		INIT_WORK(&cw->work, dmz_chunk_work);
+ 		refcount_set(&cw->refcount, 0);
+@@ -539,7 +550,6 @@ static void dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
+ 		ret = radix_tree_insert(&dmz->chunk_rxtree, chunk, cw);
+ 		if (unlikely(ret)) {
+ 			kfree(cw);
+-			cw = NULL;
+ 			goto out;
+ 		}
+ 	}
+@@ -547,10 +557,38 @@ static void dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
+ 	bio_list_add(&cw->bio_list, bio);
+ 	dmz_get_chunk_work(cw);
+ 
++	dmz_reclaim_bio_acc(dmz->reclaim);
+ 	if (queue_work(dmz->chunk_wq, &cw->work))
+ 		dmz_get_chunk_work(cw);
+ out:
+ 	mutex_unlock(&dmz->chunk_lock);
++	return ret;
++}
++
++/*
++ * Check the backing device availability. If it's on the way out,
++ * start failing I/O. Reclaim and metadata components also call this
++ * function to cleanly abort operation in the event of such failure.
++ */
++bool dmz_bdev_is_dying(struct dmz_dev *dmz_dev)
++{
++	struct gendisk *disk;
++
++	if (!(dmz_dev->flags & DMZ_BDEV_DYING)) {
++		disk = dmz_dev->bdev->bd_disk;
++		if (blk_queue_dying(bdev_get_queue(dmz_dev->bdev))) {
++			dmz_dev_warn(dmz_dev, "Backing device queue dying");
++			dmz_dev->flags |= DMZ_BDEV_DYING;
++		} else if (disk->fops->check_events) {
++			if (disk->fops->check_events(disk, 0) &
++					DISK_EVENT_MEDIA_CHANGE) {
++				dmz_dev_warn(dmz_dev, "Backing device offline");
++				dmz_dev->flags |= DMZ_BDEV_DYING;
++			}
++		}
++	}
++
++	return dmz_dev->flags & DMZ_BDEV_DYING;
+ }
+ 
+ /*
+@@ -564,6 +602,10 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
+ 	sector_t sector = bio->bi_iter.bi_sector;
+ 	unsigned int nr_sectors = bio_sectors(bio);
+ 	sector_t chunk_sector;
++	int ret;
++
++	if (dmz_bdev_is_dying(dmz->dev))
++		return DM_MAPIO_KILL;
+ 
+ 	dmz_dev_debug(dev, "BIO op %d sector %llu + %u => chunk %llu, block %llu, %u blocks",
+ 		      bio_op(bio), (unsigned long long)sector, nr_sectors,
+@@ -601,8 +643,14 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
+ 		dm_accept_partial_bio(bio, dev->zone_nr_sectors - chunk_sector);
+ 
+ 	/* Now ready to handle this BIO */
+-	dmz_reclaim_bio_acc(dmz->reclaim);
+-	dmz_queue_chunk_work(dmz, bio);
++	ret = dmz_queue_chunk_work(dmz, bio);
++	if (ret) {
++		dmz_dev_debug(dmz->dev,
++			      "BIO op %d, can't process chunk %llu, err %i\n",
++			      bio_op(bio), (u64)dmz_bio_chunk(dmz->dev, bio),
++			      ret);
++		return DM_MAPIO_REQUEUE;
++	}
+ 
+ 	return DM_MAPIO_SUBMITTED;
+ }
+@@ -855,6 +903,9 @@ static int dmz_prepare_ioctl(struct dm_target *ti, struct block_device **bdev)
+ {
+ 	struct dmz_target *dmz = ti->private;
+ 
++	if (dmz_bdev_is_dying(dmz->dev))
++		return -ENODEV;
++
+ 	*bdev = dmz->dev->bdev;
+ 
+ 	return 0;
+diff --git a/drivers/md/dm-zoned.h b/drivers/md/dm-zoned.h
+index ed8de49c9a08..93a64529f219 100644
+--- a/drivers/md/dm-zoned.h
++++ b/drivers/md/dm-zoned.h
+@@ -56,6 +56,8 @@ struct dmz_dev {
+ 
+ 	unsigned int		nr_zones;
+ 
++	unsigned int		flags;
++
+ 	sector_t		zone_nr_sectors;
+ 	unsigned int		zone_nr_sectors_shift;
+ 
+@@ -67,6 +69,9 @@ struct dmz_dev {
+ 				 (dev)->zone_nr_sectors_shift)
+ #define dmz_chunk_block(dev, b)	((b) & ((dev)->zone_nr_blocks - 1))
+ 
++/* Device flags. */
++#define DMZ_BDEV_DYING		(1 << 0)
++
+ /*
+  * Zone descriptor.
+  */
+@@ -245,4 +250,9 @@ void dmz_resume_reclaim(struct dmz_reclaim *zrc);
+ void dmz_reclaim_bio_acc(struct dmz_reclaim *zrc);
+ void dmz_schedule_reclaim(struct dmz_reclaim *zrc);
+ 
++/*
++ * Functions defined in dm-zoned-target.c
++ */
++bool dmz_bdev_is_dying(struct dmz_dev *dmz_dev);
++
+ #endif /* DM_ZONED_H */
+diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
+index 58b319757b1e..8aae0624a297 100644
+--- a/drivers/md/persistent-data/dm-btree.c
++++ b/drivers/md/persistent-data/dm-btree.c
+@@ -628,39 +628,40 @@ static int btree_split_beneath(struct shadow_spine *s, uint64_t key)
+ 
+ 	new_parent = shadow_current(s);
+ 
++	pn = dm_block_data(new_parent);
++	size = le32_to_cpu(pn->header.flags) & INTERNAL_NODE ?
++		sizeof(__le64) : s->info->value_type.size;
++
++	/* create & init the left block */
+ 	r = new_block(s->info, &left);
+ 	if (r < 0)
+ 		return r;
+ 
++	ln = dm_block_data(left);
++	nr_left = le32_to_cpu(pn->header.nr_entries) / 2;
++
++	ln->header.flags = pn->header.flags;
++	ln->header.nr_entries = cpu_to_le32(nr_left);
++	ln->header.max_entries = pn->header.max_entries;
++	ln->header.value_size = pn->header.value_size;
++	memcpy(ln->keys, pn->keys, nr_left * sizeof(pn->keys[0]));
++	memcpy(value_ptr(ln, 0), value_ptr(pn, 0), nr_left * size);
++
++	/* create & init the right block */
+ 	r = new_block(s->info, &right);
+ 	if (r < 0) {
+ 		unlock_block(s->info, left);
+ 		return r;
+ 	}
+ 
+-	pn = dm_block_data(new_parent);
+-	ln = dm_block_data(left);
+ 	rn = dm_block_data(right);
+-
+-	nr_left = le32_to_cpu(pn->header.nr_entries) / 2;
+ 	nr_right = le32_to_cpu(pn->header.nr_entries) - nr_left;
+ 
+-	ln->header.flags = pn->header.flags;
+-	ln->header.nr_entries = cpu_to_le32(nr_left);
+-	ln->header.max_entries = pn->header.max_entries;
+-	ln->header.value_size = pn->header.value_size;
+-
+ 	rn->header.flags = pn->header.flags;
+ 	rn->header.nr_entries = cpu_to_le32(nr_right);
+ 	rn->header.max_entries = pn->header.max_entries;
+ 	rn->header.value_size = pn->header.value_size;
+-
+-	memcpy(ln->keys, pn->keys, nr_left * sizeof(pn->keys[0]));
+ 	memcpy(rn->keys, pn->keys + nr_left, nr_right * sizeof(pn->keys[0]));
+-
+-	size = le32_to_cpu(pn->header.flags) & INTERNAL_NODE ?
+-		sizeof(__le64) : s->info->value_type.size;
+-	memcpy(value_ptr(ln, 0), value_ptr(pn, 0), nr_left * size);
+ 	memcpy(value_ptr(rn, 0), value_ptr(pn, nr_left),
+ 	       nr_right * size);
+ 
+diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
+index aec449243966..25328582cc48 100644
+--- a/drivers/md/persistent-data/dm-space-map-metadata.c
++++ b/drivers/md/persistent-data/dm-space-map-metadata.c
+@@ -249,7 +249,7 @@ static int out(struct sm_metadata *smm)
+ 	}
+ 
+ 	if (smm->recursion_count == 1)
+-		apply_bops(smm);
++		r = apply_bops(smm);
+ 
+ 	smm->recursion_count--;
+ 
+diff --git a/drivers/misc/habanalabs/firmware_if.c b/drivers/misc/habanalabs/firmware_if.c
+index eda5d7fcb79f..fe9e57a81b6f 100644
+--- a/drivers/misc/habanalabs/firmware_if.c
++++ b/drivers/misc/habanalabs/firmware_if.c
+@@ -24,7 +24,7 @@ int hl_fw_push_fw_to_device(struct hl_device *hdev, const char *fw_name,
+ {
+ 	const struct firmware *fw;
+ 	const u64 *fw_data;
+-	size_t fw_size, i;
++	size_t fw_size;
+ 	int rc;
+ 
+ 	rc = request_firmware(&fw, fw_name, hdev->dev);
+@@ -45,22 +45,7 @@ int hl_fw_push_fw_to_device(struct hl_device *hdev, const char *fw_name,
+ 
+ 	fw_data = (const u64 *) fw->data;
+ 
+-	if ((fw->size % 8) != 0)
+-		fw_size -= 8;
+-
+-	for (i = 0 ; i < fw_size ; i += 8, fw_data++, dst += 8) {
+-		if (!(i & (0x80000 - 1))) {
+-			dev_dbg(hdev->dev,
+-				"copied so far %zu out of %zu for %s firmware",
+-				i, fw_size, fw_name);
+-			usleep_range(20, 100);
+-		}
+-
+-		writeq(*fw_data, dst);
+-	}
+-
+-	if ((fw->size % 8) != 0)
+-		writel(*(const u32 *) fw_data, dst);
++	memcpy_toio(dst, fw_data, fw_size);
+ 
+ out:
+ 	release_firmware(fw);
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index f183cadd14e3..e8f48f3cdf94 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2205,6 +2205,15 @@ static void bond_miimon_commit(struct bonding *bond)
+ 	bond_for_each_slave(bond, slave, iter) {
+ 		switch (slave->new_link) {
+ 		case BOND_LINK_NOCHANGE:
++			/* For 802.3ad mode, check current slave speed and
++			 * duplex again in case its port was disabled after
++			 * invalid speed/duplex reporting but recovered before
++			 * link monitoring could make a decision on the actual
++			 * link status
++			 */
++			if (BOND_MODE(bond) == BOND_MODE_8023AD &&
++			    slave->link == BOND_LINK_UP)
++				bond_3ad_adapter_speed_duplex_changed(slave);
+ 			continue;
+ 
+ 		case BOND_LINK_UP:
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index b6b93a2d93a5..483d270664cc 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -1249,6 +1249,8 @@ int register_candev(struct net_device *dev)
+ 		return -EINVAL;
+ 
+ 	dev->rtnl_link_ops = &can_link_ops;
++	netif_carrier_off(dev);
++
+ 	return register_netdev(dev);
+ }
+ EXPORT_SYMBOL_GPL(register_candev);
+diff --git a/drivers/net/can/sja1000/peak_pcmcia.c b/drivers/net/can/sja1000/peak_pcmcia.c
+index 185c7f7d38a4..5e0d5e8101c8 100644
+--- a/drivers/net/can/sja1000/peak_pcmcia.c
++++ b/drivers/net/can/sja1000/peak_pcmcia.c
+@@ -479,7 +479,7 @@ static void pcan_free_channels(struct pcan_pccard *card)
+ 		if (!netdev)
+ 			continue;
+ 
+-		strncpy(name, netdev->name, IFNAMSIZ);
++		strlcpy(name, netdev->name, IFNAMSIZ);
+ 
+ 		unregister_sja1000dev(netdev);
+ 
+diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
+index 44e99e3d7134..2aec934fab0c 100644
+--- a/drivers/net/can/spi/mcp251x.c
++++ b/drivers/net/can/spi/mcp251x.c
+@@ -664,17 +664,6 @@ static int mcp251x_power_enable(struct regulator *reg, int enable)
+ 		return regulator_disable(reg);
+ }
+ 
+-static void mcp251x_open_clean(struct net_device *net)
+-{
+-	struct mcp251x_priv *priv = netdev_priv(net);
+-	struct spi_device *spi = priv->spi;
+-
+-	free_irq(spi->irq, priv);
+-	mcp251x_hw_sleep(spi);
+-	mcp251x_power_enable(priv->transceiver, 0);
+-	close_candev(net);
+-}
+-
+ static int mcp251x_stop(struct net_device *net)
+ {
+ 	struct mcp251x_priv *priv = netdev_priv(net);
+@@ -940,37 +929,43 @@ static int mcp251x_open(struct net_device *net)
+ 				   flags | IRQF_ONESHOT, DEVICE_NAME, priv);
+ 	if (ret) {
+ 		dev_err(&spi->dev, "failed to acquire irq %d\n", spi->irq);
+-		mcp251x_power_enable(priv->transceiver, 0);
+-		close_candev(net);
+-		goto open_unlock;
++		goto out_close;
+ 	}
+ 
+ 	priv->wq = alloc_workqueue("mcp251x_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,
+ 				   0);
++	if (!priv->wq) {
++		ret = -ENOMEM;
++		goto out_clean;
++	}
+ 	INIT_WORK(&priv->tx_work, mcp251x_tx_work_handler);
+ 	INIT_WORK(&priv->restart_work, mcp251x_restart_work_handler);
+ 
+ 	ret = mcp251x_hw_reset(spi);
+-	if (ret) {
+-		mcp251x_open_clean(net);
+-		goto open_unlock;
+-	}
++	if (ret)
++		goto out_free_wq;
+ 	ret = mcp251x_setup(net, spi);
+-	if (ret) {
+-		mcp251x_open_clean(net);
+-		goto open_unlock;
+-	}
++	if (ret)
++		goto out_free_wq;
+ 	ret = mcp251x_set_normal_mode(spi);
+-	if (ret) {
+-		mcp251x_open_clean(net);
+-		goto open_unlock;
+-	}
++	if (ret)
++		goto out_free_wq;
+ 
+ 	can_led_event(net, CAN_LED_EVENT_OPEN);
+ 
+ 	netif_wake_queue(net);
++	mutex_unlock(&priv->mcp_lock);
+ 
+-open_unlock:
++	return 0;
++
++out_free_wq:
++	destroy_workqueue(priv->wq);
++out_clean:
++	free_irq(spi->irq, priv);
++	mcp251x_hw_sleep(spi);
++out_close:
++	mcp251x_power_enable(priv->transceiver, 0);
++	close_candev(net);
+ 	mutex_unlock(&priv->mcp_lock);
+ 	return ret;
+ }
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+index 22b9c8e6d040..65dce642b86b 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+@@ -855,7 +855,7 @@ static void peak_usb_disconnect(struct usb_interface *intf)
+ 
+ 		dev_prev_siblings = dev->prev_siblings;
+ 		dev->state &= ~PCAN_USB_STATE_CONNECTED;
+-		strncpy(name, netdev->name, IFNAMSIZ);
++		strlcpy(name, netdev->name, IFNAMSIZ);
+ 
+ 		unregister_netdev(netdev);
+ 
+diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+index 1e82b9efe447..58f89f6a040f 100644
+--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+@@ -3269,7 +3269,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	if (!adapter->regs) {
+ 		dev_err(&pdev->dev, "cannot map device registers\n");
+ 		err = -ENOMEM;
+-		goto out_free_adapter;
++		goto out_free_adapter_nofail;
+ 	}
+ 
+ 	adapter->pdev = pdev;
+@@ -3397,6 +3397,9 @@ out_free_dev:
+ 		if (adapter->port[i])
+ 			free_netdev(adapter->port[i]);
+ 
++out_free_adapter_nofail:
++	kfree_skb(adapter->nofail_skb);
++
+ out_free_adapter:
+ 	kfree(adapter);
+ 
+diff --git a/drivers/net/ethernet/freescale/enetc/Kconfig b/drivers/net/ethernet/freescale/enetc/Kconfig
+index 8429f5c1d810..a268e74b1834 100644
+--- a/drivers/net/ethernet/freescale/enetc/Kconfig
++++ b/drivers/net/ethernet/freescale/enetc/Kconfig
+@@ -2,6 +2,7 @@
+ config FSL_ENETC
+ 	tristate "ENETC PF driver"
+ 	depends on PCI && PCI_MSI && (ARCH_LAYERSCAPE || COMPILE_TEST)
++	select PHYLIB
+ 	help
+ 	  This driver supports NXP ENETC gigabit ethernet controller PCIe
+ 	  physical function (PF) devices, managing ENETC Ports at a privileged
+@@ -12,6 +13,7 @@ config FSL_ENETC
+ config FSL_ENETC_VF
+ 	tristate "ENETC VF driver"
+ 	depends on PCI && PCI_MSI && (ARCH_LAYERSCAPE || COMPILE_TEST)
++	select PHYLIB
+ 	help
+ 	  This driver supports NXP ENETC gigabit ethernet controller PCIe
+ 	  virtual function (VF) devices enabled by the ENETC PF driver.
+diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
+index e1f2978506fd..51cf6b0db904 100644
+--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
+@@ -153,6 +153,7 @@ struct hip04_priv {
+ 	unsigned int reg_inten;
+ 
+ 	struct napi_struct napi;
++	struct device *dev;
+ 	struct net_device *ndev;
+ 
+ 	struct tx_desc *tx_desc;
+@@ -181,7 +182,7 @@ struct hip04_priv {
+ 
+ static inline unsigned int tx_count(unsigned int head, unsigned int tail)
+ {
+-	return (head - tail) % (TX_DESC_NUM - 1);
++	return (head - tail) % TX_DESC_NUM;
+ }
+ 
+ static void hip04_config_port(struct net_device *ndev, u32 speed, u32 duplex)
+@@ -383,7 +384,7 @@ static int hip04_tx_reclaim(struct net_device *ndev, bool force)
+ 		}
+ 
+ 		if (priv->tx_phys[tx_tail]) {
+-			dma_unmap_single(&ndev->dev, priv->tx_phys[tx_tail],
++			dma_unmap_single(priv->dev, priv->tx_phys[tx_tail],
+ 					 priv->tx_skb[tx_tail]->len,
+ 					 DMA_TO_DEVICE);
+ 			priv->tx_phys[tx_tail] = 0;
+@@ -434,8 +435,8 @@ hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ 		return NETDEV_TX_BUSY;
+ 	}
+ 
+-	phys = dma_map_single(&ndev->dev, skb->data, skb->len, DMA_TO_DEVICE);
+-	if (dma_mapping_error(&ndev->dev, phys)) {
++	phys = dma_map_single(priv->dev, skb->data, skb->len, DMA_TO_DEVICE);
++	if (dma_mapping_error(priv->dev, phys)) {
+ 		dev_kfree_skb(skb);
+ 		return NETDEV_TX_OK;
+ 	}
+@@ -494,6 +495,9 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget)
+ 	u16 len;
+ 	u32 err;
+ 
++	/* clean up tx descriptors */
++	tx_remaining = hip04_tx_reclaim(ndev, false);
++
+ 	while (cnt && !last) {
+ 		buf = priv->rx_buf[priv->rx_head];
+ 		skb = build_skb(buf, priv->rx_buf_size);
+@@ -502,7 +506,7 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget)
+ 			goto refill;
+ 		}
+ 
+-		dma_unmap_single(&ndev->dev, priv->rx_phys[priv->rx_head],
++		dma_unmap_single(priv->dev, priv->rx_phys[priv->rx_head],
+ 				 RX_BUF_SIZE, DMA_FROM_DEVICE);
+ 		priv->rx_phys[priv->rx_head] = 0;
+ 
+@@ -531,9 +535,9 @@ refill:
+ 		buf = netdev_alloc_frag(priv->rx_buf_size);
+ 		if (!buf)
+ 			goto done;
+-		phys = dma_map_single(&ndev->dev, buf,
++		phys = dma_map_single(priv->dev, buf,
+ 				      RX_BUF_SIZE, DMA_FROM_DEVICE);
+-		if (dma_mapping_error(&ndev->dev, phys))
++		if (dma_mapping_error(priv->dev, phys))
+ 			goto done;
+ 		priv->rx_buf[priv->rx_head] = buf;
+ 		priv->rx_phys[priv->rx_head] = phys;
+@@ -554,8 +558,7 @@ refill:
+ 	}
+ 	napi_complete_done(napi, rx);
+ done:
+-	/* clean up tx descriptors and start a new timer if necessary */
+-	tx_remaining = hip04_tx_reclaim(ndev, false);
++	/* start a new timer if necessary */
+ 	if (rx < budget && tx_remaining)
+ 		hip04_start_tx_timer(priv);
+ 
+@@ -637,9 +640,9 @@ static int hip04_mac_open(struct net_device *ndev)
+ 	for (i = 0; i < RX_DESC_NUM; i++) {
+ 		dma_addr_t phys;
+ 
+-		phys = dma_map_single(&ndev->dev, priv->rx_buf[i],
++		phys = dma_map_single(priv->dev, priv->rx_buf[i],
+ 				      RX_BUF_SIZE, DMA_FROM_DEVICE);
+-		if (dma_mapping_error(&ndev->dev, phys))
++		if (dma_mapping_error(priv->dev, phys))
+ 			return -EIO;
+ 
+ 		priv->rx_phys[i] = phys;
+@@ -673,7 +676,7 @@ static int hip04_mac_stop(struct net_device *ndev)
+ 
+ 	for (i = 0; i < RX_DESC_NUM; i++) {
+ 		if (priv->rx_phys[i]) {
+-			dma_unmap_single(&ndev->dev, priv->rx_phys[i],
++			dma_unmap_single(priv->dev, priv->rx_phys[i],
+ 					 RX_BUF_SIZE, DMA_FROM_DEVICE);
+ 			priv->rx_phys[i] = 0;
+ 		}
+@@ -817,6 +820,7 @@ static int hip04_mac_probe(struct platform_device *pdev)
+ 		return -ENOMEM;
+ 
+ 	priv = netdev_priv(ndev);
++	priv->dev = d;
+ 	priv->ndev = ndev;
+ 	platform_set_drvdata(pdev, ndev);
+ 	SET_NETDEV_DEV(ndev, &pdev->dev);
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 50ed1bdb632d..885529701de9 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -4580,9 +4580,9 @@ static void mvpp2_xlg_config(struct mvpp2_port *port, unsigned int mode,
+ 	else
+ 		ctrl0 &= ~MVPP22_XLG_CTRL0_RX_FLOW_CTRL_EN;
+ 
+-	ctrl4 &= ~MVPP22_XLG_CTRL4_MACMODSELECT_GMAC;
+-	ctrl4 |= MVPP22_XLG_CTRL4_FWD_FC | MVPP22_XLG_CTRL4_FWD_PFC |
+-		 MVPP22_XLG_CTRL4_EN_IDLE_CHECK;
++	ctrl4 &= ~(MVPP22_XLG_CTRL4_MACMODSELECT_GMAC |
++		   MVPP22_XLG_CTRL4_EN_IDLE_CHECK);
++	ctrl4 |= MVPP22_XLG_CTRL4_FWD_FC | MVPP22_XLG_CTRL4_FWD_PFC;
+ 
+ 	if (old_ctrl0 != ctrl0)
+ 		writel(ctrl0, port->base + MVPP22_XLG_CTRL0_REG);
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
+index fdfedbc8e431..70a771cd8788 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
+@@ -1093,7 +1093,7 @@ static int qed_int_deassertion(struct qed_hwfn  *p_hwfn,
+ 						snprintf(bit_name, 30,
+ 							 p_aeu->bit_name, num);
+ 					else
+-						strncpy(bit_name,
++						strlcpy(bit_name,
+ 							p_aeu->bit_name, 30);
+ 
+ 					/* We now need to pass bitmask in its
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+index 13802b825d65..909422d93903 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+@@ -442,7 +442,7 @@ static void qed_rdma_init_devinfo(struct qed_hwfn *p_hwfn,
+ 	/* Vendor specific information */
+ 	dev->vendor_id = cdev->vendor_id;
+ 	dev->vendor_part_id = cdev->device_id;
+-	dev->hw_ver = 0;
++	dev->hw_ver = cdev->chip_rev;
+ 	dev->fw_ver = (FW_MAJOR_VERSION << 24) | (FW_MINOR_VERSION << 16) |
+ 		      (FW_REVISION_VERSION << 8) | (FW_ENGINEERING_VERSION);
+ 
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index e3850938cf2f..d7bf0ad954b8 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -85,6 +85,8 @@ static void dwmac4_rx_queue_priority(struct mac_device_info *hw,
+ 	u32 value;
+ 
+ 	base_register = (queue < 4) ? GMAC_RXQ_CTRL2 : GMAC_RXQ_CTRL3;
++	if (queue >= 4)
++		queue -= 4;
+ 
+ 	value = readl(ioaddr + base_register);
+ 
+@@ -102,6 +104,8 @@ static void dwmac4_tx_queue_priority(struct mac_device_info *hw,
+ 	u32 value;
+ 
+ 	base_register = (queue < 4) ? GMAC_TXQ_PRTY_MAP0 : GMAC_TXQ_PRTY_MAP1;
++	if (queue >= 4)
++		queue -= 4;
+ 
+ 	value = readl(ioaddr + base_register);
+ 
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+index 64b8cb88ea45..d4bd99770f5d 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+@@ -106,6 +106,8 @@ static void dwxgmac2_rx_queue_prio(struct mac_device_info *hw, u32 prio,
+ 	u32 value, reg;
+ 
+ 	reg = (queue < 4) ? XGMAC_RXQ_CTRL2 : XGMAC_RXQ_CTRL3;
++	if (queue >= 4)
++		queue -= 4;
+ 
+ 	value = readl(ioaddr + reg);
+ 	value &= ~XGMAC_PSRQ(queue);
+@@ -169,6 +171,8 @@ static void dwxgmac2_map_mtl_to_dma(struct mac_device_info *hw, u32 queue,
+ 	u32 value, reg;
+ 
+ 	reg = (queue < 4) ? XGMAC_MTL_RXQ_DMA_MAP0 : XGMAC_MTL_RXQ_DMA_MAP1;
++	if (queue >= 4)
++		queue -= 4;
+ 
+ 	value = readl(ioaddr + reg);
+ 	value &= ~XGMAC_QxMDMACH(queue);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+index 0f0f4b31eb7e..9b5218a8c15b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+@@ -385,6 +385,13 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
+ 		return ERR_PTR(-ENOMEM);
+ 
+ 	*mac = of_get_mac_address(np);
++	if (IS_ERR(*mac)) {
++		if (PTR_ERR(*mac) == -EPROBE_DEFER)
++			return ERR_CAST(*mac);
++
++		*mac = NULL;
++	}
++
+ 	plat->interface = of_get_phy_mode(np);
+ 
+ 	/* Get max speed of operation from device tree */
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+index 58ea18af9813..37c0bc699cd9 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+@@ -37,7 +37,7 @@ static struct stmmac_tc_entry *tc_find_entry(struct stmmac_priv *priv,
+ 		entry = &priv->tc_entries[i];
+ 		if (!entry->in_use && !first && free)
+ 			first = entry;
+-		if (entry->handle == loc && !free)
++		if ((entry->handle == loc) && !free && !entry->is_frag)
+ 			dup = entry;
+ 	}
+ 
+diff --git a/drivers/net/phy/phy_led_triggers.c b/drivers/net/phy/phy_led_triggers.c
+index b86a4b2116f8..59a94e07e7c5 100644
+--- a/drivers/net/phy/phy_led_triggers.c
++++ b/drivers/net/phy/phy_led_triggers.c
+@@ -48,8 +48,9 @@ void phy_led_trigger_change_speed(struct phy_device *phy)
+ 		if (!phy->last_triggered)
+ 			led_trigger_event(&phy->led_link_trigger->trigger,
+ 					  LED_FULL);
++		else
++			led_trigger_event(&phy->last_triggered->trigger, LED_OFF);
+ 
+-		led_trigger_event(&phy->last_triggered->trigger, LED_OFF);
+ 		led_trigger_event(&plt->trigger, LED_FULL);
+ 		phy->last_triggered = plt;
+ 	}
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 8b4ad10cf940..26c5207466af 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1294,6 +1294,7 @@ static const struct usb_device_id products[] = {
+ 	{QMI_FIXED_INTF(0x2001, 0x7e35, 4)},	/* D-Link DWM-222 */
+ 	{QMI_FIXED_INTF(0x2020, 0x2031, 4)},	/* Olicard 600 */
+ 	{QMI_FIXED_INTF(0x2020, 0x2033, 4)},	/* BroadMobi BM806U */
++	{QMI_FIXED_INTF(0x2020, 0x2060, 4)},	/* BroadMobi BM818 */
+ 	{QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
+ 	{QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
+ 	{QMI_FIXED_INTF(0x1199, 0x68a2, 8)},	/* Sierra Wireless MC7710 in QMI mode */
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+index fba242284507..fa81ad67539f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+@@ -1627,6 +1627,8 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans)
+ 	init_completion(&drv->request_firmware_complete);
+ 	INIT_LIST_HEAD(&drv->list);
+ 
++	iwl_load_fw_dbg_tlv(drv->trans->dev, drv->trans);
++
+ #ifdef CONFIG_IWLWIFI_DEBUGFS
+ 	/* Create the device debugfs entries. */
+ 	drv->dbgfs_drv = debugfs_create_dir(dev_name(trans->dev),
+@@ -1647,8 +1649,8 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans)
+ err_fw:
+ #ifdef CONFIG_IWLWIFI_DEBUGFS
+ 	debugfs_remove_recursive(drv->dbgfs_drv);
+-	iwl_fw_dbg_free(drv->trans);
+ #endif
++	iwl_fw_dbg_free(drv->trans);
+ 	kfree(drv);
+ err:
+ 	return ERR_PTR(ret);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 964c7baabede..a6183281ee1e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -207,11 +207,11 @@ static const struct cfg80211_pmsr_capabilities iwl_mvm_pmsr_capa = {
+ 	},
+ };
+ 
+-static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
+-			       enum set_key_cmd cmd,
+-			       struct ieee80211_vif *vif,
+-			       struct ieee80211_sta *sta,
+-			       struct ieee80211_key_conf *key);
++static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
++				 enum set_key_cmd cmd,
++				 struct ieee80211_vif *vif,
++				 struct ieee80211_sta *sta,
++				 struct ieee80211_key_conf *key);
+ 
+ void iwl_mvm_ref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
+ {
+@@ -474,7 +474,19 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
+ 	ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
+ 	ieee80211_hw_set(hw, BUFF_MMPDU_TXQ);
+ 	ieee80211_hw_set(hw, STA_MMPDU_TXQ);
+-	ieee80211_hw_set(hw, TX_AMSDU);
++	/*
++	 * On older devices, enabling TX A-MSDU occasionally leads to
++	 * something getting messed up, the command read from the FIFO
++	 * gets out of sync and isn't a TX command, so that we have an
++	 * assert EDC.
++	 *
++	 * It's not clear where the bug is, but since we didn't used to
++	 * support A-MSDU until moving the mac80211 iTXQs, just leave it
++	 * for older devices. We also don't see this issue on any newer
++	 * devices.
++	 */
++	if (mvm->cfg->device_family >= IWL_DEVICE_FAMILY_9000)
++		ieee80211_hw_set(hw, TX_AMSDU);
+ 	ieee80211_hw_set(hw, TX_FRAG_LIST);
+ 
+ 	if (iwl_mvm_has_tlc_offload(mvm)) {
+@@ -2725,7 +2737,7 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
+ 
+ 		mvmvif->ap_early_keys[i] = NULL;
+ 
+-		ret = iwl_mvm_mac_set_key(hw, SET_KEY, vif, NULL, key);
++		ret = __iwl_mvm_mac_set_key(hw, SET_KEY, vif, NULL, key);
+ 		if (ret)
+ 			goto out_quota_failed;
+ 	}
+@@ -3493,11 +3505,11 @@ static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
+ 	return ret;
+ }
+ 
+-static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
+-			       enum set_key_cmd cmd,
+-			       struct ieee80211_vif *vif,
+-			       struct ieee80211_sta *sta,
+-			       struct ieee80211_key_conf *key)
++static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
++				 enum set_key_cmd cmd,
++				 struct ieee80211_vif *vif,
++				 struct ieee80211_sta *sta,
++				 struct ieee80211_key_conf *key)
+ {
+ 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+ 	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+@@ -3552,8 +3564,6 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
+ 			return -EOPNOTSUPP;
+ 	}
+ 
+-	mutex_lock(&mvm->mutex);
+-
+ 	switch (cmd) {
+ 	case SET_KEY:
+ 		if ((vif->type == NL80211_IFTYPE_ADHOC ||
+@@ -3699,7 +3709,22 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
+ 		ret = -EINVAL;
+ 	}
+ 
++	return ret;
++}
++
++static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
++			       enum set_key_cmd cmd,
++			       struct ieee80211_vif *vif,
++			       struct ieee80211_sta *sta,
++			       struct ieee80211_key_conf *key)
++{
++	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
++	int ret;
++
++	mutex_lock(&mvm->mutex);
++	ret = __iwl_mvm_mac_set_key(hw, cmd, vif, sta, key);
+ 	mutex_unlock(&mvm->mutex);
++
+ 	return ret;
+ }
+ 
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+index ed8fc9a9204c..0c11a219e347 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+@@ -1807,7 +1807,7 @@ iwl_mvm_vif_dbgfs_clean(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+ #endif /* CONFIG_IWLWIFI_DEBUGFS */
+ 
+ /* rate scaling */
+-int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool sync);
++int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq);
+ void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm, u32 rate, bool agg);
+ int rs_pretty_print_rate(char *buf, int bufsz, const u32 rate);
+ void rs_update_last_rssi(struct iwl_mvm *mvm,
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+index 63fdb4e68e9d..01b032f18bc8 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+@@ -1197,6 +1197,27 @@ static u8 rs_get_tid(struct ieee80211_hdr *hdr)
+ 	return tid;
+ }
+ 
++void iwl_mvm_rs_init_wk(struct work_struct *wk)
++{
++	struct iwl_mvm_sta *mvmsta = container_of(wk, struct iwl_mvm_sta,
++						  rs_init_wk);
++	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(mvmsta->vif);
++	struct ieee80211_sta *sta;
++
++	rcu_read_lock();
++
++	sta = rcu_dereference(mvmvif->mvm->fw_id_to_mac_id[mvmsta->sta_id]);
++	if (WARN_ON_ONCE(IS_ERR_OR_NULL(sta))) {
++		rcu_read_unlock();
++		return;
++	}
++
++	iwl_mvm_rs_rate_init(mvmvif->mvm, sta, mvmvif->phy_ctxt->channel->band,
++			     true);
++
++	rcu_read_unlock();
++}
++
+ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ 			  int tid, struct ieee80211_tx_info *info, bool ndp)
+ {
+@@ -1269,7 +1290,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ 		       (unsigned long)(lq_sta->last_tx +
+ 				       (IWL_MVM_RS_IDLE_TIMEOUT * HZ)))) {
+ 		IWL_DEBUG_RATE(mvm, "Tx idle for too long. reinit rs\n");
+-		iwl_mvm_rs_rate_init(mvm, sta, info->band, true);
++		schedule_work(&mvmsta->rs_init_wk);
+ 		return;
+ 	}
+ 	lq_sta->last_tx = jiffies;
+@@ -1305,7 +1326,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ 			IWL_DEBUG_RATE(mvm,
+ 				       "Too many rates mismatch. Send sync LQ. rs_state %d\n",
+ 				       lq_sta->rs_state);
+-			iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, false);
++			iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq);
+ 		}
+ 		/* Regardless, ignore this status info for outdated rate */
+ 		return;
+@@ -1367,7 +1388,8 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ 		if (info->status.ampdu_ack_len == 0)
+ 			info->status.ampdu_len = 1;
+ 
+-		rs_collect_tlc_data(mvm, mvmsta, tid, curr_tbl, tx_resp_rate.index,
++		rs_collect_tlc_data(mvm, mvmsta, tid, curr_tbl,
++				    tx_resp_rate.index,
+ 				    info->status.ampdu_len,
+ 				    info->status.ampdu_ack_len);
+ 
+@@ -1442,16 +1464,24 @@ static void rs_drv_mac80211_tx_status(void *mvm_r,
+ 	struct iwl_op_mode *op_mode = mvm_r;
+ 	struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+ 
+-	if (!iwl_mvm_sta_from_mac80211(sta)->vif)
++	if (!mvmsta->vif)
+ 		return;
+ 
+ 	if (!ieee80211_is_data(hdr->frame_control) ||
+ 	    info->flags & IEEE80211_TX_CTL_NO_ACK)
+ 		return;
+ 
++	/* If it's locked we are in middle of init flow
++	 * just wait for next tx status to update the lq_sta data
++	 */
++	if (!mutex_trylock(&mvmsta->lq_sta.rs_drv.mutex))
++		return;
++
+ 	iwl_mvm_rs_tx_status(mvm, sta, rs_get_tid(hdr), info,
+ 			     ieee80211_is_qos_nullfunc(hdr->frame_control));
++	mutex_unlock(&mvmsta->lq_sta.rs_drv.mutex);
+ }
+ 
+ /*
+@@ -1794,7 +1824,7 @@ static void rs_update_rate_tbl(struct iwl_mvm *mvm,
+ 			       struct iwl_scale_tbl_info *tbl)
+ {
+ 	rs_fill_lq_cmd(mvm, sta, lq_sta, &tbl->rate);
+-	iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, false);
++	iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq);
+ }
+ 
+ static bool rs_tweak_rate_tbl(struct iwl_mvm *mvm,
+@@ -2896,7 +2926,7 @@ void rs_update_last_rssi(struct iwl_mvm *mvm,
+ static void rs_initialize_lq(struct iwl_mvm *mvm,
+ 			     struct ieee80211_sta *sta,
+ 			     struct iwl_lq_sta *lq_sta,
+-			     enum nl80211_band band, bool update)
++			     enum nl80211_band band)
+ {
+ 	struct iwl_scale_tbl_info *tbl;
+ 	struct rs_rate *rate;
+@@ -2926,7 +2956,7 @@ static void rs_initialize_lq(struct iwl_mvm *mvm,
+ 	rs_set_expected_tpt_table(lq_sta, tbl);
+ 	rs_fill_lq_cmd(mvm, sta, lq_sta, rate);
+ 	/* TODO restore station should remember the lq cmd */
+-	iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, !update);
++	iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq);
+ }
+ 
+ static void rs_drv_get_rate(void *mvm_r, struct ieee80211_sta *sta,
+@@ -3179,7 +3209,7 @@ void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm, u32 rate, bool agg)
+  * Called after adding a new station to initialize rate scaling
+  */
+ static void rs_drv_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+-			     enum nl80211_band band, bool update)
++			     enum nl80211_band band)
+ {
+ 	int i, j;
+ 	struct ieee80211_hw *hw = mvm->hw;
+@@ -3259,7 +3289,7 @@ static void rs_drv_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ #ifdef CONFIG_IWLWIFI_DEBUGFS
+ 	iwl_mvm_reset_frame_stats(mvm);
+ #endif
+-	rs_initialize_lq(mvm, sta, lq_sta, band, update);
++	rs_initialize_lq(mvm, sta, lq_sta, band);
+ }
+ 
+ static void rs_drv_rate_update(void *mvm_r,
+@@ -3573,7 +3603,7 @@ static void rs_set_lq_ss_params(struct iwl_mvm *mvm,
+ 
+ 		bfersta_ss_params &= ~LQ_SS_BFER_ALLOWED;
+ 		bfersta_lq_cmd->ss_params = cpu_to_le32(bfersta_ss_params);
+-		iwl_mvm_send_lq_cmd(mvm, bfersta_lq_cmd, false);
++		iwl_mvm_send_lq_cmd(mvm, bfersta_lq_cmd);
+ 
+ 		ss_params |= LQ_SS_BFER_ALLOWED;
+ 		IWL_DEBUG_RATE(mvm,
+@@ -3739,7 +3769,7 @@ static void rs_program_fix_rate(struct iwl_mvm *mvm,
+ 
+ 	if (lq_sta->pers.dbg_fixed_rate) {
+ 		rs_fill_lq_cmd(mvm, NULL, lq_sta, NULL);
+-		iwl_mvm_send_lq_cmd(lq_sta->pers.drv, &lq_sta->lq, false);
++		iwl_mvm_send_lq_cmd(lq_sta->pers.drv, &lq_sta->lq);
+ 	}
+ }
+ 
+@@ -4136,10 +4166,15 @@ static const struct rate_control_ops rs_mvm_ops_drv = {
+ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ 			  enum nl80211_band band, bool update)
+ {
+-	if (iwl_mvm_has_tlc_offload(mvm))
++	if (iwl_mvm_has_tlc_offload(mvm)) {
+ 		rs_fw_rate_init(mvm, sta, band, update);
+-	else
+-		rs_drv_rate_init(mvm, sta, band, update);
++	} else {
++		struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
++
++		mutex_lock(&mvmsta->lq_sta.rs_drv.mutex);
++		rs_drv_rate_init(mvm, sta, band);
++		mutex_unlock(&mvmsta->lq_sta.rs_drv.mutex);
++	}
+ }
+ 
+ int iwl_mvm_rate_control_register(void)
+@@ -4169,7 +4204,7 @@ static int rs_drv_tx_protection(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
+ 			lq->flags &= ~LQ_FLAG_USE_RTS_MSK;
+ 	}
+ 
+-	return iwl_mvm_send_lq_cmd(mvm, lq, false);
++	return iwl_mvm_send_lq_cmd(mvm, lq);
+ }
+ 
+ /**
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+index f7eb60dbaf20..086f47e2a4f0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+@@ -4,7 +4,7 @@
+  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
+  * Copyright(c) 2015 Intel Mobile Communications GmbH
+  * Copyright(c) 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 Intel Corporation
++ * Copyright(c) 2018 - 2019 Intel Corporation
+  *
+  * Contact Information:
+  *  Intel Linux Wireless <linuxwifi@×××××.com>
+@@ -376,6 +376,9 @@ struct iwl_lq_sta {
+ 	/* tx power reduce for this sta */
+ 	int tpc_reduce;
+ 
++	/* avoid races of reinit and update table from rx_tx */
++	struct mutex mutex;
++
+ 	/* persistent fields - initialized only once - keep last! */
+ 	struct lq_sta_pers {
+ #ifdef CONFIG_MAC80211_DEBUGFS
+@@ -440,6 +443,8 @@ struct iwl_mvm_sta;
+ int iwl_mvm_tx_protection(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
+ 			  bool enable);
+ 
++void iwl_mvm_rs_init_wk(struct work_struct *wk);
++
+ #ifdef CONFIG_IWLWIFI_DEBUGFS
+ void iwl_mvm_reset_frame_stats(struct iwl_mvm *mvm);
+ #endif
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index f545a737a92d..22715cdb8317 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -1684,6 +1684,10 @@ int iwl_mvm_add_sta(struct iwl_mvm *mvm,
+ 	 */
+ 	if (iwl_mvm_has_tlc_offload(mvm))
+ 		iwl_mvm_rs_add_sta(mvm, mvm_sta);
++	else
++		mutex_init(&mvm_sta->lq_sta.rs_drv.mutex);
++
++	INIT_WORK(&mvm_sta->rs_init_wk, iwl_mvm_rs_init_wk);
+ 
+ 	iwl_mvm_toggle_tx_ant(mvm, &mvm_sta->tx_ant);
+ 
+@@ -1846,6 +1850,8 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm,
+ 	if (ret)
+ 		return ret;
+ 
++	cancel_work_sync(&mvm_sta->rs_init_wk);
++
+ 	/* flush its queues here since we are freeing mvm_sta */
+ 	ret = iwl_mvm_flush_sta(mvm, mvm_sta, false, 0);
+ 	if (ret)
+@@ -2972,7 +2978,7 @@ out:
+ 	IWL_DEBUG_HT(mvm, "Tx aggregation enabled on ra = %pM tid = %d\n",
+ 		     sta->addr, tid);
+ 
+-	return iwl_mvm_send_lq_cmd(mvm, &mvmsta->lq_sta.rs_drv.lq, false);
++	return iwl_mvm_send_lq_cmd(mvm, &mvmsta->lq_sta.rs_drv.lq);
+ }
+ 
+ static void iwl_mvm_unreserve_agg_queue(struct iwl_mvm *mvm,
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+index b4d4071b865d..6e93c30492b7 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+@@ -421,6 +421,7 @@ struct iwl_mvm_sta {
+ 		struct iwl_lq_sta_rs_fw rs_fw;
+ 		struct iwl_lq_sta rs_drv;
+ 	} lq_sta;
++	struct work_struct rs_init_wk;
+ 	struct ieee80211_vif *vif;
+ 	struct iwl_mvm_key_pn __rcu *ptk_pn[4];
+ 	struct iwl_mvm_rxq_dup_data *dup_data;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+index cc56ab88fb43..a71277de2e0e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+@@ -641,12 +641,12 @@ int iwl_mvm_reconfig_scd(struct iwl_mvm *mvm, int queue, int fifo, int sta_id,
+  * this case to clear the state indicating that station creation is in
+  * progress.
+  */
+-int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool sync)
++int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq)
+ {
+ 	struct iwl_host_cmd cmd = {
+ 		.id = LQ_CMD,
+ 		.len = { sizeof(struct iwl_lq_cmd), },
+-		.flags = sync ? 0 : CMD_ASYNC,
++		.flags = CMD_ASYNC,
+ 		.data = { lq, },
+ 	};
+ 
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 1c699a9fa866..faec05ab4275 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3615,10 +3615,12 @@ static int hwsim_dump_radio_nl(struct sk_buff *skb,
+ 		hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
+ 				  cb->nlh->nlmsg_seq, &hwsim_genl_family,
+ 				  NLM_F_MULTI, HWSIM_CMD_GET_RADIO);
+-		if (!hdr)
++		if (hdr) {
++			genl_dump_check_consistent(cb, hdr);
++			genlmsg_end(skb, hdr);
++		} else {
+ 			res = -EMSGSIZE;
+-		genl_dump_check_consistent(cb, hdr);
+-		genlmsg_end(skb, hdr);
++		}
+ 	}
+ 
+ done:
+diff --git a/drivers/nfc/st-nci/se.c b/drivers/nfc/st-nci/se.c
+index c3e10b6ab3a4..f25f1ec5f9e9 100644
+--- a/drivers/nfc/st-nci/se.c
++++ b/drivers/nfc/st-nci/se.c
+@@ -333,6 +333,8 @@ static int st_nci_hci_connectivity_event_received(struct nci_dev *ndev,
+ 
+ 		transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev,
+ 					    skb->len - 2, GFP_KERNEL);
++		if (!transaction)
++			return -ENOMEM;
+ 
+ 		transaction->aid_len = skb->data[1];
+ 		memcpy(transaction->aid, &skb->data[2], transaction->aid_len);
+diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c
+index 06fc542fd198..6586378cacb0 100644
+--- a/drivers/nfc/st21nfca/se.c
++++ b/drivers/nfc/st21nfca/se.c
+@@ -317,6 +317,8 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host,
+ 
+ 		transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev,
+ 						   skb->len - 2, GFP_KERNEL);
++		if (!transaction)
++			return -ENOMEM;
+ 
+ 		transaction->aid_len = skb->data[1];
+ 		memcpy(transaction->aid, &skb->data[2],
+diff --git a/drivers/nvmem/nvmem-sysfs.c b/drivers/nvmem/nvmem-sysfs.c
+index 6f303b91f6e7..9e0c429cd08a 100644
+--- a/drivers/nvmem/nvmem-sysfs.c
++++ b/drivers/nvmem/nvmem-sysfs.c
+@@ -224,10 +224,17 @@ int nvmem_sysfs_setup_compat(struct nvmem_device *nvmem,
+ 	if (!config->base_dev)
+ 		return -EINVAL;
+ 
+-	if (nvmem->read_only)
+-		nvmem->eeprom = bin_attr_ro_root_nvmem;
+-	else
+-		nvmem->eeprom = bin_attr_rw_root_nvmem;
++	if (nvmem->read_only) {
++		if (config->root_only)
++			nvmem->eeprom = bin_attr_ro_root_nvmem;
++		else
++			nvmem->eeprom = bin_attr_ro_nvmem;
++	} else {
++		if (config->root_only)
++			nvmem->eeprom = bin_attr_rw_root_nvmem;
++		else
++			nvmem->eeprom = bin_attr_rw_nvmem;
++	}
+ 	nvmem->eeprom.attr.name = "eeprom";
+ 	nvmem->eeprom.size = nvmem->size;
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
+index 152053361862..989506bd90b1 100644
+--- a/drivers/regulator/axp20x-regulator.c
++++ b/drivers/regulator/axp20x-regulator.c
+@@ -174,14 +174,14 @@
+ #define AXP803_DCDC5_1140mV_STEPS	35
+ #define AXP803_DCDC5_1140mV_END		\
+ 	(AXP803_DCDC5_1140mV_START + AXP803_DCDC5_1140mV_STEPS)
+-#define AXP803_DCDC5_NUM_VOLTAGES	68
++#define AXP803_DCDC5_NUM_VOLTAGES	69
+ 
+ #define AXP803_DCDC6_600mV_START	0x00
+ #define AXP803_DCDC6_600mV_STEPS	50
+ #define AXP803_DCDC6_600mV_END		\
+ 	(AXP803_DCDC6_600mV_START + AXP803_DCDC6_600mV_STEPS)
+ #define AXP803_DCDC6_1120mV_START	0x33
+-#define AXP803_DCDC6_1120mV_STEPS	14
++#define AXP803_DCDC6_1120mV_STEPS	20
+ #define AXP803_DCDC6_1120mV_END		\
+ 	(AXP803_DCDC6_1120mV_START + AXP803_DCDC6_1120mV_STEPS)
+ #define AXP803_DCDC6_NUM_VOLTAGES	72
+@@ -240,7 +240,7 @@
+ #define AXP806_DCDCA_600mV_END		\
+ 	(AXP806_DCDCA_600mV_START + AXP806_DCDCA_600mV_STEPS)
+ #define AXP806_DCDCA_1120mV_START	0x33
+-#define AXP806_DCDCA_1120mV_STEPS	14
++#define AXP806_DCDCA_1120mV_STEPS	20
+ #define AXP806_DCDCA_1120mV_END		\
+ 	(AXP806_DCDCA_1120mV_START + AXP806_DCDCA_1120mV_STEPS)
+ #define AXP806_DCDCA_NUM_VOLTAGES	72
+@@ -774,8 +774,8 @@ static const struct regulator_linear_range axp806_dcdcd_ranges[] = {
+ 			       AXP806_DCDCD_600mV_END,
+ 			       20000),
+ 	REGULATOR_LINEAR_RANGE(1600000,
+-			       AXP806_DCDCD_600mV_START,
+-			       AXP806_DCDCD_600mV_END,
++			       AXP806_DCDCD_1600mV_START,
++			       AXP806_DCDCD_1600mV_END,
+ 			       100000),
+ };
+ 
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 3fe3029617a8..aa3bfc20b737 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -7032,6 +7032,9 @@ static inline int ufshcd_config_vreg_lpm(struct ufs_hba *hba,
+ static inline int ufshcd_config_vreg_hpm(struct ufs_hba *hba,
+ 					 struct ufs_vreg *vreg)
+ {
++	if (!vreg)
++		return 0;
++
+ 	return ufshcd_config_vreg_load(hba->dev, vreg, vreg->max_uA);
+ }
+ 
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index af3f37ba82c8..1f32c9e3ca65 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1453,6 +1453,14 @@ static const struct pci_device_id pxa2xx_spi_pci_compound_match[] = {
+ 	{ PCI_VDEVICE(INTEL, 0x02aa), LPSS_CNL_SSP },
+ 	{ PCI_VDEVICE(INTEL, 0x02ab), LPSS_CNL_SSP },
+ 	{ PCI_VDEVICE(INTEL, 0x02fb), LPSS_CNL_SSP },
++	/* TGL-LP */
++	{ PCI_VDEVICE(INTEL, 0xa0aa), LPSS_CNL_SSP },
++	{ PCI_VDEVICE(INTEL, 0xa0ab), LPSS_CNL_SSP },
++	{ PCI_VDEVICE(INTEL, 0xa0de), LPSS_CNL_SSP },
++	{ PCI_VDEVICE(INTEL, 0xa0df), LPSS_CNL_SSP },
++	{ PCI_VDEVICE(INTEL, 0xa0fb), LPSS_CNL_SSP },
++	{ PCI_VDEVICE(INTEL, 0xa0fd), LPSS_CNL_SSP },
++	{ PCI_VDEVICE(INTEL, 0xa0fe), LPSS_CNL_SSP },
+ 	{ },
+ };
+ 
+@@ -1817,14 +1825,16 @@ static int pxa2xx_spi_probe(struct platform_device *pdev)
+ 	status = devm_spi_register_controller(&pdev->dev, controller);
+ 	if (status != 0) {
+ 		dev_err(&pdev->dev, "problem registering spi controller\n");
+-		goto out_error_clock_enabled;
++		goto out_error_pm_runtime_enabled;
+ 	}
+ 
+ 	return status;
+ 
+-out_error_clock_enabled:
++out_error_pm_runtime_enabled:
+ 	pm_runtime_put_noidle(&pdev->dev);
+ 	pm_runtime_disable(&pdev->dev);
++
++out_error_clock_enabled:
+ 	clk_disable_unprepare(ssp->clk);
+ 
+ out_error_dma_irq_alloc:
+diff --git a/drivers/staging/fbtft/fb_bd663474.c b/drivers/staging/fbtft/fb_bd663474.c
+index b6c6d66e4eb1..e2c7646588f8 100644
+--- a/drivers/staging/fbtft/fb_bd663474.c
++++ b/drivers/staging/fbtft/fb_bd663474.c
+@@ -24,7 +24,7 @@
+ 
+ static int init_display(struct fbtft_par *par)
+ {
+-	if (!par->gpio.cs)
++	if (par->gpio.cs)
+ 		gpiod_set_value(par->gpio.cs, 0);  /* Activate chip */
+ 
+ 	par->fbtftops.reset(par);
+diff --git a/drivers/staging/fbtft/fb_ili9163.c b/drivers/staging/fbtft/fb_ili9163.c
+index d609a2b67db9..fd32376700e2 100644
+--- a/drivers/staging/fbtft/fb_ili9163.c
++++ b/drivers/staging/fbtft/fb_ili9163.c
+@@ -77,7 +77,7 @@ static int init_display(struct fbtft_par *par)
+ {
+ 	par->fbtftops.reset(par);
+ 
+-	if (!par->gpio.cs)
++	if (par->gpio.cs)
+ 		gpiod_set_value(par->gpio.cs, 0);  /* Activate chip */
+ 
+ 	write_reg(par, MIPI_DCS_SOFT_RESET); /* software reset */
+diff --git a/drivers/staging/fbtft/fb_ili9325.c b/drivers/staging/fbtft/fb_ili9325.c
+index b090e7ab6fdd..85e54a10ed72 100644
+--- a/drivers/staging/fbtft/fb_ili9325.c
++++ b/drivers/staging/fbtft/fb_ili9325.c
+@@ -85,7 +85,7 @@ static int init_display(struct fbtft_par *par)
+ {
+ 	par->fbtftops.reset(par);
+ 
+-	if (!par->gpio.cs)
++	if (par->gpio.cs)
+ 		gpiod_set_value(par->gpio.cs, 0);  /* Activate chip */
+ 
+ 	bt &= 0x07;
+diff --git a/drivers/staging/fbtft/fb_s6d1121.c b/drivers/staging/fbtft/fb_s6d1121.c
+index b3d0701880fe..5a129b1352cc 100644
+--- a/drivers/staging/fbtft/fb_s6d1121.c
++++ b/drivers/staging/fbtft/fb_s6d1121.c
+@@ -29,7 +29,7 @@ static int init_display(struct fbtft_par *par)
+ {
+ 	par->fbtftops.reset(par);
+ 
+-	if (!par->gpio.cs)
++	if (par->gpio.cs)
+ 		gpiod_set_value(par->gpio.cs, 0);  /* Activate chip */
+ 
+ 	/* Initialization sequence from Lib_UTFT */
+diff --git a/drivers/staging/fbtft/fb_ssd1289.c b/drivers/staging/fbtft/fb_ssd1289.c
+index bbf75f795234..88a5b6925901 100644
+--- a/drivers/staging/fbtft/fb_ssd1289.c
++++ b/drivers/staging/fbtft/fb_ssd1289.c
+@@ -28,7 +28,7 @@ static int init_display(struct fbtft_par *par)
+ {
+ 	par->fbtftops.reset(par);
+ 
+-	if (!par->gpio.cs)
++	if (par->gpio.cs)
+ 		gpiod_set_value(par->gpio.cs, 0);  /* Activate chip */
+ 
+ 	write_reg(par, 0x00, 0x0001);
+diff --git a/drivers/staging/fbtft/fb_ssd1331.c b/drivers/staging/fbtft/fb_ssd1331.c
+index 4cfe9f8535d0..37622c9462aa 100644
+--- a/drivers/staging/fbtft/fb_ssd1331.c
++++ b/drivers/staging/fbtft/fb_ssd1331.c
+@@ -81,7 +81,7 @@ static void write_reg8_bus8(struct fbtft_par *par, int len, ...)
+ 	va_start(args, len);
+ 
+ 	*buf = (u8)va_arg(args, unsigned int);
+-	if (!par->gpio.dc)
++	if (par->gpio.dc)
+ 		gpiod_set_value(par->gpio.dc, 0);
+ 	ret = par->fbtftops.write(par, par->buf, sizeof(u8));
+ 	if (ret < 0) {
+@@ -104,7 +104,7 @@ static void write_reg8_bus8(struct fbtft_par *par, int len, ...)
+ 			return;
+ 		}
+ 	}
+-	if (!par->gpio.dc)
++	if (par->gpio.dc)
+ 		gpiod_set_value(par->gpio.dc, 1);
+ 	va_end(args);
+ }
+diff --git a/drivers/staging/fbtft/fb_upd161704.c b/drivers/staging/fbtft/fb_upd161704.c
+index 564a38e34440..c77832ae5e5b 100644
+--- a/drivers/staging/fbtft/fb_upd161704.c
++++ b/drivers/staging/fbtft/fb_upd161704.c
+@@ -26,7 +26,7 @@ static int init_display(struct fbtft_par *par)
+ {
+ 	par->fbtftops.reset(par);
+ 
+-	if (!par->gpio.cs)
++	if (par->gpio.cs)
+ 		gpiod_set_value(par->gpio.cs, 0);  /* Activate chip */
+ 
+ 	/* Initialization sequence from Lib_UTFT */
+diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c
+index 2ea814d0dca5..63c65dd67b17 100644
+--- a/drivers/staging/fbtft/fbtft-bus.c
++++ b/drivers/staging/fbtft/fbtft-bus.c
+@@ -135,7 +135,7 @@ int fbtft_write_vmem16_bus8(struct fbtft_par *par, size_t offset, size_t len)
+ 	remain = len / 2;
+ 	vmem16 = (u16 *)(par->info->screen_buffer + offset);
+ 
+-	if (!par->gpio.dc)
++	if (par->gpio.dc)
+ 		gpiod_set_value(par->gpio.dc, 1);
+ 
+ 	/* non buffered write */
+diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c
+index bc750250ccd6..5127de922f6a 100644
+--- a/drivers/staging/fbtft/fbtft-core.c
++++ b/drivers/staging/fbtft/fbtft-core.c
+@@ -916,7 +916,7 @@ static int fbtft_init_display_dt(struct fbtft_par *par)
+ 		return -EINVAL;
+ 
+ 	par->fbtftops.reset(par);
+-	if (!par->gpio.cs)
++	if (par->gpio.cs)
+ 		gpiod_set_value(par->gpio.cs, 0);  /* Activate chip */
+ 
+ 	while (p) {
+@@ -1007,7 +1007,7 @@ int fbtft_init_display(struct fbtft_par *par)
+ 	}
+ 
+ 	par->fbtftops.reset(par);
+-	if (!par->gpio.cs)
++	if (par->gpio.cs)
+ 		gpiod_set_value(par->gpio.cs, 0);  /* Activate chip */
+ 
+ 	i = 0;
+diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
+index a47c541f8006..ba30f4f33e7c 100644
+--- a/fs/ceph/addr.c
++++ b/fs/ceph/addr.c
+@@ -912,8 +912,9 @@ get_more_pages:
+ 			if (page_offset(page) >= ceph_wbc.i_size) {
+ 				dout("%p page eof %llu\n",
+ 				     page, ceph_wbc.i_size);
+-				if (ceph_wbc.size_stable ||
+-				    page_offset(page) >= i_size_read(inode))
++				if ((ceph_wbc.size_stable ||
++				    page_offset(page) >= i_size_read(inode)) &&
++				    clear_page_dirty_for_io(page))
+ 					mapping->a_ops->invalidatepage(page,
+ 								0, PAGE_SIZE);
+ 				unlock_page(page);
+diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
+index ac9b53b89365..5083e238ad15 100644
+--- a/fs/ceph/locks.c
++++ b/fs/ceph/locks.c
+@@ -111,8 +111,7 @@ static int ceph_lock_message(u8 lock_type, u16 operation, struct inode *inode,
+ 		req->r_wait_for_completion = ceph_lock_wait_for_completion;
+ 
+ 	err = ceph_mdsc_do_request(mdsc, inode, req);
+-
+-	if (operation == CEPH_MDS_OP_GETFILELOCK) {
++	if (!err && operation == CEPH_MDS_OP_GETFILELOCK) {
+ 		fl->fl_pid = -le64_to_cpu(req->r_reply_info.filelock_reply->pid);
+ 		if (CEPH_LOCK_SHARED == req->r_reply_info.filelock_reply->type)
+ 			fl->fl_type = F_RDLCK;
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 2ec37dc589a7..42de31d20616 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -3439,7 +3439,15 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len,
+ static inline void smb2_sg_set_buf(struct scatterlist *sg, const void *buf,
+ 				   unsigned int buflen)
+ {
+-	sg_set_page(sg, virt_to_page(buf), buflen, offset_in_page(buf));
++	void *addr;
++	/*
++	 * VMAP_STACK (at least) puts stack into the vmalloc address space
++	 */
++	if (is_vmalloc_addr(buf))
++		addr = vmalloc_to_page(buf);
++	else
++		addr = virt_to_page(buf);
++	sg_set_page(sg, addr, buflen, offset_in_page(buf));
+ }
+ 
+ /* Assumes the first rqst has a transform header as the first iov.
+@@ -4015,7 +4023,6 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
+ {
+ 	int ret, length;
+ 	char *buf = server->smallbuf;
+-	char *tmpbuf;
+ 	struct smb2_sync_hdr *shdr;
+ 	unsigned int pdu_length = server->pdu_size;
+ 	unsigned int buf_size;
+@@ -4045,18 +4052,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
+ 		return length;
+ 
+ 	next_is_large = server->large_buf;
+- one_more:
++one_more:
+ 	shdr = (struct smb2_sync_hdr *)buf;
+ 	if (shdr->NextCommand) {
+-		if (next_is_large) {
+-			tmpbuf = server->bigbuf;
++		if (next_is_large)
+ 			next_buffer = (char *)cifs_buf_get();
+-		} else {
+-			tmpbuf = server->smallbuf;
++		else
+ 			next_buffer = (char *)cifs_small_buf_get();
+-		}
+ 		memcpy(next_buffer,
+-		       tmpbuf + le32_to_cpu(shdr->NextCommand),
++		       buf + le32_to_cpu(shdr->NextCommand),
+ 		       pdu_length - le32_to_cpu(shdr->NextCommand));
+ 	}
+ 
+@@ -4085,12 +4089,21 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
+ 		pdu_length -= le32_to_cpu(shdr->NextCommand);
+ 		server->large_buf = next_is_large;
+ 		if (next_is_large)
+-			server->bigbuf = next_buffer;
++			server->bigbuf = buf = next_buffer;
+ 		else
+-			server->smallbuf = next_buffer;
+-
+-		buf += le32_to_cpu(shdr->NextCommand);
++			server->smallbuf = buf = next_buffer;
+ 		goto one_more;
++	} else if (ret != 0) {
++		/*
++		 * ret != 0 here means that we didn't get to handle_mid() thus
++		 * server->smallbuf and server->bigbuf are still valid. We need
++		 * to free next_buffer because it is not going to be used
++		 * anywhere.
++		 */
++		if (next_is_large)
++			free_rsp_buf(CIFS_LARGE_BUFFER, next_buffer);
++		else
++			free_rsp_buf(CIFS_SMALL_BUFFER, next_buffer);
+ 	}
+ 
+ 	return ret;
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 61018559e8fe..03cd8f5bba85 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -618,6 +618,13 @@ static void io_put_req(struct io_kiocb *req)
+ 		io_free_req(req);
+ }
+ 
++static unsigned io_cqring_events(struct io_cq_ring *ring)
++{
++	/* See comment at the top of this file */
++	smp_rmb();
++	return READ_ONCE(ring->r.tail) - READ_ONCE(ring->r.head);
++}
++
+ /*
+  * Find and free completed poll iocbs
+  */
+@@ -709,7 +716,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
+ static int io_iopoll_getevents(struct io_ring_ctx *ctx, unsigned int *nr_events,
+ 				long min)
+ {
+-	while (!list_empty(&ctx->poll_list)) {
++	while (!list_empty(&ctx->poll_list) && !need_resched()) {
+ 		int ret;
+ 
+ 		ret = io_do_iopoll(ctx, nr_events, min);
+@@ -736,6 +743,12 @@ static void io_iopoll_reap_events(struct io_ring_ctx *ctx)
+ 		unsigned int nr_events = 0;
+ 
+ 		io_iopoll_getevents(ctx, &nr_events, 1);
++
++		/*
++		 * Ensure we allow local-to-the-cpu processing to take place,
++		 * in this case we need to ensure that we reap all events.
++		 */
++		cond_resched();
+ 	}
+ 	mutex_unlock(&ctx->uring_lock);
+ }
+@@ -743,11 +756,42 @@ static void io_iopoll_reap_events(struct io_ring_ctx *ctx)
+ static int io_iopoll_check(struct io_ring_ctx *ctx, unsigned *nr_events,
+ 			   long min)
+ {
+-	int ret = 0;
++	int iters, ret = 0;
+ 
++	/*
++	 * We disallow the app entering submit/complete with polling, but we
++	 * still need to lock the ring to prevent racing with polled issue
++	 * that got punted to a workqueue.
++	 */
++	mutex_lock(&ctx->uring_lock);
++
++	iters = 0;
+ 	do {
+ 		int tmin = 0;
+ 
++		/*
++		 * Don't enter poll loop if we already have events pending.
++		 * If we do, we can potentially be spinning for commands that
++		 * already triggered a CQE (eg in error).
++		 */
++		if (io_cqring_events(ctx->cq_ring))
++			break;
++
++		/*
++		 * If a submit got punted to a workqueue, we can have the
++		 * application entering polling for a command before it gets
++		 * issued. That app will hold the uring_lock for the duration
++		 * of the poll right here, so we need to take a breather every
++		 * now and then to ensure that the issue has a chance to add
++		 * the poll to the issued list. Otherwise we can spin here
++		 * forever, while the workqueue is stuck trying to acquire the
++		 * very same mutex.
++		 */
++		if (!(++iters & 7)) {
++			mutex_unlock(&ctx->uring_lock);
++			mutex_lock(&ctx->uring_lock);
++		}
++
+ 		if (*nr_events < min)
+ 			tmin = min - *nr_events;
+ 
+@@ -757,6 +801,7 @@ static int io_iopoll_check(struct io_ring_ctx *ctx, unsigned *nr_events,
+ 		ret = 0;
+ 	} while (min && !*nr_events && !need_resched());
+ 
++	mutex_unlock(&ctx->uring_lock);
+ 	return ret;
+ }
+ 
+@@ -2073,15 +2118,7 @@ static int io_sq_thread(void *data)
+ 			unsigned nr_events = 0;
+ 
+ 			if (ctx->flags & IORING_SETUP_IOPOLL) {
+-				/*
+-				 * We disallow the app entering submit/complete
+-				 * with polling, but we still need to lock the
+-				 * ring to prevent racing with polled issue
+-				 * that got punted to a workqueue.
+-				 */
+-				mutex_lock(&ctx->uring_lock);
+ 				io_iopoll_check(ctx, &nr_events, 0);
+-				mutex_unlock(&ctx->uring_lock);
+ 			} else {
+ 				/*
+ 				 * Normal IO, just pretend everything completed.
+@@ -2216,13 +2253,6 @@ static int io_ring_submit(struct io_ring_ctx *ctx, unsigned int to_submit)
+ 	return submit;
+ }
+ 
+-static unsigned io_cqring_events(struct io_cq_ring *ring)
+-{
+-	/* See comment at the top of this file */
+-	smp_rmb();
+-	return READ_ONCE(ring->r.tail) - READ_ONCE(ring->r.head);
+-}
+-
+ /*
+  * Wait until events become available, if we don't already have some. The
+  * application must reap them itself, as they reside on the shared cq ring.
+@@ -2978,9 +3008,7 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit,
+ 		min_complete = min(min_complete, ctx->cq_entries);
+ 
+ 		if (ctx->flags & IORING_SETUP_IOPOLL) {
+-			mutex_lock(&ctx->uring_lock);
+ 			ret = io_iopoll_check(ctx, &nr_events, min_complete);
+-			mutex_unlock(&ctx->uring_lock);
+ 		} else {
+ 			ret = io_cqring_wait(ctx, min_complete, sig, sigsz);
+ 		}
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 0af854cce8ff..071b90a45933 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -1046,6 +1046,22 @@ void nfs_test_expired_all_delegations(struct nfs_client *clp)
+ 	nfs4_schedule_state_manager(clp);
+ }
+ 
++static void
++nfs_delegation_test_free_expired(struct inode *inode,
++		nfs4_stateid *stateid,
++		const struct cred *cred)
++{
++	struct nfs_server *server = NFS_SERVER(inode);
++	const struct nfs4_minor_version_ops *ops = server->nfs_client->cl_mvops;
++	int status;
++
++	if (!cred)
++		return;
++	status = ops->test_and_free_expired(server, stateid, cred);
++	if (status == -NFS4ERR_EXPIRED || status == -NFS4ERR_BAD_STATEID)
++		nfs_remove_bad_delegation(inode, stateid);
++}
++
+ /**
+  * nfs_reap_expired_delegations - reap expired delegations
+  * @clp: nfs_client to process
+@@ -1057,7 +1073,6 @@ void nfs_test_expired_all_delegations(struct nfs_client *clp)
+  */
+ void nfs_reap_expired_delegations(struct nfs_client *clp)
+ {
+-	const struct nfs4_minor_version_ops *ops = clp->cl_mvops;
+ 	struct nfs_delegation *delegation;
+ 	struct nfs_server *server;
+ 	struct inode *inode;
+@@ -1088,11 +1103,7 @@ restart:
+ 			nfs4_stateid_copy(&stateid, &delegation->stateid);
+ 			clear_bit(NFS_DELEGATION_TEST_EXPIRED, &delegation->flags);
+ 			rcu_read_unlock();
+-			if (cred != NULL &&
+-			    ops->test_and_free_expired(server, &stateid, cred) < 0) {
+-				nfs_revoke_delegation(inode, &stateid);
+-				nfs_inode_find_state_and_recover(inode, &stateid);
+-			}
++			nfs_delegation_test_free_expired(inode, &stateid, cred);
+ 			put_cred(cred);
+ 			if (nfs4_server_rebooted(clp)) {
+ 				nfs_inode_mark_test_expired_delegation(server,inode);
+diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
+index 53507aa96b0b..3800ab6f08fa 100644
+--- a/fs/nfs/fscache.c
++++ b/fs/nfs/fscache.c
+@@ -114,6 +114,10 @@ void nfs_fscache_get_super_cookie(struct super_block *sb, const char *uniq, int
+ 	struct rb_node **p, *parent;
+ 	int diff;
+ 
++	nfss->fscache_key = NULL;
++	nfss->fscache = NULL;
++	if (!(nfss->options & NFS_OPTION_FSCACHE))
++		return;
+ 	if (!uniq) {
+ 		uniq = "";
+ 		ulen = 1;
+@@ -226,10 +230,11 @@ void nfs_fscache_release_super_cookie(struct super_block *sb)
+ void nfs_fscache_init_inode(struct inode *inode)
+ {
+ 	struct nfs_fscache_inode_auxdata auxdata;
++	struct nfs_server *nfss = NFS_SERVER(inode);
+ 	struct nfs_inode *nfsi = NFS_I(inode);
+ 
+ 	nfsi->fscache = NULL;
+-	if (!S_ISREG(inode->i_mode))
++	if (!(nfss->fscache && S_ISREG(inode->i_mode)))
+ 		return;
+ 
+ 	memset(&auxdata, 0, sizeof(auxdata));
+diff --git a/fs/nfs/fscache.h b/fs/nfs/fscache.h
+index 25a75e40d91d..ad041cfbf9ec 100644
+--- a/fs/nfs/fscache.h
++++ b/fs/nfs/fscache.h
+@@ -182,7 +182,7 @@ static inline void nfs_fscache_wait_on_invalidate(struct inode *inode)
+  */
+ static inline const char *nfs_server_fscache_state(struct nfs_server *server)
+ {
+-	if (server->fscache && (server->options & NFS_OPTION_FSCACHE))
++	if (server->fscache)
+ 		return "yes";
+ 	return "no ";
+ }
+diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
+index 8a38a254f516..235919156edd 100644
+--- a/fs/nfs/nfs4_fs.h
++++ b/fs/nfs/nfs4_fs.h
+@@ -465,7 +465,8 @@ static inline void nfs4_schedule_session_recovery(struct nfs4_session *session,
+ 
+ extern struct nfs4_state_owner *nfs4_get_state_owner(struct nfs_server *, const struct cred *, gfp_t);
+ extern void nfs4_put_state_owner(struct nfs4_state_owner *);
+-extern void nfs4_purge_state_owners(struct nfs_server *);
++extern void nfs4_purge_state_owners(struct nfs_server *, struct list_head *);
++extern void nfs4_free_state_owners(struct list_head *head);
+ extern struct nfs4_state * nfs4_get_open_state(struct inode *, struct nfs4_state_owner *);
+ extern void nfs4_put_open_state(struct nfs4_state *);
+ extern void nfs4_close_state(struct nfs4_state *, fmode_t);
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 81b9b6d7927a..208a236dc235 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -758,9 +758,12 @@ out:
+ 
+ static void nfs4_destroy_server(struct nfs_server *server)
+ {
++	LIST_HEAD(freeme);
++
+ 	nfs_server_return_all_delegations(server);
+ 	unset_pnfs_layoutdriver(server);
+-	nfs4_purge_state_owners(server);
++	nfs4_purge_state_owners(server, &freeme);
++	nfs4_free_state_owners(&freeme);
+ }
+ 
+ /*
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 63edda145d1b..2023011c7a8f 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1654,6 +1654,14 @@ static void nfs_state_set_open_stateid(struct nfs4_state *state,
+ 	write_sequnlock(&state->seqlock);
+ }
+ 
++static void nfs_state_clear_open_state_flags(struct nfs4_state *state)
++{
++	clear_bit(NFS_O_RDWR_STATE, &state->flags);
++	clear_bit(NFS_O_WRONLY_STATE, &state->flags);
++	clear_bit(NFS_O_RDONLY_STATE, &state->flags);
++	clear_bit(NFS_OPEN_STATE, &state->flags);
++}
++
+ static void nfs_state_set_delegation(struct nfs4_state *state,
+ 		const nfs4_stateid *deleg_stateid,
+ 		fmode_t fmode)
+@@ -2049,13 +2057,7 @@ static int nfs4_open_recover(struct nfs4_opendata *opendata, struct nfs4_state *
+ {
+ 	int ret;
+ 
+-	/* Don't trigger recovery in nfs_test_and_clear_all_open_stateid */
+-	clear_bit(NFS_O_RDWR_STATE, &state->flags);
+-	clear_bit(NFS_O_WRONLY_STATE, &state->flags);
+-	clear_bit(NFS_O_RDONLY_STATE, &state->flags);
+ 	/* memory barrier prior to reading state->n_* */
+-	clear_bit(NFS_DELEGATED_STATE, &state->flags);
+-	clear_bit(NFS_OPEN_STATE, &state->flags);
+ 	smp_rmb();
+ 	ret = nfs4_open_recover_helper(opendata, FMODE_READ|FMODE_WRITE);
+ 	if (ret != 0)
+@@ -2131,6 +2133,8 @@ static int nfs4_open_reclaim(struct nfs4_state_owner *sp, struct nfs4_state *sta
+ 	ctx = nfs4_state_find_open_context(state);
+ 	if (IS_ERR(ctx))
+ 		return -EAGAIN;
++	clear_bit(NFS_DELEGATED_STATE, &state->flags);
++	nfs_state_clear_open_state_flags(state);
+ 	ret = nfs4_do_open_reclaim(ctx, state);
+ 	put_nfs_open_context(ctx);
+ 	return ret;
+@@ -2146,6 +2150,7 @@ static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct
+ 		case -ENOENT:
+ 		case -EAGAIN:
+ 		case -ESTALE:
++		case -ETIMEDOUT:
+ 			break;
+ 		case -NFS4ERR_BADSESSION:
+ 		case -NFS4ERR_BADSLOT:
+@@ -2466,6 +2471,7 @@ static int nfs4_run_open_task(struct nfs4_opendata *data,
+ 	if (!ctx) {
+ 		nfs4_init_sequence(&o_arg->seq_args, &o_res->seq_res, 1, 1);
+ 		data->is_recover = true;
++		task_setup_data.flags |= RPC_TASK_TIMEOUT;
+ 	} else {
+ 		nfs4_init_sequence(&o_arg->seq_args, &o_res->seq_res, 1, 0);
+ 		pnfs_lgopen_prepare(data, ctx);
+@@ -2672,6 +2678,7 @@ static int nfs40_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *st
+ {
+ 	/* NFSv4.0 doesn't allow for delegation recovery on open expire */
+ 	nfs40_clear_delegation_stateid(state);
++	nfs_state_clear_open_state_flags(state);
+ 	return nfs4_open_expired(sp, state);
+ }
+ 
+@@ -2714,13 +2721,13 @@ out_free:
+ 	return -NFS4ERR_EXPIRED;
+ }
+ 
+-static void nfs41_check_delegation_stateid(struct nfs4_state *state)
++static int nfs41_check_delegation_stateid(struct nfs4_state *state)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+ 	nfs4_stateid stateid;
+ 	struct nfs_delegation *delegation;
+ 	const struct cred *cred = NULL;
+-	int status;
++	int status, ret = NFS_OK;
+ 
+ 	/* Get the delegation credential for use by test/free_stateid */
+ 	rcu_read_lock();
+@@ -2728,20 +2735,15 @@ static void nfs41_check_delegation_stateid(struct nfs4_state *state)
+ 	if (delegation == NULL) {
+ 		rcu_read_unlock();
+ 		nfs_state_clear_delegation(state);
+-		return;
++		return NFS_OK;
+ 	}
+ 
+ 	nfs4_stateid_copy(&stateid, &delegation->stateid);
+-	if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags)) {
+-		rcu_read_unlock();
+-		nfs_state_clear_delegation(state);
+-		return;
+-	}
+ 
+ 	if (!test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED,
+ 				&delegation->flags)) {
+ 		rcu_read_unlock();
+-		return;
++		return NFS_OK;
+ 	}
+ 
+ 	if (delegation->cred)
+@@ -2751,9 +2753,24 @@ static void nfs41_check_delegation_stateid(struct nfs4_state *state)
+ 	trace_nfs4_test_delegation_stateid(state, NULL, status);
+ 	if (status == -NFS4ERR_EXPIRED || status == -NFS4ERR_BAD_STATEID)
+ 		nfs_finish_clear_delegation_stateid(state, &stateid);
++	else
++		ret = status;
+ 
+-	if (delegation->cred)
+-		put_cred(cred);
++	put_cred(cred);
++	return ret;
++}
++
++static void nfs41_delegation_recover_stateid(struct nfs4_state *state)
++{
++	nfs4_stateid tmp;
++
++	if (test_bit(NFS_DELEGATED_STATE, &state->flags) &&
++	    nfs4_copy_delegation_stateid(state->inode, state->state,
++				&tmp, NULL) &&
++	    nfs4_stateid_match_other(&state->stateid, &tmp))
++		nfs_state_set_delegation(state, &tmp, state->state);
++	else
++		nfs_state_clear_delegation(state);
+ }
+ 
+ /**
+@@ -2823,21 +2840,12 @@ static int nfs41_check_open_stateid(struct nfs4_state *state)
+ 	const struct cred *cred = state->owner->so_cred;
+ 	int status;
+ 
+-	if (test_bit(NFS_OPEN_STATE, &state->flags) == 0) {
+-		if (test_bit(NFS_DELEGATED_STATE, &state->flags) == 0)  {
+-			if (nfs4_have_delegation(state->inode, state->state))
+-				return NFS_OK;
+-			return -NFS4ERR_OPENMODE;
+-		}
++	if (test_bit(NFS_OPEN_STATE, &state->flags) == 0)
+ 		return -NFS4ERR_BAD_STATEID;
+-	}
+ 	status = nfs41_test_and_free_expired_stateid(server, stateid, cred);
+ 	trace_nfs4_test_open_stateid(state, NULL, status);
+ 	if (status == -NFS4ERR_EXPIRED || status == -NFS4ERR_BAD_STATEID) {
+-		clear_bit(NFS_O_RDONLY_STATE, &state->flags);
+-		clear_bit(NFS_O_WRONLY_STATE, &state->flags);
+-		clear_bit(NFS_O_RDWR_STATE, &state->flags);
+-		clear_bit(NFS_OPEN_STATE, &state->flags);
++		nfs_state_clear_open_state_flags(state);
+ 		stateid->type = NFS4_INVALID_STATEID_TYPE;
+ 		return status;
+ 	}
+@@ -2850,7 +2858,11 @@ static int nfs41_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *st
+ {
+ 	int status;
+ 
+-	nfs41_check_delegation_stateid(state);
++	status = nfs41_check_delegation_stateid(state);
++	if (status != NFS_OK)
++		return status;
++	nfs41_delegation_recover_stateid(state);
++
+ 	status = nfs41_check_expired_locks(state);
+ 	if (status != NFS_OK)
+ 		return status;
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index e2e3c4f04d3e..0e69cd846afb 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -624,24 +624,39 @@ void nfs4_put_state_owner(struct nfs4_state_owner *sp)
+ /**
+  * nfs4_purge_state_owners - Release all cached state owners
+  * @server: nfs_server with cached state owners to release
++ * @head: resulting list of state owners
+  *
+  * Called at umount time.  Remaining state owners will be on
+  * the LRU with ref count of zero.
++ * Note that the state owners are not freed, but are added
++ * to the list @head, which can later be used as an argument
++ * to nfs4_free_state_owners.
+  */
+-void nfs4_purge_state_owners(struct nfs_server *server)
++void nfs4_purge_state_owners(struct nfs_server *server, struct list_head *head)
+ {
+ 	struct nfs_client *clp = server->nfs_client;
+ 	struct nfs4_state_owner *sp, *tmp;
+-	LIST_HEAD(doomed);
+ 
+ 	spin_lock(&clp->cl_lock);
+ 	list_for_each_entry_safe(sp, tmp, &server->state_owners_lru, so_lru) {
+-		list_move(&sp->so_lru, &doomed);
++		list_move(&sp->so_lru, head);
+ 		nfs4_remove_state_owner_locked(sp);
+ 	}
+ 	spin_unlock(&clp->cl_lock);
++}
+ 
+-	list_for_each_entry_safe(sp, tmp, &doomed, so_lru) {
++/**
++ * nfs4_purge_state_owners - Release all cached state owners
++ * @head: resulting list of state owners
++ *
++ * Frees a list of state owners that was generated by
++ * nfs4_purge_state_owners
++ */
++void nfs4_free_state_owners(struct list_head *head)
++{
++	struct nfs4_state_owner *sp, *tmp;
++
++	list_for_each_entry_safe(sp, tmp, head, so_lru) {
+ 		list_del(&sp->so_lru);
+ 		nfs4_free_state_owner(sp);
+ 	}
+@@ -1513,6 +1528,7 @@ restart:
+ 		switch (status) {
+ 		case 0:
+ 			break;
++		case -ETIMEDOUT:
+ 		case -ESTALE:
+ 		case -NFS4ERR_ADMIN_REVOKED:
+ 		case -NFS4ERR_STALE_STATEID:
+@@ -1606,6 +1622,7 @@ static int __nfs4_reclaim_open_state(struct nfs4_state_owner *sp, struct nfs4_st
+ static int nfs4_reclaim_open_state(struct nfs4_state_owner *sp, const struct nfs4_state_recovery_ops *ops)
+ {
+ 	struct nfs4_state *state;
++	unsigned int loop = 0;
+ 	int status = 0;
+ 
+ 	/* Note: we rely on the sp->so_states list being ordered 
+@@ -1632,8 +1649,10 @@ restart:
+ 
+ 		switch (status) {
+ 		default:
+-			if (status >= 0)
++			if (status >= 0) {
++				loop = 0;
+ 				break;
++			}
+ 			printk(KERN_ERR "NFS: %s: unhandled error %d\n", __func__, status);
+ 			/* Fall through */
+ 		case -ENOENT:
+@@ -1647,6 +1666,10 @@ restart:
+ 			break;
+ 		case -EAGAIN:
+ 			ssleep(1);
++			if (loop++ < 10) {
++				set_bit(ops->state_flag_bit, &state->flags);
++				break;
++			}
+ 			/* Fall through */
+ 		case -NFS4ERR_ADMIN_REVOKED:
+ 		case -NFS4ERR_STALE_STATEID:
+@@ -1659,11 +1682,13 @@ restart:
+ 		case -NFS4ERR_EXPIRED:
+ 		case -NFS4ERR_NO_GRACE:
+ 			nfs4_state_mark_reclaim_nograce(sp->so_server->nfs_client, state);
++			/* Fall through */
+ 		case -NFS4ERR_STALE_CLIENTID:
+ 		case -NFS4ERR_BADSESSION:
+ 		case -NFS4ERR_BADSLOT:
+ 		case -NFS4ERR_BAD_HIGH_SLOT:
+ 		case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION:
++		case -ETIMEDOUT:
+ 			goto out_err;
+ 		}
+ 		nfs4_put_open_state(state);
+@@ -1857,12 +1882,13 @@ static int nfs4_do_reclaim(struct nfs_client *clp, const struct nfs4_state_recov
+ 	struct nfs4_state_owner *sp;
+ 	struct nfs_server *server;
+ 	struct rb_node *pos;
++	LIST_HEAD(freeme);
+ 	int status = 0;
+ 
+ restart:
+ 	rcu_read_lock();
+ 	list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
+-		nfs4_purge_state_owners(server);
++		nfs4_purge_state_owners(server, &freeme);
+ 		spin_lock(&clp->cl_lock);
+ 		for (pos = rb_first(&server->state_owners);
+ 		     pos != NULL;
+@@ -1891,6 +1917,7 @@ restart:
+ 		spin_unlock(&clp->cl_lock);
+ 	}
+ 	rcu_read_unlock();
++	nfs4_free_state_owners(&freeme);
+ 	return 0;
+ }
+ 
+@@ -1946,7 +1973,6 @@ static int nfs4_handle_reclaim_lease_error(struct nfs_client *clp, int status)
+ 		return -EPERM;
+ 	case -EACCES:
+ 	case -NFS4ERR_DELAY:
+-	case -ETIMEDOUT:
+ 	case -EAGAIN:
+ 		ssleep(1);
+ 		break;
+@@ -2575,7 +2601,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ 		}
+ 
+ 		/* Now recover expired state... */
+-		if (test_and_clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state)) {
++		if (test_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state)) {
+ 			section = "reclaim nograce";
+ 			status = nfs4_do_reclaim(clp,
+ 				clp->cl_mvops->nograce_recovery_ops);
+@@ -2583,6 +2609,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ 				continue;
+ 			if (status < 0)
+ 				goto out_error;
++			clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state);
+ 		}
+ 
+ 		nfs4_end_drain_session(clp);
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index f88ddac2dcdf..4d375b517eda 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -2239,6 +2239,7 @@ nfs_compare_remount_data(struct nfs_server *nfss,
+ 	    data->acdirmin != nfss->acdirmin / HZ ||
+ 	    data->acdirmax != nfss->acdirmax / HZ ||
+ 	    data->timeo != (10U * nfss->client->cl_timeout->to_initval / HZ) ||
++	    (data->options & NFS_OPTION_FSCACHE) != (nfss->options & NFS_OPTION_FSCACHE) ||
+ 	    data->nfs_server.port != nfss->port ||
+ 	    data->nfs_server.addrlen != nfss->nfs_client->cl_addrlen ||
+ 	    !rpc_cmp_addr((struct sockaddr *)&data->nfs_server.address,
+diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
+index ccbdbd62f0d8..fe6d804a38dc 100644
+--- a/fs/userfaultfd.c
++++ b/fs/userfaultfd.c
+@@ -880,6 +880,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
+ 	/* len == 0 means wake all */
+ 	struct userfaultfd_wake_range range = { .len = 0, };
+ 	unsigned long new_flags;
++	bool still_valid;
+ 
+ 	WRITE_ONCE(ctx->released, true);
+ 
+@@ -895,8 +896,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
+ 	 * taking the mmap_sem for writing.
+ 	 */
+ 	down_write(&mm->mmap_sem);
+-	if (!mmget_still_valid(mm))
+-		goto skip_mm;
++	still_valid = mmget_still_valid(mm);
+ 	prev = NULL;
+ 	for (vma = mm->mmap; vma; vma = vma->vm_next) {
+ 		cond_resched();
+@@ -907,19 +907,20 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
+ 			continue;
+ 		}
+ 		new_flags = vma->vm_flags & ~(VM_UFFD_MISSING | VM_UFFD_WP);
+-		prev = vma_merge(mm, prev, vma->vm_start, vma->vm_end,
+-				 new_flags, vma->anon_vma,
+-				 vma->vm_file, vma->vm_pgoff,
+-				 vma_policy(vma),
+-				 NULL_VM_UFFD_CTX);
+-		if (prev)
+-			vma = prev;
+-		else
+-			prev = vma;
++		if (still_valid) {
++			prev = vma_merge(mm, prev, vma->vm_start, vma->vm_end,
++					 new_flags, vma->anon_vma,
++					 vma->vm_file, vma->vm_pgoff,
++					 vma_policy(vma),
++					 NULL_VM_UFFD_CTX);
++			if (prev)
++				vma = prev;
++			else
++				prev = vma;
++		}
+ 		vma->vm_flags = new_flags;
+ 		vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
+ 	}
+-skip_mm:
+ 	up_write(&mm->mmap_sem);
+ 	mmput(mm);
+ wakeup:
+diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
+index 74047bd0c1ae..e427ad097e2e 100644
+--- a/fs/xfs/xfs_iops.c
++++ b/fs/xfs/xfs_iops.c
+@@ -803,6 +803,7 @@ xfs_setattr_nonsize(
+ 
+ out_cancel:
+ 	xfs_trans_cancel(tp);
++	xfs_iunlock(ip, XFS_ILOCK_EXCL);
+ out_dqrele:
+ 	xfs_qm_dqrele(udqp);
+ 	xfs_qm_dqrele(gdqp);
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 8fb5be3ca0ca..8b13bd05befa 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -7254,6 +7254,21 @@ void cfg80211_pmsr_complete(struct wireless_dev *wdev,
+ 			    struct cfg80211_pmsr_request *req,
+ 			    gfp_t gfp);
+ 
++/**
++ * cfg80211_iftype_allowed - check whether the interface can be allowed
++ * @wiphy: the wiphy
++ * @iftype: interface type
++ * @is_4addr: use_4addr flag, must be '0' when check_swif is '1'
++ * @check_swif: check iftype against software interfaces
++ *
++ * Check whether the interface is allowed to operate; additionally, this API
++ * can be used to check iftype against the software interfaces when
++ * check_swif is '1'.
++ */
++bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype,
++			     bool is_4addr, u8 check_swif);
++
++
+ /* Logging, debugging and troubleshooting/diagnostic helpers. */
+ 
+ /* wiphy_printk helpers, similar to dev_printk */
+diff --git a/include/sound/simple_card_utils.h b/include/sound/simple_card_utils.h
+index 3429888347e7..b3609e4c46e0 100644
+--- a/include/sound/simple_card_utils.h
++++ b/include/sound/simple_card_utils.h
+@@ -149,6 +149,10 @@ inline void asoc_simple_debug_dai(struct asoc_simple_priv *priv,
+ {
+ 	struct device *dev = simple_priv_to_dev(priv);
+ 
++	/* dai might be NULL */
++	if (!dai)
++		return;
++
+ 	if (dai->name)
+ 		dev_dbg(dev, "%s dai name = %s\n",
+ 			name, dai->name);
+diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
+index cc1d060cbf13..fa06b528c73c 100644
+--- a/include/trace/events/rxrpc.h
++++ b/include/trace/events/rxrpc.h
+@@ -498,10 +498,10 @@ rxrpc_tx_points;
+ #define E_(a, b)	{ a, b }
+ 
+ TRACE_EVENT(rxrpc_local,
+-	    TP_PROTO(struct rxrpc_local *local, enum rxrpc_local_trace op,
++	    TP_PROTO(unsigned int local_debug_id, enum rxrpc_local_trace op,
+ 		     int usage, const void *where),
+ 
+-	    TP_ARGS(local, op, usage, where),
++	    TP_ARGS(local_debug_id, op, usage, where),
+ 
+ 	    TP_STRUCT__entry(
+ 		    __field(unsigned int,	local		)
+@@ -511,7 +511,7 @@ TRACE_EVENT(rxrpc_local,
+ 			     ),
+ 
+ 	    TP_fast_assign(
+-		    __entry->local = local->debug_id;
++		    __entry->local = local_debug_id;
+ 		    __entry->op = op;
+ 		    __entry->usage = usage;
+ 		    __entry->where = where;
+diff --git a/include/uapi/sound/sof/fw.h b/include/uapi/sound/sof/fw.h
+index 1afca973eb09..e9f697467a86 100644
+--- a/include/uapi/sound/sof/fw.h
++++ b/include/uapi/sound/sof/fw.h
+@@ -13,6 +13,8 @@
+ #ifndef __INCLUDE_UAPI_SOF_FW_H__
+ #define __INCLUDE_UAPI_SOF_FW_H__
+ 
++#include <linux/types.h>
++
+ #define SND_SOF_FW_SIG_SIZE	4
+ #define SND_SOF_FW_ABI		1
+ #define SND_SOF_FW_SIG		"Reef"
+@@ -46,8 +48,8 @@ enum snd_sof_fw_blk_type {
+ 
+ struct snd_sof_blk_hdr {
+ 	enum snd_sof_fw_blk_type type;
+-	uint32_t size;		/* bytes minus this header */
+-	uint32_t offset;	/* offset from base */
++	__u32 size;		/* bytes minus this header */
++	__u32 offset;		/* offset from base */
+ } __packed;
+ 
+ /*
+@@ -61,8 +63,8 @@ enum snd_sof_fw_mod_type {
+ 
+ struct snd_sof_mod_hdr {
+ 	enum snd_sof_fw_mod_type type;
+-	uint32_t size;		/* bytes minus this header */
+-	uint32_t num_blocks;	/* number of blocks */
++	__u32 size;		/* bytes minus this header */
++	__u32 num_blocks;	/* number of blocks */
+ } __packed;
+ 
+ /*
+@@ -70,9 +72,9 @@ struct snd_sof_mod_hdr {
+  */
+ struct snd_sof_fw_header {
+ 	unsigned char sig[SND_SOF_FW_SIG_SIZE]; /* "Reef" */
+-	uint32_t file_size;	/* size of file minus this header */
+-	uint32_t num_modules;	/* number of modules */
+-	uint32_t abi;		/* version of header format */
++	__u32 file_size;	/* size of file minus this header */
++	__u32 num_modules;	/* number of modules */
++	__u32 abi;		/* version of header format */
+ } __packed;
+ 
+ #endif
+diff --git a/include/uapi/sound/sof/header.h b/include/uapi/sound/sof/header.h
+index 7868990b0d6f..5f4518e7a972 100644
+--- a/include/uapi/sound/sof/header.h
++++ b/include/uapi/sound/sof/header.h
+@@ -9,6 +9,8 @@
+ #ifndef __INCLUDE_UAPI_SOUND_SOF_USER_HEADER_H__
+ #define __INCLUDE_UAPI_SOUND_SOF_USER_HEADER_H__
+ 
++#include <linux/types.h>
++
+ /*
+  * Header for all non IPC ABI data.
+  *
+@@ -16,12 +18,12 @@
+  * Used by any bespoke component data structures or binary blobs.
+  */
+ struct sof_abi_hdr {
+-	uint32_t magic;		/**< 'S', 'O', 'F', '\0' */
+-	uint32_t type;		/**< component specific type */
+-	uint32_t size;		/**< size in bytes of data excl. this struct */
+-	uint32_t abi;		/**< SOF ABI version */
+-	uint32_t reserved[4];	/**< reserved for future use */
+-	uint32_t data[0];	/**< Component data - opaque to core */
++	__u32 magic;		/**< 'S', 'O', 'F', '\0' */
++	__u32 type;		/**< component specific type */
++	__u32 size;		/**< size in bytes of data excl. this struct */
++	__u32 abi;		/**< SOF ABI version */
++	__u32 reserved[4];	/**< reserved for future use */
++	__u32 data[0];		/**< Component data - opaque to core */
+ }  __packed;
+ 
+ #endif
+diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
+index 9484e88dabc2..9be995fc3c5a 100644
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -295,6 +295,18 @@ static void irq_sysfs_add(int irq, struct irq_desc *desc)
+ 	}
+ }
+ 
++static void irq_sysfs_del(struct irq_desc *desc)
++{
++	/*
++	 * If irq_sysfs_init() has not yet been invoked (early boot), then
++	 * irq_kobj_base is NULL and the descriptor was never added.
++	 * kobject_del() complains about a object with no parent, so make
++	 * it conditional.
++	 */
++	if (irq_kobj_base)
++		kobject_del(&desc->kobj);
++}
++
+ static int __init irq_sysfs_init(void)
+ {
+ 	struct irq_desc *desc;
+@@ -325,6 +337,7 @@ static struct kobj_type irq_kobj_type = {
+ };
+ 
+ static void irq_sysfs_add(int irq, struct irq_desc *desc) {}
++static void irq_sysfs_del(struct irq_desc *desc) {}
+ 
+ #endif /* CONFIG_SYSFS */
+ 
+@@ -438,7 +451,7 @@ static void free_desc(unsigned int irq)
+ 	 * The sysfs entry must be serialized against a concurrent
+ 	 * irq_sysfs_init() as well.
+ 	 */
+-	kobject_del(&desc->kobj);
++	irq_sysfs_del(desc);
+ 	delete_irq_desc(irq);
+ 
+ 	/*
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 43901fa3f269..1c66480afda8 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -2088,17 +2088,13 @@ retry:
+ 	}
+ 
+ 	deactivate_task(rq, next_task, 0);
+-	sub_running_bw(&next_task->dl, &rq->dl);
+-	sub_rq_bw(&next_task->dl, &rq->dl);
+ 	set_task_cpu(next_task, later_rq->cpu);
+-	add_rq_bw(&next_task->dl, &later_rq->dl);
+ 
+ 	/*
+ 	 * Update the later_rq clock here, because the clock is used
+ 	 * by the cpufreq_update_util() inside __add_running_bw().
+ 	 */
+ 	update_rq_clock(later_rq);
+-	add_running_bw(&next_task->dl, &later_rq->dl);
+ 	activate_task(later_rq, next_task, ENQUEUE_NOCLOCK);
+ 	ret = 1;
+ 
+@@ -2186,11 +2182,7 @@ static void pull_dl_task(struct rq *this_rq)
+ 			resched = true;
+ 
+ 			deactivate_task(src_rq, p, 0);
+-			sub_running_bw(&p->dl, &src_rq->dl);
+-			sub_rq_bw(&p->dl, &src_rq->dl);
+ 			set_task_cpu(p, this_cpu);
+-			add_rq_bw(&p->dl, &this_rq->dl);
+-			add_running_bw(&p->dl, &this_rq->dl);
+ 			activate_task(this_rq, p, 0);
+ 			dmin = p->dl.deadline;
+ 
+diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
+index 7acc632c3b82..6e52b67b420e 100644
+--- a/kernel/sched/psi.c
++++ b/kernel/sched/psi.c
+@@ -1051,7 +1051,7 @@ struct psi_trigger *psi_trigger_create(struct psi_group *group,
+ 
+ 	if (!rcu_access_pointer(group->poll_kworker)) {
+ 		struct sched_param param = {
+-			.sched_priority = MAX_RT_PRIO - 1,
++			.sched_priority = 1,
+ 		};
+ 		struct kthread_worker *kworker;
+ 
+@@ -1061,7 +1061,7 @@ struct psi_trigger *psi_trigger_create(struct psi_group *group,
+ 			mutex_unlock(&group->trigger_lock);
+ 			return ERR_CAST(kworker);
+ 		}
+-		sched_setscheduler(kworker->task, SCHED_FIFO, &param);
++		sched_setscheduler_nocheck(kworker->task, SCHED_FIFO, &param);
+ 		kthread_init_delayed_work(&group->poll_work,
+ 				psi_poll_work);
+ 		rcu_assign_pointer(group->poll_kworker, kworker);
+@@ -1131,7 +1131,15 @@ static void psi_trigger_destroy(struct kref *ref)
+ 	 * deadlock while waiting for psi_poll_work to acquire trigger_lock
+ 	 */
+ 	if (kworker_to_destroy) {
++		/*
++		 * After the RCU grace period has expired, the worker
++		 * can no longer be found through group->poll_kworker.
++		 * But it might have been already scheduled before
++		 * that - deschedule it cleanly before destroying it.
++		 */
+ 		kthread_cancel_delayed_work_sync(&group->poll_work);
++		atomic_set(&group->poll_scheduled, 0);
++
+ 		kthread_destroy_worker(kworker_to_destroy);
+ 	}
+ 	kfree(t);
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 885642c82aaa..83236e22a8a8 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -32,6 +32,7 @@
+ #include <linux/shmem_fs.h>
+ #include <linux/oom.h>
+ #include <linux/numa.h>
++#include <linux/page_owner.h>
+ 
+ #include <asm/tlb.h>
+ #include <asm/pgalloc.h>
+@@ -2500,6 +2501,9 @@ static void __split_huge_page(struct page *page, struct list_head *list,
+ 	}
+ 
+ 	ClearPageCompound(head);
++
++	split_page_owner(head, HPAGE_PMD_ORDER);
++
+ 	/* See comment in __split_huge_page_tail() */
+ 	if (PageAnon(head)) {
+ 		/* Additional pin to swap cache */
+diff --git a/mm/kasan/common.c b/mm/kasan/common.c
+index 242fdc01aaa9..874d75bb65eb 100644
+--- a/mm/kasan/common.c
++++ b/mm/kasan/common.c
+@@ -409,8 +409,14 @@ static inline bool shadow_invalid(u8 tag, s8 shadow_byte)
+ 	if (IS_ENABLED(CONFIG_KASAN_GENERIC))
+ 		return shadow_byte < 0 ||
+ 			shadow_byte >= KASAN_SHADOW_SCALE_SIZE;
+-	else
+-		return tag != (u8)shadow_byte;
++
++	/* else CONFIG_KASAN_SW_TAGS: */
++	if ((u8)shadow_byte == KASAN_TAG_INVALID)
++		return true;
++	if ((tag != KASAN_TAG_KERNEL) && (tag != (u8)shadow_byte))
++		return true;
++
++	return false;
+ }
+ 
+ static bool __kasan_slab_free(struct kmem_cache *cache, void *object,
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 8f5dabfaf94d..bb783c27ba21 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -3150,6 +3150,60 @@ static u64 mem_cgroup_read_u64(struct cgroup_subsys_state *css,
+ 	}
+ }
+ 
++static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg)
++{
++	unsigned long stat[MEMCG_NR_STAT];
++	struct mem_cgroup *mi;
++	int node, cpu, i;
++
++	for (i = 0; i < MEMCG_NR_STAT; i++)
++		stat[i] = 0;
++
++	for_each_online_cpu(cpu)
++		for (i = 0; i < MEMCG_NR_STAT; i++)
++			stat[i] += raw_cpu_read(memcg->vmstats_percpu->stat[i]);
++
++	for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
++		for (i = 0; i < MEMCG_NR_STAT; i++)
++			atomic_long_add(stat[i], &mi->vmstats[i]);
++
++	for_each_node(node) {
++		struct mem_cgroup_per_node *pn = memcg->nodeinfo[node];
++		struct mem_cgroup_per_node *pi;
++
++		for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
++			stat[i] = 0;
++
++		for_each_online_cpu(cpu)
++			for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
++				stat[i] += raw_cpu_read(
++					pn->lruvec_stat_cpu->count[i]);
++
++		for (pi = pn; pi; pi = parent_nodeinfo(pi, node))
++			for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
++				atomic_long_add(stat[i], &pi->lruvec_stat[i]);
++	}
++}
++
++static void memcg_flush_percpu_vmevents(struct mem_cgroup *memcg)
++{
++	unsigned long events[NR_VM_EVENT_ITEMS];
++	struct mem_cgroup *mi;
++	int cpu, i;
++
++	for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
++		events[i] = 0;
++
++	for_each_online_cpu(cpu)
++		for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
++			events[i] += raw_cpu_read(
++				memcg->vmstats_percpu->events[i]);
++
++	for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
++		for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
++			atomic_long_add(events[i], &mi->vmevents[i]);
++}
++
+ #ifdef CONFIG_MEMCG_KMEM
+ static int memcg_online_kmem(struct mem_cgroup *memcg)
+ {
+@@ -4551,6 +4605,12 @@ static void __mem_cgroup_free(struct mem_cgroup *memcg)
+ {
+ 	int node;
+ 
++	/*
++	 * Flush percpu vmstats and vmevents to guarantee the value correctness
++	 * on parent's and all ancestor levels.
++	 */
++	memcg_flush_percpu_vmstats(memcg);
++	memcg_flush_percpu_vmevents(memcg);
+ 	for_each_node(node)
+ 		free_mem_cgroup_per_node_info(memcg, node);
+ 	free_percpu(memcg->vmstats_percpu);
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 8e3bc949ebcc..81177ed87a38 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -2167,27 +2167,12 @@ static int move_freepages(struct zone *zone,
+ 	unsigned int order;
+ 	int pages_moved = 0;
+ 
+-#ifndef CONFIG_HOLES_IN_ZONE
+-	/*
+-	 * page_zone is not safe to call in this context when
+-	 * CONFIG_HOLES_IN_ZONE is set. This bug check is probably redundant
+-	 * anyway as we check zone boundaries in move_freepages_block().
+-	 * Remove at a later date when no bug reports exist related to
+-	 * grouping pages by mobility
+-	 */
+-	VM_BUG_ON(pfn_valid(page_to_pfn(start_page)) &&
+-	          pfn_valid(page_to_pfn(end_page)) &&
+-	          page_zone(start_page) != page_zone(end_page));
+-#endif
+ 	for (page = start_page; page <= end_page;) {
+ 		if (!pfn_valid_within(page_to_pfn(page))) {
+ 			page++;
+ 			continue;
+ 		}
+ 
+-		/* Make sure we are not inadvertently changing nodes */
+-		VM_BUG_ON_PAGE(page_to_nid(page) != zone_to_nid(zone), page);
+-
+ 		if (!PageBuddy(page)) {
+ 			/*
+ 			 * We assume that pages that could be isolated for
+@@ -2202,6 +2187,10 @@ static int move_freepages(struct zone *zone,
+ 			continue;
+ 		}
+ 
++		/* Make sure we are not inadvertently changing nodes */
++		VM_BUG_ON_PAGE(page_to_nid(page) != zone_to_nid(zone), page);
++		VM_BUG_ON_PAGE(page_zone(page) != zone, page);
++
+ 		order = page_order(page);
+ 		move_to_free_area(page, &zone->free_area[order], migratetype);
+ 		page += 1 << order;
+diff --git a/mm/z3fold.c b/mm/z3fold.c
+index c4debbe683eb..46686d0e3df8 100644
+--- a/mm/z3fold.c
++++ b/mm/z3fold.c
+@@ -41,6 +41,7 @@
+ #include <linux/workqueue.h>
+ #include <linux/slab.h>
+ #include <linux/spinlock.h>
++#include <linux/wait.h>
+ #include <linux/zpool.h>
+ 
+ /*
+@@ -144,6 +145,8 @@ struct z3fold_header {
+  * @release_wq:	workqueue for safe page release
+  * @work:	work_struct for safe page release
+  * @inode:	inode for z3fold pseudo filesystem
++ * @destroying: bool to stop migration once we start destruction
++ * @isolated: int to count the number of pages currently in isolation
+  *
+  * This structure is allocated at pool creation time and maintains metadata
+  * pertaining to a particular z3fold pool.
+@@ -162,8 +165,11 @@ struct z3fold_pool {
+ 	const struct zpool_ops *zpool_ops;
+ 	struct workqueue_struct *compact_wq;
+ 	struct workqueue_struct *release_wq;
++	struct wait_queue_head isolate_wait;
+ 	struct work_struct work;
+ 	struct inode *inode;
++	bool destroying;
++	int isolated;
+ };
+ 
+ /*
+@@ -771,6 +777,7 @@ static struct z3fold_pool *z3fold_create_pool(const char *name, gfp_t gfp,
+ 		goto out_c;
+ 	spin_lock_init(&pool->lock);
+ 	spin_lock_init(&pool->stale_lock);
++	init_waitqueue_head(&pool->isolate_wait);
+ 	pool->unbuddied = __alloc_percpu(sizeof(struct list_head)*NCHUNKS, 2);
+ 	if (!pool->unbuddied)
+ 		goto out_pool;
+@@ -810,6 +817,15 @@ out:
+ 	return NULL;
+ }
+ 
++static bool pool_isolated_are_drained(struct z3fold_pool *pool)
++{
++	bool ret;
++
++	spin_lock(&pool->lock);
++	ret = pool->isolated == 0;
++	spin_unlock(&pool->lock);
++	return ret;
++}
+ /**
+  * z3fold_destroy_pool() - destroys an existing z3fold pool
+  * @pool:	the z3fold pool to be destroyed
+@@ -819,6 +835,22 @@ out:
+ static void z3fold_destroy_pool(struct z3fold_pool *pool)
+ {
+ 	kmem_cache_destroy(pool->c_handle);
++	/*
++	 * We set pool-> destroying under lock to ensure that
++	 * z3fold_page_isolate() sees any changes to destroying. This way we
++	 * avoid the need for any memory barriers.
++	 */
++
++	spin_lock(&pool->lock);
++	pool->destroying = true;
++	spin_unlock(&pool->lock);
++
++	/*
++	 * We need to ensure that no pages are being migrated while we destroy
++	 * these workqueues, as migration can queue work on either of the
++	 * workqueues.
++	 */
++	wait_event(pool->isolate_wait, !pool_isolated_are_drained(pool));
+ 
+ 	/*
+ 	 * We need to destroy pool->compact_wq before pool->release_wq,
+@@ -1309,6 +1341,28 @@ static u64 z3fold_get_pool_size(struct z3fold_pool *pool)
+ 	return atomic64_read(&pool->pages_nr);
+ }
+ 
++/*
++ * z3fold_dec_isolated() expects to be called while pool->lock is held.
++ */
++static void z3fold_dec_isolated(struct z3fold_pool *pool)
++{
++	assert_spin_locked(&pool->lock);
++	VM_BUG_ON(pool->isolated <= 0);
++	pool->isolated--;
++
++	/*
++	 * If we have no more isolated pages, we have to see if
++	 * z3fold_destroy_pool() is waiting for a signal.
++	 */
++	if (pool->isolated == 0 && waitqueue_active(&pool->isolate_wait))
++		wake_up_all(&pool->isolate_wait);
++}
++
++static void z3fold_inc_isolated(struct z3fold_pool *pool)
++{
++	pool->isolated++;
++}
++
+ static bool z3fold_page_isolate(struct page *page, isolate_mode_t mode)
+ {
+ 	struct z3fold_header *zhdr;
+@@ -1335,6 +1389,33 @@ static bool z3fold_page_isolate(struct page *page, isolate_mode_t mode)
+ 		spin_lock(&pool->lock);
+ 		if (!list_empty(&page->lru))
+ 			list_del(&page->lru);
++		/*
++		 * We need to check for destruction while holding pool->lock, as
++		 * otherwise destruction could see 0 isolated pages, and
++		 * proceed.
++		 */
++		if (unlikely(pool->destroying)) {
++			spin_unlock(&pool->lock);
++			/*
++			 * If this page isn't stale, somebody else holds a
++			 * reference to it. Let't drop our refcount so that they
++			 * can call the release logic.
++			 */
++			if (unlikely(kref_put(&zhdr->refcount,
++					      release_z3fold_page_locked))) {
++				/*
++				 * If we get here we have kref problems, so we
++				 * should freak out.
++				 */
++				WARN(1, "Z3fold is experiencing kref problems\n");
++				return false;
++			}
++			z3fold_page_unlock(zhdr);
++			return false;
++		}
++
++
++		z3fold_inc_isolated(pool);
+ 		spin_unlock(&pool->lock);
+ 		z3fold_page_unlock(zhdr);
+ 		return true;
+@@ -1408,6 +1489,10 @@ static int z3fold_page_migrate(struct address_space *mapping, struct page *newpa
+ 
+ 	queue_work_on(new_zhdr->cpu, pool->compact_wq, &new_zhdr->work);
+ 
++	spin_lock(&pool->lock);
++	z3fold_dec_isolated(pool);
++	spin_unlock(&pool->lock);
++
+ 	page_mapcount_reset(page);
+ 	unlock_page(page);
+ 	put_page(page);
+@@ -1428,10 +1513,14 @@ static void z3fold_page_putback(struct page *page)
+ 	INIT_LIST_HEAD(&page->lru);
+ 	if (kref_put(&zhdr->refcount, release_z3fold_page_locked)) {
+ 		atomic64_dec(&pool->pages_nr);
++		spin_lock(&pool->lock);
++		z3fold_dec_isolated(pool);
++		spin_unlock(&pool->lock);
+ 		return;
+ 	}
+ 	spin_lock(&pool->lock);
+ 	list_add(&page->lru, &pool->lru);
++	z3fold_dec_isolated(pool);
+ 	spin_unlock(&pool->lock);
+ 	z3fold_page_unlock(zhdr);
+ }
+diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
+index 0787d33b80d8..515b00801af2 100644
+--- a/mm/zsmalloc.c
++++ b/mm/zsmalloc.c
+@@ -53,6 +53,7 @@
+ #include <linux/zpool.h>
+ #include <linux/mount.h>
+ #include <linux/migrate.h>
++#include <linux/wait.h>
+ #include <linux/pagemap.h>
+ #include <linux/fs.h>
+ 
+@@ -267,6 +268,10 @@ struct zs_pool {
+ #ifdef CONFIG_COMPACTION
+ 	struct inode *inode;
+ 	struct work_struct free_work;
++	/* A wait queue for when migration races with async_free_zspage() */
++	struct wait_queue_head migration_wait;
++	atomic_long_t isolated_pages;
++	bool destroying;
+ #endif
+ };
+ 
+@@ -1882,6 +1887,31 @@ static void dec_zspage_isolation(struct zspage *zspage)
+ 	zspage->isolated--;
+ }
+ 
++static void putback_zspage_deferred(struct zs_pool *pool,
++				    struct size_class *class,
++				    struct zspage *zspage)
++{
++	enum fullness_group fg;
++
++	fg = putback_zspage(class, zspage);
++	if (fg == ZS_EMPTY)
++		schedule_work(&pool->free_work);
++
++}
++
++static inline void zs_pool_dec_isolated(struct zs_pool *pool)
++{
++	VM_BUG_ON(atomic_long_read(&pool->isolated_pages) <= 0);
++	atomic_long_dec(&pool->isolated_pages);
++	/*
++	 * There's no possibility of racing, since wait_for_isolated_drain()
++	 * checks the isolated count under &class->lock after enqueuing
++	 * on migration_wait.
++	 */
++	if (atomic_long_read(&pool->isolated_pages) == 0 && pool->destroying)
++		wake_up_all(&pool->migration_wait);
++}
++
+ static void replace_sub_page(struct size_class *class, struct zspage *zspage,
+ 				struct page *newpage, struct page *oldpage)
+ {
+@@ -1951,6 +1981,7 @@ static bool zs_page_isolate(struct page *page, isolate_mode_t mode)
+ 	 */
+ 	if (!list_empty(&zspage->list) && !is_zspage_isolated(zspage)) {
+ 		get_zspage_mapping(zspage, &class_idx, &fullness);
++		atomic_long_inc(&pool->isolated_pages);
+ 		remove_zspage(class, zspage, fullness);
+ 	}
+ 
+@@ -2050,8 +2081,16 @@ static int zs_page_migrate(struct address_space *mapping, struct page *newpage,
+ 	 * Page migration is done so let's putback isolated zspage to
+ 	 * the list if @page is final isolated subpage in the zspage.
+ 	 */
+-	if (!is_zspage_isolated(zspage))
+-		putback_zspage(class, zspage);
++	if (!is_zspage_isolated(zspage)) {
++		/*
++		 * We cannot race with zs_destroy_pool() here because we wait
++		 * for isolation to hit zero before we start destroying.
++		 * Also, we ensure that everyone can see pool->destroying before
++		 * we start waiting.
++		 */
++		putback_zspage_deferred(pool, class, zspage);
++		zs_pool_dec_isolated(pool);
++	}
+ 
+ 	reset_page(page);
+ 	put_page(page);
+@@ -2097,13 +2136,12 @@ static void zs_page_putback(struct page *page)
+ 	spin_lock(&class->lock);
+ 	dec_zspage_isolation(zspage);
+ 	if (!is_zspage_isolated(zspage)) {
+-		fg = putback_zspage(class, zspage);
+ 		/*
+ 		 * Due to page_lock, we cannot free zspage immediately
+ 		 * so let's defer.
+ 		 */
+-		if (fg == ZS_EMPTY)
+-			schedule_work(&pool->free_work);
++		putback_zspage_deferred(pool, class, zspage);
++		zs_pool_dec_isolated(pool);
+ 	}
+ 	spin_unlock(&class->lock);
+ }
+@@ -2127,8 +2165,36 @@ static int zs_register_migration(struct zs_pool *pool)
+ 	return 0;
+ }
+ 
++static bool pool_isolated_are_drained(struct zs_pool *pool)
++{
++	return atomic_long_read(&pool->isolated_pages) == 0;
++}
++
++/* Function for resolving migration */
++static void wait_for_isolated_drain(struct zs_pool *pool)
++{
++
++	/*
++	 * We're in the process of destroying the pool, so there are no
++	 * active allocations. zs_page_isolate() fails for completely free
++	 * zspages, so we need only wait for the zs_pool's isolated
++	 * count to hit zero.
++	 */
++	wait_event(pool->migration_wait,
++		   pool_isolated_are_drained(pool));
++}
++
+ static void zs_unregister_migration(struct zs_pool *pool)
+ {
++	pool->destroying = true;
++	/*
++	 * We need a memory barrier here to ensure global visibility of
++	 * pool->destroying. Thus pool->isolated pages will either be 0 in which
++	 * case we don't care, or it will be > 0 and pool->destroying will
++	 * ensure that we wake up once isolation hits 0.
++	 */
++	smp_mb();
++	wait_for_isolated_drain(pool); /* This can block */
+ 	flush_work(&pool->free_work);
+ 	iput(pool->inode);
+ }
+@@ -2366,6 +2432,8 @@ struct zs_pool *zs_create_pool(const char *name)
+ 	if (!pool->name)
+ 		goto err;
+ 
++	init_waitqueue_head(&pool->migration_wait);
++
+ 	if (create_cache(pool))
+ 		goto err;
+ 
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 1fa9ac483173..c8177a89f52c 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -2267,8 +2267,10 @@ static int compat_do_replace(struct net *net, void __user *user,
+ 	state.buf_kern_len = size64;
+ 
+ 	ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
+-	if (WARN_ON(ret < 0))
++	if (WARN_ON(ret < 0)) {
++		vfree(entries_tmp);
+ 		goto out_unlock;
++	}
+ 
+ 	vfree(entries_tmp);
+ 	tmp.entries_size = size64;
+diff --git a/net/can/gw.c b/net/can/gw.c
+index 5275ddf580bc..72711053ebe6 100644
+--- a/net/can/gw.c
++++ b/net/can/gw.c
+@@ -1046,32 +1046,50 @@ static __init int cgw_module_init(void)
+ 	pr_info("can: netlink gateway (rev " CAN_GW_VERSION ") max_hops=%d\n",
+ 		max_hops);
+ 
+-	register_pernet_subsys(&cangw_pernet_ops);
++	ret = register_pernet_subsys(&cangw_pernet_ops);
++	if (ret)
++		return ret;
++
++	ret = -ENOMEM;
+ 	cgw_cache = kmem_cache_create("can_gw", sizeof(struct cgw_job),
+ 				      0, 0, NULL);
+-
+ 	if (!cgw_cache)
+-		return -ENOMEM;
++		goto out_cache_create;
+ 
+ 	/* set notifier */
+ 	notifier.notifier_call = cgw_notifier;
+-	register_netdevice_notifier(&notifier);
++	ret = register_netdevice_notifier(&notifier);
++	if (ret)
++		goto out_register_notifier;
+ 
+ 	ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_GETROUTE,
+ 				   NULL, cgw_dump_jobs, 0);
+-	if (ret) {
+-		unregister_netdevice_notifier(&notifier);
+-		kmem_cache_destroy(cgw_cache);
+-		return -ENOBUFS;
+-	}
+-
+-	/* Only the first call to rtnl_register_module can fail */
+-	rtnl_register_module(THIS_MODULE, PF_CAN, RTM_NEWROUTE,
+-			     cgw_create_job, NULL, 0);
+-	rtnl_register_module(THIS_MODULE, PF_CAN, RTM_DELROUTE,
+-			     cgw_remove_job, NULL, 0);
++	if (ret)
++		goto out_rtnl_register1;
++
++	ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_NEWROUTE,
++				   cgw_create_job, NULL, 0);
++	if (ret)
++		goto out_rtnl_register2;
++	ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_DELROUTE,
++				   cgw_remove_job, NULL, 0);
++	if (ret)
++		goto out_rtnl_register3;
+ 
+ 	return 0;
++
++out_rtnl_register3:
++	rtnl_unregister(PF_CAN, RTM_NEWROUTE);
++out_rtnl_register2:
++	rtnl_unregister(PF_CAN, RTM_GETROUTE);
++out_rtnl_register1:
++	unregister_netdevice_notifier(&notifier);
++out_register_notifier:
++	kmem_cache_destroy(cgw_cache);
++out_cache_create:
++	unregister_pernet_subsys(&cangw_pernet_ops);
++
++	return ret;
+ }
+ 
+ static __exit void cgw_module_exit(void)
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index 9a8eca5eda65..565ea889673c 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -1504,7 +1504,7 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc,
+ 	struct ceph_osds up, acting;
+ 	bool force_resend = false;
+ 	bool unpaused = false;
+-	bool legacy_change;
++	bool legacy_change = false;
+ 	bool split = false;
+ 	bool sort_bitwise = ceph_osdmap_flag(osdc, CEPH_OSDMAP_SORTBITWISE);
+ 	bool recovery_deletes = ceph_osdmap_flag(osdc,
+@@ -1592,15 +1592,14 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc,
+ 		t->osd = acting.primary;
+ 	}
+ 
+-	if (unpaused || legacy_change || force_resend ||
+-	    (split && con && CEPH_HAVE_FEATURE(con->peer_features,
+-					       RESEND_ON_SPLIT)))
++	if (unpaused || legacy_change || force_resend || split)
+ 		ct_res = CALC_TARGET_NEED_RESEND;
+ 	else
+ 		ct_res = CALC_TARGET_NO_ACTION;
+ 
+ out:
+-	dout("%s t %p -> ct_res %d osd %d\n", __func__, t, ct_res, t->osd);
++	dout("%s t %p -> %d%d%d%d ct_res %d osd%d\n", __func__, t, unpaused,
++	     legacy_change, force_resend, split, ct_res, t->osd);
+ 	return ct_res;
+ }
+ 
+diff --git a/net/core/sock_map.c b/net/core/sock_map.c
+index be6092ac69f8..8a4a45e7c29d 100644
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -252,6 +252,8 @@ static void sock_map_free(struct bpf_map *map)
+ 	raw_spin_unlock_bh(&stab->lock);
+ 	rcu_read_unlock();
+ 
++	synchronize_rcu();
++
+ 	bpf_map_area_free(stab->sks);
+ 	kfree(stab);
+ }
+@@ -281,16 +283,20 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
+ 			     struct sock **psk)
+ {
+ 	struct sock *sk;
++	int err = 0;
+ 
+ 	raw_spin_lock_bh(&stab->lock);
+ 	sk = *psk;
+ 	if (!sk_test || sk_test == sk)
+-		*psk = NULL;
++		sk = xchg(psk, NULL);
++
++	if (likely(sk))
++		sock_map_unref(sk, psk);
++	else
++		err = -EINVAL;
++
+ 	raw_spin_unlock_bh(&stab->lock);
+-	if (unlikely(!sk))
+-		return -EINVAL;
+-	sock_map_unref(sk, psk);
+-	return 0;
++	return err;
+ }
+ 
+ static void sock_map_delete_from_link(struct bpf_map *map, struct sock *sk,
+@@ -333,6 +339,7 @@ static int sock_map_update_common(struct bpf_map *map, u32 idx,
+ 				  struct sock *sk, u64 flags)
+ {
+ 	struct bpf_stab *stab = container_of(map, struct bpf_stab, map);
++	struct inet_connection_sock *icsk = inet_csk(sk);
+ 	struct sk_psock_link *link;
+ 	struct sk_psock *psock;
+ 	struct sock *osk;
+@@ -343,6 +350,8 @@ static int sock_map_update_common(struct bpf_map *map, u32 idx,
+ 		return -EINVAL;
+ 	if (unlikely(idx >= map->max_entries))
+ 		return -E2BIG;
++	if (unlikely(icsk->icsk_ulp_data))
++		return -EINVAL;
+ 
+ 	link = sk_psock_init_link();
+ 	if (!link)
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 1b224fa27367..ad1e58184c4e 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -3796,9 +3796,7 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+ 	}
+ 
+ 	/* Always allow software iftypes */
+-	if (local->hw.wiphy->software_iftypes & BIT(iftype) ||
+-	    (iftype == NL80211_IFTYPE_AP_VLAN &&
+-	     local->hw.wiphy->flags & WIPHY_FLAG_4ADDR_AP)) {
++	if (cfg80211_iftype_allowed(local->hw.wiphy, iftype, 0, 1)) {
+ 		if (radar_detect)
+ 			return -EINVAL;
+ 		return 0;
+@@ -3833,7 +3831,8 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+ 
+ 		if (sdata_iter == sdata ||
+ 		    !ieee80211_sdata_running(sdata_iter) ||
+-		    local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
++		    cfg80211_iftype_allowed(local->hw.wiphy,
++					    wdev_iter->iftype, 0, 1))
+ 			continue;
+ 
+ 		params.iftype_num[wdev_iter->iftype]++;
+diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+index b73c37b3a791..cfe7b556775f 100644
+--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
++++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+@@ -227,7 +227,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
+ 
+ 	e.id = ip_to_id(map, ip);
+ 
+-	if (opt->flags & IPSET_DIM_ONE_SRC)
++	if (opt->flags & IPSET_DIM_TWO_SRC)
+ 		ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
+ 	else
+ 		ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index 16afa0df4004..e103c875383a 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -1161,7 +1161,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
+ 		return -ENOENT;
+ 
+ 	write_lock_bh(&ip_set_ref_lock);
+-	if (set->ref != 0) {
++	if (set->ref != 0 || set->ref_netlink != 0) {
+ 		ret = -IPSET_ERR_REFERENCED;
+ 		goto out;
+ 	}
+diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
+index faf59b6a998f..24d8f4df4230 100644
+--- a/net/netfilter/ipset/ip_set_hash_ipmac.c
++++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
+@@ -89,15 +89,11 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
+ 	struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } };
+ 	struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
+ 
+-	 /* MAC can be src only */
+-	if (!(opt->flags & IPSET_DIM_TWO_SRC))
+-		return 0;
+-
+ 	if (skb_mac_header(skb) < skb->head ||
+ 	    (skb_mac_header(skb) + ETH_HLEN) > skb->data)
+ 		return -EINVAL;
+ 
+-	if (opt->flags & IPSET_DIM_ONE_SRC)
++	if (opt->flags & IPSET_DIM_TWO_SRC)
+ 		ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
+ 	else
+ 		ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
+diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
+index d09eaf153544..8c9bd3ae9edf 100644
+--- a/net/rxrpc/af_rxrpc.c
++++ b/net/rxrpc/af_rxrpc.c
+@@ -193,7 +193,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len)
+ 
+ service_in_use:
+ 	write_unlock(&local->services_lock);
+-	rxrpc_put_local(local);
++	rxrpc_unuse_local(local);
+ 	ret = -EADDRINUSE;
+ error_unlock:
+ 	release_sock(&rx->sk);
+@@ -901,7 +901,7 @@ static int rxrpc_release_sock(struct sock *sk)
+ 	rxrpc_queue_work(&rxnet->service_conn_reaper);
+ 	rxrpc_queue_work(&rxnet->client_conn_reaper);
+ 
+-	rxrpc_put_local(rx->local);
++	rxrpc_unuse_local(rx->local);
+ 	rx->local = NULL;
+ 	key_put(rx->key);
+ 	rx->key = NULL;
+diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
+index 80335b4ee4fd..9796c45d2f6a 100644
+--- a/net/rxrpc/ar-internal.h
++++ b/net/rxrpc/ar-internal.h
+@@ -254,7 +254,8 @@ struct rxrpc_security {
+  */
+ struct rxrpc_local {
+ 	struct rcu_head		rcu;
+-	atomic_t		usage;
++	atomic_t		active_users;	/* Number of users of the local endpoint */
++	atomic_t		usage;		/* Number of references to the structure */
+ 	struct rxrpc_net	*rxnet;		/* The network ns in which this resides */
+ 	struct list_head	link;
+ 	struct socket		*socket;	/* my UDP socket */
+@@ -1002,6 +1003,8 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *, const struct sockaddr_rxrpc
+ struct rxrpc_local *rxrpc_get_local(struct rxrpc_local *);
+ struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *);
+ void rxrpc_put_local(struct rxrpc_local *);
++struct rxrpc_local *rxrpc_use_local(struct rxrpc_local *);
++void rxrpc_unuse_local(struct rxrpc_local *);
+ void rxrpc_queue_local(struct rxrpc_local *);
+ void rxrpc_destroy_all_locals(struct rxrpc_net *);
+ 
+@@ -1061,6 +1064,7 @@ void rxrpc_destroy_all_peers(struct rxrpc_net *);
+ struct rxrpc_peer *rxrpc_get_peer(struct rxrpc_peer *);
+ struct rxrpc_peer *rxrpc_get_peer_maybe(struct rxrpc_peer *);
+ void rxrpc_put_peer(struct rxrpc_peer *);
++void rxrpc_put_peer_locked(struct rxrpc_peer *);
+ 
+ /*
+  * proc.c
+diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
+index 5bd6f1546e5c..ee95d1cd1cdf 100644
+--- a/net/rxrpc/input.c
++++ b/net/rxrpc/input.c
+@@ -1108,8 +1108,12 @@ static void rxrpc_post_packet_to_local(struct rxrpc_local *local,
+ {
+ 	_enter("%p,%p", local, skb);
+ 
+-	skb_queue_tail(&local->event_queue, skb);
+-	rxrpc_queue_local(local);
++	if (rxrpc_get_local_maybe(local)) {
++		skb_queue_tail(&local->event_queue, skb);
++		rxrpc_queue_local(local);
++	} else {
++		rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
++	}
+ }
+ 
+ /*
+@@ -1119,8 +1123,12 @@ static void rxrpc_reject_packet(struct rxrpc_local *local, struct sk_buff *skb)
+ {
+ 	CHECK_SLAB_OKAY(&local->usage);
+ 
+-	skb_queue_tail(&local->reject_queue, skb);
+-	rxrpc_queue_local(local);
++	if (rxrpc_get_local_maybe(local)) {
++		skb_queue_tail(&local->reject_queue, skb);
++		rxrpc_queue_local(local);
++	} else {
++		rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
++	}
+ }
+ 
+ /*
+diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
+index b1c71bad510b..72a6e12a9304 100644
+--- a/net/rxrpc/local_object.c
++++ b/net/rxrpc/local_object.c
+@@ -79,6 +79,7 @@ static struct rxrpc_local *rxrpc_alloc_local(struct rxrpc_net *rxnet,
+ 	local = kzalloc(sizeof(struct rxrpc_local), GFP_KERNEL);
+ 	if (local) {
+ 		atomic_set(&local->usage, 1);
++		atomic_set(&local->active_users, 1);
+ 		local->rxnet = rxnet;
+ 		INIT_LIST_HEAD(&local->link);
+ 		INIT_WORK(&local->processor, rxrpc_local_processor);
+@@ -92,7 +93,7 @@ static struct rxrpc_local *rxrpc_alloc_local(struct rxrpc_net *rxnet,
+ 		local->debug_id = atomic_inc_return(&rxrpc_debug_id);
+ 		memcpy(&local->srx, srx, sizeof(*srx));
+ 		local->srx.srx_service = 0;
+-		trace_rxrpc_local(local, rxrpc_local_new, 1, NULL);
++		trace_rxrpc_local(local->debug_id, rxrpc_local_new, 1, NULL);
+ 	}
+ 
+ 	_leave(" = %p", local);
+@@ -266,11 +267,8 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *net,
+ 		 * bind the transport socket may still fail if we're attempting
+ 		 * to use a local address that the dying object is still using.
+ 		 */
+-		if (!rxrpc_get_local_maybe(local)) {
+-			cursor = cursor->next;
+-			list_del_init(&local->link);
++		if (!rxrpc_use_local(local))
+ 			break;
+-		}
+ 
+ 		age = "old";
+ 		goto found;
+@@ -284,7 +282,10 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *net,
+ 	if (ret < 0)
+ 		goto sock_error;
+ 
+-	list_add_tail(&local->link, cursor);
++	if (cursor != &rxnet->local_endpoints)
++		list_replace_init(cursor, &local->link);
++	else
++		list_add_tail(&local->link, cursor);
+ 	age = "new";
+ 
+ found:
+@@ -320,7 +321,7 @@ struct rxrpc_local *rxrpc_get_local(struct rxrpc_local *local)
+ 	int n;
+ 
+ 	n = atomic_inc_return(&local->usage);
+-	trace_rxrpc_local(local, rxrpc_local_got, n, here);
++	trace_rxrpc_local(local->debug_id, rxrpc_local_got, n, here);
+ 	return local;
+ }
+ 
+@@ -334,7 +335,8 @@ struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *local)
+ 	if (local) {
+ 		int n = atomic_fetch_add_unless(&local->usage, 1, 0);
+ 		if (n > 0)
+-			trace_rxrpc_local(local, rxrpc_local_got, n + 1, here);
++			trace_rxrpc_local(local->debug_id, rxrpc_local_got,
++					  n + 1, here);
+ 		else
+ 			local = NULL;
+ 	}
+@@ -342,24 +344,18 @@ struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *local)
+ }
+ 
+ /*
+- * Queue a local endpoint.
++ * Queue a local endpoint and pass the caller's reference to the work item.
+  */
+ void rxrpc_queue_local(struct rxrpc_local *local)
+ {
+ 	const void *here = __builtin_return_address(0);
++	unsigned int debug_id = local->debug_id;
++	int n = atomic_read(&local->usage);
+ 
+ 	if (rxrpc_queue_work(&local->processor))
+-		trace_rxrpc_local(local, rxrpc_local_queued,
+-				  atomic_read(&local->usage), here);
+-}
+-
+-/*
+- * A local endpoint reached its end of life.
+- */
+-static void __rxrpc_put_local(struct rxrpc_local *local)
+-{
+-	_enter("%d", local->debug_id);
+-	rxrpc_queue_work(&local->processor);
++		trace_rxrpc_local(debug_id, rxrpc_local_queued, n, here);
++	else
++		rxrpc_put_local(local);
+ }
+ 
+ /*
+@@ -372,10 +368,47 @@ void rxrpc_put_local(struct rxrpc_local *local)
+ 
+ 	if (local) {
+ 		n = atomic_dec_return(&local->usage);
+-		trace_rxrpc_local(local, rxrpc_local_put, n, here);
++		trace_rxrpc_local(local->debug_id, rxrpc_local_put, n, here);
+ 
+ 		if (n == 0)
+-			__rxrpc_put_local(local);
++			call_rcu(&local->rcu, rxrpc_local_rcu);
++	}
++}
++
++/*
++ * Start using a local endpoint.
++ */
++struct rxrpc_local *rxrpc_use_local(struct rxrpc_local *local)
++{
++	unsigned int au;
++
++	local = rxrpc_get_local_maybe(local);
++	if (!local)
++		return NULL;
++
++	au = atomic_fetch_add_unless(&local->active_users, 1, 0);
++	if (au == 0) {
++		rxrpc_put_local(local);
++		return NULL;
++	}
++
++	return local;
++}
++
++/*
++ * Cease using a local endpoint.  Once the number of active users reaches 0, we
++ * start the closure of the transport in the work processor.
++ */
++void rxrpc_unuse_local(struct rxrpc_local *local)
++{
++	unsigned int au;
++
++	if (local) {
++		au = atomic_dec_return(&local->active_users);
++		if (au == 0)
++			rxrpc_queue_local(local);
++		else
++			rxrpc_put_local(local);
+ 	}
+ }
+ 
+@@ -393,16 +426,6 @@ static void rxrpc_local_destroyer(struct rxrpc_local *local)
+ 
+ 	_enter("%d", local->debug_id);
+ 
+-	/* We can get a race between an incoming call packet queueing the
+-	 * processor again and the work processor starting the destruction
+-	 * process which will shut down the UDP socket.
+-	 */
+-	if (local->dead) {
+-		_leave(" [already dead]");
+-		return;
+-	}
+-	local->dead = true;
+-
+ 	mutex_lock(&rxnet->local_mutex);
+ 	list_del_init(&local->link);
+ 	mutex_unlock(&rxnet->local_mutex);
+@@ -422,13 +445,11 @@ static void rxrpc_local_destroyer(struct rxrpc_local *local)
+ 	 */
+ 	rxrpc_purge_queue(&local->reject_queue);
+ 	rxrpc_purge_queue(&local->event_queue);
+-
+-	_debug("rcu local %d", local->debug_id);
+-	call_rcu(&local->rcu, rxrpc_local_rcu);
+ }
+ 
+ /*
+- * Process events on an endpoint
++ * Process events on an endpoint.  The work item carries a ref which
++ * we must release.
+  */
+ static void rxrpc_local_processor(struct work_struct *work)
+ {
+@@ -436,13 +457,15 @@ static void rxrpc_local_processor(struct work_struct *work)
+ 		container_of(work, struct rxrpc_local, processor);
+ 	bool again;
+ 
+-	trace_rxrpc_local(local, rxrpc_local_processing,
++	trace_rxrpc_local(local->debug_id, rxrpc_local_processing,
+ 			  atomic_read(&local->usage), NULL);
+ 
+ 	do {
+ 		again = false;
+-		if (atomic_read(&local->usage) == 0)
+-			return rxrpc_local_destroyer(local);
++		if (atomic_read(&local->active_users) == 0) {
++			rxrpc_local_destroyer(local);
++			break;
++		}
+ 
+ 		if (!skb_queue_empty(&local->reject_queue)) {
+ 			rxrpc_reject_packets(local);
+@@ -454,6 +477,8 @@ static void rxrpc_local_processor(struct work_struct *work)
+ 			again = true;
+ 		}
+ 	} while (again);
++
++	rxrpc_put_local(local);
+ }
+ 
+ /*
+diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c
+index 9f2f45c09e58..7666ec72d37e 100644
+--- a/net/rxrpc/peer_event.c
++++ b/net/rxrpc/peer_event.c
+@@ -378,7 +378,7 @@ static void rxrpc_peer_keepalive_dispatch(struct rxrpc_net *rxnet,
+ 		spin_lock_bh(&rxnet->peer_hash_lock);
+ 		list_add_tail(&peer->keepalive_link,
+ 			      &rxnet->peer_keepalive[slot & mask]);
+-		rxrpc_put_peer(peer);
++		rxrpc_put_peer_locked(peer);
+ 	}
+ 
+ 	spin_unlock_bh(&rxnet->peer_hash_lock);
+diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
+index 9d3ce81cf8ae..9c3ac96f71cb 100644
+--- a/net/rxrpc/peer_object.c
++++ b/net/rxrpc/peer_object.c
+@@ -436,6 +436,24 @@ void rxrpc_put_peer(struct rxrpc_peer *peer)
+ 	}
+ }
+ 
++/*
++ * Drop a ref on a peer record where the caller already holds the
++ * peer_hash_lock.
++ */
++void rxrpc_put_peer_locked(struct rxrpc_peer *peer)
++{
++	const void *here = __builtin_return_address(0);
++	int n;
++
++	n = atomic_dec_return(&peer->usage);
++	trace_rxrpc_peer(peer, rxrpc_peer_put, n, here);
++	if (n == 0) {
++		hash_del_rcu(&peer->hash_link);
++		list_del_init(&peer->keepalive_link);
++		kfree_rcu(peer, rcu);
++	}
++}
++
+ /*
+  * Make sure all peer records have been discarded.
+  */
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index 5d3f33ce6d41..bae14438f869 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -226,6 +226,7 @@ static int rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
+ 			rxrpc_set_call_completion(call,
+ 						  RXRPC_CALL_LOCAL_ERROR,
+ 						  0, ret);
++			rxrpc_notify_socket(call);
+ 			goto out;
+ 		}
+ 		_debug("need instant resend %d", ret);
+diff --git a/net/wireless/core.c b/net/wireless/core.c
+index 53ad3dbb76fe..ed24a0b071c3 100644
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -1397,10 +1397,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
+ 		}
+ 		break;
+ 	case NETDEV_PRE_UP:
+-		if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)) &&
+-		    !(wdev->iftype == NL80211_IFTYPE_AP_VLAN &&
+-		      rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP &&
+-		      wdev->use_4addr))
++		if (!cfg80211_iftype_allowed(wdev->wiphy, wdev->iftype,
++					     wdev->use_4addr, 0))
+ 			return notifier_from_errno(-EOPNOTSUPP);
+ 
+ 		if (rfkill_blocked(rdev->rfkill))
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 520d437aa8d1..88a1de9def11 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3481,9 +3481,7 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
+ 			return err;
+ 	}
+ 
+-	if (!(rdev->wiphy.interface_modes & (1 << type)) &&
+-	    !(type == NL80211_IFTYPE_AP_VLAN && params.use_4addr &&
+-	      rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP))
++	if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
+ 		return -EOPNOTSUPP;
+ 
+ 	err = nl80211_parse_mon_options(rdev, type, info, &params);
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 1c39d6a2e850..d0e35b7b9e35 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -1697,7 +1697,7 @@ int cfg80211_iter_combinations(struct wiphy *wiphy,
+ 	for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
+ 		num_interfaces += params->iftype_num[iftype];
+ 		if (params->iftype_num[iftype] > 0 &&
+-		    !(wiphy->software_iftypes & BIT(iftype)))
++		    !cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
+ 			used_iftypes |= BIT(iftype);
+ 	}
+ 
+@@ -1719,7 +1719,7 @@ int cfg80211_iter_combinations(struct wiphy *wiphy,
+ 			return -ENOMEM;
+ 
+ 		for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
+-			if (wiphy->software_iftypes & BIT(iftype))
++			if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
+ 				continue;
+ 			for (j = 0; j < c->n_limits; j++) {
+ 				all_iftypes |= limits[j].types;
+@@ -2072,3 +2072,26 @@ int ieee80211_get_vht_max_nss(struct ieee80211_vht_cap *cap,
+ 	return max_vht_nss;
+ }
+ EXPORT_SYMBOL(ieee80211_get_vht_max_nss);
++
++bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype,
++			     bool is_4addr, u8 check_swif)
++
++{
++	bool is_vlan = iftype == NL80211_IFTYPE_AP_VLAN;
++
++	switch (check_swif) {
++	case 0:
++		if (is_vlan && is_4addr)
++			return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
++		return wiphy->interface_modes & BIT(iftype);
++	case 1:
++		if (!(wiphy->software_iftypes & BIT(iftype)) && is_vlan)
++			return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
++		return wiphy->software_iftypes & BIT(iftype);
++	default:
++		break;
++	}
++
++	return false;
++}
++EXPORT_SYMBOL(cfg80211_iftype_allowed);
+diff --git a/sound/soc/amd/raven/acp3x-pcm-dma.c b/sound/soc/amd/raven/acp3x-pcm-dma.c
+index 9775bda2a4ca..d8aa6ab3f68b 100644
+--- a/sound/soc/amd/raven/acp3x-pcm-dma.c
++++ b/sound/soc/amd/raven/acp3x-pcm-dma.c
+@@ -367,9 +367,11 @@ static snd_pcm_uframes_t acp3x_dma_pointer(struct snd_pcm_substream *substream)
+ 
+ static int acp3x_dma_new(struct snd_soc_pcm_runtime *rtd)
+ {
++	struct snd_soc_component *component = snd_soc_rtdcom_lookup(rtd,
++								    DRV_NAME);
++	struct device *parent = component->dev->parent;
+ 	snd_pcm_lib_preallocate_pages_for_all(rtd->pcm, SNDRV_DMA_TYPE_DEV,
+-					      rtd->pcm->card->dev,
+-					      MIN_BUFFER, MAX_BUFFER);
++					      parent, MIN_BUFFER, MAX_BUFFER);
+ 	return 0;
+ }
+ 
+diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c
+index 70ed28d97d49..6398741ebd0e 100644
+--- a/sound/soc/generic/audio-graph-card.c
++++ b/sound/soc/generic/audio-graph-card.c
+@@ -63,6 +63,7 @@ static int graph_get_dai_id(struct device_node *ep)
+ 	struct device_node *endpoint;
+ 	struct of_endpoint info;
+ 	int i, id;
++	const u32 *reg;
+ 	int ret;
+ 
+ 	/* use driver specified DAI ID if exist */
+@@ -83,8 +84,9 @@ static int graph_get_dai_id(struct device_node *ep)
+ 			return info.id;
+ 
+ 		node = of_get_parent(ep);
++		reg = of_get_property(node, "reg", NULL);
+ 		of_node_put(node);
+-		if (of_get_property(node, "reg", NULL))
++		if (reg)
+ 			return info.port;
+ 	}
+ 	node = of_graph_get_port_parent(ep);
+@@ -222,10 +224,6 @@ static int graph_dai_link_of_dpcm(struct asoc_simple_priv *priv,
+ 
+ 	dev_dbg(dev, "link_of DPCM (%pOF)\n", ep);
+ 
+-	of_node_put(ports);
+-	of_node_put(port);
+-	of_node_put(node);
+-
+ 	if (li->cpu) {
+ 		int is_single_links = 0;
+ 
+@@ -243,17 +241,17 @@ static int graph_dai_link_of_dpcm(struct asoc_simple_priv *priv,
+ 
+ 		ret = asoc_simple_parse_cpu(ep, dai_link, &is_single_links);
+ 		if (ret)
+-			return ret;
++			goto out_put_node;
+ 
+ 		ret = asoc_simple_parse_clk_cpu(dev, ep, dai_link, dai);
+ 		if (ret < 0)
+-			return ret;
++			goto out_put_node;
+ 
+ 		ret = asoc_simple_set_dailink_name(dev, dai_link,
+ 						   "fe.%s",
+ 						   dai_link->cpu_dai_name);
+ 		if (ret < 0)
+-			return ret;
++			goto out_put_node;
+ 
+ 		/* card->num_links includes Codec */
+ 		asoc_simple_canonicalize_cpu(dai_link, is_single_links);
+@@ -277,17 +275,17 @@ static int graph_dai_link_of_dpcm(struct asoc_simple_priv *priv,
+ 
+ 		ret = asoc_simple_parse_codec(ep, dai_link);
+ 		if (ret < 0)
+-			return ret;
++			goto out_put_node;
+ 
+ 		ret = asoc_simple_parse_clk_codec(dev, ep, dai_link, dai);
+ 		if (ret < 0)
+-			return ret;
++			goto out_put_node;
+ 
+ 		ret = asoc_simple_set_dailink_name(dev, dai_link,
+ 						   "be.%s",
+ 						   codecs->dai_name);
+ 		if (ret < 0)
+-			return ret;
++			goto out_put_node;
+ 
+ 		/* check "prefix" from top node */
+ 		snd_soc_of_parse_node_prefix(top, cconf, codecs->of_node,
+@@ -307,19 +305,23 @@ static int graph_dai_link_of_dpcm(struct asoc_simple_priv *priv,
+ 
+ 	ret = asoc_simple_parse_tdm(ep, dai);
+ 	if (ret)
+-		return ret;
++		goto out_put_node;
+ 
+ 	ret = asoc_simple_parse_daifmt(dev, cpu_ep, codec_ep,
+ 				       NULL, &dai_link->dai_fmt);
+ 	if (ret < 0)
+-		return ret;
++		goto out_put_node;
+ 
+ 	dai_link->dpcm_playback		= 1;
+ 	dai_link->dpcm_capture		= 1;
+ 	dai_link->ops			= &graph_ops;
+ 	dai_link->init			= asoc_simple_dai_init;
+ 
+-	return 0;
++out_put_node:
++	of_node_put(ports);
++	of_node_put(port);
++	of_node_put(node);
++	return ret;
+ }
+ 
+ static int graph_dai_link_of(struct asoc_simple_priv *priv,
+diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
+index 9b568f578bcd..2712a2b20102 100644
+--- a/sound/soc/generic/simple-card.c
++++ b/sound/soc/generic/simple-card.c
+@@ -138,8 +138,6 @@ static int simple_dai_link_of_dpcm(struct asoc_simple_priv *priv,
+ 
+ 	li->link++;
+ 
+-	of_node_put(node);
+-
+ 	/* For single DAI link & old style of DT node */
+ 	if (is_top)
+ 		prefix = PREFIX;
+@@ -161,17 +159,17 @@ static int simple_dai_link_of_dpcm(struct asoc_simple_priv *priv,
+ 
+ 		ret = asoc_simple_parse_cpu(np, dai_link, &is_single_links);
+ 		if (ret)
+-			return ret;
++			goto out_put_node;
+ 
+ 		ret = asoc_simple_parse_clk_cpu(dev, np, dai_link, dai);
+ 		if (ret < 0)
+-			return ret;
++			goto out_put_node;
+ 
+ 		ret = asoc_simple_set_dailink_name(dev, dai_link,
+ 						   "fe.%s",
+ 						   dai_link->cpu_dai_name);
+ 		if (ret < 0)
+-			return ret;
++			goto out_put_node;
+ 
+ 		asoc_simple_canonicalize_cpu(dai_link, is_single_links);
+ 	} else {
+@@ -194,17 +192,17 @@ static int simple_dai_link_of_dpcm(struct asoc_simple_priv *priv,
+ 
+ 		ret = asoc_simple_parse_codec(np, dai_link);
+ 		if (ret < 0)
+-			return ret;
++			goto out_put_node;
+ 
+ 		ret = asoc_simple_parse_clk_codec(dev, np, dai_link, dai);
+ 		if (ret < 0)
+-			return ret;
++			goto out_put_node;
+ 
+ 		ret = asoc_simple_set_dailink_name(dev, dai_link,
+ 						   "be.%s",
+ 						   codecs->dai_name);
+ 		if (ret < 0)
+-			return ret;
++			goto out_put_node;
+ 
+ 		/* check "prefix" from top node */
+ 		snd_soc_of_parse_node_prefix(top, cconf, codecs->of_node,
+@@ -222,19 +220,21 @@ static int simple_dai_link_of_dpcm(struct asoc_simple_priv *priv,
+ 
+ 	ret = asoc_simple_parse_tdm(np, dai);
+ 	if (ret)
+-		return ret;
++		goto out_put_node;
+ 
+ 	ret = asoc_simple_parse_daifmt(dev, node, codec,
+ 				       prefix, &dai_link->dai_fmt);
+ 	if (ret < 0)
+-		return ret;
++		goto out_put_node;
+ 
+ 	dai_link->dpcm_playback		= 1;
+ 	dai_link->dpcm_capture		= 1;
+ 	dai_link->ops			= &simple_ops;
+ 	dai_link->init			= asoc_simple_dai_init;
+ 
+-	return 0;
++out_put_node:
++	of_node_put(node);
++	return ret;
+ }
+ 
+ static int simple_dai_link_of(struct asoc_simple_priv *priv,
+@@ -378,8 +378,6 @@ static int simple_for_each_link(struct asoc_simple_priv *priv,
+ 			goto error;
+ 		}
+ 
+-		of_node_put(codec);
+-
+ 		/* get convert-xxx property */
+ 		memset(&adata, 0, sizeof(adata));
+ 		for_each_child_of_node(node, np)
+@@ -401,11 +399,13 @@ static int simple_for_each_link(struct asoc_simple_priv *priv,
+ 				ret = func_noml(priv, np, codec, li, is_top);
+ 
+ 			if (ret < 0) {
++				of_node_put(codec);
+ 				of_node_put(np);
+ 				goto error;
+ 			}
+ 		}
+ 
++		of_node_put(codec);
+ 		node = of_get_next_child(top, node);
+ 	} while (!is_top && node);
+ 
+diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
+index 2fe1ce879123..c360ebc3ccc7 100644
+--- a/sound/soc/intel/boards/bytcht_es8316.c
++++ b/sound/soc/intel/boards/bytcht_es8316.c
+@@ -436,6 +436,14 @@ static const struct acpi_gpio_mapping byt_cht_es8316_gpios[] = {
+ 
+ /* Please keep this list alphabetically sorted */
+ static const struct dmi_system_id byt_cht_es8316_quirk_table[] = {
++	{	/* Irbis NB41 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "IRBIS"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "NB41"),
++		},
++		.driver_data = (void *)(BYT_CHT_ES8316_INTMIC_IN2_MAP
++					| BYT_CHT_ES8316_JD_INVERTED),
++	},
+ 	{	/* Teclast X98 Plus II */
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "TECLAST"),
+diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c
+index 0a34d0eb8dba..88ebaf6e1880 100644
+--- a/sound/soc/rockchip/rockchip_i2s.c
++++ b/sound/soc/rockchip/rockchip_i2s.c
+@@ -326,7 +326,6 @@ static int rockchip_i2s_hw_params(struct snd_pcm_substream *substream,
+ 		val |= I2S_CHN_4;
+ 		break;
+ 	case 2:
+-	case 1:
+ 		val |= I2S_CHN_2;
+ 		break;
+ 	default:
+@@ -459,7 +458,7 @@ static struct snd_soc_dai_driver rockchip_i2s_dai = {
+ 	},
+ 	.capture = {
+ 		.stream_name = "Capture",
+-		.channels_min = 1,
++		.channels_min = 2,
+ 		.channels_max = 2,
+ 		.rates = SNDRV_PCM_RATE_8000_192000,
+ 		.formats = (SNDRV_PCM_FMTBIT_S8 |
+@@ -659,7 +658,7 @@ static int rockchip_i2s_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	if (!of_property_read_u32(node, "rockchip,capture-channels", &val)) {
+-		if (val >= 1 && val <= 8)
++		if (val >= 2 && val <= 8)
+ 			soc_dai->capture.channels_max = val;
+ 	}
+ 
+diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c
+index e688169ff12a..d606e48fe551 100644
+--- a/sound/soc/samsung/odroid.c
++++ b/sound/soc/samsung/odroid.c
+@@ -275,9 +275,8 @@ static int odroid_audio_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	of_node_put(cpu);
+-	of_node_put(codec);
+ 	if (ret < 0)
+-		return ret;
++		goto err_put_node;
+ 
+ 	ret = snd_soc_of_get_dai_link_codecs(dev, codec, codec_link);
+ 	if (ret < 0)
+@@ -300,7 +299,6 @@ static int odroid_audio_probe(struct platform_device *pdev)
+ 		ret = PTR_ERR(priv->clk_i2s_bus);
+ 		goto err_put_sclk;
+ 	}
+-	of_node_put(cpu_dai);
+ 
+ 	ret = devm_snd_soc_register_card(dev, card);
+ 	if (ret < 0) {
+@@ -308,6 +306,8 @@ static int odroid_audio_probe(struct platform_device *pdev)
+ 		goto err_put_clk_i2s;
+ 	}
+ 
++	of_node_put(cpu_dai);
++	of_node_put(codec);
+ 	return 0;
+ 
+ err_put_clk_i2s:
+@@ -317,6 +317,8 @@ err_put_sclk:
+ err_put_cpu_dai:
+ 	of_node_put(cpu_dai);
+ 	snd_soc_of_put_dai_link_codecs(codec_link);
++err_put_node:
++	of_node_put(codec);
+ 	return ret;
+ }
+ 
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 6aeba0d66ec5..dd0f43a1c5e1 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1605,8 +1605,11 @@ static int soc_probe_link_dais(struct snd_soc_card *card,
+ 		}
+ 	}
+ 
+-	if (dai_link->dai_fmt)
+-		snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
++	if (dai_link->dai_fmt) {
++		ret = snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
++		if (ret)
++			return ret;
++	}
+ 
+ 	ret = soc_post_component_init(rtd, dai_link->name);
+ 	if (ret)
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index c91df5a9c840..f40adb604c25 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -1156,8 +1156,8 @@ static __always_inline int is_connected_ep(struct snd_soc_dapm_widget *widget,
+ 		list_add_tail(&widget->work_list, list);
+ 
+ 	if (custom_stop_condition && custom_stop_condition(widget, dir)) {
+-		widget->endpoints[dir] = 1;
+-		return widget->endpoints[dir];
++		list = NULL;
++		custom_stop_condition = NULL;
+ 	}
+ 
+ 	if ((widget->is_ep & SND_SOC_DAPM_DIR_TO_EP(dir)) && widget->connected) {
+@@ -1194,8 +1194,8 @@ static __always_inline int is_connected_ep(struct snd_soc_dapm_widget *widget,
+  *
+  * Optionally, can be supplied with a function acting as a stopping condition.
+  * This function takes the dapm widget currently being examined and the walk
+- * direction as an arguments, it should return true if the walk should be
+- * stopped and false otherwise.
++ * direction as an arguments, it should return true if widgets from that point
++ * in the graph onwards should not be added to the widget list.
+  */
+ static int is_connected_output_ep(struct snd_soc_dapm_widget *widget,
+ 	struct list_head *list,
+@@ -3705,6 +3705,8 @@ request_failed:
+ 		dev_err(dapm->dev, "ASoC: Failed to request %s: %d\n",
+ 			w->name, ret);
+ 
++	kfree_const(w->sname);
++	kfree(w);
+ 	return ERR_PTR(ret);
+ }
+ 
+diff --git a/sound/soc/ti/davinci-mcasp.c b/sound/soc/ti/davinci-mcasp.c
+index 5e8e31743a28..56009d147208 100644
+--- a/sound/soc/ti/davinci-mcasp.c
++++ b/sound/soc/ti/davinci-mcasp.c
+@@ -194,7 +194,7 @@ static inline void mcasp_set_axr_pdir(struct davinci_mcasp *mcasp, bool enable)
+ {
+ 	u32 bit;
+ 
+-	for_each_set_bit(bit, &mcasp->pdir, PIN_BIT_AFSR) {
++	for_each_set_bit(bit, &mcasp->pdir, PIN_BIT_AMUTE) {
+ 		if (enable)
+ 			mcasp_set_bits(mcasp, DAVINCI_MCASP_PDIR_REG, BIT(bit));
+ 		else
+@@ -222,6 +222,7 @@ static void mcasp_start_rx(struct davinci_mcasp *mcasp)
+ 	if (mcasp_is_synchronous(mcasp)) {
+ 		mcasp_set_ctl_reg(mcasp, DAVINCI_MCASP_GBLCTLX_REG, TXHCLKRST);
+ 		mcasp_set_ctl_reg(mcasp, DAVINCI_MCASP_GBLCTLX_REG, TXCLKRST);
++		mcasp_set_clk_pdir(mcasp, true);
+ 	}
+ 
+ 	/* Activate serializer(s) */
+@@ -1253,6 +1254,28 @@ static int davinci_mcasp_trigger(struct snd_pcm_substream *substream,
+ 	return ret;
+ }
+ 
++static int davinci_mcasp_hw_rule_slot_width(struct snd_pcm_hw_params *params,
++					    struct snd_pcm_hw_rule *rule)
++{
++	struct davinci_mcasp_ruledata *rd = rule->private;
++	struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
++	struct snd_mask nfmt;
++	int i, slot_width;
++
++	snd_mask_none(&nfmt);
++	slot_width = rd->mcasp->slot_width;
++
++	for (i = 0; i <= SNDRV_PCM_FORMAT_LAST; i++) {
++		if (snd_mask_test(fmt, i)) {
++			if (snd_pcm_format_width(i) <= slot_width) {
++				snd_mask_set(&nfmt, i);
++			}
++		}
++	}
++
++	return snd_mask_refine(fmt, &nfmt);
++}
++
+ static const unsigned int davinci_mcasp_dai_rates[] = {
+ 	8000, 11025, 16000, 22050, 32000, 44100, 48000, 64000,
+ 	88200, 96000, 176400, 192000,
+@@ -1360,7 +1383,7 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream,
+ 	struct davinci_mcasp_ruledata *ruledata =
+ 					&mcasp->ruledata[substream->stream];
+ 	u32 max_channels = 0;
+-	int i, dir;
++	int i, dir, ret;
+ 	int tdm_slots = mcasp->tdm_slots;
+ 
+ 	/* Do not allow more then one stream per direction */
+@@ -1389,6 +1412,7 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream,
+ 			max_channels++;
+ 	}
+ 	ruledata->serializers = max_channels;
++	ruledata->mcasp = mcasp;
+ 	max_channels *= tdm_slots;
+ 	/*
+ 	 * If the already active stream has less channels than the calculated
+@@ -1414,20 +1438,22 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream,
+ 				   0, SNDRV_PCM_HW_PARAM_CHANNELS,
+ 				   &mcasp->chconstr[substream->stream]);
+ 
+-	if (mcasp->slot_width)
+-		snd_pcm_hw_constraint_minmax(substream->runtime,
+-					     SNDRV_PCM_HW_PARAM_SAMPLE_BITS,
+-					     8, mcasp->slot_width);
++	if (mcasp->slot_width) {
++		/* Only allow formats require <= slot_width bits on the bus */
++		ret = snd_pcm_hw_rule_add(substream->runtime, 0,
++					  SNDRV_PCM_HW_PARAM_FORMAT,
++					  davinci_mcasp_hw_rule_slot_width,
++					  ruledata,
++					  SNDRV_PCM_HW_PARAM_FORMAT, -1);
++		if (ret)
++			return ret;
++	}
+ 
+ 	/*
+ 	 * If we rely on implicit BCLK divider setting we should
+ 	 * set constraints based on what we can provide.
+ 	 */
+ 	if (mcasp->bclk_master && mcasp->bclk_div == 0 && mcasp->sysclk_freq) {
+-		int ret;
+-
+-		ruledata->mcasp = mcasp;
+-
+ 		ret = snd_pcm_hw_rule_add(substream->runtime, 0,
+ 					  SNDRV_PCM_HW_PARAM_RATE,
+ 					  davinci_mcasp_hw_rule_rate,
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 3865a5d27251..77e14d995479 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -1044,8 +1044,13 @@ static void bpf_object__sanitize_btf(struct bpf_object *obj)
+ 		if (!has_datasec && kind == BTF_KIND_VAR) {
+ 			/* replace VAR with INT */
+ 			t->info = BTF_INFO_ENC(BTF_KIND_INT, 0, 0);
+-			t->size = sizeof(int);
+-			*(int *)(t+1) = BTF_INT_ENC(0, 0, 32);
++			/*
++			 * using size = 1 is the safest choice, 4 will be too
++			 * big and cause kernel BTF validation failure if
++			 * original variable took less than 4 bytes
++			 */
++			t->size = 1;
++			*(int *)(t+1) = BTF_INT_ENC(0, 0, 8);
+ 		} else if (!has_datasec && kind == BTF_KIND_DATASEC) {
+ 			/* replace DATASEC with STRUCT */
+ 			struct btf_var_secinfo *v = (void *)(t + 1);
+diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c
+index ca272c5b67f4..fa948c5445ec 100644
+--- a/tools/lib/bpf/xsk.c
++++ b/tools/lib/bpf/xsk.c
+@@ -327,17 +327,16 @@ static int xsk_load_xdp_prog(struct xsk_socket *xsk)
+ 
+ static int xsk_get_max_queues(struct xsk_socket *xsk)
+ {
+-	struct ethtool_channels channels;
+-	struct ifreq ifr;
++	struct ethtool_channels channels = { .cmd = ETHTOOL_GCHANNELS };
++	struct ifreq ifr = {};
+ 	int fd, err, ret;
+ 
+ 	fd = socket(AF_INET, SOCK_DGRAM, 0);
+ 	if (fd < 0)
+ 		return -errno;
+ 
+-	channels.cmd = ETHTOOL_GCHANNELS;
+ 	ifr.ifr_data = (void *)&channels;
+-	strncpy(ifr.ifr_name, xsk->ifname, IFNAMSIZ - 1);
++	memcpy(ifr.ifr_name, xsk->ifname, IFNAMSIZ - 1);
+ 	ifr.ifr_name[IFNAMSIZ - 1] = '\0';
+ 	err = ioctl(fd, SIOCETHTOOL, &ifr);
+ 	if (err && errno != EOPNOTSUPP) {
+@@ -345,7 +344,7 @@ static int xsk_get_max_queues(struct xsk_socket *xsk)
+ 		goto out;
+ 	}
+ 
+-	if (channels.max_combined == 0 || errno == EOPNOTSUPP)
++	if (err || channels.max_combined == 0)
+ 		/* If the device says it has no channels, then all traffic
+ 		 * is sent to a single stream, so max queues = 1.
+ 		 */
+@@ -562,7 +561,7 @@ int xsk_socket__create(struct xsk_socket **xsk_ptr, const char *ifname,
+ 		err = -errno;
+ 		goto out_socket;
+ 	}
+-	strncpy(xsk->ifname, ifname, IFNAMSIZ - 1);
++	memcpy(xsk->ifname, ifname, IFNAMSIZ - 1);
+ 	xsk->ifname[IFNAMSIZ - 1] = '\0';
+ 
+ 	err = xsk_set_xdp_socket_config(&xsk->config, usr_config);
+diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
+index a7784554a80d..23c27ca48abf 100644
+--- a/tools/perf/bench/numa.c
++++ b/tools/perf/bench/numa.c
+@@ -379,8 +379,10 @@ static u8 *alloc_data(ssize_t bytes0, int map_flags,
+ 
+ 	/* Allocate and initialize all memory on CPU#0: */
+ 	if (init_cpu0) {
+-		orig_mask = bind_to_node(0);
+-		bind_to_memnode(0);
++		int node = numa_node_of_cpu(0);
++
++		orig_mask = bind_to_node(node);
++		bind_to_memnode(node);
+ 	}
+ 
+ 	bytes = bytes0 + HPSIZE;
+diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c
+index 9c228c55e1fb..22386ab35050 100644
+--- a/tools/perf/builtin-ftrace.c
++++ b/tools/perf/builtin-ftrace.c
+@@ -173,7 +173,7 @@ static int set_tracing_cpumask(struct cpu_map *cpumap)
+ 	int last_cpu;
+ 
+ 	last_cpu = cpu_map__cpu(cpumap, cpumap->nr - 1);
+-	mask_size = (last_cpu + 3) / 4 + 1;
++	mask_size = last_cpu / 4 + 2; /* one more byte for EOS */
+ 	mask_size += last_cpu / 32; /* ',' is needed for every 32th cpus */
+ 
+ 	cpumask = malloc(mask_size);
+diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
+index 58f77fd0f59f..ed5423d8a95f 100644
+--- a/tools/perf/pmu-events/jevents.c
++++ b/tools/perf/pmu-events/jevents.c
+@@ -450,6 +450,7 @@ static struct fixed {
+ 	{ "inst_retired.any_p", "event=0xc0" },
+ 	{ "cpu_clk_unhalted.ref", "event=0x0,umask=0x03" },
+ 	{ "cpu_clk_unhalted.thread", "event=0x3c" },
++	{ "cpu_clk_unhalted.core", "event=0x3c" },
+ 	{ "cpu_clk_unhalted.thread_any", "event=0x3c,any=1" },
+ 	{ NULL, NULL},
+ };
+diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
+index 0b599229bc7e..0aba5b39c21e 100644
+--- a/tools/perf/util/cpumap.c
++++ b/tools/perf/util/cpumap.c
+@@ -701,7 +701,10 @@ size_t cpu_map__snprint_mask(struct cpu_map *map, char *buf, size_t size)
+ 	unsigned char *bitmap;
+ 	int last_cpu = cpu_map__cpu(map, map->nr - 1);
+ 
+-	bitmap = zalloc((last_cpu + 7) / 8);
++	if (buf == NULL)
++		return 0;
++
++	bitmap = zalloc(last_cpu / 8 + 1);
+ 	if (bitmap == NULL) {
+ 		buf[0] = '\0';
+ 		return 0;
+diff --git a/tools/testing/selftests/bpf/progs/sendmsg6_prog.c b/tools/testing/selftests/bpf/progs/sendmsg6_prog.c
+index 5aeaa284fc47..a68062820410 100644
+--- a/tools/testing/selftests/bpf/progs/sendmsg6_prog.c
++++ b/tools/testing/selftests/bpf/progs/sendmsg6_prog.c
+@@ -41,8 +41,7 @@ int sendmsg_v6_prog(struct bpf_sock_addr *ctx)
+ 	}
+ 
+ 	/* Rewrite destination. */
+-	if ((ctx->user_ip6[0] & 0xFFFF) == bpf_htons(0xFACE) &&
+-	     ctx->user_ip6[0] >> 16 == bpf_htons(0xB00C)) {
++	if (ctx->user_ip6[0] == bpf_htonl(0xFACEB00C)) {
+ 		ctx->user_ip6[0] = bpf_htonl(DST_REWRITE_IP6_0);
+ 		ctx->user_ip6[1] = bpf_htonl(DST_REWRITE_IP6_1);
+ 		ctx->user_ip6[2] = bpf_htonl(DST_REWRITE_IP6_2);
+diff --git a/tools/testing/selftests/bpf/verifier/ctx_skb.c b/tools/testing/selftests/bpf/verifier/ctx_skb.c
+index b0fda2877119..d438193804b2 100644
+--- a/tools/testing/selftests/bpf/verifier/ctx_skb.c
++++ b/tools/testing/selftests/bpf/verifier/ctx_skb.c
+@@ -974,6 +974,17 @@
+ 	.result = ACCEPT,
+ 	.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+ },
++{
++	"read gso_segs from CGROUP_SKB",
++	.insns = {
++	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
++		    offsetof(struct __sk_buff, gso_segs)),
++	BPF_MOV64_IMM(BPF_REG_0, 0),
++	BPF_EXIT_INSN(),
++	},
++	.result = ACCEPT,
++	.prog_type = BPF_PROG_TYPE_CGROUP_SKB,
++},
+ {
+ 	"write gso_segs from CGROUP_SKB",
+ 	.insns = {
+diff --git a/tools/testing/selftests/kvm/config b/tools/testing/selftests/kvm/config
+new file mode 100644
+index 000000000000..63ed533f73d6
+--- /dev/null
++++ b/tools/testing/selftests/kvm/config
+@@ -0,0 +1,3 @@
++CONFIG_KVM=y
++CONFIG_KVM_INTEL=y
++CONFIG_KVM_AMD=y
+diff --git a/tools/testing/selftests/net/forwarding/gre_multipath.sh b/tools/testing/selftests/net/forwarding/gre_multipath.sh
+index cca2baa03fb8..a8d8e8b3dc81 100755
+--- a/tools/testing/selftests/net/forwarding/gre_multipath.sh
++++ b/tools/testing/selftests/net/forwarding/gre_multipath.sh
+@@ -93,18 +93,10 @@ sw1_create()
+ 	ip route add vrf v$ol1 192.0.2.16/28 \
+ 	   nexthop dev g1a \
+ 	   nexthop dev g1b
+-
+-	tc qdisc add dev $ul1 clsact
+-	tc filter add dev $ul1 egress pref 111 prot ipv4 \
+-	   flower dst_ip 192.0.2.66 action pass
+-	tc filter add dev $ul1 egress pref 222 prot ipv4 \
+-	   flower dst_ip 192.0.2.82 action pass
+ }
+ 
+ sw1_destroy()
+ {
+-	tc qdisc del dev $ul1 clsact
+-
+ 	ip route del vrf v$ol1 192.0.2.16/28
+ 
+ 	ip route del vrf v$ol1 192.0.2.82/32 via 192.0.2.146
+@@ -139,10 +131,18 @@ sw2_create()
+ 	ip route add vrf v$ol2 192.0.2.0/28 \
+ 	   nexthop dev g2a \
+ 	   nexthop dev g2b
++
++	tc qdisc add dev $ul2 clsact
++	tc filter add dev $ul2 ingress pref 111 prot 802.1Q \
++	   flower vlan_id 111 action pass
++	tc filter add dev $ul2 ingress pref 222 prot 802.1Q \
++	   flower vlan_id 222 action pass
+ }
+ 
+ sw2_destroy()
+ {
++	tc qdisc del dev $ul2 clsact
++
+ 	ip route del vrf v$ol2 192.0.2.0/28
+ 
+ 	ip route del vrf v$ol2 192.0.2.81/32 via 192.0.2.145
+@@ -187,12 +187,16 @@ setup_prepare()
+ 	sw1_create
+ 	sw2_create
+ 	h2_create
++
++	forwarding_enable
+ }
+ 
+ cleanup()
+ {
+ 	pre_cleanup
+ 
++	forwarding_restore
++
+ 	h2_destroy
+ 	sw2_destroy
+ 	sw1_destroy
+@@ -211,15 +215,15 @@ multipath4_test()
+ 	   nexthop dev g1a weight $weight1 \
+ 	   nexthop dev g1b weight $weight2
+ 
+-	local t0_111=$(tc_rule_stats_get $ul1 111 egress)
+-	local t0_222=$(tc_rule_stats_get $ul1 222 egress)
++	local t0_111=$(tc_rule_stats_get $ul2 111 ingress)
++	local t0_222=$(tc_rule_stats_get $ul2 222 ingress)
+ 
+ 	ip vrf exec v$h1 \
+ 	   $MZ $h1 -q -p 64 -A 192.0.2.1 -B 192.0.2.18 \
+ 	       -d 1msec -t udp "sp=1024,dp=0-32768"
+ 
+-	local t1_111=$(tc_rule_stats_get $ul1 111 egress)
+-	local t1_222=$(tc_rule_stats_get $ul1 222 egress)
++	local t1_111=$(tc_rule_stats_get $ul2 111 ingress)
++	local t1_222=$(tc_rule_stats_get $ul2 222 ingress)
+ 
+ 	local d111=$((t1_111 - t0_111))
+ 	local d222=$((t1_222 - t0_222))