[gentoo-commits] proj/linux-patches:4.12 commit in: /

[Mike Pagano]

commit:     c20ad5072b7e3f69f4ff535dd534453ad3d7b8ec
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 11 17:39:51 2017 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Aug 11 17:39:51 2017 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c20ad507

Linux patch 4.12.6

 0000_README             |    4 +
 1005_linux-4.12.6.patch | 3935 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 3939 insertions(+)

diff --git a/0000_README b/0000_README
index 29e1ca2..b88e1e0 100644
--- a/0000_README
+++ b/0000_README
@@ -63,6 +63,10 @@ Patch:  1004_linux-4.12.5.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.12.5
 
+Patch:  1005_linux-4.12.6.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.12.6
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1005_linux-4.12.6.patch b/1005_linux-4.12.6.patch
new file mode 100644
index 0000000..461714c
--- /dev/null
+++ b/1005_linux-4.12.6.patch
@@ -0,0 +1,3935 @@
+diff --git a/Makefile b/Makefile
+index 382e967b0792..c8d80b50495a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 12
+-SUBLEVEL = 5
++SUBLEVEL = 6
+ EXTRAVERSION =
+ NAME = Fearless Coyote
+ 
+diff --git a/arch/arm/boot/dts/armada-388-gp.dts b/arch/arm/boot/dts/armada-388-gp.dts
+index 895fa6cfa15a..563901e0ec07 100644
+--- a/arch/arm/boot/dts/armada-388-gp.dts
++++ b/arch/arm/boot/dts/armada-388-gp.dts
+@@ -75,7 +75,7 @@
+ 					pinctrl-names = "default";
+ 					pinctrl-0 = <&pca0_pins>;
+ 					interrupt-parent = <&gpio0>;
+-					interrupts = <18 IRQ_TYPE_EDGE_FALLING>;
++					interrupts = <18 IRQ_TYPE_LEVEL_LOW>;
+ 					gpio-controller;
+ 					#gpio-cells = <2>;
+ 					interrupt-controller;
+@@ -87,7 +87,7 @@
+ 					compatible = "nxp,pca9555";
+ 					pinctrl-names = "default";
+ 					interrupt-parent = <&gpio0>;
+-					interrupts = <18 IRQ_TYPE_EDGE_FALLING>;
++					interrupts = <18 IRQ_TYPE_LEVEL_LOW>;
+ 					gpio-controller;
+ 					#gpio-cells = <2>;
+ 					interrupt-controller;
+diff --git a/arch/arm/boot/dts/tango4-vantage-1172.dts b/arch/arm/boot/dts/tango4-vantage-1172.dts
+index 86d8df98802f..13bcc460bcb2 100644
+--- a/arch/arm/boot/dts/tango4-vantage-1172.dts
++++ b/arch/arm/boot/dts/tango4-vantage-1172.dts
+@@ -22,7 +22,7 @@
+ };
+ 
+ &eth0 {
+-	phy-connection-type = "rgmii";
++	phy-connection-type = "rgmii-id";
+ 	phy-handle = <&eth0_phy>;
+ 	#address-cells = <1>;
+ 	#size-cells = <0>;
+diff --git a/arch/arm/mach-mvebu/platsmp.c b/arch/arm/mach-mvebu/platsmp.c
+index e62273aacb43..4ffbbd217e82 100644
+--- a/arch/arm/mach-mvebu/platsmp.c
++++ b/arch/arm/mach-mvebu/platsmp.c
+@@ -211,7 +211,7 @@ static int mv98dx3236_resume_set_cpu_boot_addr(int hw_cpu, void *boot_addr)
+ 		return PTR_ERR(base);
+ 
+ 	writel(0, base + MV98DX3236_CPU_RESUME_CTRL_REG);
+-	writel(virt_to_phys(boot_addr), base + MV98DX3236_CPU_RESUME_ADDR_REG);
++	writel(__pa_symbol(boot_addr), base + MV98DX3236_CPU_RESUME_ADDR_REG);
+ 
+ 	iounmap(base);
+ 
+diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+index bc179efb10ef..b69e4a4ecdd8 100644
+--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+@@ -219,7 +219,7 @@
+ 				reg = <0x18800 0x100>, <0x18C00 0x20>;
+ 				gpiosb: gpio {
+ 					#gpio-cells = <2>;
+-					gpio-ranges = <&pinctrl_sb 0 0 29>;
++					gpio-ranges = <&pinctrl_sb 0 0 30>;
+ 					gpio-controller;
+ 					interrupts =
+ 					<GIC_SPI 160 IRQ_TYPE_LEVEL_HIGH>,
+diff --git a/arch/mips/include/asm/mach-ralink/ralink_regs.h b/arch/mips/include/asm/mach-ralink/ralink_regs.h
+index 9df1a53bcb36..b4e7dfa214eb 100644
+--- a/arch/mips/include/asm/mach-ralink/ralink_regs.h
++++ b/arch/mips/include/asm/mach-ralink/ralink_regs.h
+@@ -13,6 +13,8 @@
+ #ifndef _RALINK_REGS_H_
+ #define _RALINK_REGS_H_
+ 
++#include <linux/io.h>
++
+ enum ralink_soc_type {
+ 	RALINK_UNKNOWN = 0,
+ 	RT2880_SOC,
+diff --git a/arch/parisc/include/asm/thread_info.h b/arch/parisc/include/asm/thread_info.h
+index 88fe0aad4390..bc208136bbb2 100644
+--- a/arch/parisc/include/asm/thread_info.h
++++ b/arch/parisc/include/asm/thread_info.h
+@@ -34,7 +34,7 @@ struct thread_info {
+ 
+ /* thread information allocation */
+ 
+-#define THREAD_SIZE_ORDER	2 /* PA-RISC requires at least 16k stack */
++#define THREAD_SIZE_ORDER	3 /* PA-RISC requires at least 32k stack */
+ /* Be sure to hunt all references to this down when you change the size of
+  * the kernel stack */
+ #define THREAD_SIZE             (PAGE_SIZE << THREAD_SIZE_ORDER)
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index 85a92db70afc..19c0c141bc3f 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -587,13 +587,12 @@ void flush_cache_range(struct vm_area_struct *vma,
+ 	if (parisc_requires_coherency())
+ 		flush_tlb_range(vma, start, end);
+ 
+-	if ((end - start) >= parisc_cache_flush_threshold) {
++	if ((end - start) >= parisc_cache_flush_threshold
++	    || vma->vm_mm->context != mfsp(3)) {
+ 		flush_cache_all();
+ 		return;
+ 	}
+ 
+-	BUG_ON(vma->vm_mm->context != mfsp(3));
+-
+ 	flush_user_dcache_range_asm(start, end);
+ 	if (vma->vm_flags & VM_EXEC)
+ 		flush_user_icache_range_asm(start, end);
+diff --git a/arch/parisc/kernel/irq.c b/arch/parisc/kernel/irq.c
+index ba5e1c7b1f17..ef9a4eea662f 100644
+--- a/arch/parisc/kernel/irq.c
++++ b/arch/parisc/kernel/irq.c
+@@ -380,7 +380,7 @@ static inline int eirr_to_irq(unsigned long eirr)
+ /*
+  * IRQ STACK - used for irq handler
+  */
+-#define IRQ_STACK_SIZE      (4096 << 2) /* 16k irq stack size */
++#define IRQ_STACK_SIZE      (4096 << 3) /* 32k irq stack size */
+ 
+ union irq_stack_union {
+ 	unsigned long stack[IRQ_STACK_SIZE/sizeof(unsigned long)];
+diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
+index 5c291df30fe3..40d8b552d15a 100644
+--- a/arch/powerpc/kernel/irq.c
++++ b/arch/powerpc/kernel/irq.c
+@@ -145,6 +145,19 @@ notrace unsigned int __check_irq_replay(void)
+ 
+ 	/* Clear bit 0 which we wouldn't clear otherwise */
+ 	local_paca->irq_happened &= ~PACA_IRQ_HARD_DIS;
++	if (happened & PACA_IRQ_HARD_DIS) {
++		/*
++		 * We may have missed a decrementer interrupt if hard disabled.
++		 * Check the decrementer register in case we had a rollover
++		 * while hard disabled.
++		 */
++		if (!(happened & PACA_IRQ_DEC)) {
++			if (decrementer_check_overflow()) {
++				local_paca->irq_happened |= PACA_IRQ_DEC;
++				happened |= PACA_IRQ_DEC;
++			}
++		}
++	}
+ 
+ 	/*
+ 	 * Force the delivery of pending soft-disabled interrupts on PS3.
+@@ -170,7 +183,7 @@ notrace unsigned int __check_irq_replay(void)
+ 	 * in case we also had a rollover while hard disabled
+ 	 */
+ 	local_paca->irq_happened &= ~PACA_IRQ_DEC;
+-	if ((happened & PACA_IRQ_DEC) || decrementer_check_overflow())
++	if (happened & PACA_IRQ_DEC)
+ 		return 0x900;
+ 
+ 	/* Finally check if an external interrupt happened */
+diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
+index 925a4ef90559..660ed39e9c9a 100644
+--- a/arch/powerpc/kernel/ptrace.c
++++ b/arch/powerpc/kernel/ptrace.c
+@@ -127,12 +127,19 @@ static void flush_tmregs_to_thread(struct task_struct *tsk)
+ 	 * If task is not current, it will have been flushed already to
+ 	 * it's thread_struct during __switch_to().
+ 	 *
+-	 * A reclaim flushes ALL the state.
++	 * A reclaim flushes ALL the state or if not in TM save TM SPRs
++	 * in the appropriate thread structures from live.
+ 	 */
+ 
+-	if (tsk == current && MSR_TM_SUSPENDED(mfmsr()))
+-		tm_reclaim_current(TM_CAUSE_SIGNAL);
++	if (tsk != current)
++		return;
+ 
++	if (MSR_TM_SUSPENDED(mfmsr())) {
++		tm_reclaim_current(TM_CAUSE_SIGNAL);
++	} else {
++		tm_enable();
++		tm_save_sprs(&(tsk->thread));
++	}
+ }
+ #else
+ static inline void flush_tmregs_to_thread(struct task_struct *tsk) { }
+diff --git a/arch/sparc/include/asm/mmu_context_64.h b/arch/sparc/include/asm/mmu_context_64.h
+index 2cddcda4f85f..87841d687f8d 100644
+--- a/arch/sparc/include/asm/mmu_context_64.h
++++ b/arch/sparc/include/asm/mmu_context_64.h
+@@ -27,9 +27,11 @@ void destroy_context(struct mm_struct *mm);
+ void __tsb_context_switch(unsigned long pgd_pa,
+ 			  struct tsb_config *tsb_base,
+ 			  struct tsb_config *tsb_huge,
+-			  unsigned long tsb_descr_pa);
++			  unsigned long tsb_descr_pa,
++			  unsigned long secondary_ctx);
+ 
+-static inline void tsb_context_switch(struct mm_struct *mm)
++static inline void tsb_context_switch_ctx(struct mm_struct *mm,
++					  unsigned long ctx)
+ {
+ 	__tsb_context_switch(__pa(mm->pgd),
+ 			     &mm->context.tsb_block[MM_TSB_BASE],
+@@ -40,9 +42,12 @@ static inline void tsb_context_switch(struct mm_struct *mm)
+ #else
+ 			     NULL
+ #endif
+-			     , __pa(&mm->context.tsb_descr[MM_TSB_BASE]));
++			     , __pa(&mm->context.tsb_descr[MM_TSB_BASE]),
++			     ctx);
+ }
+ 
++#define tsb_context_switch(X) tsb_context_switch_ctx(X, 0)
++
+ void tsb_grow(struct mm_struct *mm,
+ 	      unsigned long tsb_index,
+ 	      unsigned long mm_rss);
+@@ -112,8 +117,7 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str
+ 	 * cpu0 to update it's TSB because at that point the cpu_vm_mask
+ 	 * only had cpu1 set in it.
+ 	 */
+-	load_secondary_context(mm);
+-	tsb_context_switch(mm);
++	tsb_context_switch_ctx(mm, CTX_HWBITS(mm->context));
+ 
+ 	/* Any time a processor runs a context on an address space
+ 	 * for the first time, we must flush that context out of the
+diff --git a/arch/sparc/include/asm/trap_block.h b/arch/sparc/include/asm/trap_block.h
+index ec9c04de3664..ff05992dae7a 100644
+--- a/arch/sparc/include/asm/trap_block.h
++++ b/arch/sparc/include/asm/trap_block.h
+@@ -54,6 +54,7 @@ extern struct trap_per_cpu trap_block[NR_CPUS];
+ void init_cur_cpu_trap(struct thread_info *);
+ void setup_tba(void);
+ extern int ncpus_probed;
++extern u64 cpu_mondo_counter[NR_CPUS];
+ 
+ unsigned long real_hard_smp_processor_id(void);
+ 
+diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
+index fdf31040a7dc..3218bc43302e 100644
+--- a/arch/sparc/kernel/smp_64.c
++++ b/arch/sparc/kernel/smp_64.c
+@@ -622,22 +622,48 @@ static void cheetah_xcall_deliver(struct trap_per_cpu *tb, int cnt)
+ 	}
+ }
+ 
+-/* Multi-cpu list version.  */
++#define	CPU_MONDO_COUNTER(cpuid)	(cpu_mondo_counter[cpuid])
++#define	MONDO_USEC_WAIT_MIN		2
++#define	MONDO_USEC_WAIT_MAX		100
++#define	MONDO_RETRY_LIMIT		500000
++
++/* Multi-cpu list version.
++ *
++ * Deliver xcalls to 'cnt' number of cpus in 'cpu_list'.
++ * Sometimes not all cpus receive the mondo, requiring us to re-send
++ * the mondo until all cpus have received, or cpus are truly stuck
++ * unable to receive mondo, and we timeout.
++ * Occasionally a target cpu strand is borrowed briefly by hypervisor to
++ * perform guest service, such as PCIe error handling. Consider the
++ * service time, 1 second overall wait is reasonable for 1 cpu.
++ * Here two in-between mondo check wait time are defined: 2 usec for
++ * single cpu quick turn around and up to 100usec for large cpu count.
++ * Deliver mondo to large number of cpus could take longer, we adjusts
++ * the retry count as long as target cpus are making forward progress.
++ */
+ static void hypervisor_xcall_deliver(struct trap_per_cpu *tb, int cnt)
+ {
+-	int retries, this_cpu, prev_sent, i, saw_cpu_error;
++	int this_cpu, tot_cpus, prev_sent, i, rem;
++	int usec_wait, retries, tot_retries;
++	u16 first_cpu = 0xffff;
++	unsigned long xc_rcvd = 0;
+ 	unsigned long status;
++	int ecpuerror_id = 0;
++	int enocpu_id = 0;
+ 	u16 *cpu_list;
++	u16 cpu;
+ 
+ 	this_cpu = smp_processor_id();
+-
+ 	cpu_list = __va(tb->cpu_list_pa);
+-
+-	saw_cpu_error = 0;
+-	retries = 0;
++	usec_wait = cnt * MONDO_USEC_WAIT_MIN;
++	if (usec_wait > MONDO_USEC_WAIT_MAX)
++		usec_wait = MONDO_USEC_WAIT_MAX;
++	retries = tot_retries = 0;
++	tot_cpus = cnt;
+ 	prev_sent = 0;
++
+ 	do {
+-		int forward_progress, n_sent;
++		int n_sent, mondo_delivered, target_cpu_busy;
+ 
+ 		status = sun4v_cpu_mondo_send(cnt,
+ 					      tb->cpu_list_pa,
+@@ -645,94 +671,113 @@ static void hypervisor_xcall_deliver(struct trap_per_cpu *tb, int cnt)
+ 
+ 		/* HV_EOK means all cpus received the xcall, we're done.  */
+ 		if (likely(status == HV_EOK))
+-			break;
++			goto xcall_done;
++
++		/* If not these non-fatal errors, panic */
++		if (unlikely((status != HV_EWOULDBLOCK) &&
++			(status != HV_ECPUERROR) &&
++			(status != HV_ENOCPU)))
++			goto fatal_errors;
+ 
+ 		/* First, see if we made any forward progress.
++		 *
++		 * Go through the cpu_list, count the target cpus that have
++		 * received our mondo (n_sent), and those that did not (rem).
++		 * Re-pack cpu_list with the cpus remain to be retried in the
++		 * front - this simplifies tracking the truly stalled cpus.
+ 		 *
+ 		 * The hypervisor indicates successful sends by setting
+ 		 * cpu list entries to the value 0xffff.
++		 *
++		 * EWOULDBLOCK means some target cpus did not receive the
++		 * mondo and retry usually helps.
++		 *
++		 * ECPUERROR means at least one target cpu is in error state,
++		 * it's usually safe to skip the faulty cpu and retry.
++		 *
++		 * ENOCPU means one of the target cpu doesn't belong to the
++		 * domain, perhaps offlined which is unexpected, but not
++		 * fatal and it's okay to skip the offlined cpu.
+ 		 */
++		rem = 0;
+ 		n_sent = 0;
+ 		for (i = 0; i < cnt; i++) {
+-			if (likely(cpu_list[i] == 0xffff))
++			cpu = cpu_list[i];
++			if (likely(cpu == 0xffff)) {
+ 				n_sent++;
++			} else if ((status == HV_ECPUERROR) &&
++				(sun4v_cpu_state(cpu) == HV_CPU_STATE_ERROR)) {
++				ecpuerror_id = cpu + 1;
++			} else if (status == HV_ENOCPU && !cpu_online(cpu)) {
++				enocpu_id = cpu + 1;
++			} else {
++				cpu_list[rem++] = cpu;
++			}
+ 		}
+ 
+-		forward_progress = 0;
+-		if (n_sent > prev_sent)
+-			forward_progress = 1;
++		/* No cpu remained, we're done. */
++		if (rem == 0)
++			break;
+ 
+-		prev_sent = n_sent;
++		/* Otherwise, update the cpu count for retry. */
++		cnt = rem;
+ 
+-		/* If we get a HV_ECPUERROR, then one or more of the cpus
+-		 * in the list are in error state.  Use the cpu_state()
+-		 * hypervisor call to find out which cpus are in error state.
++		/* Record the overall number of mondos received by the
++		 * first of the remaining cpus.
+ 		 */
+-		if (unlikely(status == HV_ECPUERROR)) {
+-			for (i = 0; i < cnt; i++) {
+-				long err;
+-				u16 cpu;
++		if (first_cpu != cpu_list[0]) {
++			first_cpu = cpu_list[0];
++			xc_rcvd = CPU_MONDO_COUNTER(first_cpu);
++		}
+ 
+-				cpu = cpu_list[i];
+-				if (cpu == 0xffff)
+-					continue;
++		/* Was any mondo delivered successfully? */
++		mondo_delivered = (n_sent > prev_sent);
++		prev_sent = n_sent;
+ 
+-				err = sun4v_cpu_state(cpu);
+-				if (err == HV_CPU_STATE_ERROR) {
+-					saw_cpu_error = (cpu + 1);
+-					cpu_list[i] = 0xffff;
+-				}
+-			}
+-		} else if (unlikely(status != HV_EWOULDBLOCK))
+-			goto fatal_mondo_error;
++		/* or, was any target cpu busy processing other mondos? */
++		target_cpu_busy = (xc_rcvd < CPU_MONDO_COUNTER(first_cpu));
++		xc_rcvd = CPU_MONDO_COUNTER(first_cpu);
+ 
+-		/* Don't bother rewriting the CPU list, just leave the
+-		 * 0xffff and non-0xffff entries in there and the
+-		 * hypervisor will do the right thing.
+-		 *
+-		 * Only advance timeout state if we didn't make any
+-		 * forward progress.
++		/* Retry count is for no progress. If we're making progress,
++		 * reset the retry count.
+ 		 */
+-		if (unlikely(!forward_progress)) {
+-			if (unlikely(++retries > 10000))
+-				goto fatal_mondo_timeout;
+-
+-			/* Delay a little bit to let other cpus catch up
+-			 * on their cpu mondo queue work.
+-			 */
+-			udelay(2 * cnt);
++		if (likely(mondo_delivered || target_cpu_busy)) {
++			tot_retries += retries;
++			retries = 0;
++		} else if (unlikely(retries > MONDO_RETRY_LIMIT)) {
++			goto fatal_mondo_timeout;
+ 		}
+-	} while (1);
+ 
+-	if (unlikely(saw_cpu_error))
+-		goto fatal_mondo_cpu_error;
++		/* Delay a little bit to let other cpus catch up on
++		 * their cpu mondo queue work.
++		 */
++		if (!mondo_delivered)
++			udelay(usec_wait);
+ 
+-	return;
++		retries++;
++	} while (1);
+ 
+-fatal_mondo_cpu_error:
+-	printk(KERN_CRIT "CPU[%d]: SUN4V mondo cpu error, some target cpus "
+-	       "(including %d) were in error state\n",
+-	       this_cpu, saw_cpu_error - 1);
++xcall_done:
++	if (unlikely(ecpuerror_id > 0)) {
++		pr_crit("CPU[%d]: SUN4V mondo cpu error, target cpu(%d) was in error state\n",
++		       this_cpu, ecpuerror_id - 1);
++	} else if (unlikely(enocpu_id > 0)) {
++		pr_crit("CPU[%d]: SUN4V mondo cpu error, target cpu(%d) does not belong to the domain\n",
++		       this_cpu, enocpu_id - 1);
++	}
+ 	return;
+ 
++fatal_errors:
++	/* fatal errors include bad alignment, etc */
++	pr_crit("CPU[%d]: Args were cnt(%d) cpulist_pa(%lx) mondo_block_pa(%lx)\n",
++	       this_cpu, tot_cpus, tb->cpu_list_pa, tb->cpu_mondo_block_pa);
++	panic("Unexpected SUN4V mondo error %lu\n", status);
++
+ fatal_mondo_timeout:
+-	printk(KERN_CRIT "CPU[%d]: SUN4V mondo timeout, no forward "
+-	       " progress after %d retries.\n",
+-	       this_cpu, retries);
+-	goto dump_cpu_list_and_out;
+-
+-fatal_mondo_error:
+-	printk(KERN_CRIT "CPU[%d]: Unexpected SUN4V mondo error %lu\n",
+-	       this_cpu, status);
+-	printk(KERN_CRIT "CPU[%d]: Args were cnt(%d) cpulist_pa(%lx) "
+-	       "mondo_block_pa(%lx)\n",
+-	       this_cpu, cnt, tb->cpu_list_pa, tb->cpu_mondo_block_pa);
+-
+-dump_cpu_list_and_out:
+-	printk(KERN_CRIT "CPU[%d]: CPU list [ ", this_cpu);
+-	for (i = 0; i < cnt; i++)
+-		printk("%u ", cpu_list[i]);
+-	printk("]\n");
++	/* some cpus being non-responsive to the cpu mondo */
++	pr_crit("CPU[%d]: SUN4V mondo timeout, cpu(%d) made no forward progress after %d retries. Total target cpus(%d).\n",
++	       this_cpu, first_cpu, (tot_retries + retries), tot_cpus);
++	panic("SUN4V mondo timeout panic\n");
+ }
+ 
+ static void (*xcall_deliver_impl)(struct trap_per_cpu *, int);
+diff --git a/arch/sparc/kernel/sun4v_ivec.S b/arch/sparc/kernel/sun4v_ivec.S
+index 559bc5e9c199..34631995859a 100644
+--- a/arch/sparc/kernel/sun4v_ivec.S
++++ b/arch/sparc/kernel/sun4v_ivec.S
+@@ -26,6 +26,21 @@ sun4v_cpu_mondo:
+ 	ldxa	[%g0] ASI_SCRATCHPAD, %g4
+ 	sub	%g4, TRAP_PER_CPU_FAULT_INFO, %g4
+ 
++	/* Get smp_processor_id() into %g3 */
++	sethi	%hi(trap_block), %g5
++	or	%g5, %lo(trap_block), %g5
++	sub	%g4, %g5, %g3
++	srlx	%g3, TRAP_BLOCK_SZ_SHIFT, %g3
++
++	/* Increment cpu_mondo_counter[smp_processor_id()] */
++	sethi	%hi(cpu_mondo_counter), %g5
++	or	%g5, %lo(cpu_mondo_counter), %g5
++	sllx	%g3, 3, %g3
++	add	%g5, %g3, %g5
++	ldx	[%g5], %g3
++	add	%g3, 1, %g3
++	stx	%g3, [%g5]
++
+ 	/* Get CPU mondo queue base phys address into %g7.  */
+ 	ldx	[%g4 + TRAP_PER_CPU_CPU_MONDO_PA], %g7
+ 
+diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
+index 196ee5eb4d48..ad31af1dd726 100644
+--- a/arch/sparc/kernel/traps_64.c
++++ b/arch/sparc/kernel/traps_64.c
+@@ -2733,6 +2733,7 @@ void do_getpsr(struct pt_regs *regs)
+ 	}
+ }
+ 
++u64 cpu_mondo_counter[NR_CPUS] = {0};
+ struct trap_per_cpu trap_block[NR_CPUS];
+ EXPORT_SYMBOL(trap_block);
+ 
+diff --git a/arch/sparc/kernel/tsb.S b/arch/sparc/kernel/tsb.S
+index 07c0df924960..db872dbfafe9 100644
+--- a/arch/sparc/kernel/tsb.S
++++ b/arch/sparc/kernel/tsb.S
+@@ -360,6 +360,7 @@ tsb_flush:
+ 	 * %o1:	TSB base config pointer
+ 	 * %o2:	TSB huge config pointer, or NULL if none
+ 	 * %o3:	Hypervisor TSB descriptor physical address
++	 * %o4: Secondary context to load, if non-zero
+ 	 *
+ 	 * We have to run this whole thing with interrupts
+ 	 * disabled so that the current cpu doesn't change
+@@ -372,6 +373,17 @@ __tsb_context_switch:
+ 	rdpr	%pstate, %g1
+ 	wrpr	%g1, PSTATE_IE, %pstate
+ 
++	brz,pn	%o4, 1f
++	 mov	SECONDARY_CONTEXT, %o5
++
++661:	stxa	%o4, [%o5] ASI_DMMU
++	.section .sun4v_1insn_patch, "ax"
++	.word	661b
++	stxa	%o4, [%o5] ASI_MMU
++	.previous
++	flush	%g6
++
++1:
+ 	TRAP_LOAD_TRAP_BLOCK(%g2, %g3)
+ 
+ 	stx	%o0, [%g2 + TRAP_PER_CPU_PGD_PADDR]
+diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
+index 54f98706b03b..5a8cb37f0a3b 100644
+--- a/arch/sparc/lib/U3memcpy.S
++++ b/arch/sparc/lib/U3memcpy.S
+@@ -145,13 +145,13 @@ ENDPROC(U3_retl_o2_plus_GS_plus_0x08)
+ ENTRY(U3_retl_o2_and_7_plus_GS)
+ 	and	%o2, 7, %o2
+ 	retl
+-	 add	%o2, GLOBAL_SPARE, %o2
++	 add	%o2, GLOBAL_SPARE, %o0
+ ENDPROC(U3_retl_o2_and_7_plus_GS)
+ ENTRY(U3_retl_o2_and_7_plus_GS_plus_8)
+ 	add	GLOBAL_SPARE, 8, GLOBAL_SPARE
+ 	and	%o2, 7, %o2
+ 	retl
+-	 add	%o2, GLOBAL_SPARE, %o2
++	 add	%o2, GLOBAL_SPARE, %o0
+ ENDPROC(U3_retl_o2_and_7_plus_GS_plus_8)
+ #endif
+ 
+diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
+index 3c40ebd50f92..fed73f14aa49 100644
+--- a/arch/sparc/mm/init_64.c
++++ b/arch/sparc/mm/init_64.c
+@@ -325,6 +325,29 @@ static void __update_mmu_tsb_insert(struct mm_struct *mm, unsigned long tsb_inde
+ }
+ 
+ #ifdef CONFIG_HUGETLB_PAGE
++static void __init add_huge_page_size(unsigned long size)
++{
++	unsigned int order;
++
++	if (size_to_hstate(size))
++		return;
++
++	order = ilog2(size) - PAGE_SHIFT;
++	hugetlb_add_hstate(order);
++}
++
++static int __init hugetlbpage_init(void)
++{
++	add_huge_page_size(1UL << HPAGE_64K_SHIFT);
++	add_huge_page_size(1UL << HPAGE_SHIFT);
++	add_huge_page_size(1UL << HPAGE_256MB_SHIFT);
++	add_huge_page_size(1UL << HPAGE_2GB_SHIFT);
++
++	return 0;
++}
++
++arch_initcall(hugetlbpage_init);
++
+ static int __init setup_hugepagesz(char *string)
+ {
+ 	unsigned long long hugepage_size;
+@@ -364,7 +387,7 @@ static int __init setup_hugepagesz(char *string)
+ 		goto out;
+ 	}
+ 
+-	hugetlb_add_hstate(hugepage_shift - PAGE_SHIFT);
++	add_huge_page_size(hugepage_size);
+ 	rc = 1;
+ 
+ out:
+diff --git a/arch/sparc/power/hibernate.c b/arch/sparc/power/hibernate.c
+index 17bd2e167e07..df707a8ad311 100644
+--- a/arch/sparc/power/hibernate.c
++++ b/arch/sparc/power/hibernate.c
+@@ -35,6 +35,5 @@ void restore_processor_state(void)
+ {
+ 	struct mm_struct *mm = current->active_mm;
+ 
+-	load_secondary_context(mm);
+-	tsb_context_switch(mm);
++	tsb_context_switch_ctx(mm, CTX_HWBITS(mm->context));
+ }
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index 43e10d6fdbed..44adcde7a0ca 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -151,6 +151,8 @@ void kvm_async_pf_task_wait(u32 token)
+ 		if (hlist_unhashed(&n.link))
+ 			break;
+ 
++		rcu_irq_exit();
++
+ 		if (!n.halted) {
+ 			local_irq_enable();
+ 			schedule();
+@@ -159,11 +161,11 @@ void kvm_async_pf_task_wait(u32 token)
+ 			/*
+ 			 * We cannot reschedule. So halt.
+ 			 */
+-			rcu_irq_exit();
+ 			native_safe_halt();
+ 			local_irq_disable();
+-			rcu_irq_enter();
+ 		}
++
++		rcu_irq_enter();
+ 	}
+ 	if (!n.halted)
+ 		finish_swait(&n.wq, &wait);
+diff --git a/block/blk-core.c b/block/blk-core.c
+index a7421b772d0e..56a7fac71439 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -3307,6 +3307,10 @@ EXPORT_SYMBOL(blk_finish_plug);
+  */
+ void blk_pm_runtime_init(struct request_queue *q, struct device *dev)
+ {
++	/* not support for RQF_PM and ->rpm_status in blk-mq yet */
++	if (q->mq_ops)
++		return;
++
+ 	q->dev = dev;
+ 	q->rpm_status = RPM_ACTIVE;
+ 	pm_runtime_set_autosuspend_delay(q->dev, -1);
+diff --git a/block/blk-mq-cpumap.c b/block/blk-mq-cpumap.c
+index 8e61e8640e17..5eaecd40f701 100644
+--- a/block/blk-mq-cpumap.c
++++ b/block/blk-mq-cpumap.c
+@@ -35,7 +35,6 @@ int blk_mq_map_queues(struct blk_mq_tag_set *set)
+ {
+ 	unsigned int *map = set->mq_map;
+ 	unsigned int nr_queues = set->nr_hw_queues;
+-	const struct cpumask *online_mask = cpu_online_mask;
+ 	unsigned int i, nr_cpus, nr_uniq_cpus, queue, first_sibling;
+ 	cpumask_var_t cpus;
+ 
+@@ -44,7 +43,7 @@ int blk_mq_map_queues(struct blk_mq_tag_set *set)
+ 
+ 	cpumask_clear(cpus);
+ 	nr_cpus = nr_uniq_cpus = 0;
+-	for_each_cpu(i, online_mask) {
++	for_each_present_cpu(i) {
+ 		nr_cpus++;
+ 		first_sibling = get_first_sibling(i);
+ 		if (!cpumask_test_cpu(first_sibling, cpus))
+@@ -54,7 +53,7 @@ int blk_mq_map_queues(struct blk_mq_tag_set *set)
+ 
+ 	queue = 0;
+ 	for_each_possible_cpu(i) {
+-		if (!cpumask_test_cpu(i, online_mask)) {
++		if (!cpumask_test_cpu(i, cpu_present_mask)) {
+ 			map[i] = 0;
+ 			continue;
+ 		}
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 958cedaff8b8..7353e0080062 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -37,9 +37,6 @@
+ #include "blk-wbt.h"
+ #include "blk-mq-sched.h"
+ 
+-static DEFINE_MUTEX(all_q_mutex);
+-static LIST_HEAD(all_q_list);
+-
+ static void blk_mq_poll_stats_start(struct request_queue *q);
+ static void blk_mq_poll_stats_fn(struct blk_stat_callback *cb);
+ static void __blk_mq_stop_hw_queues(struct request_queue *q, bool sync);
+@@ -1975,8 +1972,8 @@ static void blk_mq_init_cpu_queues(struct request_queue *q,
+ 		INIT_LIST_HEAD(&__ctx->rq_list);
+ 		__ctx->queue = q;
+ 
+-		/* If the cpu isn't online, the cpu is mapped to first hctx */
+-		if (!cpu_online(i))
++		/* If the cpu isn't present, the cpu is mapped to first hctx */
++		if (!cpu_present(i))
+ 			continue;
+ 
+ 		hctx = blk_mq_map_queue(q, i);
+@@ -2019,8 +2016,7 @@ static void blk_mq_free_map_and_requests(struct blk_mq_tag_set *set,
+ 	}
+ }
+ 
+-static void blk_mq_map_swqueue(struct request_queue *q,
+-			       const struct cpumask *online_mask)
++static void blk_mq_map_swqueue(struct request_queue *q)
+ {
+ 	unsigned int i, hctx_idx;
+ 	struct blk_mq_hw_ctx *hctx;
+@@ -2038,13 +2034,11 @@ static void blk_mq_map_swqueue(struct request_queue *q,
+ 	}
+ 
+ 	/*
+-	 * Map software to hardware queues
++	 * Map software to hardware queues.
++	 *
++	 * If the cpu isn't present, the cpu is mapped to first hctx.
+ 	 */
+-	for_each_possible_cpu(i) {
+-		/* If the cpu isn't online, the cpu is mapped to first hctx */
+-		if (!cpumask_test_cpu(i, online_mask))
+-			continue;
+-
++	for_each_present_cpu(i) {
+ 		hctx_idx = q->mq_map[i];
+ 		/* unmapped hw queue can be remapped after CPU topo changed */
+ 		if (!set->tags[hctx_idx] &&
+@@ -2340,16 +2334,8 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
+ 		blk_queue_softirq_done(q, set->ops->complete);
+ 
+ 	blk_mq_init_cpu_queues(q, set->nr_hw_queues);
+-
+-	get_online_cpus();
+-	mutex_lock(&all_q_mutex);
+-
+-	list_add_tail(&q->all_q_node, &all_q_list);
+ 	blk_mq_add_queue_tag_set(set, q);
+-	blk_mq_map_swqueue(q, cpu_online_mask);
+-
+-	mutex_unlock(&all_q_mutex);
+-	put_online_cpus();
++	blk_mq_map_swqueue(q);
+ 
+ 	if (!(set->flags & BLK_MQ_F_NO_SCHED)) {
+ 		int ret;
+@@ -2375,18 +2361,12 @@ void blk_mq_free_queue(struct request_queue *q)
+ {
+ 	struct blk_mq_tag_set	*set = q->tag_set;
+ 
+-	mutex_lock(&all_q_mutex);
+-	list_del_init(&q->all_q_node);
+-	mutex_unlock(&all_q_mutex);
+-
+ 	blk_mq_del_queue_tag_set(q);
+-
+ 	blk_mq_exit_hw_queues(q, set, set->nr_hw_queues);
+ }
+ 
+ /* Basically redo blk_mq_init_queue with queue frozen */
+-static void blk_mq_queue_reinit(struct request_queue *q,
+-				const struct cpumask *online_mask)
++static void blk_mq_queue_reinit(struct request_queue *q)
+ {
+ 	WARN_ON_ONCE(!atomic_read(&q->mq_freeze_depth));
+ 
+@@ -2399,76 +2379,12 @@ static void blk_mq_queue_reinit(struct request_queue *q,
+ 	 * involves free and re-allocate memory, worthy doing?)
+ 	 */
+ 
+-	blk_mq_map_swqueue(q, online_mask);
++	blk_mq_map_swqueue(q);
+ 
+ 	blk_mq_sysfs_register(q);
+ 	blk_mq_debugfs_register_hctxs(q);
+ }
+ 
+-/*
+- * New online cpumask which is going to be set in this hotplug event.
+- * Declare this cpumasks as global as cpu-hotplug operation is invoked
+- * one-by-one and dynamically allocating this could result in a failure.
+- */
+-static struct cpumask cpuhp_online_new;
+-
+-static void blk_mq_queue_reinit_work(void)
+-{
+-	struct request_queue *q;
+-
+-	mutex_lock(&all_q_mutex);
+-	/*
+-	 * We need to freeze and reinit all existing queues.  Freezing
+-	 * involves synchronous wait for an RCU grace period and doing it
+-	 * one by one may take a long time.  Start freezing all queues in
+-	 * one swoop and then wait for the completions so that freezing can
+-	 * take place in parallel.
+-	 */
+-	list_for_each_entry(q, &all_q_list, all_q_node)
+-		blk_freeze_queue_start(q);
+-	list_for_each_entry(q, &all_q_list, all_q_node)
+-		blk_mq_freeze_queue_wait(q);
+-
+-	list_for_each_entry(q, &all_q_list, all_q_node)
+-		blk_mq_queue_reinit(q, &cpuhp_online_new);
+-
+-	list_for_each_entry(q, &all_q_list, all_q_node)
+-		blk_mq_unfreeze_queue(q);
+-
+-	mutex_unlock(&all_q_mutex);
+-}
+-
+-static int blk_mq_queue_reinit_dead(unsigned int cpu)
+-{
+-	cpumask_copy(&cpuhp_online_new, cpu_online_mask);
+-	blk_mq_queue_reinit_work();
+-	return 0;
+-}
+-
+-/*
+- * Before hotadded cpu starts handling requests, new mappings must be
+- * established.  Otherwise, these requests in hw queue might never be
+- * dispatched.
+- *
+- * For example, there is a single hw queue (hctx) and two CPU queues (ctx0
+- * for CPU0, and ctx1 for CPU1).
+- *
+- * Now CPU1 is just onlined and a request is inserted into ctx1->rq_list
+- * and set bit0 in pending bitmap as ctx1->index_hw is still zero.
+- *
+- * And then while running hw queue, blk_mq_flush_busy_ctxs() finds bit0 is set
+- * in pending bitmap and tries to retrieve requests in hctx->ctxs[0]->rq_list.
+- * But htx->ctxs[0] is a pointer to ctx0, so the request in ctx1->rq_list is
+- * ignored.
+- */
+-static int blk_mq_queue_reinit_prepare(unsigned int cpu)
+-{
+-	cpumask_copy(&cpuhp_online_new, cpu_online_mask);
+-	cpumask_set_cpu(cpu, &cpuhp_online_new);
+-	blk_mq_queue_reinit_work();
+-	return 0;
+-}
+-
+ static int __blk_mq_alloc_rq_maps(struct blk_mq_tag_set *set)
+ {
+ 	int i;
+@@ -2679,7 +2595,7 @@ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set,
+ 	blk_mq_update_queue_map(set);
+ 	list_for_each_entry(q, &set->tag_list, tag_set_list) {
+ 		blk_mq_realloc_hw_ctxs(set, q);
+-		blk_mq_queue_reinit(q, cpu_online_mask);
++		blk_mq_queue_reinit(q);
+ 	}
+ 
+ 	list_for_each_entry(q, &set->tag_list, tag_set_list)
+@@ -2895,24 +2811,10 @@ bool blk_mq_poll(struct request_queue *q, blk_qc_t cookie)
+ }
+ EXPORT_SYMBOL_GPL(blk_mq_poll);
+ 
+-void blk_mq_disable_hotplug(void)
+-{
+-	mutex_lock(&all_q_mutex);
+-}
+-
+-void blk_mq_enable_hotplug(void)
+-{
+-	mutex_unlock(&all_q_mutex);
+-}
+-
+ static int __init blk_mq_init(void)
+ {
+ 	cpuhp_setup_state_multi(CPUHP_BLK_MQ_DEAD, "block/mq:dead", NULL,
+ 				blk_mq_hctx_notify_dead);
+-
+-	cpuhp_setup_state_nocalls(CPUHP_BLK_MQ_PREPARE, "block/mq:prepare",
+-				  blk_mq_queue_reinit_prepare,
+-				  blk_mq_queue_reinit_dead);
+ 	return 0;
+ }
+ subsys_initcall(blk_mq_init);
+diff --git a/block/blk-mq.h b/block/blk-mq.h
+index cc67b48e3551..558df56544d2 100644
+--- a/block/blk-mq.h
++++ b/block/blk-mq.h
+@@ -56,11 +56,6 @@ void __blk_mq_insert_request(struct blk_mq_hw_ctx *hctx, struct request *rq,
+ 				bool at_head);
+ void blk_mq_insert_requests(struct blk_mq_hw_ctx *hctx, struct blk_mq_ctx *ctx,
+ 				struct list_head *list);
+-/*
+- * CPU hotplug helpers
+- */
+-void blk_mq_enable_hotplug(void);
+-void blk_mq_disable_hotplug(void);
+ 
+ /*
+  * CPU -> queue mappings
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index 10347e3d73ad..5bd58bd4ab05 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -85,6 +85,7 @@ static const struct lpss_device_desc lpss_dma_desc = {
+ };
+ 
+ struct lpss_private_data {
++	struct acpi_device *adev;
+ 	void __iomem *mmio_base;
+ 	resource_size_t mmio_size;
+ 	unsigned int fixed_clk_rate;
+@@ -155,6 +156,12 @@ static struct pwm_lookup byt_pwm_lookup[] = {
+ 
+ static void byt_pwm_setup(struct lpss_private_data *pdata)
+ {
++	struct acpi_device *adev = pdata->adev;
++
++	/* Only call pwm_add_table for the first PWM controller */
++	if (!adev->pnp.unique_id || strcmp(adev->pnp.unique_id, "1"))
++		return;
++
+ 	if (!acpi_dev_present("INT33FD", NULL, -1))
+ 		pwm_add_table(byt_pwm_lookup, ARRAY_SIZE(byt_pwm_lookup));
+ }
+@@ -180,6 +187,12 @@ static struct pwm_lookup bsw_pwm_lookup[] = {
+ 
+ static void bsw_pwm_setup(struct lpss_private_data *pdata)
+ {
++	struct acpi_device *adev = pdata->adev;
++
++	/* Only call pwm_add_table for the first PWM controller */
++	if (!adev->pnp.unique_id || strcmp(adev->pnp.unique_id, "1"))
++		return;
++
+ 	pwm_add_table(bsw_pwm_lookup, ARRAY_SIZE(bsw_pwm_lookup));
+ }
+ 
+@@ -456,6 +469,7 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
+ 		goto err_out;
+ 	}
+ 
++	pdata->adev = adev;
+ 	pdata->dev_desc = dev_desc;
+ 
+ 	if (dev_desc->setup)
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 49ba9834c715..12d59968020f 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -3028,10 +3028,12 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc)
+ static struct ata_device *ata_find_dev(struct ata_port *ap, int devno)
+ {
+ 	if (!sata_pmp_attached(ap)) {
+-		if (likely(devno < ata_link_max_devices(&ap->link)))
++		if (likely(devno >= 0 &&
++			   devno < ata_link_max_devices(&ap->link)))
+ 			return &ap->link.device[devno];
+ 	} else {
+-		if (likely(devno < ap->nr_pmp_links))
++		if (likely(devno >= 0 &&
++			   devno < ap->nr_pmp_links))
+ 			return &ap->pmp_link[devno].device[0];
+ 	}
+ 
+diff --git a/drivers/clk/sunxi-ng/ccu-sun5i.c b/drivers/clk/sunxi-ng/ccu-sun5i.c
+index 5372bf8be5e6..31d7ffda9aab 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun5i.c
++++ b/drivers/clk/sunxi-ng/ccu-sun5i.c
+@@ -184,7 +184,7 @@ static struct ccu_mux cpu_clk = {
+ 		.hw.init	= CLK_HW_INIT_PARENTS("cpu",
+ 						      cpu_parents,
+ 						      &ccu_mux_ops,
+-						      CLK_IS_CRITICAL),
++						      CLK_SET_RATE_PARENT | CLK_IS_CRITICAL),
+ 	}
+ };
+ 
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index a42a1eea5714..2e96b3d46e0c 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -704,24 +704,23 @@ static irqreturn_t lineevent_irq_thread(int irq, void *p)
+ {
+ 	struct lineevent_state *le = p;
+ 	struct gpioevent_data ge;
+-	int ret;
++	int ret, level;
+ 
+ 	ge.timestamp = ktime_get_real_ns();
++	level = gpiod_get_value_cansleep(le->desc);
+ 
+ 	if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE
+ 	    && le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE) {
+-		int level = gpiod_get_value_cansleep(le->desc);
+-
+ 		if (level)
+ 			/* Emit low-to-high event */
+ 			ge.id = GPIOEVENT_EVENT_RISING_EDGE;
+ 		else
+ 			/* Emit high-to-low event */
+ 			ge.id = GPIOEVENT_EVENT_FALLING_EDGE;
+-	} else if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE) {
++	} else if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE && level) {
+ 		/* Emit low-to-high event */
+ 		ge.id = GPIOEVENT_EVENT_RISING_EDGE;
+-	} else if (le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE) {
++	} else if (le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE && !level) {
+ 		/* Emit high-to-low event */
+ 		ge.id = GPIOEVENT_EVENT_FALLING_EDGE;
+ 	} else {
+diff --git a/drivers/gpu/drm/amd/amdgpu/clearstate_gfx9.h b/drivers/gpu/drm/amd/amdgpu/clearstate_gfx9.h
+index 18fd01f3e4b2..003a131bad47 100644
+--- a/drivers/gpu/drm/amd/amdgpu/clearstate_gfx9.h
++++ b/drivers/gpu/drm/amd/amdgpu/clearstate_gfx9.h
+@@ -1,24 +1,25 @@
+-
+ /*
+-***************************************************************************************************
+-*
+-*  Trade secret of Advanced Micro Devices, Inc.
+-*  Copyright (c) 2010 Advanced Micro Devices, Inc. (unpublished)
+-*
+-*  All rights reserved.  This notice is intended as a precaution against inadvertent publication and
+-*  does not imply publication or any waiver of confidentiality.  The year included in the foregoing
+-*  notice is the year of creation of the work.
+-*
+-***************************************************************************************************
+-*/
+-/**
+-***************************************************************************************************
+-* @brief gfx9 Clearstate Definitions
+-***************************************************************************************************
+-*
+-*   Do not edit! This is a machine-generated file!
+-*
+-*/
++ * Copyright 2017 Advanced Micro Devices, Inc.
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a
++ * copy of this software and associated documentation files (the "Software"),
++ * to deal in the Software without restriction, including without limitation
++ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
++ * and/or sell copies of the Software, and to permit persons to whom the
++ * Software is furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
++ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
++ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
++ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
++ * OTHER DEALINGS IN THE SOFTWARE.
++ *
++ */
+ 
+ static const unsigned int gfx9_SECT_CONTEXT_def_1[] =
+ {
+diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
+index c0b1aabf282f..7dbb7cf47986 100644
+--- a/drivers/gpu/drm/amd/amdgpu/si.c
++++ b/drivers/gpu/drm/amd/amdgpu/si.c
+@@ -1385,6 +1385,7 @@ static void si_init_golden_registers(struct amdgpu_device *adev)
+ 		amdgpu_program_register_sequence(adev,
+ 						 pitcairn_mgcg_cgcg_init,
+ 						 (const u32)ARRAY_SIZE(pitcairn_mgcg_cgcg_init));
++		break;
+ 	case CHIP_VERDE:
+ 		amdgpu_program_register_sequence(adev,
+ 						 verde_golden_registers,
+@@ -1409,6 +1410,7 @@ static void si_init_golden_registers(struct amdgpu_device *adev)
+ 		amdgpu_program_register_sequence(adev,
+ 						 oland_mgcg_cgcg_init,
+ 						 (const u32)ARRAY_SIZE(oland_mgcg_cgcg_init));
++		break;
+ 	case CHIP_HAINAN:
+ 		amdgpu_program_register_sequence(adev,
+ 						 hainan_golden_registers,
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+index 1d2db5d912b0..f8a977f86ec7 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -384,6 +384,12 @@ vmw_du_cursor_plane_atomic_update(struct drm_plane *plane,
+ 
+ 	hotspot_x = du->hotspot_x;
+ 	hotspot_y = du->hotspot_y;
++
++	if (plane->fb) {
++		hotspot_x += plane->fb->hot_x;
++		hotspot_y += plane->fb->hot_y;
++	}
++
+ 	du->cursor_surface = vps->surf;
+ 	du->cursor_dmabuf = vps->dmabuf;
+ 
+@@ -411,6 +417,9 @@ vmw_du_cursor_plane_atomic_update(struct drm_plane *plane,
+ 		vmw_cursor_update_position(dev_priv, true,
+ 					   du->cursor_x + hotspot_x,
+ 					   du->cursor_y + hotspot_y);
++
++		du->core_hotspot_x = hotspot_x - du->hotspot_x;
++		du->core_hotspot_y = hotspot_y - du->hotspot_y;
+ 	} else {
+ 		DRM_ERROR("Failed to update cursor image\n");
+ 	}
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 0f1219fa8561..28fbc81c6e9e 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -4316,6 +4316,7 @@ static int amd_ir_set_vcpu_affinity(struct irq_data *data, void *vcpu_info)
+ 		/* Setting */
+ 		irte->hi.fields.ga_root_ptr = (pi_data->base >> 12);
+ 		irte->hi.fields.vector = vcpu_pi_info->vector;
++		irte->lo.fields_vapic.ga_log_intr = 1;
+ 		irte->lo.fields_vapic.guest_mode = 1;
+ 		irte->lo.fields_vapic.ga_tag = pi_data->ga_tag;
+ 
+diff --git a/drivers/media/pci/saa7164/saa7164-bus.c b/drivers/media/pci/saa7164/saa7164-bus.c
+index b2ff82fa7116..ecfeac5cdbed 100644
+--- a/drivers/media/pci/saa7164/saa7164-bus.c
++++ b/drivers/media/pci/saa7164/saa7164-bus.c
+@@ -389,11 +389,11 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg,
+ 	msg_tmp.size = le16_to_cpu((__force __le16)msg_tmp.size);
+ 	msg_tmp.command = le32_to_cpu((__force __le32)msg_tmp.command);
+ 	msg_tmp.controlselector = le16_to_cpu((__force __le16)msg_tmp.controlselector);
++	memcpy(msg, &msg_tmp, sizeof(*msg));
+ 
+ 	/* No need to update the read positions, because this was a peek */
+ 	/* If the caller specifically want to peek, return */
+ 	if (peekonly) {
+-		memcpy(msg, &msg_tmp, sizeof(*msg));
+ 		goto peekout;
+ 	}
+ 
+@@ -438,21 +438,15 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg,
+ 		space_rem = bus->m_dwSizeGetRing - curr_grp;
+ 
+ 		if (space_rem < sizeof(*msg)) {
+-			/* msg wraps around the ring */
+-			memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, space_rem);
+-			memcpy_fromio((u8 *)msg + space_rem, bus->m_pdwGetRing,
+-				sizeof(*msg) - space_rem);
+ 			if (buf)
+ 				memcpy_fromio(buf, bus->m_pdwGetRing + sizeof(*msg) -
+ 					space_rem, buf_size);
+ 
+ 		} else if (space_rem == sizeof(*msg)) {
+-			memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
+ 			if (buf)
+ 				memcpy_fromio(buf, bus->m_pdwGetRing, buf_size);
+ 		} else {
+ 			/* Additional data wraps around the ring */
+-			memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
+ 			if (buf) {
+ 				memcpy_fromio(buf, bus->m_pdwGetRing + curr_grp +
+ 					sizeof(*msg), space_rem - sizeof(*msg));
+@@ -465,15 +459,10 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg,
+ 
+ 	} else {
+ 		/* No wrapping */
+-		memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
+ 		if (buf)
+ 			memcpy_fromio(buf, bus->m_pdwGetRing + curr_grp + sizeof(*msg),
+ 				buf_size);
+ 	}
+-	/* Convert from little endian to CPU */
+-	msg->size = le16_to_cpu((__force __le16)msg->size);
+-	msg->command = le32_to_cpu((__force __le32)msg->command);
+-	msg->controlselector = le16_to_cpu((__force __le16)msg->controlselector);
+ 
+ 	/* Update the read positions, adjusting the ring */
+ 	saa7164_writel(bus->m_dwGetReadPos, new_grp);
+diff --git a/drivers/media/platform/davinci/vpfe_capture.c b/drivers/media/platform/davinci/vpfe_capture.c
+index e3fe3e0635aa..1831bf5ccca5 100644
+--- a/drivers/media/platform/davinci/vpfe_capture.c
++++ b/drivers/media/platform/davinci/vpfe_capture.c
+@@ -1719,27 +1719,9 @@ static long vpfe_param_handler(struct file *file, void *priv,
+ 
+ 	switch (cmd) {
+ 	case VPFE_CMD_S_CCDC_RAW_PARAMS:
++		ret = -EINVAL;
+ 		v4l2_warn(&vpfe_dev->v4l2_dev,
+-			  "VPFE_CMD_S_CCDC_RAW_PARAMS: experimental ioctl\n");
+-		if (ccdc_dev->hw_ops.set_params) {
+-			ret = ccdc_dev->hw_ops.set_params(param);
+-			if (ret) {
+-				v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+-					"Error setting parameters in CCDC\n");
+-				goto unlock_out;
+-			}
+-			ret = vpfe_get_ccdc_image_format(vpfe_dev,
+-							 &vpfe_dev->fmt);
+-			if (ret < 0) {
+-				v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+-					"Invalid image format at CCDC\n");
+-				goto unlock_out;
+-			}
+-		} else {
+-			ret = -EINVAL;
+-			v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+-				"VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n");
+-		}
++			"VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n");
+ 		break;
+ 	default:
+ 		ret = -ENOTTY;
+diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c
+index de85f1d7ce43..c01b655571a2 100644
+--- a/drivers/media/rc/ir-lirc-codec.c
++++ b/drivers/media/rc/ir-lirc-codec.c
+@@ -266,7 +266,7 @@ static long ir_lirc_ioctl(struct file *filep, unsigned int cmd,
+ 		if (!dev->rx_resolution)
+ 			return -ENOTTY;
+ 
+-		val = dev->rx_resolution;
++		val = dev->rx_resolution / 1000;
+ 		break;
+ 
+ 	case LIRC_SET_WIDEBAND_RECEIVER:
+diff --git a/drivers/media/rc/ir-spi.c b/drivers/media/rc/ir-spi.c
+index c8863f36686a..f39cf8cb639f 100644
+--- a/drivers/media/rc/ir-spi.c
++++ b/drivers/media/rc/ir-spi.c
+@@ -57,10 +57,13 @@ static int ir_spi_tx(struct rc_dev *dev,
+ 
+ 	/* convert the pulse/space signal to raw binary signal */
+ 	for (i = 0; i < count; i++) {
++		unsigned int periods;
+ 		int j;
+ 		u16 val = ((i + 1) % 2) ? idata->pulse : idata->space;
+ 
+-		if (len + buffer[i] >= IR_SPI_MAX_BUFSIZE)
++		periods = DIV_ROUND_CLOSEST(buffer[i] * idata->freq, 1000000);
++
++		if (len + periods >= IR_SPI_MAX_BUFSIZE)
+ 			return -EINVAL;
+ 
+ 		/*
+@@ -69,13 +72,13 @@ static int ir_spi_tx(struct rc_dev *dev,
+ 		 * contain a space duration.
+ 		 */
+ 		val = (i % 2) ? idata->space : idata->pulse;
+-		for (j = 0; j < buffer[i]; j++)
++		for (j = 0; j < periods; j++)
+ 			idata->tx_buf[len++] = val;
+ 	}
+ 
+ 	memset(&xfer, 0, sizeof(xfer));
+ 
+-	xfer.speed_hz = idata->freq;
++	xfer.speed_hz = idata->freq * 16;
+ 	xfer.len = len * sizeof(*idata->tx_buf);
+ 	xfer.tx_buf = idata->tx_buf;
+ 
+diff --git a/drivers/media/usb/pulse8-cec/pulse8-cec.c b/drivers/media/usb/pulse8-cec/pulse8-cec.c
+index 1dfc2de1fe77..4767f4341ba9 100644
+--- a/drivers/media/usb/pulse8-cec/pulse8-cec.c
++++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c
+@@ -51,7 +51,7 @@ MODULE_DESCRIPTION("Pulse Eight HDMI CEC driver");
+ MODULE_LICENSE("GPL");
+ 
+ static int debug;
+-static int persistent_config = 1;
++static int persistent_config;
+ module_param(debug, int, 0644);
+ module_param(persistent_config, int, 0644);
+ MODULE_PARM_DESC(debug, "debug level (0-1)");
+diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
+index 3f8c85d5aa09..88fa03142e92 100644
+--- a/drivers/mmc/core/host.c
++++ b/drivers/mmc/core/host.c
+@@ -176,19 +176,17 @@ static void mmc_retune_timer(unsigned long data)
+  */
+ int mmc_of_parse(struct mmc_host *host)
+ {
+-	struct device_node *np;
++	struct device *dev = host->parent;
+ 	u32 bus_width;
+ 	int ret;
+ 	bool cd_cap_invert, cd_gpio_invert = false;
+ 	bool ro_cap_invert, ro_gpio_invert = false;
+ 
+-	if (!host->parent || !host->parent->of_node)
++	if (!dev || !dev_fwnode(dev))
+ 		return 0;
+ 
+-	np = host->parent->of_node;
+-
+ 	/* "bus-width" is translated to MMC_CAP_*_BIT_DATA flags */
+-	if (of_property_read_u32(np, "bus-width", &bus_width) < 0) {
++	if (device_property_read_u32(dev, "bus-width", &bus_width) < 0) {
+ 		dev_dbg(host->parent,
+ 			"\"bus-width\" property is missing, assuming 1 bit.\n");
+ 		bus_width = 1;
+@@ -210,7 +208,7 @@ int mmc_of_parse(struct mmc_host *host)
+ 	}
+ 
+ 	/* f_max is obtained from the optional "max-frequency" property */
+-	of_property_read_u32(np, "max-frequency", &host->f_max);
++	device_property_read_u32(dev, "max-frequency", &host->f_max);
+ 
+ 	/*
+ 	 * Configure CD and WP pins. They are both by default active low to
+@@ -225,12 +223,12 @@ int mmc_of_parse(struct mmc_host *host)
+ 	 */
+ 
+ 	/* Parse Card Detection */
+-	if (of_property_read_bool(np, "non-removable")) {
++	if (device_property_read_bool(dev, "non-removable")) {
+ 		host->caps |= MMC_CAP_NONREMOVABLE;
+ 	} else {
+-		cd_cap_invert = of_property_read_bool(np, "cd-inverted");
++		cd_cap_invert = device_property_read_bool(dev, "cd-inverted");
+ 
+-		if (of_property_read_bool(np, "broken-cd"))
++		if (device_property_read_bool(dev, "broken-cd"))
+ 			host->caps |= MMC_CAP_NEEDS_POLL;
+ 
+ 		ret = mmc_gpiod_request_cd(host, "cd", 0, true,
+@@ -256,7 +254,7 @@ int mmc_of_parse(struct mmc_host *host)
+ 	}
+ 
+ 	/* Parse Write Protection */
+-	ro_cap_invert = of_property_read_bool(np, "wp-inverted");
++	ro_cap_invert = device_property_read_bool(dev, "wp-inverted");
+ 
+ 	ret = mmc_gpiod_request_ro(host, "wp", 0, false, 0, &ro_gpio_invert);
+ 	if (!ret)
+@@ -264,64 +262,64 @@ int mmc_of_parse(struct mmc_host *host)
+ 	else if (ret != -ENOENT && ret != -ENOSYS)
+ 		return ret;
+ 
+-	if (of_property_read_bool(np, "disable-wp"))
++	if (device_property_read_bool(dev, "disable-wp"))
+ 		host->caps2 |= MMC_CAP2_NO_WRITE_PROTECT;
+ 
+ 	/* See the comment on CD inversion above */
+ 	if (ro_cap_invert ^ ro_gpio_invert)
+ 		host->caps2 |= MMC_CAP2_RO_ACTIVE_HIGH;
+ 
+-	if (of_property_read_bool(np, "cap-sd-highspeed"))
++	if (device_property_read_bool(dev, "cap-sd-highspeed"))
+ 		host->caps |= MMC_CAP_SD_HIGHSPEED;
+-	if (of_property_read_bool(np, "cap-mmc-highspeed"))
++	if (device_property_read_bool(dev, "cap-mmc-highspeed"))
+ 		host->caps |= MMC_CAP_MMC_HIGHSPEED;
+-	if (of_property_read_bool(np, "sd-uhs-sdr12"))
++	if (device_property_read_bool(dev, "sd-uhs-sdr12"))
+ 		host->caps |= MMC_CAP_UHS_SDR12;
+-	if (of_property_read_bool(np, "sd-uhs-sdr25"))
++	if (device_property_read_bool(dev, "sd-uhs-sdr25"))
+ 		host->caps |= MMC_CAP_UHS_SDR25;
+-	if (of_property_read_bool(np, "sd-uhs-sdr50"))
++	if (device_property_read_bool(dev, "sd-uhs-sdr50"))
+ 		host->caps |= MMC_CAP_UHS_SDR50;
+-	if (of_property_read_bool(np, "sd-uhs-sdr104"))
++	if (device_property_read_bool(dev, "sd-uhs-sdr104"))
+ 		host->caps |= MMC_CAP_UHS_SDR104;
+-	if (of_property_read_bool(np, "sd-uhs-ddr50"))
++	if (device_property_read_bool(dev, "sd-uhs-ddr50"))
+ 		host->caps |= MMC_CAP_UHS_DDR50;
+-	if (of_property_read_bool(np, "cap-power-off-card"))
++	if (device_property_read_bool(dev, "cap-power-off-card"))
+ 		host->caps |= MMC_CAP_POWER_OFF_CARD;
+-	if (of_property_read_bool(np, "cap-mmc-hw-reset"))
++	if (device_property_read_bool(dev, "cap-mmc-hw-reset"))
+ 		host->caps |= MMC_CAP_HW_RESET;
+-	if (of_property_read_bool(np, "cap-sdio-irq"))
++	if (device_property_read_bool(dev, "cap-sdio-irq"))
+ 		host->caps |= MMC_CAP_SDIO_IRQ;
+-	if (of_property_read_bool(np, "full-pwr-cycle"))
++	if (device_property_read_bool(dev, "full-pwr-cycle"))
+ 		host->caps2 |= MMC_CAP2_FULL_PWR_CYCLE;
+-	if (of_property_read_bool(np, "keep-power-in-suspend"))
++	if (device_property_read_bool(dev, "keep-power-in-suspend"))
+ 		host->pm_caps |= MMC_PM_KEEP_POWER;
+-	if (of_property_read_bool(np, "wakeup-source") ||
+-	    of_property_read_bool(np, "enable-sdio-wakeup")) /* legacy */
++	if (device_property_read_bool(dev, "wakeup-source") ||
++	    device_property_read_bool(dev, "enable-sdio-wakeup")) /* legacy */
+ 		host->pm_caps |= MMC_PM_WAKE_SDIO_IRQ;
+-	if (of_property_read_bool(np, "mmc-ddr-3_3v"))
++	if (device_property_read_bool(dev, "mmc-ddr-3_3v"))
+ 		host->caps |= MMC_CAP_3_3V_DDR;
+-	if (of_property_read_bool(np, "mmc-ddr-1_8v"))
++	if (device_property_read_bool(dev, "mmc-ddr-1_8v"))
+ 		host->caps |= MMC_CAP_1_8V_DDR;
+-	if (of_property_read_bool(np, "mmc-ddr-1_2v"))
++	if (device_property_read_bool(dev, "mmc-ddr-1_2v"))
+ 		host->caps |= MMC_CAP_1_2V_DDR;
+-	if (of_property_read_bool(np, "mmc-hs200-1_8v"))
++	if (device_property_read_bool(dev, "mmc-hs200-1_8v"))
+ 		host->caps2 |= MMC_CAP2_HS200_1_8V_SDR;
+-	if (of_property_read_bool(np, "mmc-hs200-1_2v"))
++	if (device_property_read_bool(dev, "mmc-hs200-1_2v"))
+ 		host->caps2 |= MMC_CAP2_HS200_1_2V_SDR;
+-	if (of_property_read_bool(np, "mmc-hs400-1_8v"))
++	if (device_property_read_bool(dev, "mmc-hs400-1_8v"))
+ 		host->caps2 |= MMC_CAP2_HS400_1_8V | MMC_CAP2_HS200_1_8V_SDR;
+-	if (of_property_read_bool(np, "mmc-hs400-1_2v"))
++	if (device_property_read_bool(dev, "mmc-hs400-1_2v"))
+ 		host->caps2 |= MMC_CAP2_HS400_1_2V | MMC_CAP2_HS200_1_2V_SDR;
+-	if (of_property_read_bool(np, "mmc-hs400-enhanced-strobe"))
++	if (device_property_read_bool(dev, "mmc-hs400-enhanced-strobe"))
+ 		host->caps2 |= MMC_CAP2_HS400_ES;
+-	if (of_property_read_bool(np, "no-sdio"))
++	if (device_property_read_bool(dev, "no-sdio"))
+ 		host->caps2 |= MMC_CAP2_NO_SDIO;
+-	if (of_property_read_bool(np, "no-sd"))
++	if (device_property_read_bool(dev, "no-sd"))
+ 		host->caps2 |= MMC_CAP2_NO_SD;
+-	if (of_property_read_bool(np, "no-mmc"))
++	if (device_property_read_bool(dev, "no-mmc"))
+ 		host->caps2 |= MMC_CAP2_NO_MMC;
+ 
+-	host->dsr_req = !of_property_read_u32(np, "dsr", &host->dsr);
++	host->dsr_req = !device_property_read_u32(dev, "dsr", &host->dsr);
+ 	if (host->dsr_req && (host->dsr & ~0xffff)) {
+ 		dev_err(host->parent,
+ 			"device tree specified broken value for DSR: 0x%x, ignoring\n",
+diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
+index e45129f48174..efde0f20dd24 100644
+--- a/drivers/mmc/host/dw_mmc.c
++++ b/drivers/mmc/host/dw_mmc.c
+@@ -2707,8 +2707,8 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
+ 	host->slot[id] = slot;
+ 
+ 	mmc->ops = &dw_mci_ops;
+-	if (of_property_read_u32_array(host->dev->of_node,
+-				       "clock-freq-min-max", freq, 2)) {
++	if (device_property_read_u32_array(host->dev, "clock-freq-min-max",
++					   freq, 2)) {
+ 		mmc->f_min = DW_MCI_FREQ_MIN;
+ 		mmc->f_max = DW_MCI_FREQ_MAX;
+ 	} else {
+@@ -2808,7 +2808,6 @@ static void dw_mci_init_dma(struct dw_mci *host)
+ {
+ 	int addr_config;
+ 	struct device *dev = host->dev;
+-	struct device_node *np = dev->of_node;
+ 
+ 	/*
+ 	* Check tansfer mode from HCON[17:16]
+@@ -2869,8 +2868,9 @@ static void dw_mci_init_dma(struct dw_mci *host)
+ 		dev_info(host->dev, "Using internal DMA controller.\n");
+ 	} else {
+ 		/* TRANS_MODE_EDMAC: check dma bindings again */
+-		if ((of_property_count_strings(np, "dma-names") < 0) ||
+-		    (!of_find_property(np, "dmas", NULL))) {
++		if ((device_property_read_string_array(dev, "dma-names",
++						       NULL, 0) < 0) ||
++		    !device_property_present(dev, "dmas")) {
+ 			goto no_dma;
+ 		}
+ 		host->dma_ops = &dw_mci_edmac_ops;
+@@ -2937,7 +2937,6 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
+ {
+ 	struct dw_mci_board *pdata;
+ 	struct device *dev = host->dev;
+-	struct device_node *np = dev->of_node;
+ 	const struct dw_mci_drv_data *drv_data = host->drv_data;
+ 	int ret;
+ 	u32 clock_frequency;
+@@ -2954,20 +2953,21 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
+ 	}
+ 
+ 	/* find out number of slots supported */
+-	of_property_read_u32(np, "num-slots", &pdata->num_slots);
++	device_property_read_u32(dev, "num-slots", &pdata->num_slots);
+ 
+-	if (of_property_read_u32(np, "fifo-depth", &pdata->fifo_depth))
++	if (device_property_read_u32(dev, "fifo-depth", &pdata->fifo_depth))
+ 		dev_info(dev,
+ 			 "fifo-depth property not found, using value of FIFOTH register as default\n");
+ 
+-	of_property_read_u32(np, "card-detect-delay", &pdata->detect_delay_ms);
++	device_property_read_u32(dev, "card-detect-delay",
++				 &pdata->detect_delay_ms);
+ 
+-	of_property_read_u32(np, "data-addr", &host->data_addr_override);
++	device_property_read_u32(dev, "data-addr", &host->data_addr_override);
+ 
+-	if (of_get_property(np, "fifo-watermark-aligned", NULL))
++	if (device_property_present(dev, "fifo-watermark-aligned"))
+ 		host->wm_aligned = true;
+ 
+-	if (!of_property_read_u32(np, "clock-frequency", &clock_frequency))
++	if (!device_property_read_u32(dev, "clock-frequency", &clock_frequency))
+ 		pdata->bus_hz = clock_frequency;
+ 
+ 	if (drv_data && drv_data->parse_dt) {
+diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
+index 7611fd679f1a..1485530c3592 100644
+--- a/drivers/mmc/host/sdhci-of-at91.c
++++ b/drivers/mmc/host/sdhci-of-at91.c
+@@ -31,6 +31,7 @@
+ 
+ #define SDMMC_MC1R	0x204
+ #define		SDMMC_MC1R_DDR		BIT(3)
++#define		SDMMC_MC1R_FCD		BIT(7)
+ #define SDMMC_CACR	0x230
+ #define		SDMMC_CACR_CAPWREN	BIT(0)
+ #define		SDMMC_CACR_KEY		(0x46 << 8)
+@@ -43,6 +44,15 @@ struct sdhci_at91_priv {
+ 	struct clk *mainck;
+ };
+ 
++static void sdhci_at91_set_force_card_detect(struct sdhci_host *host)
++{
++	u8 mc1r;
++
++	mc1r = readb(host->ioaddr + SDMMC_MC1R);
++	mc1r |= SDMMC_MC1R_FCD;
++	writeb(mc1r, host->ioaddr + SDMMC_MC1R);
++}
++
+ static void sdhci_at91_set_clock(struct sdhci_host *host, unsigned int clock)
+ {
+ 	u16 clk;
+@@ -110,10 +120,18 @@ void sdhci_at91_set_uhs_signaling(struct sdhci_host *host, unsigned int timing)
+ 	sdhci_set_uhs_signaling(host, timing);
+ }
+ 
++static void sdhci_at91_reset(struct sdhci_host *host, u8 mask)
++{
++	sdhci_reset(host, mask);
++
++	if (host->mmc->caps & MMC_CAP_NONREMOVABLE)
++		sdhci_at91_set_force_card_detect(host);
++}
++
+ static const struct sdhci_ops sdhci_at91_sama5d2_ops = {
+ 	.set_clock		= sdhci_at91_set_clock,
+ 	.set_bus_width		= sdhci_set_bus_width,
+-	.reset			= sdhci_reset,
++	.reset			= sdhci_at91_reset,
+ 	.set_uhs_signaling	= sdhci_at91_set_uhs_signaling,
+ 	.set_power		= sdhci_at91_set_power,
+ };
+@@ -324,6 +342,21 @@ static int sdhci_at91_probe(struct platform_device *pdev)
+ 		host->quirks &= ~SDHCI_QUIRK_BROKEN_CARD_DETECTION;
+ 	}
+ 
++	/*
++	 * If the device attached to the MMC bus is not removable, it is safer
++	 * to set the Force Card Detect bit. People often don't connect the
++	 * card detect signal and use this pin for another purpose. If the card
++	 * detect pin is not muxed to SDHCI controller, a default value is
++	 * used. This value can be different from a SoC revision to another
++	 * one. Problems come when this default value is not card present. To
++	 * avoid this case, if the device is non removable then the card
++	 * detection procedure using the SDMCC_CD signal is bypassed.
++	 * This bit is reset when a software reset for all command is performed
++	 * so we need to implement our own reset function to set back this bit.
++	 */
++	if (host->mmc->caps & MMC_CAP_NONREMOVABLE)
++		sdhci_at91_set_force_card_detect(host);
++
+ 	pm_runtime_put_autosuspend(&pdev->dev);
+ 
+ 	return 0;
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 8ab6bdbe1682..224e93aa6d23 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2047,6 +2047,7 @@ static int bond_miimon_inspect(struct bonding *bond)
+ 				continue;
+ 
+ 			bond_propose_link_state(slave, BOND_LINK_FAIL);
++			commit++;
+ 			slave->delay = bond->params.downdelay;
+ 			if (slave->delay) {
+ 				netdev_info(bond->dev, "link status down for %sinterface %s, disabling it in %d ms\n",
+@@ -2085,6 +2086,7 @@ static int bond_miimon_inspect(struct bonding *bond)
+ 				continue;
+ 
+ 			bond_propose_link_state(slave, BOND_LINK_BACK);
++			commit++;
+ 			slave->delay = bond->params.updelay;
+ 
+ 			if (slave->delay) {
+@@ -4598,7 +4600,7 @@ static int bond_check_params(struct bond_params *params)
+ 	}
+ 	ad_user_port_key = valptr->value;
+ 
+-	if (bond_mode == BOND_MODE_TLB) {
++	if ((bond_mode == BOND_MODE_TLB) || (bond_mode == BOND_MODE_ALB)) {
+ 		bond_opt_initstr(&newval, "default");
+ 		valptr = bond_opt_parse(bond_opt_get(BOND_OPT_TLB_DYNAMIC_LB),
+ 					&newval);
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index fa0eece21eef..d9cc94a7d44e 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -1668,6 +1668,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ 		.dev_name = "BCM53125",
+ 		.vlans = 4096,
+ 		.enabled_ports = 0xff,
++		.arl_entries = 4,
+ 		.cpu_port = B53_CPU_PORT,
+ 		.vta_regs = B53_VTA_REGS,
+ 		.duplex_reg = B53_DUPLEX_STAT_GE,
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index d034d8cd7d22..32864a47c4c1 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -3377,6 +3377,7 @@ static const struct mv88e6xxx_ops mv88e6390x_ops = {
+ 	.port_jumbo_config = mv88e6165_port_jumbo_config,
+ 	.port_egress_rate_limiting = mv88e6097_port_egress_rate_limiting,
+ 	.port_pause_config = mv88e6390_port_pause_config,
++	.port_set_cmode = mv88e6390x_port_set_cmode,
+ 	.port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
+ 	.port_disable_pri_override = mv88e6xxx_port_disable_pri_override,
+ 	.stats_snapshot = mv88e6390_g1_stats_snapshot,
+diff --git a/drivers/net/ethernet/aurora/nb8800.c b/drivers/net/ethernet/aurora/nb8800.c
+index 5711fbbd6ae3..878cffd37e1f 100644
+--- a/drivers/net/ethernet/aurora/nb8800.c
++++ b/drivers/net/ethernet/aurora/nb8800.c
+@@ -609,7 +609,7 @@ static void nb8800_mac_config(struct net_device *dev)
+ 		mac_mode |= HALF_DUPLEX;
+ 
+ 	if (gigabit) {
+-		if (priv->phy_mode == PHY_INTERFACE_MODE_RGMII)
++		if (phy_interface_is_rgmii(dev->phydev))
+ 			mac_mode |= RGMII_MODE;
+ 
+ 		mac_mode |= GMAC_MODE;
+@@ -1268,11 +1268,10 @@ static int nb8800_tangox_init(struct net_device *dev)
+ 		break;
+ 
+ 	case PHY_INTERFACE_MODE_RGMII:
+-		pad_mode = PAD_MODE_RGMII;
+-		break;
+-
++	case PHY_INTERFACE_MODE_RGMII_ID:
++	case PHY_INTERFACE_MODE_RGMII_RXID:
+ 	case PHY_INTERFACE_MODE_RGMII_TXID:
+-		pad_mode = PAD_MODE_RGMII | PAD_MODE_GTX_CLK_DELAY;
++		pad_mode = PAD_MODE_RGMII;
+ 		break;
+ 
+ 	default:
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+index 10d282841f5b..ac0a460c006a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -777,6 +777,10 @@ static void cb_timeout_handler(struct work_struct *work)
+ 	mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
+ }
+ 
++static void free_msg(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *msg);
++static void mlx5_free_cmd_msg(struct mlx5_core_dev *dev,
++			      struct mlx5_cmd_msg *msg);
++
+ static void cmd_work_handler(struct work_struct *work)
+ {
+ 	struct mlx5_cmd_work_ent *ent = container_of(work, struct mlx5_cmd_work_ent, work);
+@@ -786,16 +790,27 @@ static void cmd_work_handler(struct work_struct *work)
+ 	struct mlx5_cmd_layout *lay;
+ 	struct semaphore *sem;
+ 	unsigned long flags;
++	int alloc_ret;
+ 
+ 	sem = ent->page_queue ? &cmd->pages_sem : &cmd->sem;
+ 	down(sem);
+ 	if (!ent->page_queue) {
+-		ent->idx = alloc_ent(cmd);
+-		if (ent->idx < 0) {
++		alloc_ret = alloc_ent(cmd);
++		if (alloc_ret < 0) {
+ 			mlx5_core_err(dev, "failed to allocate command entry\n");
++			if (ent->callback) {
++				ent->callback(-EAGAIN, ent->context);
++				mlx5_free_cmd_msg(dev, ent->out);
++				free_msg(dev, ent->in);
++				free_cmd(ent);
++			} else {
++				ent->ret = -EAGAIN;
++				complete(&ent->done);
++			}
+ 			up(sem);
+ 			return;
+ 		}
++		ent->idx = alloc_ret;
+ 	} else {
+ 		ent->idx = cmd->max_reg_cmds;
+ 		spin_lock_irqsave(&cmd->alloc_lock, flags);
+@@ -955,7 +970,7 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
+ 
+ 	err = wait_func(dev, ent);
+ 	if (err == -ETIMEDOUT)
+-		goto out_free;
++		goto out;
+ 
+ 	ds = ent->ts2 - ent->ts1;
+ 	op = MLX5_GET(mbox_in, in->first.data, opcode);
+@@ -1419,6 +1434,7 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced)
+ 					mlx5_core_err(dev, "Command completion arrived after timeout (entry idx = %d).\n",
+ 						      ent->idx);
+ 					free_ent(cmd, ent->idx);
++					free_cmd(ent);
+ 				}
+ 				continue;
+ 			}
+@@ -1477,7 +1493,8 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced)
+ 				free_msg(dev, ent->in);
+ 
+ 				err = err ? err : ent->status;
+-				free_cmd(ent);
++				if (!forced)
++					free_cmd(ent);
+ 				callback(err, context);
+ 			} else {
+ 				complete(&ent->done);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+index 944fc1742464..3b39dbd97e57 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+@@ -261,6 +261,14 @@ struct mlx5e_dcbx {
+ };
+ #endif
+ 
++#define MAX_PIN_NUM	8
++struct mlx5e_pps {
++	u8                         pin_caps[MAX_PIN_NUM];
++	struct work_struct         out_work;
++	u64                        start[MAX_PIN_NUM];
++	u8                         enabled;
++};
++
+ struct mlx5e_tstamp {
+ 	rwlock_t                   lock;
+ 	struct cyclecounter        cycles;
+@@ -272,7 +280,7 @@ struct mlx5e_tstamp {
+ 	struct mlx5_core_dev      *mdev;
+ 	struct ptp_clock          *ptp;
+ 	struct ptp_clock_info      ptp_info;
+-	u8                        *pps_pin_caps;
++	struct mlx5e_pps           pps_info;
+ };
+ 
+ enum {
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c b/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c
+index e706a87fc8b2..80c500f87ab6 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c
+@@ -53,6 +53,15 @@ enum {
+ 	MLX5E_EVENT_MODE_ONCE_TILL_ARM	= 0x2,
+ };
+ 
++enum {
++	MLX5E_MTPPS_FS_ENABLE			= BIT(0x0),
++	MLX5E_MTPPS_FS_PATTERN			= BIT(0x2),
++	MLX5E_MTPPS_FS_PIN_MODE			= BIT(0x3),
++	MLX5E_MTPPS_FS_TIME_STAMP		= BIT(0x4),
++	MLX5E_MTPPS_FS_OUT_PULSE_DURATION	= BIT(0x5),
++	MLX5E_MTPPS_FS_ENH_OUT_PER_ADJ		= BIT(0x7),
++};
++
+ void mlx5e_fill_hwstamp(struct mlx5e_tstamp *tstamp, u64 timestamp,
+ 			struct skb_shared_hwtstamps *hwts)
+ {
+@@ -73,17 +82,46 @@ static u64 mlx5e_read_internal_timer(const struct cyclecounter *cc)
+ 	return mlx5_read_internal_timer(tstamp->mdev) & cc->mask;
+ }
+ 
++static void mlx5e_pps_out(struct work_struct *work)
++{
++	struct mlx5e_pps *pps_info = container_of(work, struct mlx5e_pps,
++						  out_work);
++	struct mlx5e_tstamp *tstamp = container_of(pps_info, struct mlx5e_tstamp,
++						   pps_info);
++	u32 in[MLX5_ST_SZ_DW(mtpps_reg)] = {0};
++	unsigned long flags;
++	int i;
++
++	for (i = 0; i < tstamp->ptp_info.n_pins; i++) {
++		u64 tstart;
++
++		write_lock_irqsave(&tstamp->lock, flags);
++		tstart = tstamp->pps_info.start[i];
++		tstamp->pps_info.start[i] = 0;
++		write_unlock_irqrestore(&tstamp->lock, flags);
++		if (!tstart)
++			continue;
++
++		MLX5_SET(mtpps_reg, in, pin, i);
++		MLX5_SET64(mtpps_reg, in, time_stamp, tstart);
++		MLX5_SET(mtpps_reg, in, field_select, MLX5E_MTPPS_FS_TIME_STAMP);
++		mlx5_set_mtpps(tstamp->mdev, in, sizeof(in));
++	}
++}
++
+ static void mlx5e_timestamp_overflow(struct work_struct *work)
+ {
+ 	struct delayed_work *dwork = to_delayed_work(work);
+ 	struct mlx5e_tstamp *tstamp = container_of(dwork, struct mlx5e_tstamp,
+ 						   overflow_work);
++	struct mlx5e_priv *priv = container_of(tstamp, struct mlx5e_priv, tstamp);
+ 	unsigned long flags;
+ 
+ 	write_lock_irqsave(&tstamp->lock, flags);
+ 	timecounter_read(&tstamp->clock);
+ 	write_unlock_irqrestore(&tstamp->lock, flags);
+-	schedule_delayed_work(&tstamp->overflow_work, tstamp->overflow_period);
++	queue_delayed_work(priv->wq, &tstamp->overflow_work,
++			   msecs_to_jiffies(tstamp->overflow_period * 1000));
+ }
+ 
+ int mlx5e_hwstamp_set(struct net_device *dev, struct ifreq *ifr)
+@@ -214,18 +252,6 @@ static int mlx5e_ptp_adjfreq(struct ptp_clock_info *ptp, s32 delta)
+ 	int neg_adj = 0;
+ 	struct mlx5e_tstamp *tstamp = container_of(ptp, struct mlx5e_tstamp,
+ 						  ptp_info);
+-	struct mlx5e_priv *priv =
+-		container_of(tstamp, struct mlx5e_priv, tstamp);
+-
+-	if (MLX5_CAP_GEN(priv->mdev, pps_modify)) {
+-		u32 in[MLX5_ST_SZ_DW(mtpps_reg)] = {0};
+-
+-		/* For future use need to add a loop for finding all 1PPS out pins */
+-		MLX5_SET(mtpps_reg, in, pin_mode, MLX5E_PIN_MODE_OUT);
+-		MLX5_SET(mtpps_reg, in, out_periodic_adjustment, delta & 0xFFFF);
+-
+-		mlx5_set_mtpps(priv->mdev, in, sizeof(in));
+-	}
+ 
+ 	if (delta < 0) {
+ 		neg_adj = 1;
+@@ -254,12 +280,13 @@ static int mlx5e_extts_configure(struct ptp_clock_info *ptp,
+ 	struct mlx5e_priv *priv =
+ 		container_of(tstamp, struct mlx5e_priv, tstamp);
+ 	u32 in[MLX5_ST_SZ_DW(mtpps_reg)] = {0};
++	u32 field_select = 0;
++	u8 pin_mode = 0;
+ 	u8 pattern = 0;
+ 	int pin = -1;
+ 	int err = 0;
+ 
+-	if (!MLX5_CAP_GEN(priv->mdev, pps) ||
+-	    !MLX5_CAP_GEN(priv->mdev, pps_modify))
++	if (!MLX5_PPS_CAP(priv->mdev))
+ 		return -EOPNOTSUPP;
+ 
+ 	if (rq->extts.index >= tstamp->ptp_info.n_pins)
+@@ -269,15 +296,21 @@ static int mlx5e_extts_configure(struct ptp_clock_info *ptp,
+ 		pin = ptp_find_pin(tstamp->ptp, PTP_PF_EXTTS, rq->extts.index);
+ 		if (pin < 0)
+ 			return -EBUSY;
++		pin_mode = MLX5E_PIN_MODE_IN;
++		pattern = !!(rq->extts.flags & PTP_FALLING_EDGE);
++		field_select = MLX5E_MTPPS_FS_PIN_MODE |
++			       MLX5E_MTPPS_FS_PATTERN |
++			       MLX5E_MTPPS_FS_ENABLE;
++	} else {
++		pin = rq->extts.index;
++		field_select = MLX5E_MTPPS_FS_ENABLE;
+ 	}
+ 
+-	if (rq->extts.flags & PTP_FALLING_EDGE)
+-		pattern = 1;
+-
+ 	MLX5_SET(mtpps_reg, in, pin, pin);
+-	MLX5_SET(mtpps_reg, in, pin_mode, MLX5E_PIN_MODE_IN);
++	MLX5_SET(mtpps_reg, in, pin_mode, pin_mode);
+ 	MLX5_SET(mtpps_reg, in, pattern, pattern);
+ 	MLX5_SET(mtpps_reg, in, enable, on);
++	MLX5_SET(mtpps_reg, in, field_select, field_select);
+ 
+ 	err = mlx5_set_mtpps(priv->mdev, in, sizeof(in));
+ 	if (err)
+@@ -296,14 +329,18 @@ static int mlx5e_perout_configure(struct ptp_clock_info *ptp,
+ 	struct mlx5e_priv *priv =
+ 		container_of(tstamp, struct mlx5e_priv, tstamp);
+ 	u32 in[MLX5_ST_SZ_DW(mtpps_reg)] = {0};
+-	u64 nsec_now, nsec_delta, time_stamp;
++	u64 nsec_now, nsec_delta, time_stamp = 0;
+ 	u64 cycles_now, cycles_delta;
+ 	struct timespec64 ts;
+ 	unsigned long flags;
++	u32 field_select = 0;
++	u8 pin_mode = 0;
++	u8 pattern = 0;
+ 	int pin = -1;
++	int err = 0;
+ 	s64 ns;
+ 
+-	if (!MLX5_CAP_GEN(priv->mdev, pps_modify))
++	if (!MLX5_PPS_CAP(priv->mdev))
+ 		return -EOPNOTSUPP;
+ 
+ 	if (rq->perout.index >= tstamp->ptp_info.n_pins)
+@@ -314,32 +351,60 @@ static int mlx5e_perout_configure(struct ptp_clock_info *ptp,
+ 				   rq->perout.index);
+ 		if (pin < 0)
+ 			return -EBUSY;
+-	}
+ 
+-	ts.tv_sec = rq->perout.period.sec;
+-	ts.tv_nsec = rq->perout.period.nsec;
+-	ns = timespec64_to_ns(&ts);
+-	if (on)
++		pin_mode = MLX5E_PIN_MODE_OUT;
++		pattern = MLX5E_OUT_PATTERN_PERIODIC;
++		ts.tv_sec = rq->perout.period.sec;
++		ts.tv_nsec = rq->perout.period.nsec;
++		ns = timespec64_to_ns(&ts);
++
+ 		if ((ns >> 1) != 500000000LL)
+ 			return -EINVAL;
+-	ts.tv_sec = rq->perout.start.sec;
+-	ts.tv_nsec = rq->perout.start.nsec;
+-	ns = timespec64_to_ns(&ts);
+-	cycles_now = mlx5_read_internal_timer(tstamp->mdev);
+-	write_lock_irqsave(&tstamp->lock, flags);
+-	nsec_now = timecounter_cyc2time(&tstamp->clock, cycles_now);
+-	nsec_delta = ns - nsec_now;
+-	cycles_delta = div64_u64(nsec_delta << tstamp->cycles.shift,
+-				 tstamp->cycles.mult);
+-	write_unlock_irqrestore(&tstamp->lock, flags);
+-	time_stamp = cycles_now + cycles_delta;
++
++		ts.tv_sec = rq->perout.start.sec;
++		ts.tv_nsec = rq->perout.start.nsec;
++		ns = timespec64_to_ns(&ts);
++		cycles_now = mlx5_read_internal_timer(tstamp->mdev);
++		write_lock_irqsave(&tstamp->lock, flags);
++		nsec_now = timecounter_cyc2time(&tstamp->clock, cycles_now);
++		nsec_delta = ns - nsec_now;
++		cycles_delta = div64_u64(nsec_delta << tstamp->cycles.shift,
++					 tstamp->cycles.mult);
++		write_unlock_irqrestore(&tstamp->lock, flags);
++		time_stamp = cycles_now + cycles_delta;
++		field_select = MLX5E_MTPPS_FS_PIN_MODE |
++			       MLX5E_MTPPS_FS_PATTERN |
++			       MLX5E_MTPPS_FS_ENABLE |
++			       MLX5E_MTPPS_FS_TIME_STAMP;
++	} else {
++		pin = rq->perout.index;
++		field_select = MLX5E_MTPPS_FS_ENABLE;
++	}
++
+ 	MLX5_SET(mtpps_reg, in, pin, pin);
+-	MLX5_SET(mtpps_reg, in, pin_mode, MLX5E_PIN_MODE_OUT);
+-	MLX5_SET(mtpps_reg, in, pattern, MLX5E_OUT_PATTERN_PERIODIC);
++	MLX5_SET(mtpps_reg, in, pin_mode, pin_mode);
++	MLX5_SET(mtpps_reg, in, pattern, pattern);
+ 	MLX5_SET(mtpps_reg, in, enable, on);
+ 	MLX5_SET64(mtpps_reg, in, time_stamp, time_stamp);
++	MLX5_SET(mtpps_reg, in, field_select, field_select);
++
++	err = mlx5_set_mtpps(priv->mdev, in, sizeof(in));
++	if (err)
++		return err;
+ 
+-	return mlx5_set_mtpps(priv->mdev, in, sizeof(in));
++	return mlx5_set_mtppse(priv->mdev, pin, 0,
++			       MLX5E_EVENT_MODE_REPETETIVE & on);
++}
++
++static int mlx5e_pps_configure(struct ptp_clock_info *ptp,
++			       struct ptp_clock_request *rq,
++			       int on)
++{
++	struct mlx5e_tstamp *tstamp =
++		container_of(ptp, struct mlx5e_tstamp, ptp_info);
++
++	tstamp->pps_info.enabled = !!on;
++	return 0;
+ }
+ 
+ static int mlx5e_ptp_enable(struct ptp_clock_info *ptp,
+@@ -351,6 +416,8 @@ static int mlx5e_ptp_enable(struct ptp_clock_info *ptp,
+ 		return mlx5e_extts_configure(ptp, rq, on);
+ 	case PTP_CLK_REQ_PEROUT:
+ 		return mlx5e_perout_configure(ptp, rq, on);
++	case PTP_CLK_REQ_PPS:
++		return mlx5e_pps_configure(ptp, rq, on);
+ 	default:
+ 		return -EOPNOTSUPP;
+ 	}
+@@ -396,6 +463,7 @@ static int mlx5e_init_pin_config(struct mlx5e_tstamp *tstamp)
+ 		return -ENOMEM;
+ 	tstamp->ptp_info.enable = mlx5e_ptp_enable;
+ 	tstamp->ptp_info.verify = mlx5e_ptp_verify;
++	tstamp->ptp_info.pps = 1;
+ 
+ 	for (i = 0; i < tstamp->ptp_info.n_pins; i++) {
+ 		snprintf(tstamp->ptp_info.pin_config[i].name,
+@@ -423,22 +491,56 @@ static void mlx5e_get_pps_caps(struct mlx5e_priv *priv,
+ 	tstamp->ptp_info.n_per_out = MLX5_GET(mtpps_reg, out,
+ 					      cap_max_num_of_pps_out_pins);
+ 
+-	tstamp->pps_pin_caps[0] = MLX5_GET(mtpps_reg, out, cap_pin_0_mode);
+-	tstamp->pps_pin_caps[1] = MLX5_GET(mtpps_reg, out, cap_pin_1_mode);
+-	tstamp->pps_pin_caps[2] = MLX5_GET(mtpps_reg, out, cap_pin_2_mode);
+-	tstamp->pps_pin_caps[3] = MLX5_GET(mtpps_reg, out, cap_pin_3_mode);
+-	tstamp->pps_pin_caps[4] = MLX5_GET(mtpps_reg, out, cap_pin_4_mode);
+-	tstamp->pps_pin_caps[5] = MLX5_GET(mtpps_reg, out, cap_pin_5_mode);
+-	tstamp->pps_pin_caps[6] = MLX5_GET(mtpps_reg, out, cap_pin_6_mode);
+-	tstamp->pps_pin_caps[7] = MLX5_GET(mtpps_reg, out, cap_pin_7_mode);
++	tstamp->pps_info.pin_caps[0] = MLX5_GET(mtpps_reg, out, cap_pin_0_mode);
++	tstamp->pps_info.pin_caps[1] = MLX5_GET(mtpps_reg, out, cap_pin_1_mode);
++	tstamp->pps_info.pin_caps[2] = MLX5_GET(mtpps_reg, out, cap_pin_2_mode);
++	tstamp->pps_info.pin_caps[3] = MLX5_GET(mtpps_reg, out, cap_pin_3_mode);
++	tstamp->pps_info.pin_caps[4] = MLX5_GET(mtpps_reg, out, cap_pin_4_mode);
++	tstamp->pps_info.pin_caps[5] = MLX5_GET(mtpps_reg, out, cap_pin_5_mode);
++	tstamp->pps_info.pin_caps[6] = MLX5_GET(mtpps_reg, out, cap_pin_6_mode);
++	tstamp->pps_info.pin_caps[7] = MLX5_GET(mtpps_reg, out, cap_pin_7_mode);
+ }
+ 
+ void mlx5e_pps_event_handler(struct mlx5e_priv *priv,
+ 			     struct ptp_clock_event *event)
+ {
++	struct net_device *netdev = priv->netdev;
+ 	struct mlx5e_tstamp *tstamp = &priv->tstamp;
++	struct timespec64 ts;
++	u64 nsec_now, nsec_delta;
++	u64 cycles_now, cycles_delta;
++	int pin = event->index;
++	s64 ns;
++	unsigned long flags;
+ 
+-	ptp_clock_event(tstamp->ptp, event);
++	switch (tstamp->ptp_info.pin_config[pin].func) {
++	case PTP_PF_EXTTS:
++		if (tstamp->pps_info.enabled) {
++			event->type = PTP_CLOCK_PPSUSR;
++			event->pps_times.ts_real = ns_to_timespec64(event->timestamp);
++		} else {
++			event->type = PTP_CLOCK_EXTTS;
++		}
++		ptp_clock_event(tstamp->ptp, event);
++		break;
++	case PTP_PF_PEROUT:
++		mlx5e_ptp_gettime(&tstamp->ptp_info, &ts);
++		cycles_now = mlx5_read_internal_timer(tstamp->mdev);
++		ts.tv_sec += 1;
++		ts.tv_nsec = 0;
++		ns = timespec64_to_ns(&ts);
++		write_lock_irqsave(&tstamp->lock, flags);
++		nsec_now = timecounter_cyc2time(&tstamp->clock, cycles_now);
++		nsec_delta = ns - nsec_now;
++		cycles_delta = div64_u64(nsec_delta << tstamp->cycles.shift,
++					 tstamp->cycles.mult);
++		tstamp->pps_info.start[pin] = cycles_now + cycles_delta;
++		queue_work(priv->wq, &tstamp->pps_info.out_work);
++		write_unlock_irqrestore(&tstamp->lock, flags);
++		break;
++	default:
++		netdev_err(netdev, "%s: Unhandled event\n", __func__);
++	}
+ }
+ 
+ void mlx5e_timestamp_init(struct mlx5e_priv *priv)
+@@ -474,9 +576,10 @@ void mlx5e_timestamp_init(struct mlx5e_priv *priv)
+ 	do_div(ns, NSEC_PER_SEC / 2 / HZ);
+ 	tstamp->overflow_period = ns;
+ 
++	INIT_WORK(&tstamp->pps_info.out_work, mlx5e_pps_out);
+ 	INIT_DELAYED_WORK(&tstamp->overflow_work, mlx5e_timestamp_overflow);
+ 	if (tstamp->overflow_period)
+-		schedule_delayed_work(&tstamp->overflow_work, 0);
++		queue_delayed_work(priv->wq, &tstamp->overflow_work, 0);
+ 	else
+ 		mlx5_core_warn(priv->mdev, "invalid overflow period, overflow_work is not scheduled\n");
+ 
+@@ -485,16 +588,10 @@ void mlx5e_timestamp_init(struct mlx5e_priv *priv)
+ 	snprintf(tstamp->ptp_info.name, 16, "mlx5 ptp");
+ 
+ 	/* Initialize 1PPS data structures */
+-#define MAX_PIN_NUM	8
+-	tstamp->pps_pin_caps = kzalloc(sizeof(u8) * MAX_PIN_NUM, GFP_KERNEL);
+-	if (tstamp->pps_pin_caps) {
+-		if (MLX5_CAP_GEN(priv->mdev, pps))
+-			mlx5e_get_pps_caps(priv, tstamp);
+-		if (tstamp->ptp_info.n_pins)
+-			mlx5e_init_pin_config(tstamp);
+-	} else {
+-		mlx5_core_warn(priv->mdev, "1PPS initialization failed\n");
+-	}
++	if (MLX5_PPS_CAP(priv->mdev))
++		mlx5e_get_pps_caps(priv, tstamp);
++	if (tstamp->ptp_info.n_pins)
++		mlx5e_init_pin_config(tstamp);
+ 
+ 	tstamp->ptp = ptp_clock_register(&tstamp->ptp_info,
+ 					 &priv->mdev->pdev->dev);
+@@ -517,8 +614,7 @@ void mlx5e_timestamp_cleanup(struct mlx5e_priv *priv)
+ 		priv->tstamp.ptp = NULL;
+ 	}
+ 
+-	kfree(tstamp->pps_pin_caps);
+-	kfree(tstamp->ptp_info.pin_config);
+-
++	cancel_work_sync(&tstamp->pps_info.out_work);
+ 	cancel_delayed_work_sync(&tstamp->overflow_work);
++	kfree(tstamp->ptp_info.pin_config);
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
+index 85bf4a389295..986387de13ee 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
+@@ -276,7 +276,7 @@ static void add_rule_to_list(struct mlx5e_priv *priv,
+ 
+ static bool outer_header_zero(u32 *match_criteria)
+ {
+-	int size = MLX5_ST_SZ_BYTES(fte_match_param);
++	int size = MLX5_FLD_SZ_BYTES(fte_match_param, outer_headers);
+ 	char *outer_headers_c = MLX5_ADDR_OF(fte_match_param, match_criteria,
+ 					     outer_headers);
+ 
+@@ -320,7 +320,7 @@ add_ethtool_flow_rule(struct mlx5e_priv *priv,
+ 
+ 	spec->match_criteria_enable = (!outer_header_zero(spec->match_criteria));
+ 	flow_act.flow_tag = MLX5_FS_DEFAULT_FLOW_TAG;
+-	rule = mlx5_add_flow_rules(ft, spec, &flow_act, dst, 1);
++	rule = mlx5_add_flow_rules(ft, spec, &flow_act, dst, dst ? 1 : 0);
+ 	if (IS_ERR(rule)) {
+ 		err = PTR_ERR(rule);
+ 		netdev_err(priv->netdev, "%s: failed to add ethtool steering rule: %d\n",
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 7819fe9ede22..072aa8a13a0a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -365,7 +365,6 @@ static void mlx5e_async_event(struct mlx5_core_dev *mdev, void *vpriv,
+ 		break;
+ 	case MLX5_DEV_EVENT_PPS:
+ 		eqe = (struct mlx5_eqe *)param;
+-		ptp_event.type = PTP_CLOCK_EXTTS;
+ 		ptp_event.index = eqe->data.pps.pin;
+ 		ptp_event.timestamp =
+ 			timecounter_cyc2time(&priv->tstamp.clock,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+index 33eae5ad2fb0..58a9f5c96d10 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+@@ -690,7 +690,7 @@ int mlx5_start_eqs(struct mlx5_core_dev *dev)
+ 	else
+ 		mlx5_core_dbg(dev, "port_module_event is not set\n");
+ 
+-	if (MLX5_CAP_GEN(dev, pps))
++	if (MLX5_PPS_CAP(dev))
+ 		async_event_mask |= (1ull << MLX5_EVENT_TYPE_PPS_EVENT);
+ 
+ 	err = mlx5_create_map_eq(dev, &table->cmd_eq, MLX5_EQ_VEC_CMD,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib.c
+index cc1858752e70..6d90e9e3bfd1 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib.c
+@@ -160,8 +160,6 @@ static int mlx5i_create_underlay_qp(struct mlx5_core_dev *mdev, struct mlx5_core
+ 
+ static void mlx5i_destroy_underlay_qp(struct mlx5_core_dev *mdev, struct mlx5_core_qp *qp)
+ {
+-	mlx5_fs_remove_rx_underlay_qpn(mdev, qp->qpn);
+-
+ 	mlx5_core_destroy_qp(mdev, qp);
+ }
+ 
+@@ -176,8 +174,6 @@ static int mlx5i_init_tx(struct mlx5e_priv *priv)
+ 		return err;
+ 	}
+ 
+-	mlx5_fs_add_rx_underlay_qpn(priv->mdev, ipriv->qp.qpn);
+-
+ 	err = mlx5e_create_tis(priv->mdev, 0 /* tc */, ipriv->qp.qpn, &priv->tisn[0]);
+ 	if (err) {
+ 		mlx5_core_warn(priv->mdev, "create tis failed, %d\n", err);
+@@ -235,6 +231,7 @@ static void mlx5i_destroy_flow_steering(struct mlx5e_priv *priv)
+ 
+ static int mlx5i_init_rx(struct mlx5e_priv *priv)
+ {
++	struct mlx5i_priv *ipriv  = priv->ppriv;
+ 	int err;
+ 
+ 	err = mlx5e_create_indirect_rqt(priv);
+@@ -253,12 +250,18 @@ static int mlx5i_init_rx(struct mlx5e_priv *priv)
+ 	if (err)
+ 		goto err_destroy_indirect_tirs;
+ 
+-	err = mlx5i_create_flow_steering(priv);
++	err = mlx5_fs_add_rx_underlay_qpn(priv->mdev, ipriv->qp.qpn);
+ 	if (err)
+ 		goto err_destroy_direct_tirs;
+ 
++	err = mlx5i_create_flow_steering(priv);
++	if (err)
++		goto err_remove_rx_underlay_qpn;
++
+ 	return 0;
+ 
++err_remove_rx_underlay_qpn:
++	mlx5_fs_remove_rx_underlay_qpn(priv->mdev, ipriv->qp.qpn);
+ err_destroy_direct_tirs:
+ 	mlx5e_destroy_direct_tirs(priv);
+ err_destroy_indirect_tirs:
+@@ -272,6 +275,9 @@ static int mlx5i_init_rx(struct mlx5e_priv *priv)
+ 
+ static void mlx5i_cleanup_rx(struct mlx5e_priv *priv)
+ {
++	struct mlx5i_priv *ipriv  = priv->ppriv;
++
++	mlx5_fs_remove_rx_underlay_qpn(priv->mdev, ipriv->qp.qpn);
+ 	mlx5i_destroy_flow_steering(priv);
+ 	mlx5e_destroy_direct_tirs(priv);
+ 	mlx5e_destroy_indirect_tirs(priv);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+index b5d5519542e8..0ca4623bda6b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+@@ -157,22 +157,17 @@ static bool mlx5_lag_is_bonded(struct mlx5_lag *ldev)
+ static void mlx5_infer_tx_affinity_mapping(struct lag_tracker *tracker,
+ 					   u8 *port1, u8 *port2)
+ {
+-	if (tracker->tx_type == NETDEV_LAG_TX_TYPE_ACTIVEBACKUP) {
+-		if (tracker->netdev_state[0].tx_enabled) {
+-			*port1 = 1;
+-			*port2 = 1;
+-		} else {
+-			*port1 = 2;
+-			*port2 = 2;
+-		}
+-	} else {
+-		*port1 = 1;
+-		*port2 = 2;
+-		if (!tracker->netdev_state[0].link_up)
+-			*port1 = 2;
+-		else if (!tracker->netdev_state[1].link_up)
+-			*port2 = 1;
++	*port1 = 1;
++	*port2 = 2;
++	if (!tracker->netdev_state[0].tx_enabled ||
++	    !tracker->netdev_state[0].link_up) {
++		*port1 = 2;
++		return;
+ 	}
++
++	if (!tracker->netdev_state[1].tx_enabled ||
++	    !tracker->netdev_state[1].link_up)
++		*port2 = 1;
+ }
+ 
+ static void mlx5_activate_lag(struct mlx5_lag *ldev,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+index fbc6e9e9e305..1874aa96c1a1 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+@@ -153,6 +153,11 @@ int mlx5_set_mtpps(struct mlx5_core_dev *mdev, u32 *mtpps, u32 mtpps_size);
+ int mlx5_query_mtppse(struct mlx5_core_dev *mdev, u8 pin, u8 *arm, u8 *mode);
+ int mlx5_set_mtppse(struct mlx5_core_dev *mdev, u8 pin, u8 arm, u8 mode);
+ 
++#define MLX5_PPS_CAP(mdev) (MLX5_CAP_GEN((mdev), pps) &&		\
++			    MLX5_CAP_GEN((mdev), pps_modify) &&		\
++			    MLX5_CAP_MCAM_FEATURE((mdev), mtpps_fs) &&	\
++			    MLX5_CAP_MCAM_FEATURE((mdev), mtpps_enh_out_per_adj))
++
+ void mlx5e_init(void);
+ void mlx5e_cleanup(void);
+ 
+diff --git a/drivers/net/irda/mcs7780.c b/drivers/net/irda/mcs7780.c
+index 6f6ed75b63c9..765de3bedb88 100644
+--- a/drivers/net/irda/mcs7780.c
++++ b/drivers/net/irda/mcs7780.c
+@@ -141,9 +141,19 @@ static int mcs_set_reg(struct mcs_cb *mcs, __u16 reg, __u16 val)
+ static int mcs_get_reg(struct mcs_cb *mcs, __u16 reg, __u16 * val)
+ {
+ 	struct usb_device *dev = mcs->usbdev;
+-	int ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
+-				  MCS_RD_RTYPE, 0, reg, val, 2,
+-				  msecs_to_jiffies(MCS_CTRL_TIMEOUT));
++	void *dmabuf;
++	int ret;
++
++	dmabuf = kmalloc(sizeof(__u16), GFP_KERNEL);
++	if (!dmabuf)
++		return -ENOMEM;
++
++	ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
++			      MCS_RD_RTYPE, 0, reg, dmabuf, 2,
++			      msecs_to_jiffies(MCS_CTRL_TIMEOUT));
++
++	memcpy(val, dmabuf, sizeof(__u16));
++	kfree(dmabuf);
+ 
+ 	return ret;
+ }
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index eebb0e1c70ff..b30d9ceee8bc 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -749,6 +749,9 @@ void phy_stop_machine(struct phy_device *phydev)
+ 	if (phydev->state > PHY_UP && phydev->state != PHY_HALTED)
+ 		phydev->state = PHY_UP;
+ 	mutex_unlock(&phydev->lock);
++
++	/* Now we can run the state machine synchronously */
++	phy_state_machine(&phydev->state_queue.work);
+ }
+ 
+ /**
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 6633dd4bb649..acb754eb1ccb 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -889,21 +889,20 @@ static int add_recvbuf_mergeable(struct virtnet_info *vi,
+ 
+ 	buf = (char *)page_address(alloc_frag->page) + alloc_frag->offset;
+ 	buf += headroom; /* advance address leaving hole at front of pkt */
+-	ctx = (void *)(unsigned long)len;
+ 	get_page(alloc_frag->page);
+ 	alloc_frag->offset += len + headroom;
+ 	hole = alloc_frag->size - alloc_frag->offset;
+ 	if (hole < len + headroom) {
+ 		/* To avoid internal fragmentation, if there is very likely not
+ 		 * enough space for another buffer, add the remaining space to
+-		 * the current buffer. This extra space is not included in
+-		 * the truesize stored in ctx.
++		 * the current buffer.
+ 		 */
+ 		len += hole;
+ 		alloc_frag->offset += hole;
+ 	}
+ 
+ 	sg_init_one(rq->sg, buf, len);
++	ctx = (void *)(unsigned long)len;
+ 	err = virtqueue_add_inbuf_ctx(rq->vq, rq->sg, 1, buf, ctx, gfp);
+ 	if (err < 0)
+ 		put_page(virt_to_head_page(buf));
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 5653d6dd38f6..d44f59ef4f72 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4168,11 +4168,6 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
+ 		goto fail;
+ 	}
+ 
+-	/* allocate scatter-gather table. sg support
+-	 * will be disabled upon allocation failure.
+-	 */
+-	brcmf_sdiod_sgtable_alloc(bus->sdiodev);
+-
+ 	/* Query the F2 block size, set roundup accordingly */
+ 	bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
+ 	bus->roundup = min(max_roundup, bus->blocksize);
+diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
+index 4b97371c3b42..838946d17b59 100644
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
+@@ -1190,11 +1190,11 @@ void iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb)
+ 				next_reclaimed;
+ 			IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
+ 						  next_reclaimed);
++			iwlagn_check_ratid_empty(priv, sta_id, tid);
+ 		}
+ 
+ 		iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs);
+ 
+-		iwlagn_check_ratid_empty(priv, sta_id, tid);
+ 		freed = 0;
+ 
+ 		/* process frames */
+diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
+index 3c52867dfe28..d145e0d90227 100644
+--- a/drivers/scsi/Kconfig
++++ b/drivers/scsi/Kconfig
+@@ -1241,6 +1241,8 @@ config SCSI_LPFC
+ 	tristate "Emulex LightPulse Fibre Channel Support"
+ 	depends on PCI && SCSI
+ 	depends on SCSI_FC_ATTRS
++	depends on NVME_TARGET_FC || NVME_TARGET_FC=n
++	depends on NVME_FC || NVME_FC=n
+ 	select CRC_T10DIF
+ 	---help---
+           This lpfc driver supports the Emulex LightPulse
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index beb5f098f32d..05804227234d 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -437,7 +437,7 @@ static int scatter_data_area(struct tcmu_dev *udev,
+ 			to_offset = get_block_offset_user(udev, dbi,
+ 					block_remaining);
+ 			offset = DATA_BLOCK_SIZE - block_remaining;
+-			to = (void *)(unsigned long)to + offset;
++			to += offset;
+ 
+ 			if (*iov_cnt != 0 &&
+ 			    to_offset == iov_tail(udev, *iov)) {
+@@ -510,7 +510,7 @@ static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd,
+ 			copy_bytes = min_t(size_t, sg_remaining,
+ 					block_remaining);
+ 			offset = DATA_BLOCK_SIZE - block_remaining;
+-			from = (void *)(unsigned long)from + offset;
++			from += offset;
+ 			tcmu_flush_dcache_range(from, copy_bytes);
+ 			memcpy(to + sg->length - sg_remaining, from,
+ 					copy_bytes);
+@@ -699,25 +699,24 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
+ 		size_t pad_size = head_to_end(cmd_head, udev->cmdr_size);
+ 
+ 		entry = (void *) mb + CMDR_OFF + cmd_head;
+-		tcmu_flush_dcache_range(entry, sizeof(*entry));
+ 		tcmu_hdr_set_op(&entry->hdr.len_op, TCMU_OP_PAD);
+ 		tcmu_hdr_set_len(&entry->hdr.len_op, pad_size);
+ 		entry->hdr.cmd_id = 0; /* not used for PAD */
+ 		entry->hdr.kflags = 0;
+ 		entry->hdr.uflags = 0;
++		tcmu_flush_dcache_range(entry, sizeof(*entry));
+ 
+ 		UPDATE_HEAD(mb->cmd_head, pad_size, udev->cmdr_size);
++		tcmu_flush_dcache_range(mb, sizeof(*mb));
+ 
+ 		cmd_head = mb->cmd_head % udev->cmdr_size; /* UAM */
+ 		WARN_ON(cmd_head != 0);
+ 	}
+ 
+ 	entry = (void *) mb + CMDR_OFF + cmd_head;
+-	tcmu_flush_dcache_range(entry, sizeof(*entry));
++	memset(entry, 0, command_size);
+ 	tcmu_hdr_set_op(&entry->hdr.len_op, TCMU_OP_CMD);
+ 	entry->hdr.cmd_id = tcmu_cmd->cmd_id;
+-	entry->hdr.kflags = 0;
+-	entry->hdr.uflags = 0;
+ 
+ 	/* Handle allocating space from the data area */
+ 	tcmu_cmd_reset_dbi_cur(tcmu_cmd);
+@@ -736,11 +735,10 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
+ 		return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+ 	}
+ 	entry->req.iov_cnt = iov_cnt;
+-	entry->req.iov_dif_cnt = 0;
+ 
+ 	/* Handle BIDI commands */
++	iov_cnt = 0;
+ 	if (se_cmd->se_cmd_flags & SCF_BIDI) {
+-		iov_cnt = 0;
+ 		iov++;
+ 		ret = scatter_data_area(udev, tcmu_cmd,
+ 					se_cmd->t_bidi_data_sg,
+@@ -753,8 +751,8 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
+ 			pr_err("tcmu: alloc and scatter bidi data failed\n");
+ 			return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+ 		}
+-		entry->req.iov_bidi_cnt = iov_cnt;
+ 	}
++	entry->req.iov_bidi_cnt = iov_cnt;
+ 
+ 	/*
+ 	 * Recalaulate the command's base size and size according
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 33d979e9ea2a..83eecd33ad96 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -4776,10 +4776,6 @@ static void shrink_delalloc(struct btrfs_root *root, u64 to_reclaim, u64 orig,
+ 		else
+ 			flush = BTRFS_RESERVE_NO_FLUSH;
+ 		spin_lock(&space_info->lock);
+-		if (can_overcommit(root, space_info, orig, flush)) {
+-			spin_unlock(&space_info->lock);
+-			break;
+-		}
+ 		if (list_empty(&space_info->tickets) &&
+ 		    list_empty(&space_info->priority_tickets)) {
+ 			spin_unlock(&space_info->lock);
+diff --git a/fs/ext4/acl.c b/fs/ext4/acl.c
+index 3ec0e46de95f..22a8d532cca6 100644
+--- a/fs/ext4/acl.c
++++ b/fs/ext4/acl.c
+@@ -193,13 +193,6 @@ __ext4_set_acl(handle_t *handle, struct inode *inode, int type,
+ 	switch (type) {
+ 	case ACL_TYPE_ACCESS:
+ 		name_index = EXT4_XATTR_INDEX_POSIX_ACL_ACCESS;
+-		if (acl) {
+-			error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+-			if (error)
+-				return error;
+-			inode->i_ctime = current_time(inode);
+-			ext4_mark_inode_dirty(handle, inode);
+-		}
+ 		break;
+ 
+ 	case ACL_TYPE_DEFAULT:
+@@ -221,8 +214,9 @@ __ext4_set_acl(handle_t *handle, struct inode *inode, int type,
+ 				      value, size, 0);
+ 
+ 	kfree(value);
+-	if (!error)
++	if (!error) {
+ 		set_cached_acl(inode, type, acl);
++	}
+ 
+ 	return error;
+ }
+@@ -232,6 +226,8 @@ ext4_set_acl(struct inode *inode, struct posix_acl *acl, int type)
+ {
+ 	handle_t *handle;
+ 	int error, retries = 0;
++	umode_t mode = inode->i_mode;
++	int update_mode = 0;
+ 
+ 	error = dquot_initialize(inode);
+ 	if (error)
+@@ -242,7 +238,20 @@ ext4_set_acl(struct inode *inode, struct posix_acl *acl, int type)
+ 	if (IS_ERR(handle))
+ 		return PTR_ERR(handle);
+ 
++	if ((type == ACL_TYPE_ACCESS) && acl) {
++		error = posix_acl_update_mode(inode, &mode, &acl);
++		if (error)
++			goto out_stop;
++		update_mode = 1;
++	}
++
+ 	error = __ext4_set_acl(handle, inode, type, acl);
++	if (!error && update_mode) {
++		inode->i_mode = mode;
++		inode->i_ctime = current_time(inode);
++		ext4_mark_inode_dirty(handle, inode);
++	}
++out_stop:
+ 	ext4_journal_stop(handle);
+ 	if (error == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
+ 		goto retry;
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index 02ce7e7bbdf5..407fc5aa32a7 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -521,6 +521,8 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
+ 				lastoff = page_offset(page);
+ 				bh = head = page_buffers(page);
+ 				do {
++					if (lastoff + bh->b_size <= startoff)
++						goto next;
+ 					if (buffer_uptodate(bh) ||
+ 					    buffer_unwritten(bh)) {
+ 						if (whence == SEEK_DATA)
+@@ -535,6 +537,7 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
+ 						unlock_page(page);
+ 						goto out;
+ 					}
++next:
+ 					lastoff += bh->b_size;
+ 					bh = bh->b_this_page;
+ 				} while (bh != head);
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index c3ed9021b781..035cd3f4785e 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -1927,7 +1927,8 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)
+ 			n_desc_blocks = o_desc_blocks +
+ 				le16_to_cpu(es->s_reserved_gdt_blocks);
+ 			n_group = n_desc_blocks * EXT4_DESC_PER_BLOCK(sb);
+-			n_blocks_count = n_group * EXT4_BLOCKS_PER_GROUP(sb);
++			n_blocks_count = (ext4_fsblk_t)n_group *
++				EXT4_BLOCKS_PER_GROUP(sb);
+ 			n_group--; /* set to last group number */
+ 		}
+ 
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index f5a7faac39a7..074169a54162 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7407,7 +7407,7 @@ static void nfs4_exchange_id_done(struct rpc_task *task, void *data)
+ 			cdata->res.server_scope = NULL;
+ 		}
+ 		/* Save the EXCHANGE_ID verifier session trunk tests */
+-		memcpy(clp->cl_confirm.data, cdata->args.verifier->data,
++		memcpy(clp->cl_confirm.data, cdata->args.verifier.data,
+ 		       sizeof(clp->cl_confirm.data));
+ 	}
+ out:
+@@ -7444,7 +7444,6 @@ static const struct rpc_call_ops nfs4_exchange_id_call_ops = {
+ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
+ 			u32 sp4_how, struct rpc_xprt *xprt)
+ {
+-	nfs4_verifier verifier;
+ 	struct rpc_message msg = {
+ 		.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_EXCHANGE_ID],
+ 		.rpc_cred = cred,
+@@ -7468,8 +7467,7 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
+ 		return -ENOMEM;
+ 	}
+ 
+-	if (!xprt)
+-		nfs4_init_boot_verifier(clp, &verifier);
++	nfs4_init_boot_verifier(clp, &calldata->args.verifier);
+ 
+ 	status = nfs4_init_uniform_client_string(clp);
+ 	if (status)
+@@ -7510,9 +7508,8 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
+ 		task_setup_data.rpc_xprt = xprt;
+ 		task_setup_data.flags =
+ 				RPC_TASK_SOFT|RPC_TASK_SOFTCONN|RPC_TASK_ASYNC;
+-		calldata->args.verifier = &clp->cl_confirm;
+-	} else {
+-		calldata->args.verifier = &verifier;
++		memcpy(calldata->args.verifier.data, clp->cl_confirm.data,
++				sizeof(calldata->args.verifier.data));
+ 	}
+ 	calldata->args.client = clp;
+ #ifdef CONFIG_NFS_V4_1_MIGRATION
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index 3aebfdc82b30..b0cbee2b2422 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -1765,7 +1765,7 @@ static void encode_exchange_id(struct xdr_stream *xdr,
+ 	int len = 0;
+ 
+ 	encode_op_hdr(xdr, OP_EXCHANGE_ID, decode_exchange_id_maxsz, hdr);
+-	encode_nfs4_verifier(xdr, args->verifier);
++	encode_nfs4_verifier(xdr, &args->verifier);
+ 
+ 	encode_string(xdr, strlen(args->client->cl_owner_id),
+ 			args->client->cl_owner_id);
+diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c
+index dc22ba8c710f..e50a387959bf 100644
+--- a/fs/ocfs2/acl.c
++++ b/fs/ocfs2/acl.c
+@@ -240,18 +240,6 @@ int ocfs2_set_acl(handle_t *handle,
+ 	switch (type) {
+ 	case ACL_TYPE_ACCESS:
+ 		name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS;
+-		if (acl) {
+-			umode_t mode;
+-
+-			ret = posix_acl_update_mode(inode, &mode, &acl);
+-			if (ret)
+-				return ret;
+-
+-			ret = ocfs2_acl_set_mode(inode, di_bh,
+-						 handle, mode);
+-			if (ret)
+-				return ret;
+-		}
+ 		break;
+ 	case ACL_TYPE_DEFAULT:
+ 		name_index = OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT;
+@@ -289,7 +277,19 @@ int ocfs2_iop_set_acl(struct inode *inode, struct posix_acl *acl, int type)
+ 	had_lock = ocfs2_inode_lock_tracker(inode, &bh, 1, &oh);
+ 	if (had_lock < 0)
+ 		return had_lock;
++	if (type == ACL_TYPE_ACCESS && acl) {
++		umode_t mode;
++
++		status = posix_acl_update_mode(inode, &mode, &acl);
++		if (status)
++			goto unlock;
++
++		status = ocfs2_acl_set_mode(inode, bh, NULL, mode);
++		if (status)
++			goto unlock;
++	}
+ 	status = ocfs2_set_acl(NULL, inode, bh, type, acl, NULL, NULL);
++unlock:
+ 	ocfs2_inode_unlock_tracker(inode, 1, &oh, had_lock);
+ 	brelse(bh);
+ 	return status;
+diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
+index 1d622f276e3a..26f9591b04b1 100644
+--- a/fs/userfaultfd.c
++++ b/fs/userfaultfd.c
+@@ -851,6 +851,9 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
+ 	__wake_up_locked_key(&ctx->fault_wqh, TASK_NORMAL, &range);
+ 	spin_unlock(&ctx->fault_pending_wqh.lock);
+ 
++	/* Flush pending events that may still wait on event_wqh */
++	wake_up_all(&ctx->event_wqh);
++
+ 	wake_up_poll(&ctx->fd_wqh, POLLHUP);
+ 	userfaultfd_ctx_put(ctx);
+ 	return 0;
+@@ -1645,6 +1648,8 @@ static int userfaultfd_zeropage(struct userfaultfd_ctx *ctx,
+ 		ret = mfill_zeropage(ctx->mm, uffdio_zeropage.range.start,
+ 				     uffdio_zeropage.range.len);
+ 		mmput(ctx->mm);
++	} else {
++		return -ENOSPC;
+ 	}
+ 	if (unlikely(put_user(ret, &user_uffdio_zeropage->zeropage)))
+ 		return -EFAULT;
+diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
+index 0f2a80377520..30b86efea2bc 100644
+--- a/include/linux/cpuhotplug.h
++++ b/include/linux/cpuhotplug.h
+@@ -58,7 +58,6 @@ enum cpuhp_state {
+ 	CPUHP_XEN_EVTCHN_PREPARE,
+ 	CPUHP_ARM_SHMOBILE_SCU_PREPARE,
+ 	CPUHP_SH_SH3X_PREPARE,
+-	CPUHP_BLK_MQ_PREPARE,
+ 	CPUHP_NET_FLOW_PREPARE,
+ 	CPUHP_TOPOLOGY_PREPARE,
+ 	CPUHP_NET_IUCV_PREPARE,
+diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
+index 119a3f9604b0..898cfe2eeb42 100644
+--- a/include/linux/cpuset.h
++++ b/include/linux/cpuset.h
+@@ -18,6 +18,19 @@
+ 
+ #ifdef CONFIG_CPUSETS
+ 
++/*
++ * Static branch rewrites can happen in an arbitrary order for a given
++ * key. In code paths where we need to loop with read_mems_allowed_begin() and
++ * read_mems_allowed_retry() to get a consistent view of mems_allowed, we need
++ * to ensure that begin() always gets rewritten before retry() in the
++ * disabled -> enabled transition. If not, then if local irqs are disabled
++ * around the loop, we can deadlock since retry() would always be
++ * comparing the latest value of the mems_allowed seqcount against 0 as
++ * begin() still would see cpusets_enabled() as false. The enabled -> disabled
++ * transition should happen in reverse order for the same reasons (want to stop
++ * looking at real value of mems_allowed.sequence in retry() first).
++ */
++extern struct static_key_false cpusets_pre_enable_key;
+ extern struct static_key_false cpusets_enabled_key;
+ static inline bool cpusets_enabled(void)
+ {
+@@ -32,12 +45,14 @@ static inline int nr_cpusets(void)
+ 
+ static inline void cpuset_inc(void)
+ {
++	static_branch_inc(&cpusets_pre_enable_key);
+ 	static_branch_inc(&cpusets_enabled_key);
+ }
+ 
+ static inline void cpuset_dec(void)
+ {
+ 	static_branch_dec(&cpusets_enabled_key);
++	static_branch_dec(&cpusets_pre_enable_key);
+ }
+ 
+ extern int cpuset_init(void);
+@@ -115,7 +130,7 @@ extern void cpuset_print_current_mems_allowed(void);
+  */
+ static inline unsigned int read_mems_allowed_begin(void)
+ {
+-	if (!cpusets_enabled())
++	if (!static_branch_unlikely(&cpusets_pre_enable_key))
+ 		return 0;
+ 
+ 	return read_seqcount_begin(&current->mems_allowed_seq);
+@@ -129,7 +144,7 @@ static inline unsigned int read_mems_allowed_begin(void)
+  */
+ static inline bool read_mems_allowed_retry(unsigned int seq)
+ {
+-	if (!cpusets_enabled())
++	if (!static_branch_unlikely(&cpusets_enabled_key))
+ 		return false;
+ 
+ 	return read_seqcount_retry(&current->mems_allowed_seq, seq);
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index edafedb7b509..e21a0b3d6454 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -7718,8 +7718,10 @@ struct mlx5_ifc_pcam_reg_bits {
+ };
+ 
+ struct mlx5_ifc_mcam_enhanced_features_bits {
+-	u8         reserved_at_0[0x7f];
++	u8         reserved_at_0[0x7d];
+ 
++	u8         mtpps_enh_out_per_adj[0x1];
++	u8         mtpps_fs[0x1];
+ 	u8         pcie_performance_group[0x1];
+ };
+ 
+@@ -8115,7 +8117,8 @@ struct mlx5_ifc_mtpps_reg_bits {
+ 	u8         reserved_at_78[0x4];
+ 	u8         cap_pin_4_mode[0x4];
+ 
+-	u8         reserved_at_80[0x80];
++	u8         field_select[0x20];
++	u8         reserved_at_a0[0x60];
+ 
+ 	u8         enable[0x1];
+ 	u8         reserved_at_101[0xb];
+@@ -8130,8 +8133,9 @@ struct mlx5_ifc_mtpps_reg_bits {
+ 
+ 	u8         out_pulse_duration[0x10];
+ 	u8         out_periodic_adjustment[0x10];
++	u8         enhanced_out_periodic_adjustment[0x20];
+ 
+-	u8         reserved_at_1a0[0x60];
++	u8         reserved_at_1c0[0x20];
+ };
+ 
+ struct mlx5_ifc_mtppse_reg_bits {
+diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
+index 45cdb27791a3..ab8f7e11c160 100644
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -494,6 +494,10 @@ struct mm_struct {
+ 	 * PROT_NONE or PROT_NUMA mapped page.
+ 	 */
+ 	bool tlb_flush_pending;
++#endif
++#ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
++	/* See flush_tlb_batched_pending() */
++	bool tlb_flush_batched;
+ #endif
+ 	struct uprobes_state uprobes_state;
+ #ifdef CONFIG_HUGETLB_PAGE
+diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
+index b28c83475ee8..7882a07d973e 100644
+--- a/include/linux/nfs_xdr.h
++++ b/include/linux/nfs_xdr.h
+@@ -1222,7 +1222,7 @@ struct nfs41_state_protection {
+ 
+ struct nfs41_exchange_id_args {
+ 	struct nfs_client		*client;
+-	nfs4_verifier			*verifier;
++	nfs4_verifier			verifier;
+ 	u32				flags;
+ 	struct nfs41_state_protection	state_protect;
+ };
+diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
+index c102ef65cb64..db6dc9dc0482 100644
+--- a/include/linux/workqueue.h
++++ b/include/linux/workqueue.h
+@@ -323,6 +323,7 @@ enum {
+ 
+ 	__WQ_DRAINING		= 1 << 16, /* internal: workqueue is draining */
+ 	__WQ_ORDERED		= 1 << 17, /* internal: workqueue is ordered */
++	__WQ_ORDERED_EXPLICIT	= 1 << 18, /* internal: alloc_ordered_workqueue() */
+ 	__WQ_LEGACY		= 1 << 18, /* internal: create*_workqueue() */
+ 
+ 	WQ_MAX_ACTIVE		= 512,	  /* I like 512, better ideas? */
+@@ -422,7 +423,8 @@ __alloc_workqueue_key(const char *fmt, unsigned int flags, int max_active,
+  * Pointer to the allocated workqueue on success, %NULL on failure.
+  */
+ #define alloc_ordered_workqueue(fmt, flags, args...)			\
+-	alloc_workqueue(fmt, WQ_UNBOUND | __WQ_ORDERED | (flags), 1, ##args)
++	alloc_workqueue(fmt, WQ_UNBOUND | __WQ_ORDERED |		\
++			__WQ_ORDERED_EXPLICIT | (flags), 1, ##args)
+ 
+ #define create_workqueue(name)						\
+ 	alloc_workqueue("%s", __WQ_LEGACY | WQ_MEM_RECLAIM, 1, (name))
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index 069582ee5d7f..06db0c3ec384 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -469,6 +469,8 @@ _sctp_walk_params((pos), (chunk), ntohs((chunk)->chunk_hdr.length), member)
+ 
+ #define _sctp_walk_params(pos, chunk, end, member)\
+ for (pos.v = chunk->member;\
++     (pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <=\
++      (void *)chunk + end) &&\
+      pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\
+      ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\
+      pos.v += SCTP_PAD4(ntohs(pos.p->length)))
+@@ -479,6 +481,8 @@ _sctp_walk_errors((err), (chunk_hdr), ntohs((chunk_hdr)->length))
+ #define _sctp_walk_errors(err, chunk_hdr, end)\
+ for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \
+ 	    sizeof(sctp_chunkhdr_t));\
++     ((void *)err + offsetof(sctp_errhdr_t, length) + sizeof(err->length) <=\
++      (void *)chunk_hdr + end) &&\
+      (void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\
+      ntohs(err->length) >= sizeof(sctp_errhdr_t); \
+      err = (sctp_errhdr_t *)((void *)err + SCTP_PAD4(ntohs(err->length))))
+diff --git a/include/net/udp.h b/include/net/udp.h
+index 3391dbd73959..1933442cf1a6 100644
+--- a/include/net/udp.h
++++ b/include/net/udp.h
+@@ -265,6 +265,7 @@ static inline struct sk_buff *skb_recv_udp(struct sock *sk, unsigned int flags,
+ }
+ 
+ void udp_v4_early_demux(struct sk_buff *skb);
++void udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst);
+ int udp_get_port(struct sock *sk, unsigned short snum,
+ 		 int (*saddr_cmp)(const struct sock *,
+ 				  const struct sock *));
+diff --git a/include/sound/soc.h b/include/sound/soc.h
+index 5170fd81e1fd..375893d8d4a5 100644
+--- a/include/sound/soc.h
++++ b/include/sound/soc.h
+@@ -795,10 +795,6 @@ struct snd_soc_component_driver {
+ 	int (*suspend)(struct snd_soc_component *);
+ 	int (*resume)(struct snd_soc_component *);
+ 
+-	/* pcm creation and destruction */
+-	int (*pcm_new)(struct snd_soc_pcm_runtime *);
+-	void (*pcm_free)(struct snd_pcm *);
+-
+ 	/* DT */
+ 	int (*of_xlate_dai_name)(struct snd_soc_component *component,
+ 				 struct of_phandle_args *args,
+@@ -872,8 +868,6 @@ struct snd_soc_component {
+ 	void (*remove)(struct snd_soc_component *);
+ 	int (*suspend)(struct snd_soc_component *);
+ 	int (*resume)(struct snd_soc_component *);
+-	int (*pcm_new)(struct snd_soc_pcm_runtime *);
+-	void (*pcm_free)(struct snd_pcm *);
+ 
+ 	/* machine specific init */
+ 	int (*init)(struct snd_soc_component *component);
+diff --git a/kernel/cgroup/cgroup-internal.h b/kernel/cgroup/cgroup-internal.h
+index 00f4d6bf048f..7a01568e5e22 100644
+--- a/kernel/cgroup/cgroup-internal.h
++++ b/kernel/cgroup/cgroup-internal.h
+@@ -33,6 +33,9 @@ struct cgroup_taskset {
+ 	struct list_head	src_csets;
+ 	struct list_head	dst_csets;
+ 
++	/* the number of tasks in the set */
++	int			nr_tasks;
++
+ 	/* the subsys currently being processed */
+ 	int			ssid;
+ 
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 8d4e85eae42c..2c62e4b3f198 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -1948,6 +1948,8 @@ static void cgroup_migrate_add_task(struct task_struct *task,
+ 	if (!cset->mg_src_cgrp)
+ 		return;
+ 
++	mgctx->tset.nr_tasks++;
++
+ 	list_move_tail(&task->cg_list, &cset->mg_tasks);
+ 	if (list_empty(&cset->mg_node))
+ 		list_add_tail(&cset->mg_node,
+@@ -2036,21 +2038,19 @@ static int cgroup_migrate_execute(struct cgroup_mgctx *mgctx)
+ 	struct css_set *cset, *tmp_cset;
+ 	int ssid, failed_ssid, ret;
+ 
+-	/* methods shouldn't be called if no task is actually migrating */
+-	if (list_empty(&tset->src_csets))
+-		return 0;
+-
+ 	/* check that we can legitimately attach to the cgroup */
+-	do_each_subsys_mask(ss, ssid, mgctx->ss_mask) {
+-		if (ss->can_attach) {
+-			tset->ssid = ssid;
+-			ret = ss->can_attach(tset);
+-			if (ret) {
+-				failed_ssid = ssid;
+-				goto out_cancel_attach;
++	if (tset->nr_tasks) {
++		do_each_subsys_mask(ss, ssid, mgctx->ss_mask) {
++			if (ss->can_attach) {
++				tset->ssid = ssid;
++				ret = ss->can_attach(tset);
++				if (ret) {
++					failed_ssid = ssid;
++					goto out_cancel_attach;
++				}
+ 			}
+-		}
+-	} while_each_subsys_mask();
++		} while_each_subsys_mask();
++	}
+ 
+ 	/*
+ 	 * Now that we're guaranteed success, proceed to move all tasks to
+@@ -2077,25 +2077,29 @@ static int cgroup_migrate_execute(struct cgroup_mgctx *mgctx)
+ 	 */
+ 	tset->csets = &tset->dst_csets;
+ 
+-	do_each_subsys_mask(ss, ssid, mgctx->ss_mask) {
+-		if (ss->attach) {
+-			tset->ssid = ssid;
+-			ss->attach(tset);
+-		}
+-	} while_each_subsys_mask();
++	if (tset->nr_tasks) {
++		do_each_subsys_mask(ss, ssid, mgctx->ss_mask) {
++			if (ss->attach) {
++				tset->ssid = ssid;
++				ss->attach(tset);
++			}
++		} while_each_subsys_mask();
++	}
+ 
+ 	ret = 0;
+ 	goto out_release_tset;
+ 
+ out_cancel_attach:
+-	do_each_subsys_mask(ss, ssid, mgctx->ss_mask) {
+-		if (ssid == failed_ssid)
+-			break;
+-		if (ss->cancel_attach) {
+-			tset->ssid = ssid;
+-			ss->cancel_attach(tset);
+-		}
+-	} while_each_subsys_mask();
++	if (tset->nr_tasks) {
++		do_each_subsys_mask(ss, ssid, mgctx->ss_mask) {
++			if (ssid == failed_ssid)
++				break;
++			if (ss->cancel_attach) {
++				tset->ssid = ssid;
++				ss->cancel_attach(tset);
++			}
++		} while_each_subsys_mask();
++	}
+ out_release_tset:
+ 	spin_lock_irq(&css_set_lock);
+ 	list_splice_init(&tset->dst_csets, &tset->src_csets);
+@@ -2917,11 +2921,11 @@ static ssize_t cgroup_subtree_control_write(struct kernfs_open_file *of,
+ 	cgrp->subtree_control &= ~disable;
+ 
+ 	ret = cgroup_apply_control(cgrp);
+-
+ 	cgroup_finalize_control(cgrp, ret);
++	if (ret)
++		goto out_unlock;
+ 
+ 	kernfs_activate(cgrp->kn);
+-	ret = 0;
+ out_unlock:
+ 	cgroup_kn_unlock(of->kn);
+ 	return ret ?: nbytes;
+@@ -4574,6 +4578,10 @@ int __init cgroup_init(void)
+ 
+ 		if (ss->bind)
+ 			ss->bind(init_css_set.subsys[ssid]);
++
++		mutex_lock(&cgroup_mutex);
++		css_populate_dir(init_css_set.subsys[ssid]);
++		mutex_unlock(&cgroup_mutex);
+ 	}
+ 
+ 	/* init_css_set.subsys[] has been updated, re-hash */
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index ae643412948a..8f26927f16a1 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -63,6 +63,7 @@
+ #include <linux/cgroup.h>
+ #include <linux/wait.h>
+ 
++DEFINE_STATIC_KEY_FALSE(cpusets_pre_enable_key);
+ DEFINE_STATIC_KEY_FALSE(cpusets_enabled_key);
+ 
+ /* See "Frequency meter" comments, below. */
+diff --git a/kernel/time/timer.c b/kernel/time/timer.c
+index 152a706ef8b8..d3f33020a06b 100644
+--- a/kernel/time/timer.c
++++ b/kernel/time/timer.c
+@@ -1495,7 +1495,7 @@ u64 get_next_timer_interrupt(unsigned long basej, u64 basem)
+ 		base->is_idle = false;
+ 	} else {
+ 		if (!is_max_delta)
+-			expires = basem + (nextevt - basej) * TICK_NSEC;
++			expires = basem + (u64)(nextevt - basej) * TICK_NSEC;
+ 		/*
+ 		 * If we expect to sleep more than a tick, mark the base idle:
+ 		 */
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index c74bf39ef764..6effbcb7a3d6 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -3744,8 +3744,12 @@ static int apply_workqueue_attrs_locked(struct workqueue_struct *wq,
+ 		return -EINVAL;
+ 
+ 	/* creating multiple pwqs breaks ordering guarantee */
+-	if (WARN_ON((wq->flags & __WQ_ORDERED) && !list_empty(&wq->pwqs)))
+-		return -EINVAL;
++	if (!list_empty(&wq->pwqs)) {
++		if (WARN_ON(wq->flags & __WQ_ORDERED_EXPLICIT))
++			return -EINVAL;
++
++		wq->flags &= ~__WQ_ORDERED;
++	}
+ 
+ 	ctx = apply_wqattrs_prepare(wq, attrs);
+ 	if (!ctx)
+@@ -3929,6 +3933,16 @@ struct workqueue_struct *__alloc_workqueue_key(const char *fmt,
+ 	struct workqueue_struct *wq;
+ 	struct pool_workqueue *pwq;
+ 
++	/*
++	 * Unbound && max_active == 1 used to imply ordered, which is no
++	 * longer the case on NUMA machines due to per-node pools.  While
++	 * alloc_ordered_workqueue() is the right way to create an ordered
++	 * workqueue, keep the previous behavior to avoid subtle breakages
++	 * on NUMA.
++	 */
++	if ((flags & WQ_UNBOUND) && max_active == 1)
++		flags |= __WQ_ORDERED;
++
+ 	/* see the comment above the definition of WQ_POWER_EFFICIENT */
+ 	if ((flags & WQ_POWER_EFFICIENT) && wq_power_efficient)
+ 		flags |= WQ_UNBOUND;
+@@ -4119,13 +4133,14 @@ void workqueue_set_max_active(struct workqueue_struct *wq, int max_active)
+ 	struct pool_workqueue *pwq;
+ 
+ 	/* disallow meddling with max_active for ordered workqueues */
+-	if (WARN_ON(wq->flags & __WQ_ORDERED))
++	if (WARN_ON(wq->flags & __WQ_ORDERED_EXPLICIT))
+ 		return;
+ 
+ 	max_active = wq_clamp_max_active(max_active, wq->flags, wq->name);
+ 
+ 	mutex_lock(&wq->mutex);
+ 
++	wq->flags &= ~__WQ_ORDERED;
+ 	wq->saved_max_active = max_active;
+ 
+ 	for_each_pwq(pwq, wq)
+@@ -5253,7 +5268,7 @@ int workqueue_sysfs_register(struct workqueue_struct *wq)
+ 	 * attributes breaks ordering guarantee.  Disallow exposing ordered
+ 	 * workqueues.
+ 	 */
+-	if (WARN_ON(wq->flags & __WQ_ORDERED))
++	if (WARN_ON(wq->flags & __WQ_ORDERED_EXPLICIT))
+ 		return -EINVAL;
+ 
+ 	wq->wq_dev = wq_dev = kzalloc(sizeof(*wq_dev), GFP_KERNEL);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 3eedb187e549..cc289933f462 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -4095,6 +4095,7 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 	unsigned long vaddr = *position;
+ 	unsigned long remainder = *nr_pages;
+ 	struct hstate *h = hstate_vma(vma);
++	int err = -EFAULT;
+ 
+ 	while (vaddr < vma->vm_end && remainder) {
+ 		pte_t *pte;
+@@ -4170,11 +4171,7 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 			}
+ 			ret = hugetlb_fault(mm, vma, vaddr, fault_flags);
+ 			if (ret & VM_FAULT_ERROR) {
+-				int err = vm_fault_to_errno(ret, flags);
+-
+-				if (err)
+-					return err;
+-
++				err = vm_fault_to_errno(ret, flags);
+ 				remainder = 0;
+ 				break;
+ 			}
+@@ -4229,7 +4226,7 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 	 */
+ 	*position = vaddr;
+ 
+-	return i ? i : -EFAULT;
++	return i ? i : err;
+ }
+ 
+ #ifndef __HAVE_ARCH_FLUSH_HUGETLB_TLB_RANGE
+diff --git a/mm/internal.h b/mm/internal.h
+index 0e4f558412fb..9c8a2bfb975c 100644
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -498,6 +498,7 @@ extern struct workqueue_struct *mm_percpu_wq;
+ #ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
+ void try_to_unmap_flush(void);
+ void try_to_unmap_flush_dirty(void);
++void flush_tlb_batched_pending(struct mm_struct *mm);
+ #else
+ static inline void try_to_unmap_flush(void)
+ {
+@@ -505,7 +506,9 @@ static inline void try_to_unmap_flush(void)
+ static inline void try_to_unmap_flush_dirty(void)
+ {
+ }
+-
++static inline void flush_tlb_batched_pending(struct mm_struct *mm)
++{
++}
+ #endif /* CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH */
+ 
+ extern const struct trace_print_flags pageflag_names[];
+diff --git a/mm/madvise.c b/mm/madvise.c
+index 25b78ee4fc2c..75d2cffbe61d 100644
+--- a/mm/madvise.c
++++ b/mm/madvise.c
+@@ -320,6 +320,7 @@ static int madvise_free_pte_range(pmd_t *pmd, unsigned long addr,
+ 
+ 	tlb_remove_check_page_size_change(tlb, PAGE_SIZE);
+ 	orig_pte = pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
++	flush_tlb_batched_pending(mm);
+ 	arch_enter_lazy_mmu_mode();
+ 	for (; addr != end; pte++, addr += PAGE_SIZE) {
+ 		ptent = *pte;
+diff --git a/mm/memory.c b/mm/memory.c
+index bb11c474857e..b0c3d1556a94 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1197,6 +1197,7 @@ static unsigned long zap_pte_range(struct mmu_gather *tlb,
+ 	init_rss_vec(rss);
+ 	start_pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
+ 	pte = start_pte;
++	flush_tlb_batched_pending(mm);
+ 	arch_enter_lazy_mmu_mode();
+ 	do {
+ 		pte_t ptent = *pte;
+diff --git a/mm/mprotect.c b/mm/mprotect.c
+index 8edd0d576254..f42749e6bf4e 100644
+--- a/mm/mprotect.c
++++ b/mm/mprotect.c
+@@ -66,6 +66,7 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
+ 	    atomic_read(&vma->vm_mm->mm_users) == 1)
+ 		target_node = numa_node_id();
+ 
++	flush_tlb_batched_pending(vma->vm_mm);
+ 	arch_enter_lazy_mmu_mode();
+ 	do {
+ 		oldpte = *pte;
+diff --git a/mm/mremap.c b/mm/mremap.c
+index cd8a1b199ef9..3f23715d3c69 100644
+--- a/mm/mremap.c
++++ b/mm/mremap.c
+@@ -152,6 +152,7 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
+ 	new_ptl = pte_lockptr(mm, new_pmd);
+ 	if (new_ptl != old_ptl)
+ 		spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING);
++	flush_tlb_batched_pending(vma->vm_mm);
+ 	arch_enter_lazy_mmu_mode();
+ 
+ 	for (; old_addr < old_end; old_pte++, old_addr += PAGE_SIZE,
+@@ -428,6 +429,7 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
+ static unsigned long mremap_to(unsigned long addr, unsigned long old_len,
+ 		unsigned long new_addr, unsigned long new_len, bool *locked,
+ 		struct vm_userfaultfd_ctx *uf,
++		struct list_head *uf_unmap_early,
+ 		struct list_head *uf_unmap)
+ {
+ 	struct mm_struct *mm = current->mm;
+@@ -446,7 +448,7 @@ static unsigned long mremap_to(unsigned long addr, unsigned long old_len,
+ 	if (addr + old_len > new_addr && new_addr + new_len > addr)
+ 		goto out;
+ 
+-	ret = do_munmap(mm, new_addr, new_len, NULL);
++	ret = do_munmap(mm, new_addr, new_len, uf_unmap_early);
+ 	if (ret)
+ 		goto out;
+ 
+@@ -514,6 +516,7 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
+ 	unsigned long charged = 0;
+ 	bool locked = false;
+ 	struct vm_userfaultfd_ctx uf = NULL_VM_UFFD_CTX;
++	LIST_HEAD(uf_unmap_early);
+ 	LIST_HEAD(uf_unmap);
+ 
+ 	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
+@@ -541,7 +544,7 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
+ 
+ 	if (flags & MREMAP_FIXED) {
+ 		ret = mremap_to(addr, old_len, new_addr, new_len,
+-				&locked, &uf, &uf_unmap);
++				&locked, &uf, &uf_unmap_early, &uf_unmap);
+ 		goto out;
+ 	}
+ 
+@@ -621,6 +624,7 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
+ 	up_write(&current->mm->mmap_sem);
+ 	if (locked && new_len > old_len)
+ 		mm_populate(new_addr + old_len, new_len - old_len);
++	userfaultfd_unmap_complete(mm, &uf_unmap_early);
+ 	mremap_userfaultfd_complete(&uf, addr, new_addr, old_len);
+ 	userfaultfd_unmap_complete(mm, &uf_unmap);
+ 	return ret;
+diff --git a/mm/rmap.c b/mm/rmap.c
+index d405f0e0ee96..9835d19fe143 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -616,6 +616,13 @@ static void set_tlb_ubc_flush_pending(struct mm_struct *mm, bool writable)
+ 	cpumask_or(&tlb_ubc->cpumask, &tlb_ubc->cpumask, mm_cpumask(mm));
+ 	tlb_ubc->flush_required = true;
+ 
++	/*
++	 * Ensure compiler does not re-order the setting of tlb_flush_batched
++	 * before the PTE is cleared.
++	 */
++	barrier();
++	mm->tlb_flush_batched = true;
++
+ 	/*
+ 	 * If the PTE was dirty then it's best to assume it's writable. The
+ 	 * caller must use try_to_unmap_flush_dirty() or try_to_unmap_flush()
+@@ -643,6 +650,35 @@ static bool should_defer_flush(struct mm_struct *mm, enum ttu_flags flags)
+ 
+ 	return should_defer;
+ }
++
++/*
++ * Reclaim unmaps pages under the PTL but do not flush the TLB prior to
++ * releasing the PTL if TLB flushes are batched. It's possible for a parallel
++ * operation such as mprotect or munmap to race between reclaim unmapping
++ * the page and flushing the page. If this race occurs, it potentially allows
++ * access to data via a stale TLB entry. Tracking all mm's that have TLB
++ * batching in flight would be expensive during reclaim so instead track
++ * whether TLB batching occurred in the past and if so then do a flush here
++ * if required. This will cost one additional flush per reclaim cycle paid
++ * by the first operation at risk such as mprotect and mumap.
++ *
++ * This must be called under the PTL so that an access to tlb_flush_batched
++ * that is potentially a "reclaim vs mprotect/munmap/etc" race will synchronise
++ * via the PTL.
++ */
++void flush_tlb_batched_pending(struct mm_struct *mm)
++{
++	if (mm->tlb_flush_batched) {
++		flush_tlb_mm(mm);
++
++		/*
++		 * Do not allow the compiler to re-order the clearing of
++		 * tlb_flush_batched before the tlb is flushed.
++		 */
++		barrier();
++		mm->tlb_flush_batched = false;
++	}
++}
+ #else
+ static void set_tlb_ubc_flush_pending(struct mm_struct *mm, bool writable)
+ {
+diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
+index 27fad31784a8..18f9cb9aa87d 100644
+--- a/net/core/dev_ioctl.c
++++ b/net/core/dev_ioctl.c
+@@ -28,6 +28,7 @@ static int dev_ifname(struct net *net, struct ifreq __user *arg)
+ 
+ 	if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
+ 		return -EFAULT;
++	ifr.ifr_name[IFNAMSIZ-1] = 0;
+ 
+ 	error = netdev_get_name(net, ifr.ifr_name, ifr.ifr_ifindex);
+ 	if (error)
+@@ -423,6 +424,8 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
+ 		if (copy_from_user(&iwr, arg, sizeof(iwr)))
+ 			return -EFAULT;
+ 
++		iwr.ifr_name[sizeof(iwr.ifr_name) - 1] = 0;
++
+ 		return wext_handle_ioctl(net, &iwr, cmd, arg);
+ 	}
+ 
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 467a2f4510a7..52bfeb60c886 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1977,7 +1977,8 @@ static int do_setlink(const struct sk_buff *skb,
+ 		struct sockaddr *sa;
+ 		int len;
+ 
+-		len = sizeof(sa_family_t) + dev->addr_len;
++		len = sizeof(sa_family_t) + max_t(size_t, dev->addr_len,
++						  sizeof(*sa));
+ 		sa = kmalloc(len, GFP_KERNEL);
+ 		if (!sa) {
+ 			err = -ENOMEM;
+@@ -4165,6 +4166,7 @@ static int rtnetlink_event(struct notifier_block *this, unsigned long event, voi
+ 
+ 	switch (event) {
+ 	case NETDEV_REBOOT:
++	case NETDEV_CHANGEADDR:
+ 	case NETDEV_CHANGENAME:
+ 	case NETDEV_FEAT_CHANGE:
+ 	case NETDEV_BONDING_FAILOVER:
+diff --git a/net/dccp/feat.c b/net/dccp/feat.c
+index 1704948e6a12..f227f002c73d 100644
+--- a/net/dccp/feat.c
++++ b/net/dccp/feat.c
+@@ -1471,9 +1471,12 @@ int dccp_feat_init(struct sock *sk)
+ 	 * singleton values (which always leads to failure).
+ 	 * These settings can still (later) be overridden via sockopts.
+ 	 */
+-	if (ccid_get_builtin_ccids(&tx.val, &tx.len) ||
+-	    ccid_get_builtin_ccids(&rx.val, &rx.len))
++	if (ccid_get_builtin_ccids(&tx.val, &tx.len))
+ 		return -ENOBUFS;
++	if (ccid_get_builtin_ccids(&rx.val, &rx.len)) {
++		kfree(tx.val);
++		return -ENOBUFS;
++	}
+ 
+ 	if (!dccp_feat_prefer(sysctl_dccp_tx_ccid, tx.val, tx.len) ||
+ 	    !dccp_feat_prefer(sysctl_dccp_rx_ccid, rx.val, rx.len))
+diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
+index f75482bdee9a..97368f229876 100644
+--- a/net/dccp/ipv4.c
++++ b/net/dccp/ipv4.c
+@@ -631,6 +631,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
+ 		goto drop_and_free;
+ 
+ 	inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
++	reqsk_put(req);
+ 	return 0;
+ 
+ drop_and_free:
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index 992621172220..cf3e40df4765 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -380,6 +380,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
+ 		goto drop_and_free;
+ 
+ 	inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
++	reqsk_put(req);
+ 	return 0;
+ 
+ drop_and_free:
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index 83e3ed258467..3acc8261477c 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -1327,13 +1327,14 @@ static struct pernet_operations fib_net_ops = {
+ 
+ void __init ip_fib_init(void)
+ {
+-	rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
+-	rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
+-	rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
++	fib_trie_init();
+ 
+ 	register_pernet_subsys(&fib_net_ops);
++
+ 	register_netdevice_notifier(&fib_netdev_notifier);
+ 	register_inetaddr_notifier(&fib_inetaddr_notifier);
+ 
+-	fib_trie_init();
++	rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
++	rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
++	rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
+ }
+diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
+index ad9ad4aab5da..ce7bc2e5175a 100644
+--- a/net/ipv4/fib_semantics.c
++++ b/net/ipv4/fib_semantics.c
+@@ -1372,7 +1372,7 @@ static int call_fib_nh_notifiers(struct fib_nh *fib_nh,
+ 		return call_fib_notifiers(dev_net(fib_nh->nh_dev), event_type,
+ 					  &info.info);
+ 	case FIB_EVENT_NH_DEL:
+-		if ((IN_DEV_IGNORE_ROUTES_WITH_LINKDOWN(in_dev) &&
++		if ((in_dev && IN_DEV_IGNORE_ROUTES_WITH_LINKDOWN(in_dev) &&
+ 		     fib_nh->nh_flags & RTNH_F_LINKDOWN) ||
+ 		    (fib_nh->nh_flags & RTNH_F_DEAD))
+ 			return call_fib_notifiers(dev_net(fib_nh->nh_dev),
+diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
+index 0257d965f111..4a97fe20f59e 100644
+--- a/net/ipv4/syncookies.c
++++ b/net/ipv4/syncookies.c
+@@ -332,6 +332,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
+ 	treq->rcv_isn		= ntohl(th->seq) - 1;
+ 	treq->snt_isn		= cookie;
+ 	treq->ts_off		= 0;
++	treq->txhash		= net_tx_rndhash();
+ 	req->mss		= mss;
+ 	ireq->ir_num		= ntohs(th->dest);
+ 	ireq->ir_rmt_port	= th->source;
+diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
+index b89bce4c721e..96c95c8d981e 100644
+--- a/net/ipv4/tcp_bbr.c
++++ b/net/ipv4/tcp_bbr.c
+@@ -113,7 +113,8 @@ struct bbr {
+ 		cwnd_gain:10,	/* current gain for setting cwnd */
+ 		full_bw_cnt:3,	/* number of rounds without large bw gains */
+ 		cycle_idx:3,	/* current index in pacing_gain cycle array */
+-		unused_b:6;
++		has_seen_rtt:1, /* have we seen an RTT sample yet? */
++		unused_b:5;
+ 	u32	prior_cwnd;	/* prior cwnd upon entering loss recovery */
+ 	u32	full_bw;	/* recent bw, to estimate if pipe is full */
+ };
+@@ -212,6 +213,35 @@ static u64 bbr_rate_bytes_per_sec(struct sock *sk, u64 rate, int gain)
+ 	return rate >> BW_SCALE;
+ }
+ 
++/* Convert a BBR bw and gain factor to a pacing rate in bytes per second. */
++static u32 bbr_bw_to_pacing_rate(struct sock *sk, u32 bw, int gain)
++{
++	u64 rate = bw;
++
++	rate = bbr_rate_bytes_per_sec(sk, rate, gain);
++	rate = min_t(u64, rate, sk->sk_max_pacing_rate);
++	return rate;
++}
++
++/* Initialize pacing rate to: high_gain * init_cwnd / RTT. */
++static void bbr_init_pacing_rate_from_rtt(struct sock *sk)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++	struct bbr *bbr = inet_csk_ca(sk);
++	u64 bw;
++	u32 rtt_us;
++
++	if (tp->srtt_us) {		/* any RTT sample yet? */
++		rtt_us = max(tp->srtt_us >> 3, 1U);
++		bbr->has_seen_rtt = 1;
++	} else {			 /* no RTT sample yet */
++		rtt_us = USEC_PER_MSEC;	 /* use nominal default RTT */
++	}
++	bw = (u64)tp->snd_cwnd * BW_UNIT;
++	do_div(bw, rtt_us);
++	sk->sk_pacing_rate = bbr_bw_to_pacing_rate(sk, bw, bbr_high_gain);
++}
++
+ /* Pace using current bw estimate and a gain factor. In order to help drive the
+  * network toward lower queues while maintaining high utilization and low
+  * latency, the average pacing rate aims to be slightly (~1%) lower than the
+@@ -221,12 +251,13 @@ static u64 bbr_rate_bytes_per_sec(struct sock *sk, u64 rate, int gain)
+  */
+ static void bbr_set_pacing_rate(struct sock *sk, u32 bw, int gain)
+ {
++	struct tcp_sock *tp = tcp_sk(sk);
+ 	struct bbr *bbr = inet_csk_ca(sk);
+-	u64 rate = bw;
++	u32 rate = bbr_bw_to_pacing_rate(sk, bw, gain);
+ 
+-	rate = bbr_rate_bytes_per_sec(sk, rate, gain);
+-	rate = min_t(u64, rate, sk->sk_max_pacing_rate);
+-	if (bbr->mode != BBR_STARTUP || rate > sk->sk_pacing_rate)
++	if (unlikely(!bbr->has_seen_rtt && tp->srtt_us))
++		bbr_init_pacing_rate_from_rtt(sk);
++	if (bbr_full_bw_reached(sk) || rate > sk->sk_pacing_rate)
+ 		sk->sk_pacing_rate = rate;
+ }
+ 
+@@ -799,7 +830,6 @@ static void bbr_init(struct sock *sk)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 	struct bbr *bbr = inet_csk_ca(sk);
+-	u64 bw;
+ 
+ 	bbr->prior_cwnd = 0;
+ 	bbr->tso_segs_goal = 0;	 /* default segs per skb until first ACK */
+@@ -815,11 +845,8 @@ static void bbr_init(struct sock *sk)
+ 
+ 	minmax_reset(&bbr->bw, bbr->rtt_cnt, 0);  /* init max bw to 0 */
+ 
+-	/* Initialize pacing rate to: high_gain * init_cwnd / RTT. */
+-	bw = (u64)tp->snd_cwnd * BW_UNIT;
+-	do_div(bw, (tp->srtt_us >> 3) ? : USEC_PER_MSEC);
+-	sk->sk_pacing_rate = 0;		/* force an update of sk_pacing_rate */
+-	bbr_set_pacing_rate(sk, bw, bbr_high_gain);
++	bbr->has_seen_rtt = 0;
++	bbr_init_pacing_rate_from_rtt(sk);
+ 
+ 	bbr->restore_cwnd = 0;
+ 	bbr->round_start = 0;
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 1d6219bf2d6b..b9a84eba60b8 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1762,7 +1762,7 @@ static int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+ /* For TCP sockets, sk_rx_dst is protected by socket lock
+  * For UDP, we use xchg() to guard against concurrent changes.
+  */
+-static void udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
++void udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
+ {
+ 	struct dst_entry *old;
+ 
+@@ -2120,6 +2120,7 @@ void udp_destroy_sock(struct sock *sk)
+ 			encap_destroy(sk);
+ 	}
+ }
++EXPORT_SYMBOL(udp_sk_rx_dst_set);
+ 
+ /*
+  *	Socket option code for UDP
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 1699acb2fa2c..be0306778938 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -673,8 +673,6 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+ 		*prevhdr = NEXTHDR_FRAGMENT;
+ 		tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
+ 		if (!tmp_hdr) {
+-			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
+-				      IPSTATS_MIB_FRAGFAILS);
+ 			err = -ENOMEM;
+ 			goto fail;
+ 		}
+@@ -793,8 +791,6 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+ 		frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
+ 				 hroom + troom, GFP_ATOMIC);
+ 		if (!frag) {
+-			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
+-				      IPSTATS_MIB_FRAGFAILS);
+ 			err = -ENOMEM;
+ 			goto fail;
+ 		}
+diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
+index e9065b8d3af8..abb2c307fbe8 100644
+--- a/net/ipv6/output_core.c
++++ b/net/ipv6/output_core.c
+@@ -78,7 +78,7 @@ EXPORT_SYMBOL(ipv6_select_ident);
+ 
+ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
+ {
+-	u16 offset = sizeof(struct ipv6hdr);
++	unsigned int offset = sizeof(struct ipv6hdr);
+ 	unsigned int packet_len = skb_tail_pointer(skb) -
+ 		skb_network_header(skb);
+ 	int found_rhdr = 0;
+@@ -86,6 +86,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
+ 
+ 	while (offset <= packet_len) {
+ 		struct ipv6_opt_hdr *exthdr;
++		unsigned int len;
+ 
+ 		switch (**nexthdr) {
+ 
+@@ -111,7 +112,10 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
+ 
+ 		exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
+ 						 offset);
+-		offset += ipv6_optlen(exthdr);
++		len = ipv6_optlen(exthdr);
++		if (len + offset >= IPV6_MAXPLEN)
++			return -EINVAL;
++		offset += len;
+ 		*nexthdr = &exthdr->nexthdr;
+ 	}
+ 
+diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
+index 5abc3692b901..ca7895454cec 100644
+--- a/net/ipv6/syncookies.c
++++ b/net/ipv6/syncookies.c
+@@ -215,6 +215,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
+ 	treq->rcv_isn = ntohl(th->seq) - 1;
+ 	treq->snt_isn = cookie;
+ 	treq->ts_off = 0;
++	treq->txhash = net_tx_rndhash();
+ 
+ 	/*
+ 	 * We need to lookup the dst_entry to get the correct window size.
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 75703fda23e7..592270c310f4 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -291,11 +291,7 @@ static struct sock *__udp6_lib_lookup_skb(struct sk_buff *skb,
+ 					  struct udp_table *udptable)
+ {
+ 	const struct ipv6hdr *iph = ipv6_hdr(skb);
+-	struct sock *sk;
+ 
+-	sk = skb_steal_sock(skb);
+-	if (unlikely(sk))
+-		return sk;
+ 	return __udp6_lib_lookup(dev_net(skb->dev), &iph->saddr, sport,
+ 				 &iph->daddr, dport, inet6_iif(skb),
+ 				 udptable, skb);
+@@ -798,6 +794,24 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ 	if (udp6_csum_init(skb, uh, proto))
+ 		goto csum_error;
+ 
++	/* Check if the socket is already available, e.g. due to early demux */
++	sk = skb_steal_sock(skb);
++	if (sk) {
++		struct dst_entry *dst = skb_dst(skb);
++		int ret;
++
++		if (unlikely(sk->sk_rx_dst != dst))
++			udp_sk_rx_dst_set(sk, dst);
++
++		ret = udpv6_queue_rcv_skb(sk, skb);
++		sock_put(sk);
++
++		/* a return value > 0 means to resubmit the input */
++		if (ret > 0)
++			return ret;
++		return 0;
++	}
++
+ 	/*
+ 	 *	Multicast receive code
+ 	 */
+@@ -806,11 +820,6 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ 				saddr, daddr, udptable, proto);
+ 
+ 	/* Unicast */
+-
+-	/*
+-	 * check socket cache ... must talk to Alan about his plans
+-	 * for sock caches... i'll skip this for now.
+-	 */
+ 	sk = __udp6_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
+ 	if (sk) {
+ 		int ret;
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index 08679ebb3068..b3bf66bbf4dc 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -1289,8 +1289,8 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
+ 
+ 	nla_for_each_nested(a, attr, rem) {
+ 		int type = nla_type(a);
+-		int maxlen = ovs_ct_attr_lens[type].maxlen;
+-		int minlen = ovs_ct_attr_lens[type].minlen;
++		int maxlen;
++		int minlen;
+ 
+ 		if (type > OVS_CT_ATTR_MAX) {
+ 			OVS_NLERR(log,
+@@ -1298,6 +1298,9 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
+ 				  type, OVS_CT_ATTR_MAX);
+ 			return -EINVAL;
+ 		}
++
++		maxlen = ovs_ct_attr_lens[type].maxlen;
++		minlen = ovs_ct_attr_lens[type].minlen;
+ 		if (nla_len(a) < minlen || nla_len(a) > maxlen) {
+ 			OVS_NLERR(log,
+ 				  "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)",
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index e3eeed19cc7a..0880e0a9d151 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -4334,7 +4334,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 		register_prot_hook(sk);
+ 	}
+ 	spin_unlock(&po->bind_lock);
+-	if (closing && (po->tp_version > TPACKET_V2)) {
++	if (pg_vec && (po->tp_version > TPACKET_V2)) {
+ 		/* Because we don't support block-based V3 on tx-ring */
+ 		if (!tx_ring)
+ 			prb_shutdown_retire_blk_timer(po, rb_queue);
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index 92e332e17391..961a6f81ae64 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -228,7 +228,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
+ 	sctp_adaptation_ind_param_t aiparam;
+ 	sctp_supported_ext_param_t ext_param;
+ 	int num_ext = 0;
+-	__u8 extensions[3];
++	__u8 extensions[4];
+ 	sctp_paramhdr_t *auth_chunks = NULL,
+ 			*auth_hmacs = NULL;
+ 
+@@ -396,7 +396,7 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
+ 	sctp_adaptation_ind_param_t aiparam;
+ 	sctp_supported_ext_param_t ext_param;
+ 	int num_ext = 0;
+-	__u8 extensions[3];
++	__u8 extensions[4];
+ 	sctp_paramhdr_t *auth_chunks = NULL,
+ 			*auth_hmacs = NULL,
+ 			*auth_random = NULL;
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index a808332d02d0..606d5333ff98 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2296,6 +2296,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3),
+ 	SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
+ 	SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
++	SND_PCI_QUIRK(0x104d, 0x9060, "Sony Vaio VPCL14M1R", ALC882_FIXUP_NO_PRIMARY_HP),
+ 	SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
+ 	SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),
+ 
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 754e3ef8d7ae..d05acc8eed1f 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -3139,8 +3139,6 @@ static int snd_soc_component_initialize(struct snd_soc_component *component,
+ 	component->remove = component->driver->remove;
+ 	component->suspend = component->driver->suspend;
+ 	component->resume = component->driver->resume;
+-	component->pcm_new = component->driver->pcm_new;
+-	component->pcm_free = component->driver->pcm_free;
+ 
+ 	dapm = &component->dapm;
+ 	dapm->dev = dev;
+@@ -3328,25 +3326,6 @@ static void snd_soc_platform_drv_remove(struct snd_soc_component *component)
+ 	platform->driver->remove(platform);
+ }
+ 
+-static int snd_soc_platform_drv_pcm_new(struct snd_soc_pcm_runtime *rtd)
+-{
+-	struct snd_soc_platform *platform = rtd->platform;
+-
+-	if (platform->driver->pcm_new)
+-		return platform->driver->pcm_new(rtd);
+-	else
+-		return 0;
+-}
+-
+-static void snd_soc_platform_drv_pcm_free(struct snd_pcm *pcm)
+-{
+-	struct snd_soc_pcm_runtime *rtd = pcm->private_data;
+-	struct snd_soc_platform *platform = rtd->platform;
+-
+-	if (platform->driver->pcm_free)
+-		platform->driver->pcm_free(pcm);
+-}
+-
+ /**
+  * snd_soc_add_platform - Add a platform to the ASoC core
+  * @dev: The parent device for the platform
+@@ -3370,10 +3349,6 @@ int snd_soc_add_platform(struct device *dev, struct snd_soc_platform *platform,
+ 		platform->component.probe = snd_soc_platform_drv_probe;
+ 	if (platform_drv->remove)
+ 		platform->component.remove = snd_soc_platform_drv_remove;
+-	if (platform_drv->pcm_new)
+-		platform->component.pcm_new = snd_soc_platform_drv_pcm_new;
+-	if (platform_drv->pcm_free)
+-		platform->component.pcm_free = snd_soc_platform_drv_pcm_free;
+ 
+ #ifdef CONFIG_DEBUG_FS
+ 	platform->component.debugfs_prefix = "platform";
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index efc5831f205d..8ff7cd3b8c1f 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -181,6 +181,10 @@ int dpcm_dapm_stream_event(struct snd_soc_pcm_runtime *fe, int dir,
+ 		dev_dbg(be->dev, "ASoC: BE %s event %d dir %d\n",
+ 				be->dai_link->name, event, dir);
+ 
++		if ((event == SND_SOC_DAPM_STREAM_STOP) &&
++		    (be->dpcm[dir].users >= 1))
++			continue;
++
+ 		snd_soc_dapm_stream_event(be, dir, event);
+ 	}
+ 
+@@ -2628,25 +2632,12 @@ static int dpcm_fe_dai_close(struct snd_pcm_substream *fe_substream)
+ 	return ret;
+ }
+ 
+-static void soc_pcm_free(struct snd_pcm *pcm)
+-{
+-	struct snd_soc_pcm_runtime *rtd = pcm->private_data;
+-	struct snd_soc_component *component;
+-
+-	list_for_each_entry(component, &rtd->card->component_dev_list,
+-			    card_list) {
+-		if (component->pcm_free)
+-			component->pcm_free(pcm);
+-	}
+-}
+-
+ /* create a new pcm */
+ int soc_new_pcm(struct snd_soc_pcm_runtime *rtd, int num)
+ {
+ 	struct snd_soc_platform *platform = rtd->platform;
+ 	struct snd_soc_dai *codec_dai;
+ 	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+-	struct snd_soc_component *component;
+ 	struct snd_pcm *pcm;
+ 	char new_name[64];
+ 	int ret = 0, playback = 0, capture = 0;
+@@ -2755,18 +2746,17 @@ int soc_new_pcm(struct snd_soc_pcm_runtime *rtd, int num)
+ 	if (capture)
+ 		snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_CAPTURE, &rtd->ops);
+ 
+-	list_for_each_entry(component, &rtd->card->component_dev_list, card_list) {
+-		if (component->pcm_new) {
+-			ret = component->pcm_new(rtd);
+-			if (ret < 0) {
+-				dev_err(component->dev,
+-					"ASoC: pcm constructor failed: %d\n",
+-					ret);
+-				return ret;
+-			}
++	if (platform->driver->pcm_new) {
++		ret = platform->driver->pcm_new(rtd);
++		if (ret < 0) {
++			dev_err(platform->dev,
++				"ASoC: pcm constructor failed: %d\n",
++				ret);
++			return ret;
+ 		}
+ 	}
+-	pcm->private_free = soc_pcm_free;
++
++	pcm->private_free = platform->driver->pcm_free;
+ out:
+ 	dev_info(rtd->card->dev, "%s <-> %s mapping ok\n",
+ 		 (rtd->num_codecs > 1) ? "multicodec" : rtd->codec_dai->name,
+diff --git a/sound/soc/ux500/mop500.c b/sound/soc/ux500/mop500.c
+index b50f68a439ce..ba9fc099cf67 100644
+--- a/sound/soc/ux500/mop500.c
++++ b/sound/soc/ux500/mop500.c
+@@ -33,6 +33,7 @@ static struct snd_soc_dai_link mop500_dai_links[] = {
+ 		.stream_name = "ab8500_0",
+ 		.cpu_dai_name = "ux500-msp-i2s.1",
+ 		.codec_dai_name = "ab8500-codec-dai.0",
++		.platform_name = "ux500-msp-i2s.1",
+ 		.codec_name = "ab8500-codec.0",
+ 		.init = mop500_ab8500_machine_init,
+ 		.ops = mop500_ab8500_ops,
+@@ -42,6 +43,7 @@ static struct snd_soc_dai_link mop500_dai_links[] = {
+ 		.stream_name = "ab8500_1",
+ 		.cpu_dai_name = "ux500-msp-i2s.3",
+ 		.codec_dai_name = "ab8500-codec-dai.1",
++		.platform_name = "ux500-msp-i2s.3",
+ 		.codec_name = "ab8500-codec.0",
+ 		.init = NULL,
+ 		.ops = mop500_ab8500_ops,
+@@ -85,6 +87,8 @@ static int mop500_of_probe(struct platform_device *pdev,
+ 	for (i = 0; i < 2; i++) {
+ 		mop500_dai_links[i].cpu_of_node = msp_np[i];
+ 		mop500_dai_links[i].cpu_dai_name = NULL;
++		mop500_dai_links[i].platform_of_node = msp_np[i];
++		mop500_dai_links[i].platform_name = NULL;
+ 		mop500_dai_links[i].codec_of_node = codec_np;
+ 		mop500_dai_links[i].codec_name = NULL;
+ 	}
+diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
+index e2e5effba2a9..db1c7b25a44c 100644
+--- a/virt/kvm/arm/mmu.c
++++ b/virt/kvm/arm/mmu.c
+@@ -1665,12 +1665,16 @@ static int kvm_test_age_hva_handler(struct kvm *kvm, gpa_t gpa, u64 size, void *
+ 
+ int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end)
+ {
++	if (!kvm->arch.pgd)
++		return 0;
+ 	trace_kvm_age_hva(start, end);
+ 	return handle_hva_to_gpa(kvm, start, end, kvm_age_hva_handler, NULL);
+ }
+ 
+ int kvm_test_age_hva(struct kvm *kvm, unsigned long hva)
+ {
++	if (!kvm->arch.pgd)
++		return 0;
+ 	trace_kvm_test_age_hva(hva);
+ 	return handle_hva_to_gpa(kvm, hva, hva, kvm_test_age_hva_handler, NULL);
+ }