[gentoo-commits] proj/linux-patches:4.14 commit in: /

[Alice Ferrazzi]

commit:     4272d0d23434036afb6b4601a7483c06cb556cf8
Author:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Thu Dec 14 09:10:31 2017 +0000
Commit:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Thu Dec 14 09:10:31 2017 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=4272d0d2

Added linux patches 4.14.6

 0000_README             |    4 +
 1005_linux-4.14.6.patch | 4512 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 4516 insertions(+)

diff --git a/0000_README b/0000_README
index 797ac0c..8e3a889 100644
--- a/0000_README
+++ b/0000_README
@@ -63,6 +63,10 @@ Patch:  1004_linux-4.14.5.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.14.5
 
+Patch:  1005_linux-4.14.6.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.14.6
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1005_linux-4.14.6.patch b/1005_linux-4.14.6.patch
new file mode 100644
index 0000000..157c09c
--- /dev/null
+++ b/1005_linux-4.14.6.patch
@@ -0,0 +1,4512 @@
+diff --git a/Documentation/devicetree/bindings/usb/usb-device.txt b/Documentation/devicetree/bindings/usb/usb-device.txt
+index ce02cebac26a..464ddf7b509a 100644
+--- a/Documentation/devicetree/bindings/usb/usb-device.txt
++++ b/Documentation/devicetree/bindings/usb/usb-device.txt
+@@ -11,7 +11,7 @@ Required properties:
+   be used, but a device adhering to this binding may leave out all except
+   for usbVID,PID.
+ - reg: the port number which this device is connecting to, the range
+-  is 1-31.
++  is 1-255.
+ 
+ Example:
+ 
+diff --git a/Makefile b/Makefile
+index 43ac7bdb10ad..eabbd7748a24 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 5
++SUBLEVEL = 6
+ EXTRAVERSION =
+ NAME = Petit Gorille
+ 
+diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi
+index 8bf0d89cdd35..2e516f4985e4 100644
+--- a/arch/arm/boot/dts/imx53.dtsi
++++ b/arch/arm/boot/dts/imx53.dtsi
+@@ -433,15 +433,6 @@
+ 				clock-names = "ipg", "per";
+ 			};
+ 
+-			srtc: srtc@53fa4000 {
+-				compatible = "fsl,imx53-rtc", "fsl,imx25-rtc";
+-				reg = <0x53fa4000 0x4000>;
+-				interrupts = <24>;
+-				interrupt-parent = <&tzic>;
+-				clocks = <&clks IMX5_CLK_SRTC_GATE>;
+-				clock-names = "ipg";
+-			};
+-
+ 			iomuxc: iomuxc@53fa8000 {
+ 				compatible = "fsl,imx53-iomuxc";
+ 				reg = <0x53fa8000 0x4000>;
+diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
+index ad301f107dd2..bc8d4bbd82e2 100644
+--- a/arch/arm/include/asm/assembler.h
++++ b/arch/arm/include/asm/assembler.h
+@@ -518,4 +518,22 @@ THUMB(	orr	\reg , \reg , #PSR_T_BIT	)
+ #endif
+ 	.endm
+ 
++	.macro	bug, msg, line
++#ifdef CONFIG_THUMB2_KERNEL
++1:	.inst	0xde02
++#else
++1:	.inst	0xe7f001f2
++#endif
++#ifdef CONFIG_DEBUG_BUGVERBOSE
++	.pushsection .rodata.str, "aMS", %progbits, 1
++2:	.asciz	"\msg"
++	.popsection
++	.pushsection __bug_table, "aw"
++	.align	2
++	.word	1b, 2b
++	.hword	\line
++	.popsection
++#endif
++	.endm
++
+ #endif /* __ASM_ASSEMBLER_H__ */
+diff --git a/arch/arm/include/asm/kvm_arm.h b/arch/arm/include/asm/kvm_arm.h
+index c8781450905b..3ab8b3781bfe 100644
+--- a/arch/arm/include/asm/kvm_arm.h
++++ b/arch/arm/include/asm/kvm_arm.h
+@@ -161,8 +161,7 @@
+ #else
+ #define VTTBR_X		(5 - KVM_T0SZ)
+ #endif
+-#define VTTBR_BADDR_SHIFT (VTTBR_X - 1)
+-#define VTTBR_BADDR_MASK  (((_AC(1, ULL) << (40 - VTTBR_X)) - 1) << VTTBR_BADDR_SHIFT)
++#define VTTBR_BADDR_MASK  (((_AC(1, ULL) << (40 - VTTBR_X)) - 1) << VTTBR_X)
+ #define VTTBR_VMID_SHIFT  _AC(48, ULL)
+ #define VTTBR_VMID_MASK(size)	(_AT(u64, (1 << size) - 1) << VTTBR_VMID_SHIFT)
+ 
+diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
+index d523cd8439a3..0f07579af472 100644
+--- a/arch/arm/kernel/entry-header.S
++++ b/arch/arm/kernel/entry-header.S
+@@ -300,6 +300,8 @@
+ 	mov	r2, sp
+ 	ldr	r1, [r2, #\offset + S_PSR]	@ get calling cpsr
+ 	ldr	lr, [r2, #\offset + S_PC]!	@ get pc
++	tst	r1, #PSR_I_BIT | 0x0f
++	bne	1f
+ 	msr	spsr_cxsf, r1			@ save in spsr_svc
+ #if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K)
+ 	@ We must avoid clrex due to Cortex-A15 erratum #830321
+@@ -314,6 +316,7 @@
+ 						@ after ldm {}^
+ 	add	sp, sp, #\offset + PT_REGS_SIZE
+ 	movs	pc, lr				@ return & move spsr_svc into cpsr
++1:	bug	"Returning to usermode but unexpected PSR bits set?", \@
+ #elif defined(CONFIG_CPU_V7M)
+ 	@ V7M restore.
+ 	@ Note that we don't need to do clrex here as clearing the local
+@@ -329,6 +332,8 @@
+ 	ldr	r1, [sp, #\offset + S_PSR]	@ get calling cpsr
+ 	ldr	lr, [sp, #\offset + S_PC]	@ get pc
+ 	add	sp, sp, #\offset + S_SP
++	tst	r1, #PSR_I_BIT | 0x0f
++	bne	1f
+ 	msr	spsr_cxsf, r1			@ save in spsr_svc
+ 
+ 	@ We must avoid clrex due to Cortex-A15 erratum #830321
+@@ -341,6 +346,7 @@
+ 	.endif
+ 	add	sp, sp, #PT_REGS_SIZE - S_SP
+ 	movs	pc, lr				@ return & move spsr_svc into cpsr
++1:	bug	"Returning to usermode but unexpected PSR bits set?", \@
+ #endif	/* !CONFIG_THUMB2_KERNEL */
+ 	.endm
+ 
+diff --git a/arch/arm64/include/asm/efi.h b/arch/arm64/include/asm/efi.h
+index 650344d01124..c4cd5081d78b 100644
+--- a/arch/arm64/include/asm/efi.h
++++ b/arch/arm64/include/asm/efi.h
+@@ -132,11 +132,9 @@ static inline void efi_set_pgd(struct mm_struct *mm)
+ 			 * Defer the switch to the current thread's TTBR0_EL1
+ 			 * until uaccess_enable(). Restore the current
+ 			 * thread's saved ttbr0 corresponding to its active_mm
+-			 * (if different from init_mm).
+ 			 */
+ 			cpu_set_reserved_ttbr0();
+-			if (current->active_mm != &init_mm)
+-				update_saved_ttbr0(current, current->active_mm);
++			update_saved_ttbr0(current, current->active_mm);
+ 		}
+ 	}
+ }
+diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
+index 61d694c2eae5..555d463c0eaa 100644
+--- a/arch/arm64/include/asm/kvm_arm.h
++++ b/arch/arm64/include/asm/kvm_arm.h
+@@ -170,8 +170,7 @@
+ #define VTCR_EL2_FLAGS			(VTCR_EL2_COMMON_BITS | VTCR_EL2_TGRAN_FLAGS)
+ #define VTTBR_X				(VTTBR_X_TGRAN_MAGIC - VTCR_EL2_T0SZ_IPA)
+ 
+-#define VTTBR_BADDR_SHIFT (VTTBR_X - 1)
+-#define VTTBR_BADDR_MASK  (((UL(1) << (PHYS_MASK_SHIFT - VTTBR_X)) - 1) << VTTBR_BADDR_SHIFT)
++#define VTTBR_BADDR_MASK  (((UL(1) << (PHYS_MASK_SHIFT - VTTBR_X)) - 1) << VTTBR_X)
+ #define VTTBR_VMID_SHIFT  (UL(48))
+ #define VTTBR_VMID_MASK(size) (_AT(u64, (1 << size) - 1) << VTTBR_VMID_SHIFT)
+ 
+diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
+index 3257895a9b5e..9d155fa9a507 100644
+--- a/arch/arm64/include/asm/mmu_context.h
++++ b/arch/arm64/include/asm/mmu_context.h
+@@ -156,29 +156,21 @@ void check_and_switch_context(struct mm_struct *mm, unsigned int cpu);
+ 
+ #define init_new_context(tsk,mm)	({ atomic64_set(&(mm)->context.id, 0); 0; })
+ 
+-/*
+- * This is called when "tsk" is about to enter lazy TLB mode.
+- *
+- * mm:  describes the currently active mm context
+- * tsk: task which is entering lazy tlb
+- * cpu: cpu number which is entering lazy tlb
+- *
+- * tsk->mm will be NULL
+- */
+-static inline void
+-enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
+-{
+-}
+-
+ #ifdef CONFIG_ARM64_SW_TTBR0_PAN
+ static inline void update_saved_ttbr0(struct task_struct *tsk,
+ 				      struct mm_struct *mm)
+ {
+-	if (system_uses_ttbr0_pan()) {
+-		BUG_ON(mm->pgd == swapper_pg_dir);
+-		task_thread_info(tsk)->ttbr0 =
+-			virt_to_phys(mm->pgd) | ASID(mm) << 48;
+-	}
++	u64 ttbr;
++
++	if (!system_uses_ttbr0_pan())
++		return;
++
++	if (mm == &init_mm)
++		ttbr = __pa_symbol(empty_zero_page);
++	else
++		ttbr = virt_to_phys(mm->pgd) | ASID(mm) << 48;
++
++	task_thread_info(tsk)->ttbr0 = ttbr;
+ }
+ #else
+ static inline void update_saved_ttbr0(struct task_struct *tsk,
+@@ -187,6 +179,16 @@ static inline void update_saved_ttbr0(struct task_struct *tsk,
+ }
+ #endif
+ 
++static inline void
++enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
++{
++	/*
++	 * We don't actually care about the ttbr0 mapping, so point it at the
++	 * zero page.
++	 */
++	update_saved_ttbr0(tsk, &init_mm);
++}
++
+ static inline void __switch_mm(struct mm_struct *next)
+ {
+ 	unsigned int cpu = smp_processor_id();
+@@ -214,11 +216,9 @@ switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ 	 * Update the saved TTBR0_EL1 of the scheduled-in task as the previous
+ 	 * value may have not been initialised yet (activate_mm caller) or the
+ 	 * ASID has changed since the last run (following the context switch
+-	 * of another thread of the same process). Avoid setting the reserved
+-	 * TTBR0_EL1 to swapper_pg_dir (init_mm; e.g. via idle_task_exit).
++	 * of another thread of the same process).
+ 	 */
+-	if (next != &init_mm)
+-		update_saved_ttbr0(tsk, next);
++	update_saved_ttbr0(tsk, next);
+ }
+ 
+ #define deactivate_mm(tsk,mm)	do { } while (0)
+diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
+index 2dc0f8482210..bcd22d7ee590 100644
+--- a/arch/arm64/kernel/process.c
++++ b/arch/arm64/kernel/process.c
+@@ -258,6 +258,15 @@ int copy_thread(unsigned long clone_flags, unsigned long stack_start,
+ 
+ 	memset(&p->thread.cpu_context, 0, sizeof(struct cpu_context));
+ 
++	/*
++	 * In case p was allocated the same task_struct pointer as some
++	 * other recently-exited task, make sure p is disassociated from
++	 * any cpu that may have run that now-exited task recently.
++	 * Otherwise we could erroneously skip reloading the FPSIMD
++	 * registers for p.
++	 */
++	fpsimd_flush_task_state(p);
++
+ 	if (likely(!(p->flags & PF_KTHREAD))) {
+ 		*childregs = *current_pt_regs();
+ 		childregs->regs[0] = 0;
+diff --git a/arch/powerpc/include/asm/machdep.h b/arch/powerpc/include/asm/machdep.h
+index 73b92017b6d7..cd2fc1cc1cc7 100644
+--- a/arch/powerpc/include/asm/machdep.h
++++ b/arch/powerpc/include/asm/machdep.h
+@@ -76,6 +76,7 @@ struct machdep_calls {
+ 
+ 	void __noreturn	(*restart)(char *cmd);
+ 	void __noreturn (*halt)(void);
++	void		(*panic)(char *str);
+ 	void		(*cpu_die)(void);
+ 
+ 	long		(*time_init)(void); /* Optional, may be NULL */
+diff --git a/arch/powerpc/include/asm/setup.h b/arch/powerpc/include/asm/setup.h
+index 257d23dbf55d..cf00ec26303a 100644
+--- a/arch/powerpc/include/asm/setup.h
++++ b/arch/powerpc/include/asm/setup.h
+@@ -24,6 +24,7 @@ extern void reloc_got2(unsigned long);
+ 
+ void check_for_initrd(void);
+ void initmem_init(void);
++void setup_panic(void);
+ #define ARCH_PANIC_TIMEOUT 180
+ 
+ #ifdef CONFIG_PPC_PSERIES
+diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S
+index 610955fe8b81..679bbe714e85 100644
+--- a/arch/powerpc/kernel/cpu_setup_power.S
++++ b/arch/powerpc/kernel/cpu_setup_power.S
+@@ -102,6 +102,7 @@ _GLOBAL(__setup_cpu_power9)
+ 	li	r0,0
+ 	mtspr	SPRN_PSSCR,r0
+ 	mtspr	SPRN_LPID,r0
++	mtspr	SPRN_PID,r0
+ 	mfspr	r3,SPRN_LPCR
+ 	LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE  | LPCR_HEIC)
+ 	or	r3, r3, r4
+@@ -126,6 +127,7 @@ _GLOBAL(__restore_cpu_power9)
+ 	li	r0,0
+ 	mtspr	SPRN_PSSCR,r0
+ 	mtspr	SPRN_LPID,r0
++	mtspr	SPRN_PID,r0
+ 	mfspr   r3,SPRN_LPCR
+ 	LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE | LPCR_HEIC)
+ 	or	r3, r3, r4
+diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c
+index e1431800bfb9..29d2b6050140 100644
+--- a/arch/powerpc/kernel/fadump.c
++++ b/arch/powerpc/kernel/fadump.c
+@@ -1453,25 +1453,6 @@ static void fadump_init_files(void)
+ 	return;
+ }
+ 
+-static int fadump_panic_event(struct notifier_block *this,
+-			      unsigned long event, void *ptr)
+-{
+-	/*
+-	 * If firmware-assisted dump has been registered then trigger
+-	 * firmware-assisted dump and let firmware handle everything
+-	 * else. If this returns, then fadump was not registered, so
+-	 * go through the rest of the panic path.
+-	 */
+-	crash_fadump(NULL, ptr);
+-
+-	return NOTIFY_DONE;
+-}
+-
+-static struct notifier_block fadump_panic_block = {
+-	.notifier_call = fadump_panic_event,
+-	.priority = INT_MIN /* may not return; must be done last */
+-};
+-
+ /*
+  * Prepare for firmware-assisted dump.
+  */
+@@ -1504,9 +1485,6 @@ int __init setup_fadump(void)
+ 		init_fadump_mem_struct(&fdm, fw_dump.reserve_dump_area_start);
+ 	fadump_init_files();
+ 
+-	atomic_notifier_chain_register(&panic_notifier_list,
+-					&fadump_panic_block);
+-
+ 	return 1;
+ }
+ subsys_initcall(setup_fadump);
+diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
+index 2e3bc16d02b2..90bc20efb4c7 100644
+--- a/arch/powerpc/kernel/setup-common.c
++++ b/arch/powerpc/kernel/setup-common.c
+@@ -704,6 +704,30 @@ int check_legacy_ioport(unsigned long base_port)
+ }
+ EXPORT_SYMBOL(check_legacy_ioport);
+ 
++static int ppc_panic_event(struct notifier_block *this,
++                             unsigned long event, void *ptr)
++{
++	/*
++	 * If firmware-assisted dump has been registered then trigger
++	 * firmware-assisted dump and let firmware handle everything else.
++	 */
++	crash_fadump(NULL, ptr);
++	ppc_md.panic(ptr);  /* May not return */
++	return NOTIFY_DONE;
++}
++
++static struct notifier_block ppc_panic_block = {
++	.notifier_call = ppc_panic_event,
++	.priority = INT_MIN /* may not return; must be done last */
++};
++
++void __init setup_panic(void)
++{
++	if (!ppc_md.panic)
++		return;
++	atomic_notifier_chain_register(&panic_notifier_list, &ppc_panic_block);
++}
++
+ #ifdef CONFIG_CHECK_CACHE_COHERENCY
+ /*
+  * For platforms that have configurable cache-coherency.  This function
+@@ -848,6 +872,9 @@ void __init setup_arch(char **cmdline_p)
+ 	/* Probe the machine type, establish ppc_md. */
+ 	probe_machine();
+ 
++	/* Setup panic notifier if requested by the platform. */
++	setup_panic();
++
+ 	/*
+ 	 * Configure ppc_md.power_save (ppc32 only, 64-bit machines do
+ 	 * it from their respective probe() function.
+diff --git a/arch/powerpc/platforms/powernv/opal-imc.c b/arch/powerpc/platforms/powernv/opal-imc.c
+index 21f6531fae20..b150f4deaccf 100644
+--- a/arch/powerpc/platforms/powernv/opal-imc.c
++++ b/arch/powerpc/platforms/powernv/opal-imc.c
+@@ -191,8 +191,10 @@ static int opal_imc_counters_probe(struct platform_device *pdev)
+ 			break;
+ 		}
+ 
+-		if (!imc_pmu_create(imc_dev, pmu_count, domain))
+-			pmu_count++;
++		if (!imc_pmu_create(imc_dev, pmu_count, domain)) {
++			if (domain == IMC_DOMAIN_NEST)
++				pmu_count++;
++		}
+ 	}
+ 
+ 	return 0;
+diff --git a/arch/powerpc/platforms/ps3/setup.c b/arch/powerpc/platforms/ps3/setup.c
+index 9dabea6e1443..6244bc849469 100644
+--- a/arch/powerpc/platforms/ps3/setup.c
++++ b/arch/powerpc/platforms/ps3/setup.c
+@@ -104,6 +104,20 @@ static void __noreturn ps3_halt(void)
+ 	ps3_sys_manager_halt(); /* never returns */
+ }
+ 
++static void ps3_panic(char *str)
++{
++	DBG("%s:%d %s\n", __func__, __LINE__, str);
++
++	smp_send_stop();
++	printk("\n");
++	printk("   System does not reboot automatically.\n");
++	printk("   Please press POWER button.\n");
++	printk("\n");
++
++	while(1)
++		lv1_pause(1);
++}
++
+ #if defined(CONFIG_FB_PS3) || defined(CONFIG_FB_PS3_MODULE) || \
+     defined(CONFIG_PS3_FLASH) || defined(CONFIG_PS3_FLASH_MODULE)
+ static void __init prealloc(struct ps3_prealloc *p)
+@@ -255,6 +269,7 @@ define_machine(ps3) {
+ 	.probe				= ps3_probe,
+ 	.setup_arch			= ps3_setup_arch,
+ 	.init_IRQ			= ps3_init_IRQ,
++	.panic				= ps3_panic,
+ 	.get_boot_time			= ps3_get_boot_time,
+ 	.set_dabr			= ps3_set_dabr,
+ 	.calibrate_decr			= ps3_calibrate_decr,
+diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
+index 5f1beb8367ac..a8531e012658 100644
+--- a/arch/powerpc/platforms/pseries/setup.c
++++ b/arch/powerpc/platforms/pseries/setup.c
+@@ -726,6 +726,7 @@ define_machine(pseries) {
+ 	.pcibios_fixup		= pSeries_final_fixup,
+ 	.restart		= rtas_restart,
+ 	.halt			= rtas_halt,
++	.panic			= rtas_os_term,
+ 	.get_boot_time		= rtas_get_boot_time,
+ 	.get_rtc_time		= rtas_get_rtc_time,
+ 	.set_rtc_time		= rtas_set_rtc_time,
+diff --git a/arch/s390/include/asm/switch_to.h b/arch/s390/include/asm/switch_to.h
+index ec7b476c1ac5..c61b2cc1a8a8 100644
+--- a/arch/s390/include/asm/switch_to.h
++++ b/arch/s390/include/asm/switch_to.h
+@@ -30,21 +30,20 @@ static inline void restore_access_regs(unsigned int *acrs)
+ 	asm volatile("lam 0,15,%0" : : "Q" (*(acrstype *)acrs));
+ }
+ 
+-#define switch_to(prev,next,last) do {					\
+-	if (prev->mm) {							\
+-		save_fpu_regs();					\
+-		save_access_regs(&prev->thread.acrs[0]);		\
+-		save_ri_cb(prev->thread.ri_cb);				\
+-		save_gs_cb(prev->thread.gs_cb);				\
+-	}								\
++#define switch_to(prev, next, last) do {				\
++	/* save_fpu_regs() sets the CIF_FPU flag, which enforces	\
++	 * a restore of the floating point / vector registers as	\
++	 * soon as the next task returns to user space			\
++	 */								\
++	save_fpu_regs();						\
++	save_access_regs(&prev->thread.acrs[0]);			\
++	save_ri_cb(prev->thread.ri_cb);					\
++	save_gs_cb(prev->thread.gs_cb);					\
+ 	update_cr_regs(next);						\
+-	if (next->mm) {							\
+-		set_cpu_flag(CIF_FPU);					\
+-		restore_access_regs(&next->thread.acrs[0]);		\
+-		restore_ri_cb(next->thread.ri_cb, prev->thread.ri_cb);	\
+-		restore_gs_cb(next->thread.gs_cb);			\
+-	}								\
+-	prev = __switch_to(prev,next);					\
++	restore_access_regs(&next->thread.acrs[0]);			\
++	restore_ri_cb(next->thread.ri_cb, prev->thread.ri_cb);		\
++	restore_gs_cb(next->thread.gs_cb);				\
++	prev = __switch_to(prev, next);					\
+ } while (0)
+ 
+ #endif /* __ASM_SWITCH_TO_H */
+diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
+index d39f121e67a9..bc905ae1d5c8 100644
+--- a/arch/s390/kernel/syscalls.S
++++ b/arch/s390/kernel/syscalls.S
+@@ -370,10 +370,10 @@ SYSCALL(sys_recvmmsg,compat_sys_recvmmsg)
+ SYSCALL(sys_sendmmsg,compat_sys_sendmmsg)
+ SYSCALL(sys_socket,sys_socket)
+ SYSCALL(sys_socketpair,compat_sys_socketpair)		/* 360 */
+-SYSCALL(sys_bind,sys_bind)
+-SYSCALL(sys_connect,sys_connect)
++SYSCALL(sys_bind,compat_sys_bind)
++SYSCALL(sys_connect,compat_sys_connect)
+ SYSCALL(sys_listen,sys_listen)
+-SYSCALL(sys_accept4,sys_accept4)
++SYSCALL(sys_accept4,compat_sys_accept4)
+ SYSCALL(sys_getsockopt,compat_sys_getsockopt)		/* 365 */
+ SYSCALL(sys_setsockopt,compat_sys_setsockopt)
+ SYSCALL(sys_getsockname,compat_sys_getsockname)
+diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
+index c954ac49eee4..5b25287f449b 100644
+--- a/arch/s390/kvm/priv.c
++++ b/arch/s390/kvm/priv.c
+@@ -235,8 +235,6 @@ static int try_handle_skey(struct kvm_vcpu *vcpu)
+ 		VCPU_EVENT(vcpu, 4, "%s", "retrying storage key operation");
+ 		return -EAGAIN;
+ 	}
+-	if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
+-		return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
+ 	return 0;
+ }
+ 
+@@ -247,6 +245,9 @@ static int handle_iske(struct kvm_vcpu *vcpu)
+ 	int reg1, reg2;
+ 	int rc;
+ 
++	if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
++		return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
++
+ 	rc = try_handle_skey(vcpu);
+ 	if (rc)
+ 		return rc != -EAGAIN ? rc : 0;
+@@ -276,6 +277,9 @@ static int handle_rrbe(struct kvm_vcpu *vcpu)
+ 	int reg1, reg2;
+ 	int rc;
+ 
++	if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
++		return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
++
+ 	rc = try_handle_skey(vcpu);
+ 	if (rc)
+ 		return rc != -EAGAIN ? rc : 0;
+@@ -311,6 +315,9 @@ static int handle_sske(struct kvm_vcpu *vcpu)
+ 	int reg1, reg2;
+ 	int rc;
+ 
++	if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
++		return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
++
+ 	rc = try_handle_skey(vcpu);
+ 	if (rc)
+ 		return rc != -EAGAIN ? rc : 0;
+diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c
+index cc2faffa7d6e..334b6d103cbd 100644
+--- a/arch/s390/mm/pgalloc.c
++++ b/arch/s390/mm/pgalloc.c
+@@ -85,8 +85,6 @@ int crst_table_upgrade(struct mm_struct *mm, unsigned long end)
+ 
+ 	/* upgrade should only happen from 3 to 4, 3 to 5, or 4 to 5 levels */
+ 	VM_BUG_ON(mm->context.asce_limit < _REGION2_SIZE);
+-	if (end >= TASK_SIZE_MAX)
+-		return -ENOMEM;
+ 	rc = 0;
+ 	notify = 0;
+ 	while (mm->context.asce_limit < end) {
+diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
+index 61bdc1270d19..a0cc1be767c8 100644
+--- a/arch/sparc/mm/init_64.c
++++ b/arch/sparc/mm/init_64.c
+@@ -2540,9 +2540,16 @@ void __init mem_init(void)
+ {
+ 	high_memory = __va(last_valid_pfn << PAGE_SHIFT);
+ 
+-	register_page_bootmem_info();
+ 	free_all_bootmem();
+ 
++	/*
++	 * Must be done after boot memory is put on freelist, because here we
++	 * might set fields in deferred struct pages that have not yet been
++	 * initialized, and free_all_bootmem() initializes all the reserved
++	 * deferred pages for us.
++	 */
++	register_page_bootmem_info();
++
+ 	/*
+ 	 * Set up the zero page, mark it reserved, so that page count
+ 	 * is not manipulated when freeing the page from user ptes.
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index c73e493adf07..eb38ac9d9a31 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1426,4 +1426,7 @@ static inline int kvm_cpu_get_apicid(int mps_cpu)
+ #endif
+ }
+ 
++void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
++		unsigned long start, unsigned long end);
++
+ #endif /* _ASM_X86_KVM_HOST_H */
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 65a0ccdc3050..5e0453f18a57 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -239,7 +239,7 @@ static void notrace start_secondary(void *unused)
+ 	load_cr3(swapper_pg_dir);
+ 	__flush_tlb_all();
+ #endif
+-
++	load_current_idt();
+ 	cpu_init();
+ 	x86_cpuinit.early_percpu_clock_init();
+ 	preempt_disable();
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index b21113bcf227..f366e6d3a5e1 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -6750,12 +6750,7 @@ static __init int hardware_setup(void)
+ 	memset(vmx_vmread_bitmap, 0xff, PAGE_SIZE);
+ 	memset(vmx_vmwrite_bitmap, 0xff, PAGE_SIZE);
+ 
+-	/*
+-	 * Allow direct access to the PC debug port (it is often used for I/O
+-	 * delays, but the vmexits simply slow things down).
+-	 */
+ 	memset(vmx_io_bitmap_a, 0xff, PAGE_SIZE);
+-	clear_bit(0x80, vmx_io_bitmap_a);
+ 
+ 	memset(vmx_io_bitmap_b, 0xff, PAGE_SIZE);
+ 
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 4195cbcdb310..df62cdc7a258 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -6745,6 +6745,20 @@ static void kvm_vcpu_flush_tlb(struct kvm_vcpu *vcpu)
+ 	kvm_x86_ops->tlb_flush(vcpu);
+ }
+ 
++void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
++		unsigned long start, unsigned long end)
++{
++	unsigned long apic_address;
++
++	/*
++	 * The physical address of apic access page is stored in the VMCS.
++	 * Update it when it becomes invalid.
++	 */
++	apic_address = gfn_to_hva(kvm, APIC_DEFAULT_PHYS_BASE >> PAGE_SHIFT);
++	if (start <= apic_address && apic_address < end)
++		kvm_make_all_cpus_request(kvm, KVM_REQ_APIC_PAGE_RELOAD);
++}
++
+ void kvm_vcpu_reload_apic_access_page(struct kvm_vcpu *vcpu)
+ {
+ 	struct page *page = NULL;
+diff --git a/arch/x86/pci/broadcom_bus.c b/arch/x86/pci/broadcom_bus.c
+index bb461cfd01ab..526536c81ddc 100644
+--- a/arch/x86/pci/broadcom_bus.c
++++ b/arch/x86/pci/broadcom_bus.c
+@@ -97,7 +97,7 @@ static int __init broadcom_postcore_init(void)
+ 	 * We should get host bridge information from ACPI unless the BIOS
+ 	 * doesn't support it.
+ 	 */
+-	if (acpi_os_get_root_pointer())
++	if (!acpi_disabled && acpi_os_get_root_pointer())
+ 		return 0;
+ #endif
+ 
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 33ee583cfe45..516ce3174683 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -605,8 +605,8 @@ void blk_set_queue_dying(struct request_queue *q)
+ 		spin_lock_irq(q->queue_lock);
+ 		blk_queue_for_each_rl(rl, q) {
+ 			if (rl->rq_pool) {
+-				wake_up(&rl->wait[BLK_RW_SYNC]);
+-				wake_up(&rl->wait[BLK_RW_ASYNC]);
++				wake_up_all(&rl->wait[BLK_RW_SYNC]);
++				wake_up_all(&rl->wait[BLK_RW_ASYNC]);
+ 			}
+ 		}
+ 		spin_unlock_irq(q->queue_lock);
+diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
+index 2d93d9eccb4d..986033e64a83 100644
+--- a/crypto/asymmetric_keys/pkcs7_verify.c
++++ b/crypto/asymmetric_keys/pkcs7_verify.c
+@@ -150,7 +150,7 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
+ 		pr_devel("Sig %u: Found cert serial match X.509[%u]\n",
+ 			 sinfo->index, certix);
+ 
+-		if (x509->pub->pkey_algo != sinfo->sig->pkey_algo) {
++		if (strcmp(x509->pub->pkey_algo, sinfo->sig->pkey_algo) != 0) {
+ 			pr_warn("Sig %u: X.509 algo and PKCS#7 sig algo don't match\n",
+ 				sinfo->index);
+ 			continue;
+diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
+index dd03fead1ca3..ce2df8c9c583 100644
+--- a/crypto/asymmetric_keys/x509_cert_parser.c
++++ b/crypto/asymmetric_keys/x509_cert_parser.c
+@@ -409,6 +409,8 @@ int x509_extract_key_data(void *context, size_t hdrlen,
+ 	ctx->cert->pub->pkey_algo = "rsa";
+ 
+ 	/* Discard the BIT STRING metadata */
++	if (vlen < 1 || *(const u8 *)value != 0)
++		return -EBADMSG;
+ 	ctx->key = value + 1;
+ 	ctx->key_size = vlen - 1;
+ 	return 0;
+diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
+index eea71dc9686c..1bd0cf71a22d 100644
+--- a/crypto/asymmetric_keys/x509_public_key.c
++++ b/crypto/asymmetric_keys/x509_public_key.c
+@@ -135,7 +135,7 @@ int x509_check_for_self_signed(struct x509_certificate *cert)
+ 	}
+ 
+ 	ret = -EKEYREJECTED;
+-	if (cert->pub->pkey_algo != cert->sig->pkey_algo)
++	if (strcmp(cert->pub->pkey_algo, cert->sig->pkey_algo) != 0)
+ 		goto out;
+ 
+ 	ret = public_key_verify_signature(cert->pub, cert->sig);
+diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
+index 7e76b35f422c..e121b8485731 100644
+--- a/drivers/atm/horizon.c
++++ b/drivers/atm/horizon.c
+@@ -2803,7 +2803,7 @@ static int hrz_probe(struct pci_dev *pci_dev,
+ 	return err;
+ 
+ out_free_irq:
+-	free_irq(dev->irq, dev);
++	free_irq(irq, dev);
+ out_free:
+ 	kfree(dev);
+ out_release:
+diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig
+index 2f6614c9a229..bdc87907d6a1 100644
+--- a/drivers/base/Kconfig
++++ b/drivers/base/Kconfig
+@@ -91,22 +91,23 @@ config FIRMWARE_IN_KERNEL
+ 	depends on FW_LOADER
+ 	default y
+ 	help
+-	  The kernel source tree includes a number of firmware 'blobs'
+-	  that are used by various drivers. The recommended way to
+-	  use these is to run "make firmware_install", which, after
+-	  converting ihex files to binary, copies all of the needed
+-	  binary files in firmware/ to /lib/firmware/ on your system so
+-	  that they can be loaded by userspace helpers on request.
++	  Various drivers in the kernel source tree may require firmware,
++	  which is generally available in your distribution's linux-firmware
++	  package.
++
++	  The linux-firmware package should install firmware into
++	  /lib/firmware/ on your system, so they can be loaded by userspace
++	  helpers on request.
+ 
+ 	  Enabling this option will build each required firmware blob
+-	  into the kernel directly, where request_firmware() will find
+-	  them without having to call out to userspace. This may be
+-	  useful if your root file system requires a device that uses
+-	  such firmware and do not wish to use an initrd.
++	  specified by EXTRA_FIRMWARE into the kernel directly, where
++	  request_firmware() will find them without having to call out to
++	  userspace. This may be useful if your root file system requires a
++	  device that uses such firmware and you do not wish to use an
++	  initrd.
+ 
+ 	  This single option controls the inclusion of firmware for
+-	  every driver that uses request_firmware() and ships its
+-	  firmware in the kernel source tree, which avoids a
++	  every driver that uses request_firmware(), which avoids a
+ 	  proliferation of 'Include firmware for xxx device' options.
+ 
+ 	  Say 'N' and let firmware be loaded from userspace.
+diff --git a/drivers/base/isa.c b/drivers/base/isa.c
+index cd6ccdcf9df0..372d10af2600 100644
+--- a/drivers/base/isa.c
++++ b/drivers/base/isa.c
+@@ -39,7 +39,7 @@ static int isa_bus_probe(struct device *dev)
+ {
+ 	struct isa_driver *isa_driver = dev->platform_data;
+ 
+-	if (isa_driver->probe)
++	if (isa_driver && isa_driver->probe)
+ 		return isa_driver->probe(dev, to_isa_dev(dev)->id);
+ 
+ 	return 0;
+@@ -49,7 +49,7 @@ static int isa_bus_remove(struct device *dev)
+ {
+ 	struct isa_driver *isa_driver = dev->platform_data;
+ 
+-	if (isa_driver->remove)
++	if (isa_driver && isa_driver->remove)
+ 		return isa_driver->remove(dev, to_isa_dev(dev)->id);
+ 
+ 	return 0;
+@@ -59,7 +59,7 @@ static void isa_bus_shutdown(struct device *dev)
+ {
+ 	struct isa_driver *isa_driver = dev->platform_data;
+ 
+-	if (isa_driver->shutdown)
++	if (isa_driver && isa_driver->shutdown)
+ 		isa_driver->shutdown(dev, to_isa_dev(dev)->id);
+ }
+ 
+@@ -67,7 +67,7 @@ static int isa_bus_suspend(struct device *dev, pm_message_t state)
+ {
+ 	struct isa_driver *isa_driver = dev->platform_data;
+ 
+-	if (isa_driver->suspend)
++	if (isa_driver && isa_driver->suspend)
+ 		return isa_driver->suspend(dev, to_isa_dev(dev)->id, state);
+ 
+ 	return 0;
+@@ -77,7 +77,7 @@ static int isa_bus_resume(struct device *dev)
+ {
+ 	struct isa_driver *isa_driver = dev->platform_data;
+ 
+-	if (isa_driver->resume)
++	if (isa_driver && isa_driver->resume)
+ 		return isa_driver->resume(dev, to_isa_dev(dev)->id);
+ 
+ 	return 0;
+diff --git a/drivers/bus/arm-cci.c b/drivers/bus/arm-cci.c
+index 3c29d36702a8..5426c04fe24b 100644
+--- a/drivers/bus/arm-cci.c
++++ b/drivers/bus/arm-cci.c
+@@ -1755,14 +1755,17 @@ static int cci_pmu_probe(struct platform_device *pdev)
+ 	raw_spin_lock_init(&cci_pmu->hw_events.pmu_lock);
+ 	mutex_init(&cci_pmu->reserve_mutex);
+ 	atomic_set(&cci_pmu->active_events, 0);
+-	cpumask_set_cpu(smp_processor_id(), &cci_pmu->cpus);
++	cpumask_set_cpu(get_cpu(), &cci_pmu->cpus);
+ 
+ 	ret = cci_pmu_init(cci_pmu, pdev);
+-	if (ret)
++	if (ret) {
++		put_cpu();
+ 		return ret;
++	}
+ 
+ 	cpuhp_state_add_instance_nocalls(CPUHP_AP_PERF_ARM_CCI_ONLINE,
+ 					 &cci_pmu->node);
++	put_cpu();
+ 	pr_info("ARM %s PMU driver probed", cci_pmu->model->name);
+ 	return 0;
+ }
+diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
+index e8c6946fed9d..03d7faf51c2b 100644
+--- a/drivers/bus/arm-ccn.c
++++ b/drivers/bus/arm-ccn.c
+@@ -1271,6 +1271,10 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn)
+ 		int len = snprintf(NULL, 0, "ccn_%d", ccn->dt.id);
+ 
+ 		name = devm_kzalloc(ccn->dev, len + 1, GFP_KERNEL);
++		if (!name) {
++			err = -ENOMEM;
++			goto error_choose_name;
++		}
+ 		snprintf(name, len + 1, "ccn_%d", ccn->dt.id);
+ 	}
+ 
+@@ -1297,7 +1301,7 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn)
+ 	}
+ 
+ 	/* Pick one CPU which we will use to collect data from CCN... */
+-	cpumask_set_cpu(smp_processor_id(), &ccn->dt.cpu);
++	cpumask_set_cpu(get_cpu(), &ccn->dt.cpu);
+ 
+ 	/* Also make sure that the overflow interrupt is handled by this CPU */
+ 	if (ccn->irq) {
+@@ -1314,10 +1318,13 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn)
+ 
+ 	cpuhp_state_add_instance_nocalls(CPUHP_AP_PERF_ARM_CCN_ONLINE,
+ 					 &ccn->dt.node);
++	put_cpu();
+ 	return 0;
+ 
+ error_pmu_register:
+ error_set_affinity:
++	put_cpu();
++error_choose_name:
+ 	ida_simple_remove(&arm_ccn_pmu_ida, ccn->dt.id);
+ 	for (i = 0; i < ccn->num_xps; i++)
+ 		writel(0, ccn->xp[i].base + CCN_XP_DT_CONTROL);
+@@ -1580,8 +1587,8 @@ static int __init arm_ccn_init(void)
+ 
+ static void __exit arm_ccn_exit(void)
+ {
+-	cpuhp_remove_multi_state(CPUHP_AP_PERF_ARM_CCN_ONLINE);
+ 	platform_driver_unregister(&arm_ccn_driver);
++	cpuhp_remove_multi_state(CPUHP_AP_PERF_ARM_CCN_ONLINE);
+ }
+ 
+ module_init(arm_ccn_init);
+diff --git a/drivers/clk/clk-stm32h7.c b/drivers/clk/clk-stm32h7.c
+index a94c3f56c590..61c3e40507d3 100644
+--- a/drivers/clk/clk-stm32h7.c
++++ b/drivers/clk/clk-stm32h7.c
+@@ -384,7 +384,7 @@ static void get_cfg_composite_div(const struct composite_clk_gcfg *gcfg,
+ 	mux_ops = div_ops = gate_ops = NULL;
+ 	mux_hw = div_hw = gate_hw = NULL;
+ 
+-	if (gcfg->mux && gcfg->mux) {
++	if (gcfg->mux && cfg->mux) {
+ 		mux = _get_cmux(base + cfg->mux->offset,
+ 				cfg->mux->shift,
+ 				cfg->mux->width,
+@@ -410,7 +410,7 @@ static void get_cfg_composite_div(const struct composite_clk_gcfg *gcfg,
+ 		}
+ 	}
+ 
+-	if (gcfg->gate && gcfg->gate) {
++	if (gcfg->gate && cfg->gate) {
+ 		gate = _get_cgate(base + cfg->gate->offset,
+ 				cfg->gate->bit_idx,
+ 				gcfg->gate->flags, lock);
+diff --git a/drivers/clk/hisilicon/clk-hi3660.c b/drivers/clk/hisilicon/clk-hi3660.c
+index a18258eb89cb..f40419959656 100644
+--- a/drivers/clk/hisilicon/clk-hi3660.c
++++ b/drivers/clk/hisilicon/clk-hi3660.c
+@@ -34,7 +34,7 @@ static const struct hisi_fixed_rate_clock hi3660_fixed_rate_clks[] = {
+ 
+ /* crgctrl */
+ static const struct hisi_fixed_factor_clock hi3660_crg_fixed_factor_clks[] = {
+-	{ HI3660_FACTOR_UART3, "clk_factor_uart3", "iomcu_peri0", 1, 8, 0, },
++	{ HI3660_FACTOR_UART3, "clk_factor_uart3", "iomcu_peri0", 1, 16, 0, },
+ 	{ HI3660_CLK_FACTOR_MMC, "clk_factor_mmc", "clkin_sys", 1, 6, 0, },
+ 	{ HI3660_CLK_GATE_I2C0, "clk_gate_i2c0", "clk_i2c0_iomcu", 1, 4, 0, },
+ 	{ HI3660_CLK_GATE_I2C1, "clk_gate_i2c1", "clk_i2c1_iomcu", 1, 4, 0, },
+diff --git a/drivers/clk/qcom/common.c b/drivers/clk/qcom/common.c
+index d523991c945f..28ceaf1e9937 100644
+--- a/drivers/clk/qcom/common.c
++++ b/drivers/clk/qcom/common.c
+@@ -143,8 +143,10 @@ static int _qcom_cc_register_board_clk(struct device *dev, const char *path,
+ 	int ret;
+ 
+ 	clocks_node = of_find_node_by_path("/clocks");
+-	if (clocks_node)
+-		node = of_find_node_by_name(clocks_node, path);
++	if (clocks_node) {
++		node = of_get_child_by_name(clocks_node, path);
++		of_node_put(clocks_node);
++	}
+ 
+ 	if (!node) {
+ 		fixed = devm_kzalloc(dev, sizeof(*fixed), GFP_KERNEL);
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a83t.c b/drivers/clk/sunxi-ng/ccu-sun8i-a83t.c
+index e43acebdfbcd..f8203115a6bc 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-a83t.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-a83t.c
+@@ -354,9 +354,9 @@ static SUNXI_CCU_GATE(bus_tdm_clk,	"bus-tdm",	"apb1",
+ static SUNXI_CCU_GATE(bus_i2c0_clk,	"bus-i2c0",	"apb2",
+ 		      0x06c, BIT(0), 0);
+ static SUNXI_CCU_GATE(bus_i2c1_clk,	"bus-i2c1",	"apb2",
+-		      0x06c, BIT(0), 0);
++		      0x06c, BIT(1), 0);
+ static SUNXI_CCU_GATE(bus_i2c2_clk,	"bus-i2c2",	"apb2",
+-		      0x06c, BIT(0), 0);
++		      0x06c, BIT(2), 0);
+ static SUNXI_CCU_GATE(bus_uart0_clk,	"bus-uart0",	"apb2",
+ 		      0x06c, BIT(16), 0);
+ static SUNXI_CCU_GATE(bus_uart1_clk,	"bus-uart1",	"apb2",
+diff --git a/drivers/clk/uniphier/clk-uniphier-sys.c b/drivers/clk/uniphier/clk-uniphier-sys.c
+index 07f3b91a7daf..d244e724e198 100644
+--- a/drivers/clk/uniphier/clk-uniphier-sys.c
++++ b/drivers/clk/uniphier/clk-uniphier-sys.c
+@@ -123,7 +123,7 @@ const struct uniphier_clk_data uniphier_sld8_sys_clk_data[] = {
+ const struct uniphier_clk_data uniphier_pro5_sys_clk_data[] = {
+ 	UNIPHIER_CLK_FACTOR("spll", -1, "ref", 120, 1),		/* 2400 MHz */
+ 	UNIPHIER_CLK_FACTOR("dapll1", -1, "ref", 128, 1),	/* 2560 MHz */
+-	UNIPHIER_CLK_FACTOR("dapll2", -1, "ref", 144, 125),	/* 2949.12 MHz */
++	UNIPHIER_CLK_FACTOR("dapll2", -1, "dapll1", 144, 125),	/* 2949.12 MHz */
+ 	UNIPHIER_CLK_FACTOR("uart", 0, "dapll2", 1, 40),
+ 	UNIPHIER_CLK_FACTOR("i2c", 1, "spll", 1, 48),
+ 	UNIPHIER_PRO5_SYS_CLK_NAND(2),
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index dff88838dce7..a19b5d0300a9 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -1232,12 +1232,11 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ 			sg_link_tbl_len += authsize;
+ 	}
+ 
+-	sg_count = talitos_sg_map(dev, areq->src, cryptlen, edesc,
+-				  &desc->ptr[4], sg_count, areq->assoclen,
+-				  tbl_off);
++	ret = talitos_sg_map(dev, areq->src, sg_link_tbl_len, edesc,
++			     &desc->ptr[4], sg_count, areq->assoclen, tbl_off);
+ 
+-	if (sg_count > 1) {
+-		tbl_off += sg_count;
++	if (ret > 1) {
++		tbl_off += ret;
+ 		sync_needed = true;
+ 	}
+ 
+@@ -1248,14 +1247,15 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ 			dma_map_sg(dev, areq->dst, sg_count, DMA_FROM_DEVICE);
+ 	}
+ 
+-	sg_count = talitos_sg_map(dev, areq->dst, cryptlen, edesc,
+-				  &desc->ptr[5], sg_count, areq->assoclen,
+-				  tbl_off);
++	ret = talitos_sg_map(dev, areq->dst, cryptlen, edesc, &desc->ptr[5],
++			     sg_count, areq->assoclen, tbl_off);
+ 
+ 	if (desc->hdr & DESC_HDR_TYPE_IPSEC_ESP)
+ 		to_talitos_ptr_ext_or(&desc->ptr[5], authsize, is_sec1);
+ 
+-	if (sg_count > 1) {
++	/* ICV data */
++	if (ret > 1) {
++		tbl_off += ret;
+ 		edesc->icv_ool = true;
+ 		sync_needed = true;
+ 
+@@ -1265,9 +1265,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ 				     sizeof(struct talitos_ptr) + authsize;
+ 
+ 			/* Add an entry to the link table for ICV data */
+-			tbl_ptr += sg_count - 1;
+-			to_talitos_ptr_ext_set(tbl_ptr, 0, is_sec1);
+-			tbl_ptr++;
++			to_talitos_ptr_ext_set(tbl_ptr - 1, 0, is_sec1);
+ 			to_talitos_ptr_ext_set(tbl_ptr, DESC_PTR_LNKTBL_RETURN,
+ 					       is_sec1);
+ 			to_talitos_ptr_len(tbl_ptr, authsize, is_sec1);
+@@ -1275,18 +1273,33 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ 			/* icv data follows link tables */
+ 			to_talitos_ptr(tbl_ptr, edesc->dma_link_tbl + offset,
+ 				       is_sec1);
++		} else {
++			dma_addr_t addr = edesc->dma_link_tbl;
++
++			if (is_sec1)
++				addr += areq->assoclen + cryptlen;
++			else
++				addr += sizeof(struct talitos_ptr) * tbl_off;
++
++			to_talitos_ptr(&desc->ptr[6], addr, is_sec1);
++			to_talitos_ptr_len(&desc->ptr[6], authsize, is_sec1);
++		}
++	} else if (!(desc->hdr & DESC_HDR_TYPE_IPSEC_ESP)) {
++		ret = talitos_sg_map(dev, areq->dst, authsize, edesc,
++				     &desc->ptr[6], sg_count, areq->assoclen +
++							      cryptlen,
++				     tbl_off);
++		if (ret > 1) {
++			tbl_off += ret;
++			edesc->icv_ool = true;
++			sync_needed = true;
++		} else {
++			edesc->icv_ool = false;
+ 		}
+ 	} else {
+ 		edesc->icv_ool = false;
+ 	}
+ 
+-	/* ICV data */
+-	if (!(desc->hdr & DESC_HDR_TYPE_IPSEC_ESP)) {
+-		to_talitos_ptr_len(&desc->ptr[6], authsize, is_sec1);
+-		to_talitos_ptr(&desc->ptr[6], edesc->dma_link_tbl +
+-			       areq->assoclen + cryptlen, is_sec1);
+-	}
+-
+ 	/* iv out */
+ 	if (desc->hdr & DESC_HDR_TYPE_IPSEC_ESP)
+ 		map_single_talitos_ptr(dev, &desc->ptr[6], ivsize, ctx->iv,
+@@ -1494,12 +1507,20 @@ static int ablkcipher_setkey(struct crypto_ablkcipher *cipher,
+ 			     const u8 *key, unsigned int keylen)
+ {
+ 	struct talitos_ctx *ctx = crypto_ablkcipher_ctx(cipher);
++	u32 tmp[DES_EXPKEY_WORDS];
+ 
+ 	if (keylen > TALITOS_MAX_KEY_SIZE) {
+ 		crypto_ablkcipher_set_flags(cipher, CRYPTO_TFM_RES_BAD_KEY_LEN);
+ 		return -EINVAL;
+ 	}
+ 
++	if (unlikely(crypto_ablkcipher_get_flags(cipher) &
++		     CRYPTO_TFM_REQ_WEAK_KEY) &&
++	    !des_ekey(tmp, key)) {
++		crypto_ablkcipher_set_flags(cipher, CRYPTO_TFM_RES_WEAK_KEY);
++		return -EINVAL;
++	}
++
+ 	memcpy(&ctx->key, key, keylen);
+ 	ctx->keylen = keylen;
+ 
+@@ -2614,7 +2635,7 @@ static struct talitos_alg_template driver_algs[] = {
+ 				.ivsize = AES_BLOCK_SIZE,
+ 			}
+ 		},
+-		.desc_hdr_template = DESC_HDR_TYPE_COMMON_NONSNOOP_NO_AFEU |
++		.desc_hdr_template = DESC_HDR_TYPE_AESU_CTR_NONSNOOP |
+ 				     DESC_HDR_SEL0_AESU |
+ 				     DESC_HDR_MODE0_AESU_CTR,
+ 	},
+@@ -3047,6 +3068,11 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev,
+ 		t_alg->algt.alg.aead.setkey = aead_setkey;
+ 		t_alg->algt.alg.aead.encrypt = aead_encrypt;
+ 		t_alg->algt.alg.aead.decrypt = aead_decrypt;
++		if (!(priv->features & TALITOS_FTR_SHA224_HWINIT) &&
++		    !strncmp(alg->cra_name, "authenc(hmac(sha224)", 20)) {
++			kfree(t_alg);
++			return ERR_PTR(-ENOTSUPP);
++		}
+ 		break;
+ 	case CRYPTO_ALG_TYPE_AHASH:
+ 		alg = &t_alg->algt.alg.hash.halg.base;
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index f70febf680c3..c3eefa126e3b 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -143,8 +143,7 @@ static ssize_t systab_show(struct kobject *kobj,
+ 	return str - buf;
+ }
+ 
+-static struct kobj_attribute efi_attr_systab =
+-			__ATTR(systab, 0400, systab_show, NULL);
++static struct kobj_attribute efi_attr_systab = __ATTR_RO_MODE(systab, 0400);
+ 
+ #define EFI_FIELD(var) efi.var
+ 
+diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c
+index bd7ed3c1148a..c47e0c6ec00f 100644
+--- a/drivers/firmware/efi/esrt.c
++++ b/drivers/firmware/efi/esrt.c
+@@ -106,7 +106,7 @@ static const struct sysfs_ops esre_attr_ops = {
+ };
+ 
+ /* Generic ESRT Entry ("ESRE") support. */
+-static ssize_t esre_fw_class_show(struct esre_entry *entry, char *buf)
++static ssize_t fw_class_show(struct esre_entry *entry, char *buf)
+ {
+ 	char *str = buf;
+ 
+@@ -117,18 +117,16 @@ static ssize_t esre_fw_class_show(struct esre_entry *entry, char *buf)
+ 	return str - buf;
+ }
+ 
+-static struct esre_attribute esre_fw_class = __ATTR(fw_class, 0400,
+-	esre_fw_class_show, NULL);
++static struct esre_attribute esre_fw_class = __ATTR_RO_MODE(fw_class, 0400);
+ 
+ #define esre_attr_decl(name, size, fmt) \
+-static ssize_t esre_##name##_show(struct esre_entry *entry, char *buf) \
++static ssize_t name##_show(struct esre_entry *entry, char *buf) \
+ { \
+ 	return sprintf(buf, fmt "\n", \
+ 		       le##size##_to_cpu(entry->esre.esre1->name)); \
+ } \
+ \
+-static struct esre_attribute esre_##name = __ATTR(name, 0400, \
+-	esre_##name##_show, NULL)
++static struct esre_attribute esre_##name = __ATTR_RO_MODE(name, 0400)
+ 
+ esre_attr_decl(fw_type, 32, "%u");
+ esre_attr_decl(fw_version, 32, "%u");
+@@ -193,14 +191,13 @@ static int esre_create_sysfs_entry(void *esre, int entry_num)
+ 
+ /* support for displaying ESRT fields at the top level */
+ #define esrt_attr_decl(name, size, fmt) \
+-static ssize_t esrt_##name##_show(struct kobject *kobj, \
++static ssize_t name##_show(struct kobject *kobj, \
+ 				  struct kobj_attribute *attr, char *buf)\
+ { \
+ 	return sprintf(buf, fmt "\n", le##size##_to_cpu(esrt->name)); \
+ } \
+ \
+-static struct kobj_attribute esrt_##name = __ATTR(name, 0400, \
+-	esrt_##name##_show, NULL)
++static struct kobj_attribute esrt_##name = __ATTR_RO_MODE(name, 0400)
+ 
+ esrt_attr_decl(fw_resource_count, 32, "%u");
+ esrt_attr_decl(fw_resource_count_max, 32, "%u");
+@@ -431,7 +428,7 @@ static int __init esrt_sysfs_init(void)
+ err_remove_esrt:
+ 	kobject_put(esrt_kobj);
+ err:
+-	kfree(esrt);
++	memunmap(esrt);
+ 	esrt = NULL;
+ 	return error;
+ }
+diff --git a/drivers/firmware/efi/runtime-map.c b/drivers/firmware/efi/runtime-map.c
+index 8e64b77aeac9..f377609ff141 100644
+--- a/drivers/firmware/efi/runtime-map.c
++++ b/drivers/firmware/efi/runtime-map.c
+@@ -63,11 +63,11 @@ static ssize_t map_attr_show(struct kobject *kobj, struct attribute *attr,
+ 	return map_attr->show(entry, buf);
+ }
+ 
+-static struct map_attribute map_type_attr = __ATTR_RO(type);
+-static struct map_attribute map_phys_addr_attr   = __ATTR_RO(phys_addr);
+-static struct map_attribute map_virt_addr_attr  = __ATTR_RO(virt_addr);
+-static struct map_attribute map_num_pages_attr  = __ATTR_RO(num_pages);
+-static struct map_attribute map_attribute_attr  = __ATTR_RO(attribute);
++static struct map_attribute map_type_attr = __ATTR_RO_MODE(type, 0400);
++static struct map_attribute map_phys_addr_attr = __ATTR_RO_MODE(phys_addr, 0400);
++static struct map_attribute map_virt_addr_attr = __ATTR_RO_MODE(virt_addr, 0400);
++static struct map_attribute map_num_pages_attr = __ATTR_RO_MODE(num_pages, 0400);
++static struct map_attribute map_attribute_attr = __ATTR_RO_MODE(attribute, 0400);
+ 
+ /*
+  * These are default attributes that are added for every memmap entry.
+diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
+index 35e553b3b190..e4b40f2b4627 100644
+--- a/drivers/firmware/google/vpd.c
++++ b/drivers/firmware/google/vpd.c
+@@ -295,38 +295,60 @@ static int vpd_probe(struct platform_device *pdev)
+ 	if (ret)
+ 		return ret;
+ 
+-	return vpd_sections_init(entry.cbmem_addr);
++	vpd_kobj = kobject_create_and_add("vpd", firmware_kobj);
++	if (!vpd_kobj)
++		return -ENOMEM;
++
++	ret = vpd_sections_init(entry.cbmem_addr);
++	if (ret) {
++		kobject_put(vpd_kobj);
++		return ret;
++	}
++
++	return 0;
++}
++
++static int vpd_remove(struct platform_device *pdev)
++{
++	vpd_section_destroy(&ro_vpd);
++	vpd_section_destroy(&rw_vpd);
++
++	kobject_put(vpd_kobj);
++
++	return 0;
+ }
+ 
+ static struct platform_driver vpd_driver = {
+ 	.probe = vpd_probe,
++	.remove = vpd_remove,
+ 	.driver = {
+ 		.name = "vpd",
+ 	},
+ };
+ 
++static struct platform_device *vpd_pdev;
++
+ static int __init vpd_platform_init(void)
+ {
+-	struct platform_device *pdev;
+-
+-	pdev = platform_device_register_simple("vpd", -1, NULL, 0);
+-	if (IS_ERR(pdev))
+-		return PTR_ERR(pdev);
++	int ret;
+ 
+-	vpd_kobj = kobject_create_and_add("vpd", firmware_kobj);
+-	if (!vpd_kobj)
+-		return -ENOMEM;
++	ret = platform_driver_register(&vpd_driver);
++	if (ret)
++		return ret;
+ 
+-	platform_driver_register(&vpd_driver);
++	vpd_pdev = platform_device_register_simple("vpd", -1, NULL, 0);
++	if (IS_ERR(vpd_pdev)) {
++		platform_driver_unregister(&vpd_driver);
++		return PTR_ERR(vpd_pdev);
++	}
+ 
+ 	return 0;
+ }
+ 
+ static void __exit vpd_platform_exit(void)
+ {
+-	vpd_section_destroy(&ro_vpd);
+-	vpd_section_destroy(&rw_vpd);
+-	kobject_put(vpd_kobj);
++	platform_device_unregister(vpd_pdev);
++	platform_driver_unregister(&vpd_driver);
+ }
+ 
+ module_init(vpd_platform_init);
+diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+index 5dd3f1cd074a..a8905049b9da 100644
+--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
++++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+@@ -946,7 +946,9 @@ static int analogix_dp_get_modes(struct drm_connector *connector)
+ 			return 0;
+ 		}
+ 
++		pm_runtime_get_sync(dp->dev);
+ 		edid = drm_get_edid(connector, &dp->aux.ddc);
++		pm_runtime_put(dp->dev);
+ 		if (edid) {
+ 			drm_mode_connector_update_edid_property(&dp->connector,
+ 								edid);
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
+index 077de014d610..4400efe3974a 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
+@@ -247,6 +247,15 @@ struct exynos_drm_gem *exynos_drm_gem_create(struct drm_device *dev,
+ 	if (IS_ERR(exynos_gem))
+ 		return exynos_gem;
+ 
++	if (!is_drm_iommu_supported(dev) && (flags & EXYNOS_BO_NONCONTIG)) {
++		/*
++		 * when no IOMMU is available, all allocated buffers are
++		 * contiguous anyway, so drop EXYNOS_BO_NONCONTIG flag
++		 */
++		flags &= ~EXYNOS_BO_NONCONTIG;
++		DRM_WARN("Non-contiguous allocation is not supported without IOMMU, falling back to contiguous buffer\n");
++	}
++
+ 	/* set memory type and cache attribute from user side. */
+ 	exynos_gem->flags = flags;
+ 
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 5ebdb63330dd..1c73d5542681 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -1000,7 +1000,8 @@ enum transcoder intel_pipe_to_cpu_transcoder(struct drm_i915_private *dev_priv,
+ 	return crtc->config->cpu_transcoder;
+ }
+ 
+-static bool pipe_dsl_stopped(struct drm_i915_private *dev_priv, enum pipe pipe)
++static bool pipe_scanline_is_moving(struct drm_i915_private *dev_priv,
++				    enum pipe pipe)
+ {
+ 	i915_reg_t reg = PIPEDSL(pipe);
+ 	u32 line1, line2;
+@@ -1015,7 +1016,28 @@ static bool pipe_dsl_stopped(struct drm_i915_private *dev_priv, enum pipe pipe)
+ 	msleep(5);
+ 	line2 = I915_READ(reg) & line_mask;
+ 
+-	return line1 == line2;
++	return line1 != line2;
++}
++
++static void wait_for_pipe_scanline_moving(struct intel_crtc *crtc, bool state)
++{
++	struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
++	enum pipe pipe = crtc->pipe;
++
++	/* Wait for the display line to settle/start moving */
++	if (wait_for(pipe_scanline_is_moving(dev_priv, pipe) == state, 100))
++		DRM_ERROR("pipe %c scanline %s wait timed out\n",
++			  pipe_name(pipe), onoff(state));
++}
++
++static void intel_wait_for_pipe_scanline_stopped(struct intel_crtc *crtc)
++{
++	wait_for_pipe_scanline_moving(crtc, false);
++}
++
++static void intel_wait_for_pipe_scanline_moving(struct intel_crtc *crtc)
++{
++	wait_for_pipe_scanline_moving(crtc, true);
+ }
+ 
+ /*
+@@ -1038,7 +1060,6 @@ static void intel_wait_for_pipe_off(struct intel_crtc *crtc)
+ {
+ 	struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
+ 	enum transcoder cpu_transcoder = crtc->config->cpu_transcoder;
+-	enum pipe pipe = crtc->pipe;
+ 
+ 	if (INTEL_GEN(dev_priv) >= 4) {
+ 		i915_reg_t reg = PIPECONF(cpu_transcoder);
+@@ -1049,9 +1070,7 @@ static void intel_wait_for_pipe_off(struct intel_crtc *crtc)
+ 					    100))
+ 			WARN(1, "pipe_off wait timed out\n");
+ 	} else {
+-		/* Wait for the display line to settle */
+-		if (wait_for(pipe_dsl_stopped(dev_priv, pipe), 100))
+-			WARN(1, "pipe_off wait timed out\n");
++		intel_wait_for_pipe_scanline_stopped(crtc);
+ 	}
+ }
+ 
+@@ -1944,15 +1963,14 @@ static void intel_enable_pipe(struct intel_crtc *crtc)
+ 	POSTING_READ(reg);
+ 
+ 	/*
+-	 * Until the pipe starts DSL will read as 0, which would cause
+-	 * an apparent vblank timestamp jump, which messes up also the
+-	 * frame count when it's derived from the timestamps. So let's
+-	 * wait for the pipe to start properly before we call
+-	 * drm_crtc_vblank_on()
++	 * Until the pipe starts PIPEDSL reads will return a stale value,
++	 * which causes an apparent vblank timestamp jump when PIPEDSL
++	 * resets to its proper value. That also messes up the frame count
++	 * when it's derived from the timestamps. So let's wait for the
++	 * pipe to start properly before we call drm_crtc_vblank_on()
+ 	 */
+-	if (dev->max_vblank_count == 0 &&
+-	    wait_for(intel_get_crtc_scanline(crtc) != crtc->scanline_offset, 50))
+-		DRM_ERROR("pipe %c didn't start\n", pipe_name(pipe));
++	if (dev->max_vblank_count == 0)
++		intel_wait_for_pipe_scanline_moving(crtc);
+ }
+ 
+ /**
+@@ -14682,6 +14700,8 @@ void i830_enable_pipe(struct drm_i915_private *dev_priv, enum pipe pipe)
+ 
+ void i830_disable_pipe(struct drm_i915_private *dev_priv, enum pipe pipe)
+ {
++	struct intel_crtc *crtc = intel_get_crtc_for_pipe(dev_priv, pipe);
++
+ 	DRM_DEBUG_KMS("disabling pipe %c due to force quirk\n",
+ 		      pipe_name(pipe));
+ 
+@@ -14691,8 +14711,7 @@ void i830_disable_pipe(struct drm_i915_private *dev_priv, enum pipe pipe)
+ 	I915_WRITE(PIPECONF(pipe), 0);
+ 	POSTING_READ(PIPECONF(pipe));
+ 
+-	if (wait_for(pipe_dsl_stopped(dev_priv, pipe), 100))
+-		DRM_ERROR("pipe %c off wait timed out\n", pipe_name(pipe));
++	intel_wait_for_pipe_scanline_stopped(crtc);
+ 
+ 	I915_WRITE(DPLL(pipe), DPLL_VGA_MODE_DIS);
+ 	POSTING_READ(DPLL(pipe));
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index 894b67ac2cae..05964347008d 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -640,22 +640,28 @@ void vmbus_close(struct vmbus_channel *channel)
+ 		 */
+ 		return;
+ 	}
+-	mutex_lock(&vmbus_connection.channel_mutex);
+ 	/*
+ 	 * Close all the sub-channels first and then close the
+ 	 * primary channel.
+ 	 */
+ 	list_for_each_safe(cur, tmp, &channel->sc_list) {
+ 		cur_channel = list_entry(cur, struct vmbus_channel, sc_list);
+-		vmbus_close_internal(cur_channel);
+ 		if (cur_channel->rescind) {
++			wait_for_completion(&cur_channel->rescind_event);
++			mutex_lock(&vmbus_connection.channel_mutex);
++			vmbus_close_internal(cur_channel);
+ 			hv_process_channel_removal(
+ 					   cur_channel->offermsg.child_relid);
++		} else {
++			mutex_lock(&vmbus_connection.channel_mutex);
++			vmbus_close_internal(cur_channel);
+ 		}
++		mutex_unlock(&vmbus_connection.channel_mutex);
+ 	}
+ 	/*
+ 	 * Now close the primary.
+ 	 */
++	mutex_lock(&vmbus_connection.channel_mutex);
+ 	vmbus_close_internal(channel);
+ 	mutex_unlock(&vmbus_connection.channel_mutex);
+ }
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 379b0df123be..65c6d6bdce4c 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -333,6 +333,7 @@ static struct vmbus_channel *alloc_channel(void)
+ 		return NULL;
+ 
+ 	spin_lock_init(&channel->lock);
++	init_completion(&channel->rescind_event);
+ 
+ 	INIT_LIST_HEAD(&channel->sc_list);
+ 	INIT_LIST_HEAD(&channel->percpu_list);
+@@ -883,6 +884,7 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
+ 	/*
+ 	 * Now wait for offer handling to complete.
+ 	 */
++	vmbus_rescind_cleanup(channel);
+ 	while (READ_ONCE(channel->probe_done) == false) {
+ 		/*
+ 		 * We wait here until any channel offer is currently
+@@ -898,7 +900,6 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
+ 	if (channel->device_obj) {
+ 		if (channel->chn_rescind_callback) {
+ 			channel->chn_rescind_callback(channel);
+-			vmbus_rescind_cleanup(channel);
+ 			return;
+ 		}
+ 		/*
+@@ -907,7 +908,6 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
+ 		 */
+ 		dev = get_device(&channel->device_obj->device);
+ 		if (dev) {
+-			vmbus_rescind_cleanup(channel);
+ 			vmbus_device_unregister(channel->device_obj);
+ 			put_device(dev);
+ 		}
+@@ -921,13 +921,14 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
+ 		 * 2. Then close the primary channel.
+ 		 */
+ 		mutex_lock(&vmbus_connection.channel_mutex);
+-		vmbus_rescind_cleanup(channel);
+ 		if (channel->state == CHANNEL_OPEN_STATE) {
+ 			/*
+ 			 * The channel is currently not open;
+ 			 * it is safe for us to cleanup the channel.
+ 			 */
+ 			hv_process_channel_removal(rescind->child_relid);
++		} else {
++			complete(&channel->rescind_event);
+ 		}
+ 		mutex_unlock(&vmbus_connection.channel_mutex);
+ 	}
+diff --git a/drivers/iio/adc/cpcap-adc.c b/drivers/iio/adc/cpcap-adc.c
+index 6e419d5a7c14..f153e02686a0 100644
+--- a/drivers/iio/adc/cpcap-adc.c
++++ b/drivers/iio/adc/cpcap-adc.c
+@@ -1012,7 +1012,7 @@ static int cpcap_adc_probe(struct platform_device *pdev)
+ 	platform_set_drvdata(pdev, indio_dev);
+ 
+ 	ddata->irq = platform_get_irq_byname(pdev, "adcdone");
+-	if (!ddata->irq)
++	if (ddata->irq < 0)
+ 		return -ENODEV;
+ 
+ 	error = devm_request_threaded_irq(&pdev->dev, ddata->irq, NULL,
+diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
+index 2e8dbb89c8c9..7dc7d297a0fc 100644
+--- a/drivers/iio/adc/meson_saradc.c
++++ b/drivers/iio/adc/meson_saradc.c
+@@ -221,8 +221,10 @@ enum meson_sar_adc_chan7_mux_sel {
+ 
+ struct meson_sar_adc_data {
+ 	bool					has_bl30_integration;
++	u32					bandgap_reg;
+ 	unsigned int				resolution;
+ 	const char				*name;
++	const struct regmap_config		*regmap_config;
+ };
+ 
+ struct meson_sar_adc_priv {
+@@ -242,13 +244,20 @@ struct meson_sar_adc_priv {
+ 	int					calibscale;
+ };
+ 
+-static const struct regmap_config meson_sar_adc_regmap_config = {
++static const struct regmap_config meson_sar_adc_regmap_config_gxbb = {
+ 	.reg_bits = 8,
+ 	.val_bits = 32,
+ 	.reg_stride = 4,
+ 	.max_register = MESON_SAR_ADC_REG13,
+ };
+ 
++static const struct regmap_config meson_sar_adc_regmap_config_meson8 = {
++	.reg_bits = 8,
++	.val_bits = 32,
++	.reg_stride = 4,
++	.max_register = MESON_SAR_ADC_DELTA_10,
++};
++
+ static unsigned int meson_sar_adc_get_fifo_count(struct iio_dev *indio_dev)
+ {
+ 	struct meson_sar_adc_priv *priv = iio_priv(indio_dev);
+@@ -600,7 +609,7 @@ static int meson_sar_adc_clk_init(struct iio_dev *indio_dev,
+ 	init.num_parents = 1;
+ 
+ 	priv->clk_gate.reg = base + MESON_SAR_ADC_REG3;
+-	priv->clk_gate.bit_idx = fls(MESON_SAR_ADC_REG3_CLK_EN);
++	priv->clk_gate.bit_idx = __ffs(MESON_SAR_ADC_REG3_CLK_EN);
+ 	priv->clk_gate.hw.init = &init;
+ 
+ 	priv->adc_clk = devm_clk_register(&indio_dev->dev, &priv->clk_gate.hw);
+@@ -685,6 +694,20 @@ static int meson_sar_adc_init(struct iio_dev *indio_dev)
+ 	return 0;
+ }
+ 
++static void meson_sar_adc_set_bandgap(struct iio_dev *indio_dev, bool on_off)
++{
++	struct meson_sar_adc_priv *priv = iio_priv(indio_dev);
++	u32 enable_mask;
++
++	if (priv->data->bandgap_reg == MESON_SAR_ADC_REG11)
++		enable_mask = MESON_SAR_ADC_REG11_BANDGAP_EN;
++	else
++		enable_mask = MESON_SAR_ADC_DELTA_10_TS_VBG_EN;
++
++	regmap_update_bits(priv->regmap, priv->data->bandgap_reg, enable_mask,
++			   on_off ? enable_mask : 0);
++}
++
+ static int meson_sar_adc_hw_enable(struct iio_dev *indio_dev)
+ {
+ 	struct meson_sar_adc_priv *priv = iio_priv(indio_dev);
+@@ -717,9 +740,9 @@ static int meson_sar_adc_hw_enable(struct iio_dev *indio_dev)
+ 	regval = FIELD_PREP(MESON_SAR_ADC_REG0_FIFO_CNT_IRQ_MASK, 1);
+ 	regmap_update_bits(priv->regmap, MESON_SAR_ADC_REG0,
+ 			   MESON_SAR_ADC_REG0_FIFO_CNT_IRQ_MASK, regval);
+-	regmap_update_bits(priv->regmap, MESON_SAR_ADC_REG11,
+-			   MESON_SAR_ADC_REG11_BANDGAP_EN,
+-			   MESON_SAR_ADC_REG11_BANDGAP_EN);
++
++	meson_sar_adc_set_bandgap(indio_dev, true);
++
+ 	regmap_update_bits(priv->regmap, MESON_SAR_ADC_REG3,
+ 			   MESON_SAR_ADC_REG3_ADC_EN,
+ 			   MESON_SAR_ADC_REG3_ADC_EN);
+@@ -739,8 +762,7 @@ static int meson_sar_adc_hw_enable(struct iio_dev *indio_dev)
+ err_adc_clk:
+ 	regmap_update_bits(priv->regmap, MESON_SAR_ADC_REG3,
+ 			   MESON_SAR_ADC_REG3_ADC_EN, 0);
+-	regmap_update_bits(priv->regmap, MESON_SAR_ADC_REG11,
+-			   MESON_SAR_ADC_REG11_BANDGAP_EN, 0);
++	meson_sar_adc_set_bandgap(indio_dev, false);
+ 	clk_disable_unprepare(priv->sana_clk);
+ err_sana_clk:
+ 	clk_disable_unprepare(priv->core_clk);
+@@ -765,8 +787,8 @@ static int meson_sar_adc_hw_disable(struct iio_dev *indio_dev)
+ 
+ 	regmap_update_bits(priv->regmap, MESON_SAR_ADC_REG3,
+ 			   MESON_SAR_ADC_REG3_ADC_EN, 0);
+-	regmap_update_bits(priv->regmap, MESON_SAR_ADC_REG11,
+-			   MESON_SAR_ADC_REG11_BANDGAP_EN, 0);
++
++	meson_sar_adc_set_bandgap(indio_dev, false);
+ 
+ 	clk_disable_unprepare(priv->sana_clk);
+ 	clk_disable_unprepare(priv->core_clk);
+@@ -845,30 +867,40 @@ static const struct iio_info meson_sar_adc_iio_info = {
+ 
+ static const struct meson_sar_adc_data meson_sar_adc_meson8_data = {
+ 	.has_bl30_integration = false,
++	.bandgap_reg = MESON_SAR_ADC_DELTA_10,
++	.regmap_config = &meson_sar_adc_regmap_config_meson8,
+ 	.resolution = 10,
+ 	.name = "meson-meson8-saradc",
+ };
+ 
+ static const struct meson_sar_adc_data meson_sar_adc_meson8b_data = {
+ 	.has_bl30_integration = false,
++	.bandgap_reg = MESON_SAR_ADC_DELTA_10,
++	.regmap_config = &meson_sar_adc_regmap_config_meson8,
+ 	.resolution = 10,
+ 	.name = "meson-meson8b-saradc",
+ };
+ 
+ static const struct meson_sar_adc_data meson_sar_adc_gxbb_data = {
+ 	.has_bl30_integration = true,
++	.bandgap_reg = MESON_SAR_ADC_REG11,
++	.regmap_config = &meson_sar_adc_regmap_config_gxbb,
+ 	.resolution = 10,
+ 	.name = "meson-gxbb-saradc",
+ };
+ 
+ static const struct meson_sar_adc_data meson_sar_adc_gxl_data = {
+ 	.has_bl30_integration = true,
++	.bandgap_reg = MESON_SAR_ADC_REG11,
++	.regmap_config = &meson_sar_adc_regmap_config_gxbb,
+ 	.resolution = 12,
+ 	.name = "meson-gxl-saradc",
+ };
+ 
+ static const struct meson_sar_adc_data meson_sar_adc_gxm_data = {
+ 	.has_bl30_integration = true,
++	.bandgap_reg = MESON_SAR_ADC_REG11,
++	.regmap_config = &meson_sar_adc_regmap_config_gxbb,
+ 	.resolution = 12,
+ 	.name = "meson-gxm-saradc",
+ };
+@@ -946,7 +978,7 @@ static int meson_sar_adc_probe(struct platform_device *pdev)
+ 		return ret;
+ 
+ 	priv->regmap = devm_regmap_init_mmio(&pdev->dev, base,
+-					     &meson_sar_adc_regmap_config);
++					     priv->data->regmap_config);
+ 	if (IS_ERR(priv->regmap))
+ 		return PTR_ERR(priv->regmap);
+ 
+diff --git a/drivers/iio/health/max30102.c b/drivers/iio/health/max30102.c
+index 839b875c29b9..9fb4bc73a6bc 100644
+--- a/drivers/iio/health/max30102.c
++++ b/drivers/iio/health/max30102.c
+@@ -371,7 +371,7 @@ static int max30102_read_raw(struct iio_dev *indio_dev,
+ 		mutex_unlock(&indio_dev->mlock);
+ 		break;
+ 	case IIO_CHAN_INFO_SCALE:
+-		*val = 1;  /* 0.0625 */
++		*val = 1000;  /* 62.5 */
+ 		*val2 = 16;
+ 		ret = IIO_VAL_FRACTIONAL;
+ 		break;
+diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
+index 28607bb42d87..a337386652b0 100644
+--- a/drivers/infiniband/core/security.c
++++ b/drivers/infiniband/core/security.c
+@@ -417,8 +417,17 @@ void ib_close_shared_qp_security(struct ib_qp_security *sec)
+ 
+ int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev)
+ {
++	u8 i = rdma_start_port(dev);
++	bool is_ib = false;
+ 	int ret;
+ 
++	while (i <= rdma_end_port(dev) && !is_ib)
++		is_ib = rdma_protocol_ib(dev, i++);
++
++	/* If this isn't an IB device don't create the security context */
++	if (!is_ib)
++		return 0;
++
+ 	qp->qp_sec = kzalloc(sizeof(*qp->qp_sec), GFP_KERNEL);
+ 	if (!qp->qp_sec)
+ 		return -ENOMEM;
+@@ -441,6 +450,10 @@ EXPORT_SYMBOL(ib_create_qp_security);
+ 
+ void ib_destroy_qp_security_begin(struct ib_qp_security *sec)
+ {
++	/* Return if not IB */
++	if (!sec)
++		return;
++
+ 	mutex_lock(&sec->mutex);
+ 
+ 	/* Remove the QP from the lists so it won't get added to
+@@ -470,6 +483,10 @@ void ib_destroy_qp_security_abort(struct ib_qp_security *sec)
+ 	int ret;
+ 	int i;
+ 
++	/* Return if not IB */
++	if (!sec)
++		return;
++
+ 	/* If a concurrent cache update is in progress this
+ 	 * QP security could be marked for an error state
+ 	 * transition.  Wait for this to complete.
+@@ -505,6 +522,10 @@ void ib_destroy_qp_security_end(struct ib_qp_security *sec)
+ {
+ 	int i;
+ 
++	/* Return if not IB */
++	if (!sec)
++		return;
++
+ 	/* If a concurrent cache update is occurring we must
+ 	 * wait until this QP security structure is processed
+ 	 * in the QP to error flow before destroying it because
+@@ -557,7 +578,7 @@ int ib_security_modify_qp(struct ib_qp *qp,
+ {
+ 	int ret = 0;
+ 	struct ib_ports_pkeys *tmp_pps;
+-	struct ib_ports_pkeys *new_pps;
++	struct ib_ports_pkeys *new_pps = NULL;
+ 	struct ib_qp *real_qp = qp->real_qp;
+ 	bool special_qp = (real_qp->qp_type == IB_QPT_SMI ||
+ 			   real_qp->qp_type == IB_QPT_GSI ||
+@@ -565,18 +586,27 @@ int ib_security_modify_qp(struct ib_qp *qp,
+ 	bool pps_change = ((qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) ||
+ 			   (qp_attr_mask & IB_QP_ALT_PATH));
+ 
++	WARN_ONCE((qp_attr_mask & IB_QP_PORT &&
++		   rdma_protocol_ib(real_qp->device, qp_attr->port_num) &&
++		   !real_qp->qp_sec),
++		   "%s: QP security is not initialized for IB QP: %d\n",
++		   __func__, real_qp->qp_num);
++
+ 	/* The port/pkey settings are maintained only for the real QP. Open
+ 	 * handles on the real QP will be in the shared_qp_list. When
+ 	 * enforcing security on the real QP all the shared QPs will be
+ 	 * checked as well.
+ 	 */
+ 
+-	if (pps_change && !special_qp) {
++	if (pps_change && !special_qp && real_qp->qp_sec) {
+ 		mutex_lock(&real_qp->qp_sec->mutex);
+ 		new_pps = get_new_pps(real_qp,
+ 				      qp_attr,
+ 				      qp_attr_mask);
+-
++		if (!new_pps) {
++			mutex_unlock(&real_qp->qp_sec->mutex);
++			return -ENOMEM;
++		}
+ 		/* Add this QP to the lists for the new port
+ 		 * and pkey settings before checking for permission
+ 		 * in case there is a concurrent cache update
+@@ -600,7 +630,7 @@ int ib_security_modify_qp(struct ib_qp *qp,
+ 						 qp_attr_mask,
+ 						 udata);
+ 
+-	if (pps_change && !special_qp) {
++	if (new_pps) {
+ 		/* Clean up the lists and free the appropriate
+ 		 * ports_pkeys structure.
+ 		 */
+@@ -631,6 +661,9 @@ int ib_security_pkey_access(struct ib_device *dev,
+ 	u16 pkey;
+ 	int ret;
+ 
++	if (!rdma_protocol_ib(dev, port_num))
++		return 0;
++
+ 	ret = ib_get_cached_pkey(dev, port_num, pkey_index, &pkey);
+ 	if (ret)
+ 		return ret;
+@@ -665,6 +698,9 @@ int ib_mad_agent_security_setup(struct ib_mad_agent *agent,
+ {
+ 	int ret;
+ 
++	if (!rdma_protocol_ib(agent->device, agent->port_num))
++		return 0;
++
+ 	ret = security_ib_alloc_security(&agent->security);
+ 	if (ret)
+ 		return ret;
+@@ -690,6 +726,9 @@ int ib_mad_agent_security_setup(struct ib_mad_agent *agent,
+ 
+ void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent)
+ {
++	if (!rdma_protocol_ib(agent->device, agent->port_num))
++		return;
++
+ 	security_ib_free_security(agent->security);
+ 	if (agent->lsm_nb_reg)
+ 		unregister_lsm_notifier(&agent->lsm_nb);
+@@ -697,20 +736,16 @@ void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent)
+ 
+ int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index)
+ {
+-	int ret;
++	if (!rdma_protocol_ib(map->agent.device, map->agent.port_num))
++		return 0;
+ 
+ 	if (map->agent.qp->qp_type == IB_QPT_SMI && !map->agent.smp_allowed)
+ 		return -EACCES;
+ 
+-	ret = ib_security_pkey_access(map->agent.device,
+-				      map->agent.port_num,
+-				      pkey_index,
+-				      map->agent.security);
+-
+-	if (ret)
+-		return ret;
+-
+-	return 0;
++	return ib_security_pkey_access(map->agent.device,
++				       map->agent.port_num,
++				       pkey_index,
++				       map->agent.security);
+ }
+ 
+ #endif /* CONFIG_SECURITY_INFINIBAND */
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index 0d89621d9fe8..b210495ff33c 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -394,6 +394,7 @@ int bnxt_re_add_gid(struct ib_device *ibdev, u8 port_num,
+ 	ctx->idx = tbl_idx;
+ 	ctx->refcnt = 1;
+ 	ctx_tbl[tbl_idx] = ctx;
++	*context = ctx;
+ 
+ 	return rc;
+ }
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index b6b33d99b0b4..17e44c86577a 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -2216,7 +2216,7 @@ static int __mlx4_ib_modify_qp(void *src, enum mlx4_ib_source_type src_type,
+ 			context->mtu_msgmax = (IB_MTU_4096 << 5) |
+ 					      ilog2(dev->dev->caps.max_gso_sz);
+ 		else
+-			context->mtu_msgmax = (IB_MTU_4096 << 5) | 12;
++			context->mtu_msgmax = (IB_MTU_4096 << 5) | 13;
+ 	} else if (attr_mask & IB_QP_PATH_MTU) {
+ 		if (attr->path_mtu < IB_MTU_256 || attr->path_mtu > IB_MTU_4096) {
+ 			pr_err("path MTU (%u) is invalid\n",
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 552f7bd4ecc3..5aff1e33d984 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -3097,6 +3097,8 @@ static int create_umr_res(struct mlx5_ib_dev *dev)
+ 	qp->real_qp    = qp;
+ 	qp->uobject    = NULL;
+ 	qp->qp_type    = MLX5_IB_QPT_REG_UMR;
++	qp->send_cq    = init_attr->send_cq;
++	qp->recv_cq    = init_attr->recv_cq;
+ 
+ 	attr->qp_state = IB_QPS_INIT;
+ 	attr->port_num = 1;
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 6784a05dd6b2..83f3d4831f94 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -2254,10 +2254,12 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
+ 		uint64_t tmp;
+ 
+ 		if (!sg_res) {
++			unsigned int pgoff = sg->offset & ~PAGE_MASK;
++
+ 			sg_res = aligned_nrpages(sg->offset, sg->length);
+-			sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + sg->offset;
++			sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + pgoff;
+ 			sg->dma_length = sg->length;
+-			pteval = page_to_phys(sg_page(sg)) | prot;
++			pteval = (sg_phys(sg) - pgoff) | prot;
+ 			phys_pfn = pteval >> VTD_PAGE_SHIFT;
+ 		}
+ 
+@@ -3790,7 +3792,7 @@ static int intel_nontranslate_map_sg(struct device *hddev,
+ 
+ 	for_each_sg(sglist, sg, nelems, i) {
+ 		BUG_ON(!sg_page(sg));
+-		sg->dma_address = page_to_phys(sg_page(sg)) + sg->offset;
++		sg->dma_address = sg_phys(sg);
+ 		sg->dma_length = sg->length;
+ 	}
+ 	return nelems;
+diff --git a/drivers/irqchip/qcom-irq-combiner.c b/drivers/irqchip/qcom-irq-combiner.c
+index 6aa3ea479214..f31265937439 100644
+--- a/drivers/irqchip/qcom-irq-combiner.c
++++ b/drivers/irqchip/qcom-irq-combiner.c
+@@ -238,7 +238,7 @@ static int __init combiner_probe(struct platform_device *pdev)
+ {
+ 	struct combiner *combiner;
+ 	size_t alloc_sz;
+-	u32 nregs;
++	int nregs;
+ 	int err;
+ 
+ 	nregs = count_registers(pdev);
+diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c
+index 97fb956bb6e0..93f3d4d61fa7 100644
+--- a/drivers/mailbox/mailbox-test.c
++++ b/drivers/mailbox/mailbox-test.c
+@@ -30,6 +30,7 @@
+ #define MBOX_HEXDUMP_MAX_LEN	(MBOX_HEXDUMP_LINE_LEN *		\
+ 				 (MBOX_MAX_MSG_LEN / MBOX_BYTES_PER_LINE))
+ 
++static bool mbox_data_ready;
+ static struct dentry *root_debugfs_dir;
+ 
+ struct mbox_test_device {
+@@ -152,16 +153,14 @@ static ssize_t mbox_test_message_write(struct file *filp,
+ 
+ static bool mbox_test_message_data_ready(struct mbox_test_device *tdev)
+ {
+-	unsigned char data;
++	bool data_ready;
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&tdev->lock, flags);
+-	data = tdev->rx_buffer[0];
++	data_ready = mbox_data_ready;
+ 	spin_unlock_irqrestore(&tdev->lock, flags);
+ 
+-	if (data != '\0')
+-		return true;
+-	return false;
++	return data_ready;
+ }
+ 
+ static ssize_t mbox_test_message_read(struct file *filp, char __user *userbuf,
+@@ -223,6 +222,7 @@ static ssize_t mbox_test_message_read(struct file *filp, char __user *userbuf,
+ 	*(touser + l) = '\0';
+ 
+ 	memset(tdev->rx_buffer, 0, MBOX_MAX_MSG_LEN);
++	mbox_data_ready = false;
+ 
+ 	spin_unlock_irqrestore(&tdev->lock, flags);
+ 
+@@ -292,6 +292,7 @@ static void mbox_test_receive_message(struct mbox_client *client, void *message)
+ 				     message, MBOX_MAX_MSG_LEN);
+ 		memcpy(tdev->rx_buffer, message, MBOX_MAX_MSG_LEN);
+ 	}
++	mbox_data_ready = true;
+ 	spin_unlock_irqrestore(&tdev->lock, flags);
+ 
+ 	wake_up_interruptible(&tdev->waitq);
+diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
+index 0b7406ac8ce1..9a340728b846 100644
+--- a/drivers/md/raid5-cache.c
++++ b/drivers/md/raid5-cache.c
+@@ -2571,31 +2571,22 @@ static ssize_t r5c_journal_mode_show(struct mddev *mddev, char *page)
+ int r5c_journal_mode_set(struct mddev *mddev, int mode)
+ {
+ 	struct r5conf *conf;
+-	int err;
+ 
+ 	if (mode < R5C_JOURNAL_MODE_WRITE_THROUGH ||
+ 	    mode > R5C_JOURNAL_MODE_WRITE_BACK)
+ 		return -EINVAL;
+ 
+-	err = mddev_lock(mddev);
+-	if (err)
+-		return err;
+ 	conf = mddev->private;
+-	if (!conf || !conf->log) {
+-		mddev_unlock(mddev);
++	if (!conf || !conf->log)
+ 		return -ENODEV;
+-	}
+ 
+ 	if (raid5_calc_degraded(conf) > 0 &&
+-	    mode == R5C_JOURNAL_MODE_WRITE_BACK) {
+-		mddev_unlock(mddev);
++	    mode == R5C_JOURNAL_MODE_WRITE_BACK)
+ 		return -EINVAL;
+-	}
+ 
+ 	mddev_suspend(mddev);
+ 	conf->log->r5c_journal_mode = mode;
+ 	mddev_resume(mddev);
+-	mddev_unlock(mddev);
+ 
+ 	pr_debug("md/raid:%s: setting r5c cache mode to %d: %s\n",
+ 		 mdname(mddev), mode, r5c_journal_mode_str[mode]);
+@@ -2608,6 +2599,7 @@ static ssize_t r5c_journal_mode_store(struct mddev *mddev,
+ {
+ 	int mode = ARRAY_SIZE(r5c_journal_mode_str);
+ 	size_t len = length;
++	int ret;
+ 
+ 	if (len < 2)
+ 		return -EINVAL;
+@@ -2619,8 +2611,12 @@ static ssize_t r5c_journal_mode_store(struct mddev *mddev,
+ 		if (strlen(r5c_journal_mode_str[mode]) == len &&
+ 		    !strncmp(page, r5c_journal_mode_str[mode], len))
+ 			break;
+-
+-	return r5c_journal_mode_set(mddev, mode) ?: length;
++	ret = mddev_lock(mddev);
++	if (ret)
++		return ret;
++	ret = r5c_journal_mode_set(mddev, mode);
++	mddev_unlock(mddev);
++	return ret ?: length;
+ }
+ 
+ struct md_sysfs_entry
+diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
+index 981cccd6b988..72f381522cb2 100644
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -38,41 +38,41 @@ static const struct {
+ 	[RC_PROTO_UNKNOWN] = { .name = "unknown", .repeat_period = 250 },
+ 	[RC_PROTO_OTHER] = { .name = "other", .repeat_period = 250 },
+ 	[RC_PROTO_RC5] = { .name = "rc-5",
+-		.scancode_bits = 0x1f7f, .repeat_period = 164 },
++		.scancode_bits = 0x1f7f, .repeat_period = 250 },
+ 	[RC_PROTO_RC5X_20] = { .name = "rc-5x-20",
+-		.scancode_bits = 0x1f7f3f, .repeat_period = 164 },
++		.scancode_bits = 0x1f7f3f, .repeat_period = 250 },
+ 	[RC_PROTO_RC5_SZ] = { .name = "rc-5-sz",
+-		.scancode_bits = 0x2fff, .repeat_period = 164 },
++		.scancode_bits = 0x2fff, .repeat_period = 250 },
+ 	[RC_PROTO_JVC] = { .name = "jvc",
+ 		.scancode_bits = 0xffff, .repeat_period = 250 },
+ 	[RC_PROTO_SONY12] = { .name = "sony-12",
+-		.scancode_bits = 0x1f007f, .repeat_period = 100 },
++		.scancode_bits = 0x1f007f, .repeat_period = 250 },
+ 	[RC_PROTO_SONY15] = { .name = "sony-15",
+-		.scancode_bits = 0xff007f, .repeat_period = 100 },
++		.scancode_bits = 0xff007f, .repeat_period = 250 },
+ 	[RC_PROTO_SONY20] = { .name = "sony-20",
+-		.scancode_bits = 0x1fff7f, .repeat_period = 100 },
++		.scancode_bits = 0x1fff7f, .repeat_period = 250 },
+ 	[RC_PROTO_NEC] = { .name = "nec",
+-		.scancode_bits = 0xffff, .repeat_period = 160 },
++		.scancode_bits = 0xffff, .repeat_period = 250 },
+ 	[RC_PROTO_NECX] = { .name = "nec-x",
+-		.scancode_bits = 0xffffff, .repeat_period = 160 },
++		.scancode_bits = 0xffffff, .repeat_period = 250 },
+ 	[RC_PROTO_NEC32] = { .name = "nec-32",
+-		.scancode_bits = 0xffffffff, .repeat_period = 160 },
++		.scancode_bits = 0xffffffff, .repeat_period = 250 },
+ 	[RC_PROTO_SANYO] = { .name = "sanyo",
+ 		.scancode_bits = 0x1fffff, .repeat_period = 250 },
+ 	[RC_PROTO_MCIR2_KBD] = { .name = "mcir2-kbd",
+-		.scancode_bits = 0xffff, .repeat_period = 150 },
++		.scancode_bits = 0xffff, .repeat_period = 250 },
+ 	[RC_PROTO_MCIR2_MSE] = { .name = "mcir2-mse",
+-		.scancode_bits = 0x1fffff, .repeat_period = 150 },
++		.scancode_bits = 0x1fffff, .repeat_period = 250 },
+ 	[RC_PROTO_RC6_0] = { .name = "rc-6-0",
+-		.scancode_bits = 0xffff, .repeat_period = 164 },
++		.scancode_bits = 0xffff, .repeat_period = 250 },
+ 	[RC_PROTO_RC6_6A_20] = { .name = "rc-6-6a-20",
+-		.scancode_bits = 0xfffff, .repeat_period = 164 },
++		.scancode_bits = 0xfffff, .repeat_period = 250 },
+ 	[RC_PROTO_RC6_6A_24] = { .name = "rc-6-6a-24",
+-		.scancode_bits = 0xffffff, .repeat_period = 164 },
++		.scancode_bits = 0xffffff, .repeat_period = 250 },
+ 	[RC_PROTO_RC6_6A_32] = { .name = "rc-6-6a-32",
+-		.scancode_bits = 0xffffffff, .repeat_period = 164 },
++		.scancode_bits = 0xffffffff, .repeat_period = 250 },
+ 	[RC_PROTO_RC6_MCE] = { .name = "rc-6-mce",
+-		.scancode_bits = 0xffff7fff, .repeat_period = 164 },
++		.scancode_bits = 0xffff7fff, .repeat_period = 250 },
+ 	[RC_PROTO_SHARP] = { .name = "sharp",
+ 		.scancode_bits = 0x1fff, .repeat_period = 250 },
+ 	[RC_PROTO_XMP] = { .name = "xmp", .repeat_period = 250 },
+diff --git a/drivers/media/rc/sir_ir.c b/drivers/media/rc/sir_ir.c
+index bc906fb128d5..d59918878eb2 100644
+--- a/drivers/media/rc/sir_ir.c
++++ b/drivers/media/rc/sir_ir.c
+@@ -57,7 +57,7 @@ static void add_read_queue(int flag, unsigned long val);
+ static irqreturn_t sir_interrupt(int irq, void *dev_id);
+ static void send_space(unsigned long len);
+ static void send_pulse(unsigned long len);
+-static void init_hardware(void);
++static int init_hardware(void);
+ static void drop_hardware(void);
+ /* Initialisation */
+ 
+@@ -263,11 +263,36 @@ static void send_pulse(unsigned long len)
+ 	}
+ }
+ 
+-static void init_hardware(void)
++static int init_hardware(void)
+ {
++	u8 scratch, scratch2, scratch3;
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&hardware_lock, flags);
++
++	/*
++	 * This is a simple port existence test, borrowed from the autoconfig
++	 * function in drivers/tty/serial/8250/8250_port.c
++	 */
++	scratch = sinp(UART_IER);
++	soutp(UART_IER, 0);
++#ifdef __i386__
++	outb(0xff, 0x080);
++#endif
++	scratch2 = sinp(UART_IER) & 0x0f;
++	soutp(UART_IER, 0x0f);
++#ifdef __i386__
++	outb(0x00, 0x080);
++#endif
++	scratch3 = sinp(UART_IER) & 0x0f;
++	soutp(UART_IER, scratch);
++	if (scratch2 != 0 || scratch3 != 0x0f) {
++		/* we fail, there's nothing here */
++		spin_unlock_irqrestore(&hardware_lock, flags);
++		pr_err("port existence test failed, cannot continue\n");
++		return -ENODEV;
++	}
++
+ 	/* reset UART */
+ 	outb(0, io + UART_MCR);
+ 	outb(0, io + UART_IER);
+@@ -285,6 +310,8 @@ static void init_hardware(void)
+ 	/* turn on UART */
+ 	outb(UART_MCR_DTR | UART_MCR_RTS | UART_MCR_OUT2, io + UART_MCR);
+ 	spin_unlock_irqrestore(&hardware_lock, flags);
++
++	return 0;
+ }
+ 
+ static void drop_hardware(void)
+@@ -334,14 +361,19 @@ static int sir_ir_probe(struct platform_device *dev)
+ 		pr_err("IRQ %d already in use.\n", irq);
+ 		return retval;
+ 	}
++
++	retval = init_hardware();
++	if (retval) {
++		del_timer_sync(&timerlist);
++		return retval;
++	}
++
+ 	pr_info("I/O port 0x%.4x, IRQ %d.\n", io, irq);
+ 
+ 	retval = devm_rc_register_device(&sir_ir_dev->dev, rcdev);
+ 	if (retval < 0)
+ 		return retval;
+ 
+-	init_hardware();
+-
+ 	return 0;
+ }
+ 
+diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c
+index 8207e6900656..bcacb0f22028 100644
+--- a/drivers/media/usb/dvb-usb/dibusb-common.c
++++ b/drivers/media/usb/dvb-usb/dibusb-common.c
+@@ -223,8 +223,20 @@ EXPORT_SYMBOL(dibusb_i2c_algo);
+ 
+ int dibusb_read_eeprom_byte(struct dvb_usb_device *d, u8 offs, u8 *val)
+ {
+-	u8 wbuf[1] = { offs };
+-	return dibusb_i2c_msg(d, 0x50, wbuf, 1, val, 1);
++	u8 *buf;
++	int rc;
++
++	buf = kmalloc(2, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	buf[0] = offs;
++
++	rc = dibusb_i2c_msg(d, 0x50, &buf[0], 1, &buf[1], 1);
++	*val = buf[1];
++	kfree(buf);
++
++	return rc;
+ }
+ EXPORT_SYMBOL(dibusb_read_eeprom_byte);
+ 
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index a13a4896a8bd..c4d1140116ea 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -189,7 +189,7 @@
+  *   MX35  FlexCAN2  03.00.00.00     no        no         ?       no        no
+  *   MX53  FlexCAN2  03.00.00.00    yes        no        no       no        no
+  *   MX6s  FlexCAN3  10.00.12.00    yes       yes        no       no       yes
+- *   VF610 FlexCAN3  ?               no       yes         ?      yes       yes?
++ *   VF610 FlexCAN3  ?               no       yes        no      yes       yes?
+  *
+  * Some SOCs do not have the RX_WARN & TX_WARN interrupt line connected.
+  */
+@@ -297,7 +297,8 @@ static const struct flexcan_devtype_data fsl_imx6q_devtype_data = {
+ 
+ static const struct flexcan_devtype_data fsl_vf610_devtype_data = {
+ 	.quirks = FLEXCAN_QUIRK_DISABLE_RXFG | FLEXCAN_QUIRK_ENABLE_EACEN_RRS |
+-		FLEXCAN_QUIRK_DISABLE_MECR | FLEXCAN_QUIRK_USE_OFF_TIMESTAMP,
++		FLEXCAN_QUIRK_DISABLE_MECR | FLEXCAN_QUIRK_USE_OFF_TIMESTAMP |
++		FLEXCAN_QUIRK_BROKEN_PERR_STATE,
+ };
+ 
+ static const struct can_bittiming_const flexcan_bittiming_const = {
+diff --git a/drivers/net/can/peak_canfd/peak_canfd.c b/drivers/net/can/peak_canfd/peak_canfd.c
+index 85268be0c913..55513411a82e 100644
+--- a/drivers/net/can/peak_canfd/peak_canfd.c
++++ b/drivers/net/can/peak_canfd/peak_canfd.c
+@@ -258,21 +258,18 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv,
+ 	/* if this frame is an echo, */
+ 	if ((rx_msg_flags & PUCAN_MSG_LOOPED_BACK) &&
+ 	    !(rx_msg_flags & PUCAN_MSG_SELF_RECEIVE)) {
+-		int n;
+ 		unsigned long flags;
+ 
+ 		spin_lock_irqsave(&priv->echo_lock, flags);
+-		n = can_get_echo_skb(priv->ndev, msg->client);
++		can_get_echo_skb(priv->ndev, msg->client);
+ 		spin_unlock_irqrestore(&priv->echo_lock, flags);
+ 
+ 		/* count bytes of the echo instead of skb */
+ 		stats->tx_bytes += cf_len;
+ 		stats->tx_packets++;
+ 
+-		if (n) {
+-			/* restart tx queue only if a slot is free */
+-			netif_wake_queue(priv->ndev);
+-		}
++		/* restart tx queue (a slot is free) */
++		netif_wake_queue(priv->ndev);
+ 
+ 		return 0;
+ 	}
+diff --git a/drivers/net/can/peak_canfd/peak_pciefd_main.c b/drivers/net/can/peak_canfd/peak_pciefd_main.c
+index b4efd711f824..788c3464a3b0 100644
+--- a/drivers/net/can/peak_canfd/peak_pciefd_main.c
++++ b/drivers/net/can/peak_canfd/peak_pciefd_main.c
+@@ -825,7 +825,10 @@ static int peak_pciefd_probe(struct pci_dev *pdev,
+ err_disable_pci:
+ 	pci_disable_device(pdev);
+ 
+-	return err;
++	/* pci_xxx_config_word() return positive PCIBIOS_xxx error codes while
++	 * the probe() function must return a negative errno in case of failure
++	 * (err is unchanged if negative) */
++	return pcibios_err_to_errno(err);
+ }
+ 
+ /* free the board structure object, as well as its resources: */
+diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c
+index 131026fbc2d7..5adc95c922ee 100644
+--- a/drivers/net/can/sja1000/peak_pci.c
++++ b/drivers/net/can/sja1000/peak_pci.c
+@@ -717,7 +717,10 @@ static int peak_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ failure_disable_pci:
+ 	pci_disable_device(pdev);
+ 
+-	return err;
++	/* pci_xxx_config_word() return positive PCIBIOS_xxx error codes while
++	 * the probe() function must return a negative errno in case of failure
++	 * (err is unchanged if negative) */
++	return pcibios_err_to_errno(err);
+ }
+ 
+ static void peak_pci_remove(struct pci_dev *pdev)
+diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
+index 4d4941469cfc..db6ea936dc3f 100644
+--- a/drivers/net/can/ti_hecc.c
++++ b/drivers/net/can/ti_hecc.c
+@@ -637,6 +637,9 @@ static int ti_hecc_rx_poll(struct napi_struct *napi, int quota)
+ 		mbx_mask = hecc_read(priv, HECC_CANMIM);
+ 		mbx_mask |= HECC_TX_MBOX_MASK;
+ 		hecc_write(priv, HECC_CANMIM, mbx_mask);
++	} else {
++		/* repoll is done only if whole budget is used */
++		num_pkts = quota;
+ 	}
+ 
+ 	return num_pkts;
+diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
+index b3d02759c226..b00358297424 100644
+--- a/drivers/net/can/usb/ems_usb.c
++++ b/drivers/net/can/usb/ems_usb.c
+@@ -288,6 +288,8 @@ static void ems_usb_read_interrupt_callback(struct urb *urb)
+ 
+ 	case -ECONNRESET: /* unlink */
+ 	case -ENOENT:
++	case -EPIPE:
++	case -EPROTO:
+ 	case -ESHUTDOWN:
+ 		return;
+ 
+diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
+index 9fdb0f0bfa06..c6dcf93675c0 100644
+--- a/drivers/net/can/usb/esd_usb2.c
++++ b/drivers/net/can/usb/esd_usb2.c
+@@ -393,6 +393,8 @@ static void esd_usb2_read_bulk_callback(struct urb *urb)
+ 		break;
+ 
+ 	case -ENOENT:
++	case -EPIPE:
++	case -EPROTO:
+ 	case -ESHUTDOWN:
+ 		return;
+ 
+diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
+index 9b18d96ef526..63587b8e6825 100644
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -609,8 +609,8 @@ static int kvaser_usb_wait_msg(const struct kvaser_usb *dev, u8 id,
+ 			}
+ 
+ 			if (pos + tmp->len > actual_len) {
+-				dev_err(dev->udev->dev.parent,
+-					"Format error\n");
++				dev_err_ratelimited(dev->udev->dev.parent,
++						    "Format error\n");
+ 				break;
+ 			}
+ 
+@@ -813,6 +813,7 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv,
+ 	if (err) {
+ 		netdev_err(netdev, "Error transmitting URB\n");
+ 		usb_unanchor_urb(urb);
++		kfree(buf);
+ 		usb_free_urb(urb);
+ 		return err;
+ 	}
+@@ -1325,6 +1326,8 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
+ 	case 0:
+ 		break;
+ 	case -ENOENT:
++	case -EPIPE:
++	case -EPROTO:
+ 	case -ESHUTDOWN:
+ 		return;
+ 	default:
+@@ -1333,7 +1336,7 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
+ 		goto resubmit_urb;
+ 	}
+ 
+-	while (pos <= urb->actual_length - MSG_HEADER_LEN) {
++	while (pos <= (int)(urb->actual_length - MSG_HEADER_LEN)) {
+ 		msg = urb->transfer_buffer + pos;
+ 
+ 		/* The Kvaser firmware can only read and write messages that
+@@ -1352,7 +1355,8 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
+ 		}
+ 
+ 		if (pos + msg->len > urb->actual_length) {
+-			dev_err(dev->udev->dev.parent, "Format error\n");
++			dev_err_ratelimited(dev->udev->dev.parent,
++					    "Format error\n");
+ 			break;
+ 		}
+ 
+@@ -1768,6 +1772,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
+ 		spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
+ 
+ 		usb_unanchor_urb(urb);
++		kfree(buf);
+ 
+ 		stats->tx_dropped++;
+ 
+diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
+index 7f0272558bef..e0c24abce16c 100644
+--- a/drivers/net/can/usb/mcba_usb.c
++++ b/drivers/net/can/usb/mcba_usb.c
+@@ -592,6 +592,8 @@ static void mcba_usb_read_bulk_callback(struct urb *urb)
+ 		break;
+ 
+ 	case -ENOENT:
++	case -EPIPE:
++	case -EPROTO:
+ 	case -ESHUTDOWN:
+ 		return;
+ 
+diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
+index d000cb62d6ae..27861c417c94 100644
+--- a/drivers/net/can/usb/usb_8dev.c
++++ b/drivers/net/can/usb/usb_8dev.c
+@@ -524,6 +524,8 @@ static void usb_8dev_read_bulk_callback(struct urb *urb)
+ 		break;
+ 
+ 	case -ENOENT:
++	case -EPIPE:
++	case -EPROTO:
+ 	case -ESHUTDOWN:
+ 		return;
+ 
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.h b/drivers/net/ethernet/netronome/nfp/flower/main.h
+index c20dd00a1cae..899e7d53e669 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/main.h
++++ b/drivers/net/ethernet/netronome/nfp/flower/main.h
+@@ -52,8 +52,7 @@ struct nfp_app;
+ #define NFP_FLOWER_MASK_ELEMENT_RS	1
+ #define NFP_FLOWER_MASK_HASH_BITS	10
+ 
+-#define NFP_FL_META_FLAG_NEW_MASK	128
+-#define NFP_FL_META_FLAG_LAST_MASK	1
++#define NFP_FL_META_FLAG_MANAGE_MASK	BIT(7)
+ 
+ #define NFP_FL_MASK_REUSE_TIME_NS	40000
+ #define NFP_FL_MASK_ID_LOCATION		1
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/metadata.c b/drivers/net/ethernet/netronome/nfp/flower/metadata.c
+index 3226ddc55f99..d9582ccc0025 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/metadata.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/metadata.c
+@@ -282,7 +282,7 @@ nfp_check_mask_add(struct nfp_app *app, char *mask_data, u32 mask_len,
+ 		id = nfp_add_mask_table(app, mask_data, mask_len);
+ 		if (id < 0)
+ 			return false;
+-		*meta_flags |= NFP_FL_META_FLAG_NEW_MASK;
++		*meta_flags |= NFP_FL_META_FLAG_MANAGE_MASK;
+ 	}
+ 	*mask_id = id;
+ 
+@@ -299,6 +299,9 @@ nfp_check_mask_remove(struct nfp_app *app, char *mask_data, u32 mask_len,
+ 	if (!mask_entry)
+ 		return false;
+ 
++	if (meta_flags)
++		*meta_flags &= ~NFP_FL_META_FLAG_MANAGE_MASK;
++
+ 	*mask_id = mask_entry->mask_id;
+ 	mask_entry->ref_cnt--;
+ 	if (!mask_entry->ref_cnt) {
+@@ -306,7 +309,7 @@ nfp_check_mask_remove(struct nfp_app *app, char *mask_data, u32 mask_len,
+ 		nfp_release_mask_id(app, *mask_id);
+ 		kfree(mask_entry);
+ 		if (meta_flags)
+-			*meta_flags |= NFP_FL_META_FLAG_LAST_MASK;
++			*meta_flags |= NFP_FL_META_FLAG_MANAGE_MASK;
+ 	}
+ 
+ 	return true;
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
+index d540a9dc77b3..1c43aca8162d 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
+@@ -297,6 +297,8 @@ int nfp_repr_init(struct nfp_app *app, struct net_device *netdev,
+ 	netdev->netdev_ops = &nfp_repr_netdev_ops;
+ 	netdev->ethtool_ops = &nfp_port_ethtool_ops;
+ 
++	netdev->max_mtu = pf_netdev->max_mtu;
++
+ 	SWITCHDEV_SET_OPS(netdev, &nfp_port_switchdev_ops);
+ 
+ 	if (nfp_app_has_tc(app)) {
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index ed51018a813e..b9d8d71a6ecc 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -1503,6 +1503,7 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ {
+ 	struct geneve_dev *geneve = netdev_priv(dev);
+ 	struct ip_tunnel_info *info = &geneve->info;
++	bool metadata = geneve->collect_md;
+ 	__u8 tmp_vni[3];
+ 	__u32 vni;
+ 
+@@ -1511,32 +1512,24 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ 	if (nla_put_u32(skb, IFLA_GENEVE_ID, vni))
+ 		goto nla_put_failure;
+ 
+-	if (rtnl_dereference(geneve->sock4)) {
++	if (!metadata && ip_tunnel_info_af(info) == AF_INET) {
+ 		if (nla_put_in_addr(skb, IFLA_GENEVE_REMOTE,
+ 				    info->key.u.ipv4.dst))
+ 			goto nla_put_failure;
+-
+ 		if (nla_put_u8(skb, IFLA_GENEVE_UDP_CSUM,
+ 			       !!(info->key.tun_flags & TUNNEL_CSUM)))
+ 			goto nla_put_failure;
+ 
+-	}
+-
+ #if IS_ENABLED(CONFIG_IPV6)
+-	if (rtnl_dereference(geneve->sock6)) {
++	} else if (!metadata) {
+ 		if (nla_put_in6_addr(skb, IFLA_GENEVE_REMOTE6,
+ 				     &info->key.u.ipv6.dst))
+ 			goto nla_put_failure;
+-
+ 		if (nla_put_u8(skb, IFLA_GENEVE_UDP_ZERO_CSUM6_TX,
+ 			       !(info->key.tun_flags & TUNNEL_CSUM)))
+ 			goto nla_put_failure;
+-
+-		if (nla_put_u8(skb, IFLA_GENEVE_UDP_ZERO_CSUM6_RX,
+-			       !geneve->use_udp6_rx_checksums))
+-			goto nla_put_failure;
+-	}
+ #endif
++	}
+ 
+ 	if (nla_put_u8(skb, IFLA_GENEVE_TTL, info->key.ttl) ||
+ 	    nla_put_u8(skb, IFLA_GENEVE_TOS, info->key.tos) ||
+@@ -1546,10 +1539,13 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ 	if (nla_put_be16(skb, IFLA_GENEVE_PORT, info->key.tp_dst))
+ 		goto nla_put_failure;
+ 
+-	if (geneve->collect_md) {
+-		if (nla_put_flag(skb, IFLA_GENEVE_COLLECT_METADATA))
++	if (metadata && nla_put_flag(skb, IFLA_GENEVE_COLLECT_METADATA))
+ 			goto nla_put_failure;
+-	}
++
++	if (nla_put_u8(skb, IFLA_GENEVE_UDP_ZERO_CSUM6_RX,
++		       !geneve->use_udp6_rx_checksums))
++		goto nla_put_failure;
++
+ 	return 0;
+ 
+ nla_put_failure:
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 613caca7dc02..b3fa8ae80465 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4096,8 +4096,8 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+ 	sdio_release_host(sdiodev->func[1]);
+ fail:
+ 	brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
+-	device_release_driver(dev);
+ 	device_release_driver(&sdiodev->func[2]->dev);
++	device_release_driver(dev);
+ }
+ 
+ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/txq.h b/drivers/net/wireless/intel/iwlwifi/fw/api/txq.h
+index 87b4434224a1..dfa111bb411e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/txq.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/txq.h
+@@ -68,6 +68,9 @@
+  * @IWL_MVM_DQA_CMD_QUEUE: a queue reserved for sending HCMDs to the FW
+  * @IWL_MVM_DQA_AUX_QUEUE: a queue reserved for aux frames
+  * @IWL_MVM_DQA_P2P_DEVICE_QUEUE: a queue reserved for P2P device frames
++ * @IWL_MVM_DQA_INJECT_MONITOR_QUEUE: a queue reserved for injection using
++ *	monitor mode. Note this queue is the same as the queue for P2P device
++ *	but we can't have active monitor mode along with P2P device anyway.
+  * @IWL_MVM_DQA_GCAST_QUEUE: a queue reserved for P2P GO/SoftAP GCAST frames
+  * @IWL_MVM_DQA_BSS_CLIENT_QUEUE: a queue reserved for BSS activity, to ensure
+  *	that we are never left without the possibility to connect to an AP.
+@@ -87,6 +90,7 @@ enum iwl_mvm_dqa_txq {
+ 	IWL_MVM_DQA_CMD_QUEUE = 0,
+ 	IWL_MVM_DQA_AUX_QUEUE = 1,
+ 	IWL_MVM_DQA_P2P_DEVICE_QUEUE = 2,
++	IWL_MVM_DQA_INJECT_MONITOR_QUEUE = 2,
+ 	IWL_MVM_DQA_GCAST_QUEUE = 3,
+ 	IWL_MVM_DQA_BSS_CLIENT_QUEUE = 4,
+ 	IWL_MVM_DQA_MIN_MGMT_QUEUE = 5,
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+index e90abbfba718..ecd5c1df811c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+@@ -117,6 +117,7 @@
+ #define FH_RSCSR_FRAME_INVALID		0x55550000
+ #define FH_RSCSR_FRAME_ALIGN		0x40
+ #define FH_RSCSR_RPA_EN			BIT(25)
++#define FH_RSCSR_RADA_EN		BIT(26)
+ #define FH_RSCSR_RXQ_POS		16
+ #define FH_RSCSR_RXQ_MASK		0x3F0000
+ 
+@@ -128,7 +129,8 @@ struct iwl_rx_packet {
+ 	 * 31:    flag flush RB request
+ 	 * 30:    flag ignore TC (terminal counter) request
+ 	 * 29:    flag fast IRQ request
+-	 * 28-26: Reserved
++	 * 28-27: Reserved
++	 * 26:    RADA enabled
+ 	 * 25:    Offload enabled
+ 	 * 24:    RPF enabled
+ 	 * 23:    RSS enabled
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+index a2bf530eeae4..2f22e14e00fe 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+@@ -787,7 +787,7 @@ static int iwl_mvm_mac_ctxt_cmd_listener(struct iwl_mvm *mvm,
+ 					 u32 action)
+ {
+ 	struct iwl_mac_ctx_cmd cmd = {};
+-	u32 tfd_queue_msk = 0;
++	u32 tfd_queue_msk = BIT(mvm->snif_queue);
+ 	int ret;
+ 
+ 	WARN_ON(vif->type != NL80211_IFTYPE_MONITOR);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+index 8dcdb522b846..2ec27ceb8af9 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+@@ -954,6 +954,7 @@ struct iwl_mvm {
+ 
+ 	/* Tx queues */
+ 	u16 aux_queue;
++	u16 snif_queue;
+ 	u16 probe_queue;
+ 	u16 p2p_dev_queue;
+ 
+@@ -1042,6 +1043,7 @@ struct iwl_mvm {
+  * @IWL_MVM_STATUS_ROC_AUX_RUNNING: AUX remain-on-channel is running
+  * @IWL_MVM_STATUS_D3_RECONFIG: D3 reconfiguration is being done
+  * @IWL_MVM_STATUS_FIRMWARE_RUNNING: firmware is running
++ * @IWL_MVM_STATUS_NEED_FLUSH_P2P: need to flush P2P bcast STA
+  */
+ enum iwl_mvm_status {
+ 	IWL_MVM_STATUS_HW_RFKILL,
+@@ -1053,6 +1055,7 @@ enum iwl_mvm_status {
+ 	IWL_MVM_STATUS_ROC_AUX_RUNNING,
+ 	IWL_MVM_STATUS_D3_RECONFIG,
+ 	IWL_MVM_STATUS_FIRMWARE_RUNNING,
++	IWL_MVM_STATUS_NEED_FLUSH_P2P,
+ };
+ 
+ /* Keep track of completed init configuration */
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+index 231878969332..9fb40955d5f4 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+@@ -622,6 +622,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
+ 	mvm->fw_restart = iwlwifi_mod_params.fw_restart ? -1 : 0;
+ 
+ 	mvm->aux_queue = IWL_MVM_DQA_AUX_QUEUE;
++	mvm->snif_queue = IWL_MVM_DQA_INJECT_MONITOR_QUEUE;
+ 	mvm->probe_queue = IWL_MVM_DQA_AP_PROBE_RESP_QUEUE;
+ 	mvm->p2p_dev_queue = IWL_MVM_DQA_P2P_DEVICE_QUEUE;
+ 
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+index 248699c2c4bf..819e6f66a5b5 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+@@ -232,8 +232,8 @@ static void iwl_mvm_get_signal_strength(struct iwl_mvm *mvm,
+ 
+ static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_hdr *hdr,
+ 			     struct ieee80211_rx_status *stats,
+-			     struct iwl_rx_mpdu_desc *desc, int queue,
+-			     u8 *crypt_len)
++			     struct iwl_rx_mpdu_desc *desc, u32 pkt_flags,
++			     int queue, u8 *crypt_len)
+ {
+ 	u16 status = le16_to_cpu(desc->status);
+ 
+@@ -253,6 +253,8 @@ static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_hdr *hdr,
+ 			return -1;
+ 
+ 		stats->flag |= RX_FLAG_DECRYPTED;
++		if (pkt_flags & FH_RSCSR_RADA_EN)
++			stats->flag |= RX_FLAG_MIC_STRIPPED;
+ 		*crypt_len = IEEE80211_CCMP_HDR_LEN;
+ 		return 0;
+ 	case IWL_RX_MPDU_STATUS_SEC_TKIP:
+@@ -270,6 +272,10 @@ static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_hdr *hdr,
+ 		if ((status & IWL_RX_MPDU_STATUS_SEC_MASK) ==
+ 				IWL_RX_MPDU_STATUS_SEC_WEP)
+ 			*crypt_len = IEEE80211_WEP_IV_LEN;
++
++		if (pkt_flags & FH_RSCSR_RADA_EN)
++			stats->flag |= RX_FLAG_ICV_STRIPPED;
++
+ 		return 0;
+ 	case IWL_RX_MPDU_STATUS_SEC_EXT_ENC:
+ 		if (!(status & IWL_RX_MPDU_STATUS_MIC_OK))
+@@ -810,7 +816,9 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
+ 
+ 	rx_status = IEEE80211_SKB_RXCB(skb);
+ 
+-	if (iwl_mvm_rx_crypto(mvm, hdr, rx_status, desc, queue, &crypt_len)) {
++	if (iwl_mvm_rx_crypto(mvm, hdr, rx_status, desc,
++			      le32_to_cpu(pkt->len_n_flags), queue,
++			      &crypt_len)) {
+ 		kfree_skb(skb);
+ 		return;
+ 	}
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index c4a343534c5e..0d7929799942 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -1700,29 +1700,29 @@ void iwl_mvm_dealloc_int_sta(struct iwl_mvm *mvm, struct iwl_mvm_int_sta *sta)
+ 	sta->sta_id = IWL_MVM_INVALID_STA;
+ }
+ 
+-static void iwl_mvm_enable_aux_queue(struct iwl_mvm *mvm)
++static void iwl_mvm_enable_aux_snif_queue(struct iwl_mvm *mvm, u16 *queue,
++					  u8 sta_id, u8 fifo)
+ {
+ 	unsigned int wdg_timeout = iwlmvm_mod_params.tfd_q_hang_detect ?
+ 					mvm->cfg->base_params->wd_timeout :
+ 					IWL_WATCHDOG_DISABLED;
+ 
+ 	if (iwl_mvm_has_new_tx_api(mvm)) {
+-		int queue = iwl_mvm_tvqm_enable_txq(mvm, mvm->aux_queue,
+-						    mvm->aux_sta.sta_id,
+-						    IWL_MAX_TID_COUNT,
+-						    wdg_timeout);
+-		mvm->aux_queue = queue;
++		int tvqm_queue =
++			iwl_mvm_tvqm_enable_txq(mvm, *queue, sta_id,
++						IWL_MAX_TID_COUNT,
++						wdg_timeout);
++		*queue = tvqm_queue;
+ 	} else {
+ 		struct iwl_trans_txq_scd_cfg cfg = {
+-			.fifo = IWL_MVM_TX_FIFO_MCAST,
+-			.sta_id = mvm->aux_sta.sta_id,
++			.fifo = fifo,
++			.sta_id = sta_id,
+ 			.tid = IWL_MAX_TID_COUNT,
+ 			.aggregate = false,
+ 			.frame_limit = IWL_FRAME_LIMIT,
+ 		};
+ 
+-		iwl_mvm_enable_txq(mvm, mvm->aux_queue, mvm->aux_queue, 0, &cfg,
+-				   wdg_timeout);
++		iwl_mvm_enable_txq(mvm, *queue, *queue, 0, &cfg, wdg_timeout);
+ 	}
+ }
+ 
+@@ -1741,7 +1741,9 @@ int iwl_mvm_add_aux_sta(struct iwl_mvm *mvm)
+ 
+ 	/* Map Aux queue to fifo - needs to happen before adding Aux station */
+ 	if (!iwl_mvm_has_new_tx_api(mvm))
+-		iwl_mvm_enable_aux_queue(mvm);
++		iwl_mvm_enable_aux_snif_queue(mvm, &mvm->aux_queue,
++					      mvm->aux_sta.sta_id,
++					      IWL_MVM_TX_FIFO_MCAST);
+ 
+ 	ret = iwl_mvm_add_int_sta_common(mvm, &mvm->aux_sta, NULL,
+ 					 MAC_INDEX_AUX, 0);
+@@ -1755,7 +1757,9 @@ int iwl_mvm_add_aux_sta(struct iwl_mvm *mvm)
+ 	 * to firmware so enable queue here - after the station was added
+ 	 */
+ 	if (iwl_mvm_has_new_tx_api(mvm))
+-		iwl_mvm_enable_aux_queue(mvm);
++		iwl_mvm_enable_aux_snif_queue(mvm, &mvm->aux_queue,
++					      mvm->aux_sta.sta_id,
++					      IWL_MVM_TX_FIFO_MCAST);
+ 
+ 	return 0;
+ }
+@@ -1763,10 +1767,31 @@ int iwl_mvm_add_aux_sta(struct iwl_mvm *mvm)
+ int iwl_mvm_add_snif_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+ {
+ 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
++	int ret;
+ 
+ 	lockdep_assert_held(&mvm->mutex);
+-	return iwl_mvm_add_int_sta_common(mvm, &mvm->snif_sta, vif->addr,
++
++	/* Map snif queue to fifo - must happen before adding snif station */
++	if (!iwl_mvm_has_new_tx_api(mvm))
++		iwl_mvm_enable_aux_snif_queue(mvm, &mvm->snif_queue,
++					      mvm->snif_sta.sta_id,
++					      IWL_MVM_TX_FIFO_BE);
++
++	ret = iwl_mvm_add_int_sta_common(mvm, &mvm->snif_sta, vif->addr,
+ 					 mvmvif->id, 0);
++	if (ret)
++		return ret;
++
++	/*
++	 * For 22000 firmware and on we cannot add queue to a station unknown
++	 * to firmware so enable queue here - after the station was added
++	 */
++	if (iwl_mvm_has_new_tx_api(mvm))
++		iwl_mvm_enable_aux_snif_queue(mvm, &mvm->snif_queue,
++					      mvm->snif_sta.sta_id,
++					      IWL_MVM_TX_FIFO_BE);
++
++	return 0;
+ }
+ 
+ int iwl_mvm_rm_snif_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+@@ -1775,6 +1800,8 @@ int iwl_mvm_rm_snif_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+ 
+ 	lockdep_assert_held(&mvm->mutex);
+ 
++	iwl_mvm_disable_txq(mvm, mvm->snif_queue, mvm->snif_queue,
++			    IWL_MAX_TID_COUNT, 0);
+ 	ret = iwl_mvm_rm_sta_common(mvm, mvm->snif_sta.sta_id);
+ 	if (ret)
+ 		IWL_WARN(mvm, "Failed sending remove station\n");
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+index 4d0314912e94..e25cda9fbf6c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+@@ -132,6 +132,24 @@ void iwl_mvm_roc_done_wk(struct work_struct *wk)
+ 	 * executed, and a new time event means a new command.
+ 	 */
+ 	iwl_mvm_flush_sta(mvm, &mvm->aux_sta, true, CMD_ASYNC);
++
++	/* Do the same for the P2P device queue (STA) */
++	if (test_and_clear_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status)) {
++		struct iwl_mvm_vif *mvmvif;
++
++		/*
++		 * NB: access to this pointer would be racy, but the flush bit
++		 * can only be set when we had a P2P-Device VIF, and we have a
++		 * flush of this work in iwl_mvm_prepare_mac_removal() so it's
++		 * not really racy.
++		 */
++
++		if (!WARN_ON(!mvm->p2p_device_vif)) {
++			mvmvif = iwl_mvm_vif_from_mac80211(mvm->p2p_device_vif);
++			iwl_mvm_flush_sta(mvm, &mvmvif->bcast_sta, true,
++					  CMD_ASYNC);
++		}
++	}
+ }
+ 
+ static void iwl_mvm_roc_finished(struct iwl_mvm *mvm)
+@@ -855,10 +873,12 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
+ 
+ 	mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
+ 
+-	if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE)
++	if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
+ 		iwl_mvm_remove_time_event(mvm, mvmvif, te_data);
+-	else
++		set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status);
++	} else {
+ 		iwl_mvm_remove_aux_roc_te(mvm, mvmvif, te_data);
++	}
+ 
+ 	iwl_mvm_roc_finished(mvm);
+ }
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index 6f2e2af23219..887a504ce64a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -657,7 +657,8 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
+ 			if (ap_sta_id != IWL_MVM_INVALID_STA)
+ 				sta_id = ap_sta_id;
+ 		} else if (info.control.vif->type == NL80211_IFTYPE_MONITOR) {
+-			queue = mvm->aux_queue;
++			queue = mvm->snif_queue;
++			sta_id = mvm->snif_sta.sta_id;
+ 		}
+ 	}
+ 
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+index 2ea74abad73d..53e269d54050 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+@@ -1143,9 +1143,18 @@ unsigned int iwl_mvm_get_wd_timeout(struct iwl_mvm *mvm,
+ 	unsigned int default_timeout =
+ 		cmd_q ? IWL_DEF_WD_TIMEOUT : mvm->cfg->base_params->wd_timeout;
+ 
+-	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_TXQ_TIMERS))
++	if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_TXQ_TIMERS)) {
++		/*
++		 * We can't know when the station is asleep or awake, so we
++		 * must disable the queue hang detection.
++		 */
++		if (fw_has_capa(&mvm->fw->ucode_capa,
++				IWL_UCODE_TLV_CAPA_STA_PM_NOTIF) &&
++		    vif && vif->type == NL80211_IFTYPE_AP)
++			return IWL_WATCHDOG_DISABLED;
+ 		return iwlmvm_mod_params.tfd_q_hang_detect ?
+ 			default_timeout : IWL_WATCHDOG_DISABLED;
++	}
+ 
+ 	trigger = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_TXQ_TIMERS);
+ 	txq_timer = (void *)trigger->data;
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index 548e1928430d..0f7bd37bf172 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -551,6 +551,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ 	{IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x271B, 0x0210, iwl9160_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x271B, 0x0214, iwl9260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x271C, 0x0214, iwl9260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x2720, 0x0034, iwl9560_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x2720, 0x0038, iwl9560_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x2720, 0x003C, iwl9560_2ac_cfg)},
+@@ -662,6 +663,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ 	{IWL_PCI_DEVICE(0x2720, 0x0310, iwla000_2ac_cfg_hr_cdb)},
+ 	{IWL_PCI_DEVICE(0x40C0, 0x0000, iwla000_2ax_cfg_hr)},
+ 	{IWL_PCI_DEVICE(0x40C0, 0x0A10, iwla000_2ax_cfg_hr)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x0000, iwla000_2ax_cfg_hr)},
+ 
+ #endif /* CONFIG_IWLMVM */
+ 
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 6467ffac9811..a59b54328c07 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3108,6 +3108,7 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
+ {
+ 	struct hwsim_new_radio_params param = { 0 };
+ 	const char *hwname = NULL;
++	int ret;
+ 
+ 	param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
+ 	param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
+@@ -3147,7 +3148,9 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
+ 		param.regd = hwsim_world_regdom_custom[idx];
+ 	}
+ 
+-	return mac80211_hwsim_new_radio(info, &param);
++	ret = mac80211_hwsim_new_radio(info, &param);
++	kfree(hwname);
++	return ret;
+ }
+ 
+ static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info)
+diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
+index 81df09dd2636..f90c10b3c921 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
+@@ -162,13 +162,13 @@ static int rsi_usb_reg_read(struct usb_device *usbdev,
+ 	u8 *buf;
+ 	int status = -ENOMEM;
+ 
++	if (len > RSI_USB_CTRL_BUF_SIZE)
++		return -EINVAL;
++
+ 	buf  = kmalloc(RSI_USB_CTRL_BUF_SIZE, GFP_KERNEL);
+ 	if (!buf)
+ 		return status;
+ 
+-	if (len > RSI_USB_CTRL_BUF_SIZE)
+-		return -EINVAL;
+-
+ 	status = usb_control_msg(usbdev,
+ 				 usb_rcvctrlpipe(usbdev, 0),
+ 				 USB_VENDOR_REGISTER_READ,
+@@ -207,13 +207,13 @@ static int rsi_usb_reg_write(struct usb_device *usbdev,
+ 	u8 *usb_reg_buf;
+ 	int status = -ENOMEM;
+ 
++	if (len > RSI_USB_CTRL_BUF_SIZE)
++		return -EINVAL;
++
+ 	usb_reg_buf  = kmalloc(RSI_USB_CTRL_BUF_SIZE, GFP_KERNEL);
+ 	if (!usb_reg_buf)
+ 		return status;
+ 
+-	if (len > RSI_USB_CTRL_BUF_SIZE)
+-		return -EINVAL;
+-
+ 	usb_reg_buf[0] = (value & 0x00ff);
+ 	usb_reg_buf[1] = (value & 0xff00) >> 8;
+ 	usb_reg_buf[2] = 0x0;
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+index 71b944748304..c5fe7d4a9065 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -408,12 +408,21 @@ static int armada_37xx_gpio_direction_output(struct gpio_chip *chip,
+ {
+ 	struct armada_37xx_pinctrl *info = gpiochip_get_data(chip);
+ 	unsigned int reg = OUTPUT_EN;
+-	unsigned int mask;
++	unsigned int mask, val, ret;
+ 
+ 	armada_37xx_update_reg(&reg, offset);
+ 	mask = BIT(offset);
+ 
+-	return regmap_update_bits(info->regmap, reg, mask, mask);
++	ret = regmap_update_bits(info->regmap, reg, mask, mask);
++
++	if (ret)
++		return ret;
++
++	reg = OUTPUT_VAL;
++	val = value ? mask : 0;
++	regmap_update_bits(info->regmap, reg, mask, val);
++
++	return 0;
+ }
+ 
+ static int armada_37xx_gpio_get(struct gpio_chip *chip, unsigned int offset)
+diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
+index 5beb0c361076..76afe1449cab 100644
+--- a/drivers/rapidio/devices/rio_mport_cdev.c
++++ b/drivers/rapidio/devices/rio_mport_cdev.c
+@@ -963,7 +963,8 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode,
+ 			   req->sgt.sgl, req->sgt.nents, dir);
+ 	if (nents == -EFAULT) {
+ 		rmcd_error("Failed to map SG list");
+-		return -EFAULT;
++		ret = -EFAULT;
++		goto err_pg;
+ 	}
+ 
+ 	ret = do_dma_request(req, xfer, sync, nents);
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index bcc1694cebcd..635cfa1f2ace 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -2126,11 +2126,13 @@ void __scsi_init_queue(struct Scsi_Host *shost, struct request_queue *q)
+ 		q->limits.cluster = 0;
+ 
+ 	/*
+-	 * set a reasonable default alignment on word boundaries: the
+-	 * host and device may alter it using
+-	 * blk_queue_update_dma_alignment() later.
++	 * Set a reasonable default alignment:  The larger of 32-byte (dword),
++	 * which is a common minimum for HBAs, and the minimum DMA alignment,
++	 * which is set by the platform.
++	 *
++	 * Devices that require a bigger alignment can increase it later.
+ 	 */
+-	blk_queue_dma_alignment(q, 0x03);
++	blk_queue_dma_alignment(q, max(4, dma_get_cache_alignment()) - 1);
+ }
+ EXPORT_SYMBOL_GPL(__scsi_init_queue);
+ 
+diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/serdev-ttyport.c
+index 302018d67efa..7f785d77ba7f 100644
+--- a/drivers/tty/serdev/serdev-ttyport.c
++++ b/drivers/tty/serdev/serdev-ttyport.c
+@@ -35,23 +35,41 @@ static int ttyport_receive_buf(struct tty_port *port, const unsigned char *cp,
+ {
+ 	struct serdev_controller *ctrl = port->client_data;
+ 	struct serport *serport = serdev_controller_get_drvdata(ctrl);
++	int ret;
+ 
+ 	if (!test_bit(SERPORT_ACTIVE, &serport->flags))
+ 		return 0;
+ 
+-	return serdev_controller_receive_buf(ctrl, cp, count);
++	ret = serdev_controller_receive_buf(ctrl, cp, count);
++
++	dev_WARN_ONCE(&ctrl->dev, ret < 0 || ret > count,
++				"receive_buf returns %d (count = %zu)\n",
++				ret, count);
++	if (ret < 0)
++		return 0;
++	else if (ret > count)
++		return count;
++
++	return ret;
+ }
+ 
+ static void ttyport_write_wakeup(struct tty_port *port)
+ {
+ 	struct serdev_controller *ctrl = port->client_data;
+ 	struct serport *serport = serdev_controller_get_drvdata(ctrl);
++	struct tty_struct *tty;
++
++	tty = tty_port_tty_get(port);
++	if (!tty)
++		return;
+ 
+-	if (test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &port->tty->flags) &&
++	if (test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) &&
+ 	    test_bit(SERPORT_ACTIVE, &serport->flags))
+ 		serdev_controller_write_wakeup(ctrl);
+ 
+-	wake_up_interruptible_poll(&port->tty->write_wait, POLLOUT);
++	wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
++
++	tty_kref_put(tty);
+ }
+ 
+ static const struct tty_port_client_operations client_ops = {
+@@ -131,8 +149,10 @@ static void ttyport_close(struct serdev_controller *ctrl)
+ 
+ 	clear_bit(SERPORT_ACTIVE, &serport->flags);
+ 
++	tty_lock(tty);
+ 	if (tty->ops->close)
+ 		tty->ops->close(tty, NULL);
++	tty_unlock(tty);
+ 
+ 	tty_release_struct(tty, serport->tty_idx);
+ }
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index ef8f7d63a8f0..0202e5132fa7 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -2286,9 +2286,18 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
+ 		int i;
+ 
+ 		if (len < sizeof(*d) ||
+-		    d->bFirstInterfaceNumber >= ffs->interfaces_count ||
+-		    !d->Reserved1)
++		    d->bFirstInterfaceNumber >= ffs->interfaces_count)
+ 			return -EINVAL;
++		if (d->Reserved1 != 1) {
++			/*
++			 * According to the spec, Reserved1 must be set to 1
++			 * but older kernels incorrectly rejected non-zero
++			 * values.  We fix it here to avoid returning EINVAL
++			 * in response to values we used to accept.
++			 */
++			pr_debug("usb_ext_compat_desc::Reserved1 forced to 1\n");
++			d->Reserved1 = 1;
++		}
+ 		for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
+ 			if (d->Reserved2[i])
+ 				return -EINVAL;
+diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
+index d41d07aae0ce..def1b05ffca0 100644
+--- a/drivers/usb/gadget/udc/core.c
++++ b/drivers/usb/gadget/udc/core.c
+@@ -1080,8 +1080,12 @@ static inline void usb_gadget_udc_stop(struct usb_udc *udc)
+ static inline void usb_gadget_udc_set_speed(struct usb_udc *udc,
+ 					    enum usb_device_speed speed)
+ {
+-	if (udc->gadget->ops->udc_set_speed)
+-		udc->gadget->ops->udc_set_speed(udc->gadget, speed);
++	if (udc->gadget->ops->udc_set_speed) {
++		enum usb_device_speed s;
++
++		s = min(speed, udc->gadget->max_speed);
++		udc->gadget->ops->udc_set_speed(udc->gadget, s);
++	}
+ }
+ 
+ /**
+diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
+index 63a206122058..6b3e8adb64e6 100644
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -254,7 +254,7 @@
+ #define USB3_EP0_SS_MAX_PACKET_SIZE	512
+ #define USB3_EP0_HSFS_MAX_PACKET_SIZE	64
+ #define USB3_EP0_BUF_SIZE		8
+-#define USB3_MAX_NUM_PIPES		30
++#define USB3_MAX_NUM_PIPES		6	/* This includes PIPE 0 */
+ #define USB3_WAIT_US			3
+ #define USB3_DMA_NUM_SETTING_AREA	4
+ /*
+diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
+index 48230a5e12f2..bf7ff3934d7f 100644
+--- a/drivers/virtio/virtio.c
++++ b/drivers/virtio/virtio.c
+@@ -333,6 +333,8 @@ int register_virtio_device(struct virtio_device *dev)
+ 	/* device_register() causes the bus infrastructure to look for a
+ 	 * matching driver. */
+ 	err = device_register(&dev->dev);
++	if (err)
++		ida_simple_remove(&virtio_index_ida, dev->index);
+ out:
+ 	if (err)
+ 		virtio_add_status(dev, VIRTIO_CONFIG_S_FAILED);
+diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
+index 782d4d05a53b..c7475867a52b 100644
+--- a/fs/afs/cmservice.c
++++ b/fs/afs/cmservice.c
+@@ -127,6 +127,9 @@ bool afs_cm_incoming_call(struct afs_call *call)
+ 	case CBProbe:
+ 		call->type = &afs_SRXCBProbe;
+ 		return true;
++	case CBProbeUuid:
++		call->type = &afs_SRXCBProbeUuid;
++		return true;
+ 	case CBTellMeAboutYourself:
+ 		call->type = &afs_SRXCBTellMeAboutYourself;
+ 		return true;
+diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
+index 0bf191f0dbaf..9f715c3edcf9 100644
+--- a/fs/afs/rxrpc.c
++++ b/fs/afs/rxrpc.c
+@@ -377,8 +377,17 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp,
+ 	 */
+ 	tx_total_len = call->request_size;
+ 	if (call->send_pages) {
+-		tx_total_len += call->last_to - call->first_offset;
+-		tx_total_len += (call->last - call->first) * PAGE_SIZE;
++		if (call->last == call->first) {
++			tx_total_len += call->last_to - call->first_offset;
++		} else {
++			/* It looks mathematically like you should be able to
++			 * combine the following lines with the ones above, but
++			 * unsigned arithmetic is fun when it wraps...
++			 */
++			tx_total_len += PAGE_SIZE - call->first_offset;
++			tx_total_len += call->last_to;
++			tx_total_len += (call->last - call->first - 1) * PAGE_SIZE;
++		}
+ 	}
+ 
+ 	/* create a call */
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 6d49db7d86be..e2bb2a065741 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1032,14 +1032,17 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
+ 		     root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) &&
+ 		    !(flags & BTRFS_BLOCK_FLAG_FULL_BACKREF)) {
+ 			ret = btrfs_inc_ref(trans, root, buf, 1);
+-			BUG_ON(ret); /* -ENOMEM */
++			if (ret)
++				return ret;
+ 
+ 			if (root->root_key.objectid ==
+ 			    BTRFS_TREE_RELOC_OBJECTID) {
+ 				ret = btrfs_dec_ref(trans, root, buf, 0);
+-				BUG_ON(ret); /* -ENOMEM */
++				if (ret)
++					return ret;
+ 				ret = btrfs_inc_ref(trans, root, cow, 1);
+-				BUG_ON(ret); /* -ENOMEM */
++				if (ret)
++					return ret;
+ 			}
+ 			new_flags |= BTRFS_BLOCK_FLAG_FULL_BACKREF;
+ 		} else {
+@@ -1049,7 +1052,8 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
+ 				ret = btrfs_inc_ref(trans, root, cow, 1);
+ 			else
+ 				ret = btrfs_inc_ref(trans, root, cow, 0);
+-			BUG_ON(ret); /* -ENOMEM */
++			if (ret)
++				return ret;
+ 		}
+ 		if (new_flags != 0) {
+ 			int level = btrfs_header_level(buf);
+@@ -1068,9 +1072,11 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
+ 				ret = btrfs_inc_ref(trans, root, cow, 1);
+ 			else
+ 				ret = btrfs_inc_ref(trans, root, cow, 0);
+-			BUG_ON(ret); /* -ENOMEM */
++			if (ret)
++				return ret;
+ 			ret = btrfs_dec_ref(trans, root, buf, 1);
+-			BUG_ON(ret); /* -ENOMEM */
++			if (ret)
++				return ret;
+ 		}
+ 		clean_tree_block(fs_info, buf);
+ 		*last_ref = 1;
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index e4774c02d922..d227d8514b25 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -9283,6 +9283,7 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
+ 	ret = btrfs_del_root(trans, fs_info, &root->root_key);
+ 	if (ret) {
+ 		btrfs_abort_transaction(trans, ret);
++		err = ret;
+ 		goto out_end_trans;
+ 	}
+ 
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 6ce467872376..b8372095ba0a 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2697,6 +2697,7 @@ static ssize_t f2fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ 
+ 		err = f2fs_preallocate_blocks(iocb, from);
+ 		if (err) {
++			clear_inode_flag(inode, FI_NO_PREALLOC);
+ 			inode_unlock(inode);
+ 			return err;
+ 		}
+diff --git a/fs/fcntl.c b/fs/fcntl.c
+index 8d78ffd7b399..6fd311367efc 100644
+--- a/fs/fcntl.c
++++ b/fs/fcntl.c
+@@ -632,9 +632,8 @@ COMPAT_SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
+ 		if (err)
+ 			break;
+ 		err = fixup_compat_flock(&flock);
+-		if (err)
+-			return err;
+-		err = put_compat_flock(&flock, compat_ptr(arg));
++		if (!err)
++			err = put_compat_flock(&flock, compat_ptr(arg));
+ 		break;
+ 	case F_GETLK64:
+ 	case F_OFD_GETLK:
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index b03b3bc05f96..bf2c43635062 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -2064,7 +2064,7 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ 		 * should mark the directories for revalidation.
+ 		 */
+ 		d_move(old_dentry, new_dentry);
+-		nfs_set_verifier(new_dentry,
++		nfs_set_verifier(old_dentry,
+ 					nfs_save_change_attribute(new_dir));
+ 	} else if (error == -ENOENT)
+ 		nfs_dentry_handle_enoent(old_dentry);
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 349c9d56d4b3..3909c55ed389 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -1125,7 +1125,7 @@ int pipe_proc_fn(struct ctl_table *table, int write, void __user *buf,
+ {
+ 	int ret;
+ 
+-	ret = proc_dointvec_minmax(table, write, buf, lenp, ppos);
++	ret = proc_douintvec_minmax(table, write, buf, lenp, ppos);
+ 	if (ret < 0 || !write)
+ 		return ret;
+ 
+diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
+index 4ec5b7f45401..63350906961a 100644
+--- a/fs/xfs/xfs_inode.c
++++ b/fs/xfs/xfs_inode.c
+@@ -2378,6 +2378,7 @@ xfs_ifree_cluster(
+ 				 */
+ 				if (ip->i_ino != inum + i) {
+ 					xfs_iunlock(ip, XFS_ILOCK_EXCL);
++					rcu_read_unlock();
+ 					continue;
+ 				}
+ 			}
+diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
+index 7653ea66874d..46930f82a988 100644
+--- a/include/linux/dma-mapping.h
++++ b/include/linux/dma-mapping.h
+@@ -697,7 +697,6 @@ static inline void *dma_zalloc_coherent(struct device *dev, size_t size,
+ 	return ret;
+ }
+ 
+-#ifdef CONFIG_HAS_DMA
+ static inline int dma_get_cache_alignment(void)
+ {
+ #ifdef ARCH_DMA_MINALIGN
+@@ -705,7 +704,6 @@ static inline int dma_get_cache_alignment(void)
+ #endif
+ 	return 1;
+ }
+-#endif
+ 
+ /* flags for the coherent memory api */
+ #define DMA_MEMORY_EXCLUSIVE		0x01
+diff --git a/include/linux/genalloc.h b/include/linux/genalloc.h
+index 6dfec4d638df..872f930f1b06 100644
+--- a/include/linux/genalloc.h
++++ b/include/linux/genalloc.h
+@@ -32,6 +32,7 @@
+ 
+ #include <linux/types.h>
+ #include <linux/spinlock_types.h>
++#include <linux/atomic.h>
+ 
+ struct device;
+ struct device_node;
+@@ -71,7 +72,7 @@ struct gen_pool {
+  */
+ struct gen_pool_chunk {
+ 	struct list_head next_chunk;	/* next chunk in pool */
+-	atomic_t avail;
++	atomic_long_t avail;
+ 	phys_addr_t phys_addr;		/* physical starting address of memory chunk */
+ 	unsigned long start_addr;	/* start address of memory chunk */
+ 	unsigned long end_addr;		/* end address of memory chunk (inclusive) */
+diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
+index 6431087816ba..ba74eaa8eadf 100644
+--- a/include/linux/hyperv.h
++++ b/include/linux/hyperv.h
+@@ -708,6 +708,7 @@ struct vmbus_channel {
+ 	u8 monitor_bit;
+ 
+ 	bool rescind; /* got rescind msg */
++	struct completion rescind_event;
+ 
+ 	u32 ringbuffer_gpadlhandle;
+ 
+diff --git a/include/linux/iio/timer/stm32-lptim-trigger.h b/include/linux/iio/timer/stm32-lptim-trigger.h
+index 34d59bfdce2d..464458d20b16 100644
+--- a/include/linux/iio/timer/stm32-lptim-trigger.h
++++ b/include/linux/iio/timer/stm32-lptim-trigger.h
+@@ -16,11 +16,14 @@
+ #define LPTIM2_OUT	"lptim2_out"
+ #define LPTIM3_OUT	"lptim3_out"
+ 
+-#if IS_ENABLED(CONFIG_IIO_STM32_LPTIMER_TRIGGER)
++#if IS_REACHABLE(CONFIG_IIO_STM32_LPTIMER_TRIGGER)
+ bool is_stm32_lptim_trigger(struct iio_trigger *trig);
+ #else
+ static inline bool is_stm32_lptim_trigger(struct iio_trigger *trig)
+ {
++#if IS_ENABLED(CONFIG_IIO_STM32_LPTIMER_TRIGGER)
++	pr_warn_once("stm32 lptim_trigger not linked in\n");
++#endif
+ 	return false;
+ }
+ #endif
+diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
+index e32dfe098e82..40839c02d28c 100644
+--- a/include/linux/sysfs.h
++++ b/include/linux/sysfs.h
+@@ -117,6 +117,12 @@ struct attribute_group {
+ 	.show	= _name##_show,						\
+ }
+ 
++#define __ATTR_RO_MODE(_name, _mode) {					\
++	.attr	= { .name = __stringify(_name),				\
++		    .mode = VERIFY_OCTAL_PERMISSIONS(_mode) },		\
++	.show	= _name##_show,						\
++}
++
+ #define __ATTR_WO(_name) {						\
+ 	.attr	= { .name = __stringify(_name), .mode = S_IWUSR },	\
+ 	.store	= _name##_store,					\
+diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h
+index 6c0dc6155ee7..a966d281dedc 100644
+--- a/include/scsi/libsas.h
++++ b/include/scsi/libsas.h
+@@ -165,11 +165,11 @@ struct expander_device {
+ 
+ struct sata_device {
+ 	unsigned int class;
+-	struct smp_resp        rps_resp; /* report_phy_sata_resp */
+ 	u8     port_no;        /* port number, if this is a PM (Port) */
+ 
+ 	struct ata_port *ap;
+ 	struct ata_host ata_host;
++	struct smp_resp rps_resp ____cacheline_aligned; /* report_phy_sata_resp */
+ 	u8     fis[ATA_RESP_FIS_SIZE];
+ };
+ 
+diff --git a/kernel/bpf/percpu_freelist.c b/kernel/bpf/percpu_freelist.c
+index 5c51d1985b51..673fa6fe2d73 100644
+--- a/kernel/bpf/percpu_freelist.c
++++ b/kernel/bpf/percpu_freelist.c
+@@ -78,8 +78,10 @@ struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s)
+ {
+ 	struct pcpu_freelist_head *head;
+ 	struct pcpu_freelist_node *node;
++	unsigned long flags;
+ 	int orig_cpu, cpu;
+ 
++	local_irq_save(flags);
+ 	orig_cpu = cpu = raw_smp_processor_id();
+ 	while (1) {
+ 		head = per_cpu_ptr(s->freelist, cpu);
+@@ -87,14 +89,16 @@ struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s)
+ 		node = head->first;
+ 		if (node) {
+ 			head->first = node->next;
+-			raw_spin_unlock(&head->lock);
++			raw_spin_unlock_irqrestore(&head->lock, flags);
+ 			return node;
+ 		}
+ 		raw_spin_unlock(&head->lock);
+ 		cpu = cpumask_next(cpu, cpu_possible_mask);
+ 		if (cpu >= nr_cpu_ids)
+ 			cpu = 0;
+-		if (cpu == orig_cpu)
++		if (cpu == orig_cpu) {
++			local_irq_restore(flags);
+ 			return NULL;
++		}
+ 	}
+ }
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 04892a82f6ac..7891aecc6aec 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -1289,11 +1289,6 @@ static struct cpuhp_step cpuhp_bp_states[] = {
+ 		.teardown.single	= NULL,
+ 		.cant_stop		= true,
+ 	},
+-	[CPUHP_AP_SMPCFD_DYING] = {
+-		.name			= "smpcfd:dying",
+-		.startup.single		= NULL,
+-		.teardown.single	= smpcfd_dying_cpu,
+-	},
+ 	/*
+ 	 * Handled on controll processor until the plugged processor manages
+ 	 * this itself.
+@@ -1335,6 +1330,11 @@ static struct cpuhp_step cpuhp_ap_states[] = {
+ 		.startup.single		= NULL,
+ 		.teardown.single	= rcutree_dying_cpu,
+ 	},
++	[CPUHP_AP_SMPCFD_DYING] = {
++		.name			= "smpcfd:dying",
++		.startup.single		= NULL,
++		.teardown.single	= smpcfd_dying_cpu,
++	},
+ 	/* Entry state on starting. Interrupts enabled from here on. Transient
+ 	 * state for synchronsization */
+ 	[CPUHP_AP_ONLINE] = {
+diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c
+index e74be38245ad..ed5d34925ad0 100644
+--- a/kernel/debug/kdb/kdb_io.c
++++ b/kernel/debug/kdb/kdb_io.c
+@@ -350,7 +350,7 @@ static char *kdb_read(char *buffer, size_t bufsize)
+ 			}
+ 			kdb_printf("\n");
+ 			for (i = 0; i < count; i++) {
+-				if (kallsyms_symbol_next(p_tmp, i) < 0)
++				if (WARN_ON(!kallsyms_symbol_next(p_tmp, i)))
+ 					break;
+ 				kdb_printf("%s ", p_tmp);
+ 				*(p_tmp + len) = '\0';
+diff --git a/kernel/jump_label.c b/kernel/jump_label.c
+index 0bf2e8f5244a..7c3774ac1d51 100644
+--- a/kernel/jump_label.c
++++ b/kernel/jump_label.c
+@@ -769,7 +769,7 @@ static __init int jump_label_test(void)
+ 
+ 	return 0;
+ }
+-late_initcall(jump_label_test);
++early_initcall(jump_label_test);
+ #endif /* STATIC_KEYS_SELFTEST */
+ 
+ #endif /* HAVE_JUMP_LABEL */
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index d9c31bc2eaea..56aca862c4f5 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -1822,7 +1822,7 @@ static struct ctl_table fs_table[] = {
+ 	{
+ 		.procname	= "pipe-max-size",
+ 		.data		= &pipe_max_size,
+-		.maxlen		= sizeof(int),
++		.maxlen		= sizeof(pipe_max_size),
+ 		.mode		= 0644,
+ 		.proc_handler	= &pipe_proc_fn,
+ 		.extra1		= &pipe_min_size,
+diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c
+index 1ef0cec38d78..dc14beae2c9a 100644
+--- a/lib/asn1_decoder.c
++++ b/lib/asn1_decoder.c
+@@ -313,42 +313,47 @@ int asn1_ber_decoder(const struct asn1_decoder *decoder,
+ 
+ 	/* Decide how to handle the operation */
+ 	switch (op) {
+-	case ASN1_OP_MATCH_ANY_ACT:
+-	case ASN1_OP_MATCH_ANY_ACT_OR_SKIP:
+-	case ASN1_OP_COND_MATCH_ANY_ACT:
+-	case ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP:
+-		ret = actions[machine[pc + 1]](context, hdr, tag, data + dp, len);
+-		if (ret < 0)
+-			return ret;
+-		goto skip_data;
+-
+-	case ASN1_OP_MATCH_ACT:
+-	case ASN1_OP_MATCH_ACT_OR_SKIP:
+-	case ASN1_OP_COND_MATCH_ACT_OR_SKIP:
+-		ret = actions[machine[pc + 2]](context, hdr, tag, data + dp, len);
+-		if (ret < 0)
+-			return ret;
+-		goto skip_data;
+-
+ 	case ASN1_OP_MATCH:
+ 	case ASN1_OP_MATCH_OR_SKIP:
++	case ASN1_OP_MATCH_ACT:
++	case ASN1_OP_MATCH_ACT_OR_SKIP:
+ 	case ASN1_OP_MATCH_ANY:
+ 	case ASN1_OP_MATCH_ANY_OR_SKIP:
++	case ASN1_OP_MATCH_ANY_ACT:
++	case ASN1_OP_MATCH_ANY_ACT_OR_SKIP:
+ 	case ASN1_OP_COND_MATCH_OR_SKIP:
++	case ASN1_OP_COND_MATCH_ACT_OR_SKIP:
+ 	case ASN1_OP_COND_MATCH_ANY:
+ 	case ASN1_OP_COND_MATCH_ANY_OR_SKIP:
+-	skip_data:
++	case ASN1_OP_COND_MATCH_ANY_ACT:
++	case ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP:
++
+ 		if (!(flags & FLAG_CONS)) {
+ 			if (flags & FLAG_INDEFINITE_LENGTH) {
++				size_t tmp = dp;
++
+ 				ret = asn1_find_indefinite_length(
+-					data, datalen, &dp, &len, &errmsg);
++					data, datalen, &tmp, &len, &errmsg);
+ 				if (ret < 0)
+ 					goto error;
+-			} else {
+-				dp += len;
+ 			}
+ 			pr_debug("- LEAF: %zu\n", len);
+ 		}
++
++		if (op & ASN1_OP_MATCH__ACT) {
++			unsigned char act;
++
++			if (op & ASN1_OP_MATCH__ANY)
++				act = machine[pc + 1];
++			else
++				act = machine[pc + 2];
++			ret = actions[act](context, hdr, tag, data + dp, len);
++			if (ret < 0)
++				return ret;
++		}
++
++		if (!(flags & FLAG_CONS))
++			dp += len;
+ 		pc += asn1_op_lengths[op];
+ 		goto next_op;
+ 
+@@ -434,6 +439,8 @@ int asn1_ber_decoder(const struct asn1_decoder *decoder,
+ 			else
+ 				act = machine[pc + 1];
+ 			ret = actions[act](context, hdr, 0, data + tdp, len);
++			if (ret < 0)
++				return ret;
+ 		}
+ 		pc += asn1_op_lengths[op];
+ 		goto next_op;
+diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
+index da796e2dc4f5..c7c96bc7654a 100644
+--- a/lib/dynamic_debug.c
++++ b/lib/dynamic_debug.c
+@@ -360,6 +360,10 @@ static int ddebug_parse_query(char *words[], int nwords,
+ 				if (parse_lineno(last, &query->last_lineno) < 0)
+ 					return -EINVAL;
+ 
++				/* special case for last lineno not specified */
++				if (query->last_lineno == 0)
++					query->last_lineno = UINT_MAX;
++
+ 				if (query->last_lineno < query->first_lineno) {
+ 					pr_err("last-line:%d < 1st-line:%d\n",
+ 						query->last_lineno,
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index 144fe6b1a03e..ca06adc4f445 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -194,7 +194,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy
+ 	chunk->phys_addr = phys;
+ 	chunk->start_addr = virt;
+ 	chunk->end_addr = virt + size - 1;
+-	atomic_set(&chunk->avail, size);
++	atomic_long_set(&chunk->avail, size);
+ 
+ 	spin_lock(&pool->lock);
+ 	list_add_rcu(&chunk->next_chunk, &pool->chunks);
+@@ -304,7 +304,7 @@ unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size,
+ 	nbits = (size + (1UL << order) - 1) >> order;
+ 	rcu_read_lock();
+ 	list_for_each_entry_rcu(chunk, &pool->chunks, next_chunk) {
+-		if (size > atomic_read(&chunk->avail))
++		if (size > atomic_long_read(&chunk->avail))
+ 			continue;
+ 
+ 		start_bit = 0;
+@@ -324,7 +324,7 @@ unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size,
+ 
+ 		addr = chunk->start_addr + ((unsigned long)start_bit << order);
+ 		size = nbits << order;
+-		atomic_sub(size, &chunk->avail);
++		atomic_long_sub(size, &chunk->avail);
+ 		break;
+ 	}
+ 	rcu_read_unlock();
+@@ -390,7 +390,7 @@ void gen_pool_free(struct gen_pool *pool, unsigned long addr, size_t size)
+ 			remain = bitmap_clear_ll(chunk->bits, start_bit, nbits);
+ 			BUG_ON(remain);
+ 			size = nbits << order;
+-			atomic_add(size, &chunk->avail);
++			atomic_long_add(size, &chunk->avail);
+ 			rcu_read_unlock();
+ 			return;
+ 		}
+@@ -464,7 +464,7 @@ size_t gen_pool_avail(struct gen_pool *pool)
+ 
+ 	rcu_read_lock();
+ 	list_for_each_entry_rcu(chunk, &pool->chunks, next_chunk)
+-		avail += atomic_read(&chunk->avail);
++		avail += atomic_long_read(&chunk->avail);
+ 	rcu_read_unlock();
+ 	return avail;
+ }
+diff --git a/mm/slub.c b/mm/slub.c
+index 1efbb8123037..8e1c027a30f4 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -5704,6 +5704,10 @@ static int sysfs_slab_add(struct kmem_cache *s)
+ 		return 0;
+ 	}
+ 
++	if (!unmergeable && disable_higher_order_debug &&
++			(slub_debug & DEBUG_METADATA_FLAGS))
++		unmergeable = 1;
++
+ 	if (unmergeable) {
+ 		/*
+ 		 * Slabcache can never be merged so we can use the name proper.
+diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
+index 7c38e850a8fc..685049a9048d 100644
+--- a/mm/zsmalloc.c
++++ b/mm/zsmalloc.c
+@@ -1349,7 +1349,7 @@ void *zs_map_object(struct zs_pool *pool, unsigned long handle,
+ 	 * pools/users, we can't allow mapping in interrupt context
+ 	 * because it can corrupt another users mappings.
+ 	 */
+-	WARN_ON_ONCE(in_interrupt());
++	BUG_ON(in_interrupt());
+ 
+ 	/* From now on, migration cannot move the object */
+ 	pin_tag(handle);
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 3d9f1c2f81c5..647cfc972bde 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -651,9 +651,12 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
+ 	struct fnhe_hash_bucket *hash;
+ 	struct fib_nh_exception *fnhe;
+ 	struct rtable *rt;
++	u32 genid, hval;
+ 	unsigned int i;
+ 	int depth;
+-	u32 hval = fnhe_hashfun(daddr);
++
++	genid = fnhe_genid(dev_net(nh->nh_dev));
++	hval = fnhe_hashfun(daddr);
+ 
+ 	spin_lock_bh(&fnhe_lock);
+ 
+@@ -676,12 +679,13 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
+ 	}
+ 
+ 	if (fnhe) {
++		if (fnhe->fnhe_genid != genid)
++			fnhe->fnhe_genid = genid;
+ 		if (gw)
+ 			fnhe->fnhe_gw = gw;
+-		if (pmtu) {
++		if (pmtu)
+ 			fnhe->fnhe_pmtu = pmtu;
+-			fnhe->fnhe_expires = max(1UL, expires);
+-		}
++		fnhe->fnhe_expires = max(1UL, expires);
+ 		/* Update all cached dsts too */
+ 		rt = rcu_dereference(fnhe->fnhe_rth_input);
+ 		if (rt)
+@@ -700,7 +704,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
+ 			fnhe->fnhe_next = hash->chain;
+ 			rcu_assign_pointer(hash->chain, fnhe);
+ 		}
+-		fnhe->fnhe_genid = fnhe_genid(dev_net(nh->nh_dev));
++		fnhe->fnhe_genid = genid;
+ 		fnhe->fnhe_daddr = daddr;
+ 		fnhe->fnhe_gw = gw;
+ 		fnhe->fnhe_pmtu = pmtu;
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 59c121b932ac..5d6bee070871 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -461,7 +461,7 @@ static int ip6gre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi)
+ 				      &ipv6h->saddr, &ipv6h->daddr, tpi->key,
+ 				      tpi->proto);
+ 	if (tunnel) {
+-		ip6_tnl_rcv(tunnel, skb, tpi, NULL, false);
++		ip6_tnl_rcv(tunnel, skb, tpi, NULL, log_ecn_error);
+ 
+ 		return PACKET_RCVD;
+ 	}
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 6f45d1713452..14c28fbfe6b8 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -83,8 +83,8 @@
+ /* Forward declarations for internal helper functions. */
+ static int sctp_writeable(struct sock *sk);
+ static void sctp_wfree(struct sk_buff *skb);
+-static int sctp_wait_for_sndbuf(struct sctp_association *, long *timeo_p,
+-				size_t msg_len);
++static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
++				size_t msg_len, struct sock **orig_sk);
+ static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);
+ static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);
+ static int sctp_wait_for_accept(struct sock *sk, long timeo);
+@@ -1962,9 +1962,16 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
+ 
+ 	timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
+ 	if (!sctp_wspace(asoc)) {
+-		err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);
+-		if (err)
++		/* sk can be changed by peel off when waiting for buf. */
++		err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len, &sk);
++		if (err) {
++			if (err == -ESRCH) {
++				/* asoc is already dead. */
++				new_asoc = NULL;
++				err = -EPIPE;
++			}
+ 			goto out_free;
++		}
+ 	}
+ 
+ 	/* If an address is passed with the sendto/sendmsg call, it is used
+@@ -4943,12 +4950,6 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp)
+ 	if (!asoc)
+ 		return -EINVAL;
+ 
+-	/* If there is a thread waiting on more sndbuf space for
+-	 * sending on this asoc, it cannot be peeled.
+-	 */
+-	if (waitqueue_active(&asoc->wait))
+-		return -EBUSY;
+-
+ 	/* An association cannot be branched off from an already peeled-off
+ 	 * socket, nor is this supported for tcp style sockets.
+ 	 */
+@@ -7822,7 +7823,7 @@ void sctp_sock_rfree(struct sk_buff *skb)
+ 
+ /* Helper function to wait for space in the sndbuf.  */
+ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
+-				size_t msg_len)
++				size_t msg_len, struct sock **orig_sk)
+ {
+ 	struct sock *sk = asoc->base.sk;
+ 	int err = 0;
+@@ -7839,10 +7840,11 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
+ 	for (;;) {
+ 		prepare_to_wait_exclusive(&asoc->wait, &wait,
+ 					  TASK_INTERRUPTIBLE);
++		if (asoc->base.dead)
++			goto do_dead;
+ 		if (!*timeo_p)
+ 			goto do_nonblock;
+-		if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING ||
+-		    asoc->base.dead)
++		if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING)
+ 			goto do_error;
+ 		if (signal_pending(current))
+ 			goto do_interrupted;
+@@ -7855,11 +7857,17 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
+ 		release_sock(sk);
+ 		current_timeo = schedule_timeout(current_timeo);
+ 		lock_sock(sk);
++		if (sk != asoc->base.sk) {
++			release_sock(sk);
++			sk = asoc->base.sk;
++			lock_sock(sk);
++		}
+ 
+ 		*timeo_p = current_timeo;
+ 	}
+ 
+ out:
++	*orig_sk = sk;
+ 	finish_wait(&asoc->wait, &wait);
+ 
+ 	/* Release the association's refcnt.  */
+@@ -7867,6 +7875,10 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
+ 
+ 	return err;
+ 
++do_dead:
++	err = -ESRCH;
++	goto out;
++
+ do_error:
+ 	err = -EPIPE;
+ 	goto out;
+diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
+index 413e3868fbf3..7166e7ecbe86 100644
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -571,7 +571,7 @@ static int __smc_buf_create(struct smc_sock *smc, bool is_rmb)
+ 		/* use socket send buffer size (w/o overhead) as start value */
+ 		sk_buf_size = smc->sk.sk_sndbuf / 2;
+ 
+-	for (bufsize_short = smc_compress_bufsize(smc->sk.sk_sndbuf / 2);
++	for (bufsize_short = smc_compress_bufsize(sk_buf_size);
+ 	     bufsize_short >= 0; bufsize_short--) {
+ 
+ 		if (is_rmb) {
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index 0cc83839c13c..f9db5fe52d36 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -274,10 +274,9 @@ static inline void rpc_task_set_debuginfo(struct rpc_task *task)
+ 
+ static void rpc_set_active(struct rpc_task *task)
+ {
+-	trace_rpc_task_begin(task->tk_client, task, NULL);
+-
+ 	rpc_task_set_debuginfo(task);
+ 	set_bit(RPC_TASK_ACTIVE, &task->tk_runstate);
++	trace_rpc_task_begin(task->tk_client, task, NULL);
+ }
+ 
+ /*
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 7d80040a37b6..f00383a37622 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -219,7 +219,7 @@ static int tls_do_encryption(struct tls_context *tls_ctx,
+ 	struct aead_request *aead_req;
+ 	int rc;
+ 
+-	aead_req = kmalloc(req_size, flags);
++	aead_req = kzalloc(req_size, flags);
+ 	if (!aead_req)
+ 		return -ENOMEM;
+ 
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 6eb228a70131..2a6093840e7e 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1306,6 +1306,7 @@ static struct xfrm_policy *clone_policy(const struct xfrm_policy *old, int dir)
+ 		newp->xfrm_nr = old->xfrm_nr;
+ 		newp->index = old->index;
+ 		newp->type = old->type;
++		newp->family = old->family;
+ 		memcpy(newp->xfrm_vec, old->xfrm_vec,
+ 		       newp->xfrm_nr*sizeof(struct xfrm_tmpl));
+ 		spin_lock_bh(&net->xfrm.xfrm_policy_lock);
+diff --git a/scripts/coccicheck b/scripts/coccicheck
+index 28ad1feff9e1..dda283aba96b 100755
+--- a/scripts/coccicheck
++++ b/scripts/coccicheck
+@@ -30,12 +30,6 @@ else
+ 	VERBOSE=0
+ fi
+ 
+-if [ -z "$J" ]; then
+-	NPROC=$(getconf _NPROCESSORS_ONLN)
+-else
+-	NPROC="$J"
+-fi
+-
+ FLAGS="--very-quiet"
+ 
+ # You can use SPFLAGS to append extra arguments to coccicheck or override any
+@@ -70,6 +64,9 @@ if [ "$C" = "1" -o "$C" = "2" ]; then
+     # Take only the last argument, which is the C file to test
+     shift $(( $# - 1 ))
+     OPTIONS="$COCCIINCLUDE $1"
++
++    # No need to parallelize Coccinelle since this mode takes one input file.
++    NPROC=1
+ else
+     ONLINE=0
+     if [ "$KBUILD_EXTMOD" = "" ] ; then
+@@ -77,6 +74,12 @@ else
+     else
+         OPTIONS="--dir $KBUILD_EXTMOD $COCCIINCLUDE"
+     fi
++
++    if [ -z "$J" ]; then
++        NPROC=$(getconf _NPROCESSORS_ONLN)
++    else
++        NPROC="$J"
++    fi
+ fi
+ 
+ if [ "$KBUILD_EXTMOD" != "" ] ; then
+diff --git a/scripts/package/Makefile b/scripts/package/Makefile
+index 73f9f3192b9f..34de8b953ecf 100644
+--- a/scripts/package/Makefile
++++ b/scripts/package/Makefile
+@@ -39,10 +39,9 @@ if test "$(objtree)" != "$(srctree)"; then \
+ 	false; \
+ fi ; \
+ $(srctree)/scripts/setlocalversion --save-scmversion; \
+-ln -sf $(srctree) $(2); \
+ tar -cz $(RCS_TAR_IGNORE) -f $(2).tar.gz \
+-	$(addprefix $(2)/,$(TAR_CONTENT) $(3)); \
+-rm -f $(2) $(objtree)/.scmversion
++	--transform 's:^:$(2)/:S' $(TAR_CONTENT) $(3); \
++rm -f $(objtree)/.scmversion
+ 
+ # rpm-pkg
+ # ---------------------------------------------------------------------------
+@@ -50,7 +49,7 @@ rpm-pkg rpm: FORCE
+ 	$(MAKE) clean
+ 	$(CONFIG_SHELL) $(MKSPEC) >$(objtree)/kernel.spec
+ 	$(call cmd,src_tar,$(KERNELPATH),kernel.spec)
+-	rpmbuild $(RPMOPTS) --target $(UTS_MACHINE) -ta $(KERNELPATH).tar.gz
++	+rpmbuild $(RPMOPTS) --target $(UTS_MACHINE) -ta $(KERNELPATH).tar.gz
+ 	rm $(KERNELPATH).tar.gz kernel.spec
+ 
+ # binrpm-pkg
+@@ -58,7 +57,7 @@ rpm-pkg rpm: FORCE
+ binrpm-pkg: FORCE
+ 	$(MAKE) KBUILD_SRC=
+ 	$(CONFIG_SHELL) $(MKSPEC) prebuilt > $(objtree)/binkernel.spec
+-	rpmbuild $(RPMOPTS) --define "_builddir $(objtree)" --target \
++	+rpmbuild $(RPMOPTS) --define "_builddir $(objtree)" --target \
+ 		$(UTS_MACHINE) -bb $(objtree)/binkernel.spec
+ 	rm binkernel.spec
+ 
+diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
+index 4243b0c3f0e4..586b249d3b46 100644
+--- a/security/apparmor/policy.c
++++ b/security/apparmor/policy.c
+@@ -502,7 +502,7 @@ struct aa_profile *aa_new_null_profile(struct aa_profile *parent, bool hat,
+ {
+ 	struct aa_profile *p, *profile;
+ 	const char *bname;
+-	char *name;
++	char *name = NULL;
+ 
+ 	AA_BUG(!parent);
+ 
+@@ -562,6 +562,7 @@ struct aa_profile *aa_new_null_profile(struct aa_profile *parent, bool hat,
+ 	return profile;
+ 
+ fail:
++	kfree(name);
+ 	aa_free_profile(profile);
+ 	return NULL;
+ }
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index 76d22f726ae4..1ffe60bb2845 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -1588,9 +1588,8 @@ long keyctl_session_to_parent(void)
+  * The caller must have Setattr permission to change keyring restrictions.
+  *
+  * The requested type name may be a NULL pointer to reject all attempts
+- * to link to the keyring. If _type is non-NULL, _restriction can be
+- * NULL or a pointer to a string describing the restriction. If _type is
+- * NULL, _restriction must also be NULL.
++ * to link to the keyring.  In this case, _restriction must also be NULL.
++ * Otherwise, both _type and _restriction must be non-NULL.
+  *
+  * Returns 0 if successful.
+  */
+@@ -1598,7 +1597,6 @@ long keyctl_restrict_keyring(key_serial_t id, const char __user *_type,
+ 			     const char __user *_restriction)
+ {
+ 	key_ref_t key_ref;
+-	bool link_reject = !_type;
+ 	char type[32];
+ 	char *restriction = NULL;
+ 	long ret;
+@@ -1607,31 +1605,29 @@ long keyctl_restrict_keyring(key_serial_t id, const char __user *_type,
+ 	if (IS_ERR(key_ref))
+ 		return PTR_ERR(key_ref);
+ 
++	ret = -EINVAL;
+ 	if (_type) {
+-		ret = key_get_type_from_user(type, _type, sizeof(type));
+-		if (ret < 0)
++		if (!_restriction)
+ 			goto error;
+-	}
+ 
+-	if (_restriction) {
+-		if (!_type) {
+-			ret = -EINVAL;
++		ret = key_get_type_from_user(type, _type, sizeof(type));
++		if (ret < 0)
+ 			goto error;
+-		}
+ 
+ 		restriction = strndup_user(_restriction, PAGE_SIZE);
+ 		if (IS_ERR(restriction)) {
+ 			ret = PTR_ERR(restriction);
+ 			goto error;
+ 		}
++	} else {
++		if (_restriction)
++			goto error;
+ 	}
+ 
+-	ret = keyring_restrict(key_ref, link_reject ? NULL : type, restriction);
++	ret = keyring_restrict(key_ref, _type ? type : NULL, restriction);
+ 	kfree(restriction);
+-
+ error:
+ 	key_ref_put(key_ref);
+-
+ 	return ret;
+ }
+ 
+diff --git a/security/keys/request_key.c b/security/keys/request_key.c
+index e8036cd0ad54..7dc741382154 100644
+--- a/security/keys/request_key.c
++++ b/security/keys/request_key.c
+@@ -251,11 +251,12 @@ static int construct_key(struct key *key, const void *callout_info,
+  * The keyring selected is returned with an extra reference upon it which the
+  * caller must release.
+  */
+-static void construct_get_dest_keyring(struct key **_dest_keyring)
++static int construct_get_dest_keyring(struct key **_dest_keyring)
+ {
+ 	struct request_key_auth *rka;
+ 	const struct cred *cred = current_cred();
+ 	struct key *dest_keyring = *_dest_keyring, *authkey;
++	int ret;
+ 
+ 	kenter("%p", dest_keyring);
+ 
+@@ -264,6 +265,8 @@ static void construct_get_dest_keyring(struct key **_dest_keyring)
+ 		/* the caller supplied one */
+ 		key_get(dest_keyring);
+ 	} else {
++		bool do_perm_check = true;
++
+ 		/* use a default keyring; falling through the cases until we
+ 		 * find one that we actually have */
+ 		switch (cred->jit_keyring) {
+@@ -278,8 +281,10 @@ static void construct_get_dest_keyring(struct key **_dest_keyring)
+ 					dest_keyring =
+ 						key_get(rka->dest_keyring);
+ 				up_read(&authkey->sem);
+-				if (dest_keyring)
++				if (dest_keyring) {
++					do_perm_check = false;
+ 					break;
++				}
+ 			}
+ 
+ 		case KEY_REQKEY_DEFL_THREAD_KEYRING:
+@@ -314,11 +319,29 @@ static void construct_get_dest_keyring(struct key **_dest_keyring)
+ 		default:
+ 			BUG();
+ 		}
++
++		/*
++		 * Require Write permission on the keyring.  This is essential
++		 * because the default keyring may be the session keyring, and
++		 * joining a keyring only requires Search permission.
++		 *
++		 * However, this check is skipped for the "requestor keyring" so
++		 * that /sbin/request-key can itself use request_key() to add
++		 * keys to the original requestor's destination keyring.
++		 */
++		if (dest_keyring && do_perm_check) {
++			ret = key_permission(make_key_ref(dest_keyring, 1),
++					     KEY_NEED_WRITE);
++			if (ret) {
++				key_put(dest_keyring);
++				return ret;
++			}
++		}
+ 	}
+ 
+ 	*_dest_keyring = dest_keyring;
+ 	kleave(" [dk %d]", key_serial(dest_keyring));
+-	return;
++	return 0;
+ }
+ 
+ /*
+@@ -444,11 +467,15 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
+ 	if (ctx->index_key.type == &key_type_keyring)
+ 		return ERR_PTR(-EPERM);
+ 
+-	user = key_user_lookup(current_fsuid());
+-	if (!user)
+-		return ERR_PTR(-ENOMEM);
++	ret = construct_get_dest_keyring(&dest_keyring);
++	if (ret)
++		goto error;
+ 
+-	construct_get_dest_keyring(&dest_keyring);
++	user = key_user_lookup(current_fsuid());
++	if (!user) {
++		ret = -ENOMEM;
++		goto error_put_dest_keyring;
++	}
+ 
+ 	ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key);
+ 	key_user_put(user);
+@@ -463,7 +490,7 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
+ 	} else if (ret == -EINPROGRESS) {
+ 		ret = 0;
+ 	} else {
+-		goto couldnt_alloc_key;
++		goto error_put_dest_keyring;
+ 	}
+ 
+ 	key_put(dest_keyring);
+@@ -473,8 +500,9 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
+ construction_failed:
+ 	key_negate_and_link(key, key_negative_timeout, NULL, NULL);
+ 	key_put(key);
+-couldnt_alloc_key:
++error_put_dest_keyring:
+ 	key_put(dest_keyring);
++error:
+ 	kleave(" = %d", ret);
+ 	return ERR_PTR(ret);
+ }
+diff --git a/sound/core/pcm.c b/sound/core/pcm.c
+index 7eadb7fd8074..7fea724d093a 100644
+--- a/sound/core/pcm.c
++++ b/sound/core/pcm.c
+@@ -153,7 +153,9 @@ static int snd_pcm_control_ioctl(struct snd_card *card,
+ 				err = -ENXIO;
+ 				goto _error;
+ 			}
++			mutex_lock(&pcm->open_mutex);
+ 			err = snd_pcm_info_user(substream, info);
++			mutex_unlock(&pcm->open_mutex);
+ 		_error:
+ 			mutex_unlock(&register_mutex);
+ 			return err;
+diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
+index 37d9cfbc29f9..b80985fbc334 100644
+--- a/sound/core/seq/seq_timer.c
++++ b/sound/core/seq/seq_timer.c
+@@ -355,7 +355,7 @@ static int initialize_timer(struct snd_seq_timer *tmr)
+ 	unsigned long freq;
+ 
+ 	t = tmr->timeri->timer;
+-	if (snd_BUG_ON(!t))
++	if (!t)
+ 		return -EINVAL;
+ 
+ 	freq = tmr->preferred_resolution;
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 7c39114d124f..b076386c8952 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -330,6 +330,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ 	case 0x10ec0236:
+ 	case 0x10ec0255:
+ 	case 0x10ec0256:
++	case 0x10ec0257:
+ 	case 0x10ec0282:
+ 	case 0x10ec0283:
+ 	case 0x10ec0286:
+@@ -2749,6 +2750,7 @@ enum {
+ 	ALC269_TYPE_ALC298,
+ 	ALC269_TYPE_ALC255,
+ 	ALC269_TYPE_ALC256,
++	ALC269_TYPE_ALC257,
+ 	ALC269_TYPE_ALC215,
+ 	ALC269_TYPE_ALC225,
+ 	ALC269_TYPE_ALC294,
+@@ -2782,6 +2784,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
+ 	case ALC269_TYPE_ALC298:
+ 	case ALC269_TYPE_ALC255:
+ 	case ALC269_TYPE_ALC256:
++	case ALC269_TYPE_ALC257:
+ 	case ALC269_TYPE_ALC215:
+ 	case ALC269_TYPE_ALC225:
+ 	case ALC269_TYPE_ALC294:
+@@ -6839,6 +6842,10 @@ static int patch_alc269(struct hda_codec *codec)
+ 		spec->gen.mixer_nid = 0; /* ALC256 does not have any loopback mixer path */
+ 		alc_update_coef_idx(codec, 0x36, 1 << 13, 1 << 5); /* Switch pcbeep path to Line in path*/
+ 		break;
++	case 0x10ec0257:
++		spec->codec_variant = ALC269_TYPE_ALC257;
++		spec->gen.mixer_nid = 0;
++		break;
+ 	case 0x10ec0215:
+ 	case 0x10ec0285:
+ 	case 0x10ec0289:
+@@ -7886,6 +7893,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
+ 	HDA_CODEC_ENTRY(0x10ec0236, "ALC236", patch_alc269),
+ 	HDA_CODEC_ENTRY(0x10ec0255, "ALC255", patch_alc269),
+ 	HDA_CODEC_ENTRY(0x10ec0256, "ALC256", patch_alc269),
++	HDA_CODEC_ENTRY(0x10ec0257, "ALC257", patch_alc269),
+ 	HDA_CODEC_ENTRY(0x10ec0260, "ALC260", patch_alc260),
+ 	HDA_CODEC_ENTRY(0x10ec0262, "ALC262", patch_alc262),
+ 	HDA_CODEC_ENTRY(0x10ec0267, "ALC267", patch_alc268),
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 2b835cca41b1..4fde4f8d4444 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -204,6 +204,10 @@ static int snd_usb_copy_string_desc(struct mixer_build *state,
+ 				    int index, char *buf, int maxlen)
+ {
+ 	int len = usb_string(state->chip->dev, index, buf, maxlen - 1);
++
++	if (len < 0)
++		return 0;
++
+ 	buf[len] = 0;
+ 	return len;
+ }
+@@ -2174,13 +2178,14 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
+ 	if (len)
+ 		;
+ 	else if (nameid)
+-		snd_usb_copy_string_desc(state, nameid, kctl->id.name,
++		len = snd_usb_copy_string_desc(state, nameid, kctl->id.name,
+ 					 sizeof(kctl->id.name));
+-	else {
++	else
+ 		len = get_term_name(state, &state->oterm,
+ 				    kctl->id.name, sizeof(kctl->id.name), 0);
+-		if (!len)
+-			strlcpy(kctl->id.name, "USB", sizeof(kctl->id.name));
++
++	if (!len) {
++		strlcpy(kctl->id.name, "USB", sizeof(kctl->id.name));
+ 
+ 		if (desc->bDescriptorSubtype == UAC2_CLOCK_SELECTOR)
+ 			append_ctl_name(kctl, " Clock Source");
+diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
+index eaa3bec273c8..4c99c57736ce 100644
+--- a/tools/hv/hv_kvp_daemon.c
++++ b/tools/hv/hv_kvp_daemon.c
+@@ -193,11 +193,14 @@ static void kvp_update_mem_state(int pool)
+ 	for (;;) {
+ 		readp = &record[records_read];
+ 		records_read += fread(readp, sizeof(struct kvp_record),
+-					ENTRIES_PER_BLOCK * num_blocks,
+-					filep);
++				ENTRIES_PER_BLOCK * num_blocks - records_read,
++				filep);
+ 
+ 		if (ferror(filep)) {
+-			syslog(LOG_ERR, "Failed to read file, pool: %d", pool);
++			syslog(LOG_ERR,
++				"Failed to read file, pool: %d; error: %d %s",
++				 pool, errno, strerror(errno));
++			kvp_release_lock(pool);
+ 			exit(EXIT_FAILURE);
+ 		}
+ 
+@@ -210,6 +213,7 @@ static void kvp_update_mem_state(int pool)
+ 
+ 			if (record == NULL) {
+ 				syslog(LOG_ERR, "malloc failed");
++				kvp_release_lock(pool);
+ 				exit(EXIT_FAILURE);
+ 			}
+ 			continue;
+@@ -224,15 +228,11 @@ static void kvp_update_mem_state(int pool)
+ 	fclose(filep);
+ 	kvp_release_lock(pool);
+ }
++
+ static int kvp_file_init(void)
+ {
+ 	int  fd;
+-	FILE *filep;
+-	size_t records_read;
+ 	char *fname;
+-	struct kvp_record *record;
+-	struct kvp_record *readp;
+-	int num_blocks;
+ 	int i;
+ 	int alloc_unit = sizeof(struct kvp_record) * ENTRIES_PER_BLOCK;
+ 
+@@ -246,61 +246,19 @@ static int kvp_file_init(void)
+ 
+ 	for (i = 0; i < KVP_POOL_COUNT; i++) {
+ 		fname = kvp_file_info[i].fname;
+-		records_read = 0;
+-		num_blocks = 1;
+ 		sprintf(fname, "%s/.kvp_pool_%d", KVP_CONFIG_LOC, i);
+ 		fd = open(fname, O_RDWR | O_CREAT | O_CLOEXEC, 0644 /* rw-r--r-- */);
+ 
+ 		if (fd == -1)
+ 			return 1;
+ 
+-
+-		filep = fopen(fname, "re");
+-		if (!filep) {
+-			close(fd);
+-			return 1;
+-		}
+-
+-		record = malloc(alloc_unit * num_blocks);
+-		if (record == NULL) {
+-			fclose(filep);
+-			close(fd);
+-			return 1;
+-		}
+-		for (;;) {
+-			readp = &record[records_read];
+-			records_read += fread(readp, sizeof(struct kvp_record),
+-					ENTRIES_PER_BLOCK,
+-					filep);
+-
+-			if (ferror(filep)) {
+-				syslog(LOG_ERR, "Failed to read file, pool: %d",
+-				       i);
+-				exit(EXIT_FAILURE);
+-			}
+-
+-			if (!feof(filep)) {
+-				/*
+-				 * We have more data to read.
+-				 */
+-				num_blocks++;
+-				record = realloc(record, alloc_unit *
+-						num_blocks);
+-				if (record == NULL) {
+-					fclose(filep);
+-					close(fd);
+-					return 1;
+-				}
+-				continue;
+-			}
+-			break;
+-		}
+ 		kvp_file_info[i].fd = fd;
+-		kvp_file_info[i].num_blocks = num_blocks;
+-		kvp_file_info[i].records = record;
+-		kvp_file_info[i].num_records = records_read;
+-		fclose(filep);
+-
++		kvp_file_info[i].num_blocks = 1;
++		kvp_file_info[i].records = malloc(alloc_unit);
++		if (kvp_file_info[i].records == NULL)
++			return 1;
++		kvp_file_info[i].num_records = 0;
++		kvp_update_mem_state(i);
+ 	}
+ 
+ 	return 0;
+diff --git a/tools/testing/selftests/x86/mpx-hw.h b/tools/testing/selftests/x86/mpx-hw.h
+index 3f0093911f03..d1b61ab870f8 100644
+--- a/tools/testing/selftests/x86/mpx-hw.h
++++ b/tools/testing/selftests/x86/mpx-hw.h
+@@ -52,14 +52,14 @@
+ struct mpx_bd_entry {
+ 	union {
+ 		char x[MPX_BOUNDS_DIR_ENTRY_SIZE_BYTES];
+-		void *contents[1];
++		void *contents[0];
+ 	};
+ } __attribute__((packed));
+ 
+ struct mpx_bt_entry {
+ 	union {
+ 		char x[MPX_BOUNDS_TABLE_ENTRY_SIZE_BYTES];
+-		unsigned long contents[1];
++		unsigned long contents[0];
+ 	};
+ } __attribute__((packed));
+ 
+diff --git a/virt/kvm/arm/hyp/vgic-v2-sr.c b/virt/kvm/arm/hyp/vgic-v2-sr.c
+index a3f18d362366..d7fd46fe9efb 100644
+--- a/virt/kvm/arm/hyp/vgic-v2-sr.c
++++ b/virt/kvm/arm/hyp/vgic-v2-sr.c
+@@ -34,11 +34,7 @@ static void __hyp_text save_elrsr(struct kvm_vcpu *vcpu, void __iomem *base)
+ 	else
+ 		elrsr1 = 0;
+ 
+-#ifdef CONFIG_CPU_BIG_ENDIAN
+-	cpu_if->vgic_elrsr = ((u64)elrsr0 << 32) | elrsr1;
+-#else
+ 	cpu_if->vgic_elrsr = ((u64)elrsr1 << 32) | elrsr0;
+-#endif
+ }
+ 
+ static void __hyp_text save_lrs(struct kvm_vcpu *vcpu, void __iomem *base)
+diff --git a/virt/kvm/arm/vgic/vgic-irqfd.c b/virt/kvm/arm/vgic/vgic-irqfd.c
+index b7baf581611a..99e026d2dade 100644
+--- a/virt/kvm/arm/vgic/vgic-irqfd.c
++++ b/virt/kvm/arm/vgic/vgic-irqfd.c
+@@ -112,8 +112,7 @@ int kvm_vgic_setup_default_irq_routing(struct kvm *kvm)
+ 	u32 nr = dist->nr_spis;
+ 	int i, ret;
+ 
+-	entries = kcalloc(nr, sizeof(struct kvm_kernel_irq_routing_entry),
+-			  GFP_KERNEL);
++	entries = kcalloc(nr, sizeof(*entries), GFP_KERNEL);
+ 	if (!entries)
+ 		return -ENOMEM;
+ 
+diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
+index 547f12dc4d54..3108e07526af 100644
+--- a/virt/kvm/arm/vgic/vgic-its.c
++++ b/virt/kvm/arm/vgic/vgic-its.c
+@@ -775,6 +775,8 @@ static int vgic_its_alloc_collection(struct vgic_its *its,
+ 		return E_ITS_MAPC_COLLECTION_OOR;
+ 
+ 	collection = kzalloc(sizeof(*collection), GFP_KERNEL);
++	if (!collection)
++		return -ENOMEM;
+ 
+ 	collection->collection_id = coll_id;
+ 	collection->target_addr = COLLECTION_NOT_MAPPED;
+diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
+index 96ea597db0e7..502f2100e7bf 100644
+--- a/virt/kvm/arm/vgic/vgic-v3.c
++++ b/virt/kvm/arm/vgic/vgic-v3.c
+@@ -324,13 +324,13 @@ int vgic_v3_save_pending_tables(struct kvm *kvm)
+ 	int last_byte_offset = -1;
+ 	struct vgic_irq *irq;
+ 	int ret;
++	u8 val;
+ 
+ 	list_for_each_entry(irq, &dist->lpi_list_head, lpi_list) {
+ 		int byte_offset, bit_nr;
+ 		struct kvm_vcpu *vcpu;
+ 		gpa_t pendbase, ptr;
+ 		bool stored;
+-		u8 val;
+ 
+ 		vcpu = irq->target_vcpu;
+ 		if (!vcpu)
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 9deb5a245b83..484e8820c382 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -136,6 +136,11 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm);
+ static unsigned long long kvm_createvm_count;
+ static unsigned long long kvm_active_vms;
+ 
++__weak void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
++		unsigned long start, unsigned long end)
++{
++}
++
+ bool kvm_is_reserved_pfn(kvm_pfn_t pfn)
+ {
+ 	if (pfn_valid(pfn))
+@@ -361,6 +366,9 @@ static void kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn,
+ 		kvm_flush_remote_tlbs(kvm);
+ 
+ 	spin_unlock(&kvm->mmu_lock);
++
++	kvm_arch_mmu_notifier_invalidate_range(kvm, start, end);
++
+ 	srcu_read_unlock(&kvm->srcu, idx);
+ }
+