[gentoo-commits] proj/linux-patches:5.3 commit in: /

[Mike Pagano]

commit:     b5c397963982ec8b83950f7e9a2ed6c989fa8678
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 29 12:05:50 2019 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Oct 29 12:05:50 2019 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b5c39796

Linux patch 5.3.8

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README            |    4 +
 1007_linux-5.3.8.patch | 7745 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 7749 insertions(+)

diff --git a/0000_README b/0000_README
index e15ba25..bc9694a 100644
--- a/0000_README
+++ b/0000_README
@@ -71,6 +71,10 @@ Patch:  1006_linux-5.3.7.patch
 From:   http://www.kernel.org
 Desc:   Linux 5.3.7
 
+Patch:  1007_linux-5.3.8.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.3.8
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1007_linux-5.3.8.patch b/1007_linux-5.3.8.patch
new file mode 100644
index 0000000..8323ef7
--- /dev/null
+++ b/1007_linux-5.3.8.patch
@@ -0,0 +1,7745 @@
+diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst
+index 3e57d09246e6..6e52d334bc55 100644
+--- a/Documentation/arm64/silicon-errata.rst
++++ b/Documentation/arm64/silicon-errata.rst
+@@ -107,6 +107,8 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | Cavium         | ThunderX2 SMMUv3| #126            | N/A                         |
+ +----------------+-----------------+-----------------+-----------------------------+
++| Cavium         | ThunderX2 Core  | #219            | CAVIUM_TX2_ERRATUM_219      |
+++----------------+-----------------+-----------------+-----------------------------+
+ +----------------+-----------------+-----------------+-----------------------------+
+ | Freescale/NXP  | LS2080A/LS1043A | A-008585        | FSL_ERRATUM_A008585         |
+ +----------------+-----------------+-----------------+-----------------------------+
+diff --git a/Makefile b/Makefile
+index 7a3e659c79ae..445f9488d8ba 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 3
+-SUBLEVEL = 7
++SUBLEVEL = 8
+ EXTRAVERSION =
+ NAME = Bobtail Squid
+ 
+diff --git a/arch/arm/boot/dts/am335x-icev2.dts b/arch/arm/boot/dts/am335x-icev2.dts
+index 18f70b35da4c..204bccfcc110 100644
+--- a/arch/arm/boot/dts/am335x-icev2.dts
++++ b/arch/arm/boot/dts/am335x-icev2.dts
+@@ -432,7 +432,7 @@
+ 	pinctrl-0 = <&mmc0_pins_default>;
+ };
+ 
+-&gpio0 {
++&gpio0_target {
+ 	/* Do not idle the GPIO used for holding the VTT regulator */
+ 	ti,no-reset-on-init;
+ 	ti,no-idle-on-init;
+diff --git a/arch/arm/boot/dts/am33xx-l4.dtsi b/arch/arm/boot/dts/am33xx-l4.dtsi
+index 46849d6ecb3e..3287cf695b5a 100644
+--- a/arch/arm/boot/dts/am33xx-l4.dtsi
++++ b/arch/arm/boot/dts/am33xx-l4.dtsi
+@@ -127,7 +127,7 @@
+ 			ranges = <0x0 0x5000 0x1000>;
+ 		};
+ 
+-		target-module@7000 {			/* 0x44e07000, ap 14 20.0 */
++		gpio0_target: target-module@7000 {	/* 0x44e07000, ap 14 20.0 */
+ 			compatible = "ti,sysc-omap2", "ti,sysc";
+ 			ti,hwmods = "gpio1";
+ 			reg = <0x7000 0x4>,
+@@ -2038,7 +2038,9 @@
+ 			reg = <0xe000 0x4>,
+ 			      <0xe054 0x4>;
+ 			reg-names = "rev", "sysc";
+-			ti,sysc-midle ;
++			ti,sysc-midle = <SYSC_IDLE_FORCE>,
++					<SYSC_IDLE_NO>,
++					<SYSC_IDLE_SMART>;
+ 			ti,sysc-sidle = <SYSC_IDLE_FORCE>,
+ 					<SYSC_IDLE_NO>,
+ 					<SYSC_IDLE_SMART>;
+diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi
+index 848e2a8884e2..14bbc438055f 100644
+--- a/arch/arm/boot/dts/am4372.dtsi
++++ b/arch/arm/boot/dts/am4372.dtsi
+@@ -337,6 +337,8 @@
+ 				ti,hwmods = "dss_dispc";
+ 				clocks = <&disp_clk>;
+ 				clock-names = "fck";
++
++				max-memory-bandwidth = <230000000>;
+ 			};
+ 
+ 			rfbi: rfbi@4832a800 {
+diff --git a/arch/arm/boot/dts/dra7-l4.dtsi b/arch/arm/boot/dts/dra7-l4.dtsi
+index 21e5914fdd62..099d6fe2a57a 100644
+--- a/arch/arm/boot/dts/dra7-l4.dtsi
++++ b/arch/arm/boot/dts/dra7-l4.dtsi
+@@ -2762,7 +2762,7 @@
+ 				interrupt-names = "tx", "rx";
+ 				dmas = <&edma_xbar 129 1>, <&edma_xbar 128 1>;
+ 				dma-names = "tx", "rx";
+-				clocks = <&ipu_clkctrl DRA7_IPU_MCASP1_CLKCTRL 22>,
++				clocks = <&ipu_clkctrl DRA7_IPU_MCASP1_CLKCTRL 0>,
+ 					 <&ipu_clkctrl DRA7_IPU_MCASP1_CLKCTRL 24>,
+ 					 <&ipu_clkctrl DRA7_IPU_MCASP1_CLKCTRL 28>;
+ 				clock-names = "fck", "ahclkx", "ahclkr";
+@@ -2799,8 +2799,8 @@
+ 				interrupt-names = "tx", "rx";
+ 				dmas = <&edma_xbar 131 1>, <&edma_xbar 130 1>;
+ 				dma-names = "tx", "rx";
+-				clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP2_CLKCTRL 22>,
+-					 <&l4per2_clkctrl DRA7_L4PER2_MCASP2_CLKCTRL 24>,
++				clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP2_CLKCTRL 0>,
++					 <&ipu_clkctrl DRA7_IPU_MCASP1_CLKCTRL 24>,
+ 					 <&l4per2_clkctrl DRA7_L4PER2_MCASP2_CLKCTRL 28>;
+ 				clock-names = "fck", "ahclkx", "ahclkr";
+ 				status = "disabled";
+@@ -2818,9 +2818,8 @@
+ 					<SYSC_IDLE_SMART>;
+ 			/* Domains (P, C): l4per_pwrdm, l4per2_clkdm */
+ 			clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 0>,
+-				 <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 24>,
+-				 <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 28>;
+-			clock-names = "fck", "ahclkx", "ahclkr";
++				 <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 24>;
++			clock-names = "fck", "ahclkx";
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
+ 			ranges = <0x0 0x68000 0x2000>,
+@@ -2836,7 +2835,7 @@
+ 				interrupt-names = "tx", "rx";
+ 				dmas = <&edma_xbar 133 1>, <&edma_xbar 132 1>;
+ 				dma-names = "tx", "rx";
+-				clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 22>,
++				clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 0>,
+ 					 <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 24>;
+ 				clock-names = "fck", "ahclkx";
+ 				status = "disabled";
+@@ -2854,9 +2853,8 @@
+ 					<SYSC_IDLE_SMART>;
+ 			/* Domains (P, C): l4per_pwrdm, l4per2_clkdm */
+ 			clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 0>,
+-				 <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 24>,
+-				 <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 28>;
+-			clock-names = "fck", "ahclkx", "ahclkr";
++				 <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 24>;
++			clock-names = "fck", "ahclkx";
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
+ 			ranges = <0x0 0x6c000 0x2000>,
+@@ -2872,7 +2870,7 @@
+ 				interrupt-names = "tx", "rx";
+ 				dmas = <&edma_xbar 135 1>, <&edma_xbar 134 1>;
+ 				dma-names = "tx", "rx";
+-				clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 22>,
++				clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 0>,
+ 					 <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 24>;
+ 				clock-names = "fck", "ahclkx";
+ 				status = "disabled";
+@@ -2890,9 +2888,8 @@
+ 					<SYSC_IDLE_SMART>;
+ 			/* Domains (P, C): l4per_pwrdm, l4per2_clkdm */
+ 			clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 0>,
+-				 <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 24>,
+-				 <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 28>;
+-			clock-names = "fck", "ahclkx", "ahclkr";
++				 <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 24>;
++			clock-names = "fck", "ahclkx";
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
+ 			ranges = <0x0 0x70000 0x2000>,
+@@ -2908,7 +2905,7 @@
+ 				interrupt-names = "tx", "rx";
+ 				dmas = <&edma_xbar 137 1>, <&edma_xbar 136 1>;
+ 				dma-names = "tx", "rx";
+-				clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 22>,
++				clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 0>,
+ 					 <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 24>;
+ 				clock-names = "fck", "ahclkx";
+ 				status = "disabled";
+@@ -2926,9 +2923,8 @@
+ 					<SYSC_IDLE_SMART>;
+ 			/* Domains (P, C): l4per_pwrdm, l4per2_clkdm */
+ 			clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 0>,
+-				 <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 24>,
+-				 <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 28>;
+-			clock-names = "fck", "ahclkx", "ahclkr";
++				 <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 24>;
++			clock-names = "fck", "ahclkx";
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
+ 			ranges = <0x0 0x74000 0x2000>,
+@@ -2944,7 +2940,7 @@
+ 				interrupt-names = "tx", "rx";
+ 				dmas = <&edma_xbar 139 1>, <&edma_xbar 138 1>;
+ 				dma-names = "tx", "rx";
+-				clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 22>,
++				clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 0>,
+ 					 <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 24>;
+ 				clock-names = "fck", "ahclkx";
+ 				status = "disabled";
+@@ -2962,9 +2958,8 @@
+ 					<SYSC_IDLE_SMART>;
+ 			/* Domains (P, C): l4per_pwrdm, l4per2_clkdm */
+ 			clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 0>,
+-				 <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 24>,
+-				 <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 28>;
+-			clock-names = "fck", "ahclkx", "ahclkr";
++				 <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 24>;
++			clock-names = "fck", "ahclkx";
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
+ 			ranges = <0x0 0x78000 0x2000>,
+@@ -2980,7 +2975,7 @@
+ 				interrupt-names = "tx", "rx";
+ 				dmas = <&edma_xbar 141 1>, <&edma_xbar 140 1>;
+ 				dma-names = "tx", "rx";
+-				clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 22>,
++				clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 0>,
+ 					 <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 24>;
+ 				clock-names = "fck", "ahclkx";
+ 				status = "disabled";
+@@ -2998,9 +2993,8 @@
+ 					<SYSC_IDLE_SMART>;
+ 			/* Domains (P, C): l4per_pwrdm, l4per2_clkdm */
+ 			clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 0>,
+-				 <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 24>,
+-				 <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 28>;
+-			clock-names = "fck", "ahclkx", "ahclkr";
++				 <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 24>;
++			clock-names = "fck", "ahclkx";
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
+ 			ranges = <0x0 0x7c000 0x2000>,
+@@ -3016,7 +3010,7 @@
+ 				interrupt-names = "tx", "rx";
+ 				dmas = <&edma_xbar 143 1>, <&edma_xbar 142 1>;
+ 				dma-names = "tx", "rx";
+-				clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 22>,
++				clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 0>,
+ 					 <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 24>;
+ 				clock-names = "fck", "ahclkx";
+ 				status = "disabled";
+diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
+index adb6271f819b..7773876d165f 100644
+--- a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
++++ b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
+@@ -811,7 +811,8 @@ static struct omap_hwmod_class_sysconfig am33xx_timer_sysc = {
+ 	.rev_offs	= 0x0000,
+ 	.sysc_offs	= 0x0010,
+ 	.syss_offs	= 0x0014,
+-	.sysc_flags	= (SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET),
++	.sysc_flags	= SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET |
++			  SYSC_HAS_RESET_STATUS,
+ 	.idlemodes	= (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART |
+ 			  SIDLE_SMART_WKUP),
+ 	.sysc_fields	= &omap_hwmod_sysc_type2,
+diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_data.c
+index c965af275e34..81d9912f17c8 100644
+--- a/arch/arm/mach-omap2/omap_hwmod_33xx_data.c
++++ b/arch/arm/mach-omap2/omap_hwmod_33xx_data.c
+@@ -231,8 +231,9 @@ static struct omap_hwmod am33xx_control_hwmod = {
+ static struct omap_hwmod_class_sysconfig lcdc_sysc = {
+ 	.rev_offs	= 0x0,
+ 	.sysc_offs	= 0x54,
+-	.sysc_flags	= (SYSC_HAS_SIDLEMODE | SYSC_HAS_MIDLEMODE),
+-	.idlemodes	= (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART),
++	.sysc_flags	= SYSC_HAS_SIDLEMODE | SYSC_HAS_MIDLEMODE,
++	.idlemodes	= SIDLE_FORCE | SIDLE_NO | SIDLE_SMART |
++			  MSTANDBY_FORCE | MSTANDBY_NO | MSTANDBY_SMART,
+ 	.sysc_fields	= &omap_hwmod_sysc_type2,
+ };
+ 
+diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
+index 1fde1bf53fb6..7ac9af56762d 100644
+--- a/arch/arm/mach-omap2/pm.c
++++ b/arch/arm/mach-omap2/pm.c
+@@ -74,83 +74,6 @@ int omap_pm_clkdms_setup(struct clockdomain *clkdm, void *unused)
+ 	return 0;
+ }
+ 
+-/*
+- * This API is to be called during init to set the various voltage
+- * domains to the voltage as per the opp table. Typically we boot up
+- * at the nominal voltage. So this function finds out the rate of
+- * the clock associated with the voltage domain, finds out the correct
+- * opp entry and sets the voltage domain to the voltage specified
+- * in the opp entry
+- */
+-static int __init omap2_set_init_voltage(char *vdd_name, char *clk_name,
+-					 const char *oh_name)
+-{
+-	struct voltagedomain *voltdm;
+-	struct clk *clk;
+-	struct dev_pm_opp *opp;
+-	unsigned long freq, bootup_volt;
+-	struct device *dev;
+-
+-	if (!vdd_name || !clk_name || !oh_name) {
+-		pr_err("%s: invalid parameters\n", __func__);
+-		goto exit;
+-	}
+-
+-	if (!strncmp(oh_name, "mpu", 3))
+-		/* 
+-		 * All current OMAPs share voltage rail and clock
+-		 * source, so CPU0 is used to represent the MPU-SS.
+-		 */
+-		dev = get_cpu_device(0);
+-	else
+-		dev = omap_device_get_by_hwmod_name(oh_name);
+-
+-	if (IS_ERR(dev)) {
+-		pr_err("%s: Unable to get dev pointer for hwmod %s\n",
+-			__func__, oh_name);
+-		goto exit;
+-	}
+-
+-	voltdm = voltdm_lookup(vdd_name);
+-	if (!voltdm) {
+-		pr_err("%s: unable to get vdd pointer for vdd_%s\n",
+-			__func__, vdd_name);
+-		goto exit;
+-	}
+-
+-	clk =  clk_get(NULL, clk_name);
+-	if (IS_ERR(clk)) {
+-		pr_err("%s: unable to get clk %s\n", __func__, clk_name);
+-		goto exit;
+-	}
+-
+-	freq = clk_get_rate(clk);
+-	clk_put(clk);
+-
+-	opp = dev_pm_opp_find_freq_ceil(dev, &freq);
+-	if (IS_ERR(opp)) {
+-		pr_err("%s: unable to find boot up OPP for vdd_%s\n",
+-			__func__, vdd_name);
+-		goto exit;
+-	}
+-
+-	bootup_volt = dev_pm_opp_get_voltage(opp);
+-	dev_pm_opp_put(opp);
+-
+-	if (!bootup_volt) {
+-		pr_err("%s: unable to find voltage corresponding to the bootup OPP for vdd_%s\n",
+-		       __func__, vdd_name);
+-		goto exit;
+-	}
+-
+-	voltdm_scale(voltdm, bootup_volt);
+-	return 0;
+-
+-exit:
+-	pr_err("%s: unable to set vdd_%s\n", __func__, vdd_name);
+-	return -EINVAL;
+-}
+-
+ #ifdef CONFIG_SUSPEND
+ static int omap_pm_enter(suspend_state_t suspend_state)
+ {
+@@ -208,25 +131,6 @@ void omap_common_suspend_init(void *pm_suspend)
+ }
+ #endif /* CONFIG_SUSPEND */
+ 
+-static void __init omap3_init_voltages(void)
+-{
+-	if (!soc_is_omap34xx())
+-		return;
+-
+-	omap2_set_init_voltage("mpu_iva", "dpll1_ck", "mpu");
+-	omap2_set_init_voltage("core", "l3_ick", "l3_main");
+-}
+-
+-static void __init omap4_init_voltages(void)
+-{
+-	if (!soc_is_omap44xx())
+-		return;
+-
+-	omap2_set_init_voltage("mpu", "dpll_mpu_ck", "mpu");
+-	omap2_set_init_voltage("core", "l3_div_ck", "l3_main_1");
+-	omap2_set_init_voltage("iva", "dpll_iva_m5x2_ck", "iva");
+-}
+-
+ int __maybe_unused omap_pm_nop_init(void)
+ {
+ 	return 0;
+@@ -246,10 +150,6 @@ int __init omap2_common_pm_late_init(void)
+ 	omap4_twl_init();
+ 	omap_voltage_late_init();
+ 
+-	/* Initialize the voltages */
+-	omap3_init_voltages();
+-	omap4_init_voltages();
+-
+ 	/* Smartreflex device init */
+ 	omap_devinit_smartreflex();
+ 
+diff --git a/arch/arm/xen/efi.c b/arch/arm/xen/efi.c
+index d687a73044bf..cb2aaf98e243 100644
+--- a/arch/arm/xen/efi.c
++++ b/arch/arm/xen/efi.c
+@@ -19,7 +19,9 @@ void __init xen_efi_runtime_setup(void)
+ 	efi.get_variable             = xen_efi_get_variable;
+ 	efi.get_next_variable        = xen_efi_get_next_variable;
+ 	efi.set_variable             = xen_efi_set_variable;
++	efi.set_variable_nonblocking = xen_efi_set_variable;
+ 	efi.query_variable_info      = xen_efi_query_variable_info;
++	efi.query_variable_info_nonblocking = xen_efi_query_variable_info;
+ 	efi.update_capsule           = xen_efi_update_capsule;
+ 	efi.query_capsule_caps       = xen_efi_query_capsule_caps;
+ 	efi.get_next_high_mono_count = xen_efi_get_next_high_mono_count;
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 3adcec05b1f6..e8cf56283871 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -601,6 +601,23 @@ config CAVIUM_ERRATUM_30115
+ 
+ 	  If unsure, say Y.
+ 
++config CAVIUM_TX2_ERRATUM_219
++	bool "Cavium ThunderX2 erratum 219: PRFM between TTBR change and ISB fails"
++	default y
++	help
++	  On Cavium ThunderX2, a load, store or prefetch instruction between a
++	  TTBR update and the corresponding context synchronizing operation can
++	  cause a spurious Data Abort to be delivered to any hardware thread in
++	  the CPU core.
++
++	  Work around the issue by avoiding the problematic code sequence and
++	  trapping KVM guest TTBRx_EL1 writes to EL2 when SMT is enabled. The
++	  trap handler performs the corresponding register access, skips the
++	  instruction and ensures context synchronization by virtue of the
++	  exception return.
++
++	  If unsure, say Y.
++
+ config QCOM_FALKOR_ERRATUM_1003
+ 	bool "Falkor E1003: Incorrect translation due to ASID change"
+ 	default y
+diff --git a/arch/arm64/include/asm/cpucaps.h b/arch/arm64/include/asm/cpucaps.h
+index f19fe4b9acc4..ac1dbca3d0cd 100644
+--- a/arch/arm64/include/asm/cpucaps.h
++++ b/arch/arm64/include/asm/cpucaps.h
+@@ -52,7 +52,9 @@
+ #define ARM64_HAS_IRQ_PRIO_MASKING		42
+ #define ARM64_HAS_DCPODP			43
+ #define ARM64_WORKAROUND_1463225		44
++#define ARM64_WORKAROUND_CAVIUM_TX2_219_TVM	45
++#define ARM64_WORKAROUND_CAVIUM_TX2_219_PRFM	46
+ 
+-#define ARM64_NCAPS				45
++#define ARM64_NCAPS				47
+ 
+ #endif /* __ASM_CPUCAPS_H */
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index 1e43ba5c79b7..27b4a973f16d 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -12,6 +12,7 @@
+ #include <asm/cpu.h>
+ #include <asm/cputype.h>
+ #include <asm/cpufeature.h>
++#include <asm/smp_plat.h>
+ 
+ static bool __maybe_unused
+ is_affected_midr_range(const struct arm64_cpu_capabilities *entry, int scope)
+@@ -623,6 +624,30 @@ check_branch_predictor(const struct arm64_cpu_capabilities *entry, int scope)
+ 	return (need_wa > 0);
+ }
+ 
++static const __maybe_unused struct midr_range tx2_family_cpus[] = {
++	MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
++	MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2),
++	{},
++};
++
++static bool __maybe_unused
++needs_tx2_tvm_workaround(const struct arm64_cpu_capabilities *entry,
++			 int scope)
++{
++	int i;
++
++	if (!is_affected_midr_range_list(entry, scope) ||
++	    !is_hyp_mode_available())
++		return false;
++
++	for_each_possible_cpu(i) {
++		if (MPIDR_AFFINITY_LEVEL(cpu_logical_map(i), 0) != 0)
++			return true;
++	}
++
++	return false;
++}
++
+ #ifdef CONFIG_HARDEN_EL2_VECTORS
+ 
+ static const struct midr_range arm64_harden_el2_vectors[] = {
+@@ -851,6 +876,19 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
+ 		.type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
+ 		.matches = has_cortex_a76_erratum_1463225,
+ 	},
++	{
++		.desc = "Cavium ThunderX2 erratum 219 (PRFM removal)",
++		.capability = ARM64_WORKAROUND_CAVIUM_TX2_219_PRFM,
++		ERRATA_MIDR_RANGE_LIST(tx2_family_cpus),
++	},
++#endif
++#ifdef CONFIG_CAVIUM_TX2_ERRATUM_219
++	{
++		.desc = "Cavium ThunderX2 erratum 219 (KVM guest sysreg trapping)",
++		.capability = ARM64_WORKAROUND_CAVIUM_TX2_219_TVM,
++		ERRATA_MIDR_RANGE_LIST(tx2_family_cpus),
++		.matches = needs_tx2_tvm_workaround,
++	},
+ #endif
+ 	{
+ 	}
+diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
+index 84a822748c84..109894bd3194 100644
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -1070,7 +1070,9 @@ alternative_insn isb, nop, ARM64_WORKAROUND_QCOM_FALKOR_E1003
+ #else
+ 	ldr	x30, =vectors
+ #endif
++alternative_if_not ARM64_WORKAROUND_CAVIUM_TX2_219_PRFM
+ 	prfm	plil1strm, [x30, #(1b - tramp_vectors)]
++alternative_else_nop_endif
+ 	msr	vbar_el1, x30
+ 	add	x30, x30, #(1b - tramp_vectors)
+ 	isb
+diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
+index adaf266d8de8..7fdc821ebb78 100644
+--- a/arch/arm64/kvm/hyp/switch.c
++++ b/arch/arm64/kvm/hyp/switch.c
+@@ -124,6 +124,9 @@ static void __hyp_text __activate_traps(struct kvm_vcpu *vcpu)
+ {
+ 	u64 hcr = vcpu->arch.hcr_el2;
+ 
++	if (cpus_have_const_cap(ARM64_WORKAROUND_CAVIUM_TX2_219_TVM))
++		hcr |= HCR_TVM;
++
+ 	write_sysreg(hcr, hcr_el2);
+ 
+ 	if (cpus_have_const_cap(ARM64_HAS_RAS_EXTN) && (hcr & HCR_VSE))
+@@ -174,8 +177,10 @@ static void __hyp_text __deactivate_traps(struct kvm_vcpu *vcpu)
+ 	 * the crucial bit is "On taking a vSError interrupt,
+ 	 * HCR_EL2.VSE is cleared to 0."
+ 	 */
+-	if (vcpu->arch.hcr_el2 & HCR_VSE)
+-		vcpu->arch.hcr_el2 = read_sysreg(hcr_el2);
++	if (vcpu->arch.hcr_el2 & HCR_VSE) {
++		vcpu->arch.hcr_el2 &= ~HCR_VSE;
++		vcpu->arch.hcr_el2 |= read_sysreg(hcr_el2) & HCR_VSE;
++	}
+ 
+ 	if (has_vhe())
+ 		deactivate_traps_vhe();
+@@ -393,6 +398,61 @@ static bool __hyp_text __hyp_handle_fpsimd(struct kvm_vcpu *vcpu)
+ 	return true;
+ }
+ 
++static bool __hyp_text handle_tx2_tvm(struct kvm_vcpu *vcpu)
++{
++	u32 sysreg = esr_sys64_to_sysreg(kvm_vcpu_get_hsr(vcpu));
++	int rt = kvm_vcpu_sys_get_rt(vcpu);
++	u64 val = vcpu_get_reg(vcpu, rt);
++
++	/*
++	 * The normal sysreg handling code expects to see the traps,
++	 * let's not do anything here.
++	 */
++	if (vcpu->arch.hcr_el2 & HCR_TVM)
++		return false;
++
++	switch (sysreg) {
++	case SYS_SCTLR_EL1:
++		write_sysreg_el1(val, SYS_SCTLR);
++		break;
++	case SYS_TTBR0_EL1:
++		write_sysreg_el1(val, SYS_TTBR0);
++		break;
++	case SYS_TTBR1_EL1:
++		write_sysreg_el1(val, SYS_TTBR1);
++		break;
++	case SYS_TCR_EL1:
++		write_sysreg_el1(val, SYS_TCR);
++		break;
++	case SYS_ESR_EL1:
++		write_sysreg_el1(val, SYS_ESR);
++		break;
++	case SYS_FAR_EL1:
++		write_sysreg_el1(val, SYS_FAR);
++		break;
++	case SYS_AFSR0_EL1:
++		write_sysreg_el1(val, SYS_AFSR0);
++		break;
++	case SYS_AFSR1_EL1:
++		write_sysreg_el1(val, SYS_AFSR1);
++		break;
++	case SYS_MAIR_EL1:
++		write_sysreg_el1(val, SYS_MAIR);
++		break;
++	case SYS_AMAIR_EL1:
++		write_sysreg_el1(val, SYS_AMAIR);
++		break;
++	case SYS_CONTEXTIDR_EL1:
++		write_sysreg_el1(val, SYS_CONTEXTIDR);
++		break;
++	default:
++		return false;
++	}
++
++	__kvm_skip_instr(vcpu);
++	return true;
++}
++
+ /*
+  * Return true when we were able to fixup the guest exit and should return to
+  * the guest, false when we should restore the host state and return to the
+@@ -412,6 +472,11 @@ static bool __hyp_text fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code)
+ 	if (*exit_code != ARM_EXCEPTION_TRAP)
+ 		goto exit;
+ 
++	if (cpus_have_const_cap(ARM64_WORKAROUND_CAVIUM_TX2_219_TVM) &&
++	    kvm_vcpu_trap_get_class(vcpu) == ESR_ELx_EC_SYS64 &&
++	    handle_tx2_tvm(vcpu))
++		return true;
++
+ 	/*
+ 	 * We trap the first access to the FP/SIMD to save the host context
+ 	 * and restore the guest context lazily.
+diff --git a/arch/mips/boot/dts/qca/ar9331.dtsi b/arch/mips/boot/dts/qca/ar9331.dtsi
+index 63a9f33aa43e..5cfc9d347826 100644
+--- a/arch/mips/boot/dts/qca/ar9331.dtsi
++++ b/arch/mips/boot/dts/qca/ar9331.dtsi
+@@ -99,7 +99,7 @@
+ 
+ 			miscintc: interrupt-controller@18060010 {
+ 				compatible = "qca,ar7240-misc-intc";
+-				reg = <0x18060010 0x4>;
++				reg = <0x18060010 0x8>;
+ 
+ 				interrupt-parent = <&cpuintc>;
+ 				interrupts = <6>;
+diff --git a/arch/mips/loongson64/common/serial.c b/arch/mips/loongson64/common/serial.c
+index ffefc1cb2612..98c3a7feb10f 100644
+--- a/arch/mips/loongson64/common/serial.c
++++ b/arch/mips/loongson64/common/serial.c
+@@ -110,7 +110,7 @@ static int __init serial_init(void)
+ }
+ module_init(serial_init);
+ 
+-static void __init serial_exit(void)
++static void __exit serial_exit(void)
+ {
+ 	platform_device_unregister(&uart8250_device);
+ }
+diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
+index bece1264d1c5..b0f70006bd85 100644
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -655,6 +655,13 @@ static void build_restore_pagemask(u32 **p, struct uasm_reloc **r,
+ 				   int restore_scratch)
+ {
+ 	if (restore_scratch) {
++		/*
++		 * Ensure the MFC0 below observes the value written to the
++		 * KScratch register by the prior MTC0.
++		 */
++		if (scratch_reg >= 0)
++			uasm_i_ehb(p);
++
+ 		/* Reset default page size */
+ 		if (PM_DEFAULT_MASK >> 16) {
+ 			uasm_i_lui(p, tmp, PM_DEFAULT_MASK >> 16);
+@@ -669,12 +676,10 @@ static void build_restore_pagemask(u32 **p, struct uasm_reloc **r,
+ 			uasm_i_mtc0(p, 0, C0_PAGEMASK);
+ 			uasm_il_b(p, r, lid);
+ 		}
+-		if (scratch_reg >= 0) {
+-			uasm_i_ehb(p);
++		if (scratch_reg >= 0)
+ 			UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg);
+-		} else {
++		else
+ 			UASM_i_LW(p, 1, scratchpad_offset(0), 0);
+-		}
+ 	} else {
+ 		/* Reset default page size */
+ 		if (PM_DEFAULT_MASK >> 16) {
+@@ -923,6 +928,10 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
+ 	}
+ 	if (mode != not_refill && check_for_high_segbits) {
+ 		uasm_l_large_segbits_fault(l, *p);
++
++		if (mode == refill_scratch && scratch_reg >= 0)
++			uasm_i_ehb(p);
++
+ 		/*
+ 		 * We get here if we are an xsseg address, or if we are
+ 		 * an xuseg address above (PGDIR_SHIFT+PGDIR_BITS) boundary.
+@@ -941,12 +950,10 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
+ 		uasm_i_jr(p, ptr);
+ 
+ 		if (mode == refill_scratch) {
+-			if (scratch_reg >= 0) {
+-				uasm_i_ehb(p);
++			if (scratch_reg >= 0)
+ 				UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg);
+-			} else {
++			else
+ 				UASM_i_LW(p, 1, scratchpad_offset(0), 0);
+-			}
+ 		} else {
+ 			uasm_i_nop(p);
+ 		}
+diff --git a/arch/parisc/mm/ioremap.c b/arch/parisc/mm/ioremap.c
+index 92a9b5f12f98..f29f682352f0 100644
+--- a/arch/parisc/mm/ioremap.c
++++ b/arch/parisc/mm/ioremap.c
+@@ -3,7 +3,7 @@
+  * arch/parisc/mm/ioremap.c
+  *
+  * (C) Copyright 1995 1996 Linus Torvalds
+- * (C) Copyright 2001-2006 Helge Deller <deller@×××.de>
++ * (C) Copyright 2001-2019 Helge Deller <deller@×××.de>
+  * (C) Copyright 2005 Kyle McMartin <kyle@××××××××××××.org>
+  */
+ 
+@@ -84,7 +84,7 @@ void __iomem * __ioremap(unsigned long phys_addr, unsigned long size, unsigned l
+ 	addr = (void __iomem *) area->addr;
+ 	if (ioremap_page_range((unsigned long)addr, (unsigned long)addr + size,
+ 			       phys_addr, pgprot)) {
+-		vfree(addr);
++		vunmap(addr);
+ 		return NULL;
+ 	}
+ 
+@@ -92,9 +92,11 @@ void __iomem * __ioremap(unsigned long phys_addr, unsigned long size, unsigned l
+ }
+ EXPORT_SYMBOL(__ioremap);
+ 
+-void iounmap(const volatile void __iomem *addr)
++void iounmap(const volatile void __iomem *io_addr)
+ {
+-	if (addr > high_memory)
+-		return vfree((void *) (PAGE_MASK & (unsigned long __force) addr));
++	unsigned long addr = (unsigned long)io_addr & PAGE_MASK;
++
++	if (is_vmalloc_addr((void *)addr))
++		vunmap((void *)addr);
+ }
+ EXPORT_SYMBOL(iounmap);
+diff --git a/arch/powerpc/kvm/book3s_xive.c b/arch/powerpc/kvm/book3s_xive.c
+index 591bfb4bfd0f..a3f9c665bb5b 100644
+--- a/arch/powerpc/kvm/book3s_xive.c
++++ b/arch/powerpc/kvm/book3s_xive.c
+@@ -1217,6 +1217,7 @@ int kvmppc_xive_connect_vcpu(struct kvm_device *dev,
+ 	struct kvmppc_xive *xive = dev->private;
+ 	struct kvmppc_xive_vcpu *xc;
+ 	int i, r = -EBUSY;
++	u32 vp_id;
+ 
+ 	pr_devel("connect_vcpu(cpu=%d)\n", cpu);
+ 
+@@ -1228,25 +1229,32 @@ int kvmppc_xive_connect_vcpu(struct kvm_device *dev,
+ 		return -EPERM;
+ 	if (vcpu->arch.irq_type != KVMPPC_IRQ_DEFAULT)
+ 		return -EBUSY;
+-	if (kvmppc_xive_find_server(vcpu->kvm, cpu)) {
+-		pr_devel("Duplicate !\n");
+-		return -EEXIST;
+-	}
+ 	if (cpu >= (KVM_MAX_VCPUS * vcpu->kvm->arch.emul_smt_mode)) {
+ 		pr_devel("Out of bounds !\n");
+ 		return -EINVAL;
+ 	}
+-	xc = kzalloc(sizeof(*xc), GFP_KERNEL);
+-	if (!xc)
+-		return -ENOMEM;
+ 
+ 	/* We need to synchronize with queue provisioning */
+ 	mutex_lock(&xive->lock);
++
++	vp_id = kvmppc_xive_vp(xive, cpu);
++	if (kvmppc_xive_vp_in_use(xive->kvm, vp_id)) {
++		pr_devel("Duplicate !\n");
++		r = -EEXIST;
++		goto bail;
++	}
++
++	xc = kzalloc(sizeof(*xc), GFP_KERNEL);
++	if (!xc) {
++		r = -ENOMEM;
++		goto bail;
++	}
++
+ 	vcpu->arch.xive_vcpu = xc;
+ 	xc->xive = xive;
+ 	xc->vcpu = vcpu;
+ 	xc->server_num = cpu;
+-	xc->vp_id = kvmppc_xive_vp(xive, cpu);
++	xc->vp_id = vp_id;
+ 	xc->mfrr = 0xff;
+ 	xc->valid = true;
+ 
+diff --git a/arch/powerpc/kvm/book3s_xive.h b/arch/powerpc/kvm/book3s_xive.h
+index 955b820ffd6d..fe3ed50e0818 100644
+--- a/arch/powerpc/kvm/book3s_xive.h
++++ b/arch/powerpc/kvm/book3s_xive.h
+@@ -220,6 +220,18 @@ static inline u32 kvmppc_xive_vp(struct kvmppc_xive *xive, u32 server)
+ 	return xive->vp_base + kvmppc_pack_vcpu_id(xive->kvm, server);
+ }
+ 
++static inline bool kvmppc_xive_vp_in_use(struct kvm *kvm, u32 vp_id)
++{
++	struct kvm_vcpu *vcpu = NULL;
++	int i;
++
++	kvm_for_each_vcpu(i, vcpu, kvm) {
++		if (vcpu->arch.xive_vcpu && vp_id == vcpu->arch.xive_vcpu->vp_id)
++			return true;
++	}
++	return false;
++}
++
+ /*
+  * Mapping between guest priorities and host priorities
+  * is as follow.
+diff --git a/arch/powerpc/kvm/book3s_xive_native.c b/arch/powerpc/kvm/book3s_xive_native.c
+index 248c1ea9e788..78b906ffa0d2 100644
+--- a/arch/powerpc/kvm/book3s_xive_native.c
++++ b/arch/powerpc/kvm/book3s_xive_native.c
+@@ -106,6 +106,7 @@ int kvmppc_xive_native_connect_vcpu(struct kvm_device *dev,
+ 	struct kvmppc_xive *xive = dev->private;
+ 	struct kvmppc_xive_vcpu *xc = NULL;
+ 	int rc;
++	u32 vp_id;
+ 
+ 	pr_devel("native_connect_vcpu(server=%d)\n", server_num);
+ 
+@@ -124,7 +125,8 @@ int kvmppc_xive_native_connect_vcpu(struct kvm_device *dev,
+ 
+ 	mutex_lock(&xive->lock);
+ 
+-	if (kvmppc_xive_find_server(vcpu->kvm, server_num)) {
++	vp_id = kvmppc_xive_vp(xive, server_num);
++	if (kvmppc_xive_vp_in_use(xive->kvm, vp_id)) {
+ 		pr_devel("Duplicate !\n");
+ 		rc = -EEXIST;
+ 		goto bail;
+@@ -141,7 +143,7 @@ int kvmppc_xive_native_connect_vcpu(struct kvm_device *dev,
+ 	xc->vcpu = vcpu;
+ 	xc->server_num = server_num;
+ 
+-	xc->vp_id = kvmppc_xive_vp(xive, server_num);
++	xc->vp_id = vp_id;
+ 	xc->valid = true;
+ 	vcpu->arch.irq_type = KVMPPC_IRQ_XIVE;
+ 
+diff --git a/arch/riscv/include/asm/asm.h b/arch/riscv/include/asm/asm.h
+index 5a02b7d50940..9c992a88d858 100644
+--- a/arch/riscv/include/asm/asm.h
++++ b/arch/riscv/include/asm/asm.h
+@@ -22,6 +22,7 @@
+ 
+ #define REG_L		__REG_SEL(ld, lw)
+ #define REG_S		__REG_SEL(sd, sw)
++#define REG_SC		__REG_SEL(sc.d, sc.w)
+ #define SZREG		__REG_SEL(8, 4)
+ #define LGREG		__REG_SEL(3, 2)
+ 
+diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
+index 9b60878a4469..2a82e0a5af46 100644
+--- a/arch/riscv/kernel/entry.S
++++ b/arch/riscv/kernel/entry.S
+@@ -98,7 +98,26 @@ _save_context:
+  */
+ 	.macro RESTORE_ALL
+ 	REG_L a0, PT_SSTATUS(sp)
+-	REG_L a2, PT_SEPC(sp)
++	/*
++	 * The current load reservation is effectively part of the processor's
++	 * state, in the sense that load reservations cannot be shared between
++	 * different hart contexts.  We can't actually save and restore a load
++	 * reservation, so instead here we clear any existing reservation --
++	 * it's always legal for implementations to clear load reservations at
++	 * any point (as long as the forward progress guarantee is kept, but
++	 * we'll ignore that here).
++	 *
++	 * Dangling load reservations can be the result of taking a trap in the
++	 * middle of an LR/SC sequence, but can also be the result of a taken
++	 * forward branch around an SC -- which is how we implement CAS.  As a
++	 * result we need to clear reservations between the last CAS and the
++	 * jump back to the new context.  While it is unlikely the store
++	 * completes, implementations are allowed to expand reservations to be
++	 * arbitrarily large.
++	 */
++	REG_L  a2, PT_SEPC(sp)
++	REG_SC x0, a2, PT_SEPC(sp)
++
+ 	csrw CSR_SSTATUS, a0
+ 	csrw CSR_SEPC, a2
+ 
+diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
+index 42bf939693d3..ed9cd9944d4f 100644
+--- a/arch/riscv/mm/init.c
++++ b/arch/riscv/mm/init.c
+@@ -11,6 +11,7 @@
+ #include <linux/swap.h>
+ #include <linux/sizes.h>
+ #include <linux/of_fdt.h>
++#include <linux/libfdt.h>
+ 
+ #include <asm/fixmap.h>
+ #include <asm/tlbflush.h>
+@@ -82,6 +83,8 @@ disable:
+ }
+ #endif /* CONFIG_BLK_DEV_INITRD */
+ 
++static phys_addr_t dtb_early_pa __initdata;
++
+ void __init setup_bootmem(void)
+ {
+ 	struct memblock_region *reg;
+@@ -117,7 +120,12 @@ void __init setup_bootmem(void)
+ 	setup_initrd();
+ #endif /* CONFIG_BLK_DEV_INITRD */
+ 
+-	early_init_fdt_reserve_self();
++	/*
++	 * Avoid using early_init_fdt_reserve_self() since __pa() does
++	 * not work for DTB pointers that are fixmap addresses
++	 */
++	memblock_reserve(dtb_early_pa, fdt_totalsize(dtb_early_va));
++
+ 	early_init_fdt_scan_reserved_mem();
+ 	memblock_allow_resize();
+ 	memblock_dump_all();
+@@ -393,6 +401,8 @@ asmlinkage void __init setup_vm(uintptr_t dtb_pa)
+ 
+ 	/* Save pointer to DTB for early FDT parsing */
+ 	dtb_early_va = (void *)fix_to_virt(FIX_FDT) + (dtb_pa & ~PAGE_MASK);
++	/* Save physical address for memblock reservation */
++	dtb_early_pa = dtb_pa;
+ }
+ 
+ static void __init setup_vm_final(void)
+diff --git a/arch/s390/boot/startup.c b/arch/s390/boot/startup.c
+index 7b0d05414618..ceeacbeff600 100644
+--- a/arch/s390/boot/startup.c
++++ b/arch/s390/boot/startup.c
+@@ -101,10 +101,18 @@ static void handle_relocs(unsigned long offset)
+ 	dynsym = (Elf64_Sym *) vmlinux.dynsym_start;
+ 	for (rela = rela_start; rela < rela_end; rela++) {
+ 		loc = rela->r_offset + offset;
+-		val = rela->r_addend + offset;
++		val = rela->r_addend;
+ 		r_sym = ELF64_R_SYM(rela->r_info);
+-		if (r_sym)
+-			val += dynsym[r_sym].st_value;
++		if (r_sym) {
++			if (dynsym[r_sym].st_shndx != SHN_UNDEF)
++				val += dynsym[r_sym].st_value + offset;
++		} else {
++			/*
++			 * 0 == undefined symbol table index (STN_UNDEF),
++			 * used for R_390_RELATIVE, only add KASLR offset
++			 */
++			val += offset;
++		}
+ 		r_type = ELF64_R_TYPE(rela->r_info);
+ 		rc = arch_kexec_do_relocs(r_type, (void *) loc, val, 0);
+ 		if (rc)
+diff --git a/arch/s390/include/asm/hugetlb.h b/arch/s390/include/asm/hugetlb.h
+index bb59dd964590..de8f0bf5f238 100644
+--- a/arch/s390/include/asm/hugetlb.h
++++ b/arch/s390/include/asm/hugetlb.h
+@@ -12,8 +12,6 @@
+ #include <asm/page.h>
+ #include <asm/pgtable.h>
+ 
+-
+-#define is_hugepage_only_range(mm, addr, len)	0
+ #define hugetlb_free_pgd_range			free_pgd_range
+ #define hugepages_supported()			(MACHINE_HAS_EDAT1)
+ 
+@@ -23,6 +21,13 @@ pte_t huge_ptep_get(pte_t *ptep);
+ pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
+ 			      unsigned long addr, pte_t *ptep);
+ 
++static inline bool is_hugepage_only_range(struct mm_struct *mm,
++					  unsigned long addr,
++					  unsigned long len)
++{
++	return false;
++}
++
+ /*
+  * If the arch doesn't supply something else, assume that hugepage
+  * size aligned regions are ok without further preparation.
+diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
+index 9b274fcaacb6..70ac23e50cae 100644
+--- a/arch/s390/include/asm/pgtable.h
++++ b/arch/s390/include/asm/pgtable.h
+@@ -1268,7 +1268,8 @@ static inline pte_t *pte_offset(pmd_t *pmd, unsigned long address)
+ 
+ #define pte_offset_kernel(pmd, address) pte_offset(pmd, address)
+ #define pte_offset_map(pmd, address) pte_offset_kernel(pmd, address)
+-#define pte_unmap(pte) do { } while (0)
++
++static inline void pte_unmap(pte_t *pte) { }
+ 
+ static inline bool gup_fast_permitted(unsigned long start, unsigned long end)
+ {
+diff --git a/arch/s390/kernel/machine_kexec_reloc.c b/arch/s390/kernel/machine_kexec_reloc.c
+index 3b664cb3ec4d..d5035de9020e 100644
+--- a/arch/s390/kernel/machine_kexec_reloc.c
++++ b/arch/s390/kernel/machine_kexec_reloc.c
+@@ -27,6 +27,7 @@ int arch_kexec_do_relocs(int r_type, void *loc, unsigned long val,
+ 		*(u32 *)loc = val;
+ 		break;
+ 	case R_390_64:		/* Direct 64 bit.  */
++	case R_390_GLOB_DAT:
+ 		*(u64 *)loc = val;
+ 		break;
+ 	case R_390_PC16:	/* PC relative 16 bit.	*/
+diff --git a/arch/x86/hyperv/hv_apic.c b/arch/x86/hyperv/hv_apic.c
+index 5c056b8aebef..e01078e93dd3 100644
+--- a/arch/x86/hyperv/hv_apic.c
++++ b/arch/x86/hyperv/hv_apic.c
+@@ -260,11 +260,21 @@ void __init hv_apic_init(void)
+ 	}
+ 
+ 	if (ms_hyperv.hints & HV_X64_APIC_ACCESS_RECOMMENDED) {
+-		pr_info("Hyper-V: Using MSR based APIC access\n");
++		pr_info("Hyper-V: Using enlightened APIC (%s mode)",
++			x2apic_enabled() ? "x2apic" : "xapic");
++		/*
++		 * With x2apic, architectural x2apic MSRs are equivalent to the
++		 * respective synthetic MSRs, so there's no need to override
++		 * the apic accessors.  The only exception is
++		 * hv_apic_eoi_write, because it benefits from lazy EOI when
++		 * available, but it works for both xapic and x2apic modes.
++		 */
+ 		apic_set_eoi_write(hv_apic_eoi_write);
+-		apic->read      = hv_apic_read;
+-		apic->write     = hv_apic_write;
+-		apic->icr_write = hv_apic_icr_write;
+-		apic->icr_read  = hv_apic_icr_read;
++		if (!x2apic_enabled()) {
++			apic->read      = hv_apic_read;
++			apic->write     = hv_apic_write;
++			apic->icr_write = hv_apic_icr_write;
++			apic->icr_read  = hv_apic_icr_read;
++		}
+ 	}
+ }
+diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
+index 35c225ede0e4..61d93f062a36 100644
+--- a/arch/x86/include/asm/uaccess.h
++++ b/arch/x86/include/asm/uaccess.h
+@@ -734,5 +734,28 @@ do {										\
+ 	if (unlikely(__gu_err)) goto err_label;					\
+ } while (0)
+ 
++/*
++ * We want the unsafe accessors to always be inlined and use
++ * the error labels - thus the macro games.
++ */
++#define unsafe_copy_loop(dst, src, len, type, label)			\
++	while (len >= sizeof(type)) {					\
++		unsafe_put_user(*(type *)src,(type __user *)dst,label);	\
++		dst += sizeof(type);					\
++		src += sizeof(type);					\
++		len -= sizeof(type);					\
++	}
++
++#define unsafe_copy_to_user(_dst,_src,_len,label)			\
++do {									\
++	char __user *__ucu_dst = (_dst);				\
++	const char *__ucu_src = (_src);					\
++	size_t __ucu_len = (_len);					\
++	unsafe_copy_loop(__ucu_dst, __ucu_src, __ucu_len, u64, label);	\
++	unsafe_copy_loop(__ucu_dst, __ucu_src, __ucu_len, u32, label);	\
++	unsafe_copy_loop(__ucu_dst, __ucu_src, __ucu_len, u16, label);	\
++	unsafe_copy_loop(__ucu_dst, __ucu_src, __ucu_len, u8, label);	\
++} while (0)
++
+ #endif /* _ASM_X86_UACCESS_H */
+ 
+diff --git a/arch/x86/kernel/apic/x2apic_cluster.c b/arch/x86/kernel/apic/x2apic_cluster.c
+index 609e499387a1..0cad36d1457a 100644
+--- a/arch/x86/kernel/apic/x2apic_cluster.c
++++ b/arch/x86/kernel/apic/x2apic_cluster.c
+@@ -158,7 +158,8 @@ static int x2apic_dead_cpu(unsigned int dead_cpu)
+ {
+ 	struct cluster_mask *cmsk = per_cpu(cluster_masks, dead_cpu);
+ 
+-	cpumask_clear_cpu(dead_cpu, &cmsk->mask);
++	if (cmsk)
++		cpumask_clear_cpu(dead_cpu, &cmsk->mask);
+ 	free_cpumask_var(per_cpu(ipi_mask, dead_cpu));
+ 	return 0;
+ }
+diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
+index 29ffa495bd1c..206a4b6144c2 100644
+--- a/arch/x86/kernel/head64.c
++++ b/arch/x86/kernel/head64.c
+@@ -222,13 +222,31 @@ unsigned long __head __startup_64(unsigned long physaddr,
+ 	 * we might write invalid pmds, when the kernel is relocated
+ 	 * cleanup_highmap() fixes this up along with the mappings
+ 	 * beyond _end.
++	 *
++	 * Only the region occupied by the kernel image has so far
++	 * been checked against the table of usable memory regions
++	 * provided by the firmware, so invalidate pages outside that
++	 * region. A page table entry that maps to a reserved area of
++	 * memory would allow processor speculation into that area,
++	 * and on some hardware (particularly the UV platform) even
++	 * speculative access to some reserved areas is caught as an
++	 * error, causing the BIOS to halt the system.
+ 	 */
+ 
+ 	pmd = fixup_pointer(level2_kernel_pgt, physaddr);
+-	for (i = 0; i < PTRS_PER_PMD; i++) {
++
++	/* invalidate pages before the kernel image */
++	for (i = 0; i < pmd_index((unsigned long)_text); i++)
++		pmd[i] &= ~_PAGE_PRESENT;
++
++	/* fixup pages that are part of the kernel image */
++	for (; i <= pmd_index((unsigned long)_end); i++)
+ 		if (pmd[i] & _PAGE_PRESENT)
+ 			pmd[i] += load_delta;
+-	}
++
++	/* invalidate pages after the kernel image */
++	for (; i < PTRS_PER_PMD; i++)
++		pmd[i] &= ~_PAGE_PRESENT;
+ 
+ 	/*
+ 	 * Fixup phys_base - remove the memory encryption mask to obtain
+diff --git a/arch/x86/xen/efi.c b/arch/x86/xen/efi.c
+index 0d3365cb64de..7e3eb70f411a 100644
+--- a/arch/x86/xen/efi.c
++++ b/arch/x86/xen/efi.c
+@@ -65,7 +65,9 @@ static efi_system_table_t __init *xen_efi_probe(void)
+ 	efi.get_variable             = xen_efi_get_variable;
+ 	efi.get_next_variable        = xen_efi_get_next_variable;
+ 	efi.set_variable             = xen_efi_set_variable;
++	efi.set_variable_nonblocking = xen_efi_set_variable;
+ 	efi.query_variable_info      = xen_efi_query_variable_info;
++	efi.query_variable_info_nonblocking = xen_efi_query_variable_info;
+ 	efi.update_capsule           = xen_efi_update_capsule;
+ 	efi.query_capsule_caps       = xen_efi_query_capsule_caps;
+ 	efi.get_next_high_mono_count = xen_efi_get_next_high_mono_count;
+diff --git a/arch/xtensa/include/asm/bitops.h b/arch/xtensa/include/asm/bitops.h
+index aeb15f4c755b..be8b2be5a98b 100644
+--- a/arch/xtensa/include/asm/bitops.h
++++ b/arch/xtensa/include/asm/bitops.h
+@@ -148,7 +148,7 @@ static inline void change_bit(unsigned int bit, volatile unsigned long *p)
+ 			"       getex   %0\n"
+ 			"       beqz    %0, 1b\n"
+ 			: "=&a" (tmp)
+-			: "a" (~mask), "a" (p)
++			: "a" (mask), "a" (p)
+ 			: "memory");
+ }
+ 
+diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
+index 04f19de46700..4092555828b1 100644
+--- a/arch/xtensa/kernel/xtensa_ksyms.c
++++ b/arch/xtensa/kernel/xtensa_ksyms.c
+@@ -119,13 +119,6 @@ EXPORT_SYMBOL(__invalidate_icache_range);
+ // FIXME EXPORT_SYMBOL(screen_info);
+ #endif
+ 
+-EXPORT_SYMBOL(outsb);
+-EXPORT_SYMBOL(outsw);
+-EXPORT_SYMBOL(outsl);
+-EXPORT_SYMBOL(insb);
+-EXPORT_SYMBOL(insw);
+-EXPORT_SYMBOL(insl);
+-
+ extern long common_exception_return;
+ EXPORT_SYMBOL(common_exception_return);
+ 
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index a79b9ad1aba1..ed41cde93641 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1998,6 +1998,8 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
+ 		}
+ 
+ 		blk_add_rq_to_plug(plug, rq);
++	} else if (q->elevator) {
++		blk_mq_sched_insert_request(rq, false, true, true);
+ 	} else if (plug && !blk_queue_nomerges(q)) {
+ 		/*
+ 		 * We do limited plugging. If the bio can be merged, do that.
+@@ -2021,8 +2023,8 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
+ 			blk_mq_try_issue_directly(data.hctx, same_queue_rq,
+ 					&cookie);
+ 		}
+-	} else if ((q->nr_hw_queues > 1 && is_sync) || (!q->elevator &&
+-			!data.hctx->dispatch_busy)) {
++	} else if ((q->nr_hw_queues > 1 && is_sync) ||
++			!data.hctx->dispatch_busy) {
+ 		blk_mq_try_issue_directly(data.hctx, rq, &cookie);
+ 	} else {
+ 		blk_mq_sched_insert_request(rq, false, true, true);
+diff --git a/block/blk-rq-qos.h b/block/blk-rq-qos.h
+index c0f0778d5396..8378f68a21ac 100644
+--- a/block/blk-rq-qos.h
++++ b/block/blk-rq-qos.h
+@@ -103,16 +103,13 @@ static inline void rq_qos_add(struct request_queue *q, struct rq_qos *rqos)
+ 
+ static inline void rq_qos_del(struct request_queue *q, struct rq_qos *rqos)
+ {
+-	struct rq_qos *cur, *prev = NULL;
+-	for (cur = q->rq_qos; cur; cur = cur->next) {
+-		if (cur == rqos) {
+-			if (prev)
+-				prev->next = rqos->next;
+-			else
+-				q->rq_qos = cur;
++	struct rq_qos **cur;
++
++	for (cur = &q->rq_qos; *cur; cur = &(*cur)->next) {
++		if (*cur == rqos) {
++			*cur = rqos->next;
+ 			break;
+ 		}
+-		prev = cur;
+ 	}
+ 
+ 	blk_mq_debugfs_unregister_rqos(rqos);
+diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
+index 3b2525908dd8..a1a858ad4d18 100644
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -905,8 +905,8 @@ void acpi_cppc_processor_exit(struct acpi_processor *pr)
+ 			pcc_data[pcc_ss_id]->refcount--;
+ 			if (!pcc_data[pcc_ss_id]->refcount) {
+ 				pcc_mbox_free_channel(pcc_data[pcc_ss_id]->pcc_channel);
+-				pcc_data[pcc_ss_id]->pcc_channel_acquired = 0;
+ 				kfree(pcc_data[pcc_ss_id]);
++				pcc_data[pcc_ss_id] = NULL;
+ 			}
+ 		}
+ 	}
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 1413324982f0..14e68f202f81 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -1322,7 +1322,7 @@ static ssize_t scrub_show(struct device *dev,
+ 	nfit_device_lock(dev);
+ 	nd_desc = dev_get_drvdata(dev);
+ 	if (!nd_desc) {
+-		device_unlock(dev);
++		nfit_device_unlock(dev);
+ 		return rc;
+ 	}
+ 	acpi_desc = to_acpi_desc(nd_desc);
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index dc1c83eafc22..1c5278207153 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -95,10 +95,6 @@ DEFINE_SHOW_ATTRIBUTE(proc);
+ #define SZ_1K                               0x400
+ #endif
+ 
+-#ifndef SZ_4M
+-#define SZ_4M                               0x400000
+-#endif
+-
+ #define FORBIDDEN_MMAP_FLAGS                (VM_WRITE)
+ 
+ enum {
+@@ -5195,9 +5191,6 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
+ 	if (proc->tsk != current->group_leader)
+ 		return -EINVAL;
+ 
+-	if ((vma->vm_end - vma->vm_start) > SZ_4M)
+-		vma->vm_end = vma->vm_start + SZ_4M;
+-
+ 	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
+ 		     "%s: %d %lx-%lx (%ld K) vma %lx pagep %lx\n",
+ 		     __func__, proc->pid, vma->vm_start, vma->vm_end,
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index 6d79a1b0d446..8fe99b20ca02 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -22,6 +22,7 @@
+ #include <asm/cacheflush.h>
+ #include <linux/uaccess.h>
+ #include <linux/highmem.h>
++#include <linux/sizes.h>
+ #include "binder_alloc.h"
+ #include "binder_trace.h"
+ 
+@@ -689,7 +690,9 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc,
+ 	alloc->buffer = (void __user *)vma->vm_start;
+ 	mutex_unlock(&binder_alloc_mmap_lock);
+ 
+-	alloc->pages = kcalloc((vma->vm_end - vma->vm_start) / PAGE_SIZE,
++	alloc->buffer_size = min_t(unsigned long, vma->vm_end - vma->vm_start,
++				   SZ_4M);
++	alloc->pages = kcalloc(alloc->buffer_size / PAGE_SIZE,
+ 			       sizeof(alloc->pages[0]),
+ 			       GFP_KERNEL);
+ 	if (alloc->pages == NULL) {
+@@ -697,7 +700,6 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc,
+ 		failure_string = "alloc page array";
+ 		goto err_alloc_pages_failed;
+ 	}
+-	alloc->buffer_size = vma->vm_end - vma->vm_start;
+ 
+ 	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
+ 	if (!buffer) {
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 3e63294304c7..691852b8bb41 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -1617,7 +1617,9 @@ static void ahci_intel_pcs_quirk(struct pci_dev *pdev, struct ahci_host_priv *hp
+ 	 */
+ 	if (!id || id->vendor != PCI_VENDOR_ID_INTEL)
+ 		return;
+-	if (((enum board_ids) id->driver_data) < board_ahci_pcs7)
++
++	/* Skip applying the quirk on Denverton and beyond */
++	if (((enum board_ids) id->driver_data) >= board_ahci_pcs7)
+ 		return;
+ 
+ 	/*
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 1669d41fcddc..810329523c28 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -9,6 +9,7 @@
+  */
+ 
+ #include <linux/acpi.h>
++#include <linux/cpufreq.h>
+ #include <linux/device.h>
+ #include <linux/err.h>
+ #include <linux/fwnode.h>
+@@ -3150,6 +3151,8 @@ void device_shutdown(void)
+ 	wait_for_device_probe();
+ 	device_block_probing();
+ 
++	cpufreq_suspend();
++
+ 	spin_lock(&devices_kset->list_lock);
+ 	/*
+ 	 * Walk the devices list backward, shutting down each in turn.
+diff --git a/drivers/base/memory.c b/drivers/base/memory.c
+index 20c39d1bcef8..9b9abc4fcfb7 100644
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -554,6 +554,9 @@ static ssize_t soft_offline_page_store(struct device *dev,
+ 	pfn >>= PAGE_SHIFT;
+ 	if (!pfn_valid(pfn))
+ 		return -ENXIO;
++	/* Only online pages can be soft-offlined (esp., not ZONE_DEVICE). */
++	if (!pfn_to_online_page(pfn))
++		return -EIO;
+ 	ret = soft_offline_page(pfn_to_page(pfn), 0);
+ 	return ret == 0 ? count : ret;
+ }
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 1410fa893653..f6f77eaa7217 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -994,6 +994,16 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
+ 	if (!(lo_flags & LO_FLAGS_READ_ONLY) && file->f_op->fsync)
+ 		blk_queue_write_cache(lo->lo_queue, true, false);
+ 
++	if (io_is_direct(lo->lo_backing_file) && inode->i_sb->s_bdev) {
++		/* In case of direct I/O, match underlying block size */
++		unsigned short bsize = bdev_logical_block_size(
++			inode->i_sb->s_bdev);
++
++		blk_queue_logical_block_size(lo->lo_queue, bsize);
++		blk_queue_physical_block_size(lo->lo_queue, bsize);
++		blk_queue_io_min(lo->lo_queue, bsize);
++	}
++
+ 	loop_update_rotational(lo);
+ 	loop_update_dio(lo);
+ 	set_capacity(lo->lo_disk, size);
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index d58a359a6622..4285e75e52c3 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -413,13 +413,14 @@ static void reset_bdev(struct zram *zram)
+ static ssize_t backing_dev_show(struct device *dev,
+ 		struct device_attribute *attr, char *buf)
+ {
++	struct file *file;
+ 	struct zram *zram = dev_to_zram(dev);
+-	struct file *file = zram->backing_dev;
+ 	char *p;
+ 	ssize_t ret;
+ 
+ 	down_read(&zram->init_lock);
+-	if (!zram->backing_dev) {
++	file = zram->backing_dev;
++	if (!file) {
+ 		memcpy(buf, "none\n", 5);
+ 		up_read(&zram->init_lock);
+ 		return 5;
+diff --git a/drivers/clk/ti/clk-7xx.c b/drivers/clk/ti/clk-7xx.c
+index b57fe09b428b..9dd6185a4b4e 100644
+--- a/drivers/clk/ti/clk-7xx.c
++++ b/drivers/clk/ti/clk-7xx.c
+@@ -683,7 +683,7 @@ static const struct omap_clkctrl_reg_data dra7_l4per2_clkctrl_regs[] __initconst
+ 	{ DRA7_L4PER2_MCASP2_CLKCTRL, dra7_mcasp2_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:0154:22" },
+ 	{ DRA7_L4PER2_MCASP3_CLKCTRL, dra7_mcasp3_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:015c:22" },
+ 	{ DRA7_L4PER2_MCASP5_CLKCTRL, dra7_mcasp5_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:016c:22" },
+-	{ DRA7_L4PER2_MCASP8_CLKCTRL, dra7_mcasp8_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:0184:24" },
++	{ DRA7_L4PER2_MCASP8_CLKCTRL, dra7_mcasp8_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:0184:22" },
+ 	{ DRA7_L4PER2_MCASP4_CLKCTRL, dra7_mcasp4_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:018c:22" },
+ 	{ DRA7_L4PER2_UART7_CLKCTRL, dra7_uart7_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:01c4:24" },
+ 	{ DRA7_L4PER2_UART8_CLKCTRL, dra7_uart8_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:01d4:24" },
+@@ -828,8 +828,8 @@ static struct ti_dt_clk dra7xx_clks[] = {
+ 	DT_CLK(NULL, "mcasp6_aux_gfclk_mux", "l4per2-clkctrl:01f8:22"),
+ 	DT_CLK(NULL, "mcasp7_ahclkx_mux", "l4per2-clkctrl:01fc:24"),
+ 	DT_CLK(NULL, "mcasp7_aux_gfclk_mux", "l4per2-clkctrl:01fc:22"),
+-	DT_CLK(NULL, "mcasp8_ahclkx_mux", "l4per2-clkctrl:0184:22"),
+-	DT_CLK(NULL, "mcasp8_aux_gfclk_mux", "l4per2-clkctrl:0184:24"),
++	DT_CLK(NULL, "mcasp8_ahclkx_mux", "l4per2-clkctrl:0184:24"),
++	DT_CLK(NULL, "mcasp8_aux_gfclk_mux", "l4per2-clkctrl:0184:22"),
+ 	DT_CLK(NULL, "mmc1_clk32k", "l3init-clkctrl:0008:8"),
+ 	DT_CLK(NULL, "mmc1_fclk_div", "l3init-clkctrl:0008:25"),
+ 	DT_CLK(NULL, "mmc1_fclk_mux", "l3init-clkctrl:0008:24"),
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index c28ebf2810f1..f970f87ce86e 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -2746,14 +2746,6 @@ int cpufreq_unregister_driver(struct cpufreq_driver *driver)
+ }
+ EXPORT_SYMBOL_GPL(cpufreq_unregister_driver);
+ 
+-/*
+- * Stop cpufreq at shutdown to make sure it isn't holding any locks
+- * or mutexes when secondary CPUs are halted.
+- */
+-static struct syscore_ops cpufreq_syscore_ops = {
+-	.shutdown = cpufreq_suspend,
+-};
+-
+ struct kobject *cpufreq_global_kobject;
+ EXPORT_SYMBOL(cpufreq_global_kobject);
+ 
+@@ -2765,8 +2757,6 @@ static int __init cpufreq_core_init(void)
+ 	cpufreq_global_kobject = kobject_create_and_add("cpufreq", &cpu_subsys.dev_root->kobj);
+ 	BUG_ON(!cpufreq_global_kobject);
+ 
+-	register_syscore_ops(&cpufreq_syscore_ops);
+-
+ 	return 0;
+ }
+ module_param(off, int, 0444);
+diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c
+index 7f19f1c672c3..2059e43ccc01 100644
+--- a/drivers/edac/ghes_edac.c
++++ b/drivers/edac/ghes_edac.c
+@@ -553,7 +553,11 @@ void ghes_edac_unregister(struct ghes *ghes)
+ 	if (!ghes_pvt)
+ 		return;
+ 
++	if (atomic_dec_return(&ghes_init))
++		return;
++
+ 	mci = ghes_pvt->mci;
++	ghes_pvt = NULL;
+ 	edac_mc_del_mc(mci->pdev);
+ 	edac_mc_free(mci);
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+index eba42c752bca..82155ac3288a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+@@ -189,7 +189,7 @@ static int acp_hw_init(void *handle)
+ 	u32 val = 0;
+ 	u32 count = 0;
+ 	struct device *dev;
+-	struct i2s_platform_data *i2s_pdata;
++	struct i2s_platform_data *i2s_pdata = NULL;
+ 
+ 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+ 
+@@ -231,20 +231,21 @@ static int acp_hw_init(void *handle)
+ 	adev->acp.acp_cell = kcalloc(ACP_DEVS, sizeof(struct mfd_cell),
+ 							GFP_KERNEL);
+ 
+-	if (adev->acp.acp_cell == NULL)
+-		return -ENOMEM;
++	if (adev->acp.acp_cell == NULL) {
++		r = -ENOMEM;
++		goto failure;
++	}
+ 
+ 	adev->acp.acp_res = kcalloc(5, sizeof(struct resource), GFP_KERNEL);
+ 	if (adev->acp.acp_res == NULL) {
+-		kfree(adev->acp.acp_cell);
+-		return -ENOMEM;
++		r = -ENOMEM;
++		goto failure;
+ 	}
+ 
+ 	i2s_pdata = kcalloc(3, sizeof(struct i2s_platform_data), GFP_KERNEL);
+ 	if (i2s_pdata == NULL) {
+-		kfree(adev->acp.acp_res);
+-		kfree(adev->acp.acp_cell);
+-		return -ENOMEM;
++		r = -ENOMEM;
++		goto failure;
+ 	}
+ 
+ 	switch (adev->asic_type) {
+@@ -341,14 +342,14 @@ static int acp_hw_init(void *handle)
+ 	r = mfd_add_hotplug_devices(adev->acp.parent, adev->acp.acp_cell,
+ 								ACP_DEVS);
+ 	if (r)
+-		return r;
++		goto failure;
+ 
+ 	for (i = 0; i < ACP_DEVS ; i++) {
+ 		dev = get_mfd_cell_dev(adev->acp.acp_cell[i].name, i);
+ 		r = pm_genpd_add_device(&adev->acp.acp_genpd->gpd, dev);
+ 		if (r) {
+ 			dev_err(dev, "Failed to add dev to genpd\n");
+-			return r;
++			goto failure;
+ 		}
+ 	}
+ 
+@@ -367,7 +368,8 @@ static int acp_hw_init(void *handle)
+ 			break;
+ 		if (--count == 0) {
+ 			dev_err(&adev->pdev->dev, "Failed to reset ACP\n");
+-			return -ETIMEDOUT;
++			r = -ETIMEDOUT;
++			goto failure;
+ 		}
+ 		udelay(100);
+ 	}
+@@ -384,7 +386,8 @@ static int acp_hw_init(void *handle)
+ 			break;
+ 		if (--count == 0) {
+ 			dev_err(&adev->pdev->dev, "Failed to reset ACP\n");
+-			return -ETIMEDOUT;
++			r = -ETIMEDOUT;
++			goto failure;
+ 		}
+ 		udelay(100);
+ 	}
+@@ -393,6 +396,13 @@ static int acp_hw_init(void *handle)
+ 	val &= ~ACP_SOFT_RESET__SoftResetAud_MASK;
+ 	cgs_write_register(adev->acp.cgs_device, mmACP_SOFT_RESET, val);
+ 	return 0;
++
++failure:
++	kfree(i2s_pdata);
++	kfree(adev->acp.acp_res);
++	kfree(adev->acp.acp_cell);
++	kfree(adev->acp.acp_genpd);
++	return r;
+ }
+ 
+ /**
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 8b26c970a3cb..90df22081a25 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -536,7 +536,6 @@ static int amdgpu_cs_list_validate(struct amdgpu_cs_parser *p,
+ 
+ 	list_for_each_entry(lobj, validated, tv.head) {
+ 		struct amdgpu_bo *bo = ttm_to_amdgpu_bo(lobj->tv.bo);
+-		bool binding_userptr = false;
+ 		struct mm_struct *usermm;
+ 
+ 		usermm = amdgpu_ttm_tt_get_usermm(bo->tbo.ttm);
+@@ -553,7 +552,6 @@ static int amdgpu_cs_list_validate(struct amdgpu_cs_parser *p,
+ 
+ 			amdgpu_ttm_tt_set_user_pages(bo->tbo.ttm,
+ 						     lobj->user_pages);
+-			binding_userptr = true;
+ 		}
+ 
+ 		if (p->evictable == lobj)
+@@ -563,10 +561,8 @@ static int amdgpu_cs_list_validate(struct amdgpu_cs_parser *p,
+ 		if (r)
+ 			return r;
+ 
+-		if (binding_userptr) {
+-			kvfree(lobj->user_pages);
+-			lobj->user_pages = NULL;
+-		}
++		kvfree(lobj->user_pages);
++		lobj->user_pages = NULL;
+ 	}
+ 	return 0;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 5376328d3fd0..a7cd4a03bf38 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -1030,6 +1030,41 @@ static int amdgpu_pci_probe(struct pci_dev *pdev,
+ 		return -ENODEV;
+ 	}
+ 
++#ifdef CONFIG_DRM_AMDGPU_SI
++	if (!amdgpu_si_support) {
++		switch (flags & AMD_ASIC_MASK) {
++		case CHIP_TAHITI:
++		case CHIP_PITCAIRN:
++		case CHIP_VERDE:
++		case CHIP_OLAND:
++		case CHIP_HAINAN:
++			dev_info(&pdev->dev,
++				 "SI support provided by radeon.\n");
++			dev_info(&pdev->dev,
++				 "Use radeon.si_support=0 amdgpu.si_support=1 to override.\n"
++				);
++			return -ENODEV;
++		}
++	}
++#endif
++#ifdef CONFIG_DRM_AMDGPU_CIK
++	if (!amdgpu_cik_support) {
++		switch (flags & AMD_ASIC_MASK) {
++		case CHIP_KAVERI:
++		case CHIP_BONAIRE:
++		case CHIP_HAWAII:
++		case CHIP_KABINI:
++		case CHIP_MULLINS:
++			dev_info(&pdev->dev,
++				 "CIK support provided by radeon.\n");
++			dev_info(&pdev->dev,
++				 "Use radeon.cik_support=0 amdgpu.cik_support=1 to override.\n"
++				);
++			return -ENODEV;
++		}
++	}
++#endif
++
+ 	/* Get rid of things like offb */
+ 	ret = drm_fb_helper_remove_conflicting_pci_framebuffers(pdev, 0, "amdgpudrmfb");
+ 	if (ret)
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index 00beba533582..56b4c241a14b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -144,41 +144,6 @@ int amdgpu_driver_load_kms(struct drm_device *dev, unsigned long flags)
+ 	struct amdgpu_device *adev;
+ 	int r, acpi_status;
+ 
+-#ifdef CONFIG_DRM_AMDGPU_SI
+-	if (!amdgpu_si_support) {
+-		switch (flags & AMD_ASIC_MASK) {
+-		case CHIP_TAHITI:
+-		case CHIP_PITCAIRN:
+-		case CHIP_VERDE:
+-		case CHIP_OLAND:
+-		case CHIP_HAINAN:
+-			dev_info(dev->dev,
+-				 "SI support provided by radeon.\n");
+-			dev_info(dev->dev,
+-				 "Use radeon.si_support=0 amdgpu.si_support=1 to override.\n"
+-				);
+-			return -ENODEV;
+-		}
+-	}
+-#endif
+-#ifdef CONFIG_DRM_AMDGPU_CIK
+-	if (!amdgpu_cik_support) {
+-		switch (flags & AMD_ASIC_MASK) {
+-		case CHIP_KAVERI:
+-		case CHIP_BONAIRE:
+-		case CHIP_HAWAII:
+-		case CHIP_KABINI:
+-		case CHIP_MULLINS:
+-			dev_info(dev->dev,
+-				 "CIK support provided by radeon.\n");
+-			dev_info(dev->dev,
+-				 "Use radeon.cik_support=0 amdgpu.cik_support=1 to override.\n"
+-				);
+-			return -ENODEV;
+-		}
+-	}
+-#endif
+-
+ 	adev = kzalloc(sizeof(struct amdgpu_device), GFP_KERNEL);
+ 	if (adev == NULL) {
+ 		return -ENOMEM;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+index b70b3c45bb29..65044b1b3d4c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+@@ -429,13 +429,14 @@ void amdgpu_vce_free_handles(struct amdgpu_device *adev, struct drm_file *filp)
+  * Open up a stream for HW test
+  */
+ int amdgpu_vce_get_create_msg(struct amdgpu_ring *ring, uint32_t handle,
++			      struct amdgpu_bo *bo,
+ 			      struct dma_fence **fence)
+ {
+ 	const unsigned ib_size_dw = 1024;
+ 	struct amdgpu_job *job;
+ 	struct amdgpu_ib *ib;
+ 	struct dma_fence *f = NULL;
+-	uint64_t dummy;
++	uint64_t addr;
+ 	int i, r;
+ 
+ 	r = amdgpu_job_alloc_with_ib(ring->adev, ib_size_dw * 4, &job);
+@@ -444,7 +445,7 @@ int amdgpu_vce_get_create_msg(struct amdgpu_ring *ring, uint32_t handle,
+ 
+ 	ib = &job->ibs[0];
+ 
+-	dummy = ib->gpu_addr + 1024;
++	addr = amdgpu_bo_gpu_offset(bo);
+ 
+ 	/* stitch together an VCE create msg */
+ 	ib->length_dw = 0;
+@@ -476,8 +477,8 @@ int amdgpu_vce_get_create_msg(struct amdgpu_ring *ring, uint32_t handle,
+ 
+ 	ib->ptr[ib->length_dw++] = 0x00000014; /* len */
+ 	ib->ptr[ib->length_dw++] = 0x05000005; /* feedback buffer */
+-	ib->ptr[ib->length_dw++] = upper_32_bits(dummy);
+-	ib->ptr[ib->length_dw++] = dummy;
++	ib->ptr[ib->length_dw++] = upper_32_bits(addr);
++	ib->ptr[ib->length_dw++] = addr;
+ 	ib->ptr[ib->length_dw++] = 0x00000001;
+ 
+ 	for (i = ib->length_dw; i < ib_size_dw; ++i)
+@@ -1110,13 +1111,20 @@ int amdgpu_vce_ring_test_ring(struct amdgpu_ring *ring)
+ int amdgpu_vce_ring_test_ib(struct amdgpu_ring *ring, long timeout)
+ {
+ 	struct dma_fence *fence = NULL;
++	struct amdgpu_bo *bo = NULL;
+ 	long r;
+ 
+ 	/* skip vce ring1/2 ib test for now, since it's not reliable */
+ 	if (ring != &ring->adev->vce.ring[0])
+ 		return 0;
+ 
+-	r = amdgpu_vce_get_create_msg(ring, 1, NULL);
++	r = amdgpu_bo_create_reserved(ring->adev, 512, PAGE_SIZE,
++				      AMDGPU_GEM_DOMAIN_VRAM,
++				      &bo, NULL, NULL);
++	if (r)
++		return r;
++
++	r = amdgpu_vce_get_create_msg(ring, 1, bo, NULL);
+ 	if (r)
+ 		goto error;
+ 
+@@ -1132,5 +1140,7 @@ int amdgpu_vce_ring_test_ib(struct amdgpu_ring *ring, long timeout)
+ 
+ error:
+ 	dma_fence_put(fence);
++	amdgpu_bo_unreserve(bo);
++	amdgpu_bo_unref(&bo);
+ 	return r;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.h
+index 30ea54dd9117..e802f7d9db0a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.h
+@@ -59,6 +59,7 @@ int amdgpu_vce_entity_init(struct amdgpu_device *adev);
+ int amdgpu_vce_suspend(struct amdgpu_device *adev);
+ int amdgpu_vce_resume(struct amdgpu_device *adev);
+ int amdgpu_vce_get_create_msg(struct amdgpu_ring *ring, uint32_t handle,
++			      struct amdgpu_bo *bo,
+ 			      struct dma_fence **fence);
+ int amdgpu_vce_get_destroy_msg(struct amdgpu_ring *ring, uint32_t handle,
+ 			       bool direct, struct dma_fence **fence);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+index 2e12eeb314a7..a3fe8b01d234 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+@@ -517,13 +517,14 @@ int amdgpu_vcn_enc_ring_test_ring(struct amdgpu_ring *ring)
+ }
+ 
+ static int amdgpu_vcn_enc_get_create_msg(struct amdgpu_ring *ring, uint32_t handle,
+-			      struct dma_fence **fence)
++					 struct amdgpu_bo *bo,
++					 struct dma_fence **fence)
+ {
+ 	const unsigned ib_size_dw = 16;
+ 	struct amdgpu_job *job;
+ 	struct amdgpu_ib *ib;
+ 	struct dma_fence *f = NULL;
+-	uint64_t dummy;
++	uint64_t addr;
+ 	int i, r;
+ 
+ 	r = amdgpu_job_alloc_with_ib(ring->adev, ib_size_dw * 4, &job);
+@@ -531,14 +532,14 @@ static int amdgpu_vcn_enc_get_create_msg(struct amdgpu_ring *ring, uint32_t hand
+ 		return r;
+ 
+ 	ib = &job->ibs[0];
+-	dummy = ib->gpu_addr + 1024;
++	addr = amdgpu_bo_gpu_offset(bo);
+ 
+ 	ib->length_dw = 0;
+ 	ib->ptr[ib->length_dw++] = 0x00000018;
+ 	ib->ptr[ib->length_dw++] = 0x00000001; /* session info */
+ 	ib->ptr[ib->length_dw++] = handle;
+-	ib->ptr[ib->length_dw++] = upper_32_bits(dummy);
+-	ib->ptr[ib->length_dw++] = dummy;
++	ib->ptr[ib->length_dw++] = upper_32_bits(addr);
++	ib->ptr[ib->length_dw++] = addr;
+ 	ib->ptr[ib->length_dw++] = 0x0000000b;
+ 
+ 	ib->ptr[ib->length_dw++] = 0x00000014;
+@@ -569,13 +570,14 @@ err:
+ }
+ 
+ static int amdgpu_vcn_enc_get_destroy_msg(struct amdgpu_ring *ring, uint32_t handle,
+-				struct dma_fence **fence)
++					  struct amdgpu_bo *bo,
++					  struct dma_fence **fence)
+ {
+ 	const unsigned ib_size_dw = 16;
+ 	struct amdgpu_job *job;
+ 	struct amdgpu_ib *ib;
+ 	struct dma_fence *f = NULL;
+-	uint64_t dummy;
++	uint64_t addr;
+ 	int i, r;
+ 
+ 	r = amdgpu_job_alloc_with_ib(ring->adev, ib_size_dw * 4, &job);
+@@ -583,14 +585,14 @@ static int amdgpu_vcn_enc_get_destroy_msg(struct amdgpu_ring *ring, uint32_t han
+ 		return r;
+ 
+ 	ib = &job->ibs[0];
+-	dummy = ib->gpu_addr + 1024;
++	addr = amdgpu_bo_gpu_offset(bo);
+ 
+ 	ib->length_dw = 0;
+ 	ib->ptr[ib->length_dw++] = 0x00000018;
+ 	ib->ptr[ib->length_dw++] = 0x00000001;
+ 	ib->ptr[ib->length_dw++] = handle;
+-	ib->ptr[ib->length_dw++] = upper_32_bits(dummy);
+-	ib->ptr[ib->length_dw++] = dummy;
++	ib->ptr[ib->length_dw++] = upper_32_bits(addr);
++	ib->ptr[ib->length_dw++] = addr;
+ 	ib->ptr[ib->length_dw++] = 0x0000000b;
+ 
+ 	ib->ptr[ib->length_dw++] = 0x00000014;
+@@ -623,13 +625,20 @@ err:
+ int amdgpu_vcn_enc_ring_test_ib(struct amdgpu_ring *ring, long timeout)
+ {
+ 	struct dma_fence *fence = NULL;
++	struct amdgpu_bo *bo = NULL;
+ 	long r;
+ 
+-	r = amdgpu_vcn_enc_get_create_msg(ring, 1, NULL);
++	r = amdgpu_bo_create_reserved(ring->adev, 128 * 1024, PAGE_SIZE,
++				      AMDGPU_GEM_DOMAIN_VRAM,
++				      &bo, NULL, NULL);
++	if (r)
++		return r;
++
++	r = amdgpu_vcn_enc_get_create_msg(ring, 1, bo, NULL);
+ 	if (r)
+ 		goto error;
+ 
+-	r = amdgpu_vcn_enc_get_destroy_msg(ring, 1, &fence);
++	r = amdgpu_vcn_enc_get_destroy_msg(ring, 1, bo, &fence);
+ 	if (r)
+ 		goto error;
+ 
+@@ -641,6 +650,8 @@ int amdgpu_vcn_enc_ring_test_ib(struct amdgpu_ring *ring, long timeout)
+ 
+ error:
+ 	dma_fence_put(fence);
++	amdgpu_bo_unreserve(bo);
++	amdgpu_bo_unref(&bo);
+ 	return r;
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
+index 15c371fac469..0d131e1d6efc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
+@@ -1086,7 +1086,7 @@ static void sdma_v5_0_ring_emit_pipeline_sync(struct amdgpu_ring *ring)
+ 	amdgpu_ring_write(ring, addr & 0xfffffffc);
+ 	amdgpu_ring_write(ring, upper_32_bits(addr) & 0xffffffff);
+ 	amdgpu_ring_write(ring, seq); /* reference */
+-	amdgpu_ring_write(ring, 0xfffffff); /* mask */
++	amdgpu_ring_write(ring, 0xffffffff); /* mask */
+ 	amdgpu_ring_write(ring, SDMA_PKT_POLL_REGMEM_DW5_RETRY_COUNT(0xfff) |
+ 			  SDMA_PKT_POLL_REGMEM_DW5_INTERVAL(4)); /* retry count, poll interval */
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+index 670784a78512..217084d56ab8 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+@@ -206,13 +206,14 @@ static int uvd_v6_0_enc_ring_test_ring(struct amdgpu_ring *ring)
+  * Open up a stream for HW test
+  */
+ static int uvd_v6_0_enc_get_create_msg(struct amdgpu_ring *ring, uint32_t handle,
++				       struct amdgpu_bo *bo,
+ 				       struct dma_fence **fence)
+ {
+ 	const unsigned ib_size_dw = 16;
+ 	struct amdgpu_job *job;
+ 	struct amdgpu_ib *ib;
+ 	struct dma_fence *f = NULL;
+-	uint64_t dummy;
++	uint64_t addr;
+ 	int i, r;
+ 
+ 	r = amdgpu_job_alloc_with_ib(ring->adev, ib_size_dw * 4, &job);
+@@ -220,15 +221,15 @@ static int uvd_v6_0_enc_get_create_msg(struct amdgpu_ring *ring, uint32_t handle
+ 		return r;
+ 
+ 	ib = &job->ibs[0];
+-	dummy = ib->gpu_addr + 1024;
++	addr = amdgpu_bo_gpu_offset(bo);
+ 
+ 	ib->length_dw = 0;
+ 	ib->ptr[ib->length_dw++] = 0x00000018;
+ 	ib->ptr[ib->length_dw++] = 0x00000001; /* session info */
+ 	ib->ptr[ib->length_dw++] = handle;
+ 	ib->ptr[ib->length_dw++] = 0x00010000;
+-	ib->ptr[ib->length_dw++] = upper_32_bits(dummy);
+-	ib->ptr[ib->length_dw++] = dummy;
++	ib->ptr[ib->length_dw++] = upper_32_bits(addr);
++	ib->ptr[ib->length_dw++] = addr;
+ 
+ 	ib->ptr[ib->length_dw++] = 0x00000014;
+ 	ib->ptr[ib->length_dw++] = 0x00000002; /* task info */
+@@ -268,13 +269,14 @@ err:
+  */
+ static int uvd_v6_0_enc_get_destroy_msg(struct amdgpu_ring *ring,
+ 					uint32_t handle,
++					struct amdgpu_bo *bo,
+ 					struct dma_fence **fence)
+ {
+ 	const unsigned ib_size_dw = 16;
+ 	struct amdgpu_job *job;
+ 	struct amdgpu_ib *ib;
+ 	struct dma_fence *f = NULL;
+-	uint64_t dummy;
++	uint64_t addr;
+ 	int i, r;
+ 
+ 	r = amdgpu_job_alloc_with_ib(ring->adev, ib_size_dw * 4, &job);
+@@ -282,15 +284,15 @@ static int uvd_v6_0_enc_get_destroy_msg(struct amdgpu_ring *ring,
+ 		return r;
+ 
+ 	ib = &job->ibs[0];
+-	dummy = ib->gpu_addr + 1024;
++	addr = amdgpu_bo_gpu_offset(bo);
+ 
+ 	ib->length_dw = 0;
+ 	ib->ptr[ib->length_dw++] = 0x00000018;
+ 	ib->ptr[ib->length_dw++] = 0x00000001; /* session info */
+ 	ib->ptr[ib->length_dw++] = handle;
+ 	ib->ptr[ib->length_dw++] = 0x00010000;
+-	ib->ptr[ib->length_dw++] = upper_32_bits(dummy);
+-	ib->ptr[ib->length_dw++] = dummy;
++	ib->ptr[ib->length_dw++] = upper_32_bits(addr);
++	ib->ptr[ib->length_dw++] = addr;
+ 
+ 	ib->ptr[ib->length_dw++] = 0x00000014;
+ 	ib->ptr[ib->length_dw++] = 0x00000002; /* task info */
+@@ -327,13 +329,20 @@ err:
+ static int uvd_v6_0_enc_ring_test_ib(struct amdgpu_ring *ring, long timeout)
+ {
+ 	struct dma_fence *fence = NULL;
++	struct amdgpu_bo *bo = NULL;
+ 	long r;
+ 
+-	r = uvd_v6_0_enc_get_create_msg(ring, 1, NULL);
++	r = amdgpu_bo_create_reserved(ring->adev, 128 * 1024, PAGE_SIZE,
++				      AMDGPU_GEM_DOMAIN_VRAM,
++				      &bo, NULL, NULL);
++	if (r)
++		return r;
++
++	r = uvd_v6_0_enc_get_create_msg(ring, 1, bo, NULL);
+ 	if (r)
+ 		goto error;
+ 
+-	r = uvd_v6_0_enc_get_destroy_msg(ring, 1, &fence);
++	r = uvd_v6_0_enc_get_destroy_msg(ring, 1, bo, &fence);
+ 	if (r)
+ 		goto error;
+ 
+@@ -345,6 +354,8 @@ static int uvd_v6_0_enc_ring_test_ib(struct amdgpu_ring *ring, long timeout)
+ 
+ error:
+ 	dma_fence_put(fence);
++	amdgpu_bo_unreserve(bo);
++	amdgpu_bo_unref(&bo);
+ 	return r;
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c
+index a6bfe7651d07..c5e2f8c1741b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c
+@@ -214,13 +214,14 @@ static int uvd_v7_0_enc_ring_test_ring(struct amdgpu_ring *ring)
+  * Open up a stream for HW test
+  */
+ static int uvd_v7_0_enc_get_create_msg(struct amdgpu_ring *ring, uint32_t handle,
++				       struct amdgpu_bo *bo,
+ 				       struct dma_fence **fence)
+ {
+ 	const unsigned ib_size_dw = 16;
+ 	struct amdgpu_job *job;
+ 	struct amdgpu_ib *ib;
+ 	struct dma_fence *f = NULL;
+-	uint64_t dummy;
++	uint64_t addr;
+ 	int i, r;
+ 
+ 	r = amdgpu_job_alloc_with_ib(ring->adev, ib_size_dw * 4, &job);
+@@ -228,15 +229,15 @@ static int uvd_v7_0_enc_get_create_msg(struct amdgpu_ring *ring, uint32_t handle
+ 		return r;
+ 
+ 	ib = &job->ibs[0];
+-	dummy = ib->gpu_addr + 1024;
++	addr = amdgpu_bo_gpu_offset(bo);
+ 
+ 	ib->length_dw = 0;
+ 	ib->ptr[ib->length_dw++] = 0x00000018;
+ 	ib->ptr[ib->length_dw++] = 0x00000001; /* session info */
+ 	ib->ptr[ib->length_dw++] = handle;
+ 	ib->ptr[ib->length_dw++] = 0x00000000;
+-	ib->ptr[ib->length_dw++] = upper_32_bits(dummy);
+-	ib->ptr[ib->length_dw++] = dummy;
++	ib->ptr[ib->length_dw++] = upper_32_bits(addr);
++	ib->ptr[ib->length_dw++] = addr;
+ 
+ 	ib->ptr[ib->length_dw++] = 0x00000014;
+ 	ib->ptr[ib->length_dw++] = 0x00000002; /* task info */
+@@ -275,13 +276,14 @@ err:
+  * Close up a stream for HW test or if userspace failed to do so
+  */
+ static int uvd_v7_0_enc_get_destroy_msg(struct amdgpu_ring *ring, uint32_t handle,
+-				struct dma_fence **fence)
++					struct amdgpu_bo *bo,
++					struct dma_fence **fence)
+ {
+ 	const unsigned ib_size_dw = 16;
+ 	struct amdgpu_job *job;
+ 	struct amdgpu_ib *ib;
+ 	struct dma_fence *f = NULL;
+-	uint64_t dummy;
++	uint64_t addr;
+ 	int i, r;
+ 
+ 	r = amdgpu_job_alloc_with_ib(ring->adev, ib_size_dw * 4, &job);
+@@ -289,15 +291,15 @@ static int uvd_v7_0_enc_get_destroy_msg(struct amdgpu_ring *ring, uint32_t handl
+ 		return r;
+ 
+ 	ib = &job->ibs[0];
+-	dummy = ib->gpu_addr + 1024;
++	addr = amdgpu_bo_gpu_offset(bo);
+ 
+ 	ib->length_dw = 0;
+ 	ib->ptr[ib->length_dw++] = 0x00000018;
+ 	ib->ptr[ib->length_dw++] = 0x00000001;
+ 	ib->ptr[ib->length_dw++] = handle;
+ 	ib->ptr[ib->length_dw++] = 0x00000000;
+-	ib->ptr[ib->length_dw++] = upper_32_bits(dummy);
+-	ib->ptr[ib->length_dw++] = dummy;
++	ib->ptr[ib->length_dw++] = upper_32_bits(addr);
++	ib->ptr[ib->length_dw++] = addr;
+ 
+ 	ib->ptr[ib->length_dw++] = 0x00000014;
+ 	ib->ptr[ib->length_dw++] = 0x00000002;
+@@ -334,13 +336,20 @@ err:
+ static int uvd_v7_0_enc_ring_test_ib(struct amdgpu_ring *ring, long timeout)
+ {
+ 	struct dma_fence *fence = NULL;
++	struct amdgpu_bo *bo = NULL;
+ 	long r;
+ 
+-	r = uvd_v7_0_enc_get_create_msg(ring, 1, NULL);
++	r = amdgpu_bo_create_reserved(ring->adev, 128 * 1024, PAGE_SIZE,
++				      AMDGPU_GEM_DOMAIN_VRAM,
++				      &bo, NULL, NULL);
++	if (r)
++		return r;
++
++	r = uvd_v7_0_enc_get_create_msg(ring, 1, bo, NULL);
+ 	if (r)
+ 		goto error;
+ 
+-	r = uvd_v7_0_enc_get_destroy_msg(ring, 1, &fence);
++	r = uvd_v7_0_enc_get_destroy_msg(ring, 1, bo, &fence);
+ 	if (r)
+ 		goto error;
+ 
+@@ -352,6 +361,8 @@ static int uvd_v7_0_enc_ring_test_ib(struct amdgpu_ring *ring, long timeout)
+ 
+ error:
+ 	dma_fence_put(fence);
++	amdgpu_bo_unreserve(bo);
++	amdgpu_bo_unref(&bo);
+ 	return r;
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
+index 6248c8455314..45f74219e79e 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
+@@ -668,6 +668,7 @@ struct clock_source *dce100_clock_source_create(
+ 		return &clk_src->base;
+ 	}
+ 
++	kfree(clk_src);
+ 	BREAK_TO_DEBUGGER();
+ 	return NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
+index 764329264c3b..0cb83b0e0e1e 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
+@@ -714,6 +714,7 @@ struct clock_source *dce110_clock_source_create(
+ 		return &clk_src->base;
+ 	}
+ 
++	kfree(clk_src);
+ 	BREAK_TO_DEBUGGER();
+ 	return NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c b/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c
+index 7a04be74c9cf..918455caa9a6 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c
+@@ -687,6 +687,7 @@ struct clock_source *dce112_clock_source_create(
+ 		return &clk_src->base;
+ 	}
+ 
++	kfree(clk_src);
+ 	BREAK_TO_DEBUGGER();
+ 	return NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c b/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
+index ae38c9c7277c..49f3f0fad763 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
+@@ -500,6 +500,7 @@ static struct clock_source *dce120_clock_source_create(
+ 		return &clk_src->base;
+ 	}
+ 
++	kfree(clk_src);
+ 	BREAK_TO_DEBUGGER();
+ 	return NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c b/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
+index 860a524ebcfa..952440893fbb 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
+@@ -701,6 +701,7 @@ struct clock_source *dce80_clock_source_create(
+ 		return &clk_src->base;
+ 	}
+ 
++	kfree(clk_src);
+ 	BREAK_TO_DEBUGGER();
+ 	return NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
+index a12530a3ab9c..3f25e8da5396 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
+@@ -786,6 +786,7 @@ struct clock_source *dcn10_clock_source_create(
+ 		return &clk_src->base;
+ 	}
+ 
++	kfree(clk_src);
+ 	BREAK_TO_DEBUGGER();
+ 	return NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+index b949e202d6cb..5b7ff6c549f1 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+@@ -955,6 +955,7 @@ struct clock_source *dcn20_clock_source_create(
+ 		return &clk_src->base;
+ 	}
+ 
++	kfree(clk_src);
+ 	BREAK_TO_DEBUGGER();
+ 	return NULL;
+ }
+diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
+index 2851cac94d86..b72840c06ab7 100644
+--- a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
++++ b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
+@@ -43,9 +43,8 @@ komeda_wb_encoder_atomic_check(struct drm_encoder *encoder,
+ 	struct komeda_data_flow_cfg dflow;
+ 	int err;
+ 
+-	if (!writeback_job || !writeback_job->fb) {
++	if (!writeback_job)
+ 		return 0;
+-	}
+ 
+ 	if (!crtc_st->active) {
+ 		DRM_DEBUG_ATOMIC("Cannot write the composition result out on a inactive CRTC.\n");
+@@ -166,8 +165,10 @@ static int komeda_wb_connector_add(struct komeda_kms_dev *kms,
+ 					   &komeda_wb_encoder_helper_funcs,
+ 					   formats, n_formats);
+ 	komeda_put_fourcc_list(formats);
+-	if (err)
++	if (err) {
++		kfree(kwb_conn);
+ 		return err;
++	}
+ 
+ 	drm_connector_helper_add(&wb_conn->base, &komeda_wb_conn_helper_funcs);
+ 
+diff --git a/drivers/gpu/drm/arm/malidp_mw.c b/drivers/gpu/drm/arm/malidp_mw.c
+index 2e812525025d..a59227b2cdb5 100644
+--- a/drivers/gpu/drm/arm/malidp_mw.c
++++ b/drivers/gpu/drm/arm/malidp_mw.c
+@@ -130,7 +130,7 @@ malidp_mw_encoder_atomic_check(struct drm_encoder *encoder,
+ 	struct drm_framebuffer *fb;
+ 	int i, n_planes;
+ 
+-	if (!conn_state->writeback_job || !conn_state->writeback_job->fb)
++	if (!conn_state->writeback_job)
+ 		return 0;
+ 
+ 	fb = conn_state->writeback_job->fb;
+@@ -247,7 +247,7 @@ void malidp_mw_atomic_commit(struct drm_device *drm,
+ 
+ 	mw_state = to_mw_state(conn_state);
+ 
+-	if (conn_state->writeback_job && conn_state->writeback_job->fb) {
++	if (conn_state->writeback_job) {
+ 		struct drm_framebuffer *fb = conn_state->writeback_job->fb;
+ 
+ 		DRM_DEV_DEBUG_DRIVER(drm->dev,
+diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
+index 419381abbdd1..14aeaf736321 100644
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -430,10 +430,15 @@ static int drm_atomic_connector_check(struct drm_connector *connector,
+ 		return -EINVAL;
+ 	}
+ 
+-	if (writeback_job->out_fence && !writeback_job->fb) {
+-		DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] requesting out-fence without framebuffer\n",
+-				 connector->base.id, connector->name);
+-		return -EINVAL;
++	if (!writeback_job->fb) {
++		if (writeback_job->out_fence) {
++			DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] requesting out-fence without framebuffer\n",
++					 connector->base.id, connector->name);
++			return -EINVAL;
++		}
++
++		drm_writeback_cleanup_job(writeback_job);
++		state->writeback_job = NULL;
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 82a4ceed3fcf..6b0177112e18 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -159,6 +159,9 @@ static const struct edid_quirk {
+ 	/* Medion MD 30217 PG */
+ 	{ "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
+ 
++	/* Lenovo G50 */
++	{ "SDC", 18514, EDID_QUIRK_FORCE_6BPC },
++
+ 	/* Panel in Samsung NP700G7A-S01PL notebook reports 6bpc */
+ 	{ "SEC", 0xd033, EDID_QUIRK_FORCE_8BPC },
+ 
+diff --git a/drivers/gpu/drm/drm_writeback.c b/drivers/gpu/drm/drm_writeback.c
+index ff138b6ec48b..43d9e3bb3a94 100644
+--- a/drivers/gpu/drm/drm_writeback.c
++++ b/drivers/gpu/drm/drm_writeback.c
+@@ -324,6 +324,9 @@ void drm_writeback_cleanup_job(struct drm_writeback_job *job)
+ 	if (job->fb)
+ 		drm_framebuffer_put(job->fb);
+ 
++	if (job->out_fence)
++		dma_fence_put(job->out_fence);
++
+ 	kfree(job);
+ }
+ EXPORT_SYMBOL(drm_writeback_cleanup_job);
+@@ -366,25 +369,29 @@ drm_writeback_signal_completion(struct drm_writeback_connector *wb_connector,
+ {
+ 	unsigned long flags;
+ 	struct drm_writeback_job *job;
++	struct dma_fence *out_fence;
+ 
+ 	spin_lock_irqsave(&wb_connector->job_lock, flags);
+ 	job = list_first_entry_or_null(&wb_connector->job_queue,
+ 				       struct drm_writeback_job,
+ 				       list_entry);
+-	if (job) {
++	if (job)
+ 		list_del(&job->list_entry);
+-		if (job->out_fence) {
+-			if (status)
+-				dma_fence_set_error(job->out_fence, status);
+-			dma_fence_signal(job->out_fence);
+-			dma_fence_put(job->out_fence);
+-		}
+-	}
++
+ 	spin_unlock_irqrestore(&wb_connector->job_lock, flags);
+ 
+ 	if (WARN_ON(!job))
+ 		return;
+ 
++	out_fence = job->out_fence;
++	if (out_fence) {
++		if (status)
++			dma_fence_set_error(out_fence, status);
++		dma_fence_signal(out_fence);
++		dma_fence_put(out_fence);
++		job->out_fence = NULL;
++	}
++
+ 	INIT_WORK(&job->cleanup_work, cleanup_work);
+ 	queue_work(system_long_wq, &job->cleanup_work);
+ }
+diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
+index 3ef4e9f573cf..b1025c248bb9 100644
+--- a/drivers/gpu/drm/i915/display/intel_bios.c
++++ b/drivers/gpu/drm/i915/display/intel_bios.c
+@@ -1269,7 +1269,7 @@ static void sanitize_ddc_pin(struct drm_i915_private *dev_priv,
+ 		DRM_DEBUG_KMS("port %c trying to use the same DDC pin (0x%x) as port %c, "
+ 			      "disabling port %c DVI/HDMI support\n",
+ 			      port_name(port), info->alternate_ddc_pin,
+-			      port_name(p), port_name(port));
++			      port_name(p), port_name(p));
+ 
+ 		/*
+ 		 * If we have multiple ports supposedly sharing the
+@@ -1277,9 +1277,14 @@ static void sanitize_ddc_pin(struct drm_i915_private *dev_priv,
+ 		 * port. Otherwise they share the same ddc bin and
+ 		 * system couldn't communicate with them separately.
+ 		 *
+-		 * Give child device order the priority, first come first
+-		 * served.
++		 * Give inverse child device order the priority,
++		 * last one wins. Yes, there are real machines
++		 * (eg. Asrock B250M-HDV) where VBT has both
++		 * port A and port E with the same AUX ch and
++		 * we must pick port E :(
+ 		 */
++		info = &dev_priv->vbt.ddi_port_info[p];
++
+ 		info->supports_dvi = false;
+ 		info->supports_hdmi = false;
+ 		info->alternate_ddc_pin = 0;
+@@ -1315,7 +1320,7 @@ static void sanitize_aux_ch(struct drm_i915_private *dev_priv,
+ 		DRM_DEBUG_KMS("port %c trying to use the same AUX CH (0x%x) as port %c, "
+ 			      "disabling port %c DP support\n",
+ 			      port_name(port), info->alternate_aux_channel,
+-			      port_name(p), port_name(port));
++			      port_name(p), port_name(p));
+ 
+ 		/*
+ 		 * If we have multiple ports supposedlt sharing the
+@@ -1323,9 +1328,14 @@ static void sanitize_aux_ch(struct drm_i915_private *dev_priv,
+ 		 * port. Otherwise they share the same aux channel
+ 		 * and system couldn't communicate with them separately.
+ 		 *
+-		 * Give child device order the priority, first come first
+-		 * served.
++		 * Give inverse child device order the priority,
++		 * last one wins. Yes, there are real machines
++		 * (eg. Asrock B250M-HDV) where VBT has both
++		 * port A and port E with the same AUX ch and
++		 * we must pick port E :(
+ 		 */
++		info = &dev_priv->vbt.ddi_port_info[p];
++
+ 		info->supports_dp = false;
+ 		info->alternate_aux_channel = 0;
+ 	}
+diff --git a/drivers/gpu/drm/i915/gem/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
+index c201289039fe..5bd27941811f 100644
+--- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
+@@ -365,6 +365,7 @@ err:
+ 		return VM_FAULT_OOM;
+ 	case -ENOSPC:
+ 	case -EFAULT:
++	case -ENODEV: /* bad object, how did you get here! */
+ 		return VM_FAULT_SIGBUS;
+ 	default:
+ 		WARN_ONCE(ret, "unhandled error in %s: %i\n", __func__, ret);
+@@ -475,10 +476,16 @@ i915_gem_mmap_gtt(struct drm_file *file,
+ 	if (!obj)
+ 		return -ENOENT;
+ 
++	if (i915_gem_object_never_bind_ggtt(obj)) {
++		ret = -ENODEV;
++		goto out;
++	}
++
+ 	ret = create_mmap_offset(obj);
+ 	if (ret == 0)
+ 		*offset = drm_vma_node_offset_addr(&obj->base.vma_node);
+ 
++out:
+ 	i915_gem_object_put(obj);
+ 	return ret;
+ }
+diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object.h b/drivers/gpu/drm/i915/gem/i915_gem_object.h
+index dfebd5706f16..e44d3f49c1d6 100644
+--- a/drivers/gpu/drm/i915/gem/i915_gem_object.h
++++ b/drivers/gpu/drm/i915/gem/i915_gem_object.h
+@@ -152,6 +152,12 @@ i915_gem_object_is_proxy(const struct drm_i915_gem_object *obj)
+ 	return obj->ops->flags & I915_GEM_OBJECT_IS_PROXY;
+ }
+ 
++static inline bool
++i915_gem_object_never_bind_ggtt(const struct drm_i915_gem_object *obj)
++{
++	return obj->ops->flags & I915_GEM_OBJECT_NO_GGTT;
++}
++
+ static inline bool
+ i915_gem_object_needs_async_cancel(const struct drm_i915_gem_object *obj)
+ {
+diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object_types.h b/drivers/gpu/drm/i915/gem/i915_gem_object_types.h
+index 18bf4f8d6d80..d5453e85df5e 100644
+--- a/drivers/gpu/drm/i915/gem/i915_gem_object_types.h
++++ b/drivers/gpu/drm/i915/gem/i915_gem_object_types.h
+@@ -31,7 +31,8 @@ struct drm_i915_gem_object_ops {
+ #define I915_GEM_OBJECT_HAS_STRUCT_PAGE	BIT(0)
+ #define I915_GEM_OBJECT_IS_SHRINKABLE	BIT(1)
+ #define I915_GEM_OBJECT_IS_PROXY	BIT(2)
+-#define I915_GEM_OBJECT_ASYNC_CANCEL	BIT(3)
++#define I915_GEM_OBJECT_NO_GGTT		BIT(3)
++#define I915_GEM_OBJECT_ASYNC_CANCEL	BIT(4)
+ 
+ 	/* Interface between the GEM object and its backing storage.
+ 	 * get_pages() is called once prior to the use of the associated set
+diff --git a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
+index 528b61678334..cd30e83c3205 100644
+--- a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
+@@ -694,6 +694,7 @@ i915_gem_userptr_dmabuf_export(struct drm_i915_gem_object *obj)
+ static const struct drm_i915_gem_object_ops i915_gem_userptr_ops = {
+ 	.flags = I915_GEM_OBJECT_HAS_STRUCT_PAGE |
+ 		 I915_GEM_OBJECT_IS_SHRINKABLE |
++		 I915_GEM_OBJECT_NO_GGTT |
+ 		 I915_GEM_OBJECT_ASYNC_CANCEL,
+ 	.get_pages = i915_gem_userptr_get_pages,
+ 	.put_pages = i915_gem_userptr_put_pages,
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 8a659d3d7435..7f6af4ca0968 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1030,6 +1030,9 @@ i915_gem_object_ggtt_pin(struct drm_i915_gem_object *obj,
+ 
+ 	lockdep_assert_held(&obj->base.dev->struct_mutex);
+ 
++	if (i915_gem_object_never_bind_ggtt(obj))
++		return ERR_PTR(-ENODEV);
++
+ 	if (flags & PIN_MAPPABLE &&
+ 	    (!view || view->type == I915_GGTT_VIEW_NORMAL)) {
+ 		/* If the required space is larger than the available
+diff --git a/drivers/gpu/drm/panfrost/panfrost_job.c b/drivers/gpu/drm/panfrost/panfrost_job.c
+index 9bb9260d9181..b05c7c513436 100644
+--- a/drivers/gpu/drm/panfrost/panfrost_job.c
++++ b/drivers/gpu/drm/panfrost/panfrost_job.c
+@@ -384,13 +384,19 @@ static void panfrost_job_timedout(struct drm_sched_job *sched_job)
+ 		job_read(pfdev, JS_TAIL_LO(js)),
+ 		sched_job);
+ 
+-	mutex_lock(&pfdev->reset_lock);
++	if (!mutex_trylock(&pfdev->reset_lock))
++		return;
+ 
+-	for (i = 0; i < NUM_JOB_SLOTS; i++)
+-		drm_sched_stop(&pfdev->js->queue[i].sched, sched_job);
++	for (i = 0; i < NUM_JOB_SLOTS; i++) {
++		struct drm_gpu_scheduler *sched = &pfdev->js->queue[i].sched;
++
++		drm_sched_stop(sched, sched_job);
++		if (js != i)
++			/* Ensure any timeouts on other slots have finished */
++			cancel_delayed_work_sync(&sched->work_tdr);
++	}
+ 
+-	if (sched_job)
+-		drm_sched_increase_karma(sched_job);
++	drm_sched_increase_karma(sched_job);
+ 
+ 	/* panfrost_core_dump(pfdev); */
+ 
+diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
+index 5cc0fbb04ab1..7033f3a38c87 100644
+--- a/drivers/gpu/drm/radeon/radeon_drv.c
++++ b/drivers/gpu/drm/radeon/radeon_drv.c
+@@ -380,19 +380,11 @@ radeon_pci_remove(struct pci_dev *pdev)
+ static void
+ radeon_pci_shutdown(struct pci_dev *pdev)
+ {
+-	struct drm_device *ddev = pci_get_drvdata(pdev);
+-
+ 	/* if we are running in a VM, make sure the device
+ 	 * torn down properly on reboot/shutdown
+ 	 */
+ 	if (radeon_device_is_virtual())
+ 		radeon_pci_remove(pdev);
+-
+-	/* Some adapters need to be suspended before a
+-	* shutdown occurs in order to prevent an error
+-	* during kexec.
+-	*/
+-	radeon_suspend_kms(ddev, true, true, false);
+ }
+ 
+ static int radeon_pmops_suspend(struct device *dev)
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_writeback.c b/drivers/gpu/drm/rcar-du/rcar_du_writeback.c
+index ae07290bba6a..04efa78d70b6 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_writeback.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_writeback.c
+@@ -147,7 +147,7 @@ static int rcar_du_wb_enc_atomic_check(struct drm_encoder *encoder,
+ 	struct drm_device *dev = encoder->dev;
+ 	struct drm_framebuffer *fb;
+ 
+-	if (!conn_state->writeback_job || !conn_state->writeback_job->fb)
++	if (!conn_state->writeback_job)
+ 		return 0;
+ 
+ 	fb = conn_state->writeback_job->fb;
+@@ -221,7 +221,7 @@ void rcar_du_writeback_setup(struct rcar_du_crtc *rcrtc,
+ 	unsigned int i;
+ 
+ 	state = rcrtc->writeback.base.state;
+-	if (!state || !state->writeback_job || !state->writeback_job->fb)
++	if (!state || !state->writeback_job)
+ 		return;
+ 
+ 	fb = state->writeback_job->fb;
+diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+index 6dacff49c1cc..a77cd0344d22 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+@@ -278,15 +278,13 @@ static vm_fault_t ttm_bo_vm_fault(struct vm_fault *vmf)
+ 		else
+ 			ret = vmf_insert_pfn(&cvma, address, pfn);
+ 
+-		/*
+-		 * Somebody beat us to this PTE or prefaulting to
+-		 * an already populated PTE, or prefaulting error.
+-		 */
+-
+-		if (unlikely((ret == VM_FAULT_NOPAGE && i > 0)))
+-			break;
+-		else if (unlikely(ret & VM_FAULT_ERROR))
+-			goto out_io_unlock;
++		/* Never error on prefaulted PTEs */
++		if (unlikely((ret & VM_FAULT_ERROR))) {
++			if (i == 0)
++				goto out_io_unlock;
++			else
++				break;
++		}
+ 
+ 		address += PAGE_SIZE;
+ 		if (unlikely(++page_offset >= page_last))
+diff --git a/drivers/gpu/drm/vc4/vc4_txp.c b/drivers/gpu/drm/vc4/vc4_txp.c
+index 96f91c1b4b6e..e92fa1275034 100644
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -229,7 +229,7 @@ static int vc4_txp_connector_atomic_check(struct drm_connector *conn,
+ 	int i;
+ 
+ 	conn_state = drm_atomic_get_new_connector_state(state, conn);
+-	if (!conn_state->writeback_job || !conn_state->writeback_job->fb)
++	if (!conn_state->writeback_job)
+ 		return 0;
+ 
+ 	crtc_state = drm_atomic_get_new_crtc_state(state, conn_state->crtc);
+@@ -269,8 +269,7 @@ static void vc4_txp_connector_atomic_commit(struct drm_connector *conn,
+ 	u32 ctrl;
+ 	int i;
+ 
+-	if (WARN_ON(!conn_state->writeback_job ||
+-		    !conn_state->writeback_job->fb))
++	if (WARN_ON(!conn_state->writeback_job))
+ 		return;
+ 
+ 	mode = &conn_state->crtc->state->adjusted_mode;
+diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
+index aa772ee0706f..35c284af574d 100644
+--- a/drivers/infiniband/hw/cxgb4/mem.c
++++ b/drivers/infiniband/hw/cxgb4/mem.c
+@@ -275,13 +275,17 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
+ 			   struct sk_buff *skb, struct c4iw_wr_wait *wr_waitp)
+ {
+ 	int err;
+-	struct fw_ri_tpte tpt;
++	struct fw_ri_tpte *tpt;
+ 	u32 stag_idx;
+ 	static atomic_t key;
+ 
+ 	if (c4iw_fatal_error(rdev))
+ 		return -EIO;
+ 
++	tpt = kmalloc(sizeof(*tpt), GFP_KERNEL);
++	if (!tpt)
++		return -ENOMEM;
++
+ 	stag_state = stag_state > 0;
+ 	stag_idx = (*stag) >> 8;
+ 
+@@ -291,6 +295,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
+ 			mutex_lock(&rdev->stats.lock);
+ 			rdev->stats.stag.fail++;
+ 			mutex_unlock(&rdev->stats.lock);
++			kfree(tpt);
+ 			return -ENOMEM;
+ 		}
+ 		mutex_lock(&rdev->stats.lock);
+@@ -305,28 +310,28 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
+ 
+ 	/* write TPT entry */
+ 	if (reset_tpt_entry)
+-		memset(&tpt, 0, sizeof(tpt));
++		memset(tpt, 0, sizeof(*tpt));
+ 	else {
+-		tpt.valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F |
++		tpt->valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F |
+ 			FW_RI_TPTE_STAGKEY_V((*stag & FW_RI_TPTE_STAGKEY_M)) |
+ 			FW_RI_TPTE_STAGSTATE_V(stag_state) |
+ 			FW_RI_TPTE_STAGTYPE_V(type) | FW_RI_TPTE_PDID_V(pdid));
+-		tpt.locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) |
++		tpt->locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) |
+ 			(bind_enabled ? FW_RI_TPTE_MWBINDEN_F : 0) |
+ 			FW_RI_TPTE_ADDRTYPE_V((zbva ? FW_RI_ZERO_BASED_TO :
+ 						      FW_RI_VA_BASED_TO))|
+ 			FW_RI_TPTE_PS_V(page_size));
+-		tpt.nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32(
++		tpt->nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32(
+ 			FW_RI_TPTE_PBLADDR_V(PBL_OFF(rdev, pbl_addr)>>3));
+-		tpt.len_lo = cpu_to_be32((u32)(len & 0xffffffffUL));
+-		tpt.va_hi = cpu_to_be32((u32)(to >> 32));
+-		tpt.va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL));
+-		tpt.dca_mwbcnt_pstag = cpu_to_be32(0);
+-		tpt.len_hi = cpu_to_be32((u32)(len >> 32));
++		tpt->len_lo = cpu_to_be32((u32)(len & 0xffffffffUL));
++		tpt->va_hi = cpu_to_be32((u32)(to >> 32));
++		tpt->va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL));
++		tpt->dca_mwbcnt_pstag = cpu_to_be32(0);
++		tpt->len_hi = cpu_to_be32((u32)(len >> 32));
+ 	}
+ 	err = write_adapter_mem(rdev, stag_idx +
+ 				(rdev->lldi.vr->stag.start >> 5),
+-				sizeof(tpt), &tpt, skb, wr_waitp);
++				sizeof(*tpt), tpt, skb, wr_waitp);
+ 
+ 	if (reset_tpt_entry) {
+ 		c4iw_put_resource(&rdev->resource.tpt_table, stag_idx);
+@@ -334,6 +339,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
+ 		rdev->stats.stag.cur -= 32;
+ 		mutex_unlock(&rdev->stats.lock);
+ 	}
++	kfree(tpt);
+ 	return err;
+ }
+ 
+diff --git a/drivers/input/misc/da9063_onkey.c b/drivers/input/misc/da9063_onkey.c
+index fd355cf59397..3daf11a7df25 100644
+--- a/drivers/input/misc/da9063_onkey.c
++++ b/drivers/input/misc/da9063_onkey.c
+@@ -232,10 +232,7 @@ static int da9063_onkey_probe(struct platform_device *pdev)
+ 	onkey->input->phys = onkey->phys;
+ 	onkey->input->dev.parent = &pdev->dev;
+ 
+-	if (onkey->key_power)
+-		input_set_capability(onkey->input, EV_KEY, KEY_POWER);
+-
+-	input_set_capability(onkey->input, EV_KEY, KEY_SLEEP);
++	input_set_capability(onkey->input, EV_KEY, KEY_POWER);
+ 
+ 	INIT_DELAYED_WORK(&onkey->work, da9063_poll_on);
+ 
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 04fe43440a3c..2d8434b7b623 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1827,31 +1827,6 @@ static int elantech_create_smbus(struct psmouse *psmouse,
+ 				  leave_breadcrumbs);
+ }
+ 
+-static bool elantech_use_host_notify(struct psmouse *psmouse,
+-				     struct elantech_device_info *info)
+-{
+-	if (ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
+-		return true;
+-
+-	switch (info->bus) {
+-	case ETP_BUS_PS2_ONLY:
+-		/* expected case */
+-		break;
+-	case ETP_BUS_SMB_HST_NTFY_ONLY:
+-	case ETP_BUS_PS2_SMB_HST_NTFY:
+-		/* SMbus implementation is stable since 2018 */
+-		if (dmi_get_bios_year() >= 2018)
+-			return true;
+-		/* fall through */
+-	default:
+-		psmouse_dbg(psmouse,
+-			    "Ignoring SMBus bus provider %d\n", info->bus);
+-		break;
+-	}
+-
+-	return false;
+-}
+-
+ /**
+  * elantech_setup_smbus - called once the PS/2 devices are enumerated
+  * and decides to instantiate a SMBus InterTouch device.
+@@ -1871,7 +1846,7 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
+ 		 * i2c_blacklist_pnp_ids.
+ 		 * Old ICs are up to the user to decide.
+ 		 */
+-		if (!elantech_use_host_notify(psmouse, info) ||
++		if (!ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version) ||
+ 		    psmouse_matches_pnp_id(psmouse, i2c_blacklist_pnp_ids))
+ 			return -ENXIO;
+ 	}
+@@ -1891,6 +1866,34 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
+ 	return 0;
+ }
+ 
++static bool elantech_use_host_notify(struct psmouse *psmouse,
++				     struct elantech_device_info *info)
++{
++	if (ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
++		return true;
++
++	switch (info->bus) {
++	case ETP_BUS_PS2_ONLY:
++		/* expected case */
++		break;
++	case ETP_BUS_SMB_ALERT_ONLY:
++		/* fall-through  */
++	case ETP_BUS_PS2_SMB_ALERT:
++		psmouse_dbg(psmouse, "Ignoring SMBus provider through alert protocol.\n");
++		break;
++	case ETP_BUS_SMB_HST_NTFY_ONLY:
++		/* fall-through  */
++	case ETP_BUS_PS2_SMB_HST_NTFY:
++		return true;
++	default:
++		psmouse_dbg(psmouse,
++			    "Ignoring SMBus bus provider %d.\n",
++			    info->bus);
++	}
++
++	return false;
++}
++
+ int elantech_init_smbus(struct psmouse *psmouse)
+ {
+ 	struct elantech_device_info info;
+diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
+index 772493b1f665..190b9974526b 100644
+--- a/drivers/input/rmi4/rmi_driver.c
++++ b/drivers/input/rmi4/rmi_driver.c
+@@ -146,7 +146,7 @@ static int rmi_process_interrupt_requests(struct rmi_device *rmi_dev)
+ 	}
+ 
+ 	mutex_lock(&data->irq_mutex);
+-	bitmap_and(data->irq_status, data->irq_status, data->current_irq_mask,
++	bitmap_and(data->irq_status, data->irq_status, data->fn_irq_bits,
+ 	       data->irq_count);
+ 	/*
+ 	 * At this point, irq_status has all bits that are set in the
+@@ -385,6 +385,8 @@ static int rmi_driver_set_irq_bits(struct rmi_device *rmi_dev,
+ 	bitmap_copy(data->current_irq_mask, data->new_irq_mask,
+ 		    data->num_of_irq_regs);
+ 
++	bitmap_or(data->fn_irq_bits, data->fn_irq_bits, mask, data->irq_count);
++
+ error_unlock:
+ 	mutex_unlock(&data->irq_mutex);
+ 	return error;
+@@ -398,6 +400,8 @@ static int rmi_driver_clear_irq_bits(struct rmi_device *rmi_dev,
+ 	struct device *dev = &rmi_dev->dev;
+ 
+ 	mutex_lock(&data->irq_mutex);
++	bitmap_andnot(data->fn_irq_bits,
++		      data->fn_irq_bits, mask, data->irq_count);
+ 	bitmap_andnot(data->new_irq_mask,
+ 		  data->current_irq_mask, mask, data->irq_count);
+ 
+diff --git a/drivers/input/touchscreen/st1232.c b/drivers/input/touchscreen/st1232.c
+index 34923399ece4..1139714e72e2 100644
+--- a/drivers/input/touchscreen/st1232.c
++++ b/drivers/input/touchscreen/st1232.c
+@@ -81,8 +81,10 @@ static int st1232_ts_read_data(struct st1232_ts_data *ts)
+ 	for (i = 0, y = 0; i < ts->chip_info->max_fingers; i++, y += 3) {
+ 		finger[i].is_valid = buf[i + y] >> 7;
+ 		if (finger[i].is_valid) {
+-			finger[i].x = ((buf[i + y] & 0x0070) << 4) | buf[i + 1];
+-			finger[i].y = ((buf[i + y] & 0x0007) << 8) | buf[i + 2];
++			finger[i].x = ((buf[i + y] & 0x0070) << 4) |
++					buf[i + y + 1];
++			finger[i].y = ((buf[i + y] & 0x0007) << 8) |
++					buf[i + y + 2];
+ 
+ 			/* st1232 includes a z-axis / touch strength */
+ 			if (ts->chip_info->have_z)
+diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
+index c72c036aea76..daefc52b0ec5 100644
+--- a/drivers/irqchip/irq-sifive-plic.c
++++ b/drivers/irqchip/irq-sifive-plic.c
+@@ -97,7 +97,7 @@ static inline void plic_irq_toggle(const struct cpumask *mask,
+ 	}
+ }
+ 
+-static void plic_irq_enable(struct irq_data *d)
++static void plic_irq_unmask(struct irq_data *d)
+ {
+ 	unsigned int cpu = cpumask_any_and(irq_data_get_affinity_mask(d),
+ 					   cpu_online_mask);
+@@ -106,7 +106,7 @@ static void plic_irq_enable(struct irq_data *d)
+ 	plic_irq_toggle(cpumask_of(cpu), d->hwirq, 1);
+ }
+ 
+-static void plic_irq_disable(struct irq_data *d)
++static void plic_irq_mask(struct irq_data *d)
+ {
+ 	plic_irq_toggle(cpu_possible_mask, d->hwirq, 0);
+ }
+@@ -125,10 +125,8 @@ static int plic_set_affinity(struct irq_data *d,
+ 	if (cpu >= nr_cpu_ids)
+ 		return -EINVAL;
+ 
+-	if (!irqd_irq_disabled(d)) {
+-		plic_irq_toggle(cpu_possible_mask, d->hwirq, 0);
+-		plic_irq_toggle(cpumask_of(cpu), d->hwirq, 1);
+-	}
++	plic_irq_toggle(cpu_possible_mask, d->hwirq, 0);
++	plic_irq_toggle(cpumask_of(cpu), d->hwirq, 1);
+ 
+ 	irq_data_update_effective_affinity(d, cpumask_of(cpu));
+ 
+@@ -136,14 +134,18 @@ static int plic_set_affinity(struct irq_data *d,
+ }
+ #endif
+ 
++static void plic_irq_eoi(struct irq_data *d)
++{
++	struct plic_handler *handler = this_cpu_ptr(&plic_handlers);
++
++	writel(d->hwirq, handler->hart_base + CONTEXT_CLAIM);
++}
++
+ static struct irq_chip plic_chip = {
+ 	.name		= "SiFive PLIC",
+-	/*
+-	 * There is no need to mask/unmask PLIC interrupts.  They are "masked"
+-	 * by reading claim and "unmasked" when writing it back.
+-	 */
+-	.irq_enable	= plic_irq_enable,
+-	.irq_disable	= plic_irq_disable,
++	.irq_mask	= plic_irq_mask,
++	.irq_unmask	= plic_irq_unmask,
++	.irq_eoi	= plic_irq_eoi,
+ #ifdef CONFIG_SMP
+ 	.irq_set_affinity = plic_set_affinity,
+ #endif
+@@ -152,7 +154,7 @@ static struct irq_chip plic_chip = {
+ static int plic_irqdomain_map(struct irq_domain *d, unsigned int irq,
+ 			      irq_hw_number_t hwirq)
+ {
+-	irq_set_chip_and_handler(irq, &plic_chip, handle_simple_irq);
++	irq_set_chip_and_handler(irq, &plic_chip, handle_fasteoi_irq);
+ 	irq_set_chip_data(irq, NULL);
+ 	irq_set_noprobe(irq);
+ 	return 0;
+@@ -188,7 +190,6 @@ static void plic_handle_irq(struct pt_regs *regs)
+ 					hwirq);
+ 		else
+ 			generic_handle_irq(irq);
+-		writel(hwirq, claim);
+ 	}
+ 	csr_set(sie, SIE_SEIE);
+ }
+diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
+index d249cf8ac277..8346e6d1816c 100644
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -542,7 +542,7 @@ static void wake_migration_worker(struct cache *cache)
+ 
+ static struct dm_bio_prison_cell_v2 *alloc_prison_cell(struct cache *cache)
+ {
+-	return dm_bio_prison_alloc_cell_v2(cache->prison, GFP_NOWAIT);
++	return dm_bio_prison_alloc_cell_v2(cache->prison, GFP_NOIO);
+ }
+ 
+ static void free_prison_cell(struct cache *cache, struct dm_bio_prison_cell_v2 *cell)
+@@ -554,9 +554,7 @@ static struct dm_cache_migration *alloc_migration(struct cache *cache)
+ {
+ 	struct dm_cache_migration *mg;
+ 
+-	mg = mempool_alloc(&cache->migration_pool, GFP_NOWAIT);
+-	if (!mg)
+-		return NULL;
++	mg = mempool_alloc(&cache->migration_pool, GFP_NOIO);
+ 
+ 	memset(mg, 0, sizeof(*mg));
+ 
+@@ -664,10 +662,6 @@ static bool bio_detain_shared(struct cache *cache, dm_oblock_t oblock, struct bi
+ 	struct dm_bio_prison_cell_v2 *cell_prealloc, *cell;
+ 
+ 	cell_prealloc = alloc_prison_cell(cache); /* FIXME: allow wait if calling from worker */
+-	if (!cell_prealloc) {
+-		defer_bio(cache, bio);
+-		return false;
+-	}
+ 
+ 	build_key(oblock, end, &key);
+ 	r = dm_cell_get_v2(cache->prison, &key, lock_level(bio), bio, cell_prealloc, &cell);
+@@ -1493,11 +1487,6 @@ static int mg_lock_writes(struct dm_cache_migration *mg)
+ 	struct dm_bio_prison_cell_v2 *prealloc;
+ 
+ 	prealloc = alloc_prison_cell(cache);
+-	if (!prealloc) {
+-		DMERR_LIMIT("%s: alloc_prison_cell failed", cache_device_name(cache));
+-		mg_complete(mg, false);
+-		return -ENOMEM;
+-	}
+ 
+ 	/*
+ 	 * Prevent writes to the block, but allow reads to continue.
+@@ -1535,11 +1524,6 @@ static int mg_start(struct cache *cache, struct policy_work *op, struct bio *bio
+ 	}
+ 
+ 	mg = alloc_migration(cache);
+-	if (!mg) {
+-		policy_complete_background_work(cache->policy, op, false);
+-		background_work_end(cache);
+-		return -ENOMEM;
+-	}
+ 
+ 	mg->op = op;
+ 	mg->overwrite_bio = bio;
+@@ -1628,10 +1612,6 @@ static int invalidate_lock(struct dm_cache_migration *mg)
+ 	struct dm_bio_prison_cell_v2 *prealloc;
+ 
+ 	prealloc = alloc_prison_cell(cache);
+-	if (!prealloc) {
+-		invalidate_complete(mg, false);
+-		return -ENOMEM;
+-	}
+ 
+ 	build_key(mg->invalidate_oblock, oblock_succ(mg->invalidate_oblock), &key);
+ 	r = dm_cell_lock_v2(cache->prison, &key,
+@@ -1669,10 +1649,6 @@ static int invalidate_start(struct cache *cache, dm_cblock_t cblock,
+ 		return -EPERM;
+ 
+ 	mg = alloc_migration(cache);
+-	if (!mg) {
+-		background_work_end(cache);
+-		return -ENOMEM;
+-	}
+ 
+ 	mg->overwrite_bio = bio;
+ 	mg->invalidate_cblock = cblock;
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index 297bbc0f41f0..c3445d2cedb9 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -151,7 +151,7 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
+ 	} else {
+ 		pr_err("md/raid0:%s: cannot assemble multi-zone RAID0 with default_layout setting\n",
+ 		       mdname(mddev));
+-		pr_err("md/raid0: please set raid.default_layout to 1 or 2\n");
++		pr_err("md/raid0: please set raid0.default_layout to 1 or 2\n");
+ 		err = -ENOTSUPP;
+ 		goto abort;
+ 	}
+diff --git a/drivers/memstick/host/jmb38x_ms.c b/drivers/memstick/host/jmb38x_ms.c
+index 32747425297d..64fff6abe60e 100644
+--- a/drivers/memstick/host/jmb38x_ms.c
++++ b/drivers/memstick/host/jmb38x_ms.c
+@@ -941,7 +941,7 @@ static int jmb38x_ms_probe(struct pci_dev *pdev,
+ 	if (!cnt) {
+ 		rc = -ENODEV;
+ 		pci_dev_busy = 1;
+-		goto err_out;
++		goto err_out_int;
+ 	}
+ 
+ 	jm = kzalloc(sizeof(struct jmb38x_ms)
+diff --git a/drivers/mmc/host/cqhci.c b/drivers/mmc/host/cqhci.c
+index f7bdae5354c3..5047f7343ffc 100644
+--- a/drivers/mmc/host/cqhci.c
++++ b/drivers/mmc/host/cqhci.c
+@@ -611,7 +611,8 @@ static int cqhci_request(struct mmc_host *mmc, struct mmc_request *mrq)
+ 	cq_host->slot[tag].flags = 0;
+ 
+ 	cq_host->qcnt += 1;
+-
++	/* Make sure descriptors are ready before ringing the doorbell */
++	wmb();
+ 	cqhci_writel(cq_host, 1 << tag, CQHCI_TDBR);
+ 	if (!(cqhci_readl(cq_host, CQHCI_TDBR) & (1 << tag)))
+ 		pr_debug("%s: cqhci: doorbell not set for tag %d\n",
+diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
+index b334e81c5cab..9a0bc0c5fa4b 100644
+--- a/drivers/mmc/host/mxs-mmc.c
++++ b/drivers/mmc/host/mxs-mmc.c
+@@ -17,6 +17,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/dmaengine.h>
++#include <linux/dma/mxs-dma.h>
+ #include <linux/highmem.h>
+ #include <linux/clk.h>
+ #include <linux/err.h>
+@@ -266,7 +267,7 @@ static void mxs_mmc_bc(struct mxs_mmc_host *host)
+ 	ssp->ssp_pio_words[2] = cmd1;
+ 	ssp->dma_dir = DMA_NONE;
+ 	ssp->slave_dirn = DMA_TRANS_NONE;
+-	desc = mxs_mmc_prep_dma(host, DMA_CTRL_ACK);
++	desc = mxs_mmc_prep_dma(host, MXS_DMA_CTRL_WAIT4END);
+ 	if (!desc)
+ 		goto out;
+ 
+@@ -311,7 +312,7 @@ static void mxs_mmc_ac(struct mxs_mmc_host *host)
+ 	ssp->ssp_pio_words[2] = cmd1;
+ 	ssp->dma_dir = DMA_NONE;
+ 	ssp->slave_dirn = DMA_TRANS_NONE;
+-	desc = mxs_mmc_prep_dma(host, DMA_CTRL_ACK);
++	desc = mxs_mmc_prep_dma(host, MXS_DMA_CTRL_WAIT4END);
+ 	if (!desc)
+ 		goto out;
+ 
+@@ -441,7 +442,7 @@ static void mxs_mmc_adtc(struct mxs_mmc_host *host)
+ 	host->data = data;
+ 	ssp->dma_dir = dma_data_dir;
+ 	ssp->slave_dirn = slave_dirn;
+-	desc = mxs_mmc_prep_dma(host, DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
++	desc = mxs_mmc_prep_dma(host, DMA_PREP_INTERRUPT | MXS_DMA_CTRL_WAIT4END);
+ 	if (!desc)
+ 		goto out;
+ 
+diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
+index 41c2677c587f..083e7e053c95 100644
+--- a/drivers/mmc/host/sdhci-omap.c
++++ b/drivers/mmc/host/sdhci-omap.c
+@@ -372,7 +372,7 @@ static int sdhci_omap_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 	 * on temperature
+ 	 */
+ 	if (temperature < -20000)
+-		phase_delay = min(max_window + 4 * max_len - 24,
++		phase_delay = min(max_window + 4 * (max_len - 1) - 24,
+ 				  max_window +
+ 				  DIV_ROUND_UP(13 * max_len, 16) * 4);
+ 	else if (temperature < 20000)
+diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c
+index 16f15c93a102..bbeeb8618c80 100644
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -705,7 +705,7 @@ qca8k_setup(struct dsa_switch *ds)
+ 		    BIT(0) << QCA8K_GLOBAL_FW_CTRL1_UC_DP_S);
+ 
+ 	/* Setup connection between CPU port & user ports */
+-	for (i = 0; i < DSA_MAX_PORTS; i++) {
++	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+ 		/* CPU port gets connected to all user ports of the switch */
+ 		if (dsa_is_cpu_port(ds, i)) {
+ 			qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(QCA8K_CPU_PORT),
+@@ -1074,7 +1074,7 @@ qca8k_sw_probe(struct mdio_device *mdiodev)
+ 	if (id != QCA8K_ID_QCA8337)
+ 		return -ENODEV;
+ 
+-	priv->ds = dsa_switch_alloc(&mdiodev->dev, DSA_MAX_PORTS);
++	priv->ds = dsa_switch_alloc(&mdiodev->dev, QCA8K_NUM_PORTS);
+ 	if (!priv->ds)
+ 		return -ENOMEM;
+ 
+diff --git a/drivers/net/dsa/rtl8366rb.c b/drivers/net/dsa/rtl8366rb.c
+index a268085ffad2..f5cc8b0a7c74 100644
+--- a/drivers/net/dsa/rtl8366rb.c
++++ b/drivers/net/dsa/rtl8366rb.c
+@@ -507,7 +507,8 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi)
+ 	irq = of_irq_get(intc, 0);
+ 	if (irq <= 0) {
+ 		dev_err(smi->dev, "failed to get parent IRQ\n");
+-		return irq ? irq : -EINVAL;
++		ret = irq ? irq : -EINVAL;
++		goto out_put_node;
+ 	}
+ 
+ 	/* This clears the IRQ status register */
+@@ -515,7 +516,7 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi)
+ 			  &val);
+ 	if (ret) {
+ 		dev_err(smi->dev, "can't read interrupt status\n");
+-		return ret;
++		goto out_put_node;
+ 	}
+ 
+ 	/* Fetch IRQ edge information from the descriptor */
+@@ -537,7 +538,7 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi)
+ 				 val);
+ 	if (ret) {
+ 		dev_err(smi->dev, "could not configure IRQ polarity\n");
+-		return ret;
++		goto out_put_node;
+ 	}
+ 
+ 	ret = devm_request_threaded_irq(smi->dev, irq, NULL,
+@@ -545,7 +546,7 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi)
+ 					"RTL8366RB", smi);
+ 	if (ret) {
+ 		dev_err(smi->dev, "unable to request irq: %d\n", ret);
+-		return ret;
++		goto out_put_node;
+ 	}
+ 	smi->irqdomain = irq_domain_add_linear(intc,
+ 					       RTL8366RB_NUM_INTERRUPT,
+@@ -553,12 +554,15 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi)
+ 					       smi);
+ 	if (!smi->irqdomain) {
+ 		dev_err(smi->dev, "failed to create IRQ domain\n");
+-		return -EINVAL;
++		ret = -EINVAL;
++		goto out_put_node;
+ 	}
+ 	for (i = 0; i < smi->num_ports; i++)
+ 		irq_set_parent(irq_create_mapping(smi->irqdomain, i), irq);
+ 
+-	return 0;
++out_put_node:
++	of_node_put(intc);
++	return ret;
+ }
+ 
+ static int rtl8366rb_set_addr(struct realtek_smi *smi)
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+index b4a0fb281e69..bb65dd39f847 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+@@ -194,9 +194,7 @@ static void aq_ndev_set_multicast_settings(struct net_device *ndev)
+ {
+ 	struct aq_nic_s *aq_nic = netdev_priv(ndev);
+ 
+-	aq_nic_set_packet_filter(aq_nic, ndev->flags);
+-
+-	aq_nic_set_multicast_list(aq_nic, ndev);
++	(void)aq_nic_set_multicast_list(aq_nic, ndev);
+ }
+ 
+ static int aq_ndo_vlan_rx_add_vid(struct net_device *ndev, __be16 proto,
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+index 8f66e7817811..2a18439b36fb 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -631,9 +631,12 @@ err_exit:
+ 
+ int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev)
+ {
+-	unsigned int packet_filter = self->packet_filter;
++	const struct aq_hw_ops *hw_ops = self->aq_hw_ops;
++	struct aq_nic_cfg_s *cfg = &self->aq_nic_cfg;
++	unsigned int packet_filter = ndev->flags;
+ 	struct netdev_hw_addr *ha = NULL;
+ 	unsigned int i = 0U;
++	int err = 0;
+ 
+ 	self->mc_list.count = 0;
+ 	if (netdev_uc_count(ndev) > AQ_HW_MULTICAST_ADDRESS_MAX) {
+@@ -641,29 +644,26 @@ int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev)
+ 	} else {
+ 		netdev_for_each_uc_addr(ha, ndev) {
+ 			ether_addr_copy(self->mc_list.ar[i++], ha->addr);
+-
+-			if (i >= AQ_HW_MULTICAST_ADDRESS_MAX)
+-				break;
+ 		}
+ 	}
+ 
+-	if (i + netdev_mc_count(ndev) > AQ_HW_MULTICAST_ADDRESS_MAX) {
+-		packet_filter |= IFF_ALLMULTI;
+-	} else {
+-		netdev_for_each_mc_addr(ha, ndev) {
+-			ether_addr_copy(self->mc_list.ar[i++], ha->addr);
+-
+-			if (i >= AQ_HW_MULTICAST_ADDRESS_MAX)
+-				break;
++	cfg->is_mc_list_enabled = !!(packet_filter & IFF_MULTICAST);
++	if (cfg->is_mc_list_enabled) {
++		if (i + netdev_mc_count(ndev) > AQ_HW_MULTICAST_ADDRESS_MAX) {
++			packet_filter |= IFF_ALLMULTI;
++		} else {
++			netdev_for_each_mc_addr(ha, ndev) {
++				ether_addr_copy(self->mc_list.ar[i++],
++						ha->addr);
++			}
+ 		}
+ 	}
+ 
+ 	if (i > 0 && i <= AQ_HW_MULTICAST_ADDRESS_MAX) {
+-		packet_filter |= IFF_MULTICAST;
+ 		self->mc_list.count = i;
+-		self->aq_hw_ops->hw_multicast_list_set(self->aq_hw,
+-						       self->mc_list.ar,
+-						       self->mc_list.count);
++		err = hw_ops->hw_multicast_list_set(self->aq_hw,
++						    self->mc_list.ar,
++						    self->mc_list.count);
+ 	}
+ 	return aq_nic_set_packet_filter(self, packet_filter);
+ }
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+index 3901d7994ca1..76bdbe1596d6 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+@@ -313,6 +313,7 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
+ 					break;
+ 
+ 				buff->is_error |= buff_->is_error;
++				buff->is_cso_err |= buff_->is_cso_err;
+ 
+ 			} while (!buff_->is_eop);
+ 
+@@ -320,7 +321,7 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
+ 				err = 0;
+ 				goto err_exit;
+ 			}
+-			if (buff->is_error) {
++			if (buff->is_error || buff->is_cso_err) {
+ 				buff_ = buff;
+ 				do {
+ 					next_ = buff_->next,
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+index 30f7fc4c97ff..2ad3fa6316ce 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -818,14 +818,15 @@ static int hw_atl_b0_hw_packet_filter_set(struct aq_hw_s *self,
+ 				     cfg->is_vlan_force_promisc);
+ 
+ 	hw_atl_rpfl2multicast_flr_en_set(self,
+-					 IS_FILTER_ENABLED(IFF_ALLMULTI), 0);
++					 IS_FILTER_ENABLED(IFF_ALLMULTI) &&
++					 IS_FILTER_ENABLED(IFF_MULTICAST), 0);
+ 
+ 	hw_atl_rpfl2_accept_all_mc_packets_set(self,
+-					       IS_FILTER_ENABLED(IFF_ALLMULTI));
++					      IS_FILTER_ENABLED(IFF_ALLMULTI) &&
++					      IS_FILTER_ENABLED(IFF_MULTICAST));
+ 
+ 	hw_atl_rpfl2broadcast_en_set(self, IS_FILTER_ENABLED(IFF_BROADCAST));
+ 
+-	cfg->is_mc_list_enabled = IS_FILTER_ENABLED(IFF_MULTICAST);
+ 
+ 	for (i = HW_ATL_B0_MAC_MIN; i < HW_ATL_B0_MAC_MAX; ++i)
+ 		hw_atl_rpfl2_uc_flr_en_set(self,
+@@ -968,14 +969,26 @@ static int hw_atl_b0_hw_interrupt_moderation_set(struct aq_hw_s *self)
+ 
+ static int hw_atl_b0_hw_stop(struct aq_hw_s *self)
+ {
++	int err;
++	u32 val;
++
+ 	hw_atl_b0_hw_irq_disable(self, HW_ATL_B0_INT_MASK);
+ 
+ 	/* Invalidate Descriptor Cache to prevent writing to the cached
+ 	 * descriptors and to the data pointer of those descriptors
+ 	 */
+-	hw_atl_rdm_rx_dma_desc_cache_init_set(self, 1);
++	hw_atl_rdm_rx_dma_desc_cache_init_tgl(self);
+ 
+-	return aq_hw_err_from_flags(self);
++	err = aq_hw_err_from_flags(self);
++
++	if (err)
++		goto err_exit;
++
++	readx_poll_timeout_atomic(hw_atl_rdm_rx_dma_desc_cache_init_done_get,
++				  self, val, val == 1, 1000U, 10000U);
++
++err_exit:
++	return err;
+ }
+ 
+ static int hw_atl_b0_hw_ring_tx_stop(struct aq_hw_s *self,
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
+index 1149812ae463..6f340695e6bd 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
+@@ -606,12 +606,25 @@ void hw_atl_rpb_rx_flow_ctl_mode_set(struct aq_hw_s *aq_hw, u32 rx_flow_ctl_mode
+ 			    HW_ATL_RPB_RX_FC_MODE_SHIFT, rx_flow_ctl_mode);
+ }
+ 
+-void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init)
++void hw_atl_rdm_rx_dma_desc_cache_init_tgl(struct aq_hw_s *aq_hw)
+ {
++	u32 val;
++
++	val = aq_hw_read_reg_bit(aq_hw, HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR,
++				 HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK,
++				 HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT);
++
+ 	aq_hw_write_reg_bit(aq_hw, HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR,
+ 			    HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK,
+ 			    HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT,
+-			    init);
++			    val ^ 1);
++}
++
++u32 hw_atl_rdm_rx_dma_desc_cache_init_done_get(struct aq_hw_s *aq_hw)
++{
++	return aq_hw_read_reg_bit(aq_hw, RDM_RX_DMA_DESC_CACHE_INIT_DONE_ADR,
++				  RDM_RX_DMA_DESC_CACHE_INIT_DONE_MSK,
++				  RDM_RX_DMA_DESC_CACHE_INIT_DONE_SHIFT);
+ }
+ 
+ void hw_atl_rpb_rx_pkt_buff_size_per_tc_set(struct aq_hw_s *aq_hw,
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
+index 0c37abbabca5..c3ee278c3747 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
+@@ -313,8 +313,11 @@ void hw_atl_rpb_rx_pkt_buff_size_per_tc_set(struct aq_hw_s *aq_hw,
+ 					    u32 rx_pkt_buff_size_per_tc,
+ 					    u32 buffer);
+ 
+-/* set rdm rx dma descriptor cache init */
+-void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init);
++/* toggle rdm rx dma descriptor cache init */
++void hw_atl_rdm_rx_dma_desc_cache_init_tgl(struct aq_hw_s *aq_hw);
++
++/* get rdm rx dma descriptor cache init done */
++u32 hw_atl_rdm_rx_dma_desc_cache_init_done_get(struct aq_hw_s *aq_hw);
+ 
+ /* set rx xoff enable (per tc) */
+ void hw_atl_rpb_rx_xoff_en_per_tc_set(struct aq_hw_s *aq_hw, u32 rx_xoff_en_per_tc,
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+index c3febcdfa92e..35887ad89025 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+@@ -318,6 +318,25 @@
+ /* default value of bitfield rdm_desc_init_i */
+ #define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_DEFAULT 0x0
+ 
++/* rdm_desc_init_done_i bitfield definitions
++ * preprocessor definitions for the bitfield rdm_desc_init_done_i.
++ * port="pif_rdm_desc_init_done_i"
++ */
++
++/* register address for bitfield rdm_desc_init_done_i */
++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_ADR 0x00005a10
++/* bitmask for bitfield rdm_desc_init_done_i */
++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_MSK 0x00000001U
++/* inverted bitmask for bitfield rdm_desc_init_done_i */
++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_MSKN 0xfffffffe
++/* lower bit position of bitfield  rdm_desc_init_done_i */
++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_SHIFT 0U
++/* width of bitfield rdm_desc_init_done_i */
++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_WIDTH 1
++/* default value of bitfield rdm_desc_init_done_i */
++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_DEFAULT 0x0
++
++
+ /* rx int_desc_wrb_en bitfield definitions
+  * preprocessor definitions for the bitfield "int_desc_wrb_en".
+  * port="pif_rdm_int_desc_wrb_en_i"
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c
+index da726489e3c8..7bc51f8d6f2f 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c
+@@ -337,7 +337,7 @@ static int aq_fw2x_get_phy_temp(struct aq_hw_s *self, int *temp)
+ 	/* Convert PHY temperature from 1/256 degree Celsius
+ 	 * to 1/1000 degree Celsius.
+ 	 */
+-	*temp = temp_res  * 1000 / 256;
++	*temp = (temp_res & 0xFFFF) * 1000 / 256;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/ethernet/atheros/ag71xx.c b/drivers/net/ethernet/atheros/ag71xx.c
+index 6703960c7cf5..d1101eea15c2 100644
+--- a/drivers/net/ethernet/atheros/ag71xx.c
++++ b/drivers/net/ethernet/atheros/ag71xx.c
+@@ -526,7 +526,7 @@ static int ag71xx_mdio_probe(struct ag71xx *ag)
+ 	struct device *dev = &ag->pdev->dev;
+ 	struct net_device *ndev = ag->ndev;
+ 	static struct mii_bus *mii_bus;
+-	struct device_node *np;
++	struct device_node *np, *mnp;
+ 	int err;
+ 
+ 	np = dev->of_node;
+@@ -571,7 +571,9 @@ static int ag71xx_mdio_probe(struct ag71xx *ag)
+ 		msleep(200);
+ 	}
+ 
+-	err = of_mdiobus_register(mii_bus, np);
++	mnp = of_get_child_by_name(np, "mdio");
++	err = of_mdiobus_register(mii_bus, mnp);
++	of_node_put(mnp);
+ 	if (err)
+ 		goto mdio_err_put_clk;
+ 
+diff --git a/drivers/net/ethernet/broadcom/Kconfig b/drivers/net/ethernet/broadcom/Kconfig
+index e24f5d2b6afe..53055ce5dfd6 100644
+--- a/drivers/net/ethernet/broadcom/Kconfig
++++ b/drivers/net/ethernet/broadcom/Kconfig
+@@ -8,7 +8,6 @@ config NET_VENDOR_BROADCOM
+ 	default y
+ 	depends on (SSB_POSSIBLE && HAS_DMA) || PCI || BCM63XX || \
+ 		   SIBYTE_SB1xxx_SOC
+-	select DIMLIB
+ 	---help---
+ 	  If you have a network (Ethernet) chipset belonging to this class,
+ 	  say Y.
+@@ -69,6 +68,7 @@ config BCMGENET
+ 	select FIXED_PHY
+ 	select BCM7XXX_PHY
+ 	select MDIO_BCM_UNIMAC
++	select DIMLIB
+ 	help
+ 	  This driver supports the built-in Ethernet MACs found in the
+ 	  Broadcom BCM7xxx Set Top Box family chipset.
+@@ -188,6 +188,7 @@ config SYSTEMPORT
+ 	select MII
+ 	select PHYLIB
+ 	select FIXED_PHY
++	select DIMLIB
+ 	help
+ 	  This driver supports the built-in Ethernet MACs found in the
+ 	  Broadcom BCM7xxx Set Top Box family chipset using an internal
+@@ -200,6 +201,7 @@ config BNXT
+ 	select LIBCRC32C
+ 	select NET_DEVLINK
+ 	select PAGE_POOL
++	select DIMLIB
+ 	---help---
+ 	  This driver supports Broadcom NetXtreme-C/E 10/25/40/50 gigabit
+ 	  Ethernet cards.  To compile this driver as a module, choose M here:
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+index 4a8fc03d82fd..dbc69d8fa05f 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+@@ -366,6 +366,7 @@ struct bcmgenet_mib_counters {
+ #define  EXT_PWR_DOWN_PHY_EN		(1 << 20)
+ 
+ #define EXT_RGMII_OOB_CTRL		0x0C
++#define  RGMII_MODE_EN_V123		(1 << 0)
+ #define  RGMII_LINK			(1 << 4)
+ #define  OOB_DISABLE			(1 << 5)
+ #define  RGMII_MODE_EN			(1 << 6)
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index 970e478a9017..e7c291bf4ed1 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -258,7 +258,11 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
+ 	 */
+ 	if (priv->ext_phy) {
+ 		reg = bcmgenet_ext_readl(priv, EXT_RGMII_OOB_CTRL);
+-		reg |= RGMII_MODE_EN | id_mode_dis;
++		reg |= id_mode_dis;
++		if (GENET_IS_V1(priv) || GENET_IS_V2(priv) || GENET_IS_V3(priv))
++			reg |= RGMII_MODE_EN_V123;
++		else
++			reg |= RGMII_MODE_EN;
+ 		bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);
+ 	}
+ 
+@@ -273,11 +277,12 @@ int bcmgenet_mii_probe(struct net_device *dev)
+ 	struct bcmgenet_priv *priv = netdev_priv(dev);
+ 	struct device_node *dn = priv->pdev->dev.of_node;
+ 	struct phy_device *phydev;
+-	u32 phy_flags;
++	u32 phy_flags = 0;
+ 	int ret;
+ 
+ 	/* Communicate the integrated PHY revision */
+-	phy_flags = priv->gphy_rev;
++	if (priv->internal_phy)
++		phy_flags = priv->gphy_rev;
+ 
+ 	/* Initialize link state variables that bcmgenet_mii_setup() uses */
+ 	priv->old_link = -1;
+diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c
+index 3e863a71c513..7df5d7d211d4 100644
+--- a/drivers/net/ethernet/hisilicon/hns_mdio.c
++++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
+@@ -148,11 +148,15 @@ static int mdio_sc_cfg_reg_write(struct hns_mdio_device *mdio_dev,
+ {
+ 	u32 time_cnt;
+ 	u32 reg_value;
++	int ret;
+ 
+ 	regmap_write(mdio_dev->subctrl_vbase, cfg_reg, set_val);
+ 
+ 	for (time_cnt = MDIO_TIMEOUT; time_cnt; time_cnt--) {
+-		regmap_read(mdio_dev->subctrl_vbase, st_reg, &reg_value);
++		ret = regmap_read(mdio_dev->subctrl_vbase, st_reg, &reg_value);
++		if (ret)
++			return ret;
++
+ 		reg_value &= st_msk;
+ 		if ((!!check_st) == (!!reg_value))
+ 			break;
+diff --git a/drivers/net/ethernet/i825xx/lasi_82596.c b/drivers/net/ethernet/i825xx/lasi_82596.c
+index 211c5f74b4c8..aec7e98bcc85 100644
+--- a/drivers/net/ethernet/i825xx/lasi_82596.c
++++ b/drivers/net/ethernet/i825xx/lasi_82596.c
+@@ -96,6 +96,8 @@
+ 
+ #define OPT_SWAP_PORT	0x0001	/* Need to wordswp on the MPU port */
+ 
++#define LIB82596_DMA_ATTR	DMA_ATTR_NON_CONSISTENT
++
+ #define DMA_WBACK(ndev, addr, len) \
+ 	do { dma_cache_sync((ndev)->dev.parent, (void *)addr, len, DMA_TO_DEVICE); } while (0)
+ 
+@@ -200,7 +202,7 @@ static int __exit lan_remove_chip(struct parisc_device *pdev)
+ 
+ 	unregister_netdev (dev);
+ 	dma_free_attrs(&pdev->dev, sizeof(struct i596_private), lp->dma,
+-		       lp->dma_addr, DMA_ATTR_NON_CONSISTENT);
++		       lp->dma_addr, LIB82596_DMA_ATTR);
+ 	free_netdev (dev);
+ 	return 0;
+ }
+diff --git a/drivers/net/ethernet/i825xx/lib82596.c b/drivers/net/ethernet/i825xx/lib82596.c
+index 1274ad24d6af..f9742af7f142 100644
+--- a/drivers/net/ethernet/i825xx/lib82596.c
++++ b/drivers/net/ethernet/i825xx/lib82596.c
+@@ -1065,7 +1065,7 @@ static int i82596_probe(struct net_device *dev)
+ 
+ 	dma = dma_alloc_attrs(dev->dev.parent, sizeof(struct i596_dma),
+ 			      &lp->dma_addr, GFP_KERNEL,
+-			      DMA_ATTR_NON_CONSISTENT);
++			      LIB82596_DMA_ATTR);
+ 	if (!dma) {
+ 		printk(KERN_ERR "%s: Couldn't get shared memory\n", __FILE__);
+ 		return -ENOMEM;
+@@ -1087,7 +1087,7 @@ static int i82596_probe(struct net_device *dev)
+ 	i = register_netdev(dev);
+ 	if (i) {
+ 		dma_free_attrs(dev->dev.parent, sizeof(struct i596_dma),
+-			       dma, lp->dma_addr, DMA_ATTR_NON_CONSISTENT);
++			       dma, lp->dma_addr, LIB82596_DMA_ATTR);
+ 		return i;
+ 	}
+ 
+diff --git a/drivers/net/ethernet/i825xx/sni_82596.c b/drivers/net/ethernet/i825xx/sni_82596.c
+index 6eb6c2ff7f09..6436a98c5953 100644
+--- a/drivers/net/ethernet/i825xx/sni_82596.c
++++ b/drivers/net/ethernet/i825xx/sni_82596.c
+@@ -24,6 +24,8 @@
+ 
+ static const char sni_82596_string[] = "snirm_82596";
+ 
++#define LIB82596_DMA_ATTR	0
++
+ #define DMA_WBACK(priv, addr, len)     do { } while (0)
+ #define DMA_INV(priv, addr, len)       do { } while (0)
+ #define DMA_WBACK_INV(priv, addr, len) do { } while (0)
+@@ -152,7 +154,7 @@ static int sni_82596_driver_remove(struct platform_device *pdev)
+ 
+ 	unregister_netdev(dev);
+ 	dma_free_attrs(dev->dev.parent, sizeof(struct i596_private), lp->dma,
+-		       lp->dma_addr, DMA_ATTR_NON_CONSISTENT);
++		       lp->dma_addr, LIB82596_DMA_ATTR);
+ 	iounmap(lp->ca);
+ 	iounmap(lp->mpu_port);
+ 	free_netdev (dev);
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 5cb55ea671e3..964e7d62f4b1 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2772,12 +2772,10 @@ static int enable_scrq_irq(struct ibmvnic_adapter *adapter,
+ 
+ 	if (adapter->resetting &&
+ 	    adapter->reset_reason == VNIC_RESET_MOBILITY) {
+-		u64 val = (0xff000000) | scrq->hw_irq;
++		struct irq_desc *desc = irq_to_desc(scrq->irq);
++		struct irq_chip *chip = irq_desc_get_chip(desc);
+ 
+-		rc = plpar_hcall_norets(H_EOI, val);
+-		if (rc)
+-			dev_err(dev, "H_EOI FAILED irq 0x%llx. rc=%ld\n",
+-				val, rc);
++		chip->irq_eoi(&desc->irq_data);
+ 	}
+ 
+ 	rc = plpar_hcall_norets(H_VIOCTL, adapter->vdev->unit_address,
+diff --git a/drivers/net/ethernet/mscc/ocelot_board.c b/drivers/net/ethernet/mscc/ocelot_board.c
+index 2451d4a96490..041fb9f38eca 100644
+--- a/drivers/net/ethernet/mscc/ocelot_board.c
++++ b/drivers/net/ethernet/mscc/ocelot_board.c
+@@ -287,13 +287,14 @@ static int mscc_ocelot_probe(struct platform_device *pdev)
+ 			continue;
+ 
+ 		phy = of_phy_find_device(phy_node);
++		of_node_put(phy_node);
+ 		if (!phy)
+ 			continue;
+ 
+ 		err = ocelot_probe_port(ocelot, port, regs, phy);
+ 		if (err) {
+ 			of_node_put(portnp);
+-			return err;
++			goto out_put_ports;
+ 		}
+ 
+ 		phy_mode = of_get_phy_mode(portnp);
+@@ -321,7 +322,8 @@ static int mscc_ocelot_probe(struct platform_device *pdev)
+ 				"invalid phy mode for port%d, (Q)SGMII only\n",
+ 				port);
+ 			of_node_put(portnp);
+-			return -EINVAL;
++			err = -EINVAL;
++			goto out_put_ports;
+ 		}
+ 
+ 		serdes = devm_of_phy_get(ocelot->dev, portnp, NULL);
+@@ -334,7 +336,8 @@ static int mscc_ocelot_probe(struct platform_device *pdev)
+ 					"missing SerDes phys for port%d\n",
+ 					port);
+ 
+-			goto err_probe_ports;
++			of_node_put(portnp);
++			goto out_put_ports;
+ 		}
+ 
+ 		ocelot->ports[port]->serdes = serdes;
+@@ -346,9 +349,8 @@ static int mscc_ocelot_probe(struct platform_device *pdev)
+ 
+ 	dev_info(&pdev->dev, "Ocelot switch probed\n");
+ 
+-	return 0;
+-
+-err_probe_ports:
++out_put_ports:
++	of_node_put(ports);
+ 	return err;
+ }
+ 
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index fc9954e4a772..9c73fb759b57 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -407,8 +407,11 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
+ 	int numhashregs = (hw->multicast_filter_bins >> 5);
+ 	int mcbitslog2 = hw->mcast_bits_log2;
+ 	unsigned int value;
++	u32 mc_filter[8];
+ 	int i;
+ 
++	memset(mc_filter, 0, sizeof(mc_filter));
++
+ 	value = readl(ioaddr + GMAC_PACKET_FILTER);
+ 	value &= ~GMAC_PACKET_FILTER_HMC;
+ 	value &= ~GMAC_PACKET_FILTER_HPF;
+@@ -422,16 +425,13 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
+ 		/* Pass all multi */
+ 		value |= GMAC_PACKET_FILTER_PM;
+ 		/* Set all the bits of the HASH tab */
+-		for (i = 0; i < numhashregs; i++)
+-			writel(0xffffffff, ioaddr + GMAC_HASH_TAB(i));
++		memset(mc_filter, 0xff, sizeof(mc_filter));
+ 	} else if (!netdev_mc_empty(dev)) {
+ 		struct netdev_hw_addr *ha;
+-		u32 mc_filter[8];
+ 
+ 		/* Hash filter for multicast */
+ 		value |= GMAC_PACKET_FILTER_HMC;
+ 
+-		memset(mc_filter, 0, sizeof(mc_filter));
+ 		netdev_for_each_mc_addr(ha, dev) {
+ 			/* The upper n bits of the calculated CRC are used to
+ 			 * index the contents of the hash table. The number of
+@@ -446,10 +446,11 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
+ 			 */
+ 			mc_filter[bit_nr >> 5] |= (1 << (bit_nr & 0x1f));
+ 		}
+-		for (i = 0; i < numhashregs; i++)
+-			writel(mc_filter[i], ioaddr + GMAC_HASH_TAB(i));
+ 	}
+ 
++	for (i = 0; i < numhashregs; i++)
++		writel(mc_filter[i], ioaddr + GMAC_HASH_TAB(i));
++
+ 	value |= GMAC_PACKET_FILTER_HPF;
+ 
+ 	/* Handle multiple unicast addresses */
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+index 85c68b7ee8c6..46d74f407aab 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+@@ -370,7 +370,7 @@ static void dwxgmac2_set_filter(struct mac_device_info *hw,
+ 	dwxgmac2_set_mchash(ioaddr, mc_filter, mcbitslog2);
+ 
+ 	/* Handle multiple unicast addresses */
+-	if (netdev_uc_count(dev) > XGMAC_ADDR_MAX) {
++	if (netdev_uc_count(dev) > hw->unicast_filter_entries) {
+ 		value |= XGMAC_FILTER_PR;
+ 	} else {
+ 		struct netdev_hw_addr *ha;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 5c4408bdc843..fe2d3029de5e 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -626,6 +626,7 @@ static int stmmac_hwtstamp_set(struct net_device *dev, struct ifreq *ifr)
+ 			config.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+ 			ptp_v2 = PTP_TCR_TSVER2ENA;
+ 			snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
++			ts_event_en = PTP_TCR_TSEVNTENA;
+ 			ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
+ 			ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
+ 			ptp_over_ethernet = PTP_TCR_TSIPENA;
+@@ -4453,11 +4454,9 @@ int stmmac_suspend(struct device *dev)
+ 	if (!ndev || !netif_running(ndev))
+ 		return 0;
+ 
+-	mutex_lock(&priv->lock);
++	phylink_mac_change(priv->phylink, false);
+ 
+-	rtnl_lock();
+-	phylink_stop(priv->phylink);
+-	rtnl_unlock();
++	mutex_lock(&priv->lock);
+ 
+ 	netif_device_detach(ndev);
+ 	stmmac_stop_all_queues(priv);
+@@ -4472,11 +4471,19 @@ int stmmac_suspend(struct device *dev)
+ 		stmmac_pmt(priv, priv->hw, priv->wolopts);
+ 		priv->irq_wake = 1;
+ 	} else {
++		mutex_unlock(&priv->lock);
++		rtnl_lock();
++		phylink_stop(priv->phylink);
++		rtnl_unlock();
++		mutex_lock(&priv->lock);
++
+ 		stmmac_mac_set(priv, priv->ioaddr, false);
+ 		pinctrl_pm_select_sleep_state(priv->device);
+ 		/* Disable clock in case of PWM is off */
+-		clk_disable(priv->plat->pclk);
+-		clk_disable(priv->plat->stmmac_clk);
++		if (priv->plat->clk_ptp_ref)
++			clk_disable_unprepare(priv->plat->clk_ptp_ref);
++		clk_disable_unprepare(priv->plat->pclk);
++		clk_disable_unprepare(priv->plat->stmmac_clk);
+ 	}
+ 	mutex_unlock(&priv->lock);
+ 
+@@ -4539,8 +4546,10 @@ int stmmac_resume(struct device *dev)
+ 	} else {
+ 		pinctrl_pm_select_default_state(priv->device);
+ 		/* enable the clk previously disabled */
+-		clk_enable(priv->plat->stmmac_clk);
+-		clk_enable(priv->plat->pclk);
++		clk_prepare_enable(priv->plat->stmmac_clk);
++		clk_prepare_enable(priv->plat->pclk);
++		if (priv->plat->clk_ptp_ref)
++			clk_prepare_enable(priv->plat->clk_ptp_ref);
+ 		/* reset the phy so that it's ready */
+ 		if (priv->mii)
+ 			stmmac_mdio_reset(priv->mii);
+@@ -4562,12 +4571,16 @@ int stmmac_resume(struct device *dev)
+ 
+ 	stmmac_start_all_queues(priv);
+ 
+-	rtnl_lock();
+-	phylink_start(priv->phylink);
+-	rtnl_unlock();
+-
+ 	mutex_unlock(&priv->lock);
+ 
++	if (!device_may_wakeup(priv->device)) {
++		rtnl_lock();
++		phylink_start(priv->phylink);
++		rtnl_unlock();
++	}
++
++	phylink_mac_change(priv->phylink, true);
++
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(stmmac_resume);
+diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
+index b188fce3f641..658b399ac9ea 100644
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -3152,12 +3152,12 @@ static int ca8210_probe(struct spi_device *spi_device)
+ 		goto error;
+ 	}
+ 
++	priv->spi->dev.platform_data = pdata;
+ 	ret = ca8210_get_platform_data(priv->spi, pdata);
+ 	if (ret) {
+ 		dev_crit(&spi_device->dev, "ca8210_get_platform_data failed\n");
+ 		goto error;
+ 	}
+-	priv->spi->dev.platform_data = pdata;
+ 
+ 	ret = ca8210_dev_com_init(priv);
+ 	if (ret) {
+diff --git a/drivers/net/netdevsim/fib.c b/drivers/net/netdevsim/fib.c
+index f61d094746c0..1a251f76d09b 100644
+--- a/drivers/net/netdevsim/fib.c
++++ b/drivers/net/netdevsim/fib.c
+@@ -241,8 +241,8 @@ static struct pernet_operations nsim_fib_net_ops = {
+ 
+ void nsim_fib_exit(void)
+ {
+-	unregister_pernet_subsys(&nsim_fib_net_ops);
+ 	unregister_fib_notifier(&nsim_fib_nb);
++	unregister_pernet_subsys(&nsim_fib_net_ops);
+ }
+ 
+ int nsim_fib_init(void)
+@@ -258,6 +258,7 @@ int nsim_fib_init(void)
+ 	err = register_fib_notifier(&nsim_fib_nb, nsim_fib_dump_inconsistent);
+ 	if (err < 0) {
+ 		pr_err("Failed to register fib notifier\n");
++		unregister_pernet_subsys(&nsim_fib_net_ops);
+ 		goto err_out;
+ 	}
+ 
+diff --git a/drivers/net/phy/mdio_device.c b/drivers/net/phy/mdio_device.c
+index e282600bd83e..c1d345c3cab3 100644
+--- a/drivers/net/phy/mdio_device.c
++++ b/drivers/net/phy/mdio_device.c
+@@ -121,7 +121,7 @@ void mdio_device_reset(struct mdio_device *mdiodev, int value)
+ 		return;
+ 
+ 	if (mdiodev->reset_gpio)
+-		gpiod_set_value(mdiodev->reset_gpio, value);
++		gpiod_set_value_cansleep(mdiodev->reset_gpio, value);
+ 
+ 	if (mdiodev->reset_ctrl) {
+ 		if (value)
+diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
+index 2fea5541c35a..63dedec0433d 100644
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -341,6 +341,35 @@ static int ksz8041_config_aneg(struct phy_device *phydev)
+ 	return genphy_config_aneg(phydev);
+ }
+ 
++static int ksz8051_ksz8795_match_phy_device(struct phy_device *phydev,
++					    const u32 ksz_phy_id)
++{
++	int ret;
++
++	if ((phydev->phy_id & MICREL_PHY_ID_MASK) != ksz_phy_id)
++		return 0;
++
++	ret = phy_read(phydev, MII_BMSR);
++	if (ret < 0)
++		return ret;
++
++	/* KSZ8051 PHY and KSZ8794/KSZ8795/KSZ8765 switch share the same
++	 * exact PHY ID. However, they can be told apart by the extended
++	 * capability registers presence. The KSZ8051 PHY has them while
++	 * the switch does not.
++	 */
++	ret &= BMSR_ERCAP;
++	if (ksz_phy_id == PHY_ID_KSZ8051)
++		return ret;
++	else
++		return !ret;
++}
++
++static int ksz8051_match_phy_device(struct phy_device *phydev)
++{
++	return ksz8051_ksz8795_match_phy_device(phydev, PHY_ID_KSZ8051);
++}
++
+ static int ksz8081_config_init(struct phy_device *phydev)
+ {
+ 	/* KSZPHY_OMSO_FACTORY_TEST is set at de-assertion of the reset line
+@@ -364,6 +393,11 @@ static int ksz8061_config_init(struct phy_device *phydev)
+ 	return kszphy_config_init(phydev);
+ }
+ 
++static int ksz8795_match_phy_device(struct phy_device *phydev)
++{
++	return ksz8051_ksz8795_match_phy_device(phydev, PHY_ID_KSZ87XX);
++}
++
+ static int ksz9021_load_values_from_of(struct phy_device *phydev,
+ 				       const struct device_node *of_node,
+ 				       u16 reg,
+@@ -1017,8 +1051,6 @@ static struct phy_driver ksphy_driver[] = {
+ 	.suspend	= genphy_suspend,
+ 	.resume		= genphy_resume,
+ }, {
+-	.phy_id		= PHY_ID_KSZ8051,
+-	.phy_id_mask	= MICREL_PHY_ID_MASK,
+ 	.name		= "Micrel KSZ8051",
+ 	/* PHY_BASIC_FEATURES */
+ 	.driver_data	= &ksz8051_type,
+@@ -1029,6 +1061,7 @@ static struct phy_driver ksphy_driver[] = {
+ 	.get_sset_count = kszphy_get_sset_count,
+ 	.get_strings	= kszphy_get_strings,
+ 	.get_stats	= kszphy_get_stats,
++	.match_phy_device = ksz8051_match_phy_device,
+ 	.suspend	= genphy_suspend,
+ 	.resume		= genphy_resume,
+ }, {
+@@ -1141,13 +1174,12 @@ static struct phy_driver ksphy_driver[] = {
+ 	.suspend	= genphy_suspend,
+ 	.resume		= genphy_resume,
+ }, {
+-	.phy_id		= PHY_ID_KSZ8795,
+-	.phy_id_mask	= MICREL_PHY_ID_MASK,
+-	.name		= "Micrel KSZ8795",
++	.name		= "Micrel KSZ87XX Switch",
+ 	/* PHY_BASIC_FEATURES */
+ 	.config_init	= kszphy_config_init,
+ 	.config_aneg	= ksz8873mll_config_aneg,
+ 	.read_status	= ksz8873mll_read_status,
++	.match_phy_device = ksz8795_match_phy_device,
+ 	.suspend	= genphy_suspend,
+ 	.resume		= genphy_resume,
+ }, {
+diff --git a/drivers/net/phy/phy-c45.c b/drivers/net/phy/phy-c45.c
+index 7935593debb1..a1caeee12236 100644
+--- a/drivers/net/phy/phy-c45.c
++++ b/drivers/net/phy/phy-c45.c
+@@ -323,6 +323,8 @@ int genphy_c45_read_pma(struct phy_device *phydev)
+ {
+ 	int val;
+ 
++	linkmode_zero(phydev->lp_advertising);
++
+ 	val = phy_read_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_CTRL1);
+ 	if (val < 0)
+ 		return val;
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index 6b0f89369b46..0ff8df35c779 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -457,6 +457,11 @@ int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd)
+ 							   val);
+ 				change_autoneg = true;
+ 				break;
++			case MII_CTRL1000:
++				mii_ctrl1000_mod_linkmode_adv_t(phydev->advertising,
++							        val);
++				change_autoneg = true;
++				break;
+ 			default:
+ 				/* do nothing */
+ 				break;
+@@ -561,9 +566,6 @@ int phy_start_aneg(struct phy_device *phydev)
+ 	if (AUTONEG_DISABLE == phydev->autoneg)
+ 		phy_sanitize_settings(phydev);
+ 
+-	/* Invalidate LP advertising flags */
+-	linkmode_zero(phydev->lp_advertising);
+-
+ 	err = phy_config_aneg(phydev);
+ 	if (err < 0)
+ 		goto out_unlock;
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 27ebc2c6c2d0..d6c9350b65bf 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -1823,7 +1823,14 @@ int genphy_read_status(struct phy_device *phydev)
+ 
+ 	linkmode_zero(phydev->lp_advertising);
+ 
+-	if (phydev->autoneg == AUTONEG_ENABLE && phydev->autoneg_complete) {
++	if (phydev->autoneg == AUTONEG_ENABLE) {
++		if (!phydev->autoneg_complete) {
++			mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising,
++							0);
++			mii_lpa_mod_linkmode_lpa_t(phydev->lp_advertising, 0);
++			return 0;
++		}
++
+ 		if (phydev->is_gigabit_capable) {
+ 			lpagb = phy_read(phydev, MII_STAT1000);
+ 			if (lpagb < 0)
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 04137ac373b0..9eedc0714422 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -4533,10 +4533,9 @@ static int rtl8152_reset_resume(struct usb_interface *intf)
+ 	struct r8152 *tp = usb_get_intfdata(intf);
+ 
+ 	clear_bit(SELECTIVE_SUSPEND, &tp->flags);
+-	mutex_lock(&tp->control);
+ 	tp->rtl_ops.init(tp);
+ 	queue_delayed_work(system_long_wq, &tp->hw_phy_work, 0);
+-	mutex_unlock(&tp->control);
++	set_ethernet_addr(tp);
+ 	return rtl8152_resume(intf);
+ }
+ 
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index 3b12e7ad35e1..acbadfdbdd3f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -513,31 +513,33 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ 	{IWL_PCI_DEVICE(0x24FD, 0x9074, iwl8265_2ac_cfg)},
+ 
+ /* 9000 Series */
+-	{IWL_PCI_DEVICE(0x02F0, 0x0030, iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x0034, iwl9560_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x0038, iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x003C, iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x0060, iwl9461_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x0064, iwl9461_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x00A0, iwl9462_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x00A4, iwl9462_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x0230, iwl9560_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x0234, iwl9560_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x0238, iwl9560_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x023C, iwl9560_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x0260, iwl9461_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x0264, iwl9461_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x02A0, iwl9462_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x02A4, iwl9462_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x1551, iwl9560_killer_s_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x1552, iwl9560_killer_i_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x2030, iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x2034, iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x4030, iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x4034, iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x40A4, iwl9462_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x4234, iwl9560_2ac_cfg_quz_a0_jf_b0_soc)},
+-	{IWL_PCI_DEVICE(0x02F0, 0x42A4, iwl9462_2ac_cfg_quz_a0_jf_b0_soc)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0038, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x003C, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0060, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0064, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x00A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x00A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0230, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0238, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x023C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0260, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x0264, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x02A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x02A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x1030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x1551, killer1550s_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x1552, killer1550i_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x2030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x2034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x4030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x4034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x40A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x4234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x02F0, 0x42A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++
+ 	{IWL_PCI_DEVICE(0x06F0, 0x0030, iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc)},
+ 	{IWL_PCI_DEVICE(0x06F0, 0x0034, iwl9560_2ac_cfg_quz_a0_jf_b0_soc)},
+ 	{IWL_PCI_DEVICE(0x06F0, 0x0038, iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc)},
+@@ -643,34 +645,34 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ 	{IWL_PCI_DEVICE(0x2720, 0x40A4, iwl9462_2ac_cfg_soc)},
+ 	{IWL_PCI_DEVICE(0x2720, 0x4234, iwl9560_2ac_cfg_soc)},
+ 	{IWL_PCI_DEVICE(0x2720, 0x42A4, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x0030, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x0034, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x0038, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x003C, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9460_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x0064, iwl9461_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x00A0, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x00A4, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x0230, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x0234, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x0238, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x023C, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x0260, iwl9461_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x0264, iwl9461_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x02A0, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x02A4, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x1010, iwl9260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x1210, iwl9260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x4034, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x40A4, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x4234, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x42A4, iwl9462_2ac_cfg_soc)},
++
++	{IWL_PCI_DEVICE(0x30DC, 0x0030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x0034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x0038, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x003C, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x0064, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x00A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x00A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x0230, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x0234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x0238, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x023C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x0260, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x0264, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x02A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x02A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x1551, killer1550s_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x1552, killer1550i_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x4034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x40A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x4234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x30DC, 0x42A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++
+ 	{IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_160_cfg_shared_clk)},
+ 	{IWL_PCI_DEVICE(0x31DC, 0x0034, iwl9560_2ac_cfg_shared_clk)},
+ 	{IWL_PCI_DEVICE(0x31DC, 0x0038, iwl9560_2ac_160_cfg_shared_clk)},
+@@ -726,62 +728,60 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ 	{IWL_PCI_DEVICE(0x34F0, 0x4234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+ 	{IWL_PCI_DEVICE(0x34F0, 0x42A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
+ 
+-	{IWL_PCI_DEVICE(0x3DF0, 0x0030, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x0034, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x0038, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x003C, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x0060, iwl9461_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x0064, iwl9461_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x00A0, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x00A4, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x0230, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x0234, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x0238, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x023C, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x0260, iwl9461_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x0264, iwl9461_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x02A0, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x02A4, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x1010, iwl9260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x1030, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x1210, iwl9260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x2030, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x2034, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x4030, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x4034, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x40A4, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x4234, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x3DF0, 0x42A4, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x0030, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x0034, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x0038, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x003C, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x0060, iwl9461_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x0064, iwl9461_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x00A0, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x00A4, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x0230, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x0234, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x0238, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x023C, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x0260, iwl9461_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x0264, iwl9461_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x02A0, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x02A4, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x1010, iwl9260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x1030, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x1210, iwl9260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x2030, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x2034, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x4030, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x4034, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x40A4, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x4234, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0x43F0, 0x42A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x0030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x0034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x0038, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x003C, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x0060, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x0064, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x00A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x00A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x0230, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x0234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x0238, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x023C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x0260, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x0264, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x02A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x02A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x1030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x1551, killer1550s_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x1552, killer1550i_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x2030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x2034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x4030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x4034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x40A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x4234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x3DF0, 0x42A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++
++	{IWL_PCI_DEVICE(0x43F0, 0x0030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x0034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x0038, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x003C, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x0060, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x0064, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x00A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x00A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x0230, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x0234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x0238, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x023C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x0260, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x0264, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x02A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x02A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x1030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x1551, killer1550s_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x1552, killer1550i_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x2030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x2034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x4030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x4034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x40A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x4234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0x43F0, 0x42A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++
+ 	{IWL_PCI_DEVICE(0x9DF0, 0x0000, iwl9460_2ac_cfg_soc)},
+ 	{IWL_PCI_DEVICE(0x9DF0, 0x0010, iwl9460_2ac_cfg_soc)},
+ 	{IWL_PCI_DEVICE(0x9DF0, 0x0030, iwl9560_2ac_160_cfg_soc)},
+@@ -821,34 +821,34 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ 	{IWL_PCI_DEVICE(0x9DF0, 0x40A4, iwl9462_2ac_cfg_soc)},
+ 	{IWL_PCI_DEVICE(0x9DF0, 0x4234, iwl9560_2ac_cfg_soc)},
+ 	{IWL_PCI_DEVICE(0x9DF0, 0x42A4, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x0030, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x0034, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x0038, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x003C, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x0060, iwl9461_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x0064, iwl9461_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x00A0, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x00A4, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x0230, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x0234, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x0238, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x023C, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x0260, iwl9461_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x0264, iwl9461_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x02A0, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x02A4, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x1010, iwl9260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x1030, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x1210, iwl9260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x2030, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x2034, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x4030, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x4034, iwl9560_2ac_160_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x40A4, iwl9462_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x4234, iwl9560_2ac_cfg_soc)},
+-	{IWL_PCI_DEVICE(0xA0F0, 0x42A4, iwl9462_2ac_cfg_soc)},
++
++	{IWL_PCI_DEVICE(0xA0F0, 0x0030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x0034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x0038, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x003C, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x0060, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x0064, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x00A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x00A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x0230, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x0234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x0238, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x023C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x0260, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x0264, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x02A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x02A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x1030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x1551, killer1550s_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x1552, killer1550i_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x2030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x2034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x4030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x4034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x40A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x4234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++	{IWL_PCI_DEVICE(0xA0F0, 0x42A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++
+ 	{IWL_PCI_DEVICE(0xA370, 0x0030, iwl9560_2ac_160_cfg_soc)},
+ 	{IWL_PCI_DEVICE(0xA370, 0x0034, iwl9560_2ac_cfg_soc)},
+ 	{IWL_PCI_DEVICE(0xA370, 0x0038, iwl9560_2ac_160_cfg_soc)},
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index 240f762b3749..103ed00775eb 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -719,7 +719,6 @@ err_unmap:
+ 	xenvif_unmap_frontend_data_rings(queue);
+ 	netif_napi_del(&queue->napi);
+ err:
+-	module_put(THIS_MODULE);
+ 	return err;
+ }
+ 
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index d3d6b7bd6903..36a5ed1eacbe 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -103,10 +103,13 @@ static void nvme_set_queue_dying(struct nvme_ns *ns)
+ 	 */
+ 	if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags))
+ 		return;
+-	revalidate_disk(ns->disk);
+ 	blk_set_queue_dying(ns->queue);
+ 	/* Forcibly unquiesce queues to avoid blocking dispatch */
+ 	blk_mq_unquiesce_queue(ns->queue);
++	/*
++	 * Revalidate after unblocking dispatchers that may be holding bd_butex
++	 */
++	revalidate_disk(ns->disk);
+ }
+ 
+ static void nvme_queue_scan(struct nvme_ctrl *ctrl)
+@@ -849,7 +852,7 @@ out:
+ static int nvme_submit_user_cmd(struct request_queue *q,
+ 		struct nvme_command *cmd, void __user *ubuffer,
+ 		unsigned bufflen, void __user *meta_buffer, unsigned meta_len,
+-		u32 meta_seed, u32 *result, unsigned timeout)
++		u32 meta_seed, u64 *result, unsigned timeout)
+ {
+ 	bool write = nvme_is_write(cmd);
+ 	struct nvme_ns *ns = q->queuedata;
+@@ -890,7 +893,7 @@ static int nvme_submit_user_cmd(struct request_queue *q,
+ 	else
+ 		ret = nvme_req(req)->status;
+ 	if (result)
+-		*result = le32_to_cpu(nvme_req(req)->result.u32);
++		*result = le64_to_cpu(nvme_req(req)->result.u64);
+ 	if (meta && !ret && !write) {
+ 		if (copy_to_user(meta_buffer, meta, meta_len))
+ 			ret = -EFAULT;
+@@ -1336,6 +1339,54 @@ static int nvme_user_cmd(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
+ 	struct nvme_command c;
+ 	unsigned timeout = 0;
+ 	u32 effects;
++	u64 result;
++	int status;
++
++	if (!capable(CAP_SYS_ADMIN))
++		return -EACCES;
++	if (copy_from_user(&cmd, ucmd, sizeof(cmd)))
++		return -EFAULT;
++	if (cmd.flags)
++		return -EINVAL;
++
++	memset(&c, 0, sizeof(c));
++	c.common.opcode = cmd.opcode;
++	c.common.flags = cmd.flags;
++	c.common.nsid = cpu_to_le32(cmd.nsid);
++	c.common.cdw2[0] = cpu_to_le32(cmd.cdw2);
++	c.common.cdw2[1] = cpu_to_le32(cmd.cdw3);
++	c.common.cdw10 = cpu_to_le32(cmd.cdw10);
++	c.common.cdw11 = cpu_to_le32(cmd.cdw11);
++	c.common.cdw12 = cpu_to_le32(cmd.cdw12);
++	c.common.cdw13 = cpu_to_le32(cmd.cdw13);
++	c.common.cdw14 = cpu_to_le32(cmd.cdw14);
++	c.common.cdw15 = cpu_to_le32(cmd.cdw15);
++
++	if (cmd.timeout_ms)
++		timeout = msecs_to_jiffies(cmd.timeout_ms);
++
++	effects = nvme_passthru_start(ctrl, ns, cmd.opcode);
++	status = nvme_submit_user_cmd(ns ? ns->queue : ctrl->admin_q, &c,
++			(void __user *)(uintptr_t)cmd.addr, cmd.data_len,
++			(void __user *)(uintptr_t)cmd.metadata,
++			cmd.metadata_len, 0, &result, timeout);
++	nvme_passthru_end(ctrl, effects);
++
++	if (status >= 0) {
++		if (put_user(result, &ucmd->result))
++			return -EFAULT;
++	}
++
++	return status;
++}
++
++static int nvme_user_cmd64(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
++			struct nvme_passthru_cmd64 __user *ucmd)
++{
++	struct nvme_passthru_cmd64 cmd;
++	struct nvme_command c;
++	unsigned timeout = 0;
++	u32 effects;
+ 	int status;
+ 
+ 	if (!capable(CAP_SYS_ADMIN))
+@@ -1406,6 +1457,41 @@ static void nvme_put_ns_from_disk(struct nvme_ns_head *head, int idx)
+ 		srcu_read_unlock(&head->srcu, idx);
+ }
+ 
++static bool is_ctrl_ioctl(unsigned int cmd)
++{
++	if (cmd == NVME_IOCTL_ADMIN_CMD || cmd == NVME_IOCTL_ADMIN64_CMD)
++		return true;
++	if (is_sed_ioctl(cmd))
++		return true;
++	return false;
++}
++
++static int nvme_handle_ctrl_ioctl(struct nvme_ns *ns, unsigned int cmd,
++				  void __user *argp,
++				  struct nvme_ns_head *head,
++				  int srcu_idx)
++{
++	struct nvme_ctrl *ctrl = ns->ctrl;
++	int ret;
++
++	nvme_get_ctrl(ns->ctrl);
++	nvme_put_ns_from_disk(head, srcu_idx);
++
++	switch (cmd) {
++	case NVME_IOCTL_ADMIN_CMD:
++		ret = nvme_user_cmd(ctrl, NULL, argp);
++		break;
++	case NVME_IOCTL_ADMIN64_CMD:
++		ret = nvme_user_cmd64(ctrl, NULL, argp);
++		break;
++	default:
++		ret = sed_ioctl(ctrl->opal_dev, cmd, argp);
++		break;
++	}
++	nvme_put_ctrl(ctrl);
++	return ret;
++}
++
+ static int nvme_ioctl(struct block_device *bdev, fmode_t mode,
+ 		unsigned int cmd, unsigned long arg)
+ {
+@@ -1423,20 +1509,8 @@ static int nvme_ioctl(struct block_device *bdev, fmode_t mode,
+ 	 * seperately and drop the ns SRCU reference early.  This avoids a
+ 	 * deadlock when deleting namespaces using the passthrough interface.
+ 	 */
+-	if (cmd == NVME_IOCTL_ADMIN_CMD || is_sed_ioctl(cmd)) {
+-		struct nvme_ctrl *ctrl = ns->ctrl;
+-
+-		nvme_get_ctrl(ns->ctrl);
+-		nvme_put_ns_from_disk(head, srcu_idx);
+-
+-		if (cmd == NVME_IOCTL_ADMIN_CMD)
+-			ret = nvme_user_cmd(ctrl, NULL, argp);
+-		else
+-			ret = sed_ioctl(ctrl->opal_dev, cmd, argp);
+-
+-		nvme_put_ctrl(ctrl);
+-		return ret;
+-	}
++	if (is_ctrl_ioctl(cmd))
++		return nvme_handle_ctrl_ioctl(ns, cmd, argp, head, srcu_idx);
+ 
+ 	switch (cmd) {
+ 	case NVME_IOCTL_ID:
+@@ -1449,6 +1523,9 @@ static int nvme_ioctl(struct block_device *bdev, fmode_t mode,
+ 	case NVME_IOCTL_SUBMIT_IO:
+ 		ret = nvme_submit_io(ns, argp);
+ 		break;
++	case NVME_IOCTL_IO64_CMD:
++		ret = nvme_user_cmd64(ns->ctrl, ns, argp);
++		break;
+ 	default:
+ 		if (ns->ndev)
+ 			ret = nvme_nvm_ioctl(ns, cmd, arg);
+@@ -2267,6 +2344,16 @@ static const struct nvme_core_quirk_entry core_quirks[] = {
+ 		.vid = 0x14a4,
+ 		.fr = "22301111",
+ 		.quirks = NVME_QUIRK_SIMPLE_SUSPEND,
++	},
++	{
++		/*
++		 * This Kingston E8FK11.T firmware version has no interrupt
++		 * after resume with actions related to suspend to idle
++		 * https://bugzilla.kernel.org/show_bug.cgi?id=204887
++		 */
++		.vid = 0x2646,
++		.fr = "E8FK11.T",
++		.quirks = NVME_QUIRK_SIMPLE_SUSPEND,
+ 	}
+ };
+ 
+@@ -2510,8 +2597,9 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
+ 		list_add_tail(&subsys->entry, &nvme_subsystems);
+ 	}
+ 
+-	if (sysfs_create_link(&subsys->dev.kobj, &ctrl->device->kobj,
+-			dev_name(ctrl->device))) {
++	ret = sysfs_create_link(&subsys->dev.kobj, &ctrl->device->kobj,
++				dev_name(ctrl->device));
++	if (ret) {
+ 		dev_err(ctrl->device,
+ 			"failed to create sysfs link from subsystem.\n");
+ 		goto out_put_subsystem;
+@@ -2812,6 +2900,8 @@ static long nvme_dev_ioctl(struct file *file, unsigned int cmd,
+ 	switch (cmd) {
+ 	case NVME_IOCTL_ADMIN_CMD:
+ 		return nvme_user_cmd(ctrl, NULL, argp);
++	case NVME_IOCTL_ADMIN64_CMD:
++		return nvme_user_cmd64(ctrl, NULL, argp);
+ 	case NVME_IOCTL_IO_CMD:
+ 		return nvme_dev_user_cmd(ctrl, argp);
+ 	case NVME_IOCTL_RESET:
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 732d5b63ec05..2303d44fc3cb 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -769,7 +769,8 @@ static blk_status_t nvme_setup_prp_simple(struct nvme_dev *dev,
+ 		struct bio_vec *bv)
+ {
+ 	struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
+-	unsigned int first_prp_len = dev->ctrl.page_size - bv->bv_offset;
++	unsigned int offset = bv->bv_offset & (dev->ctrl.page_size - 1);
++	unsigned int first_prp_len = dev->ctrl.page_size - offset;
+ 
+ 	iod->first_dma = dma_map_bvec(dev->dev, bv, rq_dma_dir(req), 0);
+ 	if (dma_mapping_error(dev->dev, iod->first_dma))
+@@ -2894,11 +2895,21 @@ static int nvme_suspend(struct device *dev)
+ 	if (ret < 0)
+ 		goto unfreeze;
+ 
++	/*
++	 * A saved state prevents pci pm from generically controlling the
++	 * device's power. If we're using protocol specific settings, we don't
++	 * want pci interfering.
++	 */
++	pci_save_state(pdev);
++
+ 	ret = nvme_set_power_state(ctrl, ctrl->npss);
+ 	if (ret < 0)
+ 		goto unfreeze;
+ 
+ 	if (ret) {
++		/* discard the saved state */
++		pci_load_saved_state(pdev, NULL);
++
+ 		/*
+ 		 * Clearing npss forces a controller reset on resume. The
+ 		 * correct value will be resdicovered then.
+@@ -2906,14 +2917,7 @@ static int nvme_suspend(struct device *dev)
+ 		nvme_dev_disable(ndev, true);
+ 		ctrl->npss = 0;
+ 		ret = 0;
+-		goto unfreeze;
+ 	}
+-	/*
+-	 * A saved state prevents pci pm from generically controlling the
+-	 * device's power. If we're using protocol specific settings, we don't
+-	 * want pci interfering.
+-	 */
+-	pci_save_state(pdev);
+ unfreeze:
+ 	nvme_unfreeze(ctrl);
+ 	return ret;
+@@ -3038,6 +3042,9 @@ static const struct pci_device_id nvme_id_table[] = {
+ 		.driver_data = NVME_QUIRK_LIGHTNVM, },
+ 	{ PCI_DEVICE(0x10ec, 0x5762),   /* ADATA SX6000LNP */
+ 		.driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, },
++	{ PCI_DEVICE(0x1cc1, 0x8201),   /* ADATA SX8200PNP 512GB */
++		.driver_data = NVME_QUIRK_NO_DEEPEST_PS |
++				NVME_QUIRK_IGNORE_DEV_SUBNQN, },
+ 	{ PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) },
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 1a6449bc547b..842ef876724f 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -427,7 +427,7 @@ static void nvme_rdma_destroy_queue_ib(struct nvme_rdma_queue *queue)
+ static int nvme_rdma_get_max_fr_pages(struct ib_device *ibdev)
+ {
+ 	return min_t(u32, NVME_RDMA_MAX_SEGMENTS,
+-		     ibdev->attrs.max_fast_reg_page_list_len);
++		     ibdev->attrs.max_fast_reg_page_list_len - 1);
+ }
+ 
+ static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue)
+@@ -437,7 +437,7 @@ static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue)
+ 	const int cq_factor = send_wr_factor + 1;	/* + RECV */
+ 	int comp_vector, idx = nvme_rdma_queue_idx(queue);
+ 	enum ib_poll_context poll_ctx;
+-	int ret;
++	int ret, pages_per_mr;
+ 
+ 	queue->device = nvme_rdma_find_get_device(queue->cm_id);
+ 	if (!queue->device) {
+@@ -479,10 +479,16 @@ static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue)
+ 		goto out_destroy_qp;
+ 	}
+ 
++	/*
++	 * Currently we don't use SG_GAPS MR's so if the first entry is
++	 * misaligned we'll end up using two entries for a single data page,
++	 * so one additional entry is required.
++	 */
++	pages_per_mr = nvme_rdma_get_max_fr_pages(ibdev) + 1;
+ 	ret = ib_mr_pool_init(queue->qp, &queue->qp->rdma_mrs,
+ 			      queue->queue_size,
+ 			      IB_MR_TYPE_MEM_REG,
+-			      nvme_rdma_get_max_fr_pages(ibdev), 0);
++			      pages_per_mr, 0);
+ 	if (ret) {
+ 		dev_err(queue->ctrl->ctrl.device,
+ 			"failed to initialize MR pool sized %d for QID %d\n",
+@@ -614,7 +620,8 @@ static int nvme_rdma_start_queue(struct nvme_rdma_ctrl *ctrl, int idx)
+ 	if (!ret) {
+ 		set_bit(NVME_RDMA_Q_LIVE, &queue->flags);
+ 	} else {
+-		__nvme_rdma_stop_queue(queue);
++		if (test_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags))
++			__nvme_rdma_stop_queue(queue);
+ 		dev_info(ctrl->ctrl.device,
+ 			"failed to connect queue: %d ret=%d\n", idx, ret);
+ 	}
+@@ -824,8 +831,8 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl,
+ 	if (error)
+ 		goto out_stop_queue;
+ 
+-	ctrl->ctrl.max_hw_sectors =
+-		(ctrl->max_fr_pages - 1) << (ilog2(SZ_4K) - 9);
++	ctrl->ctrl.max_segments = ctrl->max_fr_pages;
++	ctrl->ctrl.max_hw_sectors = ctrl->max_fr_pages << (ilog2(SZ_4K) - 9);
+ 
+ 	error = nvme_init_identify(&ctrl->ctrl);
+ 	if (error)
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 606b13d35d16..bdadb27b28bb 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -1039,7 +1039,7 @@ static void nvme_tcp_io_work(struct work_struct *w)
+ {
+ 	struct nvme_tcp_queue *queue =
+ 		container_of(w, struct nvme_tcp_queue, io_work);
+-	unsigned long start = jiffies + msecs_to_jiffies(1);
++	unsigned long deadline = jiffies + msecs_to_jiffies(1);
+ 
+ 	do {
+ 		bool pending = false;
+@@ -1064,7 +1064,7 @@ static void nvme_tcp_io_work(struct work_struct *w)
+ 		if (!pending)
+ 			return;
+ 
+-	} while (time_after(jiffies, start)); /* quota is exhausted */
++	} while (!time_after(jiffies, deadline)); /* quota is exhausted */
+ 
+ 	queue_work_on(queue->io_cpu, nvme_tcp_wq, &queue->io_work);
+ }
+diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
+index 7989703b883c..6bd610ee2cd7 100644
+--- a/drivers/of/of_reserved_mem.c
++++ b/drivers/of/of_reserved_mem.c
+@@ -324,8 +324,10 @@ int of_reserved_mem_device_init_by_idx(struct device *dev,
+ 	if (!target)
+ 		return -ENODEV;
+ 
+-	if (!of_device_is_available(target))
++	if (!of_device_is_available(target)) {
++		of_node_put(target);
+ 		return 0;
++	}
+ 
+ 	rmem = __find_rmem(target);
+ 	of_node_put(target);
+diff --git a/drivers/opp/of.c b/drivers/opp/of.c
+index b313aca9894f..4c7feb3ac4cd 100644
+--- a/drivers/opp/of.c
++++ b/drivers/opp/of.c
+@@ -77,8 +77,6 @@ static struct dev_pm_opp *_find_opp_of_np(struct opp_table *opp_table,
+ {
+ 	struct dev_pm_opp *opp;
+ 
+-	lockdep_assert_held(&opp_table_lock);
+-
+ 	mutex_lock(&opp_table->lock);
+ 
+ 	list_for_each_entry(opp, &opp_table->opp_list, node) {
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index b97d9e10c9cc..57f15a7e6f0b 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -958,19 +958,6 @@ void pci_refresh_power_state(struct pci_dev *dev)
+ 	pci_update_current_state(dev, dev->current_state);
+ }
+ 
+-/**
+- * pci_power_up - Put the given device into D0 forcibly
+- * @dev: PCI device to power up
+- */
+-void pci_power_up(struct pci_dev *dev)
+-{
+-	if (platform_pci_power_manageable(dev))
+-		platform_pci_set_power_state(dev, PCI_D0);
+-
+-	pci_raw_set_power_state(dev, PCI_D0);
+-	pci_update_current_state(dev, PCI_D0);
+-}
+-
+ /**
+  * pci_platform_power_transition - Use platform to change device power state
+  * @dev: PCI device to handle.
+@@ -1153,6 +1140,17 @@ int pci_set_power_state(struct pci_dev *dev, pci_power_t state)
+ }
+ EXPORT_SYMBOL(pci_set_power_state);
+ 
++/**
++ * pci_power_up - Put the given device into D0 forcibly
++ * @dev: PCI device to power up
++ */
++void pci_power_up(struct pci_dev *dev)
++{
++	__pci_start_power_transition(dev, PCI_D0);
++	pci_raw_set_power_state(dev, PCI_D0);
++	pci_update_current_state(dev, PCI_D0);
++}
++
+ /**
+  * pci_choose_state - Choose the power state of a PCI device
+  * @dev: PCI device to be suspended
+diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
+index 03ec7a5d9d0b..bf049d1bbb87 100644
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -1513,7 +1513,6 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+ 			DMI_MATCH(DMI_PRODUCT_FAMILY, "Intel_Strago"),
+-			DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
+ 		},
+ 	},
+ 	{
+@@ -1521,7 +1520,6 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "HP"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Setzer"),
+-			DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
+ 		},
+ 	},
+ 	{
+@@ -1529,7 +1527,6 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Cyan"),
+-			DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
+ 		},
+ 	},
+ 	{
+@@ -1537,7 +1534,6 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Celes"),
+-			DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
+ 		},
+ 	},
+ 	{}
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+index 6462d3ca7ceb..f2f5fcd9a237 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -183,10 +183,10 @@ static struct armada_37xx_pin_group armada_37xx_nb_groups[] = {
+ 	PIN_GRP_EXTRA("uart2", 9, 2, BIT(1) | BIT(13) | BIT(14) | BIT(19),
+ 		      BIT(1) | BIT(13) | BIT(14), BIT(1) | BIT(19),
+ 		      18, 2, "gpio", "uart"),
+-	PIN_GRP_GPIO("led0_od", 11, 1, BIT(20), "led"),
+-	PIN_GRP_GPIO("led1_od", 12, 1, BIT(21), "led"),
+-	PIN_GRP_GPIO("led2_od", 13, 1, BIT(22), "led"),
+-	PIN_GRP_GPIO("led3_od", 14, 1, BIT(23), "led"),
++	PIN_GRP_GPIO_2("led0_od", 11, 1, BIT(20), BIT(20), 0, "led"),
++	PIN_GRP_GPIO_2("led1_od", 12, 1, BIT(21), BIT(21), 0, "led"),
++	PIN_GRP_GPIO_2("led2_od", 13, 1, BIT(22), BIT(22), 0, "led"),
++	PIN_GRP_GPIO_2("led3_od", 14, 1, BIT(23), BIT(23), 0, "led"),
+ 
+ };
+ 
+@@ -221,11 +221,11 @@ static const struct armada_37xx_pin_data armada_37xx_pin_sb = {
+ };
+ 
+ static inline void armada_37xx_update_reg(unsigned int *reg,
+-					  unsigned int offset)
++					  unsigned int *offset)
+ {
+ 	/* We never have more than 2 registers */
+-	if (offset >= GPIO_PER_REG) {
+-		offset -= GPIO_PER_REG;
++	if (*offset >= GPIO_PER_REG) {
++		*offset -= GPIO_PER_REG;
+ 		*reg += sizeof(u32);
+ 	}
+ }
+@@ -376,7 +376,7 @@ static inline void armada_37xx_irq_update_reg(unsigned int *reg,
+ {
+ 	int offset = irqd_to_hwirq(d);
+ 
+-	armada_37xx_update_reg(reg, offset);
++	armada_37xx_update_reg(reg, &offset);
+ }
+ 
+ static int armada_37xx_gpio_direction_input(struct gpio_chip *chip,
+@@ -386,7 +386,7 @@ static int armada_37xx_gpio_direction_input(struct gpio_chip *chip,
+ 	unsigned int reg = OUTPUT_EN;
+ 	unsigned int mask;
+ 
+-	armada_37xx_update_reg(&reg, offset);
++	armada_37xx_update_reg(&reg, &offset);
+ 	mask = BIT(offset);
+ 
+ 	return regmap_update_bits(info->regmap, reg, mask, 0);
+@@ -399,7 +399,7 @@ static int armada_37xx_gpio_get_direction(struct gpio_chip *chip,
+ 	unsigned int reg = OUTPUT_EN;
+ 	unsigned int val, mask;
+ 
+-	armada_37xx_update_reg(&reg, offset);
++	armada_37xx_update_reg(&reg, &offset);
+ 	mask = BIT(offset);
+ 	regmap_read(info->regmap, reg, &val);
+ 
+@@ -413,7 +413,7 @@ static int armada_37xx_gpio_direction_output(struct gpio_chip *chip,
+ 	unsigned int reg = OUTPUT_EN;
+ 	unsigned int mask, val, ret;
+ 
+-	armada_37xx_update_reg(&reg, offset);
++	armada_37xx_update_reg(&reg, &offset);
+ 	mask = BIT(offset);
+ 
+ 	ret = regmap_update_bits(info->regmap, reg, mask, mask);
+@@ -434,7 +434,7 @@ static int armada_37xx_gpio_get(struct gpio_chip *chip, unsigned int offset)
+ 	unsigned int reg = INPUT_VAL;
+ 	unsigned int val, mask;
+ 
+-	armada_37xx_update_reg(&reg, offset);
++	armada_37xx_update_reg(&reg, &offset);
+ 	mask = BIT(offset);
+ 
+ 	regmap_read(info->regmap, reg, &val);
+@@ -449,7 +449,7 @@ static void armada_37xx_gpio_set(struct gpio_chip *chip, unsigned int offset,
+ 	unsigned int reg = OUTPUT_VAL;
+ 	unsigned int mask, val;
+ 
+-	armada_37xx_update_reg(&reg, offset);
++	armada_37xx_update_reg(&reg, &offset);
+ 	mask = BIT(offset);
+ 	val = value ? mask : 0;
+ 
+diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
+index 1058b4b5cc1e..35a0e9569239 100644
+--- a/drivers/s390/crypto/zcrypt_api.c
++++ b/drivers/s390/crypto/zcrypt_api.c
+@@ -539,8 +539,7 @@ static int zcrypt_release(struct inode *inode, struct file *filp)
+ 	if (filp->f_inode->i_cdev == &zcrypt_cdev) {
+ 		struct zcdn_device *zcdndev;
+ 
+-		if (mutex_lock_interruptible(&ap_perms_mutex))
+-			return -ERESTARTSYS;
++		mutex_lock(&ap_perms_mutex);
+ 		zcdndev = find_zcdndev_by_devt(filp->f_inode->i_rdev);
+ 		mutex_unlock(&ap_perms_mutex);
+ 		if (zcdndev) {
+diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
+index 296bbc3c4606..cf63916814cc 100644
+--- a/drivers/s390/scsi/zfcp_fsf.c
++++ b/drivers/s390/scsi/zfcp_fsf.c
+@@ -27,6 +27,11 @@
+ 
+ struct kmem_cache *zfcp_fsf_qtcb_cache;
+ 
++static bool ber_stop = true;
++module_param(ber_stop, bool, 0600);
++MODULE_PARM_DESC(ber_stop,
++		 "Shuts down FCP devices for FCP channels that report a bit-error count in excess of its threshold (default on)");
++
+ static void zfcp_fsf_request_timeout_handler(struct timer_list *t)
+ {
+ 	struct zfcp_fsf_req *fsf_req = from_timer(fsf_req, t, timer);
+@@ -236,10 +241,15 @@ static void zfcp_fsf_status_read_handler(struct zfcp_fsf_req *req)
+ 	case FSF_STATUS_READ_SENSE_DATA_AVAIL:
+ 		break;
+ 	case FSF_STATUS_READ_BIT_ERROR_THRESHOLD:
+-		dev_warn(&adapter->ccw_device->dev,
+-			 "The error threshold for checksum statistics "
+-			 "has been exceeded\n");
+ 		zfcp_dbf_hba_bit_err("fssrh_3", req);
++		if (ber_stop) {
++			dev_warn(&adapter->ccw_device->dev,
++				 "All paths over this FCP device are disused because of excessive bit errors\n");
++			zfcp_erp_adapter_shutdown(adapter, 0, "fssrh_b");
++		} else {
++			dev_warn(&adapter->ccw_device->dev,
++				 "The error threshold for checksum statistics has been exceeded\n");
++		}
+ 		break;
+ 	case FSF_STATUS_READ_LINK_DOWN:
+ 		zfcp_fsf_status_read_link_down(req);
+diff --git a/drivers/scsi/ch.c b/drivers/scsi/ch.c
+index 5f8153c37f77..76751d6c7f0d 100644
+--- a/drivers/scsi/ch.c
++++ b/drivers/scsi/ch.c
+@@ -579,7 +579,6 @@ ch_release(struct inode *inode, struct file *file)
+ 	scsi_changer *ch = file->private_data;
+ 
+ 	scsi_device_put(ch->device);
+-	ch->device = NULL;
+ 	file->private_data = NULL;
+ 	kref_put(&ch->ref, ch_destroy);
+ 	return 0;
+diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
+index 45a66048801b..ff6d4aa92421 100644
+--- a/drivers/scsi/megaraid.c
++++ b/drivers/scsi/megaraid.c
+@@ -4183,11 +4183,11 @@ megaraid_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ 		 */
+ 		if (pdev->subsystem_vendor == PCI_VENDOR_ID_COMPAQ &&
+ 		    pdev->subsystem_device == 0xC000)
+-		   	return -ENODEV;
++			goto out_disable_device;
+ 		/* Now check the magic signature byte */
+ 		pci_read_config_word(pdev, PCI_CONF_AMISIG, &magic);
+ 		if (magic != HBA_SIGNATURE_471 && magic != HBA_SIGNATURE)
+-			return -ENODEV;
++			goto out_disable_device;
+ 		/* Ok it is probably a megaraid */
+ 	}
+ 
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index bad2b12604f1..a2922b17b55b 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -2338,6 +2338,7 @@ typedef struct fc_port {
+ 	unsigned int query:1;
+ 	unsigned int id_changed:1;
+ 	unsigned int scan_needed:1;
++	unsigned int n2n_flag:1;
+ 
+ 	struct completion nvme_del_done;
+ 	uint32_t nvme_prli_service_param;
+@@ -2388,7 +2389,6 @@ typedef struct fc_port {
+ 	uint8_t fc4_type;
+ 	uint8_t	fc4f_nvme;
+ 	uint8_t scan_state;
+-	uint8_t n2n_flag;
+ 
+ 	unsigned long last_queue_full;
+ 	unsigned long last_ramp_up;
+@@ -2979,6 +2979,7 @@ enum scan_flags_t {
+ enum fc4type_t {
+ 	FS_FC4TYPE_FCP	= BIT_0,
+ 	FS_FC4TYPE_NVME	= BIT_1,
++	FS_FCP_IS_N2N = BIT_7,
+ };
+ 
+ struct fab_scan_rp {
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index afcd9a885884..cd74cc9651de 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -746,12 +746,15 @@ static void qla24xx_handle_gnl_done_event(scsi_qla_host_t *vha,
+ 			break;
+ 		default:
+ 			if ((id.b24 != fcport->d_id.b24 &&
+-			    fcport->d_id.b24) ||
++			    fcport->d_id.b24 &&
++			    fcport->loop_id != FC_NO_LOOP_ID) ||
+ 			    (fcport->loop_id != FC_NO_LOOP_ID &&
+ 				fcport->loop_id != loop_id)) {
+ 				ql_dbg(ql_dbg_disc, vha, 0x20e3,
+ 				    "%s %d %8phC post del sess\n",
+ 				    __func__, __LINE__, fcport->port_name);
++				if (fcport->n2n_flag)
++					fcport->d_id.b24 = 0;
+ 				qlt_schedule_sess_for_deletion(fcport);
+ 				return;
+ 			}
+@@ -759,6 +762,8 @@ static void qla24xx_handle_gnl_done_event(scsi_qla_host_t *vha,
+ 		}
+ 
+ 		fcport->loop_id = loop_id;
++		if (fcport->n2n_flag)
++			fcport->d_id.b24 = id.b24;
+ 
+ 		wwn = wwn_to_u64(fcport->port_name);
+ 		qlt_find_sess_invalidate_other(vha, wwn,
+@@ -966,7 +971,7 @@ qla24xx_async_gnl_sp_done(void *s, int res)
+ 		wwn = wwn_to_u64(e->port_name);
+ 
+ 		ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0x20e8,
+-		    "%s %8phC %02x:%02x:%02x state %d/%d lid %x \n",
++		    "%s %8phC %02x:%02x:%02x CLS %x/%x lid %x \n",
+ 		    __func__, (void *)&wwn, e->port_id[2], e->port_id[1],
+ 		    e->port_id[0], e->current_login_state, e->last_login_state,
+ 		    (loop_id & 0x7fff));
+@@ -1498,7 +1503,8 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport)
+ 	     (fcport->fw_login_state == DSC_LS_PRLI_PEND)))
+ 		return 0;
+ 
+-	if (fcport->fw_login_state == DSC_LS_PLOGI_COMP) {
++	if (fcport->fw_login_state == DSC_LS_PLOGI_COMP &&
++	    !N2N_TOPO(vha->hw)) {
+ 		if (time_before_eq(jiffies, fcport->plogi_nack_done_deadline)) {
+ 			set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
+ 			return 0;
+@@ -1569,8 +1575,9 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport)
+ 				qla24xx_post_gpdb_work(vha, fcport, 0);
+ 			}  else {
+ 				ql_dbg(ql_dbg_disc, vha, 0x2118,
+-				    "%s %d %8phC post NVMe PRLI\n",
+-				    __func__, __LINE__, fcport->port_name);
++				    "%s %d %8phC post %s PRLI\n",
++				    __func__, __LINE__, fcport->port_name,
++				    fcport->fc4f_nvme ? "NVME" : "FC");
+ 				qla24xx_post_prli_work(vha, fcport);
+ 			}
+ 			break;
+@@ -1924,17 +1931,38 @@ qla24xx_handle_prli_done_event(struct scsi_qla_host *vha, struct event_arg *ea)
+ 			break;
+ 		}
+ 
+-		if (ea->fcport->n2n_flag) {
++		if (ea->fcport->fc4f_nvme) {
+ 			ql_dbg(ql_dbg_disc, vha, 0x2118,
+ 				"%s %d %8phC post fc4 prli\n",
+ 				__func__, __LINE__, ea->fcport->port_name);
+ 			ea->fcport->fc4f_nvme = 0;
+-			ea->fcport->n2n_flag = 0;
+ 			qla24xx_post_prli_work(vha, ea->fcport);
++			return;
++		}
++
++		/* at this point both PRLI NVME & PRLI FCP failed */
++		if (N2N_TOPO(vha->hw)) {
++			if (ea->fcport->n2n_link_reset_cnt < 3) {
++				ea->fcport->n2n_link_reset_cnt++;
++				/*
++				 * remote port is not sending Plogi. Reset
++				 * link to kick start his state machine
++				 */
++				set_bit(N2N_LINK_RESET, &vha->dpc_flags);
++			} else {
++				ql_log(ql_log_warn, vha, 0x2119,
++				    "%s %d %8phC Unable to reconnect\n",
++				    __func__, __LINE__, ea->fcport->port_name);
++			}
++		} else {
++			/*
++			 * switch connect. login failed. Take connection
++			 * down and allow relogin to retrigger
++			 */
++			ea->fcport->flags &= ~FCF_ASYNC_SENT;
++			ea->fcport->keep_nport_handle = 0;
++			qlt_schedule_sess_for_deletion(ea->fcport);
+ 		}
+-		ql_dbg(ql_dbg_disc, vha, 0x2119,
+-		    "%s %d %8phC unhandle event of %x\n",
+-		    __func__, __LINE__, ea->fcport->port_name, ea->data[0]);
+ 		break;
+ 	}
+ }
+@@ -3268,7 +3296,7 @@ try_eft:
+ 
+ 		for (j = 0; j < 2; j++, fwdt++) {
+ 			if (!fwdt->template) {
+-				ql_log(ql_log_warn, vha, 0x00ba,
++				ql_dbg(ql_dbg_init, vha, 0x00ba,
+ 				    "-> fwdt%u no template\n", j);
+ 				continue;
+ 			}
+@@ -5078,28 +5106,47 @@ qla2x00_configure_local_loop(scsi_qla_host_t *vha)
+ 	unsigned long flags;
+ 
+ 	/* Inititae N2N login. */
+-	if (test_and_clear_bit(N2N_LOGIN_NEEDED, &vha->dpc_flags)) {
+-		/* borrowing */
+-		u32 *bp, i, sz;
+-
+-		memset(ha->init_cb, 0, ha->init_cb_size);
+-		sz = min_t(int, sizeof(struct els_plogi_payload),
+-		    ha->init_cb_size);
+-		rval = qla24xx_get_port_login_templ(vha, ha->init_cb_dma,
+-		    (void *)ha->init_cb, sz);
+-		if (rval == QLA_SUCCESS) {
+-			bp = (uint32_t *)ha->init_cb;
+-			for (i = 0; i < sz/4 ; i++, bp++)
+-				*bp = cpu_to_be32(*bp);
++	if (N2N_TOPO(ha)) {
++		if (test_and_clear_bit(N2N_LOGIN_NEEDED, &vha->dpc_flags)) {
++			/* borrowing */
++			u32 *bp, i, sz;
++
++			memset(ha->init_cb, 0, ha->init_cb_size);
++			sz = min_t(int, sizeof(struct els_plogi_payload),
++			    ha->init_cb_size);
++			rval = qla24xx_get_port_login_templ(vha,
++			    ha->init_cb_dma, (void *)ha->init_cb, sz);
++			if (rval == QLA_SUCCESS) {
++				bp = (uint32_t *)ha->init_cb;
++				for (i = 0; i < sz/4 ; i++, bp++)
++					*bp = cpu_to_be32(*bp);
+ 
+-			memcpy(&ha->plogi_els_payld.data, (void *)ha->init_cb,
+-			    sizeof(ha->plogi_els_payld.data));
+-			set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
+-		} else {
+-			ql_dbg(ql_dbg_init, vha, 0x00d1,
+-			    "PLOGI ELS param read fail.\n");
++				memcpy(&ha->plogi_els_payld.data,
++				    (void *)ha->init_cb,
++				    sizeof(ha->plogi_els_payld.data));
++				set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
++			} else {
++				ql_dbg(ql_dbg_init, vha, 0x00d1,
++				    "PLOGI ELS param read fail.\n");
++				goto skip_login;
++			}
++		}
++
++		list_for_each_entry(fcport, &vha->vp_fcports, list) {
++			if (fcport->n2n_flag) {
++				qla24xx_fcport_handle_login(vha, fcport);
++				return QLA_SUCCESS;
++			}
++		}
++skip_login:
++		spin_lock_irqsave(&vha->work_lock, flags);
++		vha->scan.scan_retry++;
++		spin_unlock_irqrestore(&vha->work_lock, flags);
++
++		if (vha->scan.scan_retry < MAX_SCAN_RETRIES) {
++			set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
++			set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+ 		}
+-		return QLA_SUCCESS;
+ 	}
+ 
+ 	found_devs = 0;
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index 133f5f6270ff..abfb9c800ce2 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -2257,7 +2257,7 @@ qla2x00_lip_reset(scsi_qla_host_t *vha)
+ 	mbx_cmd_t mc;
+ 	mbx_cmd_t *mcp = &mc;
+ 
+-	ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x105a,
++	ql_dbg(ql_dbg_disc, vha, 0x105a,
+ 	    "Entered %s.\n", __func__);
+ 
+ 	if (IS_CNA_CAPABLE(vha->hw)) {
+@@ -3891,14 +3891,24 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+ 		case TOPO_N2N:
+ 			ha->current_topology = ISP_CFG_N;
+ 			spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
++			list_for_each_entry(fcport, &vha->vp_fcports, list) {
++				fcport->scan_state = QLA_FCPORT_SCAN;
++				fcport->n2n_flag = 0;
++			}
++
+ 			fcport = qla2x00_find_fcport_by_wwpn(vha,
+ 			    rptid_entry->u.f1.port_name, 1);
+ 			spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+ 
+ 			if (fcport) {
+ 				fcport->plogi_nack_done_deadline = jiffies + HZ;
+-				fcport->dm_login_expire = jiffies + 3*HZ;
++				fcport->dm_login_expire = jiffies + 2*HZ;
+ 				fcport->scan_state = QLA_FCPORT_FOUND;
++				fcport->n2n_flag = 1;
++				fcport->keep_nport_handle = 1;
++				if (vha->flags.nvme_enabled)
++					fcport->fc4f_nvme = 1;
++
+ 				switch (fcport->disc_state) {
+ 				case DSC_DELETED:
+ 					set_bit(RELOGIN_NEEDED,
+@@ -3932,7 +3942,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+ 				    rptid_entry->u.f1.port_name,
+ 				    rptid_entry->u.f1.node_name,
+ 				    NULL,
+-				    FC4_TYPE_UNKNOWN);
++				    FS_FCP_IS_N2N);
+ 			}
+ 
+ 			/* if our portname is higher then initiate N2N login */
+@@ -4031,6 +4041,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+ 
+ 		list_for_each_entry(fcport, &vha->vp_fcports, list) {
+ 			fcport->scan_state = QLA_FCPORT_SCAN;
++			fcport->n2n_flag = 0;
+ 		}
+ 
+ 		fcport = qla2x00_find_fcport_by_wwpn(vha,
+@@ -4040,6 +4051,14 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+ 			fcport->login_retry = vha->hw->login_retry_count;
+ 			fcport->plogi_nack_done_deadline = jiffies + HZ;
+ 			fcport->scan_state = QLA_FCPORT_FOUND;
++			fcport->keep_nport_handle = 1;
++			fcport->n2n_flag = 1;
++			fcport->d_id.b.domain =
++				rptid_entry->u.f2.remote_nport_id[2];
++			fcport->d_id.b.area =
++				rptid_entry->u.f2.remote_nport_id[1];
++			fcport->d_id.b.al_pa =
++				rptid_entry->u.f2.remote_nport_id[0];
+ 		}
+ 	}
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 4fda308c3ef5..2835afbd2edc 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1153,6 +1153,7 @@ qla2x00_wait_for_sess_deletion(scsi_qla_host_t *vha)
+ 	qla2x00_mark_all_devices_lost(vha, 0);
+ 
+ 	wait_event_timeout(vha->fcport_waitQ, test_fcport_count(vha), 10*HZ);
++	flush_workqueue(vha->hw->wq);
+ }
+ 
+ /*
+@@ -5049,6 +5050,10 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e)
+ 
+ 			memcpy(fcport->port_name, e->u.new_sess.port_name,
+ 			    WWN_SIZE);
++
++			if (e->u.new_sess.fc4_type & FS_FCP_IS_N2N)
++				fcport->n2n_flag = 1;
++
+ 		} else {
+ 			ql_dbg(ql_dbg_disc, vha, 0xffff,
+ 				   "%s %8phC mem alloc fail.\n",
+@@ -5145,11 +5150,9 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e)
+ 			if (dfcp)
+ 				qlt_schedule_sess_for_deletion(tfcp);
+ 
+-
+-			if (N2N_TOPO(vha->hw))
+-				fcport->flags &= ~FCF_FABRIC_DEVICE;
+-
+ 			if (N2N_TOPO(vha->hw)) {
++				fcport->flags &= ~FCF_FABRIC_DEVICE;
++				fcport->keep_nport_handle = 1;
+ 				if (vha->flags.nvme_enabled) {
+ 					fcport->fc4f_nvme = 1;
+ 					fcport->n2n_flag = 1;
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 459c28aa3b94..1bb0fc9324ea 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -954,7 +954,7 @@ void qlt_free_session_done(struct work_struct *work)
+ 	struct qla_hw_data *ha = vha->hw;
+ 	unsigned long flags;
+ 	bool logout_started = false;
+-	scsi_qla_host_t *base_vha;
++	scsi_qla_host_t *base_vha = pci_get_drvdata(ha->pdev);
+ 	struct qlt_plogi_ack_t *own =
+ 		sess->plogi_link[QLT_PLOGI_LINK_SAME_WWN];
+ 
+@@ -1021,6 +1021,7 @@ void qlt_free_session_done(struct work_struct *work)
+ 
+ 	if (logout_started) {
+ 		bool traced = false;
++		u16 cnt = 0;
+ 
+ 		while (!READ_ONCE(sess->logout_completed)) {
+ 			if (!traced) {
+@@ -1030,6 +1031,9 @@ void qlt_free_session_done(struct work_struct *work)
+ 				traced = true;
+ 			}
+ 			msleep(100);
++			cnt++;
++			if (cnt > 200)
++				break;
+ 		}
+ 
+ 		ql_dbg(ql_dbg_disc, vha, 0xf087,
+@@ -1102,6 +1106,7 @@ void qlt_free_session_done(struct work_struct *work)
+ 	}
+ 
+ 	spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
++	sess->free_pending = 0;
+ 
+ 	ql_dbg(ql_dbg_tgt_mgt, vha, 0xf001,
+ 	    "Unregistration of sess %p %8phC finished fcp_cnt %d\n",
+@@ -1110,17 +1115,8 @@ void qlt_free_session_done(struct work_struct *work)
+ 	if (tgt && (tgt->sess_count == 0))
+ 		wake_up_all(&tgt->waitQ);
+ 
+-	if (vha->fcport_count == 0)
+-		wake_up_all(&vha->fcport_waitQ);
+-
+-	base_vha = pci_get_drvdata(ha->pdev);
+-
+-	sess->free_pending = 0;
+-
+-	if (test_bit(PFLG_DRIVER_REMOVING, &base_vha->pci_flags))
+-		return;
+-
+-	if ((!tgt || !tgt->tgt_stop) && !LOOP_TRANSITION(vha)) {
++	if (!test_bit(PFLG_DRIVER_REMOVING, &base_vha->pci_flags) &&
++	    (!tgt || !tgt->tgt_stop) && !LOOP_TRANSITION(vha)) {
+ 		switch (vha->host->active_mode) {
+ 		case MODE_INITIATOR:
+ 		case MODE_DUAL:
+@@ -1133,6 +1129,9 @@ void qlt_free_session_done(struct work_struct *work)
+ 			break;
+ 		}
+ 	}
++
++	if (vha->fcport_count == 0)
++		wake_up_all(&vha->fcport_waitQ);
+ }
+ 
+ /* ha->tgt.sess_lock supposed to be held on entry */
+@@ -1162,7 +1161,7 @@ void qlt_unreg_sess(struct fc_port *sess)
+ 	sess->last_login_gen = sess->login_gen;
+ 
+ 	INIT_WORK(&sess->free_work, qlt_free_session_done);
+-	schedule_work(&sess->free_work);
++	queue_work(sess->vha->hw->wq, &sess->free_work);
+ }
+ EXPORT_SYMBOL(qlt_unreg_sess);
+ 
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index 1c470e31ae81..ae2fa170f6ad 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -967,6 +967,7 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd, struct scsi_eh_save *ses,
+ 	ses->data_direction = scmd->sc_data_direction;
+ 	ses->sdb = scmd->sdb;
+ 	ses->result = scmd->result;
++	ses->resid_len = scmd->req.resid_len;
+ 	ses->underflow = scmd->underflow;
+ 	ses->prot_op = scmd->prot_op;
+ 	ses->eh_eflags = scmd->eh_eflags;
+@@ -977,6 +978,7 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd, struct scsi_eh_save *ses,
+ 	memset(scmd->cmnd, 0, BLK_MAX_CDB);
+ 	memset(&scmd->sdb, 0, sizeof(scmd->sdb));
+ 	scmd->result = 0;
++	scmd->req.resid_len = 0;
+ 
+ 	if (sense_bytes) {
+ 		scmd->sdb.length = min_t(unsigned, SCSI_SENSE_BUFFERSIZE,
+@@ -1029,6 +1031,7 @@ void scsi_eh_restore_cmnd(struct scsi_cmnd* scmd, struct scsi_eh_save *ses)
+ 	scmd->sc_data_direction = ses->data_direction;
+ 	scmd->sdb = ses->sdb;
+ 	scmd->result = ses->result;
++	scmd->req.resid_len = ses->resid_len;
+ 	scmd->underflow = ses->underflow;
+ 	scmd->prot_op = ses->prot_op;
+ 	scmd->eh_eflags = ses->eh_eflags;
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index 64c96c7828ee..6d7362e7367e 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -730,6 +730,14 @@ sdev_store_delete(struct device *dev, struct device_attribute *attr,
+ 		  const char *buf, size_t count)
+ {
+ 	struct kernfs_node *kn;
++	struct scsi_device *sdev = to_scsi_device(dev);
++
++	/*
++	 * We need to try to get module, avoiding the module been removed
++	 * during delete.
++	 */
++	if (scsi_device_get(sdev))
++		return -ENODEV;
+ 
+ 	kn = sysfs_break_active_protection(&dev->kobj, &attr->attr);
+ 	WARN_ON_ONCE(!kn);
+@@ -744,9 +752,10 @@ sdev_store_delete(struct device *dev, struct device_attribute *attr,
+ 	 * state into SDEV_DEL.
+ 	 */
+ 	device_remove_file(dev, attr);
+-	scsi_remove_device(to_scsi_device(dev));
++	scsi_remove_device(sdev);
+ 	if (kn)
+ 		sysfs_unbreak_active_protection(kn);
++	scsi_device_put(sdev);
+ 	return count;
+ };
+ static DEVICE_ATTR(delete, S_IWUSR, NULL, sdev_store_delete);
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 149d406aacc9..2d77f32e13d5 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1655,7 +1655,8 @@ static int sd_sync_cache(struct scsi_disk *sdkp, struct scsi_sense_hdr *sshdr)
+ 		/* we need to evaluate the error return  */
+ 		if (scsi_sense_valid(sshdr) &&
+ 			(sshdr->asc == 0x3a ||	/* medium not present */
+-			 sshdr->asc == 0x20))	/* invalid command */
++			 sshdr->asc == 0x20 ||	/* invalid command */
++			 (sshdr->asc == 0x74 && sshdr->ascq == 0x71)))	/* drive is password locked */
+ 				/* this is no error here */
+ 				return 0;
+ 
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 029da74bb2f5..e674f6148f69 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -8095,6 +8095,9 @@ int ufshcd_shutdown(struct ufs_hba *hba)
+ {
+ 	int ret = 0;
+ 
++	if (!hba->is_powered)
++		goto out;
++
+ 	if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba))
+ 		goto out;
+ 
+diff --git a/drivers/staging/wlan-ng/cfg80211.c b/drivers/staging/wlan-ng/cfg80211.c
+index eee1998c4b18..fac38c842ac5 100644
+--- a/drivers/staging/wlan-ng/cfg80211.c
++++ b/drivers/staging/wlan-ng/cfg80211.c
+@@ -469,10 +469,8 @@ static int prism2_connect(struct wiphy *wiphy, struct net_device *dev,
+ 	/* Set the encryption - we only support wep */
+ 	if (is_wep) {
+ 		if (sme->key) {
+-			if (sme->key_idx >= NUM_WEPKEYS) {
+-				err = -EINVAL;
+-				goto exit;
+-			}
++			if (sme->key_idx >= NUM_WEPKEYS)
++				return -EINVAL;
+ 
+ 			result = prism2_domibset_uint32(wlandev,
+ 				DIDMIB_DOT11SMT_PRIVACYTABLE_WEPDEFAULTKEYID,
+diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
+index 502e9bf1746f..4a80103675d5 100644
+--- a/drivers/usb/class/usblp.c
++++ b/drivers/usb/class/usblp.c
+@@ -445,6 +445,7 @@ static void usblp_cleanup(struct usblp *usblp)
+ 	kfree(usblp->readbuf);
+ 	kfree(usblp->device_id_string);
+ 	kfree(usblp->statusbuf);
++	usb_put_intf(usblp->intf);
+ 	kfree(usblp);
+ }
+ 
+@@ -1107,7 +1108,7 @@ static int usblp_probe(struct usb_interface *intf,
+ 	init_waitqueue_head(&usblp->wwait);
+ 	init_usb_anchor(&usblp->urbs);
+ 	usblp->ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
+-	usblp->intf = intf;
++	usblp->intf = usb_get_intf(intf);
+ 
+ 	/* Malloc device ID string buffer to the largest expected length,
+ 	 * since we can re-query it on an ioctl and a dynamic string
+@@ -1196,6 +1197,7 @@ abort:
+ 	kfree(usblp->readbuf);
+ 	kfree(usblp->statusbuf);
+ 	kfree(usblp->device_id_string);
++	usb_put_intf(usblp->intf);
+ 	kfree(usblp);
+ abort_ret:
+ 	return retval;
+diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c
+index bb6af6b5ac97..4f1ac9f59f1c 100644
+--- a/drivers/usb/gadget/udc/lpc32xx_udc.c
++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
+@@ -1180,11 +1180,11 @@ static void udc_pop_fifo(struct lpc32xx_udc *udc, u8 *data, u32 bytes)
+ 			tmp = readl(USBD_RXDATA(udc->udp_baseaddr));
+ 
+ 			bl = bytes - n;
+-			if (bl > 3)
+-				bl = 3;
++			if (bl > 4)
++				bl = 4;
+ 
+ 			for (i = 0; i < bl; i++)
+-				data[n + i] = (u8) ((tmp >> (n * 8)) & 0xFF);
++				data[n + i] = (u8) ((tmp >> (i * 8)) & 0xFF);
+ 		}
+ 		break;
+ 
+diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
+index f3108d85e768..15b5f06fb0b3 100644
+--- a/drivers/usb/misc/ldusb.c
++++ b/drivers/usb/misc/ldusb.c
+@@ -380,10 +380,7 @@ static int ld_usb_release(struct inode *inode, struct file *file)
+ 		goto exit;
+ 	}
+ 
+-	if (mutex_lock_interruptible(&dev->mutex)) {
+-		retval = -ERESTARTSYS;
+-		goto exit;
+-	}
++	mutex_lock(&dev->mutex);
+ 
+ 	if (dev->open_count != 1) {
+ 		retval = -ENODEV;
+@@ -467,7 +464,7 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
+ 
+ 	/* wait for data */
+ 	spin_lock_irq(&dev->rbsl);
+-	if (dev->ring_head == dev->ring_tail) {
++	while (dev->ring_head == dev->ring_tail) {
+ 		dev->interrupt_in_done = 0;
+ 		spin_unlock_irq(&dev->rbsl);
+ 		if (file->f_flags & O_NONBLOCK) {
+@@ -477,12 +474,17 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
+ 		retval = wait_event_interruptible(dev->read_wait, dev->interrupt_in_done);
+ 		if (retval < 0)
+ 			goto unlock_exit;
+-	} else {
+-		spin_unlock_irq(&dev->rbsl);
++
++		spin_lock_irq(&dev->rbsl);
+ 	}
++	spin_unlock_irq(&dev->rbsl);
+ 
+ 	/* actual_buffer contains actual_length + interrupt_in_buffer */
+ 	actual_buffer = (size_t *)(dev->ring_buffer + dev->ring_tail * (sizeof(size_t)+dev->interrupt_in_endpoint_size));
++	if (*actual_buffer > dev->interrupt_in_endpoint_size) {
++		retval = -EIO;
++		goto unlock_exit;
++	}
+ 	bytes_to_read = min(count, *actual_buffer);
+ 	if (bytes_to_read < *actual_buffer)
+ 		dev_warn(&dev->intf->dev, "Read buffer overflow, %zd bytes dropped\n",
+@@ -693,10 +695,9 @@ static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id *
+ 		dev_warn(&intf->dev, "Interrupt out endpoint not found (using control endpoint instead)\n");
+ 
+ 	dev->interrupt_in_endpoint_size = usb_endpoint_maxp(dev->interrupt_in_endpoint);
+-	dev->ring_buffer =
+-		kmalloc_array(ring_buffer_size,
+-			      sizeof(size_t) + dev->interrupt_in_endpoint_size,
+-			      GFP_KERNEL);
++	dev->ring_buffer = kcalloc(ring_buffer_size,
++			sizeof(size_t) + dev->interrupt_in_endpoint_size,
++			GFP_KERNEL);
+ 	if (!dev->ring_buffer)
+ 		goto error;
+ 	dev->interrupt_in_buffer = kmalloc(dev->interrupt_in_endpoint_size, GFP_KERNEL);
+diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
+index 9d4c52a7ebe0..62dab2441ec4 100644
+--- a/drivers/usb/misc/legousbtower.c
++++ b/drivers/usb/misc/legousbtower.c
+@@ -419,10 +419,7 @@ static int tower_release (struct inode *inode, struct file *file)
+ 		goto exit;
+ 	}
+ 
+-	if (mutex_lock_interruptible(&dev->lock)) {
+-	        retval = -ERESTARTSYS;
+-		goto exit;
+-	}
++	mutex_lock(&dev->lock);
+ 
+ 	if (dev->open_count != 1) {
+ 		dev_dbg(&dev->udev->dev, "%s: device not opened exactly once\n",
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index dd0ad67aa71e..9174ba2e06da 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -776,7 +776,6 @@ static void ti_close(struct usb_serial_port *port)
+ 	struct ti_port *tport;
+ 	int port_number;
+ 	int status;
+-	int do_unlock;
+ 	unsigned long flags;
+ 
+ 	tdev = usb_get_serial_data(port->serial);
+@@ -800,16 +799,13 @@ static void ti_close(struct usb_serial_port *port)
+ 			"%s - cannot send close port command, %d\n"
+ 							, __func__, status);
+ 
+-	/* if mutex_lock is interrupted, continue anyway */
+-	do_unlock = !mutex_lock_interruptible(&tdev->td_open_close_lock);
++	mutex_lock(&tdev->td_open_close_lock);
+ 	--tport->tp_tdev->td_open_port_count;
+-	if (tport->tp_tdev->td_open_port_count <= 0) {
++	if (tport->tp_tdev->td_open_port_count == 0) {
+ 		/* last port is closed, shut down interrupt urb */
+ 		usb_kill_urb(port->serial->port[0]->interrupt_in_urb);
+-		tport->tp_tdev->td_open_port_count = 0;
+ 	}
+-	if (do_unlock)
+-		mutex_unlock(&tdev->td_open_close_lock);
++	mutex_unlock(&tdev->td_open_close_lock);
+ }
+ 
+ 
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index f131651502b8..c62903290f3a 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -899,7 +899,7 @@ out_free_interp:
+ 	   the correct location in memory. */
+ 	for(i = 0, elf_ppnt = elf_phdata;
+ 	    i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
+-		int elf_prot, elf_flags, elf_fixed = MAP_FIXED_NOREPLACE;
++		int elf_prot, elf_flags;
+ 		unsigned long k, vaddr;
+ 		unsigned long total_size = 0;
+ 
+@@ -931,13 +931,6 @@ out_free_interp:
+ 					 */
+ 				}
+ 			}
+-
+-			/*
+-			 * Some binaries have overlapping elf segments and then
+-			 * we have to forcefully map over an existing mapping
+-			 * e.g. over this newly established brk mapping.
+-			 */
+-			elf_fixed = MAP_FIXED;
+ 		}
+ 
+ 		elf_prot = make_prot(elf_ppnt->p_flags);
+@@ -950,7 +943,7 @@ out_free_interp:
+ 		 * the ET_DYN load_addr calculations, proceed normally.
+ 		 */
+ 		if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
+-			elf_flags |= elf_fixed;
++			elf_flags |= MAP_FIXED;
+ 		} else if (loc->elf_ex.e_type == ET_DYN) {
+ 			/*
+ 			 * This logic is run once for the first LOAD Program
+@@ -986,7 +979,7 @@ out_free_interp:
+ 				load_bias = ELF_ET_DYN_BASE;
+ 				if (current->flags & PF_RANDOMIZE)
+ 					load_bias += arch_mmap_rnd();
+-				elf_flags |= elf_fixed;
++				elf_flags |= MAP_FIXED;
+ 			} else
+ 				load_bias = 0;
+ 
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index d9541d58ce3d..e7a1ec075c65 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -908,8 +908,6 @@ struct btrfs_fs_info {
+ 	struct btrfs_workqueue *fixup_workers;
+ 	struct btrfs_workqueue *delayed_workers;
+ 
+-	/* the extent workers do delayed refs on the extent allocation tree */
+-	struct btrfs_workqueue *extent_workers;
+ 	struct task_struct *transaction_kthread;
+ 	struct task_struct *cleaner_kthread;
+ 	u32 thread_pool_size;
+diff --git a/fs/btrfs/delalloc-space.c b/fs/btrfs/delalloc-space.c
+index 17f7c0d38768..934521fe7e71 100644
+--- a/fs/btrfs/delalloc-space.c
++++ b/fs/btrfs/delalloc-space.c
+@@ -371,7 +371,6 @@ int btrfs_delalloc_reserve_metadata(struct btrfs_inode *inode, u64 num_bytes)
+ out_qgroup:
+ 	btrfs_qgroup_free_meta_prealloc(root, qgroup_reserve);
+ out_fail:
+-	btrfs_inode_rsv_release(inode, true);
+ 	if (delalloc_lock)
+ 		mutex_unlock(&inode->delalloc_mutex);
+ 	return ret;
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 65af7eb3f7bd..46eac7ddf0f7 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -2036,7 +2036,6 @@ static void btrfs_stop_all_workers(struct btrfs_fs_info *fs_info)
+ 	btrfs_destroy_workqueue(fs_info->readahead_workers);
+ 	btrfs_destroy_workqueue(fs_info->flush_workers);
+ 	btrfs_destroy_workqueue(fs_info->qgroup_rescan_workers);
+-	btrfs_destroy_workqueue(fs_info->extent_workers);
+ 	/*
+ 	 * Now that all other work queues are destroyed, we can safely destroy
+ 	 * the queues used for metadata I/O, since tasks from those other work
+@@ -2242,10 +2241,6 @@ static int btrfs_init_workqueues(struct btrfs_fs_info *fs_info,
+ 				      max_active, 2);
+ 	fs_info->qgroup_rescan_workers =
+ 		btrfs_alloc_workqueue(fs_info, "qgroup-rescan", flags, 1, 0);
+-	fs_info->extent_workers =
+-		btrfs_alloc_workqueue(fs_info, "extent-refs", flags,
+-				      min_t(u64, fs_devices->num_devices,
+-					    max_active), 8);
+ 
+ 	if (!(fs_info->workers && fs_info->delalloc_workers &&
+ 	      fs_info->submit_workers && fs_info->flush_workers &&
+@@ -2256,7 +2251,6 @@ static int btrfs_init_workqueues(struct btrfs_fs_info *fs_info,
+ 	      fs_info->endio_freespace_worker && fs_info->rmw_workers &&
+ 	      fs_info->caching_workers && fs_info->readahead_workers &&
+ 	      fs_info->fixup_workers && fs_info->delayed_workers &&
+-	      fs_info->extent_workers &&
+ 	      fs_info->qgroup_rescan_workers)) {
+ 		return -ENOMEM;
+ 	}
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index ef2f80825c82..d5a3a66c8f1d 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -8117,6 +8117,7 @@ int btrfs_read_block_groups(struct btrfs_fs_info *info)
+ 			btrfs_err(info,
+ "bg %llu is a mixed block group but filesystem hasn't enabled mixed block groups",
+ 				  cache->key.objectid);
++			btrfs_put_block_group(cache);
+ 			ret = -EINVAL;
+ 			goto error;
+ 		}
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index abcda051eee2..d68add0bf346 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -2067,25 +2067,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ 	struct btrfs_trans_handle *trans;
+ 	struct btrfs_log_ctx ctx;
+ 	int ret = 0, err;
+-	u64 len;
+ 
+-	/*
+-	 * If the inode needs a full sync, make sure we use a full range to
+-	 * avoid log tree corruption, due to hole detection racing with ordered
+-	 * extent completion for adjacent ranges, and assertion failures during
+-	 * hole detection.
+-	 */
+-	if (test_bit(BTRFS_INODE_NEEDS_FULL_SYNC,
+-		     &BTRFS_I(inode)->runtime_flags)) {
+-		start = 0;
+-		end = LLONG_MAX;
+-	}
+-
+-	/*
+-	 * The range length can be represented by u64, we have to do the typecasts
+-	 * to avoid signed overflow if it's [0, LLONG_MAX] eg. from fsync()
+-	 */
+-	len = (u64)end - (u64)start + 1;
+ 	trace_btrfs_sync_file(file, datasync);
+ 
+ 	btrfs_init_log_ctx(&ctx, inode);
+@@ -2111,6 +2093,19 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ 
+ 	atomic_inc(&root->log_batch);
+ 
++	/*
++	 * If the inode needs a full sync, make sure we use a full range to
++	 * avoid log tree corruption, due to hole detection racing with ordered
++	 * extent completion for adjacent ranges, and assertion failures during
++	 * hole detection. Do this while holding the inode lock, to avoid races
++	 * with other tasks.
++	 */
++	if (test_bit(BTRFS_INODE_NEEDS_FULL_SYNC,
++		     &BTRFS_I(inode)->runtime_flags)) {
++		start = 0;
++		end = LLONG_MAX;
++	}
++
+ 	/*
+ 	 * Before we acquired the inode's lock, someone may have dirtied more
+ 	 * pages in the target range. We need to make sure that writeback for
+@@ -2138,8 +2133,11 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ 	/*
+ 	 * We have to do this here to avoid the priority inversion of waiting on
+ 	 * IO of a lower priority task while holding a transaction open.
++	 *
++	 * Also, the range length can be represented by u64, we have to do the
++	 * typecasts to avoid signed overflow if it's [0, LLONG_MAX].
+ 	 */
+-	ret = btrfs_wait_ordered_range(inode, start, len);
++	ret = btrfs_wait_ordered_range(inode, start, (u64)end - (u64)start + 1);
+ 	if (ret) {
+ 		up_write(&BTRFS_I(inode)->dio_sem);
+ 		inode_unlock(inode);
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 001efc9ba1e7..60a00f6ca18f 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -3617,7 +3617,7 @@ int __btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes,
+ 		return 0;
+ 
+ 	BUG_ON(num_bytes != round_down(num_bytes, fs_info->nodesize));
+-	trace_qgroup_meta_reserve(root, type, (s64)num_bytes);
++	trace_qgroup_meta_reserve(root, (s64)num_bytes, type);
+ 	ret = qgroup_reserve(root, num_bytes, enforce, type);
+ 	if (ret < 0)
+ 		return ret;
+@@ -3664,7 +3664,7 @@ void __btrfs_qgroup_free_meta(struct btrfs_root *root, int num_bytes,
+ 	 */
+ 	num_bytes = sub_root_meta_rsv(root, num_bytes, type);
+ 	BUG_ON(num_bytes != round_down(num_bytes, fs_info->nodesize));
+-	trace_qgroup_meta_reserve(root, type, -(s64)num_bytes);
++	trace_qgroup_meta_reserve(root, -(s64)num_bytes, type);
+ 	btrfs_qgroup_free_refroot(fs_info, root->root_key.objectid,
+ 				  num_bytes, type);
+ }
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index fbd66c33dd63..074947bebd16 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -3276,6 +3276,8 @@ static int relocate_file_extent_cluster(struct inode *inode,
+ 			if (!page) {
+ 				btrfs_delalloc_release_metadata(BTRFS_I(inode),
+ 							PAGE_SIZE, true);
++				btrfs_delalloc_release_extents(BTRFS_I(inode),
++							PAGE_SIZE, true);
+ 				ret = -ENOMEM;
+ 				goto out;
+ 			}
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index b11af7d8e8e9..61282b77950f 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -384,8 +384,8 @@ static int parse_reply_info_readdir(void **p, void *end,
+ 	}
+ 
+ done:
+-	if (*p != end)
+-		goto bad;
++	/* Skip over any unrecognized fields */
++	*p = end;
+ 	return 0;
+ 
+ bad:
+@@ -406,12 +406,10 @@ static int parse_reply_info_filelock(void **p, void *end,
+ 		goto bad;
+ 
+ 	info->filelock_reply = *p;
+-	*p += sizeof(*info->filelock_reply);
+ 
+-	if (unlikely(*p != end))
+-		goto bad;
++	/* Skip over any unrecognized fields */
++	*p = end;
+ 	return 0;
+-
+ bad:
+ 	return -EIO;
+ }
+@@ -425,18 +423,21 @@ static int parse_reply_info_create(void **p, void *end,
+ {
+ 	if (features == (u64)-1 ||
+ 	    (features & CEPH_FEATURE_REPLY_CREATE_INODE)) {
++		/* Malformed reply? */
+ 		if (*p == end) {
+ 			info->has_create_ino = false;
+ 		} else {
+ 			info->has_create_ino = true;
+-			info->ino = ceph_decode_64(p);
++			ceph_decode_64_safe(p, end, info->ino, bad);
+ 		}
++	} else {
++		if (*p != end)
++			goto bad;
+ 	}
+ 
+-	if (unlikely(*p != end))
+-		goto bad;
++	/* Skip over any unrecognized fields */
++	*p = end;
+ 	return 0;
+-
+ bad:
+ 	return -EIO;
+ }
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 4c1aeb2cf7f5..53dbb6e0d390 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -405,10 +405,11 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
+ 	bool oplock_break_cancelled;
+ 
+ 	spin_lock(&tcon->open_file_lock);
+-
++	spin_lock(&cifsi->open_file_lock);
+ 	spin_lock(&cifs_file->file_info_lock);
+ 	if (--cifs_file->count > 0) {
+ 		spin_unlock(&cifs_file->file_info_lock);
++		spin_unlock(&cifsi->open_file_lock);
+ 		spin_unlock(&tcon->open_file_lock);
+ 		return;
+ 	}
+@@ -421,9 +422,7 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
+ 	cifs_add_pending_open_locked(&fid, cifs_file->tlink, &open);
+ 
+ 	/* remove it from the lists */
+-	spin_lock(&cifsi->open_file_lock);
+ 	list_del(&cifs_file->flist);
+-	spin_unlock(&cifsi->open_file_lock);
+ 	list_del(&cifs_file->tlist);
+ 	atomic_dec(&tcon->num_local_opens);
+ 
+@@ -440,6 +439,7 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
+ 		cifs_set_oplock_level(cifsi, 0);
+ 	}
+ 
++	spin_unlock(&cifsi->open_file_lock);
+ 	spin_unlock(&tcon->open_file_lock);
+ 
+ 	oplock_break_cancelled = wait_oplock_handler ?
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 79d9a60f21ba..3c952024e10f 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -2465,9 +2465,9 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs)
+ 			rc = tcon->ses->server->ops->flush(xid, tcon, &wfile->fid);
+ 			cifsFileInfo_put(wfile);
+ 			if (rc)
+-				return rc;
++				goto cifs_setattr_exit;
+ 		} else if (rc != -EBADF)
+-			return rc;
++			goto cifs_setattr_exit;
+ 		else
+ 			rc = 0;
+ 	}
+diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
+index b7421a096319..514810694c0f 100644
+--- a/fs/cifs/smb1ops.c
++++ b/fs/cifs/smb1ops.c
+@@ -171,6 +171,9 @@ cifs_get_next_mid(struct TCP_Server_Info *server)
+ 	/* we do not want to loop forever */
+ 	last_mid = cur_mid;
+ 	cur_mid++;
++	/* avoid 0xFFFF MID */
++	if (cur_mid == 0xffff)
++		cur_mid++;
+ 
+ 	/*
+ 	 * This nested loop looks more expensive than it is.
+diff --git a/fs/dax.c b/fs/dax.c
+index 6bf81f931de3..2cc43cd914eb 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -220,10 +220,11 @@ static void *get_unlocked_entry(struct xa_state *xas, unsigned int order)
+ 
+ 	for (;;) {
+ 		entry = xas_find_conflict(xas);
++		if (!entry || WARN_ON_ONCE(!xa_is_value(entry)))
++			return entry;
+ 		if (dax_entry_order(entry) < order)
+ 			return XA_RETRY_ENTRY;
+-		if (!entry || WARN_ON_ONCE(!xa_is_value(entry)) ||
+-				!dax_is_locked(entry))
++		if (!dax_is_locked(entry))
+ 			return entry;
+ 
+ 		wq = dax_entry_waitqueue(xas, entry, &ewait.key);
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 30149652c379..ed223c33dd89 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -221,6 +221,7 @@ struct io_ring_ctx {
+ 		unsigned		sq_entries;
+ 		unsigned		sq_mask;
+ 		unsigned		sq_thread_idle;
++		unsigned		cached_sq_dropped;
+ 		struct io_uring_sqe	*sq_sqes;
+ 
+ 		struct list_head	defer_list;
+@@ -237,6 +238,7 @@ struct io_ring_ctx {
+ 		/* CQ ring */
+ 		struct io_cq_ring	*cq_ring;
+ 		unsigned		cached_cq_tail;
++		atomic_t		cached_cq_overflow;
+ 		unsigned		cq_entries;
+ 		unsigned		cq_mask;
+ 		struct wait_queue_head	cq_wait;
+@@ -431,7 +433,8 @@ static inline bool io_sequence_defer(struct io_ring_ctx *ctx,
+ 	if ((req->flags & (REQ_F_IO_DRAIN|REQ_F_IO_DRAINED)) != REQ_F_IO_DRAIN)
+ 		return false;
+ 
+-	return req->sequence != ctx->cached_cq_tail + ctx->sq_ring->dropped;
++	return req->sequence != ctx->cached_cq_tail + ctx->sq_ring->dropped
++					+ atomic_read(&ctx->cached_cq_overflow);
+ }
+ 
+ static struct io_kiocb *io_get_deferred_req(struct io_ring_ctx *ctx)
+@@ -511,9 +514,8 @@ static void io_cqring_fill_event(struct io_ring_ctx *ctx, u64 ki_user_data,
+ 		WRITE_ONCE(cqe->res, res);
+ 		WRITE_ONCE(cqe->flags, 0);
+ 	} else {
+-		unsigned overflow = READ_ONCE(ctx->cq_ring->overflow);
+-
+-		WRITE_ONCE(ctx->cq_ring->overflow, overflow + 1);
++		WRITE_ONCE(ctx->cq_ring->overflow,
++				atomic_inc_return(&ctx->cached_cq_overflow));
+ 	}
+ }
+ 
+@@ -687,6 +689,14 @@ static unsigned io_cqring_events(struct io_cq_ring *ring)
+ 	return READ_ONCE(ring->r.tail) - READ_ONCE(ring->r.head);
+ }
+ 
++static inline unsigned int io_sqring_entries(struct io_ring_ctx *ctx)
++{
++	struct io_sq_ring *ring = ctx->sq_ring;
++
++	/* make sure SQ entry isn't read before tail */
++	return smp_load_acquire(&ring->r.tail) - ctx->cached_sq_head;
++}
++
+ /*
+  * Find and free completed poll iocbs
+  */
+@@ -816,19 +826,11 @@ static void io_iopoll_reap_events(struct io_ring_ctx *ctx)
+ 	mutex_unlock(&ctx->uring_lock);
+ }
+ 
+-static int io_iopoll_check(struct io_ring_ctx *ctx, unsigned *nr_events,
+-			   long min)
++static int __io_iopoll_check(struct io_ring_ctx *ctx, unsigned *nr_events,
++			    long min)
+ {
+-	int iters, ret = 0;
++	int iters = 0, ret = 0;
+ 
+-	/*
+-	 * We disallow the app entering submit/complete with polling, but we
+-	 * still need to lock the ring to prevent racing with polled issue
+-	 * that got punted to a workqueue.
+-	 */
+-	mutex_lock(&ctx->uring_lock);
+-
+-	iters = 0;
+ 	do {
+ 		int tmin = 0;
+ 
+@@ -864,6 +866,21 @@ static int io_iopoll_check(struct io_ring_ctx *ctx, unsigned *nr_events,
+ 		ret = 0;
+ 	} while (min && !*nr_events && !need_resched());
+ 
++	return ret;
++}
++
++static int io_iopoll_check(struct io_ring_ctx *ctx, unsigned *nr_events,
++			   long min)
++{
++	int ret;
++
++	/*
++	 * We disallow the app entering submit/complete with polling, but we
++	 * still need to lock the ring to prevent racing with polled issue
++	 * that got punted to a workqueue.
++	 */
++	mutex_lock(&ctx->uring_lock);
++	ret = __io_iopoll_check(ctx, nr_events, min);
+ 	mutex_unlock(&ctx->uring_lock);
+ 	return ret;
+ }
+@@ -2150,6 +2167,8 @@ err:
+ 		return;
+ 	}
+ 
++	req->user_data = s->sqe->user_data;
++
+ 	/*
+ 	 * If we already have a head request, queue this one for async
+ 	 * submittal once the head completes. If we don't have a head but
+@@ -2255,12 +2274,13 @@ static bool io_get_sqring(struct io_ring_ctx *ctx, struct sqe_submit *s)
+ 
+ 	/* drop invalid entries */
+ 	ctx->cached_sq_head++;
+-	ring->dropped++;
++	ctx->cached_sq_dropped++;
++	WRITE_ONCE(ring->dropped, ctx->cached_sq_dropped);
+ 	return false;
+ }
+ 
+-static int io_submit_sqes(struct io_ring_ctx *ctx, struct sqe_submit *sqes,
+-			  unsigned int nr, bool has_user, bool mm_fault)
++static int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr,
++			  bool has_user, bool mm_fault)
+ {
+ 	struct io_submit_state state, *statep = NULL;
+ 	struct io_kiocb *link = NULL;
+@@ -2273,6 +2293,11 @@ static int io_submit_sqes(struct io_ring_ctx *ctx, struct sqe_submit *sqes,
+ 	}
+ 
+ 	for (i = 0; i < nr; i++) {
++		struct sqe_submit s;
++
++		if (!io_get_sqring(ctx, &s))
++			break;
++
+ 		/*
+ 		 * If previous wasn't linked and we have a linked command,
+ 		 * that's the end of the chain. Submit the previous link.
+@@ -2281,16 +2306,16 @@ static int io_submit_sqes(struct io_ring_ctx *ctx, struct sqe_submit *sqes,
+ 			io_queue_sqe(ctx, link, &link->submit);
+ 			link = NULL;
+ 		}
+-		prev_was_link = (sqes[i].sqe->flags & IOSQE_IO_LINK) != 0;
++		prev_was_link = (s.sqe->flags & IOSQE_IO_LINK) != 0;
+ 
+ 		if (unlikely(mm_fault)) {
+-			io_cqring_add_event(ctx, sqes[i].sqe->user_data,
++			io_cqring_add_event(ctx, s.sqe->user_data,
+ 						-EFAULT);
+ 		} else {
+-			sqes[i].has_user = has_user;
+-			sqes[i].needs_lock = true;
+-			sqes[i].needs_fixed_file = true;
+-			io_submit_sqe(ctx, &sqes[i], statep, &link);
++			s.has_user = has_user;
++			s.needs_lock = true;
++			s.needs_fixed_file = true;
++			io_submit_sqe(ctx, &s, statep, &link);
+ 			submitted++;
+ 		}
+ 	}
+@@ -2305,7 +2330,6 @@ static int io_submit_sqes(struct io_ring_ctx *ctx, struct sqe_submit *sqes,
+ 
+ static int io_sq_thread(void *data)
+ {
+-	struct sqe_submit sqes[IO_IOPOLL_BATCH];
+ 	struct io_ring_ctx *ctx = data;
+ 	struct mm_struct *cur_mm = NULL;
+ 	mm_segment_t old_fs;
+@@ -2320,14 +2344,27 @@ static int io_sq_thread(void *data)
+ 
+ 	timeout = inflight = 0;
+ 	while (!kthread_should_park()) {
+-		bool all_fixed, mm_fault = false;
+-		int i;
++		bool mm_fault = false;
++		unsigned int to_submit;
+ 
+ 		if (inflight) {
+ 			unsigned nr_events = 0;
+ 
+ 			if (ctx->flags & IORING_SETUP_IOPOLL) {
+-				io_iopoll_check(ctx, &nr_events, 0);
++				/*
++				 * inflight is the count of the maximum possible
++				 * entries we submitted, but it can be smaller
++				 * if we dropped some of them. If we don't have
++				 * poll entries available, then we know that we
++				 * have nothing left to poll for. Reset the
++				 * inflight count to zero in that case.
++				 */
++				mutex_lock(&ctx->uring_lock);
++				if (!list_empty(&ctx->poll_list))
++					__io_iopoll_check(ctx, &nr_events, 0);
++				else
++					inflight = 0;
++				mutex_unlock(&ctx->uring_lock);
+ 			} else {
+ 				/*
+ 				 * Normal IO, just pretend everything completed.
+@@ -2341,7 +2378,8 @@ static int io_sq_thread(void *data)
+ 				timeout = jiffies + ctx->sq_thread_idle;
+ 		}
+ 
+-		if (!io_get_sqring(ctx, &sqes[0])) {
++		to_submit = io_sqring_entries(ctx);
++		if (!to_submit) {
+ 			/*
+ 			 * We're polling. If we're within the defined idle
+ 			 * period, then let us spin without work before going
+@@ -2372,7 +2410,8 @@ static int io_sq_thread(void *data)
+ 			/* make sure to read SQ tail after writing flags */
+ 			smp_mb();
+ 
+-			if (!io_get_sqring(ctx, &sqes[0])) {
++			to_submit = io_sqring_entries(ctx);
++			if (!to_submit) {
+ 				if (kthread_should_park()) {
+ 					finish_wait(&ctx->sqo_wait, &wait);
+ 					break;
+@@ -2390,19 +2429,8 @@ static int io_sq_thread(void *data)
+ 			ctx->sq_ring->flags &= ~IORING_SQ_NEED_WAKEUP;
+ 		}
+ 
+-		i = 0;
+-		all_fixed = true;
+-		do {
+-			if (all_fixed && io_sqe_needs_user(sqes[i].sqe))
+-				all_fixed = false;
+-
+-			i++;
+-			if (i == ARRAY_SIZE(sqes))
+-				break;
+-		} while (io_get_sqring(ctx, &sqes[i]));
+-
+ 		/* Unless all new commands are FIXED regions, grab mm */
+-		if (!all_fixed && !cur_mm) {
++		if (!cur_mm) {
+ 			mm_fault = !mmget_not_zero(ctx->sqo_mm);
+ 			if (!mm_fault) {
+ 				use_mm(ctx->sqo_mm);
+@@ -2410,8 +2438,9 @@ static int io_sq_thread(void *data)
+ 			}
+ 		}
+ 
+-		inflight += io_submit_sqes(ctx, sqes, i, cur_mm != NULL,
+-						mm_fault);
++		to_submit = min(to_submit, ctx->sq_entries);
++		inflight += io_submit_sqes(ctx, to_submit, cur_mm != NULL,
++					   mm_fault);
+ 
+ 		/* Commit SQ ring head once we've consumed all SQEs */
+ 		io_commit_sqring(ctx);
+@@ -2462,13 +2491,14 @@ static int io_ring_submit(struct io_ring_ctx *ctx, unsigned int to_submit)
+ 		submit++;
+ 		io_submit_sqe(ctx, &s, statep, &link);
+ 	}
+-	io_commit_sqring(ctx);
+ 
+ 	if (link)
+ 		io_queue_sqe(ctx, link, &link->submit);
+ 	if (statep)
+ 		io_submit_state_end(statep);
+ 
++	io_commit_sqring(ctx);
++
+ 	return submit;
+ }
+ 
+diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
+index 930e3d388579..699a560efbb0 100644
+--- a/fs/ocfs2/journal.c
++++ b/fs/ocfs2/journal.c
+@@ -217,7 +217,8 @@ void ocfs2_recovery_exit(struct ocfs2_super *osb)
+ 	/* At this point, we know that no more recovery threads can be
+ 	 * launched, so wait for any recovery completion work to
+ 	 * complete. */
+-	flush_workqueue(osb->ocfs2_wq);
++	if (osb->ocfs2_wq)
++		flush_workqueue(osb->ocfs2_wq);
+ 
+ 	/*
+ 	 * Now that recovery is shut down, and the osb is about to be
+diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
+index 158e5af767fd..720e9f94957e 100644
+--- a/fs/ocfs2/localalloc.c
++++ b/fs/ocfs2/localalloc.c
+@@ -377,7 +377,8 @@ void ocfs2_shutdown_local_alloc(struct ocfs2_super *osb)
+ 	struct ocfs2_dinode *alloc = NULL;
+ 
+ 	cancel_delayed_work(&osb->la_enable_wq);
+-	flush_workqueue(osb->ocfs2_wq);
++	if (osb->ocfs2_wq)
++		flush_workqueue(osb->ocfs2_wq);
+ 
+ 	if (osb->local_alloc_state == OCFS2_LA_UNUSED)
+ 		goto out;
+diff --git a/fs/proc/page.c b/fs/proc/page.c
+index 544d1ee15aee..7c952ee732e6 100644
+--- a/fs/proc/page.c
++++ b/fs/proc/page.c
+@@ -42,10 +42,12 @@ static ssize_t kpagecount_read(struct file *file, char __user *buf,
+ 		return -EINVAL;
+ 
+ 	while (count > 0) {
+-		if (pfn_valid(pfn))
+-			ppage = pfn_to_page(pfn);
+-		else
+-			ppage = NULL;
++		/*
++		 * TODO: ZONE_DEVICE support requires to identify
++		 * memmaps that were actually initialized.
++		 */
++		ppage = pfn_to_online_page(pfn);
++
+ 		if (!ppage || PageSlab(ppage) || page_has_type(ppage))
+ 			pcount = 0;
+ 		else
+@@ -216,10 +218,11 @@ static ssize_t kpageflags_read(struct file *file, char __user *buf,
+ 		return -EINVAL;
+ 
+ 	while (count > 0) {
+-		if (pfn_valid(pfn))
+-			ppage = pfn_to_page(pfn);
+-		else
+-			ppage = NULL;
++		/*
++		 * TODO: ZONE_DEVICE support requires to identify
++		 * memmaps that were actually initialized.
++		 */
++		ppage = pfn_to_online_page(pfn);
+ 
+ 		if (put_user(stable_page_flags(ppage), out)) {
+ 			ret = -EFAULT;
+@@ -261,10 +264,11 @@ static ssize_t kpagecgroup_read(struct file *file, char __user *buf,
+ 		return -EINVAL;
+ 
+ 	while (count > 0) {
+-		if (pfn_valid(pfn))
+-			ppage = pfn_to_page(pfn);
+-		else
+-			ppage = NULL;
++		/*
++		 * TODO: ZONE_DEVICE support requires to identify
++		 * memmaps that were actually initialized.
++		 */
++		ppage = pfn_to_online_page(pfn);
+ 
+ 		if (ppage)
+ 			ino = page_cgroup_ino(ppage);
+diff --git a/fs/readdir.c b/fs/readdir.c
+index 2f6a4534e0df..d26d5ea4de7b 100644
+--- a/fs/readdir.c
++++ b/fs/readdir.c
+@@ -20,9 +20,23 @@
+ #include <linux/syscalls.h>
+ #include <linux/unistd.h>
+ #include <linux/compat.h>
+-
+ #include <linux/uaccess.h>
+ 
++#include <asm/unaligned.h>
++
++/*
++ * Note the "unsafe_put_user() semantics: we goto a
++ * label for errors.
++ */
++#define unsafe_copy_dirent_name(_dst, _src, _len, label) do {	\
++	char __user *dst = (_dst);				\
++	const char *src = (_src);				\
++	size_t len = (_len);					\
++	unsafe_put_user(0, dst+len, label);			\
++	unsafe_copy_to_user(dst, src, len, label);		\
++} while (0)
++
++
+ int iterate_dir(struct file *file, struct dir_context *ctx)
+ {
+ 	struct inode *inode = file_inode(file);
+@@ -64,6 +78,40 @@ out:
+ }
+ EXPORT_SYMBOL(iterate_dir);
+ 
++/*
++ * POSIX says that a dirent name cannot contain NULL or a '/'.
++ *
++ * It's not 100% clear what we should really do in this case.
++ * The filesystem is clearly corrupted, but returning a hard
++ * error means that you now don't see any of the other names
++ * either, so that isn't a perfect alternative.
++ *
++ * And if you return an error, what error do you use? Several
++ * filesystems seem to have decided on EUCLEAN being the error
++ * code for EFSCORRUPTED, and that may be the error to use. Or
++ * just EIO, which is perhaps more obvious to users.
++ *
++ * In order to see the other file names in the directory, the
++ * caller might want to make this a "soft" error: skip the
++ * entry, and return the error at the end instead.
++ *
++ * Note that this should likely do a "memchr(name, 0, len)"
++ * check too, since that would be filesystem corruption as
++ * well. However, that case can't actually confuse user space,
++ * which has to do a strlen() on the name anyway to find the
++ * filename length, and the above "soft error" worry means
++ * that it's probably better left alone until we have that
++ * issue clarified.
++ */
++static int verify_dirent_name(const char *name, int len)
++{
++	if (!len)
++		return -EIO;
++	if (memchr(name, '/', len))
++		return -EIO;
++	return 0;
++}
++
+ /*
+  * Traditional linux readdir() handling..
+  *
+@@ -173,6 +221,9 @@ static int filldir(struct dir_context *ctx, const char *name, int namlen,
+ 	int reclen = ALIGN(offsetof(struct linux_dirent, d_name) + namlen + 2,
+ 		sizeof(long));
+ 
++	buf->error = verify_dirent_name(name, namlen);
++	if (unlikely(buf->error))
++		return buf->error;
+ 	buf->error = -EINVAL;	/* only used if we fail.. */
+ 	if (reclen > buf->count)
+ 		return -EINVAL;
+@@ -182,28 +233,31 @@ static int filldir(struct dir_context *ctx, const char *name, int namlen,
+ 		return -EOVERFLOW;
+ 	}
+ 	dirent = buf->previous;
+-	if (dirent) {
+-		if (signal_pending(current))
+-			return -EINTR;
+-		if (__put_user(offset, &dirent->d_off))
+-			goto efault;
+-	}
+-	dirent = buf->current_dir;
+-	if (__put_user(d_ino, &dirent->d_ino))
+-		goto efault;
+-	if (__put_user(reclen, &dirent->d_reclen))
+-		goto efault;
+-	if (copy_to_user(dirent->d_name, name, namlen))
+-		goto efault;
+-	if (__put_user(0, dirent->d_name + namlen))
+-		goto efault;
+-	if (__put_user(d_type, (char __user *) dirent + reclen - 1))
++	if (dirent && signal_pending(current))
++		return -EINTR;
++
++	/*
++	 * Note! This range-checks 'previous' (which may be NULL).
++	 * The real range was checked in getdents
++	 */
++	if (!user_access_begin(dirent, sizeof(*dirent)))
+ 		goto efault;
++	if (dirent)
++		unsafe_put_user(offset, &dirent->d_off, efault_end);
++	dirent = buf->current_dir;
++	unsafe_put_user(d_ino, &dirent->d_ino, efault_end);
++	unsafe_put_user(reclen, &dirent->d_reclen, efault_end);
++	unsafe_put_user(d_type, (char __user *) dirent + reclen - 1, efault_end);
++	unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault_end);
++	user_access_end();
++
+ 	buf->previous = dirent;
+ 	dirent = (void __user *)dirent + reclen;
+ 	buf->current_dir = dirent;
+ 	buf->count -= reclen;
+ 	return 0;
++efault_end:
++	user_access_end();
+ efault:
+ 	buf->error = -EFAULT;
+ 	return -EFAULT;
+@@ -259,34 +313,38 @@ static int filldir64(struct dir_context *ctx, const char *name, int namlen,
+ 	int reclen = ALIGN(offsetof(struct linux_dirent64, d_name) + namlen + 1,
+ 		sizeof(u64));
+ 
++	buf->error = verify_dirent_name(name, namlen);
++	if (unlikely(buf->error))
++		return buf->error;
+ 	buf->error = -EINVAL;	/* only used if we fail.. */
+ 	if (reclen > buf->count)
+ 		return -EINVAL;
+ 	dirent = buf->previous;
+-	if (dirent) {
+-		if (signal_pending(current))
+-			return -EINTR;
+-		if (__put_user(offset, &dirent->d_off))
+-			goto efault;
+-	}
+-	dirent = buf->current_dir;
+-	if (__put_user(ino, &dirent->d_ino))
+-		goto efault;
+-	if (__put_user(0, &dirent->d_off))
+-		goto efault;
+-	if (__put_user(reclen, &dirent->d_reclen))
+-		goto efault;
+-	if (__put_user(d_type, &dirent->d_type))
+-		goto efault;
+-	if (copy_to_user(dirent->d_name, name, namlen))
+-		goto efault;
+-	if (__put_user(0, dirent->d_name + namlen))
++	if (dirent && signal_pending(current))
++		return -EINTR;
++
++	/*
++	 * Note! This range-checks 'previous' (which may be NULL).
++	 * The real range was checked in getdents
++	 */
++	if (!user_access_begin(dirent, sizeof(*dirent)))
+ 		goto efault;
++	if (dirent)
++		unsafe_put_user(offset, &dirent->d_off, efault_end);
++	dirent = buf->current_dir;
++	unsafe_put_user(ino, &dirent->d_ino, efault_end);
++	unsafe_put_user(reclen, &dirent->d_reclen, efault_end);
++	unsafe_put_user(d_type, &dirent->d_type, efault_end);
++	unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault_end);
++	user_access_end();
++
+ 	buf->previous = dirent;
+ 	dirent = (void __user *)dirent + reclen;
+ 	buf->current_dir = dirent;
+ 	buf->count -= reclen;
+ 	return 0;
++efault_end:
++	user_access_end();
+ efault:
+ 	buf->error = -EFAULT;
+ 	return -EFAULT;
+diff --git a/include/linux/micrel_phy.h b/include/linux/micrel_phy.h
+index ad24554f11f9..75f880c25bb8 100644
+--- a/include/linux/micrel_phy.h
++++ b/include/linux/micrel_phy.h
+@@ -31,7 +31,7 @@
+ #define PHY_ID_KSZ886X		0x00221430
+ #define PHY_ID_KSZ8863		0x00221435
+ 
+-#define PHY_ID_KSZ8795		0x00221550
++#define PHY_ID_KSZ87XX		0x00221550
+ 
+ #define	PHY_ID_KSZ9477		0x00221631
+ 
+diff --git a/include/linux/mii.h b/include/linux/mii.h
+index 5cd824c1c0ca..4ce8901a1af6 100644
+--- a/include/linux/mii.h
++++ b/include/linux/mii.h
+@@ -455,6 +455,15 @@ static inline void mii_lpa_mod_linkmode_lpa_t(unsigned long *lp_advertising,
+ 			 lp_advertising, lpa & LPA_LPACK);
+ }
+ 
++static inline void mii_ctrl1000_mod_linkmode_adv_t(unsigned long *advertising,
++						   u32 ctrl1000)
++{
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_1000baseT_Half_BIT, advertising,
++			 ctrl1000 & ADVERTISE_1000HALF);
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT, advertising,
++			 ctrl1000 & ADVERTISE_1000FULL);
++}
++
+ /**
+  * linkmode_adv_to_lcl_adv_t
+  * @advertising:pointer to linkmode advertising
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index ba5583522d24..9b18d33681c2 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -3465,8 +3465,9 @@ int skb_ensure_writable(struct sk_buff *skb, int write_len);
+ int __skb_vlan_pop(struct sk_buff *skb, u16 *vlan_tci);
+ int skb_vlan_pop(struct sk_buff *skb);
+ int skb_vlan_push(struct sk_buff *skb, __be16 vlan_proto, u16 vlan_tci);
+-int skb_mpls_push(struct sk_buff *skb, __be32 mpls_lse, __be16 mpls_proto);
+-int skb_mpls_pop(struct sk_buff *skb, __be16 next_proto);
++int skb_mpls_push(struct sk_buff *skb, __be32 mpls_lse, __be16 mpls_proto,
++		  int mac_len);
++int skb_mpls_pop(struct sk_buff *skb, __be16 next_proto, int mac_len);
+ int skb_mpls_update_lse(struct sk_buff *skb, __be32 mpls_lse);
+ int skb_mpls_dec_ttl(struct sk_buff *skb);
+ struct sk_buff *pskb_extract(struct sk_buff *skb, int off, int to_copy,
+diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
+index 34a038563d97..d38051dd414f 100644
+--- a/include/linux/uaccess.h
++++ b/include/linux/uaccess.h
+@@ -284,8 +284,10 @@ extern long strnlen_unsafe_user(const void __user *unsafe_addr, long count);
+ #ifndef user_access_begin
+ #define user_access_begin(ptr,len) access_ok(ptr, len)
+ #define user_access_end() do { } while (0)
+-#define unsafe_get_user(x, ptr, err) do { if (unlikely(__get_user(x, ptr))) goto err; } while (0)
+-#define unsafe_put_user(x, ptr, err) do { if (unlikely(__put_user(x, ptr))) goto err; } while (0)
++#define unsafe_op_wrap(op, err) do { if (unlikely(op)) goto err; } while (0)
++#define unsafe_get_user(x,p,e) unsafe_op_wrap(__get_user(x,p),e)
++#define unsafe_put_user(x,p,e) unsafe_op_wrap(__put_user(x,p),e)
++#define unsafe_copy_to_user(d,s,l,e) unsafe_op_wrap(__copy_to_user(d,s,l),e)
+ static inline unsigned long user_access_save(void) { return 0UL; }
+ static inline void user_access_restore(unsigned long flags) { }
+ #endif
+diff --git a/include/scsi/scsi_eh.h b/include/scsi/scsi_eh.h
+index 3810b340551c..6bd5ed695a5e 100644
+--- a/include/scsi/scsi_eh.h
++++ b/include/scsi/scsi_eh.h
+@@ -32,6 +32,7 @@ extern int scsi_ioctl_reset(struct scsi_device *, int __user *);
+ struct scsi_eh_save {
+ 	/* saved state */
+ 	int result;
++	unsigned int resid_len;
+ 	int eh_eflags;
+ 	enum dma_data_direction data_direction;
+ 	unsigned underflow;
+diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h
+index 2f6a669408bb..e83dee3212bd 100644
+--- a/include/trace/events/btrfs.h
++++ b/include/trace/events/btrfs.h
+@@ -1687,6 +1687,7 @@ TRACE_EVENT(qgroup_update_reserve,
+ 		__entry->qgid		= qgroup->qgroupid;
+ 		__entry->cur_reserved	= qgroup->rsv.values[type];
+ 		__entry->diff		= diff;
++		__entry->type		= type;
+ 	),
+ 
+ 	TP_printk_btrfs("qgid=%llu type=%s cur_reserved=%llu diff=%lld",
+@@ -1709,6 +1710,7 @@ TRACE_EVENT(qgroup_meta_reserve,
+ 	TP_fast_assign_btrfs(root->fs_info,
+ 		__entry->refroot	= root->root_key.objectid;
+ 		__entry->diff		= diff;
++		__entry->type		= type;
+ 	),
+ 
+ 	TP_printk_btrfs("refroot=%llu(%s) type=%s diff=%lld",
+@@ -1725,7 +1727,6 @@ TRACE_EVENT(qgroup_meta_convert,
+ 	TP_STRUCT__entry_btrfs(
+ 		__field(	u64,	refroot			)
+ 		__field(	s64,	diff			)
+-		__field(	int,	type			)
+ 	),
+ 
+ 	TP_fast_assign_btrfs(root->fs_info,
+diff --git a/include/uapi/linux/nvme_ioctl.h b/include/uapi/linux/nvme_ioctl.h
+index 1c215ea1798e..e168dc59e9a0 100644
+--- a/include/uapi/linux/nvme_ioctl.h
++++ b/include/uapi/linux/nvme_ioctl.h
+@@ -45,6 +45,27 @@ struct nvme_passthru_cmd {
+ 	__u32	result;
+ };
+ 
++struct nvme_passthru_cmd64 {
++	__u8	opcode;
++	__u8	flags;
++	__u16	rsvd1;
++	__u32	nsid;
++	__u32	cdw2;
++	__u32	cdw3;
++	__u64	metadata;
++	__u64	addr;
++	__u32	metadata_len;
++	__u32	data_len;
++	__u32	cdw10;
++	__u32	cdw11;
++	__u32	cdw12;
++	__u32	cdw13;
++	__u32	cdw14;
++	__u32	cdw15;
++	__u32	timeout_ms;
++	__u64	result;
++};
++
+ #define nvme_admin_cmd nvme_passthru_cmd
+ 
+ #define NVME_IOCTL_ID		_IO('N', 0x40)
+@@ -54,5 +75,7 @@ struct nvme_passthru_cmd {
+ #define NVME_IOCTL_RESET	_IO('N', 0x44)
+ #define NVME_IOCTL_SUBSYS_RESET	_IO('N', 0x45)
+ #define NVME_IOCTL_RESCAN	_IO('N', 0x46)
++#define NVME_IOCTL_ADMIN64_CMD	_IOWR('N', 0x47, struct nvme_passthru_cmd64)
++#define NVME_IOCTL_IO64_CMD	_IOWR('N', 0x48, struct nvme_passthru_cmd64)
+ 
+ #endif /* _UAPI_LINUX_NVME_IOCTL_H */
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 0463c1151bae..a2a50b668ef3 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -6839,7 +6839,7 @@ static void __perf_event_output_stop(struct perf_event *event, void *data)
+ static int __perf_pmu_output_stop(void *info)
+ {
+ 	struct perf_event *event = info;
+-	struct pmu *pmu = event->pmu;
++	struct pmu *pmu = event->ctx->pmu;
+ 	struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
+ 	struct remote_output ro = {
+ 		.rb	= event->rb,
+diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
+index 0892e38ed6fb..a9dfa04ffa44 100644
+--- a/kernel/trace/trace_event_perf.c
++++ b/kernel/trace/trace_event_perf.c
+@@ -272,9 +272,11 @@ int perf_kprobe_init(struct perf_event *p_event, bool is_retprobe)
+ 		goto out;
+ 	}
+ 
++	mutex_lock(&event_mutex);
+ 	ret = perf_trace_event_init(tp_event, p_event);
+ 	if (ret)
+ 		destroy_local_trace_kprobe(tp_event);
++	mutex_unlock(&event_mutex);
+ out:
+ 	kfree(func);
+ 	return ret;
+@@ -282,8 +284,10 @@ out:
+ 
+ void perf_kprobe_destroy(struct perf_event *p_event)
+ {
++	mutex_lock(&event_mutex);
+ 	perf_trace_event_close(p_event);
+ 	perf_trace_event_unreg(p_event);
++	mutex_unlock(&event_mutex);
+ 
+ 	destroy_local_trace_kprobe(p_event->tp_event);
+ }
+diff --git a/lib/textsearch.c b/lib/textsearch.c
+index 4f16eec5d554..f68dea8806be 100644
+--- a/lib/textsearch.c
++++ b/lib/textsearch.c
+@@ -89,9 +89,9 @@
+  *       goto errout;
+  *   }
+  *
+- *   pos = textsearch_find_continuous(conf, \&state, example, strlen(example));
++ *   pos = textsearch_find_continuous(conf, &state, example, strlen(example));
+  *   if (pos != UINT_MAX)
+- *       panic("Oh my god, dancing chickens at \%d\n", pos);
++ *       panic("Oh my god, dancing chickens at %d\n", pos);
+  *
+  *   textsearch_destroy(conf);
+  */
+diff --git a/lib/vdso/gettimeofday.c b/lib/vdso/gettimeofday.c
+index e630e7ff57f1..45f57fd2db64 100644
+--- a/lib/vdso/gettimeofday.c
++++ b/lib/vdso/gettimeofday.c
+@@ -214,9 +214,10 @@ int __cvdso_clock_getres_common(clockid_t clock, struct __kernel_timespec *res)
+ 		return -1;
+ 	}
+ 
+-	res->tv_sec = 0;
+-	res->tv_nsec = ns;
+-
++	if (likely(res)) {
++		res->tv_sec = 0;
++		res->tv_nsec = ns;
++	}
+ 	return 0;
+ }
+ 
+@@ -245,7 +246,7 @@ __cvdso_clock_getres_time32(clockid_t clock, struct old_timespec32 *res)
+ 		ret = clock_getres_fallback(clock, &ts);
+ #endif
+ 
+-	if (likely(!ret)) {
++	if (likely(!ret && res)) {
+ 		res->tv_sec = ts.tv_sec;
+ 		res->tv_nsec = ts.tv_nsec;
+ 	}
+diff --git a/mm/compaction.c b/mm/compaction.c
+index 1e994920e6ff..5ab9c2b22693 100644
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -270,14 +270,15 @@ __reset_isolation_pfn(struct zone *zone, unsigned long pfn, bool check_source,
+ 
+ 	/* Ensure the start of the pageblock or zone is online and valid */
+ 	block_pfn = pageblock_start_pfn(pfn);
+-	block_page = pfn_to_online_page(max(block_pfn, zone->zone_start_pfn));
++	block_pfn = max(block_pfn, zone->zone_start_pfn);
++	block_page = pfn_to_online_page(block_pfn);
+ 	if (block_page) {
+ 		page = block_page;
+ 		pfn = block_pfn;
+ 	}
+ 
+ 	/* Ensure the end of the pageblock or zone is online and valid */
+-	block_pfn += pageblock_nr_pages;
++	block_pfn = pageblock_end_pfn(pfn) - 1;
+ 	block_pfn = min(block_pfn, zone_end_pfn(zone) - 1);
+ 	end_page = pfn_to_online_page(block_pfn);
+ 	if (!end_page)
+@@ -303,7 +304,7 @@ __reset_isolation_pfn(struct zone *zone, unsigned long pfn, bool check_source,
+ 
+ 		page += (1 << PAGE_ALLOC_COSTLY_ORDER);
+ 		pfn += (1 << PAGE_ALLOC_COSTLY_ORDER);
+-	} while (page < end_page);
++	} while (page <= end_page);
+ 
+ 	return false;
+ }
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 6d7296dd11b8..843ee2f8d356 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1084,11 +1084,10 @@ static bool pfn_range_valid_gigantic(struct zone *z,
+ 	struct page *page;
+ 
+ 	for (i = start_pfn; i < end_pfn; i++) {
+-		if (!pfn_valid(i))
++		page = pfn_to_online_page(i);
++		if (!page)
+ 			return false;
+ 
+-		page = pfn_to_page(i);
+-
+ 		if (page_zone(page) != z)
+ 			return false;
+ 
+diff --git a/mm/memblock.c b/mm/memblock.c
+index 7d4f61ae666a..c4b16cae2bc9 100644
+--- a/mm/memblock.c
++++ b/mm/memblock.c
+@@ -1356,9 +1356,6 @@ static phys_addr_t __init memblock_alloc_range_nid(phys_addr_t size,
+ 		align = SMP_CACHE_BYTES;
+ 	}
+ 
+-	if (end > memblock.current_limit)
+-		end = memblock.current_limit;
+-
+ again:
+ 	found = memblock_find_in_range_node(size, align, start, end, nid,
+ 					    flags);
+@@ -1469,6 +1466,9 @@ static void * __init memblock_alloc_internal(
+ 	if (WARN_ON_ONCE(slab_is_available()))
+ 		return kzalloc_node(size, GFP_NOWAIT, nid);
+ 
++	if (max_addr > memblock.current_limit)
++		max_addr = memblock.current_limit;
++
+ 	alloc = memblock_alloc_range_nid(size, align, min_addr, max_addr, nid);
+ 
+ 	/* retry allocation without lower limit */
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 7ef849da8278..3151c87dff73 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -199,7 +199,6 @@ struct to_kill {
+ 	struct task_struct *tsk;
+ 	unsigned long addr;
+ 	short size_shift;
+-	char addr_valid;
+ };
+ 
+ /*
+@@ -324,22 +323,27 @@ static void add_to_kill(struct task_struct *tsk, struct page *p,
+ 		}
+ 	}
+ 	tk->addr = page_address_in_vma(p, vma);
+-	tk->addr_valid = 1;
+ 	if (is_zone_device_page(p))
+ 		tk->size_shift = dev_pagemap_mapping_shift(p, vma);
+ 	else
+ 		tk->size_shift = compound_order(compound_head(p)) + PAGE_SHIFT;
+ 
+ 	/*
+-	 * In theory we don't have to kill when the page was
+-	 * munmaped. But it could be also a mremap. Since that's
+-	 * likely very rare kill anyways just out of paranoia, but use
+-	 * a SIGKILL because the error is not contained anymore.
++	 * Send SIGKILL if "tk->addr == -EFAULT". Also, as
++	 * "tk->size_shift" is always non-zero for !is_zone_device_page(),
++	 * so "tk->size_shift == 0" effectively checks no mapping on
++	 * ZONE_DEVICE. Indeed, when a devdax page is mmapped N times
++	 * to a process' address space, it's possible not all N VMAs
++	 * contain mappings for the page, but at least one VMA does.
++	 * Only deliver SIGBUS with payload derived from the VMA that
++	 * has a mapping for the page.
+ 	 */
+-	if (tk->addr == -EFAULT || tk->size_shift == 0) {
++	if (tk->addr == -EFAULT) {
+ 		pr_info("Memory failure: Unable to find user space address %lx in %s\n",
+ 			page_to_pfn(p), tsk->comm);
+-		tk->addr_valid = 0;
++	} else if (tk->size_shift == 0) {
++		kfree(tk);
++		return;
+ 	}
+ 	get_task_struct(tsk);
+ 	tk->tsk = tsk;
+@@ -366,7 +370,7 @@ static void kill_procs(struct list_head *to_kill, int forcekill, bool fail,
+ 			 * make sure the process doesn't catch the
+ 			 * signal and then access the memory. Just kill it.
+ 			 */
+-			if (fail || tk->addr_valid == 0) {
++			if (fail || tk->addr == -EFAULT) {
+ 				pr_err("Memory failure: %#lx: forcibly killing %s:%d because of failure to unmap corrupted page\n",
+ 				       pfn, tk->tsk->comm, tk->tsk->pid);
+ 				do_send_sig_info(SIGKILL, SEND_SIG_PRIV,
+@@ -1253,17 +1257,19 @@ int memory_failure(unsigned long pfn, int flags)
+ 	if (!sysctl_memory_failure_recovery)
+ 		panic("Memory failure on page %lx", pfn);
+ 
+-	if (!pfn_valid(pfn)) {
++	p = pfn_to_online_page(pfn);
++	if (!p) {
++		if (pfn_valid(pfn)) {
++			pgmap = get_dev_pagemap(pfn, NULL);
++			if (pgmap)
++				return memory_failure_dev_pagemap(pfn, flags,
++								  pgmap);
++		}
+ 		pr_err("Memory failure: %#lx: memory outside kernel control\n",
+ 			pfn);
+ 		return -ENXIO;
+ 	}
+ 
+-	pgmap = get_dev_pagemap(pfn, NULL);
+-	if (pgmap)
+-		return memory_failure_dev_pagemap(pfn, flags, pgmap);
+-
+-	p = pfn_to_page(pfn);
+ 	if (PageHuge(p))
+ 		return memory_failure_hugetlb(pfn, flags);
+ 	if (TestSetPageHWPoison(p)) {
+diff --git a/mm/memremap.c b/mm/memremap.c
+index ed70c4e8e52a..31f1b2953c64 100644
+--- a/mm/memremap.c
++++ b/mm/memremap.c
+@@ -104,6 +104,7 @@ static void devm_memremap_pages_release(void *data)
+ 	struct dev_pagemap *pgmap = data;
+ 	struct device *dev = pgmap->dev;
+ 	struct resource *res = &pgmap->res;
++	struct page *first_page;
+ 	unsigned long pfn;
+ 	int nid;
+ 
+@@ -112,14 +113,16 @@ static void devm_memremap_pages_release(void *data)
+ 		put_page(pfn_to_page(pfn));
+ 	dev_pagemap_cleanup(pgmap);
+ 
++	/* make sure to access a memmap that was actually initialized */
++	first_page = pfn_to_page(pfn_first(pgmap));
++
+ 	/* pages are dead and unused, undo the arch mapping */
+-	nid = page_to_nid(pfn_to_page(PHYS_PFN(res->start)));
++	nid = page_to_nid(first_page);
+ 
+ 	mem_hotplug_begin();
+ 	if (pgmap->type == MEMORY_DEVICE_PRIVATE) {
+-		pfn = PHYS_PFN(res->start);
+-		__remove_pages(page_zone(pfn_to_page(pfn)), pfn,
+-				 PHYS_PFN(resource_size(res)), NULL);
++		__remove_pages(page_zone(first_page), PHYS_PFN(res->start),
++			       PHYS_PFN(resource_size(res)), NULL);
+ 	} else {
+ 		arch_remove_memory(nid, res->start, resource_size(res),
+ 				pgmap_altmap(pgmap));
+diff --git a/mm/page_owner.c b/mm/page_owner.c
+index addcbb2ae4e4..8088ab29bc2d 100644
+--- a/mm/page_owner.c
++++ b/mm/page_owner.c
+@@ -258,7 +258,8 @@ void pagetypeinfo_showmixedcount_print(struct seq_file *m,
+ 	 * not matter as the mixed block count will still be correct
+ 	 */
+ 	for (; pfn < end_pfn; ) {
+-		if (!pfn_valid(pfn)) {
++		page = pfn_to_online_page(pfn);
++		if (!page) {
+ 			pfn = ALIGN(pfn + 1, MAX_ORDER_NR_PAGES);
+ 			continue;
+ 		}
+@@ -266,13 +267,13 @@ void pagetypeinfo_showmixedcount_print(struct seq_file *m,
+ 		block_end_pfn = ALIGN(pfn + 1, pageblock_nr_pages);
+ 		block_end_pfn = min(block_end_pfn, end_pfn);
+ 
+-		page = pfn_to_page(pfn);
+ 		pageblock_mt = get_pageblock_migratetype(page);
+ 
+ 		for (; pfn < block_end_pfn; pfn++) {
+ 			if (!pfn_valid_within(pfn))
+ 				continue;
+ 
++			/* The pageblock is online, no need to recheck. */
+ 			page = pfn_to_page(pfn);
+ 
+ 			if (page_zone(page) != zone)
+diff --git a/mm/slab_common.c b/mm/slab_common.c
+index 807490fe217a..7f492e53a7db 100644
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -178,10 +178,13 @@ static int init_memcg_params(struct kmem_cache *s,
+ 
+ static void destroy_memcg_params(struct kmem_cache *s)
+ {
+-	if (is_root_cache(s))
++	if (is_root_cache(s)) {
+ 		kvfree(rcu_access_pointer(s->memcg_params.memcg_caches));
+-	else
++	} else {
++		mem_cgroup_put(s->memcg_params.memcg);
++		WRITE_ONCE(s->memcg_params.memcg, NULL);
+ 		percpu_ref_exit(&s->memcg_params.refcnt);
++	}
+ }
+ 
+ static void free_memcg_params(struct rcu_head *rcu)
+@@ -253,8 +256,6 @@ static void memcg_unlink_cache(struct kmem_cache *s)
+ 	} else {
+ 		list_del(&s->memcg_params.children_node);
+ 		list_del(&s->memcg_params.kmem_caches_node);
+-		mem_cgroup_put(s->memcg_params.memcg);
+-		WRITE_ONCE(s->memcg_params.memcg, NULL);
+ 	}
+ }
+ #else
+diff --git a/mm/slub.c b/mm/slub.c
+index 8834563cdb4b..dac41cf0b94a 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -4836,7 +4836,17 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
+ 		}
+ 	}
+ 
+-	get_online_mems();
++	/*
++	 * It is impossible to take "mem_hotplug_lock" here with "kernfs_mutex"
++	 * already held which will conflict with an existing lock order:
++	 *
++	 * mem_hotplug_lock->slab_mutex->kernfs_mutex
++	 *
++	 * We don't really need mem_hotplug_lock (to hold off
++	 * slab_mem_going_offline_callback) here because slab's memory hot
++	 * unplug code doesn't destroy the kmem_cache->node[] data.
++	 */
++
+ #ifdef CONFIG_SLUB_DEBUG
+ 	if (flags & SO_ALL) {
+ 		struct kmem_cache_node *n;
+@@ -4877,7 +4887,6 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
+ 			x += sprintf(buf + x, " N%d=%lu",
+ 					node, nodes[node]);
+ #endif
+-	put_online_mems();
+ 	kfree(nodes);
+ 	return x + sprintf(buf + x, "\n");
+ }
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index a6c5d0b28321..8d03013b6c59 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -354,12 +354,13 @@ unsigned long zone_reclaimable_pages(struct zone *zone)
+  */
+ unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru, int zone_idx)
+ {
+-	unsigned long lru_size;
++	unsigned long lru_size = 0;
+ 	int zid;
+ 
+-	if (!mem_cgroup_disabled())
+-		lru_size = lruvec_page_state_local(lruvec, NR_LRU_BASE + lru);
+-	else
++	if (!mem_cgroup_disabled()) {
++		for (zid = 0; zid < MAX_NR_ZONES; zid++)
++			lru_size += mem_cgroup_get_zone_lru_size(lruvec, lru, zid);
++	} else
+ 		lru_size = node_page_state(lruvec_pgdat(lruvec), NR_LRU_BASE + lru);
+ 
+ 	for (zid = zone_idx + 1; zid < MAX_NR_ZONES; zid++) {
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 982d8d12830e..d4a47c44daf0 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -5465,12 +5465,14 @@ static void skb_mod_eth_type(struct sk_buff *skb, struct ethhdr *hdr,
+  * @skb: buffer
+  * @mpls_lse: MPLS label stack entry to push
+  * @mpls_proto: ethertype of the new MPLS header (expects 0x8847 or 0x8848)
++ * @mac_len: length of the MAC header
+  *
+  * Expects skb->data at mac header.
+  *
+  * Returns 0 on success, -errno otherwise.
+  */
+-int skb_mpls_push(struct sk_buff *skb, __be32 mpls_lse, __be16 mpls_proto)
++int skb_mpls_push(struct sk_buff *skb, __be32 mpls_lse, __be16 mpls_proto,
++		  int mac_len)
+ {
+ 	struct mpls_shim_hdr *lse;
+ 	int err;
+@@ -5487,15 +5489,15 @@ int skb_mpls_push(struct sk_buff *skb, __be32 mpls_lse, __be16 mpls_proto)
+ 		return err;
+ 
+ 	if (!skb->inner_protocol) {
+-		skb_set_inner_network_header(skb, skb->mac_len);
++		skb_set_inner_network_header(skb, mac_len);
+ 		skb_set_inner_protocol(skb, skb->protocol);
+ 	}
+ 
+ 	skb_push(skb, MPLS_HLEN);
+ 	memmove(skb_mac_header(skb) - MPLS_HLEN, skb_mac_header(skb),
+-		skb->mac_len);
++		mac_len);
+ 	skb_reset_mac_header(skb);
+-	skb_set_network_header(skb, skb->mac_len);
++	skb_set_network_header(skb, mac_len);
+ 
+ 	lse = mpls_hdr(skb);
+ 	lse->label_stack_entry = mpls_lse;
+@@ -5514,29 +5516,30 @@ EXPORT_SYMBOL_GPL(skb_mpls_push);
+  *
+  * @skb: buffer
+  * @next_proto: ethertype of header after popped MPLS header
++ * @mac_len: length of the MAC header
+  *
+  * Expects skb->data at mac header.
+  *
+  * Returns 0 on success, -errno otherwise.
+  */
+-int skb_mpls_pop(struct sk_buff *skb, __be16 next_proto)
++int skb_mpls_pop(struct sk_buff *skb, __be16 next_proto, int mac_len)
+ {
+ 	int err;
+ 
+ 	if (unlikely(!eth_p_mpls(skb->protocol)))
+-		return -EINVAL;
++		return 0;
+ 
+-	err = skb_ensure_writable(skb, skb->mac_len + MPLS_HLEN);
++	err = skb_ensure_writable(skb, mac_len + MPLS_HLEN);
+ 	if (unlikely(err))
+ 		return err;
+ 
+ 	skb_postpull_rcsum(skb, mpls_hdr(skb), MPLS_HLEN);
+ 	memmove(skb_mac_header(skb) + MPLS_HLEN, skb_mac_header(skb),
+-		skb->mac_len);
++		mac_len);
+ 
+ 	__skb_pull(skb, MPLS_HLEN);
+ 	skb_reset_mac_header(skb);
+-	skb_set_network_header(skb, skb->mac_len);
++	skb_set_network_header(skb, mac_len);
+ 
+ 	if (skb->dev && skb->dev->type == ARPHRD_ETHER) {
+ 		struct ethhdr *hdr;
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 14654876127e..621f83434b24 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1482,7 +1482,7 @@ static bool rt_cache_route(struct fib_nh_common *nhc, struct rtable *rt)
+ 	prev = cmpxchg(p, orig, rt);
+ 	if (prev == orig) {
+ 		if (orig) {
+-			dst_dev_put(&orig->dst);
++			rt_add_uncached_list(orig);
+ 			dst_release(&orig->dst);
+ 		}
+ 	} else {
+@@ -2470,14 +2470,17 @@ struct rtable *ip_route_output_key_hash_rcu(struct net *net, struct flowi4 *fl4,
+ 	int orig_oif = fl4->flowi4_oif;
+ 	unsigned int flags = 0;
+ 	struct rtable *rth;
+-	int err = -ENETUNREACH;
++	int err;
+ 
+ 	if (fl4->saddr) {
+-		rth = ERR_PTR(-EINVAL);
+ 		if (ipv4_is_multicast(fl4->saddr) ||
+ 		    ipv4_is_lbcast(fl4->saddr) ||
+-		    ipv4_is_zeronet(fl4->saddr))
++		    ipv4_is_zeronet(fl4->saddr)) {
++			rth = ERR_PTR(-EINVAL);
+ 			goto out;
++		}
++
++		rth = ERR_PTR(-ENETUNREACH);
+ 
+ 		/* I removed check for oif == dev_out->oif here.
+ 		   It was wrong for two reasons:
+diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
+index a593aaf25748..2bb0b66181a7 100644
+--- a/net/ipv6/ip6_input.c
++++ b/net/ipv6/ip6_input.c
+@@ -80,8 +80,10 @@ static void ip6_sublist_rcv_finish(struct list_head *head)
+ {
+ 	struct sk_buff *skb, *next;
+ 
+-	list_for_each_entry_safe(skb, next, head, list)
++	list_for_each_entry_safe(skb, next, head, list) {
++		skb_list_del_init(skb);
+ 		dst_input(skb);
++	}
+ }
+ 
+ static void ip6_list_rcv_finish(struct net *net, struct sock *sk,
+diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
+index b1438fd4d876..64b544ae9966 100644
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -487,9 +487,14 @@ static ssize_t ieee80211_if_fmt_aqm(
+ 	const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
+ {
+ 	struct ieee80211_local *local = sdata->local;
+-	struct txq_info *txqi = to_txq_info(sdata->vif.txq);
++	struct txq_info *txqi;
+ 	int len;
+ 
++	if (!sdata->vif.txq)
++		return 0;
++
++	txqi = to_txq_info(sdata->vif.txq);
++
+ 	spin_lock_bh(&local->fq.lock);
+ 	rcu_read_lock();
+ 
+@@ -658,7 +663,9 @@ static void add_common_files(struct ieee80211_sub_if_data *sdata)
+ 	DEBUGFS_ADD(rc_rateidx_vht_mcs_mask_5ghz);
+ 	DEBUGFS_ADD(hw_queues);
+ 
+-	if (sdata->local->ops->wake_tx_queue)
++	if (sdata->local->ops->wake_tx_queue &&
++	    sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
++	    sdata->vif.type != NL80211_IFTYPE_NAN)
+ 		DEBUGFS_ADD(aqm);
+ }
+ 
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 4c888dc9bd81..a826f9ccc03f 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2629,7 +2629,8 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
+ 
+ 	rcu_read_lock();
+ 	ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
+-	if (WARN_ON_ONCE(ssid == NULL))
++	if (WARN_ONCE(!ssid || ssid[1] > IEEE80211_MAX_SSID_LEN,
++		      "invalid SSID element (len=%d)", ssid ? ssid[1] : -1))
+ 		ssid_len = 0;
+ 	else
+ 		ssid_len = ssid[1];
+@@ -5227,7 +5228,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
+ 
+ 	rcu_read_lock();
+ 	ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
+-	if (!ssidie) {
++	if (!ssidie || ssidie[1] > sizeof(assoc_data->ssid)) {
+ 		rcu_read_unlock();
+ 		kfree(assoc_data);
+ 		return -EINVAL;
+diff --git a/net/netfilter/nft_connlimit.c b/net/netfilter/nft_connlimit.c
+index af1497ab9464..69d6173f91e2 100644
+--- a/net/netfilter/nft_connlimit.c
++++ b/net/netfilter/nft_connlimit.c
+@@ -218,8 +218,13 @@ static void nft_connlimit_destroy_clone(const struct nft_ctx *ctx,
+ static bool nft_connlimit_gc(struct net *net, const struct nft_expr *expr)
+ {
+ 	struct nft_connlimit *priv = nft_expr_priv(expr);
++	bool ret;
+ 
+-	return nf_conncount_gc_list(net, &priv->list);
++	local_bh_disable();
++	ret = nf_conncount_gc_list(net, &priv->list);
++	local_bh_enable();
++
++	return ret;
+ }
+ 
+ static struct nft_expr_type nft_connlimit_type;
+diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
+index 3572e11b6f21..1c77f520f474 100644
+--- a/net/openvswitch/actions.c
++++ b/net/openvswitch/actions.c
+@@ -165,7 +165,8 @@ static int push_mpls(struct sk_buff *skb, struct sw_flow_key *key,
+ {
+ 	int err;
+ 
+-	err = skb_mpls_push(skb, mpls->mpls_lse, mpls->mpls_ethertype);
++	err = skb_mpls_push(skb, mpls->mpls_lse, mpls->mpls_ethertype,
++			    skb->mac_len);
+ 	if (err)
+ 		return err;
+ 
+@@ -178,7 +179,7 @@ static int pop_mpls(struct sk_buff *skb, struct sw_flow_key *key,
+ {
+ 	int err;
+ 
+-	err = skb_mpls_pop(skb, ethertype);
++	err = skb_mpls_pop(skb, ethertype, skb->mac_len);
+ 	if (err)
+ 		return err;
+ 
+diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c
+index c97ebdc043e4..48f67a9b1037 100644
+--- a/net/rxrpc/peer_event.c
++++ b/net/rxrpc/peer_event.c
+@@ -147,10 +147,16 @@ void rxrpc_error_report(struct sock *sk)
+ {
+ 	struct sock_exterr_skb *serr;
+ 	struct sockaddr_rxrpc srx;
+-	struct rxrpc_local *local = sk->sk_user_data;
++	struct rxrpc_local *local;
+ 	struct rxrpc_peer *peer;
+ 	struct sk_buff *skb;
+ 
++	rcu_read_lock();
++	local = rcu_dereference_sk_user_data(sk);
++	if (unlikely(!local)) {
++		rcu_read_unlock();
++		return;
++	}
+ 	_enter("%p{%d}", sk, local->debug_id);
+ 
+ 	/* Clear the outstanding error value on the socket so that it doesn't
+@@ -160,6 +166,7 @@ void rxrpc_error_report(struct sock *sk)
+ 
+ 	skb = sock_dequeue_err_skb(sk);
+ 	if (!skb) {
++		rcu_read_unlock();
+ 		_leave("UDP socket errqueue empty");
+ 		return;
+ 	}
+@@ -167,11 +174,11 @@ void rxrpc_error_report(struct sock *sk)
+ 	serr = SKB_EXT_ERR(skb);
+ 	if (!skb->len && serr->ee.ee_origin == SO_EE_ORIGIN_TIMESTAMPING) {
+ 		_leave("UDP empty message");
++		rcu_read_unlock();
+ 		rxrpc_free_skb(skb, rxrpc_skb_freed);
+ 		return;
+ 	}
+ 
+-	rcu_read_lock();
+ 	peer = rxrpc_lookup_peer_icmp_rcu(local, skb, &srx);
+ 	if (peer && !rxrpc_get_peer_maybe(peer))
+ 		peer = NULL;
+diff --git a/net/sched/act_api.c b/net/sched/act_api.c
+index 2558f00f6b3e..69d4676a402f 100644
+--- a/net/sched/act_api.c
++++ b/net/sched/act_api.c
+@@ -832,8 +832,7 @@ static struct tc_cookie *nla_memdup_cookie(struct nlattr **tb)
+ }
+ 
+ static const struct nla_policy tcf_action_policy[TCA_ACT_MAX + 1] = {
+-	[TCA_ACT_KIND]		= { .type = NLA_NUL_STRING,
+-				    .len = IFNAMSIZ - 1 },
++	[TCA_ACT_KIND]		= { .type = NLA_STRING },
+ 	[TCA_ACT_INDEX]		= { .type = NLA_U32 },
+ 	[TCA_ACT_COOKIE]	= { .type = NLA_BINARY,
+ 				    .len = TC_COOKIE_MAX_SIZE },
+@@ -865,8 +864,10 @@ struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp,
+ 			NL_SET_ERR_MSG(extack, "TC action kind must be specified");
+ 			goto err_out;
+ 		}
+-		nla_strlcpy(act_name, kind, IFNAMSIZ);
+-
++		if (nla_strlcpy(act_name, kind, IFNAMSIZ) >= IFNAMSIZ) {
++			NL_SET_ERR_MSG(extack, "TC action name too long");
++			goto err_out;
++		}
+ 		if (tb[TCA_ACT_COOKIE]) {
+ 			cookie = nla_memdup_cookie(tb);
+ 			if (!cookie) {
+@@ -1352,11 +1353,16 @@ static int tcf_action_add(struct net *net, struct nlattr *nla,
+ 			  struct netlink_ext_ack *extack)
+ {
+ 	size_t attr_size = 0;
+-	int ret = 0;
++	int loop, ret;
+ 	struct tc_action *actions[TCA_ACT_MAX_PRIO] = {};
+ 
+-	ret = tcf_action_init(net, NULL, nla, NULL, NULL, ovr, 0, actions,
+-			      &attr_size, true, extack);
++	for (loop = 0; loop < 10; loop++) {
++		ret = tcf_action_init(net, NULL, nla, NULL, NULL, ovr, 0,
++				      actions, &attr_size, true, extack);
++		if (ret != -EAGAIN)
++			break;
++	}
++
+ 	if (ret < 0)
+ 		return ret;
+ 	ret = tcf_add_notify(net, n, actions, portid, attr_size, extack);
+@@ -1406,11 +1412,8 @@ static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n,
+ 		 */
+ 		if (n->nlmsg_flags & NLM_F_REPLACE)
+ 			ovr = 1;
+-replay:
+ 		ret = tcf_action_add(net, tca[TCA_ACT_TAB], n, portid, ovr,
+ 				     extack);
+-		if (ret == -EAGAIN)
+-			goto replay;
+ 		break;
+ 	case RTM_DELACTION:
+ 		ret = tca_action_gd(net, tca[TCA_ACT_TAB], n,
+diff --git a/net/sched/act_mpls.c b/net/sched/act_mpls.c
+index e168df0e008a..4cf6c553bb0b 100644
+--- a/net/sched/act_mpls.c
++++ b/net/sched/act_mpls.c
+@@ -55,7 +55,7 @@ static int tcf_mpls_act(struct sk_buff *skb, const struct tc_action *a,
+ 	struct tcf_mpls *m = to_mpls(a);
+ 	struct tcf_mpls_params *p;
+ 	__be32 new_lse;
+-	int ret;
++	int ret, mac_len;
+ 
+ 	tcf_lastuse_update(&m->tcf_tm);
+ 	bstats_cpu_update(this_cpu_ptr(m->common.cpu_bstats), skb);
+@@ -63,8 +63,12 @@ static int tcf_mpls_act(struct sk_buff *skb, const struct tc_action *a,
+ 	/* Ensure 'data' points at mac_header prior calling mpls manipulating
+ 	 * functions.
+ 	 */
+-	if (skb_at_tc_ingress(skb))
++	if (skb_at_tc_ingress(skb)) {
+ 		skb_push_rcsum(skb, skb->mac_len);
++		mac_len = skb->mac_len;
++	} else {
++		mac_len = skb_network_header(skb) - skb_mac_header(skb);
++	}
+ 
+ 	ret = READ_ONCE(m->tcf_action);
+ 
+@@ -72,12 +76,12 @@ static int tcf_mpls_act(struct sk_buff *skb, const struct tc_action *a,
+ 
+ 	switch (p->tcfm_action) {
+ 	case TCA_MPLS_ACT_POP:
+-		if (skb_mpls_pop(skb, p->tcfm_proto))
++		if (skb_mpls_pop(skb, p->tcfm_proto, mac_len))
+ 			goto drop;
+ 		break;
+ 	case TCA_MPLS_ACT_PUSH:
+ 		new_lse = tcf_mpls_get_lse(NULL, p, !eth_p_mpls(skb->protocol));
+-		if (skb_mpls_push(skb, new_lse, p->tcfm_proto))
++		if (skb_mpls_push(skb, new_lse, p->tcfm_proto, mac_len))
+ 			goto drop;
+ 		break;
+ 	case TCA_MPLS_ACT_MODIFY:
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index 9aef93300f1c..6b12883e04b8 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -160,11 +160,22 @@ static inline u32 tcf_auto_prio(struct tcf_proto *tp)
+ 	return TC_H_MAJ(first);
+ }
+ 
++static bool tcf_proto_check_kind(struct nlattr *kind, char *name)
++{
++	if (kind)
++		return nla_strlcpy(name, kind, IFNAMSIZ) >= IFNAMSIZ;
++	memset(name, 0, IFNAMSIZ);
++	return false;
++}
++
+ static bool tcf_proto_is_unlocked(const char *kind)
+ {
+ 	const struct tcf_proto_ops *ops;
+ 	bool ret;
+ 
++	if (strlen(kind) == 0)
++		return false;
++
+ 	ops = tcf_proto_lookup_ops(kind, false, NULL);
+ 	/* On error return false to take rtnl lock. Proto lookup/create
+ 	 * functions will perform lookup again and properly handle errors.
+@@ -1976,6 +1987,7 @@ static int tc_new_tfilter(struct sk_buff *skb, struct nlmsghdr *n,
+ {
+ 	struct net *net = sock_net(skb->sk);
+ 	struct nlattr *tca[TCA_MAX + 1];
++	char name[IFNAMSIZ];
+ 	struct tcmsg *t;
+ 	u32 protocol;
+ 	u32 prio;
+@@ -2032,13 +2044,19 @@ replay:
+ 	if (err)
+ 		return err;
+ 
++	if (tcf_proto_check_kind(tca[TCA_KIND], name)) {
++		NL_SET_ERR_MSG(extack, "Specified TC filter name too long");
++		err = -EINVAL;
++		goto errout;
++	}
++
+ 	/* Take rtnl mutex if rtnl_held was set to true on previous iteration,
+ 	 * block is shared (no qdisc found), qdisc is not unlocked, classifier
+ 	 * type is not specified, classifier is not unlocked.
+ 	 */
+ 	if (rtnl_held ||
+ 	    (q && !(q->ops->cl_ops->flags & QDISC_CLASS_OPS_DOIT_UNLOCKED)) ||
+-	    !tca[TCA_KIND] || !tcf_proto_is_unlocked(nla_data(tca[TCA_KIND]))) {
++	    !tcf_proto_is_unlocked(name)) {
+ 		rtnl_held = true;
+ 		rtnl_lock();
+ 	}
+@@ -2196,6 +2214,7 @@ static int tc_del_tfilter(struct sk_buff *skb, struct nlmsghdr *n,
+ {
+ 	struct net *net = sock_net(skb->sk);
+ 	struct nlattr *tca[TCA_MAX + 1];
++	char name[IFNAMSIZ];
+ 	struct tcmsg *t;
+ 	u32 protocol;
+ 	u32 prio;
+@@ -2235,13 +2254,18 @@ static int tc_del_tfilter(struct sk_buff *skb, struct nlmsghdr *n,
+ 	if (err)
+ 		return err;
+ 
++	if (tcf_proto_check_kind(tca[TCA_KIND], name)) {
++		NL_SET_ERR_MSG(extack, "Specified TC filter name too long");
++		err = -EINVAL;
++		goto errout;
++	}
+ 	/* Take rtnl mutex if flushing whole chain, block is shared (no qdisc
+ 	 * found), qdisc is not unlocked, classifier type is not specified,
+ 	 * classifier is not unlocked.
+ 	 */
+ 	if (!prio ||
+ 	    (q && !(q->ops->cl_ops->flags & QDISC_CLASS_OPS_DOIT_UNLOCKED)) ||
+-	    !tca[TCA_KIND] || !tcf_proto_is_unlocked(nla_data(tca[TCA_KIND]))) {
++	    !tcf_proto_is_unlocked(name)) {
+ 		rtnl_held = true;
+ 		rtnl_lock();
+ 	}
+@@ -2349,6 +2373,7 @@ static int tc_get_tfilter(struct sk_buff *skb, struct nlmsghdr *n,
+ {
+ 	struct net *net = sock_net(skb->sk);
+ 	struct nlattr *tca[TCA_MAX + 1];
++	char name[IFNAMSIZ];
+ 	struct tcmsg *t;
+ 	u32 protocol;
+ 	u32 prio;
+@@ -2385,12 +2410,17 @@ static int tc_get_tfilter(struct sk_buff *skb, struct nlmsghdr *n,
+ 	if (err)
+ 		return err;
+ 
++	if (tcf_proto_check_kind(tca[TCA_KIND], name)) {
++		NL_SET_ERR_MSG(extack, "Specified TC filter name too long");
++		err = -EINVAL;
++		goto errout;
++	}
+ 	/* Take rtnl mutex if block is shared (no qdisc found), qdisc is not
+ 	 * unlocked, classifier type is not specified, classifier is not
+ 	 * unlocked.
+ 	 */
+ 	if ((q && !(q->ops->cl_ops->flags & QDISC_CLASS_OPS_DOIT_UNLOCKED)) ||
+-	    !tca[TCA_KIND] || !tcf_proto_is_unlocked(nla_data(tca[TCA_KIND]))) {
++	    !tcf_proto_is_unlocked(name)) {
+ 		rtnl_held = true;
+ 		rtnl_lock();
+ 	}
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index 81d58b280612..1047825d9f48 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1390,8 +1390,7 @@ check_loop_fn(struct Qdisc *q, unsigned long cl, struct qdisc_walker *w)
+ }
+ 
+ const struct nla_policy rtm_tca_policy[TCA_MAX + 1] = {
+-	[TCA_KIND]		= { .type = NLA_NUL_STRING,
+-				    .len = IFNAMSIZ - 1 },
++	[TCA_KIND]		= { .type = NLA_STRING },
+ 	[TCA_RATE]		= { .type = NLA_BINARY,
+ 				    .len = sizeof(struct tc_estimator) },
+ 	[TCA_STAB]		= { .type = NLA_NESTED },
+diff --git a/net/sched/sch_etf.c b/net/sched/sch_etf.c
+index cebfb65d8556..b1da5589a0c6 100644
+--- a/net/sched/sch_etf.c
++++ b/net/sched/sch_etf.c
+@@ -177,7 +177,7 @@ static int etf_enqueue_timesortedlist(struct sk_buff *nskb, struct Qdisc *sch,
+ 
+ 		parent = *p;
+ 		skb = rb_to_skb(parent);
+-		if (ktime_after(txtime, skb->tstamp)) {
++		if (ktime_compare(txtime, skb->tstamp) >= 0) {
+ 			p = &parent->rb_right;
+ 			leftmost = false;
+ 		} else {
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index b083d4e66230..8fd7b0e6ce9f 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -9353,7 +9353,7 @@ struct proto sctp_prot = {
+ 	.backlog_rcv =	sctp_backlog_rcv,
+ 	.hash        =	sctp_hash,
+ 	.unhash      =	sctp_unhash,
+-	.get_port    =	sctp_get_port,
++	.no_autobind =	true,
+ 	.obj_size    =  sizeof(struct sctp_sock),
+ 	.useroffset  =  offsetof(struct sctp_sock, subscribe),
+ 	.usersize    =  offsetof(struct sctp_sock, initmsg) -
+@@ -9395,7 +9395,7 @@ struct proto sctpv6_prot = {
+ 	.backlog_rcv	= sctp_backlog_rcv,
+ 	.hash		= sctp_hash,
+ 	.unhash		= sctp_unhash,
+-	.get_port	= sctp_get_port,
++	.no_autobind	= true,
+ 	.obj_size	= sizeof(struct sctp6_sock),
+ 	.useroffset	= offsetof(struct sctp6_sock, sctp.subscribe),
+ 	.usersize	= offsetof(struct sctp6_sock, sctp.initmsg) -
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index f03459ddc840..c2ce582ea143 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -6184,6 +6184,9 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
+ 	if (!rdev->ops->del_mpath)
+ 		return -EOPNOTSUPP;
+ 
++	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
++		return -EOPNOTSUPP;
++
+ 	return rdev_del_mpath(rdev, dev, dst);
+ }
+ 
+diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
+index c67d7a82ab13..73fd0eae08ca 100644
+--- a/net/wireless/wext-sme.c
++++ b/net/wireless/wext-sme.c
+@@ -202,6 +202,7 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
+ 			       struct iw_point *data, char *ssid)
+ {
+ 	struct wireless_dev *wdev = dev->ieee80211_ptr;
++	int ret = 0;
+ 
+ 	/* call only for station! */
+ 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+@@ -219,7 +220,10 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
+ 		if (ie) {
+ 			data->flags = 1;
+ 			data->length = ie[1];
+-			memcpy(ssid, ie + 2, data->length);
++			if (data->length > IW_ESSID_MAX_SIZE)
++				ret = -EINVAL;
++			else
++				memcpy(ssid, ie + 2, data->length);
+ 		}
+ 		rcu_read_unlock();
+ 	} else if (wdev->wext.connect.ssid && wdev->wext.connect.ssid_len) {
+@@ -229,7 +233,7 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
+ 	}
+ 	wdev_unlock(wdev);
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ int cfg80211_mgd_wext_siwap(struct net_device *dev,
+diff --git a/scripts/namespace.pl b/scripts/namespace.pl
+index 6135574a6f39..1da7bca201a4 100755
+--- a/scripts/namespace.pl
++++ b/scripts/namespace.pl
+@@ -65,13 +65,14 @@
+ use warnings;
+ use strict;
+ use File::Find;
++use File::Spec;
+ 
+ my $nm = ($ENV{'NM'} || "nm") . " -p";
+ my $objdump = ($ENV{'OBJDUMP'} || "objdump") . " -s -j .comment";
+-my $srctree = "";
+-my $objtree = "";
+-$srctree = "$ENV{'srctree'}/" if (exists($ENV{'srctree'}));
+-$objtree = "$ENV{'objtree'}/" if (exists($ENV{'objtree'}));
++my $srctree = File::Spec->curdir();
++my $objtree = File::Spec->curdir();
++$srctree = File::Spec->rel2abs($ENV{'srctree'}) if (exists($ENV{'srctree'}));
++$objtree = File::Spec->rel2abs($ENV{'objtree'}) if (exists($ENV{'objtree'}));
+ 
+ if ($#ARGV != -1) {
+ 	print STDERR "usage: $0 takes no parameters\n";
+@@ -231,9 +232,9 @@ sub do_nm
+ 	}
+ 	($source = $basename) =~ s/\.o$//;
+ 	if (-e "$source.c" || -e "$source.S") {
+-		$source = "$objtree$File::Find::dir/$source";
++		$source = File::Spec->catfile($objtree, $File::Find::dir, $source)
+ 	} else {
+-		$source = "$srctree$File::Find::dir/$source";
++		$source = File::Spec->catfile($srctree, $File::Find::dir, $source)
+ 	}
+ 	if (! -e "$source.c" && ! -e "$source.S") {
+ 		# No obvious source, exclude the object if it is conglomerate
+diff --git a/security/safesetid/securityfs.c b/security/safesetid/securityfs.c
+index d568e17dd773..74a13d432ed8 100644
+--- a/security/safesetid/securityfs.c
++++ b/security/safesetid/securityfs.c
+@@ -187,7 +187,8 @@ out_free_rule:
+ out_free_buf:
+ 	kfree(buf);
+ out_free_pol:
+-	release_ruleset(pol);
++	if (pol)
++                release_ruleset(pol);
+ 	return err;
+ }
+ 
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 36240def9bf5..00796c7727ea 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3307,6 +3307,8 @@ static int patch_nvhdmi(struct hda_codec *codec)
+ 		nvhdmi_chmap_cea_alloc_validate_get_type;
+ 	spec->chmap.ops.chmap_validate = nvhdmi_chmap_validate;
+ 
++	codec->link_down_at_suspend = 1;
++
+ 	return 0;
+ }
+ 
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 36aee8ad2054..26249c607f2c 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -393,6 +393,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ 	case 0x10ec0700:
+ 	case 0x10ec0701:
+ 	case 0x10ec0703:
++	case 0x10ec0711:
+ 		alc_update_coef_idx(codec, 0x10, 1<<15, 0);
+ 		break;
+ 	case 0x10ec0662:
+@@ -5867,6 +5868,7 @@ enum {
+ 	ALC225_FIXUP_WYSE_AUTO_MUTE,
+ 	ALC225_FIXUP_WYSE_DISABLE_MIC_VREF,
+ 	ALC286_FIXUP_ACER_AIO_HEADSET_MIC,
++	ALC256_FIXUP_ASUS_HEADSET_MIC,
+ 	ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
+ 	ALC299_FIXUP_PREDATOR_SPK,
+ 	ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC,
+@@ -6901,6 +6903,15 @@ static const struct hda_fixup alc269_fixups[] = {
+ 		.chained = true,
+ 		.chain_id = ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE
+ 	},
++	[ALC256_FIXUP_ASUS_HEADSET_MIC] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{ 0x19, 0x03a11020 }, /* headset mic with jack detect */
++			{ }
++		},
++		.chained = true,
++		.chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
++	},
+ 	[ALC256_FIXUP_ASUS_MIC_NO_PRESENCE] = {
+ 		.type = HDA_FIXUP_PINS,
+ 		.v.pins = (const struct hda_pintbl[]) {
+@@ -7097,6 +7108,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
+ 	SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
+ 	SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC),
++	SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+ 	SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC),
+ 	SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
+@@ -7965,6 +7977,7 @@ static int patch_alc269(struct hda_codec *codec)
+ 	case 0x10ec0700:
+ 	case 0x10ec0701:
+ 	case 0x10ec0703:
++	case 0x10ec0711:
+ 		spec->codec_variant = ALC269_TYPE_ALC700;
+ 		spec->gen.mixer_nid = 0; /* ALC700 does not have any loopback mixer path */
+ 		alc_update_coef_idx(codec, 0x4a, 1 << 15, 0); /* Combo jack auto trigger control */
+@@ -9105,6 +9118,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
+ 	HDA_CODEC_ENTRY(0x10ec0700, "ALC700", patch_alc269),
+ 	HDA_CODEC_ENTRY(0x10ec0701, "ALC701", patch_alc269),
+ 	HDA_CODEC_ENTRY(0x10ec0703, "ALC703", patch_alc269),
++	HDA_CODEC_ENTRY(0x10ec0711, "ALC711", patch_alc269),
+ 	HDA_CODEC_ENTRY(0x10ec0867, "ALC891", patch_alc662),
+ 	HDA_CODEC_ENTRY(0x10ec0880, "ALC880", patch_alc880),
+ 	HDA_CODEC_ENTRY(0x10ec0882, "ALC882", patch_alc882),
+diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
+index 56e8dae9a15c..217f2aa06139 100644
+--- a/sound/soc/sh/rcar/core.c
++++ b/sound/soc/sh/rcar/core.c
+@@ -761,6 +761,7 @@ static int rsnd_soc_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ 	}
+ 
+ 	/* set format */
++	rdai->bit_clk_inv = 0;
+ 	switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+ 	case SND_SOC_DAIFMT_I2S:
+ 		rdai->sys_delay = 0;
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index 33cd26763c0e..ff5ab24f3bd1 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -348,6 +348,9 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
+ 		ep = 0x84;
+ 		ifnum = 0;
+ 		goto add_sync_ep_from_ifnum;
++	case USB_ID(0x0582, 0x01d8): /* BOSS Katana */
++		/* BOSS Katana amplifiers do not need quirks */
++		return 0;
+ 	}
+ 
+ 	if (attr == USB_ENDPOINT_SYNC_ASYNC &&
+diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile
+index ba7849751989..fc8aeb224c03 100644
+--- a/tools/testing/selftests/kvm/Makefile
++++ b/tools/testing/selftests/kvm/Makefile
+@@ -46,7 +46,7 @@ CFLAGS += -Wall -Wstrict-prototypes -Wuninitialized -O2 -g -std=gnu99 \
+ 	-I$(LINUX_HDR_PATH) -Iinclude -I$(<D) -Iinclude/$(UNAME_M) -I..
+ 
+ no-pie-option := $(call try-run, echo 'int main() { return 0; }' | \
+-        $(CC) -Werror $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) -no-pie -x c - -o "$$TMP", -no-pie)
++        $(CC) -Werror -no-pie -x c - -o "$$TMP", -no-pie)
+ 
+ # On s390, build the testcases KVM-enabled
+ pgste-option = $(call try-run, echo 'int main() { return 0; }' | \