[gentoo-commits] proj/linux-patches:5.9 commit in: /

[Mike Pagano]

commit:     54f932d5566957b4eb41aea06e6febb1c65245bd
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Dec  2 12:50:56 2020 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Dec  2 12:50:56 2020 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=54f932d5

Linux patch 5.9.12

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README             |    4 +
 1011_linux-5.9.12.patch | 6940 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 6944 insertions(+)

diff --git a/0000_README b/0000_README
index 7528f5d..22fb04b 100644
--- a/0000_README
+++ b/0000_README
@@ -87,6 +87,10 @@ Patch:  1010_linux-5.9.11.patch
 From:   http://www.kernel.org
 Desc:   Linux 5.9.11
 
+Patch:  1011_linux-5.9.12.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.9.12
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1011_linux-5.9.12.patch b/1011_linux-5.9.12.patch
new file mode 100644
index 0000000..4267414
--- /dev/null
+++ b/1011_linux-5.9.12.patch
@@ -0,0 +1,6940 @@
+diff --git a/Makefile b/Makefile
+index bacb52fac2a54..1dd088b0ac993 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 9
+-SUBLEVEL = 11
++SUBLEVEL = 12
+ EXTRAVERSION =
+ NAME = Kleptomaniac Octopus
+ 
+diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
+index f1ed17edb085b..163641726a2b9 100644
+--- a/arch/arc/include/asm/pgtable.h
++++ b/arch/arc/include/asm/pgtable.h
+@@ -134,8 +134,10 @@
+ 
+ #ifdef CONFIG_ARC_HAS_PAE40
+ #define PTE_BITS_NON_RWX_IN_PD1	(0xff00000000 | PAGE_MASK | _PAGE_CACHEABLE)
++#define MAX_POSSIBLE_PHYSMEM_BITS 40
+ #else
+ #define PTE_BITS_NON_RWX_IN_PD1	(PAGE_MASK | _PAGE_CACHEABLE)
++#define MAX_POSSIBLE_PHYSMEM_BITS 32
+ #endif
+ 
+ /**************************************************************************
+diff --git a/arch/arm/boot/dts/dra76x.dtsi b/arch/arm/boot/dts/dra76x.dtsi
+index b69c7d40f5d82..2f326151116b7 100644
+--- a/arch/arm/boot/dts/dra76x.dtsi
++++ b/arch/arm/boot/dts/dra76x.dtsi
+@@ -32,8 +32,8 @@
+ 				interrupts = <GIC_SPI 67 IRQ_TYPE_LEVEL_HIGH>,
+ 					     <GIC_SPI 68 IRQ_TYPE_LEVEL_HIGH>;
+ 				interrupt-names = "int0", "int1";
+-				clocks = <&mcan_clk>, <&l3_iclk_div>;
+-				clock-names = "cclk", "hclk";
++				clocks = <&l3_iclk_div>, <&mcan_clk>;
++				clock-names = "hclk", "cclk";
+ 				bosch,mram-cfg = <0x0 0 0 32 0 0 1 1>;
+ 			};
+ 		};
+diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h
+index 3502c2f746ca7..baf7d0204eb5a 100644
+--- a/arch/arm/include/asm/pgtable-2level.h
++++ b/arch/arm/include/asm/pgtable-2level.h
+@@ -75,6 +75,8 @@
+ #define PTE_HWTABLE_OFF		(PTE_HWTABLE_PTRS * sizeof(pte_t))
+ #define PTE_HWTABLE_SIZE	(PTRS_PER_PTE * sizeof(u32))
+ 
++#define MAX_POSSIBLE_PHYSMEM_BITS	32
++
+ /*
+  * PMD_SHIFT determines the size of the area a second-level page table can map
+  * PGDIR_SHIFT determines what a third-level page table entry can map
+diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h
+index fbb6693c33528..2b85d175e9996 100644
+--- a/arch/arm/include/asm/pgtable-3level.h
++++ b/arch/arm/include/asm/pgtable-3level.h
+@@ -25,6 +25,8 @@
+ #define PTE_HWTABLE_OFF		(0)
+ #define PTE_HWTABLE_SIZE	(PTRS_PER_PTE * sizeof(u64))
+ 
++#define MAX_POSSIBLE_PHYSMEM_BITS 40
++
+ /*
+  * PGDIR_SHIFT determines the size a top-level page table entry can map.
+  */
+diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c
+index a92d277f81a08..c8d317fafe2ea 100644
+--- a/arch/arm/mach-omap2/cpuidle44xx.c
++++ b/arch/arm/mach-omap2/cpuidle44xx.c
+@@ -175,8 +175,11 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
+ 		if (mpuss_can_lose_context) {
+ 			error = cpu_cluster_pm_enter();
+ 			if (error) {
+-				omap_set_pwrdm_state(mpu_pd, PWRDM_POWER_ON);
+-				goto cpu_cluster_pm_out;
++				index = 0;
++				cx = state_ptr + index;
++				pwrdm_set_logic_retst(mpu_pd, cx->mpu_logic_state);
++				omap_set_pwrdm_state(mpu_pd, cx->mpu_state);
++				mpuss_can_lose_context = 0;
+ 			}
+ 		}
+ 	}
+@@ -184,7 +187,6 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
+ 	omap4_enter_lowpower(dev->cpu, cx->cpu_state);
+ 	cpu_done[dev->cpu] = true;
+ 
+-cpu_cluster_pm_out:
+ 	/* Wakeup CPU1 only if it is not offlined */
+ 	if (dev->cpu == 0 && cpumask_test_cpu(1, cpu_online_mask)) {
+ 
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p3668-0000.dtsi b/arch/arm64/boot/dts/nvidia/tegra194-p3668-0000.dtsi
+index 10cb836aea7ea..e970d8860a1fd 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194-p3668-0000.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra194-p3668-0000.dtsi
+@@ -54,7 +54,7 @@
+ 			status = "okay";
+ 		};
+ 
+-		serial@c280000 {
++		serial@3100000 {
+ 			status = "okay";
+ 		};
+ 
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+index ca5cb6aef5ee4..6f6d460c931aa 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+@@ -924,7 +924,7 @@
+ 
+ 		hsp_aon: hsp@c150000 {
+ 			compatible = "nvidia,tegra194-hsp", "nvidia,tegra186-hsp";
+-			reg = <0x0c150000 0xa0000>;
++			reg = <0x0c150000 0x90000>;
+ 			interrupts = <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>,
+ 			             <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>,
+ 			             <GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>,
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi
+index e18e1a9a30113..a9caaf7c0d67e 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi
+@@ -1663,16 +1663,6 @@
+ 		vin-supply = <&vdd_5v0_sys>;
+ 	};
+ 
+-	vdd_usb_vbus_otg: regulator@11 {
+-		compatible = "regulator-fixed";
+-		regulator-name = "USB_VBUS_EN0";
+-		regulator-min-microvolt = <5000000>;
+-		regulator-max-microvolt = <5000000>;
+-		gpio = <&gpio TEGRA_GPIO(CC, 4) GPIO_ACTIVE_HIGH>;
+-		enable-active-high;
+-		vin-supply = <&vdd_5v0_sys>;
+-	};
+-
+ 	vdd_hdmi: regulator@10 {
+ 		compatible = "regulator-fixed";
+ 		regulator-name = "VDD_HDMI_5V0";
+@@ -1712,4 +1702,14 @@
+ 		enable-active-high;
+ 		vin-supply = <&vdd_3v3_sys>;
+ 	};
++
++	vdd_usb_vbus_otg: regulator@14 {
++		compatible = "regulator-fixed";
++		regulator-name = "USB_VBUS_EN0";
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++		gpio = <&gpio TEGRA_GPIO(CC, 4) GPIO_ACTIVE_HIGH>;
++		enable-active-high;
++		vin-supply = <&vdd_5v0_sys>;
++	};
+ };
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index 88233d42d9c29..db16919a53e4a 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -108,8 +108,6 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+ #define pte_valid(pte)		(!!(pte_val(pte) & PTE_VALID))
+ #define pte_valid_not_user(pte) \
+ 	((pte_val(pte) & (PTE_VALID | PTE_USER)) == PTE_VALID)
+-#define pte_valid_young(pte) \
+-	((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF))
+ #define pte_valid_user(pte) \
+ 	((pte_val(pte) & (PTE_VALID | PTE_USER)) == (PTE_VALID | PTE_USER))
+ 
+@@ -117,9 +115,12 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+  * Could the pte be present in the TLB? We must check mm_tlb_flush_pending
+  * so that we don't erroneously return false for pages that have been
+  * remapped as PROT_NONE but are yet to be flushed from the TLB.
++ * Note that we can't make any assumptions based on the state of the access
++ * flag, since ptep_clear_flush_young() elides a DSB when invalidating the
++ * TLB.
+  */
+ #define pte_accessible(mm, pte)	\
+-	(mm_tlb_flush_pending(mm) ? pte_present(pte) : pte_valid_young(pte))
++	(mm_tlb_flush_pending(mm) ? pte_present(pte) : pte_valid(pte))
+ 
+ /*
+  * p??_access_permitted() is true for valid user mappings (subject to the
+@@ -145,13 +146,6 @@ static inline pte_t set_pte_bit(pte_t pte, pgprot_t prot)
+ 	return pte;
+ }
+ 
+-static inline pte_t pte_wrprotect(pte_t pte)
+-{
+-	pte = clear_pte_bit(pte, __pgprot(PTE_WRITE));
+-	pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
+-	return pte;
+-}
+-
+ static inline pte_t pte_mkwrite(pte_t pte)
+ {
+ 	pte = set_pte_bit(pte, __pgprot(PTE_WRITE));
+@@ -177,6 +171,20 @@ static inline pte_t pte_mkdirty(pte_t pte)
+ 	return pte;
+ }
+ 
++static inline pte_t pte_wrprotect(pte_t pte)
++{
++	/*
++	 * If hardware-dirty (PTE_WRITE/DBM bit set and PTE_RDONLY
++	 * clear), set the PTE_DIRTY bit.
++	 */
++	if (pte_hw_dirty(pte))
++		pte = pte_mkdirty(pte);
++
++	pte = clear_pte_bit(pte, __pgprot(PTE_WRITE));
++	pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
++	return pte;
++}
++
+ static inline pte_t pte_mkold(pte_t pte)
+ {
+ 	return clear_pte_bit(pte, __pgprot(PTE_AF));
+@@ -798,12 +806,6 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres
+ 	pte = READ_ONCE(*ptep);
+ 	do {
+ 		old_pte = pte;
+-		/*
+-		 * If hardware-dirty (PTE_WRITE/DBM bit set and PTE_RDONLY
+-		 * clear), set the PTE_DIRTY bit.
+-		 */
+-		if (pte_hw_dirty(pte))
+-			pte = pte_mkdirty(pte);
+ 		pte = pte_wrprotect(pte);
+ 		pte_val(pte) = cmpxchg_relaxed(&pte_val(*ptep),
+ 					       pte_val(old_pte), pte_val(pte));
+diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
+index 5c786b915cd34..39c34d92b6017 100644
+--- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c
++++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
+@@ -273,6 +273,23 @@ static unsigned long vgic_mmio_read_v3r_typer(struct kvm_vcpu *vcpu,
+ 	return extract_bytes(value, addr & 7, len);
+ }
+ 
++static unsigned long vgic_uaccess_read_v3r_typer(struct kvm_vcpu *vcpu,
++						 gpa_t addr, unsigned int len)
++{
++	unsigned long mpidr = kvm_vcpu_get_mpidr_aff(vcpu);
++	int target_vcpu_id = vcpu->vcpu_id;
++	u64 value;
++
++	value = (u64)(mpidr & GENMASK(23, 0)) << 32;
++	value |= ((target_vcpu_id & 0xffff) << 8);
++
++	if (vgic_has_its(vcpu->kvm))
++		value |= GICR_TYPER_PLPIS;
++
++	/* reporting of the Last bit is not supported for userspace */
++	return extract_bytes(value, addr & 7, len);
++}
++
+ static unsigned long vgic_mmio_read_v3r_iidr(struct kvm_vcpu *vcpu,
+ 					     gpa_t addr, unsigned int len)
+ {
+@@ -593,8 +610,9 @@ static const struct vgic_register_region vgic_v3_rd_registers[] = {
+ 	REGISTER_DESC_WITH_LENGTH(GICR_IIDR,
+ 		vgic_mmio_read_v3r_iidr, vgic_mmio_write_wi, 4,
+ 		VGIC_ACCESS_32bit),
+-	REGISTER_DESC_WITH_LENGTH(GICR_TYPER,
+-		vgic_mmio_read_v3r_typer, vgic_mmio_write_wi, 8,
++	REGISTER_DESC_WITH_LENGTH_UACCESS(GICR_TYPER,
++		vgic_mmio_read_v3r_typer, vgic_mmio_write_wi,
++		vgic_uaccess_read_v3r_typer, vgic_mmio_uaccess_write_wi, 8,
+ 		VGIC_ACCESS_64bit | VGIC_ACCESS_32bit),
+ 	REGISTER_DESC_WITH_LENGTH(GICR_WAKER,
+ 		vgic_mmio_read_raz, vgic_mmio_write_wi, 4,
+diff --git a/arch/mips/include/asm/pgtable-32.h b/arch/mips/include/asm/pgtable-32.h
+index a950fc1ddb4da..6c0532d7b2119 100644
+--- a/arch/mips/include/asm/pgtable-32.h
++++ b/arch/mips/include/asm/pgtable-32.h
+@@ -154,6 +154,7 @@ static inline void pmd_clear(pmd_t *pmdp)
+ 
+ #if defined(CONFIG_XPA)
+ 
++#define MAX_POSSIBLE_PHYSMEM_BITS 40
+ #define pte_pfn(x)		(((unsigned long)((x).pte_high >> _PFN_SHIFT)) | (unsigned long)((x).pte_low << _PAGE_PRESENT_SHIFT))
+ static inline pte_t
+ pfn_pte(unsigned long pfn, pgprot_t prot)
+@@ -169,6 +170,7 @@ pfn_pte(unsigned long pfn, pgprot_t prot)
+ 
+ #elif defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32)
+ 
++#define MAX_POSSIBLE_PHYSMEM_BITS 36
+ #define pte_pfn(x)		((unsigned long)((x).pte_high >> 6))
+ 
+ static inline pte_t pfn_pte(unsigned long pfn, pgprot_t prot)
+@@ -183,6 +185,7 @@ static inline pte_t pfn_pte(unsigned long pfn, pgprot_t prot)
+ 
+ #else
+ 
++#define MAX_POSSIBLE_PHYSMEM_BITS 32
+ #ifdef CONFIG_CPU_VR41XX
+ #define pte_pfn(x)		((unsigned long)((x).pte >> (PAGE_SHIFT + 2)))
+ #define pfn_pte(pfn, prot)	__pte(((pfn) << (PAGE_SHIFT + 2)) | pgprot_val(prot))
+diff --git a/arch/powerpc/include/asm/book3s/32/pgtable.h b/arch/powerpc/include/asm/book3s/32/pgtable.h
+index 36443cda8dcf2..1376be95e975f 100644
+--- a/arch/powerpc/include/asm/book3s/32/pgtable.h
++++ b/arch/powerpc/include/asm/book3s/32/pgtable.h
+@@ -36,8 +36,10 @@ static inline bool pte_user(pte_t pte)
+  */
+ #ifdef CONFIG_PTE_64BIT
+ #define PTE_RPN_MASK	(~((1ULL << PTE_RPN_SHIFT) - 1))
++#define MAX_POSSIBLE_PHYSMEM_BITS 36
+ #else
+ #define PTE_RPN_MASK	(~((1UL << PTE_RPN_SHIFT) - 1))
++#define MAX_POSSIBLE_PHYSMEM_BITS 32
+ #endif
+ 
+ /*
+diff --git a/arch/powerpc/include/asm/book3s/64/kup-radix.h b/arch/powerpc/include/asm/book3s/64/kup-radix.h
+index 28716e2f13e31..a39e2d193fdc1 100644
+--- a/arch/powerpc/include/asm/book3s/64/kup-radix.h
++++ b/arch/powerpc/include/asm/book3s/64/kup-radix.h
+@@ -63,6 +63,8 @@
+ 
+ #else /* !__ASSEMBLY__ */
+ 
++#include <linux/jump_label.h>
++
+ DECLARE_STATIC_KEY_FALSE(uaccess_flush_key);
+ 
+ #ifdef CONFIG_PPC_KUAP
+diff --git a/arch/powerpc/include/asm/nohash/32/pgtable.h b/arch/powerpc/include/asm/nohash/32/pgtable.h
+index b9e134d0f03ad..5f5049c1ddb7f 100644
+--- a/arch/powerpc/include/asm/nohash/32/pgtable.h
++++ b/arch/powerpc/include/asm/nohash/32/pgtable.h
+@@ -153,8 +153,10 @@ int map_kernel_page(unsigned long va, phys_addr_t pa, pgprot_t prot);
+  */
+ #if defined(CONFIG_PPC32) && defined(CONFIG_PTE_64BIT)
+ #define PTE_RPN_MASK	(~((1ULL << PTE_RPN_SHIFT) - 1))
++#define MAX_POSSIBLE_PHYSMEM_BITS 36
+ #else
+ #define PTE_RPN_MASK	(~((1UL << PTE_RPN_SHIFT) - 1))
++#define MAX_POSSIBLE_PHYSMEM_BITS 32
+ #endif
+ 
+ /*
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index f63a3d3bca3d3..4d01f09ecf808 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -1000,8 +1000,6 @@ TRAMP_REAL_BEGIN(system_reset_idle_wake)
+  * Vectors for the FWNMI option.  Share common code.
+  */
+ TRAMP_REAL_BEGIN(system_reset_fwnmi)
+-	/* XXX: fwnmi guest could run a nested/PR guest, so why no test?  */
+-	__IKVM_REAL(system_reset)=0
+ 	GEN_INT_ENTRY system_reset, virt=0
+ 
+ #endif /* CONFIG_PPC_PSERIES */
+@@ -1412,6 +1410,11 @@ END_FTR_SECTION_IFSET(CPU_FTR_HVMODE)
+  *   If none is found, do a Linux page fault. Linux page faults can happen in
+  *   kernel mode due to user copy operations of course.
+  *
++ *   KVM: The KVM HDSI handler may perform a load with MSR[DR]=1 in guest
++ *   MMU context, which may cause a DSI in the host, which must go to the
++ *   KVM handler. MSR[IR] is not enabled, so the real-mode handler will
++ *   always be used regardless of AIL setting.
++ *
+  * - Radix MMU
+  *   The hardware loads from the Linux page table directly, so a fault goes
+  *   immediately to Linux page fault.
+@@ -1422,10 +1425,8 @@ INT_DEFINE_BEGIN(data_access)
+ 	IVEC=0x300
+ 	IDAR=1
+ 	IDSISR=1
+-#ifdef CONFIG_KVM_BOOK3S_PR_POSSIBLE
+ 	IKVM_SKIP=1
+ 	IKVM_REAL=1
+-#endif
+ INT_DEFINE_END(data_access)
+ 
+ EXC_REAL_BEGIN(data_access, 0x300, 0x80)
+@@ -1464,6 +1465,8 @@ ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_TYPE_RADIX)
+  *   ppc64_bolted_size (first segment). The kernel handler must avoid stomping
+  *   on user-handler data structures.
+  *
++ *   KVM: Same as 0x300, DSLB must test for KVM guest.
++ *
+  * A dedicated save area EXSLB is used (XXX: but it actually need not be
+  * these days, we could use EXGEN).
+  */
+@@ -1472,10 +1475,8 @@ INT_DEFINE_BEGIN(data_access_slb)
+ 	IAREA=PACA_EXSLB
+ 	IRECONCILE=0
+ 	IDAR=1
+-#ifdef CONFIG_KVM_BOOK3S_PR_POSSIBLE
+ 	IKVM_SKIP=1
+ 	IKVM_REAL=1
+-#endif
+ INT_DEFINE_END(data_access_slb)
+ 
+ EXC_REAL_BEGIN(data_access_slb, 0x380, 0x80)
+diff --git a/arch/powerpc/kvm/book3s_xive_native.c b/arch/powerpc/kvm/book3s_xive_native.c
+index bdea91df14974..eed17b1ef7728 100644
+--- a/arch/powerpc/kvm/book3s_xive_native.c
++++ b/arch/powerpc/kvm/book3s_xive_native.c
+@@ -251,6 +251,13 @@ static vm_fault_t xive_native_esb_fault(struct vm_fault *vmf)
+ 	}
+ 
+ 	state = &sb->irq_state[src];
++
++	/* Some sanity checking */
++	if (!state->valid) {
++		pr_devel("%s: source %lx invalid !\n", __func__, irq);
++		return VM_FAULT_SIGBUS;
++	}
++
+ 	kvmppc_xive_select_irq(state, &hw_num, &xd);
+ 
+ 	arch_spin_lock(&sb->lock);
+diff --git a/arch/riscv/include/asm/pgtable-32.h b/arch/riscv/include/asm/pgtable-32.h
+index b0ab66e5fdb1d..5b2e79e5bfa5b 100644
+--- a/arch/riscv/include/asm/pgtable-32.h
++++ b/arch/riscv/include/asm/pgtable-32.h
+@@ -14,4 +14,6 @@
+ #define PGDIR_SIZE      (_AC(1, UL) << PGDIR_SHIFT)
+ #define PGDIR_MASK      (~(PGDIR_SIZE - 1))
+ 
++#define MAX_POSSIBLE_PHYSMEM_BITS 34
++
+ #endif /* _ASM_RISCV_PGTABLE_32_H */
+diff --git a/arch/riscv/include/asm/vdso/processor.h b/arch/riscv/include/asm/vdso/processor.h
+index 82a5693b18614..134388cbaaa1d 100644
+--- a/arch/riscv/include/asm/vdso/processor.h
++++ b/arch/riscv/include/asm/vdso/processor.h
+@@ -4,6 +4,8 @@
+ 
+ #ifndef __ASSEMBLY__
+ 
++#include <asm/barrier.h>
++
+ static inline void cpu_relax(void)
+ {
+ #ifdef __riscv_muldiv
+diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
+index 2c6dd329312bd..3de5234b6de5b 100644
+--- a/arch/riscv/kernel/setup.c
++++ b/arch/riscv/kernel/setup.c
+@@ -69,6 +69,7 @@ void __init setup_arch(char **cmdline_p)
+ 
+ 	*cmdline_p = boot_command_line;
+ 
++	jump_label_init();
+ 	parse_early_param();
+ 
+ 	setup_bootmem();
+diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile
+index cb8f9e4cfcbf8..0cfd6da784f84 100644
+--- a/arch/riscv/kernel/vdso/Makefile
++++ b/arch/riscv/kernel/vdso/Makefile
+@@ -44,7 +44,7 @@ SYSCFLAGS_vdso.so.dbg = $(c_flags)
+ $(obj)/vdso.so.dbg: $(src)/vdso.lds $(obj-vdso) FORCE
+ 	$(call if_changed,vdsold)
+ SYSCFLAGS_vdso.so.dbg = -shared -s -Wl,-soname=linux-vdso.so.1 \
+-	-Wl,--build-id -Wl,--hash-style=both
++	-Wl,--build-id=sha1 -Wl,--hash-style=both
+ 
+ # We also create a special relocatable object that should mirror the symbol
+ # table and layout of the linked DSO. With ld --just-symbols we can then
+diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
+index 5d8cc1864566d..62a18dee4c36d 100644
+--- a/arch/s390/kernel/asm-offsets.c
++++ b/arch/s390/kernel/asm-offsets.c
+@@ -53,11 +53,11 @@ int main(void)
+ 	/* stack_frame offsets */
+ 	OFFSET(__SF_BACKCHAIN, stack_frame, back_chain);
+ 	OFFSET(__SF_GPRS, stack_frame, gprs);
+-	OFFSET(__SF_EMPTY, stack_frame, empty1);
+-	OFFSET(__SF_SIE_CONTROL, stack_frame, empty1[0]);
+-	OFFSET(__SF_SIE_SAVEAREA, stack_frame, empty1[1]);
+-	OFFSET(__SF_SIE_REASON, stack_frame, empty1[2]);
+-	OFFSET(__SF_SIE_FLAGS, stack_frame, empty1[3]);
++	OFFSET(__SF_EMPTY, stack_frame, empty1[0]);
++	OFFSET(__SF_SIE_CONTROL, stack_frame, empty1[1]);
++	OFFSET(__SF_SIE_SAVEAREA, stack_frame, empty1[2]);
++	OFFSET(__SF_SIE_REASON, stack_frame, empty1[3]);
++	OFFSET(__SF_SIE_FLAGS, stack_frame, empty1[4]);
+ 	BLANK();
+ 	/* timeval/timezone offsets for use by vdso */
+ 	OFFSET(__VDSO_UPD_COUNT, vdso_data, tb_update_count);
+diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
+index 3349750f930ee..ca55db0823534 100644
+--- a/arch/s390/kernel/entry.S
++++ b/arch/s390/kernel/entry.S
+@@ -1072,6 +1072,7 @@ EXPORT_SYMBOL(save_fpu_regs)
+  *	%r4
+  */
+ load_fpu_regs:
++	stnsm	__SF_EMPTY(%r15),0xfc
+ 	lg	%r4,__LC_CURRENT
+ 	aghi	%r4,__TASK_thread
+ 	TSTMSK	__LC_CPU_FLAGS,_CIF_FPU
+@@ -1103,6 +1104,7 @@ load_fpu_regs:
+ .Lload_fpu_regs_done:
+ 	ni	__LC_CPU_FLAGS+7,255-_CIF_FPU
+ .Lload_fpu_regs_exit:
++	ssm	__SF_EMPTY(%r15)
+ 	BR_EX	%r14
+ .Lload_fpu_regs_end:
+ ENDPROC(load_fpu_regs)
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 6b74b92c1a586..425d3d75320bf 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -2312,7 +2312,7 @@ static int kvm_s390_handle_pv(struct kvm *kvm, struct kvm_pv_cmd *cmd)
+ 		struct kvm_s390_pv_unp unp = {};
+ 
+ 		r = -EINVAL;
+-		if (!kvm_s390_pv_is_protected(kvm))
++		if (!kvm_s390_pv_is_protected(kvm) || !mm_is_protected(kvm->mm))
+ 			break;
+ 
+ 		r = -EFAULT;
+@@ -3564,7 +3564,6 @@ static void kvm_arch_vcpu_ioctl_initial_reset(struct kvm_vcpu *vcpu)
+ 		vcpu->arch.sie_block->pp = 0;
+ 		vcpu->arch.sie_block->fpf &= ~FPF_BPBC;
+ 		vcpu->arch.sie_block->todpr = 0;
+-		vcpu->arch.sie_block->cpnc = 0;
+ 	}
+ }
+ 
+@@ -3582,7 +3581,6 @@ static void kvm_arch_vcpu_ioctl_clear_reset(struct kvm_vcpu *vcpu)
+ 
+ 	regs->etoken = 0;
+ 	regs->etoken_extension = 0;
+-	regs->diag318 = 0;
+ }
+ 
+ int kvm_arch_vcpu_ioctl_set_regs(struct kvm_vcpu *vcpu, struct kvm_regs *regs)
+diff --git a/arch/s390/kvm/pv.c b/arch/s390/kvm/pv.c
+index eb99e2f95ebed..f5847f9dec7c9 100644
+--- a/arch/s390/kvm/pv.c
++++ b/arch/s390/kvm/pv.c
+@@ -208,7 +208,6 @@ int kvm_s390_pv_init_vm(struct kvm *kvm, u16 *rc, u16 *rrc)
+ 		return -EIO;
+ 	}
+ 	kvm->arch.gmap->guest_handle = uvcb.guest_handle;
+-	atomic_set(&kvm->mm->context.is_protected, 1);
+ 	return 0;
+ }
+ 
+@@ -228,6 +227,8 @@ int kvm_s390_pv_set_sec_parms(struct kvm *kvm, void *hdr, u64 length, u16 *rc,
+ 	*rrc = uvcb.header.rrc;
+ 	KVM_UV_EVENT(kvm, 3, "PROTVIRT VM SET PARMS: rc %x rrc %x",
+ 		     *rc, *rrc);
++	if (!cc)
++		atomic_set(&kvm->mm->context.is_protected, 1);
+ 	return cc ? -EINVAL : 0;
+ }
+ 
+diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
+index 373542ca1113e..78dbba6a4500c 100644
+--- a/arch/s390/mm/gmap.c
++++ b/arch/s390/mm/gmap.c
+@@ -2690,6 +2690,8 @@ static const struct mm_walk_ops reset_acc_walk_ops = {
+ #include <linux/sched/mm.h>
+ void s390_reset_acc(struct mm_struct *mm)
+ {
++	if (!mm_is_protected(mm))
++		return;
+ 	/*
+ 	 * we might be called during
+ 	 * reset:                             we walk the pages and clear
+diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
+index 442e1ed4acd49..4eb7ee5fed72d 100644
+--- a/arch/x86/events/intel/cstate.c
++++ b/arch/x86/events/intel/cstate.c
+@@ -107,14 +107,14 @@
+ MODULE_LICENSE("GPL");
+ 
+ #define DEFINE_CSTATE_FORMAT_ATTR(_var, _name, _format)		\
+-static ssize_t __cstate_##_var##_show(struct kobject *kobj,	\
+-				struct kobj_attribute *attr,	\
++static ssize_t __cstate_##_var##_show(struct device *dev,	\
++				struct device_attribute *attr,	\
+ 				char *page)			\
+ {								\
+ 	BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE);		\
+ 	return sprintf(page, _format "\n");			\
+ }								\
+-static struct kobj_attribute format_attr_##_var =		\
++static struct device_attribute format_attr_##_var =		\
+ 	__ATTR(_name, 0444, __cstate_##_var##_show, NULL)
+ 
+ static ssize_t cstate_get_attr_cpumask(struct device *dev,
+diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
+index d5c6d3b340c50..803601baa753d 100644
+--- a/arch/x86/events/intel/uncore.c
++++ b/arch/x86/events/intel/uncore.c
+@@ -92,8 +92,8 @@ end:
+ 	return map;
+ }
+ 
+-ssize_t uncore_event_show(struct kobject *kobj,
+-			  struct kobj_attribute *attr, char *buf)
++ssize_t uncore_event_show(struct device *dev,
++			  struct device_attribute *attr, char *buf)
+ {
+ 	struct uncore_event_desc *event =
+ 		container_of(attr, struct uncore_event_desc, attr);
+diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h
+index 105fdc69825eb..c5744783e05d0 100644
+--- a/arch/x86/events/intel/uncore.h
++++ b/arch/x86/events/intel/uncore.h
+@@ -157,7 +157,7 @@ struct intel_uncore_box {
+ #define UNCORE_BOX_FLAG_CFL8_CBOX_MSR_OFFS	2
+ 
+ struct uncore_event_desc {
+-	struct kobj_attribute attr;
++	struct device_attribute attr;
+ 	const char *config;
+ };
+ 
+@@ -179,8 +179,8 @@ struct pci2phy_map {
+ struct pci2phy_map *__find_pci2phy_map(int segment);
+ int uncore_pcibus_to_physid(struct pci_bus *bus);
+ 
+-ssize_t uncore_event_show(struct kobject *kobj,
+-			  struct kobj_attribute *attr, char *buf);
++ssize_t uncore_event_show(struct device *dev,
++			  struct device_attribute *attr, char *buf);
+ 
+ static inline struct intel_uncore_pmu *dev_to_uncore_pmu(struct device *dev)
+ {
+@@ -201,14 +201,14 @@ extern int __uncore_max_dies;
+ }
+ 
+ #define DEFINE_UNCORE_FORMAT_ATTR(_var, _name, _format)			\
+-static ssize_t __uncore_##_var##_show(struct kobject *kobj,		\
+-				struct kobj_attribute *attr,		\
++static ssize_t __uncore_##_var##_show(struct device *dev,		\
++				struct device_attribute *attr,		\
+ 				char *page)				\
+ {									\
+ 	BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE);			\
+ 	return sprintf(page, _format "\n");				\
+ }									\
+-static struct kobj_attribute format_attr_##_var =			\
++static struct device_attribute format_attr_##_var =			\
+ 	__ATTR(_name, 0444, __uncore_##_var##_show, NULL)
+ 
+ static inline bool uncore_pmc_fixed(int idx)
+diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c
+index 67b411f7e8c41..abaed36212250 100644
+--- a/arch/x86/events/rapl.c
++++ b/arch/x86/events/rapl.c
+@@ -93,18 +93,6 @@ static const char *const rapl_domain_names[NR_RAPL_DOMAINS] __initconst = {
+  * any other bit is reserved
+  */
+ #define RAPL_EVENT_MASK	0xFFULL
+-
+-#define DEFINE_RAPL_FORMAT_ATTR(_var, _name, _format)		\
+-static ssize_t __rapl_##_var##_show(struct kobject *kobj,	\
+-				struct kobj_attribute *attr,	\
+-				char *page)			\
+-{								\
+-	BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE);		\
+-	return sprintf(page, _format "\n");			\
+-}								\
+-static struct kobj_attribute format_attr_##_var =		\
+-	__ATTR(_name, 0444, __rapl_##_var##_show, NULL)
+-
+ #define RAPL_CNTR_WIDTH 32
+ 
+ #define RAPL_EVENT_ATTR_STR(_name, v, str)					\
+@@ -441,7 +429,7 @@ static struct attribute_group rapl_pmu_events_group = {
+ 	.attrs = attrs_empty,
+ };
+ 
+-DEFINE_RAPL_FORMAT_ATTR(event, event, "config:0-7");
++PMU_FORMAT_ATTR(event, "config:0-7");
+ static struct attribute *rapl_formats_attr[] = {
+ 	&format_attr_event.attr,
+ 	NULL,
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 5303dbc5c9bce..7b54213551c6f 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1603,6 +1603,7 @@ int kvm_test_age_hva(struct kvm *kvm, unsigned long hva);
+ int kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
+ int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v);
+ int kvm_cpu_has_interrupt(struct kvm_vcpu *vcpu);
++int kvm_cpu_has_extint(struct kvm_vcpu *v);
+ int kvm_arch_interrupt_allowed(struct kvm_vcpu *vcpu);
+ int kvm_cpu_get_interrupt(struct kvm_vcpu *v);
+ void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event);
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 581fb7223ad0e..d41b70fe4918e 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -739,11 +739,13 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
+ 	if (boot_cpu_has(X86_FEATURE_IBPB)) {
+ 		setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
+ 
++		spectre_v2_user_ibpb = mode;
+ 		switch (cmd) {
+ 		case SPECTRE_V2_USER_CMD_FORCE:
+ 		case SPECTRE_V2_USER_CMD_PRCTL_IBPB:
+ 		case SPECTRE_V2_USER_CMD_SECCOMP_IBPB:
+ 			static_branch_enable(&switch_mm_always_ibpb);
++			spectre_v2_user_ibpb = SPECTRE_V2_USER_STRICT;
+ 			break;
+ 		case SPECTRE_V2_USER_CMD_PRCTL:
+ 		case SPECTRE_V2_USER_CMD_AUTO:
+@@ -757,8 +759,6 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
+ 		pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n",
+ 			static_key_enabled(&switch_mm_always_ibpb) ?
+ 			"always-on" : "conditional");
+-
+-		spectre_v2_user_ibpb = mode;
+ 	}
+ 
+ 	/*
+diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
+index de29c4a267c05..35a6eb03a6a02 100644
+--- a/arch/x86/kernel/cpu/mce/core.c
++++ b/arch/x86/kernel/cpu/mce/core.c
+@@ -1363,8 +1363,10 @@ noinstr void do_machine_check(struct pt_regs *regs)
+ 	 * When there's any problem use only local no_way_out state.
+ 	 */
+ 	if (!lmce) {
+-		if (mce_end(order) < 0)
+-			no_way_out = worst >= MCE_PANIC_SEVERITY;
++		if (mce_end(order) < 0) {
++			if (!no_way_out)
++				no_way_out = worst >= MCE_PANIC_SEVERITY;
++		}
+ 	} else {
+ 		/*
+ 		 * If there was a fatal machine check we should have
+diff --git a/arch/x86/kernel/cpu/resctrl/rdtgroup.c b/arch/x86/kernel/cpu/resctrl/rdtgroup.c
+index 3f844f14fc0a6..799b60c9f8927 100644
+--- a/arch/x86/kernel/cpu/resctrl/rdtgroup.c
++++ b/arch/x86/kernel/cpu/resctrl/rdtgroup.c
+@@ -507,6 +507,24 @@ unlock:
+ 	return ret ?: nbytes;
+ }
+ 
++/**
++ * rdtgroup_remove - the helper to remove resource group safely
++ * @rdtgrp: resource group to remove
++ *
++ * On resource group creation via a mkdir, an extra kernfs_node reference is
++ * taken to ensure that the rdtgroup structure remains accessible for the
++ * rdtgroup_kn_unlock() calls where it is removed.
++ *
++ * Drop the extra reference here, then free the rdtgroup structure.
++ *
++ * Return: void
++ */
++static void rdtgroup_remove(struct rdtgroup *rdtgrp)
++{
++	kernfs_put(rdtgrp->kn);
++	kfree(rdtgrp);
++}
++
+ struct task_move_callback {
+ 	struct callback_head	work;
+ 	struct rdtgroup		*rdtgrp;
+@@ -529,7 +547,7 @@ static void move_myself(struct callback_head *head)
+ 	    (rdtgrp->flags & RDT_DELETED)) {
+ 		current->closid = 0;
+ 		current->rmid = 0;
+-		kfree(rdtgrp);
++		rdtgroup_remove(rdtgrp);
+ 	}
+ 
+ 	if (unlikely(current->flags & PF_EXITING))
+@@ -1708,7 +1726,6 @@ static int rdtgroup_mkdir_info_resdir(struct rdt_resource *r, char *name,
+ 	if (IS_ERR(kn_subdir))
+ 		return PTR_ERR(kn_subdir);
+ 
+-	kernfs_get(kn_subdir);
+ 	ret = rdtgroup_kn_set_ugid(kn_subdir);
+ 	if (ret)
+ 		return ret;
+@@ -1731,7 +1748,6 @@ static int rdtgroup_create_info_dir(struct kernfs_node *parent_kn)
+ 	kn_info = kernfs_create_dir(parent_kn, "info", parent_kn->mode, NULL);
+ 	if (IS_ERR(kn_info))
+ 		return PTR_ERR(kn_info);
+-	kernfs_get(kn_info);
+ 
+ 	ret = rdtgroup_add_files(kn_info, RF_TOP_INFO);
+ 	if (ret)
+@@ -1752,12 +1768,6 @@ static int rdtgroup_create_info_dir(struct kernfs_node *parent_kn)
+ 			goto out_destroy;
+ 	}
+ 
+-	/*
+-	 * This extra ref will be put in kernfs_remove() and guarantees
+-	 * that @rdtgrp->kn is always accessible.
+-	 */
+-	kernfs_get(kn_info);
+-
+ 	ret = rdtgroup_kn_set_ugid(kn_info);
+ 	if (ret)
+ 		goto out_destroy;
+@@ -1786,12 +1796,6 @@ mongroup_create_dir(struct kernfs_node *parent_kn, struct rdtgroup *prgrp,
+ 	if (dest_kn)
+ 		*dest_kn = kn;
+ 
+-	/*
+-	 * This extra ref will be put in kernfs_remove() and guarantees
+-	 * that @rdtgrp->kn is always accessible.
+-	 */
+-	kernfs_get(kn);
+-
+ 	ret = rdtgroup_kn_set_ugid(kn);
+ 	if (ret)
+ 		goto out_destroy;
+@@ -2018,8 +2022,7 @@ void rdtgroup_kn_unlock(struct kernfs_node *kn)
+ 		    rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED)
+ 			rdtgroup_pseudo_lock_remove(rdtgrp);
+ 		kernfs_unbreak_active_protection(kn);
+-		kernfs_put(rdtgrp->kn);
+-		kfree(rdtgrp);
++		rdtgroup_remove(rdtgrp);
+ 	} else {
+ 		kernfs_unbreak_active_protection(kn);
+ 	}
+@@ -2078,13 +2081,11 @@ static int rdt_get_tree(struct fs_context *fc)
+ 					  &kn_mongrp);
+ 		if (ret < 0)
+ 			goto out_info;
+-		kernfs_get(kn_mongrp);
+ 
+ 		ret = mkdir_mondata_all(rdtgroup_default.kn,
+ 					&rdtgroup_default, &kn_mondata);
+ 		if (ret < 0)
+ 			goto out_mongrp;
+-		kernfs_get(kn_mondata);
+ 		rdtgroup_default.mon.mon_data_kn = kn_mondata;
+ 	}
+ 
+@@ -2308,7 +2309,7 @@ static void free_all_child_rdtgrp(struct rdtgroup *rdtgrp)
+ 		if (atomic_read(&sentry->waitcount) != 0)
+ 			sentry->flags = RDT_DELETED;
+ 		else
+-			kfree(sentry);
++			rdtgroup_remove(sentry);
+ 	}
+ }
+ 
+@@ -2350,7 +2351,7 @@ static void rmdir_all_sub(void)
+ 		if (atomic_read(&rdtgrp->waitcount) != 0)
+ 			rdtgrp->flags = RDT_DELETED;
+ 		else
+-			kfree(rdtgrp);
++			rdtgroup_remove(rdtgrp);
+ 	}
+ 	/* Notify online CPUs to update per cpu storage and PQR_ASSOC MSR */
+ 	update_closid_rmid(cpu_online_mask, &rdtgroup_default);
+@@ -2450,11 +2451,6 @@ static int mkdir_mondata_subdir(struct kernfs_node *parent_kn,
+ 	if (IS_ERR(kn))
+ 		return PTR_ERR(kn);
+ 
+-	/*
+-	 * This extra ref will be put in kernfs_remove() and guarantees
+-	 * that kn is always accessible.
+-	 */
+-	kernfs_get(kn);
+ 	ret = rdtgroup_kn_set_ugid(kn);
+ 	if (ret)
+ 		goto out_destroy;
+@@ -2789,8 +2785,8 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
+ 	/*
+ 	 * kernfs_remove() will drop the reference count on "kn" which
+ 	 * will free it. But we still need it to stick around for the
+-	 * rdtgroup_kn_unlock(kn} call below. Take one extra reference
+-	 * here, which will be dropped inside rdtgroup_kn_unlock().
++	 * rdtgroup_kn_unlock(kn) call. Take one extra reference here,
++	 * which will be dropped by kernfs_put() in rdtgroup_remove().
+ 	 */
+ 	kernfs_get(kn);
+ 
+@@ -2831,6 +2827,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
+ out_idfree:
+ 	free_rmid(rdtgrp->mon.rmid);
+ out_destroy:
++	kernfs_put(rdtgrp->kn);
+ 	kernfs_remove(rdtgrp->kn);
+ out_free_rgrp:
+ 	kfree(rdtgrp);
+@@ -2843,7 +2840,7 @@ static void mkdir_rdt_prepare_clean(struct rdtgroup *rgrp)
+ {
+ 	kernfs_remove(rgrp->kn);
+ 	free_rmid(rgrp->mon.rmid);
+-	kfree(rgrp);
++	rdtgroup_remove(rgrp);
+ }
+ 
+ /*
+@@ -3000,11 +2997,6 @@ static int rdtgroup_rmdir_mon(struct kernfs_node *kn, struct rdtgroup *rdtgrp,
+ 	WARN_ON(list_empty(&prdtgrp->mon.crdtgrp_list));
+ 	list_del(&rdtgrp->mon.crdtgrp_list);
+ 
+-	/*
+-	 * one extra hold on this, will drop when we kfree(rdtgrp)
+-	 * in rdtgroup_kn_unlock()
+-	 */
+-	kernfs_get(kn);
+ 	kernfs_remove(rdtgrp->kn);
+ 
+ 	return 0;
+@@ -3016,11 +3008,6 @@ static int rdtgroup_ctrl_remove(struct kernfs_node *kn,
+ 	rdtgrp->flags = RDT_DELETED;
+ 	list_del(&rdtgrp->rdtgroup_list);
+ 
+-	/*
+-	 * one extra hold on this, will drop when we kfree(rdtgrp)
+-	 * in rdtgroup_kn_unlock()
+-	 */
+-	kernfs_get(kn);
+ 	kernfs_remove(rdtgrp->kn);
+ 	return 0;
+ }
+diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
+index ea8d51ec251bb..4da8345d34bb0 100644
+--- a/arch/x86/kernel/dumpstack.c
++++ b/arch/x86/kernel/dumpstack.c
+@@ -77,6 +77,9 @@ static int copy_code(struct pt_regs *regs, u8 *buf, unsigned long src,
+ 	if (!user_mode(regs))
+ 		return copy_from_kernel_nofault(buf, (u8 *)src, nbytes);
+ 
++	/* The user space code from other tasks cannot be accessed. */
++	if (regs != task_pt_regs(current))
++		return -EPERM;
+ 	/*
+ 	 * Make sure userspace isn't trying to trick us into dumping kernel
+ 	 * memory by pointing the userspace instruction pointer at it.
+@@ -84,6 +87,12 @@ static int copy_code(struct pt_regs *regs, u8 *buf, unsigned long src,
+ 	if (__chk_range_not_ok(src, nbytes, TASK_SIZE_MAX))
+ 		return -EINVAL;
+ 
++	/*
++	 * Even if named copy_from_user_nmi() this can be invoked from
++	 * other contexts and will not try to resolve a pagefault, which is
++	 * the correct thing to do here as this code can be called from any
++	 * context.
++	 */
+ 	return copy_from_user_nmi(buf, (void __user *)src, nbytes);
+ }
+ 
+@@ -114,13 +123,19 @@ void show_opcodes(struct pt_regs *regs, const char *loglvl)
+ 	u8 opcodes[OPCODE_BUFSIZE];
+ 	unsigned long prologue = regs->ip - PROLOGUE_SIZE;
+ 
+-	if (copy_code(regs, opcodes, prologue, sizeof(opcodes))) {
+-		printk("%sCode: Unable to access opcode bytes at RIP 0x%lx.\n",
+-		       loglvl, prologue);
+-	} else {
++	switch (copy_code(regs, opcodes, prologue, sizeof(opcodes))) {
++	case 0:
+ 		printk("%sCode: %" __stringify(PROLOGUE_SIZE) "ph <%02x> %"
+ 		       __stringify(EPILOGUE_SIZE) "ph\n", loglvl, opcodes,
+ 		       opcodes[PROLOGUE_SIZE], opcodes + PROLOGUE_SIZE + 1);
++		break;
++	case -EPERM:
++		/* No access to the user space stack of other tasks. Ignore. */
++		break;
++	default:
++		printk("%sCode: Unable to access opcode bytes at RIP 0x%lx.\n",
++		       loglvl, prologue);
++		break;
+ 	}
+ }
+ 
+diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
+index 420be871d9d45..ae64f98ec2ab6 100644
+--- a/arch/x86/kernel/tboot.c
++++ b/arch/x86/kernel/tboot.c
+@@ -514,13 +514,10 @@ int tboot_force_iommu(void)
+ 	if (!tboot_enabled())
+ 		return 0;
+ 
+-	if (no_iommu || swiotlb || dmar_disabled)
++	if (no_iommu || dmar_disabled)
+ 		pr_warn("Forcing Intel-IOMMU to enabled\n");
+ 
+ 	dmar_disabled = 0;
+-#ifdef CONFIG_SWIOTLB
+-	swiotlb = 0;
+-#endif
+ 	no_iommu = 0;
+ 
+ 	return 1;
+diff --git a/arch/x86/kvm/irq.c b/arch/x86/kvm/irq.c
+index 99d118ffc67db..814698e5b1526 100644
+--- a/arch/x86/kvm/irq.c
++++ b/arch/x86/kvm/irq.c
+@@ -40,29 +40,10 @@ static int pending_userspace_extint(struct kvm_vcpu *v)
+  * check if there is pending interrupt from
+  * non-APIC source without intack.
+  */
+-static int kvm_cpu_has_extint(struct kvm_vcpu *v)
+-{
+-	u8 accept = kvm_apic_accept_pic_intr(v);
+-
+-	if (accept) {
+-		if (irqchip_split(v->kvm))
+-			return pending_userspace_extint(v);
+-		else
+-			return v->kvm->arch.vpic->output;
+-	} else
+-		return 0;
+-}
+-
+-/*
+- * check if there is injectable interrupt:
+- * when virtual interrupt delivery enabled,
+- * interrupt from apic will handled by hardware,
+- * we don't need to check it here.
+- */
+-int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v)
++int kvm_cpu_has_extint(struct kvm_vcpu *v)
+ {
+ 	/*
+-	 * FIXME: interrupt.injected represents an interrupt that it's
++	 * FIXME: interrupt.injected represents an interrupt whose
+ 	 * side-effects have already been applied (e.g. bit from IRR
+ 	 * already moved to ISR). Therefore, it is incorrect to rely
+ 	 * on interrupt.injected to know if there is a pending
+@@ -75,6 +56,23 @@ int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v)
+ 	if (!lapic_in_kernel(v))
+ 		return v->arch.interrupt.injected;
+ 
++	if (!kvm_apic_accept_pic_intr(v))
++		return 0;
++
++	if (irqchip_split(v->kvm))
++		return pending_userspace_extint(v);
++	else
++		return v->kvm->arch.vpic->output;
++}
++
++/*
++ * check if there is injectable interrupt:
++ * when virtual interrupt delivery enabled,
++ * interrupt from apic will handled by hardware,
++ * we don't need to check it here.
++ */
++int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v)
++{
+ 	if (kvm_cpu_has_extint(v))
+ 		return 1;
+ 
+@@ -91,20 +89,6 @@ EXPORT_SYMBOL_GPL(kvm_cpu_has_injectable_intr);
+  */
+ int kvm_cpu_has_interrupt(struct kvm_vcpu *v)
+ {
+-	/*
+-	 * FIXME: interrupt.injected represents an interrupt that it's
+-	 * side-effects have already been applied (e.g. bit from IRR
+-	 * already moved to ISR). Therefore, it is incorrect to rely
+-	 * on interrupt.injected to know if there is a pending
+-	 * interrupt in the user-mode LAPIC.
+-	 * This leads to nVMX/nSVM not be able to distinguish
+-	 * if it should exit from L2 to L1 on EXTERNAL_INTERRUPT on
+-	 * pending interrupt or should re-inject an injected
+-	 * interrupt.
+-	 */
+-	if (!lapic_in_kernel(v))
+-		return v->arch.interrupt.injected;
+-
+ 	if (kvm_cpu_has_extint(v))
+ 		return 1;
+ 
+@@ -118,16 +102,21 @@ EXPORT_SYMBOL_GPL(kvm_cpu_has_interrupt);
+  */
+ static int kvm_cpu_get_extint(struct kvm_vcpu *v)
+ {
+-	if (kvm_cpu_has_extint(v)) {
+-		if (irqchip_split(v->kvm)) {
+-			int vector = v->arch.pending_external_vector;
+-
+-			v->arch.pending_external_vector = -1;
+-			return vector;
+-		} else
+-			return kvm_pic_read_irq(v->kvm); /* PIC */
+-	} else
++	if (!kvm_cpu_has_extint(v)) {
++		WARN_ON(!lapic_in_kernel(v));
+ 		return -1;
++	}
++
++	if (!lapic_in_kernel(v))
++		return v->arch.interrupt.nr;
++
++	if (irqchip_split(v->kvm)) {
++		int vector = v->arch.pending_external_vector;
++
++		v->arch.pending_external_vector = -1;
++		return vector;
++	} else
++		return kvm_pic_read_irq(v->kvm); /* PIC */
+ }
+ 
+ /*
+@@ -135,13 +124,7 @@ static int kvm_cpu_get_extint(struct kvm_vcpu *v)
+  */
+ int kvm_cpu_get_interrupt(struct kvm_vcpu *v)
+ {
+-	int vector;
+-
+-	if (!lapic_in_kernel(v))
+-		return v->arch.interrupt.nr;
+-
+-	vector = kvm_cpu_get_extint(v);
+-
++	int vector = kvm_cpu_get_extint(v);
+ 	if (vector != -1)
+ 		return vector;			/* PIC */
+ 
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 8055a486d843d..1fc1a8e8cce02 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -2461,7 +2461,7 @@ int kvm_apic_has_interrupt(struct kvm_vcpu *vcpu)
+ 	struct kvm_lapic *apic = vcpu->arch.apic;
+ 	u32 ppr;
+ 
+-	if (!kvm_apic_hw_enabled(apic))
++	if (!kvm_apic_present(vcpu))
+ 		return -1;
+ 
+ 	__apic_update_ppr(apic, &ppr);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index bacfc9e94a62b..6e5ed3dc4f298 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3839,21 +3839,23 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
+ 
+ static int kvm_cpu_accept_dm_intr(struct kvm_vcpu *vcpu)
+ {
++	/*
++	 * We can accept userspace's request for interrupt injection
++	 * as long as we have a place to store the interrupt number.
++	 * The actual injection will happen when the CPU is able to
++	 * deliver the interrupt.
++	 */
++	if (kvm_cpu_has_extint(vcpu))
++		return false;
++
++	/* Acknowledging ExtINT does not happen if LINT0 is masked.  */
+ 	return (!lapic_in_kernel(vcpu) ||
+ 		kvm_apic_accept_pic_intr(vcpu));
+ }
+ 
+-/*
+- * if userspace requested an interrupt window, check that the
+- * interrupt window is open.
+- *
+- * No need to exit to userspace if we already have an interrupt queued.
+- */
+ static int kvm_vcpu_ready_for_interrupt_injection(struct kvm_vcpu *vcpu)
+ {
+ 	return kvm_arch_interrupt_allowed(vcpu) &&
+-		!kvm_cpu_has_interrupt(vcpu) &&
+-		!kvm_event_needs_reinjection(vcpu) &&
+ 		kvm_cpu_accept_dm_intr(vcpu);
+ }
+ 
+diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
+index 799f4eba0a621..043c73dfd2c98 100644
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -93,10 +93,20 @@ void xen_init_lock_cpu(int cpu)
+ 
+ void xen_uninit_lock_cpu(int cpu)
+ {
++	int irq;
++
+ 	if (!xen_pvspin)
+ 		return;
+ 
+-	unbind_from_irqhandler(per_cpu(lock_kicker_irq, cpu), NULL);
++	/*
++	 * When booting the kernel with 'mitigations=auto,nosmt', the secondary
++	 * CPUs are not activated, and lock_kicker_irq is not initialized.
++	 */
++	irq = per_cpu(lock_kicker_irq, cpu);
++	if (irq == -1)
++		return;
++
++	unbind_from_irqhandler(irq, NULL);
+ 	per_cpu(lock_kicker_irq, cpu) = -1;
+ 	kfree(per_cpu(irq_name, cpu));
+ 	per_cpu(irq_name, cpu) = NULL;
+diff --git a/arch/xtensa/include/asm/uaccess.h b/arch/xtensa/include/asm/uaccess.h
+index b9758119feca1..5c9fb8005aa89 100644
+--- a/arch/xtensa/include/asm/uaccess.h
++++ b/arch/xtensa/include/asm/uaccess.h
+@@ -302,7 +302,7 @@ strncpy_from_user(char *dst, const char __user *src, long count)
+ 	return -EFAULT;
+ }
+ #else
+-long strncpy_from_user(char *dst, const char *src, long count);
++long strncpy_from_user(char *dst, const char __user *src, long count);
+ #endif
+ 
+ /*
+diff --git a/block/keyslot-manager.c b/block/keyslot-manager.c
+index 35abcb1ec051d..86f8195d8039e 100644
+--- a/block/keyslot-manager.c
++++ b/block/keyslot-manager.c
+@@ -103,6 +103,13 @@ int blk_ksm_init(struct blk_keyslot_manager *ksm, unsigned int num_slots)
+ 	spin_lock_init(&ksm->idle_slots_lock);
+ 
+ 	slot_hashtable_size = roundup_pow_of_two(num_slots);
++	/*
++	 * hash_ptr() assumes bits != 0, so ensure the hash table has at least 2
++	 * buckets.  This only makes a difference when there is only 1 keyslot.
++	 */
++	if (slot_hashtable_size < 2)
++		slot_hashtable_size = 2;
++
+ 	ksm->log_slot_ht_size = ilog2(slot_hashtable_size);
+ 	ksm->slot_hashtable = kvmalloc_array(slot_hashtable_size,
+ 					     sizeof(ksm->slot_hashtable[0]),
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index efb088df12766..92ecf1a78ec73 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -227,6 +227,9 @@ static int sysc_wait_softreset(struct sysc *ddata)
+ 	u32 sysc_mask, syss_done, rstval;
+ 	int syss_offset, error = 0;
+ 
++	if (ddata->cap->regbits->srst_shift < 0)
++		return 0;
++
+ 	syss_offset = ddata->offsets[SYSC_SYSSTATUS];
+ 	sysc_mask = BIT(ddata->cap->regbits->srst_shift);
+ 
+@@ -970,9 +973,15 @@ static int sysc_enable_module(struct device *dev)
+ 			return error;
+ 		}
+ 	}
+-	error = sysc_wait_softreset(ddata);
+-	if (error)
+-		dev_warn(ddata->dev, "OCP softreset timed out\n");
++	/*
++	 * Some modules like i2c and hdq1w have unusable reset status unless
++	 * the module reset quirk is enabled. Skip status check on enable.
++	 */
++	if (!(ddata->cfg.quirks & SYSC_MODULE_QUIRK_ENA_RESETDONE)) {
++		error = sysc_wait_softreset(ddata);
++		if (error)
++			dev_warn(ddata->dev, "OCP softreset timed out\n");
++	}
+ 	if (ddata->cfg.quirks & SYSC_QUIRK_OPT_CLKS_IN_RESET)
+ 		sysc_disable_opt_clocks(ddata);
+ 
+@@ -1373,17 +1382,17 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = {
+ 	SYSC_QUIRK("hdmi", 0, 0, 0x10, -ENODEV, 0x50030200, 0xffffffff,
+ 		   SYSC_QUIRK_OPT_CLKS_NEEDED),
+ 	SYSC_QUIRK("hdq1w", 0, 0, 0x14, 0x18, 0x00000006, 0xffffffff,
+-		   SYSC_MODULE_QUIRK_HDQ1W),
++		   SYSC_MODULE_QUIRK_HDQ1W | SYSC_MODULE_QUIRK_ENA_RESETDONE),
+ 	SYSC_QUIRK("hdq1w", 0, 0, 0x14, 0x18, 0x0000000a, 0xffffffff,
+-		   SYSC_MODULE_QUIRK_HDQ1W),
++		   SYSC_MODULE_QUIRK_HDQ1W | SYSC_MODULE_QUIRK_ENA_RESETDONE),
+ 	SYSC_QUIRK("i2c", 0, 0, 0x20, 0x10, 0x00000036, 0x000000ff,
+-		   SYSC_MODULE_QUIRK_I2C),
++		   SYSC_MODULE_QUIRK_I2C | SYSC_MODULE_QUIRK_ENA_RESETDONE),
+ 	SYSC_QUIRK("i2c", 0, 0, 0x20, 0x10, 0x0000003c, 0x000000ff,
+-		   SYSC_MODULE_QUIRK_I2C),
++		   SYSC_MODULE_QUIRK_I2C | SYSC_MODULE_QUIRK_ENA_RESETDONE),
+ 	SYSC_QUIRK("i2c", 0, 0, 0x20, 0x10, 0x00000040, 0x000000ff,
+-		   SYSC_MODULE_QUIRK_I2C),
++		   SYSC_MODULE_QUIRK_I2C | SYSC_MODULE_QUIRK_ENA_RESETDONE),
+ 	SYSC_QUIRK("i2c", 0, 0, 0x10, 0x90, 0x5040000a, 0xfffff0f0,
+-		   SYSC_MODULE_QUIRK_I2C),
++		   SYSC_MODULE_QUIRK_I2C | SYSC_MODULE_QUIRK_ENA_RESETDONE),
+ 	SYSC_QUIRK("gpu", 0x50000000, 0x14, -ENODEV, -ENODEV, 0x00010201, 0xffffffff, 0),
+ 	SYSC_QUIRK("gpu", 0x50000000, 0xfe00, 0xfe10, -ENODEV, 0x40000000 , 0xffffffff,
+ 		   SYSC_MODULE_QUIRK_SGX),
+@@ -2880,7 +2889,7 @@ static int sysc_check_active_timer(struct sysc *ddata)
+ 
+ 	if ((ddata->cfg.quirks & SYSC_QUIRK_NO_RESET_ON_INIT) &&
+ 	    (ddata->cfg.quirks & SYSC_QUIRK_NO_IDLE))
+-		return -EBUSY;
++		return -ENXIO;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/cpuidle/cpuidle-tegra.c b/drivers/cpuidle/cpuidle-tegra.c
+index e8956706a2917..191966dc8d023 100644
+--- a/drivers/cpuidle/cpuidle-tegra.c
++++ b/drivers/cpuidle/cpuidle-tegra.c
+@@ -189,7 +189,7 @@ static int tegra_cpuidle_state_enter(struct cpuidle_device *dev,
+ 	}
+ 
+ 	local_fiq_disable();
+-	tegra_pm_set_cpu_in_lp2();
++	RCU_NONIDLE(tegra_pm_set_cpu_in_lp2());
+ 	cpu_pm_enter();
+ 
+ 	switch (index) {
+@@ -207,7 +207,7 @@ static int tegra_cpuidle_state_enter(struct cpuidle_device *dev,
+ 	}
+ 
+ 	cpu_pm_exit();
+-	tegra_pm_clear_cpu_in_lp2();
++	RCU_NONIDLE(tegra_pm_clear_cpu_in_lp2());
+ 	local_fiq_enable();
+ 
+ 	return err ?: index;
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index 5274a0704d960..2c3c47e4f7770 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2802,7 +2802,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
+ 	 * If burst size is smaller than bus width then make sure we only
+ 	 * transfer one at a time to avoid a burst stradling an MFIFO entry.
+ 	 */
+-	if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width)
++	if (burst * 8 < pl330->pcfg.data_bus_width)
+ 		desc->rqcfg.brst_len = 1;
+ 
+ 	desc->bytes_requested = len;
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index 0fc432567b857..993297d585c01 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -517,8 +517,8 @@ struct xilinx_dma_device {
+ #define to_dma_tx_descriptor(tx) \
+ 	container_of(tx, struct xilinx_dma_tx_descriptor, async_tx)
+ #define xilinx_dma_poll_timeout(chan, reg, val, cond, delay_us, timeout_us) \
+-	readl_poll_timeout(chan->xdev->regs + chan->ctrl_offset + reg, val, \
+-			   cond, delay_us, timeout_us)
++	readl_poll_timeout_atomic(chan->xdev->regs + chan->ctrl_offset + reg, \
++				  val, cond, delay_us, timeout_us)
+ 
+ /* IO accessors */
+ static inline u32 dma_read(struct xilinx_dma_chan *chan, u32 reg)
+diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig
+index 3939699e62fe0..929d6f05b6bb1 100644
+--- a/drivers/firmware/efi/Kconfig
++++ b/drivers/firmware/efi/Kconfig
+@@ -275,7 +275,7 @@ config EFI_DEV_PATH_PARSER
+ 
+ config EFI_EARLYCON
+ 	def_bool y
+-	depends on SERIAL_EARLYCON && !ARM && !IA64
++	depends on EFI && SERIAL_EARLYCON && !ARM && !IA64
+ 	select FONT_SUPPORT
+ 	select ARCH_USE_MEMREMAP_PROT
+ 
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index 3aa07c3b51369..8ead4379e6e85 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -387,10 +387,10 @@ static int __init efisubsys_init(void)
+ 
+ 	if (efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE |
+ 				      EFI_RT_SUPPORTED_GET_NEXT_VARIABLE_NAME)) {
+-		efivar_ssdt_load();
+ 		error = generic_ops_register();
+ 		if (error)
+ 			goto err_put;
++		efivar_ssdt_load();
+ 		platform_device_register_simple("efivars", 0, NULL, 0);
+ 	}
+ 
+diff --git a/drivers/firmware/xilinx/zynqmp.c b/drivers/firmware/xilinx/zynqmp.c
+index efb8a66efc684..d08ac824c993c 100644
+--- a/drivers/firmware/xilinx/zynqmp.c
++++ b/drivers/firmware/xilinx/zynqmp.c
+@@ -20,12 +20,28 @@
+ #include <linux/of_platform.h>
+ #include <linux/slab.h>
+ #include <linux/uaccess.h>
++#include <linux/hashtable.h>
+ 
+ #include <linux/firmware/xlnx-zynqmp.h>
+ #include "zynqmp-debug.h"
+ 
++/* Max HashMap Order for PM API feature check (1<<7 = 128) */
++#define PM_API_FEATURE_CHECK_MAX_ORDER  7
++
+ static bool feature_check_enabled;
+-static u32 zynqmp_pm_features[PM_API_MAX];
++DEFINE_HASHTABLE(pm_api_features_map, PM_API_FEATURE_CHECK_MAX_ORDER);
++
++/**
++ * struct pm_api_feature_data - PM API Feature data
++ * @pm_api_id:		PM API Id, used as key to index into hashmap
++ * @feature_status:	status of PM API feature: valid, invalid
++ * @hentry:		hlist_node that hooks this entry into hashtable
++ */
++struct pm_api_feature_data {
++	u32 pm_api_id;
++	int feature_status;
++	struct hlist_node hentry;
++};
+ 
+ static const struct mfd_cell firmware_devs[] = {
+ 	{
+@@ -142,29 +158,37 @@ static int zynqmp_pm_feature(u32 api_id)
+ 	int ret;
+ 	u32 ret_payload[PAYLOAD_ARG_CNT];
+ 	u64 smc_arg[2];
++	struct pm_api_feature_data *feature_data;
+ 
+ 	if (!feature_check_enabled)
+ 		return 0;
+ 
+-	/* Return value if feature is already checked */
+-	if (api_id > ARRAY_SIZE(zynqmp_pm_features))
+-		return PM_FEATURE_INVALID;
++	/* Check for existing entry in hash table for given api */
++	hash_for_each_possible(pm_api_features_map, feature_data, hentry,
++			       api_id) {
++		if (feature_data->pm_api_id == api_id)
++			return feature_data->feature_status;
++	}
+ 
+-	if (zynqmp_pm_features[api_id] != PM_FEATURE_UNCHECKED)
+-		return zynqmp_pm_features[api_id];
++	/* Add new entry if not present */
++	feature_data = kmalloc(sizeof(*feature_data), GFP_KERNEL);
++	if (!feature_data)
++		return -ENOMEM;
+ 
++	feature_data->pm_api_id = api_id;
+ 	smc_arg[0] = PM_SIP_SVC | PM_FEATURE_CHECK;
+ 	smc_arg[1] = api_id;
+ 
+ 	ret = do_fw_call(smc_arg[0], smc_arg[1], 0, ret_payload);
+-	if (ret) {
+-		zynqmp_pm_features[api_id] = PM_FEATURE_INVALID;
+-		return PM_FEATURE_INVALID;
+-	}
++	if (ret)
++		ret = -EOPNOTSUPP;
++	else
++		ret = ret_payload[1];
+ 
+-	zynqmp_pm_features[api_id] = ret_payload[1];
++	feature_data->feature_status = ret;
++	hash_add(pm_api_features_map, &feature_data->hentry, api_id);
+ 
+-	return zynqmp_pm_features[api_id];
++	return ret;
+ }
+ 
+ /**
+@@ -200,9 +224,12 @@ int zynqmp_pm_invoke_fn(u32 pm_api_id, u32 arg0, u32 arg1,
+ 	 * Make sure to stay in x0 register
+ 	 */
+ 	u64 smc_arg[4];
++	int ret;
+ 
+-	if (zynqmp_pm_feature(pm_api_id) == PM_FEATURE_INVALID)
+-		return -ENOTSUPP;
++	/* Check if feature is supported or not */
++	ret = zynqmp_pm_feature(pm_api_id);
++	if (ret < 0)
++		return ret;
+ 
+ 	smc_arg[0] = PM_SIP_SVC | pm_api_id;
+ 	smc_arg[1] = ((u64)arg1 << 32) | arg0;
+@@ -615,7 +642,7 @@ EXPORT_SYMBOL_GPL(zynqmp_pm_set_sd_tapdelay);
+  */
+ int zynqmp_pm_sd_dll_reset(u32 node_id, u32 type)
+ {
+-	return zynqmp_pm_invoke_fn(PM_IOCTL, node_id, IOCTL_SET_SD_TAPDELAY,
++	return zynqmp_pm_invoke_fn(PM_IOCTL, node_id, IOCTL_SD_DLL_RESET,
+ 				   type, 0, NULL);
+ }
+ EXPORT_SYMBOL_GPL(zynqmp_pm_sd_dll_reset);
+@@ -1252,9 +1279,17 @@ static int zynqmp_firmware_probe(struct platform_device *pdev)
+ 
+ static int zynqmp_firmware_remove(struct platform_device *pdev)
+ {
++	struct pm_api_feature_data *feature_data;
++	int i;
++
+ 	mfd_remove_devices(&pdev->dev);
+ 	zynqmp_pm_api_debugfs_exit();
+ 
++	hash_for_each(pm_api_features_map, i, feature_data, hentry) {
++		hash_del(&feature_data->hentry);
++		kfree(feature_data);
++	}
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index b4a8da8fc8fd7..1595b124c1457 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -4593,7 +4593,7 @@ int amdgpu_device_baco_enter(struct drm_device *dev)
+ 	if (!amdgpu_device_supports_baco(adev->ddev))
+ 		return -ENOTSUPP;
+ 
+-	if (ras && ras->supported)
++	if (ras && ras->supported && adev->nbio.funcs->enable_doorbell_interrupt)
+ 		adev->nbio.funcs->enable_doorbell_interrupt(adev, false);
+ 
+ 	return amdgpu_dpm_baco_enter(adev);
+@@ -4612,7 +4612,7 @@ int amdgpu_device_baco_exit(struct drm_device *dev)
+ 	if (ret)
+ 		return ret;
+ 
+-	if (ras && ras->supported)
++	if (ras && ras->supported && adev->nbio.funcs->enable_doorbell_interrupt)
+ 		adev->nbio.funcs->enable_doorbell_interrupt(adev, true);
+ 
+ 	return 0;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index 7c787ec598f18..d5e95e4ea5bd2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -1571,6 +1571,12 @@ static int psp_get_fw_type(struct amdgpu_firmware_info *ucode,
+ 	case AMDGPU_UCODE_ID_RLC_RESTORE_LIST_SRM_MEM:
+ 		*type = GFX_FW_TYPE_RLC_RESTORE_LIST_SRM_MEM;
+ 		break;
++	case AMDGPU_UCODE_ID_RLC_IRAM:
++		*type = GFX_FW_TYPE_RLC_IRAM;
++		break;
++	case AMDGPU_UCODE_ID_RLC_DRAM:
++		*type = GFX_FW_TYPE_RLC_DRAM_BOOT;
++		break;
+ 	case AMDGPU_UCODE_ID_SMC:
+ 		*type = GFX_FW_TYPE_SMU;
+ 		break;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_rlc.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_rlc.h
+index 60bb3e8b31188..aeaaae713c59d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_rlc.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_rlc.h
+@@ -168,12 +168,16 @@ struct amdgpu_rlc {
+ 	u32 save_restore_list_cntl_size_bytes;
+ 	u32 save_restore_list_gpm_size_bytes;
+ 	u32 save_restore_list_srm_size_bytes;
++	u32 rlc_iram_ucode_size_bytes;
++	u32 rlc_dram_ucode_size_bytes;
+ 
+ 	u32 *register_list_format;
+ 	u32 *register_restore;
+ 	u8 *save_restore_list_cntl;
+ 	u8 *save_restore_list_gpm;
+ 	u8 *save_restore_list_srm;
++	u8 *rlc_iram_ucode;
++	u8 *rlc_dram_ucode;
+ 
+ 	bool is_rlc_v2_1;
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
+index 183743c5fb7bf..c3cc2e8b24064 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
+@@ -500,6 +500,8 @@ static int amdgpu_ucode_init_single_fw(struct amdgpu_device *adev,
+ 	     ucode->ucode_id != AMDGPU_UCODE_ID_RLC_RESTORE_LIST_CNTL &&
+ 	     ucode->ucode_id != AMDGPU_UCODE_ID_RLC_RESTORE_LIST_GPM_MEM &&
+ 	     ucode->ucode_id != AMDGPU_UCODE_ID_RLC_RESTORE_LIST_SRM_MEM &&
++	     ucode->ucode_id != AMDGPU_UCODE_ID_RLC_IRAM &&
++	     ucode->ucode_id != AMDGPU_UCODE_ID_RLC_DRAM &&
+ 		 ucode->ucode_id != AMDGPU_UCODE_ID_DMCU_ERAM &&
+ 		 ucode->ucode_id != AMDGPU_UCODE_ID_DMCU_INTV &&
+ 		 ucode->ucode_id != AMDGPU_UCODE_ID_DMCUB)) {
+@@ -556,6 +558,14 @@ static int amdgpu_ucode_init_single_fw(struct amdgpu_device *adev,
+ 		ucode->ucode_size = adev->gfx.rlc.save_restore_list_srm_size_bytes;
+ 		memcpy(ucode->kaddr, adev->gfx.rlc.save_restore_list_srm,
+ 		       ucode->ucode_size);
++	} else if (ucode->ucode_id == AMDGPU_UCODE_ID_RLC_IRAM) {
++		ucode->ucode_size = adev->gfx.rlc.rlc_iram_ucode_size_bytes;
++		memcpy(ucode->kaddr, adev->gfx.rlc.rlc_iram_ucode,
++		       ucode->ucode_size);
++	} else if (ucode->ucode_id == AMDGPU_UCODE_ID_RLC_DRAM) {
++		ucode->ucode_size = adev->gfx.rlc.rlc_dram_ucode_size_bytes;
++		memcpy(ucode->kaddr, adev->gfx.rlc.rlc_dram_ucode,
++		       ucode->ucode_size);
+ 	} else if (ucode->ucode_id == AMDGPU_UCODE_ID_CP_MES) {
+ 		ucode->ucode_size = le32_to_cpu(mes_hdr->mes_ucode_size_bytes);
+ 		memcpy(ucode->kaddr, (void *)((uint8_t *)adev->mes.fw->data +
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h
+index 12a8bc8fca0b0..97c78d91fc2fa 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.h
+@@ -221,6 +221,15 @@ struct rlc_firmware_header_v2_1 {
+ 	uint32_t save_restore_list_srm_offset_bytes;
+ };
+ 
++/* version_major=2, version_minor=1 */
++struct rlc_firmware_header_v2_2 {
++	struct rlc_firmware_header_v2_1 v2_1;
++	uint32_t rlc_iram_ucode_size_bytes;
++	uint32_t rlc_iram_ucode_offset_bytes;
++	uint32_t rlc_dram_ucode_size_bytes;
++	uint32_t rlc_dram_ucode_offset_bytes;
++};
++
+ /* version_major=1, version_minor=0 */
+ struct sdma_firmware_header_v1_0 {
+ 	struct common_firmware_header header;
+@@ -338,6 +347,8 @@ enum AMDGPU_UCODE_ID {
+ 	AMDGPU_UCODE_ID_RLC_RESTORE_LIST_CNTL,
+ 	AMDGPU_UCODE_ID_RLC_RESTORE_LIST_GPM_MEM,
+ 	AMDGPU_UCODE_ID_RLC_RESTORE_LIST_SRM_MEM,
++	AMDGPU_UCODE_ID_RLC_IRAM,
++	AMDGPU_UCODE_ID_RLC_DRAM,
+ 	AMDGPU_UCODE_ID_RLC_G,
+ 	AMDGPU_UCODE_ID_STORAGE,
+ 	AMDGPU_UCODE_ID_SMC,
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.h
+index 5eb63288d1574..edbb8194ee81b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.h
+@@ -67,6 +67,7 @@ struct amdgpu_uvd {
+ 	unsigned		harvest_config;
+ 	/* store image width to adjust nb memory state */
+ 	unsigned		decode_image_width;
++	uint32_t                keyselect;
+ };
+ 
+ int amdgpu_uvd_sw_init(struct amdgpu_device *adev);
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+index 3a2af95f2bf0d..514cb4b1e537a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -3105,6 +3105,8 @@ static const struct soc15_reg_golden golden_settings_gc_10_3[] =
+ 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG3, 0xffffffff, 0x00000280),
+ 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG4, 0xffffffff, 0x00800000),
+ 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_EXCEPTION_CONTROL, 0x7fff0f1f, 0x00b80000),
++	SOC15_REG_GOLDEN_VALUE(GC, 0 ,mmGCEA_SDP_TAG_RESERVE0, 0xffffffff, 0x10100100),
++	SOC15_REG_GOLDEN_VALUE(GC, 0, mmGCEA_SDP_TAG_RESERVE1, 0xffffffff, 0x17000088),
+ 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmGCR_GENERAL_CNTL_Sienna_Cichlid, 0x1ff1ffff, 0x00000500),
+ 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmGE_PC_CNTL, 0x003fffff, 0x00280400),
+ 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmGL2A_ADDR_MATCH_MASK, 0xffffffff, 0xffffffcf),
+@@ -3594,6 +3596,17 @@ static void gfx_v10_0_init_rlc_ext_microcode(struct amdgpu_device *adev)
+ 			le32_to_cpu(rlc_hdr->reg_list_format_direct_reg_list_length);
+ }
+ 
++static void gfx_v10_0_init_rlc_iram_dram_microcode(struct amdgpu_device *adev)
++{
++	const struct rlc_firmware_header_v2_2 *rlc_hdr;
++
++	rlc_hdr = (const struct rlc_firmware_header_v2_2 *)adev->gfx.rlc_fw->data;
++	adev->gfx.rlc.rlc_iram_ucode_size_bytes = le32_to_cpu(rlc_hdr->rlc_iram_ucode_size_bytes);
++	adev->gfx.rlc.rlc_iram_ucode = (u8 *)rlc_hdr + le32_to_cpu(rlc_hdr->rlc_iram_ucode_offset_bytes);
++	adev->gfx.rlc.rlc_dram_ucode_size_bytes = le32_to_cpu(rlc_hdr->rlc_dram_ucode_size_bytes);
++	adev->gfx.rlc.rlc_dram_ucode = (u8 *)rlc_hdr + le32_to_cpu(rlc_hdr->rlc_dram_ucode_offset_bytes);
++}
++
+ static bool gfx_v10_0_navi10_gfxoff_should_enable(struct amdgpu_device *adev)
+ {
+ 	bool ret = false;
+@@ -3709,8 +3722,6 @@ static int gfx_v10_0_init_microcode(struct amdgpu_device *adev)
+ 		rlc_hdr = (const struct rlc_firmware_header_v2_0 *)adev->gfx.rlc_fw->data;
+ 		version_major = le16_to_cpu(rlc_hdr->header.header_version_major);
+ 		version_minor = le16_to_cpu(rlc_hdr->header.header_version_minor);
+-		if (version_major == 2 && version_minor == 1)
+-			adev->gfx.rlc.is_rlc_v2_1 = true;
+ 
+ 		adev->gfx.rlc_fw_version = le32_to_cpu(rlc_hdr->header.ucode_version);
+ 		adev->gfx.rlc_feature_version = le32_to_cpu(rlc_hdr->ucode_feature_version);
+@@ -3752,8 +3763,12 @@ static int gfx_v10_0_init_microcode(struct amdgpu_device *adev)
+ 		for (i = 0 ; i < (rlc_hdr->reg_list_size_bytes >> 2); i++)
+ 			adev->gfx.rlc.register_restore[i] = le32_to_cpu(tmp[i]);
+ 
+-		if (adev->gfx.rlc.is_rlc_v2_1)
+-			gfx_v10_0_init_rlc_ext_microcode(adev);
++		if (version_major == 2) {
++			if (version_minor >= 1)
++				gfx_v10_0_init_rlc_ext_microcode(adev);
++			if (version_minor == 2)
++				gfx_v10_0_init_rlc_iram_dram_microcode(adev);
++		}
+ 	}
+ 
+ 	snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec%s.bin", chip_name, wks);
+@@ -3814,8 +3829,7 @@ static int gfx_v10_0_init_microcode(struct amdgpu_device *adev)
+ 			adev->firmware.fw_size +=
+ 				ALIGN(le32_to_cpu(header->ucode_size_bytes), PAGE_SIZE);
+ 		}
+-		if (adev->gfx.rlc.is_rlc_v2_1 &&
+-		    adev->gfx.rlc.save_restore_list_cntl_size_bytes &&
++		if (adev->gfx.rlc.save_restore_list_cntl_size_bytes &&
+ 		    adev->gfx.rlc.save_restore_list_gpm_size_bytes &&
+ 		    adev->gfx.rlc.save_restore_list_srm_size_bytes) {
+ 			info = &adev->firmware.ucode[AMDGPU_UCODE_ID_RLC_RESTORE_LIST_CNTL];
+@@ -3835,6 +3849,21 @@ static int gfx_v10_0_init_microcode(struct amdgpu_device *adev)
+ 			info->fw = adev->gfx.rlc_fw;
+ 			adev->firmware.fw_size +=
+ 				ALIGN(adev->gfx.rlc.save_restore_list_srm_size_bytes, PAGE_SIZE);
++
++			if (adev->gfx.rlc.rlc_iram_ucode_size_bytes &&
++			    adev->gfx.rlc.rlc_dram_ucode_size_bytes) {
++				info = &adev->firmware.ucode[AMDGPU_UCODE_ID_RLC_IRAM];
++				info->ucode_id = AMDGPU_UCODE_ID_RLC_IRAM;
++				info->fw = adev->gfx.rlc_fw;
++				adev->firmware.fw_size +=
++					ALIGN(adev->gfx.rlc.rlc_iram_ucode_size_bytes, PAGE_SIZE);
++
++				info = &adev->firmware.ucode[AMDGPU_UCODE_ID_RLC_DRAM];
++				info->ucode_id = AMDGPU_UCODE_ID_RLC_DRAM;
++				info->fw = adev->gfx.rlc_fw;
++				adev->firmware.fw_size +=
++					ALIGN(adev->gfx.rlc.rlc_dram_ucode_size_bytes, PAGE_SIZE);
++			}
+ 		}
+ 
+ 		info = &adev->firmware.ucode[AMDGPU_UCODE_ID_CP_MEC1];
+diff --git a/drivers/gpu/drm/amd/amdgpu/psp_gfx_if.h b/drivers/gpu/drm/amd/amdgpu/psp_gfx_if.h
+index cbc04a5c0fe1d..baf994627b0d7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/psp_gfx_if.h
++++ b/drivers/gpu/drm/amd/amdgpu/psp_gfx_if.h
+@@ -214,7 +214,7 @@ enum psp_gfx_fw_type {
+ 	GFX_FW_TYPE_UVD1        = 23,   /* UVD1                     VG-20   */
+ 	GFX_FW_TYPE_TOC         = 24,   /* TOC                      NV-10   */
+ 	GFX_FW_TYPE_RLC_P                           = 25,   /* RLC P                    NV      */
+-	GFX_FW_TYPE_RLX6                            = 26,   /* RLX6                     NV      */
++	GFX_FW_TYPE_RLC_IRAM                        = 26,   /* RLC_IRAM                 NV      */
+ 	GFX_FW_TYPE_GLOBAL_TAP_DELAYS               = 27,   /* GLOBAL TAP DELAYS        NV      */
+ 	GFX_FW_TYPE_SE0_TAP_DELAYS                  = 28,   /* SE0 TAP DELAYS           NV      */
+ 	GFX_FW_TYPE_SE1_TAP_DELAYS                  = 29,   /* SE1 TAP DELAYS           NV      */
+@@ -236,7 +236,7 @@ enum psp_gfx_fw_type {
+ 	GFX_FW_TYPE_ACCUM_CTRL_RAM                  = 45,   /* ACCUM CTRL RAM           NV      */
+ 	GFX_FW_TYPE_RLCP_CAM                        = 46,   /* RLCP CAM                 NV      */
+ 	GFX_FW_TYPE_RLC_SPP_CAM_EXT                 = 47,   /* RLC SPP CAM EXT          NV      */
+-	GFX_FW_TYPE_RLX6_DRAM_BOOT                  = 48,   /* RLX6 DRAM BOOT           NV      */
++	GFX_FW_TYPE_RLC_DRAM_BOOT                   = 48,   /* RLC DRAM BOOT            NV      */
+ 	GFX_FW_TYPE_VCN0_RAM                        = 49,   /* VCN_RAM                  NV + RN */
+ 	GFX_FW_TYPE_VCN1_RAM                        = 50,   /* VCN_RAM                  NV + RN */
+ 	GFX_FW_TYPE_DMUB                            = 51,   /* DMUB                          RN */
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+index 7cf4b11a65c5c..41800fcad4102 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+@@ -277,15 +277,8 @@ static void uvd_v3_1_mc_resume(struct amdgpu_device *adev)
+  */
+ static int uvd_v3_1_fw_validate(struct amdgpu_device *adev)
+ {
+-	void *ptr;
+-	uint32_t ucode_len, i;
+-	uint32_t keysel;
+-
+-	ptr = adev->uvd.inst[0].cpu_addr;
+-	ptr += 192 + 16;
+-	memcpy(&ucode_len, ptr, 4);
+-	ptr += ucode_len;
+-	memcpy(&keysel, ptr, 4);
++	int i;
++	uint32_t keysel = adev->uvd.keyselect;
+ 
+ 	WREG32(mmUVD_FW_START, keysel);
+ 
+@@ -550,6 +543,8 @@ static int uvd_v3_1_sw_init(void *handle)
+ 	struct amdgpu_ring *ring;
+ 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+ 	int r;
++	void *ptr;
++	uint32_t ucode_len;
+ 
+ 	/* UVD TRAP */
+ 	r = amdgpu_irq_add_id(adev, AMDGPU_IRQ_CLIENTID_LEGACY, 124, &adev->uvd.inst->irq);
+@@ -571,6 +566,13 @@ static int uvd_v3_1_sw_init(void *handle)
+ 	if (r)
+ 		return r;
+ 
++	/* Retrieval firmware validate key */
++	ptr = adev->uvd.inst[0].cpu_addr;
++	ptr += 192 + 16;
++	memcpy(&ucode_len, ptr, 4);
++	ptr += ucode_len;
++	memcpy(&adev->uvd.keyselect, ptr, 4);
++
+ 	r = amdgpu_uvd_entity_init(adev);
+ 
+ 	return r;
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 6beccd5a0941a..640cbafdde101 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -960,7 +960,7 @@ static int amdgpu_dm_init(struct amdgpu_device *adev)
+ 	amdgpu_dm_init_color_mod();
+ 
+ #ifdef CONFIG_DRM_AMD_DC_HDCP
+-	if (adev->asic_type >= CHIP_RAVEN) {
++	if (adev->dm.dc->caps.max_links > 0 && adev->asic_type >= CHIP_RAVEN) {
+ 		adev->dm.hdcp_workqueue = hdcp_create_workqueue(adev, &init_params.cp_psp, adev->dm.dc);
+ 
+ 		if (!adev->dm.hdcp_workqueue)
+diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
+index 80b7a082e8740..d6e0a29ea6b28 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
+@@ -444,7 +444,10 @@ static void mtk_dsi_config_vdo_timing(struct mtk_dsi *dsi)
+ 	u32 horizontal_sync_active_byte;
+ 	u32 horizontal_backporch_byte;
+ 	u32 horizontal_frontporch_byte;
++	u32 horizontal_front_back_byte;
++	u32 data_phy_cycles_byte;
+ 	u32 dsi_tmp_buf_bpp, data_phy_cycles;
++	u32 delta;
+ 	struct mtk_phy_timing *timing = &dsi->phy_timing;
+ 
+ 	struct videomode *vm = &dsi->vm;
+@@ -466,50 +469,30 @@ static void mtk_dsi_config_vdo_timing(struct mtk_dsi *dsi)
+ 	horizontal_sync_active_byte = (vm->hsync_len * dsi_tmp_buf_bpp - 10);
+ 
+ 	if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_SYNC_PULSE)
+-		horizontal_backporch_byte = vm->hback_porch * dsi_tmp_buf_bpp;
++		horizontal_backporch_byte = vm->hback_porch * dsi_tmp_buf_bpp - 10;
+ 	else
+ 		horizontal_backporch_byte = (vm->hback_porch + vm->hsync_len) *
+-					    dsi_tmp_buf_bpp;
++					    dsi_tmp_buf_bpp - 10;
+ 
+ 	data_phy_cycles = timing->lpx + timing->da_hs_prepare +
+-			  timing->da_hs_zero + timing->da_hs_exit;
+-
+-	if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_BURST) {
+-		if ((vm->hfront_porch + vm->hback_porch) * dsi_tmp_buf_bpp >
+-		    data_phy_cycles * dsi->lanes + 18) {
+-			horizontal_frontporch_byte =
+-				vm->hfront_porch * dsi_tmp_buf_bpp -
+-				(data_phy_cycles * dsi->lanes + 18) *
+-				vm->hfront_porch /
+-				(vm->hfront_porch + vm->hback_porch);
+-
+-			horizontal_backporch_byte =
+-				horizontal_backporch_byte -
+-				(data_phy_cycles * dsi->lanes + 18) *
+-				vm->hback_porch /
+-				(vm->hfront_porch + vm->hback_porch);
+-		} else {
+-			DRM_WARN("HFP less than d-phy, FPS will under 60Hz\n");
+-			horizontal_frontporch_byte = vm->hfront_porch *
+-						     dsi_tmp_buf_bpp;
+-		}
++			  timing->da_hs_zero + timing->da_hs_exit + 3;
++
++	delta = dsi->mode_flags & MIPI_DSI_MODE_VIDEO_BURST ? 18 : 12;
++
++	horizontal_frontporch_byte = vm->hfront_porch * dsi_tmp_buf_bpp;
++	horizontal_front_back_byte = horizontal_frontporch_byte + horizontal_backporch_byte;
++	data_phy_cycles_byte = data_phy_cycles * dsi->lanes + delta;
++
++	if (horizontal_front_back_byte > data_phy_cycles_byte) {
++		horizontal_frontporch_byte -= data_phy_cycles_byte *
++					      horizontal_frontporch_byte /
++					      horizontal_front_back_byte;
++
++		horizontal_backporch_byte -= data_phy_cycles_byte *
++					     horizontal_backporch_byte /
++					     horizontal_front_back_byte;
+ 	} else {
+-		if ((vm->hfront_porch + vm->hback_porch) * dsi_tmp_buf_bpp >
+-		    data_phy_cycles * dsi->lanes + 12) {
+-			horizontal_frontporch_byte =
+-				vm->hfront_porch * dsi_tmp_buf_bpp -
+-				(data_phy_cycles * dsi->lanes + 12) *
+-				vm->hfront_porch /
+-				(vm->hfront_porch + vm->hback_porch);
+-			horizontal_backporch_byte = horizontal_backporch_byte -
+-				(data_phy_cycles * dsi->lanes + 12) *
+-				vm->hback_porch /
+-				(vm->hfront_porch + vm->hback_porch);
+-		} else {
+-			DRM_WARN("HFP less than d-phy, FPS will under 60Hz\n");
+-			horizontal_frontporch_byte = vm->hfront_porch *
+-						     dsi_tmp_buf_bpp;
+-		}
++		DRM_WARN("HFP + HBP less than d-phy, FPS will under 60Hz\n");
+ 	}
+ 
+ 	writel(horizontal_sync_active_byte, dsi->regs + DSI_HSA_WC);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
+index 124d3dcc5c590..98e99aa8a547e 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
+@@ -570,8 +570,10 @@ nouveau_gem_pushbuf_validate(struct nouveau_channel *chan,
+ 			NV_PRINTK(err, cli, "validating bo list\n");
+ 		validate_fini(op, chan, NULL, NULL);
+ 		return ret;
++	} else if (ret > 0) {
++		*apply_relocs = true;
+ 	}
+-	*apply_relocs = ret;
++
+ 	return 0;
+ }
+ 
+@@ -674,7 +676,6 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli,
+ 		nouveau_bo_wr32(nvbo, r->reloc_bo_offset >> 2, data);
+ 	}
+ 
+-	u_free(reloc);
+ 	return ret;
+ }
+ 
+@@ -884,9 +885,10 @@ out:
+ 				break;
+ 			}
+ 		}
+-		u_free(reloc);
+ 	}
+ out_prevalid:
++	if (!IS_ERR(reloc))
++		u_free(reloc);
+ 	u_free(bo);
+ 	u_free(push);
+ 
+diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c
+index a50ba4a4a1d71..b88f889b3932e 100644
+--- a/drivers/hid/hid-cypress.c
++++ b/drivers/hid/hid-cypress.c
+@@ -23,19 +23,17 @@
+ #define CP_2WHEEL_MOUSE_HACK		0x02
+ #define CP_2WHEEL_MOUSE_HACK_ON		0x04
+ 
++#define VA_INVAL_LOGICAL_BOUNDARY	0x08
++
+ /*
+  * Some USB barcode readers from cypress have usage min and usage max in
+  * the wrong order
+  */
+-static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
++static __u8 *cp_rdesc_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 		unsigned int *rsize)
+ {
+-	unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
+ 	unsigned int i;
+ 
+-	if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX))
+-		return rdesc;
+-
+ 	if (*rsize < 4)
+ 		return rdesc;
+ 
+@@ -48,6 +46,40 @@ static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 	return rdesc;
+ }
+ 
++static __u8 *va_logical_boundary_fixup(struct hid_device *hdev, __u8 *rdesc,
++		unsigned int *rsize)
++{
++	/*
++	 * Varmilo VA104M (with VID Cypress and device ID 07B1) incorrectly
++	 * reports Logical Minimum of its Consumer Control device as 572
++	 * (0x02 0x3c). Fix this by setting its Logical Minimum to zero.
++	 */
++	if (*rsize == 25 &&
++			rdesc[0] == 0x05 && rdesc[1] == 0x0c &&
++			rdesc[2] == 0x09 && rdesc[3] == 0x01 &&
++			rdesc[6] == 0x19 && rdesc[7] == 0x00 &&
++			rdesc[11] == 0x16 && rdesc[12] == 0x3c && rdesc[13] == 0x02) {
++		hid_info(hdev,
++			 "fixing up varmilo VA104M consumer control report descriptor\n");
++		rdesc[12] = 0x00;
++		rdesc[13] = 0x00;
++	}
++	return rdesc;
++}
++
++static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
++		unsigned int *rsize)
++{
++	unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
++
++	if (quirks & CP_RDESC_SWAPPED_MIN_MAX)
++		rdesc = cp_rdesc_fixup(hdev, rdesc, rsize);
++	if (quirks & VA_INVAL_LOGICAL_BOUNDARY)
++		rdesc = va_logical_boundary_fixup(hdev, rdesc, rsize);
++
++	return rdesc;
++}
++
+ static int cp_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+ 		struct hid_field *field, struct hid_usage *usage,
+ 		unsigned long **bit, int *max)
+@@ -128,6 +160,8 @@ static const struct hid_device_id cp_devices[] = {
+ 		.driver_data = CP_RDESC_SWAPPED_MIN_MAX },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE),
+ 		.driver_data = CP_2WHEEL_MOUSE_HACK },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1),
++		.driver_data = VA_INVAL_LOGICAL_BOUNDARY },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(hid, cp_devices);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 79495e218b7fc..a6d63a7590434 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -331,6 +331,8 @@
+ #define USB_DEVICE_ID_CYPRESS_BARCODE_4	0xed81
+ #define USB_DEVICE_ID_CYPRESS_TRUETOUCH	0xc001
+ 
++#define USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1   0X07b1
++
+ #define USB_VENDOR_ID_DATA_MODUL	0x7374
+ #define USB_VENDOR_ID_DATA_MODUL_EASYMAXTOUCH	0x1201
+ 
+@@ -443,6 +445,10 @@
+ #define USB_VENDOR_ID_FRUCTEL	0x25B6
+ #define USB_DEVICE_ID_GAMETEL_MT_MODE	0x0002
+ 
++#define USB_VENDOR_ID_GAMEVICE	0x27F8
++#define USB_DEVICE_ID_GAMEVICE_GV186	0x0BBE
++#define USB_DEVICE_ID_GAMEVICE_KISHI	0x0BBF
++
+ #define USB_VENDOR_ID_GAMERON		0x0810
+ #define USB_DEVICE_ID_GAMERON_DUAL_PSX_ADAPTOR	0x0001
+ #define USB_DEVICE_ID_GAMERON_DUAL_PCS_ADAPTOR	0x0002
+@@ -485,6 +491,7 @@
+ #define USB_DEVICE_ID_PENPOWER		0x00f4
+ 
+ #define USB_VENDOR_ID_GREENASIA		0x0e8f
++#define USB_DEVICE_ID_GREENASIA_DUAL_SAT_ADAPTOR 0x3010
+ #define USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD	0x3013
+ 
+ #define USB_VENDOR_ID_GRETAGMACBETH	0x0971
+@@ -742,6 +749,7 @@
+ #define USB_VENDOR_ID_LOGITECH		0x046d
+ #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
+ #define USB_DEVICE_ID_LOGITECH_T651	0xb00c
++#define USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD	0xb309
+ #define USB_DEVICE_ID_LOGITECH_C007	0xc007
+ #define USB_DEVICE_ID_LOGITECH_C077	0xc077
+ #define USB_DEVICE_ID_LOGITECH_RECEIVER	0xc101
+@@ -1297,6 +1305,7 @@
+ 
+ #define USB_VENDOR_ID_UGTIZER			0x2179
+ #define USB_DEVICE_ID_UGTIZER_TABLET_GP0610	0x0053
++#define USB_DEVICE_ID_UGTIZER_TABLET_GT5040	0x0077
+ 
+ #define USB_VENDOR_ID_VIEWSONIC			0x0543
+ #define USB_DEVICE_ID_VIEWSONIC_PD1011		0xe621
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 9770db624bfaf..4dca113924593 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -319,6 +319,9 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ 		USB_DEVICE_ID_ASUSTEK_T100CHI_KEYBOARD),
+ 	  HID_BATTERY_QUIRK_IGNORE },
++	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
++		USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD),
++	  HID_BATTERY_QUIRK_IGNORE },
+ 	{}
+ };
+ 
+diff --git a/drivers/hid/hid-ite.c b/drivers/hid/hid-ite.c
+index 044a93f3c1178..742c052b0110a 100644
+--- a/drivers/hid/hid-ite.c
++++ b/drivers/hid/hid-ite.c
+@@ -11,6 +11,48 @@
+ 
+ #include "hid-ids.h"
+ 
++#define QUIRK_TOUCHPAD_ON_OFF_REPORT		BIT(0)
++
++static __u8 *ite_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize)
++{
++	unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
++
++	if (quirks & QUIRK_TOUCHPAD_ON_OFF_REPORT) {
++		if (*rsize == 188 && rdesc[162] == 0x81 && rdesc[163] == 0x02) {
++			hid_info(hdev, "Fixing up ITE keyboard report descriptor\n");
++			rdesc[163] = HID_MAIN_ITEM_RELATIVE;
++		}
++	}
++
++	return rdesc;
++}
++
++static int ite_input_mapping(struct hid_device *hdev,
++		struct hid_input *hi, struct hid_field *field,
++		struct hid_usage *usage, unsigned long **bit,
++		int *max)
++{
++
++	unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
++
++	if ((quirks & QUIRK_TOUCHPAD_ON_OFF_REPORT) &&
++	    (usage->hid & HID_USAGE_PAGE) == 0x00880000) {
++		if (usage->hid == 0x00880078) {
++			/* Touchpad on, userspace expects F22 for this */
++			hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_F22);
++			return 1;
++		}
++		if (usage->hid == 0x00880079) {
++			/* Touchpad off, userspace expects F23 for this */
++			hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_F23);
++			return 1;
++		}
++		return -1;
++	}
++
++	return 0;
++}
++
+ static int ite_event(struct hid_device *hdev, struct hid_field *field,
+ 		     struct hid_usage *usage, __s32 value)
+ {
+@@ -37,13 +79,27 @@ static int ite_event(struct hid_device *hdev, struct hid_field *field,
+ 	return 0;
+ }
+ 
++static int ite_probe(struct hid_device *hdev, const struct hid_device_id *id)
++{
++	int ret;
++
++	hid_set_drvdata(hdev, (void *)id->driver_data);
++
++	ret = hid_open_report(hdev);
++	if (ret)
++		return ret;
++
++	return hid_hw_start(hdev, HID_CONNECT_DEFAULT);
++}
++
+ static const struct hid_device_id ite_devices[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ITE, USB_DEVICE_ID_ITE8595) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_258A, USB_DEVICE_ID_258A_6A88) },
+ 	/* ITE8595 USB kbd ctlr, with Synaptics touchpad connected to it. */
+ 	{ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ 		     USB_VENDOR_ID_SYNAPTICS,
+-		     USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012) },
++		     USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012),
++	  .driver_data = QUIRK_TOUCHPAD_ON_OFF_REPORT },
+ 	/* ITE8910 USB kbd ctlr, with Synaptics touchpad connected to it. */
+ 	{ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ 		     USB_VENDOR_ID_SYNAPTICS,
+@@ -55,6 +111,9 @@ MODULE_DEVICE_TABLE(hid, ite_devices);
+ static struct hid_driver ite_driver = {
+ 	.name = "itetech",
+ 	.id_table = ite_devices,
++	.probe = ite_probe,
++	.report_fixup = ite_report_fixup,
++	.input_mapping = ite_input_mapping,
+ 	.event = ite_event,
+ };
+ module_hid_driver(ite_driver);
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index a2991622702ae..0ca7231195473 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -3997,6 +3997,9 @@ static const struct hid_device_id hidpp_devices[] = {
+ 	{ /* Keyboard MX5000 (Bluetooth-receiver in HID proxy mode) */
+ 	  LDJ_DEVICE(0xb305),
+ 	  .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS },
++	{ /* Dinovo Edge (Bluetooth-receiver in HID proxy mode) */
++	  LDJ_DEVICE(0xb309),
++	  .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS },
+ 	{ /* Keyboard MX5500 (Bluetooth-receiver in HID proxy mode) */
+ 	  LDJ_DEVICE(0xb30b),
+ 	  .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS },
+@@ -4039,6 +4042,9 @@ static const struct hid_device_id hidpp_devices[] = {
+ 	{ /* MX5000 keyboard over Bluetooth */
+ 	  HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb305),
+ 	  .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS },
++	{ /* Dinovo Edge keyboard over Bluetooth */
++	  HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb309),
++	  .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS },
+ 	{ /* MX5500 keyboard over Bluetooth */
+ 	  HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb30b),
+ 	  .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS },
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 7a2be0205dfd1..bf7ecab5d9e5e 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -83,7 +83,12 @@ static const struct hid_device_id hid_quirks[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER), HID_QUIRK_NO_INIT_REPORTS },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28), HID_QUIRK_NOGET },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_FUTABA, USB_DEVICE_ID_LED_DISPLAY), HID_QUIRK_NO_INIT_REPORTS },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_SAT_ADAPTOR), HID_QUIRK_MULTI_INPUT },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD), HID_QUIRK_MULTI_INPUT },
++	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_GAMEVICE, USB_DEVICE_ID_GAMEVICE_GV186),
++		HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_GAMEVICE, USB_DEVICE_ID_GAMEVICE_KISHI),
++		HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
+index 94c7398b5c279..3dd7d32467378 100644
+--- a/drivers/hid/hid-sensor-hub.c
++++ b/drivers/hid/hid-sensor-hub.c
+@@ -483,7 +483,8 @@ static int sensor_hub_raw_event(struct hid_device *hdev,
+ 		return 1;
+ 
+ 	ptr = raw_data;
+-	ptr++; /* Skip report id */
++	if (report->id)
++		ptr++; /* Skip report id */
+ 
+ 	spin_lock_irqsave(&pdata->lock, flags);
+ 
+diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c
+index 86b568037cb8a..8e9c9e646cb7d 100644
+--- a/drivers/hid/hid-uclogic-core.c
++++ b/drivers/hid/hid-uclogic-core.c
+@@ -385,6 +385,8 @@ static const struct hid_device_id uclogic_devices[] = {
+ 				USB_DEVICE_ID_UCLOGIC_DRAWIMAGE_G3) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER,
+ 				USB_DEVICE_ID_UGTIZER_TABLET_GP0610) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER,
++				USB_DEVICE_ID_UGTIZER_TABLET_GT5040) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_UGEE,
+ 				USB_DEVICE_ID_UGEE_TABLET_G5) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_UGEE,
+diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c
+index 7d20d1fcf8d20..d26d8cd98efcf 100644
+--- a/drivers/hid/hid-uclogic-params.c
++++ b/drivers/hid/hid-uclogic-params.c
+@@ -997,6 +997,8 @@ int uclogic_params_init(struct uclogic_params *params,
+ 		break;
+ 	case VID_PID(USB_VENDOR_ID_UGTIZER,
+ 		     USB_DEVICE_ID_UGTIZER_TABLET_GP0610):
++	case VID_PID(USB_VENDOR_ID_UGTIZER,
++		     USB_DEVICE_ID_UGTIZER_TABLET_GT5040):
+ 	case VID_PID(USB_VENDOR_ID_UGEE,
+ 		     USB_DEVICE_ID_UGEE_XPPEN_TABLET_G540):
+ 	case VID_PID(USB_VENDOR_ID_UGEE,
+diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
+index 8ca51e43cf530..329ee4f48d957 100644
+--- a/drivers/infiniband/hw/hfi1/file_ops.c
++++ b/drivers/infiniband/hw/hfi1/file_ops.c
+@@ -1,4 +1,5 @@
+ /*
++ * Copyright(c) 2020 Cornelis Networks, Inc.
+  * Copyright(c) 2015-2020 Intel Corporation.
+  *
+  * This file is provided under a dual BSD/GPLv2 license.  When using or
+@@ -206,8 +207,6 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
+ 	spin_lock_init(&fd->tid_lock);
+ 	spin_lock_init(&fd->invalid_lock);
+ 	fd->rec_cpu_num = -1; /* no cpu affinity by default */
+-	fd->mm = current->mm;
+-	mmgrab(fd->mm);
+ 	fd->dd = dd;
+ 	fp->private_data = fd;
+ 	return 0;
+@@ -711,7 +710,6 @@ static int hfi1_file_close(struct inode *inode, struct file *fp)
+ 
+ 	deallocate_ctxt(uctxt);
+ done:
+-	mmdrop(fdata->mm);
+ 
+ 	if (atomic_dec_and_test(&dd->user_refcount))
+ 		complete(&dd->user_comp);
+diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
+index b4c6bff60a4e8..e09e8244a94c4 100644
+--- a/drivers/infiniband/hw/hfi1/hfi.h
++++ b/drivers/infiniband/hw/hfi1/hfi.h
+@@ -1,6 +1,7 @@
+ #ifndef _HFI1_KERNEL_H
+ #define _HFI1_KERNEL_H
+ /*
++ * Copyright(c) 2020 Cornelis Networks, Inc.
+  * Copyright(c) 2015-2020 Intel Corporation.
+  *
+  * This file is provided under a dual BSD/GPLv2 license.  When using or
+@@ -1451,7 +1452,6 @@ struct hfi1_filedata {
+ 	u32 invalid_tid_idx;
+ 	/* protect invalid_tids array and invalid_tid_idx */
+ 	spinlock_t invalid_lock;
+-	struct mm_struct *mm;
+ };
+ 
+ extern struct xarray hfi1_dev_table;
+diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c
+index 24ca17b77b72b..f3fb28e3d5d74 100644
+--- a/drivers/infiniband/hw/hfi1/mmu_rb.c
++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c
+@@ -1,4 +1,5 @@
+ /*
++ * Copyright(c) 2020 Cornelis Networks, Inc.
+  * Copyright(c) 2016 - 2017 Intel Corporation.
+  *
+  * This file is provided under a dual BSD/GPLv2 license.  When using or
+@@ -48,23 +49,11 @@
+ #include <linux/rculist.h>
+ #include <linux/mmu_notifier.h>
+ #include <linux/interval_tree_generic.h>
++#include <linux/sched/mm.h>
+ 
+ #include "mmu_rb.h"
+ #include "trace.h"
+ 
+-struct mmu_rb_handler {
+-	struct mmu_notifier mn;
+-	struct rb_root_cached root;
+-	void *ops_arg;
+-	spinlock_t lock;        /* protect the RB tree */
+-	struct mmu_rb_ops *ops;
+-	struct mm_struct *mm;
+-	struct list_head lru_list;
+-	struct work_struct del_work;
+-	struct list_head del_list;
+-	struct workqueue_struct *wq;
+-};
+-
+ static unsigned long mmu_node_start(struct mmu_rb_node *);
+ static unsigned long mmu_node_last(struct mmu_rb_node *);
+ static int mmu_notifier_range_start(struct mmu_notifier *,
+@@ -92,37 +81,36 @@ static unsigned long mmu_node_last(struct mmu_rb_node *node)
+ 	return PAGE_ALIGN(node->addr + node->len) - 1;
+ }
+ 
+-int hfi1_mmu_rb_register(void *ops_arg, struct mm_struct *mm,
++int hfi1_mmu_rb_register(void *ops_arg,
+ 			 struct mmu_rb_ops *ops,
+ 			 struct workqueue_struct *wq,
+ 			 struct mmu_rb_handler **handler)
+ {
+-	struct mmu_rb_handler *handlr;
++	struct mmu_rb_handler *h;
+ 	int ret;
+ 
+-	handlr = kmalloc(sizeof(*handlr), GFP_KERNEL);
+-	if (!handlr)
++	h = kmalloc(sizeof(*h), GFP_KERNEL);
++	if (!h)
+ 		return -ENOMEM;
+ 
+-	handlr->root = RB_ROOT_CACHED;
+-	handlr->ops = ops;
+-	handlr->ops_arg = ops_arg;
+-	INIT_HLIST_NODE(&handlr->mn.hlist);
+-	spin_lock_init(&handlr->lock);
+-	handlr->mn.ops = &mn_opts;
+-	handlr->mm = mm;
+-	INIT_WORK(&handlr->del_work, handle_remove);
+-	INIT_LIST_HEAD(&handlr->del_list);
+-	INIT_LIST_HEAD(&handlr->lru_list);
+-	handlr->wq = wq;
+-
+-	ret = mmu_notifier_register(&handlr->mn, handlr->mm);
++	h->root = RB_ROOT_CACHED;
++	h->ops = ops;
++	h->ops_arg = ops_arg;
++	INIT_HLIST_NODE(&h->mn.hlist);
++	spin_lock_init(&h->lock);
++	h->mn.ops = &mn_opts;
++	INIT_WORK(&h->del_work, handle_remove);
++	INIT_LIST_HEAD(&h->del_list);
++	INIT_LIST_HEAD(&h->lru_list);
++	h->wq = wq;
++
++	ret = mmu_notifier_register(&h->mn, current->mm);
+ 	if (ret) {
+-		kfree(handlr);
++		kfree(h);
+ 		return ret;
+ 	}
+ 
+-	*handler = handlr;
++	*handler = h;
+ 	return 0;
+ }
+ 
+@@ -134,7 +122,7 @@ void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler)
+ 	struct list_head del_list;
+ 
+ 	/* Unregister first so we don't get any more notifications. */
+-	mmu_notifier_unregister(&handler->mn, handler->mm);
++	mmu_notifier_unregister(&handler->mn, handler->mn.mm);
+ 
+ 	/*
+ 	 * Make sure the wq delete handler is finished running.  It will not
+@@ -166,6 +154,10 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
+ 	int ret = 0;
+ 
+ 	trace_hfi1_mmu_rb_insert(mnode->addr, mnode->len);
++
++	if (current->mm != handler->mn.mm)
++		return -EPERM;
++
+ 	spin_lock_irqsave(&handler->lock, flags);
+ 	node = __mmu_rb_search(handler, mnode->addr, mnode->len);
+ 	if (node) {
+@@ -180,6 +172,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
+ 		__mmu_int_rb_remove(mnode, &handler->root);
+ 		list_del(&mnode->list); /* remove from LRU list */
+ 	}
++	mnode->handler = handler;
+ unlock:
+ 	spin_unlock_irqrestore(&handler->lock, flags);
+ 	return ret;
+@@ -217,6 +210,9 @@ bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler,
+ 	unsigned long flags;
+ 	bool ret = false;
+ 
++	if (current->mm != handler->mn.mm)
++		return ret;
++
+ 	spin_lock_irqsave(&handler->lock, flags);
+ 	node = __mmu_rb_search(handler, addr, len);
+ 	if (node) {
+@@ -239,6 +235,9 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ 	unsigned long flags;
+ 	bool stop = false;
+ 
++	if (current->mm != handler->mn.mm)
++		return;
++
+ 	INIT_LIST_HEAD(&del_list);
+ 
+ 	spin_lock_irqsave(&handler->lock, flags);
+@@ -272,6 +271,9 @@ void hfi1_mmu_rb_remove(struct mmu_rb_handler *handler,
+ {
+ 	unsigned long flags;
+ 
++	if (current->mm != handler->mn.mm)
++		return;
++
+ 	/* Validity of handler and node pointers has been checked by caller. */
+ 	trace_hfi1_mmu_rb_remove(node->addr, node->len);
+ 	spin_lock_irqsave(&handler->lock, flags);
+diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.h b/drivers/infiniband/hw/hfi1/mmu_rb.h
+index f04cec1e99d11..423aacc67e948 100644
+--- a/drivers/infiniband/hw/hfi1/mmu_rb.h
++++ b/drivers/infiniband/hw/hfi1/mmu_rb.h
+@@ -1,4 +1,5 @@
+ /*
++ * Copyright(c) 2020 Cornelis Networks, Inc.
+  * Copyright(c) 2016 Intel Corporation.
+  *
+  * This file is provided under a dual BSD/GPLv2 license.  When using or
+@@ -54,6 +55,7 @@ struct mmu_rb_node {
+ 	unsigned long len;
+ 	unsigned long __last;
+ 	struct rb_node node;
++	struct mmu_rb_handler *handler;
+ 	struct list_head list;
+ };
+ 
+@@ -71,7 +73,19 @@ struct mmu_rb_ops {
+ 		     void *evict_arg, bool *stop);
+ };
+ 
+-int hfi1_mmu_rb_register(void *ops_arg, struct mm_struct *mm,
++struct mmu_rb_handler {
++	struct mmu_notifier mn;
++	struct rb_root_cached root;
++	void *ops_arg;
++	spinlock_t lock;        /* protect the RB tree */
++	struct mmu_rb_ops *ops;
++	struct list_head lru_list;
++	struct work_struct del_work;
++	struct list_head del_list;
++	struct workqueue_struct *wq;
++};
++
++int hfi1_mmu_rb_register(void *ops_arg,
+ 			 struct mmu_rb_ops *ops,
+ 			 struct workqueue_struct *wq,
+ 			 struct mmu_rb_handler **handler);
+diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+index f81ca20f4b693..b94fc7fd75a96 100644
+--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c
++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+@@ -1,4 +1,5 @@
+ /*
++ * Copyright(c) 2020 Cornelis Networks, Inc.
+  * Copyright(c) 2015-2018 Intel Corporation.
+  *
+  * This file is provided under a dual BSD/GPLv2 license.  When using or
+@@ -173,15 +174,18 @@ static void unpin_rcv_pages(struct hfi1_filedata *fd,
+ {
+ 	struct page **pages;
+ 	struct hfi1_devdata *dd = fd->uctxt->dd;
++	struct mm_struct *mm;
+ 
+ 	if (mapped) {
+ 		pci_unmap_single(dd->pcidev, node->dma_addr,
+ 				 node->npages * PAGE_SIZE, PCI_DMA_FROMDEVICE);
+ 		pages = &node->pages[idx];
++		mm = mm_from_tid_node(node);
+ 	} else {
+ 		pages = &tidbuf->pages[idx];
++		mm = current->mm;
+ 	}
+-	hfi1_release_user_pages(fd->mm, pages, npages, mapped);
++	hfi1_release_user_pages(mm, pages, npages, mapped);
+ 	fd->tid_n_pinned -= npages;
+ }
+ 
+@@ -216,12 +220,12 @@ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf)
+ 	 * pages, accept the amount pinned so far and program only that.
+ 	 * User space knows how to deal with partially programmed buffers.
+ 	 */
+-	if (!hfi1_can_pin_pages(dd, fd->mm, fd->tid_n_pinned, npages)) {
++	if (!hfi1_can_pin_pages(dd, current->mm, fd->tid_n_pinned, npages)) {
+ 		kfree(pages);
+ 		return -ENOMEM;
+ 	}
+ 
+-	pinned = hfi1_acquire_user_pages(fd->mm, vaddr, npages, true, pages);
++	pinned = hfi1_acquire_user_pages(current->mm, vaddr, npages, true, pages);
+ 	if (pinned <= 0) {
+ 		kfree(pages);
+ 		return pinned;
+@@ -756,7 +760,7 @@ static int set_rcvarray_entry(struct hfi1_filedata *fd,
+ 
+ 	if (fd->use_mn) {
+ 		ret = mmu_interval_notifier_insert(
+-			&node->notifier, fd->mm,
++			&node->notifier, current->mm,
+ 			tbuf->vaddr + (pageidx * PAGE_SIZE), npages * PAGE_SIZE,
+ 			&tid_mn_ops);
+ 		if (ret)
+diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.h b/drivers/infiniband/hw/hfi1/user_exp_rcv.h
+index 332abb446861a..d45c7b6988d4d 100644
+--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.h
++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.h
+@@ -1,6 +1,7 @@
+ #ifndef _HFI1_USER_EXP_RCV_H
+ #define _HFI1_USER_EXP_RCV_H
+ /*
++ * Copyright(c) 2020 - Cornelis Networks, Inc.
+  * Copyright(c) 2015 - 2017 Intel Corporation.
+  *
+  * This file is provided under a dual BSD/GPLv2 license.  When using or
+@@ -95,4 +96,9 @@ int hfi1_user_exp_rcv_clear(struct hfi1_filedata *fd,
+ int hfi1_user_exp_rcv_invalid(struct hfi1_filedata *fd,
+ 			      struct hfi1_tid_info *tinfo);
+ 
++static inline struct mm_struct *mm_from_tid_node(struct tid_rb_node *node)
++{
++	return node->notifier.mm;
++}
++
+ #endif /* _HFI1_USER_EXP_RCV_H */
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
+index a92346e88628b..4a4956f96a7eb 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.c
++++ b/drivers/infiniband/hw/hfi1/user_sdma.c
+@@ -1,4 +1,5 @@
+ /*
++ * Copyright(c) 2020 - Cornelis Networks, Inc.
+  * Copyright(c) 2015 - 2018 Intel Corporation.
+  *
+  * This file is provided under a dual BSD/GPLv2 license.  When using or
+@@ -188,7 +189,6 @@ int hfi1_user_sdma_alloc_queues(struct hfi1_ctxtdata *uctxt,
+ 	atomic_set(&pq->n_reqs, 0);
+ 	init_waitqueue_head(&pq->wait);
+ 	atomic_set(&pq->n_locked, 0);
+-	pq->mm = fd->mm;
+ 
+ 	iowait_init(&pq->busy, 0, NULL, NULL, defer_packet_queue,
+ 		    activate_packet_queue, NULL, NULL);
+@@ -230,7 +230,7 @@ int hfi1_user_sdma_alloc_queues(struct hfi1_ctxtdata *uctxt,
+ 
+ 	cq->nentries = hfi1_sdma_comp_ring_size;
+ 
+-	ret = hfi1_mmu_rb_register(pq, pq->mm, &sdma_rb_ops, dd->pport->hfi1_wq,
++	ret = hfi1_mmu_rb_register(pq, &sdma_rb_ops, dd->pport->hfi1_wq,
+ 				   &pq->handler);
+ 	if (ret) {
+ 		dd_dev_err(dd, "Failed to register with MMU %d", ret);
+@@ -980,13 +980,13 @@ static int pin_sdma_pages(struct user_sdma_request *req,
+ 
+ 	npages -= node->npages;
+ retry:
+-	if (!hfi1_can_pin_pages(pq->dd, pq->mm,
++	if (!hfi1_can_pin_pages(pq->dd, current->mm,
+ 				atomic_read(&pq->n_locked), npages)) {
+ 		cleared = sdma_cache_evict(pq, npages);
+ 		if (cleared >= npages)
+ 			goto retry;
+ 	}
+-	pinned = hfi1_acquire_user_pages(pq->mm,
++	pinned = hfi1_acquire_user_pages(current->mm,
+ 					 ((unsigned long)iovec->iov.iov_base +
+ 					 (node->npages * PAGE_SIZE)), npages, 0,
+ 					 pages + node->npages);
+@@ -995,7 +995,7 @@ retry:
+ 		return pinned;
+ 	}
+ 	if (pinned != npages) {
+-		unpin_vector_pages(pq->mm, pages, node->npages, pinned);
++		unpin_vector_pages(current->mm, pages, node->npages, pinned);
+ 		return -EFAULT;
+ 	}
+ 	kfree(node->pages);
+@@ -1008,7 +1008,8 @@ retry:
+ static void unpin_sdma_pages(struct sdma_mmu_node *node)
+ {
+ 	if (node->npages) {
+-		unpin_vector_pages(node->pq->mm, node->pages, 0, node->npages);
++		unpin_vector_pages(mm_from_sdma_node(node), node->pages, 0,
++				   node->npages);
+ 		atomic_sub(node->npages, &node->pq->n_locked);
+ 	}
+ }
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h
+index 9972e0e6545e8..1e8c02fe8ad1d 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.h
++++ b/drivers/infiniband/hw/hfi1/user_sdma.h
+@@ -1,6 +1,7 @@
+ #ifndef _HFI1_USER_SDMA_H
+ #define _HFI1_USER_SDMA_H
+ /*
++ * Copyright(c) 2020 - Cornelis Networks, Inc.
+  * Copyright(c) 2015 - 2018 Intel Corporation.
+  *
+  * This file is provided under a dual BSD/GPLv2 license.  When using or
+@@ -133,7 +134,6 @@ struct hfi1_user_sdma_pkt_q {
+ 	unsigned long unpinned;
+ 	struct mmu_rb_handler *handler;
+ 	atomic_t n_locked;
+-	struct mm_struct *mm;
+ };
+ 
+ struct hfi1_user_sdma_comp_q {
+@@ -250,4 +250,9 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ 				   struct iovec *iovec, unsigned long dim,
+ 				   unsigned long *count);
+ 
++static inline struct mm_struct *mm_from_sdma_node(struct sdma_mmu_node *node)
++{
++	return node->rb.handler->mn.mm;
++}
++
+ #endif /* _HFI1_USER_SDMA_H */
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index cee140920c579..4c02839b7b418 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -2738,6 +2738,7 @@ static int hns_roce_v2_mw_write_mtpt(void *mb_buf, struct hns_roce_mw *mw)
+ 
+ 	roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_R_INV_EN_S, 1);
+ 	roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_L_INV_EN_S, 1);
++	roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_LW_EN_S, 1);
+ 
+ 	roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_PA_S, 0);
+ 	roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_MR_MW_S, 1);
+@@ -4771,11 +4772,11 @@ static int hns_roce_v2_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
+ 					      V2_QPC_BYTE_28_AT_M,
+ 					      V2_QPC_BYTE_28_AT_S);
+ 	qp_attr->retry_cnt = roce_get_field(context.byte_212_lsn,
+-					    V2_QPC_BYTE_212_RETRY_CNT_M,
+-					    V2_QPC_BYTE_212_RETRY_CNT_S);
++					    V2_QPC_BYTE_212_RETRY_NUM_INIT_M,
++					    V2_QPC_BYTE_212_RETRY_NUM_INIT_S);
+ 	qp_attr->rnr_retry = roce_get_field(context.byte_244_rnr_rxack,
+-					    V2_QPC_BYTE_244_RNR_CNT_M,
+-					    V2_QPC_BYTE_244_RNR_CNT_S);
++					    V2_QPC_BYTE_244_RNR_NUM_INIT_M,
++					    V2_QPC_BYTE_244_RNR_NUM_INIT_S);
+ 
+ done:
+ 	qp_attr->cur_qp_state = qp_attr->qp_state;
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+index 17f35f91f4ad2..9d27dfe86821b 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+@@ -1639,7 +1639,7 @@ struct hns_roce_query_pf_caps_d {
+ 	__le32 rsv_uars_rsv_qps;
+ };
+ #define V2_QUERY_PF_CAPS_D_NUM_SRQS_S 0
+-#define V2_QUERY_PF_CAPS_D_NUM_SRQS_M GENMASK(20, 0)
++#define V2_QUERY_PF_CAPS_D_NUM_SRQS_M GENMASK(19, 0)
+ 
+ #define V2_QUERY_PF_CAPS_D_RQWQE_HOP_NUM_S 20
+ #define V2_QUERY_PF_CAPS_D_RQWQE_HOP_NUM_M GENMASK(21, 20)
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
+index 58a433135a038..9023ad9c30182 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
+@@ -54,10 +54,6 @@
+ #define DRV_VERSION	__stringify(DRV_VERSION_MAJOR) "."		\
+ 	__stringify(DRV_VERSION_MINOR) "." __stringify(DRV_VERSION_BUILD)
+ 
+-static int push_mode;
+-module_param(push_mode, int, 0644);
+-MODULE_PARM_DESC(push_mode, "Low latency mode: 0=disabled (default), 1=enabled)");
+-
+ static int debug;
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "debug flags: 0=disabled (default), 0x7fffffff=all");
+@@ -1580,7 +1576,6 @@ static enum i40iw_status_code i40iw_setup_init_state(struct i40iw_handler *hdl,
+ 	if (status)
+ 		goto exit;
+ 	iwdev->obj_next = iwdev->obj_mem;
+-	iwdev->push_mode = push_mode;
+ 
+ 	init_waitqueue_head(&iwdev->vchnl_waitq);
+ 	init_waitqueue_head(&dev->vf_reqs);
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+index 09caad228aa4f..e40c505196645 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+@@ -167,39 +167,16 @@ static void i40iw_dealloc_ucontext(struct ib_ucontext *context)
+  */
+ static int i40iw_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
+ {
+-	struct i40iw_ucontext *ucontext;
+-	u64 db_addr_offset, push_offset, pfn;
+-
+-	ucontext = to_ucontext(context);
+-	if (ucontext->iwdev->sc_dev.is_pf) {
+-		db_addr_offset = I40IW_DB_ADDR_OFFSET;
+-		push_offset = I40IW_PUSH_OFFSET;
+-		if (vma->vm_pgoff)
+-			vma->vm_pgoff += I40IW_PF_FIRST_PUSH_PAGE_INDEX - 1;
+-	} else {
+-		db_addr_offset = I40IW_VF_DB_ADDR_OFFSET;
+-		push_offset = I40IW_VF_PUSH_OFFSET;
+-		if (vma->vm_pgoff)
+-			vma->vm_pgoff += I40IW_VF_FIRST_PUSH_PAGE_INDEX - 1;
+-	}
++	struct i40iw_ucontext *ucontext = to_ucontext(context);
++	u64 dbaddr;
+ 
+-	vma->vm_pgoff += db_addr_offset >> PAGE_SHIFT;
+-
+-	if (vma->vm_pgoff == (db_addr_offset >> PAGE_SHIFT)) {
+-		vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+-	} else {
+-		if ((vma->vm_pgoff - (push_offset >> PAGE_SHIFT)) % 2)
+-			vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+-		else
+-			vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+-	}
++	if (vma->vm_pgoff || vma->vm_end - vma->vm_start != PAGE_SIZE)
++		return -EINVAL;
+ 
+-	pfn = vma->vm_pgoff +
+-	      (pci_resource_start(ucontext->iwdev->ldev->pcidev, 0) >>
+-	       PAGE_SHIFT);
++	dbaddr = I40IW_DB_ADDR_OFFSET + pci_resource_start(ucontext->iwdev->ldev->pcidev, 0);
+ 
+-	return rdma_user_mmap_io(context, vma, pfn, PAGE_SIZE,
+-				 vma->vm_page_prot, NULL);
++	return rdma_user_mmap_io(context, vma, dbaddr >> PAGE_SHIFT, PAGE_SIZE,
++				 pgprot_noncached(vma->vm_page_prot), NULL);
+ }
+ 
+ /**
+diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
+index c3cfea243af8c..119b2573c9a08 100644
+--- a/drivers/infiniband/hw/mthca/mthca_cq.c
++++ b/drivers/infiniband/hw/mthca/mthca_cq.c
+@@ -803,8 +803,10 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
+ 	}
+ 
+ 	mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL);
+-	if (IS_ERR(mailbox))
++	if (IS_ERR(mailbox)) {
++		err = PTR_ERR(mailbox);
+ 		goto err_out_arm;
++	}
+ 
+ 	cq_context = mailbox->buf;
+ 
+@@ -846,9 +848,9 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
+ 	}
+ 
+ 	spin_lock_irq(&dev->cq_table.lock);
+-	if (mthca_array_set(&dev->cq_table.cq,
+-			    cq->cqn & (dev->limits.num_cqs - 1),
+-			    cq)) {
++	err = mthca_array_set(&dev->cq_table.cq,
++			      cq->cqn & (dev->limits.num_cqs - 1), cq);
++	if (err) {
+ 		spin_unlock_irq(&dev->cq_table.lock);
+ 		goto err_out_free_mr;
+ 	}
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index d3eda48032e39..944cbb519c6d7 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -122,6 +122,7 @@ module_param_named(unmask_kbd_data, i8042_unmask_kbd_data, bool, 0600);
+ MODULE_PARM_DESC(unmask_kbd_data, "Unconditional enable (may reveal sensitive data) of normally sanitize-filtered kbd data traffic debug log [pre-condition: i8042.debug=1 enabled]");
+ #endif
+ 
++static bool i8042_present;
+ static bool i8042_bypass_aux_irq_test;
+ static char i8042_kbd_firmware_id[128];
+ static char i8042_aux_firmware_id[128];
+@@ -343,6 +344,9 @@ int i8042_command(unsigned char *param, int command)
+ 	unsigned long flags;
+ 	int retval;
+ 
++	if (!i8042_present)
++		return -1;
++
+ 	spin_lock_irqsave(&i8042_lock, flags);
+ 	retval = __i8042_command(param, command);
+ 	spin_unlock_irqrestore(&i8042_lock, flags);
+@@ -1612,12 +1616,15 @@ static int __init i8042_init(void)
+ 
+ 	err = i8042_platform_init();
+ 	if (err)
+-		return err;
++		return (err == -ENODEV) ? 0 : err;
+ 
+ 	err = i8042_controller_check();
+ 	if (err)
+ 		goto err_platform_exit;
+ 
++	/* Set this before creating the dev to allow i8042_command to work right away */
++	i8042_present = true;
++
+ 	pdev = platform_create_bundle(&i8042_driver, i8042_probe, NULL, 0, NULL, 0);
+ 	if (IS_ERR(pdev)) {
+ 		err = PTR_ERR(pdev);
+@@ -1636,6 +1643,9 @@ static int __init i8042_init(void)
+ 
+ static void __exit i8042_exit(void)
+ {
++	if (!i8042_present)
++		return;
++
+ 	platform_device_unregister(i8042_platform_device);
+ 	platform_driver_unregister(&i8042_driver);
+ 	i8042_platform_exit();
+diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c
+index 93e6345f3414f..48cda86f43a2c 100644
+--- a/drivers/iommu/intel/dmar.c
++++ b/drivers/iommu/intel/dmar.c
+@@ -964,7 +964,8 @@ static int map_iommu(struct intel_iommu *iommu, u64 phys_addr)
+ 		warn_invalid_dmar(phys_addr, " returns all ones");
+ 		goto unmap;
+ 	}
+-	iommu->vccap = dmar_readq(iommu->reg + DMAR_VCCAP_REG);
++	if (ecap_vcs(iommu->ecap))
++		iommu->vccap = dmar_readq(iommu->reg + DMAR_VCCAP_REG);
+ 
+ 	/* the registers might be more than one page */
+ 	map_size = max_t(int, ecap_max_iotlb_offset(iommu->ecap),
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index f67b7e6ddf1bc..7e790655c1ab5 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -1798,7 +1798,7 @@ static void free_dmar_iommu(struct intel_iommu *iommu)
+ 		if (ecap_prs(iommu->ecap))
+ 			intel_svm_finish_prq(iommu);
+ 	}
+-	if (ecap_vcs(iommu->ecap) && vccap_pasid(iommu->vccap))
++	if (vccap_pasid(iommu->vccap))
+ 		ioasid_unregister_allocator(&iommu->pasid_allocator);
+ 
+ #endif
+@@ -3177,7 +3177,7 @@ static void register_pasid_allocator(struct intel_iommu *iommu)
+ 	 * is active. All vIOMMU allocators will eventually be calling the same
+ 	 * host allocator.
+ 	 */
+-	if (!ecap_vcs(iommu->ecap) || !vccap_pasid(iommu->vccap))
++	if (!vccap_pasid(iommu->vccap))
+ 		return;
+ 
+ 	pr_info("Register custom PASID allocator\n");
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 609bd25bf154b..6a0a79e3f5641 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -264,16 +264,18 @@ int iommu_probe_device(struct device *dev)
+ 	 */
+ 	iommu_alloc_default_domain(group, dev);
+ 
+-	if (group->default_domain)
++	if (group->default_domain) {
+ 		ret = __iommu_attach_device(group->default_domain, dev);
++		if (ret) {
++			iommu_group_put(group);
++			goto err_release;
++		}
++	}
+ 
+ 	iommu_create_device_direct_mappings(group, dev);
+ 
+ 	iommu_group_put(group);
+ 
+-	if (ret)
+-		goto err_release;
+-
+ 	if (ops->probe_finalize)
+ 		ops->probe_finalize(dev);
+ 
+diff --git a/drivers/irqchip/irq-sni-exiu.c b/drivers/irqchip/irq-sni-exiu.c
+index 1d027623c7760..abd011fcecf4a 100644
+--- a/drivers/irqchip/irq-sni-exiu.c
++++ b/drivers/irqchip/irq-sni-exiu.c
+@@ -136,7 +136,7 @@ static int exiu_domain_translate(struct irq_domain *domain,
+ 		if (fwspec->param_count != 2)
+ 			return -EINVAL;
+ 		*hwirq = fwspec->param[0];
+-		*type = fwspec->param[2] & IRQ_TYPE_SENSE_MASK;
++		*type = fwspec->param[1] & IRQ_TYPE_SENSE_MASK;
+ 	}
+ 	return 0;
+ }
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 84ecbc6fa0ff2..47afc5938c26b 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1460,7 +1460,39 @@ static void bond_upper_dev_unlink(struct bonding *bond, struct slave *slave)
+ 	slave->dev->flags &= ~IFF_SLAVE;
+ }
+ 
+-static struct slave *bond_alloc_slave(struct bonding *bond)
++static void slave_kobj_release(struct kobject *kobj)
++{
++	struct slave *slave = to_slave(kobj);
++	struct bonding *bond = bond_get_bond_by_slave(slave);
++
++	cancel_delayed_work_sync(&slave->notify_work);
++	if (BOND_MODE(bond) == BOND_MODE_8023AD)
++		kfree(SLAVE_AD_INFO(slave));
++
++	kfree(slave);
++}
++
++static struct kobj_type slave_ktype = {
++	.release = slave_kobj_release,
++#ifdef CONFIG_SYSFS
++	.sysfs_ops = &slave_sysfs_ops,
++#endif
++};
++
++static int bond_kobj_init(struct slave *slave)
++{
++	int err;
++
++	err = kobject_init_and_add(&slave->kobj, &slave_ktype,
++				   &(slave->dev->dev.kobj), "bonding_slave");
++	if (err)
++		kobject_put(&slave->kobj);
++
++	return err;
++}
++
++static struct slave *bond_alloc_slave(struct bonding *bond,
++				      struct net_device *slave_dev)
+ {
+ 	struct slave *slave = NULL;
+ 
+@@ -1468,11 +1500,17 @@ static struct slave *bond_alloc_slave(struct bonding *bond)
+ 	if (!slave)
+ 		return NULL;
+ 
++	slave->bond = bond;
++	slave->dev = slave_dev;
++
++	if (bond_kobj_init(slave))
++		return NULL;
++
+ 	if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+ 		SLAVE_AD_INFO(slave) = kzalloc(sizeof(struct ad_slave_info),
+ 					       GFP_KERNEL);
+ 		if (!SLAVE_AD_INFO(slave)) {
+-			kfree(slave);
++			kobject_put(&slave->kobj);
+ 			return NULL;
+ 		}
+ 	}
+@@ -1481,17 +1519,6 @@ static struct slave *bond_alloc_slave(struct bonding *bond)
+ 	return slave;
+ }
+ 
+-static void bond_free_slave(struct slave *slave)
+-{
+-	struct bonding *bond = bond_get_bond_by_slave(slave);
+-
+-	cancel_delayed_work_sync(&slave->notify_work);
+-	if (BOND_MODE(bond) == BOND_MODE_8023AD)
+-		kfree(SLAVE_AD_INFO(slave));
+-
+-	kfree(slave);
+-}
+-
+ static void bond_fill_ifbond(struct bonding *bond, struct ifbond *info)
+ {
+ 	info->bond_mode = BOND_MODE(bond);
+@@ -1678,14 +1705,12 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
+ 			goto err_undo_flags;
+ 	}
+ 
+-	new_slave = bond_alloc_slave(bond);
++	new_slave = bond_alloc_slave(bond, slave_dev);
+ 	if (!new_slave) {
+ 		res = -ENOMEM;
+ 		goto err_undo_flags;
+ 	}
+ 
+-	new_slave->bond = bond;
+-	new_slave->dev = slave_dev;
+ 	/* Set the new_slave's queue_id to be zero.  Queue ID mapping
+ 	 * is set via sysfs or module option if desired.
+ 	 */
+@@ -2007,7 +2032,7 @@ err_restore_mtu:
+ 	dev_set_mtu(slave_dev, new_slave->original_mtu);
+ 
+ err_free:
+-	bond_free_slave(new_slave);
++	kobject_put(&new_slave->kobj);
+ 
+ err_undo_flags:
+ 	/* Enslave of first slave has failed and we need to fix master's mac */
+@@ -2187,7 +2212,7 @@ static int __bond_release_one(struct net_device *bond_dev,
+ 	if (!netif_is_bond_master(slave_dev))
+ 		slave_dev->priv_flags &= ~IFF_BONDING;
+ 
+-	bond_free_slave(slave);
++	kobject_put(&slave->kobj);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c
+index 9b8346638f697..fd07561da0348 100644
+--- a/drivers/net/bonding/bond_sysfs_slave.c
++++ b/drivers/net/bonding/bond_sysfs_slave.c
+@@ -121,7 +121,6 @@ static const struct slave_attribute *slave_attrs[] = {
+ };
+ 
+ #define to_slave_attr(_at) container_of(_at, struct slave_attribute, attr)
+-#define to_slave(obj)	container_of(obj, struct slave, kobj)
+ 
+ static ssize_t slave_show(struct kobject *kobj,
+ 			  struct attribute *attr, char *buf)
+@@ -132,28 +131,15 @@ static ssize_t slave_show(struct kobject *kobj,
+ 	return slave_attr->show(slave, buf);
+ }
+ 
+-static const struct sysfs_ops slave_sysfs_ops = {
++const struct sysfs_ops slave_sysfs_ops = {
+ 	.show = slave_show,
+ };
+ 
+-static struct kobj_type slave_ktype = {
+-#ifdef CONFIG_SYSFS
+-	.sysfs_ops = &slave_sysfs_ops,
+-#endif
+-};
+-
+ int bond_sysfs_slave_add(struct slave *slave)
+ {
+ 	const struct slave_attribute **a;
+ 	int err;
+ 
+-	err = kobject_init_and_add(&slave->kobj, &slave_ktype,
+-				   &(slave->dev->dev.kobj), "bonding_slave");
+-	if (err) {
+-		kobject_put(&slave->kobj);
+-		return err;
+-	}
+-
+ 	for (a = slave_attrs; *a; ++a) {
+ 		err = sysfs_create_file(&slave->kobj, &((*a)->attr));
+ 		if (err) {
+@@ -171,6 +157,4 @@ void bond_sysfs_slave_del(struct slave *slave)
+ 
+ 	for (a = slave_attrs; *a; ++a)
+ 		sysfs_remove_file(&slave->kobj, &((*a)->attr));
+-
+-	kobject_put(&slave->kobj);
+ }
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index f3fc37e96b087..d4030abad935d 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1033,7 +1033,7 @@ static const struct can_bittiming_const m_can_bittiming_const_31X = {
+ 	.name = KBUILD_MODNAME,
+ 	.tseg1_min = 2,		/* Time segment 1 = prop_seg + phase_seg1 */
+ 	.tseg1_max = 256,
+-	.tseg2_min = 1,		/* Time segment 2 = phase_seg2 */
++	.tseg2_min = 2,		/* Time segment 2 = phase_seg2 */
+ 	.tseg2_max = 128,
+ 	.sjw_max = 128,
+ 	.brp_min = 1,
+@@ -1653,7 +1653,7 @@ static int m_can_open(struct net_device *dev)
+ 		INIT_WORK(&cdev->tx_work, m_can_tx_work_queue);
+ 
+ 		err = request_threaded_irq(dev->irq, NULL, m_can_isr,
+-					   IRQF_ONESHOT | IRQF_TRIGGER_FALLING,
++					   IRQF_ONESHOT,
+ 					   dev->name, dev);
+ 	} else {
+ 		err = request_irq(dev->irq, m_can_isr, IRQF_SHARED, dev->name,
+diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
+index a4b4b742c80c3..0ad13d78815c5 100644
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -63,21 +63,27 @@ enum gs_can_identify_mode {
+ };
+ 
+ /* data types passed between host and device */
++
++/* The firmware on the original USB2CAN by Geschwister Schneider
++ * Technologie Entwicklungs- und Vertriebs UG exchanges all data
++ * between the host and the device in host byte order. This is done
++ * with the struct gs_host_config::byte_order member, which is sent
++ * first to indicate the desired byte order.
++ *
++ * The widely used open source firmware candleLight doesn't support
++ * this feature and exchanges the data in little endian byte order.
++ */
+ struct gs_host_config {
+-	u32 byte_order;
++	__le32 byte_order;
+ } __packed;
+-/* All data exchanged between host and device is exchanged in host byte order,
+- * thanks to the struct gs_host_config byte_order member, which is sent first
+- * to indicate the desired byte order.
+- */
+ 
+ struct gs_device_config {
+ 	u8 reserved1;
+ 	u8 reserved2;
+ 	u8 reserved3;
+ 	u8 icount;
+-	u32 sw_version;
+-	u32 hw_version;
++	__le32 sw_version;
++	__le32 hw_version;
+ } __packed;
+ 
+ #define GS_CAN_MODE_NORMAL               0
+@@ -87,26 +93,26 @@ struct gs_device_config {
+ #define GS_CAN_MODE_ONE_SHOT             BIT(3)
+ 
+ struct gs_device_mode {
+-	u32 mode;
+-	u32 flags;
++	__le32 mode;
++	__le32 flags;
+ } __packed;
+ 
+ struct gs_device_state {
+-	u32 state;
+-	u32 rxerr;
+-	u32 txerr;
++	__le32 state;
++	__le32 rxerr;
++	__le32 txerr;
+ } __packed;
+ 
+ struct gs_device_bittiming {
+-	u32 prop_seg;
+-	u32 phase_seg1;
+-	u32 phase_seg2;
+-	u32 sjw;
+-	u32 brp;
++	__le32 prop_seg;
++	__le32 phase_seg1;
++	__le32 phase_seg2;
++	__le32 sjw;
++	__le32 brp;
+ } __packed;
+ 
+ struct gs_identify_mode {
+-	u32 mode;
++	__le32 mode;
+ } __packed;
+ 
+ #define GS_CAN_FEATURE_LISTEN_ONLY      BIT(0)
+@@ -117,23 +123,23 @@ struct gs_identify_mode {
+ #define GS_CAN_FEATURE_IDENTIFY         BIT(5)
+ 
+ struct gs_device_bt_const {
+-	u32 feature;
+-	u32 fclk_can;
+-	u32 tseg1_min;
+-	u32 tseg1_max;
+-	u32 tseg2_min;
+-	u32 tseg2_max;
+-	u32 sjw_max;
+-	u32 brp_min;
+-	u32 brp_max;
+-	u32 brp_inc;
++	__le32 feature;
++	__le32 fclk_can;
++	__le32 tseg1_min;
++	__le32 tseg1_max;
++	__le32 tseg2_min;
++	__le32 tseg2_max;
++	__le32 sjw_max;
++	__le32 brp_min;
++	__le32 brp_max;
++	__le32 brp_inc;
+ } __packed;
+ 
+ #define GS_CAN_FLAG_OVERFLOW 1
+ 
+ struct gs_host_frame {
+ 	u32 echo_id;
+-	u32 can_id;
++	__le32 can_id;
+ 
+ 	u8 can_dlc;
+ 	u8 channel;
+@@ -329,13 +335,13 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
+ 		if (!skb)
+ 			return;
+ 
+-		cf->can_id = hf->can_id;
++		cf->can_id = le32_to_cpu(hf->can_id);
+ 
+ 		cf->can_dlc = get_can_dlc(hf->can_dlc);
+ 		memcpy(cf->data, hf->data, 8);
+ 
+ 		/* ERROR frames tell us information about the controller */
+-		if (hf->can_id & CAN_ERR_FLAG)
++		if (le32_to_cpu(hf->can_id) & CAN_ERR_FLAG)
+ 			gs_update_state(dev, cf);
+ 
+ 		netdev->stats.rx_packets++;
+@@ -418,11 +424,11 @@ static int gs_usb_set_bittiming(struct net_device *netdev)
+ 	if (!dbt)
+ 		return -ENOMEM;
+ 
+-	dbt->prop_seg = bt->prop_seg;
+-	dbt->phase_seg1 = bt->phase_seg1;
+-	dbt->phase_seg2 = bt->phase_seg2;
+-	dbt->sjw = bt->sjw;
+-	dbt->brp = bt->brp;
++	dbt->prop_seg = cpu_to_le32(bt->prop_seg);
++	dbt->phase_seg1 = cpu_to_le32(bt->phase_seg1);
++	dbt->phase_seg2 = cpu_to_le32(bt->phase_seg2);
++	dbt->sjw = cpu_to_le32(bt->sjw);
++	dbt->brp = cpu_to_le32(bt->brp);
+ 
+ 	/* request bit timings */
+ 	rc = usb_control_msg(interface_to_usbdev(intf),
+@@ -503,7 +509,7 @@ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb,
+ 
+ 	cf = (struct can_frame *)skb->data;
+ 
+-	hf->can_id = cf->can_id;
++	hf->can_id = cpu_to_le32(cf->can_id);
+ 	hf->can_dlc = cf->can_dlc;
+ 	memcpy(hf->data, cf->data, cf->can_dlc);
+ 
+@@ -573,6 +579,7 @@ static int gs_can_open(struct net_device *netdev)
+ 	int rc, i;
+ 	struct gs_device_mode *dm;
+ 	u32 ctrlmode;
++	u32 flags = 0;
+ 
+ 	rc = open_candev(netdev);
+ 	if (rc)
+@@ -640,24 +647,24 @@ static int gs_can_open(struct net_device *netdev)
+ 
+ 	/* flags */
+ 	ctrlmode = dev->can.ctrlmode;
+-	dm->flags = 0;
+ 
+ 	if (ctrlmode & CAN_CTRLMODE_LOOPBACK)
+-		dm->flags |= GS_CAN_MODE_LOOP_BACK;
++		flags |= GS_CAN_MODE_LOOP_BACK;
+ 	else if (ctrlmode & CAN_CTRLMODE_LISTENONLY)
+-		dm->flags |= GS_CAN_MODE_LISTEN_ONLY;
++		flags |= GS_CAN_MODE_LISTEN_ONLY;
+ 
+ 	/* Controller is not allowed to retry TX
+ 	 * this mode is unavailable on atmels uc3c hardware
+ 	 */
+ 	if (ctrlmode & CAN_CTRLMODE_ONE_SHOT)
+-		dm->flags |= GS_CAN_MODE_ONE_SHOT;
++		flags |= GS_CAN_MODE_ONE_SHOT;
+ 
+ 	if (ctrlmode & CAN_CTRLMODE_3_SAMPLES)
+-		dm->flags |= GS_CAN_MODE_TRIPLE_SAMPLE;
++		flags |= GS_CAN_MODE_TRIPLE_SAMPLE;
+ 
+ 	/* finally start device */
+-	dm->mode = GS_CAN_MODE_START;
++	dm->mode = cpu_to_le32(GS_CAN_MODE_START);
++	dm->flags = cpu_to_le32(flags);
+ 	rc = usb_control_msg(interface_to_usbdev(dev->iface),
+ 			     usb_sndctrlpipe(interface_to_usbdev(dev->iface), 0),
+ 			     GS_USB_BREQ_MODE,
+@@ -737,9 +744,9 @@ static int gs_usb_set_identify(struct net_device *netdev, bool do_identify)
+ 		return -ENOMEM;
+ 
+ 	if (do_identify)
+-		imode->mode = GS_CAN_IDENTIFY_ON;
++		imode->mode = cpu_to_le32(GS_CAN_IDENTIFY_ON);
+ 	else
+-		imode->mode = GS_CAN_IDENTIFY_OFF;
++		imode->mode = cpu_to_le32(GS_CAN_IDENTIFY_OFF);
+ 
+ 	rc = usb_control_msg(interface_to_usbdev(dev->iface),
+ 			     usb_sndctrlpipe(interface_to_usbdev(dev->iface),
+@@ -790,6 +797,7 @@ static struct gs_can *gs_make_candev(unsigned int channel,
+ 	struct net_device *netdev;
+ 	int rc;
+ 	struct gs_device_bt_const *bt_const;
++	u32 feature;
+ 
+ 	bt_const = kmalloc(sizeof(*bt_const), GFP_KERNEL);
+ 	if (!bt_const)
+@@ -830,14 +838,14 @@ static struct gs_can *gs_make_candev(unsigned int channel,
+ 
+ 	/* dev settup */
+ 	strcpy(dev->bt_const.name, "gs_usb");
+-	dev->bt_const.tseg1_min = bt_const->tseg1_min;
+-	dev->bt_const.tseg1_max = bt_const->tseg1_max;
+-	dev->bt_const.tseg2_min = bt_const->tseg2_min;
+-	dev->bt_const.tseg2_max = bt_const->tseg2_max;
+-	dev->bt_const.sjw_max = bt_const->sjw_max;
+-	dev->bt_const.brp_min = bt_const->brp_min;
+-	dev->bt_const.brp_max = bt_const->brp_max;
+-	dev->bt_const.brp_inc = bt_const->brp_inc;
++	dev->bt_const.tseg1_min = le32_to_cpu(bt_const->tseg1_min);
++	dev->bt_const.tseg1_max = le32_to_cpu(bt_const->tseg1_max);
++	dev->bt_const.tseg2_min = le32_to_cpu(bt_const->tseg2_min);
++	dev->bt_const.tseg2_max = le32_to_cpu(bt_const->tseg2_max);
++	dev->bt_const.sjw_max = le32_to_cpu(bt_const->sjw_max);
++	dev->bt_const.brp_min = le32_to_cpu(bt_const->brp_min);
++	dev->bt_const.brp_max = le32_to_cpu(bt_const->brp_max);
++	dev->bt_const.brp_inc = le32_to_cpu(bt_const->brp_inc);
+ 
+ 	dev->udev = interface_to_usbdev(intf);
+ 	dev->iface = intf;
+@@ -854,28 +862,29 @@ static struct gs_can *gs_make_candev(unsigned int channel,
+ 
+ 	/* can settup */
+ 	dev->can.state = CAN_STATE_STOPPED;
+-	dev->can.clock.freq = bt_const->fclk_can;
++	dev->can.clock.freq = le32_to_cpu(bt_const->fclk_can);
+ 	dev->can.bittiming_const = &dev->bt_const;
+ 	dev->can.do_set_bittiming = gs_usb_set_bittiming;
+ 
+ 	dev->can.ctrlmode_supported = 0;
+ 
+-	if (bt_const->feature & GS_CAN_FEATURE_LISTEN_ONLY)
++	feature = le32_to_cpu(bt_const->feature);
++	if (feature & GS_CAN_FEATURE_LISTEN_ONLY)
+ 		dev->can.ctrlmode_supported |= CAN_CTRLMODE_LISTENONLY;
+ 
+-	if (bt_const->feature & GS_CAN_FEATURE_LOOP_BACK)
++	if (feature & GS_CAN_FEATURE_LOOP_BACK)
+ 		dev->can.ctrlmode_supported |= CAN_CTRLMODE_LOOPBACK;
+ 
+-	if (bt_const->feature & GS_CAN_FEATURE_TRIPLE_SAMPLE)
++	if (feature & GS_CAN_FEATURE_TRIPLE_SAMPLE)
+ 		dev->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
+ 
+-	if (bt_const->feature & GS_CAN_FEATURE_ONE_SHOT)
++	if (feature & GS_CAN_FEATURE_ONE_SHOT)
+ 		dev->can.ctrlmode_supported |= CAN_CTRLMODE_ONE_SHOT;
+ 
+ 	SET_NETDEV_DEV(netdev, &intf->dev);
+ 
+-	if (dconf->sw_version > 1)
+-		if (bt_const->feature & GS_CAN_FEATURE_IDENTIFY)
++	if (le32_to_cpu(dconf->sw_version) > 1)
++		if (feature & GS_CAN_FEATURE_IDENTIFY)
+ 			netdev->ethtool_ops = &gs_usb_ethtool_ops;
+ 
+ 	kfree(bt_const);
+@@ -910,7 +919,7 @@ static int gs_usb_probe(struct usb_interface *intf,
+ 	if (!hconf)
+ 		return -ENOMEM;
+ 
+-	hconf->byte_order = 0x0000beef;
++	hconf->byte_order = cpu_to_le32(0x0000beef);
+ 
+ 	/* send host config */
+ 	rc = usb_control_msg(interface_to_usbdev(intf),
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index f0dbc05e30a4d..16040b13579ef 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -2299,6 +2299,8 @@ static void mv88e6xxx_hardware_reset(struct mv88e6xxx_chip *chip)
+ 		usleep_range(10000, 20000);
+ 		gpiod_set_value_cansleep(gpiod, 0);
+ 		usleep_range(10000, 20000);
++
++		mv88e6xxx_g1_wait_eeprom_done(chip);
+ 	}
+ }
+ 
+diff --git a/drivers/net/dsa/mv88e6xxx/global1.c b/drivers/net/dsa/mv88e6xxx/global1.c
+index f62aa83ca08d4..33d443a37efc4 100644
+--- a/drivers/net/dsa/mv88e6xxx/global1.c
++++ b/drivers/net/dsa/mv88e6xxx/global1.c
+@@ -75,6 +75,37 @@ static int mv88e6xxx_g1_wait_init_ready(struct mv88e6xxx_chip *chip)
+ 	return mv88e6xxx_g1_wait_bit(chip, MV88E6XXX_G1_STS, bit, 1);
+ }
+ 
++void mv88e6xxx_g1_wait_eeprom_done(struct mv88e6xxx_chip *chip)
++{
++	const unsigned long timeout = jiffies + 1 * HZ;
++	u16 val;
++	int err;
++
++	/* Wait up to 1 second for the switch to finish reading the
++	 * EEPROM.
++	 */
++	while (time_before(jiffies, timeout)) {
++		err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_STS, &val);
++		if (err) {
++			dev_err(chip->dev, "Error reading status");
++			return;
++		}
++
++		/* If the switch is still resetting, it may not
++		 * respond on the bus, and so MDIO read returns
++		 * 0xffff. Differentiate between that, and waiting for
++		 * the EEPROM to be done by bit 0 being set.
++		 */
++		if (val != 0xffff &&
++		    val & BIT(MV88E6XXX_G1_STS_IRQ_EEPROM_DONE))
++			return;
++
++		usleep_range(1000, 2000);
++	}
++
++	dev_err(chip->dev, "Timeout waiting for EEPROM done");
++}
++
+ /* Offset 0x01: Switch MAC Address Register Bytes 0 & 1
+  * Offset 0x02: Switch MAC Address Register Bytes 2 & 3
+  * Offset 0x03: Switch MAC Address Register Bytes 4 & 5
+diff --git a/drivers/net/dsa/mv88e6xxx/global1.h b/drivers/net/dsa/mv88e6xxx/global1.h
+index 1e3546f8b0727..e05abe61fa114 100644
+--- a/drivers/net/dsa/mv88e6xxx/global1.h
++++ b/drivers/net/dsa/mv88e6xxx/global1.h
+@@ -278,6 +278,7 @@ int mv88e6xxx_g1_set_switch_mac(struct mv88e6xxx_chip *chip, u8 *addr);
+ int mv88e6185_g1_reset(struct mv88e6xxx_chip *chip);
+ int mv88e6352_g1_reset(struct mv88e6xxx_chip *chip);
+ int mv88e6250_g1_reset(struct mv88e6xxx_chip *chip);
++void mv88e6xxx_g1_wait_eeprom_done(struct mv88e6xxx_chip *chip);
+ 
+ int mv88e6185_g1_ppu_enable(struct mv88e6xxx_chip *chip);
+ int mv88e6185_g1_ppu_disable(struct mv88e6xxx_chip *chip);
+diff --git a/drivers/net/ethernet/amazon/ena/ena_eth_com.c b/drivers/net/ethernet/amazon/ena/ena_eth_com.c
+index ccd4405895651..336f115e8091f 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_eth_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_eth_com.c
+@@ -538,6 +538,7 @@ int ena_com_rx_pkt(struct ena_com_io_cq *io_cq,
+ {
+ 	struct ena_com_rx_buf_info *ena_buf = &ena_rx_ctx->ena_bufs[0];
+ 	struct ena_eth_io_rx_cdesc_base *cdesc = NULL;
++	u16 q_depth = io_cq->q_depth;
+ 	u16 cdesc_idx = 0;
+ 	u16 nb_hw_desc;
+ 	u16 i = 0;
+@@ -565,6 +566,8 @@ int ena_com_rx_pkt(struct ena_com_io_cq *io_cq,
+ 	do {
+ 		ena_buf[i].len = cdesc->length;
+ 		ena_buf[i].req_id = cdesc->req_id;
++		if (unlikely(ena_buf[i].req_id >= q_depth))
++			return -EIO;
+ 
+ 		if (++i >= nb_hw_desc)
+ 			break;
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index a3a8edf9a734d..36134fc3e9197 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -801,24 +801,6 @@ static void ena_free_all_io_tx_resources(struct ena_adapter *adapter)
+ 					      adapter->num_io_queues);
+ }
+ 
+-static int validate_rx_req_id(struct ena_ring *rx_ring, u16 req_id)
+-{
+-	if (likely(req_id < rx_ring->ring_size))
+-		return 0;
+-
+-	netif_err(rx_ring->adapter, rx_err, rx_ring->netdev,
+-		  "Invalid rx req_id: %hu\n", req_id);
+-
+-	u64_stats_update_begin(&rx_ring->syncp);
+-	rx_ring->rx_stats.bad_req_id++;
+-	u64_stats_update_end(&rx_ring->syncp);
+-
+-	/* Trigger device reset */
+-	rx_ring->adapter->reset_reason = ENA_REGS_RESET_INV_RX_REQ_ID;
+-	set_bit(ENA_FLAG_TRIGGER_RESET, &rx_ring->adapter->flags);
+-	return -EFAULT;
+-}
+-
+ /* ena_setup_rx_resources - allocate I/O Rx resources (Descriptors)
+  * @adapter: network interface device structure
+  * @qid: queue index
+@@ -938,10 +920,14 @@ static void ena_free_all_io_rx_resources(struct ena_adapter *adapter)
+ static int ena_alloc_rx_page(struct ena_ring *rx_ring,
+ 				    struct ena_rx_buffer *rx_info, gfp_t gfp)
+ {
++	int headroom = rx_ring->rx_headroom;
+ 	struct ena_com_buf *ena_buf;
+ 	struct page *page;
+ 	dma_addr_t dma;
+ 
++	/* restore page offset value in case it has been changed by device */
++	rx_info->page_offset = headroom;
++
+ 	/* if previous allocated page is not used */
+ 	if (unlikely(rx_info->page))
+ 		return 0;
+@@ -971,10 +957,9 @@ static int ena_alloc_rx_page(struct ena_ring *rx_ring,
+ 		  "alloc page %p, rx_info %p\n", page, rx_info);
+ 
+ 	rx_info->page = page;
+-	rx_info->page_offset = 0;
+ 	ena_buf = &rx_info->ena_buf;
+-	ena_buf->paddr = dma + rx_ring->rx_headroom;
+-	ena_buf->len = ENA_PAGE_SIZE - rx_ring->rx_headroom;
++	ena_buf->paddr = dma + headroom;
++	ena_buf->len = ENA_PAGE_SIZE - headroom;
+ 
+ 	return 0;
+ }
+@@ -1368,15 +1353,10 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring,
+ 	struct ena_rx_buffer *rx_info;
+ 	u16 len, req_id, buf = 0;
+ 	void *va;
+-	int rc;
+ 
+ 	len = ena_bufs[buf].len;
+ 	req_id = ena_bufs[buf].req_id;
+ 
+-	rc = validate_rx_req_id(rx_ring, req_id);
+-	if (unlikely(rc < 0))
+-		return NULL;
+-
+ 	rx_info = &rx_ring->rx_buffer_info[req_id];
+ 
+ 	if (unlikely(!rx_info->page)) {
+@@ -1391,7 +1371,8 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring,
+ 
+ 	/* save virt address of first buffer */
+ 	va = page_address(rx_info->page) + rx_info->page_offset;
+-	prefetch(va + NET_IP_ALIGN);
++
++	prefetch(va);
+ 
+ 	if (len <= rx_ring->rx_copybreak) {
+ 		skb = ena_alloc_skb(rx_ring, false);
+@@ -1432,8 +1413,6 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring,
+ 
+ 		skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, rx_info->page,
+ 				rx_info->page_offset, len, ENA_PAGE_SIZE);
+-		/* The offset is non zero only for the first buffer */
+-		rx_info->page_offset = 0;
+ 
+ 		netif_dbg(rx_ring->adapter, rx_status, rx_ring->netdev,
+ 			  "rx skb updated. len %d. data_len %d\n",
+@@ -1452,10 +1431,6 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring,
+ 		len = ena_bufs[buf].len;
+ 		req_id = ena_bufs[buf].req_id;
+ 
+-		rc = validate_rx_req_id(rx_ring, req_id);
+-		if (unlikely(rc < 0))
+-			return NULL;
+-
+ 		rx_info = &rx_ring->rx_buffer_info[req_id];
+ 	} while (1);
+ 
+@@ -1556,8 +1531,7 @@ static int ena_xdp_handle_buff(struct ena_ring *rx_ring, struct xdp_buff *xdp)
+ 	int ret;
+ 
+ 	rx_info = &rx_ring->rx_buffer_info[rx_ring->ena_bufs[0].req_id];
+-	xdp->data = page_address(rx_info->page) +
+-		rx_info->page_offset + rx_ring->rx_headroom;
++	xdp->data = page_address(rx_info->page) + rx_info->page_offset;
+ 	xdp_set_data_meta_invalid(xdp);
+ 	xdp->data_hard_start = page_address(rx_info->page);
+ 	xdp->data_end = xdp->data + rx_ring->ena_bufs[0].len;
+@@ -1624,8 +1598,9 @@ static int ena_clean_rx_irq(struct ena_ring *rx_ring, struct napi_struct *napi,
+ 		if (unlikely(ena_rx_ctx.descs == 0))
+ 			break;
+ 
++		/* First descriptor might have an offset set by the device */
+ 		rx_info = &rx_ring->rx_buffer_info[rx_ring->ena_bufs[0].req_id];
+-		rx_info->page_offset = ena_rx_ctx.pkt_offset;
++		rx_info->page_offset += ena_rx_ctx.pkt_offset;
+ 
+ 		netif_dbg(rx_ring->adapter, rx_status, rx_ring->netdev,
+ 			  "rx_poll: q %d got packet from ena. descs #: %d l3 proto %d l4 proto %d hash: %x\n",
+@@ -1704,12 +1679,18 @@ static int ena_clean_rx_irq(struct ena_ring *rx_ring, struct napi_struct *napi,
+ error:
+ 	adapter = netdev_priv(rx_ring->netdev);
+ 
+-	u64_stats_update_begin(&rx_ring->syncp);
+-	rx_ring->rx_stats.bad_desc_num++;
+-	u64_stats_update_end(&rx_ring->syncp);
++	if (rc == -ENOSPC) {
++		u64_stats_update_begin(&rx_ring->syncp);
++		rx_ring->rx_stats.bad_desc_num++;
++		u64_stats_update_end(&rx_ring->syncp);
++		adapter->reset_reason = ENA_REGS_RESET_TOO_MANY_RX_DESCS;
++	} else {
++		u64_stats_update_begin(&rx_ring->syncp);
++		rx_ring->rx_stats.bad_req_id++;
++		u64_stats_update_end(&rx_ring->syncp);
++		adapter->reset_reason = ENA_REGS_RESET_INV_RX_REQ_ID;
++	}
+ 
+-	/* Too many desc from the device. Trigger reset */
+-	adapter->reset_reason = ENA_REGS_RESET_TOO_MANY_RX_DESCS;
+ 	set_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
+ 
+ 	return 0;
+@@ -3378,16 +3359,9 @@ static int ena_device_init(struct ena_com_dev *ena_dev, struct pci_dev *pdev,
+ 		goto err_mmio_read_less;
+ 	}
+ 
+-	rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(dma_width));
++	rc = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(dma_width));
+ 	if (rc) {
+-		dev_err(dev, "pci_set_dma_mask failed 0x%x\n", rc);
+-		goto err_mmio_read_less;
+-	}
+-
+-	rc = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(dma_width));
+-	if (rc) {
+-		dev_err(dev, "err_pci_set_consistent_dma_mask failed 0x%x\n",
+-			rc);
++		dev_err(dev, "dma_set_mask_and_coherent failed %d\n", rc);
+ 		goto err_mmio_read_less;
+ 	}
+ 
+@@ -4157,6 +4131,12 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 		return rc;
+ 	}
+ 
++	rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(ENA_MAX_PHYS_ADDR_SIZE_BITS));
++	if (rc) {
++		dev_err(&pdev->dev, "dma_set_mask_and_coherent failed %d\n", rc);
++		goto err_disable_device;
++	}
++
+ 	pci_set_master(pdev);
+ 
+ 	ena_dev = vzalloc(sizeof(*ena_dev));
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+index 4f913658eea46..24122ccda614c 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+@@ -413,85 +413,63 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
+ 					      buff->rxdata.pg_off,
+ 					      buff->len, DMA_FROM_DEVICE);
+ 
+-		/* for single fragment packets use build_skb() */
+-		if (buff->is_eop &&
+-		    buff->len <= AQ_CFG_RX_FRAME_MAX - AQ_SKB_ALIGN) {
+-			skb = build_skb(aq_buf_vaddr(&buff->rxdata),
++		skb = napi_alloc_skb(napi, AQ_CFG_RX_HDR_SIZE);
++		if (unlikely(!skb)) {
++			u64_stats_update_begin(&self->stats.rx.syncp);
++			self->stats.rx.skb_alloc_fails++;
++			u64_stats_update_end(&self->stats.rx.syncp);
++			err = -ENOMEM;
++			goto err_exit;
++		}
++		if (is_ptp_ring)
++			buff->len -=
++				aq_ptp_extract_ts(self->aq_nic, skb,
++						  aq_buf_vaddr(&buff->rxdata),
++						  buff->len);
++
++		hdr_len = buff->len;
++		if (hdr_len > AQ_CFG_RX_HDR_SIZE)
++			hdr_len = eth_get_headlen(skb->dev,
++						  aq_buf_vaddr(&buff->rxdata),
++						  AQ_CFG_RX_HDR_SIZE);
++
++		memcpy(__skb_put(skb, hdr_len), aq_buf_vaddr(&buff->rxdata),
++		       ALIGN(hdr_len, sizeof(long)));
++
++		if (buff->len - hdr_len > 0) {
++			skb_add_rx_frag(skb, 0, buff->rxdata.page,
++					buff->rxdata.pg_off + hdr_len,
++					buff->len - hdr_len,
+ 					AQ_CFG_RX_FRAME_MAX);
+-			if (unlikely(!skb)) {
+-				u64_stats_update_begin(&self->stats.rx.syncp);
+-				self->stats.rx.skb_alloc_fails++;
+-				u64_stats_update_end(&self->stats.rx.syncp);
+-				err = -ENOMEM;
+-				goto err_exit;
+-			}
+-			if (is_ptp_ring)
+-				buff->len -=
+-					aq_ptp_extract_ts(self->aq_nic, skb,
+-						aq_buf_vaddr(&buff->rxdata),
+-						buff->len);
+-			skb_put(skb, buff->len);
+ 			page_ref_inc(buff->rxdata.page);
+-		} else {
+-			skb = napi_alloc_skb(napi, AQ_CFG_RX_HDR_SIZE);
+-			if (unlikely(!skb)) {
+-				u64_stats_update_begin(&self->stats.rx.syncp);
+-				self->stats.rx.skb_alloc_fails++;
+-				u64_stats_update_end(&self->stats.rx.syncp);
+-				err = -ENOMEM;
+-				goto err_exit;
+-			}
+-			if (is_ptp_ring)
+-				buff->len -=
+-					aq_ptp_extract_ts(self->aq_nic, skb,
+-						aq_buf_vaddr(&buff->rxdata),
+-						buff->len);
+-
+-			hdr_len = buff->len;
+-			if (hdr_len > AQ_CFG_RX_HDR_SIZE)
+-				hdr_len = eth_get_headlen(skb->dev,
+-							  aq_buf_vaddr(&buff->rxdata),
+-							  AQ_CFG_RX_HDR_SIZE);
+-
+-			memcpy(__skb_put(skb, hdr_len), aq_buf_vaddr(&buff->rxdata),
+-			       ALIGN(hdr_len, sizeof(long)));
+-
+-			if (buff->len - hdr_len > 0) {
+-				skb_add_rx_frag(skb, 0, buff->rxdata.page,
+-						buff->rxdata.pg_off + hdr_len,
+-						buff->len - hdr_len,
+-						AQ_CFG_RX_FRAME_MAX);
+-				page_ref_inc(buff->rxdata.page);
+-			}
++		}
+ 
+-			if (!buff->is_eop) {
+-				buff_ = buff;
+-				i = 1U;
+-				do {
+-					next_ = buff_->next,
+-					buff_ = &self->buff_ring[next_];
++		if (!buff->is_eop) {
++			buff_ = buff;
++			i = 1U;
++			do {
++				next_ = buff_->next;
++				buff_ = &self->buff_ring[next_];
+ 
+-					dma_sync_single_range_for_cpu(
+-							aq_nic_get_dev(self->aq_nic),
+-							buff_->rxdata.daddr,
+-							buff_->rxdata.pg_off,
+-							buff_->len,
+-							DMA_FROM_DEVICE);
+-					skb_add_rx_frag(skb, i++,
+-							buff_->rxdata.page,
+-							buff_->rxdata.pg_off,
+-							buff_->len,
+-							AQ_CFG_RX_FRAME_MAX);
+-					page_ref_inc(buff_->rxdata.page);
+-					buff_->is_cleaned = 1;
+-
+-					buff->is_ip_cso &= buff_->is_ip_cso;
+-					buff->is_udp_cso &= buff_->is_udp_cso;
+-					buff->is_tcp_cso &= buff_->is_tcp_cso;
+-					buff->is_cso_err |= buff_->is_cso_err;
++				dma_sync_single_range_for_cpu(aq_nic_get_dev(self->aq_nic),
++							      buff_->rxdata.daddr,
++							      buff_->rxdata.pg_off,
++							      buff_->len,
++							      DMA_FROM_DEVICE);
++				skb_add_rx_frag(skb, i++,
++						buff_->rxdata.page,
++						buff_->rxdata.pg_off,
++						buff_->len,
++						AQ_CFG_RX_FRAME_MAX);
++				page_ref_inc(buff_->rxdata.page);
++				buff_->is_cleaned = 1;
+ 
+-				} while (!buff_->is_eop);
+-			}
++				buff->is_ip_cso &= buff_->is_ip_cso;
++				buff->is_udp_cso &= buff_->is_udp_cso;
++				buff->is_tcp_cso &= buff_->is_tcp_cso;
++				buff->is_cso_err |= buff_->is_cso_err;
++
++			} while (!buff_->is_eop);
+ 		}
+ 
+ 		if (buff->is_vlan)
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 2326571e8c84a..50efdcf681083 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -11273,7 +11273,8 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev)
+ 	if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)) != 0 &&
+ 	    dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) {
+ 		dev_err(&pdev->dev, "System does not support DMA, aborting\n");
+-		goto init_err_disable;
++		rc = -EIO;
++		goto init_err_release;
+ 	}
+ 
+ 	pci_set_master(pdev);
+@@ -12353,6 +12354,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 				create_singlethread_workqueue("bnxt_pf_wq");
+ 			if (!bnxt_pf_wq) {
+ 				dev_err(&pdev->dev, "Unable to create workqueue.\n");
++				rc = -ENOMEM;
+ 				goto init_err_pci_clean;
+ 			}
+ 		}
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+index 8eb976106d0c8..7e7537eabf000 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+@@ -883,7 +883,8 @@ int set_filter_wr(struct adapter *adapter, int fidx)
+ 		 FW_FILTER_WR_OVLAN_VLD_V(f->fs.val.ovlan_vld) |
+ 		 FW_FILTER_WR_IVLAN_VLDM_V(f->fs.mask.ivlan_vld) |
+ 		 FW_FILTER_WR_OVLAN_VLDM_V(f->fs.mask.ovlan_vld));
+-	fwr->smac_sel = f->smt->idx;
++	if (f->fs.newsmac)
++		fwr->smac_sel = f->smt->idx;
+ 	fwr->rx_chan_rx_rpl_iq =
+ 		htons(FW_FILTER_WR_RX_CHAN_V(0) |
+ 		      FW_FILTER_WR_RX_RPL_IQ_V(adapter->sge.fw_evtq.abs_id));
+diff --git a/drivers/net/ethernet/freescale/dpaa2/Kconfig b/drivers/net/ethernet/freescale/dpaa2/Kconfig
+index feea797cde022..70aabd2343371 100644
+--- a/drivers/net/ethernet/freescale/dpaa2/Kconfig
++++ b/drivers/net/ethernet/freescale/dpaa2/Kconfig
+@@ -3,6 +3,7 @@ config FSL_DPAA2_ETH
+ 	tristate "Freescale DPAA2 Ethernet"
+ 	depends on FSL_MC_BUS && FSL_MC_DPIO
+ 	select PHYLINK
++	select FSL_XGMAC_MDIO
+ 	help
+ 	  This is the DPAA2 Ethernet driver supporting Freescale SoCs
+ 	  with DPAA2 (DataPath Acceleration Architecture v2).
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_qos.c b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
+index 1c4a535890dac..9a91e3568adbf 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_qos.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
+@@ -95,18 +95,8 @@ static int enetc_setup_taprio(struct net_device *ndev,
+ 	gcl_config->atc = 0xff;
+ 	gcl_config->acl_len = cpu_to_le16(gcl_len);
+ 
+-	if (!admin_conf->base_time) {
+-		gcl_data->btl =
+-			cpu_to_le32(enetc_rd(&priv->si->hw, ENETC_SICTR0));
+-		gcl_data->bth =
+-			cpu_to_le32(enetc_rd(&priv->si->hw, ENETC_SICTR1));
+-	} else {
+-		gcl_data->btl =
+-			cpu_to_le32(lower_32_bits(admin_conf->base_time));
+-		gcl_data->bth =
+-			cpu_to_le32(upper_32_bits(admin_conf->base_time));
+-	}
+-
++	gcl_data->btl = cpu_to_le32(lower_32_bits(admin_conf->base_time));
++	gcl_data->bth = cpu_to_le32(upper_32_bits(admin_conf->base_time));
+ 	gcl_data->ct = cpu_to_le32(admin_conf->cycle_time);
+ 	gcl_data->cte = cpu_to_le32(admin_conf->cycle_time_extension);
+ 
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index c6ee42278fdcf..81ec233926acb 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2087,8 +2087,11 @@ static int do_reset(struct ibmvnic_adapter *adapter,
+ 	for (i = 0; i < adapter->req_rx_queues; i++)
+ 		napi_schedule(&adapter->napi[i]);
+ 
+-	if (adapter->reset_reason != VNIC_RESET_FAILOVER)
++	if (adapter->reset_reason == VNIC_RESET_FAILOVER ||
++	    adapter->reset_reason == VNIC_RESET_MOBILITY) {
+ 		call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev);
++		call_netdevice_notifiers(NETDEV_RESEND_IGMP, netdev);
++	}
+ 
+ 	rc = 0;
+ 
+@@ -2158,6 +2161,9 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter,
+ 	if (rc)
+ 		return IBMVNIC_OPEN_FAILED;
+ 
++	call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev);
++	call_netdevice_notifiers(NETDEV_RESEND_IGMP, netdev);
++
+ 	return 0;
+ }
+ 
+@@ -2222,7 +2228,6 @@ static void __ibmvnic_reset(struct work_struct *work)
+ 
+ 		if (!saved_state) {
+ 			reset_state = adapter->state;
+-			adapter->state = VNIC_RESETTING;
+ 			saved_state = true;
+ 		}
+ 		spin_unlock_irqrestore(&adapter->state_lock, flags);
+@@ -2881,6 +2886,9 @@ static int reset_sub_crq_queues(struct ibmvnic_adapter *adapter)
+ {
+ 	int i, rc;
+ 
++	if (!adapter->tx_scrq || !adapter->rx_scrq)
++		return -EINVAL;
++
+ 	for (i = 0; i < adapter->req_tx_queues; i++) {
+ 		netdev_dbg(adapter->netdev, "Re-setting tx_scrq[%d]\n", i);
+ 		rc = reset_one_sub_crq_queue(adapter, adapter->tx_scrq[i]);
+@@ -4910,6 +4918,9 @@ static int ibmvnic_reset_crq(struct ibmvnic_adapter *adapter)
+ 	} while (rc == H_BUSY || H_IS_LONG_BUSY(rc));
+ 
+ 	/* Clean out the queue */
++	if (!crq->msgs)
++		return -EINVAL;
++
+ 	memset(crq->msgs, 0, PAGE_SIZE);
+ 	crq->cur = 0;
+ 	crq->active = false;
+@@ -5249,7 +5260,7 @@ static int ibmvnic_remove(struct vio_dev *dev)
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&adapter->state_lock, flags);
+-	if (adapter->state == VNIC_RESETTING) {
++	if (test_bit(0, &adapter->resetting)) {
+ 		spin_unlock_irqrestore(&adapter->state_lock, flags);
+ 		return -EBUSY;
+ 	}
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
+index 43feb96b0a68a..31d604fc7bde7 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.h
++++ b/drivers/net/ethernet/ibm/ibmvnic.h
+@@ -941,8 +941,7 @@ enum vnic_state {VNIC_PROBING = 1,
+ 		 VNIC_CLOSING,
+ 		 VNIC_CLOSED,
+ 		 VNIC_REMOVING,
+-		 VNIC_REMOVED,
+-		 VNIC_RESETTING};
++		 VNIC_REMOVED};
+ 
+ enum ibmvnic_reset_reason {VNIC_RESET_FAILOVER = 1,
+ 			   VNIC_RESET_MOBILITY,
+diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
+index a7e212d1caa22..6c1290137cbba 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e.h
++++ b/drivers/net/ethernet/intel/i40e/i40e.h
+@@ -140,6 +140,7 @@ enum i40e_state_t {
+ 	__I40E_CLIENT_RESET,
+ 	__I40E_VIRTCHNL_OP_PENDING,
+ 	__I40E_RECOVERY_MODE,
++	__I40E_VF_RESETS_DISABLED,	/* disable resets during i40e_remove */
+ 	/* This must be last as it determines the size of the BITMAP */
+ 	__I40E_STATE_SIZE__,
+ };
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 2e433fdbf2c36..da80dccad1dd3 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -4006,8 +4006,16 @@ static irqreturn_t i40e_intr(int irq, void *data)
+ 	}
+ 
+ 	if (icr0 & I40E_PFINT_ICR0_VFLR_MASK) {
+-		ena_mask &= ~I40E_PFINT_ICR0_ENA_VFLR_MASK;
+-		set_bit(__I40E_VFLR_EVENT_PENDING, pf->state);
++		/* disable any further VFLR event notifications */
++		if (test_bit(__I40E_VF_RESETS_DISABLED, pf->state)) {
++			u32 reg = rd32(hw, I40E_PFINT_ICR0_ENA);
++
++			reg &= ~I40E_PFINT_ICR0_VFLR_MASK;
++			wr32(hw, I40E_PFINT_ICR0_ENA, reg);
++		} else {
++			ena_mask &= ~I40E_PFINT_ICR0_ENA_VFLR_MASK;
++			set_bit(__I40E_VFLR_EVENT_PENDING, pf->state);
++		}
+ 	}
+ 
+ 	if (icr0 & I40E_PFINT_ICR0_GRST_MASK) {
+@@ -15466,6 +15474,11 @@ static void i40e_remove(struct pci_dev *pdev)
+ 	while (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state))
+ 		usleep_range(1000, 2000);
+ 
++	if (pf->flags & I40E_FLAG_SRIOV_ENABLED) {
++		set_bit(__I40E_VF_RESETS_DISABLED, pf->state);
++		i40e_free_vfs(pf);
++		pf->flags &= ~I40E_FLAG_SRIOV_ENABLED;
++	}
+ 	/* no more scheduling of any task */
+ 	set_bit(__I40E_SUSPENDED, pf->state);
+ 	set_bit(__I40E_DOWN, pf->state);
+@@ -15492,11 +15505,6 @@ static void i40e_remove(struct pci_dev *pdev)
+ 	 */
+ 	i40e_notify_client_of_netdev_close(pf->vsi[pf->lan_vsi], false);
+ 
+-	if (pf->flags & I40E_FLAG_SRIOV_ENABLED) {
+-		i40e_free_vfs(pf);
+-		pf->flags &= ~I40E_FLAG_SRIOV_ENABLED;
+-	}
+-
+ 	i40e_fdir_teardown(pf);
+ 
+ 	/* If there is a switch structure or any orphans, remove them.
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index 343177d71f70a..0d76b8c79f4da 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -1403,7 +1403,8 @@ static void i40e_cleanup_reset_vf(struct i40e_vf *vf)
+  * @vf: pointer to the VF structure
+  * @flr: VFLR was issued or not
+  *
+- * Returns true if the VF is reset, false otherwise.
++ * Returns true if the VF is in reset, resets successfully, or resets
++ * are disabled and false otherwise.
+  **/
+ bool i40e_reset_vf(struct i40e_vf *vf, bool flr)
+ {
+@@ -1413,11 +1414,14 @@ bool i40e_reset_vf(struct i40e_vf *vf, bool flr)
+ 	u32 reg;
+ 	int i;
+ 
++	if (test_bit(__I40E_VF_RESETS_DISABLED, pf->state))
++		return true;
++
+ 	/* If the VFs have been disabled, this means something else is
+ 	 * resetting the VF, so we shouldn't continue.
+ 	 */
+ 	if (test_and_set_bit(__I40E_VF_DISABLE, pf->state))
+-		return false;
++		return true;
+ 
+ 	i40e_trigger_vf_reset(vf, flr);
+ 
+@@ -1581,6 +1585,15 @@ void i40e_free_vfs(struct i40e_pf *pf)
+ 
+ 	i40e_notify_client_of_vf_enable(pf, 0);
+ 
++	/* Disable IOV before freeing resources. This lets any VF drivers
++	 * running in the host get themselves cleaned up before we yank
++	 * the carpet out from underneath their feet.
++	 */
++	if (!pci_vfs_assigned(pf->pdev))
++		pci_disable_sriov(pf->pdev);
++	else
++		dev_warn(&pf->pdev->dev, "VFs are assigned - not disabling SR-IOV\n");
++
+ 	/* Amortize wait time by stopping all VFs at the same time */
+ 	for (i = 0; i < pf->num_alloc_vfs; i++) {
+ 		if (test_bit(I40E_VF_STATE_INIT, &pf->vf[i].vf_states))
+@@ -1596,15 +1609,6 @@ void i40e_free_vfs(struct i40e_pf *pf)
+ 		i40e_vsi_wait_queues_disabled(pf->vsi[pf->vf[i].lan_vsi_idx]);
+ 	}
+ 
+-	/* Disable IOV before freeing resources. This lets any VF drivers
+-	 * running in the host get themselves cleaned up before we yank
+-	 * the carpet out from underneath their feet.
+-	 */
+-	if (!pci_vfs_assigned(pf->pdev))
+-		pci_disable_sriov(pf->pdev);
+-	else
+-		dev_warn(&pf->pdev->dev, "VFs are assigned - not disabling SR-IOV\n");
+-
+ 	/* free up VF resources */
+ 	tmp = pf->num_alloc_vfs;
+ 	pf->num_alloc_vfs = 0;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index ecd834e0e1216..72a5408a44d61 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -1160,7 +1160,6 @@ const struct stmmac_ops dwmac4_ops = {
+ 	.pcs_get_adv_lp = dwmac4_get_adv_lp,
+ 	.debug = dwmac4_debug,
+ 	.set_filter = dwmac4_set_filter,
+-	.flex_pps_config = dwmac5_flex_pps_config,
+ 	.set_mac_loopback = dwmac4_set_mac_loopback,
+ 	.update_vlan_hash = dwmac4_update_vlan_hash,
+ 	.sarc_configure = dwmac4_sarc_configure,
+@@ -1202,6 +1201,7 @@ const struct stmmac_ops dwmac410_ops = {
+ 	.pcs_get_adv_lp = dwmac4_get_adv_lp,
+ 	.debug = dwmac4_debug,
+ 	.set_filter = dwmac4_set_filter,
++	.flex_pps_config = dwmac5_flex_pps_config,
+ 	.set_mac_loopback = dwmac4_set_mac_loopback,
+ 	.update_vlan_hash = dwmac4_update_vlan_hash,
+ 	.sarc_configure = dwmac4_sarc_configure,
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c b/drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c
+index cb87d31a99dfb..57a53a600aa55 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c
+@@ -23,7 +23,7 @@ int dwmac_dma_reset(void __iomem *ioaddr)
+ 
+ 	return readl_poll_timeout(ioaddr + DMA_BUS_MODE, value,
+ 				 !(value & DMA_BUS_MODE_SFT_RESET),
+-				 10000, 100000);
++				 10000, 200000);
+ }
+ 
+ /* CSR1 enables the transmit DMA to check for new descriptor */
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h b/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h
+index a731f28e101a6..53b438d709dbe 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h
+@@ -8,7 +8,7 @@
+  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 - 2019 Intel Corporation
++ * Copyright(c) 2018 - 2020 Intel Corporation
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of version 2 of the GNU General Public License as
+@@ -31,7 +31,7 @@
+  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 - 2019 Intel Corporation
++ * Copyright(c) 2018 - 2020 Intel Corporation
+  * All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+@@ -421,12 +421,14 @@ struct iwl_hs20_roc_res {
+  *	able to run the GO Negotiation. Will not be fragmented and not
+  *	repetitive. Valid only on the P2P Device MAC. Only the duration will
+  *	be taken into account.
++ * @SESSION_PROTECT_CONF_MAX_ID: not used
+  */
+ enum iwl_mvm_session_prot_conf_id {
+ 	SESSION_PROTECT_CONF_ASSOC,
+ 	SESSION_PROTECT_CONF_GO_CLIENT_ASSOC,
+ 	SESSION_PROTECT_CONF_P2P_DEVICE_DISCOV,
+ 	SESSION_PROTECT_CONF_P2P_GO_NEGOTIATION,
++	SESSION_PROTECT_CONF_MAX_ID,
+ }; /* SESSION_PROTECTION_CONF_ID_E_VER_1 */
+ 
+ /**
+@@ -459,7 +461,7 @@ struct iwl_mvm_session_prot_cmd {
+  * @mac_id: the mac id for which the session protection started / ended
+  * @status: 1 means success, 0 means failure
+  * @start: 1 means the session protection started, 0 means it ended
+- * @conf_id: the configuration id of the session that started / eneded
++ * @conf_id: see &enum iwl_mvm_session_prot_conf_id
+  *
+  * Note that any session protection will always get two notifications: start
+  * and end even the firmware could not schedule it.
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index c918c0887ed01..34362dc0d4612 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -3104,6 +3104,9 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
+ 			goto out_unlock;
+ 		}
+ 
++		if (vif->type == NL80211_IFTYPE_STATION)
++			vif->bss_conf.he_support = sta->he_cap.has_he;
++
+ 		if (sta->tdls &&
+ 		    (vif->p2p ||
+ 		     iwl_mvm_tdls_sta_count(mvm, NULL) ==
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+index 1babc4bb5194b..6ca45e89a820c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+@@ -638,11 +638,32 @@ void iwl_mvm_protect_session(struct iwl_mvm *mvm,
+ 	}
+ }
+ 
++static void iwl_mvm_cancel_session_protection(struct iwl_mvm *mvm,
++					      struct iwl_mvm_vif *mvmvif)
++{
++	struct iwl_mvm_session_prot_cmd cmd = {
++		.id_and_color =
++			cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
++							mvmvif->color)),
++		.action = cpu_to_le32(FW_CTXT_ACTION_REMOVE),
++		.conf_id = cpu_to_le32(mvmvif->time_event_data.id),
++	};
++	int ret;
++
++	ret = iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(SESSION_PROTECTION_CMD,
++						   MAC_CONF_GROUP, 0),
++				   0, sizeof(cmd), &cmd);
++	if (ret)
++		IWL_ERR(mvm,
++			"Couldn't send the SESSION_PROTECTION_CMD: %d\n", ret);
++}
++
+ static bool __iwl_mvm_remove_time_event(struct iwl_mvm *mvm,
+ 					struct iwl_mvm_time_event_data *te_data,
+ 					u32 *uid)
+ {
+ 	u32 id;
++	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
+ 
+ 	/*
+ 	 * It is possible that by the time we got to this point the time
+@@ -660,14 +681,29 @@ static bool __iwl_mvm_remove_time_event(struct iwl_mvm *mvm,
+ 	iwl_mvm_te_clear_data(mvm, te_data);
+ 	spin_unlock_bh(&mvm->time_event_lock);
+ 
+-	/*
+-	 * It is possible that by the time we try to remove it, the time event
+-	 * has already ended and removed. In such a case there is no need to
+-	 * send a removal command.
++	/* When session protection is supported, the te_data->id field
++	 * is reused to save session protection's configuration.
+ 	 */
+-	if (id == TE_MAX) {
+-		IWL_DEBUG_TE(mvm, "TE 0x%x has already ended\n", *uid);
++	if (fw_has_capa(&mvm->fw->ucode_capa,
++			IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD)) {
++		if (mvmvif && id < SESSION_PROTECT_CONF_MAX_ID) {
++			/* Session protection is still ongoing. Cancel it */
++			iwl_mvm_cancel_session_protection(mvm, mvmvif);
++			if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
++				set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status);
++				iwl_mvm_roc_finished(mvm);
++			}
++		}
+ 		return false;
++	} else {
++		/* It is possible that by the time we try to remove it, the
++		 * time event has already ended and removed. In such a case
++		 * there is no need to send a removal command.
++		 */
++		if (id == TE_MAX) {
++			IWL_DEBUG_TE(mvm, "TE 0x%x has already ended\n", *uid);
++			return false;
++		}
+ 	}
+ 
+ 	return true;
+@@ -768,6 +804,7 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm,
+ 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
+ 	struct iwl_mvm_session_prot_notif *notif = (void *)pkt->data;
+ 	struct ieee80211_vif *vif;
++	struct iwl_mvm_vif *mvmvif;
+ 
+ 	rcu_read_lock();
+ 	vif = iwl_mvm_rcu_dereference_vif_id(mvm, le32_to_cpu(notif->mac_id),
+@@ -776,9 +813,10 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm,
+ 	if (!vif)
+ 		goto out_unlock;
+ 
++	mvmvif = iwl_mvm_vif_from_mac80211(vif);
++
+ 	/* The vif is not a P2P_DEVICE, maintain its time_event_data */
+ 	if (vif->type != NL80211_IFTYPE_P2P_DEVICE) {
+-		struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+ 		struct iwl_mvm_time_event_data *te_data =
+ 			&mvmvif->time_event_data;
+ 
+@@ -813,10 +851,14 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm,
+ 
+ 	if (!le32_to_cpu(notif->status) || !le32_to_cpu(notif->start)) {
+ 		/* End TE, notify mac80211 */
++		mvmvif->time_event_data.id = SESSION_PROTECT_CONF_MAX_ID;
+ 		ieee80211_remain_on_channel_expired(mvm->hw);
+ 		set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status);
+ 		iwl_mvm_roc_finished(mvm);
+ 	} else if (le32_to_cpu(notif->start)) {
++		if (WARN_ON(mvmvif->time_event_data.id !=
++				le32_to_cpu(notif->conf_id)))
++			goto out_unlock;
+ 		set_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status);
+ 		ieee80211_ready_on_channel(mvm->hw); /* Start TE */
+ 	}
+@@ -842,20 +884,24 @@ iwl_mvm_start_p2p_roc_session_protection(struct iwl_mvm *mvm,
+ 
+ 	lockdep_assert_held(&mvm->mutex);
+ 
++	/* The time_event_data.id field is reused to save session
++	 * protection's configuration.
++	 */
+ 	switch (type) {
+ 	case IEEE80211_ROC_TYPE_NORMAL:
+-		cmd.conf_id =
+-			cpu_to_le32(SESSION_PROTECT_CONF_P2P_DEVICE_DISCOV);
++		mvmvif->time_event_data.id =
++			SESSION_PROTECT_CONF_P2P_DEVICE_DISCOV;
+ 		break;
+ 	case IEEE80211_ROC_TYPE_MGMT_TX:
+-		cmd.conf_id =
+-			cpu_to_le32(SESSION_PROTECT_CONF_P2P_GO_NEGOTIATION);
++		mvmvif->time_event_data.id =
++			SESSION_PROTECT_CONF_P2P_GO_NEGOTIATION;
+ 		break;
+ 	default:
+ 		WARN_ONCE(1, "Got an invalid ROC type\n");
+ 		return -EINVAL;
+ 	}
+ 
++	cmd.conf_id = cpu_to_le32(mvmvif->time_event_data.id);
+ 	return iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(SESSION_PROTECTION_CMD,
+ 						    MAC_CONF_GROUP, 0),
+ 				    0, sizeof(cmd), &cmd);
+@@ -957,25 +1003,6 @@ void iwl_mvm_cleanup_roc_te(struct iwl_mvm *mvm)
+ 		__iwl_mvm_remove_time_event(mvm, te_data, &uid);
+ }
+ 
+-static void iwl_mvm_cancel_session_protection(struct iwl_mvm *mvm,
+-					      struct iwl_mvm_vif *mvmvif)
+-{
+-	struct iwl_mvm_session_prot_cmd cmd = {
+-		.id_and_color =
+-			cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
+-							mvmvif->color)),
+-		.action = cpu_to_le32(FW_CTXT_ACTION_REMOVE),
+-	};
+-	int ret;
+-
+-	ret = iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(SESSION_PROTECTION_CMD,
+-						   MAC_CONF_GROUP, 0),
+-				   0, sizeof(cmd), &cmd);
+-	if (ret)
+-		IWL_ERR(mvm,
+-			"Couldn't send the SESSION_PROTECTION_CMD: %d\n", ret);
+-}
+-
+ void iwl_mvm_stop_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+ {
+ 	struct iwl_mvm_vif *mvmvif;
+@@ -985,10 +1012,13 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+ 			IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD)) {
+ 		mvmvif = iwl_mvm_vif_from_mac80211(vif);
+ 
+-		iwl_mvm_cancel_session_protection(mvm, mvmvif);
+-
+-		if (vif->type == NL80211_IFTYPE_P2P_DEVICE)
++		if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
++			iwl_mvm_cancel_session_protection(mvm, mvmvif);
+ 			set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status);
++		} else {
++			iwl_mvm_remove_aux_roc_te(mvm, mvmvif,
++						  &mvmvif->time_event_data);
++		}
+ 
+ 		iwl_mvm_roc_finished(mvm);
+ 
+@@ -1101,10 +1131,15 @@ void iwl_mvm_schedule_session_protection(struct iwl_mvm *mvm,
+ 			cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
+ 							mvmvif->color)),
+ 		.action = cpu_to_le32(FW_CTXT_ACTION_ADD),
+-		.conf_id = cpu_to_le32(SESSION_PROTECT_CONF_ASSOC),
+ 		.duration_tu = cpu_to_le32(MSEC_TO_TU(duration)),
+ 	};
+ 
++	/* The time_event_data.id field is reused to save session
++	 * protection's configuration.
++	 */
++	mvmvif->time_event_data.id = SESSION_PROTECT_CONF_ASSOC;
++	cmd.conf_id = cpu_to_le32(mvmvif->time_event_data.id);
++
+ 	lockdep_assert_held(&mvm->mutex);
+ 
+ 	spin_lock_bh(&mvm->time_event_lock);
+diff --git a/drivers/nfc/s3fwrn5/i2c.c b/drivers/nfc/s3fwrn5/i2c.c
+index b4eb926d220ac..d7ecff0b1c662 100644
+--- a/drivers/nfc/s3fwrn5/i2c.c
++++ b/drivers/nfc/s3fwrn5/i2c.c
+@@ -26,8 +26,8 @@ struct s3fwrn5_i2c_phy {
+ 	struct i2c_client *i2c_dev;
+ 	struct nci_dev *ndev;
+ 
+-	unsigned int gpio_en;
+-	unsigned int gpio_fw_wake;
++	int gpio_en;
++	int gpio_fw_wake;
+ 
+ 	struct mutex mutex;
+ 
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index a6af96aaa0eb7..3448f7ac209a0 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -292,9 +292,21 @@ static void nvme_dbbuf_init(struct nvme_dev *dev,
+ 	nvmeq->dbbuf_cq_ei = &dev->dbbuf_eis[cq_idx(qid, dev->db_stride)];
+ }
+ 
++static void nvme_dbbuf_free(struct nvme_queue *nvmeq)
++{
++	if (!nvmeq->qid)
++		return;
++
++	nvmeq->dbbuf_sq_db = NULL;
++	nvmeq->dbbuf_cq_db = NULL;
++	nvmeq->dbbuf_sq_ei = NULL;
++	nvmeq->dbbuf_cq_ei = NULL;
++}
++
+ static void nvme_dbbuf_set(struct nvme_dev *dev)
+ {
+ 	struct nvme_command c;
++	unsigned int i;
+ 
+ 	if (!dev->dbbuf_dbs)
+ 		return;
+@@ -308,6 +320,9 @@ static void nvme_dbbuf_set(struct nvme_dev *dev)
+ 		dev_warn(dev->ctrl.device, "unable to set dbbuf\n");
+ 		/* Free memory and continue on */
+ 		nvme_dbbuf_dma_free(dev);
++
++		for (i = 1; i <= dev->online_queues; i++)
++			nvme_dbbuf_free(&dev->queues[i]);
+ 	}
+ }
+ 
+diff --git a/drivers/phy/qualcomm/Kconfig b/drivers/phy/qualcomm/Kconfig
+index 928db510b86c6..7f6fcb8ec5bab 100644
+--- a/drivers/phy/qualcomm/Kconfig
++++ b/drivers/phy/qualcomm/Kconfig
+@@ -87,7 +87,7 @@ config PHY_QCOM_USB_HSIC
+ 
+ config PHY_QCOM_USB_HS_28NM
+ 	tristate "Qualcomm 28nm High-Speed PHY"
+-	depends on ARCH_QCOM || COMPILE_TEST
++	depends on OF && (ARCH_QCOM || COMPILE_TEST)
+ 	depends on EXTCON || !EXTCON # if EXTCON=m, this cannot be built-in
+ 	select GENERIC_PHY
+ 	help
+@@ -98,7 +98,7 @@ config PHY_QCOM_USB_HS_28NM
+ 
+ config PHY_QCOM_USB_SS
+ 	tristate "Qualcomm USB Super-Speed PHY driver"
+-	depends on ARCH_QCOM || COMPILE_TEST
++	depends on OF && (ARCH_QCOM || COMPILE_TEST)
+ 	depends on EXTCON || !EXTCON # if EXTCON=m, this cannot be built-in
+ 	select GENERIC_PHY
+ 	help
+diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
+index de4a46fe17630..ad88d74c18842 100644
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -1242,6 +1242,7 @@ power_down:
+ reset:
+ 	reset_control_assert(padctl->rst);
+ remove:
++	platform_set_drvdata(pdev, NULL);
+ 	soc->ops->remove(padctl);
+ 	return err;
+ }
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index eae3579f106f3..017f090a90f68 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -4220,6 +4220,7 @@ static void hotkey_resume(void)
+ 		pr_err("error while attempting to reset the event firmware interface\n");
+ 
+ 	tpacpi_send_radiosw_update();
++	tpacpi_input_send_tabletsw();
+ 	hotkey_tablet_mode_notify_change();
+ 	hotkey_wakeup_reason_notify_change();
+ 	hotkey_wakeup_hotunplug_complete_notify_change();
+diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
+index e557d757c6470..fa7232ad8c395 100644
+--- a/drivers/platform/x86/toshiba_acpi.c
++++ b/drivers/platform/x86/toshiba_acpi.c
+@@ -1478,7 +1478,7 @@ static ssize_t video_proc_write(struct file *file, const char __user *buf,
+ 	struct toshiba_acpi_dev *dev = PDE_DATA(file_inode(file));
+ 	char *buffer;
+ 	char *cmd;
+-	int lcd_out, crt_out, tv_out;
++	int lcd_out = -1, crt_out = -1, tv_out = -1;
+ 	int remain = count;
+ 	int value;
+ 	int ret;
+@@ -1510,7 +1510,6 @@ static ssize_t video_proc_write(struct file *file, const char __user *buf,
+ 
+ 	kfree(cmd);
+ 
+-	lcd_out = crt_out = tv_out = -1;
+ 	ret = get_video_status(dev, &video_out);
+ 	if (!ret) {
+ 		unsigned int new_video_out = video_out;
+diff --git a/drivers/ptp/ptp_clockmatrix.c b/drivers/ptp/ptp_clockmatrix.c
+index e020faff7da53..663255774c0b0 100644
+--- a/drivers/ptp/ptp_clockmatrix.c
++++ b/drivers/ptp/ptp_clockmatrix.c
+@@ -103,43 +103,26 @@ static int timespec_to_char_array(struct timespec64 const *ts,
+ 	return 0;
+ }
+ 
+-static int idtcm_strverscmp(const char *ver1, const char *ver2)
++static int idtcm_strverscmp(const char *version1, const char *version2)
+ {
+-	u8 num1;
+-	u8 num2;
+-	int result = 0;
+-
+-	/* loop through each level of the version string */
+-	while (result == 0) {
+-		/* extract leading version numbers */
+-		if (kstrtou8(ver1, 10, &num1) < 0)
+-			return -1;
++	u8 ver1[3], ver2[3];
++	int i;
+ 
+-		if (kstrtou8(ver2, 10, &num2) < 0)
+-			return -1;
++	if (sscanf(version1, "%hhu.%hhu.%hhu",
++		   &ver1[0], &ver1[1], &ver1[2]) != 3)
++		return -1;
++	if (sscanf(version2, "%hhu.%hhu.%hhu",
++		   &ver2[0], &ver2[1], &ver2[2]) != 3)
++		return -1;
+ 
+-		/* if numbers differ, then set the result */
+-		if (num1 < num2)
+-			result = -1;
+-		else if (num1 > num2)
+-			result = 1;
+-		else {
+-			/* if numbers are the same, go to next level */
+-			ver1 = strchr(ver1, '.');
+-			ver2 = strchr(ver2, '.');
+-			if (!ver1 && !ver2)
+-				break;
+-			else if (!ver1)
+-				result = -1;
+-			else if (!ver2)
+-				result = 1;
+-			else {
+-				ver1++;
+-				ver2++;
+-			}
+-		}
++	for (i = 0; i < 3; i++) {
++		if (ver1[i] > ver2[i])
++			return 1;
++		if (ver1[i] < ver2[i])
++			return -1;
+ 	}
+-	return result;
++
++	return 0;
+ }
+ 
+ static int idtcm_xfer_read(struct idtcm *idtcm,
+diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
+index ed6316992cbb8..07a5630ec841f 100644
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -559,7 +559,7 @@ static int pcf2127_probe(struct device *dev, struct regmap *regmap,
+ 	pcf2127->rtc->set_start_time = true; /* Sets actual start to 1970 */
+ 	pcf2127->rtc->uie_unsupported = 1;
+ 
+-	if (alarm_irq >= 0) {
++	if (alarm_irq > 0) {
+ 		ret = devm_request_threaded_irq(dev, alarm_irq, NULL,
+ 						pcf2127_rtc_irq,
+ 						IRQF_TRIGGER_LOW | IRQF_ONESHOT,
+@@ -570,7 +570,7 @@ static int pcf2127_probe(struct device *dev, struct regmap *regmap,
+ 		}
+ 	}
+ 
+-	if (alarm_irq >= 0 || device_property_read_bool(dev, "wakeup-source")) {
++	if (alarm_irq > 0 || device_property_read_bool(dev, "wakeup-source")) {
+ 		device_init_wakeup(dev, true);
+ 		pcf2127->rtc->ops = &pcf2127_rtc_alrm_ops;
+ 	}
+diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
+index 6b5cf9ba03e5b..757d6ba817ee1 100644
+--- a/drivers/s390/net/qeth_core.h
++++ b/drivers/s390/net/qeth_core.h
+@@ -397,10 +397,13 @@ enum qeth_qdio_out_buffer_state {
+ 	QETH_QDIO_BUF_EMPTY,
+ 	/* Filled by driver; owned by hardware in order to be sent. */
+ 	QETH_QDIO_BUF_PRIMED,
+-	/* Identified to be pending in TPQ. */
++	/* Discovered by the TX completion code: */
+ 	QETH_QDIO_BUF_PENDING,
+-	/* Found in completion queue. */
+-	QETH_QDIO_BUF_IN_CQ,
++	/* Finished by the TX completion code: */
++	QETH_QDIO_BUF_NEED_QAOB,
++	/* Received QAOB notification on CQ: */
++	QETH_QDIO_BUF_QAOB_OK,
++	QETH_QDIO_BUF_QAOB_ERROR,
+ 	/* Handled via transfer pending / completion queue. */
+ 	QETH_QDIO_BUF_HANDLED_DELAYED,
+ };
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 6a73982514237..e3666232a19a8 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -32,6 +32,7 @@
+ 
+ #include <net/iucv/af_iucv.h>
+ #include <net/dsfield.h>
++#include <net/sock.h>
+ 
+ #include <asm/ebcdic.h>
+ #include <asm/chpid.h>
+@@ -500,18 +501,13 @@ static void qeth_cleanup_handled_pending(struct qeth_qdio_out_q *q, int bidx,
+ 
+ 		}
+ 	}
+-	if (forced_cleanup && (atomic_read(&(q->bufs[bidx]->state)) ==
+-					QETH_QDIO_BUF_HANDLED_DELAYED)) {
+-		/* for recovery situations */
+-		qeth_init_qdio_out_buf(q, bidx);
+-		QETH_CARD_TEXT(q->card, 2, "clprecov");
+-	}
+ }
+ 
+ 
+ static void qeth_qdio_handle_aob(struct qeth_card *card,
+ 				 unsigned long phys_aob_addr)
+ {
++	enum qeth_qdio_out_buffer_state new_state = QETH_QDIO_BUF_QAOB_OK;
+ 	struct qaob *aob;
+ 	struct qeth_qdio_out_buffer *buffer;
+ 	enum iucv_tx_notify notification;
+@@ -523,22 +519,6 @@ static void qeth_qdio_handle_aob(struct qeth_card *card,
+ 	buffer = (struct qeth_qdio_out_buffer *) aob->user1;
+ 	QETH_CARD_TEXT_(card, 5, "%lx", aob->user1);
+ 
+-	if (atomic_cmpxchg(&buffer->state, QETH_QDIO_BUF_PRIMED,
+-			   QETH_QDIO_BUF_IN_CQ) == QETH_QDIO_BUF_PRIMED) {
+-		notification = TX_NOTIFY_OK;
+-	} else {
+-		WARN_ON_ONCE(atomic_read(&buffer->state) !=
+-							QETH_QDIO_BUF_PENDING);
+-		atomic_set(&buffer->state, QETH_QDIO_BUF_IN_CQ);
+-		notification = TX_NOTIFY_DELAYED_OK;
+-	}
+-
+-	if (aob->aorc != 0)  {
+-		QETH_CARD_TEXT_(card, 2, "aorc%02X", aob->aorc);
+-		notification = qeth_compute_cq_notification(aob->aorc, 1);
+-	}
+-	qeth_notify_skbs(buffer->q, buffer, notification);
+-
+ 	/* Free dangling allocations. The attached skbs are handled by
+ 	 * qeth_cleanup_handled_pending().
+ 	 */
+@@ -550,7 +530,33 @@ static void qeth_qdio_handle_aob(struct qeth_card *card,
+ 		if (data && buffer->is_header[i])
+ 			kmem_cache_free(qeth_core_header_cache, data);
+ 	}
+-	atomic_set(&buffer->state, QETH_QDIO_BUF_HANDLED_DELAYED);
++
++	if (aob->aorc) {
++		QETH_CARD_TEXT_(card, 2, "aorc%02X", aob->aorc);
++		new_state = QETH_QDIO_BUF_QAOB_ERROR;
++	}
++
++	switch (atomic_xchg(&buffer->state, new_state)) {
++	case QETH_QDIO_BUF_PRIMED:
++		/* Faster than TX completion code. */
++		notification = qeth_compute_cq_notification(aob->aorc, 0);
++		qeth_notify_skbs(buffer->q, buffer, notification);
++		atomic_set(&buffer->state, QETH_QDIO_BUF_HANDLED_DELAYED);
++		break;
++	case QETH_QDIO_BUF_PENDING:
++		/* TX completion code is active and will handle the async
++		 * completion for us.
++		 */
++		break;
++	case QETH_QDIO_BUF_NEED_QAOB:
++		/* TX completion code is already finished. */
++		notification = qeth_compute_cq_notification(aob->aorc, 1);
++		qeth_notify_skbs(buffer->q, buffer, notification);
++		atomic_set(&buffer->state, QETH_QDIO_BUF_HANDLED_DELAYED);
++		break;
++	default:
++		WARN_ON_ONCE(1);
++	}
+ 
+ 	qdio_release_aob(aob);
+ }
+@@ -1408,7 +1414,7 @@ static void qeth_notify_skbs(struct qeth_qdio_out_q *q,
+ 	skb_queue_walk(&buf->skb_list, skb) {
+ 		QETH_CARD_TEXT_(q->card, 5, "skbn%d", notification);
+ 		QETH_CARD_TEXT_(q->card, 5, "%lx", (long) skb);
+-		if (skb->protocol == htons(ETH_P_AF_IUCV) && skb->sk)
++		if (skb->sk && skb->sk->sk_family == PF_IUCV)
+ 			iucv_sk(skb->sk)->sk_txnotify(skb, notification);
+ 	}
+ }
+@@ -1419,9 +1425,6 @@ static void qeth_tx_complete_buf(struct qeth_qdio_out_buffer *buf, bool error,
+ 	struct qeth_qdio_out_q *queue = buf->q;
+ 	struct sk_buff *skb;
+ 
+-	/* release may never happen from within CQ tasklet scope */
+-	WARN_ON_ONCE(atomic_read(&buf->state) == QETH_QDIO_BUF_IN_CQ);
+-
+ 	if (atomic_read(&buf->state) == QETH_QDIO_BUF_PENDING)
+ 		qeth_notify_skbs(queue, buf, TX_NOTIFY_GENERALERROR);
+ 
+@@ -5846,9 +5849,32 @@ static void qeth_iqd_tx_complete(struct qeth_qdio_out_q *queue,
+ 
+ 		if (atomic_cmpxchg(&buffer->state, QETH_QDIO_BUF_PRIMED,
+ 						   QETH_QDIO_BUF_PENDING) ==
+-		    QETH_QDIO_BUF_PRIMED)
++		    QETH_QDIO_BUF_PRIMED) {
+ 			qeth_notify_skbs(queue, buffer, TX_NOTIFY_PENDING);
+ 
++			/* Handle race with qeth_qdio_handle_aob(): */
++			switch (atomic_xchg(&buffer->state,
++					    QETH_QDIO_BUF_NEED_QAOB)) {
++			case QETH_QDIO_BUF_PENDING:
++				/* No concurrent QAOB notification. */
++				break;
++			case QETH_QDIO_BUF_QAOB_OK:
++				qeth_notify_skbs(queue, buffer,
++						 TX_NOTIFY_DELAYED_OK);
++				atomic_set(&buffer->state,
++					   QETH_QDIO_BUF_HANDLED_DELAYED);
++				break;
++			case QETH_QDIO_BUF_QAOB_ERROR:
++				qeth_notify_skbs(queue, buffer,
++						 TX_NOTIFY_DELAYED_GENERALERROR);
++				atomic_set(&buffer->state,
++					   QETH_QDIO_BUF_HANDLED_DELAYED);
++				break;
++			default:
++				WARN_ON_ONCE(1);
++			}
++		}
++
+ 		QETH_CARD_TEXT_(card, 5, "pel%u", bidx);
+ 
+ 		/* prepare the queue slot for re-use: */
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 1e9c3171fa9f4..f9314f1393fbd 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -533,8 +533,8 @@ static void iscsi_complete_task(struct iscsi_task *task, int state)
+ 	if (conn->task == task)
+ 		conn->task = NULL;
+ 
+-	if (conn->ping_task == task)
+-		conn->ping_task = NULL;
++	if (READ_ONCE(conn->ping_task) == task)
++		WRITE_ONCE(conn->ping_task, NULL);
+ 
+ 	/* release get from queueing */
+ 	__iscsi_put_task(task);
+@@ -738,6 +738,9 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
+ 						   task->conn->session->age);
+ 	}
+ 
++	if (unlikely(READ_ONCE(conn->ping_task) == INVALID_SCSI_TASK))
++		WRITE_ONCE(conn->ping_task, task);
++
+ 	if (!ihost->workq) {
+ 		if (iscsi_prep_mgmt_task(conn, task))
+ 			goto free_task;
+@@ -941,8 +944,11 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
+         struct iscsi_nopout hdr;
+ 	struct iscsi_task *task;
+ 
+-	if (!rhdr && conn->ping_task)
+-		return -EINVAL;
++	if (!rhdr) {
++		if (READ_ONCE(conn->ping_task))
++			return -EINVAL;
++		WRITE_ONCE(conn->ping_task, INVALID_SCSI_TASK);
++	}
+ 
+ 	memset(&hdr, 0, sizeof(struct iscsi_nopout));
+ 	hdr.opcode = ISCSI_OP_NOOP_OUT | ISCSI_OP_IMMEDIATE;
+@@ -957,11 +963,12 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
+ 
+ 	task = __iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)&hdr, NULL, 0);
+ 	if (!task) {
++		if (!rhdr)
++			WRITE_ONCE(conn->ping_task, NULL);
+ 		iscsi_conn_printk(KERN_ERR, conn, "Could not send nopout\n");
+ 		return -EIO;
+ 	} else if (!rhdr) {
+ 		/* only track our nops */
+-		conn->ping_task = task;
+ 		conn->last_ping = jiffies;
+ 	}
+ 
+@@ -984,7 +991,7 @@ static int iscsi_nop_out_rsp(struct iscsi_task *task,
+ 	struct iscsi_conn *conn = task->conn;
+ 	int rc = 0;
+ 
+-	if (conn->ping_task != task) {
++	if (READ_ONCE(conn->ping_task) != task) {
+ 		/*
+ 		 * If this is not in response to one of our
+ 		 * nops then it must be from userspace.
+@@ -1923,7 +1930,7 @@ static void iscsi_start_tx(struct iscsi_conn *conn)
+  */
+ static int iscsi_has_ping_timed_out(struct iscsi_conn *conn)
+ {
+-	if (conn->ping_task &&
++	if (READ_ONCE(conn->ping_task) &&
+ 	    time_before_eq(conn->last_recv + (conn->recv_timeout * HZ) +
+ 			   (conn->ping_timeout * HZ), jiffies))
+ 		return 1;
+@@ -2058,7 +2065,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc)
+ 	 * Checking the transport already or nop from a cmd timeout still
+ 	 * running
+ 	 */
+-	if (conn->ping_task) {
++	if (READ_ONCE(conn->ping_task)) {
+ 		task->have_checked_conn = true;
+ 		rc = BLK_EH_RESET_TIMER;
+ 		goto done;
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 54928a837dad0..9dd32bb0ff2be 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -8677,11 +8677,7 @@ int ufshcd_shutdown(struct ufs_hba *hba)
+ 	if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba))
+ 		goto out;
+ 
+-	if (pm_runtime_suspended(hba->dev)) {
+-		ret = ufshcd_runtime_resume(hba);
+-		if (ret)
+-			goto out;
+-	}
++	pm_runtime_get_sync(hba->dev);
+ 
+ 	ret = ufshcd_suspend(hba, UFS_SHUTDOWN_PM);
+ out:
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index 9cfa15ec8b08c..5743e727b5f78 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -1334,7 +1334,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
+ 
+ 	data = of_id->data;
+ 
+-	master = spi_alloc_master(dev, sizeof(struct bcm_qspi));
++	master = devm_spi_alloc_master(dev, sizeof(struct bcm_qspi));
+ 	if (!master) {
+ 		dev_err(dev, "error allocating spi_master\n");
+ 		return -ENOMEM;
+@@ -1374,21 +1374,17 @@ int bcm_qspi_probe(struct platform_device *pdev,
+ 
+ 	if (res) {
+ 		qspi->base[MSPI]  = devm_ioremap_resource(dev, res);
+-		if (IS_ERR(qspi->base[MSPI])) {
+-			ret = PTR_ERR(qspi->base[MSPI]);
+-			goto qspi_resource_err;
+-		}
++		if (IS_ERR(qspi->base[MSPI]))
++			return PTR_ERR(qspi->base[MSPI]);
+ 	} else {
+-		goto qspi_resource_err;
++		return 0;
+ 	}
+ 
+ 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi");
+ 	if (res) {
+ 		qspi->base[BSPI]  = devm_ioremap_resource(dev, res);
+-		if (IS_ERR(qspi->base[BSPI])) {
+-			ret = PTR_ERR(qspi->base[BSPI]);
+-			goto qspi_resource_err;
+-		}
++		if (IS_ERR(qspi->base[BSPI]))
++			return PTR_ERR(qspi->base[BSPI]);
+ 		qspi->bspi_mode = true;
+ 	} else {
+ 		qspi->bspi_mode = false;
+@@ -1399,18 +1395,14 @@ int bcm_qspi_probe(struct platform_device *pdev,
+ 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "cs_reg");
+ 	if (res) {
+ 		qspi->base[CHIP_SELECT]  = devm_ioremap_resource(dev, res);
+-		if (IS_ERR(qspi->base[CHIP_SELECT])) {
+-			ret = PTR_ERR(qspi->base[CHIP_SELECT]);
+-			goto qspi_resource_err;
+-		}
++		if (IS_ERR(qspi->base[CHIP_SELECT]))
++			return PTR_ERR(qspi->base[CHIP_SELECT]);
+ 	}
+ 
+ 	qspi->dev_ids = kcalloc(num_irqs, sizeof(struct bcm_qspi_dev_id),
+ 				GFP_KERNEL);
+-	if (!qspi->dev_ids) {
+-		ret = -ENOMEM;
+-		goto qspi_resource_err;
+-	}
++	if (!qspi->dev_ids)
++		return -ENOMEM;
+ 
+ 	for (val = 0; val < num_irqs; val++) {
+ 		irq = -1;
+@@ -1491,7 +1483,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
+ 	qspi->xfer_mode.addrlen = -1;
+ 	qspi->xfer_mode.hp = -1;
+ 
+-	ret = devm_spi_register_master(&pdev->dev, master);
++	ret = spi_register_master(master);
+ 	if (ret < 0) {
+ 		dev_err(dev, "can't register master\n");
+ 		goto qspi_reg_err;
+@@ -1504,8 +1496,6 @@ qspi_reg_err:
+ 	clk_disable_unprepare(qspi->clk);
+ qspi_probe_err:
+ 	kfree(qspi->dev_ids);
+-qspi_resource_err:
+-	spi_master_put(master);
+ 	return ret;
+ }
+ /* probe function to be called by SoC specific platform driver probe */
+@@ -1515,10 +1505,10 @@ int bcm_qspi_remove(struct platform_device *pdev)
+ {
+ 	struct bcm_qspi *qspi = platform_get_drvdata(pdev);
+ 
++	spi_unregister_master(qspi->master);
+ 	bcm_qspi_hw_uninit(qspi);
+ 	clk_disable_unprepare(qspi->clk);
+ 	kfree(qspi->dev_ids);
+-	spi_unregister_master(qspi->master);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
+index 9605abaaec670..197485f2c2b22 100644
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -1278,7 +1278,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
+ 	struct bcm2835_spi *bs;
+ 	int err;
+ 
+-	ctlr = spi_alloc_master(&pdev->dev, ALIGN(sizeof(*bs),
++	ctlr = devm_spi_alloc_master(&pdev->dev, ALIGN(sizeof(*bs),
+ 						  dma_get_cache_alignment()));
+ 	if (!ctlr)
+ 		return -ENOMEM;
+@@ -1299,26 +1299,17 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
+ 	bs->ctlr = ctlr;
+ 
+ 	bs->regs = devm_platform_ioremap_resource(pdev, 0);
+-	if (IS_ERR(bs->regs)) {
+-		err = PTR_ERR(bs->regs);
+-		goto out_controller_put;
+-	}
++	if (IS_ERR(bs->regs))
++		return PTR_ERR(bs->regs);
+ 
+ 	bs->clk = devm_clk_get(&pdev->dev, NULL);
+-	if (IS_ERR(bs->clk)) {
+-		err = PTR_ERR(bs->clk);
+-		if (err == -EPROBE_DEFER)
+-			dev_dbg(&pdev->dev, "could not get clk: %d\n", err);
+-		else
+-			dev_err(&pdev->dev, "could not get clk: %d\n", err);
+-		goto out_controller_put;
+-	}
++	if (IS_ERR(bs->clk))
++		return dev_err_probe(&pdev->dev, PTR_ERR(bs->clk),
++				     "could not get clk\n");
+ 
+ 	bs->irq = platform_get_irq(pdev, 0);
+-	if (bs->irq <= 0) {
+-		err = bs->irq ? bs->irq : -ENODEV;
+-		goto out_controller_put;
+-	}
++	if (bs->irq <= 0)
++		return bs->irq ? bs->irq : -ENODEV;
+ 
+ 	clk_prepare_enable(bs->clk);
+ 
+@@ -1352,8 +1343,6 @@ out_dma_release:
+ 	bcm2835_dma_release(ctlr, bs);
+ out_clk_disable:
+ 	clk_disable_unprepare(bs->clk);
+-out_controller_put:
+-	spi_controller_put(ctlr);
+ 	return err;
+ }
+ 
+diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
+index fd58547110e68..1a26865c42f83 100644
+--- a/drivers/spi/spi-bcm2835aux.c
++++ b/drivers/spi/spi-bcm2835aux.c
+@@ -529,8 +529,9 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
+ 
+ 	bs->clk = devm_clk_get(&pdev->dev, NULL);
+ 	if (IS_ERR(bs->clk)) {
++		err = PTR_ERR(bs->clk);
+ 		dev_err(&pdev->dev, "could not get clk: %d\n", err);
+-		return PTR_ERR(bs->clk);
++		return err;
+ 	}
+ 
+ 	bs->irq = platform_get_irq(pdev, 0);
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 9aac515b718c8..91578103a3ca9 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -1684,6 +1684,7 @@ static int spi_imx_probe(struct platform_device *pdev)
+ 
+ 	pm_runtime_set_autosuspend_delay(spi_imx->dev, MXC_RPM_TIMEOUT);
+ 	pm_runtime_use_autosuspend(spi_imx->dev);
++	pm_runtime_get_noresume(spi_imx->dev);
+ 	pm_runtime_set_active(spi_imx->dev);
+ 	pm_runtime_enable(spi_imx->dev);
+ 
+diff --git a/drivers/staging/ralink-gdma/Kconfig b/drivers/staging/ralink-gdma/Kconfig
+index 54e8029e6b1af..0017376234e28 100644
+--- a/drivers/staging/ralink-gdma/Kconfig
++++ b/drivers/staging/ralink-gdma/Kconfig
+@@ -2,6 +2,7 @@
+ config DMA_RALINK
+ 	tristate "RALINK DMA support"
+ 	depends on RALINK && !SOC_RT288X
++	depends on DMADEVICES
+ 	select DMA_ENGINE
+ 	select DMA_VIRTUAL_CHANNELS
+ 
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 7b56fe9f10628..2e18ec42c7045 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -483,8 +483,7 @@ EXPORT_SYMBOL(iscsit_queue_rsp);
+ void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
+ {
+ 	spin_lock_bh(&conn->cmd_lock);
+-	if (!list_empty(&cmd->i_conn_node) &&
+-	    !(cmd->se_cmd.transport_state & CMD_T_FABRIC_STOP))
++	if (!list_empty(&cmd->i_conn_node))
+ 		list_del_init(&cmd->i_conn_node);
+ 	spin_unlock_bh(&conn->cmd_lock);
+ 
+@@ -4083,12 +4082,22 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ 	spin_lock_bh(&conn->cmd_lock);
+ 	list_splice_init(&conn->conn_cmd_list, &tmp_list);
+ 
+-	list_for_each_entry(cmd, &tmp_list, i_conn_node) {
++	list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) {
+ 		struct se_cmd *se_cmd = &cmd->se_cmd;
+ 
+ 		if (se_cmd->se_tfo != NULL) {
+ 			spin_lock_irq(&se_cmd->t_state_lock);
+-			se_cmd->transport_state |= CMD_T_FABRIC_STOP;
++			if (se_cmd->transport_state & CMD_T_ABORTED) {
++				/*
++				 * LIO's abort path owns the cleanup for this,
++				 * so put it back on the list and let
++				 * aborted_task handle it.
++				 */
++				list_move_tail(&cmd->i_conn_node,
++					       &conn->conn_cmd_list);
++			} else {
++				se_cmd->transport_state |= CMD_T_FABRIC_STOP;
++			}
+ 			spin_unlock_irq(&se_cmd->t_state_lock);
+ 		}
+ 	}
+diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c
+index 20b6fd7383c54..c981757ba0d40 100644
+--- a/drivers/tee/optee/call.c
++++ b/drivers/tee/optee/call.c
+@@ -534,7 +534,8 @@ void optee_free_pages_list(void *list, size_t num_entries)
+ static bool is_normal_memory(pgprot_t p)
+ {
+ #if defined(CONFIG_ARM)
+-	return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC;
++	return (((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC) ||
++		((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEBACK));
+ #elif defined(CONFIG_ARM64)
+ 	return (pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL);
+ #else
+diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c
+index e0e1cb907ffd8..6af6343c7c65a 100644
+--- a/drivers/usb/cdns3/gadget.c
++++ b/drivers/usb/cdns3/gadget.c
+@@ -261,8 +261,8 @@ int cdns3_allocate_trb_pool(struct cdns3_endpoint *priv_ep)
+ 		 */
+ 		link_trb->control = 0;
+ 	} else {
+-		link_trb->buffer = TRB_BUFFER(priv_ep->trb_pool_dma);
+-		link_trb->control = TRB_CYCLE | TRB_TYPE(TRB_LINK) | TRB_TOGGLE;
++		link_trb->buffer = cpu_to_le32(TRB_BUFFER(priv_ep->trb_pool_dma));
++		link_trb->control = cpu_to_le32(TRB_CYCLE | TRB_TYPE(TRB_LINK) | TRB_TOGGLE);
+ 	}
+ 	return 0;
+ }
+@@ -853,10 +853,10 @@ static void cdns3_wa1_restore_cycle_bit(struct cdns3_endpoint *priv_ep)
+ 		priv_ep->wa1_trb_index = 0xFFFF;
+ 		if (priv_ep->wa1_cycle_bit) {
+ 			priv_ep->wa1_trb->control =
+-				priv_ep->wa1_trb->control | 0x1;
++				priv_ep->wa1_trb->control | cpu_to_le32(0x1);
+ 		} else {
+ 			priv_ep->wa1_trb->control =
+-				priv_ep->wa1_trb->control & ~0x1;
++				priv_ep->wa1_trb->control & cpu_to_le32(~0x1);
+ 		}
+ 	}
+ }
+@@ -1014,17 +1014,16 @@ static int cdns3_ep_run_stream_transfer(struct cdns3_endpoint *priv_ep,
+ 		  TRB_STREAM_ID(priv_req->request.stream_id) | TRB_ISP;
+ 
+ 	if (!request->num_sgs) {
+-		trb->buffer = TRB_BUFFER(trb_dma);
++		trb->buffer = cpu_to_le32(TRB_BUFFER(trb_dma));
+ 		length = request->length;
+ 	} else {
+-		trb->buffer = TRB_BUFFER(request->sg[sg_idx].dma_address);
++		trb->buffer = cpu_to_le32(TRB_BUFFER(request->sg[sg_idx].dma_address));
+ 		length = request->sg[sg_idx].length;
+ 	}
+ 
+ 	tdl = DIV_ROUND_UP(length, priv_ep->endpoint.maxpacket);
+ 
+-	trb->length = TRB_BURST_LEN(16 /*priv_ep->trb_burst_size*/) |
+-				  TRB_LEN(length);
++	trb->length = cpu_to_le32(TRB_BURST_LEN(16) | TRB_LEN(length));
+ 
+ 	/*
+ 	 * For DEV_VER_V2 controller version we have enabled
+@@ -1033,11 +1032,11 @@ static int cdns3_ep_run_stream_transfer(struct cdns3_endpoint *priv_ep,
+ 	 */
+ 	if (priv_dev->dev_ver >= DEV_VER_V2) {
+ 		if (priv_dev->gadget.speed == USB_SPEED_SUPER)
+-			trb->length |= TRB_TDL_SS_SIZE(tdl);
++			trb->length |= cpu_to_le32(TRB_TDL_SS_SIZE(tdl));
+ 	}
+ 	priv_req->flags |= REQUEST_PENDING;
+ 
+-	trb->control = control;
++	trb->control = cpu_to_le32(control);
+ 
+ 	trace_cdns3_prepare_trb(priv_ep, priv_req->trb);
+ 
+@@ -1162,8 +1161,8 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep,
+ 		    TRBS_PER_SEGMENT > 2)
+ 			ch_bit = TRB_CHAIN;
+ 
+-		link_trb->control = ((priv_ep->pcs) ? TRB_CYCLE : 0) |
+-				    TRB_TYPE(TRB_LINK) | TRB_TOGGLE | ch_bit;
++		link_trb->control = cpu_to_le32(((priv_ep->pcs) ? TRB_CYCLE : 0) |
++				    TRB_TYPE(TRB_LINK) | TRB_TOGGLE | ch_bit);
+ 	}
+ 
+ 	if (priv_dev->dev_ver <= DEV_VER_V2)
+@@ -1171,35 +1170,37 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep,
+ 
+ 	/* set incorrect Cycle Bit for first trb*/
+ 	control = priv_ep->pcs ? 0 : TRB_CYCLE;
++	trb->length = 0;
++	if (priv_dev->dev_ver >= DEV_VER_V2) {
++		u16 td_size;
++
++		td_size = DIV_ROUND_UP(request->length,
++				       priv_ep->endpoint.maxpacket);
++		if (priv_dev->gadget.speed == USB_SPEED_SUPER)
++			trb->length = TRB_TDL_SS_SIZE(td_size);
++		else
++			control |= TRB_TDL_HS_SIZE(td_size);
++	}
+ 
+ 	do {
+ 		u32 length;
+-		u16 td_size = 0;
+ 
+ 		/* fill TRB */
+ 		control |= TRB_TYPE(TRB_NORMAL);
+-		trb->buffer = TRB_BUFFER(request->num_sgs == 0
+-				? trb_dma : request->sg[sg_iter].dma_address);
++		trb->buffer = cpu_to_le32(TRB_BUFFER(request->num_sgs == 0
++				? trb_dma : request->sg[sg_iter].dma_address));
+ 
+ 		if (likely(!request->num_sgs))
+ 			length = request->length;
+ 		else
+ 			length = request->sg[sg_iter].length;
+ 
+-		if (likely(priv_dev->dev_ver >= DEV_VER_V2))
+-			td_size = DIV_ROUND_UP(length,
+-					       priv_ep->endpoint.maxpacket);
+-		else if (priv_ep->flags & EP_TDLCHK_EN)
++		if (priv_ep->flags & EP_TDLCHK_EN)
+ 			total_tdl += DIV_ROUND_UP(length,
+ 					       priv_ep->endpoint.maxpacket);
+ 
+-		trb->length = TRB_BURST_LEN(priv_ep->trb_burst_size) |
+-					TRB_LEN(length);
+-		if (priv_dev->gadget.speed == USB_SPEED_SUPER)
+-			trb->length |= TRB_TDL_SS_SIZE(td_size);
+-		else
+-			control |= TRB_TDL_HS_SIZE(td_size);
+-
++		trb->length |= cpu_to_le32(TRB_BURST_LEN(priv_ep->trb_burst_size) |
++					TRB_LEN(length));
+ 		pcs = priv_ep->pcs ? TRB_CYCLE : 0;
+ 
+ 		/*
+@@ -1218,9 +1219,9 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep,
+ 		}
+ 
+ 		if (sg_iter)
+-			trb->control = control;
++			trb->control = cpu_to_le32(control);
+ 		else
+-			priv_req->trb->control = control;
++			priv_req->trb->control = cpu_to_le32(control);
+ 
+ 		control = 0;
+ 		++sg_iter;
+@@ -1234,7 +1235,7 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep,
+ 	priv_req->flags |= REQUEST_PENDING;
+ 
+ 	if (sg_iter == 1)
+-		trb->control |= TRB_IOC | TRB_ISP;
++		trb->control |= cpu_to_le32(TRB_IOC | TRB_ISP);
+ 
+ 	if (priv_dev->dev_ver < DEV_VER_V2 &&
+ 	    (priv_ep->flags & EP_TDLCHK_EN)) {
+@@ -1260,7 +1261,7 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep,
+ 
+ 	/* give the TD to the consumer*/
+ 	if (togle_pcs)
+-		trb->control =  trb->control ^ 1;
++		trb->control = trb->control ^ cpu_to_le32(1);
+ 
+ 	if (priv_dev->dev_ver <= DEV_VER_V2)
+ 		cdns3_wa1_tray_restore_cycle_bit(priv_dev, priv_ep);
+@@ -1399,7 +1400,7 @@ static bool cdns3_request_handled(struct cdns3_endpoint *priv_ep,
+ 
+ 	trb = &priv_ep->trb_pool[priv_req->start_trb];
+ 
+-	if ((trb->control  & TRB_CYCLE) != priv_ep->ccs)
++	if ((le32_to_cpu(trb->control) & TRB_CYCLE) != priv_ep->ccs)
+ 		goto finish;
+ 
+ 	if (doorbell == 1 && current_index == priv_ep->dequeue)
+@@ -1448,7 +1449,7 @@ static void cdns3_transfer_completed(struct cdns3_device *priv_dev,
+ 		trb = priv_ep->trb_pool + priv_ep->dequeue;
+ 
+ 		/* Request was dequeued and TRB was changed to TRB_LINK. */
+-		if (TRB_FIELD_TO_TYPE(trb->control) == TRB_LINK) {
++		if (TRB_FIELD_TO_TYPE(le32_to_cpu(trb->control)) == TRB_LINK) {
+ 			trace_cdns3_complete_trb(priv_ep, trb);
+ 			cdns3_move_deq_to_next_trb(priv_req);
+ 		}
+@@ -1580,7 +1581,7 @@ static int cdns3_check_ep_interrupt_proceed(struct cdns3_endpoint *priv_ep)
+ 		 * that host ignore the ERDY packet and driver has to send it
+ 		 * again.
+ 		 */
+-		if (tdl && (dbusy | !EP_STS_BUFFEMPTY(ep_sts_reg) |
++		if (tdl && (dbusy || !EP_STS_BUFFEMPTY(ep_sts_reg) ||
+ 		    EP_STS_HOSTPP(ep_sts_reg))) {
+ 			writel(EP_CMD_ERDY |
+ 			       EP_CMD_ERDY_SID(priv_ep->last_stream_id),
+@@ -2564,10 +2565,10 @@ found:
+ 
+ 	/* Update ring only if removed request is on pending_req_list list */
+ 	if (req_on_hw_ring && link_trb) {
+-		link_trb->buffer = TRB_BUFFER(priv_ep->trb_pool_dma +
+-			((priv_req->end_trb + 1) * TRB_SIZE));
+-		link_trb->control = (link_trb->control & TRB_CYCLE) |
+-				    TRB_TYPE(TRB_LINK) | TRB_CHAIN;
++		link_trb->buffer = cpu_to_le32(TRB_BUFFER(priv_ep->trb_pool_dma +
++			((priv_req->end_trb + 1) * TRB_SIZE)));
++		link_trb->control = cpu_to_le32((le32_to_cpu(link_trb->control) & TRB_CYCLE) |
++				    TRB_TYPE(TRB_LINK) | TRB_CHAIN);
+ 
+ 		if (priv_ep->wa1_trb == priv_req->trb)
+ 			cdns3_wa1_restore_cycle_bit(priv_ep);
+@@ -2622,7 +2623,7 @@ int __cdns3_gadget_ep_clear_halt(struct cdns3_endpoint *priv_ep)
+ 		priv_req = to_cdns3_request(request);
+ 		trb = priv_req->trb;
+ 		if (trb)
+-			trb->control = trb->control ^ TRB_CYCLE;
++			trb->control = trb->control ^ cpu_to_le32(TRB_CYCLE);
+ 	}
+ 
+ 	writel(EP_CMD_CSTALL | EP_CMD_EPRST, &priv_dev->regs->ep_cmd);
+@@ -2637,7 +2638,8 @@ int __cdns3_gadget_ep_clear_halt(struct cdns3_endpoint *priv_ep)
+ 
+ 	if (request) {
+ 		if (trb)
+-			trb->control = trb->control ^ TRB_CYCLE;
++			trb->control = trb->control ^ cpu_to_le32(TRB_CYCLE);
++
+ 		cdns3_rearm_transfer(priv_ep, 1);
+ 	}
+ 
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index e96a858a12185..533236366a03b 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -482,11 +482,11 @@ static void snoop_urb(struct usb_device *udev,
+ 
+ 	if (userurb) {		/* Async */
+ 		if (when == SUBMIT)
+-			dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
++			dev_info(&udev->dev, "userurb %px, ep%d %s-%s, "
+ 					"length %u\n",
+ 					userurb, ep, t, d, length);
+ 		else
+-			dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
++			dev_info(&udev->dev, "userurb %px, ep%d %s-%s, "
+ 					"actual_length %u status %d\n",
+ 					userurb, ep, t, d, length,
+ 					timeout_or_status);
+@@ -1997,7 +1997,7 @@ static int proc_reapurb(struct usb_dev_state *ps, void __user *arg)
+ 	if (as) {
+ 		int retval;
+ 
+-		snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
++		snoop(&ps->dev->dev, "reap %px\n", as->userurb);
+ 		retval = processcompl(as, (void __user * __user *)arg);
+ 		free_async(as);
+ 		return retval;
+@@ -2014,7 +2014,7 @@ static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
+ 
+ 	as = async_getcompleted(ps);
+ 	if (as) {
+-		snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
++		snoop(&ps->dev->dev, "reap %px\n", as->userurb);
+ 		retval = processcompl(as, (void __user * __user *)arg);
+ 		free_async(as);
+ 	} else {
+@@ -2142,7 +2142,7 @@ static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg)
+ 	if (as) {
+ 		int retval;
+ 
+-		snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
++		snoop(&ps->dev->dev, "reap %px\n", as->userurb);
+ 		retval = processcompl_compat(as, (void __user * __user *)arg);
+ 		free_async(as);
+ 		return retval;
+@@ -2159,7 +2159,7 @@ static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *ar
+ 
+ 	as = async_getcompleted(ps);
+ 	if (as) {
+-		snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
++		snoop(&ps->dev->dev, "reap %px\n", as->userurb);
+ 		retval = processcompl_compat(as, (void __user * __user *)arg);
+ 		free_async(as);
+ 	} else {
+@@ -2624,7 +2624,7 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
+ #endif
+ 
+ 	case USBDEVFS_DISCARDURB:
+-		snoop(&dev->dev, "%s: DISCARDURB %pK\n", __func__, p);
++		snoop(&dev->dev, "%s: DISCARDURB %px\n", __func__, p);
+ 		ret = proc_unlinkurb(ps, p);
+ 		break;
+ 
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index a1e3a037a2892..fad31ccd1fa83 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -348,6 +348,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* Guillemot Webcam Hercules Dualpix Exchange*/
+ 	{ USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
++	/* Guillemot Hercules DJ Console audio card (BZ 208357) */
++	{ USB_DEVICE(0x06f8, 0xb000), .driver_info =
++			USB_QUIRK_ENDPOINT_IGNORE },
++
+ 	/* Midiman M-Audio Keystation 88es */
+ 	{ USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+@@ -421,6 +425,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	{ USB_DEVICE(0x1532, 0x0116), .driver_info =
+ 			USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+ 
++	/* Lenovo ThinkCenter A630Z TI024Gen3 usb-audio */
++	{ USB_DEVICE(0x17ef, 0xa012), .driver_info =
++			USB_QUIRK_DISCONNECT_SUSPEND },
++
+ 	/* BUILDWIN Photo Frame */
+ 	{ USB_DEVICE(0x1908, 0x1315), .driver_info =
+ 			USB_QUIRK_HONOR_BNUMINTERFACES },
+@@ -521,6 +529,8 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = {
+  * Matched for devices with USB_QUIRK_ENDPOINT_IGNORE.
+  */
+ static const struct usb_device_id usb_endpoint_ignore[] = {
++	{ USB_DEVICE_INTERFACE_NUMBER(0x06f8, 0xb000, 5), .driver_info = 0x01 },
++	{ USB_DEVICE_INTERFACE_NUMBER(0x06f8, 0xb000, 5), .driver_info = 0x81 },
+ 	{ USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0202, 1), .driver_info = 0x85 },
+ 	{ USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0208, 1), .driver_info = 0x85 },
+ 	{ }
+diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
+index 46af0aa07e2e3..b2b5b0689667b 100644
+--- a/drivers/usb/gadget/function/f_midi.c
++++ b/drivers/usb/gadget/function/f_midi.c
+@@ -1315,7 +1315,7 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
+ 	midi->id = kstrdup(opts->id, GFP_KERNEL);
+ 	if (opts->id && !midi->id) {
+ 		status = -ENOMEM;
+-		goto setup_fail;
++		goto midi_free;
+ 	}
+ 	midi->in_ports = opts->in_ports;
+ 	midi->out_ports = opts->out_ports;
+@@ -1327,7 +1327,7 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
+ 
+ 	status = kfifo_alloc(&midi->in_req_fifo, midi->qlen, GFP_KERNEL);
+ 	if (status)
+-		goto setup_fail;
++		goto midi_free;
+ 
+ 	spin_lock_init(&midi->transmit_lock);
+ 
+@@ -1343,9 +1343,13 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
+ 
+ 	return &midi->func;
+ 
++midi_free:
++	if (midi)
++		kfree(midi->id);
++	kfree(midi);
+ setup_fail:
+ 	mutex_unlock(&opts->lock);
+-	kfree(midi);
++
+ 	return ERR_PTR(status);
+ }
+ 
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index 1b430b36d0a6b..71e7d10dd76b9 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -2039,6 +2039,9 @@ gadgetfs_fill_super (struct super_block *sb, struct fs_context *fc)
+ 	return 0;
+ 
+ Enomem:
++	kfree(CHIP);
++	CHIP = NULL;
++
+ 	return -ENOMEM;
+ }
+ 
+diff --git a/drivers/vdpa/Kconfig b/drivers/vdpa/Kconfig
+index d7d32b6561021..358f6048dd3ce 100644
+--- a/drivers/vdpa/Kconfig
++++ b/drivers/vdpa/Kconfig
+@@ -13,6 +13,7 @@ config VDPA_SIM
+ 	depends on RUNTIME_TESTING_MENU && HAS_DMA
+ 	select DMA_OPS
+ 	select VHOST_RING
++	select GENERIC_NET_UTILS
+ 	default n
+ 	help
+ 	  vDPA networking device simulator which loop TX traffic back
+diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
+index b22adf03f5842..5d8850f5aef16 100644
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -52,7 +52,6 @@
+ #define VHOST_SCSI_VERSION  "v0.1"
+ #define VHOST_SCSI_NAMELEN 256
+ #define VHOST_SCSI_MAX_CDB_SIZE 32
+-#define VHOST_SCSI_DEFAULT_TAGS 256
+ #define VHOST_SCSI_PREALLOC_SGLS 2048
+ #define VHOST_SCSI_PREALLOC_UPAGES 2048
+ #define VHOST_SCSI_PREALLOC_PROT_SGLS 2048
+@@ -189,6 +188,9 @@ struct vhost_scsi_virtqueue {
+ 	 * Writers must also take dev mutex and flush under it.
+ 	 */
+ 	int inflight_idx;
++	struct vhost_scsi_cmd *scsi_cmds;
++	struct sbitmap scsi_tags;
++	int max_cmds;
+ };
+ 
+ struct vhost_scsi {
+@@ -320,11 +322,13 @@ static u32 vhost_scsi_tpg_get_inst_index(struct se_portal_group *se_tpg)
+ 	return 1;
+ }
+ 
+-static void vhost_scsi_release_cmd(struct se_cmd *se_cmd)
++static void vhost_scsi_release_cmd_res(struct se_cmd *se_cmd)
+ {
+ 	struct vhost_scsi_cmd *tv_cmd = container_of(se_cmd,
+ 				struct vhost_scsi_cmd, tvc_se_cmd);
+-	struct se_session *se_sess = tv_cmd->tvc_nexus->tvn_se_sess;
++	struct vhost_scsi_virtqueue *svq = container_of(tv_cmd->tvc_vq,
++				struct vhost_scsi_virtqueue, vq);
++	struct vhost_scsi_inflight *inflight = tv_cmd->inflight;
+ 	int i;
+ 
+ 	if (tv_cmd->tvc_sgl_count) {
+@@ -336,8 +340,18 @@ static void vhost_scsi_release_cmd(struct se_cmd *se_cmd)
+ 			put_page(sg_page(&tv_cmd->tvc_prot_sgl[i]));
+ 	}
+ 
+-	vhost_scsi_put_inflight(tv_cmd->inflight);
+-	target_free_tag(se_sess, se_cmd);
++	sbitmap_clear_bit(&svq->scsi_tags, se_cmd->map_tag);
++	vhost_scsi_put_inflight(inflight);
++}
++
++static void vhost_scsi_release_cmd(struct se_cmd *se_cmd)
++{
++	struct vhost_scsi_cmd *cmd = container_of(se_cmd,
++					struct vhost_scsi_cmd, tvc_se_cmd);
++	struct vhost_scsi *vs = cmd->tvc_vhost;
++
++	llist_add(&cmd->tvc_completion_list, &vs->vs_completion_list);
++	vhost_work_queue(&vs->dev, &vs->vs_completion_work);
+ }
+ 
+ static u32 vhost_scsi_sess_get_index(struct se_session *se_sess)
+@@ -362,28 +376,15 @@ static int vhost_scsi_get_cmd_state(struct se_cmd *se_cmd)
+ 	return 0;
+ }
+ 
+-static void vhost_scsi_complete_cmd(struct vhost_scsi_cmd *cmd)
+-{
+-	struct vhost_scsi *vs = cmd->tvc_vhost;
+-
+-	llist_add(&cmd->tvc_completion_list, &vs->vs_completion_list);
+-
+-	vhost_work_queue(&vs->dev, &vs->vs_completion_work);
+-}
+-
+ static int vhost_scsi_queue_data_in(struct se_cmd *se_cmd)
+ {
+-	struct vhost_scsi_cmd *cmd = container_of(se_cmd,
+-				struct vhost_scsi_cmd, tvc_se_cmd);
+-	vhost_scsi_complete_cmd(cmd);
++	transport_generic_free_cmd(se_cmd, 0);
+ 	return 0;
+ }
+ 
+ static int vhost_scsi_queue_status(struct se_cmd *se_cmd)
+ {
+-	struct vhost_scsi_cmd *cmd = container_of(se_cmd,
+-				struct vhost_scsi_cmd, tvc_se_cmd);
+-	vhost_scsi_complete_cmd(cmd);
++	transport_generic_free_cmd(se_cmd, 0);
+ 	return 0;
+ }
+ 
+@@ -429,15 +430,6 @@ vhost_scsi_allocate_evt(struct vhost_scsi *vs,
+ 	return evt;
+ }
+ 
+-static void vhost_scsi_free_cmd(struct vhost_scsi_cmd *cmd)
+-{
+-	struct se_cmd *se_cmd = &cmd->tvc_se_cmd;
+-
+-	/* TODO locking against target/backend threads? */
+-	transport_generic_free_cmd(se_cmd, 0);
+-
+-}
+-
+ static int vhost_scsi_check_stop_free(struct se_cmd *se_cmd)
+ {
+ 	return target_put_sess_cmd(se_cmd);
+@@ -556,7 +548,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
+ 		} else
+ 			pr_err("Faulted on virtio_scsi_cmd_resp\n");
+ 
+-		vhost_scsi_free_cmd(cmd);
++		vhost_scsi_release_cmd_res(se_cmd);
+ 	}
+ 
+ 	vq = -1;
+@@ -566,31 +558,31 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
+ }
+ 
+ static struct vhost_scsi_cmd *
+-vhost_scsi_get_tag(struct vhost_virtqueue *vq, struct vhost_scsi_tpg *tpg,
++vhost_scsi_get_cmd(struct vhost_virtqueue *vq, struct vhost_scsi_tpg *tpg,
+ 		   unsigned char *cdb, u64 scsi_tag, u16 lun, u8 task_attr,
+ 		   u32 exp_data_len, int data_direction)
+ {
++	struct vhost_scsi_virtqueue *svq = container_of(vq,
++					struct vhost_scsi_virtqueue, vq);
+ 	struct vhost_scsi_cmd *cmd;
+ 	struct vhost_scsi_nexus *tv_nexus;
+-	struct se_session *se_sess;
+ 	struct scatterlist *sg, *prot_sg;
+ 	struct page **pages;
+-	int tag, cpu;
++	int tag;
+ 
+ 	tv_nexus = tpg->tpg_nexus;
+ 	if (!tv_nexus) {
+ 		pr_err("Unable to locate active struct vhost_scsi_nexus\n");
+ 		return ERR_PTR(-EIO);
+ 	}
+-	se_sess = tv_nexus->tvn_se_sess;
+ 
+-	tag = sbitmap_queue_get(&se_sess->sess_tag_pool, &cpu);
++	tag = sbitmap_get(&svq->scsi_tags, 0, false);
+ 	if (tag < 0) {
+ 		pr_err("Unable to obtain tag for vhost_scsi_cmd\n");
+ 		return ERR_PTR(-ENOMEM);
+ 	}
+ 
+-	cmd = &((struct vhost_scsi_cmd *)se_sess->sess_cmd_map)[tag];
++	cmd = &svq->scsi_cmds[tag];
+ 	sg = cmd->tvc_sgl;
+ 	prot_sg = cmd->tvc_prot_sgl;
+ 	pages = cmd->tvc_upages;
+@@ -599,7 +591,6 @@ vhost_scsi_get_tag(struct vhost_virtqueue *vq, struct vhost_scsi_tpg *tpg,
+ 	cmd->tvc_prot_sgl = prot_sg;
+ 	cmd->tvc_upages = pages;
+ 	cmd->tvc_se_cmd.map_tag = tag;
+-	cmd->tvc_se_cmd.map_cpu = cpu;
+ 	cmd->tvc_tag = scsi_tag;
+ 	cmd->tvc_lun = lun;
+ 	cmd->tvc_task_attr = task_attr;
+@@ -1065,11 +1056,11 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
+ 				scsi_command_size(cdb), VHOST_SCSI_MAX_CDB_SIZE);
+ 				goto err;
+ 		}
+-		cmd = vhost_scsi_get_tag(vq, tpg, cdb, tag, lun, task_attr,
++		cmd = vhost_scsi_get_cmd(vq, tpg, cdb, tag, lun, task_attr,
+ 					 exp_data_len + prot_bytes,
+ 					 data_direction);
+ 		if (IS_ERR(cmd)) {
+-			vq_err(vq, "vhost_scsi_get_tag failed %ld\n",
++			vq_err(vq, "vhost_scsi_get_cmd failed %ld\n",
+ 			       PTR_ERR(cmd));
+ 			goto err;
+ 		}
+@@ -1088,7 +1079,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
+ 						      &prot_iter, exp_data_len,
+ 						      &data_iter))) {
+ 				vq_err(vq, "Failed to map iov to sgl\n");
+-				vhost_scsi_release_cmd(&cmd->tvc_se_cmd);
++				vhost_scsi_release_cmd_res(&cmd->tvc_se_cmd);
+ 				goto err;
+ 			}
+ 		}
+@@ -1373,6 +1364,83 @@ static void vhost_scsi_flush(struct vhost_scsi *vs)
+ 		wait_for_completion(&old_inflight[i]->comp);
+ }
+ 
++static void vhost_scsi_destroy_vq_cmds(struct vhost_virtqueue *vq)
++{
++	struct vhost_scsi_virtqueue *svq = container_of(vq,
++					struct vhost_scsi_virtqueue, vq);
++	struct vhost_scsi_cmd *tv_cmd;
++	unsigned int i;
++
++	if (!svq->scsi_cmds)
++		return;
++
++	for (i = 0; i < svq->max_cmds; i++) {
++		tv_cmd = &svq->scsi_cmds[i];
++
++		kfree(tv_cmd->tvc_sgl);
++		kfree(tv_cmd->tvc_prot_sgl);
++		kfree(tv_cmd->tvc_upages);
++	}
++
++	sbitmap_free(&svq->scsi_tags);
++	kfree(svq->scsi_cmds);
++	svq->scsi_cmds = NULL;
++}
++
++static int vhost_scsi_setup_vq_cmds(struct vhost_virtqueue *vq, int max_cmds)
++{
++	struct vhost_scsi_virtqueue *svq = container_of(vq,
++					struct vhost_scsi_virtqueue, vq);
++	struct vhost_scsi_cmd *tv_cmd;
++	unsigned int i;
++
++	if (svq->scsi_cmds)
++		return 0;
++
++	if (sbitmap_init_node(&svq->scsi_tags, max_cmds, -1, GFP_KERNEL,
++			      NUMA_NO_NODE))
++		return -ENOMEM;
++	svq->max_cmds = max_cmds;
++
++	svq->scsi_cmds = kcalloc(max_cmds, sizeof(*tv_cmd), GFP_KERNEL);
++	if (!svq->scsi_cmds) {
++		sbitmap_free(&svq->scsi_tags);
++		return -ENOMEM;
++	}
++
++	for (i = 0; i < max_cmds; i++) {
++		tv_cmd = &svq->scsi_cmds[i];
++
++		tv_cmd->tvc_sgl = kcalloc(VHOST_SCSI_PREALLOC_SGLS,
++					  sizeof(struct scatterlist),
++					  GFP_KERNEL);
++		if (!tv_cmd->tvc_sgl) {
++			pr_err("Unable to allocate tv_cmd->tvc_sgl\n");
++			goto out;
++		}
++
++		tv_cmd->tvc_upages = kcalloc(VHOST_SCSI_PREALLOC_UPAGES,
++					     sizeof(struct page *),
++					     GFP_KERNEL);
++		if (!tv_cmd->tvc_upages) {
++			pr_err("Unable to allocate tv_cmd->tvc_upages\n");
++			goto out;
++		}
++
++		tv_cmd->tvc_prot_sgl = kcalloc(VHOST_SCSI_PREALLOC_PROT_SGLS,
++					       sizeof(struct scatterlist),
++					       GFP_KERNEL);
++		if (!tv_cmd->tvc_prot_sgl) {
++			pr_err("Unable to allocate tv_cmd->tvc_prot_sgl\n");
++			goto out;
++		}
++	}
++	return 0;
++out:
++	vhost_scsi_destroy_vq_cmds(vq);
++	return -ENOMEM;
++}
++
+ /*
+  * Called from vhost_scsi_ioctl() context to walk the list of available
+  * vhost_scsi_tpg with an active struct vhost_scsi_nexus
+@@ -1427,10 +1495,9 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs,
+ 
+ 		if (!strcmp(tv_tport->tport_name, t->vhost_wwpn)) {
+ 			if (vs->vs_tpg && vs->vs_tpg[tpg->tport_tpgt]) {
+-				kfree(vs_tpg);
+ 				mutex_unlock(&tpg->tv_tpg_mutex);
+ 				ret = -EEXIST;
+-				goto out;
++				goto undepend;
+ 			}
+ 			/*
+ 			 * In order to ensure individual vhost-scsi configfs
+@@ -1442,9 +1509,8 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs,
+ 			ret = target_depend_item(&se_tpg->tpg_group.cg_item);
+ 			if (ret) {
+ 				pr_warn("target_depend_item() failed: %d\n", ret);
+-				kfree(vs_tpg);
+ 				mutex_unlock(&tpg->tv_tpg_mutex);
+-				goto out;
++				goto undepend;
+ 			}
+ 			tpg->tv_tpg_vhost_count++;
+ 			tpg->vhost_scsi = vs;
+@@ -1457,6 +1523,16 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs,
+ 	if (match) {
+ 		memcpy(vs->vs_vhost_wwpn, t->vhost_wwpn,
+ 		       sizeof(vs->vs_vhost_wwpn));
++
++		for (i = VHOST_SCSI_VQ_IO; i < VHOST_SCSI_MAX_VQ; i++) {
++			vq = &vs->vqs[i].vq;
++			if (!vhost_vq_is_setup(vq))
++				continue;
++
++			if (vhost_scsi_setup_vq_cmds(vq, vq->num))
++				goto destroy_vq_cmds;
++		}
++
+ 		for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
+ 			vq = &vs->vqs[i].vq;
+ 			mutex_lock(&vq->mutex);
+@@ -1476,7 +1552,22 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs,
+ 	vhost_scsi_flush(vs);
+ 	kfree(vs->vs_tpg);
+ 	vs->vs_tpg = vs_tpg;
++	goto out;
+ 
++destroy_vq_cmds:
++	for (i--; i >= VHOST_SCSI_VQ_IO; i--) {
++		if (!vhost_vq_get_backend(&vs->vqs[i].vq))
++			vhost_scsi_destroy_vq_cmds(&vs->vqs[i].vq);
++	}
++undepend:
++	for (i = 0; i < VHOST_SCSI_MAX_TARGET; i++) {
++		tpg = vs_tpg[i];
++		if (tpg) {
++			tpg->tv_tpg_vhost_count--;
++			target_undepend_item(&tpg->se_tpg.tpg_group.cg_item);
++		}
++	}
++	kfree(vs_tpg);
+ out:
+ 	mutex_unlock(&vs->dev.mutex);
+ 	mutex_unlock(&vhost_scsi_mutex);
+@@ -1549,6 +1640,12 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs,
+ 			mutex_lock(&vq->mutex);
+ 			vhost_vq_set_backend(vq, NULL);
+ 			mutex_unlock(&vq->mutex);
++			/*
++			 * Make sure cmds are not running before tearing them
++			 * down.
++			 */
++			vhost_scsi_flush(vs);
++			vhost_scsi_destroy_vq_cmds(vq);
+ 		}
+ 	}
+ 	/*
+@@ -1842,23 +1939,6 @@ static void vhost_scsi_port_unlink(struct se_portal_group *se_tpg,
+ 	mutex_unlock(&vhost_scsi_mutex);
+ }
+ 
+-static void vhost_scsi_free_cmd_map_res(struct se_session *se_sess)
+-{
+-	struct vhost_scsi_cmd *tv_cmd;
+-	unsigned int i;
+-
+-	if (!se_sess->sess_cmd_map)
+-		return;
+-
+-	for (i = 0; i < VHOST_SCSI_DEFAULT_TAGS; i++) {
+-		tv_cmd = &((struct vhost_scsi_cmd *)se_sess->sess_cmd_map)[i];
+-
+-		kfree(tv_cmd->tvc_sgl);
+-		kfree(tv_cmd->tvc_prot_sgl);
+-		kfree(tv_cmd->tvc_upages);
+-	}
+-}
+-
+ static ssize_t vhost_scsi_tpg_attrib_fabric_prot_type_store(
+ 		struct config_item *item, const char *page, size_t count)
+ {
+@@ -1898,45 +1978,6 @@ static struct configfs_attribute *vhost_scsi_tpg_attrib_attrs[] = {
+ 	NULL,
+ };
+ 
+-static int vhost_scsi_nexus_cb(struct se_portal_group *se_tpg,
+-			       struct se_session *se_sess, void *p)
+-{
+-	struct vhost_scsi_cmd *tv_cmd;
+-	unsigned int i;
+-
+-	for (i = 0; i < VHOST_SCSI_DEFAULT_TAGS; i++) {
+-		tv_cmd = &((struct vhost_scsi_cmd *)se_sess->sess_cmd_map)[i];
+-
+-		tv_cmd->tvc_sgl = kcalloc(VHOST_SCSI_PREALLOC_SGLS,
+-					  sizeof(struct scatterlist),
+-					  GFP_KERNEL);
+-		if (!tv_cmd->tvc_sgl) {
+-			pr_err("Unable to allocate tv_cmd->tvc_sgl\n");
+-			goto out;
+-		}
+-
+-		tv_cmd->tvc_upages = kcalloc(VHOST_SCSI_PREALLOC_UPAGES,
+-					     sizeof(struct page *),
+-					     GFP_KERNEL);
+-		if (!tv_cmd->tvc_upages) {
+-			pr_err("Unable to allocate tv_cmd->tvc_upages\n");
+-			goto out;
+-		}
+-
+-		tv_cmd->tvc_prot_sgl = kcalloc(VHOST_SCSI_PREALLOC_PROT_SGLS,
+-					       sizeof(struct scatterlist),
+-					       GFP_KERNEL);
+-		if (!tv_cmd->tvc_prot_sgl) {
+-			pr_err("Unable to allocate tv_cmd->tvc_prot_sgl\n");
+-			goto out;
+-		}
+-	}
+-	return 0;
+-out:
+-	vhost_scsi_free_cmd_map_res(se_sess);
+-	return -ENOMEM;
+-}
+-
+ static int vhost_scsi_make_nexus(struct vhost_scsi_tpg *tpg,
+ 				const char *name)
+ {
+@@ -1960,12 +2001,9 @@ static int vhost_scsi_make_nexus(struct vhost_scsi_tpg *tpg,
+ 	 * struct se_node_acl for the vhost_scsi struct se_portal_group with
+ 	 * the SCSI Initiator port name of the passed configfs group 'name'.
+ 	 */
+-	tv_nexus->tvn_se_sess = target_setup_session(&tpg->se_tpg,
+-					VHOST_SCSI_DEFAULT_TAGS,
+-					sizeof(struct vhost_scsi_cmd),
++	tv_nexus->tvn_se_sess = target_setup_session(&tpg->se_tpg, 0, 0,
+ 					TARGET_PROT_DIN_PASS | TARGET_PROT_DOUT_PASS,
+-					(unsigned char *)name, tv_nexus,
+-					vhost_scsi_nexus_cb);
++					(unsigned char *)name, tv_nexus, NULL);
+ 	if (IS_ERR(tv_nexus->tvn_se_sess)) {
+ 		mutex_unlock(&tpg->tv_tpg_mutex);
+ 		kfree(tv_nexus);
+@@ -2015,7 +2053,6 @@ static int vhost_scsi_drop_nexus(struct vhost_scsi_tpg *tpg)
+ 		" %s Initiator Port: %s\n", vhost_scsi_dump_proto_id(tpg->tport),
+ 		tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
+ 
+-	vhost_scsi_free_cmd_map_res(se_sess);
+ 	/*
+ 	 * Release the SCSI I_T Nexus to the emulated vhost Target Port
+ 	 */
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 9ad45e1d27f0f..23e7b2d624511 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -305,6 +305,12 @@ static void vhost_vring_call_reset(struct vhost_vring_call *call_ctx)
+ 	spin_lock_init(&call_ctx->ctx_lock);
+ }
+ 
++bool vhost_vq_is_setup(struct vhost_virtqueue *vq)
++{
++	return vq->avail && vq->desc && vq->used && vhost_vq_access_ok(vq);
++}
++EXPORT_SYMBOL_GPL(vhost_vq_is_setup);
++
+ static void vhost_vq_reset(struct vhost_dev *dev,
+ 			   struct vhost_virtqueue *vq)
+ {
+diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
+index 9032d3c2a9f48..3d30b3da7bcf5 100644
+--- a/drivers/vhost/vhost.h
++++ b/drivers/vhost/vhost.h
+@@ -190,6 +190,7 @@ int vhost_get_vq_desc(struct vhost_virtqueue *,
+ 		      struct vhost_log *log, unsigned int *log_num);
+ void vhost_discard_vq_desc(struct vhost_virtqueue *, int n);
+ 
++bool vhost_vq_is_setup(struct vhost_virtqueue *vq);
+ int vhost_vq_init_access(struct vhost_virtqueue *);
+ int vhost_add_used(struct vhost_virtqueue *, unsigned int head, int len);
+ int vhost_add_used_n(struct vhost_virtqueue *, struct vring_used_elem *heads,
+diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c
+index e36fb1a0ecdbd..19b3f3416d31c 100644
+--- a/drivers/video/fbdev/hyperv_fb.c
++++ b/drivers/video/fbdev/hyperv_fb.c
+@@ -1092,7 +1092,12 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
+ 		goto err1;
+ 	}
+ 
+-	fb_virt = ioremap(par->mem->start, screen_fb_size);
++	/*
++	 * Map the VRAM cacheable for performance. This is also required for
++	 * VM Connect to display properly for ARM64 Linux VM, as the host also
++	 * maps the VRAM cacheable.
++	 */
++	fb_virt = ioremap_cache(par->mem->start, screen_fb_size);
+ 	if (!fb_virt)
+ 		goto err2;
+ 
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 4507c3d093994..dcafe09be8dca 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -452,46 +452,6 @@ static void btrfs_drop_pages(struct page **pages, size_t num_pages)
+ 	}
+ }
+ 
+-static int btrfs_find_new_delalloc_bytes(struct btrfs_inode *inode,
+-					 const u64 start,
+-					 const u64 len,
+-					 struct extent_state **cached_state)
+-{
+-	u64 search_start = start;
+-	const u64 end = start + len - 1;
+-
+-	while (search_start < end) {
+-		const u64 search_len = end - search_start + 1;
+-		struct extent_map *em;
+-		u64 em_len;
+-		int ret = 0;
+-
+-		em = btrfs_get_extent(inode, NULL, 0, search_start, search_len);
+-		if (IS_ERR(em))
+-			return PTR_ERR(em);
+-
+-		if (em->block_start != EXTENT_MAP_HOLE)
+-			goto next;
+-
+-		em_len = em->len;
+-		if (em->start < search_start)
+-			em_len -= search_start - em->start;
+-		if (em_len > search_len)
+-			em_len = search_len;
+-
+-		ret = set_extent_bit(&inode->io_tree, search_start,
+-				     search_start + em_len - 1,
+-				     EXTENT_DELALLOC_NEW,
+-				     NULL, cached_state, GFP_NOFS);
+-next:
+-		search_start = extent_map_end(em);
+-		free_extent_map(em);
+-		if (ret)
+-			return ret;
+-	}
+-	return 0;
+-}
+-
+ /*
+  * after copy_from_user, pages need to be dirtied and we need to make
+  * sure holes are created between the current EOF and the start of
+@@ -528,23 +488,6 @@ int btrfs_dirty_pages(struct btrfs_inode *inode, struct page **pages,
+ 			 EXTENT_DELALLOC | EXTENT_DO_ACCOUNTING | EXTENT_DEFRAG,
+ 			 0, 0, cached);
+ 
+-	if (!btrfs_is_free_space_inode(inode)) {
+-		if (start_pos >= isize &&
+-		    !(inode->flags & BTRFS_INODE_PREALLOC)) {
+-			/*
+-			 * There can't be any extents following eof in this case
+-			 * so just set the delalloc new bit for the range
+-			 * directly.
+-			 */
+-			extra_bits |= EXTENT_DELALLOC_NEW;
+-		} else {
+-			err = btrfs_find_new_delalloc_bytes(inode, start_pos,
+-							    num_bytes, cached);
+-			if (err)
+-				return err;
+-		}
+-	}
+-
+ 	err = btrfs_set_extent_delalloc(inode, start_pos, end_of_last_block,
+ 					extra_bits, cached);
+ 	if (err)
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 11d132bc2679c..4708ea05449b9 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -2262,11 +2262,69 @@ static noinline int add_pending_csums(struct btrfs_trans_handle *trans,
+ 	return 0;
+ }
+ 
++static int btrfs_find_new_delalloc_bytes(struct btrfs_inode *inode,
++					 const u64 start,
++					 const u64 len,
++					 struct extent_state **cached_state)
++{
++	u64 search_start = start;
++	const u64 end = start + len - 1;
++
++	while (search_start < end) {
++		const u64 search_len = end - search_start + 1;
++		struct extent_map *em;
++		u64 em_len;
++		int ret = 0;
++
++		em = btrfs_get_extent(inode, NULL, 0, search_start, search_len);
++		if (IS_ERR(em))
++			return PTR_ERR(em);
++
++		if (em->block_start != EXTENT_MAP_HOLE)
++			goto next;
++
++		em_len = em->len;
++		if (em->start < search_start)
++			em_len -= search_start - em->start;
++		if (em_len > search_len)
++			em_len = search_len;
++
++		ret = set_extent_bit(&inode->io_tree, search_start,
++				     search_start + em_len - 1,
++				     EXTENT_DELALLOC_NEW,
++				     NULL, cached_state, GFP_NOFS);
++next:
++		search_start = extent_map_end(em);
++		free_extent_map(em);
++		if (ret)
++			return ret;
++	}
++	return 0;
++}
++
+ int btrfs_set_extent_delalloc(struct btrfs_inode *inode, u64 start, u64 end,
+ 			      unsigned int extra_bits,
+ 			      struct extent_state **cached_state)
+ {
+ 	WARN_ON(PAGE_ALIGNED(end));
++
++	if (start >= i_size_read(&inode->vfs_inode) &&
++	    !(inode->flags & BTRFS_INODE_PREALLOC)) {
++		/*
++		 * There can't be any extents following eof in this case so just
++		 * set the delalloc new bit for the range directly.
++		 */
++		extra_bits |= EXTENT_DELALLOC_NEW;
++	} else {
++		int ret;
++
++		ret = btrfs_find_new_delalloc_bytes(inode, start,
++						    end + 1 - start,
++						    cached_state);
++		if (ret)
++			return ret;
++	}
++
+ 	return set_extent_delalloc(&inode->io_tree, start, end, extra_bits,
+ 				   cached_state);
+ }
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index db953cb947bc4..9205a88f2a881 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -497,13 +497,13 @@ next2:
+ 			break;
+ 	}
+ out:
++	btrfs_free_path(path);
+ 	fs_info->qgroup_flags |= flags;
+ 	if (!(fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_ON))
+ 		clear_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
+ 	else if (fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN &&
+ 		 ret >= 0)
+ 		ret = qgroup_rescan_init(fs_info, rescan_progress, 0);
+-	btrfs_free_path(path);
+ 
+ 	if (ret < 0) {
+ 		ulist_free(fs_info->qgroup_ulist);
+@@ -3516,6 +3516,7 @@ static int try_flush_qgroup(struct btrfs_root *root)
+ {
+ 	struct btrfs_trans_handle *trans;
+ 	int ret;
++	bool can_commit = true;
+ 
+ 	/*
+ 	 * We don't want to run flush again and again, so if there is a running
+@@ -3527,6 +3528,20 @@ static int try_flush_qgroup(struct btrfs_root *root)
+ 		return 0;
+ 	}
+ 
++	/*
++	 * If current process holds a transaction, we shouldn't flush, as we
++	 * assume all space reservation happens before a transaction handle is
++	 * held.
++	 *
++	 * But there are cases like btrfs_delayed_item_reserve_metadata() where
++	 * we try to reserve space with one transction handle already held.
++	 * In that case we can't commit transaction, but at least try to end it
++	 * and hope the started data writes can free some space.
++	 */
++	if (current->journal_info &&
++	    current->journal_info != BTRFS_SEND_TRANS_STUB)
++		can_commit = false;
++
+ 	ret = btrfs_start_delalloc_snapshot(root);
+ 	if (ret < 0)
+ 		goto out;
+@@ -3538,7 +3553,10 @@ static int try_flush_qgroup(struct btrfs_root *root)
+ 		goto out;
+ 	}
+ 
+-	ret = btrfs_commit_transaction(trans);
++	if (can_commit)
++		ret = btrfs_commit_transaction(trans);
++	else
++		ret = btrfs_end_transaction(trans);
+ out:
+ 	clear_bit(BTRFS_ROOT_QGROUP_FLUSHING, &root->state);
+ 	wake_up(&root->qgroup_flush_wait);
+diff --git a/fs/btrfs/tests/inode-tests.c b/fs/btrfs/tests/inode-tests.c
+index 894a63a92236e..a6539500a8828 100644
+--- a/fs/btrfs/tests/inode-tests.c
++++ b/fs/btrfs/tests/inode-tests.c
+@@ -986,7 +986,8 @@ static int test_extent_accounting(u32 sectorsize, u32 nodesize)
+ 	ret = clear_extent_bit(&BTRFS_I(inode)->io_tree,
+ 			       BTRFS_MAX_EXTENT_SIZE >> 1,
+ 			       (BTRFS_MAX_EXTENT_SIZE >> 1) + sectorsize - 1,
+-			       EXTENT_DELALLOC | EXTENT_UPTODATE, 0, 0, NULL);
++			       EXTENT_DELALLOC | EXTENT_DELALLOC_NEW |
++			       EXTENT_UPTODATE, 0, 0, NULL);
+ 	if (ret) {
+ 		test_err("clear_extent_bit returned %d", ret);
+ 		goto out;
+@@ -1053,7 +1054,8 @@ static int test_extent_accounting(u32 sectorsize, u32 nodesize)
+ 	ret = clear_extent_bit(&BTRFS_I(inode)->io_tree,
+ 			       BTRFS_MAX_EXTENT_SIZE + sectorsize,
+ 			       BTRFS_MAX_EXTENT_SIZE + 2 * sectorsize - 1,
+-			       EXTENT_DELALLOC | EXTENT_UPTODATE, 0, 0, NULL);
++			       EXTENT_DELALLOC | EXTENT_DELALLOC_NEW |
++			       EXTENT_UPTODATE, 0, 0, NULL);
+ 	if (ret) {
+ 		test_err("clear_extent_bit returned %d", ret);
+ 		goto out;
+@@ -1085,7 +1087,8 @@ static int test_extent_accounting(u32 sectorsize, u32 nodesize)
+ 
+ 	/* Empty */
+ 	ret = clear_extent_bit(&BTRFS_I(inode)->io_tree, 0, (u64)-1,
+-			       EXTENT_DELALLOC | EXTENT_UPTODATE, 0, 0, NULL);
++			       EXTENT_DELALLOC | EXTENT_DELALLOC_NEW |
++			       EXTENT_UPTODATE, 0, 0, NULL);
+ 	if (ret) {
+ 		test_err("clear_extent_bit returned %d", ret);
+ 		goto out;
+@@ -1100,7 +1103,8 @@ static int test_extent_accounting(u32 sectorsize, u32 nodesize)
+ out:
+ 	if (ret)
+ 		clear_extent_bit(&BTRFS_I(inode)->io_tree, 0, (u64)-1,
+-				 EXTENT_DELALLOC | EXTENT_UPTODATE, 0, 0, NULL);
++				 EXTENT_DELALLOC | EXTENT_DELALLOC_NEW |
++				 EXTENT_UPTODATE, 0, 0, NULL);
+ 	iput(inode);
+ 	btrfs_free_dummy_root(root);
+ 	btrfs_free_dummy_fs_info(fs_info);
+diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
+index 8784b74f5232e..ea2bb4cb58909 100644
+--- a/fs/btrfs/tree-checker.c
++++ b/fs/btrfs/tree-checker.c
+@@ -1068,6 +1068,7 @@ static int check_root_item(struct extent_buffer *leaf, struct btrfs_key *key,
+ 			    "invalid root item size, have %u expect %zu or %u",
+ 			    btrfs_item_size_nr(leaf, slot), sizeof(ri),
+ 			    btrfs_legacy_root_item_size());
++		return -EUCLEAN;
+ 	}
+ 
+ 	/*
+@@ -1423,6 +1424,7 @@ static int check_extent_data_ref(struct extent_buffer *leaf,
+ 	"invalid item size, have %u expect aligned to %zu for key type %u",
+ 			    btrfs_item_size_nr(leaf, slot),
+ 			    sizeof(*dref), key->type);
++		return -EUCLEAN;
+ 	}
+ 	if (!IS_ALIGNED(key->objectid, leaf->fs_info->sectorsize)) {
+ 		generic_err(leaf, slot,
+@@ -1451,6 +1453,7 @@ static int check_extent_data_ref(struct extent_buffer *leaf,
+ 			extent_err(leaf, slot,
+ 	"invalid extent data backref offset, have %llu expect aligned to %u",
+ 				   offset, leaf->fs_info->sectorsize);
++			return -EUCLEAN;
+ 		}
+ 	}
+ 	return 0;
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 578bbe544c8b5..7c703f9c3eda7 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -941,7 +941,13 @@ static noinline struct btrfs_device *device_list_add(const char *path,
+ 			if (device->bdev != path_bdev) {
+ 				bdput(path_bdev);
+ 				mutex_unlock(&fs_devices->device_list_mutex);
+-				btrfs_warn_in_rcu(device->fs_info,
++				/*
++				 * device->fs_info may not be reliable here, so
++				 * pass in a NULL instead. This avoids a
++				 * possible use-after-free when the fs_info and
++				 * fs_info->sb are already torn down.
++				 */
++				btrfs_warn_in_rcu(NULL,
+ 	"duplicate device %s devid %llu generation %llu scanned by %s (%d)",
+ 						  path, devid, found_transid,
+ 						  current->comm,
+diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
+index 23b21e9436528..ef4784e72b1d5 100644
+--- a/fs/cifs/cifsacl.c
++++ b/fs/cifs/cifsacl.c
+@@ -1266,6 +1266,7 @@ cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
+ 		cifs_dbg(VFS, "%s: error %d getting sec desc\n", __func__, rc);
+ 	} else if (mode_from_special_sid) {
+ 		rc = parse_sec_desc(cifs_sb, pntsd, acllen, fattr, true);
++		kfree(pntsd);
+ 	} else {
+ 		/* get approximated mode from ACL */
+ 		rc = parse_sec_desc(cifs_sb, pntsd, acllen, fattr, false);
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index e2e53652193e6..475c2b9e799d8 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -262,7 +262,7 @@ smb2_revert_current_mid(struct TCP_Server_Info *server, const unsigned int val)
+ }
+ 
+ static struct mid_q_entry *
+-smb2_find_mid(struct TCP_Server_Info *server, char *buf)
++__smb2_find_mid(struct TCP_Server_Info *server, char *buf, bool dequeue)
+ {
+ 	struct mid_q_entry *mid;
+ 	struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buf;
+@@ -279,6 +279,10 @@ smb2_find_mid(struct TCP_Server_Info *server, char *buf)
+ 		    (mid->mid_state == MID_REQUEST_SUBMITTED) &&
+ 		    (mid->command == shdr->Command)) {
+ 			kref_get(&mid->refcount);
++			if (dequeue) {
++				list_del_init(&mid->qhead);
++				mid->mid_flags |= MID_DELETED;
++			}
+ 			spin_unlock(&GlobalMid_Lock);
+ 			return mid;
+ 		}
+@@ -287,6 +291,18 @@ smb2_find_mid(struct TCP_Server_Info *server, char *buf)
+ 	return NULL;
+ }
+ 
++static struct mid_q_entry *
++smb2_find_mid(struct TCP_Server_Info *server, char *buf)
++{
++	return __smb2_find_mid(server, buf, false);
++}
++
++static struct mid_q_entry *
++smb2_find_dequeue_mid(struct TCP_Server_Info *server, char *buf)
++{
++	return __smb2_find_mid(server, buf, true);
++}
++
+ static void
+ smb2_dump_detail(void *buf, struct TCP_Server_Info *server)
+ {
+@@ -4212,7 +4228,8 @@ init_read_bvec(struct page **pages, unsigned int npages, unsigned int data_size,
+ static int
+ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+ 		 char *buf, unsigned int buf_len, struct page **pages,
+-		 unsigned int npages, unsigned int page_data_size)
++		 unsigned int npages, unsigned int page_data_size,
++		 bool is_offloaded)
+ {
+ 	unsigned int data_offset;
+ 	unsigned int data_len;
+@@ -4234,7 +4251,8 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+ 
+ 	if (server->ops->is_session_expired &&
+ 	    server->ops->is_session_expired(buf)) {
+-		cifs_reconnect(server);
++		if (!is_offloaded)
++			cifs_reconnect(server);
+ 		return -1;
+ 	}
+ 
+@@ -4258,7 +4276,10 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+ 		cifs_dbg(FYI, "%s: server returned error %d\n",
+ 			 __func__, rdata->result);
+ 		/* normal error on read response */
+-		dequeue_mid(mid, false);
++		if (is_offloaded)
++			mid->mid_state = MID_RESPONSE_RECEIVED;
++		else
++			dequeue_mid(mid, false);
+ 		return 0;
+ 	}
+ 
+@@ -4282,7 +4303,10 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+ 		cifs_dbg(FYI, "%s: data offset (%u) beyond end of smallbuf\n",
+ 			 __func__, data_offset);
+ 		rdata->result = -EIO;
+-		dequeue_mid(mid, rdata->result);
++		if (is_offloaded)
++			mid->mid_state = MID_RESPONSE_MALFORMED;
++		else
++			dequeue_mid(mid, rdata->result);
+ 		return 0;
+ 	}
+ 
+@@ -4298,21 +4322,30 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+ 			cifs_dbg(FYI, "%s: data offset (%u) beyond 1st page of response\n",
+ 				 __func__, data_offset);
+ 			rdata->result = -EIO;
+-			dequeue_mid(mid, rdata->result);
++			if (is_offloaded)
++				mid->mid_state = MID_RESPONSE_MALFORMED;
++			else
++				dequeue_mid(mid, rdata->result);
+ 			return 0;
+ 		}
+ 
+ 		if (data_len > page_data_size - pad_len) {
+ 			/* data_len is corrupt -- discard frame */
+ 			rdata->result = -EIO;
+-			dequeue_mid(mid, rdata->result);
++			if (is_offloaded)
++				mid->mid_state = MID_RESPONSE_MALFORMED;
++			else
++				dequeue_mid(mid, rdata->result);
+ 			return 0;
+ 		}
+ 
+ 		rdata->result = init_read_bvec(pages, npages, page_data_size,
+ 					       cur_off, &bvec);
+ 		if (rdata->result != 0) {
+-			dequeue_mid(mid, rdata->result);
++			if (is_offloaded)
++				mid->mid_state = MID_RESPONSE_MALFORMED;
++			else
++				dequeue_mid(mid, rdata->result);
+ 			return 0;
+ 		}
+ 
+@@ -4327,7 +4360,10 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+ 		/* read response payload cannot be in both buf and pages */
+ 		WARN_ONCE(1, "buf can not contain only a part of read data");
+ 		rdata->result = -EIO;
+-		dequeue_mid(mid, rdata->result);
++		if (is_offloaded)
++			mid->mid_state = MID_RESPONSE_MALFORMED;
++		else
++			dequeue_mid(mid, rdata->result);
+ 		return 0;
+ 	}
+ 
+@@ -4338,7 +4374,10 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+ 	if (length < 0)
+ 		return length;
+ 
+-	dequeue_mid(mid, false);
++	if (is_offloaded)
++		mid->mid_state = MID_RESPONSE_RECEIVED;
++	else
++		dequeue_mid(mid, false);
+ 	return length;
+ }
+ 
+@@ -4367,15 +4406,34 @@ static void smb2_decrypt_offload(struct work_struct *work)
+ 	}
+ 
+ 	dw->server->lstrp = jiffies;
+-	mid = smb2_find_mid(dw->server, dw->buf);
++	mid = smb2_find_dequeue_mid(dw->server, dw->buf);
+ 	if (mid == NULL)
+ 		cifs_dbg(FYI, "mid not found\n");
+ 	else {
+ 		mid->decrypted = true;
+ 		rc = handle_read_data(dw->server, mid, dw->buf,
+ 				      dw->server->vals->read_rsp_size,
+-				      dw->ppages, dw->npages, dw->len);
+-		mid->callback(mid);
++				      dw->ppages, dw->npages, dw->len,
++				      true);
++		if (rc >= 0) {
++#ifdef CONFIG_CIFS_STATS2
++			mid->when_received = jiffies;
++#endif
++			mid->callback(mid);
++		} else {
++			spin_lock(&GlobalMid_Lock);
++			if (dw->server->tcpStatus == CifsNeedReconnect) {
++				mid->mid_state = MID_RETRY_NEEDED;
++				spin_unlock(&GlobalMid_Lock);
++				mid->callback(mid);
++			} else {
++				mid->mid_state = MID_REQUEST_SUBMITTED;
++				mid->mid_flags &= ~(MID_DELETED);
++				list_add_tail(&mid->qhead,
++					&dw->server->pending_mid_q);
++				spin_unlock(&GlobalMid_Lock);
++			}
++		}
+ 		cifs_mid_q_entry_release(mid);
+ 	}
+ 
+@@ -4478,7 +4536,7 @@ non_offloaded_decrypt:
+ 		(*mid)->decrypted = true;
+ 		rc = handle_read_data(server, *mid, buf,
+ 				      server->vals->read_rsp_size,
+-				      pages, npages, len);
++				      pages, npages, len, false);
+ 	}
+ 
+ free_pages:
+@@ -4621,7 +4679,7 @@ smb3_handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid)
+ 	char *buf = server->large_buf ? server->bigbuf : server->smallbuf;
+ 
+ 	return handle_read_data(server, mid, buf, server->pdu_size,
+-				NULL, 0, 0);
++				NULL, 0, 0, false);
+ }
+ 
+ static int
+diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c
+index 96c0c86f3fffe..0297ad95eb5cc 100644
+--- a/fs/efivarfs/inode.c
++++ b/fs/efivarfs/inode.c
+@@ -7,6 +7,7 @@
+ #include <linux/efi.h>
+ #include <linux/fs.h>
+ #include <linux/ctype.h>
++#include <linux/kmemleak.h>
+ #include <linux/slab.h>
+ #include <linux/uuid.h>
+ 
+@@ -103,6 +104,7 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
+ 	var->var.VariableName[i] = '\0';
+ 
+ 	inode->i_private = var;
++	kmemleak_ignore(var);
+ 
+ 	err = efivar_entry_add(var, &efivarfs_list);
+ 	if (err)
+diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
+index f943fd0b0699c..15880a68faadc 100644
+--- a/fs/efivarfs/super.c
++++ b/fs/efivarfs/super.c
+@@ -21,7 +21,6 @@ LIST_HEAD(efivarfs_list);
+ static void efivarfs_evict_inode(struct inode *inode)
+ {
+ 	clear_inode(inode);
+-	kfree(inode->i_private);
+ }
+ 
+ static const struct super_operations efivarfs_ops = {
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index e74a56f6915c0..6d729a278535e 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -200,6 +200,7 @@ struct fixed_file_ref_node {
+ 	struct list_head		file_list;
+ 	struct fixed_file_data		*file_data;
+ 	struct llist_node		llist;
++	bool				done;
+ };
+ 
+ struct fixed_file_data {
+@@ -435,6 +436,7 @@ struct io_sr_msg {
+ struct io_open {
+ 	struct file			*file;
+ 	int				dfd;
++	bool				ignore_nonblock;
+ 	struct filename			*filename;
+ 	struct open_how			how;
+ 	unsigned long			nofile;
+@@ -2990,7 +2992,7 @@ static void io_req_map_rw(struct io_kiocb *req, const struct iovec *iovec,
+ 	rw->free_iovec = NULL;
+ 	rw->bytes_done = 0;
+ 	/* can only be fixed buffers, no need to do anything */
+-	if (iter->type == ITER_BVEC)
++	if (iov_iter_is_bvec(iter))
+ 		return;
+ 	if (!iovec) {
+ 		unsigned iov_off = 0;
+@@ -3590,6 +3592,7 @@ static int __io_openat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe
+ 		return ret;
+ 	}
+ 	req->open.nofile = rlimit(RLIMIT_NOFILE);
++	req->open.ignore_nonblock = false;
+ 	req->flags |= REQ_F_NEED_CLEANUP;
+ 	return 0;
+ }
+@@ -3637,7 +3640,7 @@ static int io_openat2(struct io_kiocb *req, bool force_nonblock)
+ 	struct file *file;
+ 	int ret;
+ 
+-	if (force_nonblock)
++	if (force_nonblock && !req->open.ignore_nonblock)
+ 		return -EAGAIN;
+ 
+ 	ret = build_open_flags(&req->open.how, &op);
+@@ -3652,6 +3655,21 @@ static int io_openat2(struct io_kiocb *req, bool force_nonblock)
+ 	if (IS_ERR(file)) {
+ 		put_unused_fd(ret);
+ 		ret = PTR_ERR(file);
++		/*
++		 * A work-around to ensure that /proc/self works that way
++		 * that it should - if we get -EOPNOTSUPP back, then assume
++		 * that proc_self_get_link() failed us because we're in async
++		 * context. We should be safe to retry this from the task
++		 * itself with force_nonblock == false set, as it should not
++		 * block on lookup. Would be nice to know this upfront and
++		 * avoid the async dance, but doesn't seem feasible.
++		 */
++		if (ret == -EOPNOTSUPP && io_wq_current_is_worker()) {
++			req->open.ignore_nonblock = true;
++			refcount_inc(&req->refs);
++			io_req_task_queue(req);
++			return 0;
++		}
+ 	} else {
+ 		fsnotify_open(file);
+ 		fd_install(ret, file);
+@@ -6854,9 +6872,8 @@ static int io_sqe_files_unregister(struct io_ring_ctx *ctx)
+ 		return -ENXIO;
+ 
+ 	spin_lock(&data->lock);
+-	if (!list_empty(&data->ref_list))
+-		ref_node = list_first_entry(&data->ref_list,
+-				struct fixed_file_ref_node, node);
++	ref_node = container_of(data->cur_refs, struct fixed_file_ref_node,
++				refs);
+ 	spin_unlock(&data->lock);
+ 	if (ref_node)
+ 		percpu_ref_kill(&ref_node->refs);
+@@ -7107,10 +7124,6 @@ static void __io_file_put_work(struct fixed_file_ref_node *ref_node)
+ 		kfree(pfile);
+ 	}
+ 
+-	spin_lock(&file_data->lock);
+-	list_del(&ref_node->node);
+-	spin_unlock(&file_data->lock);
+-
+ 	percpu_ref_exit(&ref_node->refs);
+ 	kfree(ref_node);
+ 	percpu_ref_put(&file_data->refs);
+@@ -7137,17 +7150,33 @@ static void io_file_put_work(struct work_struct *work)
+ static void io_file_data_ref_zero(struct percpu_ref *ref)
+ {
+ 	struct fixed_file_ref_node *ref_node;
++	struct fixed_file_data *data;
+ 	struct io_ring_ctx *ctx;
+-	bool first_add;
++	bool first_add = false;
+ 	int delay = HZ;
+ 
+ 	ref_node = container_of(ref, struct fixed_file_ref_node, refs);
+-	ctx = ref_node->file_data->ctx;
++	data = ref_node->file_data;
++	ctx = data->ctx;
++
++	spin_lock(&data->lock);
++	ref_node->done = true;
+ 
+-	if (percpu_ref_is_dying(&ctx->file_data->refs))
++	while (!list_empty(&data->ref_list)) {
++		ref_node = list_first_entry(&data->ref_list,
++					struct fixed_file_ref_node, node);
++		/* recycle ref nodes in order */
++		if (!ref_node->done)
++			break;
++		list_del(&ref_node->node);
++		first_add |= llist_add(&ref_node->llist, &ctx->file_put_llist);
++	}
++	spin_unlock(&data->lock);
++
++
++	if (percpu_ref_is_dying(&data->refs))
+ 		delay = 0;
+ 
+-	first_add = llist_add(&ref_node->llist, &ctx->file_put_llist);
+ 	if (!delay)
+ 		mod_delayed_work(system_wq, &ctx->file_put_work, 0);
+ 	else if (first_add)
+@@ -7171,6 +7200,7 @@ static struct fixed_file_ref_node *alloc_fixed_file_ref_node(
+ 	INIT_LIST_HEAD(&ref_node->node);
+ 	INIT_LIST_HEAD(&ref_node->file_list);
+ 	ref_node->file_data = ctx->file_data;
++	ref_node->done = false;
+ 	return ref_node;
+ }
+ 
+@@ -7298,7 +7328,7 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
+ 
+ 	ctx->file_data->cur_refs = &ref_node->refs;
+ 	spin_lock(&ctx->file_data->lock);
+-	list_add(&ref_node->node, &ctx->file_data->ref_list);
++	list_add_tail(&ref_node->node, &ctx->file_data->ref_list);
+ 	spin_unlock(&ctx->file_data->lock);
+ 	percpu_ref_get(&ctx->file_data->refs);
+ 	return ret;
+@@ -7443,7 +7473,7 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx,
+ 	if (needs_switch) {
+ 		percpu_ref_kill(data->cur_refs);
+ 		spin_lock(&data->lock);
+-		list_add(&ref_node->node, &data->ref_list);
++		list_add_tail(&ref_node->node, &data->ref_list);
+ 		data->cur_refs = &ref_node->refs;
+ 		spin_unlock(&data->lock);
+ 		percpu_ref_get(&ctx->file_data->refs);
+@@ -8877,14 +8907,16 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p,
+ 		 * to a power-of-two, if it isn't already. We do NOT impose
+ 		 * any cq vs sq ring sizing.
+ 		 */
+-		p->cq_entries = roundup_pow_of_two(p->cq_entries);
+-		if (p->cq_entries < p->sq_entries)
++		if (!p->cq_entries)
+ 			return -EINVAL;
+ 		if (p->cq_entries > IORING_MAX_CQ_ENTRIES) {
+ 			if (!(p->flags & IORING_SETUP_CLAMP))
+ 				return -EINVAL;
+ 			p->cq_entries = IORING_MAX_CQ_ENTRIES;
+ 		}
++		p->cq_entries = roundup_pow_of_two(p->cq_entries);
++		if (p->cq_entries < p->sq_entries)
++			return -EINVAL;
+ 	} else {
+ 		p->cq_entries = 2 * p->sq_entries;
+ 	}
+diff --git a/fs/proc/self.c b/fs/proc/self.c
+index 72cd69bcaf4ad..cc71ce3466dc0 100644
+--- a/fs/proc/self.c
++++ b/fs/proc/self.c
+@@ -16,6 +16,13 @@ static const char *proc_self_get_link(struct dentry *dentry,
+ 	pid_t tgid = task_tgid_nr_ns(current, ns);
+ 	char *name;
+ 
++	/*
++	 * Not currently supported. Once we can inherit all of struct pid,
++	 * we can allow this.
++	 */
++	if (current->flags & PF_KTHREAD)
++		return ERR_PTR(-EOPNOTSUPP);
++
+ 	if (!tgid)
+ 		return ERR_PTR(-ENOENT);
+ 	/* max length of unsigned int in decimal + NULL term */
+diff --git a/include/kunit/test.h b/include/kunit/test.h
+index 59f3144f009a5..b68ba33c16937 100644
+--- a/include/kunit/test.h
++++ b/include/kunit/test.h
+@@ -1064,7 +1064,7 @@ do {									       \
+ 	KUNIT_ASSERTION(test,						       \
+ 			strcmp(__left, __right) op 0,			       \
+ 			kunit_binary_str_assert,			       \
+-			KUNIT_INIT_BINARY_ASSERT_STRUCT(test,		       \
++			KUNIT_INIT_BINARY_STR_ASSERT_STRUCT(test,	       \
+ 							assert_type,	       \
+ 							#op,		       \
+ 							#left,		       \
+diff --git a/include/linux/firmware/xlnx-zynqmp.h b/include/linux/firmware/xlnx-zynqmp.h
+index 5968df82b9912..41a1bab98b7e1 100644
+--- a/include/linux/firmware/xlnx-zynqmp.h
++++ b/include/linux/firmware/xlnx-zynqmp.h
+@@ -50,10 +50,6 @@
+ #define	ZYNQMP_PM_CAPABILITY_WAKEUP	0x4U
+ #define	ZYNQMP_PM_CAPABILITY_UNUSABLE	0x8U
+ 
+-/* Feature check status */
+-#define PM_FEATURE_INVALID		-1
+-#define PM_FEATURE_UNCHECKED		0
+-
+ /*
+  * Firmware FPGA Manager flags
+  * XILINX_ZYNQMP_PM_FPGA_FULL:	FPGA full reconfiguration
+diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h
+index 0cb5fe3afd164..cd5aa875245b4 100644
+--- a/include/linux/pgtable.h
++++ b/include/linux/pgtable.h
+@@ -1399,6 +1399,19 @@ typedef unsigned int pgtbl_mod_mask;
+ 
+ #endif /* !__ASSEMBLY__ */
+ 
++#if !defined(MAX_POSSIBLE_PHYSMEM_BITS) && !defined(CONFIG_64BIT)
++#ifdef CONFIG_PHYS_ADDR_T_64BIT
++/*
++ * ZSMALLOC needs to know the highest PFN on 32-bit architectures
++ * with physical address space extension, but falls back to
++ * BITS_PER_LONG otherwise.
++ */
++#error Missing MAX_POSSIBLE_PHYSMEM_BITS definition
++#else
++#define MAX_POSSIBLE_PHYSMEM_BITS 32
++#endif
++#endif
++
+ #ifndef has_transparent_hugepage
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+ #define has_transparent_hugepage() 1
+diff --git a/include/linux/platform_data/ti-sysc.h b/include/linux/platform_data/ti-sysc.h
+index c59999ce044e5..240dce553a0bd 100644
+--- a/include/linux/platform_data/ti-sysc.h
++++ b/include/linux/platform_data/ti-sysc.h
+@@ -50,6 +50,7 @@ struct sysc_regbits {
+ 	s8 emufree_shift;
+ };
+ 
++#define SYSC_MODULE_QUIRK_ENA_RESETDONE	BIT(25)
+ #define SYSC_MODULE_QUIRK_PRUSS		BIT(24)
+ #define SYSC_MODULE_QUIRK_DSS_RESET	BIT(23)
+ #define SYSC_MODULE_QUIRK_RTC_UNLOCK	BIT(22)
+diff --git a/include/net/bonding.h b/include/net/bonding.h
+index 7d132cc1e5848..d9d0ff3b0ad32 100644
+--- a/include/net/bonding.h
++++ b/include/net/bonding.h
+@@ -185,6 +185,11 @@ struct slave {
+ 	struct rtnl_link_stats64 slave_stats;
+ };
+ 
++static inline struct slave *to_slave(struct kobject *kobj)
++{
++	return container_of(kobj, struct slave, kobj);
++}
++
+ struct bond_up_slave {
+ 	unsigned int	count;
+ 	struct rcu_head rcu;
+@@ -750,6 +755,9 @@ extern struct bond_parm_tbl ad_select_tbl[];
+ /* exported from bond_netlink.c */
+ extern struct rtnl_link_ops bond_link_ops;
+ 
++/* exported from bond_sysfs_slave.c */
++extern const struct sysfs_ops slave_sysfs_ops;
++
+ static inline netdev_tx_t bond_tx_drop(struct net_device *dev, struct sk_buff *skb)
+ {
+ 	atomic_long_inc(&dev->tx_dropped);
+diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h
+index c25fb86ffae95..b3bbd10eb3f07 100644
+--- a/include/scsi/libiscsi.h
++++ b/include/scsi/libiscsi.h
+@@ -132,6 +132,9 @@ struct iscsi_task {
+ 	void			*dd_data;	/* driver/transport data */
+ };
+ 
++/* invalid scsi_task pointer */
++#define	INVALID_SCSI_TASK	(struct iscsi_task *)-1l
++
+ static inline int iscsi_task_has_unsol_data(struct iscsi_task *task)
+ {
+ 	return task->unsol_r2t.data_length > task->unsol_r2t.sent;
+diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h
+index e7cbccc7c14cc..57d795365987d 100644
+--- a/include/trace/events/writeback.h
++++ b/include/trace/events/writeback.h
+@@ -190,7 +190,7 @@ TRACE_EVENT(inode_foreign_history,
+ 	),
+ 
+ 	TP_fast_assign(
+-		strncpy(__entry->name, bdi_dev_name(inode_to_bdi(inode)), 32);
++		strscpy_pad(__entry->name, bdi_dev_name(inode_to_bdi(inode)), 32);
+ 		__entry->ino		= inode->i_ino;
+ 		__entry->cgroup_ino	= __trace_wbc_assign_cgroup(wbc);
+ 		__entry->history	= history;
+@@ -219,7 +219,7 @@ TRACE_EVENT(inode_switch_wbs,
+ 	),
+ 
+ 	TP_fast_assign(
+-		strncpy(__entry->name,	bdi_dev_name(old_wb->bdi), 32);
++		strscpy_pad(__entry->name, bdi_dev_name(old_wb->bdi), 32);
+ 		__entry->ino		= inode->i_ino;
+ 		__entry->old_cgroup_ino	= __trace_wb_assign_cgroup(old_wb);
+ 		__entry->new_cgroup_ino	= __trace_wb_assign_cgroup(new_wb);
+@@ -252,7 +252,7 @@ TRACE_EVENT(track_foreign_dirty,
+ 		struct address_space *mapping = page_mapping(page);
+ 		struct inode *inode = mapping ? mapping->host : NULL;
+ 
+-		strncpy(__entry->name,	bdi_dev_name(wb->bdi), 32);
++		strscpy_pad(__entry->name, bdi_dev_name(wb->bdi), 32);
+ 		__entry->bdi_id		= wb->bdi->id;
+ 		__entry->ino		= inode ? inode->i_ino : 0;
+ 		__entry->memcg_id	= wb->memcg_css->id;
+@@ -285,7 +285,7 @@ TRACE_EVENT(flush_foreign,
+ 	),
+ 
+ 	TP_fast_assign(
+-		strncpy(__entry->name,	bdi_dev_name(wb->bdi), 32);
++		strscpy_pad(__entry->name, bdi_dev_name(wb->bdi), 32);
+ 		__entry->cgroup_ino	= __trace_wb_assign_cgroup(wb);
+ 		__entry->frn_bdi_id	= frn_bdi_id;
+ 		__entry->frn_memcg_id	= frn_memcg_id;
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index 3eb35ad1b5241..04134a242f3d5 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -108,19 +108,21 @@ static inline void lockdep_lock(void)
+ {
+ 	DEBUG_LOCKS_WARN_ON(!irqs_disabled());
+ 
++	__this_cpu_inc(lockdep_recursion);
+ 	arch_spin_lock(&__lock);
+ 	__owner = current;
+-	__this_cpu_inc(lockdep_recursion);
+ }
+ 
+ static inline void lockdep_unlock(void)
+ {
++	DEBUG_LOCKS_WARN_ON(!irqs_disabled());
++
+ 	if (debug_locks && DEBUG_LOCKS_WARN_ON(__owner != current))
+ 		return;
+ 
+-	__this_cpu_dec(lockdep_recursion);
+ 	__owner = NULL;
+ 	arch_spin_unlock(&__lock);
++	__this_cpu_dec(lockdep_recursion);
+ }
+ 
+ static inline bool lockdep_assert_locked(void)
+diff --git a/mm/filemap.c b/mm/filemap.c
+index 6024d15998a43..abc1a1dcce97b 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -1464,11 +1464,19 @@ void end_page_writeback(struct page *page)
+ 		rotate_reclaimable_page(page);
+ 	}
+ 
++	/*
++	 * Writeback does not hold a page reference of its own, relying
++	 * on truncation to wait for the clearing of PG_writeback.
++	 * But here we must make sure that the page is not freed and
++	 * reused before the wake_up_page().
++	 */
++	get_page(page);
+ 	if (!test_clear_page_writeback(page))
+ 		BUG();
+ 
+ 	smp_mb__after_atomic();
+ 	wake_up_page(page, PG_writeback);
++	put_page(page);
+ }
+ EXPORT_SYMBOL(end_page_writeback);
+ 
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index 4e4ddd67b71e5..a28dcf672e81a 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -2754,12 +2754,6 @@ int test_clear_page_writeback(struct page *page)
+ 	} else {
+ 		ret = TestClearPageWriteback(page);
+ 	}
+-	/*
+-	 * NOTE: Page might be free now! Writeback doesn't hold a page
+-	 * reference on its own, it relies on truncation to wait for
+-	 * the clearing of PG_writeback. The below can only access
+-	 * page state that is static across allocation cycles.
+-	 */
+ 	if (ret) {
+ 		dec_lruvec_state(lruvec, NR_WRITEBACK);
+ 		dec_zone_page_state(page, NR_ZONE_WRITE_PENDING);
+diff --git a/net/batman-adv/log.c b/net/batman-adv/log.c
+index a67b2b0914478..c0ca5fbe5b081 100644
+--- a/net/batman-adv/log.c
++++ b/net/batman-adv/log.c
+@@ -180,6 +180,7 @@ static const struct file_operations batadv_log_fops = {
+ 	.read           = batadv_log_read,
+ 	.poll           = batadv_log_poll,
+ 	.llseek         = no_llseek,
++	.owner          = THIS_MODULE,
+ };
+ 
+ /**
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index 86a23e4a6a50f..b87140a1fa284 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -696,7 +696,7 @@ int fib_gw_from_via(struct fib_config *cfg, struct nlattr *nla,
+ 		cfg->fc_gw4 = *((__be32 *)via->rtvia_addr);
+ 		break;
+ 	case AF_INET6:
+-#ifdef CONFIG_IPV6
++#if IS_ENABLED(CONFIG_IPV6)
+ 		if (alen != sizeof(struct in6_addr)) {
+ 			NL_SET_ERR_MSG(extack, "Invalid IPv6 address in RTA_VIA");
+ 			return -EINVAL;
+diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
+index aa898014ad12f..03c1a39c312a8 100644
+--- a/tools/perf/util/dwarf-aux.c
++++ b/tools/perf/util/dwarf-aux.c
+@@ -373,6 +373,7 @@ bool die_is_func_def(Dwarf_Die *dw_die)
+ int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr)
+ {
+ 	Dwarf_Addr base, end;
++	Dwarf_Attribute attr;
+ 
+ 	if (!addr)
+ 		return -EINVAL;
+@@ -380,6 +381,13 @@ int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr)
+ 	if (dwarf_entrypc(dw_die, addr) == 0)
+ 		return 0;
+ 
++	/*
++	 *  Since the dwarf_ranges() will return 0 if there is no
++	 * DW_AT_ranges attribute, we should check it first.
++	 */
++	if (!dwarf_attr(dw_die, DW_AT_ranges, &attr))
++		return -ENOENT;
++
+ 	return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0;
+ }
+ 
+diff --git a/tools/perf/util/stat-display.c b/tools/perf/util/stat-display.c
+index 493ec372fdec4..f2709879bad96 100644
+--- a/tools/perf/util/stat-display.c
++++ b/tools/perf/util/stat-display.c
+@@ -324,13 +324,10 @@ static int first_shadow_cpu(struct perf_stat_config *config,
+ 	struct evlist *evlist = evsel->evlist;
+ 	int i;
+ 
+-	if (!config->aggr_get_id)
+-		return 0;
+-
+ 	if (config->aggr_mode == AGGR_NONE)
+ 		return id;
+ 
+-	if (config->aggr_mode == AGGR_GLOBAL)
++	if (!config->aggr_get_id)
+ 		return 0;
+ 
+ 	for (i = 0; i < evsel__nr_cpus(evsel); i++) {
+diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
+index 89b390623b63d..54ca751a2b3b3 100644
+--- a/tools/perf/util/synthetic-events.c
++++ b/tools/perf/util/synthetic-events.c
+@@ -563,6 +563,9 @@ int perf_event__synthesize_cgroups(struct perf_tool *tool,
+ 	char cgrp_root[PATH_MAX];
+ 	size_t mount_len;  /* length of mount point in the path */
+ 
++	if (!tool || !tool->cgroup_events)
++		return 0;
++
+ 	if (cgroupfs_find_mountpoint(cgrp_root, PATH_MAX, "perf_event") < 0) {
+ 		pr_debug("cannot find cgroup mount point\n");
+ 		return -1;