[gentoo-commits] proj/linux-patches:4.19 commit in: /

[Mike Pagano]

commit:     82476154d4461d52b9ba7f9b16db179d440f4c05
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 27 16:15:57 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Nov 27 16:15:57 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=82476154

proj/linux-patches: Linux patch 4.19.5

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README             |    4 +
 1004_linux-4.19.5.patch | 4298 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 4302 insertions(+)

diff --git a/0000_README b/0000_README
index f74e5e3..c0b6ddf 100644
--- a/0000_README
+++ b/0000_README
@@ -59,6 +59,10 @@ Patch:  1003_linux-4.19.4.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.19.4
 
+Patch:  1004_linux-4.19.5.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.19.5
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1004_linux-4.19.5.patch b/1004_linux-4.19.5.patch
new file mode 100644
index 0000000..008e859
--- /dev/null
+++ b/1004_linux-4.19.5.patch
@@ -0,0 +1,4298 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 92eb1f42240d..fa4eec22816d 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -1063,7 +1063,7 @@
+ 			earlyprintk=serial[,0x...[,baudrate]]
+ 			earlyprintk=ttySn[,baudrate]
+ 			earlyprintk=dbgp[debugController#]
+-			earlyprintk=pciserial,bus:device.function[,baudrate]
++			earlyprintk=pciserial[,force],bus:device.function[,baudrate]
+ 			earlyprintk=xdbc[xhciController#]
+ 
+ 			earlyprintk is useful when the kernel crashes before
+@@ -1095,6 +1095,10 @@
+ 
+ 			The sclp output can only be used on s390.
+ 
++			The optional "force" to "pciserial" enables use of a
++			PCI device even when its classcode is not of the
++			UART class.
++
+ 	edac_report=	[HW,EDAC] Control how to report EDAC event
+ 			Format: {"on" | "off" | "force"}
+ 			on: enable EDAC to report H/W event. May be overridden
+@@ -4683,6 +4687,8 @@
+ 					prevent spurious wakeup);
+ 				n = USB_QUIRK_DELAY_CTRL_MSG (Device needs a
+ 					pause after every control message);
++				o = USB_QUIRK_HUB_SLOW_RESET (Hub needs extra
++					delay after resetting its port);
+ 			Example: quirks=0781:5580:bk,0a5c:5834:gij
+ 
+ 	usbhid.mousepoll=
+diff --git a/Documentation/x86/x86_64/mm.txt b/Documentation/x86/x86_64/mm.txt
+index 5432a96d31ff..05ef53d83a41 100644
+--- a/Documentation/x86/x86_64/mm.txt
++++ b/Documentation/x86/x86_64/mm.txt
+@@ -4,8 +4,9 @@ Virtual memory map with 4 level page tables:
+ 0000000000000000 - 00007fffffffffff (=47 bits) user space, different per mm
+ hole caused by [47:63] sign extension
+ ffff800000000000 - ffff87ffffffffff (=43 bits) guard hole, reserved for hypervisor
+-ffff880000000000 - ffffc7ffffffffff (=64 TB) direct mapping of all phys. memory
+-ffffc80000000000 - ffffc8ffffffffff (=40 bits) hole
++ffff880000000000 - ffff887fffffffff (=39 bits) LDT remap for PTI
++ffff888000000000 - ffffc87fffffffff (=64 TB) direct mapping of all phys. memory
++ffffc88000000000 - ffffc8ffffffffff (=39 bits) hole
+ ffffc90000000000 - ffffe8ffffffffff (=45 bits) vmalloc/ioremap space
+ ffffe90000000000 - ffffe9ffffffffff (=40 bits) hole
+ ffffea0000000000 - ffffeaffffffffff (=40 bits) virtual memory map (1TB)
+@@ -30,8 +31,9 @@ Virtual memory map with 5 level page tables:
+ 0000000000000000 - 00ffffffffffffff (=56 bits) user space, different per mm
+ hole caused by [56:63] sign extension
+ ff00000000000000 - ff0fffffffffffff (=52 bits) guard hole, reserved for hypervisor
+-ff10000000000000 - ff8fffffffffffff (=55 bits) direct mapping of all phys. memory
+-ff90000000000000 - ff9fffffffffffff (=52 bits) LDT remap for PTI
++ff10000000000000 - ff10ffffffffffff (=48 bits) LDT remap for PTI
++ff11000000000000 - ff90ffffffffffff (=55 bits) direct mapping of all phys. memory
++ff91000000000000 - ff9fffffffffffff (=3840 TB) hole
+ ffa0000000000000 - ffd1ffffffffffff (=54 bits) vmalloc/ioremap space (12800 TB)
+ ffd2000000000000 - ffd3ffffffffffff (=49 bits) hole
+ ffd4000000000000 - ffd5ffffffffffff (=49 bits) virtual memory map (512TB)
+diff --git a/Makefile b/Makefile
+index 1f3c7adeea63..a07830185bdf 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 4
++SUBLEVEL = 5
+ EXTRAVERSION =
+ NAME = "People's Front"
+ 
+diff --git a/arch/arm/boot/dts/imx53-ppd.dts b/arch/arm/boot/dts/imx53-ppd.dts
+index cdb90bee7b4a..f202396e3f2a 100644
+--- a/arch/arm/boot/dts/imx53-ppd.dts
++++ b/arch/arm/boot/dts/imx53-ppd.dts
+@@ -55,7 +55,7 @@
+ 	};
+ 
+ 	chosen {
+-		stdout-path = "&uart1:115200n8";
++		stdout-path = "serial0:115200n8";
+ 	};
+ 
+ 	memory@70000000 {
+diff --git a/arch/arm/boot/dts/imx6sll.dtsi b/arch/arm/boot/dts/imx6sll.dtsi
+index 000e6136a9d6..3e6ffaf5f104 100644
+--- a/arch/arm/boot/dts/imx6sll.dtsi
++++ b/arch/arm/boot/dts/imx6sll.dtsi
+@@ -709,7 +709,7 @@
+ 			i2c1: i2c@21a0000 {
+ 				#address-cells = <1>;
+ 				#size-cells = <0>;
+-				compatible = "fs,imx6sll-i2c", "fsl,imx21-i2c";
++				compatible = "fsl,imx6sll-i2c", "fsl,imx21-i2c";
+ 				reg = <0x021a0000 0x4000>;
+ 				interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
+ 				clocks = <&clks IMX6SLL_CLK_I2C1>;
+diff --git a/arch/arm/boot/dts/vf610m4-colibri.dts b/arch/arm/boot/dts/vf610m4-colibri.dts
+index 41ec66a96990..ca6249558760 100644
+--- a/arch/arm/boot/dts/vf610m4-colibri.dts
++++ b/arch/arm/boot/dts/vf610m4-colibri.dts
+@@ -50,8 +50,8 @@
+ 	compatible = "fsl,vf610m4";
+ 
+ 	chosen {
+-		bootargs = "console=ttyLP2,115200 clk_ignore_unused init=/linuxrc rw";
+-		stdout-path = "&uart2";
++		bootargs = "clk_ignore_unused init=/linuxrc rw";
++		stdout-path = "serial2:115200";
+ 	};
+ 
+ 	memory@8c000000 {
+diff --git a/arch/arm64/boot/dts/renesas/r8a7795.dtsi b/arch/arm64/boot/dts/renesas/r8a7795.dtsi
+index fb9d08ad7659..c87eed77de2c 100644
+--- a/arch/arm64/boot/dts/renesas/r8a7795.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a7795.dtsi
+@@ -662,7 +662,7 @@
+ 			clock-names = "fck", "brg_int", "scif_clk";
+ 			dmas = <&dmac1 0x35>, <&dmac1 0x34>,
+ 			       <&dmac2 0x35>, <&dmac2 0x34>;
+-			dma-names = "tx", "rx";
++			dma-names = "tx", "rx", "tx", "rx";
+ 			power-domains = <&sysc R8A7795_PD_ALWAYS_ON>;
+ 			resets = <&cpg 518>;
+ 			status = "disabled";
+diff --git a/arch/arm64/boot/dts/renesas/r8a77980-condor.dts b/arch/arm64/boot/dts/renesas/r8a77980-condor.dts
+index 9f25c407dfd7..e830b6162375 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77980-condor.dts
++++ b/arch/arm64/boot/dts/renesas/r8a77980-condor.dts
+@@ -15,7 +15,7 @@
+ 
+ 	aliases {
+ 		serial0 = &scif0;
+-		ethernet0 = &avb;
++		ethernet0 = &gether;
+ 	};
+ 
+ 	chosen {
+@@ -47,23 +47,6 @@
+ 	};
+ };
+ 
+-&avb {
+-	pinctrl-0 = <&avb_pins>;
+-	pinctrl-names = "default";
+-
+-	phy-mode = "rgmii-id";
+-	phy-handle = <&phy0>;
+-	renesas,no-ether-link;
+-	status = "okay";
+-
+-	phy0: ethernet-phy@0 {
+-		rxc-skew-ps = <1500>;
+-		reg = <0>;
+-		interrupt-parent = <&gpio1>;
+-		interrupts = <17 IRQ_TYPE_LEVEL_LOW>;
+-	};
+-};
+-
+ &canfd {
+ 	pinctrl-0 = <&canfd0_pins>;
+ 	pinctrl-names = "default";
+@@ -82,6 +65,23 @@
+ 	clock-frequency = <32768>;
+ };
+ 
++&gether {
++	pinctrl-0 = <&gether_pins>;
++	pinctrl-names = "default";
++
++	phy-mode = "rgmii-id";
++	phy-handle = <&phy0>;
++	renesas,no-ether-link;
++	status = "okay";
++
++	phy0: ethernet-phy@0 {
++		rxc-skew-ps = <1500>;
++		reg = <0>;
++		interrupt-parent = <&gpio4>;
++		interrupts = <23 IRQ_TYPE_LEVEL_LOW>;
++	};
++};
++
+ &i2c0 {
+ 	pinctrl-0 = <&i2c0_pins>;
+ 	pinctrl-names = "default";
+@@ -118,16 +118,17 @@
+ };
+ 
+ &pfc {
+-	avb_pins: avb {
+-		groups = "avb_mdio", "avb_rgmii";
+-		function = "avb";
+-	};
+-
+ 	canfd0_pins: canfd0 {
+ 		groups = "canfd0_data_a";
+ 		function = "canfd0";
+ 	};
+ 
++	gether_pins: gether {
++		groups = "gether_mdio_a", "gether_rgmii",
++			 "gether_txcrefclk", "gether_txcrefclk_mega";
++		function = "gether";
++	};
++
+ 	i2c0_pins: i2c0 {
+ 		groups = "i2c0";
+ 		function = "i2c0";
+diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
+index 9234013e759e..21a81b59a0cc 100644
+--- a/arch/arm64/include/asm/percpu.h
++++ b/arch/arm64/include/asm/percpu.h
+@@ -96,6 +96,7 @@ static inline unsigned long __percpu_##op(void *ptr,			\
+ 		: [val] "Ir" (val));					\
+ 		break;							\
+ 	default:							\
++		ret = 0;						\
+ 		BUILD_BUG();						\
+ 	}								\
+ 									\
+@@ -125,6 +126,7 @@ static inline unsigned long __percpu_read(void *ptr, int size)
+ 		ret = READ_ONCE(*(u64 *)ptr);
+ 		break;
+ 	default:
++		ret = 0;
+ 		BUILD_BUG();
+ 	}
+ 
+@@ -194,6 +196,7 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val,
+ 		: [val] "r" (val));
+ 		break;
+ 	default:
++		ret = 0;
+ 		BUILD_BUG();
+ 	}
+ 
+diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
+index e78c3ef04d95..b5a367d4bba6 100644
+--- a/arch/arm64/kernel/probes/kprobes.c
++++ b/arch/arm64/kernel/probes/kprobes.c
+@@ -23,7 +23,9 @@
+ #include <linux/slab.h>
+ #include <linux/stop_machine.h>
+ #include <linux/sched/debug.h>
++#include <linux/set_memory.h>
+ #include <linux/stringify.h>
++#include <linux/vmalloc.h>
+ #include <asm/traps.h>
+ #include <asm/ptrace.h>
+ #include <asm/cacheflush.h>
+@@ -42,10 +44,21 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
+ static void __kprobes
+ post_kprobe_handler(struct kprobe_ctlblk *, struct pt_regs *);
+ 
++static int __kprobes patch_text(kprobe_opcode_t *addr, u32 opcode)
++{
++	void *addrs[1];
++	u32 insns[1];
++
++	addrs[0] = addr;
++	insns[0] = opcode;
++
++	return aarch64_insn_patch_text(addrs, insns, 1);
++}
++
+ static void __kprobes arch_prepare_ss_slot(struct kprobe *p)
+ {
+ 	/* prepare insn slot */
+-	p->ainsn.api.insn[0] = cpu_to_le32(p->opcode);
++	patch_text(p->ainsn.api.insn, p->opcode);
+ 
+ 	flush_icache_range((uintptr_t) (p->ainsn.api.insn),
+ 			   (uintptr_t) (p->ainsn.api.insn) +
+@@ -118,15 +131,15 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
+ 	return 0;
+ }
+ 
+-static int __kprobes patch_text(kprobe_opcode_t *addr, u32 opcode)
++void *alloc_insn_page(void)
+ {
+-	void *addrs[1];
+-	u32 insns[1];
++	void *page;
+ 
+-	addrs[0] = (void *)addr;
+-	insns[0] = (u32)opcode;
++	page = vmalloc_exec(PAGE_SIZE);
++	if (page)
++		set_memory_ro((unsigned long)page, 1);
+ 
+-	return aarch64_insn_patch_text(addrs, insns, 1);
++	return page;
+ }
+ 
+ /* arm kprobe: install breakpoint in text */
+diff --git a/arch/mips/configs/cavium_octeon_defconfig b/arch/mips/configs/cavium_octeon_defconfig
+index 490b12af103c..c52d0efacd14 100644
+--- a/arch/mips/configs/cavium_octeon_defconfig
++++ b/arch/mips/configs/cavium_octeon_defconfig
+@@ -140,6 +140,7 @@ CONFIG_RTC_CLASS=y
+ CONFIG_RTC_DRV_DS1307=y
+ CONFIG_STAGING=y
+ CONFIG_OCTEON_ETHERNET=y
++CONFIG_OCTEON_USB=y
+ # CONFIG_IOMMU_SUPPORT is not set
+ CONFIG_RAS=y
+ CONFIG_EXT4_FS=y
+diff --git a/arch/riscv/include/asm/uaccess.h b/arch/riscv/include/asm/uaccess.h
+index 473cfc84e412..8c3e3e3c8be1 100644
+--- a/arch/riscv/include/asm/uaccess.h
++++ b/arch/riscv/include/asm/uaccess.h
+@@ -400,13 +400,13 @@ extern unsigned long __must_check __asm_copy_from_user(void *to,
+ static inline unsigned long
+ raw_copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+-	return __asm_copy_to_user(to, from, n);
++	return __asm_copy_from_user(to, from, n);
+ }
+ 
+ static inline unsigned long
+ raw_copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
+-	return __asm_copy_from_user(to, from, n);
++	return __asm_copy_to_user(to, from, n);
+ }
+ 
+ extern long strncpy_from_user(char *dest, const char __user *src, long count);
+diff --git a/arch/s390/boot/compressed/Makefile b/arch/s390/boot/compressed/Makefile
+index 04609478d18b..b375c6c5ae7b 100644
+--- a/arch/s390/boot/compressed/Makefile
++++ b/arch/s390/boot/compressed/Makefile
+@@ -20,7 +20,7 @@ KBUILD_CFLAGS := $(KBUILD_CFLAGS_DECOMPRESSOR)
+ OBJECTS := $(addprefix $(obj)/,$(obj-y))
+ 
+ LDFLAGS_vmlinux := --oformat $(LD_BFD) -e startup -T
+-$(obj)/vmlinux: $(obj)/vmlinux.lds $(objtree)/arch/s390/boot/startup.a $(OBJECTS)
++$(obj)/vmlinux: $(obj)/vmlinux.lds $(objtree)/arch/s390/boot/startup.a $(OBJECTS) FORCE
+ 	$(call if_changed,ld)
+ 
+ # extract required uncompressed vmlinux symbols and adjust them to reflect offsets inside vmlinux.bin
+@@ -51,17 +51,17 @@ suffix-$(CONFIG_KERNEL_LZMA)  := .lzma
+ suffix-$(CONFIG_KERNEL_LZO)  := .lzo
+ suffix-$(CONFIG_KERNEL_XZ)  := .xz
+ 
+-$(obj)/vmlinux.bin.gz: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.gz: $(vmlinux.bin.all-y) FORCE
+ 	$(call if_changed,gzip)
+-$(obj)/vmlinux.bin.bz2: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.bz2: $(vmlinux.bin.all-y) FORCE
+ 	$(call if_changed,bzip2)
+-$(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y) FORCE
+ 	$(call if_changed,lz4)
+-$(obj)/vmlinux.bin.lzma: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.lzma: $(vmlinux.bin.all-y) FORCE
+ 	$(call if_changed,lzma)
+-$(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y) FORCE
+ 	$(call if_changed,lzo)
+-$(obj)/vmlinux.bin.xz: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.xz: $(vmlinux.bin.all-y) FORCE
+ 	$(call if_changed,xzkern)
+ 
+ LDFLAGS_piggy.o := -r --format binary --oformat $(LD_BFD) -T
+diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
+index 0717ee76885d..f1ab9420ccfb 100644
+--- a/arch/s390/include/asm/mmu_context.h
++++ b/arch/s390/include/asm/mmu_context.h
+@@ -45,8 +45,6 @@ static inline int init_new_context(struct task_struct *tsk,
+ 		mm->context.asce_limit = STACK_TOP_MAX;
+ 		mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
+ 				   _ASCE_USER_BITS | _ASCE_TYPE_REGION3;
+-		/* pgd_alloc() did not account this pud */
+-		mm_inc_nr_puds(mm);
+ 		break;
+ 	case -PAGE_SIZE:
+ 		/* forked 5-level task, set new asce with new_mm->pgd */
+@@ -62,9 +60,6 @@ static inline int init_new_context(struct task_struct *tsk,
+ 		/* forked 2-level compat task, set new asce with new mm->pgd */
+ 		mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
+ 				   _ASCE_USER_BITS | _ASCE_TYPE_SEGMENT;
+-		/* pgd_alloc() did not account this pmd */
+-		mm_inc_nr_pmds(mm);
+-		mm_inc_nr_puds(mm);
+ 	}
+ 	crst_table_init((unsigned long *) mm->pgd, pgd_entry_type(mm));
+ 	return 0;
+diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h
+index f0f9bcf94c03..5ee733720a57 100644
+--- a/arch/s390/include/asm/pgalloc.h
++++ b/arch/s390/include/asm/pgalloc.h
+@@ -36,11 +36,11 @@ static inline void crst_table_init(unsigned long *crst, unsigned long entry)
+ 
+ static inline unsigned long pgd_entry_type(struct mm_struct *mm)
+ {
+-	if (mm->context.asce_limit <= _REGION3_SIZE)
++	if (mm_pmd_folded(mm))
+ 		return _SEGMENT_ENTRY_EMPTY;
+-	if (mm->context.asce_limit <= _REGION2_SIZE)
++	if (mm_pud_folded(mm))
+ 		return _REGION3_ENTRY_EMPTY;
+-	if (mm->context.asce_limit <= _REGION1_SIZE)
++	if (mm_p4d_folded(mm))
+ 		return _REGION2_ENTRY_EMPTY;
+ 	return _REGION1_ENTRY_EMPTY;
+ }
+diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
+index 0e7cb0dc9c33..de05466ce50c 100644
+--- a/arch/s390/include/asm/pgtable.h
++++ b/arch/s390/include/asm/pgtable.h
+@@ -485,6 +485,24 @@ static inline int is_module_addr(void *addr)
+ 				   _REGION_ENTRY_PROTECT | \
+ 				   _REGION_ENTRY_NOEXEC)
+ 
++static inline bool mm_p4d_folded(struct mm_struct *mm)
++{
++	return mm->context.asce_limit <= _REGION1_SIZE;
++}
++#define mm_p4d_folded(mm) mm_p4d_folded(mm)
++
++static inline bool mm_pud_folded(struct mm_struct *mm)
++{
++	return mm->context.asce_limit <= _REGION2_SIZE;
++}
++#define mm_pud_folded(mm) mm_pud_folded(mm)
++
++static inline bool mm_pmd_folded(struct mm_struct *mm)
++{
++	return mm->context.asce_limit <= _REGION3_SIZE;
++}
++#define mm_pmd_folded(mm) mm_pmd_folded(mm)
++
+ static inline int mm_has_pgste(struct mm_struct *mm)
+ {
+ #ifdef CONFIG_PGSTE
+diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h
+index 457b7ba0fbb6..b31c779cf581 100644
+--- a/arch/s390/include/asm/tlb.h
++++ b/arch/s390/include/asm/tlb.h
+@@ -136,7 +136,7 @@ static inline void pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
+ static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
+ 				unsigned long address)
+ {
+-	if (tlb->mm->context.asce_limit <= _REGION3_SIZE)
++	if (mm_pmd_folded(tlb->mm))
+ 		return;
+ 	pgtable_pmd_page_dtor(virt_to_page(pmd));
+ 	tlb_remove_table(tlb, pmd);
+@@ -152,7 +152,7 @@ static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
+ static inline void p4d_free_tlb(struct mmu_gather *tlb, p4d_t *p4d,
+ 				unsigned long address)
+ {
+-	if (tlb->mm->context.asce_limit <= _REGION1_SIZE)
++	if (mm_p4d_folded(tlb->mm))
+ 		return;
+ 	tlb_remove_table(tlb, p4d);
+ }
+@@ -167,7 +167,7 @@ static inline void p4d_free_tlb(struct mmu_gather *tlb, p4d_t *p4d,
+ static inline void pud_free_tlb(struct mmu_gather *tlb, pud_t *pud,
+ 				unsigned long address)
+ {
+-	if (tlb->mm->context.asce_limit <= _REGION2_SIZE)
++	if (mm_pud_folded(tlb->mm))
+ 		return;
+ 	tlb_remove_table(tlb, pud);
+ }
+diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c
+index cc085e2d2ce9..74091fd3101e 100644
+--- a/arch/s390/kernel/perf_cpum_cf.c
++++ b/arch/s390/kernel/perf_cpum_cf.c
+@@ -373,7 +373,7 @@ static int __hw_perf_event_init(struct perf_event *event)
+ 		return -ENOENT;
+ 
+ 	if (ev > PERF_CPUM_CF_MAX_CTR)
+-		return -EINVAL;
++		return -ENOENT;
+ 
+ 	/* Obtain the counter set to which the specified counter belongs */
+ 	set = get_counter_set(ev);
+diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile
+index c5c856f320bc..04dd3e2c3bd9 100644
+--- a/arch/s390/kernel/vdso32/Makefile
++++ b/arch/s390/kernel/vdso32/Makefile
+@@ -36,7 +36,7 @@ UBSAN_SANITIZE := n
+ $(obj)/vdso32_wrapper.o : $(obj)/vdso32.so
+ 
+ # link rule for the .so file, .lds has to be first
+-$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32)
++$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32) FORCE
+ 	$(call if_changed,vdso32ld)
+ 
+ # strip rule for the .so file
+@@ -45,12 +45,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
+ 	$(call if_changed,objcopy)
+ 
+ # assembly rules for the .S files
+-$(obj-vdso32): %.o: %.S
++$(obj-vdso32): %.o: %.S FORCE
+ 	$(call if_changed_dep,vdso32as)
+ 
+ # actual build commands
+ quiet_cmd_vdso32ld = VDSO32L $@
+-      cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $^ -o $@
++      cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@
+ quiet_cmd_vdso32as = VDSO32A $@
+       cmd_vdso32as = $(CC) $(a_flags) -c -o $@ $<
+ 
+diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile
+index 15b1ceafc4c1..ddebc26cd949 100644
+--- a/arch/s390/kernel/vdso64/Makefile
++++ b/arch/s390/kernel/vdso64/Makefile
+@@ -36,7 +36,7 @@ UBSAN_SANITIZE := n
+ $(obj)/vdso64_wrapper.o : $(obj)/vdso64.so
+ 
+ # link rule for the .so file, .lds has to be first
+-$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64)
++$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64) FORCE
+ 	$(call if_changed,vdso64ld)
+ 
+ # strip rule for the .so file
+@@ -45,12 +45,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
+ 	$(call if_changed,objcopy)
+ 
+ # assembly rules for the .S files
+-$(obj-vdso64): %.o: %.S
++$(obj-vdso64): %.o: %.S FORCE
+ 	$(call if_changed_dep,vdso64as)
+ 
+ # actual build commands
+ quiet_cmd_vdso64ld = VDSO64L $@
+-      cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $^ -o $@
++      cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@
+ quiet_cmd_vdso64as = VDSO64A $@
+       cmd_vdso64as = $(CC) $(a_flags) -c -o $@ $<
+ 
+diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c
+index 76d89ee8b428..814f26520aa2 100644
+--- a/arch/s390/mm/pgalloc.c
++++ b/arch/s390/mm/pgalloc.c
+@@ -101,6 +101,7 @@ int crst_table_upgrade(struct mm_struct *mm, unsigned long end)
+ 			mm->context.asce_limit = _REGION1_SIZE;
+ 			mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
+ 				_ASCE_USER_BITS | _ASCE_TYPE_REGION2;
++			mm_inc_nr_puds(mm);
+ 		} else {
+ 			crst_table_init(table, _REGION1_ENTRY_EMPTY);
+ 			pgd_populate(mm, (pgd_t *) table, (p4d_t *) pgd);
+diff --git a/arch/s390/numa/numa.c b/arch/s390/numa/numa.c
+index 5bd374491f94..6c151b42e65d 100644
+--- a/arch/s390/numa/numa.c
++++ b/arch/s390/numa/numa.c
+@@ -54,6 +54,7 @@ int __node_distance(int a, int b)
+ {
+ 	return mode->distance ? mode->distance(a, b) : 0;
+ }
++EXPORT_SYMBOL(__node_distance);
+ 
+ int numa_debug_enabled;
+ 
+diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
+index c94c3bd70ccd..df4a985716eb 100644
+--- a/arch/um/os-Linux/skas/process.c
++++ b/arch/um/os-Linux/skas/process.c
+@@ -610,6 +610,11 @@ int start_idle_thread(void *stack, jmp_buf *switch_buf)
+ 		fatal_sigsegv();
+ 	}
+ 	longjmp(*switch_buf, 1);
++
++	/* unreachable */
++	printk(UM_KERN_ERR "impossible long jump!");
++	fatal_sigsegv();
++	return 0;
+ }
+ 
+ void initial_thread_cb_skas(void (*proc)(void *), void *arg)
+diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
+index 6afac386a434..b99d497e342d 100644
+--- a/arch/x86/include/asm/page_64_types.h
++++ b/arch/x86/include/asm/page_64_types.h
+@@ -33,12 +33,14 @@
+ 
+ /*
+  * Set __PAGE_OFFSET to the most negative possible address +
+- * PGDIR_SIZE*16 (pgd slot 272).  The gap is to allow a space for a
+- * hypervisor to fit.  Choosing 16 slots here is arbitrary, but it's
+- * what Xen requires.
++ * PGDIR_SIZE*17 (pgd slot 273).
++ *
++ * The gap is to allow a space for LDT remap for PTI (1 pgd slot) and space for
++ * a hypervisor (16 slots). Choosing 16 slots for a hypervisor is arbitrary,
++ * but it's what Xen requires.
+  */
+-#define __PAGE_OFFSET_BASE_L5	_AC(0xff10000000000000, UL)
+-#define __PAGE_OFFSET_BASE_L4	_AC(0xffff880000000000, UL)
++#define __PAGE_OFFSET_BASE_L5	_AC(0xff11000000000000, UL)
++#define __PAGE_OFFSET_BASE_L4	_AC(0xffff888000000000, UL)
+ 
+ #ifdef CONFIG_DYNAMIC_MEMORY_LAYOUT
+ #define __PAGE_OFFSET           page_offset_base
+diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
+index 04edd2d58211..84bd9bdc1987 100644
+--- a/arch/x86/include/asm/pgtable_64_types.h
++++ b/arch/x86/include/asm/pgtable_64_types.h
+@@ -111,9 +111,7 @@ extern unsigned int ptrs_per_p4d;
+  */
+ #define MAXMEM			(1UL << MAX_PHYSMEM_BITS)
+ 
+-#define LDT_PGD_ENTRY_L4	-3UL
+-#define LDT_PGD_ENTRY_L5	-112UL
+-#define LDT_PGD_ENTRY		(pgtable_l5_enabled() ? LDT_PGD_ENTRY_L5 : LDT_PGD_ENTRY_L4)
++#define LDT_PGD_ENTRY		-240UL
+ #define LDT_BASE_ADDR		(LDT_PGD_ENTRY << PGDIR_SHIFT)
+ #define LDT_END_ADDR		(LDT_BASE_ADDR + PGDIR_SIZE)
+ 
+diff --git a/arch/x86/kernel/early_printk.c b/arch/x86/kernel/early_printk.c
+index 5e801c8c8ce7..374a52fa5296 100644
+--- a/arch/x86/kernel/early_printk.c
++++ b/arch/x86/kernel/early_printk.c
+@@ -213,8 +213,9 @@ static unsigned int mem32_serial_in(unsigned long addr, int offset)
+  * early_pci_serial_init()
+  *
+  * This function is invoked when the early_printk param starts with "pciserial"
+- * The rest of the param should be ",B:D.F,baud" where B, D & F describe the
+- * location of a PCI device that must be a UART device.
++ * The rest of the param should be "[force],B:D.F,baud", where B, D & F describe
++ * the location of a PCI device that must be a UART device. "force" is optional
++ * and overrides the use of an UART device with a wrong PCI class code.
+  */
+ static __init void early_pci_serial_init(char *s)
+ {
+@@ -224,17 +225,23 @@ static __init void early_pci_serial_init(char *s)
+ 	u32 classcode, bar0;
+ 	u16 cmdreg;
+ 	char *e;
++	int force = 0;
+ 
+-
+-	/*
+-	 * First, part the param to get the BDF values
+-	 */
+ 	if (*s == ',')
+ 		++s;
+ 
+ 	if (*s == 0)
+ 		return;
+ 
++	/* Force the use of an UART device with wrong class code */
++	if (!strncmp(s, "force,", 6)) {
++		force = 1;
++		s += 6;
++	}
++
++	/*
++	 * Part the param to get the BDF values
++	 */
+ 	bus = (u8)simple_strtoul(s, &e, 16);
+ 	s = e;
+ 	if (*s != ':')
+@@ -253,7 +260,7 @@ static __init void early_pci_serial_init(char *s)
+ 		s++;
+ 
+ 	/*
+-	 * Second, find the device from the BDF
++	 * Find the device from the BDF
+ 	 */
+ 	cmdreg = read_pci_config(bus, slot, func, PCI_COMMAND);
+ 	classcode = read_pci_config(bus, slot, func, PCI_CLASS_REVISION);
+@@ -264,8 +271,10 @@ static __init void early_pci_serial_init(char *s)
+ 	 */
+ 	if (((classcode >> 16 != PCI_CLASS_COMMUNICATION_MODEM) &&
+ 	     (classcode >> 16 != PCI_CLASS_COMMUNICATION_SERIAL)) ||
+-	   (((classcode >> 8) & 0xff) != 0x02)) /* 16550 I/F at BAR0 */
+-		return;
++	   (((classcode >> 8) & 0xff) != 0x02)) /* 16550 I/F at BAR0 */ {
++		if (!force)
++			return;
++	}
+ 
+ 	/*
+ 	 * Determine if it is IO or memory mapped
+@@ -289,7 +298,7 @@ static __init void early_pci_serial_init(char *s)
+ 	}
+ 
+ 	/*
+-	 * Lastly, initialize the hardware
++	 * Initialize the hardware
+ 	 */
+ 	if (*s) {
+ 		if (strcmp(s, "nocfg") == 0)
+diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
+index 733e6ace0fa4..65590eee6289 100644
+--- a/arch/x86/kernel/ldt.c
++++ b/arch/x86/kernel/ldt.c
+@@ -199,14 +199,6 @@ static void sanity_check_ldt_mapping(struct mm_struct *mm)
+ /*
+  * If PTI is enabled, this maps the LDT into the kernelmode and
+  * usermode tables for the given mm.
+- *
+- * There is no corresponding unmap function.  Even if the LDT is freed, we
+- * leave the PTEs around until the slot is reused or the mm is destroyed.
+- * This is harmless: the LDT is always in ordinary memory, and no one will
+- * access the freed slot.
+- *
+- * If we wanted to unmap freed LDTs, we'd also need to do a flush to make
+- * it useful, and the flush would slow down modify_ldt().
+  */
+ static int
+ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
+@@ -214,8 +206,7 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
+ 	unsigned long va;
+ 	bool is_vmalloc;
+ 	spinlock_t *ptl;
+-	pgd_t *pgd;
+-	int i;
++	int i, nr_pages;
+ 
+ 	if (!static_cpu_has(X86_FEATURE_PTI))
+ 		return 0;
+@@ -229,16 +220,11 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
+ 	/* Check if the current mappings are sane */
+ 	sanity_check_ldt_mapping(mm);
+ 
+-	/*
+-	 * Did we already have the top level entry allocated?  We can't
+-	 * use pgd_none() for this because it doens't do anything on
+-	 * 4-level page table kernels.
+-	 */
+-	pgd = pgd_offset(mm, LDT_BASE_ADDR);
+-
+ 	is_vmalloc = is_vmalloc_addr(ldt->entries);
+ 
+-	for (i = 0; i * PAGE_SIZE < ldt->nr_entries * LDT_ENTRY_SIZE; i++) {
++	nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE);
++
++	for (i = 0; i < nr_pages; i++) {
+ 		unsigned long offset = i << PAGE_SHIFT;
+ 		const void *src = (char *)ldt->entries + offset;
+ 		unsigned long pfn;
+@@ -272,13 +258,39 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
+ 	/* Propagate LDT mapping to the user page-table */
+ 	map_ldt_struct_to_user(mm);
+ 
+-	va = (unsigned long)ldt_slot_va(slot);
+-	flush_tlb_mm_range(mm, va, va + LDT_SLOT_STRIDE, 0);
+-
+ 	ldt->slot = slot;
+ 	return 0;
+ }
+ 
++static void unmap_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt)
++{
++	unsigned long va;
++	int i, nr_pages;
++
++	if (!ldt)
++		return;
++
++	/* LDT map/unmap is only required for PTI */
++	if (!static_cpu_has(X86_FEATURE_PTI))
++		return;
++
++	nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE);
++
++	for (i = 0; i < nr_pages; i++) {
++		unsigned long offset = i << PAGE_SHIFT;
++		spinlock_t *ptl;
++		pte_t *ptep;
++
++		va = (unsigned long)ldt_slot_va(ldt->slot) + offset;
++		ptep = get_locked_pte(mm, va, &ptl);
++		pte_clear(mm, va, ptep);
++		pte_unmap_unlock(ptep, ptl);
++	}
++
++	va = (unsigned long)ldt_slot_va(ldt->slot);
++	flush_tlb_mm_range(mm, va, va + nr_pages * PAGE_SIZE, 0);
++}
++
+ #else /* !CONFIG_PAGE_TABLE_ISOLATION */
+ 
+ static int
+@@ -286,6 +298,10 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
+ {
+ 	return 0;
+ }
++
++static void unmap_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt)
++{
++}
+ #endif /* CONFIG_PAGE_TABLE_ISOLATION */
+ 
+ static void free_ldt_pgtables(struct mm_struct *mm)
+@@ -524,6 +540,7 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+ 	}
+ 
+ 	install_ldt(mm, new_ldt);
++	unmap_ldt_struct(mm, old_ldt);
+ 	free_ldt_struct(old_ldt);
+ 	error = 0;
+ 
+diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
+index dd461c0167ef..2c84c6ad8b50 100644
+--- a/arch/x86/xen/mmu_pv.c
++++ b/arch/x86/xen/mmu_pv.c
+@@ -1897,7 +1897,7 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
+ 	init_top_pgt[0] = __pgd(0);
+ 
+ 	/* Pre-constructed entries are in pfn, so convert to mfn */
+-	/* L4[272] -> level3_ident_pgt  */
++	/* L4[273] -> level3_ident_pgt  */
+ 	/* L4[511] -> level3_kernel_pgt */
+ 	convert_pfn_mfn(init_top_pgt);
+ 
+@@ -1917,8 +1917,8 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
+ 	addr[0] = (unsigned long)pgd;
+ 	addr[1] = (unsigned long)l3;
+ 	addr[2] = (unsigned long)l2;
+-	/* Graft it onto L4[272][0]. Note that we creating an aliasing problem:
+-	 * Both L4[272][0] and L4[511][510] have entries that point to the same
++	/* Graft it onto L4[273][0]. Note that we creating an aliasing problem:
++	 * Both L4[273][0] and L4[511][510] have entries that point to the same
+ 	 * L2 (PMD) tables. Meaning that if you modify it in __va space
+ 	 * it will be also modified in the __ka space! (But if you just
+ 	 * modify the PMD table to point to other PTE's or none, then you
+diff --git a/block/bio.c b/block/bio.c
+index 0093bed81c0e..41173710430c 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -1261,6 +1261,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
+ 		if (ret)
+ 			goto cleanup;
+ 	} else {
++		zero_fill_bio(bio);
+ 		iov_iter_advance(iter, bio->bi_iter.bi_size);
+ 	}
+ 
+diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
+index eaa60c94205a..1f32caa87686 100644
+--- a/drivers/acpi/acpi_platform.c
++++ b/drivers/acpi/acpi_platform.c
+@@ -30,6 +30,7 @@ static const struct acpi_device_id forbidden_id_list[] = {
+ 	{"PNP0200",  0},	/* AT DMA Controller */
+ 	{"ACPI0009", 0},	/* IOxAPIC */
+ 	{"ACPI000A", 0},	/* IOAPIC */
++	{"SMB0001",  0},	/* ACPI SMBUS virtual device */
+ 	{"", 0},
+ };
+ 
+diff --git a/drivers/block/brd.c b/drivers/block/brd.c
+index df8103dd40ac..c18586fccb6f 100644
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -396,15 +396,14 @@ static struct brd_device *brd_alloc(int i)
+ 	disk->first_minor	= i * max_part;
+ 	disk->fops		= &brd_fops;
+ 	disk->private_data	= brd;
+-	disk->queue		= brd->brd_queue;
+ 	disk->flags		= GENHD_FL_EXT_DEVT;
+ 	sprintf(disk->disk_name, "ram%d", i);
+ 	set_capacity(disk, rd_size * 2);
+-	disk->queue->backing_dev_info->capabilities |= BDI_CAP_SYNCHRONOUS_IO;
++	brd->brd_queue->backing_dev_info->capabilities |= BDI_CAP_SYNCHRONOUS_IO;
+ 
+ 	/* Tell the block layer that this is not a rotational device */
+-	blk_queue_flag_set(QUEUE_FLAG_NONROT, disk->queue);
+-	blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, disk->queue);
++	blk_queue_flag_set(QUEUE_FLAG_NONROT, brd->brd_queue);
++	blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, brd->brd_queue);
+ 
+ 	return brd;
+ 
+@@ -436,6 +435,7 @@ static struct brd_device *brd_init_one(int i, bool *new)
+ 
+ 	brd = brd_alloc(i);
+ 	if (brd) {
++		brd->brd_disk->queue = brd->brd_queue;
+ 		add_disk(brd->brd_disk);
+ 		list_add_tail(&brd->brd_list, &brd_devices);
+ 	}
+@@ -503,8 +503,14 @@ static int __init brd_init(void)
+ 
+ 	/* point of no return */
+ 
+-	list_for_each_entry(brd, &brd_devices, brd_list)
++	list_for_each_entry(brd, &brd_devices, brd_list) {
++		/*
++		 * associate with queue just before adding disk for
++		 * avoiding to mess up failure path
++		 */
++		brd->brd_disk->queue = brd->brd_queue;
+ 		add_disk(brd->brd_disk);
++	}
+ 
+ 	blk_register_region(MKDEV(RAMDISK_MAJOR, 0), 1UL << MINORBITS,
+ 				  THIS_MODULE, brd_probe, NULL, NULL);
+diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c
+index 20724abd38bd..7df6b5b1e7ee 100644
+--- a/drivers/clk/clk-fixed-factor.c
++++ b/drivers/clk/clk-fixed-factor.c
+@@ -210,6 +210,7 @@ static int of_fixed_factor_clk_remove(struct platform_device *pdev)
+ {
+ 	struct clk *clk = platform_get_drvdata(pdev);
+ 
++	of_clk_del_provider(pdev->dev.of_node);
+ 	clk_unregister_fixed_factor(clk);
+ 
+ 	return 0;
+diff --git a/drivers/clk/clk-fixed-rate.c b/drivers/clk/clk-fixed-rate.c
+index b5c46b3f8764..6d6475c32ee5 100644
+--- a/drivers/clk/clk-fixed-rate.c
++++ b/drivers/clk/clk-fixed-rate.c
+@@ -200,6 +200,7 @@ static int of_fixed_clk_remove(struct platform_device *pdev)
+ {
+ 	struct clk *clk = platform_get_drvdata(pdev);
+ 
++	of_clk_del_provider(pdev->dev.of_node);
+ 	clk_unregister_fixed_rate(clk);
+ 
+ 	return 0;
+diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c
+index 8cf74fc423e6..02229d051d77 100644
+--- a/drivers/clk/meson/axg.c
++++ b/drivers/clk/meson/axg.c
+@@ -96,7 +96,6 @@ static struct clk_regmap axg_sys_pll = {
+ 		.ops = &meson_clk_pll_ro_ops,
+ 		.parent_names = (const char *[]){ "xtal" },
+ 		.num_parents = 1,
+-		.flags = CLK_GET_RATE_NOCACHE,
+ 	},
+ };
+ 
+@@ -713,12 +712,14 @@ static struct clk_regmap axg_pcie_mux = {
+ 		.offset = HHI_PCIE_PLL_CNTL6,
+ 		.mask = 0x1,
+ 		.shift = 2,
++		/* skip the parent mpll3, reserved for debug */
++		.table = (u32[]){ 1 },
+ 	},
+ 	.hw.init = &(struct clk_init_data){
+ 		.name = "pcie_mux",
+ 		.ops = &clk_regmap_mux_ops,
+-		.parent_names = (const char *[]){ "mpll3", "pcie_pll" },
+-		.num_parents = 2,
++		.parent_names = (const char *[]){ "pcie_pll" },
++		.num_parents = 1,
+ 		.flags = CLK_SET_RATE_PARENT,
+ 	},
+ };
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index 6435d86118f1..6628ffa31383 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -213,7 +213,6 @@ static struct clk_regmap gxbb_fixed_pll = {
+ 		.ops = &meson_clk_pll_ro_ops,
+ 		.parent_names = (const char *[]){ "xtal" },
+ 		.num_parents = 1,
+-		.flags = CLK_GET_RATE_NOCACHE,
+ 	},
+ };
+ 
+@@ -276,6 +275,10 @@ static struct clk_regmap gxbb_hdmi_pll = {
+ 		.ops = &meson_clk_pll_ro_ops,
+ 		.parent_names = (const char *[]){ "hdmi_pll_pre_mult" },
+ 		.num_parents = 1,
++		/*
++		 * Display directly handle hdmi pll registers ATM, we need
++		 * NOCACHE to keep our view of the clock as accurate as possible
++		 */
+ 		.flags = CLK_GET_RATE_NOCACHE,
+ 	},
+ };
+@@ -334,6 +337,10 @@ static struct clk_regmap gxl_hdmi_pll = {
+ 		.ops = &meson_clk_pll_ro_ops,
+ 		.parent_names = (const char *[]){ "xtal" },
+ 		.num_parents = 1,
++		/*
++		 * Display directly handle hdmi pll registers ATM, we need
++		 * NOCACHE to keep our view of the clock as accurate as possible
++		 */
+ 		.flags = CLK_GET_RATE_NOCACHE,
+ 	},
+ };
+@@ -371,7 +378,6 @@ static struct clk_regmap gxbb_sys_pll = {
+ 		.ops = &meson_clk_pll_ro_ops,
+ 		.parent_names = (const char *[]){ "xtal" },
+ 		.num_parents = 1,
+-		.flags = CLK_GET_RATE_NOCACHE,
+ 	},
+ };
+ 
+@@ -418,7 +424,6 @@ static struct clk_regmap gxbb_gp0_pll = {
+ 		.ops = &meson_clk_pll_ops,
+ 		.parent_names = (const char *[]){ "xtal" },
+ 		.num_parents = 1,
+-		.flags = CLK_GET_RATE_NOCACHE,
+ 	},
+ };
+ 
+@@ -472,7 +477,6 @@ static struct clk_regmap gxl_gp0_pll = {
+ 		.ops = &meson_clk_pll_ops,
+ 		.parent_names = (const char *[]){ "xtal" },
+ 		.num_parents = 1,
+-		.flags = CLK_GET_RATE_NOCACHE,
+ 	},
+ };
+ 
+diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
+index 7447d96a265f..74697e145dde 100644
+--- a/drivers/clk/meson/meson8b.c
++++ b/drivers/clk/meson/meson8b.c
+@@ -132,7 +132,6 @@ static struct clk_regmap meson8b_fixed_pll = {
+ 		.ops = &meson_clk_pll_ro_ops,
+ 		.parent_names = (const char *[]){ "xtal" },
+ 		.num_parents = 1,
+-		.flags = CLK_GET_RATE_NOCACHE,
+ 	},
+ };
+ 
+@@ -169,7 +168,6 @@ static struct clk_regmap meson8b_vid_pll = {
+ 		.ops = &meson_clk_pll_ro_ops,
+ 		.parent_names = (const char *[]){ "xtal" },
+ 		.num_parents = 1,
+-		.flags = CLK_GET_RATE_NOCACHE,
+ 	},
+ };
+ 
+@@ -207,7 +205,6 @@ static struct clk_regmap meson8b_sys_pll = {
+ 		.ops = &meson_clk_pll_ro_ops,
+ 		.parent_names = (const char *[]){ "xtal" },
+ 		.num_parents = 1,
+-		.flags = CLK_GET_RATE_NOCACHE,
+ 	},
+ };
+ 
+diff --git a/drivers/clk/renesas/r9a06g032-clocks.c b/drivers/clk/renesas/r9a06g032-clocks.c
+index a0b6ecdc63dd..6d2b56891559 100644
+--- a/drivers/clk/renesas/r9a06g032-clocks.c
++++ b/drivers/clk/renesas/r9a06g032-clocks.c
+@@ -539,7 +539,8 @@ r9a06g032_div_round_rate(struct clk_hw *hw,
+ 	 * several uarts attached to this divider, and changing this impacts
+ 	 * everyone.
+ 	 */
+-	if (clk->index == R9A06G032_DIV_UART) {
++	if (clk->index == R9A06G032_DIV_UART ||
++	    clk->index == R9A06G032_DIV_P2_PG) {
+ 		pr_devel("%s div uart hack!\n", __func__);
+ 		return clk_get_rate(hw->clk);
+ 	}
+diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
+index 95e1bf69449b..d4f77c4eb277 100644
+--- a/drivers/clk/samsung/clk-exynos5420.c
++++ b/drivers/clk/samsung/clk-exynos5420.c
+@@ -281,6 +281,7 @@ static const struct samsung_clk_reg_dump exynos5420_set_clksrc[] = {
+ 	{ .offset = GATE_BUS_TOP,		.value = 0xffffffff, },
+ 	{ .offset = GATE_BUS_DISP1,		.value = 0xffffffff, },
+ 	{ .offset = GATE_IP_PERIC,		.value = 0xffffffff, },
++	{ .offset = GATE_IP_PERIS,		.value = 0xffffffff, },
+ };
+ 
+ static int exynos5420_clk_suspend(void)
+diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c
+index 7d22e1af2247..27e0979b3158 100644
+--- a/drivers/clk/ti/clk.c
++++ b/drivers/clk/ti/clk.c
+@@ -129,7 +129,7 @@ int ti_clk_setup_ll_ops(struct ti_clk_ll_ops *ops)
+ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[])
+ {
+ 	struct ti_dt_clk *c;
+-	struct device_node *node;
++	struct device_node *node, *parent;
+ 	struct clk *clk;
+ 	struct of_phandle_args clkspec;
+ 	char buf[64];
+@@ -164,8 +164,12 @@ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[])
+ 			continue;
+ 
+ 		node = of_find_node_by_name(NULL, buf);
+-		if (num_args)
+-			node = of_find_node_by_name(node, "clk");
++		if (num_args) {
++			parent = node;
++			node = of_get_child_by_name(parent, "clk");
++			of_node_put(parent);
++		}
++
+ 		clkspec.np = node;
+ 		clkspec.args_count = num_args;
+ 		for (i = 0; i < num_args; i++) {
+@@ -173,11 +177,12 @@ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[])
+ 			if (ret) {
+ 				pr_warn("Bad tag in %s at %d: %s\n",
+ 					c->node_name, i, tags[i]);
++				of_node_put(node);
+ 				return;
+ 			}
+ 		}
+ 		clk = of_clk_get_from_provider(&clkspec);
+-
++		of_node_put(node);
+ 		if (!IS_ERR(clk)) {
+ 			c->lk.clk = clk;
+ 			clkdev_add(&c->lk);
+diff --git a/drivers/gnss/serial.c b/drivers/gnss/serial.c
+index b01ba4438501..31e891f00175 100644
+--- a/drivers/gnss/serial.c
++++ b/drivers/gnss/serial.c
+@@ -13,6 +13,7 @@
+ #include <linux/of.h>
+ #include <linux/pm.h>
+ #include <linux/pm_runtime.h>
++#include <linux/sched.h>
+ #include <linux/serdev.h>
+ #include <linux/slab.h>
+ 
+@@ -63,7 +64,7 @@ static int gnss_serial_write_raw(struct gnss_device *gdev,
+ 	int ret;
+ 
+ 	/* write is only buffered synchronously */
+-	ret = serdev_device_write(serdev, buf, count, 0);
++	ret = serdev_device_write(serdev, buf, count, MAX_SCHEDULE_TIMEOUT);
+ 	if (ret < 0)
+ 		return ret;
+ 
+diff --git a/drivers/gnss/sirf.c b/drivers/gnss/sirf.c
+index 79cb98950013..71d014edd167 100644
+--- a/drivers/gnss/sirf.c
++++ b/drivers/gnss/sirf.c
+@@ -16,6 +16,7 @@
+ #include <linux/pm.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/regulator/consumer.h>
++#include <linux/sched.h>
+ #include <linux/serdev.h>
+ #include <linux/slab.h>
+ #include <linux/wait.h>
+@@ -83,7 +84,7 @@ static int sirf_write_raw(struct gnss_device *gdev, const unsigned char *buf,
+ 	int ret;
+ 
+ 	/* write is only buffered synchronously */
+-	ret = serdev_device_write(serdev, buf, count, 0);
++	ret = serdev_device_write(serdev, buf, count, MAX_SCHEDULE_TIMEOUT);
+ 	if (ret < 0)
+ 		return ret;
+ 
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 6903fe6c894b..ef5c6af4d964 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -3167,7 +3167,7 @@ void dm_drm_plane_destroy_state(struct drm_plane *plane,
+ static const struct drm_plane_funcs dm_plane_funcs = {
+ 	.update_plane	= drm_atomic_helper_update_plane,
+ 	.disable_plane	= drm_atomic_helper_disable_plane,
+-	.destroy	= drm_plane_cleanup,
++	.destroy	= drm_primary_helper_destroy,
+ 	.reset = dm_drm_plane_reset,
+ 	.atomic_duplicate_state = dm_drm_plane_duplicate_state,
+ 	.atomic_destroy_state = dm_drm_plane_destroy_state,
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+index a29dc35954c9..aba2c5c1d2f8 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+@@ -173,8 +173,6 @@ struct amdgpu_dm_connector {
+ 	struct mutex hpd_lock;
+ 
+ 	bool fake_enable;
+-
+-	bool mst_connected;
+ };
+ 
+ #define to_amdgpu_dm_connector(x) container_of(x, struct amdgpu_dm_connector, base)
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index 9a300732ba37..4cc45a1d21db 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -317,12 +317,7 @@ dm_dp_create_fake_mst_encoder(struct amdgpu_dm_connector *connector)
+ 	struct amdgpu_device *adev = dev->dev_private;
+ 	struct amdgpu_encoder *amdgpu_encoder;
+ 	struct drm_encoder *encoder;
+-	const struct drm_connector_helper_funcs *connector_funcs =
+-		connector->base.helper_private;
+-	struct drm_encoder *enc_master =
+-		connector_funcs->best_encoder(&connector->base);
+ 
+-	DRM_DEBUG_KMS("enc master is %p\n", enc_master);
+ 	amdgpu_encoder = kzalloc(sizeof(*amdgpu_encoder), GFP_KERNEL);
+ 	if (!amdgpu_encoder)
+ 		return NULL;
+@@ -352,25 +347,6 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ 	struct amdgpu_device *adev = dev->dev_private;
+ 	struct amdgpu_dm_connector *aconnector;
+ 	struct drm_connector *connector;
+-	struct drm_connector_list_iter conn_iter;
+-
+-	drm_connector_list_iter_begin(dev, &conn_iter);
+-	drm_for_each_connector_iter(connector, &conn_iter) {
+-		aconnector = to_amdgpu_dm_connector(connector);
+-		if (aconnector->mst_port == master
+-				&& !aconnector->port) {
+-			DRM_INFO("DM_MST: reusing connector: %p [id: %d] [master: %p]\n",
+-						aconnector, connector->base.id, aconnector->mst_port);
+-
+-			aconnector->port = port;
+-			drm_connector_set_path_property(connector, pathprop);
+-
+-			drm_connector_list_iter_end(&conn_iter);
+-			aconnector->mst_connected = true;
+-			return &aconnector->base;
+-		}
+-	}
+-	drm_connector_list_iter_end(&conn_iter);
+ 
+ 	aconnector = kzalloc(sizeof(*aconnector), GFP_KERNEL);
+ 	if (!aconnector)
+@@ -419,8 +395,6 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ 	 */
+ 	amdgpu_dm_connector_funcs_reset(connector);
+ 
+-	aconnector->mst_connected = true;
+-
+ 	DRM_INFO("DM_MST: added connector: %p [id: %d] [master: %p]\n",
+ 			aconnector, connector->base.id, aconnector->mst_port);
+ 
+@@ -432,6 +406,9 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ 					struct drm_connector *connector)
+ {
++	struct amdgpu_dm_connector *master = container_of(mgr, struct amdgpu_dm_connector, mst_mgr);
++	struct drm_device *dev = master->base.dev;
++	struct amdgpu_device *adev = dev->dev_private;
+ 	struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
+ 
+ 	DRM_INFO("DM_MST: Disabling connector: %p [id: %d] [master: %p]\n",
+@@ -445,7 +422,10 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ 		aconnector->dc_sink = NULL;
+ 	}
+ 
+-	aconnector->mst_connected = false;
++	drm_connector_unregister(connector);
++	if (adev->mode_info.rfbdev)
++		drm_fb_helper_remove_one_connector(&adev->mode_info.rfbdev->helper, connector);
++	drm_connector_put(connector);
+ }
+ 
+ static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr)
+@@ -456,18 +436,10 @@ static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr)
+ 	drm_kms_helper_hotplug_event(dev);
+ }
+ 
+-static void dm_dp_mst_link_status_reset(struct drm_connector *connector)
+-{
+-	mutex_lock(&connector->dev->mode_config.mutex);
+-	drm_connector_set_link_status_property(connector, DRM_MODE_LINK_STATUS_BAD);
+-	mutex_unlock(&connector->dev->mode_config.mutex);
+-}
+-
+ static void dm_dp_mst_register_connector(struct drm_connector *connector)
+ {
+ 	struct drm_device *dev = connector->dev;
+ 	struct amdgpu_device *adev = dev->dev_private;
+-	struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
+ 
+ 	if (adev->mode_info.rfbdev)
+ 		drm_fb_helper_add_one_connector(&adev->mode_info.rfbdev->helper, connector);
+@@ -475,9 +447,6 @@ static void dm_dp_mst_register_connector(struct drm_connector *connector)
+ 		DRM_ERROR("adev->mode_info.rfbdev is NULL\n");
+ 
+ 	drm_connector_register(connector);
+-
+-	if (aconnector->mst_connected)
+-		dm_dp_mst_link_status_reset(connector);
+ }
+ 
+ static const struct drm_dp_mst_topology_cbs dm_mst_cbs = {
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index ff0bfc65a8c1..b506e3622b08 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -122,6 +122,9 @@ static const struct edid_quirk {
+ 	/* SDC panel of Lenovo B50-80 reports 8 bpc, but is a 6 bpc panel */
+ 	{ "SDC", 0x3652, EDID_QUIRK_FORCE_6BPC },
+ 
++	/* BOE model 0x0771 reports 8 bpc, but is a 6 bpc panel */
++	{ "BOE", 0x0771, EDID_QUIRK_FORCE_6BPC },
++
+ 	/* Belinea 10 15 55 */
+ 	{ "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 },
+ 	{ "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 },
+diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+index 94529aa82339..aef487dd8731 100644
+--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
++++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+@@ -164,13 +164,6 @@ static u32 decon_get_frame_count(struct decon_context *ctx, bool end)
+ 	return frm;
+ }
+ 
+-static u32 decon_get_vblank_counter(struct exynos_drm_crtc *crtc)
+-{
+-	struct decon_context *ctx = crtc->ctx;
+-
+-	return decon_get_frame_count(ctx, false);
+-}
+-
+ static void decon_setup_trigger(struct decon_context *ctx)
+ {
+ 	if (!ctx->crtc->i80_mode && !(ctx->out_type & I80_HW_TRG))
+@@ -536,7 +529,6 @@ static const struct exynos_drm_crtc_ops decon_crtc_ops = {
+ 	.disable		= decon_disable,
+ 	.enable_vblank		= decon_enable_vblank,
+ 	.disable_vblank		= decon_disable_vblank,
+-	.get_vblank_counter	= decon_get_vblank_counter,
+ 	.atomic_begin		= decon_atomic_begin,
+ 	.update_plane		= decon_update_plane,
+ 	.disable_plane		= decon_disable_plane,
+@@ -554,7 +546,6 @@ static int decon_bind(struct device *dev, struct device *master, void *data)
+ 	int ret;
+ 
+ 	ctx->drm_dev = drm_dev;
+-	drm_dev->max_vblank_count = 0xffffffff;
+ 
+ 	for (win = ctx->first_win; win < WINDOWS_NR; win++) {
+ 		ctx->configs[win].pixel_formats = decon_formats;
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+index eea90251808f..2696289ecc78 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+@@ -162,16 +162,6 @@ static void exynos_drm_crtc_disable_vblank(struct drm_crtc *crtc)
+ 		exynos_crtc->ops->disable_vblank(exynos_crtc);
+ }
+ 
+-static u32 exynos_drm_crtc_get_vblank_counter(struct drm_crtc *crtc)
+-{
+-	struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc);
+-
+-	if (exynos_crtc->ops->get_vblank_counter)
+-		return exynos_crtc->ops->get_vblank_counter(exynos_crtc);
+-
+-	return 0;
+-}
+-
+ static const struct drm_crtc_funcs exynos_crtc_funcs = {
+ 	.set_config	= drm_atomic_helper_set_config,
+ 	.page_flip	= drm_atomic_helper_page_flip,
+@@ -181,7 +171,6 @@ static const struct drm_crtc_funcs exynos_crtc_funcs = {
+ 	.atomic_destroy_state = drm_atomic_helper_crtc_destroy_state,
+ 	.enable_vblank = exynos_drm_crtc_enable_vblank,
+ 	.disable_vblank = exynos_drm_crtc_disable_vblank,
+-	.get_vblank_counter = exynos_drm_crtc_get_vblank_counter,
+ };
+ 
+ struct exynos_drm_crtc *exynos_drm_crtc_create(struct drm_device *drm_dev,
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
+index c737c4bd2c19..630f1edc5de2 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
++++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
+@@ -133,7 +133,6 @@ struct exynos_drm_crtc_ops {
+ 	void (*disable)(struct exynos_drm_crtc *crtc);
+ 	int (*enable_vblank)(struct exynos_drm_crtc *crtc);
+ 	void (*disable_vblank)(struct exynos_drm_crtc *crtc);
+-	u32 (*get_vblank_counter)(struct exynos_drm_crtc *crtc);
+ 	enum drm_mode_status (*mode_valid)(struct exynos_drm_crtc *crtc,
+ 		const struct drm_display_mode *mode);
+ 	bool (*mode_fixup)(struct exynos_drm_crtc *crtc,
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 4aca5344863d..d6c25bea4382 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -2248,7 +2248,7 @@ static inline struct scatterlist *__sg_next(struct scatterlist *sg)
+ #define for_each_sgt_dma(__dmap, __iter, __sgt)				\
+ 	for ((__iter) = __sgt_iter((__sgt)->sgl, true);			\
+ 	     ((__dmap) = (__iter).dma + (__iter).curr);			\
+-	     (((__iter).curr += PAGE_SIZE) >= (__iter).max) ?		\
++	     (((__iter).curr += I915_GTT_PAGE_SIZE) >= (__iter).max) ?	\
+ 	     (__iter) = __sgt_iter(__sg_next((__iter).sgp), true), 0 : 0)
+ 
+ /**
+diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
+index 294a143b85f5..5f57f4e1fbc8 100644
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
+@@ -1058,7 +1058,7 @@ gen8_ppgtt_insert_pte_entries(struct i915_hw_ppgtt *ppgtt,
+ 	do {
+ 		vaddr[idx->pte] = pte_encode | iter->dma;
+ 
+-		iter->dma += PAGE_SIZE;
++		iter->dma += I915_GTT_PAGE_SIZE;
+ 		if (iter->dma >= iter->max) {
+ 			iter->sg = __sg_next(iter->sg);
+ 			if (!iter->sg) {
+@@ -1770,7 +1770,7 @@ static void gen6_dump_ppgtt(struct i915_hw_ppgtt *base, struct seq_file *m)
+ 
+ 			seq_printf(m, "\t\t(%03d, %04d) %08llx: ",
+ 				   pde, pte,
+-				   (pde * GEN6_PTES + pte) * PAGE_SIZE);
++				   (pde * GEN6_PTES + pte) * I915_GTT_PAGE_SIZE);
+ 			for (i = 0; i < 4; i++) {
+ 				if (vaddr[pte + i] != scratch_pte)
+ 					seq_printf(m, " %08x", vaddr[pte + i]);
+@@ -1910,7 +1910,7 @@ static void gen6_ppgtt_insert_entries(struct i915_address_space *vm,
+ 	do {
+ 		vaddr[act_pte] = pte_encode | GEN6_PTE_ADDR_ENCODE(iter.dma);
+ 
+-		iter.dma += PAGE_SIZE;
++		iter.dma += I915_GTT_PAGE_SIZE;
+ 		if (iter.dma == iter.max) {
+ 			iter.sg = __sg_next(iter.sg);
+ 			if (!iter.sg)
+@@ -2048,7 +2048,7 @@ static int pd_vma_bind(struct i915_vma *vma,
+ {
+ 	struct i915_ggtt *ggtt = i915_vm_to_ggtt(vma->vm);
+ 	struct gen6_hw_ppgtt *ppgtt = vma->private;
+-	u32 ggtt_offset = i915_ggtt_offset(vma) / PAGE_SIZE;
++	u32 ggtt_offset = i915_ggtt_offset(vma) / I915_GTT_PAGE_SIZE;
+ 	struct i915_page_table *pt;
+ 	unsigned int pde;
+ 
+@@ -2174,7 +2174,7 @@ static struct i915_hw_ppgtt *gen6_ppgtt_create(struct drm_i915_private *i915)
+ 	ppgtt->base.vm.i915 = i915;
+ 	ppgtt->base.vm.dma = &i915->drm.pdev->dev;
+ 
+-	ppgtt->base.vm.total = I915_PDES * GEN6_PTES * PAGE_SIZE;
++	ppgtt->base.vm.total = I915_PDES * GEN6_PTES * I915_GTT_PAGE_SIZE;
+ 
+ 	i915_address_space_init(&ppgtt->base.vm, i915);
+ 
+@@ -3031,7 +3031,7 @@ static unsigned int gen8_get_total_gtt_size(u16 bdw_gmch_ctl)
+ 		bdw_gmch_ctl = 1 << bdw_gmch_ctl;
+ 
+ #ifdef CONFIG_X86_32
+-	/* Limit 32b platforms to a 2GB GGTT: 4 << 20 / pte size * PAGE_SIZE */
++	/* Limit 32b platforms to a 2GB GGTT: 4 << 20 / pte size * I915_GTT_PAGE_SIZE */
+ 	if (bdw_gmch_ctl > 4)
+ 		bdw_gmch_ctl = 4;
+ #endif
+@@ -3729,9 +3729,9 @@ rotate_pages(const dma_addr_t *in, unsigned int offset,
+ 			 * the entries so the sg list can be happily traversed.
+ 			 * The only thing we need are DMA addresses.
+ 			 */
+-			sg_set_page(sg, NULL, PAGE_SIZE, 0);
++			sg_set_page(sg, NULL, I915_GTT_PAGE_SIZE, 0);
+ 			sg_dma_address(sg) = in[offset + src_idx];
+-			sg_dma_len(sg) = PAGE_SIZE;
++			sg_dma_len(sg) = I915_GTT_PAGE_SIZE;
+ 			sg = sg_next(sg);
+ 			src_idx -= stride;
+ 		}
+@@ -3744,7 +3744,7 @@ static noinline struct sg_table *
+ intel_rotate_pages(struct intel_rotation_info *rot_info,
+ 		   struct drm_i915_gem_object *obj)
+ {
+-	const unsigned long n_pages = obj->base.size / PAGE_SIZE;
++	const unsigned long n_pages = obj->base.size / I915_GTT_PAGE_SIZE;
+ 	unsigned int size = intel_rotation_info_size(rot_info);
+ 	struct sgt_iter sgt_iter;
+ 	dma_addr_t dma_addr;
+diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c
+index aec253b44156..3cd7229b6e54 100644
+--- a/drivers/hid/hid-alps.c
++++ b/drivers/hid/hid-alps.c
+@@ -660,6 +660,20 @@ exit:
+ 	return ret;
+ }
+ 
++static int alps_sp_open(struct input_dev *dev)
++{
++	struct hid_device *hid = input_get_drvdata(dev);
++
++	return hid_hw_open(hid);
++}
++
++static void alps_sp_close(struct input_dev *dev)
++{
++	struct hid_device *hid = input_get_drvdata(dev);
++
++	hid_hw_close(hid);
++}
++
+ static int alps_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ {
+ 	struct alps_dev *data = hid_get_drvdata(hdev);
+@@ -733,6 +747,10 @@ static int alps_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ 		input2->id.version = input->id.version;
+ 		input2->dev.parent = input->dev.parent;
+ 
++		input_set_drvdata(input2, hdev);
++		input2->open = alps_sp_open;
++		input2->close = alps_sp_close;
++
+ 		__set_bit(EV_KEY, input2->evbit);
+ 		data->sp_btn_cnt = (data->sp_btn_info & 0x0F);
+ 		for (i = 0; i < data->sp_btn_cnt; i++)
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index bc49909aba8e..501c05cbec7e 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -799,6 +799,7 @@
+ #define USB_DEVICE_ID_MS_TOUCH_COVER_2   0x07a7
+ #define USB_DEVICE_ID_MS_TYPE_COVER_2    0x07a9
+ #define USB_DEVICE_ID_MS_POWER_COVER     0x07da
++#define USB_DEVICE_ID_MS_PIXART_MOUSE    0x00cb
+ 
+ #define USB_VENDOR_ID_MOJO		0x8282
+ #define USB_DEVICE_ID_RETRO_ADAPTER	0x3201
+@@ -921,6 +922,9 @@
+ #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003		0x3003
+ #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008		0x3008
+ 
++#define I2C_VENDOR_ID_RAYDIUM		0x2386
++#define I2C_PRODUCT_ID_RAYDIUM_4B33	0x4b33
++
+ #define USB_VENDOR_ID_RAZER            0x1532
+ #define USB_DEVICE_ID_RAZER_BLADE_14   0x011D
+ 
+@@ -1195,6 +1199,8 @@
+ #define USB_DEVICE_ID_PRIMAX_MOUSE_4D22	0x4d22
+ #define USB_DEVICE_ID_PRIMAX_KEYBOARD	0x4e05
+ #define USB_DEVICE_ID_PRIMAX_REZEL	0x4e72
++#define USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4D0F	0x4d0f
++#define USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4E22	0x4e22
+ 
+ 
+ #define USB_VENDOR_ID_RISO_KAGAKU	0x1294	/* Riso Kagaku Corp. */
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 249d49b6b16c..0a0605a7e481 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -106,7 +106,7 @@ static const struct hid_device_id hid_quirks[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C05A), HID_QUIRK_ALWAYS_POLL },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C06A), HID_QUIRK_ALWAYS_POLL },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MCS, USB_DEVICE_ID_MCS_GAMEPADBLOCK), HID_QUIRK_MULTI_INPUT },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS), HID_QUIRK_NOGET },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PIXART_MOUSE), HID_QUIRK_ALWAYS_POLL },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER), HID_QUIRK_NO_INIT_REPORTS },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_SURFACE_PRO_2), HID_QUIRK_NO_INIT_REPORTS },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2), HID_QUIRK_NO_INIT_REPORTS },
+@@ -129,6 +129,8 @@ static const struct hid_device_id hid_quirks[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN), HID_QUIRK_NO_INIT_REPORTS },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_MOUSE_4D22), HID_QUIRK_ALWAYS_POLL },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4D0F), HID_QUIRK_ALWAYS_POLL },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4E22), HID_QUIRK_ALWAYS_POLL },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS), HID_QUIRK_NOGET },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001), HID_QUIRK_NOGET },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003), HID_QUIRK_NOGET },
+diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
+index 4e3592e7a3f7..88daa388e1f6 100644
+--- a/drivers/hid/i2c-hid/i2c-hid.c
++++ b/drivers/hid/i2c-hid/i2c-hid.c
+@@ -48,6 +48,7 @@
+ #define I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV	BIT(0)
+ #define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET	BIT(1)
+ #define I2C_HID_QUIRK_NO_RUNTIME_PM		BIT(2)
++#define I2C_HID_QUIRK_DELAY_AFTER_SLEEP		BIT(3)
+ 
+ /* flags */
+ #define I2C_HID_STARTED		0
+@@ -157,6 +158,8 @@ struct i2c_hid {
+ 
+ 	bool			irq_wake_enabled;
+ 	struct mutex		reset_lock;
++
++	unsigned long		sleep_delay;
+ };
+ 
+ static const struct i2c_hid_quirks {
+@@ -171,6 +174,8 @@ static const struct i2c_hid_quirks {
+ 	{ I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
+ 		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET |
+ 		I2C_HID_QUIRK_NO_RUNTIME_PM },
++	{ I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_4B33,
++		I2C_HID_QUIRK_DELAY_AFTER_SLEEP },
+ 	{ 0, 0 }
+ };
+ 
+@@ -386,6 +391,7 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state)
+ {
+ 	struct i2c_hid *ihid = i2c_get_clientdata(client);
+ 	int ret;
++	unsigned long now, delay;
+ 
+ 	i2c_hid_dbg(ihid, "%s\n", __func__);
+ 
+@@ -403,9 +409,22 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state)
+ 			goto set_pwr_exit;
+ 	}
+ 
++	if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP &&
++	    power_state == I2C_HID_PWR_ON) {
++		now = jiffies;
++		if (time_after(ihid->sleep_delay, now)) {
++			delay = jiffies_to_usecs(ihid->sleep_delay - now);
++			usleep_range(delay, delay + 1);
++		}
++	}
++
+ 	ret = __i2c_hid_command(client, &hid_set_power_cmd, power_state,
+ 		0, NULL, 0, NULL, 0);
+ 
++	if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP &&
++	    power_state == I2C_HID_PWR_SLEEP)
++		ihid->sleep_delay = jiffies + msecs_to_jiffies(20);
++
+ 	if (ret)
+ 		dev_err(&client->dev, "failed to change power setting.\n");
+ 
+diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
+index 3c5507313606..051639c09f72 100644
+--- a/drivers/hid/uhid.c
++++ b/drivers/hid/uhid.c
+@@ -12,6 +12,7 @@
+ 
+ #include <linux/atomic.h>
+ #include <linux/compat.h>
++#include <linux/cred.h>
+ #include <linux/device.h>
+ #include <linux/fs.h>
+ #include <linux/hid.h>
+@@ -722,6 +723,17 @@ static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
+ 
+ 	switch (uhid->input_buf.type) {
+ 	case UHID_CREATE:
++		/*
++		 * 'struct uhid_create_req' contains a __user pointer which is
++		 * copied from, so it's unsafe to allow this with elevated
++		 * privileges (e.g. from a setuid binary) or via kernel_write().
++		 */
++		if (file->f_cred != current_cred() || uaccess_kernel()) {
++			pr_err_once("UHID_CREATE from different security context by process %d (%s), this is not allowed.\n",
++				    task_tgid_vnr(current), current->comm);
++			ret = -EACCES;
++			goto unlock;
++		}
+ 		ret = uhid_dev_create(uhid, &uhid->input_buf);
+ 		break;
+ 	case UHID_CREATE2:
+diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c
+index 83472808c816..64d05edff130 100644
+--- a/drivers/hwmon/ibmpowernv.c
++++ b/drivers/hwmon/ibmpowernv.c
+@@ -181,7 +181,7 @@ static ssize_t show_label(struct device *dev, struct device_attribute *devattr,
+ 	return sprintf(buf, "%s\n", sdata->label);
+ }
+ 
+-static int __init get_logical_cpu(int hwcpu)
++static int get_logical_cpu(int hwcpu)
+ {
+ 	int cpu;
+ 
+@@ -192,9 +192,8 @@ static int __init get_logical_cpu(int hwcpu)
+ 	return -ENOENT;
+ }
+ 
+-static void __init make_sensor_label(struct device_node *np,
+-				     struct sensor_data *sdata,
+-				     const char *label)
++static void make_sensor_label(struct device_node *np,
++			      struct sensor_data *sdata, const char *label)
+ {
+ 	u32 id;
+ 	size_t n;
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index 451d4ae50e66..ac4b09642f63 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -751,7 +751,7 @@ config I2C_OCORES
+ 
+ config I2C_OMAP
+ 	tristate "OMAP I2C adapter"
+-	depends on ARCH_OMAP
++	depends on ARCH_OMAP || ARCH_K3
+ 	default y if MACH_OMAP_H3 || MACH_OMAP_OSK
+ 	help
+ 	  If you say yes to this option, support will be included for the
+diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
+index 9f2eb02481d3..d7329177b0ea 100644
+--- a/drivers/i2c/busses/i2c-qcom-geni.c
++++ b/drivers/i2c/busses/i2c-qcom-geni.c
+@@ -590,18 +590,19 @@ static int geni_i2c_probe(struct platform_device *pdev)
+ 
+ 	dev_dbg(&pdev->dev, "i2c fifo/se-dma mode. fifo depth:%d\n", tx_depth);
+ 
+-	ret = i2c_add_adapter(&gi2c->adap);
+-	if (ret) {
+-		dev_err(&pdev->dev, "Error adding i2c adapter %d\n", ret);
+-		return ret;
+-	}
+-
+ 	gi2c->suspended = 1;
+ 	pm_runtime_set_suspended(gi2c->se.dev);
+ 	pm_runtime_set_autosuspend_delay(gi2c->se.dev, I2C_AUTO_SUSPEND_DELAY);
+ 	pm_runtime_use_autosuspend(gi2c->se.dev);
+ 	pm_runtime_enable(gi2c->se.dev);
+ 
++	ret = i2c_add_adapter(&gi2c->adap);
++	if (ret) {
++		dev_err(&pdev->dev, "Error adding i2c adapter %d\n", ret);
++		pm_runtime_disable(gi2c->se.dev);
++		return ret;
++	}
++
+ 	return 0;
+ }
+ 
+@@ -609,8 +610,8 @@ static int geni_i2c_remove(struct platform_device *pdev)
+ {
+ 	struct geni_i2c_dev *gi2c = platform_get_drvdata(pdev);
+ 
+-	pm_runtime_disable(gi2c->se.dev);
+ 	i2c_del_adapter(&gi2c->adap);
++	pm_runtime_disable(gi2c->se.dev);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c
+index a3ef1f50a4b3..481e3c65cf97 100644
+--- a/drivers/media/v4l2-core/v4l2-event.c
++++ b/drivers/media/v4l2-core/v4l2-event.c
+@@ -193,6 +193,22 @@ int v4l2_event_pending(struct v4l2_fh *fh)
+ }
+ EXPORT_SYMBOL_GPL(v4l2_event_pending);
+ 
++static void __v4l2_event_unsubscribe(struct v4l2_subscribed_event *sev)
++{
++	struct v4l2_fh *fh = sev->fh;
++	unsigned int i;
++
++	lockdep_assert_held(&fh->subscribe_lock);
++	assert_spin_locked(&fh->vdev->fh_lock);
++
++	/* Remove any pending events for this subscription */
++	for (i = 0; i < sev->in_use; i++) {
++		list_del(&sev->events[sev_pos(sev, i)].list);
++		fh->navailable--;
++	}
++	list_del(&sev->list);
++}
++
+ int v4l2_event_subscribe(struct v4l2_fh *fh,
+ 			 const struct v4l2_event_subscription *sub, unsigned elems,
+ 			 const struct v4l2_subscribed_event_ops *ops)
+@@ -224,27 +240,23 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
+ 
+ 	spin_lock_irqsave(&fh->vdev->fh_lock, flags);
+ 	found_ev = v4l2_event_subscribed(fh, sub->type, sub->id);
++	if (!found_ev)
++		list_add(&sev->list, &fh->subscribed);
+ 	spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
+ 
+ 	if (found_ev) {
+ 		/* Already listening */
+ 		kvfree(sev);
+-		goto out_unlock;
+-	}
+-
+-	if (sev->ops && sev->ops->add) {
++	} else if (sev->ops && sev->ops->add) {
+ 		ret = sev->ops->add(sev, elems);
+ 		if (ret) {
++			spin_lock_irqsave(&fh->vdev->fh_lock, flags);
++			__v4l2_event_unsubscribe(sev);
++			spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
+ 			kvfree(sev);
+-			goto out_unlock;
+ 		}
+ 	}
+ 
+-	spin_lock_irqsave(&fh->vdev->fh_lock, flags);
+-	list_add(&sev->list, &fh->subscribed);
+-	spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
+-
+-out_unlock:
+ 	mutex_unlock(&fh->subscribe_lock);
+ 
+ 	return ret;
+@@ -279,7 +291,6 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
+ {
+ 	struct v4l2_subscribed_event *sev;
+ 	unsigned long flags;
+-	int i;
+ 
+ 	if (sub->type == V4L2_EVENT_ALL) {
+ 		v4l2_event_unsubscribe_all(fh);
+@@ -291,14 +302,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
+ 	spin_lock_irqsave(&fh->vdev->fh_lock, flags);
+ 
+ 	sev = v4l2_event_subscribed(fh, sub->type, sub->id);
+-	if (sev != NULL) {
+-		/* Remove any pending events for this subscription */
+-		for (i = 0; i < sev->in_use; i++) {
+-			list_del(&sev->events[sev_pos(sev, i)].list);
+-			fh->navailable--;
+-		}
+-		list_del(&sev->list);
+-	}
++	if (sev != NULL)
++		__v4l2_event_unsubscribe(sev);
+ 
+ 	spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
+ 
+diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
+index b2a0340f277e..d8e3cc2dc747 100644
+--- a/drivers/misc/atmel-ssc.c
++++ b/drivers/misc/atmel-ssc.c
+@@ -132,7 +132,7 @@ static const struct of_device_id atmel_ssc_dt_ids[] = {
+ MODULE_DEVICE_TABLE(of, atmel_ssc_dt_ids);
+ #endif
+ 
+-static inline const struct atmel_ssc_platform_data * __init
++static inline const struct atmel_ssc_platform_data *
+ 	atmel_ssc_get_driver_data(struct platform_device *pdev)
+ {
+ 	if (pdev->dev.of_node) {
+diff --git a/drivers/misc/sgi-gru/grukdump.c b/drivers/misc/sgi-gru/grukdump.c
+index 313da3150262..1540a7785e14 100644
+--- a/drivers/misc/sgi-gru/grukdump.c
++++ b/drivers/misc/sgi-gru/grukdump.c
+@@ -27,6 +27,9 @@
+ #include <linux/delay.h>
+ #include <linux/bitops.h>
+ #include <asm/uv/uv_hub.h>
++
++#include <linux/nospec.h>
++
+ #include "gru.h"
+ #include "grutables.h"
+ #include "gruhandles.h"
+@@ -196,6 +199,7 @@ int gru_dump_chiplet_request(unsigned long arg)
+ 	/* Currently, only dump by gid is implemented */
+ 	if (req.gid >= gru_max_gids)
+ 		return -EINVAL;
++	req.gid = array_index_nospec(req.gid, gru_max_gids);
+ 
+ 	gru = GID_TO_GRU(req.gid);
+ 	ubuf = req.buf;
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index a594fb1e9a99..32e95af486a2 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -2061,8 +2061,7 @@ atmel_hsmc_nand_controller_legacy_init(struct atmel_hsmc_nand_controller *nc)
+ 	int ret;
+ 
+ 	nand_np = dev->of_node;
+-	nfc_np = of_find_compatible_node(dev->of_node, NULL,
+-					 "atmel,sama5d3-nfc");
++	nfc_np = of_get_compatible_child(dev->of_node, "atmel,sama5d3-nfc");
+ 	if (!nfc_np) {
+ 		dev_err(dev, "Could not find device node for sama5d3-nfc\n");
+ 		return -ENODEV;
+@@ -2476,15 +2475,19 @@ static int atmel_nand_controller_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	if (caps->legacy_of_bindings) {
++		struct device_node *nfc_node;
+ 		u32 ale_offs = 21;
+ 
+ 		/*
+ 		 * If we are parsing legacy DT props and the DT contains a
+ 		 * valid NFC node, forward the request to the sama5 logic.
+ 		 */
+-		if (of_find_compatible_node(pdev->dev.of_node, NULL,
+-					    "atmel,sama5d3-nfc"))
++		nfc_node = of_get_compatible_child(pdev->dev.of_node,
++						   "atmel,sama5d3-nfc");
++		if (nfc_node) {
+ 			caps = &atmel_sama5_nand_caps;
++			of_node_put(nfc_node);
++		}
+ 
+ 		/*
+ 		 * Even if the compatible says we are dealing with an
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+index b939a4c10b84..c89c7d4900d7 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+@@ -528,7 +528,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
+ 			context = &priv->tx_contexts[i];
+ 
+ 			context->echo_index = i;
+-			can_put_echo_skb(skb, netdev, context->echo_index);
+ 			++priv->active_tx_contexts;
+ 			if (priv->active_tx_contexts >= (int)dev->max_tx_urbs)
+ 				netif_stop_queue(netdev);
+@@ -553,7 +552,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
+ 		dev_kfree_skb(skb);
+ 		spin_lock_irqsave(&priv->tx_contexts_lock, flags);
+ 
+-		can_free_echo_skb(netdev, context->echo_index);
+ 		context->echo_index = dev->max_tx_urbs;
+ 		--priv->active_tx_contexts;
+ 		netif_wake_queue(netdev);
+@@ -564,6 +562,8 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
+ 
+ 	context->priv = priv;
+ 
++	can_put_echo_skb(skb, netdev, context->echo_index);
++
+ 	usb_fill_bulk_urb(urb, dev->udev,
+ 			  usb_sndbulkpipe(dev->udev,
+ 					  dev->bulk_out->bEndpointAddress),
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+index c084bae5ec0a..5fc0be564274 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -1019,6 +1019,11 @@ kvaser_usb_hydra_error_frame(struct kvaser_usb_net_priv *priv,
+ 					new_state : CAN_STATE_ERROR_ACTIVE;
+ 
+ 			can_change_state(netdev, cf, tx_state, rx_state);
++
++			if (priv->can.restart_ms &&
++			    old_state >= CAN_STATE_BUS_OFF &&
++			    new_state < CAN_STATE_BUS_OFF)
++				cf->can_id |= CAN_ERR_RESTARTED;
+ 		}
+ 
+ 		if (new_state == CAN_STATE_BUS_OFF) {
+@@ -1028,11 +1033,6 @@ kvaser_usb_hydra_error_frame(struct kvaser_usb_net_priv *priv,
+ 
+ 			can_bus_off(netdev);
+ 		}
+-
+-		if (priv->can.restart_ms &&
+-		    old_state >= CAN_STATE_BUS_OFF &&
+-		    new_state < CAN_STATE_BUS_OFF)
+-			cf->can_id |= CAN_ERR_RESTARTED;
+ 	}
+ 
+ 	if (!skb) {
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+index 26dc6782b475..4f34808f1e06 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -590,7 +590,7 @@ int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev)
+ 		}
+ 	}
+ 
+-	if (i > 0 && i < AQ_HW_MULTICAST_ADDRESS_MAX) {
++	if (i > 0 && i <= AQ_HW_MULTICAST_ADDRESS_MAX) {
+ 		packet_filter |= IFF_MULTICAST;
+ 		self->mc_list.count = i;
+ 		self->aq_hw_ops->hw_multicast_list_set(self->aq_hw,
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+index d1e1a0ba8615..7134d0d4cdf7 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+@@ -172,6 +172,27 @@ bool aq_ring_tx_clean(struct aq_ring_s *self)
+ 	return !!budget;
+ }
+ 
++static void aq_rx_checksum(struct aq_ring_s *self,
++			   struct aq_ring_buff_s *buff,
++			   struct sk_buff *skb)
++{
++	if (!(self->aq_nic->ndev->features & NETIF_F_RXCSUM))
++		return;
++
++	if (unlikely(buff->is_cso_err)) {
++		++self->stats.rx.errors;
++		skb->ip_summed = CHECKSUM_NONE;
++		return;
++	}
++	if (buff->is_ip_cso) {
++		__skb_incr_checksum_unnecessary(skb);
++		if (buff->is_udp_cso || buff->is_tcp_cso)
++			__skb_incr_checksum_unnecessary(skb);
++	} else {
++		skb->ip_summed = CHECKSUM_NONE;
++	}
++}
++
+ #define AQ_SKB_ALIGN SKB_DATA_ALIGN(sizeof(struct skb_shared_info))
+ int aq_ring_rx_clean(struct aq_ring_s *self,
+ 		     struct napi_struct *napi,
+@@ -267,18 +288,8 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
+ 		}
+ 
+ 		skb->protocol = eth_type_trans(skb, ndev);
+-		if (unlikely(buff->is_cso_err)) {
+-			++self->stats.rx.errors;
+-			skb->ip_summed = CHECKSUM_NONE;
+-		} else {
+-			if (buff->is_ip_cso) {
+-				__skb_incr_checksum_unnecessary(skb);
+-				if (buff->is_udp_cso || buff->is_tcp_cso)
+-					__skb_incr_checksum_unnecessary(skb);
+-			} else {
+-				skb->ip_summed = CHECKSUM_NONE;
+-			}
+-		}
++
++		aq_rx_checksum(self, buff, skb);
+ 
+ 		skb_set_hash(skb, buff->rss_hash,
+ 			     buff->is_hash_l4 ? PKT_HASH_TYPE_L4 :
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+index 1d44a386e7d3..88705dee5b95 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -655,9 +655,9 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self,
+ 		struct hw_atl_rxd_wb_s *rxd_wb = (struct hw_atl_rxd_wb_s *)
+ 			&ring->dx_ring[ring->hw_head * HW_ATL_B0_RXD_SIZE];
+ 
+-		unsigned int is_err = 1U;
+ 		unsigned int is_rx_check_sum_enabled = 0U;
+ 		unsigned int pkt_type = 0U;
++		u8 rx_stat = 0U;
+ 
+ 		if (!(rxd_wb->status & 0x1U)) { /* RxD is not done */
+ 			break;
+@@ -665,35 +665,35 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self,
+ 
+ 		buff = &ring->buff_ring[ring->hw_head];
+ 
+-		is_err = (0x0000003CU & rxd_wb->status);
++		rx_stat = (0x0000003CU & rxd_wb->status) >> 2;
+ 
+ 		is_rx_check_sum_enabled = (rxd_wb->type) & (0x3U << 19);
+-		is_err &= ~0x20U; /* exclude validity bit */
+ 
+ 		pkt_type = 0xFFU & (rxd_wb->type >> 4);
+ 
+-		if (is_rx_check_sum_enabled) {
+-			if (0x0U == (pkt_type & 0x3U))
+-				buff->is_ip_cso = (is_err & 0x08U) ? 0U : 1U;
++		if (is_rx_check_sum_enabled & BIT(0) &&
++		    (0x0U == (pkt_type & 0x3U)))
++			buff->is_ip_cso = (rx_stat & BIT(1)) ? 0U : 1U;
+ 
++		if (is_rx_check_sum_enabled & BIT(1)) {
+ 			if (0x4U == (pkt_type & 0x1CU))
+-				buff->is_udp_cso = buff->is_cso_err ? 0U : 1U;
++				buff->is_udp_cso = (rx_stat & BIT(2)) ? 0U :
++						   !!(rx_stat & BIT(3));
+ 			else if (0x0U == (pkt_type & 0x1CU))
+-				buff->is_tcp_cso = buff->is_cso_err ? 0U : 1U;
+-
+-			/* Checksum offload workaround for small packets */
+-			if (rxd_wb->pkt_len <= 60) {
+-				buff->is_ip_cso = 0U;
+-				buff->is_cso_err = 0U;
+-			}
++				buff->is_tcp_cso = (rx_stat & BIT(2)) ? 0U :
++						   !!(rx_stat & BIT(3));
++		}
++		buff->is_cso_err = !!(rx_stat & 0x6);
++		/* Checksum offload workaround for small packets */
++		if (unlikely(rxd_wb->pkt_len <= 60)) {
++			buff->is_ip_cso = 0U;
++			buff->is_cso_err = 0U;
+ 		}
+-
+-		is_err &= ~0x18U;
+ 
+ 		dma_unmap_page(ndev, buff->pa, buff->len, DMA_FROM_DEVICE);
+ 
+-		if (is_err || rxd_wb->type & 0x1000U) {
+-			/* status error or DMA error */
++		if ((rx_stat & BIT(0)) || rxd_wb->type & 0x1000U) {
++			/* MAC error or DMA error */
+ 			buff->is_error = 1U;
+ 		} else {
+ 			if (self->aq_nic_cfg->is_rss) {
+@@ -915,6 +915,12 @@ static int hw_atl_b0_hw_interrupt_moderation_set(struct aq_hw_s *self)
+ static int hw_atl_b0_hw_stop(struct aq_hw_s *self)
+ {
+ 	hw_atl_b0_hw_irq_disable(self, HW_ATL_B0_INT_MASK);
++
++	/* Invalidate Descriptor Cache to prevent writing to the cached
++	 * descriptors and to the data pointer of those descriptors
++	 */
++	hw_atl_rdm_rx_dma_desc_cache_init_set(self, 1);
++
+ 	return aq_hw_err_from_flags(self);
+ }
+ 
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
+index 10ba035dadb1..10ec5dc88e24 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
+@@ -619,6 +619,14 @@ void hw_atl_rpb_rx_flow_ctl_mode_set(struct aq_hw_s *aq_hw, u32 rx_flow_ctl_mode
+ 			    HW_ATL_RPB_RX_FC_MODE_SHIFT, rx_flow_ctl_mode);
+ }
+ 
++void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init)
++{
++	aq_hw_write_reg_bit(aq_hw, HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR,
++			    HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK,
++			    HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT,
++			    init);
++}
++
+ void hw_atl_rpb_rx_pkt_buff_size_per_tc_set(struct aq_hw_s *aq_hw,
+ 					    u32 rx_pkt_buff_size_per_tc, u32 buffer)
+ {
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
+index dfb426f2dc2c..b3bf64b48b93 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
+@@ -325,6 +325,9 @@ void hw_atl_rpb_rx_pkt_buff_size_per_tc_set(struct aq_hw_s *aq_hw,
+ 					    u32 rx_pkt_buff_size_per_tc,
+ 					    u32 buffer);
+ 
++/* set rdm rx dma descriptor cache init */
++void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init);
++
+ /* set rx xoff enable (per tc) */
+ void hw_atl_rpb_rx_xoff_en_per_tc_set(struct aq_hw_s *aq_hw, u32 rx_xoff_en_per_tc,
+ 				      u32 buffer);
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+index e0cf70120f1d..e2ecdb1c5a5c 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+@@ -293,6 +293,24 @@
+ /* default value of bitfield desc{d}_reset */
+ #define HW_ATL_RDM_DESCDRESET_DEFAULT 0x0
+ 
++/* rdm_desc_init_i bitfield definitions
++ * preprocessor definitions for the bitfield rdm_desc_init_i.
++ * port="pif_rdm_desc_init_i"
++ */
++
++/* register address for bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR 0x00005a00
++/* bitmask for bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK 0xffffffff
++/* inverted bitmask for bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSKN 0x00000000
++/* lower bit position of bitfield  rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT 0
++/* width of bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_WIDTH 32
++/* default value of bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_DEFAULT 0x0
++
+ /* rx int_desc_wrb_en bitfield definitions
+  * preprocessor definitions for the bitfield "int_desc_wrb_en".
+  * port="pif_rdm_int_desc_wrb_en_i"
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+index ac13cb2b168e..68026a5ad7e7 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+@@ -304,6 +304,10 @@ int hclge_cmd_queue_init(struct hclge_dev *hdev)
+ {
+ 	int ret;
+ 
++	/* Setup the lock for command queue */
++	spin_lock_init(&hdev->hw.cmq.csq.lock);
++	spin_lock_init(&hdev->hw.cmq.crq.lock);
++
+ 	/* Setup the queue entries for use cmd queue */
+ 	hdev->hw.cmq.csq.desc_num = HCLGE_NIC_CMQ_DESC_NUM;
+ 	hdev->hw.cmq.crq.desc_num = HCLGE_NIC_CMQ_DESC_NUM;
+@@ -337,18 +341,20 @@ int hclge_cmd_init(struct hclge_dev *hdev)
+ 	u32 version;
+ 	int ret;
+ 
++	spin_lock_bh(&hdev->hw.cmq.csq.lock);
++	spin_lock_bh(&hdev->hw.cmq.crq.lock);
++
+ 	hdev->hw.cmq.csq.next_to_clean = 0;
+ 	hdev->hw.cmq.csq.next_to_use = 0;
+ 	hdev->hw.cmq.crq.next_to_clean = 0;
+ 	hdev->hw.cmq.crq.next_to_use = 0;
+ 
+-	/* Setup the lock for command queue */
+-	spin_lock_init(&hdev->hw.cmq.csq.lock);
+-	spin_lock_init(&hdev->hw.cmq.crq.lock);
+-
+ 	hclge_cmd_init_regs(&hdev->hw);
+ 	clear_bit(HCLGE_STATE_CMD_DISABLE, &hdev->state);
+ 
++	spin_unlock_bh(&hdev->hw.cmq.crq.lock);
++	spin_unlock_bh(&hdev->hw.cmq.csq.lock);
++
+ 	ret = hclge_cmd_query_firmware_version(&hdev->hw, &version);
+ 	if (ret) {
+ 		dev_err(&hdev->pdev->dev,
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index db763450e5e3..340baf6a470c 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -2804,14 +2804,17 @@ static void hclge_reset(struct hclge_dev *hdev)
+ 	handle = &hdev->vport[0].nic;
+ 	rtnl_lock();
+ 	hclge_notify_client(hdev, HNAE3_DOWN_CLIENT);
++	rtnl_unlock();
+ 
+ 	if (!hclge_reset_wait(hdev)) {
++		rtnl_lock();
+ 		hclge_notify_client(hdev, HNAE3_UNINIT_CLIENT);
+ 		hclge_reset_ae_dev(hdev->ae_dev);
+ 		hclge_notify_client(hdev, HNAE3_INIT_CLIENT);
+ 
+ 		hclge_clear_reset_cause(hdev);
+ 	} else {
++		rtnl_lock();
+ 		/* schedule again to check pending resets later */
+ 		set_bit(hdev->reset_type, &hdev->reset_pending);
+ 		hclge_reset_task_schedule(hdev);
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+index f34851c91eb3..e08e82020402 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+@@ -458,6 +458,12 @@ void hclge_mbx_handler(struct hclge_dev *hdev)
+ 
+ 	/* handle all the mailbox requests in the queue */
+ 	while (!hclge_cmd_crq_empty(&hdev->hw)) {
++		if (test_bit(HCLGE_STATE_CMD_DISABLE, &hdev->state)) {
++			dev_warn(&hdev->pdev->dev,
++				 "command queue needs re-initializing\n");
++			return;
++		}
++
+ 		desc = &crq->desc[crq->next_to_use];
+ 		req = (struct hclge_mbx_vf_to_pf_cmd *)desc->data;
+ 
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index 5db70a1451c5..48235dc2dd56 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -1167,14 +1167,14 @@ static int hclge_pfc_setup_hw(struct hclge_dev *hdev)
+  */
+ static int hclge_bp_setup_hw(struct hclge_dev *hdev, u8 tc)
+ {
+-	struct hclge_vport *vport = hdev->vport;
+-	u32 i, k, qs_bitmap;
+-	int ret;
++	int i;
+ 
+ 	for (i = 0; i < HCLGE_BP_GRP_NUM; i++) {
+-		qs_bitmap = 0;
++		u32 qs_bitmap = 0;
++		int k, ret;
+ 
+ 		for (k = 0; k < hdev->num_alloc_vport; k++) {
++			struct hclge_vport *vport = &hdev->vport[k];
+ 			u16 qs_id = vport->qs_offset + tc;
+ 			u8 grp, sub_grp;
+ 
+@@ -1184,8 +1184,6 @@ static int hclge_bp_setup_hw(struct hclge_dev *hdev, u8 tc)
+ 						  HCLGE_BP_SUB_GRP_ID_S);
+ 			if (i == grp)
+ 				qs_bitmap |= (1 << sub_grp);
+-
+-			vport++;
+ 		}
+ 
+ 		ret = hclge_tm_qs_bp_cfg(hdev, tc, i, qs_bitmap);
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index 320043e87fc6..5570fb5dc2eb 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -1065,6 +1065,8 @@ static int hclgevf_reset(struct hclgevf_dev *hdev)
+ 	/* bring down the nic to stop any ongoing TX/RX */
+ 	hclgevf_notify_client(hdev, HNAE3_DOWN_CLIENT);
+ 
++	rtnl_unlock();
++
+ 	/* check if VF could successfully fetch the hardware reset completion
+ 	 * status from the hardware
+ 	 */
+@@ -1076,12 +1078,15 @@ static int hclgevf_reset(struct hclgevf_dev *hdev)
+ 			ret);
+ 
+ 		dev_warn(&hdev->pdev->dev, "VF reset failed, disabling VF!\n");
++		rtnl_lock();
+ 		hclgevf_notify_client(hdev, HNAE3_UNINIT_CLIENT);
+ 
+ 		rtnl_unlock();
+ 		return ret;
+ 	}
+ 
++	rtnl_lock();
++
+ 	/* now, re-initialize the nic client and ae device*/
+ 	ret = hclgevf_reset_stack(hdev);
+ 	if (ret)
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index ac685ad4d877..6eccfa82ca94 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -11926,6 +11926,8 @@ static int i40e_config_netdev(struct i40e_vsi *vsi)
+ 			  NETIF_F_GSO_GRE		|
+ 			  NETIF_F_GSO_GRE_CSUM		|
+ 			  NETIF_F_GSO_PARTIAL		|
++			  NETIF_F_GSO_IPXIP4		|
++			  NETIF_F_GSO_IPXIP6		|
+ 			  NETIF_F_GSO_UDP_TUNNEL	|
+ 			  NETIF_F_GSO_UDP_TUNNEL_CSUM	|
+ 			  NETIF_F_SCTP_CRC		|
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+index 9d6754f65a1a..4c5c87b158f5 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+@@ -797,10 +797,15 @@ ice_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *pause)
+ 	}
+ 
+ 	if (!test_bit(__ICE_DOWN, pf->state)) {
+-		/* Give it a little more time to try to come back */
++		/* Give it a little more time to try to come back. If still
++		 * down, restart autoneg link or reinitialize the interface.
++		 */
+ 		msleep(75);
+ 		if (!test_bit(__ICE_DOWN, pf->state))
+ 			return ice_nway_reset(netdev);
++
++		ice_down(vsi);
++		ice_up(vsi);
+ 	}
+ 
+ 	return err;
+diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
+index 6481e3d86374..0c95c8f83432 100644
+--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
++++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
+@@ -1519,7 +1519,7 @@ int ice_tso(struct ice_tx_buf *first, struct ice_tx_offload_params *off)
+ 
+ 	/* update gso_segs and bytecount */
+ 	first->gso_segs = skb_shinfo(skb)->gso_segs;
+-	first->bytecount = (first->gso_segs - 1) * off->header_len;
++	first->bytecount += (first->gso_segs - 1) * off->header_len;
+ 
+ 	cd_tso_len = skb->len - off->header_len;
+ 	cd_mss = skb_shinfo(skb)->gso_size;
+diff --git a/drivers/net/ethernet/intel/ice/ice_type.h b/drivers/net/ethernet/intel/ice/ice_type.h
+index 97c366e0ca59..ba11b5898833 100644
+--- a/drivers/net/ethernet/intel/ice/ice_type.h
++++ b/drivers/net/ethernet/intel/ice/ice_type.h
+@@ -83,12 +83,12 @@ struct ice_link_status {
+ 	u64 phy_type_low;
+ 	u16 max_frame_size;
+ 	u16 link_speed;
++	u16 req_speeds;
+ 	u8 lse_ena;	/* Link Status Event notification */
+ 	u8 link_info;
+ 	u8 an_info;
+ 	u8 ext_info;
+ 	u8 pacing;
+-	u8 req_speeds;
+ 	/* Refer to #define from module_type[ICE_MODULE_TYPE_TOTAL_BYTE] of
+ 	 * ice_aqc_get_phy_caps structure
+ 	 */
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+index 3c6f01c41b78..eea63a99f29c 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+@@ -721,8 +721,10 @@ static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
+ 			ixgbe_set_vmvir(adapter, vfinfo->pf_vlan,
+ 					adapter->default_up, vf);
+ 
+-		if (vfinfo->spoofchk_enabled)
++		if (vfinfo->spoofchk_enabled) {
+ 			hw->mac.ops.set_vlan_anti_spoofing(hw, true, vf);
++			hw->mac.ops.set_mac_anti_spoofing(hw, true, vf);
++		}
+ 	}
+ 
+ 	/* reset multicast table array for vf */
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_fcoe.c b/drivers/net/ethernet/qlogic/qed/qed_fcoe.c
+index cc1b373c0ace..46dc93d3b9b5 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_fcoe.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_fcoe.c
+@@ -147,7 +147,8 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn,
+ 		       "Cannot satisfy CQ amount. CQs requested %d, CQs available %d. Aborting function start\n",
+ 		       fcoe_pf_params->num_cqs,
+ 		       p_hwfn->hw_info.feat_num[QED_FCOE_CQ]);
+-		return -EINVAL;
++		rc = -EINVAL;
++		goto err;
+ 	}
+ 
+ 	p_data->mtu = cpu_to_le16(fcoe_pf_params->mtu);
+@@ -156,14 +157,14 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn,
+ 
+ 	rc = qed_cxt_acquire_cid(p_hwfn, PROTOCOLID_FCOE, &dummy_cid);
+ 	if (rc)
+-		return rc;
++		goto err;
+ 
+ 	cxt_info.iid = dummy_cid;
+ 	rc = qed_cxt_get_cid_info(p_hwfn, &cxt_info);
+ 	if (rc) {
+ 		DP_NOTICE(p_hwfn, "Cannot find context info for dummy cid=%d\n",
+ 			  dummy_cid);
+-		return rc;
++		goto err;
+ 	}
+ 	p_cxt = cxt_info.p_cxt;
+ 	SET_FIELD(p_cxt->tstorm_ag_context.flags3,
+@@ -240,6 +241,10 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn,
+ 	rc = qed_spq_post(p_hwfn, p_ent, NULL);
+ 
+ 	return rc;
++
++err:
++	qed_sp_destroy_request(p_hwfn, p_ent);
++	return rc;
+ }
+ 
+ static int
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
+index 1135387bd99d..4f8a685d1a55 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
+@@ -200,6 +200,7 @@ qed_sp_iscsi_func_start(struct qed_hwfn *p_hwfn,
+ 		       "Cannot satisfy CQ amount. Queues requested %d, CQs available %d. Aborting function start\n",
+ 		       p_params->num_queues,
+ 		       p_hwfn->hw_info.feat_num[QED_ISCSI_CQ]);
++		qed_sp_destroy_request(p_hwfn, p_ent);
+ 		return -EINVAL;
+ 	}
+ 
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+index 82a1bd1f8a8c..67c02ea93906 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+@@ -740,8 +740,7 @@ int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
+ 
+ 	rc = qed_sp_vport_update_rss(p_hwfn, p_ramrod, p_rss_params);
+ 	if (rc) {
+-		/* Return spq entry which is taken in qed_sp_init_request()*/
+-		qed_spq_return_entry(p_hwfn, p_ent);
++		qed_sp_destroy_request(p_hwfn, p_ent);
+ 		return rc;
+ 	}
+ 
+@@ -1355,6 +1354,7 @@ qed_filter_ucast_common(struct qed_hwfn *p_hwfn,
+ 			DP_NOTICE(p_hwfn,
+ 				  "%d is not supported yet\n",
+ 				  p_filter_cmd->opcode);
++			qed_sp_destroy_request(p_hwfn, *pp_ent);
+ 			return -EINVAL;
+ 		}
+ 
+@@ -2056,13 +2056,13 @@ qed_configure_rfs_ntuple_filter(struct qed_hwfn *p_hwfn,
+ 	} else {
+ 		rc = qed_fw_vport(p_hwfn, p_params->vport_id, &abs_vport_id);
+ 		if (rc)
+-			return rc;
++			goto err;
+ 
+ 		if (p_params->qid != QED_RFS_NTUPLE_QID_RSS) {
+ 			rc = qed_fw_l2_queue(p_hwfn, p_params->qid,
+ 					     &abs_rx_q_id);
+ 			if (rc)
+-				return rc;
++				goto err;
+ 
+ 			p_ramrod->rx_qid_valid = 1;
+ 			p_ramrod->rx_qid = cpu_to_le16(abs_rx_q_id);
+@@ -2083,6 +2083,10 @@ qed_configure_rfs_ntuple_filter(struct qed_hwfn *p_hwfn,
+ 		   (u64)p_params->addr, p_params->length);
+ 
+ 	return qed_spq_post(p_hwfn, p_ent, NULL);
++
++err:
++	qed_sp_destroy_request(p_hwfn, p_ent);
++	return rc;
+ }
+ 
+ int qed_get_rxq_coalesce(struct qed_hwfn *p_hwfn,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+index c71391b9c757..62113438c880 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+@@ -1514,6 +1514,7 @@ qed_rdma_register_tid(void *rdma_cxt,
+ 	default:
+ 		rc = -EINVAL;
+ 		DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "rc = %d\n", rc);
++		qed_sp_destroy_request(p_hwfn, p_ent);
+ 		return rc;
+ 	}
+ 	SET_FIELD(p_ramrod->flags1,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c
+index f9167d1354bb..e49fada85410 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c
+@@ -745,6 +745,7 @@ static int qed_roce_sp_destroy_qp_responder(struct qed_hwfn *p_hwfn,
+ 		DP_NOTICE(p_hwfn,
+ 			  "qed destroy responder failed: cannot allocate memory (ramrod). rc = %d\n",
+ 			  rc);
++		qed_sp_destroy_request(p_hwfn, p_ent);
+ 		return rc;
+ 	}
+ 
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h
+index e95431f6acd4..3157c0d99441 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h
+@@ -167,6 +167,9 @@ struct qed_spq_entry {
+ 	enum spq_mode			comp_mode;
+ 	struct qed_spq_comp_cb		comp_cb;
+ 	struct qed_spq_comp_done	comp_done; /* SPQ_MODE_EBLOCK */
++
++	/* Posted entry for unlimited list entry in EBLOCK mode */
++	struct qed_spq_entry		*post_ent;
+ };
+ 
+ struct qed_eq {
+@@ -396,6 +399,17 @@ struct qed_sp_init_data {
+ 	struct qed_spq_comp_cb *p_comp_data;
+ };
+ 
++/**
++ * @brief Returns a SPQ entry to the pool / frees the entry if allocated.
++ *        Should be called on in error flows after initializing the SPQ entry
++ *        and before posting it.
++ *
++ * @param p_hwfn
++ * @param p_ent
++ */
++void qed_sp_destroy_request(struct qed_hwfn *p_hwfn,
++			    struct qed_spq_entry *p_ent);
++
+ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
+ 			struct qed_spq_entry **pp_ent,
+ 			u8 cmd,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
+index 77b6248ad3b9..888274fa208b 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
+@@ -47,6 +47,19 @@
+ #include "qed_sp.h"
+ #include "qed_sriov.h"
+ 
++void qed_sp_destroy_request(struct qed_hwfn *p_hwfn,
++			    struct qed_spq_entry *p_ent)
++{
++	/* qed_spq_get_entry() can either get an entry from the free_pool,
++	 * or, if no entries are left, allocate a new entry and add it to
++	 * the unlimited_pending list.
++	 */
++	if (p_ent->queue == &p_hwfn->p_spq->unlimited_pending)
++		kfree(p_ent);
++	else
++		qed_spq_return_entry(p_hwfn, p_ent);
++}
++
+ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
+ 			struct qed_spq_entry **pp_ent,
+ 			u8 cmd, u8 protocol, struct qed_sp_init_data *p_data)
+@@ -80,7 +93,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
+ 
+ 	case QED_SPQ_MODE_BLOCK:
+ 		if (!p_data->p_comp_data)
+-			return -EINVAL;
++			goto err;
+ 
+ 		p_ent->comp_cb.cookie = p_data->p_comp_data->cookie;
+ 		break;
+@@ -95,7 +108,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
+ 	default:
+ 		DP_NOTICE(p_hwfn, "Unknown SPQE completion mode %d\n",
+ 			  p_ent->comp_mode);
+-		return -EINVAL;
++		goto err;
+ 	}
+ 
+ 	DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
+@@ -109,6 +122,11 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
+ 	memset(&p_ent->ramrod, 0, sizeof(p_ent->ramrod));
+ 
+ 	return 0;
++
++err:
++	qed_sp_destroy_request(p_hwfn, p_ent);
++
++	return -EINVAL;
+ }
+ 
+ static enum tunnel_clss qed_tunn_clss_to_fw_clss(u8 type)
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
+index 1673fc90027f..7106ad17afe2 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
+@@ -142,6 +142,7 @@ static int qed_spq_block(struct qed_hwfn *p_hwfn,
+ 
+ 	DP_INFO(p_hwfn, "Ramrod is stuck, requesting MCP drain\n");
+ 	rc = qed_mcp_drain(p_hwfn, p_ptt);
++	qed_ptt_release(p_hwfn, p_ptt);
+ 	if (rc) {
+ 		DP_NOTICE(p_hwfn, "MCP drain failed\n");
+ 		goto err;
+@@ -150,18 +151,15 @@ static int qed_spq_block(struct qed_hwfn *p_hwfn,
+ 	/* Retry after drain */
+ 	rc = __qed_spq_block(p_hwfn, p_ent, p_fw_ret, true);
+ 	if (!rc)
+-		goto out;
++		return 0;
+ 
+ 	comp_done = (struct qed_spq_comp_done *)p_ent->comp_cb.cookie;
+-	if (comp_done->done == 1)
++	if (comp_done->done == 1) {
+ 		if (p_fw_ret)
+ 			*p_fw_ret = comp_done->fw_return_code;
+-out:
+-	qed_ptt_release(p_hwfn, p_ptt);
+-	return 0;
+-
++		return 0;
++	}
+ err:
+-	qed_ptt_release(p_hwfn, p_ptt);
+ 	DP_NOTICE(p_hwfn,
+ 		  "Ramrod is stuck [CID %08x cmd %02x protocol %02x echo %04x]\n",
+ 		  le32_to_cpu(p_ent->elem.hdr.cid),
+@@ -685,6 +683,8 @@ static int qed_spq_add_entry(struct qed_hwfn *p_hwfn,
+ 			/* EBLOCK responsible to free the allocated p_ent */
+ 			if (p_ent->comp_mode != QED_SPQ_MODE_EBLOCK)
+ 				kfree(p_ent);
++			else
++				p_ent->post_ent = p_en2;
+ 
+ 			p_ent = p_en2;
+ 		}
+@@ -768,6 +768,25 @@ static int qed_spq_pend_post(struct qed_hwfn *p_hwfn)
+ 				 SPQ_HIGH_PRI_RESERVE_DEFAULT);
+ }
+ 
++/* Avoid overriding of SPQ entries when getting out-of-order completions, by
++ * marking the completions in a bitmap and increasing the chain consumer only
++ * for the first successive completed entries.
++ */
++static void qed_spq_comp_bmap_update(struct qed_hwfn *p_hwfn, __le16 echo)
++{
++	u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE;
++	struct qed_spq *p_spq = p_hwfn->p_spq;
++
++	__set_bit(pos, p_spq->p_comp_bitmap);
++	while (test_bit(p_spq->comp_bitmap_idx,
++			p_spq->p_comp_bitmap)) {
++		__clear_bit(p_spq->comp_bitmap_idx,
++			    p_spq->p_comp_bitmap);
++		p_spq->comp_bitmap_idx++;
++		qed_chain_return_produced(&p_spq->chain);
++	}
++}
++
+ int qed_spq_post(struct qed_hwfn *p_hwfn,
+ 		 struct qed_spq_entry *p_ent, u8 *fw_return_code)
+ {
+@@ -825,11 +844,12 @@ int qed_spq_post(struct qed_hwfn *p_hwfn,
+ 				   p_ent->queue == &p_spq->unlimited_pending);
+ 
+ 		if (p_ent->queue == &p_spq->unlimited_pending) {
+-			/* This is an allocated p_ent which does not need to
+-			 * return to pool.
+-			 */
++			struct qed_spq_entry *p_post_ent = p_ent->post_ent;
++
+ 			kfree(p_ent);
+-			return rc;
++
++			/* Return the entry which was actually posted */
++			p_ent = p_post_ent;
+ 		}
+ 
+ 		if (rc)
+@@ -843,7 +863,7 @@ int qed_spq_post(struct qed_hwfn *p_hwfn,
+ spq_post_fail2:
+ 	spin_lock_bh(&p_spq->lock);
+ 	list_del(&p_ent->list);
+-	qed_chain_return_produced(&p_spq->chain);
++	qed_spq_comp_bmap_update(p_hwfn, p_ent->elem.hdr.echo);
+ 
+ spq_post_fail:
+ 	/* return to the free pool */
+@@ -875,25 +895,8 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
+ 	spin_lock_bh(&p_spq->lock);
+ 	list_for_each_entry_safe(p_ent, tmp, &p_spq->completion_pending, list) {
+ 		if (p_ent->elem.hdr.echo == echo) {
+-			u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE;
+-
+ 			list_del(&p_ent->list);
+-
+-			/* Avoid overriding of SPQ entries when getting
+-			 * out-of-order completions, by marking the completions
+-			 * in a bitmap and increasing the chain consumer only
+-			 * for the first successive completed entries.
+-			 */
+-			__set_bit(pos, p_spq->p_comp_bitmap);
+-
+-			while (test_bit(p_spq->comp_bitmap_idx,
+-					p_spq->p_comp_bitmap)) {
+-				__clear_bit(p_spq->comp_bitmap_idx,
+-					    p_spq->p_comp_bitmap);
+-				p_spq->comp_bitmap_idx++;
+-				qed_chain_return_produced(&p_spq->chain);
+-			}
+-
++			qed_spq_comp_bmap_update(p_hwfn, echo);
+ 			p_spq->comp_count++;
+ 			found = p_ent;
+ 			break;
+@@ -932,11 +935,9 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
+ 			   QED_MSG_SPQ,
+ 			   "Got a completion without a callback function\n");
+ 
+-	if ((found->comp_mode != QED_SPQ_MODE_EBLOCK) ||
+-	    (found->queue == &p_spq->unlimited_pending))
++	if (found->comp_mode != QED_SPQ_MODE_EBLOCK)
+ 		/* EBLOCK  is responsible for returning its own entry into the
+-		 * free list, unless it originally added the entry into the
+-		 * unlimited pending list.
++		 * free list.
+ 		 */
+ 		qed_spq_return_entry(p_hwfn, found);
+ 
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+index 9b08a9d9e151..ca6290fa0f30 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+@@ -101,6 +101,7 @@ static int qed_sp_vf_start(struct qed_hwfn *p_hwfn, struct qed_vf_info *p_vf)
+ 	default:
+ 		DP_NOTICE(p_hwfn, "Unknown VF personality %d\n",
+ 			  p_hwfn->hw_info.personality);
++		qed_sp_destroy_request(p_hwfn, p_ent);
+ 		return -EINVAL;
+ 	}
+ 
+diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
+index b1b305f8f414..272b9ca66314 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/common.h
++++ b/drivers/net/ethernet/stmicro/stmmac/common.h
+@@ -365,7 +365,8 @@ struct dma_features {
+ 
+ /* GMAC TX FIFO is 8K, Rx FIFO is 16K */
+ #define BUF_SIZE_16KiB 16384
+-#define BUF_SIZE_8KiB 8192
++/* RX Buffer size must be < 8191 and multiple of 4/8/16 bytes */
++#define BUF_SIZE_8KiB 8188
+ #define BUF_SIZE_4KiB 4096
+ #define BUF_SIZE_2KiB 2048
+ 
+diff --git a/drivers/net/ethernet/stmicro/stmmac/descs_com.h b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
+index ca9d7e48034c..40d6356a7e73 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h
++++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
+@@ -31,7 +31,7 @@
+ /* Enhanced descriptors */
+ static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end)
+ {
+-	p->des1 |= cpu_to_le32(((BUF_SIZE_8KiB - 1)
++	p->des1 |= cpu_to_le32((BUF_SIZE_8KiB
+ 			<< ERDES1_BUFFER2_SIZE_SHIFT)
+ 		   & ERDES1_BUFFER2_SIZE_MASK);
+ 
+diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+index 77914c89d749..5ef91a790f9d 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+@@ -262,7 +262,7 @@ static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
+ 				  int mode, int end)
+ {
+ 	p->des0 |= cpu_to_le32(RDES0_OWN);
+-	p->des1 |= cpu_to_le32((BUF_SIZE_8KiB - 1) & ERDES1_BUFFER1_SIZE_MASK);
++	p->des1 |= cpu_to_le32(BUF_SIZE_8KiB & ERDES1_BUFFER1_SIZE_MASK);
+ 
+ 	if (mode == STMMAC_CHAIN_MODE)
+ 		ehn_desc_rx_set_on_chain(p);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+index a7ffc73fffe8..bc83ced94e1b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
++++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+@@ -140,7 +140,7 @@ static void clean_desc3(void *priv_ptr, struct dma_desc *p)
+ static int set_16kib_bfsize(int mtu)
+ {
+ 	int ret = 0;
+-	if (unlikely(mtu >= BUF_SIZE_8KiB))
++	if (unlikely(mtu > BUF_SIZE_8KiB))
+ 		ret = BUF_SIZE_16KiB;
+ 	return ret;
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
+index 5da7bfbe907f..14e8c575f6c3 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
+@@ -757,10 +757,10 @@ __mt76x0_phy_set_channel(struct mt76x0_dev *dev,
+ 	/* Vendor driver don't do it */
+ 	/* mt76x0_phy_set_tx_power(dev, channel, rf_bw_band); */
+ 
++	mt76x0_vco_cal(dev, channel);
+ 	if (scan)
+-		mt76x0_vco_cal(dev, channel);
++		mt76x0_mcu_calibrate(dev, MCU_CAL_RXDCOC, 1);
+ 
+-	mt76x0_mcu_calibrate(dev, MCU_CAL_RXDCOC, 1);
+ 	mt76x0_phy_set_chan_pwr(dev, channel);
+ 
+ 	dev->mt76.chandef = *chandef;
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 6bb9908bf46f..0ba301f7e8b4 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1519,8 +1519,10 @@ static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
+ 	if (ns->ndev)
+ 		nvme_nvm_update_nvm_info(ns);
+ #ifdef CONFIG_NVME_MULTIPATH
+-	if (ns->head->disk)
++	if (ns->head->disk) {
+ 		nvme_update_disk_info(ns->head->disk, ns, id);
++		blk_queue_stack_limits(ns->head->disk->queue, ns->queue);
++	}
+ #endif
+ }
+ 
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index b71c9ad1bf45..c27af277e14e 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -257,6 +257,7 @@ int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl, struct nvme_ns_head *head)
+ 	blk_queue_flag_set(QUEUE_FLAG_NONROT, q);
+ 	/* set to a default value for 512 until disk is validated */
+ 	blk_queue_logical_block_size(q, 512);
++	blk_set_stacking_limits(&q->limits);
+ 
+ 	/* we need to propagate up the VMC settings */
+ 	if (ctrl->vwc & NVME_CTRL_VWC_PRESENT)
+diff --git a/drivers/of/device.c b/drivers/of/device.c
+index 5957cd4fa262..40b9051a7fce 100644
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -149,9 +149,11 @@ int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma)
+ 	 * set by the driver.
+ 	 */
+ 	mask = DMA_BIT_MASK(ilog2(dma_addr + size - 1) + 1);
+-	dev->bus_dma_mask = mask;
+ 	dev->coherent_dma_mask &= mask;
+ 	*dev->dma_mask &= mask;
++	/* ...but only set bus mask if we found valid dma-ranges earlier */
++	if (!ret)
++		dev->bus_dma_mask = mask;
+ 
+ 	coherent = of_dma_is_coherent(np);
+ 	dev_dbg(dev, "device is%sdma coherent\n",
+diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c
+index ea22591ee66f..53dfe67807e3 100644
+--- a/drivers/platform/x86/acerhdf.c
++++ b/drivers/platform/x86/acerhdf.c
+@@ -233,6 +233,7 @@ static const struct bios_settings bios_tbl[] = {
+ 	{"Gateway", "LT31",   "v1.3201",  0x55, 0x58, {0x9e, 0x00}, 0},
+ 	{"Gateway", "LT31",   "v1.3302",  0x55, 0x58, {0x9e, 0x00}, 0},
+ 	{"Gateway", "LT31",   "v1.3303t", 0x55, 0x58, {0x9e, 0x00}, 0},
++	{"Gateway", "LT31",   "v1.3307",  0x55, 0x58, {0x9e, 0x00}, 0},
+ 	/* Packard Bell */
+ 	{"Packard Bell", "DOA150",  "v0.3104",  0x55, 0x58, {0x21, 0x00}, 0},
+ 	{"Packard Bell", "DOA150",  "v0.3105",  0x55, 0x58, {0x20, 0x00}, 0},
+diff --git a/drivers/platform/x86/intel_telemetry_debugfs.c b/drivers/platform/x86/intel_telemetry_debugfs.c
+index ffd0474b0531..1423fa8710fd 100644
+--- a/drivers/platform/x86/intel_telemetry_debugfs.c
++++ b/drivers/platform/x86/intel_telemetry_debugfs.c
+@@ -951,12 +951,16 @@ static int __init telemetry_debugfs_init(void)
+ 	debugfs_conf = (struct telemetry_debugfs_conf *)id->driver_data;
+ 
+ 	err = telemetry_pltconfig_valid();
+-	if (err < 0)
++	if (err < 0) {
++		pr_info("Invalid pltconfig, ensure IPC1 device is enabled in BIOS\n");
+ 		return -ENODEV;
++	}
+ 
+ 	err = telemetry_debugfs_check_evts();
+-	if (err < 0)
++	if (err < 0) {
++		pr_info("telemetry_debugfs_check_evts failed\n");
+ 		return -EINVAL;
++	}
+ 
+ 	register_pm_notifier(&pm_notifier);
+ 
+diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
+index 34e0d476c5c6..970654fcc48d 100644
+--- a/drivers/s390/net/qeth_core.h
++++ b/drivers/s390/net/qeth_core.h
+@@ -826,6 +826,11 @@ struct qeth_trap_id {
+ /*some helper functions*/
+ #define QETH_CARD_IFNAME(card) (((card)->dev)? (card)->dev->name : "")
+ 
++static inline bool qeth_netdev_is_registered(struct net_device *dev)
++{
++	return dev->netdev_ops != NULL;
++}
++
+ static inline void qeth_scrub_qdio_buffer(struct qdio_buffer *buf,
+ 					  unsigned int elements)
+ {
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index b5e38531733f..76b2fba5fba2 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -854,7 +854,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)
+ 
+ 	if (cgdev->state == CCWGROUP_ONLINE)
+ 		qeth_l2_set_offline(cgdev);
+-	unregister_netdev(card->dev);
++	if (qeth_netdev_is_registered(card->dev))
++		unregister_netdev(card->dev);
+ }
+ 
+ static const struct ethtool_ops qeth_l2_ethtool_ops = {
+@@ -894,7 +895,7 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
+ {
+ 	int rc;
+ 
+-	if (card->dev->netdev_ops)
++	if (qeth_netdev_is_registered(card->dev))
+ 		return 0;
+ 
+ 	card->dev->priv_flags |= IFF_UNICAST_FLT;
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index ada258c01a08..b7f6a8384543 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -279,9 +279,6 @@ static void qeth_l3_clear_ip_htable(struct qeth_card *card, int recover)
+ 
+ 	QETH_CARD_TEXT(card, 4, "clearip");
+ 
+-	if (recover && card->options.sniffer)
+-		return;
+-
+ 	spin_lock_bh(&card->ip_lock);
+ 
+ 	hash_for_each_safe(card->ip_htable, i, tmp, addr, hnode) {
+@@ -664,6 +661,8 @@ static int qeth_l3_register_addr_entry(struct qeth_card *card,
+ 	int rc = 0;
+ 	int cnt = 3;
+ 
++	if (card->options.sniffer)
++		return 0;
+ 
+ 	if (addr->proto == QETH_PROT_IPV4) {
+ 		QETH_CARD_TEXT(card, 2, "setaddr4");
+@@ -698,6 +697,9 @@ static int qeth_l3_deregister_addr_entry(struct qeth_card *card,
+ {
+ 	int rc = 0;
+ 
++	if (card->options.sniffer)
++		return 0;
++
+ 	if (addr->proto == QETH_PROT_IPV4) {
+ 		QETH_CARD_TEXT(card, 2, "deladdr4");
+ 		QETH_CARD_HEX(card, 3, &addr->u.a4.addr, sizeof(int));
+@@ -2512,7 +2514,7 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
+ {
+ 	int rc;
+ 
+-	if (card->dev->netdev_ops)
++	if (qeth_netdev_is_registered(card->dev))
+ 		return 0;
+ 
+ 	if (card->info.type == QETH_CARD_TYPE_OSD ||
+@@ -2609,7 +2611,8 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev)
+ 	if (cgdev->state == CCWGROUP_ONLINE)
+ 		qeth_l3_set_offline(cgdev);
+ 
+-	unregister_netdev(card->dev);
++	if (qeth_netdev_is_registered(card->dev))
++		unregister_netdev(card->dev);
+ 	qeth_l3_clear_ip_htable(card, 0);
+ 	qeth_l3_clear_ipato_list(card);
+ }
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 3649b83ef863..effba6ce0caa 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -1614,10 +1614,10 @@ static void sci_request_dma(struct uart_port *port)
+ 		hrtimer_init(&s->rx_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ 		s->rx_timer.function = rx_timer_fn;
+ 
++		s->chan_rx_saved = s->chan_rx = chan;
++
+ 		if (port->type == PORT_SCIFA || port->type == PORT_SCIFB)
+ 			sci_submit_rx(s);
+-
+-		s->chan_rx_saved = s->chan_rx = chan;
+ 	}
+ }
+ 
+diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
+index 9916edda5271..2762148c169d 100644
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -959,6 +959,8 @@ int __uio_register_device(struct module *owner,
+ 	if (ret)
+ 		goto err_uio_dev_add_attributes;
+ 
++	info->uio_dev = idev;
++
+ 	if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) {
+ 		/*
+ 		 * Note that we deliberately don't use devm_request_irq
+@@ -970,11 +972,12 @@ int __uio_register_device(struct module *owner,
+ 		 */
+ 		ret = request_irq(info->irq, uio_interrupt,
+ 				  info->irq_flags, info->name, idev);
+-		if (ret)
++		if (ret) {
++			info->uio_dev = NULL;
+ 			goto err_request_irq;
++		}
+ 	}
+ 
+-	info->uio_dev = idev;
+ 	return 0;
+ 
+ err_request_irq:
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 9ede35cecb12..40c64c7ab5e4 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1711,6 +1711,9 @@ static const struct usb_device_id acm_ids[] = {
+ 	{ USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */
+ 	.driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+ 	},
++	{ USB_DEVICE(0x0572, 0x1349), /* Hiro (Conexant) USB MODEM H50228 */
++	.driver_info = NO_UNION_NORMAL, /* has no union descriptor */
++	},
+ 	{ USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */
+ 	.driver_info = QUIRK_CONTROL_LINE_STATE, },
+ 	{ USB_DEVICE(0x2184, 0x001c) },	/* GW Instek AFG-2225 */
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 462ce49f683a..6e0823790bee 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2791,6 +2791,7 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ 	int i, status;
+ 	u16 portchange, portstatus;
+ 	struct usb_port *port_dev = hub->ports[port1 - 1];
++	int reset_recovery_time;
+ 
+ 	if (!hub_is_superspeed(hub->hdev)) {
+ 		if (warm) {
+@@ -2882,11 +2883,18 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ 
+ done:
+ 	if (status == 0) {
+-		/* TRSTRCY = 10 ms; plus some extra */
+ 		if (port_dev->quirks & USB_PORT_QUIRK_FAST_ENUM)
+ 			usleep_range(10000, 12000);
+-		else
+-			msleep(10 + 40);
++		else {
++			/* TRSTRCY = 10 ms; plus some extra */
++			reset_recovery_time = 10 + 40;
++
++			/* Hub needs extra delay after resetting its port. */
++			if (hub->hdev->quirks & USB_QUIRK_HUB_SLOW_RESET)
++				reset_recovery_time += 100;
++
++			msleep(reset_recovery_time);
++		}
+ 
+ 		if (udev) {
+ 			struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 178d6c6063c0..f9ff03e6af93 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -128,6 +128,9 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp)
+ 			case 'n':
+ 				flags |= USB_QUIRK_DELAY_CTRL_MSG;
+ 				break;
++			case 'o':
++				flags |= USB_QUIRK_HUB_SLOW_RESET;
++				break;
+ 			/* Ignore unrecognized flag characters */
+ 			}
+ 		}
+@@ -380,6 +383,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	{ USB_DEVICE(0x1a0a, 0x0200), .driver_info =
+ 			USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+ 
++	/* Terminus Technology Inc. Hub */
++	{ USB_DEVICE(0x1a40, 0x0101), .driver_info = USB_QUIRK_HUB_SLOW_RESET },
++
+ 	/* Corsair K70 RGB */
+ 	{ USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
+ 
+@@ -391,6 +397,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	{ USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT |
+ 	  USB_QUIRK_DELAY_CTRL_MSG },
+ 
++	/* Corsair K70 LUX RGB */
++	{ USB_DEVICE(0x1b1c, 0x1b33), .driver_info = USB_QUIRK_DELAY_INIT },
++
+ 	/* Corsair K70 LUX */
+ 	{ USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
+ 
+@@ -411,6 +420,11 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	{ USB_DEVICE(0x2040, 0x7200), .driver_info =
+ 			USB_QUIRK_CONFIG_INTF_STRINGS },
+ 
++	/* Raydium Touchscreen */
++	{ USB_DEVICE(0x2386, 0x3114), .driver_info = USB_QUIRK_NO_LPM },
++
++	{ USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM },
++
+ 	/* DJI CineSSD */
+ 	{ USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
+ 
+diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
+index d746c26a8055..6a0c60badfa0 100644
+--- a/drivers/usb/misc/appledisplay.c
++++ b/drivers/usb/misc/appledisplay.c
+@@ -50,6 +50,7 @@ static const struct usb_device_id appledisplay_table[] = {
+ 	{ APPLEDISPLAY_DEVICE(0x9219) },
+ 	{ APPLEDISPLAY_DEVICE(0x921c) },
+ 	{ APPLEDISPLAY_DEVICE(0x921d) },
++	{ APPLEDISPLAY_DEVICE(0x9222) },
+ 	{ APPLEDISPLAY_DEVICE(0x9236) },
+ 
+ 	/* Terminating entry */
+diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
+index 84575baceebc..97341fa75458 100644
+--- a/drivers/xen/grant-table.c
++++ b/drivers/xen/grant-table.c
+@@ -914,7 +914,7 @@ int gnttab_dma_free_pages(struct gnttab_dma_alloc_args *args)
+ 
+ 	ret = xenmem_reservation_increase(args->nr_pages, args->frames);
+ 	if (ret != args->nr_pages) {
+-		pr_debug("Failed to decrease reservation for DMA buffer\n");
++		pr_debug("Failed to increase reservation for DMA buffer\n");
+ 		ret = -EFAULT;
+ 	} else {
+ 		ret = 0;
+diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
+index 77a83790a31f..2543f24d23f8 100644
+--- a/fs/afs/rxrpc.c
++++ b/fs/afs/rxrpc.c
+@@ -500,7 +500,6 @@ static void afs_deliver_to_call(struct afs_call *call)
+ 		case -EINPROGRESS:
+ 		case -EAGAIN:
+ 			goto out;
+-		case -EIO:
+ 		case -ECONNABORTED:
+ 			ASSERTCMP(state, ==, AFS_CALL_COMPLETE);
+ 			goto done;
+@@ -509,6 +508,10 @@ static void afs_deliver_to_call(struct afs_call *call)
+ 			rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
+ 						abort_code, ret, "KIV");
+ 			goto local_abort;
++		case -EIO:
++			pr_err("kAFS: Call %u in bad state %u\n",
++			       call->debug_id, state);
++			/* Fall through */
+ 		case -ENODATA:
+ 		case -EBADMSG:
+ 		case -EMSGSIZE:
+diff --git a/fs/ceph/quota.c b/fs/ceph/quota.c
+index 32d4f13784ba..03f4d24db8fe 100644
+--- a/fs/ceph/quota.c
++++ b/fs/ceph/quota.c
+@@ -237,7 +237,8 @@ static bool check_quota_exceeded(struct inode *inode, enum quota_check_op op,
+ 		ceph_put_snap_realm(mdsc, realm);
+ 		realm = next;
+ 	}
+-	ceph_put_snap_realm(mdsc, realm);
++	if (realm)
++		ceph_put_snap_realm(mdsc, realm);
+ 	up_read(&mdsc->snap_rwsem);
+ 
+ 	return exceeded;
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 7065426b3280..fb32f3d6925e 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -981,8 +981,8 @@ static int cifs_clone_file_range(struct file *src_file, loff_t off,
+ 	struct inode *src_inode = file_inode(src_file);
+ 	struct inode *target_inode = file_inode(dst_file);
+ 	struct cifsFileInfo *smb_file_src = src_file->private_data;
+-	struct cifsFileInfo *smb_file_target = dst_file->private_data;
+-	struct cifs_tcon *target_tcon = tlink_tcon(smb_file_target->tlink);
++	struct cifsFileInfo *smb_file_target;
++	struct cifs_tcon *target_tcon;
+ 	unsigned int xid;
+ 	int rc;
+ 
+@@ -996,6 +996,9 @@ static int cifs_clone_file_range(struct file *src_file, loff_t off,
+ 		goto out;
+ 	}
+ 
++	smb_file_target = dst_file->private_data;
++	target_tcon = tlink_tcon(smb_file_target->tlink);
++
+ 	/*
+ 	 * Note: cifs case is easier than btrfs since server responsible for
+ 	 * checks for proper open modes and file type and if it wants
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 89985a0a6819..812da3e56a22 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -686,6 +686,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size,
+ 	int rc = 0;
+ 	unsigned int ea_name_len = ea_name ? strlen(ea_name) : 0;
+ 	char *name, *value;
++	size_t buf_size = dst_size;
+ 	size_t name_len, value_len, user_name_len;
+ 
+ 	while (src_size > 0) {
+@@ -721,9 +722,10 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size,
+ 			/* 'user.' plus a terminating null */
+ 			user_name_len = 5 + 1 + name_len;
+ 
+-			rc += user_name_len;
+-
+-			if (dst_size >= user_name_len) {
++			if (buf_size == 0) {
++				/* skip copy - calc size only */
++				rc += user_name_len;
++			} else if (dst_size >= user_name_len) {
+ 				dst_size -= user_name_len;
+ 				memcpy(dst, "user.", 5);
+ 				dst += 5;
+@@ -731,8 +733,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size,
+ 				dst += name_len;
+ 				*dst = 0;
+ 				++dst;
+-			} else if (dst_size == 0) {
+-				/* skip copy - calc size only */
++				rc += user_name_len;
+ 			} else {
+ 				/* stop before overrun buffer */
+ 				rc = -ERANGE;
+diff --git a/fs/exofs/super.c b/fs/exofs/super.c
+index 41cf2fbee50d..7d61e3fa378c 100644
+--- a/fs/exofs/super.c
++++ b/fs/exofs/super.c
+@@ -101,6 +101,7 @@ static int parse_options(char *options, struct exofs_mountopt *opts)
+ 		token = match_token(p, tokens, args);
+ 		switch (token) {
+ 		case Opt_name:
++			kfree(opts->dev_name);
+ 			opts->dev_name = match_strdup(&args[0]);
+ 			if (unlikely(!opts->dev_name)) {
+ 				EXOFS_ERR("Error allocating dev_name");
+@@ -866,8 +867,10 @@ static struct dentry *exofs_mount(struct file_system_type *type,
+ 	int ret;
+ 
+ 	ret = parse_options(data, &opts);
+-	if (ret)
++	if (ret) {
++		kfree(opts.dev_name);
+ 		return ERR_PTR(ret);
++	}
+ 
+ 	if (!opts.dev_name)
+ 		opts.dev_name = dev_name;
+diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c
+index 9a8772465a90..da25c49203cc 100644
+--- a/fs/hfs/brec.c
++++ b/fs/hfs/brec.c
+@@ -425,6 +425,10 @@ skip:
+ 	if (new_node) {
+ 		__be32 cnid;
+ 
++		if (!new_node->parent) {
++			hfs_btree_inc_height(tree);
++			new_node->parent = tree->root;
++		}
+ 		fd->bnode = hfs_bnode_find(tree, new_node->parent);
+ 		/* create index key and entry */
+ 		hfs_bnode_read_key(new_node, fd->search_key, 14);
+diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
+index ed8eacb34452..aa17a392b414 100644
+--- a/fs/hfsplus/brec.c
++++ b/fs/hfsplus/brec.c
+@@ -429,6 +429,10 @@ skip:
+ 	if (new_node) {
+ 		__be32 cnid;
+ 
++		if (!new_node->parent) {
++			hfs_btree_inc_height(tree);
++			new_node->parent = tree->root;
++		}
+ 		fd->bnode = hfs_bnode_find(tree, new_node->parent);
+ 		/* create index key and entry */
+ 		hfs_bnode_read_key(new_node, fd->search_key, 14);
+diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
+index 48cdfc81fe10..32d8986c26fb 100644
+--- a/fs/reiserfs/xattr.c
++++ b/fs/reiserfs/xattr.c
+@@ -185,6 +185,7 @@ struct reiserfs_dentry_buf {
+ 	struct dir_context ctx;
+ 	struct dentry *xadir;
+ 	int count;
++	int err;
+ 	struct dentry *dentries[8];
+ };
+ 
+@@ -207,6 +208,7 @@ fill_with_dentries(struct dir_context *ctx, const char *name, int namelen,
+ 
+ 	dentry = lookup_one_len(name, dbuf->xadir, namelen);
+ 	if (IS_ERR(dentry)) {
++		dbuf->err = PTR_ERR(dentry);
+ 		return PTR_ERR(dentry);
+ 	} else if (d_really_is_negative(dentry)) {
+ 		/* A directory entry exists, but no file? */
+@@ -215,6 +217,7 @@ fill_with_dentries(struct dir_context *ctx, const char *name, int namelen,
+ 			       "not found for file %pd.\n",
+ 			       dentry, dbuf->xadir);
+ 		dput(dentry);
++		dbuf->err = -EIO;
+ 		return -EIO;
+ 	}
+ 
+@@ -262,6 +265,10 @@ static int reiserfs_for_each_xattr(struct inode *inode,
+ 		err = reiserfs_readdir_inode(d_inode(dir), &buf.ctx);
+ 		if (err)
+ 			break;
++		if (buf.err) {
++			err = buf.err;
++			break;
++		}
+ 		if (!buf.count)
+ 			break;
+ 		for (i = 0; !err && i < buf.count && buf.dentries[i]; i++) {
+diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
+index 78b86dea2f29..7f53ece2c039 100644
+--- a/include/linux/mtd/nand.h
++++ b/include/linux/mtd/nand.h
+@@ -568,7 +568,7 @@ static inline void nanddev_pos_next_eraseblock(struct nand_device *nand,
+ }
+ 
+ /**
+- * nanddev_pos_next_eraseblock() - Move a position to the next page
++ * nanddev_pos_next_page() - Move a position to the next page
+  * @nand: NAND device
+  * @pos: the position to update
+  *
+diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
+index 34fc80f3eb90..1d100efe74ec 100644
+--- a/include/linux/netfilter/ipset/ip_set.h
++++ b/include/linux/netfilter/ipset/ip_set.h
+@@ -314,7 +314,7 @@ enum {
+ extern ip_set_id_t ip_set_get_byname(struct net *net,
+ 				     const char *name, struct ip_set **set);
+ extern void ip_set_put_byindex(struct net *net, ip_set_id_t index);
+-extern const char *ip_set_name_byindex(struct net *net, ip_set_id_t index);
++extern void ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name);
+ extern ip_set_id_t ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index);
+ extern void ip_set_nfnl_put(struct net *net, ip_set_id_t index);
+ 
+diff --git a/include/linux/netfilter/ipset/ip_set_comment.h b/include/linux/netfilter/ipset/ip_set_comment.h
+index 8e2bab1e8e90..70877f8de7e9 100644
+--- a/include/linux/netfilter/ipset/ip_set_comment.h
++++ b/include/linux/netfilter/ipset/ip_set_comment.h
+@@ -43,11 +43,11 @@ ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment,
+ 	rcu_assign_pointer(comment->c, c);
+ }
+ 
+-/* Used only when dumping a set, protected by rcu_read_lock_bh() */
++/* Used only when dumping a set, protected by rcu_read_lock() */
+ static inline int
+ ip_set_put_comment(struct sk_buff *skb, const struct ip_set_comment *comment)
+ {
+-	struct ip_set_comment_rcu *c = rcu_dereference_bh(comment->c);
++	struct ip_set_comment_rcu *c = rcu_dereference(comment->c);
+ 
+ 	if (!c)
+ 		return 0;
+diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
+index b7a99ce56bc9..a1be64c9940f 100644
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -66,4 +66,7 @@
+ /* Device needs a pause after every control message. */
+ #define USB_QUIRK_DELAY_CTRL_MSG		BIT(13)
+ 
++/* Hub needs extra delay after resetting its port. */
++#define USB_QUIRK_HUB_SLOW_RESET		BIT(14)
++
+ #endif /* __LINUX_USB_QUIRKS_H */
+diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
+index e23290ffdc77..325ec6ef0a76 100644
+--- a/include/uapi/linux/netfilter/nf_tables.h
++++ b/include/uapi/linux/netfilter/nf_tables.h
+@@ -1581,8 +1581,8 @@ enum nft_ng_attributes {
+ 	NFTA_NG_MODULUS,
+ 	NFTA_NG_TYPE,
+ 	NFTA_NG_OFFSET,
+-	NFTA_NG_SET_NAME,
+-	NFTA_NG_SET_ID,
++	NFTA_NG_SET_NAME,	/* deprecated */
++	NFTA_NG_SET_ID,		/* deprecated */
+ 	__NFTA_NG_MAX
+ };
+ #define NFTA_NG_MAX	(__NFTA_NG_MAX - 1)
+diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h
+index 156ccd089df1..1610fdbab98d 100644
+--- a/include/uapi/linux/netfilter_bridge.h
++++ b/include/uapi/linux/netfilter_bridge.h
+@@ -11,6 +11,10 @@
+ #include <linux/if_vlan.h>
+ #include <linux/if_pppox.h>
+ 
++#ifndef __KERNEL__
++#include <limits.h> /* for INT_MIN, INT_MAX */
++#endif
++
+ /* Bridge Hooks */
+ /* After promisc drops, checksum checks. */
+ #define NF_BR_PRE_ROUTING	0
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 675eb6d36e47..382c09dddf93 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -1974,6 +1974,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
+ 		info.jited_prog_len = 0;
+ 		info.xlated_prog_len = 0;
+ 		info.nr_jited_ksyms = 0;
++		info.nr_jited_func_lens = 0;
+ 		goto done;
+ 	}
+ 
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index ad97f3ba5ec5..35551110d277 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5854,11 +5854,14 @@ void __init sched_init_smp(void)
+ 	/*
+ 	 * There's no userspace yet to cause hotplug operations; hence all the
+ 	 * CPU masks are stable and all blatant races in the below code cannot
+-	 * happen.
++	 * happen. The hotplug lock is nevertheless taken to satisfy lockdep,
++	 * but there won't be any contention on it.
+ 	 */
++	cpus_read_lock();
+ 	mutex_lock(&sched_domains_mutex);
+ 	sched_init_domains(cpu_active_mask);
+ 	mutex_unlock(&sched_domains_mutex);
++	cpus_read_unlock();
+ 
+ 	/* Move init over to a non-isolated CPU */
+ 	if (set_cpus_allowed_ptr(current, housekeeping_cpumask(HK_FLAG_DOMAIN)) < 0)
+diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile
+index 5d73f5cb4d8a..79777645cac9 100644
+--- a/lib/raid6/test/Makefile
++++ b/lib/raid6/test/Makefile
+@@ -27,7 +27,7 @@ ifeq ($(ARCH),arm)
+         CFLAGS += -I../../../arch/arm/include -mfpu=neon
+         HAS_NEON = yes
+ endif
+-ifeq ($(ARCH),arm64)
++ifeq ($(ARCH),aarch64)
+         CFLAGS += -I../../../arch/arm64/include
+         HAS_NEON = yes
+ endif
+@@ -41,7 +41,7 @@ ifeq ($(IS_X86),yes)
+ 		    gcc -c -x assembler - >&/dev/null &&        \
+ 		    rm ./-.o && echo -DCONFIG_AS_AVX512=1)
+ else ifeq ($(HAS_NEON),yes)
+-        OBJS   += neon.o neon1.o neon2.o neon4.o neon8.o
++        OBJS   += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o
+         CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1
+ else
+         HAS_ALTIVEC := $(shell printf '\#include <altivec.h>\nvector int a;\n' |\
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index 0a187196aeed..9a1c27c61de8 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -593,9 +593,15 @@ static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
+ 	struct bio_vec bvec;
+ 	int ret;
+ 
+-	/* sendpage cannot properly handle pages with page_count == 0,
+-	 * we need to fallback to sendmsg if that's the case */
+-	if (page_count(page) >= 1)
++	/*
++	 * sendpage cannot properly handle pages with page_count == 0,
++	 * we need to fall back to sendmsg if that's the case.
++	 *
++	 * Same goes for slab pages: skb_can_coalesce() allows
++	 * coalescing neighboring slab objects into a single frag which
++	 * triggers one of hardened usercopy checks.
++	 */
++	if (page_count(page) >= 1 && !PageSlab(page))
+ 		return __ceph_tcp_sendpage(sock, page, offset, size, more);
+ 
+ 	bvec.bv_page = page;
+diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
+index 8f68a518d9db..f76bd4d15704 100644
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -587,11 +587,16 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
+ 	 */
+ 	ret = -EINPROGRESS;
+ 	if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
+-	    fq->q.meat == fq->q.len &&
+-	    nf_ct_frag6_reasm(fq, skb, dev))
+-		ret = 0;
+-	else
++	    fq->q.meat == fq->q.len) {
++		unsigned long orefdst = skb->_skb_refdst;
++
++		skb->_skb_refdst = 0UL;
++		if (nf_ct_frag6_reasm(fq, skb, dev))
++			ret = 0;
++		skb->_skb_refdst = orefdst;
++	} else {
+ 		skb_dst_drop(skb);
++	}
+ 
+ out_unlock:
+ 	spin_unlock_bh(&fq->q.lock);
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index bc4bd247bb7d..1577f2f76060 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -55,11 +55,15 @@ MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@××××××××××××××.hu>");
+ MODULE_DESCRIPTION("core IP set support");
+ MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);
+ 
+-/* When the nfnl mutex is held: */
++/* When the nfnl mutex or ip_set_ref_lock is held: */
+ #define ip_set_dereference(p)		\
+-	rcu_dereference_protected(p, lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET))
++	rcu_dereference_protected(p,	\
++		lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET) || \
++		lockdep_is_held(&ip_set_ref_lock))
+ #define ip_set(inst, id)		\
+ 	ip_set_dereference((inst)->ip_set_list)[id]
++#define ip_set_ref_netlink(inst,id)	\
++	rcu_dereference_raw((inst)->ip_set_list)[id]
+ 
+ /* The set types are implemented in modules and registered set types
+  * can be found in ip_set_type_list. Adding/deleting types is
+@@ -693,21 +697,20 @@ ip_set_put_byindex(struct net *net, ip_set_id_t index)
+ EXPORT_SYMBOL_GPL(ip_set_put_byindex);
+ 
+ /* Get the name of a set behind a set index.
+- * We assume the set is referenced, so it does exist and
+- * can't be destroyed. The set cannot be renamed due to
+- * the referencing either.
+- *
++ * Set itself is protected by RCU, but its name isn't: to protect against
++ * renaming, grab ip_set_ref_lock as reader (see ip_set_rename()) and copy the
++ * name.
+  */
+-const char *
+-ip_set_name_byindex(struct net *net, ip_set_id_t index)
++void
++ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name)
+ {
+-	const struct ip_set *set = ip_set_rcu_get(net, index);
++	struct ip_set *set = ip_set_rcu_get(net, index);
+ 
+ 	BUG_ON(!set);
+-	BUG_ON(set->ref == 0);
+ 
+-	/* Referenced, so it's safe */
+-	return set->name;
++	read_lock_bh(&ip_set_ref_lock);
++	strncpy(name, set->name, IPSET_MAXNAMELEN);
++	read_unlock_bh(&ip_set_ref_lock);
+ }
+ EXPORT_SYMBOL_GPL(ip_set_name_byindex);
+ 
+@@ -961,7 +964,7 @@ static int ip_set_create(struct net *net, struct sock *ctnl,
+ 			/* Wraparound */
+ 			goto cleanup;
+ 
+-		list = kcalloc(i, sizeof(struct ip_set *), GFP_KERNEL);
++		list = kvcalloc(i, sizeof(struct ip_set *), GFP_KERNEL);
+ 		if (!list)
+ 			goto cleanup;
+ 		/* nfnl mutex is held, both lists are valid */
+@@ -973,7 +976,7 @@ static int ip_set_create(struct net *net, struct sock *ctnl,
+ 		/* Use new list */
+ 		index = inst->ip_set_max;
+ 		inst->ip_set_max = i;
+-		kfree(tmp);
++		kvfree(tmp);
+ 		ret = 0;
+ 	} else if (ret) {
+ 		goto cleanup;
+@@ -1153,7 +1156,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
+ 	if (!set)
+ 		return -ENOENT;
+ 
+-	read_lock_bh(&ip_set_ref_lock);
++	write_lock_bh(&ip_set_ref_lock);
+ 	if (set->ref != 0) {
+ 		ret = -IPSET_ERR_REFERENCED;
+ 		goto out;
+@@ -1170,7 +1173,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
+ 	strncpy(set->name, name2, IPSET_MAXNAMELEN);
+ 
+ out:
+-	read_unlock_bh(&ip_set_ref_lock);
++	write_unlock_bh(&ip_set_ref_lock);
+ 	return ret;
+ }
+ 
+@@ -1252,7 +1255,7 @@ ip_set_dump_done(struct netlink_callback *cb)
+ 		struct ip_set_net *inst =
+ 			(struct ip_set_net *)cb->args[IPSET_CB_NET];
+ 		ip_set_id_t index = (ip_set_id_t)cb->args[IPSET_CB_INDEX];
+-		struct ip_set *set = ip_set(inst, index);
++		struct ip_set *set = ip_set_ref_netlink(inst, index);
+ 
+ 		if (set->variant->uref)
+ 			set->variant->uref(set, cb, false);
+@@ -1441,7 +1444,7 @@ next_set:
+ release_refcount:
+ 	/* If there was an error or set is done, release set */
+ 	if (ret || !cb->args[IPSET_CB_ARG0]) {
+-		set = ip_set(inst, index);
++		set = ip_set_ref_netlink(inst, index);
+ 		if (set->variant->uref)
+ 			set->variant->uref(set, cb, false);
+ 		pr_debug("release set %s\n", set->name);
+@@ -2059,7 +2062,7 @@ ip_set_net_init(struct net *net)
+ 	if (inst->ip_set_max >= IPSET_INVALID_ID)
+ 		inst->ip_set_max = IPSET_INVALID_ID - 1;
+ 
+-	list = kcalloc(inst->ip_set_max, sizeof(struct ip_set *), GFP_KERNEL);
++	list = kvcalloc(inst->ip_set_max, sizeof(struct ip_set *), GFP_KERNEL);
+ 	if (!list)
+ 		return -ENOMEM;
+ 	inst->is_deleted = false;
+@@ -2087,7 +2090,7 @@ ip_set_net_exit(struct net *net)
+ 		}
+ 	}
+ 	nfnl_unlock(NFNL_SUBSYS_IPSET);
+-	kfree(rcu_dereference_protected(inst->ip_set_list, 1));
++	kvfree(rcu_dereference_protected(inst->ip_set_list, 1));
+ }
+ 
+ static struct pernet_operations ip_set_net_ops = {
+diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c
+index d391485a6acd..613e18e720a4 100644
+--- a/net/netfilter/ipset/ip_set_hash_netportnet.c
++++ b/net/netfilter/ipset/ip_set_hash_netportnet.c
+@@ -213,13 +213,13 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
+ 
+ 	if (tb[IPSET_ATTR_CIDR]) {
+ 		e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+-		if (!e.cidr[0] || e.cidr[0] > HOST_MASK)
++		if (e.cidr[0] > HOST_MASK)
+ 			return -IPSET_ERR_INVALID_CIDR;
+ 	}
+ 
+ 	if (tb[IPSET_ATTR_CIDR2]) {
+ 		e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
+-		if (!e.cidr[1] || e.cidr[1] > HOST_MASK)
++		if (e.cidr[1] > HOST_MASK)
+ 			return -IPSET_ERR_INVALID_CIDR;
+ 	}
+ 
+@@ -493,13 +493,13 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
+ 
+ 	if (tb[IPSET_ATTR_CIDR]) {
+ 		e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+-		if (!e.cidr[0] || e.cidr[0] > HOST_MASK)
++		if (e.cidr[0] > HOST_MASK)
+ 			return -IPSET_ERR_INVALID_CIDR;
+ 	}
+ 
+ 	if (tb[IPSET_ATTR_CIDR2]) {
+ 		e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
+-		if (!e.cidr[1] || e.cidr[1] > HOST_MASK)
++		if (e.cidr[1] > HOST_MASK)
+ 			return -IPSET_ERR_INVALID_CIDR;
+ 	}
+ 
+diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
+index 072a658fde04..4eef55da0878 100644
+--- a/net/netfilter/ipset/ip_set_list_set.c
++++ b/net/netfilter/ipset/ip_set_list_set.c
+@@ -148,9 +148,7 @@ __list_set_del_rcu(struct rcu_head * rcu)
+ {
+ 	struct set_elem *e = container_of(rcu, struct set_elem, rcu);
+ 	struct ip_set *set = e->set;
+-	struct list_set *map = set->data;
+ 
+-	ip_set_put_byindex(map->net, e->id);
+ 	ip_set_ext_destroy(set, e);
+ 	kfree(e);
+ }
+@@ -158,15 +156,21 @@ __list_set_del_rcu(struct rcu_head * rcu)
+ static inline void
+ list_set_del(struct ip_set *set, struct set_elem *e)
+ {
++	struct list_set *map = set->data;
++
+ 	set->elements--;
+ 	list_del_rcu(&e->list);
++	ip_set_put_byindex(map->net, e->id);
+ 	call_rcu(&e->rcu, __list_set_del_rcu);
+ }
+ 
+ static inline void
+-list_set_replace(struct set_elem *e, struct set_elem *old)
++list_set_replace(struct ip_set *set, struct set_elem *e, struct set_elem *old)
+ {
++	struct list_set *map = set->data;
++
+ 	list_replace_rcu(&old->list, &e->list);
++	ip_set_put_byindex(map->net, old->id);
+ 	call_rcu(&old->rcu, __list_set_del_rcu);
+ }
+ 
+@@ -298,7 +302,7 @@ list_set_uadd(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ 	INIT_LIST_HEAD(&e->list);
+ 	list_set_init_extensions(set, ext, e);
+ 	if (n)
+-		list_set_replace(e, n);
++		list_set_replace(set, e, n);
+ 	else if (next)
+ 		list_add_tail_rcu(&e->list, &next->list);
+ 	else if (prev)
+@@ -486,6 +490,7 @@ list_set_list(const struct ip_set *set,
+ 	const struct list_set *map = set->data;
+ 	struct nlattr *atd, *nested;
+ 	u32 i = 0, first = cb->args[IPSET_CB_ARG0];
++	char name[IPSET_MAXNAMELEN];
+ 	struct set_elem *e;
+ 	int ret = 0;
+ 
+@@ -504,8 +509,8 @@ list_set_list(const struct ip_set *set,
+ 		nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
+ 		if (!nested)
+ 			goto nla_put_failure;
+-		if (nla_put_string(skb, IPSET_ATTR_NAME,
+-				   ip_set_name_byindex(map->net, e->id)))
++		ip_set_name_byindex(map->net, e->id, name);
++		if (nla_put_string(skb, IPSET_ATTR_NAME, name))
+ 			goto nla_put_failure;
+ 		if (ip_set_put_extensions(skb, set, e, true))
+ 			goto nla_put_failure;
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index 32535eea51b2..ad2fe6a7e47d 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -54,9 +54,11 @@ static bool nft_xt_put(struct nft_xt *xt)
+ 	return false;
+ }
+ 
+-static int nft_compat_chain_validate_dependency(const char *tablename,
+-						const struct nft_chain *chain)
++static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx,
++						const char *tablename)
+ {
++	enum nft_chain_types type = NFT_CHAIN_T_DEFAULT;
++	const struct nft_chain *chain = ctx->chain;
+ 	const struct nft_base_chain *basechain;
+ 
+ 	if (!tablename ||
+@@ -64,9 +66,12 @@ static int nft_compat_chain_validate_dependency(const char *tablename,
+ 		return 0;
+ 
+ 	basechain = nft_base_chain(chain);
+-	if (strcmp(tablename, "nat") == 0 &&
+-	    basechain->type->type != NFT_CHAIN_T_NAT)
+-		return -EINVAL;
++	if (strcmp(tablename, "nat") == 0) {
++		if (ctx->family != NFPROTO_BRIDGE)
++			type = NFT_CHAIN_T_NAT;
++		if (basechain->type->type != type)
++			return -EINVAL;
++	}
+ 
+ 	return 0;
+ }
+@@ -323,8 +328,7 @@ static int nft_target_validate(const struct nft_ctx *ctx,
+ 		if (target->hooks && !(hook_mask & target->hooks))
+ 			return -EINVAL;
+ 
+-		ret = nft_compat_chain_validate_dependency(target->table,
+-							   ctx->chain);
++		ret = nft_compat_chain_validate_dependency(ctx, target->table);
+ 		if (ret < 0)
+ 			return ret;
+ 	}
+@@ -570,8 +574,7 @@ static int nft_match_validate(const struct nft_ctx *ctx,
+ 		if (match->hooks && !(hook_mask & match->hooks))
+ 			return -EINVAL;
+ 
+-		ret = nft_compat_chain_validate_dependency(match->table,
+-							   ctx->chain);
++		ret = nft_compat_chain_validate_dependency(ctx, match->table);
+ 		if (ret < 0)
+ 			return ret;
+ 	}
+diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
+index 649d1700ec5b..3cc1b3dc3c3c 100644
+--- a/net/netfilter/nft_numgen.c
++++ b/net/netfilter/nft_numgen.c
+@@ -24,7 +24,6 @@ struct nft_ng_inc {
+ 	u32			modulus;
+ 	atomic_t		counter;
+ 	u32			offset;
+-	struct nft_set		*map;
+ };
+ 
+ static u32 nft_ng_inc_gen(struct nft_ng_inc *priv)
+@@ -48,34 +47,11 @@ static void nft_ng_inc_eval(const struct nft_expr *expr,
+ 	regs->data[priv->dreg] = nft_ng_inc_gen(priv);
+ }
+ 
+-static void nft_ng_inc_map_eval(const struct nft_expr *expr,
+-				struct nft_regs *regs,
+-				const struct nft_pktinfo *pkt)
+-{
+-	struct nft_ng_inc *priv = nft_expr_priv(expr);
+-	const struct nft_set *map = priv->map;
+-	const struct nft_set_ext *ext;
+-	u32 result;
+-	bool found;
+-
+-	result = nft_ng_inc_gen(priv);
+-	found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
+-
+-	if (!found)
+-		return;
+-
+-	nft_data_copy(&regs->data[priv->dreg],
+-		      nft_set_ext_data(ext), map->dlen);
+-}
+-
+ static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
+ 	[NFTA_NG_DREG]		= { .type = NLA_U32 },
+ 	[NFTA_NG_MODULUS]	= { .type = NLA_U32 },
+ 	[NFTA_NG_TYPE]		= { .type = NLA_U32 },
+ 	[NFTA_NG_OFFSET]	= { .type = NLA_U32 },
+-	[NFTA_NG_SET_NAME]	= { .type = NLA_STRING,
+-				    .len = NFT_SET_MAXNAMELEN - 1 },
+-	[NFTA_NG_SET_ID]	= { .type = NLA_U32 },
+ };
+ 
+ static int nft_ng_inc_init(const struct nft_ctx *ctx,
+@@ -101,22 +77,6 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
+ 					   NFT_DATA_VALUE, sizeof(u32));
+ }
+ 
+-static int nft_ng_inc_map_init(const struct nft_ctx *ctx,
+-			       const struct nft_expr *expr,
+-			       const struct nlattr * const tb[])
+-{
+-	struct nft_ng_inc *priv = nft_expr_priv(expr);
+-	u8 genmask = nft_genmask_next(ctx->net);
+-
+-	nft_ng_inc_init(ctx, expr, tb);
+-
+-	priv->map = nft_set_lookup_global(ctx->net, ctx->table,
+-					  tb[NFTA_NG_SET_NAME],
+-					  tb[NFTA_NG_SET_ID], genmask);
+-
+-	return PTR_ERR_OR_ZERO(priv->map);
+-}
+-
+ static int nft_ng_dump(struct sk_buff *skb, enum nft_registers dreg,
+ 		       u32 modulus, enum nft_ng_types type, u32 offset)
+ {
+@@ -143,27 +103,10 @@ static int nft_ng_inc_dump(struct sk_buff *skb, const struct nft_expr *expr)
+ 			   priv->offset);
+ }
+ 
+-static int nft_ng_inc_map_dump(struct sk_buff *skb,
+-			       const struct nft_expr *expr)
+-{
+-	const struct nft_ng_inc *priv = nft_expr_priv(expr);
+-
+-	if (nft_ng_dump(skb, priv->dreg, priv->modulus,
+-			NFT_NG_INCREMENTAL, priv->offset) ||
+-	    nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name))
+-		goto nla_put_failure;
+-
+-	return 0;
+-
+-nla_put_failure:
+-	return -1;
+-}
+-
+ struct nft_ng_random {
+ 	enum nft_registers      dreg:8;
+ 	u32			modulus;
+ 	u32			offset;
+-	struct nft_set		*map;
+ };
+ 
+ static u32 nft_ng_random_gen(struct nft_ng_random *priv)
+@@ -183,25 +126,6 @@ static void nft_ng_random_eval(const struct nft_expr *expr,
+ 	regs->data[priv->dreg] = nft_ng_random_gen(priv);
+ }
+ 
+-static void nft_ng_random_map_eval(const struct nft_expr *expr,
+-				   struct nft_regs *regs,
+-				   const struct nft_pktinfo *pkt)
+-{
+-	struct nft_ng_random *priv = nft_expr_priv(expr);
+-	const struct nft_set *map = priv->map;
+-	const struct nft_set_ext *ext;
+-	u32 result;
+-	bool found;
+-
+-	result = nft_ng_random_gen(priv);
+-	found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
+-	if (!found)
+-		return;
+-
+-	nft_data_copy(&regs->data[priv->dreg],
+-		      nft_set_ext_data(ext), map->dlen);
+-}
+-
+ static int nft_ng_random_init(const struct nft_ctx *ctx,
+ 			      const struct nft_expr *expr,
+ 			      const struct nlattr * const tb[])
+@@ -226,21 +150,6 @@ static int nft_ng_random_init(const struct nft_ctx *ctx,
+ 					   NFT_DATA_VALUE, sizeof(u32));
+ }
+ 
+-static int nft_ng_random_map_init(const struct nft_ctx *ctx,
+-				  const struct nft_expr *expr,
+-				  const struct nlattr * const tb[])
+-{
+-	struct nft_ng_random *priv = nft_expr_priv(expr);
+-	u8 genmask = nft_genmask_next(ctx->net);
+-
+-	nft_ng_random_init(ctx, expr, tb);
+-	priv->map = nft_set_lookup_global(ctx->net, ctx->table,
+-					  tb[NFTA_NG_SET_NAME],
+-					  tb[NFTA_NG_SET_ID], genmask);
+-
+-	return PTR_ERR_OR_ZERO(priv->map);
+-}
+-
+ static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr)
+ {
+ 	const struct nft_ng_random *priv = nft_expr_priv(expr);
+@@ -249,22 +158,6 @@ static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr)
+ 			   priv->offset);
+ }
+ 
+-static int nft_ng_random_map_dump(struct sk_buff *skb,
+-				  const struct nft_expr *expr)
+-{
+-	const struct nft_ng_random *priv = nft_expr_priv(expr);
+-
+-	if (nft_ng_dump(skb, priv->dreg, priv->modulus,
+-			NFT_NG_RANDOM, priv->offset) ||
+-	    nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name))
+-		goto nla_put_failure;
+-
+-	return 0;
+-
+-nla_put_failure:
+-	return -1;
+-}
+-
+ static struct nft_expr_type nft_ng_type;
+ static const struct nft_expr_ops nft_ng_inc_ops = {
+ 	.type		= &nft_ng_type,
+@@ -274,14 +167,6 @@ static const struct nft_expr_ops nft_ng_inc_ops = {
+ 	.dump		= nft_ng_inc_dump,
+ };
+ 
+-static const struct nft_expr_ops nft_ng_inc_map_ops = {
+-	.type		= &nft_ng_type,
+-	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ng_inc)),
+-	.eval		= nft_ng_inc_map_eval,
+-	.init		= nft_ng_inc_map_init,
+-	.dump		= nft_ng_inc_map_dump,
+-};
+-
+ static const struct nft_expr_ops nft_ng_random_ops = {
+ 	.type		= &nft_ng_type,
+ 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ng_random)),
+@@ -290,14 +175,6 @@ static const struct nft_expr_ops nft_ng_random_ops = {
+ 	.dump		= nft_ng_random_dump,
+ };
+ 
+-static const struct nft_expr_ops nft_ng_random_map_ops = {
+-	.type		= &nft_ng_type,
+-	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ng_random)),
+-	.eval		= nft_ng_random_map_eval,
+-	.init		= nft_ng_random_map_init,
+-	.dump		= nft_ng_random_map_dump,
+-};
+-
+ static const struct nft_expr_ops *
+ nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
+ {
+@@ -312,12 +189,8 @@ nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
+ 
+ 	switch (type) {
+ 	case NFT_NG_INCREMENTAL:
+-		if (tb[NFTA_NG_SET_NAME])
+-			return &nft_ng_inc_map_ops;
+ 		return &nft_ng_inc_ops;
+ 	case NFT_NG_RANDOM:
+-		if (tb[NFTA_NG_SET_NAME])
+-			return &nft_ng_random_map_ops;
+ 		return &nft_ng_random_ops;
+ 	}
+ 
+diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
+index 5ee859193783..25453a16385e 100644
+--- a/net/netfilter/xt_IDLETIMER.c
++++ b/net/netfilter/xt_IDLETIMER.c
+@@ -116,6 +116,22 @@ static void idletimer_tg_expired(struct timer_list *t)
+ 	schedule_work(&timer->work);
+ }
+ 
++static int idletimer_check_sysfs_name(const char *name, unsigned int size)
++{
++	int ret;
++
++	ret = xt_check_proc_name(name, size);
++	if (ret < 0)
++		return ret;
++
++	if (!strcmp(name, "power") ||
++	    !strcmp(name, "subsystem") ||
++	    !strcmp(name, "uevent"))
++		return -EINVAL;
++
++	return 0;
++}
++
+ static int idletimer_tg_create(struct idletimer_tg_info *info)
+ {
+ 	int ret;
+@@ -126,6 +142,10 @@ static int idletimer_tg_create(struct idletimer_tg_info *info)
+ 		goto out;
+ 	}
+ 
++	ret = idletimer_check_sysfs_name(info->label, sizeof(info->label));
++	if (ret < 0)
++		goto out_free_timer;
++
+ 	sysfs_attr_init(&info->timer->attr.attr);
+ 	info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL);
+ 	if (!info->timer->attr.attr.name) {
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index b53cc0960b5d..ac16f509c95c 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -512,7 +512,7 @@ EXPORT_SYMBOL_GPL(xdr_commit_encode);
+ static __be32 *xdr_get_next_encode_buffer(struct xdr_stream *xdr,
+ 		size_t nbytes)
+ {
+-	static __be32 *p;
++	__be32 *p;
+ 	int space_left;
+ 	int frag1bytes, frag2bytes;
+ 
+diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian
+index 663a7f343b42..edcad61fe3cd 100755
+--- a/scripts/package/mkdebian
++++ b/scripts/package/mkdebian
+@@ -88,6 +88,7 @@ set_debarch() {
+ version=$KERNELRELEASE
+ if [ -n "$KDEB_PKGVERSION" ]; then
+ 	packageversion=$KDEB_PKGVERSION
++	revision=${packageversion##*-}
+ else
+ 	revision=$(cat .version 2>/dev/null||echo 1)
+ 	packageversion=$version-$revision
+@@ -205,10 +206,12 @@ cat <<EOF > debian/rules
+ #!$(command -v $MAKE) -f
+ 
+ build:
+-	\$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} KBUILD_SRC=
++	\$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} \
++	KBUILD_BUILD_VERSION=${revision} KBUILD_SRC=
+ 
+ binary-arch:
+-	\$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} KBUILD_SRC= intdeb-pkg
++	\$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} \
++	KBUILD_BUILD_VERSION=${revision} KBUILD_SRC= intdeb-pkg
+ 
+ clean:
+ 	rm -rf debian/*tmp debian/files
+diff --git a/scripts/setlocalversion b/scripts/setlocalversion
+index 79f7dd57d571..71f39410691b 100755
+--- a/scripts/setlocalversion
++++ b/scripts/setlocalversion
+@@ -74,7 +74,7 @@ scm_version()
+ 		fi
+ 
+ 		# Check for uncommitted changes
+-		if git status -uno --porcelain | grep -qv '^.. scripts/package'; then
++		if git diff-index --name-only HEAD | grep -qv "^scripts/package"; then
+ 			printf '%s' -dirty
+ 		fi
+ 
+diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
+index 974affe50531..76491e7f4177 100644
+--- a/security/apparmor/lib.c
++++ b/security/apparmor/lib.c
+@@ -90,10 +90,12 @@ const char *aa_splitn_fqname(const char *fqname, size_t n, const char **ns_name,
+ 	const char *end = fqname + n;
+ 	const char *name = skipn_spaces(fqname, n);
+ 
+-	if (!name)
+-		return NULL;
+ 	*ns_name = NULL;
+ 	*ns_len = 0;
++
++	if (!name)
++		return NULL;
++
+ 	if (name[0] == ':') {
+ 		char *split = strnchr(&name[1], end - &name[1], ':');
+ 		*ns_name = skipn_spaces(&name[1], end - &name[1]);
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 0166a3d7cd55..dffd60cebc31 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -7395,7 +7395,7 @@ static void ca0132_free(struct hda_codec *codec)
+ 
+ 	snd_hda_power_down(codec);
+ 	if (spec->mem_base)
+-		iounmap(spec->mem_base);
++		pci_iounmap(codec->bus->pci, spec->mem_base);
+ 	kfree(spec->spec_init_verbs);
+ 	kfree(codec->spec);
+ }
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 1070749c3cf4..e58537e13ad3 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6481,6 +6481,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
++	SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ 	SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
+ 	SND_PCI_QUIRK(0x103c, 0x827e, "HP x360", ALC295_FIXUP_HP_X360),
+ 	SND_PCI_QUIRK(0x103c, 0x82bf, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+diff --git a/tools/perf/jvmti/jvmti_agent.c b/tools/perf/jvmti/jvmti_agent.c
+index ac1bcdc17dae..f7eb63cbbc65 100644
+--- a/tools/perf/jvmti/jvmti_agent.c
++++ b/tools/perf/jvmti/jvmti_agent.c
+@@ -125,7 +125,7 @@ perf_get_timestamp(void)
+ }
+ 
+ static int
+-debug_cache_init(void)
++create_jit_cache_dir(void)
+ {
+ 	char str[32];
+ 	char *base, *p;
+@@ -144,8 +144,13 @@ debug_cache_init(void)
+ 
+ 	strftime(str, sizeof(str), JIT_LANG"-jit-%Y%m%d", &tm);
+ 
+-	snprintf(jit_path, PATH_MAX - 1, "%s/.debug/", base);
+-
++	ret = snprintf(jit_path, PATH_MAX, "%s/.debug/", base);
++	if (ret >= PATH_MAX) {
++		warnx("jvmti: cannot generate jit cache dir because %s/.debug/"
++			" is too long, please check the cwd, JITDUMPDIR, and"
++			" HOME variables", base);
++		return -1;
++	}
+ 	ret = mkdir(jit_path, 0755);
+ 	if (ret == -1) {
+ 		if (errno != EEXIST) {
+@@ -154,20 +159,32 @@ debug_cache_init(void)
+ 		}
+ 	}
+ 
+-	snprintf(jit_path, PATH_MAX - 1, "%s/.debug/jit", base);
++	ret = snprintf(jit_path, PATH_MAX, "%s/.debug/jit", base);
++	if (ret >= PATH_MAX) {
++		warnx("jvmti: cannot generate jit cache dir because"
++			" %s/.debug/jit is too long, please check the cwd,"
++			" JITDUMPDIR, and HOME variables", base);
++		return -1;
++	}
+ 	ret = mkdir(jit_path, 0755);
+ 	if (ret == -1) {
+ 		if (errno != EEXIST) {
+-			warn("cannot create jit cache dir %s", jit_path);
++			warn("jvmti: cannot create jit cache dir %s", jit_path);
+ 			return -1;
+ 		}
+ 	}
+ 
+-	snprintf(jit_path, PATH_MAX - 1, "%s/.debug/jit/%s.XXXXXXXX", base, str);
+-
++	ret = snprintf(jit_path, PATH_MAX, "%s/.debug/jit/%s.XXXXXXXX", base, str);
++	if (ret >= PATH_MAX) {
++		warnx("jvmti: cannot generate jit cache dir because"
++			" %s/.debug/jit/%s.XXXXXXXX is too long, please check"
++			" the cwd, JITDUMPDIR, and HOME variables",
++			base, str);
++		return -1;
++	}
+ 	p = mkdtemp(jit_path);
+ 	if (p != jit_path) {
+-		warn("cannot create jit cache dir %s", jit_path);
++		warn("jvmti: cannot create jit cache dir %s", jit_path);
+ 		return -1;
+ 	}
+ 
+@@ -228,7 +245,7 @@ void *jvmti_open(void)
+ {
+ 	char dump_path[PATH_MAX];
+ 	struct jitheader header;
+-	int fd;
++	int fd, ret;
+ 	FILE *fp;
+ 
+ 	init_arch_timestamp();
+@@ -245,12 +262,22 @@ void *jvmti_open(void)
+ 
+ 	memset(&header, 0, sizeof(header));
+ 
+-	debug_cache_init();
++	/*
++	 * jitdump file dir
++	 */
++	if (create_jit_cache_dir() < 0)
++		return NULL;
+ 
+ 	/*
+ 	 * jitdump file name
+ 	 */
+-	scnprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid());
++	ret = snprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid());
++	if (ret >= PATH_MAX) {
++		warnx("jvmti: cannot generate jitdump file full path because"
++			" %s/jit-%i.dump is too long, please check the cwd,"
++			" JITDUMPDIR, and HOME variables", jit_path, getpid());
++		return NULL;
++	}
+ 
+ 	fd = open(dump_path, O_CREAT|O_TRUNC|O_RDWR, 0666);
+ 	if (fd == -1)
+diff --git a/tools/perf/tests/attr/test-record-group-sampling b/tools/perf/tests/attr/test-record-group-sampling
+index 8a33ca4f9e1f..f0729c454f16 100644
+--- a/tools/perf/tests/attr/test-record-group-sampling
++++ b/tools/perf/tests/attr/test-record-group-sampling
+@@ -37,4 +37,3 @@ sample_freq=0
+ sample_period=0
+ freq=0
+ write_backward=0
+-sample_id_all=0
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index e596ae358c4d..03a72310315f 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -952,7 +952,6 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts,
+ 		attr->sample_freq    = 0;
+ 		attr->sample_period  = 0;
+ 		attr->write_backward = 0;
+-		attr->sample_id_all  = 0;
+ 	}
+ 
+ 	if (opts->no_samples)
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index 29770ea61768..6e70cc00c161 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -324,7 +324,17 @@ int dso__synthesize_plt_symbols(struct dso *dso, struct symsrc *ss)
+ 			plt_entry_size = 16;
+ 			break;
+ 
+-		default: /* FIXME: s390/alpha/mips/parisc/poperpc/sh/sparc/xtensa need to be checked */
++		case EM_SPARC:
++			plt_header_size = 48;
++			plt_entry_size = 12;
++			break;
++
++		case EM_SPARCV9:
++			plt_header_size = 128;
++			plt_entry_size = 32;
++			break;
++
++		default: /* FIXME: s390/alpha/mips/parisc/poperpc/sh/xtensa need to be checked */
+ 			plt_header_size = shdr_plt.sh_entsize;
+ 			plt_entry_size = shdr_plt.sh_entsize;
+ 			break;
+diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
+index 6f318b15950e..5eff9bfc5758 100644
+--- a/tools/perf/util/unwind-libdw.c
++++ b/tools/perf/util/unwind-libdw.c
+@@ -45,13 +45,13 @@ static int __report_module(struct addr_location *al, u64 ip,
+ 		Dwarf_Addr s;
+ 
+ 		dwfl_module_info(mod, NULL, &s, NULL, NULL, NULL, NULL, NULL);
+-		if (s != al->map->start)
++		if (s != al->map->start - al->map->pgoff)
+ 			mod = 0;
+ 	}
+ 
+ 	if (!mod)
+ 		mod = dwfl_report_elf(ui->dwfl, dso->short_name,
+-				      (dso->symsrc_filename ? dso->symsrc_filename : dso->long_name), -1, al->map->start,
++				      (dso->symsrc_filename ? dso->symsrc_filename : dso->long_name), -1, al->map->start - al->map->pgoff,
+ 				      false);
+ 
+ 	return mod && dwfl_addrmodule(ui->dwfl, ip) == mod ? 0 : -1;