diff --git a/Makefile b/Makefile
index c0d34d03ab5f..b56456c45c97 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 7
-SUBLEVEL = 17
+SUBLEVEL = 18
 EXTRAVERSION =
 NAME = Kleptomaniac Octopus
 
diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h
index e6225cf40de5..b09dd6bc98a1 100644
--- a/arch/alpha/include/asm/io.h
+++ b/arch/alpha/include/asm/io.h
@@ -490,10 +490,10 @@ extern inline void writeq(u64 b, volatile void __iomem 
*addr)
 }
 #endif
 
-#define ioread16be(p) be16_to_cpu(ioread16(p))
-#define ioread32be(p) be32_to_cpu(ioread32(p))
-#define iowrite16be(v,p) iowrite16(cpu_to_be16(v), (p))
-#define iowrite32be(v,p) iowrite32(cpu_to_be32(v), (p))
+#define ioread16be(p) swab16(ioread16(p))
+#define ioread32be(p) swab32(ioread32(p))
+#define iowrite16be(v,p) iowrite16(swab16(v), (p))
+#define iowrite32be(v,p) iowrite32(swab32(v), (p))
 
 #define inb_p          inb
 #define inw_p          inw
diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index 85e4149cc5d5..d3c7ffa72902 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -156,6 +156,7 @@ zinstall install:
 PHONY += vdso_install
 vdso_install:
        $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso $@
+       $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso32 $@
 
 # We use MRPROPER_FILES and CLEAN_FILES now
 archclean:
diff --git a/arch/arm64/include/asm/kvm_host.h 
b/arch/arm64/include/asm/kvm_host.h
index 26fca93cd697..397e20a35975 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -440,7 +440,7 @@ int __kvm_arm_vcpu_set_events(struct kvm_vcpu *vcpu,
 
 #define KVM_ARCH_WANT_MMU_NOTIFIER
 int kvm_unmap_hva_range(struct kvm *kvm,
-                       unsigned long start, unsigned long end);
+                       unsigned long start, unsigned long end, unsigned flags);
 int kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
 int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end);
 int kvm_test_age_hva(struct kvm *kvm, unsigned long hva);
diff --git a/arch/arm64/kernel/vdso32/Makefile 
b/arch/arm64/kernel/vdso32/Makefile
index 0433bb58ce52..601c075f1f47 100644
--- a/arch/arm64/kernel/vdso32/Makefile
+++ b/arch/arm64/kernel/vdso32/Makefile
@@ -201,7 +201,7 @@ quiet_cmd_vdsosym = VDSOSYM $@
       cmd_vdsosym = $(NM) $< | $(gen-vdsosym) | LC_ALL=C sort > $@
 
 # Install commands for the unstripped file
-quiet_cmd_vdso_install = INSTALL $@
+quiet_cmd_vdso_install = INSTALL32 $@
       cmd_vdso_install = cp $(obj)/[email protected] $(MODLIB)/vdso/vdso32.so
 
 vdso.so: $(obj)/vdso.so.dbg
diff --git a/arch/m68k/include/asm/m53xxacr.h b/arch/m68k/include/asm/m53xxacr.h
index 9138a624c5c8..692f90e7fecc 100644
--- a/arch/m68k/include/asm/m53xxacr.h
+++ b/arch/m68k/include/asm/m53xxacr.h
@@ -89,9 +89,9 @@
  * coherency though in all cases. And for copyback caches we will need
  * to push cached data as well.
  */
-#define CACHE_INIT       CACR_CINVA
-#define CACHE_INVALIDATE  CACR_CINVA
-#define CACHE_INVALIDATED CACR_CINVA
+#define CACHE_INIT        (CACHE_MODE + CACR_CINVA - CACR_EC)
+#define CACHE_INVALIDATE  (CACHE_MODE + CACR_CINVA)
+#define CACHE_INVALIDATED (CACHE_MODE + CACR_CINVA)
 
 #define ACR0_MODE      ((CONFIG_RAMBASE & 0xff000000) + \
                         (0x000f0000) + \
diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h
index caa2b936125c..8861e9d4eb1f 100644
--- a/arch/mips/include/asm/kvm_host.h
+++ b/arch/mips/include/asm/kvm_host.h
@@ -939,7 +939,7 @@ enum kvm_mips_fault_result kvm_trap_emul_gva_fault(struct 
kvm_vcpu *vcpu,
 
 #define KVM_ARCH_WANT_MMU_NOTIFIER
 int kvm_unmap_hva_range(struct kvm *kvm,
-                       unsigned long start, unsigned long end);
+                       unsigned long start, unsigned long end, unsigned flags);
 int kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
 int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end);
 int kvm_test_age_hva(struct kvm *kvm, unsigned long hva);
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index 573509e0f2d4..3ace115740dd 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -497,7 +497,7 @@ static void __init mips_parse_crashkernel(void)
        if (ret != 0 || crash_size <= 0)
                return;
 
-       if (!memblock_find_in_range(crash_base, crash_base + crash_size, 
crash_size, 0)) {
+       if (!memblock_find_in_range(crash_base, crash_base + crash_size, 
crash_size, 1)) {
                pr_warn("Invalid memory region reserved for crash kernel\n");
                return;
        }
diff --git a/arch/mips/kvm/mmu.c b/arch/mips/kvm/mmu.c
index 7dad7a293eae..2514e51d908b 100644
--- a/arch/mips/kvm/mmu.c
+++ b/arch/mips/kvm/mmu.c
@@ -518,7 +518,8 @@ static int kvm_unmap_hva_handler(struct kvm *kvm, gfn_t 
gfn, gfn_t gfn_end,
        return 1;
 }
 
-int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long 
end)
+int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long 
end,
+                       unsigned flags)
 {
        handle_hva_to_gpa(kvm, start, end, &kvm_unmap_hva_handler, NULL);
 
diff --git a/arch/powerpc/include/asm/fixmap.h 
b/arch/powerpc/include/asm/fixmap.h
index 77ab25a19974..e808461e6532 100644
--- a/arch/powerpc/include/asm/fixmap.h
+++ b/arch/powerpc/include/asm/fixmap.h
@@ -52,7 +52,7 @@ enum fixed_addresses {
        FIX_HOLE,
        /* reserve the top 128K for early debugging purposes */
        FIX_EARLY_DEBUG_TOP = FIX_HOLE,
-       FIX_EARLY_DEBUG_BASE = FIX_EARLY_DEBUG_TOP+(ALIGN(SZ_128, 
PAGE_SIZE)/PAGE_SIZE)-1,
+       FIX_EARLY_DEBUG_BASE = FIX_EARLY_DEBUG_TOP+(ALIGN(SZ_128K, 
PAGE_SIZE)/PAGE_SIZE)-1,
 #ifdef CONFIG_HIGHMEM
        FIX_KMAP_BEGIN, /* reserved pte's for temporary kernel mappings */
        FIX_KMAP_END = FIX_KMAP_BEGIN+(KM_TYPE_NR*NR_CPUS)-1,
diff --git a/arch/powerpc/include/asm/kvm_host.h 
b/arch/powerpc/include/asm/kvm_host.h
index 1dc63101ffe1..b82e46ecd7fb 100644
--- a/arch/powerpc/include/asm/kvm_host.h
+++ b/arch/powerpc/include/asm/kvm_host.h
@@ -58,7 +58,8 @@
 #define KVM_ARCH_WANT_MMU_NOTIFIER
 
 extern int kvm_unmap_hva_range(struct kvm *kvm,
-                              unsigned long start, unsigned long end);
+                              unsigned long start, unsigned long end,
+                              unsigned flags);
 extern int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long 
end);
 extern int kvm_test_age_hva(struct kvm *kvm, unsigned long hva);
 extern int kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
diff --git a/arch/powerpc/kvm/book3s.c b/arch/powerpc/kvm/book3s.c
index 5690a1f9b976..13f107dff880 100644
--- a/arch/powerpc/kvm/book3s.c
+++ b/arch/powerpc/kvm/book3s.c
@@ -837,7 +837,8 @@ void kvmppc_core_commit_memory_region(struct kvm *kvm,
        kvm->arch.kvm_ops->commit_memory_region(kvm, mem, old, new, change);
 }
 
-int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long 
end)
+int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long 
end,
+                       unsigned flags)
 {
        return kvm->arch.kvm_ops->unmap_hva_range(kvm, start, end);
 }
diff --git a/arch/powerpc/kvm/e500_mmu_host.c b/arch/powerpc/kvm/e500_mmu_host.c
index df9989cf7ba3..9b402c345154 100644
--- a/arch/powerpc/kvm/e500_mmu_host.c
+++ b/arch/powerpc/kvm/e500_mmu_host.c
@@ -734,7 +734,8 @@ static int kvm_unmap_hva(struct kvm *kvm, unsigned long hva)
        return 0;
 }
 
-int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long 
end)
+int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long 
end,
+                       unsigned flags)
 {
        /* kvm_unmap_hva flushes everything anyways */
        kvm_unmap_hva(kvm, start);
diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c 
b/arch/powerpc/platforms/pseries/hotplug-cpu.c
index 6d4ee03d476a..ec04fc7f5a64 100644
--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
@@ -107,22 +107,28 @@ static int pseries_cpu_disable(void)
  */
 static void pseries_cpu_die(unsigned int cpu)
 {
-       int tries;
        int cpu_status = 1;
        unsigned int pcpu = get_hard_smp_processor_id(cpu);
+       unsigned long timeout = jiffies + msecs_to_jiffies(120000);
 
-       for (tries = 0; tries < 25; tries++) {
+       while (true) {
                cpu_status = smp_query_cpu_stopped(pcpu);
                if (cpu_status == QCSS_STOPPED ||
                    cpu_status == QCSS_HARDWARE_ERROR)
                        break;
-               cpu_relax();
 
+               if (time_after(jiffies, timeout)) {
+                       pr_warn("CPU %i (hwid %i) didn't die after 120 
seconds\n",
+                               cpu, pcpu);
+                       timeout = jiffies + msecs_to_jiffies(120000);
+               }
+
+               cond_resched();
        }
 
-       if (cpu_status != 0) {
-               printk("Querying DEAD? cpu %i (%i) shows %i\n",
-                      cpu, pcpu, cpu_status);
+       if (cpu_status == QCSS_HARDWARE_ERROR) {
+               pr_warn("CPU %i (hwid %i) reported error while dying\n",
+                       cpu, pcpu);
        }
 
        /* Isolation and deallocation are definitely done by
diff --git a/arch/powerpc/platforms/pseries/ras.c 
b/arch/powerpc/platforms/pseries/ras.c
index 16ba5c542e55..988e9b75ff64 100644
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -184,7 +184,6 @@ static void handle_system_shutdown(char event_modifier)
        case EPOW_SHUTDOWN_ON_UPS:
                pr_emerg("Loss of system power detected. System is running on"
                         " UPS/battery. Check RTAS error log for details\n");
-               orderly_poweroff(true);
                break;
 
        case EPOW_SHUTDOWN_LOSS_OF_CRITICAL_FUNCTIONS:
diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S
index 0339b6bbe11a..bf3f34dbe630 100644
--- a/arch/riscv/kernel/vmlinux.lds.S
+++ b/arch/riscv/kernel/vmlinux.lds.S
@@ -22,6 +22,7 @@ SECTIONS
        /* Beginning of code and text segment */
        . = LOAD_OFFSET;
        _start = .;
+       _stext = .;
        HEAD_TEXT_SECTION
        . = ALIGN(PAGE_SIZE);
 
@@ -49,7 +50,6 @@ SECTIONS
        . = ALIGN(SECTION_ALIGN);
        .text : {
                _text = .;
-               _stext = .;
                TEXT_TEXT
                SCHED_TEXT
                CPUIDLE_TEXT
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index e007224b65bb..a266ffed04df 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -1311,7 +1311,6 @@ static bool is_ri_cb_valid(struct runtime_instr_cb *cb)
                cb->pc == 1 &&
                cb->qc == 0 &&
                cb->reserved2 == 0 &&
-               cb->key == PAGE_DEFAULT_KEY &&
                cb->reserved3 == 0 &&
                cb->reserved4 == 0 &&
                cb->reserved5 == 0 &&
@@ -1375,7 +1374,11 @@ static int s390_runtime_instr_set(struct task_struct 
*target,
                kfree(data);
                return -EINVAL;
        }
-
+       /*
+        * Override access key in any case, since user space should
+        * not be able to set it, nor should it care about it.
+        */
+       ri_cb.key = PAGE_DEFAULT_KEY >> 4;
        preempt_disable();
        if (!target->thread.ri_cb)
                target->thread.ri_cb = data;
diff --git a/arch/s390/kernel/runtime_instr.c b/arch/s390/kernel/runtime_instr.c
index 125c7f6e8715..1788a5454b6f 100644
--- a/arch/s390/kernel/runtime_instr.c
+++ b/arch/s390/kernel/runtime_instr.c
@@ -57,7 +57,7 @@ static void init_runtime_instr_cb(struct runtime_instr_cb *cb)
        cb->k = 1;
        cb->ps = 1;
        cb->pc = 1;
-       cb->key = PAGE_DEFAULT_KEY;
+       cb->key = PAGE_DEFAULT_KEY >> 4;
        cb->v = 1;
 }
 
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 86e2e0272c57..d4c5d1d6c6f5 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1606,7 +1606,8 @@ asmlinkage void kvm_spurious_fault(void);
        _ASM_EXTABLE(666b, 667b)
 
 #define KVM_ARCH_WANT_MMU_NOTIFIER
-int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long 
end);
+int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long 
end,
+                       unsigned flags);
 int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end);
 int kvm_test_age_hva(struct kvm *kvm, unsigned long hva);
 int kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index 70cf2c1a1423..59d096cacb26 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -1972,7 +1972,8 @@ static int kvm_handle_hva(struct kvm *kvm, unsigned long 
hva,
        return kvm_handle_hva_range(kvm, hva, hva + 1, data, handler);
 }
 
-int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long 
end)
+int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long 
end,
+                       unsigned flags)
 {
        return kvm_handle_hva_range(kvm, start, end, 0, kvm_unmap_rmapp);
 }
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 51ccb4dfaad2..be195e63f1e6 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -956,7 +956,7 @@ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
 {
        unsigned long old_cr4 = kvm_read_cr4(vcpu);
        unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE |
-                                  X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE;
+                                  X86_CR4_SMEP;
 
        if (kvm_valid_cr4(vcpu, cr4))
                return 1;
diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
index 91220cc25854..5c11ae66b5d8 100644
--- a/arch/x86/pci/xen.c
+++ b/arch/x86/pci/xen.c
@@ -26,6 +26,7 @@
 #include <asm/xen/pci.h>
 #include <asm/xen/cpuid.h>
 #include <asm/apic.h>
+#include <asm/acpi.h>
 #include <asm/i8259.h>
 
 static int xen_pcifront_enable_irq(struct pci_dev *dev)
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index c5e393f8bb3f..3b0a84c88b7d 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -269,6 +269,8 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, 
unsigned num_pages)
        npages = (__end_rodata - __start_rodata) >> PAGE_SHIFT;
        rodata = __pa(__start_rodata);
        pfn = rodata >> PAGE_SHIFT;
+
+       pf = _PAGE_NX | _PAGE_ENC;
        if (kernel_map_pages_in_pgd(pgd, pfn, rodata, npages, pf)) {
                pr_err("Failed to map kernel rodata 1:1\n");
                return 1;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 4d3429b2058f..8c4d86032c7a 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -1572,6 +1572,7 @@ static void intel_pstate_get_cpu_pstates(struct cpudata 
*cpu)
 
                intel_pstate_get_hwp_max(cpu->cpu, &phy_max, &current_max);
                cpu->pstate.turbo_freq = phy_max * cpu->pstate.scaling;
+               cpu->pstate.turbo_pstate = phy_max;
        } else {
                cpu->pstate.turbo_freq = cpu->pstate.turbo_pstate * 
cpu->pstate.scaling;
        }
diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
index b3135b208f9a..0710b1a06927 100644
--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -1710,9 +1710,9 @@ static void i7core_mce_output_error(struct mem_ctl_info 
*mci,
        if (uncorrected_error) {
                core_err_cnt = 1;
                if (ripv)
-                       tp_event = HW_EVENT_ERR_FATAL;
-               else
                        tp_event = HW_EVENT_ERR_UNCORRECTED;
+               else
+                       tp_event = HW_EVENT_ERR_FATAL;
        } else {
                tp_event = HW_EVENT_ERR_CORRECTED;
        }
diff --git a/drivers/edac/pnd2_edac.c b/drivers/edac/pnd2_edac.c
index bc47328eb485..fdf214ab8ce4 100644
--- a/drivers/edac/pnd2_edac.c
+++ b/drivers/edac/pnd2_edac.c
@@ -1155,7 +1155,7 @@ static void pnd2_mce_output_error(struct mem_ctl_info 
*mci, const struct mce *m,
        u32 optypenum = GET_BITFIELD(m->status, 4, 6);
        int rc;
 
-       tp_event = uc_err ? (ripv ? HW_EVENT_ERR_FATAL : 
HW_EVENT_ERR_UNCORRECTED) :
+       tp_event = uc_err ? (ripv ? HW_EVENT_ERR_UNCORRECTED : 
HW_EVENT_ERR_FATAL) :
                                                 HW_EVENT_ERR_CORRECTED;
 
        /*
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index 7d51c82be62b..6ab863ab6d86 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -2982,9 +2982,9 @@ static void sbridge_mce_output_error(struct mem_ctl_info 
*mci,
        if (uncorrected_error) {
                core_err_cnt = 1;
                if (ripv) {
-                       tp_event = HW_EVENT_ERR_FATAL;
-               } else {
                        tp_event = HW_EVENT_ERR_UNCORRECTED;
+               } else {
+                       tp_event = HW_EVENT_ERR_FATAL;
                }
        } else {
                tp_event = HW_EVENT_ERR_CORRECTED;
diff --git a/drivers/edac/skx_common.c b/drivers/edac/skx_common.c
index 412c651bef26..dfeefacc90d6 100644
--- a/drivers/edac/skx_common.c
+++ b/drivers/edac/skx_common.c
@@ -494,9 +494,9 @@ static void skx_mce_output_error(struct mem_ctl_info *mci,
        if (uncorrected_error) {
                core_err_cnt = 1;
                if (ripv) {
-                       tp_event = HW_EVENT_ERR_FATAL;
-               } else {
                        tp_event = HW_EVENT_ERR_UNCORRECTED;
+               } else {
+                       tp_event = HW_EVENT_ERR_FATAL;
                }
        } else {
                tp_event = HW_EVENT_ERR_CORRECTED;
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 99446b384726..9a0b614e9907 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -381,6 +381,7 @@ static int __init efisubsys_init(void)
        efi_kobj = kobject_create_and_add("efi", firmware_kobj);
        if (!efi_kobj) {
                pr_err("efi: Firmware registration failed.\n");
+               destroy_workqueue(efi_rts_wq);
                return -ENOMEM;
        }
 
@@ -424,6 +425,7 @@ static int __init efisubsys_init(void)
                generic_ops_unregister();
 err_put:
        kobject_put(efi_kobj);
+       destroy_workqueue(efi_rts_wq);
        return error;
 }
 
diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c 
b/drivers/firmware/efi/libstub/efi-stub-helper.c
index 9f34c7242939..cac64fdfc3ae 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -73,10 +73,14 @@ void efi_printk(char *str)
  */
 efi_status_t efi_parse_options(char const *cmdline)
 {
-       size_t len = strlen(cmdline) + 1;
+       size_t len;
        efi_status_t status;
        char *str, *buf;
 
+       if (!cmdline)
+               return EFI_SUCCESS;
+
+       len = strlen(cmdline) + 1;
        status = efi_bs_call(allocate_pool, EFI_LOADER_DATA, len, (void 
**)&buf);
        if (status != EFI_SUCCESS)
                return status;
@@ -87,6 +91,8 @@ efi_status_t efi_parse_options(char const *cmdline)
                char *param, *val;
 
                str = next_arg(str, &param, &val);
+               if (!val && !strcmp(param, "--"))
+                       break;
 
                if (!strcmp(param, "nokaslr")) {
                        efi_nokaslr = true;
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c 
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 7cb4fe479614..debad3401591 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1983,6 +1983,7 @@ void amdgpu_dm_update_connector_after_detect(
 
                        drm_connector_update_edid_property(connector,
                                                           aconnector->edid);
+                       drm_add_edid_modes(connector, aconnector->edid);
 
                        if (aconnector->dc_link->aux_mode)
                                drm_dp_cec_set_edid(&aconnector->dm_dp_aux.aux,
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c 
b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 3f157bcc174b..92079e2fa515 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -3113,12 +3113,11 @@ void core_link_disable_stream(struct pipe_ctx *pipe_ctx)
                        dc_is_virtual_signal(pipe_ctx->stream->signal))
                return;
 
+       dc->hwss.blank_stream(pipe_ctx);
 #if defined(CONFIG_DRM_AMD_DC_HDCP)
        update_psp_stream_config(pipe_ctx, true);
 #endif
 
-       dc->hwss.blank_stream(pipe_ctx);
-
        if (pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
                deallocate_mst_payload(pipe_ctx);
 
@@ -3146,11 +3145,9 @@ void core_link_disable_stream(struct pipe_ctx *pipe_ctx)
                        write_i2c_redriver_setting(pipe_ctx, false);
                }
        }
-
-       disable_link(pipe_ctx->stream->link, pipe_ctx->stream->signal);
-
        dc->hwss.disable_stream(pipe_ctx);
 
+       disable_link(pipe_ctx->stream->link, pipe_ctx->stream->signal);
        if (pipe_ctx->stream->timing.flags.DSC) {
                if (dc_is_dp_signal(pipe_ctx->stream->signal))
                        dp_set_dsc_enable(pipe_ctx, false);
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c 
b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index 1ada01322cd2..caa090d0b6ac 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -1103,10 +1103,6 @@ static inline enum link_training_result 
perform_link_training_int(
        dpcd_pattern.v1_4.TRAINING_PATTERN_SET = 
DPCD_TRAINING_PATTERN_VIDEOIDLE;
        dpcd_set_training_pattern(link, dpcd_pattern);
 
-       /* delay 5ms after notifying sink of idle pattern before switching 
output */
-       if (link->connector_signal != SIGNAL_TYPE_EDP)
-               msleep(5);
-
        /* 4. mainlink output idle pattern*/
        dp_set_hw_test_pattern(link, DP_TEST_PATTERN_VIDEO_MODE, NULL, 0);
 
@@ -1556,12 +1552,6 @@ bool perform_link_training_with_retries(
        struct dc_link *link = stream->link;
        enum dp_panel_mode panel_mode = dp_get_panel_mode(link);
 
-       /* We need to do this before the link training to ensure the idle 
pattern in SST
-        * mode will be sent right after the link training
-        */
-       link->link_enc->funcs->connect_dig_be_to_fe(link->link_enc,
-                                                       
pipe_ctx->stream_res.stream_enc->id, true);
-
        for (j = 0; j < attempts; ++j) {
 
                dp_enable_link_phy(
@@ -1578,6 +1568,12 @@ bool perform_link_training_with_retries(
 
                dp_set_panel_mode(link, panel_mode);
 
+               /* We need to do this before the link training to ensure the 
idle pattern in SST
+                * mode will be sent right after the link training
+                */
+               link->link_enc->funcs->connect_dig_be_to_fe(link->link_enc,
+                                                               
pipe_ctx->stream_res.stream_enc->id, true);
+
                if (link->aux_access_disabled) {
                        dc_link_dp_perform_link_training_skip_aux(link, 
link_setting);
                        return true;
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c 
b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
index 24ca592c90df..10527593868c 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -1090,17 +1090,8 @@ void dce110_blank_stream(struct pipe_ctx *pipe_ctx)
                dc_link_set_abm_disable(link);
        }
 
-       if (dc_is_dp_signal(pipe_ctx->stream->signal)) {
+       if (dc_is_dp_signal(pipe_ctx->stream->signal))
                
pipe_ctx->stream_res.stream_enc->funcs->dp_blank(pipe_ctx->stream_res.stream_enc);
-
-               /*
-                * After output is idle pattern some sinks need time to 
recognize the stream
-                * has changed or they enter protection state and hang.
-                */
-               if (!dc_is_embedded_signal(pipe_ctx->stream->signal))
-                       msleep(60);
-       }
-
 }
 
 
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c 
b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
index c4fa13e4eaf9..ab93cecb78f6 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
@@ -1386,8 +1386,8 @@ static void dcn20_update_dchubp_dpp(
 
        /* Any updates are handled in dc interface, just need to apply existing 
for plane enable */
        if ((pipe_ctx->update_flags.bits.enable || 
pipe_ctx->update_flags.bits.opp_changed ||
-                       pipe_ctx->update_flags.bits.scaler || 
pipe_ctx->update_flags.bits.viewport)
-                       && 
pipe_ctx->stream->cursor_attributes.address.quad_part != 0) {
+                       pipe_ctx->update_flags.bits.scaler || viewport_changed 
== true) &&
+                       pipe_ctx->stream->cursor_attributes.address.quad_part 
!= 0) {
                dc->hwss.set_cursor_position(pipe_ctx);
                dc->hwss.set_cursor_attribute(pipe_ctx);
 
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c 
b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
index 2719cdecc1cb..d37ede03510f 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
@@ -3031,7 +3031,7 @@ static bool dcn20_validate_bandwidth_internal(struct dc 
*dc, struct dc_state *co
        int vlevel = 0;
        int pipe_split_from[MAX_PIPES];
        int pipe_cnt = 0;
-       display_e2e_pipe_params_st *pipes = kzalloc(dc->res_pool->pipe_count * 
sizeof(display_e2e_pipe_params_st), GFP_KERNEL);
+       display_e2e_pipe_params_st *pipes = kzalloc(dc->res_pool->pipe_count * 
sizeof(display_e2e_pipe_params_st), GFP_ATOMIC);
        DC_LOGGER_INIT(dc->ctx->logger);
 
        BW_VAL_TRACE_COUNT();
diff --git a/drivers/gpu/drm/amd/display/include/fixed31_32.h 
b/drivers/gpu/drm/amd/display/include/fixed31_32.h
index 89ef9f6860e5..16df2a485dd0 100644
--- a/drivers/gpu/drm/amd/display/include/fixed31_32.h
+++ b/drivers/gpu/drm/amd/display/include/fixed31_32.h
@@ -431,6 +431,9 @@ struct fixed31_32 dc_fixpt_log(struct fixed31_32 arg);
  */
 static inline struct fixed31_32 dc_fixpt_pow(struct fixed31_32 arg1, struct 
fixed31_32 arg2)
 {
+       if (arg1.value == 0)
+               return arg2.value == 0 ? dc_fixpt_one : dc_fixpt_zero;
+
        return dc_fixpt_exp(
                dc_fixpt_mul(
                        dc_fixpt_log(arg1),
diff --git a/drivers/gpu/drm/panel/panel-simple.c 
b/drivers/gpu/drm/panel/panel-simple.c
index 346e3f9fd505..a68eff1fb429 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -1537,7 +1537,7 @@ static const struct drm_display_mode 
frida_frd350h54004_mode = {
        .vsync_end = 240 + 2 + 6,
        .vtotal = 240 + 2 + 6 + 2,
        .vrefresh = 60,
-       .flags = DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC,
+       .flags = DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC,
 };
 
 static const struct panel_desc frida_frd350h54004 = {
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index 72100b84c7a9..b08fdfa4291b 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -505,8 +505,10 @@ static int ttm_bo_vm_access_kmap(struct ttm_buffer_object 
*bo,
 int ttm_bo_vm_access(struct vm_area_struct *vma, unsigned long addr,
                     void *buf, int len, int write)
 {
-       unsigned long offset = (addr) - vma->vm_start;
        struct ttm_buffer_object *bo = vma->vm_private_data;
+       unsigned long offset = (addr) - vma->vm_start +
+               ((vma->vm_pgoff - drm_vma_node_start(&bo->base.vma_node))
+                << PAGE_SHIFT);
        int ret;
 
        if (len < 1 || (offset + len) >> PAGE_SHIFT > bo->num_pages)
diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c
index 909eba43664a..204d1df5a21d 100644
--- a/drivers/gpu/drm/vgem/vgem_drv.c
+++ b/drivers/gpu/drm/vgem/vgem_drv.c
@@ -229,32 +229,6 @@ static int vgem_gem_dumb_create(struct drm_file *file, 
struct drm_device *dev,
        return 0;
 }
 
-static int vgem_gem_dumb_map(struct drm_file *file, struct drm_device *dev,
-                            uint32_t handle, uint64_t *offset)
-{
-       struct drm_gem_object *obj;
-       int ret;
-
-       obj = drm_gem_object_lookup(file, handle);
-       if (!obj)
-               return -ENOENT;
-
-       if (!obj->filp) {
-               ret = -EINVAL;
-               goto unref;
-       }
-
-       ret = drm_gem_create_mmap_offset(obj);
-       if (ret)
-               goto unref;
-
-       *offset = drm_vma_node_offset_addr(&obj->vma_node);
-unref:
-       drm_gem_object_put_unlocked(obj);
-
-       return ret;
-}
-
 static struct drm_ioctl_desc vgem_ioctls[] = {
        DRM_IOCTL_DEF_DRV(VGEM_FENCE_ATTACH, vgem_fence_attach_ioctl, 
DRM_RENDER_ALLOW),
        DRM_IOCTL_DEF_DRV(VGEM_FENCE_SIGNAL, vgem_fence_signal_ioctl, 
DRM_RENDER_ALLOW),
@@ -448,7 +422,6 @@ static struct drm_driver vgem_driver = {
        .fops                           = &vgem_driver_fops,
 
        .dumb_create                    = vgem_gem_dumb_create,
-       .dumb_map_offset                = vgem_gem_dumb_map,
 
        .prime_handle_to_fd = drm_gem_prime_handle_to_fd,
        .prime_fd_to_handle = drm_gem_prime_fd_to_handle,
diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c 
b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
index 512daff92038..1fc3fa00685d 100644
--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
@@ -180,6 +180,7 @@ static int virtio_gpu_execbuffer_ioctl(struct drm_device 
*dev, void *data,
 
        virtio_gpu_cmd_submit(vgdev, buf, exbuf->size,
                              vfpriv->ctx_id, buflist, out_fence);
+       dma_fence_put(&out_fence->f);
        virtio_gpu_notify(vgdev);
        return 0;
 
diff --git a/drivers/infiniband/hw/bnxt_re/main.c 
b/drivers/infiniband/hw/bnxt_re/main.c
index b12fbc857f94..5c41e13496a0 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -811,7 +811,8 @@ static int bnxt_re_handle_qp_async_event(struct 
creq_qp_event *qp_event,
        struct ib_event event;
        unsigned int flags;
 
-       if (qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_ERR) {
+       if (qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_ERR &&
+           rdma_is_kernel_res(&qp->ib_qp.res)) {
                flags = bnxt_re_lock_cqs(qp);
                bnxt_qplib_add_flush_qp(&qp->qplib_qp);
                bnxt_re_unlock_cqs(qp, flags);
diff --git a/drivers/infiniband/hw/hfi1/tid_rdma.c 
b/drivers/infiniband/hw/hfi1/tid_rdma.c
index 7c6fd720fb2e..c018fc633cca 100644
--- a/drivers/infiniband/hw/hfi1/tid_rdma.c
+++ b/drivers/infiniband/hw/hfi1/tid_rdma.c
@@ -3215,6 +3215,7 @@ bool hfi1_tid_rdma_wqe_interlock(struct rvt_qp *qp, 
struct rvt_swqe *wqe)
        case IB_WR_ATOMIC_CMP_AND_SWP:
        case IB_WR_ATOMIC_FETCH_AND_ADD:
        case IB_WR_RDMA_WRITE:
+       case IB_WR_RDMA_WRITE_WITH_IMM:
                switch (prev->wr.opcode) {
                case IB_WR_TID_RDMA_WRITE:
                        req = wqe_to_tid_req(prev);
diff --git a/drivers/input/mouse/psmouse-base.c 
b/drivers/input/mouse/psmouse-base.c
index 527ae0b9a191..0b4a3039f312 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -2042,7 +2042,7 @@ static int psmouse_get_maxproto(char *buffer, const 
struct kernel_param *kp)
 {
        int type = *((unsigned int *)kp->arg);
 
-       return sprintf(buffer, "%s", psmouse_protocol_by_type(type)->name);
+       return sprintf(buffer, "%s\n", psmouse_protocol_by_type(type)->name);
 }
 
 static int __init psmouse_init(void)
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index b4d23d9f30f9..d5477faa14ed 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -825,19 +825,19 @@ static int bcache_device_init(struct bcache_device *d, 
unsigned int block_size,
        struct request_queue *q;
        const size_t max_stripes = min_t(size_t, INT_MAX,
                                         SIZE_MAX / sizeof(atomic_t));
-       size_t n;
+       uint64_t n;
        int idx;
 
        if (!d->stripe_size)
                d->stripe_size = 1 << 31;
 
-       d->nr_stripes = DIV_ROUND_UP_ULL(sectors, d->stripe_size);
-
-       if (!d->nr_stripes || d->nr_stripes > max_stripes) {
-               pr_err("nr_stripes too large or invalid: %u (start sector 
beyond end of disk?)",
-                       (unsigned int)d->nr_stripes);
+       n = DIV_ROUND_UP_ULL(sectors, d->stripe_size);
+       if (!n || n > max_stripes) {
+               pr_err("nr_stripes too large or invalid: %llu (start sector 
beyond end of disk?)\n",
+                       n);
                return -ENOMEM;
        }
+       d->nr_stripes = n;
 
        n = d->nr_stripes * sizeof(atomic_t);
        d->stripe_sectors_dirty = kvzalloc(n, GFP_KERNEL);
diff --git a/drivers/media/pci/ttpci/budget-core.c 
b/drivers/media/pci/ttpci/budget-core.c
index fadbdeeb4495..293867b9e796 100644
--- a/drivers/media/pci/ttpci/budget-core.c
+++ b/drivers/media/pci/ttpci/budget-core.c
@@ -369,20 +369,25 @@ static int budget_register(struct budget *budget)
        ret = dvbdemux->dmx.add_frontend(&dvbdemux->dmx, &budget->hw_frontend);
 
        if (ret < 0)
-               return ret;
+               goto err_release_dmx;
 
        budget->mem_frontend.source = DMX_MEMORY_FE;
        ret = dvbdemux->dmx.add_frontend(&dvbdemux->dmx, &budget->mem_frontend);
        if (ret < 0)
-               return ret;
+               goto err_release_dmx;
 
        ret = dvbdemux->dmx.connect_frontend(&dvbdemux->dmx, 
&budget->hw_frontend);
        if (ret < 0)
-               return ret;
+               goto err_release_dmx;
 
        dvb_net_init(&budget->dvb_adapter, &budget->dvb_net, &dvbdemux->dmx);
 
        return 0;
+
+err_release_dmx:
+       dvb_dmxdev_release(&budget->dmxdev);
+       dvb_dmx_release(&budget->demux);
+       return ret;
 }
 
 static void budget_unregister(struct budget *budget)
diff --git a/drivers/media/platform/davinci/vpss.c 
b/drivers/media/platform/davinci/vpss.c
index d38d2bbb6f0f..7000f0bf0b35 100644
--- a/drivers/media/platform/davinci/vpss.c
+++ b/drivers/media/platform/davinci/vpss.c
@@ -505,19 +505,31 @@ static void vpss_exit(void)
 
 static int __init vpss_init(void)
 {
+       int ret;
+
        if (!request_mem_region(VPSS_CLK_CTRL, 4, "vpss_clock_control"))
                return -EBUSY;
 
        oper_cfg.vpss_regs_base2 = ioremap(VPSS_CLK_CTRL, 4);
        if (unlikely(!oper_cfg.vpss_regs_base2)) {
-               release_mem_region(VPSS_CLK_CTRL, 4);
-               return -ENOMEM;
+               ret = -ENOMEM;
+               goto err_ioremap;
        }
 
        writel(VPSS_CLK_CTRL_VENCCLKEN |
-                    VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2);
+              VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2);
+
+       ret = platform_driver_register(&vpss_driver);
+       if (ret)
+               goto err_pd_register;
+
+       return 0;
 
-       return platform_driver_register(&vpss_driver);
+err_pd_register:
+       iounmap(oper_cfg.vpss_regs_base2);
+err_ioremap:
+       release_mem_region(VPSS_CLK_CTRL, 4);
+       return ret;
 }
 subsys_initcall(vpss_init);
 module_exit(vpss_exit);
diff --git a/drivers/media/platform/qcom/camss/camss.c 
b/drivers/media/platform/qcom/camss/camss.c
index 3fdc9f964a3c..2483641799df 100644
--- a/drivers/media/platform/qcom/camss/camss.c
+++ b/drivers/media/platform/qcom/camss/camss.c
@@ -504,7 +504,6 @@ static int camss_of_parse_ports(struct camss *camss)
        return num_subdevs;
 
 err_cleanup:
-       v4l2_async_notifier_cleanup(&camss->notifier);
        of_node_put(node);
        return ret;
 }
@@ -835,29 +834,38 @@ static int camss_probe(struct platform_device *pdev)
                camss->csid_num = 4;
                camss->vfe_num = 2;
        } else {
-               return -EINVAL;
+               ret = -EINVAL;
+               goto err_free;
        }
 
        camss->csiphy = devm_kcalloc(dev, camss->csiphy_num,
                                     sizeof(*camss->csiphy), GFP_KERNEL);
-       if (!camss->csiphy)
-               return -ENOMEM;
+       if (!camss->csiphy) {
+               ret = -ENOMEM;
+               goto err_free;
+       }
 
        camss->csid = devm_kcalloc(dev, camss->csid_num, sizeof(*camss->csid),
                                   GFP_KERNEL);
-       if (!camss->csid)
-               return -ENOMEM;
+       if (!camss->csid) {
+               ret = -ENOMEM;
+               goto err_free;
+       }
 
        camss->vfe = devm_kcalloc(dev, camss->vfe_num, sizeof(*camss->vfe),
                                  GFP_KERNEL);
-       if (!camss->vfe)
-               return -ENOMEM;
+       if (!camss->vfe) {
+               ret = -ENOMEM;
+               goto err_free;
+       }
 
        v4l2_async_notifier_init(&camss->notifier);
 
        num_subdevs = camss_of_parse_ports(camss);
-       if (num_subdevs < 0)
-               return num_subdevs;
+       if (num_subdevs < 0) {
+               ret = num_subdevs;
+               goto err_cleanup;
+       }
 
        ret = camss_init_subdevices(camss);
        if (ret < 0)
@@ -936,6 +944,8 @@ static int camss_probe(struct platform_device *pdev)
        v4l2_device_unregister(&camss->v4l2_dev);
 err_cleanup:
        v4l2_async_notifier_cleanup(&camss->notifier);
+err_free:
+       kfree(camss);
 
        return ret;
 }
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 6b40b5ab143a..07624e89b96d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2084,7 +2084,8 @@ static int bond_release_and_destroy(struct net_device 
*bond_dev,
        int ret;
 
        ret = __bond_release_one(bond_dev, slave_dev, false, true);
-       if (ret == 0 && !bond_has_slaves(bond)) {
+       if (ret == 0 && !bond_has_slaves(bond) &&
+           bond_dev->reg_state != NETREG_UNREGISTERING) {
                bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
                netdev_info(bond_dev, "Destroying bond\n");
                bond_remove_proc_entry(bond);
@@ -2824,6 +2825,9 @@ static int bond_ab_arp_inspect(struct bonding *bond)
                        if (bond_time_in_interval(bond, last_rx, 1)) {
                                bond_propose_link_state(slave, BOND_LINK_UP);
                                commit++;
+                       } else if (slave->link == BOND_LINK_BACK) {
+                               bond_propose_link_state(slave, BOND_LINK_FAIL);
+                               commit++;
                        }
                        continue;
                }
@@ -2932,6 +2936,19 @@ static void bond_ab_arp_commit(struct bonding *bond)
 
                        continue;
 
+               case BOND_LINK_FAIL:
+                       bond_set_slave_link_state(slave, BOND_LINK_FAIL,
+                                                 BOND_SLAVE_NOTIFY_NOW);
+                       bond_set_slave_inactive_flags(slave,
+                                                     BOND_SLAVE_NOTIFY_NOW);
+
+                       /* A slave has just been enslaved and has become
+                        * the current active slave.
+                        */
+                       if (rtnl_dereference(bond->curr_active_slave))
+                               RCU_INIT_POINTER(bond->current_arp_slave, NULL);
+                       continue;
+
                default:
                        slave_err(bond->dev, slave->dev,
                                  "impossible: link_new_state %d on slave\n",
@@ -2982,8 +2999,6 @@ static bool bond_ab_arp_probe(struct bonding *bond)
                        return should_notify_rtnl;
        }
 
-       bond_set_slave_inactive_flags(curr_arp_slave, BOND_SLAVE_NOTIFY_LATER);
-
        bond_for_each_slave_rcu(bond, slave, iter) {
                if (!found && !before && bond_slave_is_up(slave))
                        before = slave;
@@ -4336,13 +4351,23 @@ static netdev_tx_t bond_start_xmit(struct sk_buff *skb, 
struct net_device *dev)
        return ret;
 }
 
+static u32 bond_mode_bcast_speed(struct slave *slave, u32 speed)
+{
+       if (speed == 0 || speed == SPEED_UNKNOWN)
+               speed = slave->speed;
+       else
+               speed = min(speed, slave->speed);
+
+       return speed;
+}
+
 static int bond_ethtool_get_link_ksettings(struct net_device *bond_dev,
                                           struct ethtool_link_ksettings *cmd)
 {
        struct bonding *bond = netdev_priv(bond_dev);
-       unsigned long speed = 0;
        struct list_head *iter;
        struct slave *slave;
+       u32 speed = 0;
 
        cmd->base.duplex = DUPLEX_UNKNOWN;
        cmd->base.port = PORT_OTHER;
@@ -4354,8 +4379,13 @@ static int bond_ethtool_get_link_ksettings(struct 
net_device *bond_dev,
         */
        bond_for_each_slave(bond, slave, iter) {
                if (bond_slave_can_tx(slave)) {
-                       if (slave->speed != SPEED_UNKNOWN)
-                               speed += slave->speed;
+                       if (slave->speed != SPEED_UNKNOWN) {
+                               if (BOND_MODE(bond) == BOND_MODE_BROADCAST)
+                                       speed = bond_mode_bcast_speed(slave,
+                                                                     speed);
+                               else
+                                       speed += slave->speed;
+                       }
                        if (cmd->base.duplex == DUPLEX_UNKNOWN &&
                            slave->duplex != DUPLEX_UNKNOWN)
                                cmd->base.duplex = slave->duplex;
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index c283593bef17..dc1979096302 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1556,6 +1556,8 @@ static int b53_arl_op(struct b53_device *dev, int op, int 
port,
                return ret;
 
        switch (ret) {
+       case -ETIMEDOUT:
+               return ret;
        case -ENOSPC:
                dev_dbg(dev->dev, "{%pM,%.4d} no space left in ARL\n",
                        addr, vid);
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c 
b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index 15ce93be05ea..c501a4edc34d 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -2166,13 +2166,10 @@ static void ena_del_napi_in_range(struct ena_adapter 
*adapter,
        int i;
 
        for (i = first_index; i < first_index + count; i++) {
-               /* Check if napi was initialized before */
-               if (!ENA_IS_XDP_INDEX(adapter, i) ||
-                   adapter->ena_napi[i].xdp_ring)
-                       netif_napi_del(&adapter->ena_napi[i].napi);
-               else
-                       WARN_ON(ENA_IS_XDP_INDEX(adapter, i) &&
-                               adapter->ena_napi[i].xdp_ring);
+               netif_napi_del(&adapter->ena_napi[i].napi);
+
+               WARN_ON(!ENA_IS_XDP_INDEX(adapter, i) &&
+                       adapter->ena_napi[i].xdp_ring);
        }
 }
 
@@ -3508,16 +3505,14 @@ static void ena_fw_reset_device(struct work_struct 
*work)
 {
        struct ena_adapter *adapter =
                container_of(work, struct ena_adapter, reset_task);
-       struct pci_dev *pdev = adapter->pdev;
 
-       if (unlikely(!test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags))) {
-               dev_err(&pdev->dev,
-                       "device reset schedule while reset bit is off\n");
-               return;
-       }
        rtnl_lock();
-       ena_destroy_device(adapter, false);
-       ena_restore_device(adapter);
+
+       if (likely(test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags))) {
+               ena_destroy_device(adapter, false);
+               ena_restore_device(adapter);
+       }
+
        rtnl_unlock();
 }
 
@@ -4351,8 +4346,11 @@ static void __ena_shutoff(struct pci_dev *pdev, bool 
shutdown)
                netdev->rx_cpu_rmap = NULL;
        }
 #endif /* CONFIG_RFS_ACCEL */
-       del_timer_sync(&adapter->timer_service);
 
+       /* Make sure timer and reset routine won't be called after
+        * freeing device resources.
+        */
+       del_timer_sync(&adapter->timer_service);
        cancel_work_sync(&adapter->reset_task);
 
        rtnl_lock(); /* lock released inside the below if-else block */
diff --git a/drivers/net/ethernet/cortina/gemini.c 
b/drivers/net/ethernet/cortina/gemini.c
index 5359fb40578d..e641890e9702 100644
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -2388,7 +2388,7 @@ static int gemini_ethernet_port_probe(struct 
platform_device *pdev)
 
        dev_info(dev, "probe %s ID %d\n", dev_name(dev), id);
 
-       netdev = alloc_etherdev_mq(sizeof(*port), TX_QUEUE_NUM);
+       netdev = devm_alloc_etherdev_mqs(dev, sizeof(*port), TX_QUEUE_NUM, 
TX_QUEUE_NUM);
        if (!netdev) {
                dev_err(dev, "Can't allocate ethernet device #%d\n", id);
                return -ENOMEM;
@@ -2520,7 +2520,6 @@ static int gemini_ethernet_port_probe(struct 
platform_device *pdev)
        }
 
        port->netdev = NULL;
-       free_netdev(netdev);
        return ret;
 }
 
@@ -2529,7 +2528,6 @@ static int gemini_ethernet_port_remove(struct 
platform_device *pdev)
        struct gemini_ethernet_port *port = platform_get_drvdata(pdev);
 
        gemini_port_remove(port);
-       free_netdev(port->netdev);
        return 0;
 }
 
diff --git a/drivers/net/ethernet/freescale/fec_main.c 
b/drivers/net/ethernet/freescale/fec_main.c
index bf73bc9bf35b..76abafd099e2 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3719,11 +3719,11 @@ fec_probe(struct platform_device *pdev)
 failed_irq:
 failed_init:
        fec_ptp_stop(pdev);
-       if (fep->reg_phy)
-               regulator_disable(fep->reg_phy);
 failed_reset:
        pm_runtime_put_noidle(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
+       if (fep->reg_phy)
+               regulator_disable(fep->reg_phy);
 failed_regulator:
        clk_disable_unprepare(fep->clk_ahb);
 failed_clk_ahb:
diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h 
b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h
index aa5f1c0aa721..0921785a1079 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h
@@ -1211,7 +1211,7 @@ struct i40e_aqc_set_vsi_promiscuous_modes {
 #define I40E_AQC_SET_VSI_PROMISC_BROADCAST     0x04
 #define I40E_AQC_SET_VSI_DEFAULT               0x08
 #define I40E_AQC_SET_VSI_PROMISC_VLAN          0x10
-#define I40E_AQC_SET_VSI_PROMISC_TX            0x8000
+#define I40E_AQC_SET_VSI_PROMISC_RX_ONLY       0x8000
        __le16  seid;
 #define I40E_AQC_VSI_PROM_CMD_SEID_MASK                0x3FF
        __le16  vlan_tag;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c 
b/drivers/net/ethernet/intel/i40e/i40e_common.c
index 45b90eb11adb..21e44c6cd5ea 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
@@ -1969,6 +1969,21 @@ i40e_status i40e_aq_set_phy_debug(struct i40e_hw *hw, u8 
cmd_flags,
        return status;
 }
 
+/**
+ * i40e_is_aq_api_ver_ge
+ * @aq: pointer to AdminQ info containing HW API version to compare
+ * @maj: API major value
+ * @min: API minor value
+ *
+ * Assert whether current HW API version is greater/equal than provided.
+ **/
+static bool i40e_is_aq_api_ver_ge(struct i40e_adminq_info *aq, u16 maj,
+                                 u16 min)
+{
+       return (aq->api_maj_ver > maj ||
+               (aq->api_maj_ver == maj && aq->api_min_ver >= min));
+}
+
 /**
  * i40e_aq_add_vsi
  * @hw: pointer to the hw struct
@@ -2094,18 +2109,16 @@ i40e_status i40e_aq_set_vsi_unicast_promiscuous(struct 
i40e_hw *hw,
 
        if (set) {
                flags |= I40E_AQC_SET_VSI_PROMISC_UNICAST;
-               if (rx_only_promisc &&
-                   (((hw->aq.api_maj_ver == 1) && (hw->aq.api_min_ver >= 5)) ||
-                    (hw->aq.api_maj_ver > 1)))
-                       flags |= I40E_AQC_SET_VSI_PROMISC_TX;
+               if (rx_only_promisc && i40e_is_aq_api_ver_ge(&hw->aq, 1, 5))
+                       flags |= I40E_AQC_SET_VSI_PROMISC_RX_ONLY;
        }
 
        cmd->promiscuous_flags = cpu_to_le16(flags);
 
        cmd->valid_flags = cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_UNICAST);
-       if (((hw->aq.api_maj_ver >= 1) && (hw->aq.api_min_ver >= 5)) ||
-           (hw->aq.api_maj_ver > 1))
-               cmd->valid_flags |= cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_TX);
+       if (i40e_is_aq_api_ver_ge(&hw->aq, 1, 5))
+               cmd->valid_flags |=
+                       cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_RX_ONLY);
 
        cmd->seid = cpu_to_le16(seid);
        status = i40e_asq_send_command(hw, &desc, NULL, 0, cmd_details);
@@ -2202,11 +2215,17 @@ enum i40e_status_code 
i40e_aq_set_vsi_uc_promisc_on_vlan(struct i40e_hw *hw,
        i40e_fill_default_direct_cmd_desc(&desc,
                                          
i40e_aqc_opc_set_vsi_promiscuous_modes);
 
-       if (enable)
+       if (enable) {
                flags |= I40E_AQC_SET_VSI_PROMISC_UNICAST;
+               if (i40e_is_aq_api_ver_ge(&hw->aq, 1, 5))
+                       flags |= I40E_AQC_SET_VSI_PROMISC_RX_ONLY;
+       }
 
        cmd->promiscuous_flags = cpu_to_le16(flags);
        cmd->valid_flags = cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_UNICAST);
+       if (i40e_is_aq_api_ver_ge(&hw->aq, 1, 5))
+               cmd->valid_flags |=
+                       cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_RX_ONLY);
        cmd->seid = cpu_to_le16(seid);
        cmd->vlan_tag = cpu_to_le16(vid | I40E_AQC_SET_VSI_VLAN_VALID);
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c 
b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 80dc5fcb82db..deb2d77ef975 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -15344,6 +15344,9 @@ static void i40e_remove(struct pci_dev *pdev)
        i40e_write_rx_ctl(hw, I40E_PFQF_HENA(0), 0);
        i40e_write_rx_ctl(hw, I40E_PFQF_HENA(1), 0);
 
+       while (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state))
+               usleep_range(1000, 2000);
+
        /* no more scheduling of any task */
        set_bit(__I40E_SUSPENDED, pf->state);
        set_bit(__I40E_DOWN, pf->state);
diff --git a/drivers/net/ethernet/intel/igc/igc_main.c 
b/drivers/net/ethernet/intel/igc/igc_main.c
index c7020ff2f490..2ec89c99b644 100644
--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
@@ -4801,6 +4801,8 @@ static int igc_probe(struct pci_dev *pdev,
        device_set_wakeup_enable(&adapter->pdev->dev,
                                 adapter->flags & IGC_FLAG_WOL_SUPPORTED);
 
+       igc_ptp_init(adapter);
+
        /* reset the hardware with the new settings */
        igc_reset(adapter);
 
@@ -4817,9 +4819,6 @@ static int igc_probe(struct pci_dev *pdev,
         /* carrier off reporting is important to ethtool even BEFORE open */
        netif_carrier_off(netdev);
 
-       /* do hw tstamp init after resetting */
-       igc_ptp_init(adapter);
-
        /* Check if Media Autosense is enabled */
        adapter->ei = *ei;
 
diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c 
b/drivers/net/ethernet/intel/igc/igc_ptp.c
index f99c514ad0f4..4f67bdd1948b 100644
--- a/drivers/net/ethernet/intel/igc/igc_ptp.c
+++ b/drivers/net/ethernet/intel/igc/igc_ptp.c
@@ -620,8 +620,6 @@ void igc_ptp_init(struct igc_adapter *adapter)
        adapter->tstamp_config.rx_filter = HWTSTAMP_FILTER_NONE;
        adapter->tstamp_config.tx_type = HWTSTAMP_TX_OFF;
 
-       igc_ptp_reset(adapter);
-
        adapter->ptp_clock = ptp_clock_register(&adapter->ptp_caps,
                                                &adapter->pdev->dev);
        if (IS_ERR(adapter->ptp_clock)) {
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index b8b7fc13b3dc..016fec19063a 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -502,7 +502,7 @@ static int netvsc_vf_xmit(struct net_device *net, struct 
net_device *vf_netdev,
        int rc;
 
        skb->dev = vf_netdev;
-       skb->queue_mapping = qdisc_skb_cb(skb)->slave_dev_queue_mapping;
+       skb_record_rx_queue(skb, qdisc_skb_cb(skb)->slave_dev_queue_mapping);
 
        rc = dev_queue_xmit(skb);
        if (likely(rc == NET_XMIT_SUCCESS || rc == NET_XMIT_CN)) {
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index f195f278a83a..7768f1120c1f 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -106,12 +106,21 @@ static void ipvlan_port_destroy(struct net_device *dev)
        kfree(port);
 }
 
+#define IPVLAN_ALWAYS_ON_OFLOADS \
+       (NETIF_F_SG | NETIF_F_HW_CSUM | \
+        NETIF_F_GSO_ROBUST | NETIF_F_GSO_SOFTWARE | NETIF_F_GSO_ENCAP_ALL)
+
+#define IPVLAN_ALWAYS_ON \
+       (IPVLAN_ALWAYS_ON_OFLOADS | NETIF_F_LLTX | NETIF_F_VLAN_CHALLENGED)
+
 #define IPVLAN_FEATURES \
-       (NETIF_F_SG | NETIF_F_CSUM_MASK | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
+       (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
         NETIF_F_GSO | NETIF_F_ALL_TSO | NETIF_F_GSO_ROBUST | \
         NETIF_F_GRO | NETIF_F_RXCSUM | \
         NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_HW_VLAN_STAG_FILTER)
 
+       /* NETIF_F_GSO_ENCAP_ALL NETIF_F_GSO_SOFTWARE Newly added */
+
 #define IPVLAN_STATE_MASK \
        ((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT))
 
@@ -125,7 +134,9 @@ static int ipvlan_init(struct net_device *dev)
        dev->state = (dev->state & ~IPVLAN_STATE_MASK) |
                     (phy_dev->state & IPVLAN_STATE_MASK);
        dev->features = phy_dev->features & IPVLAN_FEATURES;
-       dev->features |= NETIF_F_LLTX | NETIF_F_VLAN_CHALLENGED;
+       dev->features |= IPVLAN_ALWAYS_ON;
+       dev->vlan_features = phy_dev->vlan_features & IPVLAN_FEATURES;
+       dev->vlan_features |= IPVLAN_ALWAYS_ON_OFLOADS;
        dev->hw_enc_features |= dev->features;
        dev->gso_max_size = phy_dev->gso_max_size;
        dev->gso_max_segs = phy_dev->gso_max_segs;
@@ -225,7 +236,14 @@ static netdev_features_t ipvlan_fix_features(struct 
net_device *dev,
 {
        struct ipvl_dev *ipvlan = netdev_priv(dev);
 
-       return features & (ipvlan->sfeatures | ~IPVLAN_FEATURES);
+       features |= NETIF_F_ALL_FOR_ALL;
+       features &= (ipvlan->sfeatures | ~IPVLAN_FEATURES);
+       features = netdev_increment_features(ipvlan->phy_dev->features,
+                                            features, features);
+       features |= IPVLAN_ALWAYS_ON;
+       features &= (IPVLAN_FEATURES | IPVLAN_ALWAYS_ON);
+
+       return features;
 }
 
 static void ipvlan_change_rx_flags(struct net_device *dev, int change)
@@ -732,10 +750,9 @@ static int ipvlan_device_event(struct notifier_block 
*unused,
 
        case NETDEV_FEAT_CHANGE:
                list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
-                       ipvlan->dev->features = dev->features & IPVLAN_FEATURES;
                        ipvlan->dev->gso_max_size = dev->gso_max_size;
                        ipvlan->dev->gso_max_segs = dev->gso_max_segs;
-                       netdev_features_change(ipvlan->dev);
+                       netdev_update_features(ipvlan->dev);
                }
                break;
 
diff --git a/drivers/of/address.c b/drivers/of/address.c
index 8eea3f6e29a4..340d3051b1ce 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -980,6 +980,11 @@ int of_dma_get_range(struct device_node *np, u64 
*dma_addr, u64 *paddr, u64 *siz
                        /* Don't error out as we'd break some existing DTs */
                        continue;
                }
+               if (range.cpu_addr == OF_BAD_ADDR) {
+                       pr_err("translation of DMA address(%llx) to CPU address 
failed node(%pOF)\n",
+                              range.bus_addr, node);
+                       continue;
+               }
                dma_offset = range.cpu_addr - range.bus_addr;
 
                /* Take lower and upper limits */
diff --git a/drivers/opp/core.c b/drivers/opp/core.c
index e4f01e7771a2..a55d083e5be2 100644
--- a/drivers/opp/core.c
+++ b/drivers/opp/core.c
@@ -817,15 +817,23 @@ int dev_pm_opp_set_rate(struct device *dev, unsigned long 
target_freq)
        }
 
        if (unlikely(!target_freq)) {
-               if (opp_table->required_opp_tables) {
-                       ret = _set_required_opps(dev, opp_table, NULL);
-               } else if (!_get_opp_count(opp_table)) {
-                       return 0;
-               } else {
+               /*
+                * Some drivers need to support cases where some platforms may
+                * have OPP table for the device, while others don't and
+                * opp_set_rate() just needs to behave like clk_set_rate().
+                */
+               if (!_get_opp_count(opp_table)) {
+                       ret = 0;
+                       goto put_opp_table;
+               }
+
+               if (!opp_table->required_opp_tables) {
                        dev_err(dev, "target frequency can't be 0\n");
                        ret = -EINVAL;
+                       goto put_opp_table;
                }
 
+               ret = _set_required_opps(dev, opp_table, NULL);
                goto put_opp_table;
        }
 
@@ -845,10 +853,12 @@ int dev_pm_opp_set_rate(struct device *dev, unsigned long 
target_freq)
 
        /* Return early if nothing to do */
        if (old_freq == freq) {
-               dev_dbg(dev, "%s: old/new frequencies (%lu Hz) are same, 
nothing to do\n",
-                       __func__, freq);
-               ret = 0;
-               goto put_opp_table;
+               if (!opp_table->required_opp_tables && !opp_table->regulators) {
+                       dev_dbg(dev, "%s: old/new frequencies (%lu Hz) are 
same, nothing to do\n",
+                               __func__, freq);
+                       ret = 0;
+                       goto put_opp_table;
+               }
        }
 
        /*
diff --git a/drivers/rtc/rtc-goldfish.c b/drivers/rtc/rtc-goldfish.c
index cb6b0ad7ec3f..5dd92147f168 100644
--- a/drivers/rtc/rtc-goldfish.c
+++ b/drivers/rtc/rtc-goldfish.c
@@ -73,6 +73,7 @@ static int goldfish_rtc_set_alarm(struct device *dev,
                rtc_alarm64 = rtc_tm_to_time64(&alrm->time) * NSEC_PER_SEC;
                writel((rtc_alarm64 >> 32), base + TIMER_ALARM_HIGH);
                writel(rtc_alarm64, base + TIMER_ALARM_LOW);
+               writel(1, base + TIMER_IRQ_ENABLED);
        } else {
                /*
                 * if this function was called with enabled=0
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index 111fe3fc32d7..e5d2299a7a39 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -430,7 +430,7 @@ static void zfcp_fsf_req_complete(struct zfcp_fsf_req *req)
                return;
        }
 
-       del_timer(&req->timer);
+       del_timer_sync(&req->timer);
        zfcp_fsf_protstatus_eval(req);
        zfcp_fsf_fsfstatus_eval(req);
        req->handler(req);
@@ -905,7 +905,7 @@ static int zfcp_fsf_req_send(struct zfcp_fsf_req *req)
        req->qdio_req.qdio_outb_usage = atomic_read(&qdio->req_q_free);
        req->issued = get_tod_clock();
        if (zfcp_qdio_send(qdio, &req->qdio_req)) {
-               del_timer(&req->timer);
+               del_timer_sync(&req->timer);
                /* lookup request again, list might have changed */
                zfcp_reqlist_find_rm(adapter->req_list, req_id);
                zfcp_erp_adapter_reopen(adapter, 0, "fsrs__1");
diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c
index 2b865c6423e2..e00dc4693fcb 100644
--- a/drivers/scsi/libfc/fc_disc.c
+++ b/drivers/scsi/libfc/fc_disc.c
@@ -581,8 +581,12 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct 
fc_frame *fp,
 
        if (PTR_ERR(fp) == -FC_EX_CLOSED)
                goto out;
-       if (IS_ERR(fp))
-               goto redisc;
+       if (IS_ERR(fp)) {
+               mutex_lock(&disc->disc_mutex);
+               fc_disc_restart(disc);
+               mutex_unlock(&disc->disc_mutex);
+               goto out;
+       }
 
        cp = fc_frame_payload_get(fp, sizeof(*cp));
        if (!cp)
@@ -609,7 +613,7 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct 
fc_frame *fp,
                                new_rdata->disc_id = disc->disc_id;
                                fc_rport_login(new_rdata);
                        }
-                       goto out;
+                       goto free_fp;
                }
                rdata->disc_id = disc->disc_id;
                mutex_unlock(&rdata->rp_mutex);
@@ -626,6 +630,8 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct 
fc_frame *fp,
                fc_disc_restart(disc);
                mutex_unlock(&disc->disc_mutex);
        }
+free_fp:
+       fc_frame_free(fp);
 out:
        kref_put(&rdata->kref, fc_rport_destroy);
        if (!IS_ERR(fp))
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 1120d133204c..20e3048276a0 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -2829,10 +2829,6 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct 
pci_device_id *id)
        /* This may fail but that's ok */
        pci_enable_pcie_error_reporting(pdev);
 
-       /* Turn off T10-DIF when FC-NVMe is enabled */
-       if (ql2xnvmeenable)
-               ql2xenabledif = 0;
-
        ha = kzalloc(sizeof(struct qla_hw_data), GFP_KERNEL);
        if (!ha) {
                ql_log_pci(ql_log_fatal, pdev, 0x0009,
diff --git a/drivers/scsi/ufs/ti-j721e-ufs.c b/drivers/scsi/ufs/ti-j721e-ufs.c
index 46bb905b4d6a..eafe0db98d54 100644
--- a/drivers/scsi/ufs/ti-j721e-ufs.c
+++ b/drivers/scsi/ufs/ti-j721e-ufs.c
@@ -38,6 +38,7 @@ static int ti_j721e_ufs_probe(struct platform_device *pdev)
        /* Select MPHY refclk frequency */
        clk = devm_clk_get(dev, NULL);
        if (IS_ERR(clk)) {
+               ret = PTR_ERR(clk);
                dev_err(dev, "Cannot claim MPHY clock.\n");
                goto clk_err;
        }
diff --git a/drivers/scsi/ufs/ufs_quirks.h b/drivers/scsi/ufs/ufs_quirks.h
index df7a1e6805a3..c3af72c58805 100644
--- a/drivers/scsi/ufs/ufs_quirks.h
+++ b/drivers/scsi/ufs/ufs_quirks.h
@@ -12,6 +12,7 @@
 #define UFS_ANY_VENDOR 0xFFFF
 #define UFS_ANY_MODEL  "ANY_MODEL"
 
+#define UFS_VENDOR_MICRON      0x12C
 #define UFS_VENDOR_TOSHIBA     0x198
 #define UFS_VENDOR_SAMSUNG     0x1CE
 #define UFS_VENDOR_SKHYNIX     0x1AD
diff --git a/drivers/scsi/ufs/ufshcd-pci.c b/drivers/scsi/ufs/ufshcd-pci.c
index 8f78a8151499..b220666774ce 100644
--- a/drivers/scsi/ufs/ufshcd-pci.c
+++ b/drivers/scsi/ufs/ufshcd-pci.c
@@ -67,11 +67,23 @@ static int ufs_intel_link_startup_notify(struct ufs_hba 
*hba,
        return err;
 }
 
+static int ufs_intel_ehl_init(struct ufs_hba *hba)
+{
+       hba->quirks |= UFSHCD_QUIRK_BROKEN_AUTO_HIBERN8;
+       return 0;
+}
+
 static struct ufs_hba_variant_ops ufs_intel_cnl_hba_vops = {
        .name                   = "intel-pci",
        .link_startup_notify    = ufs_intel_link_startup_notify,
 };
 
+static struct ufs_hba_variant_ops ufs_intel_ehl_hba_vops = {
+       .name                   = "intel-pci",
+       .init                   = ufs_intel_ehl_init,
+       .link_startup_notify    = ufs_intel_link_startup_notify,
+};
+
 #ifdef CONFIG_PM_SLEEP
 /**
  * ufshcd_pci_suspend - suspend power management function
@@ -200,8 +212,8 @@ static const struct dev_pm_ops ufshcd_pci_pm_ops = {
 static const struct pci_device_id ufshcd_pci_tbl[] = {
        { PCI_VENDOR_ID_SAMSUNG, 0xC00C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
        { PCI_VDEVICE(INTEL, 0x9DFA), (kernel_ulong_t)&ufs_intel_cnl_hba_vops },
-       { PCI_VDEVICE(INTEL, 0x4B41), (kernel_ulong_t)&ufs_intel_cnl_hba_vops },
-       { PCI_VDEVICE(INTEL, 0x4B43), (kernel_ulong_t)&ufs_intel_cnl_hba_vops },
+       { PCI_VDEVICE(INTEL, 0x4B41), (kernel_ulong_t)&ufs_intel_ehl_hba_vops },
+       { PCI_VDEVICE(INTEL, 0x4B43), (kernel_ulong_t)&ufs_intel_ehl_hba_vops },
        { }     /* terminate list */
 };
 
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 477b6cfff381..3b80d692dd2e 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -211,6 +211,8 @@ ufs_get_desired_pm_lvl_for_dev_link_state(enum 
ufs_dev_pwr_mode dev_state,
 
 static struct ufs_dev_fix ufs_fixups[] = {
        /* UFS cards deviations table */
+       UFS_FIX(UFS_VENDOR_MICRON, UFS_ANY_MODEL,
+               UFS_DEVICE_QUIRK_DELAY_BEFORE_LPM),
        UFS_FIX(UFS_VENDOR_SAMSUNG, UFS_ANY_MODEL,
                UFS_DEVICE_QUIRK_DELAY_BEFORE_LPM),
        UFS_FIX(UFS_VENDOR_SAMSUNG, UFS_ANY_MODEL,
@@ -645,7 +647,11 @@ static inline int ufshcd_get_tr_ocs(struct ufshcd_lrb 
*lrbp)
  */
 static inline void ufshcd_utrl_clear(struct ufs_hba *hba, u32 pos)
 {
-       ufshcd_writel(hba, ~(1 << pos), REG_UTP_TRANSFER_REQ_LIST_CLEAR);
+       if (hba->quirks & UFSHCI_QUIRK_BROKEN_REQ_LIST_CLR)
+               ufshcd_writel(hba, (1 << pos), REG_UTP_TRANSFER_REQ_LIST_CLEAR);
+       else
+               ufshcd_writel(hba, ~(1 << pos),
+                               REG_UTP_TRANSFER_REQ_LIST_CLEAR);
 }
 
 /**
@@ -655,7 +661,10 @@ static inline void ufshcd_utrl_clear(struct ufs_hba *hba, 
u32 pos)
  */
 static inline void ufshcd_utmrl_clear(struct ufs_hba *hba, u32 pos)
 {
-       ufshcd_writel(hba, ~(1 << pos), REG_UTP_TASK_REQ_LIST_CLEAR);
+       if (hba->quirks & UFSHCI_QUIRK_BROKEN_REQ_LIST_CLR)
+               ufshcd_writel(hba, (1 << pos), REG_UTP_TASK_REQ_LIST_CLEAR);
+       else
+               ufshcd_writel(hba, ~(1 << pos), REG_UTP_TASK_REQ_LIST_CLEAR);
 }
 
 /**
@@ -2149,8 +2158,14 @@ static int ufshcd_map_sg(struct ufs_hba *hba, struct 
ufshcd_lrb *lrbp)
                return sg_segments;
 
        if (sg_segments) {
-               lrbp->utr_descriptor_ptr->prd_table_length =
-                       cpu_to_le16((u16)sg_segments);
+
+               if (hba->quirks & UFSHCD_QUIRK_PRDT_BYTE_GRAN)
+                       lrbp->utr_descriptor_ptr->prd_table_length =
+                               cpu_to_le16((sg_segments *
+                                       sizeof(struct ufshcd_sg_entry)));
+               else
+                       lrbp->utr_descriptor_ptr->prd_table_length =
+                               cpu_to_le16((u16) (sg_segments));
 
                prd_table = (struct ufshcd_sg_entry *)lrbp->ucd_prdt_ptr;
 
@@ -3496,11 +3511,21 @@ static void ufshcd_host_memory_configure(struct ufs_hba 
*hba)
                                
cpu_to_le32(upper_32_bits(cmd_desc_element_addr));
 
                /* Response upiu and prdt offset should be in double words */
-               utrdlp[i].response_upiu_offset =
-                       cpu_to_le16(response_offset >> 2);
-               utrdlp[i].prd_table_offset = cpu_to_le16(prdt_offset >> 2);
-               utrdlp[i].response_upiu_length =
-                       cpu_to_le16(ALIGNED_UPIU_SIZE >> 2);
+               if (hba->quirks & UFSHCD_QUIRK_PRDT_BYTE_GRAN) {
+                       utrdlp[i].response_upiu_offset =
+                               cpu_to_le16(response_offset);
+                       utrdlp[i].prd_table_offset =
+                               cpu_to_le16(prdt_offset);
+                       utrdlp[i].response_upiu_length =
+                               cpu_to_le16(ALIGNED_UPIU_SIZE);
+               } else {
+                       utrdlp[i].response_upiu_offset =
+                               cpu_to_le16(response_offset >> 2);
+                       utrdlp[i].prd_table_offset =
+                               cpu_to_le16(prdt_offset >> 2);
+                       utrdlp[i].response_upiu_length =
+                               cpu_to_le16(ALIGNED_UPIU_SIZE >> 2);
+               }
 
                ufshcd_init_lrb(hba, &hba->lrb[i], i);
        }
@@ -3530,6 +3555,52 @@ static int ufshcd_dme_link_startup(struct ufs_hba *hba)
                        "dme-link-startup: error code %d\n", ret);
        return ret;
 }
+/**
+ * ufshcd_dme_reset - UIC command for DME_RESET
+ * @hba: per adapter instance
+ *
+ * DME_RESET command is issued in order to reset UniPro stack.
+ * This function now deals with cold reset.
+ *
+ * Returns 0 on success, non-zero value on failure
+ */
+static int ufshcd_dme_reset(struct ufs_hba *hba)
+{
+       struct uic_command uic_cmd = {0};
+       int ret;
+
+       uic_cmd.command = UIC_CMD_DME_RESET;
+
+       ret = ufshcd_send_uic_cmd(hba, &uic_cmd);
+       if (ret)
+               dev_err(hba->dev,
+                       "dme-reset: error code %d\n", ret);
+
+       return ret;
+}
+
+/**
+ * ufshcd_dme_enable - UIC command for DME_ENABLE
+ * @hba: per adapter instance
+ *
+ * DME_ENABLE command is issued in order to enable UniPro stack.
+ *
+ * Returns 0 on success, non-zero value on failure
+ */
+static int ufshcd_dme_enable(struct ufs_hba *hba)
+{
+       struct uic_command uic_cmd = {0};
+       int ret;
+
+       uic_cmd.command = UIC_CMD_DME_ENABLE;
+
+       ret = ufshcd_send_uic_cmd(hba, &uic_cmd);
+       if (ret)
+               dev_err(hba->dev,
+                       "dme-reset: error code %d\n", ret);
+
+       return ret;
+}
 
 static inline void ufshcd_add_delay_before_dme_cmd(struct ufs_hba *hba)
 {
@@ -4247,7 +4318,7 @@ static inline void ufshcd_hba_stop(struct ufs_hba *hba, 
bool can_sleep)
 }
 
 /**
- * ufshcd_hba_enable - initialize the controller
+ * ufshcd_hba_execute_hce - initialize the controller
  * @hba: per adapter instance
  *
  * The controller resets itself and controller firmware initialization
@@ -4256,7 +4327,7 @@ static inline void ufshcd_hba_stop(struct ufs_hba *hba, 
bool can_sleep)
  *
  * Returns 0 on success, non-zero value on failure
  */
-int ufshcd_hba_enable(struct ufs_hba *hba)
+static int ufshcd_hba_execute_hce(struct ufs_hba *hba)
 {
        int retry;
 
@@ -4304,6 +4375,32 @@ int ufshcd_hba_enable(struct ufs_hba *hba)
 
        return 0;
 }
+
+int ufshcd_hba_enable(struct ufs_hba *hba)
+{
+       int ret;
+
+       if (hba->quirks & UFSHCI_QUIRK_BROKEN_HCE) {
+               ufshcd_set_link_off(hba);
+               ufshcd_vops_hce_enable_notify(hba, PRE_CHANGE);
+
+               /* enable UIC related interrupts */
+               ufshcd_enable_intr(hba, UFSHCD_UIC_MASK);
+               ret = ufshcd_dme_reset(hba);
+               if (!ret) {
+                       ret = ufshcd_dme_enable(hba);
+                       if (!ret)
+                               ufshcd_vops_hce_enable_notify(hba, POST_CHANGE);
+                       if (ret)
+                               dev_err(hba->dev,
+                                       "Host controller enable failed with 
non-hce\n");
+               }
+       } else {
+               ret = ufshcd_hba_execute_hce(hba);
+       }
+
+       return ret;
+}
 EXPORT_SYMBOL_GPL(ufshcd_hba_enable);
 
 static int ufshcd_disable_tx_lcc(struct ufs_hba *hba, bool peer)
@@ -4702,6 +4799,12 @@ ufshcd_transfer_rsp_status(struct ufs_hba *hba, struct 
ufshcd_lrb *lrbp)
        /* overall command status of utrd */
        ocs = ufshcd_get_tr_ocs(lrbp);
 
+       if (hba->quirks & UFSHCD_QUIRK_BROKEN_OCS_FATAL_ERROR) {
+               if (be32_to_cpu(lrbp->ucd_rsp_ptr->header.dword_1) &
+                                       MASK_RSP_UPIU_RESULT)
+                       ocs = OCS_SUCCESS;
+       }
+
        switch (ocs) {
        case OCS_SUCCESS:
                result = ufshcd_get_req_rsp(lrbp->ucd_rsp_ptr);
@@ -4880,7 +4983,8 @@ static irqreturn_t ufshcd_transfer_req_compl(struct 
ufs_hba *hba)
         * false interrupt if device completes another request after resetting
         * aggregation and before reading the DB.
         */
-       if (ufshcd_is_intr_aggr_allowed(hba))
+       if (ufshcd_is_intr_aggr_allowed(hba) &&
+           !(hba->quirks & UFSHCI_QUIRK_SKIP_RESET_INTR_AGGR))
                ufshcd_reset_intr_aggr(hba);
 
        tr_doorbell = ufshcd_readl(hba, REG_UTP_TRANSFER_REQ_DOOR_BELL);
@@ -5699,7 +5803,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba)
                intr_status = ufshcd_readl(hba, REG_INTERRUPT_STATUS);
        } while (intr_status && --retries);
 
-       if (retval == IRQ_NONE) {
+       if (enabled_intr_status && retval == IRQ_NONE) {
                dev_err(hba->dev, "%s: Unhandled interrupt 0x%08x\n",
                                        __func__, intr_status);
                ufshcd_dump_regs(hba, 0, UFSHCI_REG_SPACE_SIZE, "host_regs: ");
diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
index 2315ecc20927..ccbeae4f8325 100644
--- a/drivers/scsi/ufs/ufshcd.h
+++ b/drivers/scsi/ufs/ufshcd.h
@@ -518,6 +518,41 @@ enum ufshcd_quirks {
         * ops (get_ufs_hci_version) to get the correct version.
         */
        UFSHCD_QUIRK_BROKEN_UFS_HCI_VERSION             = 1 << 5,
+
+       /*
+        * Clear handling for transfer/task request list is just opposite.
+        */
+       UFSHCI_QUIRK_BROKEN_REQ_LIST_CLR                = 1 << 6,
+
+       /*
+        * This quirk needs to be enabled if host controller doesn't allow
+        * that the interrupt aggregation timer and counter are reset by s/w.
+        */
+       UFSHCI_QUIRK_SKIP_RESET_INTR_AGGR               = 1 << 7,
+
+       /*
+        * This quirks needs to be enabled if host controller cannot be
+        * enabled via HCE register.
+        */
+       UFSHCI_QUIRK_BROKEN_HCE                         = 1 << 8,
+
+       /*
+        * This quirk needs to be enabled if the host controller regards
+        * resolution of the values of PRDTO and PRDTL in UTRD as byte.
+        */
+       UFSHCD_QUIRK_PRDT_BYTE_GRAN                     = 1 << 9,
+
+       /*
+        * This quirk needs to be enabled if the host controller reports
+        * OCS FATAL ERROR with device error through sense data
+        */
+       UFSHCD_QUIRK_BROKEN_OCS_FATAL_ERROR             = 1 << 10,
+
+       /*
+        * This quirk needs to be enabled if the host controller has
+        * auto-hibernate capability but it doesn't work.
+        */
+       UFSHCD_QUIRK_BROKEN_AUTO_HIBERN8                = 1 << 11,
 };
 
 enum ufshcd_caps {
@@ -767,7 +802,8 @@ return true;
 
 static inline bool ufshcd_is_auto_hibern8_supported(struct ufs_hba *hba)
 {
-       return (hba->capabilities & MASK_AUTO_HIBERN8_SUPPORT);
+       return (hba->capabilities & MASK_AUTO_HIBERN8_SUPPORT) &&
+               !(hba->quirks & UFSHCD_QUIRK_BROKEN_AUTO_HIBERN8);
 }
 
 static inline bool ufshcd_is_auto_hibern8_enabled(struct ufs_hba *hba)
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 741b9140992a..11279dcc4a3e 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -989,4 +989,7 @@ config SPI_SLAVE_SYSTEM_CONTROL
 
 endif # SPI_SLAVE
 
+config SPI_DYNAMIC
+       def_bool ACPI || OF_DYNAMIC || SPI_SLAVE
+
 endif # SPI
diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
index 44ac6eb3298d..e29818abbeaf 100644
--- a/drivers/spi/spi-stm32.c
+++ b/drivers/spi/spi-stm32.c
@@ -13,6 +13,7 @@
 #include <linux/iopoll.h>
 #include <linux/module.h>
 #include <linux/of_platform.h>
+#include <linux/pinctrl/consumer.h>
 #include <linux/pm_runtime.h>
 #include <linux/reset.h>
 #include <linux/spi/spi.h>
@@ -1985,6 +1986,8 @@ static int stm32_spi_remove(struct platform_device *pdev)
 
        pm_runtime_disable(&pdev->dev);
 
+       pinctrl_pm_select_sleep_state(&pdev->dev);
+
        return 0;
 }
 
@@ -1996,13 +1999,18 @@ static int stm32_spi_runtime_suspend(struct device *dev)
 
        clk_disable_unprepare(spi->clk);
 
-       return 0;
+       return pinctrl_pm_select_sleep_state(dev);
 }
 
 static int stm32_spi_runtime_resume(struct device *dev)
 {
        struct spi_master *master = dev_get_drvdata(dev);
        struct stm32_spi *spi = spi_master_get_devdata(master);
+       int ret;
+
+       ret = pinctrl_pm_select_default_state(dev);
+       if (ret)
+               return ret;
 
        return clk_prepare_enable(spi->clk);
 }
@@ -2032,10 +2040,23 @@ static int stm32_spi_resume(struct device *dev)
                return ret;
 
        ret = spi_master_resume(master);
-       if (ret)
+       if (ret) {
                clk_disable_unprepare(spi->clk);
+               return ret;
+       }
 
-       return ret;
+       ret = pm_runtime_get_sync(dev);
+       if (ret) {
+               dev_err(dev, "Unable to power device:%d\n", ret);
+               return ret;
+       }
+
+       spi->cfg->config(spi);
+
+       pm_runtime_mark_last_busy(dev);
+       pm_runtime_put_autosuspend(dev);
+
+       return 0;
 }
 #endif
 
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 299384c91917..a6e16c138845 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -475,6 +475,12 @@ static LIST_HEAD(spi_controller_list);
  */
 static DEFINE_MUTEX(board_lock);
 
+/*
+ * Prevents addition of devices with same chip select and
+ * addition of devices below an unregistering controller.
+ */
+static DEFINE_MUTEX(spi_add_lock);
+
 /**
  * spi_alloc_device - Allocate a new SPI device
  * @ctlr: Controller to which device is connected
@@ -554,7 +560,6 @@ static int spi_dev_check(struct device *dev, void *data)
  */
 int spi_add_device(struct spi_device *spi)
 {
-       static DEFINE_MUTEX(spi_add_lock);
        struct spi_controller *ctlr = spi->controller;
        struct device *dev = ctlr->dev.parent;
        int status;
@@ -582,6 +587,13 @@ int spi_add_device(struct spi_device *spi)
                goto done;
        }
 
+       /* Controller may unregister concurrently */
+       if (IS_ENABLED(CONFIG_SPI_DYNAMIC) &&
+           !device_is_registered(&ctlr->dev)) {
+               status = -ENODEV;
+               goto done;
+       }
+
        /* Descriptors take precedence */
        if (ctlr->cs_gpiods)
                spi->cs_gpiod = ctlr->cs_gpiods[spi->chip_select];
@@ -2761,6 +2773,10 @@ void spi_unregister_controller(struct spi_controller 
*ctlr)
        struct spi_controller *found;
        int id = ctlr->bus_num;
 
+       /* Prevent addition of new devices, unregister existing ones */
+       if (IS_ENABLED(CONFIG_SPI_DYNAMIC))
+               mutex_lock(&spi_add_lock);
+
        device_for_each_child(&ctlr->dev, NULL, __unregister);
 
        /* First make sure that this controller was ever added */
@@ -2781,6 +2797,9 @@ void spi_unregister_controller(struct spi_controller 
*ctlr)
        if (found == ctlr)
                idr_remove(&spi_master_idr, id);
        mutex_unlock(&board_lock);
+
+       if (IS_ENABLED(CONFIG_SPI_DYNAMIC))
+               mutex_unlock(&spi_add_lock);
 }
 EXPORT_SYMBOL_GPL(spi_unregister_controller);
 
diff --git a/drivers/target/target_core_user.c 
b/drivers/target/target_core_user.c
index b63a1e0c4aa6..a55114975b00 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -601,7 +601,7 @@ static inline void tcmu_flush_dcache_range(void *vaddr, 
size_t size)
        size = round_up(size+offset, PAGE_SIZE);
 
        while (size) {
-               flush_dcache_page(virt_to_page(start));
+               flush_dcache_page(vmalloc_to_page(start));
                start += PAGE_SIZE;
                size -= PAGE_SIZE;
        }
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index cc1d64765ce7..c244e0ecf9f4 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -1149,13 +1149,16 @@ static int vfio_bus_type(struct device *dev, void *data)
 static int vfio_iommu_replay(struct vfio_iommu *iommu,
                             struct vfio_domain *domain)
 {
-       struct vfio_domain *d;
+       struct vfio_domain *d = NULL;
        struct rb_node *n;
        unsigned long limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
        int ret;
 
        /* Arbitrarily pick the first domain in the list for lookups */
-       d = list_first_entry(&iommu->domain_list, struct vfio_domain, next);
+       if (!list_empty(&iommu->domain_list))
+               d = list_first_entry(&iommu->domain_list,
+                                    struct vfio_domain, next);
+
        n = rb_first(&iommu->dma_list);
 
        for (; n; n = rb_next(n)) {
@@ -1173,6 +1176,11 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu,
                                phys_addr_t p;
                                dma_addr_t i;
 
+                               if (WARN_ON(!d)) { /* mapped w/o a domain?! */
+                                       ret = -EINVAL;
+                                       goto unwind;
+                               }
+
                                phys = iommu_iova_to_phys(d->domain, iova);
 
                                if (WARN_ON(!phys)) {
@@ -1202,7 +1210,7 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu,
                                if (npage <= 0) {
                                        WARN_ON(!npage);
                                        ret = (int)npage;
-                                       return ret;
+                                       goto unwind;
                                }
 
                                phys = pfn << PAGE_SHIFT;
@@ -1211,14 +1219,67 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu,
 
                        ret = iommu_map(domain->domain, iova, phys,
                                        size, dma->prot | domain->prot);
-                       if (ret)
-                               return ret;
+                       if (ret) {
+                               if (!dma->iommu_mapped)
+                                       vfio_unpin_pages_remote(dma, iova,
+                                                       phys >> PAGE_SHIFT,
+                                                       size >> PAGE_SHIFT,
+                                                       true);
+                               goto unwind;
+                       }
 
                        iova += size;
                }
+       }
+
+       /* All dmas are now mapped, defer to second tree walk for unwind */
+       for (n = rb_first(&iommu->dma_list); n; n = rb_next(n)) {
+               struct vfio_dma *dma = rb_entry(n, struct vfio_dma, node);
+
                dma->iommu_mapped = true;
        }
+
        return 0;
+
+unwind:
+       for (; n; n = rb_prev(n)) {
+               struct vfio_dma *dma = rb_entry(n, struct vfio_dma, node);
+               dma_addr_t iova;
+
+               if (dma->iommu_mapped) {
+                       iommu_unmap(domain->domain, dma->iova, dma->size);
+                       continue;
+               }
+
+               iova = dma->iova;
+               while (iova < dma->iova + dma->size) {
+                       phys_addr_t phys, p;
+                       size_t size;
+                       dma_addr_t i;
+
+                       phys = iommu_iova_to_phys(domain->domain, iova);
+                       if (!phys) {
+                               iova += PAGE_SIZE;
+                               continue;
+                       }
+
+                       size = PAGE_SIZE;
+                       p = phys + size;
+                       i = iova + size;
+                       while (i < dma->iova + dma->size &&
+                              p == iommu_iova_to_phys(domain->domain, i)) {
+                               size += PAGE_SIZE;
+                               p += PAGE_SIZE;
+                               i += PAGE_SIZE;
+                       }
+
+                       iommu_unmap(domain->domain, iova, size);
+                       vfio_unpin_pages_remote(dma, iova, phys >> PAGE_SHIFT,
+                                               size >> PAGE_SHIFT, true);
+               }
+       }
+
+       return ret;
 }
 
 /*
diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
index 65491ae74808..e57c00824965 100644
--- a/drivers/video/fbdev/efifb.c
+++ b/drivers/video/fbdev/efifb.c
@@ -453,7 +453,7 @@ static int efifb_probe(struct platform_device *dev)
        info->apertures->ranges[0].base = efifb_fix.smem_start;
        info->apertures->ranges[0].size = size_remap;
 
-       if (efi_enabled(EFI_BOOT) &&
+       if (efi_enabled(EFI_MEMMAP) &&
            !efi_mem_desc_lookup(efifb_fix.smem_start, &md)) {
                if ((efifb_fix.smem_start + efifb_fix.smem_len) >
                    (md.phys_addr + (md.num_pages << EFI_PAGE_SHIFT))) {
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 58b96baa8d48..4f7c73e6052f 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -1960,6 +1960,9 @@ bool virtqueue_poll(struct virtqueue *_vq, unsigned 
last_used_idx)
 {
        struct vring_virtqueue *vq = to_vvq(_vq);
 
+       if (unlikely(vq->broken))
+               return false;
+
        virtio_mb(vq->weak_barriers);
        return vq->packed_ring ? virtqueue_poll_packed(_vq, last_used_idx) :
                                 virtqueue_poll_split(_vq, last_used_idx);
diff --git a/drivers/xen/preempt.c b/drivers/xen/preempt.c
index 17240c5325a3..6ad87b5c95ed 100644
--- a/drivers/xen/preempt.c
+++ b/drivers/xen/preempt.c
@@ -27,7 +27,7 @@ EXPORT_SYMBOL_GPL(xen_in_preemptible_hcall);
 asmlinkage __visible void xen_maybe_preempt_hcall(void)
 {
        if (unlikely(__this_cpu_read(xen_in_preemptible_hcall)
-                    && need_resched())) {
+                    && need_resched() && !preempt_count())) {
                /*
                 * Clear flag as we may be rescheduled on a different
                 * cpu.
diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index b6d27762c6f8..5fbadd07819b 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -335,6 +335,7 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t 
size, void *vaddr,
        int order = get_order(size);
        phys_addr_t phys;
        u64 dma_mask = DMA_BIT_MASK(32);
+       struct page *page;
 
        if (hwdev && hwdev->coherent_dma_mask)
                dma_mask = hwdev->coherent_dma_mask;
@@ -346,9 +347,14 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t 
size, void *vaddr,
        /* Convert the size to actually allocated. */
        size = 1UL << (order + XEN_PAGE_SHIFT);
 
+       if (is_vmalloc_addr(vaddr))
+               page = vmalloc_to_page(vaddr);
+       else
+               page = virt_to_page(vaddr);
+
        if (!WARN_ON((dev_addr + size - 1 > dma_mask) ||
                     range_straddles_page_boundary(phys, size)) &&
-           TestClearPageXenRemapped(virt_to_page(vaddr)))
+           TestClearPageXenRemapped(page))
                xen_destroy_contiguous_region(phys, order);
 
        xen_free_coherent_pages(hwdev, size, vaddr, (dma_addr_t)phys, attrs);
diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
index 7503899c0a1b..f07e53ab808e 100644
--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -289,15 +289,17 @@ void afs_dynroot_depopulate(struct super_block *sb)
                net->dynroot_sb = NULL;
        mutex_unlock(&net->proc_cells_lock);
 
-       inode_lock(root->d_inode);
-
-       /* Remove all the pins for dirs created for manually added cells */
-       list_for_each_entry_safe(subdir, tmp, &root->d_subdirs, d_child) {
-               if (subdir->d_fsdata) {
-                       subdir->d_fsdata = NULL;
-                       dput(subdir);
+       if (root) {
+               inode_lock(root->d_inode);
+
+               /* Remove all the pins for dirs created for manually added 
cells */
+               list_for_each_entry_safe(subdir, tmp, &root->d_subdirs, 
d_child) {
+                       if (subdir->d_fsdata) {
+                               subdir->d_fsdata = NULL;
+                               dput(subdir);
+                       }
                }
-       }
 
-       inode_unlock(root->d_inode);
+               inode_unlock(root->d_inode);
+       }
 }
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 95272ae36b05..e32935b68d0a 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -4337,7 +4337,6 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc)
                return -ENOMEM;
        }
 
-       fsc->mdsc = mdsc;
        init_completion(&mdsc->safe_umount_waiters);
        init_waitqueue_head(&mdsc->session_close_wq);
        INIT_LIST_HEAD(&mdsc->waiting_for_map);
@@ -4390,6 +4389,8 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc)
 
        strscpy(mdsc->nodename, utsname()->nodename,
                sizeof(mdsc->nodename));
+
+       fsc->mdsc = mdsc;
        return 0;
 }
 
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 12eebcdea9c8..e0decff22ae2 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1994,9 +1994,11 @@ static int ep_loop_check_proc(void *priv, void *cookie, 
int call_nests)
                         * not already there, and calling reverse_path_check()
                         * during ep_insert().
                         */
-                       if (list_empty(&epi->ffd.file->f_tfile_llink))
+                       if (list_empty(&epi->ffd.file->f_tfile_llink)) {
+                               get_file(epi->ffd.file);
                                list_add(&epi->ffd.file->f_tfile_llink,
                                         &tfile_check_list);
+                       }
                }
        }
        mutex_unlock(&ep->mtx);
@@ -2040,6 +2042,7 @@ static void clear_tfile_check_list(void)
                file = list_first_entry(&tfile_check_list, struct file,
                                        f_tfile_llink);
                list_del_init(&file->f_tfile_llink);
+               fput(file);
        }
        INIT_LIST_HEAD(&tfile_check_list);
 }
@@ -2200,25 +2203,22 @@ int do_epoll_ctl(int epfd, int op, int fd, struct 
epoll_event *epds,
                        full_check = 1;
                        if (is_file_epoll(tf.file)) {
                                error = -ELOOP;
-                               if (ep_loop_check(ep, tf.file) != 0) {
-                                       clear_tfile_check_list();
+                               if (ep_loop_check(ep, tf.file) != 0)
                                        goto error_tgt_fput;
-                               }
-                       } else
+                       } else {
+                               get_file(tf.file);
                                list_add(&tf.file->f_tfile_llink,
                                                        &tfile_check_list);
+                       }
                        error = epoll_mutex_lock(&ep->mtx, 0, nonblock);
-                       if (error) {
-out_del:
-                               list_del(&tf.file->f_tfile_llink);
+                       if (error)
                                goto error_tgt_fput;
-                       }
                        if (is_file_epoll(tf.file)) {
                                tep = tf.file->private_data;
                                error = epoll_mutex_lock(&tep->mtx, 1, 
nonblock);
                                if (error) {
                                        mutex_unlock(&ep->mtx);
-                                       goto out_del;
+                                       goto error_tgt_fput;
                                }
                        }
                }
@@ -2239,8 +2239,6 @@ int do_epoll_ctl(int epfd, int op, int fd, struct 
epoll_event *epds,
                        error = ep_insert(ep, epds, tf.file, fd, full_check);
                } else
                        error = -EEXIST;
-               if (full_check)
-                       clear_tfile_check_list();
                break;
        case EPOLL_CTL_DEL:
                if (epi)
@@ -2263,8 +2261,10 @@ int do_epoll_ctl(int epfd, int op, int fd, struct 
epoll_event *epds,
        mutex_unlock(&ep->mtx);
 
 error_tgt_fput:
-       if (full_check)
+       if (full_check) {
+               clear_tfile_check_list();
                mutex_unlock(&epmutex);
+       }
 
        fdput(tf);
 error_fput:
diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
index 16e9b2fda03a..e830a9d4e10d 100644
--- a/fs/ext4/block_validity.c
+++ b/fs/ext4/block_validity.c
@@ -24,6 +24,7 @@ struct ext4_system_zone {
        struct rb_node  node;
        ext4_fsblk_t    start_blk;
        unsigned int    count;
+       u32             ino;
 };
 
 static struct kmem_cache *ext4_system_zone_cachep;
@@ -45,7 +46,8 @@ void ext4_exit_system_zone(void)
 static inline int can_merge(struct ext4_system_zone *entry1,
                     struct ext4_system_zone *entry2)
 {
-       if ((entry1->start_blk + entry1->count) == entry2->start_blk)
+       if ((entry1->start_blk + entry1->count) == entry2->start_blk &&
+           entry1->ino == entry2->ino)
                return 1;
        return 0;
 }
@@ -66,9 +68,9 @@ static void release_system_zone(struct ext4_system_blocks 
*system_blks)
  */
 static int add_system_zone(struct ext4_system_blocks *system_blks,
                           ext4_fsblk_t start_blk,
-                          unsigned int count)
+                          unsigned int count, u32 ino)
 {
-       struct ext4_system_zone *new_entry = NULL, *entry;
+       struct ext4_system_zone *new_entry, *entry;
        struct rb_node **n = &system_blks->root.rb_node, *node;
        struct rb_node *parent = NULL, *new_node = NULL;
 
@@ -79,30 +81,21 @@ static int add_system_zone(struct ext4_system_blocks 
*system_blks,
                        n = &(*n)->rb_left;
                else if (start_blk >= (entry->start_blk + entry->count))
                        n = &(*n)->rb_right;
-               else {
-                       if (start_blk + count > (entry->start_blk +
-                                                entry->count))
-                               entry->count = (start_blk + count -
-                                               entry->start_blk);
-                       new_node = *n;
-                       new_entry = rb_entry(new_node, struct ext4_system_zone,
-                                            node);
-                       break;
-               }
+               else    /* Unexpected overlap of system zones. */
+                       return -EFSCORRUPTED;
        }
 
-       if (!new_entry) {
-               new_entry = kmem_cache_alloc(ext4_system_zone_cachep,
-                                            GFP_KERNEL);
-               if (!new_entry)
-                       return -ENOMEM;
-               new_entry->start_blk = start_blk;
-               new_entry->count = count;
-               new_node = &new_entry->node;
-
-               rb_link_node(new_node, parent, n);
-               rb_insert_color(new_node, &system_blks->root);
-       }
+       new_entry = kmem_cache_alloc(ext4_system_zone_cachep,
+                                    GFP_KERNEL);
+       if (!new_entry)
+               return -ENOMEM;
+       new_entry->start_blk = start_blk;
+       new_entry->count = count;
+       new_entry->ino = ino;
+       new_node = &new_entry->node;
+
+       rb_link_node(new_node, parent, n);
+       rb_insert_color(new_node, &system_blks->root);
 
        /* Can we merge to the left? */
        node = rb_prev(new_node);
@@ -159,7 +152,7 @@ static void debug_print_tree(struct ext4_sb_info *sbi)
 static int ext4_data_block_valid_rcu(struct ext4_sb_info *sbi,
                                     struct ext4_system_blocks *system_blks,
                                     ext4_fsblk_t start_blk,
-                                    unsigned int count)
+                                    unsigned int count, ino_t ino)
 {
        struct ext4_system_zone *entry;
        struct rb_node *n;
@@ -180,7 +173,7 @@ static int ext4_data_block_valid_rcu(struct ext4_sb_info 
*sbi,
                else if (start_blk >= (entry->start_blk + entry->count))
                        n = n->rb_right;
                else
-                       return 0;
+                       return entry->ino == ino;
        }
        return 1;
 }
@@ -214,19 +207,18 @@ static int ext4_protect_reserved_inode(struct super_block 
*sb,
                if (n == 0) {
                        i++;
                } else {
-                       if (!ext4_data_block_valid_rcu(sbi, system_blks,
-                                               map.m_pblk, n)) {
-                               err = -EFSCORRUPTED;
-                               __ext4_error(sb, __func__, __LINE__, -err,
-                                            map.m_pblk, "blocks %llu-%llu "
-                                            "from inode %u overlap system 
zone",
-                                            map.m_pblk,
-                                            map.m_pblk + map.m_len - 1, ino);
+                       err = add_system_zone(system_blks, map.m_pblk, n, ino);
+                       if (err < 0) {
+                               if (err == -EFSCORRUPTED) {
+                                       __ext4_error(sb, __func__, __LINE__,
+                                                    -err, map.m_pblk,
+                                                    "blocks %llu-%llu from 
inode %u overlap system zone",
+                                                    map.m_pblk,
+                                                    map.m_pblk + map.m_len - 1,
+                                                    ino);
+                               }
                                break;
                        }
-                       err = add_system_zone(system_blks, map.m_pblk, n);
-                       if (err < 0)
-                               break;
                        i += n;
                }
        }
@@ -280,19 +272,19 @@ int ext4_setup_system_zone(struct super_block *sb)
                    ((i < 5) || ((i % flex_size) == 0)))
                        add_system_zone(system_blks,
                                        ext4_group_first_block_no(sb, i),
-                                       ext4_bg_num_gdb(sb, i) + 1);
+                                       ext4_bg_num_gdb(sb, i) + 1, 0);
                gdp = ext4_get_group_desc(sb, i, NULL);
                ret = add_system_zone(system_blks,
-                               ext4_block_bitmap(sb, gdp), 1);
+                               ext4_block_bitmap(sb, gdp), 1, 0);
                if (ret)
                        goto err;
                ret = add_system_zone(system_blks,
-                               ext4_inode_bitmap(sb, gdp), 1);
+                               ext4_inode_bitmap(sb, gdp), 1, 0);
                if (ret)
                        goto err;
                ret = add_system_zone(system_blks,
                                ext4_inode_table(sb, gdp),
-                               sbi->s_itb_per_group);
+                               sbi->s_itb_per_group, 0);
                if (ret)
                        goto err;
        }
@@ -341,7 +333,7 @@ void ext4_release_system_zone(struct super_block *sb)
                call_rcu(&system_blks->rcu, ext4_destroy_system_zone);
 }
 
-int ext4_data_block_valid(struct ext4_sb_info *sbi, ext4_fsblk_t start_blk,
+int ext4_inode_block_valid(struct inode *inode, ext4_fsblk_t start_blk,
                          unsigned int count)
 {
        struct ext4_system_blocks *system_blks;
@@ -353,9 +345,9 @@ int ext4_data_block_valid(struct ext4_sb_info *sbi, 
ext4_fsblk_t start_blk,
         * mount option.
         */
        rcu_read_lock();
-       system_blks = rcu_dereference(sbi->system_blks);
-       ret = ext4_data_block_valid_rcu(sbi, system_blks, start_blk,
-                                       count);
+       system_blks = rcu_dereference(EXT4_SB(inode->i_sb)->system_blks);
+       ret = ext4_data_block_valid_rcu(EXT4_SB(inode->i_sb), system_blks,
+                                       start_blk, count, inode->i_ino);
        rcu_read_unlock();
        return ret;
 }
@@ -374,8 +366,7 @@ int ext4_check_blockref(const char *function, unsigned int 
line,
        while (bref < p+max) {
                blk = le32_to_cpu(*bref++);
                if (blk &&
-                   unlikely(!ext4_data_block_valid(EXT4_SB(inode->i_sb),
-                                                   blk, 1))) {
+                   unlikely(!ext4_inode_block_valid(inode, blk, 1))) {
                        ext4_error_inode(inode, function, line, blk,
                                         "invalid block");
                        return -EFSCORRUPTED;
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 51a85b50033a..98b44322a3c1 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -3338,9 +3338,9 @@ extern void ext4_release_system_zone(struct super_block 
*sb);
 extern int ext4_setup_system_zone(struct super_block *sb);
 extern int __init ext4_init_system_zone(void);
 extern void ext4_exit_system_zone(void);
-extern int ext4_data_block_valid(struct ext4_sb_info *sbi,
-                                ext4_fsblk_t start_blk,
-                                unsigned int count);
+extern int ext4_inode_block_valid(struct inode *inode,
+                                 ext4_fsblk_t start_blk,
+                                 unsigned int count);
 extern int ext4_check_blockref(const char *, unsigned int,
                               struct inode *, __le32 *, unsigned int);
 
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index d5453072eb63..910574aa6a90 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -337,7 +337,7 @@ static int ext4_valid_extent(struct inode *inode, struct 
ext4_extent *ext)
         */
        if (lblock + len <= lblock)
                return 0;
-       return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
+       return ext4_inode_block_valid(inode, block, len);
 }
 
 static int ext4_valid_extent_idx(struct inode *inode,
@@ -345,7 +345,7 @@ static int ext4_valid_extent_idx(struct inode *inode,
 {
        ext4_fsblk_t block = ext4_idx_pblock(ext_idx);
 
-       return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, 1);
+       return ext4_inode_block_valid(inode, block, 1);
 }
 
 static int ext4_valid_extent_entries(struct inode *inode,
@@ -500,14 +500,10 @@ __read_extent_tree_block(const char *function, unsigned 
int line,
        }
        if (buffer_verified(bh) && !(flags & EXT4_EX_FORCE_CACHE))
                return bh;
-       if (!ext4_has_feature_journal(inode->i_sb) ||
-           (inode->i_ino !=
-            le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum))) {
-               err = __ext4_ext_check(function, line, inode,
-                                      ext_block_hdr(bh), depth, pblk);
-               if (err)
-                       goto errout;
-       }
+       err = __ext4_ext_check(function, line, inode,
+                              ext_block_hdr(bh), depth, pblk);
+       if (err)
+               goto errout;
        set_buffer_verified(bh);
        /*
         * If this is a leaf block, cache all of its entries
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 2a01e31a032c..8f742b53f1d4 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -428,6 +428,10 @@ static ssize_t ext4_dio_write_checks(struct kiocb *iocb, 
struct iov_iter *from,
         */
        if (*ilock_shared && (!IS_NOSEC(inode) || *extend ||
             !ext4_overwrite_io(inode, offset, count))) {
+               if (iocb->ki_flags & IOCB_NOWAIT) {
+                       ret = -EAGAIN;
+                       goto out;
+               }
                inode_unlock_shared(inode);
                *ilock_shared = false;
                inode_lock(inode);
diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
index be2b66eb65f7..402641825712 100644
--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -858,8 +858,7 @@ static int ext4_clear_blocks(handle_t *handle, struct inode 
*inode,
        else if (ext4_should_journal_data(inode))
                flags |= EXT4_FREE_BLOCKS_FORGET;
 
-       if (!ext4_data_block_valid(EXT4_SB(inode->i_sb), block_to_free,
-                                  count)) {
+       if (!ext4_inode_block_valid(inode, block_to_free, count)) {
                EXT4_ERROR_INODE(inode, "attempt to clear invalid "
                                 "blocks %llu len %lu",
                                 (unsigned long long) block_to_free, count);
@@ -1004,8 +1003,7 @@ static void ext4_free_branches(handle_t *handle, struct 
inode *inode,
                        if (!nr)
                                continue;               /* A hole */
 
-                       if (!ext4_data_block_valid(EXT4_SB(inode->i_sb),
-                                                  nr, 1)) {
+                       if (!ext4_inode_block_valid(inode, nr, 1)) {
                                EXT4_ERROR_INODE(inode,
                                                 "invalid indirect mapped "
                                                 "block %lu (level %d)",
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 87430d276bcc..d074ee4a7085 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -384,8 +384,7 @@ static int __check_block_validity(struct inode *inode, 
const char *func,
            (inode->i_ino ==
             le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum)))
                return 0;
-       if (!ext4_data_block_valid(EXT4_SB(inode->i_sb), map->m_pblk,
-                                  map->m_len)) {
+       if (!ext4_inode_block_valid(inode, map->m_pblk, map->m_len)) {
                ext4_error_inode(inode, func, line, map->m_pblk,
                                 "lblock %lu mapped to illegal pblock %llu "
                                 "(length %d)", (unsigned long) map->m_lblk,
@@ -4747,7 +4746,7 @@ struct inode *__ext4_iget(struct super_block *sb, 
unsigned long ino,
 
        ret = 0;
        if (ei->i_file_acl &&
-           !ext4_data_block_valid(EXT4_SB(sb), ei->i_file_acl, 1)) {
+           !ext4_inode_block_valid(inode, ei->i_file_acl, 1)) {
                ext4_error_inode(inode, function, line, 0,
                                 "iget: bad extended attribute block %llu",
                                 ei->i_file_acl);
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 30d5d97548c4..0461e82aba35 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2992,7 +2992,7 @@ ext4_mb_mark_diskspace_used(struct 
ext4_allocation_context *ac,
        block = ext4_grp_offs_to_block(sb, &ac->ac_b_ex);
 
        len = EXT4_C2B(sbi, ac->ac_b_ex.fe_len);
-       if (!ext4_data_block_valid(sbi, block, len)) {
+       if (!ext4_inode_block_valid(ac->ac_inode, block, len)) {
                ext4_error(sb, "Allocating blocks %llu-%llu which overlap "
                           "fs metadata", block, block+len);
                /* File system mounted not to panic on error
@@ -4759,7 +4759,7 @@ void ext4_free_blocks(handle_t *handle, struct inode 
*inode,
 
        sbi = EXT4_SB(sb);
        if (!(flags & EXT4_FREE_BLOCKS_VALIDATED) &&
-           !ext4_data_block_valid(sbi, block, count)) {
+           !ext4_inode_block_valid(inode, block, count)) {
                ext4_error(sb, "Freeing blocks not in datazone - "
                           "block = %llu, count = %lu", block, count);
                goto error_return;
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 56738b538ddf..a91a5bb8c3a2 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1396,8 +1396,8 @@ int ext4_search_dir(struct buffer_head *bh, char 
*search_buf, int buf_size,
                    ext4_match(dir, fname, de)) {
                        /* found a match - just to be sure, do
                         * a full check */
-                       if (ext4_check_dir_entry(dir, NULL, de, bh, bh->b_data,
-                                                bh->b_size, offset))
+                       if (ext4_check_dir_entry(dir, NULL, de, bh, search_buf,
+                                                buf_size, offset))
                                return -1;
                        *res_dir = de;
                        return 1;
@@ -1858,7 +1858,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t 
*handle, struct inode *dir,
                             blocksize, hinfo, map);
        map -= count;
        dx_sort_map(map, count);
-       /* Split the existing block in the middle, size-wise */
+       /* Ensure that neither split block is over half full */
        size = 0;
        move = 0;
        for (i = count-1; i >= 0; i--) {
@@ -1868,8 +1868,18 @@ static struct ext4_dir_entry_2 *do_split(handle_t 
*handle, struct inode *dir,
                size += map[i].size;
                move++;
        }
-       /* map index at which we will split */
-       split = count - move;
+       /*
+        * map index at which we will split
+        *
+        * If the sum of active entries didn't exceed half the block size, just
+        * split it in half by count; each resulting block will have at least
+        * half the space free.
+        */
+       if (i > 0)
+               split = count - move;
+       else
+               split = count/2;
+
        hash2 = map[split].hash;
        continued = hash2 == map[split - 1].hash;
        dxtrace(printk(KERN_INFO "Split block %lu at %x, %i/%i\n",
@@ -2472,7 +2482,7 @@ int ext4_generic_delete_entry(handle_t *handle,
        de = (struct ext4_dir_entry_2 *)entry_buf;
        while (i < buf_size - csum_size) {
                if (ext4_check_dir_entry(dir, NULL, de, bh,
-                                        bh->b_data, bh->b_size, i))
+                                        entry_buf, buf_size, i))
                        return -EFSCORRUPTED;
                if (de == de_del)  {
                        if (pde)
diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
index 527d50edcb95..b397121dfa10 100644
--- a/fs/f2fs/compress.c
+++ b/fs/f2fs/compress.c
@@ -1207,6 +1207,12 @@ static int f2fs_write_raw_pages(struct compress_ctx *cc,
                                congestion_wait(BLK_RW_ASYNC,
                                                DEFAULT_IO_TIMEOUT);
                                lock_page(cc->rpages[i]);
+
+                               if (!PageDirty(cc->rpages[i])) {
+                                       unlock_page(cc->rpages[i]);
+                                       continue;
+                               }
+
                                clear_page_dirty_for_io(cc->rpages[i]);
                                goto retry_write;
                        }
diff --git a/fs/io-wq.c b/fs/io-wq.c
index 4023c9846860..2bfa9117bc28 100644
--- a/fs/io-wq.c
+++ b/fs/io-wq.c
@@ -907,13 +907,15 @@ void io_wq_cancel_all(struct io_wq *wq)
 struct io_cb_cancel_data {
        work_cancel_fn *fn;
        void *data;
+       int nr_running;
+       int nr_pending;
+       bool cancel_all;
 };
 
 static bool io_wq_worker_cancel(struct io_worker *worker, void *data)
 {
        struct io_cb_cancel_data *match = data;
        unsigned long flags;
-       bool ret = false;
 
        /*
         * Hold the lock to avoid ->cur_work going out of scope, caller
@@ -924,74 +926,90 @@ static bool io_wq_worker_cancel(struct io_worker *worker, 
void *data)
            !(worker->cur_work->flags & IO_WQ_WORK_NO_CANCEL) &&
            match->fn(worker->cur_work, match->data)) {
                send_sig(SIGINT, worker->task, 1);
-               ret = true;
+               match->nr_running++;
        }
        spin_unlock_irqrestore(&worker->lock, flags);
 
-       return ret;
+       return match->nr_running && !match->cancel_all;
 }
 
-static enum io_wq_cancel io_wqe_cancel_work(struct io_wqe *wqe,
-                                           struct io_cb_cancel_data *match)
+static void io_wqe_cancel_pending_work(struct io_wqe *wqe,
+                                      struct io_cb_cancel_data *match)
 {
        struct io_wq_work_node *node, *prev;
        struct io_wq_work *work;
        unsigned long flags;
-       bool found = false;
 
-       /*
-        * First check pending list, if we're lucky we can just remove it
-        * from there. CANCEL_OK means that the work is returned as-new,
-        * no completion will be posted for it.
-        */
+retry:
        spin_lock_irqsave(&wqe->lock, flags);
        wq_list_for_each(node, prev, &wqe->work_list) {
                work = container_of(node, struct io_wq_work, list);
+               if (!match->fn(work, match->data))
+                       continue;
 
-               if (match->fn(work, match->data)) {
-                       wq_list_del(&wqe->work_list, node, prev);
-                       found = true;
-                       break;
-               }
-       }
-       spin_unlock_irqrestore(&wqe->lock, flags);
-
-       if (found) {
+               wq_list_del(&wqe->work_list, node, prev);
+               spin_unlock_irqrestore(&wqe->lock, flags);
                io_run_cancel(work, wqe);
-               return IO_WQ_CANCEL_OK;
+               match->nr_pending++;
+               if (!match->cancel_all)
+                       return;
+
+               /* not safe to continue after unlock */
+               goto retry;
        }
+       spin_unlock_irqrestore(&wqe->lock, flags);
+}
 
-       /*
-        * Now check if a free (going busy) or busy worker has the work
-        * currently running. If we find it there, we'll return CANCEL_RUNNING
-        * as an indication that we attempt to signal cancellation. The
-        * completion will run normally in this case.
-        */
+static void io_wqe_cancel_running_work(struct io_wqe *wqe,
+                                      struct io_cb_cancel_data *match)
+{
        rcu_read_lock();
-       found = io_wq_for_each_worker(wqe, io_wq_worker_cancel, match);
+       io_wq_for_each_worker(wqe, io_wq_worker_cancel, match);
        rcu_read_unlock();
-       return found ? IO_WQ_CANCEL_RUNNING : IO_WQ_CANCEL_NOTFOUND;
 }
 
 enum io_wq_cancel io_wq_cancel_cb(struct io_wq *wq, work_cancel_fn *cancel,
-                                 void *data)
+                                 void *data, bool cancel_all)
 {
        struct io_cb_cancel_data match = {
-               .fn     = cancel,
-               .data   = data,
+               .fn             = cancel,
+               .data           = data,
+               .cancel_all     = cancel_all,
        };
-       enum io_wq_cancel ret = IO_WQ_CANCEL_NOTFOUND;
        int node;
 
+       /*
+        * First check pending list, if we're lucky we can just remove it
+        * from there. CANCEL_OK means that the work is returned as-new,
+        * no completion will be posted for it.
+        */
        for_each_node(node) {
                struct io_wqe *wqe = wq->wqes[node];
 
-               ret = io_wqe_cancel_work(wqe, &match);
-               if (ret != IO_WQ_CANCEL_NOTFOUND)
-                       break;
+               io_wqe_cancel_pending_work(wqe, &match);
+               if (match.nr_pending && !match.cancel_all)
+                       return IO_WQ_CANCEL_OK;
        }
 
-       return ret;
+       /*
+        * Now check if a free (going busy) or busy worker has the work
+        * currently running. If we find it there, we'll return CANCEL_RUNNING
+        * as an indication that we attempt to signal cancellation. The
+        * completion will run normally in this case.
+        */
+       for_each_node(node) {
+               struct io_wqe *wqe = wq->wqes[node];
+
+               io_wqe_cancel_running_work(wqe, &match);
+               if (match.nr_running && !match.cancel_all)
+                       return IO_WQ_CANCEL_RUNNING;
+       }
+
+       if (match.nr_running)
+               return IO_WQ_CANCEL_RUNNING;
+       if (match.nr_pending)
+               return IO_WQ_CANCEL_OK;
+       return IO_WQ_CANCEL_NOTFOUND;
 }
 
 static bool io_wq_io_cb_cancel_data(struct io_wq_work *work, void *data)
@@ -1001,21 +1019,7 @@ static bool io_wq_io_cb_cancel_data(struct io_wq_work 
*work, void *data)
 
 enum io_wq_cancel io_wq_cancel_work(struct io_wq *wq, struct io_wq_work *cwork)
 {
-       return io_wq_cancel_cb(wq, io_wq_io_cb_cancel_data, (void *)cwork);
-}
-
-static bool io_wq_pid_match(struct io_wq_work *work, void *data)
-{
-       pid_t pid = (pid_t) (unsigned long) data;
-
-       return work->task_pid == pid;
-}
-
-enum io_wq_cancel io_wq_cancel_pid(struct io_wq *wq, pid_t pid)
-{
-       void *data = (void *) (unsigned long) pid;
-
-       return io_wq_cancel_cb(wq, io_wq_pid_match, data);
+       return io_wq_cancel_cb(wq, io_wq_io_cb_cancel_data, (void *)cwork, 
false);
 }
 
 struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data)
diff --git a/fs/io-wq.h b/fs/io-wq.h
index 5ba12de7572f..df8a4cd3236d 100644
--- a/fs/io-wq.h
+++ b/fs/io-wq.h
@@ -129,12 +129,11 @@ static inline bool io_wq_is_hashed(struct io_wq_work 
*work)
 
 void io_wq_cancel_all(struct io_wq *wq);
 enum io_wq_cancel io_wq_cancel_work(struct io_wq *wq, struct io_wq_work 
*cwork);
-enum io_wq_cancel io_wq_cancel_pid(struct io_wq *wq, pid_t pid);
 
 typedef bool (work_cancel_fn)(struct io_wq_work *, void *);
 
 enum io_wq_cancel io_wq_cancel_cb(struct io_wq *wq, work_cancel_fn *cancel,
-                                       void *data);
+                                       void *data, bool cancel_all);
 
 struct task_struct *io_wq_get_task(struct io_wq *wq);
 
diff --git a/fs/io_uring.c b/fs/io_uring.c
index b33d4a97a877..0822a16bed9a 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5023,7 +5023,7 @@ static int io_async_cancel_one(struct io_ring_ctx *ctx, 
void *sqe_addr)
        enum io_wq_cancel cancel_ret;
        int ret = 0;
 
-       cancel_ret = io_wq_cancel_cb(ctx->io_wq, io_cancel_cb, sqe_addr);
+       cancel_ret = io_wq_cancel_cb(ctx->io_wq, io_cancel_cb, sqe_addr, false);
        switch (cancel_ret) {
        case IO_WQ_CANCEL_OK:
                ret = 0;
@@ -7659,6 +7659,33 @@ static bool io_timeout_remove_link(struct io_ring_ctx 
*ctx,
        return found;
 }
 
+static bool io_cancel_link_cb(struct io_wq_work *work, void *data)
+{
+       return io_match_link(container_of(work, struct io_kiocb, work), data);
+}
+
+static void io_attempt_cancel(struct io_ring_ctx *ctx, struct io_kiocb *req)
+{
+       enum io_wq_cancel cret;
+
+       /* cancel this particular work, if it's running */
+       cret = io_wq_cancel_work(ctx->io_wq, &req->work);
+       if (cret != IO_WQ_CANCEL_NOTFOUND)
+               return;
+
+       /* find links that hold this pending, cancel those */
+       cret = io_wq_cancel_cb(ctx->io_wq, io_cancel_link_cb, req, true);
+       if (cret != IO_WQ_CANCEL_NOTFOUND)
+               return;
+
+       /* if we have a poll link holding this pending, cancel that */
+       if (io_poll_remove_link(ctx, req))
+               return;
+
+       /* final option, timeout link is holding this req pending */
+       io_timeout_remove_link(ctx, req);
+}
+
 static void io_uring_cancel_files(struct io_ring_ctx *ctx,
                                  struct files_struct *files)
 {
@@ -7708,10 +7735,8 @@ static void io_uring_cancel_files(struct io_ring_ctx 
*ctx,
                                continue;
                        }
                } else {
-                       io_wq_cancel_work(ctx->io_wq, &cancel_req->work);
-                       /* could be a link, check and remove if it is */
-                       if (!io_poll_remove_link(ctx, cancel_req))
-                               io_timeout_remove_link(ctx, cancel_req);
+                       /* cancel this request, or head link requests */
+                       io_attempt_cancel(ctx, cancel_req);
                        io_put_req(cancel_req);
                }
 
@@ -7720,6 +7745,13 @@ static void io_uring_cancel_files(struct io_ring_ctx 
*ctx,
        }
 }
 
+static bool io_cancel_pid_cb(struct io_wq_work *work, void *data)
+{
+       pid_t pid = (pid_t) (unsigned long) data;
+
+       return work->task_pid == pid;
+}
+
 static int io_uring_flush(struct file *file, void *data)
 {
        struct io_ring_ctx *ctx = file->private_data;
@@ -7729,8 +7761,11 @@ static int io_uring_flush(struct file *file, void *data)
        /*
         * If the task is going away, cancel work it may have pending
         */
-       if (fatal_signal_pending(current) || (current->flags & PF_EXITING))
-               io_wq_cancel_pid(ctx->io_wq, task_pid_vnr(current));
+       if (fatal_signal_pending(current) || (current->flags & PF_EXITING)) {
+               void *data = (void *) (unsigned long)task_pid_vnr(current);
+
+               io_wq_cancel_cb(ctx->io_wq, io_cancel_pid_cb, data, true);
+       }
 
        return 0;
 }
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index e4944436e733..5493a0da23dd 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1367,8 +1367,10 @@ static int jbd2_write_superblock(journal_t *journal, int 
write_flags)
        int ret;
 
        /* Buffer got discarded which means block device got invalidated */
-       if (!buffer_mapped(bh))
+       if (!buffer_mapped(bh)) {
+               unlock_buffer(bh);
                return -EIO;
+       }
 
        trace_jbd2_write_superblock(journal, write_flags);
        if (!(journal->j_flags & JBD2_BARRIER))
diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c
index f20cff1194bb..776493713153 100644
--- a/fs/jffs2/dir.c
+++ b/fs/jffs2/dir.c
@@ -590,10 +590,14 @@ static int jffs2_rmdir (struct inode *dir_i, struct 
dentry *dentry)
        int ret;
        uint32_t now = JFFS2_NOW();
 
+       mutex_lock(&f->sem);
        for (fd = f->dents ; fd; fd = fd->next) {
-               if (fd->ino)
+               if (fd->ino) {
+                       mutex_unlock(&f->sem);
                        return -ENOTEMPTY;
+               }
        }
+       mutex_unlock(&f->sem);
 
        ret = jffs2_do_unlink(c, dir_f, dentry->d_name.name,
                              dentry->d_name.len, f, now);
diff --git a/fs/romfs/storage.c b/fs/romfs/storage.c
index 6b2b4362089e..b57b3ffcbc32 100644
--- a/fs/romfs/storage.c
+++ b/fs/romfs/storage.c
@@ -217,10 +217,8 @@ int romfs_dev_read(struct super_block *sb, unsigned long 
pos,
        size_t limit;
 
        limit = romfs_maxsize(sb);
-       if (pos >= limit)
+       if (pos >= limit || buflen > limit - pos)
                return -EIO;
-       if (buflen > limit - pos)
-               buflen = limit - pos;
 
 #ifdef CONFIG_ROMFS_ON_MTD
        if (sb->s_mtd)
diff --git a/fs/signalfd.c b/fs/signalfd.c
index 44b6845b071c..5b78719be445 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -314,9 +314,10 @@ SYSCALL_DEFINE4(signalfd4, int, ufd, sigset_t __user *, 
user_mask,
 {
        sigset_t mask;
 
-       if (sizemask != sizeof(sigset_t) ||
-           copy_from_user(&mask, user_mask, sizeof(mask)))
+       if (sizemask != sizeof(sigset_t))
                return -EINVAL;
+       if (copy_from_user(&mask, user_mask, sizeof(mask)))
+               return -EFAULT;
        return do_signalfd4(ufd, &mask, flags);
 }
 
@@ -325,9 +326,10 @@ SYSCALL_DEFINE3(signalfd, int, ufd, sigset_t __user *, 
user_mask,
 {
        sigset_t mask;
 
-       if (sizemask != sizeof(sigset_t) ||
-           copy_from_user(&mask, user_mask, sizeof(mask)))
+       if (sizemask != sizeof(sigset_t))
                return -EINVAL;
+       if (copy_from_user(&mask, user_mask, sizeof(mask)))
+               return -EFAULT;
        return do_signalfd4(ufd, &mask, 0);
 }
 
diff --git a/fs/xfs/xfs_sysfs.h b/fs/xfs/xfs_sysfs.h
index e9f810fc6731..43585850f154 100644
--- a/fs/xfs/xfs_sysfs.h
+++ b/fs/xfs/xfs_sysfs.h
@@ -32,9 +32,11 @@ xfs_sysfs_init(
        struct xfs_kobj         *parent_kobj,
        const char              *name)
 {
+       struct kobject          *parent;
+
+       parent = parent_kobj ? &parent_kobj->kobject : NULL;
        init_completion(&kobj->complete);
-       return kobject_init_and_add(&kobj->kobject, ktype,
-                                   &parent_kobj->kobject, "%s", name);
+       return kobject_init_and_add(&kobj->kobject, ktype, parent, "%s", name);
 }
 
 static inline void
diff --git a/fs/xfs/xfs_trans_dquot.c b/fs/xfs/xfs_trans_dquot.c
index d1b9869bc5fa..af3636a99bf6 100644
--- a/fs/xfs/xfs_trans_dquot.c
+++ b/fs/xfs/xfs_trans_dquot.c
@@ -647,7 +647,7 @@ xfs_trans_dqresv(
                        }
                }
                if (ninos > 0) {
-                       total_count = be64_to_cpu(dqp->q_core.d_icount) + ninos;
+                       total_count = dqp->q_res_icount + ninos;
                        timer = be32_to_cpu(dqp->q_core.d_itimer);
                        warns = be16_to_cpu(dqp->q_core.d_iwarns);
                        warnlimit = dqp->q_mount->m_quotainfo->qi_iwarnlimit;
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 8e1f7165162c..d92d3e729bc7 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -211,7 +211,7 @@ static int __replace_page(struct vm_area_struct *vma, 
unsigned long addr,
                try_to_free_swap(old_page);
        page_vma_mapped_walk_done(&pvmw);
 
-       if (vma->vm_flags & VM_LOCKED)
+       if ((vma->vm_flags & VM_LOCKED) && !PageCompound(old_page))
                munlock_vma_page(old_page);
        put_page(old_page);
 
diff --git a/kernel/relay.c b/kernel/relay.c
index 4b760ec16342..d3940becf2fc 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -197,6 +197,7 @@ static struct rchan_buf *relay_create_buf(struct rchan 
*chan)
 static void relay_destroy_channel(struct kref *kref)
 {
        struct rchan *chan = container_of(kref, struct rchan, kref);
+       free_percpu(chan->buf);
        kfree(chan);
 }
 
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index 38874fe112d5..cb17091d0a20 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -400,7 +400,7 @@ static void insert_to_mm_slots_hash(struct mm_struct *mm,
 
 static inline int khugepaged_test_exit(struct mm_struct *mm)
 {
-       return atomic_read(&mm->mm_users) == 0;
+       return atomic_read(&mm->mm_users) == 0 || !mmget_still_valid(mm);
 }
 
 static bool hugepage_vma_check(struct vm_area_struct *vma,
@@ -435,7 +435,7 @@ int __khugepaged_enter(struct mm_struct *mm)
                return -ENOMEM;
 
        /* __khugepaged_exit() must not run from under us */
-       VM_BUG_ON_MM(khugepaged_test_exit(mm), mm);
+       VM_BUG_ON_MM(atomic_read(&mm->mm_users) == 0, mm);
        if (unlikely(test_and_set_bit(MMF_VM_HUGEPAGE, &mm->flags))) {
                free_mm_slot(mm_slot);
                return 0;
@@ -1016,9 +1016,6 @@ static void collapse_huge_page(struct mm_struct *mm,
         * handled by the anon_vma lock + PG_lock.
         */
        down_write(&mm->mmap_sem);
-       result = SCAN_ANY_PROCESS;
-       if (!mmget_still_valid(mm))
-               goto out;
        result = hugepage_vma_revalidate(mm, address, &vma);
        if (result)
                goto out;
diff --git a/mm/memory.c b/mm/memory.c
index 22d218bc56c8..44d848b291b4 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4237,6 +4237,9 @@ static vm_fault_t handle_pte_fault(struct vm_fault *vmf)
                                vmf->flags & FAULT_FLAG_WRITE)) {
                update_mmu_cache(vmf->vma, vmf->address, vmf->pte);
        } else {
+               /* Skip spurious TLB flush for retried page fault */
+               if (vmf->flags & FAULT_FLAG_TRIED)
+                       goto unlock;
                /*
                 * This is needed only for protection faults but the arch code
                 * is not yet telling us if this is a protection fault or not.
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index d0c0d9364aa6..398dd6c90ad0 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1308,6 +1308,11 @@ static void free_pcppages_bulk(struct zone *zone, int 
count,
        struct page *page, *tmp;
        LIST_HEAD(head);
 
+       /*
+        * Ensure proper count is passed which otherwise would stuck in the
+        * below while (list_empty(list)) loop.
+        */
+       count = min(pcp->count, count);
        while (count) {
                struct list_head *list;
 
@@ -7959,7 +7964,7 @@ int __meminit init_per_zone_wmark_min(void)
 
        return 0;
 }
-core_initcall(init_per_zone_wmark_min)
+postcore_initcall(init_per_zone_wmark_min)
 
 /*
  * min_free_kbytes_sysctl_handler - just a wrapper around proc_dointvec() so
diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c
index f7587428febd..bf9fd6ee88fe 100644
--- a/net/can/j1939/socket.c
+++ b/net/can/j1939/socket.c
@@ -398,6 +398,7 @@ static int j1939_sk_init(struct sock *sk)
        spin_lock_init(&jsk->sk_session_queue_lock);
        INIT_LIST_HEAD(&jsk->sk_session_queue);
        sk->sk_destruct = j1939_sk_sock_destruct;
+       sk->sk_protocol = CAN_J1939;
 
        return 0;
 }
@@ -466,6 +467,14 @@ static int j1939_sk_bind(struct socket *sock, struct 
sockaddr *uaddr, int len)
                        goto out_release_sock;
                }
 
+               if (!ndev->ml_priv) {
+                       netdev_warn_once(ndev,
+                                        "No CAN mid layer private allocated, 
please fix your driver and use alloc_candev()!\n");
+                       dev_put(ndev);
+                       ret = -ENODEV;
+                       goto out_release_sock;
+               }
+
                priv = j1939_netdev_start(ndev);
                dev_put(ndev);
                if (IS_ERR(priv)) {
@@ -553,6 +562,11 @@ static int j1939_sk_connect(struct socket *sock, struct 
sockaddr *uaddr,
 static void j1939_sk_sock2sockaddr_can(struct sockaddr_can *addr,
                                       const struct j1939_sock *jsk, int peer)
 {
+       /* There are two holes (2 bytes and 3 bytes) to clear to avoid
+        * leaking kernel information to user space.
+        */
+       memset(addr, 0, J1939_MIN_NAMELEN);
+
        addr->can_family = AF_CAN;
        addr->can_ifindex = jsk->ifindex;
        addr->can_addr.j1939.pgn = jsk->addr.pgn;
diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index 9f99af5b0b11..dbd215cbc53d 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -352,17 +352,16 @@ void j1939_session_skb_queue(struct j1939_session 
*session,
        skb_queue_tail(&session->skb_queue, skb);
 }
 
-static struct sk_buff *j1939_session_skb_find(struct j1939_session *session)
+static struct
+sk_buff *j1939_session_skb_find_by_offset(struct j1939_session *session,
+                                         unsigned int offset_start)
 {
        struct j1939_priv *priv = session->priv;
+       struct j1939_sk_buff_cb *do_skcb;
        struct sk_buff *skb = NULL;
        struct sk_buff *do_skb;
-       struct j1939_sk_buff_cb *do_skcb;
-       unsigned int offset_start;
        unsigned long flags;
 
-       offset_start = session->pkt.dpo * 7;
-
        spin_lock_irqsave(&session->skb_queue.lock, flags);
        skb_queue_walk(&session->skb_queue, do_skb) {
                do_skcb = j1939_skb_to_cb(do_skb);
@@ -382,6 +381,14 @@ static struct sk_buff *j1939_session_skb_find(struct 
j1939_session *session)
        return skb;
 }
 
+static struct sk_buff *j1939_session_skb_find(struct j1939_session *session)
+{
+       unsigned int offset_start;
+
+       offset_start = session->pkt.dpo * 7;
+       return j1939_session_skb_find_by_offset(session, offset_start);
+}
+
 /* see if we are receiver
  * returns 0 for broadcasts, although we will receive them
  */
@@ -716,10 +723,12 @@ static int j1939_session_tx_rts(struct j1939_session 
*session)
                return ret;
 
        session->last_txcmd = dat[0];
-       if (dat[0] == J1939_TP_CMD_BAM)
+       if (dat[0] == J1939_TP_CMD_BAM) {
                j1939_tp_schedule_txtimer(session, 50);
-
-       j1939_tp_set_rxtimeout(session, 1250);
+               j1939_tp_set_rxtimeout(session, 250);
+       } else {
+               j1939_tp_set_rxtimeout(session, 1250);
+       }
 
        netdev_dbg(session->priv->ndev, "%s: 0x%p\n", __func__, session);
 
@@ -766,7 +775,7 @@ static int j1939_session_tx_dat(struct j1939_session 
*session)
        int ret = 0;
        u8 dat[8];
 
-       se_skb = j1939_session_skb_find(session);
+       se_skb = j1939_session_skb_find_by_offset(session, session->pkt.tx * 7);
        if (!se_skb)
                return -ENOBUFS;
 
@@ -787,6 +796,18 @@ static int j1939_session_tx_dat(struct j1939_session 
*session)
                if (len > 7)
                        len = 7;
 
+               if (offset + len > se_skb->len) {
+                       netdev_err_once(priv->ndev,
+                                       "%s: 0x%p: requested data outside of 
queued buffer: offset %i, len %i, pkt.tx: %i\n",
+                                       __func__, session, skcb->offset, 
se_skb->len , session->pkt.tx);
+                       return -EOVERFLOW;
+               }
+
+               if (!len) {
+                       ret = -ENOBUFS;
+                       break;
+               }
+
                memcpy(&dat[1], &tpdat[offset], len);
                ret = j1939_tp_tx_dat(session, dat, len + 1);
                if (ret < 0) {
@@ -1055,9 +1076,9 @@ static void __j1939_session_cancel(struct j1939_session 
*session,
        lockdep_assert_held(&session->priv->active_session_list_lock);
 
        session->err = j1939_xtp_abort_to_errno(priv, err);
+       session->state = J1939_SESSION_WAITING_ABORT;
        /* do not send aborts on incoming broadcasts */
        if (!j1939_cb_is_broadcast(&session->skcb)) {
-               session->state = J1939_SESSION_WAITING_ABORT;
                j1939_xtp_tx_abort(priv, &session->skcb,
                                   !session->transmission,
                                   err, session->skcb.addr.pgn);
@@ -1120,6 +1141,9 @@ static enum hrtimer_restart j1939_tp_txtimer(struct 
hrtimer *hrtimer)
                 * cleanup including propagation of the error to user space.
                 */
                break;
+       case -EOVERFLOW:
+               j1939_session_cancel(session, J1939_XTP_ABORT_ECTS_TOO_BIG);
+               break;
        case 0:
                session->tx_retry = 0;
                break;
@@ -1651,8 +1675,12 @@ static void j1939_xtp_rx_rts(struct j1939_priv *priv, 
struct sk_buff *skb,
                        return;
                }
                session = j1939_xtp_rx_rts_session_new(priv, skb);
-               if (!session)
+               if (!session) {
+                       if (cmd == J1939_TP_CMD_BAM && 
j1939_sk_recv_match(priv, skcb))
+                               netdev_info(priv->ndev, "%s: failed to create 
TP BAM session\n",
+                                           __func__);
                        return;
+               }
        } else {
                if (j1939_xtp_rx_rts_session_active(session, skb)) {
                        j1939_session_put(session);
@@ -1661,11 +1689,15 @@ static void j1939_xtp_rx_rts(struct j1939_priv *priv, 
struct sk_buff *skb,
        }
        session->last_cmd = cmd;
 
-       j1939_tp_set_rxtimeout(session, 1250);
-
-       if (cmd != J1939_TP_CMD_BAM && !session->transmission) {
-               j1939_session_txtimer_cancel(session);
-               j1939_tp_schedule_txtimer(session, 0);
+       if (cmd == J1939_TP_CMD_BAM) {
+               if (!session->transmission)
+                       j1939_tp_set_rxtimeout(session, 750);
+       } else {
+               if (!session->transmission) {
+                       j1939_session_txtimer_cancel(session);
+                       j1939_tp_schedule_txtimer(session, 0);
+               }
+               j1939_tp_set_rxtimeout(session, 1250);
        }
 
        j1939_session_put(session);
@@ -1716,6 +1748,7 @@ static void j1939_xtp_rx_dat_one(struct j1939_session 
*session,
        int offset;
        int nbytes;
        bool final = false;
+       bool remain = false;
        bool do_cts_eoma = false;
        int packet;
 
@@ -1750,7 +1783,8 @@ static void j1939_xtp_rx_dat_one(struct j1939_session 
*session,
                            __func__, session);
                goto out_session_cancel;
        }
-       se_skb = j1939_session_skb_find(session);
+
+       se_skb = j1939_session_skb_find_by_offset(session, packet * 7);
        if (!se_skb) {
                netdev_warn(priv->ndev, "%s: 0x%p: no skb found\n", __func__,
                            session);
@@ -1777,6 +1811,8 @@ static void j1939_xtp_rx_dat_one(struct j1939_session 
*session,
            j1939_cb_is_broadcast(&session->skcb)) {
                if (session->pkt.rx >= session->pkt.total)
                        final = true;
+               else
+                       remain = true;
        } else {
                /* never final, an EOMA must follow */
                if (session->pkt.rx >= session->pkt.last)
@@ -1784,7 +1820,11 @@ static void j1939_xtp_rx_dat_one(struct j1939_session 
*session,
        }
 
        if (final) {
+               j1939_session_timers_cancel(session);
                j1939_session_completed(session);
+       } else if (remain) {
+               if (!session->transmission)
+                       j1939_tp_set_rxtimeout(session, 750);
        } else if (do_cts_eoma) {
                j1939_tp_set_rxtimeout(session, 1250);
                if (!session->transmission)
@@ -1829,6 +1869,13 @@ static void j1939_xtp_rx_dat(struct j1939_priv *priv, 
struct sk_buff *skb)
                else
                        j1939_xtp_rx_dat_one(session, skb);
        }
+
+       if (j1939_cb_is_broadcast(skcb)) {
+               session = j1939_session_get_by_addr(priv, &skcb->addr, false,
+                                                   false);
+               if (session)
+                       j1939_xtp_rx_dat_one(session, skb);
+       }
 }
 
 /* j1939 main intf */
@@ -1920,7 +1967,7 @@ static void j1939_tp_cmd_recv(struct j1939_priv *priv, 
struct sk_buff *skb)
                if (j1939_tp_im_transmitter(skcb))
                        j1939_xtp_rx_rts(priv, skb, true);
 
-               if (j1939_tp_im_receiver(skcb))
+               if (j1939_tp_im_receiver(skcb) || j1939_cb_is_broadcast(skcb))
                        j1939_xtp_rx_rts(priv, skb, false);
 
                break;
@@ -1984,7 +2031,7 @@ int j1939_tp_recv(struct j1939_priv *priv, struct sk_buff 
*skb)
 {
        struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
 
-       if (!j1939_tp_im_involved_anydir(skcb))
+       if (!j1939_tp_im_involved_anydir(skcb) && !j1939_cb_is_broadcast(skcb))
                return 0;
 
        switch (skcb->addr.pgn) {
@@ -2017,6 +2064,10 @@ void j1939_simple_recv(struct j1939_priv *priv, struct 
sk_buff *skb)
        if (!skb->sk)
                return;
 
+       if (skb->sk->sk_family != AF_CAN ||
+           skb->sk->sk_protocol != CAN_J1939)
+               return;
+
        j1939_session_list_lock(priv);
        session = j1939_session_get_simple(priv, skb);
        j1939_session_list_unlock(priv);
diff --git a/net/core/filter.c b/net/core/filter.c
index cebbb6ba9ed9..9c0370260012 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -8066,15 +8066,31 @@ static u32 sock_ops_convert_ctx_access(enum 
bpf_access_type type,
 /* Helper macro for adding read access to tcp_sock or sock fields. */
 #define SOCK_OPS_GET_FIELD(BPF_FIELD, OBJ_FIELD, OBJ)                        \
        do {                                                                  \
+               int fullsock_reg = si->dst_reg, reg = BPF_REG_9, jmp = 2;     \
                BUILD_BUG_ON(sizeof_field(OBJ, OBJ_FIELD) >                   \
                             sizeof_field(struct bpf_sock_ops, BPF_FIELD));   \
+               if (si->dst_reg == reg || si->src_reg == reg)                 \
+                       reg--;                                                \
+               if (si->dst_reg == reg || si->src_reg == reg)                 \
+                       reg--;                                                \
+               if (si->dst_reg == si->src_reg) {                             \
+                       *insn++ = BPF_STX_MEM(BPF_DW, si->src_reg, reg,       \
+                                         offsetof(struct bpf_sock_ops_kern,  \
+                                         temp));                             \
+                       fullsock_reg = reg;                                   \
+                       jmp += 2;                                             \
+               }                                                             \
                *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(                       \
                                                struct bpf_sock_ops_kern,     \
                                                is_fullsock),                 \
-                                     si->dst_reg, si->src_reg,               \
+                                     fullsock_reg, si->src_reg,              \
                                      offsetof(struct bpf_sock_ops_kern,      \
                                               is_fullsock));                 \
-               *insn++ = BPF_JMP_IMM(BPF_JEQ, si->dst_reg, 0, 2);            \
+               *insn++ = BPF_JMP_IMM(BPF_JEQ, fullsock_reg, 0, jmp);         \
+               if (si->dst_reg == si->src_reg)                               \
+                       *insn++ = BPF_LDX_MEM(BPF_DW, reg, si->src_reg,       \
+                                     offsetof(struct bpf_sock_ops_kern,      \
+                                     temp));                                 \
                *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(                       \
                                                struct bpf_sock_ops_kern, sk),\
                                      si->dst_reg, si->src_reg,               \
@@ -8083,6 +8099,49 @@ static u32 sock_ops_convert_ctx_access(enum 
bpf_access_type type,
                                                       OBJ_FIELD),            \
                                      si->dst_reg, si->dst_reg,               \
                                      offsetof(OBJ, OBJ_FIELD));              \
+               if (si->dst_reg == si->src_reg) {                             \
+                       *insn++ = BPF_JMP_A(1);                               \
+                       *insn++ = BPF_LDX_MEM(BPF_DW, reg, si->src_reg,       \
+                                     offsetof(struct bpf_sock_ops_kern,      \
+                                     temp));                                 \
+               }                                                             \
+       } while (0)
+
+#define SOCK_OPS_GET_SK()                                                      
      \
+       do {                                                                  \
+               int fullsock_reg = si->dst_reg, reg = BPF_REG_9, jmp = 1;     \
+               if (si->dst_reg == reg || si->src_reg == reg)                 \
+                       reg--;                                                \
+               if (si->dst_reg == reg || si->src_reg == reg)                 \
+                       reg--;                                                \
+               if (si->dst_reg == si->src_reg) {                             \
+                       *insn++ = BPF_STX_MEM(BPF_DW, si->src_reg, reg,       \
+                                         offsetof(struct bpf_sock_ops_kern,  \
+                                         temp));                             \
+                       fullsock_reg = reg;                                   \
+                       jmp += 2;                                             \
+               }                                                             \
+               *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(                       \
+                                               struct bpf_sock_ops_kern,     \
+                                               is_fullsock),                 \
+                                     fullsock_reg, si->src_reg,              \
+                                     offsetof(struct bpf_sock_ops_kern,      \
+                                              is_fullsock));                 \
+               *insn++ = BPF_JMP_IMM(BPF_JEQ, fullsock_reg, 0, jmp);         \
+               if (si->dst_reg == si->src_reg)                               \
+                       *insn++ = BPF_LDX_MEM(BPF_DW, reg, si->src_reg,       \
+                                     offsetof(struct bpf_sock_ops_kern,      \
+                                     temp));                                 \
+               *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(                       \
+                                               struct bpf_sock_ops_kern, sk),\
+                                     si->dst_reg, si->src_reg,               \
+                                     offsetof(struct bpf_sock_ops_kern, sk));\
+               if (si->dst_reg == si->src_reg) {                             \
+                       *insn++ = BPF_JMP_A(1);                               \
+                       *insn++ = BPF_LDX_MEM(BPF_DW, reg, si->src_reg,       \
+                                     offsetof(struct bpf_sock_ops_kern,      \
+                                     temp));                                 \
+               }                                                             \
        } while (0)
 
 #define SOCK_OPS_GET_TCP_SOCK_FIELD(FIELD) \
@@ -8369,17 +8428,7 @@ static u32 sock_ops_convert_ctx_access(enum 
bpf_access_type type,
                SOCK_OPS_GET_TCP_SOCK_FIELD(bytes_acked);
                break;
        case offsetof(struct bpf_sock_ops, sk):
-               *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(
-                                               struct bpf_sock_ops_kern,
-                                               is_fullsock),
-                                     si->dst_reg, si->src_reg,
-                                     offsetof(struct bpf_sock_ops_kern,
-                                              is_fullsock));
-               *insn++ = BPF_JMP_IMM(BPF_JEQ, si->dst_reg, 0, 1);
-               *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(
-                                               struct bpf_sock_ops_kern, sk),
-                                     si->dst_reg, si->src_reg,
-                                     offsetof(struct bpf_sock_ops_kern, sk));
+               SOCK_OPS_GET_SK();
                break;
        }
        return insn - insn_buf;
diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index 07782836fad6..3c48cdc8935d 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -44,7 +44,7 @@ static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
 
        err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
        if (priv->flags & NFT_EXTHDR_F_PRESENT) {
-               *dest = (err >= 0);
+               nft_reg_store8(dest, err >= 0);
                return;
        } else if (err < 0) {
                goto err;
@@ -141,7 +141,7 @@ static void nft_exthdr_ipv4_eval(const struct nft_expr 
*expr,
 
        err = ipv4_find_option(nft_net(pkt), skb, &offset, priv->type);
        if (priv->flags & NFT_EXTHDR_F_PRESENT) {
-               *dest = (err >= 0);
+               nft_reg_store8(dest, err >= 0);
                return;
        } else if (err < 0) {
                goto err;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 
b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index efa5fcb5793f..952b8f190850 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -265,6 +265,8 @@ static int svc_rdma_post_recv(struct svcxprt_rdma *rdma)
 {
        struct svc_rdma_recv_ctxt *ctxt;
 
+       if (test_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags))
+               return 0;
        ctxt = svc_rdma_recv_ctxt_get(rdma);
        if (!ctxt)
                return -ENOMEM;
diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc
index c0ac8f7b5f1a..1eb076c7eae1 100644
--- a/scripts/kconfig/qconf.cc
+++ b/scripts/kconfig/qconf.cc
@@ -881,40 +881,40 @@ void ConfigList::focusInEvent(QFocusEvent *e)
 
 void ConfigList::contextMenuEvent(QContextMenuEvent *e)
 {
-       if (e->y() <= header()->geometry().bottom()) {
-               if (!headerPopup) {
-                       QAction *action;
-
-                       headerPopup = new QMenu(this);
-                       action = new QAction("Show Name", this);
-                         action->setCheckable(true);
-                         connect(action, SIGNAL(toggled(bool)),
-                                 parent(), SLOT(setShowName(bool)));
-                         connect(parent(), SIGNAL(showNameChanged(bool)),
-                                 action, SLOT(setOn(bool)));
-                         action->setChecked(showName);
-                         headerPopup->addAction(action);
-                       action = new QAction("Show Range", this);
-                         action->setCheckable(true);
-                         connect(action, SIGNAL(toggled(bool)),
-                                 parent(), SLOT(setShowRange(bool)));
-                         connect(parent(), SIGNAL(showRangeChanged(bool)),
-                                 action, SLOT(setOn(bool)));
-                         action->setChecked(showRange);
-                         headerPopup->addAction(action);
-                       action = new QAction("Show Data", this);
-                         action->setCheckable(true);
-                         connect(action, SIGNAL(toggled(bool)),
-                                 parent(), SLOT(setShowData(bool)));
-                         connect(parent(), SIGNAL(showDataChanged(bool)),
-                                 action, SLOT(setOn(bool)));
-                         action->setChecked(showData);
-                         headerPopup->addAction(action);
-               }
-               headerPopup->exec(e->globalPos());
-               e->accept();
-       } else
-               e->ignore();
+       if (!headerPopup) {
+               QAction *action;
+
+               headerPopup = new QMenu(this);
+               action = new QAction("Show Name", this);
+               action->setCheckable(true);
+               connect(action, SIGNAL(toggled(bool)),
+                       parent(), SLOT(setShowName(bool)));
+               connect(parent(), SIGNAL(showNameChanged(bool)),
+                       action, SLOT(setChecked(bool)));
+               action->setChecked(showName);
+               headerPopup->addAction(action);
+
+               action = new QAction("Show Range", this);
+               action->setCheckable(true);
+               connect(action, SIGNAL(toggled(bool)),
+                       parent(), SLOT(setShowRange(bool)));
+               connect(parent(), SIGNAL(showRangeChanged(bool)),
+                       action, SLOT(setChecked(bool)));
+               action->setChecked(showRange);
+               headerPopup->addAction(action);
+
+               action = new QAction("Show Data", this);
+               action->setCheckable(true);
+               connect(action, SIGNAL(toggled(bool)),
+                       parent(), SLOT(setShowData(bool)));
+               connect(parent(), SIGNAL(showDataChanged(bool)),
+                       action, SLOT(setChecked(bool)));
+               action->setChecked(showData);
+               headerPopup->addAction(action);
+       }
+
+       headerPopup->exec(e->globalPos());
+       e->accept();
 }
 
 ConfigView*ConfigView::viewList;
@@ -1240,7 +1240,7 @@ QMenu* ConfigInfoView::createStandardContextMenu(const 
QPoint & pos)
 
        action->setCheckable(true);
        connect(action, SIGNAL(toggled(bool)), SLOT(setShowDebug(bool)));
-       connect(this, SIGNAL(showDebugChanged(bool)), action, 
SLOT(setOn(bool)));
+       connect(this, SIGNAL(showDebugChanged(bool)), action, 
SLOT(setChecked(bool)));
        action->setChecked(showDebug());
        popup->addSeparator();
        popup->addAction(action);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 313eecfb91b4..fe6db8b171e4 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7666,6 +7666,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", 
ALC269_FIXUP_INV_DMIC),
        SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen 
(NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
        SND_PCI_QUIRK(0x144d, 0xc176, "Samsung Notebook 9 Pro 
(NP930MBE-K04US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+       SND_PCI_QUIRK(0x144d, 0xc189, "Samsung Galaxy Flex Book 
(NT950QCG-X716)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+       SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion 
(NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
        SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", 
ALC269_FIXUP_ATIV_BOOK_8),
        SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", 
ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
        SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", 
ALC283_FIXUP_HEADSET_MIC),
diff --git a/sound/soc/codecs/msm8916-wcd-analog.c 
b/sound/soc/codecs/msm8916-wcd-analog.c
index 85bc7ae4d267..26cf372ccda6 100644
--- a/sound/soc/codecs/msm8916-wcd-analog.c
+++ b/sound/soc/codecs/msm8916-wcd-analog.c
@@ -19,8 +19,8 @@
 
 #define CDC_D_REVISION1                        (0xf000)
 #define CDC_D_PERPH_SUBTYPE            (0xf005)
-#define CDC_D_INT_EN_SET               (0x015)
-#define CDC_D_INT_EN_CLR               (0x016)
+#define CDC_D_INT_EN_SET               (0xf015)
+#define CDC_D_INT_EN_CLR               (0xf016)
 #define MBHC_SWITCH_INT                        BIT(7)
 #define MBHC_MIC_ELECTRICAL_INS_REM_DET        BIT(6)
 #define MBHC_BUTTON_PRESS_DET          BIT(5)
diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c 
b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
index 82f2b6357778..a3cb05d92584 100644
--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
@@ -331,7 +331,7 @@ static int sst_media_open(struct snd_pcm_substream 
*substream,
 
        ret_val = power_up_sst(stream);
        if (ret_val < 0)
-               return ret_val;
+               goto out_power_up;
 
        /* Make sure, that the period size is always even */
        snd_pcm_hw_constraint_step(substream->runtime, 0,
@@ -340,8 +340,9 @@ static int sst_media_open(struct snd_pcm_substream 
*substream,
        return snd_pcm_hw_constraint_integer(runtime,
                         SNDRV_PCM_HW_PARAM_PERIODS);
 out_ops:
-       kfree(stream);
        mutex_unlock(&sst_lock);
+out_power_up:
+       kfree(stream);
        return ret_val;
 }
 
diff --git a/sound/soc/qcom/qdsp6/q6afe-dai.c b/sound/soc/qcom/qdsp6/q6afe-dai.c
index 2a5302f1db98..0168af849272 100644
--- a/sound/soc/qcom/qdsp6/q6afe-dai.c
+++ b/sound/soc/qcom/qdsp6/q6afe-dai.c
@@ -1150,206 +1150,206 @@ static int q6afe_of_xlate_dai_name(struct 
snd_soc_component *component,
 }
 
 static const struct snd_soc_dapm_widget q6afe_dai_widgets[] = {
-       SND_SOC_DAPM_AIF_IN("HDMI_RX", NULL, 0, 0, 0, 0),
-       SND_SOC_DAPM_AIF_IN("SLIMBUS_0_RX", NULL, 0, 0, 0, 0),
-       SND_SOC_DAPM_AIF_IN("SLIMBUS_1_RX", NULL, 0, 0, 0, 0),
-       SND_SOC_DAPM_AIF_IN("SLIMBUS_2_RX", NULL, 0, 0, 0, 0),
-       SND_SOC_DAPM_AIF_IN("SLIMBUS_3_RX", NULL, 0, 0, 0, 0),
-       SND_SOC_DAPM_AIF_IN("SLIMBUS_4_RX", NULL, 0, 0, 0, 0),
-       SND_SOC_DAPM_AIF_IN("SLIMBUS_5_RX", NULL, 0, 0, 0, 0),
-       SND_SOC_DAPM_AIF_IN("SLIMBUS_6_RX", NULL, 0, 0, 0, 0),
-       SND_SOC_DAPM_AIF_OUT("SLIMBUS_0_TX", NULL, 0, 0, 0, 0),
-       SND_SOC_DAPM_AIF_OUT("SLIMBUS_1_TX", NULL, 0, 0, 0, 0),
-       SND_SOC_DAPM_AIF_OUT("SLIMBUS_2_TX", NULL, 0, 0, 0, 0),
-       SND_SOC_DAPM_AIF_OUT("SLIMBUS_3_TX", NULL, 0, 0, 0, 0),
-       SND_SOC_DAPM_AIF_OUT("SLIMBUS_4_TX", NULL, 0, 0, 0, 0),
-       SND_SOC_DAPM_AIF_OUT("SLIMBUS_5_TX", NULL, 0, 0, 0, 0),
-       SND_SOC_DAPM_AIF_OUT("SLIMBUS_6_TX", NULL, 0, 0, 0, 0),
+       SND_SOC_DAPM_AIF_IN("HDMI_RX", NULL, 0, SND_SOC_NOPM, 0, 0),
+       SND_SOC_DAPM_AIF_IN("SLIMBUS_0_RX", NULL, 0, SND_SOC_NOPM, 0, 0),
+       SND_SOC_DAPM_AIF_IN("SLIMBUS_1_RX", NULL, 0, SND_SOC_NOPM, 0, 0),
+       SND_SOC_DAPM_AIF_IN("SLIMBUS_2_RX", NULL, 0, SND_SOC_NOPM, 0, 0),
+       SND_SOC_DAPM_AIF_IN("SLIMBUS_3_RX", NULL, 0, SND_SOC_NOPM, 0, 0),
+       SND_SOC_DAPM_AIF_IN("SLIMBUS_4_RX", NULL, 0, SND_SOC_NOPM, 0, 0),
+       SND_SOC_DAPM_AIF_IN("SLIMBUS_5_RX", NULL, 0, SND_SOC_NOPM, 0, 0),
+       SND_SOC_DAPM_AIF_IN("SLIMBUS_6_RX", NULL, 0, SND_SOC_NOPM, 0, 0),
+       SND_SOC_DAPM_AIF_OUT("SLIMBUS_0_TX", NULL, 0, SND_SOC_NOPM, 0, 0),
+       SND_SOC_DAPM_AIF_OUT("SLIMBUS_1_TX", NULL, 0, SND_SOC_NOPM, 0, 0),
+       SND_SOC_DAPM_AIF_OUT("SLIMBUS_2_TX", NULL, 0, SND_SOC_NOPM, 0, 0),
+       SND_SOC_DAPM_AIF_OUT("SLIMBUS_3_TX", NULL, 0, SND_SOC_NOPM, 0, 0),
+       SND_SOC_DAPM_AIF_OUT("SLIMBUS_4_TX", NULL, 0, SND_SOC_NOPM, 0, 0),
+       SND_SOC_DAPM_AIF_OUT("SLIMBUS_5_TX", NULL, 0, SND_SOC_NOPM, 0, 0),
+       SND_SOC_DAPM_AIF_OUT("SLIMBUS_6_TX", NULL, 0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("QUAT_MI2S_RX", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUAT_MI2S_TX", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("TERT_MI2S_RX", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("TERT_MI2S_TX", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("SEC_MI2S_RX", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("SEC_MI2S_TX", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("SEC_MI2S_RX_SD1",
                        "Secondary MI2S Playback SD1",
-                       0, 0, 0, 0),
+                       0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("PRI_MI2S_RX", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("PRI_MI2S_TX", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
 
        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_0", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_1", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_2", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_3", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_4", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_5", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_6", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_7", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_0", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_1", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_2", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_3", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_4", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_5", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_6", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_7", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
 
        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_0", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_1", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_2", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_3", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_4", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_5", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_6", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_7", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_0", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_1", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_2", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_3", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_4", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_5", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_6", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_7", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
 
        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_0", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_1", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_2", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_3", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_4", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_5", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_6", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_7", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_0", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_1", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_2", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_3", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_4", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_5", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_6", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_7", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
 
        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_0", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_1", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_2", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_3", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_4", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_5", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_6", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_7", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_0", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_1", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_2", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_3", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_4", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_5", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_6", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_7", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
 
        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_0", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_1", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_2", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_3", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_4", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_5", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_6", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_7", NULL,
-                            0, 0, 0, 0),
+                            0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_0", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_1", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_2", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_3", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_4", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_5", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_6", NULL,
-                                               0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_7", NULL,
-                                               0, 0, 0, 0),
-       SND_SOC_DAPM_AIF_OUT("DISPLAY_PORT_RX", "NULL", 0, 0, 0, 0),
+                                               0, SND_SOC_NOPM, 0, 0),
+       SND_SOC_DAPM_AIF_OUT("DISPLAY_PORT_RX", "NULL", 0, SND_SOC_NOPM, 0, 0),
 };
 
 static const struct snd_soc_component_driver q6afe_dai_component = {
diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c
index 46e50612b92c..750e6a30444e 100644
--- a/sound/soc/qcom/qdsp6/q6routing.c
+++ b/sound/soc/qcom/qdsp6/q6routing.c
@@ -973,6 +973,20 @@ static int msm_routing_probe(struct snd_soc_component *c)
        return 0;
 }
 
+static unsigned int q6routing_reg_read(struct snd_soc_component *component,
+                                      unsigned int reg)
+{
+       /* default value */
+       return 0;
+}
+
+static int q6routing_reg_write(struct snd_soc_component *component,
+                              unsigned int reg, unsigned int val)
+{
+       /* dummy */
+       return 0;
+}
+
 static const struct snd_soc_component_driver msm_soc_routing_component = {
        .probe = msm_routing_probe,
        .name = DRV_NAME,
@@ -981,6 +995,8 @@ static const struct snd_soc_component_driver 
msm_soc_routing_component = {
        .num_dapm_widgets = ARRAY_SIZE(msm_qdsp6_widgets),
        .dapm_routes = intercon,
        .num_dapm_routes = ARRAY_SIZE(intercon),
+       .read = q6routing_reg_read,
+       .write = q6routing_reg_write,
 };
 
 static int q6pcm_routing_probe(struct platform_device *pdev)
diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
index 5ff951e08c74..52ebe400e9ca 100644
--- a/tools/bpf/bpftool/gen.c
+++ b/tools/bpf/bpftool/gen.c
@@ -402,7 +402,7 @@ static int do_skeleton(int argc, char **argv)
                {                                                           \n\
                        struct %1$s *obj;                                   \n\
                                                                            \n\
-                       obj = (typeof(obj))calloc(1, sizeof(*obj));         \n\
+                       obj = (struct %1$s *)calloc(1, sizeof(*obj));       \n\
                        if (!obj)                                           \n\
                                return NULL;                                \n\
                        if (%1$s__create_skeleton(obj))                     \n\
@@ -466,7 +466,7 @@ static int do_skeleton(int argc, char **argv)
                {                                                           \n\
                        struct bpf_object_skeleton *s;                      \n\
                                                                            \n\
-                       s = (typeof(s))calloc(1, sizeof(*s));               \n\
+                       s = (struct bpf_object_skeleton *)calloc(1, 
sizeof(*s));\n\
                        if (!s)                                             \n\
                                return -1;                                  \n\
                        obj->skeleton = s;                                  \n\
@@ -484,7 +484,7 @@ static int do_skeleton(int argc, char **argv)
                                /* maps */                                  \n\
                                s->map_cnt = %zu;                           \n\
                                s->map_skel_sz = sizeof(*s->maps);          \n\
-                               s->maps = (typeof(s->maps))calloc(s->map_cnt, 
s->map_skel_sz);\n\
+                               s->maps = (struct bpf_map_skeleton 
*)calloc(s->map_cnt, s->map_skel_sz);\n\
                                if (!s->maps)                               \n\
                                        goto err;                           \n\
                        ",
@@ -520,7 +520,7 @@ static int do_skeleton(int argc, char **argv)
                                /* programs */                              \n\
                                s->prog_cnt = %zu;                          \n\
                                s->prog_skel_sz = sizeof(*s->progs);        \n\
-                               s->progs = 
(typeof(s->progs))calloc(s->prog_cnt, s->prog_skel_sz);\n\
+                               s->progs = (struct bpf_prog_skeleton 
*)calloc(s->prog_cnt, s->prog_skel_sz);\n\
                                if (!s->progs)                              \n\
                                        goto err;                           \n\
                        ",
diff --git a/tools/testing/selftests/cgroup/cgroup_util.c 
b/tools/testing/selftests/cgroup/cgroup_util.c
index 8a637ca7d73a..05853b0b8831 100644
--- a/tools/testing/selftests/cgroup/cgroup_util.c
+++ b/tools/testing/selftests/cgroup/cgroup_util.c
@@ -106,7 +106,7 @@ int cg_read_strcmp(const char *cgroup, const char *control,
 
        /* Handle the case of comparing against empty string */
        if (!expected)
-               size = 32;
+               return -1;
        else
                size = strlen(expected) + 1;
 
diff --git a/tools/testing/selftests/kvm/x86_64/debug_regs.c 
b/tools/testing/selftests/kvm/x86_64/debug_regs.c
index 8162c58a1234..b8d14f9db5f9 100644
--- a/tools/testing/selftests/kvm/x86_64/debug_regs.c
+++ b/tools/testing/selftests/kvm/x86_64/debug_regs.c
@@ -40,11 +40,11 @@ static void guest_code(void)
 
        /* Single step test, covers 2 basic instructions and 2 emulated */
        asm volatile("ss_start: "
-                    "xor %%rax,%%rax\n\t"
+                    "xor %%eax,%%eax\n\t"
                     "cpuid\n\t"
                     "movl $0x1a0,%%ecx\n\t"
                     "rdmsr\n\t"
-                    : : : "rax", "ecx");
+                    : : : "eax", "ebx", "ecx", "edx");
 
        /* DR6.BD test */
        asm volatile("bd_start: mov %%dr0, %%rax" : : : "rax");
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index 8a9d13e8e904..b005685a6de4 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -331,7 +331,8 @@ static void unmap_stage2_puds(struct kvm *kvm, pgd_t *pgd,
  * destroying the VM), otherwise another faulting VCPU may come in and mess
  * with things behind our backs.
  */
-static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size)
+static void __unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size,
+                                bool may_block)
 {
        pgd_t *pgd;
        phys_addr_t addr = start, end = start + size;
@@ -356,11 +357,16 @@ static void unmap_stage2_range(struct kvm *kvm, 
phys_addr_t start, u64 size)
                 * If the range is too large, release the kvm->mmu_lock
                 * to prevent starvation and lockup detector warnings.
                 */
-               if (next != end)
+               if (may_block && next != end)
                        cond_resched_lock(&kvm->mmu_lock);
        } while (pgd++, addr = next, addr != end);
 }
 
+static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size)
+{
+       __unmap_stage2_range(kvm, start, size, true);
+}
+
 static void stage2_flush_ptes(struct kvm *kvm, pmd_t *pmd,
                              phys_addr_t addr, phys_addr_t end)
 {
@@ -2041,18 +2047,21 @@ static int handle_hva_to_gpa(struct kvm *kvm,
 
 static int kvm_unmap_hva_handler(struct kvm *kvm, gpa_t gpa, u64 size, void 
*data)
 {
-       unmap_stage2_range(kvm, gpa, size);
+       unsigned flags = *(unsigned *)data;
+       bool may_block = flags & MMU_NOTIFIER_RANGE_BLOCKABLE;
+
+       __unmap_stage2_range(kvm, gpa, size, may_block);
        return 0;
 }
 
 int kvm_unmap_hva_range(struct kvm *kvm,
-                       unsigned long start, unsigned long end)
+                       unsigned long start, unsigned long end, unsigned flags)
 {
        if (!kvm->arch.pgd)
                return 0;
 
        trace_kvm_unmap_hva_range(start, end);
-       handle_hva_to_gpa(kvm, start, end, &kvm_unmap_hva_handler, NULL);
+       handle_hva_to_gpa(kvm, start, end, &kvm_unmap_hva_handler, &flags);
        return 0;
 }
 
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 77aa91fb08d2..66b7a9dbb77d 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -428,7 +428,8 @@ static int kvm_mmu_notifier_invalidate_range_start(struct 
mmu_notifier *mn,
         * count is also read inside the mmu_lock critical section.
         */
        kvm->mmu_notifier_count++;
-       need_tlb_flush = kvm_unmap_hva_range(kvm, range->start, range->end);
+       need_tlb_flush = kvm_unmap_hva_range(kvm, range->start, range->end,
+                                            range->flags);
        need_tlb_flush |= kvm->tlbs_dirty;
        /* we've to flush the tlb before the pages can be freed */
        if (need_tlb_flush)
  • Linux 5.7.18 Greg Kroah-Hartman
    • Re: Linux 5.7.18 Greg Kroah-Hartman

Reply via email to