Linux patch 4.14.75

Signed-off-by: Mike Pagano <mpagano@gentoo.org>

2 files changed, 3400 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index db32f2ee..06840071 100644
--- a/0000_README
+++ b/0000_README
@@ -339,6 +339,10 @@ Patch:  1073_linux-4.14.74.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.14.74
 
+Patch:  1074_linux-4.14.75.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.14.75
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1074_linux-4.14.75.patch b/1074_linux-4.14.75.patch
new file mode 100644
index 00000000..a13dbf45
--- /dev/null
+++ b/1074_linux-4.14.75.patch
@@ -0,0 +1,3396 @@
+diff --git a/Makefile b/Makefile
+index cc0e65a8d7bf..7fc373c011c0 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 74
++SUBLEVEL = 75
+ EXTRAVERSION =
+ NAME = Petit Gorille
+ 
+diff --git a/arch/arc/include/asm/atomic.h b/arch/arc/include/asm/atomic.h
+index 11859287c52a..c98b59ac0612 100644
+--- a/arch/arc/include/asm/atomic.h
++++ b/arch/arc/include/asm/atomic.h
+@@ -84,7 +84,7 @@ static inline int atomic_fetch_##op(int i, atomic_t *v)			\
+ 	"1:	llock   %[orig], [%[ctr]]		\n"		\
+ 	"	" #asm_op " %[val], %[orig], %[i]	\n"		\
+ 	"	scond   %[val], [%[ctr]]		\n"		\
+-	"						\n"		\
++	"	bnz     1b				\n"		\
+ 	: [val]	"=&r"	(val),						\
+ 	  [orig] "=&r" (orig)						\
+ 	: [ctr]	"r"	(&v->counter),					\
+diff --git a/arch/arm64/include/asm/jump_label.h b/arch/arm64/include/asm/jump_label.h
+index 1b5e0e843c3a..7e2b3e360086 100644
+--- a/arch/arm64/include/asm/jump_label.h
++++ b/arch/arm64/include/asm/jump_label.h
+@@ -28,7 +28,7 @@
+ 
+ static __always_inline bool arch_static_branch(struct static_key *key, bool branch)
+ {
+-	asm goto("1: nop\n\t"
++	asm_volatile_goto("1: nop\n\t"
+ 		 ".pushsection __jump_table,  \"aw\"\n\t"
+ 		 ".align 3\n\t"
+ 		 ".quad 1b, %l[l_yes], %c0\n\t"
+@@ -42,7 +42,7 @@ l_yes:
+ 
+ static __always_inline bool arch_static_branch_jump(struct static_key *key, bool branch)
+ {
+-	asm goto("1: b %l[l_yes]\n\t"
++	asm_volatile_goto("1: b %l[l_yes]\n\t"
+ 		 ".pushsection __jump_table,  \"aw\"\n\t"
+ 		 ".align 3\n\t"
+ 		 ".quad 1b, %l[l_yes], %c0\n\t"
+diff --git a/arch/hexagon/include/asm/bitops.h b/arch/hexagon/include/asm/bitops.h
+index 5e4a59b3ec1b..2691a1857d20 100644
+--- a/arch/hexagon/include/asm/bitops.h
++++ b/arch/hexagon/include/asm/bitops.h
+@@ -211,7 +211,7 @@ static inline long ffz(int x)
+  * This is defined the same way as ffs.
+  * Note fls(0) = 0, fls(1) = 1, fls(0x80000000) = 32.
+  */
+-static inline long fls(int x)
++static inline int fls(int x)
+ {
+ 	int r;
+ 
+@@ -232,7 +232,7 @@ static inline long fls(int x)
+  * the libc and compiler builtin ffs routines, therefore
+  * differs in spirit from the above ffz (man ffs).
+  */
+-static inline long ffs(int x)
++static inline int ffs(int x)
+ {
+ 	int r;
+ 
+diff --git a/arch/hexagon/kernel/dma.c b/arch/hexagon/kernel/dma.c
+index 546792d176a4..564651bded42 100644
+--- a/arch/hexagon/kernel/dma.c
++++ b/arch/hexagon/kernel/dma.c
+@@ -59,7 +59,7 @@ static void *hexagon_dma_alloc_coherent(struct device *dev, size_t size,
+ 			panic("Can't create %s() memory pool!", __func__);
+ 		else
+ 			gen_pool_add(coherent_pool,
+-				pfn_to_virt(max_low_pfn),
++				(unsigned long)pfn_to_virt(max_low_pfn),
+ 				hexagon_coherent_pool_size, -1);
+ 	}
+ 
+diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
+index df9b53f40b1e..7ac7e21b137e 100644
+--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
++++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
+@@ -355,7 +355,7 @@ static int kvmppc_mmu_book3s_64_hv_xlate(struct kvm_vcpu *vcpu, gva_t eaddr,
+ 	unsigned long pp, key;
+ 	unsigned long v, orig_v, gr;
+ 	__be64 *hptep;
+-	int index;
++	long int index;
+ 	int virtmode = vcpu->arch.shregs.msr & (data ? MSR_DR : MSR_IR);
+ 
+ 	/* Get SLB entry */
+diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
+index a4170048a30b..17fbd07e4245 100644
+--- a/arch/x86/events/intel/lbr.c
++++ b/arch/x86/events/intel/lbr.c
+@@ -1250,4 +1250,8 @@ void intel_pmu_lbr_init_knl(void)
+ 
+ 	x86_pmu.lbr_sel_mask = LBR_SEL_MASK;
+ 	x86_pmu.lbr_sel_map  = snb_lbr_sel_map;
++
++	/* Knights Landing does have MISPREDICT bit */
++	if (x86_pmu.intel_cap.lbr_format == LBR_FORMAT_LIP)
++		x86_pmu.intel_cap.lbr_format = LBR_FORMAT_EIP_FLAGS;
+ }
+diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
+index a8a2a271b63d..43fe195f6dca 100644
+--- a/drivers/crypto/caam/caamalg.c
++++ b/drivers/crypto/caam/caamalg.c
+@@ -1511,8 +1511,8 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request
+ 	edesc->src_nents = src_nents;
+ 	edesc->dst_nents = dst_nents;
+ 	edesc->sec4_sg_bytes = sec4_sg_bytes;
+-	edesc->sec4_sg = (void *)edesc + sizeof(struct ablkcipher_edesc) +
+-			 desc_bytes;
++	edesc->sec4_sg = (struct sec4_sg_entry *)((u8 *)edesc->hw_desc +
++						  desc_bytes);
+ 	edesc->iv_dir = DMA_TO_DEVICE;
+ 
+ 	/* Make sure IV is located in a DMAable area */
+@@ -1715,8 +1715,8 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc(
+ 	edesc->src_nents = src_nents;
+ 	edesc->dst_nents = dst_nents;
+ 	edesc->sec4_sg_bytes = sec4_sg_bytes;
+-	edesc->sec4_sg = (void *)edesc + sizeof(struct ablkcipher_edesc) +
+-			 desc_bytes;
++	edesc->sec4_sg = (struct sec4_sg_entry *)((u8 *)edesc->hw_desc +
++						  desc_bytes);
+ 	edesc->iv_dir = DMA_FROM_DEVICE;
+ 
+ 	/* Make sure IV is located in a DMAable area */
+diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c
+index 764be3e6933c..a98a25733a22 100644
+--- a/drivers/crypto/mxs-dcp.c
++++ b/drivers/crypto/mxs-dcp.c
+@@ -63,7 +63,7 @@ struct dcp {
+ 	struct dcp_coherent_block	*coh;
+ 
+ 	struct completion		completion[DCP_MAX_CHANS];
+-	struct mutex			mutex[DCP_MAX_CHANS];
++	spinlock_t			lock[DCP_MAX_CHANS];
+ 	struct task_struct		*thread[DCP_MAX_CHANS];
+ 	struct crypto_queue		queue[DCP_MAX_CHANS];
+ };
+@@ -349,13 +349,20 @@ static int dcp_chan_thread_aes(void *data)
+ 
+ 	int ret;
+ 
+-	do {
+-		__set_current_state(TASK_INTERRUPTIBLE);
++	while (!kthread_should_stop()) {
++		set_current_state(TASK_INTERRUPTIBLE);
+ 
+-		mutex_lock(&sdcp->mutex[chan]);
++		spin_lock(&sdcp->lock[chan]);
+ 		backlog = crypto_get_backlog(&sdcp->queue[chan]);
+ 		arq = crypto_dequeue_request(&sdcp->queue[chan]);
+-		mutex_unlock(&sdcp->mutex[chan]);
++		spin_unlock(&sdcp->lock[chan]);
++
++		if (!backlog && !arq) {
++			schedule();
++			continue;
++		}
++
++		set_current_state(TASK_RUNNING);
+ 
+ 		if (backlog)
+ 			backlog->complete(backlog, -EINPROGRESS);
+@@ -363,11 +370,8 @@ static int dcp_chan_thread_aes(void *data)
+ 		if (arq) {
+ 			ret = mxs_dcp_aes_block_crypt(arq);
+ 			arq->complete(arq, ret);
+-			continue;
+ 		}
+-
+-		schedule();
+-	} while (!kthread_should_stop());
++	}
+ 
+ 	return 0;
+ }
+@@ -409,9 +413,9 @@ static int mxs_dcp_aes_enqueue(struct ablkcipher_request *req, int enc, int ecb)
+ 	rctx->ecb = ecb;
+ 	actx->chan = DCP_CHAN_CRYPTO;
+ 
+-	mutex_lock(&sdcp->mutex[actx->chan]);
++	spin_lock(&sdcp->lock[actx->chan]);
+ 	ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base);
+-	mutex_unlock(&sdcp->mutex[actx->chan]);
++	spin_unlock(&sdcp->lock[actx->chan]);
+ 
+ 	wake_up_process(sdcp->thread[actx->chan]);
+ 
+@@ -640,13 +644,20 @@ static int dcp_chan_thread_sha(void *data)
+ 	struct ahash_request *req;
+ 	int ret, fini;
+ 
+-	do {
+-		__set_current_state(TASK_INTERRUPTIBLE);
++	while (!kthread_should_stop()) {
++		set_current_state(TASK_INTERRUPTIBLE);
+ 
+-		mutex_lock(&sdcp->mutex[chan]);
++		spin_lock(&sdcp->lock[chan]);
+ 		backlog = crypto_get_backlog(&sdcp->queue[chan]);
+ 		arq = crypto_dequeue_request(&sdcp->queue[chan]);
+-		mutex_unlock(&sdcp->mutex[chan]);
++		spin_unlock(&sdcp->lock[chan]);
++
++		if (!backlog && !arq) {
++			schedule();
++			continue;
++		}
++
++		set_current_state(TASK_RUNNING);
+ 
+ 		if (backlog)
+ 			backlog->complete(backlog, -EINPROGRESS);
+@@ -658,12 +669,8 @@ static int dcp_chan_thread_sha(void *data)
+ 			ret = dcp_sha_req_to_buf(arq);
+ 			fini = rctx->fini;
+ 			arq->complete(arq, ret);
+-			if (!fini)
+-				continue;
+ 		}
+-
+-		schedule();
+-	} while (!kthread_should_stop());
++	}
+ 
+ 	return 0;
+ }
+@@ -721,9 +728,9 @@ static int dcp_sha_update_fx(struct ahash_request *req, int fini)
+ 		rctx->init = 1;
+ 	}
+ 
+-	mutex_lock(&sdcp->mutex[actx->chan]);
++	spin_lock(&sdcp->lock[actx->chan]);
+ 	ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base);
+-	mutex_unlock(&sdcp->mutex[actx->chan]);
++	spin_unlock(&sdcp->lock[actx->chan]);
+ 
+ 	wake_up_process(sdcp->thread[actx->chan]);
+ 	mutex_unlock(&actx->mutex);
+@@ -983,7 +990,7 @@ static int mxs_dcp_probe(struct platform_device *pdev)
+ 	platform_set_drvdata(pdev, sdcp);
+ 
+ 	for (i = 0; i < DCP_MAX_CHANS; i++) {
+-		mutex_init(&sdcp->mutex[i]);
++		spin_lock_init(&sdcp->lock[i]);
+ 		init_completion(&sdcp->completion[i]);
+ 		crypto_init_queue(&sdcp->queue[i], 50);
+ 	}
+diff --git a/drivers/crypto/qat/qat_c3xxx/adf_drv.c b/drivers/crypto/qat/qat_c3xxx/adf_drv.c
+index f172171668ee..7c470ae97f60 100644
+--- a/drivers/crypto/qat/qat_c3xxx/adf_drv.c
++++ b/drivers/crypto/qat/qat_c3xxx/adf_drv.c
+@@ -123,7 +123,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	struct adf_hw_device_data *hw_data;
+ 	char name[ADF_DEVICE_NAME_LENGTH];
+ 	unsigned int i, bar_nr;
+-	int ret, bar_mask;
++	unsigned long bar_mask;
++	int ret;
+ 
+ 	switch (ent->device) {
+ 	case ADF_C3XXX_PCI_DEVICE_ID:
+@@ -235,8 +236,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	/* Find and map all the device's BARS */
+ 	i = 0;
+ 	bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
+-	for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+-			 ADF_PCI_MAX_BARS * 2) {
++	for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
+ 		struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
+ 
+ 		bar->base_addr = pci_resource_start(pdev, bar_nr);
+diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
+index 24ec908eb26c..613c7d5644ce 100644
+--- a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
++++ b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
+@@ -125,7 +125,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	struct adf_hw_device_data *hw_data;
+ 	char name[ADF_DEVICE_NAME_LENGTH];
+ 	unsigned int i, bar_nr;
+-	int ret, bar_mask;
++	unsigned long bar_mask;
++	int ret;
+ 
+ 	switch (ent->device) {
+ 	case ADF_C3XXXIOV_PCI_DEVICE_ID:
+@@ -215,8 +216,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	/* Find and map all the device's BARS */
+ 	i = 0;
+ 	bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
+-	for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+-			 ADF_PCI_MAX_BARS * 2) {
++	for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
+ 		struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
+ 
+ 		bar->base_addr = pci_resource_start(pdev, bar_nr);
+diff --git a/drivers/crypto/qat/qat_c62x/adf_drv.c b/drivers/crypto/qat/qat_c62x/adf_drv.c
+index 58a984c9c3ec..cb11d85d7bb3 100644
+--- a/drivers/crypto/qat/qat_c62x/adf_drv.c
++++ b/drivers/crypto/qat/qat_c62x/adf_drv.c
+@@ -123,7 +123,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	struct adf_hw_device_data *hw_data;
+ 	char name[ADF_DEVICE_NAME_LENGTH];
+ 	unsigned int i, bar_nr;
+-	int ret, bar_mask;
++	unsigned long bar_mask;
++	int ret;
+ 
+ 	switch (ent->device) {
+ 	case ADF_C62X_PCI_DEVICE_ID:
+@@ -235,8 +236,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	/* Find and map all the device's BARS */
+ 	i = (hw_data->fuses & ADF_DEVICE_FUSECTL_MASK) ? 1 : 0;
+ 	bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
+-	for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+-			 ADF_PCI_MAX_BARS * 2) {
++	for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
+ 		struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
+ 
+ 		bar->base_addr = pci_resource_start(pdev, bar_nr);
+diff --git a/drivers/crypto/qat/qat_c62xvf/adf_drv.c b/drivers/crypto/qat/qat_c62xvf/adf_drv.c
+index b9f3e0e4fde9..278452b8ef81 100644
+--- a/drivers/crypto/qat/qat_c62xvf/adf_drv.c
++++ b/drivers/crypto/qat/qat_c62xvf/adf_drv.c
+@@ -125,7 +125,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	struct adf_hw_device_data *hw_data;
+ 	char name[ADF_DEVICE_NAME_LENGTH];
+ 	unsigned int i, bar_nr;
+-	int ret, bar_mask;
++	unsigned long bar_mask;
++	int ret;
+ 
+ 	switch (ent->device) {
+ 	case ADF_C62XIOV_PCI_DEVICE_ID:
+@@ -215,8 +216,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	/* Find and map all the device's BARS */
+ 	i = 0;
+ 	bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
+-	for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+-			 ADF_PCI_MAX_BARS * 2) {
++	for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
+ 		struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
+ 
+ 		bar->base_addr = pci_resource_start(pdev, bar_nr);
+diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_drv.c b/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
+index 2ce01f010c74..07b741aed108 100644
+--- a/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
++++ b/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
+@@ -123,7 +123,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	struct adf_hw_device_data *hw_data;
+ 	char name[ADF_DEVICE_NAME_LENGTH];
+ 	unsigned int i, bar_nr;
+-	int ret, bar_mask;
++	unsigned long bar_mask;
++	int ret;
+ 
+ 	switch (ent->device) {
+ 	case ADF_DH895XCC_PCI_DEVICE_ID:
+@@ -237,8 +238,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	/* Find and map all the device's BARS */
+ 	i = 0;
+ 	bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
+-	for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+-			 ADF_PCI_MAX_BARS * 2) {
++	for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
+ 		struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
+ 
+ 		bar->base_addr = pci_resource_start(pdev, bar_nr);
+diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
+index 26ab17bfc6da..3da0f951cb59 100644
+--- a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
++++ b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
+@@ -125,7 +125,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	struct adf_hw_device_data *hw_data;
+ 	char name[ADF_DEVICE_NAME_LENGTH];
+ 	unsigned int i, bar_nr;
+-	int ret, bar_mask;
++	unsigned long bar_mask;
++	int ret;
+ 
+ 	switch (ent->device) {
+ 	case ADF_DH895XCCIOV_PCI_DEVICE_ID:
+@@ -215,8 +216,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	/* Find and map all the device's BARS */
+ 	i = 0;
+ 	bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
+-	for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+-			 ADF_PCI_MAX_BARS * 2) {
++	for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
+ 		struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
+ 
+ 		bar->base_addr = pci_resource_start(pdev, bar_nr);
+diff --git a/drivers/gpio/gpio-adp5588.c b/drivers/gpio/gpio-adp5588.c
+index e717f8dc3966..202d367a21e4 100644
+--- a/drivers/gpio/gpio-adp5588.c
++++ b/drivers/gpio/gpio-adp5588.c
+@@ -41,6 +41,8 @@ struct adp5588_gpio {
+ 	uint8_t int_en[3];
+ 	uint8_t irq_mask[3];
+ 	uint8_t irq_stat[3];
++	uint8_t int_input_en[3];
++	uint8_t int_lvl_cached[3];
+ };
+ 
+ static int adp5588_gpio_read(struct i2c_client *client, u8 reg)
+@@ -173,12 +175,28 @@ static void adp5588_irq_bus_sync_unlock(struct irq_data *d)
+ 	struct adp5588_gpio *dev = irq_data_get_irq_chip_data(d);
+ 	int i;
+ 
+-	for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++)
++	for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++) {
++		if (dev->int_input_en[i]) {
++			mutex_lock(&dev->lock);
++			dev->dir[i] &= ~dev->int_input_en[i];
++			dev->int_input_en[i] = 0;
++			adp5588_gpio_write(dev->client, GPIO_DIR1 + i,
++					   dev->dir[i]);
++			mutex_unlock(&dev->lock);
++		}
++
++		if (dev->int_lvl_cached[i] != dev->int_lvl[i]) {
++			dev->int_lvl_cached[i] = dev->int_lvl[i];
++			adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + i,
++					   dev->int_lvl[i]);
++		}
++
+ 		if (dev->int_en[i] ^ dev->irq_mask[i]) {
+ 			dev->int_en[i] = dev->irq_mask[i];
+ 			adp5588_gpio_write(dev->client, GPIO_INT_EN1 + i,
+ 					   dev->int_en[i]);
+ 		}
++	}
+ 
+ 	mutex_unlock(&dev->irq_lock);
+ }
+@@ -221,9 +239,7 @@ static int adp5588_irq_set_type(struct irq_data *d, unsigned int type)
+ 	else
+ 		return -EINVAL;
+ 
+-	adp5588_gpio_direction_input(&dev->gpio_chip, gpio);
+-	adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + bank,
+-			   dev->int_lvl[bank]);
++	dev->int_input_en[bank] |= bit;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index 70b3c556f6cf..33d4bd505b5b 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -25,7 +25,6 @@
+ 
+ struct acpi_gpio_event {
+ 	struct list_head node;
+-	struct list_head initial_sync_list;
+ 	acpi_handle handle;
+ 	unsigned int pin;
+ 	unsigned int irq;
+@@ -49,10 +48,19 @@ struct acpi_gpio_chip {
+ 	struct mutex conn_lock;
+ 	struct gpio_chip *chip;
+ 	struct list_head events;
++	struct list_head deferred_req_irqs_list_entry;
+ };
+ 
+-static LIST_HEAD(acpi_gpio_initial_sync_list);
+-static DEFINE_MUTEX(acpi_gpio_initial_sync_list_lock);
++/*
++ * For gpiochips which call acpi_gpiochip_request_interrupts() before late_init
++ * (so builtin drivers) we register the ACPI GpioInt event handlers from a
++ * late_initcall_sync handler, so that other builtin drivers can register their
++ * OpRegions before the event handlers can run.  This list contains gpiochips
++ * for which the acpi_gpiochip_request_interrupts() has been deferred.
++ */
++static DEFINE_MUTEX(acpi_gpio_deferred_req_irqs_lock);
++static LIST_HEAD(acpi_gpio_deferred_req_irqs_list);
++static bool acpi_gpio_deferred_req_irqs_done;
+ 
+ static int acpi_gpiochip_find(struct gpio_chip *gc, void *data)
+ {
+@@ -146,21 +154,6 @@ static struct gpio_desc *acpi_get_gpiod(char *path, int pin)
+ 	return gpiochip_get_desc(chip, offset);
+ }
+ 
+-static void acpi_gpio_add_to_initial_sync_list(struct acpi_gpio_event *event)
+-{
+-	mutex_lock(&acpi_gpio_initial_sync_list_lock);
+-	list_add(&event->initial_sync_list, &acpi_gpio_initial_sync_list);
+-	mutex_unlock(&acpi_gpio_initial_sync_list_lock);
+-}
+-
+-static void acpi_gpio_del_from_initial_sync_list(struct acpi_gpio_event *event)
+-{
+-	mutex_lock(&acpi_gpio_initial_sync_list_lock);
+-	if (!list_empty(&event->initial_sync_list))
+-		list_del_init(&event->initial_sync_list);
+-	mutex_unlock(&acpi_gpio_initial_sync_list_lock);
+-}
+-
+ static irqreturn_t acpi_gpio_irq_handler(int irq, void *data)
+ {
+ 	struct acpi_gpio_event *event = data;
+@@ -247,7 +240,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
+ 
+ 	gpiod_direction_input(desc);
+ 
+-	value = gpiod_get_value(desc);
++	value = gpiod_get_value_cansleep(desc);
+ 
+ 	ret = gpiochip_lock_as_irq(chip, pin);
+ 	if (ret) {
+@@ -290,7 +283,6 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
+ 	event->irq = irq;
+ 	event->pin = pin;
+ 	event->desc = desc;
+-	INIT_LIST_HEAD(&event->initial_sync_list);
+ 
+ 	ret = request_threaded_irq(event->irq, NULL, handler, irqflags,
+ 				   "ACPI:Event", event);
+@@ -312,10 +304,9 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
+ 	 * may refer to OperationRegions from other (builtin) drivers which
+ 	 * may be probed after us.
+ 	 */
+-	if (handler == acpi_gpio_irq_handler &&
+-	    (((irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
+-	     ((irqflags & IRQF_TRIGGER_FALLING) && value == 0)))
+-		acpi_gpio_add_to_initial_sync_list(event);
++	if (((irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
++	    ((irqflags & IRQF_TRIGGER_FALLING) && value == 0))
++		handler(event->irq, event);
+ 
+ 	return AE_OK;
+ 
+@@ -344,6 +335,7 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip)
+ 	struct acpi_gpio_chip *acpi_gpio;
+ 	acpi_handle handle;
+ 	acpi_status status;
++	bool defer;
+ 
+ 	if (!chip->parent || !chip->to_irq)
+ 		return;
+@@ -356,6 +348,16 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip)
+ 	if (ACPI_FAILURE(status))
+ 		return;
+ 
++	mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
++	defer = !acpi_gpio_deferred_req_irqs_done;
++	if (defer)
++		list_add(&acpi_gpio->deferred_req_irqs_list_entry,
++			 &acpi_gpio_deferred_req_irqs_list);
++	mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
++
++	if (defer)
++		return;
++
+ 	acpi_walk_resources(handle, "_AEI",
+ 			    acpi_gpiochip_request_interrupt, acpi_gpio);
+ }
+@@ -386,11 +388,14 @@ void acpi_gpiochip_free_interrupts(struct gpio_chip *chip)
+ 	if (ACPI_FAILURE(status))
+ 		return;
+ 
++	mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
++	if (!list_empty(&acpi_gpio->deferred_req_irqs_list_entry))
++		list_del_init(&acpi_gpio->deferred_req_irqs_list_entry);
++	mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
++
+ 	list_for_each_entry_safe_reverse(event, ep, &acpi_gpio->events, node) {
+ 		struct gpio_desc *desc;
+ 
+-		acpi_gpio_del_from_initial_sync_list(event);
+-
+ 		if (irqd_is_wakeup_set(irq_get_irq_data(event->irq)))
+ 			disable_irq_wake(event->irq);
+ 
+@@ -1101,6 +1106,7 @@ void acpi_gpiochip_add(struct gpio_chip *chip)
+ 
+ 	acpi_gpio->chip = chip;
+ 	INIT_LIST_HEAD(&acpi_gpio->events);
++	INIT_LIST_HEAD(&acpi_gpio->deferred_req_irqs_list_entry);
+ 
+ 	status = acpi_attach_data(handle, acpi_gpio_chip_dh, acpi_gpio);
+ 	if (ACPI_FAILURE(status)) {
+@@ -1247,20 +1253,28 @@ bool acpi_can_fallback_to_crs(struct acpi_device *adev, const char *con_id)
+ 	return con_id == NULL;
+ }
+ 
+-/* Sync the initial state of handlers after all builtin drivers have probed */
+-static int acpi_gpio_initial_sync(void)
++/* Run deferred acpi_gpiochip_request_interrupts() */
++static int acpi_gpio_handle_deferred_request_interrupts(void)
+ {
+-	struct acpi_gpio_event *event, *ep;
++	struct acpi_gpio_chip *acpi_gpio, *tmp;
++
++	mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
++	list_for_each_entry_safe(acpi_gpio, tmp,
++				 &acpi_gpio_deferred_req_irqs_list,
++				 deferred_req_irqs_list_entry) {
++		acpi_handle handle;
+ 
+-	mutex_lock(&acpi_gpio_initial_sync_list_lock);
+-	list_for_each_entry_safe(event, ep, &acpi_gpio_initial_sync_list,
+-				 initial_sync_list) {
+-		acpi_evaluate_object(event->handle, NULL, NULL, NULL);
+-		list_del_init(&event->initial_sync_list);
++		handle = ACPI_HANDLE(acpi_gpio->chip->parent);
++		acpi_walk_resources(handle, "_AEI",
++				    acpi_gpiochip_request_interrupt, acpi_gpio);
++
++		list_del_init(&acpi_gpio->deferred_req_irqs_list_entry);
+ 	}
+-	mutex_unlock(&acpi_gpio_initial_sync_list_lock);
++
++	acpi_gpio_deferred_req_irqs_done = true;
++	mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
+ 
+ 	return 0;
+ }
+ /* We must use _sync so that this runs after the first deferred_probe run */
+-late_initcall_sync(acpi_gpio_initial_sync);
++late_initcall_sync(acpi_gpio_handle_deferred_request_interrupts);
+diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
+index ba38f530e403..ee8c046cab62 100644
+--- a/drivers/gpio/gpiolib-of.c
++++ b/drivers/gpio/gpiolib-of.c
+@@ -31,6 +31,7 @@ static int of_gpiochip_match_node_and_xlate(struct gpio_chip *chip, void *data)
+ 	struct of_phandle_args *gpiospec = data;
+ 
+ 	return chip->gpiodev->dev.of_node == gpiospec->np &&
++				chip->of_xlate &&
+ 				chip->of_xlate(chip, gpiospec, NULL) >= 0;
+ }
+ 
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 7e0bfd7347f6..7d5de4ef4f22 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -489,7 +489,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
+ 		if (ret)
+ 			goto out_free_descs;
+ 		lh->descs[i] = desc;
+-		count = i;
++		count = i + 1;
+ 
+ 		if (lflags & GPIOHANDLE_REQUEST_ACTIVE_LOW)
+ 			set_bit(FLAG_ACTIVE_LOW, &desc->flags);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+index 1ae5ae8c45a4..1a75a6b9ab2f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+@@ -569,6 +569,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
+ 	{ 0x1002, 0x6900, 0x1002, 0x0124, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ 	{ 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ 	{ 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
++	{ 0x1002, 0x6900, 0x1025, 0x125A, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ 	{ 0x1002, 0x67DF, 0x1028, 0x0774, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ 	{ 0, 0, 0, 0, 0 },
+ };
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 5f892ad6476e..44aa58ab55d0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -37,6 +37,7 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
+ {
+ 	struct drm_gem_object *gobj;
+ 	unsigned long size;
++	int r;
+ 
+ 	gobj = drm_gem_object_lookup(p->filp, data->handle);
+ 	if (gobj == NULL)
+@@ -48,20 +49,26 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
+ 	p->uf_entry.tv.shared = true;
+ 	p->uf_entry.user_pages = NULL;
+ 
+-	size = amdgpu_bo_size(p->uf_entry.robj);
+-	if (size != PAGE_SIZE || (data->offset + 8) > size)
+-		return -EINVAL;
+-
+-	*offset = data->offset;
+-
+ 	drm_gem_object_put_unlocked(gobj);
+ 
++	size = amdgpu_bo_size(p->uf_entry.robj);
++	if (size != PAGE_SIZE || (data->offset + 8) > size) {
++		r = -EINVAL;
++		goto error_unref;
++	}
++
+ 	if (amdgpu_ttm_tt_get_usermm(p->uf_entry.robj->tbo.ttm)) {
+-		amdgpu_bo_unref(&p->uf_entry.robj);
+-		return -EINVAL;
++		r = -EINVAL;
++		goto error_unref;
+ 	}
+ 
++	*offset = data->offset;
++
+ 	return 0;
++
++error_unref:
++	amdgpu_bo_unref(&p->uf_entry.robj);
++	return r;
+ }
+ 
+ static int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data)
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_powertune.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_powertune.c
+index e7fa67063cdc..cb9e1cd456b8 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_powertune.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_powertune.c
+@@ -1142,7 +1142,7 @@ static int vega10_enable_psm_gc_edc_config(struct pp_hwmgr *hwmgr)
+ 	for (count = 0; count < num_se; count++) {
+ 		data = GRBM_GFX_INDEX__INSTANCE_BROADCAST_WRITES_MASK | GRBM_GFX_INDEX__SH_BROADCAST_WRITES_MASK | ( count << GRBM_GFX_INDEX__SE_INDEX__SHIFT);
+ 		cgs_write_register(hwmgr->device, reg, data);
+-		result |= vega10_program_didt_config_registers(hwmgr, PSMSEEDCStallPatternConfig_Vega10, VEGA10_CONFIGREG_DIDT);
++		result = vega10_program_didt_config_registers(hwmgr, PSMSEEDCStallPatternConfig_Vega10, VEGA10_CONFIGREG_DIDT);
+ 		result |= vega10_program_didt_config_registers(hwmgr, PSMSEEDCStallDelayConfig_Vega10, VEGA10_CONFIGREG_DIDT);
+ 		result |= vega10_program_didt_config_registers(hwmgr, PSMSEEDCCtrlResetConfig_Vega10, VEGA10_CONFIGREG_DIDT);
+ 		result |= vega10_program_didt_config_registers(hwmgr, PSMSEEDCCtrlConfig_Vega10, VEGA10_CONFIGREG_DIDT);
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
+index 7c5bed29ffef..6160a6158cf2 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
+@@ -412,14 +412,10 @@ nvkm_dp_train(struct nvkm_dp *dp, u32 dataKBps)
+ }
+ 
+ static void
+-nvkm_dp_release(struct nvkm_outp *outp, struct nvkm_ior *ior)
++nvkm_dp_disable(struct nvkm_outp *outp, struct nvkm_ior *ior)
+ {
+ 	struct nvkm_dp *dp = nvkm_dp(outp);
+ 
+-	/* Prevent link from being retrained if sink sends an IRQ. */
+-	atomic_set(&dp->lt.done, 0);
+-	ior->dp.nr = 0;
+-
+ 	/* Execute DisableLT script from DP Info Table. */
+ 	nvbios_init(&ior->disp->engine.subdev, dp->info.script[4],
+ 		init.outp = &dp->outp.info;
+@@ -428,6 +424,16 @@ nvkm_dp_release(struct nvkm_outp *outp, struct nvkm_ior *ior)
+ 	);
+ }
+ 
++static void
++nvkm_dp_release(struct nvkm_outp *outp)
++{
++	struct nvkm_dp *dp = nvkm_dp(outp);
++
++	/* Prevent link from being retrained if sink sends an IRQ. */
++	atomic_set(&dp->lt.done, 0);
++	dp->outp.ior->dp.nr = 0;
++}
++
+ static int
+ nvkm_dp_acquire(struct nvkm_outp *outp)
+ {
+@@ -576,6 +582,7 @@ nvkm_dp_func = {
+ 	.fini = nvkm_dp_fini,
+ 	.acquire = nvkm_dp_acquire,
+ 	.release = nvkm_dp_release,
++	.disable = nvkm_dp_disable,
+ };
+ 
+ static int
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
+index 0c570dbd3021..bc18a96bc61a 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
+@@ -436,11 +436,11 @@ nv50_disp_super_2_0(struct nv50_disp *disp, struct nvkm_head *head)
+ 	nv50_disp_super_ied_off(head, ior, 2);
+ 
+ 	/* If we're shutting down the OR's only active head, execute
+-	 * the output path's release function.
++	 * the output path's disable function.
+ 	 */
+ 	if (ior->arm.head == (1 << head->id)) {
+-		if ((outp = ior->arm.outp) && outp->func->release)
+-			outp->func->release(outp, ior);
++		if ((outp = ior->arm.outp) && outp->func->disable)
++			outp->func->disable(outp, ior);
+ 	}
+ }
+ 
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
+index be9e7f8c3b23..bbba77ff9385 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
+@@ -93,6 +93,8 @@ nvkm_outp_release(struct nvkm_outp *outp, u8 user)
+ 	if (ior) {
+ 		outp->acquired &= ~user;
+ 		if (!outp->acquired) {
++			if (outp->func->release && outp->ior)
++				outp->func->release(outp);
+ 			outp->ior->asy.outp = NULL;
+ 			outp->ior = NULL;
+ 		}
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
+index ea84d7d5741a..97196f802924 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
+@@ -41,7 +41,8 @@ struct nvkm_outp_func {
+ 	void (*init)(struct nvkm_outp *);
+ 	void (*fini)(struct nvkm_outp *);
+ 	int (*acquire)(struct nvkm_outp *);
+-	void (*release)(struct nvkm_outp *, struct nvkm_ior *);
++	void (*release)(struct nvkm_outp *);
++	void (*disable)(struct nvkm_outp *, struct nvkm_ior *);
+ };
+ 
+ #define OUTP_MSG(o,l,f,a...) do {                                              \
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c
+index 1730371933df..be0dd6074b57 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c
+@@ -158,7 +158,8 @@ gm200_devinit_post(struct nvkm_devinit *base, bool post)
+ 	}
+ 
+ 	/* load and execute some other ucode image (bios therm?) */
+-	return pmu_load(init, 0x01, post, NULL, NULL);
++	pmu_load(init, 0x01, post, NULL, NULL);
++	return 0;
+ }
+ 
+ static const struct nvkm_devinit_func
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 25b7bd56ae11..1cb41992aaa1 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -335,7 +335,8 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+ 		struct hid_field *field, struct hid_usage *usage,
+ 		unsigned long **bit, int *max)
+ {
+-	if (usage->hid == (HID_UP_CUSTOM | 0x0003)) {
++	if (usage->hid == (HID_UP_CUSTOM | 0x0003) ||
++			usage->hid == (HID_UP_MSVENDOR | 0x0003)) {
+ 		/* The fn key on Apple USB keyboards */
+ 		set_bit(EV_REP, hi->input->evbit);
+ 		hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN);
+@@ -472,6 +473,12 @@ static const struct hid_device_id apple_devices[] = {
+ 		.driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI),
+ 		.driver_data = APPLE_HAS_FN },
++	{ HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI),
++		.driver_data = APPLE_HAS_FN },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI),
++		.driver_data = APPLE_HAS_FN },
++	{ HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI),
++		.driver_data = APPLE_HAS_FN },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING_ANSI),
+ 		.driver_data = APPLE_HAS_FN },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING_ISO),
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 81ee1d026648..3fc8c0d67592 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -85,6 +85,7 @@
+ #define USB_DEVICE_ID_ANTON_TOUCH_PAD	0x3101
+ 
+ #define USB_VENDOR_ID_APPLE		0x05ac
++#define BT_VENDOR_ID_APPLE		0x004c
+ #define USB_DEVICE_ID_APPLE_MIGHTYMOUSE	0x0304
+ #define USB_DEVICE_ID_APPLE_MAGICMOUSE	0x030d
+ #define USB_DEVICE_ID_APPLE_MAGICTRACKPAD	0x030e
+@@ -154,6 +155,7 @@
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO   0x0256
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_JIS   0x0257
+ #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI   0x0267
++#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI   0x026c
+ #define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI	0x0290
+ #define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO	0x0291
+ #define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS	0x0292
+@@ -924,6 +926,7 @@
+ #define USB_DEVICE_ID_SAITEK_RUMBLEPAD	0xff17
+ #define USB_DEVICE_ID_SAITEK_PS1000	0x0621
+ #define USB_DEVICE_ID_SAITEK_RAT7_OLD	0x0ccb
++#define USB_DEVICE_ID_SAITEK_RAT7_CONTAGION	0x0ccd
+ #define USB_DEVICE_ID_SAITEK_RAT7	0x0cd7
+ #define USB_DEVICE_ID_SAITEK_RAT9	0x0cfa
+ #define USB_DEVICE_ID_SAITEK_MMO7	0x0cd0
+diff --git a/drivers/hid/hid-saitek.c b/drivers/hid/hid-saitek.c
+index 39e642686ff0..683861f324e3 100644
+--- a/drivers/hid/hid-saitek.c
++++ b/drivers/hid/hid-saitek.c
+@@ -183,6 +183,8 @@ static const struct hid_device_id saitek_devices[] = {
+ 		.driver_data = SAITEK_RELEASE_MODE_RAT7 },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7),
+ 		.driver_data = SAITEK_RELEASE_MODE_RAT7 },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7_CONTAGION),
++		.driver_data = SAITEK_RELEASE_MODE_RAT7 },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT9),
+ 		.driver_data = SAITEK_RELEASE_MODE_RAT7 },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9),
+diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
+index 25363fc571bc..faba542d1b07 100644
+--- a/drivers/hid/hid-sensor-hub.c
++++ b/drivers/hid/hid-sensor-hub.c
+@@ -579,6 +579,28 @@ void sensor_hub_device_close(struct hid_sensor_hub_device *hsdev)
+ }
+ EXPORT_SYMBOL_GPL(sensor_hub_device_close);
+ 
++static __u8 *sensor_hub_report_fixup(struct hid_device *hdev, __u8 *rdesc,
++		unsigned int *rsize)
++{
++	/*
++	 * Checks if the report descriptor of Thinkpad Helix 2 has a logical
++	 * minimum for magnetic flux axis greater than the maximum.
++	 */
++	if (hdev->product == USB_DEVICE_ID_TEXAS_INSTRUMENTS_LENOVO_YOGA &&
++		*rsize == 2558 && rdesc[913] == 0x17 && rdesc[914] == 0x40 &&
++		rdesc[915] == 0x81 && rdesc[916] == 0x08 &&
++		rdesc[917] == 0x00 && rdesc[918] == 0x27 &&
++		rdesc[921] == 0x07 && rdesc[922] == 0x00) {
++		/* Sets negative logical minimum for mag x, y and z */
++		rdesc[914] = rdesc[935] = rdesc[956] = 0xc0;
++		rdesc[915] = rdesc[936] = rdesc[957] = 0x7e;
++		rdesc[916] = rdesc[937] = rdesc[958] = 0xf7;
++		rdesc[917] = rdesc[938] = rdesc[959] = 0xff;
++	}
++
++	return rdesc;
++}
++
+ static int sensor_hub_probe(struct hid_device *hdev,
+ 				const struct hid_device_id *id)
+ {
+@@ -742,6 +764,7 @@ static struct hid_driver sensor_hub_driver = {
+ 	.probe = sensor_hub_probe,
+ 	.remove = sensor_hub_remove,
+ 	.raw_event = sensor_hub_raw_event,
++	.report_fixup = sensor_hub_report_fixup,
+ #ifdef CONFIG_PM
+ 	.suspend = sensor_hub_suspend,
+ 	.resume = sensor_hub_resume,
+diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
+index f41901f80b64..5449fc59b7f5 100644
+--- a/drivers/hv/connection.c
++++ b/drivers/hv/connection.c
+@@ -74,6 +74,7 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo,
+ 					__u32 version)
+ {
+ 	int ret = 0;
++	unsigned int cur_cpu;
+ 	struct vmbus_channel_initiate_contact *msg;
+ 	unsigned long flags;
+ 
+@@ -96,9 +97,10 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo,
+ 	 * the CPU attempting to connect may not be CPU 0.
+ 	 */
+ 	if (version >= VERSION_WIN8_1) {
+-		msg->target_vcpu =
+-			hv_cpu_number_to_vp_number(smp_processor_id());
+-		vmbus_connection.connect_cpu = smp_processor_id();
++		cur_cpu = get_cpu();
++		msg->target_vcpu = hv_cpu_number_to_vp_number(cur_cpu);
++		vmbus_connection.connect_cpu = cur_cpu;
++		put_cpu();
+ 	} else {
+ 		msg->target_vcpu = 0;
+ 		vmbus_connection.connect_cpu = 0;
+diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c
+index 9918bdd81619..a403e8579b65 100644
+--- a/drivers/i2c/busses/i2c-uniphier-f.c
++++ b/drivers/i2c/busses/i2c-uniphier-f.c
+@@ -401,11 +401,8 @@ static int uniphier_fi2c_master_xfer(struct i2c_adapter *adap,
+ 		return ret;
+ 
+ 	for (msg = msgs; msg < emsg; msg++) {
+-		/* If next message is read, skip the stop condition */
+-		bool stop = !(msg + 1 < emsg && msg[1].flags & I2C_M_RD);
+-		/* but, force it if I2C_M_STOP is set */
+-		if (msg->flags & I2C_M_STOP)
+-			stop = true;
++		/* Emit STOP if it is the last message or I2C_M_STOP is set. */
++		bool stop = (msg + 1 == emsg) || (msg->flags & I2C_M_STOP);
+ 
+ 		ret = uniphier_fi2c_master_xfer_one(adap, msg, stop);
+ 		if (ret)
+diff --git a/drivers/i2c/busses/i2c-uniphier.c b/drivers/i2c/busses/i2c-uniphier.c
+index bb181b088291..454f914ae66d 100644
+--- a/drivers/i2c/busses/i2c-uniphier.c
++++ b/drivers/i2c/busses/i2c-uniphier.c
+@@ -248,11 +248,8 @@ static int uniphier_i2c_master_xfer(struct i2c_adapter *adap,
+ 		return ret;
+ 
+ 	for (msg = msgs; msg < emsg; msg++) {
+-		/* If next message is read, skip the stop condition */
+-		bool stop = !(msg + 1 < emsg && msg[1].flags & I2C_M_RD);
+-		/* but, force it if I2C_M_STOP is set */
+-		if (msg->flags & I2C_M_STOP)
+-			stop = true;
++		/* Emit STOP if it is the last message or I2C_M_STOP is set. */
++		bool stop = (msg + 1 == emsg) || (msg->flags & I2C_M_STOP);
+ 
+ 		ret = uniphier_i2c_master_xfer_one(adap, msg, stop);
+ 		if (ret)
+diff --git a/drivers/iio/temperature/maxim_thermocouple.c b/drivers/iio/temperature/maxim_thermocouple.c
+index d70e2e53d6a7..557214202eff 100644
+--- a/drivers/iio/temperature/maxim_thermocouple.c
++++ b/drivers/iio/temperature/maxim_thermocouple.c
+@@ -267,7 +267,6 @@ static int maxim_thermocouple_remove(struct spi_device *spi)
+ static const struct spi_device_id maxim_thermocouple_id[] = {
+ 	{"max6675", MAX6675},
+ 	{"max31855", MAX31855},
+-	{"max31856", MAX31855},
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(spi, maxim_thermocouple_id);
+diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
+index a22b992cde38..16423d7ab599 100644
+--- a/drivers/infiniband/core/ucma.c
++++ b/drivers/infiniband/core/ucma.c
+@@ -124,6 +124,8 @@ static DEFINE_MUTEX(mut);
+ static DEFINE_IDR(ctx_idr);
+ static DEFINE_IDR(multicast_idr);
+ 
++static const struct file_operations ucma_fops;
++
+ static inline struct ucma_context *_ucma_find_context(int id,
+ 						      struct ucma_file *file)
+ {
+@@ -1564,6 +1566,10 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file,
+ 	f = fdget(cmd.fd);
+ 	if (!f.file)
+ 		return -ENOENT;
++	if (f.file->f_op != &ucma_fops) {
++		ret = -EINVAL;
++		goto file_put;
++	}
+ 
+ 	/* Validate current fd and prevent destruction of id. */
+ 	ctx = ucma_get_ctx(f.file->private_data, cmd.id);
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 01746e7b90de..9137030423cd 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -3071,7 +3071,7 @@ static phys_addr_t amd_iommu_iova_to_phys(struct iommu_domain *dom,
+ 		return 0;
+ 
+ 	offset_mask = pte_pgsize - 1;
+-	__pte	    = *pte & PM_ADDR_MASK;
++	__pte	    = __sme_clr(*pte & PM_ADDR_MASK);
+ 
+ 	return (__pte & ~offset_mask) | (iova & offset_mask);
+ }
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index 38a2ac24428e..151211b4cb1b 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -3061,6 +3061,11 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ 		set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags);
+ 		rs_set_new(rs);
+ 	} else if (rs_is_recovering(rs)) {
++		/* Rebuild particular devices */
++		if (test_bit(__CTR_FLAG_REBUILD, &rs->ctr_flags)) {
++			set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags);
++			rs_setup_recovery(rs, MaxSector);
++		}
+ 		/* A recovering raid set may be resized */
+ 		; /* skip setup rs */
+ 	} else if (rs_is_reshaping(rs)) {
+diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
+index 36ef284ad086..45ff8fd00248 100644
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -188,6 +188,12 @@ struct dm_pool_metadata {
+ 	unsigned long flags;
+ 	sector_t data_block_size;
+ 
++	/*
++	 * We reserve a section of the metadata for commit overhead.
++	 * All reported space does *not* include this.
++	 */
++	dm_block_t metadata_reserve;
++
+ 	/*
+ 	 * Set if a transaction has to be aborted but the attempt to roll back
+ 	 * to the previous (good) transaction failed.  The only pool metadata
+@@ -825,6 +831,20 @@ static int __commit_transaction(struct dm_pool_metadata *pmd)
+ 	return dm_tm_commit(pmd->tm, sblock);
+ }
+ 
++static void __set_metadata_reserve(struct dm_pool_metadata *pmd)
++{
++	int r;
++	dm_block_t total;
++	dm_block_t max_blocks = 4096; /* 16M */
++
++	r = dm_sm_get_nr_blocks(pmd->metadata_sm, &total);
++	if (r) {
++		DMERR("could not get size of metadata device");
++		pmd->metadata_reserve = max_blocks;
++	} else
++		pmd->metadata_reserve = min(max_blocks, div_u64(total, 10));
++}
++
+ struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev,
+ 					       sector_t data_block_size,
+ 					       bool format_device)
+@@ -858,6 +878,8 @@ struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev,
+ 		return ERR_PTR(r);
+ 	}
+ 
++	__set_metadata_reserve(pmd);
++
+ 	return pmd;
+ }
+ 
+@@ -1829,6 +1851,13 @@ int dm_pool_get_free_metadata_block_count(struct dm_pool_metadata *pmd,
+ 	down_read(&pmd->root_lock);
+ 	if (!pmd->fail_io)
+ 		r = dm_sm_get_nr_free(pmd->metadata_sm, result);
++
++	if (!r) {
++		if (*result < pmd->metadata_reserve)
++			*result = 0;
++		else
++			*result -= pmd->metadata_reserve;
++	}
+ 	up_read(&pmd->root_lock);
+ 
+ 	return r;
+@@ -1941,8 +1970,11 @@ int dm_pool_resize_metadata_dev(struct dm_pool_metadata *pmd, dm_block_t new_cou
+ 	int r = -EINVAL;
+ 
+ 	down_write(&pmd->root_lock);
+-	if (!pmd->fail_io)
++	if (!pmd->fail_io) {
+ 		r = __resize_space_map(pmd->metadata_sm, new_count);
++		if (!r)
++			__set_metadata_reserve(pmd);
++	}
+ 	up_write(&pmd->root_lock);
+ 
+ 	return r;
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 6cf9ad4e4e16..699c40c7fe60 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -200,7 +200,13 @@ struct dm_thin_new_mapping;
+ enum pool_mode {
+ 	PM_WRITE,		/* metadata may be changed */
+ 	PM_OUT_OF_DATA_SPACE,	/* metadata may be changed, though data may not be allocated */
++
++	/*
++	 * Like READ_ONLY, except may switch back to WRITE on metadata resize. Reported as READ_ONLY.
++	 */
++	PM_OUT_OF_METADATA_SPACE,
+ 	PM_READ_ONLY,		/* metadata may not be changed */
++
+ 	PM_FAIL,		/* all I/O fails */
+ };
+ 
+@@ -1382,7 +1388,35 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
+ 
+ static void requeue_bios(struct pool *pool);
+ 
+-static void check_for_space(struct pool *pool)
++static bool is_read_only_pool_mode(enum pool_mode mode)
++{
++	return (mode == PM_OUT_OF_METADATA_SPACE || mode == PM_READ_ONLY);
++}
++
++static bool is_read_only(struct pool *pool)
++{
++	return is_read_only_pool_mode(get_pool_mode(pool));
++}
++
++static void check_for_metadata_space(struct pool *pool)
++{
++	int r;
++	const char *ooms_reason = NULL;
++	dm_block_t nr_free;
++
++	r = dm_pool_get_free_metadata_block_count(pool->pmd, &nr_free);
++	if (r)
++		ooms_reason = "Could not get free metadata blocks";
++	else if (!nr_free)
++		ooms_reason = "No free metadata blocks";
++
++	if (ooms_reason && !is_read_only(pool)) {
++		DMERR("%s", ooms_reason);
++		set_pool_mode(pool, PM_OUT_OF_METADATA_SPACE);
++	}
++}
++
++static void check_for_data_space(struct pool *pool)
+ {
+ 	int r;
+ 	dm_block_t nr_free;
+@@ -1408,14 +1442,16 @@ static int commit(struct pool *pool)
+ {
+ 	int r;
+ 
+-	if (get_pool_mode(pool) >= PM_READ_ONLY)
++	if (get_pool_mode(pool) >= PM_OUT_OF_METADATA_SPACE)
+ 		return -EINVAL;
+ 
+ 	r = dm_pool_commit_metadata(pool->pmd);
+ 	if (r)
+ 		metadata_operation_failed(pool, "dm_pool_commit_metadata", r);
+-	else
+-		check_for_space(pool);
++	else {
++		check_for_metadata_space(pool);
++		check_for_data_space(pool);
++	}
+ 
+ 	return r;
+ }
+@@ -1481,6 +1517,19 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
+ 		return r;
+ 	}
+ 
++	r = dm_pool_get_free_metadata_block_count(pool->pmd, &free_blocks);
++	if (r) {
++		metadata_operation_failed(pool, "dm_pool_get_free_metadata_block_count", r);
++		return r;
++	}
++
++	if (!free_blocks) {
++		/* Let's commit before we use up the metadata reserve. */
++		r = commit(pool);
++		if (r)
++			return r;
++	}
++
+ 	return 0;
+ }
+ 
+@@ -1512,6 +1561,7 @@ static blk_status_t should_error_unserviceable_bio(struct pool *pool)
+ 	case PM_OUT_OF_DATA_SPACE:
+ 		return pool->pf.error_if_no_space ? BLK_STS_NOSPC : 0;
+ 
++	case PM_OUT_OF_METADATA_SPACE:
+ 	case PM_READ_ONLY:
+ 	case PM_FAIL:
+ 		return BLK_STS_IOERR;
+@@ -2475,8 +2525,9 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
+ 		error_retry_list(pool);
+ 		break;
+ 
++	case PM_OUT_OF_METADATA_SPACE:
+ 	case PM_READ_ONLY:
+-		if (old_mode != new_mode)
++		if (!is_read_only_pool_mode(old_mode))
+ 			notify_of_pool_mode_change(pool, "read-only");
+ 		dm_pool_metadata_read_only(pool->pmd);
+ 		pool->process_bio = process_bio_read_only;
+@@ -3412,6 +3463,10 @@ static int maybe_resize_metadata_dev(struct dm_target *ti, bool *need_commit)
+ 		DMINFO("%s: growing the metadata device from %llu to %llu blocks",
+ 		       dm_device_name(pool->pool_md),
+ 		       sb_metadata_dev_size, metadata_dev_size);
++
++		if (get_pool_mode(pool) == PM_OUT_OF_METADATA_SPACE)
++			set_pool_mode(pool, PM_WRITE);
++
+ 		r = dm_pool_resize_metadata_dev(pool->pmd, metadata_dev_size);
+ 		if (r) {
+ 			metadata_operation_failed(pool, "dm_pool_resize_metadata_dev", r);
+@@ -3715,7 +3770,7 @@ static int pool_message(struct dm_target *ti, unsigned argc, char **argv)
+ 	struct pool_c *pt = ti->private;
+ 	struct pool *pool = pt->pool;
+ 
+-	if (get_pool_mode(pool) >= PM_READ_ONLY) {
++	if (get_pool_mode(pool) >= PM_OUT_OF_METADATA_SPACE) {
+ 		DMERR("%s: unable to service pool target messages in READ_ONLY or FAIL mode",
+ 		      dm_device_name(pool->pool_md));
+ 		return -EOPNOTSUPP;
+@@ -3789,6 +3844,7 @@ static void pool_status(struct dm_target *ti, status_type_t type,
+ 	dm_block_t nr_blocks_data;
+ 	dm_block_t nr_blocks_metadata;
+ 	dm_block_t held_root;
++	enum pool_mode mode;
+ 	char buf[BDEVNAME_SIZE];
+ 	char buf2[BDEVNAME_SIZE];
+ 	struct pool_c *pt = ti->private;
+@@ -3859,9 +3915,10 @@ static void pool_status(struct dm_target *ti, status_type_t type,
+ 		else
+ 			DMEMIT("- ");
+ 
+-		if (pool->pf.mode == PM_OUT_OF_DATA_SPACE)
++		mode = get_pool_mode(pool);
++		if (mode == PM_OUT_OF_DATA_SPACE)
+ 			DMEMIT("out_of_data_space ");
+-		else if (pool->pf.mode == PM_READ_ONLY)
++		else if (is_read_only_pool_mode(mode))
+ 			DMEMIT("ro ");
+ 		else
+ 			DMEMIT("rw ");
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 262a0f0f8fd5..927b60e9d3ca 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -4394,11 +4394,12 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr,
+ 		allow_barrier(conf);
+ 	}
+ 
++	raise_barrier(conf, 0);
+ read_more:
+ 	/* Now schedule reads for blocks from sector_nr to last */
+ 	r10_bio = raid10_alloc_init_r10buf(conf);
+ 	r10_bio->state = 0;
+-	raise_barrier(conf, sectors_done != 0);
++	raise_barrier(conf, 1);
+ 	atomic_set(&r10_bio->remaining, 0);
+ 	r10_bio->mddev = mddev;
+ 	r10_bio->sector = sector_nr;
+@@ -4494,6 +4495,8 @@ read_more:
+ 	if (sector_nr <= last)
+ 		goto read_more;
+ 
++	lower_barrier(conf);
++
+ 	/* Now that we have done the whole section we can
+ 	 * update reshape_progress
+ 	 */
+diff --git a/drivers/md/raid5-log.h b/drivers/md/raid5-log.h
+index 284578b0a349..5c908c510c77 100644
+--- a/drivers/md/raid5-log.h
++++ b/drivers/md/raid5-log.h
+@@ -43,6 +43,11 @@ extern void ppl_write_stripe_run(struct r5conf *conf);
+ extern void ppl_stripe_write_finished(struct stripe_head *sh);
+ extern int ppl_modify_log(struct r5conf *conf, struct md_rdev *rdev, bool add);
+ 
++static inline bool raid5_has_log(struct r5conf *conf)
++{
++	return test_bit(MD_HAS_JOURNAL, &conf->mddev->flags);
++}
++
+ static inline bool raid5_has_ppl(struct r5conf *conf)
+ {
+ 	return test_bit(MD_HAS_PPL, &conf->mddev->flags);
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 5018fb2352c2..dbf51b4c21b3 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -736,7 +736,7 @@ static bool stripe_can_batch(struct stripe_head *sh)
+ {
+ 	struct r5conf *conf = sh->raid_conf;
+ 
+-	if (conf->log || raid5_has_ppl(conf))
++	if (raid5_has_log(conf) || raid5_has_ppl(conf))
+ 		return false;
+ 	return test_bit(STRIPE_BATCH_READY, &sh->state) &&
+ 		!test_bit(STRIPE_BITMAP_PENDING, &sh->state) &&
+@@ -7717,7 +7717,7 @@ static int raid5_resize(struct mddev *mddev, sector_t sectors)
+ 	sector_t newsize;
+ 	struct r5conf *conf = mddev->private;
+ 
+-	if (conf->log || raid5_has_ppl(conf))
++	if (raid5_has_log(conf) || raid5_has_ppl(conf))
+ 		return -EINVAL;
+ 	sectors &= ~((sector_t)conf->chunk_sectors - 1);
+ 	newsize = raid5_size(mddev, sectors, mddev->raid_disks);
+@@ -7768,7 +7768,7 @@ static int check_reshape(struct mddev *mddev)
+ {
+ 	struct r5conf *conf = mddev->private;
+ 
+-	if (conf->log || raid5_has_ppl(conf))
++	if (raid5_has_log(conf) || raid5_has_ppl(conf))
+ 		return -EINVAL;
+ 	if (mddev->delta_disks == 0 &&
+ 	    mddev->new_layout == mddev->layout &&
+diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
+index e3b7a71fcad9..1a4ffc5d3da4 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -457,7 +457,7 @@ static void ena_com_handle_admin_completion(struct ena_com_admin_queue *admin_qu
+ 	cqe = &admin_queue->cq.entries[head_masked];
+ 
+ 	/* Go over all the completions */
+-	while ((cqe->acq_common_descriptor.flags &
++	while ((READ_ONCE(cqe->acq_common_descriptor.flags) &
+ 			ENA_ADMIN_ACQ_COMMON_DESC_PHASE_MASK) == phase) {
+ 		/* Do not read the rest of the completion entry before the
+ 		 * phase bit was validated
+@@ -633,7 +633,7 @@ static u32 ena_com_reg_bar_read32(struct ena_com_dev *ena_dev, u16 offset)
+ 	writel(mmio_read_reg, ena_dev->reg_bar + ENA_REGS_MMIO_REG_READ_OFF);
+ 
+ 	for (i = 0; i < timeout; i++) {
+-		if (read_resp->req_id == mmio_read->seq_num)
++		if (READ_ONCE(read_resp->req_id) == mmio_read->seq_num)
+ 			break;
+ 
+ 		udelay(1);
+@@ -1790,8 +1790,8 @@ void ena_com_aenq_intr_handler(struct ena_com_dev *dev, void *data)
+ 	aenq_common = &aenq_e->aenq_common_desc;
+ 
+ 	/* Go over all the events */
+-	while ((aenq_common->flags & ENA_ADMIN_AENQ_COMMON_DESC_PHASE_MASK) ==
+-	       phase) {
++	while ((READ_ONCE(aenq_common->flags) &
++		ENA_ADMIN_AENQ_COMMON_DESC_PHASE_MASK) == phase) {
+ 		pr_debug("AENQ! Group[%x] Syndrom[%x] timestamp: [%llus]\n",
+ 			 aenq_common->group, aenq_common->syndrom,
+ 			 (u64)aenq_common->timestamp_low +
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index 67df5053dc30..60b3ee29d82c 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -456,7 +456,7 @@ static inline int ena_alloc_rx_page(struct ena_ring *rx_ring,
+ 		return -ENOMEM;
+ 	}
+ 
+-	dma = dma_map_page(rx_ring->dev, page, 0, PAGE_SIZE,
++	dma = dma_map_page(rx_ring->dev, page, 0, ENA_PAGE_SIZE,
+ 			   DMA_FROM_DEVICE);
+ 	if (unlikely(dma_mapping_error(rx_ring->dev, dma))) {
+ 		u64_stats_update_begin(&rx_ring->syncp);
+@@ -473,7 +473,7 @@ static inline int ena_alloc_rx_page(struct ena_ring *rx_ring,
+ 	rx_info->page_offset = 0;
+ 	ena_buf = &rx_info->ena_buf;
+ 	ena_buf->paddr = dma;
+-	ena_buf->len = PAGE_SIZE;
++	ena_buf->len = ENA_PAGE_SIZE;
+ 
+ 	return 0;
+ }
+@@ -490,7 +490,7 @@ static void ena_free_rx_page(struct ena_ring *rx_ring,
+ 		return;
+ 	}
+ 
+-	dma_unmap_page(rx_ring->dev, ena_buf->paddr, PAGE_SIZE,
++	dma_unmap_page(rx_ring->dev, ena_buf->paddr, ENA_PAGE_SIZE,
+ 		       DMA_FROM_DEVICE);
+ 
+ 	__free_page(page);
+@@ -910,10 +910,10 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring,
+ 	do {
+ 		dma_unmap_page(rx_ring->dev,
+ 			       dma_unmap_addr(&rx_info->ena_buf, paddr),
+-			       PAGE_SIZE, DMA_FROM_DEVICE);
++			       ENA_PAGE_SIZE, DMA_FROM_DEVICE);
+ 
+ 		skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, rx_info->page,
+-				rx_info->page_offset, len, PAGE_SIZE);
++				rx_info->page_offset, len, ENA_PAGE_SIZE);
+ 
+ 		netif_dbg(rx_ring->adapter, rx_status, rx_ring->netdev,
+ 			  "rx skb updated. len %d. data_len %d\n",
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h
+index 29bb5704260b..3404376c28ca 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
+@@ -350,4 +350,15 @@ void ena_dump_stats_to_buf(struct ena_adapter *adapter, u8 *buf);
+ 
+ int ena_get_sset_count(struct net_device *netdev, int sset);
+ 
++/* The ENA buffer length fields is 16 bit long. So when PAGE_SIZE == 64kB the
++ * driver passas 0.
++ * Since the max packet size the ENA handles is ~9kB limit the buffer length to
++ * 16kB.
++ */
++#if PAGE_SIZE > SZ_16K
++#define ENA_PAGE_SIZE SZ_16K
++#else
++#define ENA_PAGE_SIZE PAGE_SIZE
++#endif
++
+ #endif /* !(ENA_H) */
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index dfef4ec167c1..c1787be6a258 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -642,7 +642,7 @@ static int macb_halt_tx(struct macb *bp)
+ 		if (!(status & MACB_BIT(TGO)))
+ 			return 0;
+ 
+-		usleep_range(10, 250);
++		udelay(250);
+ 	} while (time_before(halt_time, timeout));
+ 
+ 	return -ETIMEDOUT;
+diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h
+index cad52bd331f7..08a750fb60c4 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hnae.h
++++ b/drivers/net/ethernet/hisilicon/hns/hnae.h
+@@ -486,6 +486,8 @@ struct hnae_ae_ops {
+ 			u8 *auto_neg, u16 *speed, u8 *duplex);
+ 	void (*toggle_ring_irq)(struct hnae_ring *ring, u32 val);
+ 	void (*adjust_link)(struct hnae_handle *handle, int speed, int duplex);
++	bool (*need_adjust_link)(struct hnae_handle *handle,
++				 int speed, int duplex);
+ 	int (*set_loopback)(struct hnae_handle *handle,
+ 			    enum hnae_loop loop_mode, int en);
+ 	void (*get_ring_bdnum_limit)(struct hnae_queue *queue,
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+index bd68379d2bea..bf930ab3c2bd 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+@@ -155,6 +155,41 @@ static void hns_ae_put_handle(struct hnae_handle *handle)
+ 		hns_ae_get_ring_pair(handle->qs[i])->used_by_vf = 0;
+ }
+ 
++static int hns_ae_wait_flow_down(struct hnae_handle *handle)
++{
++	struct dsaf_device *dsaf_dev;
++	struct hns_ppe_cb *ppe_cb;
++	struct hnae_vf_cb *vf_cb;
++	int ret;
++	int i;
++
++	for (i = 0; i < handle->q_num; i++) {
++		ret = hns_rcb_wait_tx_ring_clean(handle->qs[i]);
++		if (ret)
++			return ret;
++	}
++
++	ppe_cb = hns_get_ppe_cb(handle);
++	ret = hns_ppe_wait_tx_fifo_clean(ppe_cb);
++	if (ret)
++		return ret;
++
++	dsaf_dev = hns_ae_get_dsaf_dev(handle->dev);
++	if (!dsaf_dev)
++		return -EINVAL;
++	ret = hns_dsaf_wait_pkt_clean(dsaf_dev, handle->dport_id);
++	if (ret)
++		return ret;
++
++	vf_cb = hns_ae_get_vf_cb(handle);
++	ret = hns_mac_wait_fifo_clean(vf_cb->mac_cb);
++	if (ret)
++		return ret;
++
++	mdelay(10);
++	return 0;
++}
++
+ static void hns_ae_ring_enable_all(struct hnae_handle *handle, int val)
+ {
+ 	int q_num = handle->q_num;
+@@ -399,12 +434,41 @@ static int hns_ae_get_mac_info(struct hnae_handle *handle,
+ 	return hns_mac_get_port_info(mac_cb, auto_neg, speed, duplex);
+ }
+ 
++static bool hns_ae_need_adjust_link(struct hnae_handle *handle, int speed,
++				    int duplex)
++{
++	struct hns_mac_cb *mac_cb = hns_get_mac_cb(handle);
++
++	return hns_mac_need_adjust_link(mac_cb, speed, duplex);
++}
++
+ static void hns_ae_adjust_link(struct hnae_handle *handle, int speed,
+ 			       int duplex)
+ {
+ 	struct hns_mac_cb *mac_cb = hns_get_mac_cb(handle);
+ 
+-	hns_mac_adjust_link(mac_cb, speed, duplex);
++	switch (mac_cb->dsaf_dev->dsaf_ver) {
++	case AE_VERSION_1:
++		hns_mac_adjust_link(mac_cb, speed, duplex);
++		break;
++
++	case AE_VERSION_2:
++		/* chip need to clear all pkt inside */
++		hns_mac_disable(mac_cb, MAC_COMM_MODE_RX);
++		if (hns_ae_wait_flow_down(handle)) {
++			hns_mac_enable(mac_cb, MAC_COMM_MODE_RX);
++			break;
++		}
++
++		hns_mac_adjust_link(mac_cb, speed, duplex);
++		hns_mac_enable(mac_cb, MAC_COMM_MODE_RX);
++		break;
++
++	default:
++		break;
++	}
++
++	return;
+ }
+ 
+ static void hns_ae_get_ring_bdnum_limit(struct hnae_queue *queue,
+@@ -902,6 +966,7 @@ static struct hnae_ae_ops hns_dsaf_ops = {
+ 	.get_status = hns_ae_get_link_status,
+ 	.get_info = hns_ae_get_mac_info,
+ 	.adjust_link = hns_ae_adjust_link,
++	.need_adjust_link = hns_ae_need_adjust_link,
+ 	.set_loopback = hns_ae_config_loopback,
+ 	.get_ring_bdnum_limit = hns_ae_get_ring_bdnum_limit,
+ 	.get_pauseparam = hns_ae_get_pauseparam,
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+index 74bd260ca02a..8c7bc5cf193c 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+@@ -257,6 +257,16 @@ static void hns_gmac_get_pausefrm_cfg(void *mac_drv, u32 *rx_pause_en,
+ 	*tx_pause_en = dsaf_get_bit(pause_en, GMAC_PAUSE_EN_TX_FDFC_B);
+ }
+ 
++static bool hns_gmac_need_adjust_link(void *mac_drv, enum mac_speed speed,
++				      int duplex)
++{
++	struct mac_driver *drv = (struct mac_driver *)mac_drv;
++	struct hns_mac_cb *mac_cb = drv->mac_cb;
++
++	return (mac_cb->speed != speed) ||
++		(mac_cb->half_duplex == duplex);
++}
++
+ static int hns_gmac_adjust_link(void *mac_drv, enum mac_speed speed,
+ 				u32 full_duplex)
+ {
+@@ -309,6 +319,30 @@ static void hns_gmac_set_promisc(void *mac_drv, u8 en)
+ 		hns_gmac_set_uc_match(mac_drv, en);
+ }
+ 
++int hns_gmac_wait_fifo_clean(void *mac_drv)
++{
++	struct mac_driver *drv = (struct mac_driver *)mac_drv;
++	int wait_cnt;
++	u32 val;
++
++	wait_cnt = 0;
++	while (wait_cnt++ < HNS_MAX_WAIT_CNT) {
++		val = dsaf_read_dev(drv, GMAC_FIFO_STATE_REG);
++		/* bit5~bit0 is not send complete pkts */
++		if ((val & 0x3f) == 0)
++			break;
++		usleep_range(100, 200);
++	}
++
++	if (wait_cnt >= HNS_MAX_WAIT_CNT) {
++		dev_err(drv->dev,
++			"hns ge %d fifo was not idle.\n", drv->mac_id);
++		return -EBUSY;
++	}
++
++	return 0;
++}
++
+ static void hns_gmac_init(void *mac_drv)
+ {
+ 	u32 port;
+@@ -690,6 +724,7 @@ void *hns_gmac_config(struct hns_mac_cb *mac_cb, struct mac_params *mac_param)
+ 	mac_drv->mac_disable = hns_gmac_disable;
+ 	mac_drv->mac_free = hns_gmac_free;
+ 	mac_drv->adjust_link = hns_gmac_adjust_link;
++	mac_drv->need_adjust_link = hns_gmac_need_adjust_link;
+ 	mac_drv->set_tx_auto_pause_frames = hns_gmac_set_tx_auto_pause_frames;
+ 	mac_drv->config_max_frame_length = hns_gmac_config_max_frame_length;
+ 	mac_drv->mac_pausefrm_cfg = hns_gmac_pause_frm_cfg;
+@@ -717,6 +752,7 @@ void *hns_gmac_config(struct hns_mac_cb *mac_cb, struct mac_params *mac_param)
+ 	mac_drv->get_strings = hns_gmac_get_strings;
+ 	mac_drv->update_stats = hns_gmac_update_stats;
+ 	mac_drv->set_promiscuous = hns_gmac_set_promisc;
++	mac_drv->wait_fifo_clean = hns_gmac_wait_fifo_clean;
+ 
+ 	return (void *)mac_drv;
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+index 8b5cdf490850..5a8dbd72fe45 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+@@ -114,6 +114,26 @@ int hns_mac_get_port_info(struct hns_mac_cb *mac_cb,
+ 	return 0;
+ }
+ 
++/**
++ *hns_mac_is_adjust_link - check is need change mac speed and duplex register
++ *@mac_cb: mac device
++ *@speed: phy device speed
++ *@duplex:phy device duplex
++ *
++ */
++bool hns_mac_need_adjust_link(struct hns_mac_cb *mac_cb, int speed, int duplex)
++{
++	struct mac_driver *mac_ctrl_drv;
++
++	mac_ctrl_drv = (struct mac_driver *)(mac_cb->priv.mac);
++
++	if (mac_ctrl_drv->need_adjust_link)
++		return mac_ctrl_drv->need_adjust_link(mac_ctrl_drv,
++			(enum mac_speed)speed, duplex);
++	else
++		return true;
++}
++
+ void hns_mac_adjust_link(struct hns_mac_cb *mac_cb, int speed, int duplex)
+ {
+ 	int ret;
+@@ -432,6 +452,16 @@ int hns_mac_vm_config_bc_en(struct hns_mac_cb *mac_cb, u32 vmid, bool enable)
+ 	return 0;
+ }
+ 
++int hns_mac_wait_fifo_clean(struct hns_mac_cb *mac_cb)
++{
++	struct mac_driver *drv = hns_mac_get_drv(mac_cb);
++
++	if (drv->wait_fifo_clean)
++		return drv->wait_fifo_clean(drv);
++
++	return 0;
++}
++
+ void hns_mac_reset(struct hns_mac_cb *mac_cb)
+ {
+ 	struct mac_driver *drv = hns_mac_get_drv(mac_cb);
+@@ -1001,6 +1031,20 @@ static int hns_mac_get_max_port_num(struct dsaf_device *dsaf_dev)
+ 		return  DSAF_MAX_PORT_NUM;
+ }
+ 
++void hns_mac_enable(struct hns_mac_cb *mac_cb, enum mac_commom_mode mode)
++{
++	struct mac_driver *mac_ctrl_drv = hns_mac_get_drv(mac_cb);
++
++	mac_ctrl_drv->mac_enable(mac_cb->priv.mac, mode);
++}
++
++void hns_mac_disable(struct hns_mac_cb *mac_cb, enum mac_commom_mode mode)
++{
++	struct mac_driver *mac_ctrl_drv = hns_mac_get_drv(mac_cb);
++
++	mac_ctrl_drv->mac_disable(mac_cb->priv.mac, mode);
++}
++
+ /**
+  * hns_mac_init - init mac
+  * @dsaf_dev: dsa fabric device struct pointer
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
+index bbc0a98e7ca3..fbc75341bef7 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
+@@ -356,6 +356,9 @@ struct mac_driver {
+ 	/*adjust mac mode of port,include speed and duplex*/
+ 	int (*adjust_link)(void *mac_drv, enum mac_speed speed,
+ 			   u32 full_duplex);
++	/* need adjust link */
++	bool (*need_adjust_link)(void *mac_drv, enum mac_speed speed,
++				 int duplex);
+ 	/* config autoegotaite mode of port*/
+ 	void (*set_an_mode)(void *mac_drv, u8 enable);
+ 	/* config loopbank mode */
+@@ -394,6 +397,7 @@ struct mac_driver {
+ 	void (*get_info)(void *mac_drv, struct mac_info *mac_info);
+ 
+ 	void (*update_stats)(void *mac_drv);
++	int (*wait_fifo_clean)(void *mac_drv);
+ 
+ 	enum mac_mode mac_mode;
+ 	u8 mac_id;
+@@ -427,6 +431,7 @@ void *hns_xgmac_config(struct hns_mac_cb *mac_cb,
+ 
+ int hns_mac_init(struct dsaf_device *dsaf_dev);
+ void mac_adjust_link(struct net_device *net_dev);
++bool hns_mac_need_adjust_link(struct hns_mac_cb *mac_cb, int speed, int duplex);
+ void hns_mac_get_link_status(struct hns_mac_cb *mac_cb,	u32 *link_status);
+ int hns_mac_change_vf_addr(struct hns_mac_cb *mac_cb, u32 vmid, char *addr);
+ int hns_mac_set_multi(struct hns_mac_cb *mac_cb,
+@@ -463,5 +468,8 @@ int hns_mac_add_uc_addr(struct hns_mac_cb *mac_cb, u8 vf_id,
+ int hns_mac_rm_uc_addr(struct hns_mac_cb *mac_cb, u8 vf_id,
+ 		       const unsigned char *addr);
+ int hns_mac_clr_multicast(struct hns_mac_cb *mac_cb, int vfn);
++void hns_mac_enable(struct hns_mac_cb *mac_cb, enum mac_commom_mode mode);
++void hns_mac_disable(struct hns_mac_cb *mac_cb, enum mac_commom_mode mode);
++int hns_mac_wait_fifo_clean(struct hns_mac_cb *mac_cb);
+ 
+ #endif /* _HNS_DSAF_MAC_H */
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+index e0bc79ea3d88..1f056a6b167e 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+@@ -2720,6 +2720,35 @@ void hns_dsaf_set_promisc_tcam(struct dsaf_device *dsaf_dev,
+ 	soft_mac_entry->index = enable ? entry_index : DSAF_INVALID_ENTRY_IDX;
+ }
+ 
++int hns_dsaf_wait_pkt_clean(struct dsaf_device *dsaf_dev, int port)
++{
++	u32 val, val_tmp;
++	int wait_cnt;
++
++	if (port >= DSAF_SERVICE_NW_NUM)
++		return 0;
++
++	wait_cnt = 0;
++	while (wait_cnt++ < HNS_MAX_WAIT_CNT) {
++		val = dsaf_read_dev(dsaf_dev, DSAF_VOQ_IN_PKT_NUM_0_REG +
++			(port + DSAF_XGE_NUM) * 0x40);
++		val_tmp = dsaf_read_dev(dsaf_dev, DSAF_VOQ_OUT_PKT_NUM_0_REG +
++			(port + DSAF_XGE_NUM) * 0x40);
++		if (val == val_tmp)
++			break;
++
++		usleep_range(100, 200);
++	}
++
++	if (wait_cnt >= HNS_MAX_WAIT_CNT) {
++		dev_err(dsaf_dev->dev, "hns dsaf clean wait timeout(%u - %u).\n",
++			val, val_tmp);
++		return -EBUSY;
++	}
++
++	return 0;
++}
++
+ /**
+  * dsaf_probe - probo dsaf dev
+  * @pdev: dasf platform device
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
+index 4507e8222683..0e1cd99831a6 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
+@@ -44,6 +44,8 @@ struct hns_mac_cb;
+ #define DSAF_ROCE_CREDIT_CHN	8
+ #define DSAF_ROCE_CHAN_MODE	3
+ 
++#define HNS_MAX_WAIT_CNT 10000
++
+ enum dsaf_roce_port_mode {
+ 	DSAF_ROCE_6PORT_MODE,
+ 	DSAF_ROCE_4PORT_MODE,
+@@ -463,5 +465,6 @@ int hns_dsaf_rm_mac_addr(
+ 
+ int hns_dsaf_clr_mac_mc_port(struct dsaf_device *dsaf_dev,
+ 			     u8 mac_id, u8 port_num);
++int hns_dsaf_wait_pkt_clean(struct dsaf_device *dsaf_dev, int port);
+ 
+ #endif /* __HNS_DSAF_MAIN_H__ */
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
+index 93e71e27401b..a19932aeb9d7 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
+@@ -274,6 +274,29 @@ static void hns_ppe_exc_irq_en(struct hns_ppe_cb *ppe_cb, int en)
+ 	dsaf_write_dev(ppe_cb, PPE_INTEN_REG, msk_vlue & vld_msk);
+ }
+ 
++int hns_ppe_wait_tx_fifo_clean(struct hns_ppe_cb *ppe_cb)
++{
++	int wait_cnt;
++	u32 val;
++
++	wait_cnt = 0;
++	while (wait_cnt++ < HNS_MAX_WAIT_CNT) {
++		val = dsaf_read_dev(ppe_cb, PPE_CURR_TX_FIFO0_REG) & 0x3ffU;
++		if (!val)
++			break;
++
++		usleep_range(100, 200);
++	}
++
++	if (wait_cnt >= HNS_MAX_WAIT_CNT) {
++		dev_err(ppe_cb->dev, "hns ppe tx fifo clean wait timeout, still has %u pkt.\n",
++			val);
++		return -EBUSY;
++	}
++
++	return 0;
++}
++
+ /**
+  * ppe_init_hw - init ppe
+  * @ppe_cb: ppe device
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
+index 9d8e643e8aa6..f670e63a5a01 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
+@@ -100,6 +100,7 @@ struct ppe_common_cb {
+ 
+ };
+ 
++int hns_ppe_wait_tx_fifo_clean(struct hns_ppe_cb *ppe_cb);
+ int hns_ppe_init(struct dsaf_device *dsaf_dev);
+ 
+ void hns_ppe_uninit(struct dsaf_device *dsaf_dev);
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
+index e2e28532e4dc..1e43d7a3ca86 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
+@@ -66,6 +66,29 @@ void hns_rcb_wait_fbd_clean(struct hnae_queue **qs, int q_num, u32 flag)
+ 			"queue(%d) wait fbd(%d) clean fail!!\n", i, fbd_num);
+ }
+ 
++int hns_rcb_wait_tx_ring_clean(struct hnae_queue *qs)
++{
++	u32 head, tail;
++	int wait_cnt;
++
++	tail = dsaf_read_dev(&qs->tx_ring, RCB_REG_TAIL);
++	wait_cnt = 0;
++	while (wait_cnt++ < HNS_MAX_WAIT_CNT) {
++		head = dsaf_read_dev(&qs->tx_ring, RCB_REG_HEAD);
++		if (tail == head)
++			break;
++
++		usleep_range(100, 200);
++	}
++
++	if (wait_cnt >= HNS_MAX_WAIT_CNT) {
++		dev_err(qs->dev->dev, "rcb wait timeout, head not equal to tail.\n");
++		return -EBUSY;
++	}
++
++	return 0;
++}
++
+ /**
+  *hns_rcb_reset_ring_hw - ring reset
+  *@q: ring struct pointer
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h
+index 602816498c8d..2319b772a271 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h
+@@ -136,6 +136,7 @@ void hns_rcbv2_int_clr_hw(struct hnae_queue *q, u32 flag);
+ void hns_rcb_init_hw(struct ring_pair_cb *ring);
+ void hns_rcb_reset_ring_hw(struct hnae_queue *q);
+ void hns_rcb_wait_fbd_clean(struct hnae_queue **qs, int q_num, u32 flag);
++int hns_rcb_wait_tx_ring_clean(struct hnae_queue *qs);
+ u32 hns_rcb_get_rx_coalesced_frames(
+ 	struct rcb_common_cb *rcb_common, u32 port_idx);
+ u32 hns_rcb_get_tx_coalesced_frames(
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+index 46a52d9bb196..6d20e4eb7402 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+@@ -464,6 +464,7 @@
+ #define RCB_RING_INTMSK_TX_OVERTIME_REG		0x000C4
+ #define RCB_RING_INTSTS_TX_OVERTIME_REG		0x000C8
+ 
++#define GMAC_FIFO_STATE_REG			0x0000UL
+ #define GMAC_DUPLEX_TYPE_REG			0x0008UL
+ #define GMAC_FD_FC_TYPE_REG			0x000CUL
+ #define GMAC_TX_WATER_LINE_REG			0x0010UL
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 25a9732afc84..07d6a9cf2c55 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -1212,11 +1212,26 @@ static void hns_nic_adjust_link(struct net_device *ndev)
+ 	struct hnae_handle *h = priv->ae_handle;
+ 	int state = 1;
+ 
++	/* If there is no phy, do not need adjust link */
+ 	if (ndev->phydev) {
+-		h->dev->ops->adjust_link(h, ndev->phydev->speed,
+-					 ndev->phydev->duplex);
+-		state = ndev->phydev->link;
++		/* When phy link down, do nothing */
++		if (ndev->phydev->link == 0)
++			return;
++
++		if (h->dev->ops->need_adjust_link(h, ndev->phydev->speed,
++						  ndev->phydev->duplex)) {
++			/* because Hi161X chip don't support to change gmac
++			 * speed and duplex with traffic. Delay 200ms to
++			 * make sure there is no more data in chip FIFO.
++			 */
++			netif_carrier_off(ndev);
++			msleep(200);
++			h->dev->ops->adjust_link(h, ndev->phydev->speed,
++						 ndev->phydev->duplex);
++			netif_carrier_on(ndev);
++		}
+ 	}
++
+ 	state = state && h->dev->ops->get_status(h);
+ 
+ 	if (state != priv->link) {
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+index 2e14a3ae1d8b..c1e947bb852f 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+@@ -243,7 +243,9 @@ static int hns_nic_set_link_ksettings(struct net_device *net_dev,
+ 	}
+ 
+ 	if (h->dev->ops->adjust_link) {
++		netif_carrier_off(net_dev);
+ 		h->dev->ops->adjust_link(h, (int)speed, cmd->base.duplex);
++		netif_carrier_on(net_dev);
+ 		return 0;
+ 	}
+ 
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index b68d94b49a8a..42183a8b649c 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -3108,11 +3108,13 @@ int ixgbe_poll(struct napi_struct *napi, int budget)
+ 		return budget;
+ 
+ 	/* all work done, exit the polling mode */
+-	napi_complete_done(napi, work_done);
+-	if (adapter->rx_itr_setting & 1)
+-		ixgbe_set_itr(q_vector);
+-	if (!test_bit(__IXGBE_DOWN, &adapter->state))
+-		ixgbe_irq_enable_queues(adapter, BIT_ULL(q_vector->v_idx));
++	if (likely(napi_complete_done(napi, work_done))) {
++		if (adapter->rx_itr_setting & 1)
++			ixgbe_set_itr(q_vector);
++		if (!test_bit(__IXGBE_DOWN, &adapter->state))
++			ixgbe_irq_enable_queues(adapter,
++						BIT_ULL(q_vector->v_idx));
++	}
+ 
+ 	return min(work_done, budget - 1);
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+index 9f9c9ff10735..07fda3984e10 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+@@ -388,16 +388,17 @@ void mlx5_remove_dev_by_protocol(struct mlx5_core_dev *dev, int protocol)
+ 		}
+ }
+ 
+-static u16 mlx5_gen_pci_id(struct mlx5_core_dev *dev)
++static u32 mlx5_gen_pci_id(struct mlx5_core_dev *dev)
+ {
+-	return (u16)((dev->pdev->bus->number << 8) |
++	return (u32)((pci_domain_nr(dev->pdev->bus) << 16) |
++		     (dev->pdev->bus->number << 8) |
+ 		     PCI_SLOT(dev->pdev->devfn));
+ }
+ 
+ /* Must be called with intf_mutex held */
+ struct mlx5_core_dev *mlx5_get_next_phys_dev(struct mlx5_core_dev *dev)
+ {
+-	u16 pci_id = mlx5_gen_pci_id(dev);
++	u32 pci_id = mlx5_gen_pci_id(dev);
+ 	struct mlx5_core_dev *res = NULL;
+ 	struct mlx5_core_dev *tmp_dev;
+ 	struct mlx5_priv *priv;
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 3669005b9294..f7e540eeb877 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -760,7 +760,7 @@ struct rtl8169_tc_offsets {
+ };
+ 
+ enum rtl_flag {
+-	RTL_FLAG_TASK_ENABLED,
++	RTL_FLAG_TASK_ENABLED = 0,
+ 	RTL_FLAG_TASK_SLOW_PENDING,
+ 	RTL_FLAG_TASK_RESET_PENDING,
+ 	RTL_FLAG_TASK_PHY_PENDING,
+@@ -7657,7 +7657,8 @@ static int rtl8169_close(struct net_device *dev)
+ 	rtl8169_update_counters(dev);
+ 
+ 	rtl_lock_work(tp);
+-	clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags);
++	/* Clear all task flags */
++	bitmap_zero(tp->wk.flags, RTL_FLAG_MAX);
+ 
+ 	rtl8169_down(dev);
+ 	rtl_unlock_work(tp);
+@@ -7838,7 +7839,9 @@ static void rtl8169_net_suspend(struct net_device *dev)
+ 
+ 	rtl_lock_work(tp);
+ 	napi_disable(&tp->napi);
+-	clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags);
++	/* Clear all task flags */
++	bitmap_zero(tp->wk.flags, RTL_FLAG_MAX);
++
+ 	rtl_unlock_work(tp);
+ 
+ 	rtl_pll_power_down(tp);
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index d686ba10fecc..aafa7aa18fbd 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -2632,9 +2632,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
+ 				IEEE80211_VHT_CAP_SHORT_GI_80 |
+ 				IEEE80211_VHT_CAP_SHORT_GI_160 |
+ 				IEEE80211_VHT_CAP_TXSTBC |
+-				IEEE80211_VHT_CAP_RXSTBC_1 |
+-				IEEE80211_VHT_CAP_RXSTBC_2 |
+-				IEEE80211_VHT_CAP_RXSTBC_3 |
+ 				IEEE80211_VHT_CAP_RXSTBC_4 |
+ 				IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
+ 			sband->vht_cap.vht_mcs.rx_mcs_map =
+@@ -3124,6 +3121,11 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
+ 	if (info->attrs[HWSIM_ATTR_CHANNELS])
+ 		param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
+ 
++	if (param.channels < 1) {
++		GENL_SET_ERR_MSG(info, "must have at least one channel");
++		return -EINVAL;
++	}
++
+ 	if (param.channels > CFG80211_MAX_NUM_DIFFERENT_CHANNELS) {
+ 		GENL_SET_ERR_MSG(info, "too many channels specified");
+ 		return -EINVAL;
+diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
+index 3333d417b248..a70b3d24936d 100644
+--- a/drivers/nvme/target/rdma.c
++++ b/drivers/nvme/target/rdma.c
+@@ -65,6 +65,7 @@ struct nvmet_rdma_rsp {
+ 
+ 	struct nvmet_req	req;
+ 
++	bool			allocated;
+ 	u8			n_rdma;
+ 	u32			flags;
+ 	u32			invalidate_rkey;
+@@ -167,11 +168,19 @@ nvmet_rdma_get_rsp(struct nvmet_rdma_queue *queue)
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&queue->rsps_lock, flags);
+-	rsp = list_first_entry(&queue->free_rsps,
++	rsp = list_first_entry_or_null(&queue->free_rsps,
+ 				struct nvmet_rdma_rsp, free_list);
+-	list_del(&rsp->free_list);
++	if (likely(rsp))
++		list_del(&rsp->free_list);
+ 	spin_unlock_irqrestore(&queue->rsps_lock, flags);
+ 
++	if (unlikely(!rsp)) {
++		rsp = kmalloc(sizeof(*rsp), GFP_KERNEL);
++		if (unlikely(!rsp))
++			return NULL;
++		rsp->allocated = true;
++	}
++
+ 	return rsp;
+ }
+ 
+@@ -180,6 +189,11 @@ nvmet_rdma_put_rsp(struct nvmet_rdma_rsp *rsp)
+ {
+ 	unsigned long flags;
+ 
++	if (rsp->allocated) {
++		kfree(rsp);
++		return;
++	}
++
+ 	spin_lock_irqsave(&rsp->queue->rsps_lock, flags);
+ 	list_add_tail(&rsp->free_list, &rsp->queue->free_rsps);
+ 	spin_unlock_irqrestore(&rsp->queue->rsps_lock, flags);
+@@ -756,6 +770,15 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ 
+ 	cmd->queue = queue;
+ 	rsp = nvmet_rdma_get_rsp(queue);
++	if (unlikely(!rsp)) {
++		/*
++		 * we get here only under memory pressure,
++		 * silently drop and have the host retry
++		 * as we can't even fail it.
++		 */
++		nvmet_rdma_post_recv(queue->dev, cmd);
++		return;
++	}
+ 	rsp->queue = queue;
+ 	rsp->cmd = cmd;
+ 	rsp->flags = 0;
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 0a6afd4b283d..4f2747cd15a6 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -23,6 +23,7 @@
+ #include <linux/netdevice.h>
+ #include <linux/netdev_features.h>
+ #include <linux/skbuff.h>
++#include <linux/vmalloc.h>
+ 
+ #include <net/iucv/af_iucv.h>
+ #include <net/dsfield.h>
+@@ -4728,7 +4729,7 @@ static int qeth_query_oat_command(struct qeth_card *card, char __user *udata)
+ 
+ 	priv.buffer_len = oat_data.buffer_len;
+ 	priv.response_len = 0;
+-	priv.buffer =  kzalloc(oat_data.buffer_len, GFP_KERNEL);
++	priv.buffer = vzalloc(oat_data.buffer_len);
+ 	if (!priv.buffer) {
+ 		rc = -ENOMEM;
+ 		goto out;
+@@ -4769,7 +4770,7 @@ static int qeth_query_oat_command(struct qeth_card *card, char __user *udata)
+ 			rc = -EFAULT;
+ 
+ out_free:
+-	kfree(priv.buffer);
++	vfree(priv.buffer);
+ out:
+ 	return rc;
+ }
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index 521293b1f4fa..11ae67842edf 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -484,7 +484,7 @@ static int qeth_l2_process_inbound_buffer(struct qeth_card *card,
+ 		default:
+ 			dev_kfree_skb_any(skb);
+ 			QETH_CARD_TEXT(card, 3, "inbunkno");
+-			QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN);
++			QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr));
+ 			continue;
+ 		}
+ 		work_done++;
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index 1c62cbbaa66f..cd73172bff47 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -1793,7 +1793,7 @@ static int qeth_l3_process_inbound_buffer(struct qeth_card *card,
+ 		default:
+ 			dev_kfree_skb_any(skb);
+ 			QETH_CARD_TEXT(card, 3, "inbunkno");
+-			QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN);
++			QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr));
+ 			continue;
+ 		}
+ 		work_done++;
+diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
+index 5be0086142ca..ab30db8c36c6 100644
+--- a/drivers/scsi/csiostor/csio_hw.c
++++ b/drivers/scsi/csiostor/csio_hw.c
+@@ -2010,8 +2010,8 @@ bye:
+ }
+ 
+ /*
+- * Returns -EINVAL if attempts to flash the firmware failed
+- * else returns 0,
++ * Returns -EINVAL if attempts to flash the firmware failed,
++ * -ENOMEM if memory allocation failed else returns 0,
+  * if flashing was not attempted because the card had the
+  * latest firmware ECANCELED is returned
+  */
+@@ -2039,6 +2039,13 @@ csio_hw_flash_fw(struct csio_hw *hw, int *reset)
+ 		return -EINVAL;
+ 	}
+ 
++	/* allocate memory to read the header of the firmware on the
++	 * card
++	 */
++	card_fw = kmalloc(sizeof(*card_fw), GFP_KERNEL);
++	if (!card_fw)
++		return -ENOMEM;
++
+ 	if (csio_is_t5(pci_dev->device & CSIO_HW_CHIP_MASK))
+ 		fw_bin_file = FW_FNAME_T5;
+ 	else
+@@ -2052,11 +2059,6 @@ csio_hw_flash_fw(struct csio_hw *hw, int *reset)
+ 		fw_size = fw->size;
+ 	}
+ 
+-	/* allocate memory to read the header of the firmware on the
+-	 * card
+-	 */
+-	card_fw = kmalloc(sizeof(*card_fw), GFP_KERNEL);
+-
+ 	/* upgrade FW logic */
+ 	ret = csio_hw_prep_fw(hw, fw_info, fw_data, fw_size, card_fw,
+ 			 hw->fw_state, reset);
+diff --git a/drivers/scsi/qedi/qedi.h b/drivers/scsi/qedi/qedi.h
+index b8b22ce60ecc..95141066c3fa 100644
+--- a/drivers/scsi/qedi/qedi.h
++++ b/drivers/scsi/qedi/qedi.h
+@@ -77,6 +77,11 @@ enum qedi_nvm_tgts {
+ 	QEDI_NVM_TGT_SEC,
+ };
+ 
++struct qedi_nvm_iscsi_image {
++	struct nvm_iscsi_cfg iscsi_cfg;
++	u32 crc;
++};
++
+ struct qedi_uio_ctrl {
+ 	/* meta data */
+ 	u32 uio_hsi_version;
+@@ -294,7 +299,7 @@ struct qedi_ctx {
+ 	void *bdq_pbl_list;
+ 	dma_addr_t bdq_pbl_list_dma;
+ 	u8 bdq_pbl_list_num_entries;
+-	struct nvm_iscsi_cfg *iscsi_cfg;
++	struct qedi_nvm_iscsi_image *iscsi_image;
+ 	dma_addr_t nvm_buf_dma;
+ 	void __iomem *bdq_primary_prod;
+ 	void __iomem *bdq_secondary_prod;
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index e7daadc089fc..24b945b555ba 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -1147,23 +1147,26 @@ exit_setup_int:
+ 
+ static void qedi_free_nvm_iscsi_cfg(struct qedi_ctx *qedi)
+ {
+-	if (qedi->iscsi_cfg)
++	if (qedi->iscsi_image)
+ 		dma_free_coherent(&qedi->pdev->dev,
+-				  sizeof(struct nvm_iscsi_cfg),
+-				  qedi->iscsi_cfg, qedi->nvm_buf_dma);
++				  sizeof(struct qedi_nvm_iscsi_image),
++				  qedi->iscsi_image, qedi->nvm_buf_dma);
+ }
+ 
+ static int qedi_alloc_nvm_iscsi_cfg(struct qedi_ctx *qedi)
+ {
+-	qedi->iscsi_cfg = dma_zalloc_coherent(&qedi->pdev->dev,
+-					     sizeof(struct nvm_iscsi_cfg),
+-					     &qedi->nvm_buf_dma, GFP_KERNEL);
+-	if (!qedi->iscsi_cfg) {
++	struct qedi_nvm_iscsi_image nvm_image;
++
++	qedi->iscsi_image = dma_zalloc_coherent(&qedi->pdev->dev,
++						sizeof(nvm_image),
++						&qedi->nvm_buf_dma,
++						GFP_KERNEL);
++	if (!qedi->iscsi_image) {
+ 		QEDI_ERR(&qedi->dbg_ctx, "Could not allocate NVM BUF.\n");
+ 		return -ENOMEM;
+ 	}
+ 	QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
+-		  "NVM BUF addr=0x%p dma=0x%llx.\n", qedi->iscsi_cfg,
++		  "NVM BUF addr=0x%p dma=0x%llx.\n", qedi->iscsi_image,
+ 		  qedi->nvm_buf_dma);
+ 
+ 	return 0;
+@@ -1716,7 +1719,7 @@ qedi_get_nvram_block(struct qedi_ctx *qedi)
+ 	struct nvm_iscsi_block *block;
+ 
+ 	pf = qedi->dev_info.common.abs_pf_id;
+-	block = &qedi->iscsi_cfg->block[0];
++	block = &qedi->iscsi_image->iscsi_cfg.block[0];
+ 	for (i = 0; i < NUM_OF_ISCSI_PF_SUPPORTED; i++, block++) {
+ 		flags = ((block->id) & NVM_ISCSI_CFG_BLK_CTRL_FLAG_MASK) >>
+ 			NVM_ISCSI_CFG_BLK_CTRL_FLAG_OFFSET;
+@@ -2008,15 +2011,14 @@ static void qedi_boot_release(void *data)
+ static int qedi_get_boot_info(struct qedi_ctx *qedi)
+ {
+ 	int ret = 1;
+-	u16 len;
+-
+-	len = sizeof(struct nvm_iscsi_cfg);
++	struct qedi_nvm_iscsi_image nvm_image;
+ 
+ 	QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
+ 		  "Get NVM iSCSI CFG image\n");
+ 	ret = qedi_ops->common->nvm_get_image(qedi->cdev,
+ 					      QED_NVM_IMAGE_ISCSI_CFG,
+-					      (char *)qedi->iscsi_cfg, len);
++					      (char *)qedi->iscsi_image,
++					      sizeof(nvm_image));
+ 	if (ret)
+ 		QEDI_ERR(&qedi->dbg_ctx,
+ 			 "Could not get NVM image. ret = %d\n", ret);
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index 98e27da34f3c..27893d90c4ef 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -310,11 +310,9 @@ static int iscsi_login_zero_tsih_s1(
+ 		return -ENOMEM;
+ 	}
+ 
+-	ret = iscsi_login_set_conn_values(sess, conn, pdu->cid);
+-	if (unlikely(ret)) {
+-		kfree(sess);
+-		return ret;
+-	}
++	if (iscsi_login_set_conn_values(sess, conn, pdu->cid))
++		goto free_sess;
++
+ 	sess->init_task_tag	= pdu->itt;
+ 	memcpy(&sess->isid, pdu->isid, 6);
+ 	sess->exp_cmd_sn	= be32_to_cpu(pdu->cmdsn);
+diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
+index 45b57c294d13..401c983ec5f3 100644
+--- a/drivers/tty/serial/mvebu-uart.c
++++ b/drivers/tty/serial/mvebu-uart.c
+@@ -327,8 +327,10 @@ static void mvebu_uart_set_termios(struct uart_port *port,
+ 	if ((termios->c_cflag & CREAD) == 0)
+ 		port->ignore_status_mask |= STAT_RX_RDY | STAT_BRK_ERR;
+ 
+-	if (old)
++	if (old) {
+ 		tty_termios_copy_hw(termios, old);
++		termios->c_cflag |= CS8;
++	}
+ 
+ 	baud = uart_get_baud_rate(port, termios, old, 0, 460800);
+ 	uart_update_timeout(port, termios->c_cflag, baud);
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index 78d0204e3e20..d17d7052605b 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -1066,12 +1066,15 @@ static const struct usb_gadget_ops fotg210_gadget_ops = {
+ static int fotg210_udc_remove(struct platform_device *pdev)
+ {
+ 	struct fotg210_udc *fotg210 = platform_get_drvdata(pdev);
++	int i;
+ 
+ 	usb_del_gadget_udc(&fotg210->gadget);
+ 	iounmap(fotg210->reg);
+ 	free_irq(platform_get_irq(pdev, 0), fotg210);
+ 
+ 	fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
++	for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
++		kfree(fotg210->ep[i]);
+ 	kfree(fotg210);
+ 
+ 	return 0;
+@@ -1102,7 +1105,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
+ 	/* initialize udc */
+ 	fotg210 = kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL);
+ 	if (fotg210 == NULL)
+-		goto err_alloc;
++		goto err;
+ 
+ 	for (i = 0; i < FOTG210_MAX_NUM_EP; i++) {
+ 		_ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL);
+@@ -1114,7 +1117,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
+ 	fotg210->reg = ioremap(res->start, resource_size(res));
+ 	if (fotg210->reg == NULL) {
+ 		pr_err("ioremap error.\n");
+-		goto err_map;
++		goto err_alloc;
+ 	}
+ 
+ 	spin_lock_init(&fotg210->lock);
+@@ -1162,7 +1165,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
+ 	fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep,
+ 				GFP_KERNEL);
+ 	if (fotg210->ep0_req == NULL)
+-		goto err_req;
++		goto err_map;
+ 
+ 	fotg210_init(fotg210);
+ 
+@@ -1190,12 +1193,14 @@ err_req:
+ 	fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
+ 
+ err_map:
+-	if (fotg210->reg)
+-		iounmap(fotg210->reg);
++	iounmap(fotg210->reg);
+ 
+ err_alloc:
++	for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
++		kfree(fotg210->ep[i]);
+ 	kfree(fotg210);
+ 
++err:
+ 	return ret;
+ }
+ 
+diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
+index 0673f286afbd..4f48f5730e12 100644
+--- a/drivers/usb/misc/yurex.c
++++ b/drivers/usb/misc/yurex.c
+@@ -417,6 +417,9 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,
+ 	spin_unlock_irqrestore(&dev->lock, flags);
+ 	mutex_unlock(&dev->io_mutex);
+ 
++	if (WARN_ON_ONCE(len >= sizeof(in_buffer)))
++		return -EIO;
++
+ 	return simple_read_from_buffer(buffer, count, ppos, in_buffer, len);
+ }
+ 
+diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c
+index d4265c8ebb22..b1357aa4bc55 100644
+--- a/drivers/xen/cpu_hotplug.c
++++ b/drivers/xen/cpu_hotplug.c
+@@ -19,15 +19,16 @@ static void enable_hotplug_cpu(int cpu)
+ 
+ static void disable_hotplug_cpu(int cpu)
+ {
+-	if (cpu_online(cpu)) {
+-		lock_device_hotplug();
++	if (!cpu_is_hotpluggable(cpu))
++		return;
++	lock_device_hotplug();
++	if (cpu_online(cpu))
+ 		device_offline(get_cpu_device(cpu));
+-		unlock_device_hotplug();
+-	}
+-	if (cpu_present(cpu))
++	if (!cpu_online(cpu) && cpu_present(cpu)) {
+ 		xen_arch_unregister_cpu(cpu);
+-
+-	set_cpu_present(cpu, false);
++		set_cpu_present(cpu, false);
++	}
++	unlock_device_hotplug();
+ }
+ 
+ static int vcpu_online(unsigned int cpu)
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index 08e4af04d6f2..e6c1934734b7 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -138,7 +138,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq)
+ 		clear_evtchn_to_irq_row(row);
+ 	}
+ 
+-	evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)] = irq;
++	evtchn_to_irq[row][col] = irq;
+ 	return 0;
+ }
+ 
+diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
+index 587d12829925..0444ebdda3f0 100644
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -283,9 +283,11 @@ static void sysrq_handler(struct xenbus_watch *watch, const char *path,
+ 		/*
+ 		 * The Xenstore watch fires directly after registering it and
+ 		 * after a suspend/resume cycle. So ENOENT is no error but
+-		 * might happen in those cases.
++		 * might happen in those cases. ERANGE is observed when we get
++		 * an empty value (''), this happens when we acknowledge the
++		 * request by writing '\0' below.
+ 		 */
+-		if (err != -ENOENT)
++		if (err != -ENOENT && err != -ERANGE)
+ 			pr_err("Error %d reading sysrq code in control/sysrq\n",
+ 			       err);
+ 		xenbus_transaction_end(xbt, 1);
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index a39b1f0b0606..a0947f4a3e87 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -4517,7 +4517,12 @@ again:
+ 
+ 	/* Now btrfs_update_device() will change the on-disk size. */
+ 	ret = btrfs_update_device(trans, device);
+-	btrfs_end_transaction(trans);
++	if (ret < 0) {
++		btrfs_abort_transaction(trans, ret);
++		btrfs_end_transaction(trans);
++	} else {
++		ret = btrfs_commit_transaction(trans);
++	}
+ done:
+ 	btrfs_free_path(path);
+ 	if (ret) {
+diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
+index b380e0871372..a2b2355e7f01 100644
+--- a/fs/cifs/cifs_unicode.c
++++ b/fs/cifs/cifs_unicode.c
+@@ -105,9 +105,6 @@ convert_sfm_char(const __u16 src_char, char *target)
+ 	case SFM_LESSTHAN:
+ 		*target = '<';
+ 		break;
+-	case SFM_SLASH:
+-		*target = '\\';
+-		break;
+ 	case SFM_SPACE:
+ 		*target = ' ';
+ 		break;
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index b5a436583469..2e936f94f102 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -589,10 +589,15 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses)
+ 	}
+ 
+ 	count = 0;
++	/*
++	 * We know that all the name entries in the protocols array
++	 * are short (< 16 bytes anyway) and are NUL terminated.
++	 */
+ 	for (i = 0; i < CIFS_NUM_PROT; i++) {
+-		strncpy(pSMB->DialectsArray+count, protocols[i].name, 16);
+-		count += strlen(protocols[i].name) + 1;
+-		/* null at end of source and target buffers anyway */
++		size_t len = strlen(protocols[i].name) + 1;
++
++		memcpy(pSMB->DialectsArray+count, protocols[i].name, len);
++		count += len;
+ 	}
+ 	inc_rfc1001_len(pSMB, count);
+ 	pSMB->ByteCount = cpu_to_le16(count);
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index 460084a8eac5..bcab30d4a6c7 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -398,9 +398,17 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
+ 			(struct smb_com_transaction_change_notify_rsp *)buf;
+ 		struct file_notify_information *pnotify;
+ 		__u32 data_offset = 0;
++		size_t len = srv->total_read - sizeof(pSMBr->hdr.smb_buf_length);
++
+ 		if (get_bcc(buf) > sizeof(struct file_notify_information)) {
+ 			data_offset = le32_to_cpu(pSMBr->DataOffset);
+ 
++			if (data_offset >
++			    len - sizeof(struct file_notify_information)) {
++				cifs_dbg(FYI, "invalid data_offset %u\n",
++					 data_offset);
++				return true;
++			}
+ 			pnotify = (struct file_notify_information *)
+ 				((char *)&pSMBr->hdr.Protocol + data_offset);
+ 			cifs_dbg(FYI, "dnotify on %s Action: 0x%x\n",
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 759cbbf7b1af..4e5b05263e4a 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -1239,7 +1239,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon,
+ 	}
+ 
+ 	srch_inf->entries_in_buffer = 0;
+-	srch_inf->index_of_last_entry = 0;
++	srch_inf->index_of_last_entry = 2;
+ 
+ 	rc = SMB2_query_directory(xid, tcon, fid->persistent_fid,
+ 				  fid->volatile_fid, 0, srch_inf);
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index 3e04279446e8..44e7d180ebec 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -589,9 +589,9 @@ static void dlm_init_lockres(struct dlm_ctxt *dlm,
+ 
+ 	res->last_used = 0;
+ 
+-	spin_lock(&dlm->spinlock);
++	spin_lock(&dlm->track_lock);
+ 	list_add_tail(&res->tracking, &dlm->tracking_list);
+-	spin_unlock(&dlm->spinlock);
++	spin_unlock(&dlm->track_lock);
+ 
+ 	memset(res->lvb, 0, DLM_LVB_LEN);
+ 	memset(res->refmap, 0, sizeof(res->refmap));
+diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
+index 8a10506db993..d9468de3c951 100644
+--- a/fs/overlayfs/namei.c
++++ b/fs/overlayfs/namei.c
+@@ -519,7 +519,7 @@ static struct dentry *ovl_lookup_index(struct dentry *dentry,
+ 			index = NULL;
+ 			goto out;
+ 		}
+-		pr_warn_ratelimited("overlayfs: failed inode index lookup (ino=%lu, key=%*s, err=%i);\n"
++		pr_warn_ratelimited("overlayfs: failed inode index lookup (ino=%lu, key=%.*s, err=%i);\n"
+ 				    "overlayfs: mount with '-o index=off' to disable inodes index.\n",
+ 				    d_inode(origin)->i_ino, name.len, name.name,
+ 				    err);
+diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
+index d9a0edd4e57e..e1e743005583 100644
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -136,8 +136,8 @@ static inline int ovl_do_setxattr(struct dentry *dentry, const char *name,
+ 				  const void *value, size_t size, int flags)
+ {
+ 	int err = vfs_setxattr(dentry, name, value, size, flags);
+-	pr_debug("setxattr(%pd2, \"%s\", \"%*s\", 0x%x) = %i\n",
+-		 dentry, name, (int) size, (char *) value, flags, err);
++	pr_debug("setxattr(%pd2, \"%s\", \"%*pE\", %zu, 0x%x) = %i\n",
++		 dentry, name, min((int)size, 48), value, size, flags, err);
+ 	return err;
+ }
+ 
+diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
+index f60ce2e04df0..afdc2533ce74 100644
+--- a/fs/overlayfs/util.c
++++ b/fs/overlayfs/util.c
+@@ -438,7 +438,7 @@ static void ovl_cleanup_index(struct dentry *dentry)
+ 	struct dentry *upperdentry = ovl_dentry_upper(dentry);
+ 	struct dentry *index = NULL;
+ 	struct inode *inode;
+-	struct qstr name;
++	struct qstr name = { };
+ 	int err;
+ 
+ 	err = ovl_get_index_name(lowerdentry, &name);
+@@ -477,6 +477,7 @@ static void ovl_cleanup_index(struct dentry *dentry)
+ 		goto fail;
+ 
+ out:
++	kfree(name.name);
+ 	dput(index);
+ 	return;
+ 
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index c5c42f3e33d1..9063738ff1f0 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -431,6 +431,20 @@ static int proc_pid_stack(struct seq_file *m, struct pid_namespace *ns,
+ 	int err;
+ 	int i;
+ 
++	/*
++	 * The ability to racily run the kernel stack unwinder on a running task
++	 * and then observe the unwinder output is scary; while it is useful for
++	 * debugging kernel issues, it can also allow an attacker to leak kernel
++	 * stack contents.
++	 * Doing this in a manner that is at least safe from races would require
++	 * some work to ensure that the remote task can not be scheduled; and
++	 * even then, this would still expose the unwinder as local attack
++	 * surface.
++	 * Therefore, this interface is restricted to root.
++	 */
++	if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN))
++		return -EACCES;
++
+ 	entries = kmalloc(MAX_STACK_TRACE_DEPTH * sizeof(*entries), GFP_KERNEL);
+ 	if (!entries)
+ 		return -ENOMEM;
+diff --git a/fs/xattr.c b/fs/xattr.c
+index be2ce57cd6ad..50029811fbe3 100644
+--- a/fs/xattr.c
++++ b/fs/xattr.c
+@@ -951,17 +951,19 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
+ 	int err = 0;
+ 
+ #ifdef CONFIG_FS_POSIX_ACL
+-	if (inode->i_acl) {
+-		err = xattr_list_one(&buffer, &remaining_size,
+-				     XATTR_NAME_POSIX_ACL_ACCESS);
+-		if (err)
+-			return err;
+-	}
+-	if (inode->i_default_acl) {
+-		err = xattr_list_one(&buffer, &remaining_size,
+-				     XATTR_NAME_POSIX_ACL_DEFAULT);
+-		if (err)
+-			return err;
++	if (IS_POSIXACL(inode)) {
++		if (inode->i_acl) {
++			err = xattr_list_one(&buffer, &remaining_size,
++					     XATTR_NAME_POSIX_ACL_ACCESS);
++			if (err)
++				return err;
++		}
++		if (inode->i_default_acl) {
++			err = xattr_list_one(&buffer, &remaining_size,
++					     XATTR_NAME_POSIX_ACL_DEFAULT);
++			if (err)
++				return err;
++		}
+ 	}
+ #endif
+ 
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 450e2cd31ed6..a0ffc62e7677 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -2076,6 +2076,15 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
+ 	u64 umin_val, umax_val;
+ 	u64 insn_bitness = (BPF_CLASS(insn->code) == BPF_ALU64) ? 64 : 32;
+ 
++	if (insn_bitness == 32) {
++		/* Relevant for 32-bit RSH: Information can propagate towards
++		 * LSB, so it isn't sufficient to only truncate the output to
++		 * 32 bits.
++		 */
++		coerce_reg_to_size(dst_reg, 4);
++		coerce_reg_to_size(&src_reg, 4);
++	}
++
+ 	smin_val = src_reg.smin_value;
+ 	smax_val = src_reg.smax_value;
+ 	umin_val = src_reg.umin_value;
+@@ -2295,7 +2304,6 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
+ 	if (BPF_CLASS(insn->code) != BPF_ALU64) {
+ 		/* 32-bit ALU ops are (32,32)->32 */
+ 		coerce_reg_to_size(dst_reg, 4);
+-		coerce_reg_to_size(&src_reg, 4);
+ 	}
+ 
+ 	__reg_deduce_bounds(dst_reg);
+diff --git a/mm/madvise.c b/mm/madvise.c
+index 751e97aa2210..576b753be428 100644
+--- a/mm/madvise.c
++++ b/mm/madvise.c
+@@ -96,7 +96,7 @@ static long madvise_behavior(struct vm_area_struct *vma,
+ 		new_flags |= VM_DONTDUMP;
+ 		break;
+ 	case MADV_DODUMP:
+-		if (new_flags & VM_SPECIAL) {
++		if (!is_vm_hugetlb_page(vma) && new_flags & VM_SPECIAL) {
+ 			error = -EINVAL;
+ 			goto out;
+ 		}
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index e9c6aa3ed05b..3d0d12fbd8dd 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -947,8 +947,8 @@ static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata,
+ 	if (len < IEEE80211_DEAUTH_FRAME_LEN)
+ 		return;
+ 
+-	ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM BSSID=%pM (reason: %d)\n",
+-		 mgmt->sa, mgmt->da, mgmt->bssid, reason);
++	ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
++	ibss_dbg(sdata, "\tBSSID=%pM (reason: %d)\n", mgmt->bssid, reason);
+ 	sta_info_destroy_addr(sdata, mgmt->sa);
+ }
+ 
+@@ -966,9 +966,9 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
+ 	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
+ 	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
+ 
+-	ibss_dbg(sdata,
+-		 "RX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=%d)\n",
+-		 mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction);
++	ibss_dbg(sdata, "RX Auth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
++	ibss_dbg(sdata, "\tBSSID=%pM (auth_transaction=%d)\n",
++		 mgmt->bssid, auth_transaction);
+ 
+ 	if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
+ 		return;
+@@ -1175,10 +1175,10 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
+ 		rx_timestamp = drv_get_tsf(local, sdata);
+ 	}
+ 
+-	ibss_dbg(sdata,
+-		 "RX beacon SA=%pM BSSID=%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
++	ibss_dbg(sdata, "RX beacon SA=%pM BSSID=%pM TSF=0x%llx\n",
+ 		 mgmt->sa, mgmt->bssid,
+-		 (unsigned long long)rx_timestamp,
++		 (unsigned long long)rx_timestamp);
++	ibss_dbg(sdata, "\tBCN=0x%llx diff=%lld @%lu\n",
+ 		 (unsigned long long)beacon_timestamp,
+ 		 (unsigned long long)(rx_timestamp - beacon_timestamp),
+ 		 jiffies);
+@@ -1537,9 +1537,9 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
+ 
+ 	tx_last_beacon = drv_tx_last_beacon(local);
+ 
+-	ibss_dbg(sdata,
+-		 "RX ProbeReq SA=%pM DA=%pM BSSID=%pM (tx_last_beacon=%d)\n",
+-		 mgmt->sa, mgmt->da, mgmt->bssid, tx_last_beacon);
++	ibss_dbg(sdata, "RX ProbeReq SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
++	ibss_dbg(sdata, "\tBSSID=%pM (tx_last_beacon=%d)\n",
++		 mgmt->bssid, tx_last_beacon);
+ 
+ 	if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da))
+ 		return;
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 8aa1f5b6a051..8a51f94ec1ce 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -255,8 +255,27 @@ static void ieee80211_restart_work(struct work_struct *work)
+ 
+ 	flush_work(&local->radar_detected_work);
+ 	rtnl_lock();
+-	list_for_each_entry(sdata, &local->interfaces, list)
++	list_for_each_entry(sdata, &local->interfaces, list) {
++		/*
++		 * XXX: there may be more work for other vif types and even
++		 * for station mode: a good thing would be to run most of
++		 * the iface type's dependent _stop (ieee80211_mg_stop,
++		 * ieee80211_ibss_stop) etc...
++		 * For now, fix only the specific bug that was seen: race
++		 * between csa_connection_drop_work and us.
++		 */
++		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
++			/*
++			 * This worker is scheduled from the iface worker that
++			 * runs on mac80211's workqueue, so we can't be
++			 * scheduling this worker after the cancel right here.
++			 * The exception is ieee80211_chswitch_done.
++			 * Then we can have a race...
++			 */
++			cancel_work_sync(&sdata->u.mgd.csa_connection_drop_work);
++		}
+ 		flush_delayed_work(&sdata->dec_tailroom_needed_wk);
++	}
+ 	ieee80211_scan_cancel(local);
+ 
+ 	/* make sure any new ROC will consider local->in_reconfig */
+@@ -467,10 +486,7 @@ static const struct ieee80211_vht_cap mac80211_vht_capa_mod_mask = {
+ 		cpu_to_le32(IEEE80211_VHT_CAP_RXLDPC |
+ 			    IEEE80211_VHT_CAP_SHORT_GI_80 |
+ 			    IEEE80211_VHT_CAP_SHORT_GI_160 |
+-			    IEEE80211_VHT_CAP_RXSTBC_1 |
+-			    IEEE80211_VHT_CAP_RXSTBC_2 |
+-			    IEEE80211_VHT_CAP_RXSTBC_3 |
+-			    IEEE80211_VHT_CAP_RXSTBC_4 |
++			    IEEE80211_VHT_CAP_RXSTBC_MASK |
+ 			    IEEE80211_VHT_CAP_TXSTBC |
+ 			    IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
+ 			    IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
+@@ -1171,6 +1187,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
+ #if IS_ENABLED(CONFIG_IPV6)
+ 	unregister_inet6addr_notifier(&local->ifa6_notifier);
+ #endif
++	ieee80211_txq_teardown_flows(local);
+ 
+ 	rtnl_lock();
+ 
+@@ -1199,7 +1216,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
+ 	skb_queue_purge(&local->skb_queue);
+ 	skb_queue_purge(&local->skb_queue_unreliable);
+ 	skb_queue_purge(&local->skb_queue_tdls_chsw);
+-	ieee80211_txq_teardown_flows(local);
+ 
+ 	destroy_workqueue(local->workqueue);
+ 	wiphy_unregister(local->hw.wiphy);
+diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
+index d6d3f316de4c..055ea36ff27b 100644
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -572,6 +572,10 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
+ 		forward = false;
+ 		reply = true;
+ 		target_metric = 0;
++
++		if (SN_GT(target_sn, ifmsh->sn))
++			ifmsh->sn = target_sn;
++
+ 		if (time_after(jiffies, ifmsh->last_sn_update +
+ 					net_traversal_jiffies(sdata)) ||
+ 		    time_before(jiffies, ifmsh->last_sn_update)) {
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 052dbd4fa366..328ac10084e4 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -988,6 +988,10 @@ static void ieee80211_chswitch_work(struct work_struct *work)
+ 	 */
+ 
+ 	if (sdata->reserved_chanctx) {
++		struct ieee80211_supported_band *sband = NULL;
++		struct sta_info *mgd_sta = NULL;
++		enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;
++
+ 		/*
+ 		 * with multi-vif csa driver may call ieee80211_csa_finish()
+ 		 * many times while waiting for other interfaces to use their
+@@ -996,6 +1000,48 @@ static void ieee80211_chswitch_work(struct work_struct *work)
+ 		if (sdata->reserved_ready)
+ 			goto out;
+ 
++		if (sdata->vif.bss_conf.chandef.width !=
++		    sdata->csa_chandef.width) {
++			/*
++			 * For managed interface, we need to also update the AP
++			 * station bandwidth and align the rate scale algorithm
++			 * on the bandwidth change. Here we only consider the
++			 * bandwidth of the new channel definition (as channel
++			 * switch flow does not have the full HT/VHT/HE
++			 * information), assuming that if additional changes are
++			 * required they would be done as part of the processing
++			 * of the next beacon from the AP.
++			 */
++			switch (sdata->csa_chandef.width) {
++			case NL80211_CHAN_WIDTH_20_NOHT:
++			case NL80211_CHAN_WIDTH_20:
++			default:
++				bw = IEEE80211_STA_RX_BW_20;
++				break;
++			case NL80211_CHAN_WIDTH_40:
++				bw = IEEE80211_STA_RX_BW_40;
++				break;
++			case NL80211_CHAN_WIDTH_80:
++				bw = IEEE80211_STA_RX_BW_80;
++				break;
++			case NL80211_CHAN_WIDTH_80P80:
++			case NL80211_CHAN_WIDTH_160:
++				bw = IEEE80211_STA_RX_BW_160;
++				break;
++			}
++
++			mgd_sta = sta_info_get(sdata, ifmgd->bssid);
++			sband =
++				local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
++		}
++
++		if (sdata->vif.bss_conf.chandef.width >
++		    sdata->csa_chandef.width) {
++			mgd_sta->sta.bandwidth = bw;
++			rate_control_rate_update(local, sband, mgd_sta,
++						 IEEE80211_RC_BW_CHANGED);
++		}
++
+ 		ret = ieee80211_vif_use_reserved_context(sdata);
+ 		if (ret) {
+ 			sdata_info(sdata,
+@@ -1006,6 +1052,13 @@ static void ieee80211_chswitch_work(struct work_struct *work)
+ 			goto out;
+ 		}
+ 
++		if (sdata->vif.bss_conf.chandef.width <
++		    sdata->csa_chandef.width) {
++			mgd_sta->sta.bandwidth = bw;
++			rate_control_rate_update(local, sband, mgd_sta,
++						 IEEE80211_RC_BW_CHANGED);
++		}
++
+ 		goto out;
+ 	}
+ 
+@@ -1227,6 +1280,16 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+ 					 cbss->beacon_interval));
+ 	return;
+  drop_connection:
++	/*
++	 * This is just so that the disconnect flow will know that
++	 * we were trying to switch channel and failed. In case the
++	 * mode is 1 (we are not allowed to Tx), we will know not to
++	 * send a deauthentication frame. Those two fields will be
++	 * reset when the disconnection worker runs.
++	 */
++	sdata->vif.csa_active = true;
++	sdata->csa_block_tx = csa_ie.mode;
++
+ 	ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
+ 	mutex_unlock(&local->chanctx_mtx);
+ 	mutex_unlock(&local->mtx);
+@@ -2397,6 +2460,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+ 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
++	bool tx;
+ 
+ 	sdata_lock(sdata);
+ 	if (!ifmgd->associated) {
+@@ -2404,6 +2468,8 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
+ 		return;
+ 	}
+ 
++	tx = !sdata->csa_block_tx;
++
+ 	/* AP is probably out of range (or not reachable for another reason) so
+ 	 * remove the bss struct for that AP.
+ 	 */
+@@ -2411,7 +2477,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
+ 
+ 	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+ 			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
+-			       true, frame_buf);
++			       tx, frame_buf);
+ 	mutex_lock(&local->mtx);
+ 	sdata->vif.csa_active = false;
+ 	ifmgd->csa_waiting_bcn = false;
+@@ -2422,7 +2488,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
+ 	}
+ 	mutex_unlock(&local->mtx);
+ 
+-	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
++	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
+ 				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
+ 
+ 	sdata_unlock(sdata);
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index ccb65f18df5d..d8fddd88bf46 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3022,27 +3022,18 @@ void ieee80211_clear_fast_xmit(struct sta_info *sta)
+ }
+ 
+ static bool ieee80211_amsdu_realloc_pad(struct ieee80211_local *local,
+-					struct sk_buff *skb, int headroom,
+-					int *subframe_len)
++					struct sk_buff *skb, int headroom)
+ {
+-	int amsdu_len = *subframe_len + sizeof(struct ethhdr);
+-	int padding = (4 - amsdu_len) & 3;
+-
+-	if (skb_headroom(skb) < headroom || skb_tailroom(skb) < padding) {
++	if (skb_headroom(skb) < headroom) {
+ 		I802_DEBUG_INC(local->tx_expand_skb_head);
+ 
+-		if (pskb_expand_head(skb, headroom, padding, GFP_ATOMIC)) {
++		if (pskb_expand_head(skb, headroom, 0, GFP_ATOMIC)) {
+ 			wiphy_debug(local->hw.wiphy,
+ 				    "failed to reallocate TX buffer\n");
+ 			return false;
+ 		}
+ 	}
+ 
+-	if (padding) {
+-		*subframe_len += padding;
+-		skb_put_zero(skb, padding);
+-	}
+-
+ 	return true;
+ }
+ 
+@@ -3066,8 +3057,7 @@ static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata,
+ 	if (info->control.flags & IEEE80211_TX_CTRL_AMSDU)
+ 		return true;
+ 
+-	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr),
+-					 &subframe_len))
++	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr)))
+ 		return false;
+ 
+ 	data = skb_push(skb, sizeof(*amsdu_hdr));
+@@ -3133,7 +3123,8 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
+ 	void *data;
+ 	bool ret = false;
+ 	unsigned int orig_len;
+-	int n = 1, nfrags;
++	int n = 2, nfrags, pad = 0;
++	u16 hdrlen;
+ 
+ 	if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
+ 		return false;
+@@ -3166,9 +3157,6 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
+ 	if (skb->len + head->len > max_amsdu_len)
+ 		goto out;
+ 
+-	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
+-		goto out;
+-
+ 	nfrags = 1 + skb_shinfo(skb)->nr_frags;
+ 	nfrags += 1 + skb_shinfo(head)->nr_frags;
+ 	frag_tail = &skb_shinfo(head)->frag_list;
+@@ -3184,10 +3172,24 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
+ 	if (max_frags && nfrags > max_frags)
+ 		goto out;
+ 
+-	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) + 2,
+-					 &subframe_len))
++	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
+ 		goto out;
+ 
++	/*
++	 * Pad out the previous subframe to a multiple of 4 by adding the
++	 * padding to the next one, that's being added. Note that head->len
++	 * is the length of the full A-MSDU, but that works since each time
++	 * we add a new subframe we pad out the previous one to a multiple
++	 * of 4 and thus it no longer matters in the next round.
++	 */
++	hdrlen = fast_tx->hdr_len - sizeof(rfc1042_header);
++	if ((head->len - hdrlen) & 3)
++		pad = 4 - ((head->len - hdrlen) & 3);
++
++	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) +
++						     2 + pad))
++		goto out_recalc;
++
+ 	ret = true;
+ 	data = skb_push(skb, ETH_ALEN + 2);
+ 	memmove(data, data + ETH_ALEN + 2, 2 * ETH_ALEN);
+@@ -3197,15 +3199,19 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
+ 	memcpy(data, &len, 2);
+ 	memcpy(data + 2, rfc1042_header, sizeof(rfc1042_header));
+ 
++	memset(skb_push(skb, pad), 0, pad);
++
+ 	head->len += skb->len;
+ 	head->data_len += skb->len;
+ 	*frag_tail = skb;
+ 
+-	flow->backlog += head->len - orig_len;
+-	tin->backlog_bytes += head->len - orig_len;
+-
+-	fq_recalc_backlog(fq, tin, flow);
++out_recalc:
++	if (head->len != orig_len) {
++		flow->backlog += head->len - orig_len;
++		tin->backlog_bytes += head->len - orig_len;
+ 
++		fq_recalc_backlog(fq, tin, flow);
++	}
+ out:
+ 	spin_unlock_bh(&fq->lock);
+ 
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 742aacb317e5..3ae365f92bff 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -4250,6 +4250,7 @@ static int nft_flush_set(const struct nft_ctx *ctx,
+ 	}
+ 	set->ndeact++;
+ 
++	nft_set_elem_deactivate(ctx->net, set, elem);
+ 	nft_trans_elem_set(trans) = set;
+ 	nft_trans_elem(trans) = *elem;
+ 	list_add_tail(&trans->list, &ctx->net->nft.commit_list);
+diff --git a/net/netfilter/xt_cluster.c b/net/netfilter/xt_cluster.c
+index 57ef175dfbfa..504d5f730f4e 100644
+--- a/net/netfilter/xt_cluster.c
++++ b/net/netfilter/xt_cluster.c
+@@ -133,6 +133,7 @@ xt_cluster_mt(const struct sk_buff *skb, struct xt_action_param *par)
+ static int xt_cluster_mt_checkentry(const struct xt_mtchk_param *par)
+ {
+ 	struct xt_cluster_match_info *info = par->matchinfo;
++	int ret;
+ 
+ 	if (info->total_nodes > XT_CLUSTER_NODES_MAX) {
+ 		pr_info("you have exceeded the maximum "
+@@ -145,7 +146,17 @@ static int xt_cluster_mt_checkentry(const struct xt_mtchk_param *par)
+ 			"higher than the total number of nodes\n");
+ 		return -EDOM;
+ 	}
+-	return 0;
++
++	ret = nf_ct_netns_get(par->net, par->family);
++	if (ret < 0)
++		pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
++				    par->family);
++	return ret;
++}
++
++static void xt_cluster_mt_destroy(const struct xt_mtdtor_param *par)
++{
++	nf_ct_netns_put(par->net, par->family);
+ }
+ 
+ static struct xt_match xt_cluster_match __read_mostly = {
+@@ -154,6 +165,7 @@ static struct xt_match xt_cluster_match __read_mostly = {
+ 	.match		= xt_cluster_mt,
+ 	.checkentry	= xt_cluster_mt_checkentry,
+ 	.matchsize	= sizeof(struct xt_cluster_match_info),
++	.destroy	= xt_cluster_mt_destroy,
+ 	.me		= THIS_MODULE,
+ };
+ 
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 753f3e73c498..3de415bca391 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -11679,6 +11679,7 @@ static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
+ 		return -EOPNOTSUPP;
+ 
+ 	if (!info->attrs[NL80211_ATTR_MDID] ||
++	    !info->attrs[NL80211_ATTR_IE] ||
+ 	    !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+ 		return -EINVAL;
+ 
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index c1238d582fd1..ca3361a3e750 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -1449,7 +1449,7 @@ bool ieee80211_chandef_to_operating_class(struct cfg80211_chan_def *chandef,
+ 					  u8 *op_class)
+ {
+ 	u8 vht_opclass;
+-	u16 freq = chandef->center_freq1;
++	u32 freq = chandef->center_freq1;
+ 
+ 	if (freq >= 2412 && freq <= 2472) {
+ 		if (chandef->width > NL80211_CHAN_WIDTH_40)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index dcc9e6551b51..fe5c741fcc6a 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6288,6 +6288,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ 	SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
+ 	SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
++	SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME),
+ 	SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
+ 	SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3),
+ 	SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+diff --git a/tools/hv/hv_fcopy_daemon.c b/tools/hv/hv_fcopy_daemon.c
+index 785f4e95148c..7a1039c15e7d 100644
+--- a/tools/hv/hv_fcopy_daemon.c
++++ b/tools/hv/hv_fcopy_daemon.c
+@@ -233,6 +233,7 @@ int main(int argc, char *argv[])
+ 			break;
+ 
+ 		default:
++			error = HV_E_FAIL;
+ 			syslog(LOG_ERR, "Unknown operation: %d",
+ 				buffer.hdr.operation);
+ 
+diff --git a/tools/kvm/kvm_stat/kvm_stat b/tools/kvm/kvm_stat/kvm_stat
+index 32283d88701a..c0d653d36c0f 100755
+--- a/tools/kvm/kvm_stat/kvm_stat
++++ b/tools/kvm/kvm_stat/kvm_stat
+@@ -724,13 +724,20 @@ class DebugfsProvider(Provider):
+             if len(vms) == 0:
+                 self.do_read = False
+ 
+-            self.paths = filter(lambda x: "{}-".format(pid) in x, vms)
++            self.paths = list(filter(lambda x: "{}-".format(pid) in x, vms))
+ 
+         else:
+             self.paths = []
+             self.do_read = True
+         self.reset()
+ 
++    def _verify_paths(self):
++        """Remove invalid paths"""
++        for path in self.paths:
++            if not os.path.exists(os.path.join(PATH_DEBUGFS_KVM, path)):
++                self.paths.remove(path)
++                continue
++
+     def read(self, reset=0, by_guest=0):
+         """Returns a dict with format:'file name / field -> current value'.
+ 
+@@ -745,6 +752,7 @@ class DebugfsProvider(Provider):
+         # If no debugfs filtering support is available, then don't read.
+         if not self.do_read:
+             return results
++        self._verify_paths()
+ 
+         paths = self.paths
+         if self._pid == 0:
+@@ -1119,10 +1127,10 @@ class Tui(object):
+         (x, term_width) = self.screen.getmaxyx()
+         row = 2
+         for line in text:
+-            start = (term_width - len(line)) / 2
++            start = (term_width - len(line)) // 2
+             self.screen.addstr(row, start, line)
+             row += 1
+-        self.screen.addstr(row + 1, (term_width - len(hint)) / 2, hint,
++        self.screen.addstr(row + 1, (term_width - len(hint)) // 2, hint,
+                            curses.A_STANDOUT)
+         self.screen.getkey()
+ 
+diff --git a/tools/perf/arch/powerpc/util/sym-handling.c b/tools/perf/arch/powerpc/util/sym-handling.c
+index 20e7d74d86cd..10a44e946f77 100644
+--- a/tools/perf/arch/powerpc/util/sym-handling.c
++++ b/tools/perf/arch/powerpc/util/sym-handling.c
+@@ -22,15 +22,16 @@ bool elf__needs_adjust_symbols(GElf_Ehdr ehdr)
+ 
+ #endif
+ 
+-#if !defined(_CALL_ELF) || _CALL_ELF != 2
+ int arch__choose_best_symbol(struct symbol *syma,
+ 			     struct symbol *symb __maybe_unused)
+ {
+ 	char *sym = syma->name;
+ 
++#if !defined(_CALL_ELF) || _CALL_ELF != 2
+ 	/* Skip over any initial dot */
+ 	if (*sym == '.')
+ 		sym++;
++#endif
+ 
+ 	/* Avoid "SyS" kernel syscall aliases */
+ 	if (strlen(sym) >= 3 && !strncmp(sym, "SyS", 3))
+@@ -41,6 +42,7 @@ int arch__choose_best_symbol(struct symbol *syma,
+ 	return SYMBOL_A;
+ }
+ 
++#if !defined(_CALL_ELF) || _CALL_ELF != 2
+ /* Allow matching against dot variants */
+ int arch__compare_symbol_names(const char *namea, const char *nameb)
+ {
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index 2227ee92d8e2..44c2f62b47a3 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -259,8 +259,9 @@ struct perf_evsel *perf_evsel__new_idx(struct perf_event_attr *attr, int idx)
+ {
+ 	struct perf_evsel *evsel = zalloc(perf_evsel__object.size);
+ 
+-	if (evsel != NULL)
+-		perf_evsel__init(evsel, attr, idx);
++	if (!evsel)
++		return NULL;
++	perf_evsel__init(evsel, attr, idx);
+ 
+ 	if (perf_evsel__is_bpf_output(evsel)) {
+ 		evsel->attr.sample_type |= (PERF_SAMPLE_RAW | PERF_SAMPLE_TIME |
+diff --git a/tools/perf/util/trace-event-info.c b/tools/perf/util/trace-event-info.c
+index e7d60d05596d..8f3b7ef221f2 100644
+--- a/tools/perf/util/trace-event-info.c
++++ b/tools/perf/util/trace-event-info.c
+@@ -379,7 +379,7 @@ out:
+ 
+ static int record_saved_cmdline(void)
+ {
+-	unsigned int size;
++	unsigned long long size;
+ 	char *path;
+ 	struct stat st;
+ 	int ret, err = 0;
+diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
+index 1512086c8cb8..7a1b20ec5216 100644
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -1485,7 +1485,7 @@ int get_mp(int cpu, struct msr_counter *mp, unsigned long long *counterp)
+ 		if (get_msr(cpu, mp->msr_num, counterp))
+ 			return -1;
+ 	} else {
+-		char path[128];
++		char path[128 + PATH_BYTES];
+ 
+ 		if (mp->flags & SYSFS_PERCPU) {
+ 			sprintf(path, "/sys/devices/system/cpu/cpu%d/%s",
+diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
+index e92903fc7113..6d5bcbaf6193 100644
+--- a/tools/vm/page-types.c
++++ b/tools/vm/page-types.c
+@@ -155,12 +155,6 @@ static const char * const page_flag_names[] = {
+ };
+ 
+ 
+-static const char * const debugfs_known_mountpoints[] = {
+-	"/sys/kernel/debug",
+-	"/debug",
+-	0,
+-};
+-
+ /*
+  * data structures
+  */
+diff --git a/tools/vm/slabinfo.c b/tools/vm/slabinfo.c
+index b0b7ef6d0de1..3fe093254385 100644
+--- a/tools/vm/slabinfo.c
++++ b/tools/vm/slabinfo.c
+@@ -30,8 +30,8 @@ struct slabinfo {
+ 	int alias;
+ 	int refs;
+ 	int aliases, align, cache_dma, cpu_slabs, destroy_by_rcu;
+-	int hwcache_align, object_size, objs_per_slab;
+-	int sanity_checks, slab_size, store_user, trace;
++	unsigned int hwcache_align, object_size, objs_per_slab;
++	unsigned int sanity_checks, slab_size, store_user, trace;
+ 	int order, poison, reclaim_account, red_zone;
+ 	unsigned long partial, objects, slabs, objects_partial, objects_total;
+ 	unsigned long alloc_fastpath, alloc_slowpath;