Merge git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux

to pick up the KVM fix which is required for the NX series.

429 files changed, 3953 insertions, 2194 deletions

diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst
index ab7ed2fd072f..5a09661330fc 100644
--- a/Documentation/arm64/silicon-errata.rst
+++ b/Documentation/arm64/silicon-errata.rst
@@ -91,6 +91,11 @@ stable kernels.
 | ARM            | MMU-500         | #841119,826419  | N/A                         |
 +----------------+-----------------+-----------------+-----------------------------+
 +----------------+-----------------+-----------------+-----------------------------+
+| Broadcom       | Brahma-B53      | N/A             | ARM64_ERRATUM_845719        |
++----------------+-----------------+-----------------+-----------------------------+
+| Broadcom       | Brahma-B53      | N/A             | ARM64_ERRATUM_843419        |
++----------------+-----------------+-----------------+-----------------------------+
++----------------+-----------------+-----------------+-----------------------------+
 | Cavium         | ThunderX ITS    | #22375,24313    | CAVIUM_ERRATUM_22375        |
 +----------------+-----------------+-----------------+-----------------------------+
 | Cavium         | ThunderX ITS    | #23144          | CAVIUM_ERRATUM_23144        |
@@ -126,7 +131,7 @@ stable kernels.
 +----------------+-----------------+-----------------+-----------------------------+
 | Qualcomm Tech. | Kryo/Falkor v1  | E1003           | QCOM_FALKOR_ERRATUM_1003    |
 +----------------+-----------------+-----------------+-----------------------------+
-| Qualcomm Tech. | Falkor v1       | E1009           | QCOM_FALKOR_ERRATUM_1009    |
+| Qualcomm Tech. | Kryo/Falkor v1  | E1009           | QCOM_FALKOR_ERRATUM_1009    |
 +----------------+-----------------+-----------------+-----------------------------+
 | Qualcomm Tech. | QDF2400 ITS     | E0065           | QCOM_QDF2400_ERRATUM_0065   |
 +----------------+-----------------+-----------------+-----------------------------+
diff --git a/Documentation/networking/device_drivers/intel/e100.rst b/Documentation/networking/device_drivers/intel/e100.rst
index 2b9f4887beda..caf023cc88de 100644
--- a/Documentation/networking/device_drivers/intel/e100.rst
+++ b/Documentation/networking/device_drivers/intel/e100.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
 
-==============================================================
-Linux* Base Driver for the Intel(R) PRO/100 Family of Adapters
-==============================================================
+=============================================================
+Linux Base Driver for the Intel(R) PRO/100 Family of Adapters
+=============================================================
 
 June 1, 2018
 
@@ -21,7 +21,7 @@ Contents
 In This Release
 ===============
 
-This file describes the Linux* Base Driver for the Intel(R) PRO/100 Family of
+This file describes the Linux Base Driver for the Intel(R) PRO/100 Family of
 Adapters. This driver includes support for Itanium(R)2-based systems.
 
 For questions related to hardware requirements, refer to the documentation
@@ -138,9 +138,9 @@ version 1.6 or later is required for this functionality.
 The latest release of ethtool can be found from
 https://www.kernel.org/pub/software/network/ethtool/
 
-Enabling Wake on LAN* (WoL)
----------------------------
-WoL is provided through the ethtool* utility.  For instructions on
+Enabling Wake on LAN (WoL)
+--------------------------
+WoL is provided through the ethtool utility.  For instructions on
 enabling WoL with ethtool, refer to the ethtool man page.  WoL will be
 enabled on the system during the next shut down or reboot.  For this
 driver version, in order to enable WoL, the e100 driver must be loaded
diff --git a/Documentation/networking/device_drivers/intel/e1000.rst b/Documentation/networking/device_drivers/intel/e1000.rst
index 956560b6e745..4aaae0f7d6ba 100644
--- a/Documentation/networking/device_drivers/intel/e1000.rst
+++ b/Documentation/networking/device_drivers/intel/e1000.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
 
-===========================================================
-Linux* Base Driver for Intel(R) Ethernet Network Connection
-===========================================================
+==========================================================
+Linux Base Driver for Intel(R) Ethernet Network Connection
+==========================================================
 
 Intel Gigabit Linux driver.
 Copyright(c) 1999 - 2013 Intel Corporation.
@@ -438,10 +438,10 @@ ethtool
   The latest release of ethtool can be found from
   https://www.kernel.org/pub/software/network/ethtool/
 
-Enabling Wake on LAN* (WoL)
----------------------------
+Enabling Wake on LAN (WoL)
+--------------------------
 
-  WoL is configured through the ethtool* utility.
+  WoL is configured through the ethtool utility.
 
   WoL will be enabled on the system during the next shut down or reboot.
   For this driver version, in order to enable WoL, the e1000 driver must be
diff --git a/Documentation/networking/device_drivers/intel/e1000e.rst b/Documentation/networking/device_drivers/intel/e1000e.rst
index 01999f05509c..f49cd370e7bf 100644
--- a/Documentation/networking/device_drivers/intel/e1000e.rst
+++ b/Documentation/networking/device_drivers/intel/e1000e.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
 
-======================================================
-Linux* Driver for Intel(R) Ethernet Network Connection
-======================================================
+=====================================================
+Linux Driver for Intel(R) Ethernet Network Connection
+=====================================================
 
 Intel Gigabit Linux driver.
 Copyright(c) 2008-2018 Intel Corporation.
@@ -338,7 +338,7 @@ and higher cannot be forced. Use the autonegotiation advertising setting to
 manually set devices for 1 Gbps and higher.
 
 Speed, duplex, and autonegotiation advertising are configured through the
-ethtool* utility.
+ethtool utility.
 
 Caution: Only experienced network administrators should force speed and duplex
 or change autonegotiation advertising manually. The settings at the switch must
@@ -351,9 +351,9 @@ will not attempt to auto-negotiate with its link partner since those adapters
 operate only in full duplex and only at their native speed.
 
 
-Enabling Wake on LAN* (WoL)
----------------------------
-WoL is configured through the ethtool* utility.
+Enabling Wake on LAN (WoL)
+--------------------------
+WoL is configured through the ethtool utility.
 
 WoL will be enabled on the system during the next shut down or reboot. For
 this driver version, in order to enable WoL, the e1000e driver must be loaded
diff --git a/Documentation/networking/device_drivers/intel/fm10k.rst b/Documentation/networking/device_drivers/intel/fm10k.rst
index ac3269e34f55..4d279e64e221 100644
--- a/Documentation/networking/device_drivers/intel/fm10k.rst
+++ b/Documentation/networking/device_drivers/intel/fm10k.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
 
-==============================================================
-Linux* Base Driver for Intel(R) Ethernet Multi-host Controller
-==============================================================
+=============================================================
+Linux Base Driver for Intel(R) Ethernet Multi-host Controller
+=============================================================
 
 August 20, 2018
 Copyright(c) 2015-2018 Intel Corporation.
@@ -120,8 +120,8 @@ rx-flow-hash tcp4|udp4|ah4|esp4|sctp4|tcp6|udp6|ah6|esp6|sctp6 m|v|t|s|d|f|n|r
 Known Issues/Troubleshooting
 ============================
 
-Enabling SR-IOV in a 64-bit Microsoft* Windows Server* 2012/R2 guest OS under Linux KVM
----------------------------------------------------------------------------------------
+Enabling SR-IOV in a 64-bit Microsoft Windows Server 2012/R2 guest OS under Linux KVM
+-------------------------------------------------------------------------------------
 KVM Hypervisor/VMM supports direct assignment of a PCIe device to a VM. This
 includes traditional PCIe devices, as well as SR-IOV-capable devices based on
 the Intel Ethernet Controller XL710.
diff --git a/Documentation/networking/device_drivers/intel/i40e.rst b/Documentation/networking/device_drivers/intel/i40e.rst
index 848fd388fa6e..8a9b18573688 100644
--- a/Documentation/networking/device_drivers/intel/i40e.rst
+++ b/Documentation/networking/device_drivers/intel/i40e.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
 
-==================================================================
-Linux* Base Driver for the Intel(R) Ethernet Controller 700 Series
-==================================================================
+=================================================================
+Linux Base Driver for the Intel(R) Ethernet Controller 700 Series
+=================================================================
 
 Intel 40 Gigabit Linux driver.
 Copyright(c) 1999-2018 Intel Corporation.
@@ -384,7 +384,7 @@ NOTE: You cannot set the speed for devices based on the Intel(R) Ethernet
 Network Adapter XXV710 based devices.
 
 Speed, duplex, and autonegotiation advertising are configured through the
-ethtool* utility.
+ethtool utility.
 
 Caution: Only experienced network administrators should force speed and duplex
 or change autonegotiation advertising manually. The settings at the switch must
diff --git a/Documentation/networking/device_drivers/intel/iavf.rst b/Documentation/networking/device_drivers/intel/iavf.rst
index cfc08842e32c..84ac7e75f363 100644
--- a/Documentation/networking/device_drivers/intel/iavf.rst
+++ b/Documentation/networking/device_drivers/intel/iavf.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
 
-==================================================================
-Linux* Base Driver for Intel(R) Ethernet Adaptive Virtual Function
-==================================================================
+=================================================================
+Linux Base Driver for Intel(R) Ethernet Adaptive Virtual Function
+=================================================================
 
 Intel Ethernet Adaptive Virtual Function Linux driver.
 Copyright(c) 2013-2018 Intel Corporation.
@@ -19,7 +19,7 @@ Contents
 Overview
 ========
 
-This file describes the iavf Linux* Base Driver. This driver was formerly
+This file describes the iavf Linux Base Driver. This driver was formerly
 called i40evf.
 
 The iavf driver supports the below mentioned virtual function devices and
diff --git a/Documentation/networking/device_drivers/intel/ice.rst b/Documentation/networking/device_drivers/intel/ice.rst
index c220aa2711c6..ee43ea57d443 100644
--- a/Documentation/networking/device_drivers/intel/ice.rst
+++ b/Documentation/networking/device_drivers/intel/ice.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
 
-===================================================================
-Linux* Base Driver for the Intel(R) Ethernet Connection E800 Series
-===================================================================
+==================================================================
+Linux Base Driver for the Intel(R) Ethernet Connection E800 Series
+==================================================================
 
 Intel ice Linux driver.
 Copyright(c) 2018 Intel Corporation.
diff --git a/Documentation/networking/device_drivers/intel/igb.rst b/Documentation/networking/device_drivers/intel/igb.rst
index fc8cfaa5dcfa..87e560fe5eaa 100644
--- a/Documentation/networking/device_drivers/intel/igb.rst
+++ b/Documentation/networking/device_drivers/intel/igb.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
 
-===========================================================
-Linux* Base Driver for Intel(R) Ethernet Network Connection
-===========================================================
+==========================================================
+Linux Base Driver for Intel(R) Ethernet Network Connection
+==========================================================
 
 Intel Gigabit Linux driver.
 Copyright(c) 1999-2018 Intel Corporation.
@@ -129,9 +129,9 @@ version is required for this functionality. Download it at:
 https://www.kernel.org/pub/software/network/ethtool/
 
 
-Enabling Wake on LAN* (WoL)
----------------------------
-WoL is configured through the ethtool* utility.
+Enabling Wake on LAN (WoL)
+--------------------------
+WoL is configured through the ethtool utility.
 
 WoL will be enabled on the system during the next shut down or reboot. For
 this driver version, in order to enable WoL, the igb driver must be loaded
diff --git a/Documentation/networking/device_drivers/intel/igbvf.rst b/Documentation/networking/device_drivers/intel/igbvf.rst
index 9cddabe8108e..557fc020ef31 100644
--- a/Documentation/networking/device_drivers/intel/igbvf.rst
+++ b/Documentation/networking/device_drivers/intel/igbvf.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
 
-============================================================
-Linux* Base Virtual Function Driver for Intel(R) 1G Ethernet
-============================================================
+===========================================================
+Linux Base Virtual Function Driver for Intel(R) 1G Ethernet
+===========================================================
 
 Intel Gigabit Virtual Function Linux driver.
 Copyright(c) 1999-2018 Intel Corporation.
diff --git a/Documentation/networking/device_drivers/intel/ixgbe.rst b/Documentation/networking/device_drivers/intel/ixgbe.rst
index c7d25483fedb..f1d5233e5e51 100644
--- a/Documentation/networking/device_drivers/intel/ixgbe.rst
+++ b/Documentation/networking/device_drivers/intel/ixgbe.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
 
-=============================================================================
-Linux* Base Driver for the Intel(R) Ethernet 10 Gigabit PCI Express Adapters
-=============================================================================
+===========================================================================
+Linux Base Driver for the Intel(R) Ethernet 10 Gigabit PCI Express Adapters
+===========================================================================
 
 Intel 10 Gigabit Linux driver.
 Copyright(c) 1999-2018 Intel Corporation.
@@ -519,8 +519,8 @@ The offload is also supported for ixgbe's VFs, but the VF must be set as
 Known Issues/Troubleshooting
 ============================
 
-Enabling SR-IOV in a 64-bit Microsoft* Windows Server* 2012/R2 guest OS
------------------------------------------------------------------------
+Enabling SR-IOV in a 64-bit Microsoft Windows Server 2012/R2 guest OS
+---------------------------------------------------------------------
 Linux KVM Hypervisor/VMM supports direct assignment of a PCIe device to a VM.
 This includes traditional PCIe devices, as well as SR-IOV-capable devices based
 on the Intel Ethernet Controller XL710.
diff --git a/Documentation/networking/device_drivers/intel/ixgbevf.rst b/Documentation/networking/device_drivers/intel/ixgbevf.rst
index 5d4977360157..76bbde736f21 100644
--- a/Documentation/networking/device_drivers/intel/ixgbevf.rst
+++ b/Documentation/networking/device_drivers/intel/ixgbevf.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
 
-=============================================================
-Linux* Base Virtual Function Driver for Intel(R) 10G Ethernet
-=============================================================
+============================================================
+Linux Base Virtual Function Driver for Intel(R) 10G Ethernet
+============================================================
 
 Intel 10 Gigabit Virtual Function Linux driver.
 Copyright(c) 1999-2018 Intel Corporation.
diff --git a/Documentation/networking/device_drivers/pensando/ionic.rst b/Documentation/networking/device_drivers/pensando/ionic.rst
index 13935896bee6..c17d680cf334 100644
--- a/Documentation/networking/device_drivers/pensando/ionic.rst
+++ b/Documentation/networking/device_drivers/pensando/ionic.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
 
-==========================================================
-Linux* Driver for the Pensando(R) Ethernet adapter family
-==========================================================
+========================================================
+Linux Driver for the Pensando(R) Ethernet adapter family
+========================================================
 
 Pensando Linux Ethernet driver.
 Copyright(c) 2019 Pensando Systems, Inc
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 49e95f438ed7..8d4ad1d1ae26 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -207,8 +207,8 @@ TCP variables:
 
 somaxconn - INTEGER
         Limit of socket listen() backlog, known in userspace as SOMAXCONN.
-        Defaults to 128.  See also tcp_max_syn_backlog for additional tuning
-        for TCP sockets.
+        Defaults to 4096. (Was 128 before linux-5.4)
+        See also tcp_max_syn_backlog for additional tuning for TCP sockets.
 
 tcp_abort_on_overflow - BOOLEAN
         If listening service is too slow to accept new connections,
@@ -408,11 +408,14 @@ tcp_max_orphans - INTEGER
         up to ~64K of unswappable memory.
 
 tcp_max_syn_backlog - INTEGER
-        Maximal number of remembered connection requests, which have not
-        received an acknowledgment from connecting client.
+        Maximal number of remembered connection requests (SYN_RECV),
+        which have not received an acknowledgment from connecting client.
+        This is a per-listener limit.
         The minimal value is 128 for low memory machines, and it will
         increase in proportion to the memory of machine.
         If server suffers from overload, try increasing this number.
+        Remember to also check /proc/sys/net/core/somaxconn
+        A SYN_RECV request socket consumes about 304 bytes of memory.
 
 tcp_max_tw_buckets - INTEGER
         Maximal number of timewait sockets held by system simultaneously.
diff --git a/MAINTAINERS b/MAINTAINERS
index c6c34d04ce95..cba1095547fd 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -11408,7 +11408,6 @@ F:	include/trace/events/tcp.h
 NETWORKING [TLS]
 M:      Boris Pismenny <borisp@mellanox.com>
 M:      Aviad Yehezkel <aviadye@mellanox.com>
-M:      Dave Watson <davejwatson@fb.com>
 M:      John Fastabend <john.fastabend@gmail.com>
 M:      Daniel Borkmann <daniel@iogearbox.net>
 M:      Jakub Kicinski <jakub.kicinski@netronome.com>
@@ -13906,7 +13905,7 @@ F:	drivers/mtd/nand/raw/r852.h
 
 RISC-V ARCHITECTURE
 M:      Paul Walmsley <paul.walmsley@sifive.com>
-M:      Palmer Dabbelt <palmer@sifive.com>
+M:      Palmer Dabbelt <palmer@dabbelt.com>
 M:      Albert Ou <aou@eecs.berkeley.edu>
 L:      linux-riscv@lists.infradead.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git
@@ -14783,7 +14782,7 @@ F:	drivers/media/usb/siano/
 F:      drivers/media/mmc/siano/
 
 SIFIVE DRIVERS
-M:      Palmer Dabbelt <palmer@sifive.com>
+M:      Palmer Dabbelt <palmer@dabbelt.com>
 M:      Paul Walmsley <paul.walmsley@sifive.com>
 L:      linux-riscv@lists.infradead.org
 T:      git git://github.com/sifive/riscv-linux.git
@@ -14793,7 +14792,7 @@ N:	sifive
 
 SIFIVE FU540 SYSTEM-ON-CHIP
 M:      Paul Walmsley <paul.walmsley@sifive.com>
-M:      Palmer Dabbelt <palmer@sifive.com>
+M:      Palmer Dabbelt <palmer@dabbelt.com>
 L:      linux-riscv@lists.infradead.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/pjw/sifive.git
 S:      Supported
diff --git a/Makefile b/Makefile
index 79be70bf2899..b37d0e8fc61d 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 4
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc6
 NAME = Kleptomaniac Octopus
 
 # *DOCUMENTATION*
diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
index bfc7f5f5d6f2..9acbeba832c0 100644
--- a/arch/arc/boot/dts/hsdk.dts
+++ b/arch/arc/boot/dts/hsdk.dts
@@ -65,6 +65,14 @@
                 clock-frequency = <33333333>;
         };
 
+        reg_5v0: regulator-5v0 {
+                compatible = "regulator-fixed";
+
+                regulator-name = "5v0-supply";
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+        };
+
         cpu_intc: cpu-interrupt-controller {
                 compatible = "snps,archs-intc";
                 interrupt-controller;
@@ -264,6 +272,21 @@
                         clocks = <&input_clk>;
                         cs-gpios = <&creg_gpio 0 GPIO_ACTIVE_LOW>,
                                    <&creg_gpio 1 GPIO_ACTIVE_LOW>;
+
+                        spi-flash@0 {
+                                compatible = "sst26wf016b", "jedec,spi-nor";
+                                reg = <0>;
+                                #address-cells = <1>;
+                                #size-cells = <1>;
+                                spi-max-frequency = <4000000>;
+                        };
+
+                        adc@1 {
+                                compatible = "ti,adc108s102";
+                                reg = <1>;
+                                vref-supply = <&reg_5v0>;
+                                spi-max-frequency = <1000000>;
+                        };
                 };
 
                 creg_gpio: gpio@14b0 {
diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig
index 9b9a74444ce2..0974226fab55 100644
--- a/arch/arc/configs/hsdk_defconfig
+++ b/arch/arc/configs/hsdk_defconfig
@@ -32,6 +32,8 @@ CONFIG_INET=y
 CONFIG_DEVTMPFS=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
+CONFIG_MTD=y
+CONFIG_MTD_SPI_NOR=y
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_NETDEVICES=y
@@ -55,6 +57,8 @@ CONFIG_GPIO_SYSFS=y
 CONFIG_GPIO_DWAPB=y
 CONFIG_GPIO_SNPS_CREG=y
 # CONFIG_HWMON is not set
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_DRM=y
 # CONFIG_DRM_FBDEV_EMULATION is not set
 CONFIG_DRM_UDL=y
@@ -72,6 +76,8 @@ CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_DW=y
 CONFIG_DMADEVICES=y
 CONFIG_DW_AXI_DMAC=y
+CONFIG_IIO=y
+CONFIG_TI_ADC108S102=y
 CONFIG_EXT3_FS=y
 CONFIG_VFAT_FS=y
 CONFIG_TMPFS=y
diff --git a/arch/arc/kernel/perf_event.c b/arch/arc/kernel/perf_event.c
index 861a8aea51f9..661fd842ea97 100644
--- a/arch/arc/kernel/perf_event.c
+++ b/arch/arc/kernel/perf_event.c
@@ -614,8 +614,8 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
         /* loop thru all available h/w condition indexes */
         for (i = 0; i < cc_bcr.c; i++) {
                 write_aux_reg(ARC_REG_CC_INDEX, i);
-                cc_name.indiv.word0 = read_aux_reg(ARC_REG_CC_NAME0);
-                cc_name.indiv.word1 = read_aux_reg(ARC_REG_CC_NAME1);
+                cc_name.indiv.word0 = le32_to_cpu(read_aux_reg(ARC_REG_CC_NAME0));
+                cc_name.indiv.word1 = le32_to_cpu(read_aux_reg(ARC_REG_CC_NAME1));
 
                 arc_pmu_map_hw_event(i, cc_name.str);
                 arc_pmu_add_raw_event_attr(i, cc_name.str);
diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
index b1454d117cd2..aca07c2f6e6e 100644
--- a/arch/arm64/include/asm/cputype.h
+++ b/arch/arm64/include/asm/cputype.h
@@ -79,6 +79,7 @@
 #define CAVIUM_CPU_PART_THUNDERX_83XX   0x0A3
 #define CAVIUM_CPU_PART_THUNDERX2       0x0AF
 
+#define BRCM_CPU_PART_BRAHMA_B53        0x100
 #define BRCM_CPU_PART_VULCAN            0x516
 
 #define QCOM_CPU_PART_FALKOR_V1         0x800
@@ -105,6 +106,7 @@
 #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)
 #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX)
 #define MIDR_CAVIUM_THUNDERX2 MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX2)
+#define MIDR_BRAHMA_B53 MIDR_CPU_MODEL(ARM_CPU_IMP_BRCM, BRCM_CPU_PART_BRAHMA_B53)
 #define MIDR_BRCM_VULCAN MIDR_CPU_MODEL(ARM_CPU_IMP_BRCM, BRCM_CPU_PART_VULCAN)
 #define MIDR_QCOM_FALKOR_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR_V1)
 #define MIDR_QCOM_FALKOR MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR)
diff --git a/arch/arm64/include/asm/pgtable-prot.h b/arch/arm64/include/asm/pgtable-prot.h
index 9a21b84536f2..8dc6c5cdabe6 100644
--- a/arch/arm64/include/asm/pgtable-prot.h
+++ b/arch/arm64/include/asm/pgtable-prot.h
@@ -32,11 +32,11 @@
 #define PROT_DEFAULT            (_PROT_DEFAULT | PTE_MAYBE_NG)
 #define PROT_SECT_DEFAULT       (_PROT_SECT_DEFAULT | PMD_MAYBE_NG)
 
-#define PROT_DEVICE_nGnRnE      (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_ATTRINDX(MT_DEVICE_nGnRnE))
-#define PROT_DEVICE_nGnRE       (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_ATTRINDX(MT_DEVICE_nGnRE))
-#define PROT_NORMAL_NC          (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL_NC))
-#define PROT_NORMAL_WT          (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL_WT))
-#define PROT_NORMAL             (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL))
+#define PROT_DEVICE_nGnRnE      (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_WRITE | PTE_ATTRINDX(MT_DEVICE_nGnRnE))
+#define PROT_DEVICE_nGnRE       (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_WRITE | PTE_ATTRINDX(MT_DEVICE_nGnRE))
+#define PROT_NORMAL_NC          (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL_NC))
+#define PROT_NORMAL_WT          (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL_WT))
+#define PROT_NORMAL             (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL))
 
 #define PROT_SECT_DEVICE_nGnRE  (PROT_SECT_DEFAULT | PMD_SECT_PXN | PMD_SECT_UXN | PMD_ATTRINDX(MT_DEVICE_nGnRE))
 #define PROT_SECT_NORMAL        (PROT_SECT_DEFAULT | PMD_SECT_PXN | PMD_SECT_UXN | PMD_ATTRINDX(MT_NORMAL))
@@ -80,8 +80,9 @@
 #define PAGE_S2_DEVICE          __pgprot(_PROT_DEFAULT | PAGE_S2_MEMATTR(DEVICE_nGnRE) | PTE_S2_RDONLY | PTE_S2_XN)
 
 #define PAGE_NONE               __pgprot(((_PAGE_DEFAULT) & ~PTE_VALID) | PTE_PROT_NONE | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_UXN)
-#define PAGE_SHARED             __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_UXN | PTE_WRITE)
-#define PAGE_SHARED_EXEC        __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_WRITE)
+/* shared+writable pages are clean by default, hence PTE_RDONLY|PTE_WRITE */
+#define PAGE_SHARED             __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_UXN | PTE_WRITE)
+#define PAGE_SHARED_EXEC        __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_WRITE)
 #define PAGE_READONLY           __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_UXN)
 #define PAGE_READONLY_EXEC      __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN)
 #define PAGE_EXECONLY           __pgprot(_PAGE_DEFAULT | PTE_RDONLY | PTE_NG | PTE_PXN)
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 6c3b10a41bd8..93f34b4eca25 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -489,6 +489,7 @@ static const struct midr_range arm64_ssb_cpus[] = {
         MIDR_ALL_VERSIONS(MIDR_CORTEX_A35),
         MIDR_ALL_VERSIONS(MIDR_CORTEX_A53),
         MIDR_ALL_VERSIONS(MIDR_CORTEX_A55),
+        MIDR_ALL_VERSIONS(MIDR_BRAHMA_B53),
         {},
 };
 
@@ -573,6 +574,7 @@ static const struct midr_range spectre_v2_safe_list[] = {
         MIDR_ALL_VERSIONS(MIDR_CORTEX_A35),
         MIDR_ALL_VERSIONS(MIDR_CORTEX_A53),
         MIDR_ALL_VERSIONS(MIDR_CORTEX_A55),
+        MIDR_ALL_VERSIONS(MIDR_BRAHMA_B53),
         { /* sentinel */ }
 };
 
@@ -659,17 +661,23 @@ static const struct midr_range arm64_harden_el2_vectors[] = {
 #endif
 
 #ifdef CONFIG_ARM64_WORKAROUND_REPEAT_TLBI
-
-static const struct midr_range arm64_repeat_tlbi_cpus[] = {
+static const struct arm64_cpu_capabilities arm64_repeat_tlbi_list[] = {
 #ifdef CONFIG_QCOM_FALKOR_ERRATUM_1009
-        MIDR_RANGE(MIDR_QCOM_FALKOR_V1, 0, 0, 0, 0),
+        {
+                ERRATA_MIDR_REV(MIDR_QCOM_FALKOR_V1, 0, 0)
+        },
+        {
+                .midr_range.model = MIDR_QCOM_KRYO,
+                .matches = is_kryo_midr,
+        },
 #endif
 #ifdef CONFIG_ARM64_ERRATUM_1286807
-        MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 3, 0),
+        {
+                ERRATA_MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 3, 0),
+        },
 #endif
         {},
 };
-
 #endif
 
 #ifdef CONFIG_CAVIUM_ERRATUM_27456
@@ -737,6 +745,33 @@ static const struct midr_range erratum_1418040_list[] = {
 };
 #endif
 
+#ifdef CONFIG_ARM64_ERRATUM_845719
+static const struct midr_range erratum_845719_list[] = {
+        /* Cortex-A53 r0p[01234] */
+        MIDR_REV_RANGE(MIDR_CORTEX_A53, 0, 0, 4),
+        /* Brahma-B53 r0p[0] */
+        MIDR_REV(MIDR_BRAHMA_B53, 0, 0),
+        {},
+};
+#endif
+
+#ifdef CONFIG_ARM64_ERRATUM_843419
+static const struct arm64_cpu_capabilities erratum_843419_list[] = {
+        {
+                /* Cortex-A53 r0p[01234] */
+                .matches = is_affected_midr_range,
+                ERRATA_MIDR_REV_RANGE(MIDR_CORTEX_A53, 0, 0, 4),
+                MIDR_FIXED(0x4, BIT(8)),
+        },
+        {
+                /* Brahma-B53 r0p[0] */
+                .matches = is_affected_midr_range,
+                ERRATA_MIDR_REV(MIDR_BRAHMA_B53, 0, 0),
+        },
+        {},
+};
+#endif
+
 const struct arm64_cpu_capabilities arm64_errata[] = {
 #ifdef CONFIG_ARM64_WORKAROUND_CLEAN_CACHE
         {
@@ -768,19 +803,18 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
 #endif
 #ifdef CONFIG_ARM64_ERRATUM_843419
         {
-        /* Cortex-A53 r0p[01234] */
                 .desc = "ARM erratum 843419",
                 .capability = ARM64_WORKAROUND_843419,
-                ERRATA_MIDR_REV_RANGE(MIDR_CORTEX_A53, 0, 0, 4),
-                MIDR_FIXED(0x4, BIT(8)),
+                .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
+                .matches = cpucap_multi_entry_cap_matches,
+                .match_list = erratum_843419_list,
         },
 #endif
 #ifdef CONFIG_ARM64_ERRATUM_845719
         {
-        /* Cortex-A53 r0p[01234] */
                 .desc = "ARM erratum 845719",
                 .capability = ARM64_WORKAROUND_845719,
-                ERRATA_MIDR_REV_RANGE(MIDR_CORTEX_A53, 0, 0, 4),
+                ERRATA_MIDR_RANGE_LIST(erratum_845719_list),
         },
 #endif
 #ifdef CONFIG_CAVIUM_ERRATUM_23154
@@ -816,6 +850,7 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
         {
                 .desc = "Qualcomm Technologies Falkor/Kryo erratum 1003",
                 .capability = ARM64_WORKAROUND_QCOM_FALKOR_E1003,
+                .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
                 .matches = cpucap_multi_entry_cap_matches,
                 .match_list = qcom_erratum_1003_list,
         },
@@ -824,7 +859,9 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
         {
                 .desc = "Qualcomm erratum 1009, ARM erratum 1286807",
                 .capability = ARM64_WORKAROUND_REPEAT_TLBI,
-                ERRATA_MIDR_RANGE_LIST(arm64_repeat_tlbi_cpus),
+                .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
+                .matches = cpucap_multi_entry_cap_matches,
+                .match_list = arm64_repeat_tlbi_list,
         },
 #endif
 #ifdef CONFIG_ARM64_ERRATUM_858921
diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
index 1d1d748c227f..b96d74496977 100644
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -2125,7 +2125,7 @@ ftrace_regs_caller:
         copy    %rp, %r26
         LDREG   -FTRACE_FRAME_SIZE-PT_SZ_ALGN(%sp), %r25
         ldo     -8(%r25), %r25
-        copy    %r3, %arg2
+        ldo     -FTRACE_FRAME_SIZE(%r1), %arg2
         b,l     ftrace_function_trampoline, %rp
         copy    %r1, %arg3 /* struct pt_regs */
 
diff --git a/arch/powerpc/include/asm/book3s/32/kup.h b/arch/powerpc/include/asm/book3s/32/kup.h
index 677e9babef80..f9dc597b0b86 100644
--- a/arch/powerpc/include/asm/book3s/32/kup.h
+++ b/arch/powerpc/include/asm/book3s/32/kup.h
@@ -91,6 +91,7 @@
 
 static inline void kuap_update_sr(u32 sr, u32 addr, u32 end)
 {
+        addr &= 0xf0000000;     /* align addr to start of segment */
         barrier();      /* make sure thread.kuap is updated before playing with SRs */
         while (addr < end) {
                 mtsrin(sr, addr);
diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
index 409c9bfb43d9..57c229a86f08 100644
--- a/arch/powerpc/include/asm/elf.h
+++ b/arch/powerpc/include/asm/elf.h
@@ -175,4 +175,7 @@ do {									\
         ARCH_DLINFO_CACHE_GEOMETRY;                                     \
 } while (0)
 
+/* Relocate the kernel image to @final_address */
+void relocate(unsigned long final_address);
+
 #endif /* _ASM_POWERPC_ELF_H */
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index a4e7762dd286..100f1b57ec2f 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -3249,7 +3249,20 @@ static void setup_secure_guest(unsigned long kbase, unsigned long fdt)
         /* Switch to secure mode. */
         prom_printf("Switching to secure mode.\n");
 
+        /*
+         * The ultravisor will do an integrity check of the kernel image but we
+         * relocated it so the check will fail. Restore the original image by
+         * relocating it back to the kernel virtual base address.
+         */
+        if (IS_ENABLED(CONFIG_RELOCATABLE))
+                relocate(KERNELBASE);
+
         ret = enter_secure_mode(kbase, fdt);
+
+        /* Relocate the kernel again. */
+        if (IS_ENABLED(CONFIG_RELOCATABLE))
+                relocate(kbase);
+
         if (ret != U_SUCCESS) {
                 prom_printf("Returned %d from switching to secure mode.\n", ret);
                 prom_rtas_os_term("Switch to secure mode failed.\n");
diff --git a/arch/powerpc/kernel/prom_init_check.sh b/arch/powerpc/kernel/prom_init_check.sh
index 78bab17b1396..b183ab9c5107 100644
--- a/arch/powerpc/kernel/prom_init_check.sh
+++ b/arch/powerpc/kernel/prom_init_check.sh
@@ -26,7 +26,8 @@ _end enter_prom $MEM_FUNCS reloc_offset __secondary_hold
 __secondary_hold_acknowledge __secondary_hold_spinloop __start
 logo_linux_clut224 btext_prepare_BAT
 reloc_got2 kernstart_addr memstart_addr linux_banner _stext
-__prom_init_toc_start __prom_init_toc_end btext_setup_display TOC."
+__prom_init_toc_start __prom_init_toc_end btext_setup_display TOC.
+relocate"
 
 NM="$1"
 OBJ="$2"
diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c
index 6bc24a47e9ef..6f300ab7f0e9 100644
--- a/arch/powerpc/platforms/powernv/eeh-powernv.c
+++ b/arch/powerpc/platforms/powernv/eeh-powernv.c
@@ -42,7 +42,7 @@ void pnv_pcibios_bus_add_device(struct pci_dev *pdev)
 {
         struct pci_dn *pdn = pci_get_pdn(pdev);
 
-        if (eeh_has_flag(EEH_FORCE_DISABLED))
+        if (!pdn || eeh_has_flag(EEH_FORCE_DISABLED))
                 return;
 
         dev_dbg(&pdev->dev, "EEH: Setting up device\n");
diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
index fbd6e6b7bbf2..13e251699346 100644
--- a/arch/powerpc/platforms/powernv/smp.c
+++ b/arch/powerpc/platforms/powernv/smp.c
@@ -146,20 +146,25 @@ static int pnv_smp_cpu_disable(void)
         return 0;
 }
 
+static void pnv_flush_interrupts(void)
+{
+        if (cpu_has_feature(CPU_FTR_ARCH_300)) {
+                if (xive_enabled())
+                        xive_flush_interrupt();
+                else
+                        icp_opal_flush_interrupt();
+        } else {
+                icp_native_flush_interrupt();
+        }
+}
+
 static void pnv_smp_cpu_kill_self(void)
 {
+        unsigned long srr1, unexpected_mask, wmask;
         unsigned int cpu;
-        unsigned long srr1, wmask;
         u64 lpcr_val;
 
         /* Standard hot unplug procedure */
-        /*
-         * This hard disables local interurpts, ensuring we have no lazy
-         * irqs pending.
-         */
-        WARN_ON(irqs_disabled());
-        hard_irq_disable();
-        WARN_ON(lazy_irq_pending());
 
         idle_task_exit();
         current->active_mm = NULL; /* for sanity */
@@ -173,6 +178,27 @@ static void pnv_smp_cpu_kill_self(void)
                 wmask = SRR1_WAKEMASK_P8;
 
         /*
+         * This turns the irq soft-disabled state we're called with, into a
+         * hard-disabled state with pending irq_happened interrupts cleared.
+         *
+         * PACA_IRQ_DEC   - Decrementer should be ignored.
+         * PACA_IRQ_HMI   - Can be ignored, processing is done in real mode.
+         * PACA_IRQ_DBELL, EE, PMI - Unexpected.
+         */
+        hard_irq_disable();
+        if (generic_check_cpu_restart(cpu))
+                goto out;
+
+        unexpected_mask = ~(PACA_IRQ_DEC | PACA_IRQ_HMI | PACA_IRQ_HARD_DIS);
+        if (local_paca->irq_happened & unexpected_mask) {
+                if (local_paca->irq_happened & PACA_IRQ_EE)
+                        pnv_flush_interrupts();
+                DBG("CPU%d Unexpected exit while offline irq_happened=%lx!\n",
+                                cpu, local_paca->irq_happened);
+        }
+        local_paca->irq_happened = PACA_IRQ_HARD_DIS;
+
+        /*
          * We don't want to take decrementer interrupts while we are
          * offline, so clear LPCR:PECE1. We keep PECE2 (and
          * LPCR_PECE_HVEE on P9) enabled so as to let IPIs in.
@@ -197,6 +223,7 @@ static void pnv_smp_cpu_kill_self(void)
 
                 srr1 = pnv_cpu_offline(cpu);
 
+                WARN_ON_ONCE(!irqs_disabled());
                 WARN_ON(lazy_irq_pending());
 
                 /*
@@ -212,13 +239,7 @@ static void pnv_smp_cpu_kill_self(void)
                  */
                 if (((srr1 & wmask) == SRR1_WAKEEE) ||
                     ((srr1 & wmask) == SRR1_WAKEHVI)) {
-                        if (cpu_has_feature(CPU_FTR_ARCH_300)) {
-                                if (xive_enabled())
-                                        xive_flush_interrupt();
-                                else
-                                        icp_opal_flush_interrupt();
-                        } else
-                                icp_native_flush_interrupt();
+                        pnv_flush_interrupts();
                 } else if ((srr1 & wmask) == SRR1_WAKEHDBELL) {
                         unsigned long msg = PPC_DBELL_TYPE(PPC_DBELL_SERVER);
                         asm volatile(PPC_MSGCLR(%0) : : "r" (msg));
@@ -266,7 +287,7 @@ static void pnv_smp_cpu_kill_self(void)
          */
         lpcr_val = mfspr(SPRN_LPCR) | (u64)LPCR_PECE1;
         pnv_program_cpu_hotplug_lpcr(cpu, lpcr_val);
-
+out:
         DBG("CPU%d coming online...\n", cpu);
 }
 
diff --git a/arch/riscv/include/asm/io.h b/arch/riscv/include/asm/io.h
index fc1189ad3777..3ba4d93721d3 100644
--- a/arch/riscv/include/asm/io.h
+++ b/arch/riscv/include/asm/io.h
@@ -13,6 +13,7 @@
 
 #include <linux/types.h>
 #include <asm/mmiowb.h>
+#include <asm/pgtable.h>
 
 extern void __iomem *ioremap(phys_addr_t offset, unsigned long size);
 
@@ -162,6 +163,12 @@ static inline u64 __raw_readq(const volatile void __iomem *addr)
 #endif
 
 /*
+ *  I/O port access constants.
+ */
+#define IO_SPACE_LIMIT          (PCI_IO_SIZE - 1)
+#define PCI_IOBASE              ((void __iomem *)PCI_IO_START)
+
+/*
  * Emulation routines for the port-mapped IO space used by some PCI drivers.
  * These are defined as being "fully synchronous", but also "not guaranteed to
  * be fully ordered with respect to other memory and I/O operations".  We're
diff --git a/arch/riscv/include/asm/irq.h b/arch/riscv/include/asm/irq.h
index 75576424c0f7..6e1b0e0325eb 100644
--- a/arch/riscv/include/asm/irq.h
+++ b/arch/riscv/include/asm/irq.h
@@ -7,6 +7,9 @@
 #ifndef _ASM_RISCV_IRQ_H
 #define _ASM_RISCV_IRQ_H
 
+#include <linux/interrupt.h>
+#include <linux/linkage.h>
+
 #define NR_IRQS         0
 
 void riscv_timer_interrupt(void);
diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
index 0352f20c29f4..d3221017194d 100644
--- a/arch/riscv/include/asm/pgtable.h
+++ b/arch/riscv/include/asm/pgtable.h
@@ -7,6 +7,7 @@
 #define _ASM_RISCV_PGTABLE_H
 
 #include <linux/mmzone.h>
+#include <linux/sizes.h>
 
 #include <asm/pgtable-bits.h>
 
@@ -86,6 +87,7 @@ extern pgd_t swapper_pg_dir[];
 #define VMALLOC_SIZE     (KERN_VIRT_SIZE >> 1)
 #define VMALLOC_END      (PAGE_OFFSET - 1)
 #define VMALLOC_START    (PAGE_OFFSET - VMALLOC_SIZE)
+#define PCI_IO_SIZE      SZ_16M
 
 /*
  * Roughly size the vmemmap space to be large enough to fit enough
@@ -100,7 +102,10 @@ extern pgd_t swapper_pg_dir[];
 
 #define vmemmap         ((struct page *)VMEMMAP_START)
 
-#define FIXADDR_TOP      (VMEMMAP_START)
+#define PCI_IO_END       VMEMMAP_START
+#define PCI_IO_START     (PCI_IO_END - PCI_IO_SIZE)
+#define FIXADDR_TOP      PCI_IO_START
+
 #ifdef CONFIG_64BIT
 #define FIXADDR_SIZE     PMD_SIZE
 #else
diff --git a/arch/riscv/include/asm/switch_to.h b/arch/riscv/include/asm/switch_to.h
index f0227bdce0f0..ee4f0ac62c9d 100644
--- a/arch/riscv/include/asm/switch_to.h
+++ b/arch/riscv/include/asm/switch_to.h
@@ -6,6 +6,7 @@
 #ifndef _ASM_RISCV_SWITCH_TO_H
 #define _ASM_RISCV_SWITCH_TO_H
 
+#include <linux/sched/task_stack.h>
 #include <asm/processor.h>
 #include <asm/ptrace.h>
 #include <asm/csr.h>
diff --git a/arch/riscv/kernel/cpufeature.c b/arch/riscv/kernel/cpufeature.c
index b1ade9a49347..a5ad00043104 100644
--- a/arch/riscv/kernel/cpufeature.c
+++ b/arch/riscv/kernel/cpufeature.c
@@ -10,6 +10,7 @@
 #include <asm/processor.h>
 #include <asm/hwcap.h>
 #include <asm/smp.h>
+#include <asm/switch_to.h>
 
 unsigned long elf_hwcap __read_mostly;
 #ifdef CONFIG_FPU
diff --git a/arch/riscv/kernel/head.h b/arch/riscv/kernel/head.h
new file mode 100644
index 000000000000..105fb0496b24
--- /dev/null
+++ b/arch/riscv/kernel/head.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (C) 2019 SiFive, Inc.
+ */
+#ifndef __ASM_HEAD_H
+#define __ASM_HEAD_H
+
+#include <linux/linkage.h>
+#include <linux/init.h>
+
+extern atomic_t hart_lottery;
+
+asmlinkage void do_page_fault(struct pt_regs *regs);
+asmlinkage void __init setup_vm(uintptr_t dtb_pa);
+
+extern void *__cpu_up_stack_pointer[];
+extern void *__cpu_up_task_pointer[];
+
+void __init parse_dtb(void);
+
+#endif /* __ASM_HEAD_H */
diff --git a/arch/riscv/kernel/irq.c b/arch/riscv/kernel/irq.c
index 6d8659388c49..fffac6ddb0e0 100644
--- a/arch/riscv/kernel/irq.c
+++ b/arch/riscv/kernel/irq.c
@@ -24,7 +24,7 @@ int arch_show_interrupts(struct seq_file *p, int prec)
         return 0;
 }
 
-asmlinkage void __irq_entry do_IRQ(struct pt_regs *regs)
+asmlinkage __visible void __irq_entry do_IRQ(struct pt_regs *regs)
 {
         struct pt_regs *old_regs = set_irq_regs(regs);
 
diff --git a/arch/riscv/kernel/module-sections.c b/arch/riscv/kernel/module-sections.c
index c9ae48333114..e264e59e596e 100644
--- a/arch/riscv/kernel/module-sections.c
+++ b/arch/riscv/kernel/module-sections.c
@@ -8,6 +8,7 @@
 #include <linux/elf.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/moduleloader.h>
 
 unsigned long module_emit_got_entry(struct module *mod, unsigned long val)
 {
diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
index fb3a082362eb..85e3c39bb60b 100644
--- a/arch/riscv/kernel/process.c
+++ b/arch/riscv/kernel/process.c
@@ -7,6 +7,7 @@
  * Copyright (C) 2017 SiFive
  */
 
+#include <linux/cpu.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/sched/task_stack.h>
@@ -19,6 +20,7 @@
 #include <asm/csr.h>
 #include <asm/string.h>
 #include <asm/switch_to.h>
+#include <asm/thread_info.h>
 
 extern asmlinkage void ret_from_fork(void);
 extern asmlinkage void ret_from_kernel_thread(void);
diff --git a/arch/riscv/kernel/ptrace.c b/arch/riscv/kernel/ptrace.c
index 368751438366..1252113ef8b2 100644
--- a/arch/riscv/kernel/ptrace.c
+++ b/arch/riscv/kernel/ptrace.c
@@ -148,7 +148,7 @@ long arch_ptrace(struct task_struct *child, long request,
  * Allows PTRACE_SYSCALL to work.  These are called from entry.S in
  * {handle,ret_from}_syscall.
  */
-void do_syscall_trace_enter(struct pt_regs *regs)
+__visible void do_syscall_trace_enter(struct pt_regs *regs)
 {
         if (test_thread_flag(TIF_SYSCALL_TRACE))
                 if (tracehook_report_syscall_entry(regs))
@@ -162,7 +162,7 @@ void do_syscall_trace_enter(struct pt_regs *regs)
         audit_syscall_entry(regs->a7, regs->a0, regs->a1, regs->a2, regs->a3);
 }
 
-void do_syscall_trace_exit(struct pt_regs *regs)
+__visible void do_syscall_trace_exit(struct pt_regs *regs)
 {
         audit_syscall_exit(regs);
 
diff --git a/arch/riscv/kernel/reset.c b/arch/riscv/kernel/reset.c
index d0fe623bfb8f..aa56bb135ec4 100644
--- a/arch/riscv/kernel/reset.c
+++ b/arch/riscv/kernel/reset.c
@@ -4,6 +4,7 @@
  */
 
 #include <linux/reboot.h>
+#include <linux/pm.h>
 #include <asm/sbi.h>
 
 static void default_power_off(void)
diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
index a990a6cb184f..845ae0e12115 100644
--- a/arch/riscv/kernel/setup.c
+++ b/arch/riscv/kernel/setup.c
@@ -24,6 +24,8 @@
 #include <asm/tlbflush.h>
 #include <asm/thread_info.h>
 
+#include "head.h"
+
 #ifdef CONFIG_DUMMY_CONSOLE
 struct screen_info screen_info = {
         .orig_video_lines       = 30,
diff --git a/arch/riscv/kernel/signal.c b/arch/riscv/kernel/signal.c
index b14d7647d800..d0f6f212f5df 100644
--- a/arch/riscv/kernel/signal.c
+++ b/arch/riscv/kernel/signal.c
@@ -26,7 +26,7 @@ struct rt_sigframe {
 
 #ifdef CONFIG_FPU
 static long restore_fp_state(struct pt_regs *regs,
-                             union __riscv_fp_state *sc_fpregs)
+                             union __riscv_fp_state __user *sc_fpregs)
 {
         long err;
         struct __riscv_d_ext_state __user *state = &sc_fpregs->d;
@@ -53,7 +53,7 @@ static long restore_fp_state(struct pt_regs *regs,
 }
 
 static long save_fp_state(struct pt_regs *regs,
-                          union __riscv_fp_state *sc_fpregs)
+                          union __riscv_fp_state __user *sc_fpregs)
 {
         long err;
         struct __riscv_d_ext_state __user *state = &sc_fpregs->d;
@@ -292,8 +292,8 @@ static void do_signal(struct pt_regs *regs)
  * notification of userspace execution resumption
  * - triggered by the _TIF_WORK_MASK flags
  */
-asmlinkage void do_notify_resume(struct pt_regs *regs,
-        unsigned long thread_info_flags)
+asmlinkage __visible void do_notify_resume(struct pt_regs *regs,
+                                           unsigned long thread_info_flags)
 {
         /* Handle pending signal delivery */
         if (thread_info_flags & _TIF_SIGPENDING)
diff --git a/arch/riscv/kernel/smp.c b/arch/riscv/kernel/smp.c
index b18cd6c8e8fb..5c9ec78422c2 100644
--- a/arch/riscv/kernel/smp.c
+++ b/arch/riscv/kernel/smp.c
@@ -8,7 +8,9 @@
  * Copyright (C) 2017 SiFive
  */
 
+#include <linux/cpu.h>
 #include <linux/interrupt.h>
+#include <linux/profile.h>
 #include <linux/smp.h>
 #include <linux/sched.h>
 #include <linux/seq_file.h>
diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c
index 18ae6da5115e..261f4087cc39 100644
--- a/arch/riscv/kernel/smpboot.c
+++ b/arch/riscv/kernel/smpboot.c
@@ -29,6 +29,9 @@
 #include <asm/tlbflush.h>
 #include <asm/sections.h>
 #include <asm/sbi.h>
+#include <asm/smp.h>
+
+#include "head.h"
 
 void *__cpu_up_stack_pointer[NR_CPUS];
 void *__cpu_up_task_pointer[NR_CPUS];
@@ -130,7 +133,7 @@ void __init smp_cpus_done(unsigned int max_cpus)
 /*
  * C entry point for a secondary processor.
  */
-asmlinkage void __init smp_callin(void)
+asmlinkage __visible void __init smp_callin(void)
 {
         struct mm_struct *mm = &init_mm;
 
diff --git a/arch/riscv/kernel/syscall_table.c b/arch/riscv/kernel/syscall_table.c
index e5dd52d8f633..f1ead9df96ca 100644
--- a/arch/riscv/kernel/syscall_table.c
+++ b/arch/riscv/kernel/syscall_table.c
@@ -8,6 +8,7 @@
 #include <linux/syscalls.h>
 #include <asm-generic/syscalls.h>
 #include <asm/vdso.h>
+#include <asm/syscall.h>
 
 #undef __SYSCALL
 #define __SYSCALL(nr, call)     [nr] = (call),
diff --git a/arch/riscv/kernel/time.c b/arch/riscv/kernel/time.c
index 9dd1f2e64db1..6a53c02e9c73 100644
--- a/arch/riscv/kernel/time.c
+++ b/arch/riscv/kernel/time.c
@@ -7,6 +7,7 @@
 #include <linux/clocksource.h>
 #include <linux/delay.h>
 #include <asm/sbi.h>
+#include <asm/processor.h>
 
 unsigned long riscv_timebase;
 EXPORT_SYMBOL_GPL(riscv_timebase);
diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c
index 10a17e545f43..473de3ae8bb7 100644
--- a/arch/riscv/kernel/traps.c
+++ b/arch/riscv/kernel/traps.c
@@ -3,6 +3,7 @@
  * Copyright (C) 2012 Regents of the University of California
  */
 
+#include <linux/cpu.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/sched.h>
@@ -83,7 +84,7 @@ static void do_trap_error(struct pt_regs *regs, int signo, int code,
 }
 
 #define DO_ERROR_INFO(name, signo, code, str)                           \
-asmlinkage void name(struct pt_regs *regs)                              \
+asmlinkage __visible void name(struct pt_regs *regs)                    \
 {                                                                       \
         do_trap_error(regs, signo, code, regs->sepc, "Oops - " str);    \
 }
@@ -120,7 +121,7 @@ static inline unsigned long get_break_insn_length(unsigned long pc)
         return (((insn & __INSN_LENGTH_MASK) == __INSN_LENGTH_32) ? 4UL : 2UL);
 }
 
-asmlinkage void do_trap_break(struct pt_regs *regs)
+asmlinkage __visible void do_trap_break(struct pt_regs *regs)
 {
         if (user_mode(regs))
                 force_sig_fault(SIGTRAP, TRAP_BRKPT, (void __user *)regs->sepc);
diff --git a/arch/riscv/kernel/vdso.c b/arch/riscv/kernel/vdso.c
index c9c21e0d5641..484d95a70907 100644
--- a/arch/riscv/kernel/vdso.c
+++ b/arch/riscv/kernel/vdso.c
@@ -6,6 +6,7 @@
  * Copyright (C) 2015 Regents of the University of California
  */
 
+#include <linux/elf.h>
 #include <linux/mm.h>
 #include <linux/slab.h>
 #include <linux/binfmts.h>
@@ -25,7 +26,7 @@ static union {
         struct vdso_data        data;
         u8                      page[PAGE_SIZE];
 } vdso_data_store __page_aligned_data;
-struct vdso_data *vdso_data = &vdso_data_store.data;
+static struct vdso_data *vdso_data = &vdso_data_store.data;
 
 static int __init vdso_init(void)
 {
diff --git a/arch/riscv/mm/context.c b/arch/riscv/mm/context.c
index beeb5d7f92ea..ca66d44156b6 100644
--- a/arch/riscv/mm/context.c
+++ b/arch/riscv/mm/context.c
@@ -7,6 +7,7 @@
 #include <linux/mm.h>
 #include <asm/tlbflush.h>
 #include <asm/cacheflush.h>
+#include <asm/mmu_context.h>
 
 /*
  * When necessary, performs a deferred icache flush for the given MM context,
diff --git a/arch/riscv/mm/fault.c b/arch/riscv/mm/fault.c
index 96add1427a75..247b8c859c44 100644
--- a/arch/riscv/mm/fault.c
+++ b/arch/riscv/mm/fault.c
@@ -18,6 +18,8 @@
 #include <asm/ptrace.h>
 #include <asm/tlbflush.h>
 
+#include "../kernel/head.h"
+
 /*
  * This routine handles page faults.  It determines the address and the
  * problem, and then passes it off to one of the appropriate routines.
diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index a1ca6200c31f..573463d1c799 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -19,6 +19,8 @@
 #include <asm/pgtable.h>
 #include <asm/io.h>
 
+#include "../kernel/head.h"
+
 unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]
                                                         __page_aligned_bss;
 EXPORT_SYMBOL(empty_zero_page);
@@ -337,8 +339,7 @@ static uintptr_t __init best_map_size(phys_addr_t base, phys_addr_t size)
  */
 
 #ifndef __riscv_cmodel_medany
-#error "setup_vm() is called from head.S before relocate so it should "
-        "not use absolute addressing."
+#error "setup_vm() is called from head.S before relocate so it should not use absolute addressing."
 #endif
 
 asmlinkage void __init setup_vm(uintptr_t dtb_pa)
diff --git a/arch/riscv/mm/sifive_l2_cache.c b/arch/riscv/mm/sifive_l2_cache.c
index 2e637ad71c05..a9ffff3277c7 100644
--- a/arch/riscv/mm/sifive_l2_cache.c
+++ b/arch/riscv/mm/sifive_l2_cache.c
@@ -142,7 +142,7 @@ static irqreturn_t l2_int_handler(int irq, void *device)
         return IRQ_HANDLED;
 }
 
-int __init sifive_l2_init(void)
+static int __init sifive_l2_init(void)
 {
         struct device_node *np;
         struct resource res;
diff --git a/arch/s390/include/asm/unwind.h b/arch/s390/include/asm/unwind.h
index d827b5b9a32c..eaaefeceef6f 100644
--- a/arch/s390/include/asm/unwind.h
+++ b/arch/s390/include/asm/unwind.h
@@ -35,6 +35,7 @@ struct unwind_state {
         struct task_struct *task;
         struct pt_regs *regs;
         unsigned long sp, ip;
+        bool reuse_sp;
         int graph_idx;
         bool reliable;
         bool error;
diff --git a/arch/s390/kernel/idle.c b/arch/s390/kernel/idle.c
index b9d8fe45737a..8f8456816d83 100644
--- a/arch/s390/kernel/idle.c
+++ b/arch/s390/kernel/idle.c
@@ -69,18 +69,26 @@ DEVICE_ATTR(idle_count, 0444, show_idle_count, NULL);
 static ssize_t show_idle_time(struct device *dev,
                                 struct device_attribute *attr, char *buf)
 {
+        unsigned long long now, idle_time, idle_enter, idle_exit, in_idle;
         struct s390_idle_data *idle = &per_cpu(s390_idle, dev->id);
-        unsigned long long now, idle_time, idle_enter, idle_exit;
         unsigned int seq;
 
         do {
-                now = get_tod_clock();
                 seq = read_seqcount_begin(&idle->seqcount);
                 idle_time = READ_ONCE(idle->idle_time);
                 idle_enter = READ_ONCE(idle->clock_idle_enter);
                 idle_exit = READ_ONCE(idle->clock_idle_exit);
         } while (read_seqcount_retry(&idle->seqcount, seq));
-        idle_time += idle_enter ? ((idle_exit ? : now) - idle_enter) : 0;
+        in_idle = 0;
+        now = get_tod_clock();
+        if (idle_enter) {
+                if (idle_exit) {
+                        in_idle = idle_exit - idle_enter;
+                } else if (now > idle_enter) {
+                        in_idle = now - idle_enter;
+                }
+        }
+        idle_time += in_idle;
         return sprintf(buf, "%llu\n", idle_time >> 12);
 }
 DEVICE_ATTR(idle_time_us, 0444, show_idle_time, NULL);
@@ -88,17 +96,24 @@ DEVICE_ATTR(idle_time_us, 0444, show_idle_time, NULL);
 u64 arch_cpu_idle_time(int cpu)
 {
         struct s390_idle_data *idle = &per_cpu(s390_idle, cpu);
-        unsigned long long now, idle_enter, idle_exit;
+        unsigned long long now, idle_enter, idle_exit, in_idle;
         unsigned int seq;
 
         do {
-                now = get_tod_clock();
                 seq = read_seqcount_begin(&idle->seqcount);
                 idle_enter = READ_ONCE(idle->clock_idle_enter);
                 idle_exit = READ_ONCE(idle->clock_idle_exit);
         } while (read_seqcount_retry(&idle->seqcount, seq));
-
-        return cputime_to_nsecs(idle_enter ? ((idle_exit ?: now) - idle_enter) : 0);
+        in_idle = 0;
+        now = get_tod_clock();
+        if (idle_enter) {
+                if (idle_exit) {
+                        in_idle = idle_exit - idle_enter;
+                } else if (now > idle_enter) {
+                        in_idle = now - idle_enter;
+                }
+        }
+        return cputime_to_nsecs(in_idle);
 }
 
 void arch_cpu_idle_enter(void)
diff --git a/arch/s390/kernel/unwind_bc.c b/arch/s390/kernel/unwind_bc.c
index 8fc9daae47a2..a8204f952315 100644
--- a/arch/s390/kernel/unwind_bc.c
+++ b/arch/s390/kernel/unwind_bc.c
@@ -46,10 +46,15 @@ bool unwind_next_frame(struct unwind_state *state)
 
         regs = state->regs;
         if (unlikely(regs)) {
-                sp = READ_ONCE_NOCHECK(regs->gprs[15]);
-                if (unlikely(outside_of_stack(state, sp))) {
-                        if (!update_stack_info(state, sp))
-                                goto out_err;
+                if (state->reuse_sp) {
+                        sp = state->sp;
+                        state->reuse_sp = false;
+                } else {
+                        sp = READ_ONCE_NOCHECK(regs->gprs[15]);
+                        if (unlikely(outside_of_stack(state, sp))) {
+                                if (!update_stack_info(state, sp))
+                                        goto out_err;
+                        }
                 }
                 sf = (struct stack_frame *) sp;
                 ip = READ_ONCE_NOCHECK(sf->gprs[8]);
@@ -107,9 +112,9 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
 {
         struct stack_info *info = &state->stack_info;
         unsigned long *mask = &state->stack_mask;
+        bool reliable, reuse_sp;
         struct stack_frame *sf;
         unsigned long ip;
-        bool reliable;
 
         memset(state, 0, sizeof(*state));
         state->task = task;
@@ -134,10 +139,12 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
         if (regs) {
                 ip = READ_ONCE_NOCHECK(regs->psw.addr);
                 reliable = true;
+                reuse_sp = true;
         } else {
                 sf = (struct stack_frame *) sp;
                 ip = READ_ONCE_NOCHECK(sf->gprs[8]);
                 reliable = false;
+                reuse_sp = false;
         }
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
@@ -151,5 +158,6 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
         state->sp = sp;
         state->ip = ip;
         state->reliable = reliable;
+        state->reuse_sp = reuse_sp;
 }
 EXPORT_SYMBOL_GPL(__unwind_start);
diff --git a/arch/s390/mm/cmm.c b/arch/s390/mm/cmm.c
index 510a18299196..a51c892f14f3 100644
--- a/arch/s390/mm/cmm.c
+++ b/arch/s390/mm/cmm.c
@@ -298,16 +298,16 @@ static int cmm_timeout_handler(struct ctl_table *ctl, int write,
         }
 
         if (write) {
-                len = *lenp;
-                if (copy_from_user(buf, buffer,
-                                   len > sizeof(buf) ? sizeof(buf) : len))
+                len = min(*lenp, sizeof(buf));
+                if (copy_from_user(buf, buffer, len))
                         return -EFAULT;
-                buf[sizeof(buf) - 1] = '\0';
+                buf[len - 1] = '\0';
                 cmm_skip_blanks(buf, &p);
                 nr = simple_strtoul(p, &p, 0);
                 cmm_skip_blanks(p, &p);
                 seconds = simple_strtoul(p, &p, 0);
                 cmm_set_timeout(nr, seconds);
+                *ppos += *lenp;
         } else {
                 len = sprintf(buf, "%ld %ld\n",
                               cmm_timeout_pages, cmm_timeout_seconds);
@@ -315,9 +315,9 @@ static int cmm_timeout_handler(struct ctl_table *ctl, int write,
                         len = *lenp;
                 if (copy_to_user(buffer, buf, len))
                         return -EFAULT;
+                *lenp = len;
+                *ppos += len;
         }
-        *lenp = len;
-        *ppos += len;
         return 0;
 }
 
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 612535cd9706..6627d7c30f37 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -1403,8 +1403,12 @@ static blk_status_t ubd_queue_rq(struct blk_mq_hw_ctx *hctx,
 
         spin_unlock_irq(&ubd_dev->lock);
 
-        if (ret < 0)
-                blk_mq_requeue_request(req, true);
+        if (ret < 0) {
+                if (ret == -ENOMEM)
+                        res = BLK_STS_RESOURCE;
+                else
+                        res = BLK_STS_DEV_RESOURCE;
+        }
 
         return res;
 }
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index d6662fdef300..82bc60c8acb2 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -13,6 +13,7 @@
 #include <asm/e820/types.h>
 #include <asm/setup.h>
 #include <asm/desc.h>
+#include <asm/boot.h>
 
 #include "../string.h"
 #include "eboot.h"
@@ -813,7 +814,8 @@ efi_main(struct efi_config *c, struct boot_params *boot_params)
                 status = efi_relocate_kernel(sys_table, &bzimage_addr,
                                              hdr->init_size, hdr->init_size,
                                              hdr->pref_address,
-                                             hdr->kernel_alignment);
+                                             hdr->kernel_alignment,
+                                             LOAD_PHYSICAL_ADDR);
                 if (status != EFI_SUCCESS) {
                         efi_printk(sys_table, "efi_relocate_kernel() failed!\n");
                         goto fail;
diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
index 5b35b7ea5d72..26c36357c4c9 100644
--- a/arch/x86/events/amd/ibs.c
+++ b/arch/x86/events/amd/ibs.c
@@ -377,7 +377,8 @@ static inline void perf_ibs_disable_event(struct perf_ibs *perf_ibs,
                                           struct hw_perf_event *hwc, u64 config)
 {
         config &= ~perf_ibs->cnt_mask;
-        wrmsrl(hwc->config_base, config);
+        if (boot_cpu_data.x86 == 0x10)
+                wrmsrl(hwc->config_base, config);
         config &= ~perf_ibs->enable_mask;
         wrmsrl(hwc->config_base, config);
 }
@@ -553,7 +554,8 @@ static struct perf_ibs perf_ibs_op = {
         },
         .msr                    = MSR_AMD64_IBSOPCTL,
         .config_mask            = IBS_OP_CONFIG_MASK,
-        .cnt_mask               = IBS_OP_MAX_CNT,
+        .cnt_mask               = IBS_OP_MAX_CNT | IBS_OP_CUR_CNT |
+                                  IBS_OP_CUR_CNT_RAND,
         .enable_mask            = IBS_OP_ENABLE,
         .valid_mask             = IBS_OP_VAL,
         .max_period             = IBS_OP_MAX_CNT << 4,
@@ -614,7 +616,7 @@ fail:
         if (event->attr.sample_type & PERF_SAMPLE_RAW)
                 offset_max = perf_ibs->offset_max;
         else if (check_rip)
-                offset_max = 2;
+                offset_max = 3;
         else
                 offset_max = 1;
         do {
diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index 6fc2e06ab4c6..86467f85c383 100644
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -502,10 +502,8 @@ void uncore_pmu_event_start(struct perf_event *event, int flags)
         local64_set(&event->hw.prev_count, uncore_read_counter(box, event));
         uncore_enable_event(box, event);
 
-        if (box->n_active == 1) {
-                uncore_enable_box(box);
+        if (box->n_active == 1)
                 uncore_pmu_start_hrtimer(box);
-        }
 }
 
 void uncore_pmu_event_stop(struct perf_event *event, int flags)
@@ -529,10 +527,8 @@ void uncore_pmu_event_stop(struct perf_event *event, int flags)
                 WARN_ON_ONCE(hwc->state & PERF_HES_STOPPED);
                 hwc->state |= PERF_HES_STOPPED;
 
-                if (box->n_active == 0) {
-                        uncore_disable_box(box);
+                if (box->n_active == 0)
                         uncore_pmu_cancel_hrtimer(box);
-                }
         }
 
         if ((flags & PERF_EF_UPDATE) && !(hwc->state & PERF_HES_UPTODATE)) {
@@ -778,6 +774,40 @@ static int uncore_pmu_event_init(struct perf_event *event)
         return ret;
 }
 
+static void uncore_pmu_enable(struct pmu *pmu)
+{
+        struct intel_uncore_pmu *uncore_pmu;
+        struct intel_uncore_box *box;
+
+        uncore_pmu = container_of(pmu, struct intel_uncore_pmu, pmu);
+        if (!uncore_pmu)
+                return;
+
+        box = uncore_pmu_to_box(uncore_pmu, smp_processor_id());
+        if (!box)
+                return;
+
+        if (uncore_pmu->type->ops->enable_box)
+                uncore_pmu->type->ops->enable_box(box);
+}
+
+static void uncore_pmu_disable(struct pmu *pmu)
+{
+        struct intel_uncore_pmu *uncore_pmu;
+        struct intel_uncore_box *box;
+
+        uncore_pmu = container_of(pmu, struct intel_uncore_pmu, pmu);
+        if (!uncore_pmu)
+                return;
+
+        box = uncore_pmu_to_box(uncore_pmu, smp_processor_id());
+        if (!box)
+                return;
+
+        if (uncore_pmu->type->ops->disable_box)
+                uncore_pmu->type->ops->disable_box(box);
+}
+
 static ssize_t uncore_get_attr_cpumask(struct device *dev,
                                 struct device_attribute *attr, char *buf)
 {
@@ -803,6 +833,8 @@ static int uncore_pmu_register(struct intel_uncore_pmu *pmu)
                 pmu->pmu = (struct pmu) {
                         .attr_groups    = pmu->type->attr_groups,
                         .task_ctx_nr    = perf_invalid_context,
+                        .pmu_enable     = uncore_pmu_enable,
+                        .pmu_disable    = uncore_pmu_disable,
                         .event_init     = uncore_pmu_event_init,
                         .add            = uncore_pmu_event_add,
                         .del            = uncore_pmu_event_del,
diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h
index f36f7bebbc1b..bbfdaa720b45 100644
--- a/arch/x86/events/intel/uncore.h
+++ b/arch/x86/events/intel/uncore.h
@@ -441,18 +441,6 @@ static inline int uncore_freerunning_hw_config(struct intel_uncore_box *box,
         return -EINVAL;
 }
 
-static inline void uncore_disable_box(struct intel_uncore_box *box)
-{
-        if (box->pmu->type->ops->disable_box)
-                box->pmu->type->ops->disable_box(box);
-}
-
-static inline void uncore_enable_box(struct intel_uncore_box *box)
-{
-        if (box->pmu->type->ops->enable_box)
-                box->pmu->type->ops->enable_box(box);
-}
-
 static inline void uncore_disable_event(struct intel_uncore_box *box,
                                 struct perf_event *event)
 {
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index ca200b50cde4..c5673bda4b66 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -734,8 +734,14 @@ static int get_npt_level(struct kvm_vcpu *vcpu)
 static void svm_set_efer(struct kvm_vcpu *vcpu, u64 efer)
 {
         vcpu->arch.efer = efer;
-        if (!npt_enabled && !(efer & EFER_LMA))
-                efer &= ~EFER_LME;
+
+        if (!npt_enabled) {
+                /* Shadow paging assumes NX to be available.  */
+                efer |= EFER_NX;
+
+                if (!(efer & EFER_LMA))
+                        efer &= ~EFER_LME;
+        }
 
         to_svm(vcpu)->vmcb->save.efer = efer | EFER_SVME;
         mark_dirty(to_svm(vcpu)->vmcb, VMCB_CR);
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 8f01019295a1..5d21a4ab28cf 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -969,17 +969,9 @@ static bool update_transition_efer(struct vcpu_vmx *vmx, int efer_offset)
         u64 guest_efer = vmx->vcpu.arch.efer;
         u64 ignore_bits = 0;
 
-        if (!enable_ept) {
-                /*
-                 * NX is needed to handle CR0.WP=1, CR4.SMEP=1.  Testing
-                 * host CPUID is more efficient than testing guest CPUID
-                 * or CR4.  Host SMEP is anyway a requirement for guest SMEP.
-                 */
-                if (boot_cpu_has(X86_FEATURE_SMEP))
-                        guest_efer |= EFER_NX;
-                else if (!(guest_efer & EFER_NX))
-                        ignore_bits |= EFER_NX;
-        }
+        /* Shadow paging assumes NX to be available.  */
+        if (!enable_ept)
+                guest_efer |= EFER_NX;
 
         /*
          * LMA and LME handled by hardware; SCE meaningless outside long mode.
diff --git a/block/blk-iocost.c b/block/blk-iocost.c
index 2a3db80c1dce..a7ed434eae03 100644
--- a/block/blk-iocost.c
+++ b/block/blk-iocost.c
@@ -2110,10 +2110,10 @@ static ssize_t ioc_weight_write(struct kernfs_open_file *of, char *buf,
                         goto einval;
         }
 
-        spin_lock_irq(&iocg->ioc->lock);
+        spin_lock(&iocg->ioc->lock);
         iocg->cfg_weight = v;
         weight_updated(iocg);
-        spin_unlock_irq(&iocg->ioc->lock);
+        spin_unlock(&iocg->ioc->lock);
 
         blkg_conf_finish(&ctx);
         return nbytes;
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index 753e171de006..5909e8fa4013 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -159,26 +159,34 @@ void acpi_processor_ignore_ppc_init(void)
 
 void acpi_processor_ppc_init(struct cpufreq_policy *policy)
 {
-        int cpu = policy->cpu;
-        struct acpi_processor *pr = per_cpu(processors, cpu);
-        int ret;
+        unsigned int cpu;
 
-        if (!pr)
-                return;
+        for_each_cpu(cpu, policy->related_cpus) {
+                struct acpi_processor *pr = per_cpu(processors, cpu);
+                int ret;
+
+                if (!pr)
+                        continue;
 
-        ret = freq_qos_add_request(&policy->constraints, &pr->perflib_req,
-                                   FREQ_QOS_MAX, INT_MAX);
-        if (ret < 0)
-                pr_err("Failed to add freq constraint for CPU%d (%d)\n", cpu,
-                       ret);
+                ret = freq_qos_add_request(&policy->constraints,
+                                           &pr->perflib_req,
+                                           FREQ_QOS_MAX, INT_MAX);
+                if (ret < 0)
+                        pr_err("Failed to add freq constraint for CPU%d (%d)\n",
+                               cpu, ret);
+        }
 }
 
 void acpi_processor_ppc_exit(struct cpufreq_policy *policy)
 {
-        struct acpi_processor *pr = per_cpu(processors, policy->cpu);
+        unsigned int cpu;
 
-        if (pr)
-                freq_qos_remove_request(&pr->perflib_req);
+        for_each_cpu(cpu, policy->related_cpus) {
+                struct acpi_processor *pr = per_cpu(processors, cpu);
+
+                if (pr)
+                        freq_qos_remove_request(&pr->perflib_req);
+        }
 }
 
 static int acpi_processor_get_performance_control(struct acpi_processor *pr)
diff --git a/drivers/acpi/processor_thermal.c b/drivers/acpi/processor_thermal.c
index c77a5b1fb107..41feb88ee92d 100644
--- a/drivers/acpi/processor_thermal.c
+++ b/drivers/acpi/processor_thermal.c
@@ -127,26 +127,34 @@ static int cpufreq_set_cur_state(unsigned int cpu, int state)
 
 void acpi_thermal_cpufreq_init(struct cpufreq_policy *policy)
 {
-        int cpu = policy->cpu;
-        struct acpi_processor *pr = per_cpu(processors, cpu);
-        int ret;
+        unsigned int cpu;
 
-        if (!pr)
-                return;
+        for_each_cpu(cpu, policy->related_cpus) {
+                struct acpi_processor *pr = per_cpu(processors, cpu);
+                int ret;
+
+                if (!pr)
+                        continue;
 
-        ret = freq_qos_add_request(&policy->constraints, &pr->thermal_req,
-                                   FREQ_QOS_MAX, INT_MAX);
-        if (ret < 0)
-                pr_err("Failed to add freq constraint for CPU%d (%d)\n", cpu,
-                       ret);
+                ret = freq_qos_add_request(&policy->constraints,
+                                           &pr->thermal_req,
+                                           FREQ_QOS_MAX, INT_MAX);
+                if (ret < 0)
+                        pr_err("Failed to add freq constraint for CPU%d (%d)\n",
+                               cpu, ret);
+        }
 }
 
 void acpi_thermal_cpufreq_exit(struct cpufreq_policy *policy)
 {
-        struct acpi_processor *pr = per_cpu(processors, policy->cpu);
+        unsigned int cpu;
+
+        for_each_cpu(cpu, policy->related_cpus) {
+                struct acpi_processor *pr = per_cpu(processors, policy->cpu);
 
-        if (pr)
-                freq_qos_remove_request(&pr->thermal_req);
+                if (pr)
+                        freq_qos_remove_request(&pr->thermal_req);
+        }
 }
 #else                           /* ! CONFIG_CPU_FREQ */
 static int cpufreq_get_max_state(unsigned int cpu)
diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c b/drivers/crypto/chelsio/chtls/chtls_cm.c
index 774d991d7cca..aca75237bbcf 100644
--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
+++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
@@ -1297,7 +1297,7 @@ static void make_established(struct sock *sk, u32 snd_isn, unsigned int opt)
         tp->write_seq = snd_isn;
         tp->snd_nxt = snd_isn;
         tp->snd_una = snd_isn;
-        inet_sk(sk)->inet_id = tp->write_seq ^ jiffies;
+        inet_sk(sk)->inet_id = prandom_u32();
         assign_rxopt(sk, opt);
 
         if (tp->rcv_wnd > (RCV_BUFSIZ_M << 10))
diff --git a/drivers/crypto/chelsio/chtls/chtls_io.c b/drivers/crypto/chelsio/chtls/chtls_io.c
index 0891ab829b1b..98bc5a4cd5e7 100644
--- a/drivers/crypto/chelsio/chtls/chtls_io.c
+++ b/drivers/crypto/chelsio/chtls/chtls_io.c
@@ -1702,7 +1702,7 @@ int chtls_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
                 return peekmsg(sk, msg, len, nonblock, flags);
 
         if (sk_can_busy_loop(sk) &&
-            skb_queue_empty(&sk->sk_receive_queue) &&
+            skb_queue_empty_lockless(&sk->sk_receive_queue) &&
             sk->sk_state == TCP_ESTABLISHED)
                 sk_busy_loop(sk, nonblock);
 
diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 9ba74ab7e912..c27e206a764c 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -1707,6 +1707,14 @@ static void sdma_add_scripts(struct sdma_engine *sdma,
         if (!sdma->script_number)
                 sdma->script_number = SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V1;
 
+        if (sdma->script_number > sizeof(struct sdma_script_start_addrs)
+                                  / sizeof(s32)) {
+                dev_err(sdma->dev,
+                        "SDMA script number %d not match with firmware.\n",
+                        sdma->script_number);
+                return;
+        }
+
         for (i = 0; i < sdma->script_number; i++)
                 if (addr_arr[i] > 0)
                         saddr_arr[i] = addr_arr[i];
diff --git a/drivers/dma/qcom/bam_dma.c b/drivers/dma/qcom/bam_dma.c
index 8e90a405939d..ef73f65224b1 100644
--- a/drivers/dma/qcom/bam_dma.c
+++ b/drivers/dma/qcom/bam_dma.c
@@ -694,6 +694,25 @@ static int bam_dma_terminate_all(struct dma_chan *chan)
 
         /* remove all transactions, including active transaction */
         spin_lock_irqsave(&bchan->vc.lock, flag);
+        /*
+         * If we have transactions queued, then some might be committed to the
+         * hardware in the desc fifo.  The only way to reset the desc fifo is
+         * to do a hardware reset (either by pipe or the entire block).
+         * bam_chan_init_hw() will trigger a pipe reset, and also reinit the
+         * pipe.  If the pipe is left disabled (default state after pipe reset)
+         * and is accessed by a connected hardware engine, a fatal error in
+         * the BAM will occur.  There is a small window where this could happen
+         * with bam_chan_init_hw(), but it is assumed that the caller has
+         * stopped activity on any attached hardware engine.  Make sure to do
+         * this first so that the BAM hardware doesn't cause memory corruption
+         * by accessing freed resources.
+         */
+        if (!list_empty(&bchan->desc_list)) {
+                async_desc = list_first_entry(&bchan->desc_list,
+                                              struct bam_async_desc, desc_node);
+                bam_chan_init_hw(bchan, async_desc->dir);
+        }
+
         list_for_each_entry_safe(async_desc, tmp,
                                  &bchan->desc_list, desc_node) {
                 list_add(&async_desc->vd.node, &bchan->vc.desc_issued);
diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
index 525dc7338fe3..8546ad034720 100644
--- a/drivers/dma/sprd-dma.c
+++ b/drivers/dma/sprd-dma.c
@@ -134,6 +134,10 @@
 #define SPRD_DMA_SRC_TRSF_STEP_OFFSET   0
 #define SPRD_DMA_TRSF_STEP_MASK         GENMASK(15, 0)
 
+/* SPRD DMA_SRC_BLK_STEP register definition */
+#define SPRD_DMA_LLIST_HIGH_MASK        GENMASK(31, 28)
+#define SPRD_DMA_LLIST_HIGH_SHIFT       28
+
 /* define DMA channel mode & trigger mode mask */
 #define SPRD_DMA_CHN_MODE_MASK          GENMASK(7, 0)
 #define SPRD_DMA_TRG_MODE_MASK          GENMASK(7, 0)
@@ -208,6 +212,7 @@ struct sprd_dma_dev {
         struct sprd_dma_chn     channels[0];
 };
 
+static void sprd_dma_free_desc(struct virt_dma_desc *vd);
 static bool sprd_dma_filter_fn(struct dma_chan *chan, void *param);
 static struct of_dma_filter_info sprd_dma_info = {
         .filter_fn = sprd_dma_filter_fn,
@@ -609,12 +614,19 @@ static int sprd_dma_alloc_chan_resources(struct dma_chan *chan)
 static void sprd_dma_free_chan_resources(struct dma_chan *chan)
 {
         struct sprd_dma_chn *schan = to_sprd_dma_chan(chan);
+        struct virt_dma_desc *cur_vd = NULL;
         unsigned long flags;
 
         spin_lock_irqsave(&schan->vc.lock, flags);
+        if (schan->cur_desc)
+                cur_vd = &schan->cur_desc->vd;
+
         sprd_dma_stop(schan);
         spin_unlock_irqrestore(&schan->vc.lock, flags);
 
+        if (cur_vd)
+                sprd_dma_free_desc(cur_vd);
+
         vchan_free_chan_resources(&schan->vc);
         pm_runtime_put(chan->device->dev);
 }
@@ -717,6 +729,7 @@ static int sprd_dma_fill_desc(struct dma_chan *chan,
         u32 int_mode = flags & SPRD_DMA_INT_MASK;
         int src_datawidth, dst_datawidth, src_step, dst_step;
         u32 temp, fix_mode = 0, fix_en = 0;
+        phys_addr_t llist_ptr;
 
         if (dir == DMA_MEM_TO_DEV) {
                 src_step = sprd_dma_get_step(slave_cfg->src_addr_width);
@@ -814,13 +827,16 @@ static int sprd_dma_fill_desc(struct dma_chan *chan,
                  * Set the link-list pointer point to next link-list
                  * configuration's physical address.
                  */
-                hw->llist_ptr = schan->linklist.phy_addr + temp;
+                llist_ptr = schan->linklist.phy_addr + temp;
+                hw->llist_ptr = lower_32_bits(llist_ptr);
+                hw->src_blk_step = (upper_32_bits(llist_ptr) << SPRD_DMA_LLIST_HIGH_SHIFT) &
+                        SPRD_DMA_LLIST_HIGH_MASK;
         } else {
                 hw->llist_ptr = 0;
+                hw->src_blk_step = 0;
         }
 
         hw->frg_step = 0;
-        hw->src_blk_step = 0;
         hw->des_blk_step = 0;
         return 0;
 }
@@ -1023,15 +1039,22 @@ static int sprd_dma_resume(struct dma_chan *chan)
 static int sprd_dma_terminate_all(struct dma_chan *chan)
 {
         struct sprd_dma_chn *schan = to_sprd_dma_chan(chan);
+        struct virt_dma_desc *cur_vd = NULL;
         unsigned long flags;
         LIST_HEAD(head);
 
         spin_lock_irqsave(&schan->vc.lock, flags);
+        if (schan->cur_desc)
+                cur_vd = &schan->cur_desc->vd;
+
         sprd_dma_stop(schan);
 
         vchan_get_all_descriptors(&schan->vc, &head);
         spin_unlock_irqrestore(&schan->vc.lock, flags);
 
+        if (cur_vd)
+                sprd_dma_free_desc(cur_vd);
+
         vchan_dma_desc_free_list(&schan->vc, &head);
         return 0;
 }
diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
index 5f8adf5c1f20..6e1268552f74 100644
--- a/drivers/dma/tegra210-adma.c
+++ b/drivers/dma/tegra210-adma.c
@@ -40,6 +40,7 @@
 #define ADMA_CH_CONFIG_MAX_BURST_SIZE                   16
 #define ADMA_CH_CONFIG_WEIGHT_FOR_WRR(val)              ((val) & 0xf)
 #define ADMA_CH_CONFIG_MAX_BUFS                         8
+#define TEGRA186_ADMA_CH_CONFIG_OUTSTANDING_REQS(reqs)  (reqs << 4)
 
 #define ADMA_CH_FIFO_CTRL                               0x2c
 #define TEGRA210_ADMA_CH_FIFO_CTRL_TXSIZE(val)          (((val) & 0xf) << 8)
@@ -77,6 +78,7 @@ struct tegra_adma;
  * @ch_req_tx_shift: Register offset for AHUB transmit channel select.
  * @ch_req_rx_shift: Register offset for AHUB receive channel select.
  * @ch_base_offset: Register offset of DMA channel registers.
+ * @has_outstanding_reqs: If DMA channel can have outstanding requests.
  * @ch_fifo_ctrl: Default value for channel FIFO CTRL register.
  * @ch_req_mask: Mask for Tx or Rx channel select.
  * @ch_req_max: Maximum number of Tx or Rx channels available.
@@ -95,6 +97,7 @@ struct tegra_adma_chip_data {
         unsigned int ch_req_max;
         unsigned int ch_reg_size;
         unsigned int nr_channels;
+        bool has_outstanding_reqs;
 };
 
 /*
@@ -594,6 +597,8 @@ static int tegra_adma_set_xfer_params(struct tegra_adma_chan *tdc,
                          ADMA_CH_CTRL_FLOWCTRL_EN;
         ch_regs->config |= cdata->adma_get_burst_config(burst_size);
         ch_regs->config |= ADMA_CH_CONFIG_WEIGHT_FOR_WRR(1);
+        if (cdata->has_outstanding_reqs)
+                ch_regs->config |= TEGRA186_ADMA_CH_CONFIG_OUTSTANDING_REQS(8);
         ch_regs->fifo_ctrl = cdata->ch_fifo_ctrl;
         ch_regs->tc = desc->period_len & ADMA_CH_TC_COUNT_MASK;
 
@@ -778,6 +783,7 @@ static const struct tegra_adma_chip_data tegra210_chip_data = {
         .ch_req_tx_shift        = 28,
         .ch_req_rx_shift        = 24,
         .ch_base_offset         = 0,
+        .has_outstanding_reqs   = false,
         .ch_fifo_ctrl           = TEGRA210_FIFO_CTRL_DEFAULT,
         .ch_req_mask            = 0xf,
         .ch_req_max             = 10,
@@ -792,6 +798,7 @@ static const struct tegra_adma_chip_data tegra186_chip_data = {
         .ch_req_tx_shift        = 27,
         .ch_req_rx_shift        = 22,
         .ch_base_offset         = 0x10000,
+        .has_outstanding_reqs   = true,
         .ch_fifo_ctrl           = TEGRA186_FIFO_CTRL_DEFAULT,
         .ch_req_mask            = 0x1f,
         .ch_req_max             = 20,
diff --git a/drivers/dma/ti/cppi41.c b/drivers/dma/ti/cppi41.c
index 2f946f55076c..8c2f7ebe998c 100644
--- a/drivers/dma/ti/cppi41.c
+++ b/drivers/dma/ti/cppi41.c
@@ -586,9 +586,22 @@ static struct dma_async_tx_descriptor *cppi41_dma_prep_slave_sg(
         enum dma_transfer_direction dir, unsigned long tx_flags, void *context)
 {
         struct cppi41_channel *c = to_cpp41_chan(chan);
+        struct dma_async_tx_descriptor *txd = NULL;
+        struct cppi41_dd *cdd = c->cdd;
         struct cppi41_desc *d;
         struct scatterlist *sg;
         unsigned int i;
+        int error;
+
+        error = pm_runtime_get(cdd->ddev.dev);
+        if (error < 0) {
+                pm_runtime_put_noidle(cdd->ddev.dev);
+
+                return NULL;
+        }
+
+        if (cdd->is_suspended)
+                goto err_out_not_ready;
 
         d = c->desc;
         for_each_sg(sgl, sg, sg_len, i) {
@@ -611,7 +624,13 @@ static struct dma_async_tx_descriptor *cppi41_dma_prep_slave_sg(
                 d++;
         }
 
-        return &c->txd;
+        txd = &c->txd;
+
+err_out_not_ready:
+        pm_runtime_mark_last_busy(cdd->ddev.dev);
+        pm_runtime_put_autosuspend(cdd->ddev.dev);
+
+        return txd;
 }
 
 static void cppi41_compute_td_desc(struct cppi41_desc *d)
diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
index e7dc3c4dc8e0..5d56f1e4d332 100644
--- a/drivers/dma/xilinx/xilinx_dma.c
+++ b/drivers/dma/xilinx/xilinx_dma.c
@@ -68,6 +68,9 @@
 #define XILINX_DMA_DMACR_CIRC_EN                BIT(1)
 #define XILINX_DMA_DMACR_RUNSTOP                BIT(0)
 #define XILINX_DMA_DMACR_FSYNCSRC_MASK          GENMASK(6, 5)
+#define XILINX_DMA_DMACR_DELAY_MASK             GENMASK(31, 24)
+#define XILINX_DMA_DMACR_FRAME_COUNT_MASK       GENMASK(23, 16)
+#define XILINX_DMA_DMACR_MASTER_MASK            GENMASK(11, 8)
 
 #define XILINX_DMA_REG_DMASR                    0x0004
 #define XILINX_DMA_DMASR_EOL_LATE_ERR           BIT(15)
@@ -1354,7 +1357,8 @@ static void xilinx_dma_start_transfer(struct xilinx_dma_chan *chan)
                                            node);
                 hw = &segment->hw;
 
-                xilinx_write(chan, XILINX_DMA_REG_SRCDSTADDR, hw->buf_addr);
+                xilinx_write(chan, XILINX_DMA_REG_SRCDSTADDR,
+                             xilinx_prep_dma_addr_t(hw->buf_addr));
 
                 /* Start the transfer */
                 dma_ctrl_write(chan, XILINX_DMA_REG_BTT,
@@ -2117,8 +2121,10 @@ int xilinx_vdma_channel_set_config(struct dma_chan *dchan,
         chan->config.gen_lock = cfg->gen_lock;
         chan->config.master = cfg->master;
 
+        dmacr &= ~XILINX_DMA_DMACR_GENLOCK_EN;
         if (cfg->gen_lock && chan->genlock) {
                 dmacr |= XILINX_DMA_DMACR_GENLOCK_EN;
+                dmacr &= ~XILINX_DMA_DMACR_MASTER_MASK;
                 dmacr |= cfg->master << XILINX_DMA_DMACR_MASTER_SHIFT;
         }
 
@@ -2134,11 +2140,13 @@ int xilinx_vdma_channel_set_config(struct dma_chan *dchan,
         chan->config.delay = cfg->delay;
 
         if (cfg->coalesc <= XILINX_DMA_DMACR_FRAME_COUNT_MAX) {
+                dmacr &= ~XILINX_DMA_DMACR_FRAME_COUNT_MASK;
                 dmacr |= cfg->coalesc << XILINX_DMA_DMACR_FRAME_COUNT_SHIFT;
                 chan->config.coalesc = cfg->coalesc;
         }
 
         if (cfg->delay <= XILINX_DMA_DMACR_DELAY_MAX) {
+                dmacr &= ~XILINX_DMA_DMACR_DELAY_MASK;
                 dmacr |= cfg->delay << XILINX_DMA_DMACR_DELAY_SHIFT;
                 chan->config.delay = cfg->delay;
         }
diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig
index 178ee8106828..b248870a9806 100644
--- a/drivers/firmware/efi/Kconfig
+++ b/drivers/firmware/efi/Kconfig
@@ -182,6 +182,7 @@ config RESET_ATTACK_MITIGATION
 
 config EFI_RCI2_TABLE
         bool "EFI Runtime Configuration Interface Table Version 2 Support"
+        depends on X86 || COMPILE_TEST
         help
           Displays the content of the Runtime Configuration Interface
           Table version 2 on Dell EMC PowerEdge systems as a binary
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 69f00f7453a3..e98bbf8e56d9 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -554,7 +554,7 @@ int __init efi_config_parse_tables(void *config_tables, int count, int sz,
                                               sizeof(*seed) + size);
                         if (seed != NULL) {
                                 pr_notice("seeding entropy pool\n");
-                                add_device_randomness(seed->bits, seed->size);
+                                add_bootloader_randomness(seed->bits, seed->size);
                                 early_memunmap(seed, sizeof(*seed) + size);
                         } else {
                                 pr_err("Could not map UEFI random seed!\n");
diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
index 0460c7581220..ee0661ddb25b 100644
--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -52,6 +52,7 @@ lib-$(CONFIG_EFI_ARMSTUB)	+= arm-stub.o fdt.o string.o random.o \
 
 lib-$(CONFIG_ARM)               += arm32-stub.o
 lib-$(CONFIG_ARM64)             += arm64-stub.o
+CFLAGS_arm32-stub.o             := -DTEXT_OFFSET=$(TEXT_OFFSET)
 CFLAGS_arm64-stub.o             := -DTEXT_OFFSET=$(TEXT_OFFSET)
 
 #
diff --git a/drivers/firmware/efi/libstub/arm32-stub.c b/drivers/firmware/efi/libstub/arm32-stub.c
index e8f7aefb6813..41213bf5fcf5 100644
--- a/drivers/firmware/efi/libstub/arm32-stub.c
+++ b/drivers/firmware/efi/libstub/arm32-stub.c
@@ -195,6 +195,7 @@ efi_status_t handle_kernel_image(efi_system_table_t *sys_table,
                                  unsigned long dram_base,
                                  efi_loaded_image_t *image)
 {
+        unsigned long kernel_base;
         efi_status_t status;
 
         /*
@@ -204,9 +205,18 @@ efi_status_t handle_kernel_image(efi_system_table_t *sys_table,
          * loaded. These assumptions are made by the decompressor,
          * before any memory map is available.
          */
-        dram_base = round_up(dram_base, SZ_128M);
+        kernel_base = round_up(dram_base, SZ_128M);
 
-        status = reserve_kernel_base(sys_table, dram_base, reserve_addr,
+        /*
+         * Note that some platforms (notably, the Raspberry Pi 2) put
+         * spin-tables and other pieces of firmware at the base of RAM,
+         * abusing the fact that the window of TEXT_OFFSET bytes at the
+         * base of the kernel image is only partially used at the moment.
+         * (Up to 5 pages are used for the swapper page tables)
+         */
+        kernel_base += TEXT_OFFSET - 5 * PAGE_SIZE;
+
+        status = reserve_kernel_base(sys_table, kernel_base, reserve_addr,
                                      reserve_size);
         if (status != EFI_SUCCESS) {
                 pr_efi_err(sys_table, "Unable to allocate memory for uncompressed kernel.\n");
@@ -220,7 +230,7 @@ efi_status_t handle_kernel_image(efi_system_table_t *sys_table,
         *image_size = image->image_size;
         status = efi_relocate_kernel(sys_table, image_addr, *image_size,
                                      *image_size,
-                                     dram_base + MAX_UNCOMP_KERNEL_SIZE, 0);
+                                     kernel_base + MAX_UNCOMP_KERNEL_SIZE, 0, 0);
         if (status != EFI_SUCCESS) {
                 pr_efi_err(sys_table, "Failed to relocate kernel.\n");
                 efi_free(sys_table, *reserve_size, *reserve_addr);
diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index 3caae7f2cf56..35dbc2791c97 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -260,11 +260,11 @@ fail:
 }
 
 /*
- * Allocate at the lowest possible address.
+ * Allocate at the lowest possible address that is not below 'min'.
  */
-efi_status_t efi_low_alloc(efi_system_table_t *sys_table_arg,
-                           unsigned long size, unsigned long align,
-                           unsigned long *addr)
+efi_status_t efi_low_alloc_above(efi_system_table_t *sys_table_arg,
+                                 unsigned long size, unsigned long align,
+                                 unsigned long *addr, unsigned long min)
 {
         unsigned long map_size, desc_size, buff_size;
         efi_memory_desc_t *map;
@@ -311,13 +311,8 @@ efi_status_t efi_low_alloc(efi_system_table_t *sys_table_arg,
                 start = desc->phys_addr;
                 end = start + desc->num_pages * EFI_PAGE_SIZE;
 
-                /*
-                 * Don't allocate at 0x0. It will confuse code that
-                 * checks pointers against NULL. Skip the first 8
-                 * bytes so we start at a nice even number.
-                 */
-                if (start == 0x0)
-                        start += 8;
+                if (start < min)
+                        start = min;
 
                 start = round_up(start, align);
                 if ((start + size) > end)
@@ -698,7 +693,8 @@ efi_status_t efi_relocate_kernel(efi_system_table_t *sys_table_arg,
                                  unsigned long image_size,
                                  unsigned long alloc_size,
                                  unsigned long preferred_addr,
-                                 unsigned long alignment)
+                                 unsigned long alignment,
+                                 unsigned long min_addr)
 {
         unsigned long cur_image_addr;
         unsigned long new_addr = 0;
@@ -731,8 +727,8 @@ efi_status_t efi_relocate_kernel(efi_system_table_t *sys_table_arg,
          * possible.
          */
         if (status != EFI_SUCCESS) {
-                status = efi_low_alloc(sys_table_arg, alloc_size, alignment,
-                                       &new_addr);
+                status = efi_low_alloc_above(sys_table_arg, alloc_size,
+                                             alignment, &new_addr, min_addr);
         }
         if (status != EFI_SUCCESS) {
                 pr_efi_err(sys_table_arg, "Failed to allocate usable memory for kernel.\n");
diff --git a/drivers/firmware/efi/test/efi_test.c b/drivers/firmware/efi/test/efi_test.c
index 877745c3aaf2..7baf48c01e72 100644
--- a/drivers/firmware/efi/test/efi_test.c
+++ b/drivers/firmware/efi/test/efi_test.c
@@ -14,6 +14,7 @@
 #include <linux/init.h>
 #include <linux/proc_fs.h>
 #include <linux/efi.h>
+#include <linux/security.h>
 #include <linux/slab.h>
 #include <linux/uaccess.h>
 
@@ -717,6 +718,13 @@ static long efi_test_ioctl(struct file *file, unsigned int cmd,
 
 static int efi_test_open(struct inode *inode, struct file *file)
 {
+        int ret = security_locked_down(LOCKDOWN_EFI_TEST);
+
+        if (ret)
+                return ret;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EACCES;
         /*
          * nothing special to do here
          * We do accept multiple open files at the same time as we
diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c
index ebd7977653a8..31f9f0e369b9 100644
--- a/drivers/firmware/efi/tpm.c
+++ b/drivers/firmware/efi/tpm.c
@@ -88,6 +88,7 @@ int __init efi_tpm_eventlog_init(void)
 
         if (tbl_size < 0) {
                 pr_err(FW_BUG "Failed to parse event in TPM Final Events Log\n");
+                ret = -EINVAL;
                 goto out_calc;
         }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
index 9d76e0923a5a..96b2a31ccfed 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
@@ -218,7 +218,7 @@ static struct dma_fence *amdgpu_job_run(struct drm_sched_job *sched_job)
         struct amdgpu_ring *ring = to_amdgpu_ring(sched_job->sched);
         struct dma_fence *fence = NULL, *finished;
         struct amdgpu_job *job;
-        int r;
+        int r = 0;
 
         job = to_amdgpu_job(sched_job);
         finished = &job->base.s_fence->finished;
@@ -243,6 +243,8 @@ static struct dma_fence *amdgpu_job_run(struct drm_sched_job *sched_job)
         job->fence = dma_fence_get(fence);
 
         amdgpu_job_free_resources(job);
+
+        fence = r ? ERR_PTR(r) : fence;
         return fence;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
index 957811b73672..8dfc775626a7 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
@@ -93,7 +93,7 @@ static const struct soc15_reg_golden golden_settings_gc_10_1[] =
 {
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCB_HW_CONTROL_4, 0xffffffff, 0x00400014),
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_CPF_CLK_CTRL, 0xfcff8fff, 0xf8000100),
-        SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_CLK_CTRL, 0xc0000000, 0xc0000100),
+        SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_CLK_CTRL, 0xcd000000, 0x0d000100),
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SQ_CLK_CTRL, 0x60000ff0, 0x60000100),
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SQG_CLK_CTRL, 0x40000000, 0x40000100),
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_VGT_CLK_CTRL, 0xffff8fff, 0xffff8100),
@@ -140,7 +140,7 @@ static const struct soc15_reg_golden golden_settings_gc_10_1_1[] =
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCB_HW_CONTROL_4, 0xffffffff, 0x003c0014),
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_GS_NGG_CLK_CTRL, 0xffff8fff, 0xffff8100),
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_IA_CLK_CTRL, 0xffff0fff, 0xffff0100),
-        SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_CLK_CTRL, 0xc0000000, 0xc0000100),
+        SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_CLK_CTRL, 0xcd000000, 0x0d000100),
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SQ_CLK_CTRL, 0xf8ff0fff, 0x60000100),
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SQG_CLK_CTRL, 0x40000ff0, 0x40000100),
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_VGT_CLK_CTRL, 0xffff8fff, 0xffff8100),
@@ -179,7 +179,7 @@ static const struct soc15_reg_golden golden_settings_gc_10_1_2[] =
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCB_HW_CONTROL_4, 0x003e001f, 0x003c0014),
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_GS_NGG_CLK_CTRL, 0xffff8fff, 0xffff8100),
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_IA_CLK_CTRL, 0xffff0fff, 0xffff0100),
-        SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_CLK_CTRL, 0xff7f0fff, 0xc0000100),
+        SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_CLK_CTRL, 0xff7f0fff, 0x0d000100),
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SQ_CLK_CTRL, 0xffffcfff, 0x60000100),
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SQG_CLK_CTRL, 0xffff0fff, 0x40000100),
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_VGT_CLK_CTRL, 0xffff8fff, 0xffff8100),
diff --git a/drivers/gpu/drm/amd/amdgpu/gfxhub_v2_0.c b/drivers/gpu/drm/amd/amdgpu/gfxhub_v2_0.c
index 8b789f750b72..db10640a3b2f 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfxhub_v2_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfxhub_v2_0.c
@@ -151,6 +151,15 @@ static void gfxhub_v2_0_init_cache_regs(struct amdgpu_device *adev)
         WREG32_SOC15(GC, 0, mmGCVM_L2_CNTL2, tmp);
 
         tmp = mmGCVM_L2_CNTL3_DEFAULT;
+        if (adev->gmc.translate_further) {
+                tmp = REG_SET_FIELD(tmp, GCVM_L2_CNTL3, BANK_SELECT, 12);
+                tmp = REG_SET_FIELD(tmp, GCVM_L2_CNTL3,
+                                    L2_CACHE_BIGK_FRAGMENT_SIZE, 9);
+        } else {
+                tmp = REG_SET_FIELD(tmp, GCVM_L2_CNTL3, BANK_SELECT, 9);
+                tmp = REG_SET_FIELD(tmp, GCVM_L2_CNTL3,
+                                    L2_CACHE_BIGK_FRAGMENT_SIZE, 6);
+        }
         WREG32_SOC15(GC, 0, mmGCVM_L2_CNTL3, tmp);
 
         tmp = mmGCVM_L2_CNTL4_DEFAULT;
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
index 241a4e57cf4a..354e6200ca9a 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
@@ -309,6 +309,7 @@ static void gmc_v10_0_flush_gpu_tlb(struct amdgpu_device *adev, uint32_t vmid,
 
         job->vm_pd_addr = amdgpu_gmc_pd_addr(adev->gart.bo);
         job->vm_needs_flush = true;
+        job->ibs->ptr[job->ibs->length_dw++] = ring->funcs->nop;
         amdgpu_ring_pad_ib(ring, &job->ibs[0]);
         r = amdgpu_job_submit(job, &adev->mman.entity,
                               AMDGPU_FENCE_OWNER_UNDEFINED, &fence);
diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
index 3542c203c3c8..b39bea6f54e9 100644
--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
@@ -137,6 +137,15 @@ static void mmhub_v2_0_init_cache_regs(struct amdgpu_device *adev)
         WREG32_SOC15(MMHUB, 0, mmMMVM_L2_CNTL2, tmp);
 
         tmp = mmMMVM_L2_CNTL3_DEFAULT;
+        if (adev->gmc.translate_further) {
+                tmp = REG_SET_FIELD(tmp, MMVM_L2_CNTL3, BANK_SELECT, 12);
+                tmp = REG_SET_FIELD(tmp, MMVM_L2_CNTL3,
+                                    L2_CACHE_BIGK_FRAGMENT_SIZE, 9);
+        } else {
+                tmp = REG_SET_FIELD(tmp, MMVM_L2_CNTL3, BANK_SELECT, 9);
+                tmp = REG_SET_FIELD(tmp, MMVM_L2_CNTL3,
+                                    L2_CACHE_BIGK_FRAGMENT_SIZE, 6);
+        }
         WREG32_SOC15(MMHUB, 0, mmMMVM_L2_CNTL3, tmp);
 
         tmp = mmMMVM_L2_CNTL4_DEFAULT;
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
index 78452cf0115d..4554e72c8378 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
@@ -254,6 +254,7 @@ static const struct soc15_reg_golden golden_settings_sdma_4_3[] = {
         SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC0_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000),
         SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000),
         SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003c0),
+        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_WATERMK, 0xfc000000, 0x00000000)
 };
 
 static u32 sdma_v4_0_get_reg_offset(struct amdgpu_device *adev,
diff --git a/drivers/gpu/drm/amd/display/dc/calcs/Makefile b/drivers/gpu/drm/amd/display/dc/calcs/Makefile
index 985633c08a26..26c6d735cdc7 100644
--- a/drivers/gpu/drm/amd/display/dc/calcs/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/calcs/Makefile
@@ -24,15 +24,20 @@
 # It calculates Bandwidth and Watermarks values for HW programming
 #
 
-ifneq ($(call cc-option, -mpreferred-stack-boundary=4),)
-        cc_stack_align := -mpreferred-stack-boundary=4
-else ifneq ($(call cc-option, -mstack-alignment=16),)
-        cc_stack_align := -mstack-alignment=16
-endif
+calcs_ccflags := -mhard-float -msse
 
-calcs_ccflags := -mhard-float -msse $(cc_stack_align)
+ifdef CONFIG_CC_IS_GCC
+ifeq ($(call cc-ifversion, -lt, 0701, y), y)
+IS_OLD_GCC = 1
+endif
+endif
 
-ifdef CONFIG_CC_IS_CLANG
+ifdef IS_OLD_GCC
+# Stack alignment mismatch, proceed with caution.
+# GCC < 7.1 cannot compile code using `double` and -mpreferred-stack-boundary=3
+# (8B stack alignment).
+calcs_ccflags += -mpreferred-stack-boundary=4
+else
 calcs_ccflags += -msse2
 endif
 
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 5d1adeda4d90..4b8819c27fcd 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -580,6 +580,10 @@ static bool construct(struct dc *dc,
 #ifdef CONFIG_DRM_AMD_DC_DCN2_0
         // Allocate memory for the vm_helper
         dc->vm_helper = kzalloc(sizeof(struct vm_helper), GFP_KERNEL);
+        if (!dc->vm_helper) {
+                dm_error("%s: failed to create dc->vm_helper\n", __func__);
+                goto fail;
+        }
 
 #endif
         memcpy(&dc->bb_overrides, &init_params->bb_overrides, sizeof(dc->bb_overrides));
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index ca20b150afcc..9c58670d5414 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -2767,6 +2767,15 @@ void core_link_enable_stream(
                                         CONTROLLER_DP_TEST_PATTERN_VIDEOMODE,
                                         COLOR_DEPTH_UNDEFINED);
 
+                /* This second call is needed to reconfigure the DIG
+                 * as a workaround for the incorrect value being applied
+                 * from transmitter control.
+                 */
+                if (!dc_is_virtual_signal(pipe_ctx->stream->signal))
+                        stream->link->link_enc->funcs->setup(
+                                stream->link->link_enc,
+                                pipe_ctx->stream->signal);
+
 #ifdef CONFIG_DRM_AMD_DC_DSC_SUPPORT
                 if (pipe_ctx->stream->timing.flags.DSC) {
                         if (dc_is_dp_signal(pipe_ctx->stream->signal) ||
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
index 505967b48e14..51991bf26a93 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
@@ -374,6 +374,7 @@ void dal_ddc_service_i2c_query_dp_dual_mode_adaptor(
         enum display_dongle_type *dongle = &sink_cap->dongle_type;
         uint8_t type2_dongle_buf[DP_ADAPTOR_TYPE2_SIZE];
         bool is_type2_dongle = false;
+        int retry_count = 2;
         struct dp_hdmi_dongle_signature_data *dongle_signature;
 
         /* Assume we have no valid DP passive dongle connected */
@@ -386,13 +387,24 @@ void dal_ddc_service_i2c_query_dp_dual_mode_adaptor(
                 DP_HDMI_DONGLE_ADDRESS,
                 type2_dongle_buf,
                 sizeof(type2_dongle_buf))) {
-                *dongle = DISPLAY_DONGLE_DP_DVI_DONGLE;
-                sink_cap->max_hdmi_pixel_clock = DP_ADAPTOR_DVI_MAX_TMDS_CLK;
+                /* Passive HDMI dongles can sometimes fail here without retrying*/
+                while (retry_count > 0) {
+                        if (i2c_read(ddc,
+                                DP_HDMI_DONGLE_ADDRESS,
+                                type2_dongle_buf,
+                                sizeof(type2_dongle_buf)))
+                                break;
+                        retry_count--;
+                }
+                if (retry_count == 0) {
+                        *dongle = DISPLAY_DONGLE_DP_DVI_DONGLE;
+                        sink_cap->max_hdmi_pixel_clock = DP_ADAPTOR_DVI_MAX_TMDS_CLK;
 
-                CONN_DATA_DETECT(ddc->link, type2_dongle_buf, sizeof(type2_dongle_buf),
-                                "DP-DVI passive dongle %dMhz: ",
-                                DP_ADAPTOR_DVI_MAX_TMDS_CLK / 1000);
-                return;
+                        CONN_DATA_DETECT(ddc->link, type2_dongle_buf, sizeof(type2_dongle_buf),
+                                        "DP-DVI passive dongle %dMhz: ",
+                                        DP_ADAPTOR_DVI_MAX_TMDS_CLK / 1000);
+                        return;
+                }
         }
 
         /* Check if Type 2 dongle.*/
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
index 8f70295179ff..f25ac17f47fa 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
@@ -404,6 +404,9 @@ bool resource_are_streams_timing_synchronizable(
         if (stream1->view_format != stream2->view_format)
                 return false;
 
+        if (stream1->ignore_msa_timing_param || stream2->ignore_msa_timing_param)
+                return false;
+
         return true;
 }
 static bool is_dp_and_hdmi_sharable(
@@ -1540,6 +1543,9 @@ bool dc_is_stream_unchanged(
         if (!are_stream_backends_same(old_stream, stream))
                 return false;
 
+        if (old_stream->ignore_msa_timing_param != stream->ignore_msa_timing_param)
+                return false;
+
         return true;
 }
 
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
index 01c7e30b9ce1..bbd6e01b3eca 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
@@ -393,6 +393,10 @@ bool cm_helper_translate_curve_to_hw_format(
         rgb_resulted[hw_points - 1].green = output_tf->tf_pts.green[start_index];
         rgb_resulted[hw_points - 1].blue = output_tf->tf_pts.blue[start_index];
 
+        rgb_resulted[hw_points].red = rgb_resulted[hw_points - 1].red;
+        rgb_resulted[hw_points].green = rgb_resulted[hw_points - 1].green;
+        rgb_resulted[hw_points].blue = rgb_resulted[hw_points - 1].blue;
+
         // All 3 color channels have same x
         corner_points[0].red.x = dc_fixpt_pow(dc_fixpt_from_int(2),
                                              dc_fixpt_from_int(region_start));
@@ -464,13 +468,6 @@ bool cm_helper_translate_curve_to_hw_format(
 
         i = 1;
         while (i != hw_points + 1) {
-                if (dc_fixpt_lt(rgb_plus_1->red, rgb->red))
-                        rgb_plus_1->red = rgb->red;
-                if (dc_fixpt_lt(rgb_plus_1->green, rgb->green))
-                        rgb_plus_1->green = rgb->green;
-                if (dc_fixpt_lt(rgb_plus_1->blue, rgb->blue))
-                        rgb_plus_1->blue = rgb->blue;
-
                 rgb->delta_red   = dc_fixpt_sub(rgb_plus_1->red,   rgb->red);
                 rgb->delta_green = dc_fixpt_sub(rgb_plus_1->green, rgb->green);
                 rgb->delta_blue  = dc_fixpt_sub(rgb_plus_1->blue,  rgb->blue);
@@ -562,6 +559,10 @@ bool cm_helper_translate_curve_to_degamma_hw_format(
         rgb_resulted[hw_points - 1].green = output_tf->tf_pts.green[start_index];
         rgb_resulted[hw_points - 1].blue = output_tf->tf_pts.blue[start_index];
 
+        rgb_resulted[hw_points].red = rgb_resulted[hw_points - 1].red;
+        rgb_resulted[hw_points].green = rgb_resulted[hw_points - 1].green;
+        rgb_resulted[hw_points].blue = rgb_resulted[hw_points - 1].blue;
+
         corner_points[0].red.x = dc_fixpt_pow(dc_fixpt_from_int(2),
                                              dc_fixpt_from_int(region_start));
         corner_points[0].green.x = corner_points[0].red.x;
@@ -624,13 +625,6 @@ bool cm_helper_translate_curve_to_degamma_hw_format(
 
         i = 1;
         while (i != hw_points + 1) {
-                if (dc_fixpt_lt(rgb_plus_1->red, rgb->red))
-                        rgb_plus_1->red = rgb->red;
-                if (dc_fixpt_lt(rgb_plus_1->green, rgb->green))
-                        rgb_plus_1->green = rgb->green;
-                if (dc_fixpt_lt(rgb_plus_1->blue, rgb->blue))
-                        rgb_plus_1->blue = rgb->blue;
-
                 rgb->delta_red   = dc_fixpt_sub(rgb_plus_1->red,   rgb->red);
                 rgb->delta_green = dc_fixpt_sub(rgb_plus_1->green, rgb->green);
                 rgb->delta_blue  = dc_fixpt_sub(rgb_plus_1->blue,  rgb->blue);
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/Makefile b/drivers/gpu/drm/amd/display/dc/dcn20/Makefile
index ddb8d5649e79..63f3bddba7da 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/Makefile
@@ -10,15 +10,20 @@ ifdef CONFIG_DRM_AMD_DC_DSC_SUPPORT
 DCN20 += dcn20_dsc.o
 endif
 
-ifneq ($(call cc-option, -mpreferred-stack-boundary=4),)
-        cc_stack_align := -mpreferred-stack-boundary=4
-else ifneq ($(call cc-option, -mstack-alignment=16),)
-        cc_stack_align := -mstack-alignment=16
-endif
+CFLAGS_$(AMDDALPATH)/dc/dcn20/dcn20_resource.o := -mhard-float -msse
 
-CFLAGS_$(AMDDALPATH)/dc/dcn20/dcn20_resource.o := -mhard-float -msse $(cc_stack_align)
+ifdef CONFIG_CC_IS_GCC
+ifeq ($(call cc-ifversion, -lt, 0701, y), y)
+IS_OLD_GCC = 1
+endif
+endif
 
-ifdef CONFIG_CC_IS_CLANG
+ifdef IS_OLD_GCC
+# Stack alignment mismatch, proceed with caution.
+# GCC < 7.1 cannot compile code using `double` and -mpreferred-stack-boundary=3
+# (8B stack alignment).
+CFLAGS_$(AMDDALPATH)/dc/dcn20/dcn20_resource.o += -mpreferred-stack-boundary=4
+else
 CFLAGS_$(AMDDALPATH)/dc/dcn20/dcn20_resource.o += -msse2
 endif
 
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
index 5a2763daff4d..dfb208285a9c 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
@@ -814,7 +814,7 @@ static const struct resource_caps res_cap_nv14 = {
                 .num_audio = 6,
                 .num_stream_encoder = 5,
                 .num_pll = 5,
-                .num_dwb = 0,
+                .num_dwb = 1,
                 .num_ddc = 5,
 };
 
diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/Makefile b/drivers/gpu/drm/amd/display/dc/dcn21/Makefile
index ef673bffc241..ff50ae71fe27 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn21/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dcn21/Makefile
@@ -3,15 +3,20 @@
 
 DCN21 = dcn21_hubp.o dcn21_hubbub.o dcn21_resource.o
 
-ifneq ($(call cc-option, -mpreferred-stack-boundary=4),)
-        cc_stack_align := -mpreferred-stack-boundary=4
-else ifneq ($(call cc-option, -mstack-alignment=16),)
-        cc_stack_align := -mstack-alignment=16
-endif
+CFLAGS_$(AMDDALPATH)/dc/dcn21/dcn21_resource.o := -mhard-float -msse
 
-CFLAGS_$(AMDDALPATH)/dc/dcn21/dcn21_resource.o := -mhard-float -msse $(cc_stack_align)
+ifdef CONFIG_CC_IS_GCC
+ifeq ($(call cc-ifversion, -lt, 0701, y), y)
+IS_OLD_GCC = 1
+endif
+endif
 
-ifdef CONFIG_CC_IS_CLANG
+ifdef IS_OLD_GCC
+# Stack alignment mismatch, proceed with caution.
+# GCC < 7.1 cannot compile code using `double` and -mpreferred-stack-boundary=3
+# (8B stack alignment).
+CFLAGS_$(AMDDALPATH)/dc/dcn21/dcn21_resource.o += -mpreferred-stack-boundary=4
+else
 CFLAGS_$(AMDDALPATH)/dc/dcn21/dcn21_resource.o += -msse2
 endif
 
diff --git a/drivers/gpu/drm/amd/display/dc/dml/Makefile b/drivers/gpu/drm/amd/display/dc/dml/Makefile
index 5b2a65b42403..8df251626e22 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dml/Makefile
@@ -24,15 +24,20 @@
 # It provides the general basic services required by other DAL
 # subcomponents.
 
-ifneq ($(call cc-option, -mpreferred-stack-boundary=4),)
-        cc_stack_align := -mpreferred-stack-boundary=4
-else ifneq ($(call cc-option, -mstack-alignment=16),)
-        cc_stack_align := -mstack-alignment=16
-endif
+dml_ccflags := -mhard-float -msse
 
-dml_ccflags := -mhard-float -msse $(cc_stack_align)
+ifdef CONFIG_CC_IS_GCC
+ifeq ($(call cc-ifversion, -lt, 0701, y), y)
+IS_OLD_GCC = 1
+endif
+endif
 
-ifdef CONFIG_CC_IS_CLANG
+ifdef IS_OLD_GCC
+# Stack alignment mismatch, proceed with caution.
+# GCC < 7.1 cannot compile code using `double` and -mpreferred-stack-boundary=3
+# (8B stack alignment).
+dml_ccflags += -mpreferred-stack-boundary=4
+else
 dml_ccflags += -msse2
 endif
 
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c
index 649883777f62..6c6c486b774a 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c
@@ -2577,7 +2577,8 @@ static void dml20_DISPCLKDPPCLKDCFCLKDeepSleepPrefetchParametersWatermarksAndPer
                         mode_lib->vba.MinActiveDRAMClockChangeMargin
                                         + mode_lib->vba.DRAMClockChangeLatency;
 
-        if (mode_lib->vba.MinActiveDRAMClockChangeMargin > 0) {
+        if (mode_lib->vba.MinActiveDRAMClockChangeMargin > 50) {
+                mode_lib->vba.DRAMClockChangeWatermark += 25;
                 mode_lib->vba.DRAMClockChangeSupport[0][0] = dm_dram_clock_change_vactive;
         } else {
                 if (mode_lib->vba.SynchronizedVBlank || mode_lib->vba.NumberOfActivePlanes == 1) {
diff --git a/drivers/gpu/drm/amd/display/dc/dsc/Makefile b/drivers/gpu/drm/amd/display/dc/dsc/Makefile
index b456cd23c6fa..970737217e53 100644
--- a/drivers/gpu/drm/amd/display/dc/dsc/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dsc/Makefile
@@ -1,15 +1,20 @@
 #
 # Makefile for the 'dsc' sub-component of DAL.
 
-ifneq ($(call cc-option, -mpreferred-stack-boundary=4),)
-        cc_stack_align := -mpreferred-stack-boundary=4
-else ifneq ($(call cc-option, -mstack-alignment=16),)
-        cc_stack_align := -mstack-alignment=16
-endif
+dsc_ccflags := -mhard-float -msse
 
-dsc_ccflags := -mhard-float -msse $(cc_stack_align)
+ifdef CONFIG_CC_IS_GCC
+ifeq ($(call cc-ifversion, -lt, 0701, y), y)
+IS_OLD_GCC = 1
+endif
+endif
 
-ifdef CONFIG_CC_IS_CLANG
+ifdef IS_OLD_GCC
+# Stack alignment mismatch, proceed with caution.
+# GCC < 7.1 cannot compile code using `double` and -mpreferred-stack-boundary=3
+# (8B stack alignment).
+dsc_ccflags += -mpreferred-stack-boundary=4
+else
 dsc_ccflags += -msse2
 endif
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
index d08493b67b67..beacfffbdc3e 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
@@ -5098,9 +5098,7 @@ static void vega10_odn_update_soc_table(struct pp_hwmgr *hwmgr,
 
         if (type == PP_OD_EDIT_SCLK_VDDC_TABLE) {
                 podn_vdd_dep = &data->odn_dpm_table.vdd_dep_on_sclk;
-                for (i = 0; i < podn_vdd_dep->count - 1; i++)
-                        od_vddc_lookup_table->entries[i].us_vdd = podn_vdd_dep->entries[i].vddc;
-                if (od_vddc_lookup_table->entries[i].us_vdd < podn_vdd_dep->entries[i].vddc)
+                for (i = 0; i < podn_vdd_dep->count; i++)
                         od_vddc_lookup_table->entries[i].us_vdd = podn_vdd_dep->entries[i].vddc;
         } else if (type == PP_OD_EDIT_MCLK_VDDC_TABLE) {
                 podn_vdd_dep = &data->odn_dpm_table.vdd_dep_on_mclk;
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
index 698db540972c..648cf0207309 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
@@ -180,6 +180,8 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit)
                               etnaviv_cmdbuf_get_va(&submit->cmdbuf,
                                         &gpu->mmu_context->cmdbuf_mapping));
 
+        mutex_unlock(&gpu->mmu_context->lock);
+
         /* Reserve space for the bomap */
         if (n_bomap_pages) {
                 bomap_start = bomap = iter.data;
@@ -221,8 +223,6 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit)
                                          obj->base.size);
         }
 
-        mutex_unlock(&gpu->mmu_context->lock);
-
         etnaviv_core_dump_header(&iter, ETDUMP_BUF_END, iter.data);
 
         dev_coredumpv(gpu->dev, iter.start, iter.data - iter.start, GFP_KERNEL);
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c b/drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c
index 043111a1d60c..f8bf488e9d71 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c
@@ -155,9 +155,11 @@ static void etnaviv_iommuv2_dump(struct etnaviv_iommu_context *context, void *bu
 
         memcpy(buf, v2_context->mtlb_cpu, SZ_4K);
         buf += SZ_4K;
-        for (i = 0; i < MMUv2_MAX_STLB_ENTRIES; i++, buf += SZ_4K)
-                if (v2_context->mtlb_cpu[i] & MMUv2_PTE_PRESENT)
+        for (i = 0; i < MMUv2_MAX_STLB_ENTRIES; i++)
+                if (v2_context->mtlb_cpu[i] & MMUv2_PTE_PRESENT) {
                         memcpy(buf, v2_context->stlb_cpu[i], SZ_4K);
+                        buf += SZ_4K;
+                }
 }
 
 static void etnaviv_iommuv2_restore_nonsec(struct etnaviv_gpu *gpu,
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
index 35ebae6a1be7..3607d348c298 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
@@ -328,12 +328,23 @@ etnaviv_iommu_context_init(struct etnaviv_iommu_global *global,
 
         ret = etnaviv_cmdbuf_suballoc_map(suballoc, ctx, &ctx->cmdbuf_mapping,
                                           global->memory_base);
-        if (ret) {
-                global->ops->free(ctx);
-                return NULL;
+        if (ret)
+                goto out_free;
+
+        if (global->version == ETNAVIV_IOMMU_V1 &&
+            ctx->cmdbuf_mapping.iova > 0x80000000) {
+                dev_err(global->dev,
+                        "command buffer outside valid memory window\n");
+                goto out_unmap;
         }
 
         return ctx;
+
+out_unmap:
+        etnaviv_cmdbuf_suballoc_unmap(ctx, &ctx->cmdbuf_mapping);
+out_free:
+        global->ops->free(ctx);
+        return NULL;
 }
 
 void etnaviv_iommu_restore(struct etnaviv_gpu *gpu,
diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
index aa54bb22796d..dfff6f4357b8 100644
--- a/drivers/gpu/drm/i915/display/intel_display.c
+++ b/drivers/gpu/drm/i915/display/intel_display.c
@@ -9315,7 +9315,6 @@ static bool wrpll_uses_pch_ssc(struct drm_i915_private *dev_priv,
 static void lpt_init_pch_refclk(struct drm_i915_private *dev_priv)
 {
         struct intel_encoder *encoder;
-        bool pch_ssc_in_use = false;
         bool has_fdi = false;
 
         for_each_intel_encoder(&dev_priv->drm, encoder) {
@@ -9343,22 +9342,24 @@ static void lpt_init_pch_refclk(struct drm_i915_private *dev_priv)
          * clock hierarchy. That would also allow us to do
          * clock bending finally.
          */
+        dev_priv->pch_ssc_use = 0;
+
         if (spll_uses_pch_ssc(dev_priv)) {
                 DRM_DEBUG_KMS("SPLL using PCH SSC\n");
-                pch_ssc_in_use = true;
+                dev_priv->pch_ssc_use |= BIT(DPLL_ID_SPLL);
         }
 
         if (wrpll_uses_pch_ssc(dev_priv, DPLL_ID_WRPLL1)) {
                 DRM_DEBUG_KMS("WRPLL1 using PCH SSC\n");
-                pch_ssc_in_use = true;
+                dev_priv->pch_ssc_use |= BIT(DPLL_ID_WRPLL1);
         }
 
         if (wrpll_uses_pch_ssc(dev_priv, DPLL_ID_WRPLL2)) {
                 DRM_DEBUG_KMS("WRPLL2 using PCH SSC\n");
-                pch_ssc_in_use = true;
+                dev_priv->pch_ssc_use |= BIT(DPLL_ID_WRPLL2);
         }
 
-        if (pch_ssc_in_use)
+        if (dev_priv->pch_ssc_use)
                 return;
 
         if (has_fdi) {
diff --git a/drivers/gpu/drm/i915/display/intel_dpll_mgr.c b/drivers/gpu/drm/i915/display/intel_dpll_mgr.c
index b8148f838354..d5a298c3c83b 100644
--- a/drivers/gpu/drm/i915/display/intel_dpll_mgr.c
+++ b/drivers/gpu/drm/i915/display/intel_dpll_mgr.c
@@ -525,16 +525,31 @@ static void hsw_ddi_wrpll_disable(struct drm_i915_private *dev_priv,
         val = I915_READ(WRPLL_CTL(id));
         I915_WRITE(WRPLL_CTL(id), val & ~WRPLL_PLL_ENABLE);
         POSTING_READ(WRPLL_CTL(id));
+
+        /*
+         * Try to set up the PCH reference clock once all DPLLs
+         * that depend on it have been shut down.
+         */
+        if (dev_priv->pch_ssc_use & BIT(id))
+                intel_init_pch_refclk(dev_priv);
 }
 
 static void hsw_ddi_spll_disable(struct drm_i915_private *dev_priv,
                                  struct intel_shared_dpll *pll)
 {
+        enum intel_dpll_id id = pll->info->id;
         u32 val;
 
         val = I915_READ(SPLL_CTL);
         I915_WRITE(SPLL_CTL, val & ~SPLL_PLL_ENABLE);
         POSTING_READ(SPLL_CTL);
+
+        /*
+         * Try to set up the PCH reference clock once all DPLLs
+         * that depend on it have been shut down.
+         */
+        if (dev_priv->pch_ssc_use & BIT(id))
+                intel_init_pch_refclk(dev_priv);
 }
 
 static bool hsw_ddi_wrpll_get_hw_state(struct drm_i915_private *dev_priv,
diff --git a/drivers/gpu/drm/i915/display/intel_dpll_mgr.h b/drivers/gpu/drm/i915/display/intel_dpll_mgr.h
index e7588799fce5..104cf6d42333 100644
--- a/drivers/gpu/drm/i915/display/intel_dpll_mgr.h
+++ b/drivers/gpu/drm/i915/display/intel_dpll_mgr.h
@@ -147,11 +147,11 @@ enum intel_dpll_id {
          */
         DPLL_ID_ICL_MGPLL4 = 6,
         /**
-         * @DPLL_ID_TGL_TCPLL5: TGL TC PLL port 5 (TC5)
+         * @DPLL_ID_TGL_MGPLL5: TGL TC PLL port 5 (TC5)
          */
         DPLL_ID_TGL_MGPLL5 = 7,
         /**
-         * @DPLL_ID_TGL_TCPLL6: TGL TC PLL port 6 (TC6)
+         * @DPLL_ID_TGL_MGPLL6: TGL TC PLL port 6 (TC6)
          */
         DPLL_ID_TGL_MGPLL6 = 8,
 };
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 772154e4073e..953e1d12c23c 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1723,6 +1723,8 @@ struct drm_i915_private {
                 struct work_struct idle_work;
         } gem;
 
+        u8 pch_ssc_use;
+
         /* For i945gm vblank irq vs. C3 workaround */
         struct {
                 struct work_struct work;
diff --git a/drivers/gpu/drm/panfrost/panfrost_drv.c b/drivers/gpu/drm/panfrost/panfrost_drv.c
index bc2ddeb55f5d..f21bc8a7ee3a 100644
--- a/drivers/gpu/drm/panfrost/panfrost_drv.c
+++ b/drivers/gpu/drm/panfrost/panfrost_drv.c
@@ -556,11 +556,11 @@ static int panfrost_probe(struct platform_device *pdev)
         return 0;
 
 err_out2:
+        pm_runtime_disable(pfdev->dev);
         panfrost_devfreq_fini(pfdev);
 err_out1:
         panfrost_device_fini(pfdev);
 err_out0:
-        pm_runtime_disable(pfdev->dev);
         drm_dev_put(ddev);
         return err;
 }
diff --git a/drivers/gpu/drm/panfrost/panfrost_mmu.c b/drivers/gpu/drm/panfrost/panfrost_mmu.c
index bdd990568476..a3ed64a1f15e 100644
--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c
+++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c
@@ -224,9 +224,9 @@ static size_t get_pgsize(u64 addr, size_t size)
         return SZ_2M;
 }
 
-void panfrost_mmu_flush_range(struct panfrost_device *pfdev,
-                              struct panfrost_mmu *mmu,
-                              u64 iova, size_t size)
+static void panfrost_mmu_flush_range(struct panfrost_device *pfdev,
+                                     struct panfrost_mmu *mmu,
+                                     u64 iova, size_t size)
 {
         if (mmu->as < 0)
                 return;
@@ -406,11 +406,11 @@ addr_to_drm_mm_node(struct panfrost_device *pfdev, int as, u64 addr)
         spin_lock(&pfdev->as_lock);
         list_for_each_entry(mmu, &pfdev->as_lru_list, list) {
                 if (as == mmu->as)
-                        break;
+                        goto found_mmu;
         }
-        if (as != mmu->as)
-                goto out;
+        goto out;
 
+found_mmu:
         priv = container_of(mmu, struct panfrost_file_priv, mmu);
 
         spin_lock(&priv->mm_lock);
@@ -432,7 +432,8 @@ out:
 
 #define NUM_FAULT_PAGES (SZ_2M / PAGE_SIZE)
 
-int panfrost_mmu_map_fault_addr(struct panfrost_device *pfdev, int as, u64 addr)
+static int panfrost_mmu_map_fault_addr(struct panfrost_device *pfdev, int as,
+                                       u64 addr)
 {
         int ret, i;
         struct panfrost_gem_object *bo;
diff --git a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
index 83c57d325ca8..2dba192bf198 100644
--- a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
+++ b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
@@ -16,6 +16,7 @@
 #include "panfrost_issues.h"
 #include "panfrost_job.h"
 #include "panfrost_mmu.h"
+#include "panfrost_perfcnt.h"
 #include "panfrost_regs.h"
 
 #define COUNTERS_PER_BLOCK              64
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 9e55076578c6..4528f4dc0b2d 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -379,11 +379,25 @@ radeon_pci_remove(struct pci_dev *pdev)
 static void
 radeon_pci_shutdown(struct pci_dev *pdev)
 {
+#ifdef CONFIG_PPC64
+        struct drm_device *ddev = pci_get_drvdata(pdev);
+#endif
+
         /* if we are running in a VM, make sure the device
          * torn down properly on reboot/shutdown
          */
         if (radeon_device_is_virtual())
                 radeon_pci_remove(pdev);
+
+#ifdef CONFIG_PPC64
+        /* Some adapters need to be suspended before a
+         * shutdown occurs in order to prevent an error
+         * during kexec.
+         * Make this power specific becauase it breaks
+         * some non-power boards.
+         */
+        radeon_suspend_kms(ddev, true, true, false);
+#endif
 }
 
 static int radeon_pmops_suspend(struct device *dev)
diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
index 9a0ee74d82dc..f39b97ed4ade 100644
--- a/drivers/gpu/drm/scheduler/sched_main.c
+++ b/drivers/gpu/drm/scheduler/sched_main.c
@@ -479,6 +479,7 @@ void drm_sched_resubmit_jobs(struct drm_gpu_scheduler *sched)
         struct drm_sched_job *s_job, *tmp;
         uint64_t guilty_context;
         bool found_guilty = false;
+        struct dma_fence *fence;
 
         list_for_each_entry_safe(s_job, tmp, &sched->ring_mirror_list, node) {
                 struct drm_sched_fence *s_fence = s_job->s_fence;
@@ -492,7 +493,16 @@ void drm_sched_resubmit_jobs(struct drm_gpu_scheduler *sched)
                         dma_fence_set_error(&s_fence->finished, -ECANCELED);
 
                 dma_fence_put(s_job->s_fence->parent);
-                s_job->s_fence->parent = sched->ops->run_job(s_job);
+                fence = sched->ops->run_job(s_job);
+
+                if (IS_ERR_OR_NULL(fence)) {
+                        s_job->s_fence->parent = NULL;
+                        dma_fence_set_error(&s_fence->finished, PTR_ERR(fence));
+                } else {
+                        s_job->s_fence->parent = fence;
+                }
+
+
         }
 }
 EXPORT_SYMBOL(drm_sched_resubmit_jobs);
@@ -720,7 +730,7 @@ static int drm_sched_main(void *param)
                 fence = sched->ops->run_job(sched_job);
                 drm_sched_fence_scheduled(s_fence);
 
-                if (fence) {
+                if (!IS_ERR_OR_NULL(fence)) {
                         s_fence->parent = dma_fence_get(fence);
                         r = dma_fence_add_callback(fence, &sched_job->cb,
                                                    drm_sched_process_job);
@@ -730,8 +740,11 @@ static int drm_sched_main(void *param)
                                 DRM_ERROR("fence add callback failed (%d)\n",
                                           r);
                         dma_fence_put(fence);
-                } else
+                } else {
+
+                        dma_fence_set_error(&s_fence->finished, PTR_ERR(fence));
                         drm_sched_process_job(NULL, &sched_job->cb);
+                }
 
                 wake_up(&sched->job_scheduled);
         }
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 5d80507b539b..19c092d75266 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -557,13 +557,16 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 
         if (args->bcl_start != args->bcl_end) {
                 bin = kcalloc(1, sizeof(*bin), GFP_KERNEL);
-                if (!bin)
+                if (!bin) {
+                        v3d_job_put(&render->base);
                         return -ENOMEM;
+                }
 
                 ret = v3d_job_init(v3d, file_priv, &bin->base,
                                    v3d_job_free, args->in_sync_bcl);
                 if (ret) {
                         v3d_job_put(&render->base);
+                        kfree(bin);
                         return ret;
                 }
 
diff --git a/drivers/hid/hid-axff.c b/drivers/hid/hid-axff.c
index 6654c1550e2e..fbe4e16ab029 100644
--- a/drivers/hid/hid-axff.c
+++ b/drivers/hid/hid-axff.c
@@ -63,13 +63,20 @@ static int axff_init(struct hid_device *hid)
 {
         struct axff_device *axff;
         struct hid_report *report;
-        struct hid_input *hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
+        struct hid_input *hidinput;
         struct list_head *report_list =&hid->report_enum[HID_OUTPUT_REPORT].report_list;
-        struct input_dev *dev = hidinput->input;
+        struct input_dev *dev;
         int field_count = 0;
         int i, j;
         int error;
 
+        if (list_empty(&hid->inputs)) {
+                hid_err(hid, "no inputs found\n");
+                return -ENODEV;
+        }
+        hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
+        dev = hidinput->input;
+
         if (list_empty(report_list)) {
                 hid_err(hid, "no output reports found\n");
                 return -ENODEV;
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 3eaee2c37931..63fdbf09b044 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1139,6 +1139,7 @@ int hid_open_report(struct hid_device *device)
         __u8 *start;
         __u8 *buf;
         __u8 *end;
+        __u8 *next;
         int ret;
         static int (*dispatch_type[])(struct hid_parser *parser,
                                       struct hid_item *item) = {
@@ -1192,7 +1193,8 @@ int hid_open_report(struct hid_device *device)
         device->collection_size = HID_DEFAULT_NUM_COLLECTIONS;
 
         ret = -EINVAL;
-        while ((start = fetch_item(start, end, &item)) != NULL) {
+        while ((next = fetch_item(start, end, &item)) != NULL) {
+                start = next;
 
                 if (item.format != HID_ITEM_FORMAT_SHORT) {
                         hid_err(device, "unexpected long global item\n");
@@ -1230,7 +1232,8 @@ int hid_open_report(struct hid_device *device)
                 }
         }
 
-        hid_err(device, "item fetching failed at offset %d\n", (int)(end - start));
+        hid_err(device, "item fetching failed at offset %u/%u\n",
+                size - (unsigned int)(end - start), size);
 err:
         kfree(parser->collection_stack);
 alloc_err:
diff --git a/drivers/hid/hid-dr.c b/drivers/hid/hid-dr.c
index 17e17f9a597b..947f19f8685f 100644
--- a/drivers/hid/hid-dr.c
+++ b/drivers/hid/hid-dr.c
@@ -75,13 +75,19 @@ static int drff_init(struct hid_device *hid)
 {
         struct drff_device *drff;
         struct hid_report *report;
-        struct hid_input *hidinput = list_first_entry(&hid->inputs,
-                                                struct hid_input, list);
+        struct hid_input *hidinput;
         struct list_head *report_list =
                         &hid->report_enum[HID_OUTPUT_REPORT].report_list;
-        struct input_dev *dev = hidinput->input;
+        struct input_dev *dev;
         int error;
 
+        if (list_empty(&hid->inputs)) {
+                hid_err(hid, "no inputs found\n");
+                return -ENODEV;
+        }
+        hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
+        dev = hidinput->input;
+
         if (list_empty(report_list)) {
                 hid_err(hid, "no output reports found\n");
                 return -ENODEV;
diff --git a/drivers/hid/hid-emsff.c b/drivers/hid/hid-emsff.c
index 7cd5651872d3..c34f2e5a049f 100644
--- a/drivers/hid/hid-emsff.c
+++ b/drivers/hid/hid-emsff.c
@@ -47,13 +47,19 @@ static int emsff_init(struct hid_device *hid)
 {
         struct emsff_device *emsff;
         struct hid_report *report;
-        struct hid_input *hidinput = list_first_entry(&hid->inputs,
-                                                struct hid_input, list);
+        struct hid_input *hidinput;
         struct list_head *report_list =
                         &hid->report_enum[HID_OUTPUT_REPORT].report_list;
-        struct input_dev *dev = hidinput->input;
+        struct input_dev *dev;
         int error;
 
+        if (list_empty(&hid->inputs)) {
+                hid_err(hid, "no inputs found\n");
+                return -ENODEV;
+        }
+        hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
+        dev = hidinput->input;
+
         if (list_empty(report_list)) {
                 hid_err(hid, "no output reports found\n");
                 return -ENODEV;
diff --git a/drivers/hid/hid-gaff.c b/drivers/hid/hid-gaff.c
index 0f95c96b70f8..ecbd3995a4eb 100644
--- a/drivers/hid/hid-gaff.c
+++ b/drivers/hid/hid-gaff.c
@@ -64,14 +64,20 @@ static int gaff_init(struct hid_device *hid)
 {
         struct gaff_device *gaff;
         struct hid_report *report;
-        struct hid_input *hidinput = list_entry(hid->inputs.next,
-                                                struct hid_input, list);
+        struct hid_input *hidinput;
         struct list_head *report_list =
                         &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct list_head *report_ptr = report_list;
-        struct input_dev *dev = hidinput->input;
+        struct input_dev *dev;
         int error;
 
+        if (list_empty(&hid->inputs)) {
+                hid_err(hid, "no inputs found\n");
+                return -ENODEV;
+        }
+        hidinput = list_entry(hid->inputs.next, struct hid_input, list);
+        dev = hidinput->input;
+
         if (list_empty(report_list)) {
                 hid_err(hid, "no output reports found\n");
                 return -ENODEV;
diff --git a/drivers/hid/hid-google-hammer.c b/drivers/hid/hid-google-hammer.c
index 84f8c127ebdc..d86a9189e88f 100644
--- a/drivers/hid/hid-google-hammer.c
+++ b/drivers/hid/hid-google-hammer.c
@@ -470,6 +470,10 @@ static const struct hid_device_id hammer_devices[] = {
         { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
                      USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_HAMMER) },
         { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+                     USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_MAGNEMITE) },
+        { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+                     USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_MASTERBALL) },
+        { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
                      USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_STAFF) },
         { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
                      USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_WAND) },
diff --git a/drivers/hid/hid-holtekff.c b/drivers/hid/hid-holtekff.c
index 10a720558830..8619b80c834c 100644
--- a/drivers/hid/hid-holtekff.c
+++ b/drivers/hid/hid-holtekff.c
@@ -124,13 +124,19 @@ static int holtekff_init(struct hid_device *hid)
 {
         struct holtekff_device *holtekff;
         struct hid_report *report;
-        struct hid_input *hidinput = list_entry(hid->inputs.next,
-                                                struct hid_input, list);
+        struct hid_input *hidinput;
         struct list_head *report_list =
                         &hid->report_enum[HID_OUTPUT_REPORT].report_list;
-        struct input_dev *dev = hidinput->input;
+        struct input_dev *dev;
         int error;
 
+        if (list_empty(&hid->inputs)) {
+                hid_err(hid, "no inputs found\n");
+                return -ENODEV;
+        }
+        hidinput = list_entry(hid->inputs.next, struct hid_input, list);
+        dev = hidinput->input;
+
         if (list_empty(report_list)) {
                 hid_err(hid, "no output report found\n");
                 return -ENODEV;
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 76969a22b0f2..447e8db21174 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -476,6 +476,8 @@
 #define USB_DEVICE_ID_GOOGLE_STAFF      0x502b
 #define USB_DEVICE_ID_GOOGLE_WAND       0x502d
 #define USB_DEVICE_ID_GOOGLE_WHISKERS   0x5030
+#define USB_DEVICE_ID_GOOGLE_MASTERBALL 0x503c
+#define USB_DEVICE_ID_GOOGLE_MAGNEMITE  0x503d
 
 #define USB_VENDOR_ID_GOTOP             0x08f2
 #define USB_DEVICE_ID_SUPER_Q2          0x007f
diff --git a/drivers/hid/hid-lg2ff.c b/drivers/hid/hid-lg2ff.c
index dd1a6c3a7de6..73d07e35f12a 100644
--- a/drivers/hid/hid-lg2ff.c
+++ b/drivers/hid/hid-lg2ff.c
@@ -50,11 +50,17 @@ int lg2ff_init(struct hid_device *hid)
 {
         struct lg2ff_device *lg2ff;
         struct hid_report *report;
-        struct hid_input *hidinput = list_entry(hid->inputs.next,
-                                                struct hid_input, list);
-        struct input_dev *dev = hidinput->input;
+        struct hid_input *hidinput;
+        struct input_dev *dev;
         int error;
 
+        if (list_empty(&hid->inputs)) {
+                hid_err(hid, "no inputs found\n");
+                return -ENODEV;
+        }
+        hidinput = list_entry(hid->inputs.next, struct hid_input, list);
+        dev = hidinput->input;
+
         /* Check that the report looks ok */
         report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7);
         if (!report)
diff --git a/drivers/hid/hid-lg3ff.c b/drivers/hid/hid-lg3ff.c
index 9ecb6fd06203..b7e1949f3cf7 100644
--- a/drivers/hid/hid-lg3ff.c
+++ b/drivers/hid/hid-lg3ff.c
@@ -117,12 +117,19 @@ static const signed short ff3_joystick_ac[] = {
 
 int lg3ff_init(struct hid_device *hid)
 {
-        struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
-        struct input_dev *dev = hidinput->input;
+        struct hid_input *hidinput;
+        struct input_dev *dev;
         const signed short *ff_bits = ff3_joystick_ac;
         int error;
         int i;
 
+        if (list_empty(&hid->inputs)) {
+                hid_err(hid, "no inputs found\n");
+                return -ENODEV;
+        }
+        hidinput = list_entry(hid->inputs.next, struct hid_input, list);
+        dev = hidinput->input;
+
         /* Check that the report looks ok */
         if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 35))
                 return -ENODEV;
diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c
index 03f0220062ca..5e6a0cef2a06 100644
--- a/drivers/hid/hid-lg4ff.c
+++ b/drivers/hid/hid-lg4ff.c
@@ -1253,8 +1253,8 @@ static int lg4ff_handle_multimode_wheel(struct hid_device *hid, u16 *real_produc
 
 int lg4ff_init(struct hid_device *hid)
 {
-        struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
-        struct input_dev *dev = hidinput->input;
+        struct hid_input *hidinput;
+        struct input_dev *dev;
         struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct hid_report *report = list_entry(report_list->next, struct hid_report, list);
         const struct usb_device_descriptor *udesc = &(hid_to_usb_dev(hid)->descriptor);
@@ -1266,6 +1266,13 @@ int lg4ff_init(struct hid_device *hid)
         int mmode_ret, mmode_idx = -1;
         u16 real_product_id;
 
+        if (list_empty(&hid->inputs)) {
+                hid_err(hid, "no inputs found\n");
+                return -ENODEV;
+        }
+        hidinput = list_entry(hid->inputs.next, struct hid_input, list);
+        dev = hidinput->input;
+
         /* Check that the report looks ok */
         if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7))
                 return -1;
diff --git a/drivers/hid/hid-lgff.c b/drivers/hid/hid-lgff.c
index c79a6ec43745..aed4ddc397a9 100644
--- a/drivers/hid/hid-lgff.c
+++ b/drivers/hid/hid-lgff.c
@@ -115,12 +115,19 @@ static void hid_lgff_set_autocenter(struct input_dev *dev, u16 magnitude)
 
 int lgff_init(struct hid_device* hid)
 {
-        struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
-        struct input_dev *dev = hidinput->input;
+        struct hid_input *hidinput;
+        struct input_dev *dev;
         const signed short *ff_bits = ff_joystick;
         int error;
         int i;
 
+        if (list_empty(&hid->inputs)) {
+                hid_err(hid, "no inputs found\n");
+                return -ENODEV;
+        }
+        hidinput = list_entry(hid->inputs.next, struct hid_input, list);
+        dev = hidinput->input;
+
         /* Check that the report looks ok */
         if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7))
                 return -ENODEV;
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 0179f7ed77e5..8e91e2f06cb4 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -1669,6 +1669,7 @@ static void hidpp_touchpad_raw_xy_event(struct hidpp_device *hidpp_dev,
 
 #define HIDPP_FF_EFFECTID_NONE          -1
 #define HIDPP_FF_EFFECTID_AUTOCENTER    -2
+#define HIDPP_AUTOCENTER_PARAMS_LENGTH  18
 
 #define HIDPP_FF_MAX_PARAMS     20
 #define HIDPP_FF_RESERVED_SLOTS 1
@@ -2009,7 +2010,7 @@ static int hidpp_ff_erase_effect(struct input_dev *dev, int effect_id)
 static void hidpp_ff_set_autocenter(struct input_dev *dev, u16 magnitude)
 {
         struct hidpp_ff_private_data *data = dev->ff->private;
-        u8 params[18];
+        u8 params[HIDPP_AUTOCENTER_PARAMS_LENGTH];
 
         dbg_hid("Setting autocenter to %d.\n", magnitude);
 
@@ -2077,23 +2078,34 @@ static DEVICE_ATTR(range, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH, hidpp
 static void hidpp_ff_destroy(struct ff_device *ff)
 {
         struct hidpp_ff_private_data *data = ff->private;
+        struct hid_device *hid = data->hidpp->hid_dev;
 
+        hid_info(hid, "Unloading HID++ force feedback.\n");
+
+        device_remove_file(&hid->dev, &dev_attr_range);
+        destroy_workqueue(data->wq);
         kfree(data->effect_ids);
 }
 
-static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
+static int hidpp_ff_init(struct hidpp_device *hidpp,
+                         struct hidpp_ff_private_data *data)
 {
         struct hid_device *hid = hidpp->hid_dev;
-        struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
-        struct input_dev *dev = hidinput->input;
+        struct hid_input *hidinput;
+        struct input_dev *dev;
         const struct usb_device_descriptor *udesc = &(hid_to_usb_dev(hid)->descriptor);
         const u16 bcdDevice = le16_to_cpu(udesc->bcdDevice);
         struct ff_device *ff;
-        struct hidpp_report response;
-        struct hidpp_ff_private_data *data;
-        int error, j, num_slots;
+        int error, j, num_slots = data->num_effects;
         u8 version;
 
+        if (list_empty(&hid->inputs)) {
+                hid_err(hid, "no inputs found\n");
+                return -ENODEV;
+        }
+        hidinput = list_entry(hid->inputs.next, struct hid_input, list);
+        dev = hidinput->input;
+
         if (!dev) {
                 hid_err(hid, "Struct input_dev not set!\n");
                 return -EINVAL;
@@ -2109,27 +2121,17 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
                 for (j = 0; hidpp_ff_effects_v2[j] >= 0; j++)
                         set_bit(hidpp_ff_effects_v2[j], dev->ffbit);
 
-        /* Read number of slots available in device */
-        error = hidpp_send_fap_command_sync(hidpp, feature_index,
-                HIDPP_FF_GET_INFO, NULL, 0, &response);
-        if (error) {
-                if (error < 0)
-                        return error;
-                hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
-                        __func__, error);
-                return -EPROTO;
-        }
-
-        num_slots = response.fap.params[0] - HIDPP_FF_RESERVED_SLOTS;
-
         error = input_ff_create(dev, num_slots);
 
         if (error) {
                 hid_err(dev, "Failed to create FF device!\n");
                 return error;
         }
-
-        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        /*
+         * Create a copy of passed data, so we can transfer memory
+         * ownership to FF core
+         */
+        data = kmemdup(data, sizeof(*data), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
         data->effect_ids = kcalloc(num_slots, sizeof(int), GFP_KERNEL);
@@ -2145,10 +2147,7 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
         }
 
         data->hidpp = hidpp;
-        data->feature_index = feature_index;
         data->version = version;
-        data->slot_autocenter = 0;
-        data->num_effects = num_slots;
         for (j = 0; j < num_slots; j++)
                 data->effect_ids[j] = -1;
 
@@ -2162,68 +2161,20 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
         ff->set_autocenter = hidpp_ff_set_autocenter;
         ff->destroy = hidpp_ff_destroy;
 
-
-        /* reset all forces */
-        error = hidpp_send_fap_command_sync(hidpp, feature_index,
-                HIDPP_FF_RESET_ALL, NULL, 0, &response);
-
-        /* Read current Range */
-        error = hidpp_send_fap_command_sync(hidpp, feature_index,
-                HIDPP_FF_GET_APERTURE, NULL, 0, &response);
-        if (error)
-                hid_warn(hidpp->hid_dev, "Failed to read range from device!\n");
-        data->range = error ? 900 : get_unaligned_be16(&response.fap.params[0]);
-
         /* Create sysfs interface */
         error = device_create_file(&(hidpp->hid_dev->dev), &dev_attr_range);
         if (error)
                 hid_warn(hidpp->hid_dev, "Unable to create sysfs interface for \"range\", errno %d!\n", error);
 
-        /* Read the current gain values */
-        error = hidpp_send_fap_command_sync(hidpp, feature_index,
-                HIDPP_FF_GET_GLOBAL_GAINS, NULL, 0, &response);
-        if (error)
-                hid_warn(hidpp->hid_dev, "Failed to read gain values from device!\n");
-        data->gain = error ? 0xffff : get_unaligned_be16(&response.fap.params[0]);
-        /* ignore boost value at response.fap.params[2] */
-
         /* init the hardware command queue */
         atomic_set(&data->workqueue_size, 0);
 
-        /* initialize with zero autocenter to get wheel in usable state */
-        hidpp_ff_set_autocenter(dev, 0);
-
         hid_info(hid, "Force feedback support loaded (firmware release %d).\n",
                  version);
 
         return 0;
 }
 
-static int hidpp_ff_deinit(struct hid_device *hid)
-{
-        struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
-        struct input_dev *dev = hidinput->input;
-        struct hidpp_ff_private_data *data;
-
-        if (!dev) {
-                hid_err(hid, "Struct input_dev not found!\n");
-                return -EINVAL;
-        }
-
-        hid_info(hid, "Unloading HID++ force feedback.\n");
-        data = dev->ff->private;
-        if (!data) {
-                hid_err(hid, "Private data not found!\n");
-                return -EINVAL;
-        }
-
-        destroy_workqueue(data->wq);
-        device_remove_file(&hid->dev, &dev_attr_range);
-
-        return 0;
-}
-
-
 /* ************************************************************************** */
 /*                                                                            */
 /* Device Support                                                             */
@@ -2725,24 +2676,93 @@ static int k400_connect(struct hid_device *hdev, bool connected)
 
 #define HIDPP_PAGE_G920_FORCE_FEEDBACK                  0x8123
 
-static int g920_get_config(struct hidpp_device *hidpp)
+static int g920_ff_set_autocenter(struct hidpp_device *hidpp,
+                                  struct hidpp_ff_private_data *data)
 {
+        struct hidpp_report response;
+        u8 params[HIDPP_AUTOCENTER_PARAMS_LENGTH] = {
+                [1] = HIDPP_FF_EFFECT_SPRING | HIDPP_FF_EFFECT_AUTOSTART,
+        };
+        int ret;
+
+        /* initialize with zero autocenter to get wheel in usable state */
+
+        dbg_hid("Setting autocenter to 0.\n");
+        ret = hidpp_send_fap_command_sync(hidpp, data->feature_index,
+                                          HIDPP_FF_DOWNLOAD_EFFECT,
+                                          params, ARRAY_SIZE(params),
+                                          &response);
+        if (ret)
+                hid_warn(hidpp->hid_dev, "Failed to autocenter device!\n");
+        else
+                data->slot_autocenter = response.fap.params[0];
+
+        return ret;
+}
+
+static int g920_get_config(struct hidpp_device *hidpp,
+                           struct hidpp_ff_private_data *data)
+{
+        struct hidpp_report response;
         u8 feature_type;
-        u8 feature_index;
         int ret;
 
+        memset(data, 0, sizeof(*data));
+
         /* Find feature and store for later use */
         ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_G920_FORCE_FEEDBACK,
-                &feature_index, &feature_type);
+                                     &data->feature_index, &feature_type);
         if (ret)
                 return ret;
 
-        ret = hidpp_ff_init(hidpp, feature_index);
+        /* Read number of slots available in device */
+        ret = hidpp_send_fap_command_sync(hidpp, data->feature_index,
+                                          HIDPP_FF_GET_INFO,
+                                          NULL, 0,
+                                          &response);
+        if (ret) {
+                if (ret < 0)
+                        return ret;
+                hid_err(hidpp->hid_dev,
+                        "%s: received protocol error 0x%02x\n", __func__, ret);
+                return -EPROTO;
+        }
+
+        data->num_effects = response.fap.params[0] - HIDPP_FF_RESERVED_SLOTS;
+
+        /* reset all forces */
+        ret = hidpp_send_fap_command_sync(hidpp, data->feature_index,
+                                          HIDPP_FF_RESET_ALL,
+                                          NULL, 0,
+                                          &response);
         if (ret)
-                hid_warn(hidpp->hid_dev, "Unable to initialize force feedback support, errno %d\n",
-                                ret);
+                hid_warn(hidpp->hid_dev, "Failed to reset all forces!\n");
 
-        return 0;
+        ret = hidpp_send_fap_command_sync(hidpp, data->feature_index,
+                                          HIDPP_FF_GET_APERTURE,
+                                          NULL, 0,
+                                          &response);
+        if (ret) {
+                hid_warn(hidpp->hid_dev,
+                         "Failed to read range from device!\n");
+        }
+        data->range = ret ?
+                900 : get_unaligned_be16(&response.fap.params[0]);
+
+        /* Read the current gain values */
+        ret = hidpp_send_fap_command_sync(hidpp, data->feature_index,
+                                          HIDPP_FF_GET_GLOBAL_GAINS,
+                                          NULL, 0,
+                                          &response);
+        if (ret)
+                hid_warn(hidpp->hid_dev,
+                         "Failed to read gain values from device!\n");
+        data->gain = ret ?
+                0xffff : get_unaligned_be16(&response.fap.params[0]);
+
+        /* ignore boost value at response.fap.params[2] */
+
+        return g920_ff_set_autocenter(hidpp, data);
 }
 
 /* -------------------------------------------------------------------------- */
@@ -3458,34 +3478,45 @@ static int hidpp_get_report_length(struct hid_device *hdev, int id)
         return report->field[0]->report_count + 1;
 }
 
-static bool hidpp_validate_report(struct hid_device *hdev, int id,
-                                  int expected_length, bool optional)
+static bool hidpp_validate_device(struct hid_device *hdev)
 {
-        int report_length;
+        struct hidpp_device *hidpp = hid_get_drvdata(hdev);
+        int id, report_length, supported_reports = 0;
 
-        if (id >= HID_MAX_IDS || id < 0) {
-                hid_err(hdev, "invalid HID report id %u\n", id);
-                return false;
+        id = REPORT_ID_HIDPP_SHORT;
+        report_length = hidpp_get_report_length(hdev, id);
+        if (report_length) {
+                if (report_length < HIDPP_REPORT_SHORT_LENGTH)
+                        goto bad_device;
+
+                supported_reports++;
         }
 
+        id = REPORT_ID_HIDPP_LONG;
         report_length = hidpp_get_report_length(hdev, id);
-        if (!report_length)
-                return optional;
+        if (report_length) {
+                if (report_length < HIDPP_REPORT_LONG_LENGTH)
+                        goto bad_device;
 
-        if (report_length < expected_length) {
-                hid_warn(hdev, "not enough values in hidpp report %d\n", id);
-                return false;
+                supported_reports++;
         }
 
-        return true;
-}
+        id = REPORT_ID_HIDPP_VERY_LONG;
+        report_length = hidpp_get_report_length(hdev, id);
+        if (report_length) {
+                if (report_length < HIDPP_REPORT_LONG_LENGTH ||
+                    report_length > HIDPP_REPORT_VERY_LONG_MAX_LENGTH)
+                        goto bad_device;
 
-static bool hidpp_validate_device(struct hid_device *hdev)
-{
-        return hidpp_validate_report(hdev, REPORT_ID_HIDPP_SHORT,
-                                     HIDPP_REPORT_SHORT_LENGTH, false) &&
-               hidpp_validate_report(hdev, REPORT_ID_HIDPP_LONG,
-                                     HIDPP_REPORT_LONG_LENGTH, true);
+                supported_reports++;
+                hidpp->very_long_report_length = report_length;
+        }
+
+        return supported_reports;
+
+bad_device:
+        hid_warn(hdev, "not enough values in hidpp report %d\n", id);
+        return false;
 }
 
 static bool hidpp_application_equals(struct hid_device *hdev,
@@ -3505,6 +3536,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
         int ret;
         bool connected;
         unsigned int connect_mask = HID_CONNECT_DEFAULT;
+        struct hidpp_ff_private_data data;
 
         /* report_fixup needs drvdata to be set before we call hid_parse */
         hidpp = devm_kzalloc(&hdev->dev, sizeof(*hidpp), GFP_KERNEL);
@@ -3531,11 +3563,6 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
                 return hid_hw_start(hdev, HID_CONNECT_DEFAULT);
         }
 
-        hidpp->very_long_report_length =
-                hidpp_get_report_length(hdev, REPORT_ID_HIDPP_VERY_LONG);
-        if (hidpp->very_long_report_length > HIDPP_REPORT_VERY_LONG_MAX_LENGTH)
-                hidpp->very_long_report_length = HIDPP_REPORT_VERY_LONG_MAX_LENGTH;
-
         if (id->group == HID_GROUP_LOGITECH_DJ_DEVICE)
                 hidpp->quirks |= HIDPP_QUIRK_UNIFYING;
 
@@ -3614,7 +3641,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
                 if (ret)
                         goto hid_hw_init_fail;
         } else if (connected && (hidpp->quirks & HIDPP_QUIRK_CLASS_G920)) {
-                ret = g920_get_config(hidpp);
+                ret = g920_get_config(hidpp, &data);
                 if (ret)
                         goto hid_hw_init_fail;
         }
@@ -3636,6 +3663,14 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
                 goto hid_hw_start_fail;
         }
 
+        if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) {
+                ret = hidpp_ff_init(hidpp, &data);
+                if (ret)
+                        hid_warn(hidpp->hid_dev,
+                     "Unable to initialize force feedback support, errno %d\n",
+                                 ret);
+        }
+
         return ret;
 
 hid_hw_init_fail:
@@ -3658,9 +3693,6 @@ static void hidpp_remove(struct hid_device *hdev)
 
         sysfs_remove_group(&hdev->dev.kobj, &ps_attribute_group);
 
-        if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920)
-                hidpp_ff_deinit(hdev);
-
         hid_hw_stop(hdev);
         cancel_work_sync(&hidpp->work);
         mutex_destroy(&hidpp->send_mutex);
diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
index 2cf83856f2e4..2d8b589201a4 100644
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -328,11 +328,17 @@ static int ms_play_effect(struct input_dev *dev, void *data,
 
 static int ms_init_ff(struct hid_device *hdev)
 {
-        struct hid_input *hidinput = list_entry(hdev->inputs.next,
-                                                struct hid_input, list);
-        struct input_dev *input_dev = hidinput->input;
+        struct hid_input *hidinput;
+        struct input_dev *input_dev;
         struct ms_data *ms = hid_get_drvdata(hdev);
 
+        if (list_empty(&hdev->inputs)) {
+                hid_err(hdev, "no inputs found\n");
+                return -ENODEV;
+        }
+        hidinput = list_entry(hdev->inputs.next, struct hid_input, list);
+        input_dev = hidinput->input;
+
         if (!(ms->quirks & MS_QUIRK_FF))
                 return 0;
 
diff --git a/drivers/hid/hid-prodikeys.c b/drivers/hid/hid-prodikeys.c
index 5a3b3d974d84..2666af02d5c1 100644
--- a/drivers/hid/hid-prodikeys.c
+++ b/drivers/hid/hid-prodikeys.c
@@ -516,7 +516,7 @@ static void pcmidi_setup_extra_keys(
                 MY PICTURES =>  KEY_WORDPROCESSOR
                 MY MUSIC=>      KEY_SPREADSHEET
         */
-        unsigned int keys[] = {
+        static const unsigned int keys[] = {
                 KEY_FN,
                 KEY_MESSENGER, KEY_CALENDAR,
                 KEY_ADDRESSBOOK, KEY_DOCUMENTS,
@@ -532,7 +532,7 @@ static void pcmidi_setup_extra_keys(
                 0
         };
 
-        unsigned int *pkeys = &keys[0];
+        const unsigned int *pkeys = &keys[0];
         unsigned short i;
 
         if (pm->ifnum != 1)  /* only set up ONCE for interace 1 */
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 73c0f7a95e2d..4c6ed6ef31f1 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -2254,9 +2254,15 @@ static int sony_play_effect(struct input_dev *dev, void *data,
 
 static int sony_init_ff(struct sony_sc *sc)
 {
-        struct hid_input *hidinput = list_entry(sc->hdev->inputs.next,
-                                                struct hid_input, list);
-        struct input_dev *input_dev = hidinput->input;
+        struct hid_input *hidinput;
+        struct input_dev *input_dev;
+
+        if (list_empty(&sc->hdev->inputs)) {
+                hid_err(sc->hdev, "no inputs found\n");
+                return -ENODEV;
+        }
+        hidinput = list_entry(sc->hdev->inputs.next, struct hid_input, list);
+        input_dev = hidinput->input;
 
         input_set_capability(input_dev, EV_FF, FF_RUMBLE);
         return input_ff_create_memless(input_dev, NULL, sony_play_effect);
diff --git a/drivers/hid/hid-tmff.c b/drivers/hid/hid-tmff.c
index bdfc5ff3b2c5..90acef304536 100644
--- a/drivers/hid/hid-tmff.c
+++ b/drivers/hid/hid-tmff.c
@@ -124,12 +124,18 @@ static int tmff_init(struct hid_device *hid, const signed short *ff_bits)
         struct tmff_device *tmff;
         struct hid_report *report;
         struct list_head *report_list;
-        struct hid_input *hidinput = list_entry(hid->inputs.next,
-                                                        struct hid_input, list);
-        struct input_dev *input_dev = hidinput->input;
+        struct hid_input *hidinput;
+        struct input_dev *input_dev;
         int error;
         int i;
 
+        if (list_empty(&hid->inputs)) {
+                hid_err(hid, "no inputs found\n");
+                return -ENODEV;
+        }
+        hidinput = list_entry(hid->inputs.next, struct hid_input, list);
+        input_dev = hidinput->input;
+
         tmff = kzalloc(sizeof(struct tmff_device), GFP_KERNEL);
         if (!tmff)
                 return -ENOMEM;
diff --git a/drivers/hid/hid-zpff.c b/drivers/hid/hid-zpff.c
index f90959e94028..3abaca045869 100644
--- a/drivers/hid/hid-zpff.c
+++ b/drivers/hid/hid-zpff.c
@@ -54,11 +54,17 @@ static int zpff_init(struct hid_device *hid)
 {
         struct zpff_device *zpff;
         struct hid_report *report;
-        struct hid_input *hidinput = list_entry(hid->inputs.next,
-                                                struct hid_input, list);
-        struct input_dev *dev = hidinput->input;
+        struct hid_input *hidinput;
+        struct input_dev *dev;
         int i, error;
 
+        if (list_empty(&hid->inputs)) {
+                hid_err(hid, "no inputs found\n");
+                return -ENODEV;
+        }
+        hidinput = list_entry(hid->inputs.next, struct hid_input, list);
+        dev = hidinput->input;
+
         for (i = 0; i < 4; i++) {
                 report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, i, 1);
                 if (!report)
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 2a7c6e33bb1c..d9c55e30f986 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -26,7 +26,6 @@
 #include <linux/delay.h>
 #include <linux/slab.h>
 #include <linux/pm.h>
-#include <linux/pm_runtime.h>
 #include <linux/device.h>
 #include <linux/wait.h>
 #include <linux/err.h>
@@ -48,8 +47,6 @@
 /* quirks to control the device */
 #define I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV        BIT(0)
 #define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET        BIT(1)
-#define I2C_HID_QUIRK_NO_RUNTIME_PM             BIT(2)
-#define I2C_HID_QUIRK_DELAY_AFTER_SLEEP         BIT(3)
 #define I2C_HID_QUIRK_BOGUS_IRQ                 BIT(4)
 
 /* flags */
@@ -172,14 +169,7 @@ static const struct i2c_hid_quirks {
         { USB_VENDOR_ID_WEIDA, HID_ANY_ID,
                 I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV },
         { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
-                I2C_HID_QUIRK_NO_IRQ_AFTER_RESET |
-                I2C_HID_QUIRK_NO_RUNTIME_PM },
-        { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_4B33,
-                I2C_HID_QUIRK_DELAY_AFTER_SLEEP },
-        { USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_8001,
-                I2C_HID_QUIRK_NO_RUNTIME_PM },
-        { I2C_VENDOR_ID_GOODIX, I2C_DEVICE_ID_GOODIX_01F0,
-                I2C_HID_QUIRK_NO_RUNTIME_PM },
+                I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
         { USB_VENDOR_ID_ELAN, HID_ANY_ID,
                  I2C_HID_QUIRK_BOGUS_IRQ },
         { 0, 0 }
@@ -397,7 +387,6 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state)
 {
         struct i2c_hid *ihid = i2c_get_clientdata(client);
         int ret;
-        unsigned long now, delay;
 
         i2c_hid_dbg(ihid, "%s\n", __func__);
 
@@ -415,22 +404,9 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state)
                         goto set_pwr_exit;
         }
 
-        if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP &&
-            power_state == I2C_HID_PWR_ON) {
-                now = jiffies;
-                if (time_after(ihid->sleep_delay, now)) {
-                        delay = jiffies_to_usecs(ihid->sleep_delay - now);
-                        usleep_range(delay, delay + 1);
-                }
-        }
-
         ret = __i2c_hid_command(client, &hid_set_power_cmd, power_state,
                 0, NULL, 0, NULL, 0);
 
-        if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP &&
-            power_state == I2C_HID_PWR_SLEEP)
-                ihid->sleep_delay = jiffies + msecs_to_jiffies(20);
-
         if (ret)
                 dev_err(&client->dev, "failed to change power setting.\n");
 
@@ -791,11 +767,6 @@ static int i2c_hid_open(struct hid_device *hid)
 {
         struct i2c_client *client = hid->driver_data;
         struct i2c_hid *ihid = i2c_get_clientdata(client);
-        int ret = 0;
-
-        ret = pm_runtime_get_sync(&client->dev);
-        if (ret < 0)
-                return ret;
 
         set_bit(I2C_HID_STARTED, &ihid->flags);
         return 0;
@@ -807,27 +778,6 @@ static void i2c_hid_close(struct hid_device *hid)
         struct i2c_hid *ihid = i2c_get_clientdata(client);
 
         clear_bit(I2C_HID_STARTED, &ihid->flags);
-
-        /* Save some power */
-        pm_runtime_put(&client->dev);
-}
-
-static int i2c_hid_power(struct hid_device *hid, int lvl)
-{
-        struct i2c_client *client = hid->driver_data;
-        struct i2c_hid *ihid = i2c_get_clientdata(client);
-
-        i2c_hid_dbg(ihid, "%s lvl:%d\n", __func__, lvl);
-
-        switch (lvl) {
-        case PM_HINT_FULLON:
-                pm_runtime_get_sync(&client->dev);
-                break;
-        case PM_HINT_NORMAL:
-                pm_runtime_put(&client->dev);
-                break;
-        }
-        return 0;
 }
 
 struct hid_ll_driver i2c_hid_ll_driver = {
@@ -836,7 +786,6 @@ struct hid_ll_driver i2c_hid_ll_driver = {
         .stop = i2c_hid_stop,
         .open = i2c_hid_open,
         .close = i2c_hid_close,
-        .power = i2c_hid_power,
         .output_report = i2c_hid_output_report,
         .raw_request = i2c_hid_raw_request,
 };
@@ -1104,9 +1053,6 @@ static int i2c_hid_probe(struct i2c_client *client,
 
         i2c_hid_acpi_fix_up_power(&client->dev);
 
-        pm_runtime_get_noresume(&client->dev);
-        pm_runtime_set_active(&client->dev);
-        pm_runtime_enable(&client->dev);
         device_enable_async_suspend(&client->dev);
 
         /* Make sure there is something at this address */
@@ -1114,16 +1060,16 @@ static int i2c_hid_probe(struct i2c_client *client,
         if (ret < 0) {
                 dev_dbg(&client->dev, "nothing at this address: %d\n", ret);
                 ret = -ENXIO;
-                goto err_pm;
+                goto err_regulator;
         }
 
         ret = i2c_hid_fetch_hid_descriptor(ihid);
         if (ret < 0)
-                goto err_pm;
+                goto err_regulator;
 
         ret = i2c_hid_init_irq(client);
         if (ret < 0)
-                goto err_pm;
+                goto err_regulator;
 
         hid = hid_allocate_device();
         if (IS_ERR(hid)) {
@@ -1154,9 +1100,6 @@ static int i2c_hid_probe(struct i2c_client *client,
                 goto err_mem_free;
         }
 
-        if (!(ihid->quirks & I2C_HID_QUIRK_NO_RUNTIME_PM))
-                pm_runtime_put(&client->dev);
-
         return 0;
 
 err_mem_free:
@@ -1165,10 +1108,6 @@ err_mem_free:
 err_irq:
         free_irq(client->irq, ihid);
 
-err_pm:
-        pm_runtime_put_noidle(&client->dev);
-        pm_runtime_disable(&client->dev);
-
 err_regulator:
         regulator_bulk_disable(ARRAY_SIZE(ihid->pdata.supplies),
                                ihid->pdata.supplies);
@@ -1181,12 +1120,6 @@ static int i2c_hid_remove(struct i2c_client *client)
         struct i2c_hid *ihid = i2c_get_clientdata(client);
         struct hid_device *hid;
 
-        if (!(ihid->quirks & I2C_HID_QUIRK_NO_RUNTIME_PM))
-                pm_runtime_get_sync(&client->dev);
-        pm_runtime_disable(&client->dev);
-        pm_runtime_set_suspended(&client->dev);
-        pm_runtime_put_noidle(&client->dev);
-
         hid = ihid->hid;
         hid_destroy_device(hid);
 
@@ -1219,25 +1152,15 @@ static int i2c_hid_suspend(struct device *dev)
         int wake_status;
 
         if (hid->driver && hid->driver->suspend) {
-                /*
-                 * Wake up the device so that IO issues in
-                 * HID driver's suspend code can succeed.
-                 */
-                ret = pm_runtime_resume(dev);
-                if (ret < 0)
-                        return ret;
-
                 ret = hid->driver->suspend(hid, PMSG_SUSPEND);
                 if (ret < 0)
                         return ret;
         }
 
-        if (!pm_runtime_suspended(dev)) {
-                /* Save some power */
-                i2c_hid_set_power(client, I2C_HID_PWR_SLEEP);
+        /* Save some power */
+        i2c_hid_set_power(client, I2C_HID_PWR_SLEEP);
 
-                disable_irq(client->irq);
-        }
+        disable_irq(client->irq);
 
         if (device_may_wakeup(&client->dev)) {
                 wake_status = enable_irq_wake(client->irq);
@@ -1279,11 +1202,6 @@ static int i2c_hid_resume(struct device *dev)
                                 wake_status);
         }
 
-        /* We'll resume to full power */
-        pm_runtime_disable(dev);
-        pm_runtime_set_active(dev);
-        pm_runtime_enable(dev);
-
         enable_irq(client->irq);
 
         /* Instead of resetting device, simply powers the device on. This
@@ -1304,30 +1222,8 @@ static int i2c_hid_resume(struct device *dev)
 }
 #endif
 
-#ifdef CONFIG_PM
-static int i2c_hid_runtime_suspend(struct device *dev)
-{
-        struct i2c_client *client = to_i2c_client(dev);
-
-        i2c_hid_set_power(client, I2C_HID_PWR_SLEEP);
-        disable_irq(client->irq);
-        return 0;
-}
-
-static int i2c_hid_runtime_resume(struct device *dev)
-{
-        struct i2c_client *client = to_i2c_client(dev);
-
-        enable_irq(client->irq);
-        i2c_hid_set_power(client, I2C_HID_PWR_ON);
-        return 0;
-}
-#endif
-
 static const struct dev_pm_ops i2c_hid_pm = {
         SET_SYSTEM_SLEEP_PM_OPS(i2c_hid_suspend, i2c_hid_resume)
-        SET_RUNTIME_PM_OPS(i2c_hid_runtime_suspend, i2c_hid_runtime_resume,
-                           NULL)
 };
 
 static const struct i2c_device_id i2c_hid_id_table[] = {
diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
index 75078c83be1a..d31ea82b84c1 100644
--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
@@ -323,6 +323,25 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
                 .driver_data = (void *)&sipodev_desc
         },
         {
+                /*
+                 * There are at least 2 Primebook C11B versions, the older
+                 * version has a product-name of "Primebook C11B", and a
+                 * bios version / release / firmware revision of:
+                 * V2.1.2 / 05/03/2018 / 18.2
+                 * The new version has "PRIMEBOOK C11B" as product-name and a
+                 * bios version / release / firmware revision of:
+                 * CFALKSW05_BIOS_V1.1.2 / 11/19/2018 / 19.2
+                 * Only the older version needs this quirk, note the newer
+                 * version will not match as it has a different product-name.
+                 */
+                .ident = "Trekstor Primebook C11B",
+                .matches = {
+                        DMI_EXACT_MATCH(DMI_SYS_VENDOR, "TREKSTOR"),
+                        DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Primebook C11B"),
+                },
+                .driver_data = (void *)&sipodev_desc
+        },
+        {
                 .ident = "Direkt-Tek DTLAPY116-2",
                 .matches = {
                         DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Direkt-Tek"),
diff --git a/drivers/hid/intel-ish-hid/ishtp/client-buffers.c b/drivers/hid/intel-ish-hid/ishtp/client-buffers.c
index 1b0a0cc605e7..513d7a4a1b8a 100644
--- a/drivers/hid/intel-ish-hid/ishtp/client-buffers.c
+++ b/drivers/hid/intel-ish-hid/ishtp/client-buffers.c
@@ -84,7 +84,7 @@ int ishtp_cl_alloc_tx_ring(struct ishtp_cl *cl)
         return  0;
 out:
         dev_err(&cl->device->dev, "error in allocating Tx pool\n");
-        ishtp_cl_free_rx_ring(cl);
+        ishtp_cl_free_tx_ring(cl);
         return  -ENOMEM;
 }
 
diff --git a/drivers/hwmon/ina3221.c b/drivers/hwmon/ina3221.c
index 0037e2bdacd6..8a51dcf055ea 100644
--- a/drivers/hwmon/ina3221.c
+++ b/drivers/hwmon/ina3221.c
@@ -170,7 +170,7 @@ static inline int ina3221_wait_for_data(struct ina3221_data *ina)
 
         /* Polling the CVRF bit to make sure read data is ready */
         return regmap_field_read_poll_timeout(ina->fields[F_CVRF],
-                                              cvrf, cvrf, wait, 100000);
+                                              cvrf, cvrf, wait, wait * 2);
 }
 
 static int ina3221_read_value(struct ina3221_data *ina, unsigned int reg,
diff --git a/drivers/hwmon/nct7904.c b/drivers/hwmon/nct7904.c
index b26419dbe840..281c81edabc6 100644
--- a/drivers/hwmon/nct7904.c
+++ b/drivers/hwmon/nct7904.c
@@ -82,6 +82,10 @@
 #define FANCTL1_FMR_REG         0x00    /* Bank 3; 1 reg per channel */
 #define FANCTL1_OUT_REG         0x10    /* Bank 3; 1 reg per channel */
 
+#define VOLT_MONITOR_MODE       0x0
+#define THERMAL_DIODE_MODE      0x1
+#define THERMISTOR_MODE         0x3
+
 #define ENABLE_TSI      BIT(1)
 
 static const unsigned short normal_i2c[] = {
@@ -935,11 +939,16 @@ static int nct7904_probe(struct i2c_client *client,
         for (i = 0; i < 4; i++) {
                 val = (ret >> (i * 2)) & 0x03;
                 bit = (1 << i);
-                if (val == 0) {
+                if (val == VOLT_MONITOR_MODE) {
                         data->tcpu_mask &= ~bit;
+                } else if (val == THERMAL_DIODE_MODE && i < 2) {
+                        data->temp_mode |= bit;
+                        data->vsen_mask &= ~(0x06 << (i * 2));
+                } else if (val == THERMISTOR_MODE) {
+                        data->vsen_mask &= ~(0x02 << (i * 2));
                 } else {
-                        if (val == 0x1 || val == 0x2)
-                                data->temp_mode |= bit;
+                        /* Reserved */
+                        data->tcpu_mask &= ~bit;
                         data->vsen_mask &= ~(0x06 << (i * 2));
                 }
         }
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index 3a8b0911c3bc..9d07378b5b42 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -199,6 +199,7 @@ void ib_mad_cleanup(void);
 int ib_sa_init(void);
 void ib_sa_cleanup(void);
 
+void rdma_nl_init(void);
 void rdma_nl_exit(void);
 
 int ib_nl_handle_resolve_resp(struct sk_buff *skb,
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 2dd2cfe9b561..50a92442c4f7 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -2716,6 +2716,8 @@ static int __init ib_core_init(void)
                 goto err_comp_unbound;
         }
 
+        rdma_nl_init();
+
         ret = addr_init();
         if (ret) {
                 pr_warn("Could't init IB address resolution\n");
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
index 72141c5b7c95..ade71823370f 100644
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -372,6 +372,7 @@ EXPORT_SYMBOL(iw_cm_disconnect);
 static void destroy_cm_id(struct iw_cm_id *cm_id)
 {
         struct iwcm_id_private *cm_id_priv;
+        struct ib_qp *qp;
         unsigned long flags;
 
         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
@@ -389,6 +390,9 @@ static void destroy_cm_id(struct iw_cm_id *cm_id)
         set_bit(IWCM_F_DROP_EVENTS, &cm_id_priv->flags);
 
         spin_lock_irqsave(&cm_id_priv->lock, flags);
+        qp = cm_id_priv->qp;
+        cm_id_priv->qp = NULL;
+
         switch (cm_id_priv->state) {
         case IW_CM_STATE_LISTEN:
                 cm_id_priv->state = IW_CM_STATE_DESTROYING;
@@ -401,7 +405,7 @@ static void destroy_cm_id(struct iw_cm_id *cm_id)
                 cm_id_priv->state = IW_CM_STATE_DESTROYING;
                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
                 /* Abrupt close of the connection */
-                (void)iwcm_modify_qp_err(cm_id_priv->qp);
+                (void)iwcm_modify_qp_err(qp);
                 spin_lock_irqsave(&cm_id_priv->lock, flags);
                 break;
         case IW_CM_STATE_IDLE:
@@ -426,11 +430,9 @@ static void destroy_cm_id(struct iw_cm_id *cm_id)
                 BUG();
                 break;
         }
-        if (cm_id_priv->qp) {
-                cm_id_priv->id.device->ops.iw_rem_ref(cm_id_priv->qp);
-                cm_id_priv->qp = NULL;
-        }
         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        if (qp)
+                cm_id_priv->id.device->ops.iw_rem_ref(qp);
 
         if (cm_id->mapped) {
                 iwpm_remove_mapinfo(&cm_id->local_addr, &cm_id->m_local_addr);
@@ -671,11 +673,11 @@ int iw_cm_accept(struct iw_cm_id *cm_id,
                 BUG_ON(cm_id_priv->state != IW_CM_STATE_CONN_RECV);
                 cm_id_priv->state = IW_CM_STATE_IDLE;
                 spin_lock_irqsave(&cm_id_priv->lock, flags);
-                if (cm_id_priv->qp) {
-                        cm_id->device->ops.iw_rem_ref(qp);
-                        cm_id_priv->qp = NULL;
-                }
+                qp = cm_id_priv->qp;
+                cm_id_priv->qp = NULL;
                 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                if (qp)
+                        cm_id->device->ops.iw_rem_ref(qp);
                 clear_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags);
                 wake_up_all(&cm_id_priv->connect_wait);
         }
@@ -696,7 +698,7 @@ int iw_cm_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *iw_param)
         struct iwcm_id_private *cm_id_priv;
         int ret;
         unsigned long flags;
-        struct ib_qp *qp;
+        struct ib_qp *qp = NULL;
 
         cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
 
@@ -730,13 +732,13 @@ int iw_cm_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *iw_param)
                 return 0;       /* success */
 
         spin_lock_irqsave(&cm_id_priv->lock, flags);
-        if (cm_id_priv->qp) {
-                cm_id->device->ops.iw_rem_ref(qp);
-                cm_id_priv->qp = NULL;
-        }
+        qp = cm_id_priv->qp;
+        cm_id_priv->qp = NULL;
         cm_id_priv->state = IW_CM_STATE_IDLE;
 err:
         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        if (qp)
+                cm_id->device->ops.iw_rem_ref(qp);
         clear_bit(IWCM_F_CONNECT_WAIT, &cm_id_priv->flags);
         wake_up_all(&cm_id_priv->connect_wait);
         return ret;
@@ -878,6 +880,7 @@ static int cm_conn_est_handler(struct iwcm_id_private *cm_id_priv,
 static int cm_conn_rep_handler(struct iwcm_id_private *cm_id_priv,
                                struct iw_cm_event *iw_event)
 {
+        struct ib_qp *qp = NULL;
         unsigned long flags;
         int ret;
 
@@ -896,11 +899,13 @@ static int cm_conn_rep_handler(struct iwcm_id_private *cm_id_priv,
                 cm_id_priv->state = IW_CM_STATE_ESTABLISHED;
         } else {
                 /* REJECTED or RESET */
-                cm_id_priv->id.device->ops.iw_rem_ref(cm_id_priv->qp);
+                qp = cm_id_priv->qp;
                 cm_id_priv->qp = NULL;
                 cm_id_priv->state = IW_CM_STATE_IDLE;
         }
         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        if (qp)
+                cm_id_priv->id.device->ops.iw_rem_ref(qp);
         ret = cm_id_priv->id.cm_handler(&cm_id_priv->id, iw_event);
 
         if (iw_event->private_data_len)
@@ -942,21 +947,18 @@ static void cm_disconnect_handler(struct iwcm_id_private *cm_id_priv,
 static int cm_close_handler(struct iwcm_id_private *cm_id_priv,
                                   struct iw_cm_event *iw_event)
 {
+        struct ib_qp *qp;
         unsigned long flags;
-        int ret = 0;
+        int ret = 0, notify_event = 0;
         spin_lock_irqsave(&cm_id_priv->lock, flags);
+        qp = cm_id_priv->qp;
+        cm_id_priv->qp = NULL;
 
-        if (cm_id_priv->qp) {
-                cm_id_priv->id.device->ops.iw_rem_ref(cm_id_priv->qp);
-                cm_id_priv->qp = NULL;
-        }
         switch (cm_id_priv->state) {
         case IW_CM_STATE_ESTABLISHED:
         case IW_CM_STATE_CLOSING:
                 cm_id_priv->state = IW_CM_STATE_IDLE;
-                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
-                ret = cm_id_priv->id.cm_handler(&cm_id_priv->id, iw_event);
-                spin_lock_irqsave(&cm_id_priv->lock, flags);
+                notify_event = 1;
                 break;
         case IW_CM_STATE_DESTROYING:
                 break;
@@ -965,6 +967,10 @@ static int cm_close_handler(struct iwcm_id_private *cm_id_priv,
         }
         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 
+        if (qp)
+                cm_id_priv->id.device->ops.iw_rem_ref(qp);
+        if (notify_event)
+                ret = cm_id_priv->id.cm_handler(&cm_id_priv->id, iw_event);
         return ret;
 }
 
diff --git a/drivers/infiniband/core/netlink.c b/drivers/infiniband/core/netlink.c
index 81dbd5f41bed..8cd31ef25eff 100644
--- a/drivers/infiniband/core/netlink.c
+++ b/drivers/infiniband/core/netlink.c
@@ -42,9 +42,12 @@
 #include <linux/module.h>
 #include "core_priv.h"
 
-static DEFINE_MUTEX(rdma_nl_mutex);
 static struct {
-        const struct rdma_nl_cbs   *cb_table;
+        const struct rdma_nl_cbs *cb_table;
+        /* Synchronizes between ongoing netlink commands and netlink client
+         * unregistration.
+         */
+        struct rw_semaphore sem;
 } rdma_nl_types[RDMA_NL_NUM_CLIENTS];
 
 bool rdma_nl_chk_listeners(unsigned int group)
@@ -75,70 +78,53 @@ static bool is_nl_msg_valid(unsigned int type, unsigned int op)
         return (op < max_num_ops[type]) ? true : false;
 }
 
-static bool
-is_nl_valid(const struct sk_buff *skb, unsigned int type, unsigned int op)
+static const struct rdma_nl_cbs *
+get_cb_table(const struct sk_buff *skb, unsigned int type, unsigned int op)
 {
         const struct rdma_nl_cbs *cb_table;
 
-        if (!is_nl_msg_valid(type, op))
-                return false;
-
         /*
          * Currently only NLDEV client is supporting netlink commands in
          * non init_net net namespace.
          */
         if (sock_net(skb->sk) != &init_net && type != RDMA_NL_NLDEV)
-                return false;
+                return NULL;
 
-        if (!rdma_nl_types[type].cb_table) {
-                mutex_unlock(&rdma_nl_mutex);
-                request_module("rdma-netlink-subsys-%d", type);
-                mutex_lock(&rdma_nl_mutex);
-        }
+        cb_table = READ_ONCE(rdma_nl_types[type].cb_table);
+        if (!cb_table) {
+                /*
+                 * Didn't get valid reference of the table, attempt module
+                 * load once.
+                 */
+                up_read(&rdma_nl_types[type].sem);
 
-        cb_table = rdma_nl_types[type].cb_table;
+                request_module("rdma-netlink-subsys-%d", type);
 
+                down_read(&rdma_nl_types[type].sem);
+                cb_table = READ_ONCE(rdma_nl_types[type].cb_table);
+        }
         if (!cb_table || (!cb_table[op].dump && !cb_table[op].doit))
-                return false;
-        return true;
+                return NULL;
+        return cb_table;
 }
 
 void rdma_nl_register(unsigned int index,
                       const struct rdma_nl_cbs cb_table[])
 {
-        mutex_lock(&rdma_nl_mutex);
-        if (!is_nl_msg_valid(index, 0)) {
-                /*
-                 * All clients are not interesting in success/failure of
-                 * this call. They want to see the print to error log and
-                 * continue their initialization. Print warning for them,
-                 * because it is programmer's error to be here.
-                 */
-                mutex_unlock(&rdma_nl_mutex);
-                WARN(true,
-                     "The not-valid %u index was supplied to RDMA netlink\n",
-                     index);
+        if (WARN_ON(!is_nl_msg_valid(index, 0)) ||
+            WARN_ON(READ_ONCE(rdma_nl_types[index].cb_table)))
                 return;
-        }
-
-        if (rdma_nl_types[index].cb_table) {
-                mutex_unlock(&rdma_nl_mutex);
-                WARN(true,
-                     "The %u index is already registered in RDMA netlink\n",
-                     index);
-                return;
-        }
 
-        rdma_nl_types[index].cb_table = cb_table;
-        mutex_unlock(&rdma_nl_mutex);
+        /* Pairs with the READ_ONCE in is_nl_valid() */
+        smp_store_release(&rdma_nl_types[index].cb_table, cb_table);
 }
 EXPORT_SYMBOL(rdma_nl_register);
 
 void rdma_nl_unregister(unsigned int index)
 {
-        mutex_lock(&rdma_nl_mutex);
+        down_write(&rdma_nl_types[index].sem);
         rdma_nl_types[index].cb_table = NULL;
-        mutex_unlock(&rdma_nl_mutex);
+        up_write(&rdma_nl_types[index].sem);
 }
 EXPORT_SYMBOL(rdma_nl_unregister);
 
@@ -170,15 +156,21 @@ static int rdma_nl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
         unsigned int index = RDMA_NL_GET_CLIENT(type);
         unsigned int op = RDMA_NL_GET_OP(type);
         const struct rdma_nl_cbs *cb_table;
+        int err = -EINVAL;
 
-        if (!is_nl_valid(skb, index, op))
+        if (!is_nl_msg_valid(index, op))
                 return -EINVAL;
 
-        cb_table = rdma_nl_types[index].cb_table;
+        down_read(&rdma_nl_types[index].sem);
+        cb_table = get_cb_table(skb, index, op);
+        if (!cb_table)
+                goto done;
 
         if ((cb_table[op].flags & RDMA_NL_ADMIN_PERM) &&
-            !netlink_capable(skb, CAP_NET_ADMIN))
-                return -EPERM;
+            !netlink_capable(skb, CAP_NET_ADMIN)) {
+                err = -EPERM;
+                goto done;
+        }
 
         /*
          * LS responses overload the 0x100 (NLM_F_ROOT) flag.  Don't
@@ -186,8 +178,8 @@ static int rdma_nl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
          */
         if (index == RDMA_NL_LS) {
                 if (cb_table[op].doit)
-                        return cb_table[op].doit(skb, nlh, extack);
-                return -EINVAL;
+                        err = cb_table[op].doit(skb, nlh, extack);
+                goto done;
         }
         /* FIXME: Convert IWCM to properly handle doit callbacks */
         if ((nlh->nlmsg_flags & NLM_F_DUMP) || index == RDMA_NL_IWCM) {
@@ -195,14 +187,15 @@ static int rdma_nl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
                         .dump = cb_table[op].dump,
                 };
                 if (c.dump)
-                        return netlink_dump_start(skb->sk, skb, nlh, &c);
-                return -EINVAL;
+                        err = netlink_dump_start(skb->sk, skb, nlh, &c);
+                goto done;
         }
 
         if (cb_table[op].doit)
-                return cb_table[op].doit(skb, nlh, extack);
-
-        return 0;
+                err = cb_table[op].doit(skb, nlh, extack);
+done:
+        up_read(&rdma_nl_types[index].sem);
+        return err;
 }
 
 /*
@@ -263,9 +256,7 @@ skip:
 
 static void rdma_nl_rcv(struct sk_buff *skb)
 {
-        mutex_lock(&rdma_nl_mutex);
         rdma_nl_rcv_skb(skb, &rdma_nl_rcv_msg);
-        mutex_unlock(&rdma_nl_mutex);
 }
 
 int rdma_nl_unicast(struct net *net, struct sk_buff *skb, u32 pid)
@@ -297,6 +288,14 @@ int rdma_nl_multicast(struct net *net, struct sk_buff *skb,
 }
 EXPORT_SYMBOL(rdma_nl_multicast);
 
+void rdma_nl_init(void)
+{
+        int idx;
+
+        for (idx = 0; idx < RDMA_NL_NUM_CLIENTS; idx++)
+                init_rwsem(&rdma_nl_types[idx].sem);
+}
+
 void rdma_nl_exit(void)
 {
         int idx;
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index 65b36548bc17..c03af08b80e7 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -778,7 +778,7 @@ static int fill_res_counter_entry(struct sk_buff *msg, bool has_cap_net_admin,
                 container_of(res, struct rdma_counter, res);
 
         if (port && port != counter->port)
-                return 0;
+                return -EAGAIN;
 
         /* Dump it even query failed */
         rdma_counter_query_stats(counter);
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index 1e5aeb39f774..63f7f7db5902 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -98,7 +98,7 @@ ib_uverbs_init_udata_buf_or_null(struct ib_udata *udata,
 
 struct ib_uverbs_device {
         atomic_t                                refcount;
-        int                                     num_comp_vectors;
+        u32                                     num_comp_vectors;
         struct completion                       comp;
         struct device                           dev;
         /* First group for device attributes, NULL terminated array */
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index f974b6854224..35c2841a569e 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -662,16 +662,17 @@ static bool find_gid_index(const union ib_gid *gid,
                            void *context)
 {
         struct find_gid_index_context *ctx = context;
+        u16 vlan_id = 0xffff;
+        int ret;
 
         if (ctx->gid_type != gid_attr->gid_type)
                 return false;
 
-        if ((!!(ctx->vlan_id != 0xffff) == !is_vlan_dev(gid_attr->ndev)) ||
-            (is_vlan_dev(gid_attr->ndev) &&
-             vlan_dev_vlan_id(gid_attr->ndev) != ctx->vlan_id))
+        ret = rdma_read_gid_l2_fields(gid_attr, &vlan_id, NULL);
+        if (ret)
                 return false;
 
-        return true;
+        return ctx->vlan_id == vlan_id;
 }
 
 static const struct ib_gid_attr *
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index e87fc0408470..347dc242fb88 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -495,7 +495,6 @@ static int _put_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)
 
         ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
         release_ep_resources(ep);
-        kfree_skb(skb);
         return 0;
 }
 
@@ -506,7 +505,6 @@ static int _put_pass_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)
         ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
         c4iw_put_ep(&ep->parent_ep->com);
         release_ep_resources(ep);
-        kfree_skb(skb);
         return 0;
 }
 
@@ -2424,20 +2422,6 @@ static int accept_cr(struct c4iw_ep *ep, struct sk_buff *skb,
         enum chip_type adapter_type = ep->com.dev->rdev.lldi.adapter_type;
 
         pr_debug("ep %p tid %u\n", ep, ep->hwtid);
-
-        skb_get(skb);
-        rpl = cplhdr(skb);
-        if (!is_t4(adapter_type)) {
-                skb_trim(skb, roundup(sizeof(*rpl5), 16));
-                rpl5 = (void *)rpl;
-                INIT_TP_WR(rpl5, ep->hwtid);
-        } else {
-                skb_trim(skb, sizeof(*rpl));
-                INIT_TP_WR(rpl, ep->hwtid);
-        }
-        OPCODE_TID(rpl) = cpu_to_be32(MK_OPCODE_TID(CPL_PASS_ACCEPT_RPL,
-                                                    ep->hwtid));
-
         cxgb_best_mtu(ep->com.dev->rdev.lldi.mtus, ep->mtu, &mtu_idx,
                       enable_tcp_timestamps && req->tcpopt.tstamp,
                       (ep->com.remote_addr.ss_family == AF_INET) ? 0 : 1);
@@ -2483,6 +2467,20 @@ static int accept_cr(struct c4iw_ep *ep, struct sk_buff *skb,
                 if (tcph->ece && tcph->cwr)
                         opt2 |= CCTRL_ECN_V(1);
         }
+
+        skb_get(skb);
+        rpl = cplhdr(skb);
+        if (!is_t4(adapter_type)) {
+                skb_trim(skb, roundup(sizeof(*rpl5), 16));
+                rpl5 = (void *)rpl;
+                INIT_TP_WR(rpl5, ep->hwtid);
+        } else {
+                skb_trim(skb, sizeof(*rpl));
+                INIT_TP_WR(rpl, ep->hwtid);
+        }
+        OPCODE_TID(rpl) = cpu_to_be32(MK_OPCODE_TID(CPL_PASS_ACCEPT_RPL,
+                                                    ep->hwtid));
+
         if (CHELSIO_CHIP_VERSION(adapter_type) > CHELSIO_T4) {
                 u32 isn = (prandom_u32() & ~7UL) - 1;
                 opt2 |= T5_OPT_2_VALID_F;
diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
index 2ed7bfd5feea..c61b6022575e 100644
--- a/drivers/infiniband/hw/hfi1/sdma.c
+++ b/drivers/infiniband/hw/hfi1/sdma.c
@@ -65,6 +65,7 @@
 #define SDMA_DESCQ_CNT 2048
 #define SDMA_DESC_INTR 64
 #define INVALID_TAIL 0xffff
+#define SDMA_PAD max_t(size_t, MAX_16B_PADDING, sizeof(u32))
 
 static uint sdma_descq_cnt = SDMA_DESCQ_CNT;
 module_param(sdma_descq_cnt, uint, S_IRUGO);
@@ -1296,7 +1297,7 @@ void sdma_clean(struct hfi1_devdata *dd, size_t num_engines)
         struct sdma_engine *sde;
 
         if (dd->sdma_pad_dma) {
-                dma_free_coherent(&dd->pcidev->dev, 4,
+                dma_free_coherent(&dd->pcidev->dev, SDMA_PAD,
                                   (void *)dd->sdma_pad_dma,
                                   dd->sdma_pad_phys);
                 dd->sdma_pad_dma = NULL;
@@ -1491,7 +1492,7 @@ int sdma_init(struct hfi1_devdata *dd, u8 port)
         }
 
         /* Allocate memory for pad */
-        dd->sdma_pad_dma = dma_alloc_coherent(&dd->pcidev->dev, sizeof(u32),
+        dd->sdma_pad_dma = dma_alloc_coherent(&dd->pcidev->dev, SDMA_PAD,
                                               &dd->sdma_pad_phys, GFP_KERNEL);
         if (!dd->sdma_pad_dma) {
                 dd_dev_err(dd, "failed to allocate SendDMA pad memory\n");
diff --git a/drivers/infiniband/hw/hfi1/tid_rdma.c b/drivers/infiniband/hw/hfi1/tid_rdma.c
index b4dcc4d29f84..f21fca3617d5 100644
--- a/drivers/infiniband/hw/hfi1/tid_rdma.c
+++ b/drivers/infiniband/hw/hfi1/tid_rdma.c
@@ -2736,11 +2736,6 @@ static bool handle_read_kdeth_eflags(struct hfi1_ctxtdata *rcd,
                                 diff = cmp_psn(psn,
                                                flow->flow_state.r_next_psn);
                                 if (diff > 0) {
-                                        if (!(qp->r_flags & RVT_R_RDMAR_SEQ))
-                                                restart_tid_rdma_read_req(rcd,
-                                                                          qp,
-                                                                          wqe);
-
                                         /* Drop the packet.*/
                                         goto s_unlock;
                                 } else if (diff < 0) {
diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
index 7bff0a1e713d..089e201d7550 100644
--- a/drivers/infiniband/hw/hfi1/verbs.c
+++ b/drivers/infiniband/hw/hfi1/verbs.c
@@ -147,9 +147,6 @@ static int pio_wait(struct rvt_qp *qp,
 /* Length of buffer to create verbs txreq cache name */
 #define TXREQ_NAME_LEN 24
 
-/* 16B trailing buffer */
-static const u8 trail_buf[MAX_16B_PADDING];
-
 static uint wss_threshold = 80;
 module_param(wss_threshold, uint, S_IRUGO);
 MODULE_PARM_DESC(wss_threshold, "Percentage (1-100) of LLC to use as a threshold for a cacheless copy");
@@ -820,8 +817,8 @@ static int build_verbs_tx_desc(
 
         /* add icrc, lt byte, and padding to flit */
         if (extra_bytes)
-                ret = sdma_txadd_kvaddr(sde->dd, &tx->txreq,
-                                        (void *)trail_buf, extra_bytes);
+                ret = sdma_txadd_daddr(sde->dd, &tx->txreq,
+                                       sde->dd->sdma_pad_phys, extra_bytes);
 
 bail_txadd:
         return ret;
@@ -1089,7 +1086,8 @@ int hfi1_verbs_send_pio(struct rvt_qp *qp, struct hfi1_pkt_state *ps,
                 }
                 /* add icrc, lt byte, and padding to flit */
                 if (extra_bytes)
-                        seg_pio_copy_mid(pbuf, trail_buf, extra_bytes);
+                        seg_pio_copy_mid(pbuf, ppd->dd->sdma_pad_dma,
+                                         extra_bytes);
 
                 seg_pio_copy_end(pbuf);
         }
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 7a89d669f8bf..e82567fcdeb7 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -5389,9 +5389,9 @@ static void hns_roce_v2_free_eq(struct hns_roce_dev *hr_dev,
                 return;
         }
 
-        if (eq->buf_list)
-                dma_free_coherent(hr_dev->dev, buf_chk_sz,
-                                  eq->buf_list->buf, eq->buf_list->map);
+        dma_free_coherent(hr_dev->dev, buf_chk_sz, eq->buf_list->buf,
+                          eq->buf_list->map);
+        kfree(eq->buf_list);
 }
 
 static void hns_roce_config_eqc(struct hns_roce_dev *hr_dev,
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 630599311586..7019c12005f4 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1967,8 +1967,8 @@ int mlx5_ib_dealloc_mw(struct ib_mw *mw)
         int err;
 
         if (IS_ENABLED(CONFIG_INFINIBAND_ON_DEMAND_PAGING)) {
-                xa_erase(&dev->mdev->priv.mkey_table,
-                         mlx5_base_mkey(mmw->mmkey.key));
+                xa_erase_irq(&dev->mdev->priv.mkey_table,
+                             mlx5_base_mkey(mmw->mmkey.key));
                 /*
                  * pagefault_single_data_segment() may be accessing mmw under
                  * SRCU if the user bound an ODP MR to this MW.
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 8937d72ddcf6..5fd071c05944 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -3249,10 +3249,12 @@ static int modify_raw_packet_qp_sq(
         }
 
         /* Only remove the old rate after new rate was set */
-        if ((old_rl.rate &&
-             !mlx5_rl_are_equal(&old_rl, &new_rl)) ||
-            (new_state != MLX5_SQC_STATE_RDY))
+        if ((old_rl.rate && !mlx5_rl_are_equal(&old_rl, &new_rl)) ||
+            (new_state != MLX5_SQC_STATE_RDY)) {
                 mlx5_rl_remove_rate(dev, &old_rl);
+                if (new_state != MLX5_SQC_STATE_RDY)
+                        memset(&new_rl, 0, sizeof(new_rl));
+        }
 
         ibqp->rl = new_rl;
         sq->state = new_state;
diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c
index 5136b835e1ba..dc71b6e16a07 100644
--- a/drivers/infiniband/hw/qedr/main.c
+++ b/drivers/infiniband/hw/qedr/main.c
@@ -76,7 +76,7 @@ static void qedr_get_dev_fw_str(struct ib_device *ibdev, char *str)
         struct qedr_dev *qedr = get_qedr_dev(ibdev);
         u32 fw_ver = (u32)qedr->attr.fw_ver;
 
-        snprintf(str, IB_FW_VERSION_NAME_MAX, "%d. %d. %d. %d",
+        snprintf(str, IB_FW_VERSION_NAME_MAX, "%d.%d.%d.%d",
                  (fw_ver >> 24) & 0xFF, (fw_ver >> 16) & 0xFF,
                  (fw_ver >> 8) & 0xFF, fw_ver & 0xFF);
 }
diff --git a/drivers/infiniband/sw/siw/siw_qp.c b/drivers/infiniband/sw/siw/siw_qp.c
index 52d402f39df9..b4317480cee7 100644
--- a/drivers/infiniband/sw/siw/siw_qp.c
+++ b/drivers/infiniband/sw/siw/siw_qp.c
@@ -1312,6 +1312,7 @@ int siw_qp_add(struct siw_device *sdev, struct siw_qp *qp)
 void siw_free_qp(struct kref *ref)
 {
         struct siw_qp *found, *qp = container_of(ref, struct siw_qp, ref);
+        struct siw_base_qp *siw_base_qp = to_siw_base_qp(qp->ib_qp);
         struct siw_device *sdev = qp->sdev;
         unsigned long flags;
 
@@ -1334,4 +1335,5 @@ void siw_free_qp(struct kref *ref)
         atomic_dec(&sdev->num_qp);
         siw_dbg_qp(qp, "free QP\n");
         kfree_rcu(qp, rcu);
+        kfree(siw_base_qp);
 }
diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
index 869e02b69a01..b18a677832e1 100644
--- a/drivers/infiniband/sw/siw/siw_verbs.c
+++ b/drivers/infiniband/sw/siw/siw_verbs.c
@@ -604,7 +604,6 @@ out:
 int siw_destroy_qp(struct ib_qp *base_qp, struct ib_udata *udata)
 {
         struct siw_qp *qp = to_siw_qp(base_qp);
-        struct siw_base_qp *siw_base_qp = to_siw_base_qp(base_qp);
         struct siw_ucontext *uctx =
                 rdma_udata_to_drv_context(udata, struct siw_ucontext,
                                           base_ucontext);
@@ -641,7 +640,6 @@ int siw_destroy_qp(struct ib_qp *base_qp, struct ib_udata *udata)
         qp->scq = qp->rcq = NULL;
 
         siw_qp_put(qp);
-        kfree(siw_base_qp);
 
         return 0;
 }
diff --git a/drivers/iommu/amd_iommu_quirks.c b/drivers/iommu/amd_iommu_quirks.c
index c235f79b7a20..5120ce4fdce3 100644
--- a/drivers/iommu/amd_iommu_quirks.c
+++ b/drivers/iommu/amd_iommu_quirks.c
@@ -74,6 +74,19 @@ static const struct dmi_system_id ivrs_quirks[] __initconst = {
                 .driver_data = (void *)&ivrs_ioapic_quirks[DELL_LATITUDE_5495],
         },
         {
+                /*
+                 * Acer Aspire A315-41 requires the very same workaround as
+                 * Dell Latitude 5495
+                 */
+                .callback = ivrs_ioapic_quirk_cb,
+                .ident = "Acer Aspire A315-41",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A315-41"),
+                },
+                .driver_data = (void *)&ivrs_ioapic_quirks[DELL_LATITUDE_5495],
+        },
+        {
                 .callback = ivrs_ioapic_quirk_cb,
                 .ident = "Lenovo ideapad 330S-15ARR",
                 .matches = {
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 79e35b3180ac..6db6d969e31c 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -2794,7 +2794,7 @@ static int identity_mapping(struct device *dev)
         struct device_domain_info *info;
 
         info = dev->archdata.iommu;
-        if (info && info != DUMMY_DEVICE_DOMAIN_INFO)
+        if (info && info != DUMMY_DEVICE_DOMAIN_INFO && info != DEFER_DEVICE_DOMAIN_INFO)
                 return (info->domain == si_domain);
 
         return 0;
diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
index 237103465b82..2639fc718117 100644
--- a/drivers/iommu/ipmmu-vmsa.c
+++ b/drivers/iommu/ipmmu-vmsa.c
@@ -1105,10 +1105,8 @@ static int ipmmu_probe(struct platform_device *pdev)
         /* Root devices have mandatory IRQs */
         if (ipmmu_is_root(mmu)) {
                 irq = platform_get_irq(pdev, 0);
-                if (irq < 0) {
-                        dev_err(&pdev->dev, "no IRQ found\n");
+                if (irq < 0)
                         return irq;
-                }
 
                 ret = devm_request_irq(&pdev->dev, irq, ipmmu_irq, 0,
                                        dev_name(&pdev->dev), mmu);
diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
index c92b405b7646..ba8619524231 100644
--- a/drivers/isdn/capi/capi.c
+++ b/drivers/isdn/capi/capi.c
@@ -744,7 +744,7 @@ capi_poll(struct file *file, poll_table *wait)
 
         poll_wait(file, &(cdev->recvwait), wait);
         mask = EPOLLOUT | EPOLLWRNORM;
-        if (!skb_queue_empty(&cdev->recvqueue))
+        if (!skb_queue_empty_lockless(&cdev->recvqueue))
                 mask |= EPOLLIN | EPOLLRDNORM;
         return mask;
 }
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 8c79bad2a9a5..4f2e6910c623 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -952,7 +952,7 @@ static int alb_upper_dev_walk(struct net_device *upper, void *_data)
         struct bond_vlan_tag *tags;
 
         if (is_vlan_dev(upper) &&
-            bond->nest_level == vlan_get_encap_level(upper) - 1) {
+            bond->dev->lower_level == upper->lower_level - 1) {
                 if (upper->addr_assign_type == NET_ADDR_STOLEN) {
                         alb_send_lp_vid(slave, mac_addr,
                                         vlan_dev_vlan_proto(upper),
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 21d8fcc83c9c..480f9459b402 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1733,8 +1733,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
                 goto err_upper_unlink;
         }
 
-        bond->nest_level = dev_get_nest_level(bond_dev) + 1;
-
         /* If the mode uses primary, then the following is handled by
          * bond_change_active_slave().
          */
@@ -1816,7 +1814,8 @@ err_detach:
         slave_disable_netpoll(new_slave);
 
 err_close:
-        slave_dev->priv_flags &= ~IFF_BONDING;
+        if (!netif_is_bond_master(slave_dev))
+                slave_dev->priv_flags &= ~IFF_BONDING;
         dev_close(slave_dev);
 
 err_restore_mac:
@@ -1956,9 +1955,6 @@ static int __bond_release_one(struct net_device *bond_dev,
         if (!bond_has_slaves(bond)) {
                 bond_set_carrier(bond);
                 eth_hw_addr_random(bond_dev);
-                bond->nest_level = SINGLE_DEPTH_NESTING;
-        } else {
-                bond->nest_level = dev_get_nest_level(bond_dev) + 1;
         }
 
         unblock_netpoll_tx();
@@ -2017,7 +2013,8 @@ static int __bond_release_one(struct net_device *bond_dev,
         else
                 dev_set_mtu(slave_dev, slave->original_mtu);
 
-        slave_dev->priv_flags &= ~IFF_BONDING;
+        if (!netif_is_bond_master(slave_dev))
+                slave_dev->priv_flags &= ~IFF_BONDING;
 
         bond_free_slave(slave);
 
@@ -3442,13 +3439,6 @@ static void bond_fold_stats(struct rtnl_link_stats64 *_res,
         }
 }
 
-static int bond_get_nest_level(struct net_device *bond_dev)
-{
-        struct bonding *bond = netdev_priv(bond_dev);
-
-        return bond->nest_level;
-}
-
 static void bond_get_stats(struct net_device *bond_dev,
                            struct rtnl_link_stats64 *stats)
 {
@@ -3457,7 +3447,7 @@ static void bond_get_stats(struct net_device *bond_dev,
         struct list_head *iter;
         struct slave *slave;
 
-        spin_lock_nested(&bond->stats_lock, bond_get_nest_level(bond_dev));
+        spin_lock(&bond->stats_lock);
         memcpy(stats, &bond->bond_stats, sizeof(*stats));
 
         rcu_read_lock();
@@ -4268,7 +4258,6 @@ static const struct net_device_ops bond_netdev_ops = {
         .ndo_neigh_setup        = bond_neigh_setup,
         .ndo_vlan_rx_add_vid    = bond_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid   = bond_vlan_rx_kill_vid,
-        .ndo_get_lock_subclass  = bond_get_nest_level,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_netpoll_setup      = bond_netpoll_setup,
         .ndo_netpoll_cleanup    = bond_netpoll_cleanup,
@@ -4296,7 +4285,6 @@ void bond_setup(struct net_device *bond_dev)
         struct bonding *bond = netdev_priv(bond_dev);
 
         spin_lock_init(&bond->mode_lock);
-        spin_lock_init(&bond->stats_lock);
         bond->params = bonding_defaults;
 
         /* Initialize pointers */
@@ -4365,6 +4353,7 @@ static void bond_uninit(struct net_device *bond_dev)
 
         list_del(&bond->bond_list);
 
+        lockdep_unregister_key(&bond->stats_lock_key);
         bond_debug_unregister(bond);
 }
 
@@ -4768,8 +4757,9 @@ static int bond_init(struct net_device *bond_dev)
         if (!bond->wq)
                 return -ENOMEM;
 
-        bond->nest_level = SINGLE_DEPTH_NESTING;
-        netdev_lockdep_set_classes(bond_dev);
+        spin_lock_init(&bond->stats_lock);
+        lockdep_register_key(&bond->stats_lock_key);
+        lockdep_set_class(&bond->stats_lock, &bond->stats_lock_key);
 
         list_add_tail(&bond->bond_list, &bn->dev_list);
 
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index 26509fa37a50..d44651ad520c 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -37,22 +37,11 @@ static void bcm_sf2_imp_setup(struct dsa_switch *ds, int port)
         unsigned int i;
         u32 reg, offset;
 
-        if (priv->type == BCM7445_DEVICE_ID)
-                offset = CORE_STS_OVERRIDE_IMP;
-        else
-                offset = CORE_STS_OVERRIDE_IMP2;
-
         /* Enable the port memories */
         reg = core_readl(priv, CORE_MEM_PSM_VDD_CTRL);
         reg &= ~P_TXQ_PSM_VDD(port);
         core_writel(priv, reg, CORE_MEM_PSM_VDD_CTRL);
 
-        /* Enable Broadcast, Multicast, Unicast forwarding to IMP port */
-        reg = core_readl(priv, CORE_IMP_CTL);
-        reg |= (RX_BCST_EN | RX_MCST_EN | RX_UCST_EN);
-        reg &= ~(RX_DIS | TX_DIS);
-        core_writel(priv, reg, CORE_IMP_CTL);
-
         /* Enable forwarding */
         core_writel(priv, SW_FWDG_EN, CORE_SWMODE);
 
@@ -71,10 +60,27 @@ static void bcm_sf2_imp_setup(struct dsa_switch *ds, int port)
 
         b53_brcm_hdr_setup(ds, port);
 
-        /* Force link status for IMP port */
-        reg = core_readl(priv, offset);
-        reg |= (MII_SW_OR | LINK_STS);
-        core_writel(priv, reg, offset);
+        if (port == 8) {
+                if (priv->type == BCM7445_DEVICE_ID)
+                        offset = CORE_STS_OVERRIDE_IMP;
+                else
+                        offset = CORE_STS_OVERRIDE_IMP2;
+
+                /* Force link status for IMP port */
+                reg = core_readl(priv, offset);
+                reg |= (MII_SW_OR | LINK_STS);
+                core_writel(priv, reg, offset);
+
+                /* Enable Broadcast, Multicast, Unicast forwarding to IMP port */
+                reg = core_readl(priv, CORE_IMP_CTL);
+                reg |= (RX_BCST_EN | RX_MCST_EN | RX_UCST_EN);
+                reg &= ~(RX_DIS | TX_DIS);
+                core_writel(priv, reg, CORE_IMP_CTL);
+        } else {
+                reg = core_readl(priv, CORE_G_PCTL_PORT(port));
+                reg &= ~(RX_DIS | TX_DIS);
+                core_writel(priv, reg, CORE_G_PCTL_PORT(port));
+        }
 }
 
 static void bcm_sf2_gphy_enable_set(struct dsa_switch *ds, bool enable)
diff --git a/drivers/net/dsa/sja1105/Kconfig b/drivers/net/dsa/sja1105/Kconfig
index f40b248f0b23..ffac0ea4e8d5 100644
--- a/drivers/net/dsa/sja1105/Kconfig
+++ b/drivers/net/dsa/sja1105/Kconfig
@@ -26,8 +26,8 @@ config NET_DSA_SJA1105_PTP
 
 config NET_DSA_SJA1105_TAS
         bool "Support for the Time-Aware Scheduler on NXP SJA1105"
-        depends on NET_DSA_SJA1105
-        depends on NET_SCH_TAPRIO
+        depends on NET_DSA_SJA1105 && NET_SCH_TAPRIO
+        depends on NET_SCH_TAPRIO=y || NET_DSA_SJA1105=m
         help
           This enables support for the TTEthernet-based egress scheduling
           engine in the SJA1105 DSA driver, which is controlled using a
diff --git a/drivers/net/ethernet/arc/emac_rockchip.c b/drivers/net/ethernet/arc/emac_rockchip.c
index 42d2e1b02c44..664d664e0925 100644
--- a/drivers/net/ethernet/arc/emac_rockchip.c
+++ b/drivers/net/ethernet/arc/emac_rockchip.c
@@ -256,6 +256,9 @@ static int emac_rockchip_remove(struct platform_device *pdev)
         if (priv->regulator)
                 regulator_disable(priv->regulator);
 
+        if (priv->soc_data->need_div_macclk)
+                clk_disable_unprepare(priv->macclk);
+
         free_netdev(ndev);
         return err;
 }
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index b4a8cf620a0c..04ec909e06df 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -10382,7 +10382,8 @@ static void bnxt_cleanup_pci(struct bnxt *bp)
 {
         bnxt_unmap_bars(bp, bp->pdev);
         pci_release_regions(bp->pdev);
-        pci_disable_device(bp->pdev);
+        if (pci_is_enabled(bp->pdev))
+                pci_disable_device(bp->pdev);
 }
 
 static void bnxt_init_dflt_coal(struct bnxt *bp)
@@ -10669,14 +10670,11 @@ static void bnxt_fw_reset_task(struct work_struct *work)
                 bp->fw_reset_state = BNXT_FW_RESET_STATE_RESET_FW;
         }
         /* fall through */
-        case BNXT_FW_RESET_STATE_RESET_FW: {
-                u32 wait_dsecs = bp->fw_health->post_reset_wait_dsecs;
-
+        case BNXT_FW_RESET_STATE_RESET_FW:
                 bnxt_reset_all(bp);
                 bp->fw_reset_state = BNXT_FW_RESET_STATE_ENABLE_DEV;
-                bnxt_queue_fw_reset_work(bp, wait_dsecs * HZ / 10);
+                bnxt_queue_fw_reset_work(bp, bp->fw_reset_min_dsecs * HZ / 10);
                 return;
-        }
         case BNXT_FW_RESET_STATE_ENABLE_DEV:
                 if (test_bit(BNXT_STATE_FW_FATAL_COND, &bp->state) &&
                     bp->fw_health) {
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
index e664392dccc0..7151244f8c7d 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
@@ -29,25 +29,20 @@ static int bnxt_fw_reporter_diagnose(struct devlink_health_reporter *reporter,
         val = bnxt_fw_health_readl(bp, BNXT_FW_HEALTH_REG);
         health_status = val & 0xffff;
 
-        if (health_status == BNXT_FW_STATUS_HEALTHY) {
-                rc = devlink_fmsg_string_pair_put(fmsg, "FW status",
-                                                  "Healthy;");
-                if (rc)
-                        return rc;
-        } else if (health_status < BNXT_FW_STATUS_HEALTHY) {
-                rc = devlink_fmsg_string_pair_put(fmsg, "FW status",
-                                                  "Not yet completed initialization;");
+        if (health_status < BNXT_FW_STATUS_HEALTHY) {
+                rc = devlink_fmsg_string_pair_put(fmsg, "Description",
+                                                  "Not yet completed initialization");
                 if (rc)
                         return rc;
         } else if (health_status > BNXT_FW_STATUS_HEALTHY) {
-                rc = devlink_fmsg_string_pair_put(fmsg, "FW status",
-                                                  "Encountered fatal error and cannot recover;");
+                rc = devlink_fmsg_string_pair_put(fmsg, "Description",
+                                                  "Encountered fatal error and cannot recover");
                 if (rc)
                         return rc;
         }
 
         if (val >> 16) {
-                rc = devlink_fmsg_u32_pair_put(fmsg, "Error", val >> 16);
+                rc = devlink_fmsg_u32_pair_put(fmsg, "Error code", val >> 16);
                 if (rc)
                         return rc;
         }
@@ -215,25 +210,68 @@ enum bnxt_dl_param_id {
 
 static const struct bnxt_dl_nvm_param nvm_params[] = {
         {DEVLINK_PARAM_GENERIC_ID_ENABLE_SRIOV, NVM_OFF_ENABLE_SRIOV,
-         BNXT_NVM_SHARED_CFG, 1},
+         BNXT_NVM_SHARED_CFG, 1, 1},
         {DEVLINK_PARAM_GENERIC_ID_IGNORE_ARI, NVM_OFF_IGNORE_ARI,
-         BNXT_NVM_SHARED_CFG, 1},
+         BNXT_NVM_SHARED_CFG, 1, 1},
         {DEVLINK_PARAM_GENERIC_ID_MSIX_VEC_PER_PF_MAX,
-         NVM_OFF_MSIX_VEC_PER_PF_MAX, BNXT_NVM_SHARED_CFG, 10},
+         NVM_OFF_MSIX_VEC_PER_PF_MAX, BNXT_NVM_SHARED_CFG, 10, 4},
         {DEVLINK_PARAM_GENERIC_ID_MSIX_VEC_PER_PF_MIN,
-         NVM_OFF_MSIX_VEC_PER_PF_MIN, BNXT_NVM_SHARED_CFG, 7},
+         NVM_OFF_MSIX_VEC_PER_PF_MIN, BNXT_NVM_SHARED_CFG, 7, 4},
         {BNXT_DEVLINK_PARAM_ID_GRE_VER_CHECK, NVM_OFF_DIS_GRE_VER_CHECK,
-         BNXT_NVM_SHARED_CFG, 1},
+         BNXT_NVM_SHARED_CFG, 1, 1},
 };
 
+union bnxt_nvm_data {
+        u8      val8;
+        __le32  val32;
+};
+
+static void bnxt_copy_to_nvm_data(union bnxt_nvm_data *dst,
+                                  union devlink_param_value *src,
+                                  int nvm_num_bits, int dl_num_bytes)
+{
+        u32 val32 = 0;
+
+        if (nvm_num_bits == 1) {
+                dst->val8 = src->vbool;
+                return;
+        }
+        if (dl_num_bytes == 4)
+                val32 = src->vu32;
+        else if (dl_num_bytes == 2)
+                val32 = (u32)src->vu16;
+        else if (dl_num_bytes == 1)
+                val32 = (u32)src->vu8;
+        dst->val32 = cpu_to_le32(val32);
+}
+
+static void bnxt_copy_from_nvm_data(union devlink_param_value *dst,
+                                    union bnxt_nvm_data *src,
+                                    int nvm_num_bits, int dl_num_bytes)
+{
+        u32 val32;
+
+        if (nvm_num_bits == 1) {
+                dst->vbool = src->val8;
+                return;
+        }
+        val32 = le32_to_cpu(src->val32);
+        if (dl_num_bytes == 4)
+                dst->vu32 = val32;
+        else if (dl_num_bytes == 2)
+                dst->vu16 = (u16)val32;
+        else if (dl_num_bytes == 1)
+                dst->vu8 = (u8)val32;
+}
+
 static int bnxt_hwrm_nvm_req(struct bnxt *bp, u32 param_id, void *msg,
                              int msg_len, union devlink_param_value *val)
 {
         struct hwrm_nvm_get_variable_input *req = msg;
-        void *data_addr = NULL, *buf = NULL;
         struct bnxt_dl_nvm_param nvm_param;
-        int bytesize, idx = 0, rc, i;
+        union bnxt_nvm_data *data;
         dma_addr_t data_dma_addr;
+        int idx = 0, rc, i;
 
         /* Get/Set NVM CFG parameter is supported only on PFs */
         if (BNXT_VF(bp))
@@ -254,47 +292,31 @@ static int bnxt_hwrm_nvm_req(struct bnxt *bp, u32 param_id, void *msg,
         else if (nvm_param.dir_type == BNXT_NVM_FUNC_CFG)
                 idx = bp->pf.fw_fid - BNXT_FIRST_PF_FID;
 
-        bytesize = roundup(nvm_param.num_bits, BITS_PER_BYTE) / BITS_PER_BYTE;
-        switch (bytesize) {
-        case 1:
-                if (nvm_param.num_bits == 1)
-                        buf = &val->vbool;
-                else
-                        buf = &val->vu8;
-                break;
-        case 2:
-                buf = &val->vu16;
-                break;
-        case 4:
-                buf = &val->vu32;
-                break;
-        default:
-                return -EFAULT;
-        }
-
-        data_addr = dma_alloc_coherent(&bp->pdev->dev, bytesize,
-                                       &data_dma_addr, GFP_KERNEL);
-        if (!data_addr)
+        data = dma_alloc_coherent(&bp->pdev->dev, sizeof(*data),
+                                  &data_dma_addr, GFP_KERNEL);
+        if (!data)
                 return -ENOMEM;
 
         req->dest_data_addr = cpu_to_le64(data_dma_addr);
-        req->data_len = cpu_to_le16(nvm_param.num_bits);
+        req->data_len = cpu_to_le16(nvm_param.nvm_num_bits);
         req->option_num = cpu_to_le16(nvm_param.offset);
         req->index_0 = cpu_to_le16(idx);
         if (idx)
                 req->dimensions = cpu_to_le16(1);
 
         if (req->req_type == cpu_to_le16(HWRM_NVM_SET_VARIABLE)) {
-                memcpy(data_addr, buf, bytesize);
+                bnxt_copy_to_nvm_data(data, val, nvm_param.nvm_num_bits,
+                                      nvm_param.dl_num_bytes);
                 rc = hwrm_send_message(bp, msg, msg_len, HWRM_CMD_TIMEOUT);
         } else {
                 rc = hwrm_send_message_silent(bp, msg, msg_len,
                                               HWRM_CMD_TIMEOUT);
+                if (!rc)
+                        bnxt_copy_from_nvm_data(val, data,
+                                                nvm_param.nvm_num_bits,
+                                                nvm_param.dl_num_bytes);
         }
-        if (!rc && req->req_type == cpu_to_le16(HWRM_NVM_GET_VARIABLE))
-                memcpy(buf, data_addr, bytesize);
-
-        dma_free_coherent(&bp->pdev->dev, bytesize, data_addr, data_dma_addr);
+        dma_free_coherent(&bp->pdev->dev, sizeof(*data), data, data_dma_addr);
         if (rc == -EACCES)
                 netdev_err(bp->dev, "PF does not have admin privileges to modify NVM config\n");
         return rc;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h
index b97e0baeb42d..2f4fd0a7d04b 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h
@@ -52,7 +52,8 @@ struct bnxt_dl_nvm_param {
         u16 id;
         u16 offset;
         u16 dir_type;
-        u16 num_bits;
+        u16 nvm_num_bits;
+        u8 dl_num_bytes;
 };
 
 void bnxt_devlink_health_report(struct bnxt *bp, unsigned long event);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
index a4dead4ab0ed..86b528d8364c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
@@ -695,10 +695,10 @@ static void uld_init(struct adapter *adap, struct cxgb4_lld_info *lld)
         lld->write_cmpl_support = adap->params.write_cmpl_support;
 }
 
-static void uld_attach(struct adapter *adap, unsigned int uld)
+static int uld_attach(struct adapter *adap, unsigned int uld)
 {
-        void *handle;
         struct cxgb4_lld_info lli;
+        void *handle;
 
         uld_init(adap, &lli);
         uld_queue_init(adap, uld, &lli);
@@ -708,7 +708,7 @@ static void uld_attach(struct adapter *adap, unsigned int uld)
                 dev_warn(adap->pdev_dev,
                          "could not attach to the %s driver, error %ld\n",
                          adap->uld[uld].name, PTR_ERR(handle));
-                return;
+                return PTR_ERR(handle);
         }
 
         adap->uld[uld].handle = handle;
@@ -716,22 +716,22 @@ static void uld_attach(struct adapter *adap, unsigned int uld)
 
         if (adap->flags & CXGB4_FULL_INIT_DONE)
                 adap->uld[uld].state_change(handle, CXGB4_STATE_UP);
+
+        return 0;
 }
 
-/**
- *      cxgb4_register_uld - register an upper-layer driver
- *      @type: the ULD type
- *      @p: the ULD methods
+/* cxgb4_register_uld - register an upper-layer driver
+ * @type: the ULD type
+ * @p: the ULD methods
  *
- *      Registers an upper-layer driver with this driver and notifies the ULD
- *      about any presently available devices that support its type.  Returns
- *      %-EBUSY if a ULD of the same type is already registered.
+ * Registers an upper-layer driver with this driver and notifies the ULD
+ * about any presently available devices that support its type.
  */
 void cxgb4_register_uld(enum cxgb4_uld type,
                         const struct cxgb4_uld_info *p)
 {
-        int ret = 0;
         struct adapter *adap;
+        int ret = 0;
 
         if (type >= CXGB4_ULD_MAX)
                 return;
@@ -763,8 +763,12 @@ void cxgb4_register_uld(enum cxgb4_uld type,
                 if (ret)
                         goto free_irq;
                 adap->uld[type] = *p;
-                uld_attach(adap, type);
+                ret = uld_attach(adap, type);
+                if (ret)
+                        goto free_txq;
                 continue;
+free_txq:
+                release_sge_txq_uld(adap, type);
 free_irq:
                 if (adap->flags & CXGB4_FULL_INIT_DONE)
                         quiesce_rx_uld(adap, type);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index b3da81e90132..928bfea5457b 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -3791,15 +3791,11 @@ int t4_sge_alloc_eth_txq(struct adapter *adap, struct sge_eth_txq *txq,
          * write the CIDX Updates into the Status Page at the end of the
          * TX Queue.
          */
-        c.autoequiqe_to_viid = htonl((dbqt
-                                      ? FW_EQ_ETH_CMD_AUTOEQUIQE_F
-                                      : FW_EQ_ETH_CMD_AUTOEQUEQE_F) |
+        c.autoequiqe_to_viid = htonl(FW_EQ_ETH_CMD_AUTOEQUEQE_F |
                                      FW_EQ_ETH_CMD_VIID_V(pi->viid));
 
         c.fetchszm_to_iqid =
-                htonl(FW_EQ_ETH_CMD_HOSTFCMODE_V(dbqt
-                                                 ? HOSTFCMODE_INGRESS_QUEUE_X
-                                                 : HOSTFCMODE_STATUS_PAGE_X) |
+                htonl(FW_EQ_ETH_CMD_HOSTFCMODE_V(HOSTFCMODE_STATUS_PAGE_X) |
                       FW_EQ_ETH_CMD_PCIECHN_V(pi->tx_chan) |
                       FW_EQ_ETH_CMD_FETCHRO_F | FW_EQ_ETH_CMD_IQID_V(iqid));
 
diff --git a/drivers/net/ethernet/cortina/gemini.h b/drivers/net/ethernet/cortina/gemini.h
index 0b12f89bf89a..9fdf77d5eb37 100644
--- a/drivers/net/ethernet/cortina/gemini.h
+++ b/drivers/net/ethernet/cortina/gemini.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 /* Register definitions for Gemini GMAC Ethernet device driver
  *
  * Copyright (C) 2006 Storlink, Corp.
diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
index 9b7af94a40bb..96e9565f1e08 100644
--- a/drivers/net/ethernet/faraday/ftgmac100.c
+++ b/drivers/net/ethernet/faraday/ftgmac100.c
@@ -727,6 +727,18 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,
          */
         nfrags = skb_shinfo(skb)->nr_frags;
 
+        /* Setup HW checksumming */
+        csum_vlan = 0;
+        if (skb->ip_summed == CHECKSUM_PARTIAL &&
+            !ftgmac100_prep_tx_csum(skb, &csum_vlan))
+                goto drop;
+
+        /* Add VLAN tag */
+        if (skb_vlan_tag_present(skb)) {
+                csum_vlan |= FTGMAC100_TXDES1_INS_VLANTAG;
+                csum_vlan |= skb_vlan_tag_get(skb) & 0xffff;
+        }
+
         /* Get header len */
         len = skb_headlen(skb);
 
@@ -753,19 +765,6 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,
         if (nfrags == 0)
                 f_ctl_stat |= FTGMAC100_TXDES0_LTS;
         txdes->txdes3 = cpu_to_le32(map);
-
-        /* Setup HW checksumming */
-        csum_vlan = 0;
-        if (skb->ip_summed == CHECKSUM_PARTIAL &&
-            !ftgmac100_prep_tx_csum(skb, &csum_vlan))
-                goto drop;
-
-        /* Add VLAN tag */
-        if (skb_vlan_tag_present(skb)) {
-                csum_vlan |= FTGMAC100_TXDES1_INS_VLANTAG;
-                csum_vlan |= skb_vlan_tag_get(skb) & 0xffff;
-        }
-
         txdes->txdes1 = cpu_to_le32(csum_vlan);
 
         /* Next descriptor */
diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.h b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.h
index ff2e177395d4..df2458a5e9ef 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.h
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright 2018 NXP
  */
diff --git a/drivers/net/ethernet/freescale/dpaa2/dprtc-cmd.h b/drivers/net/ethernet/freescale/dpaa2/dprtc-cmd.h
index 720cd50f5895..4ac05bfef338 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dprtc-cmd.h
+++ b/drivers/net/ethernet/freescale/dpaa2/dprtc-cmd.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright 2013-2016 Freescale Semiconductor Inc.
  * Copyright 2016-2018 NXP
diff --git a/drivers/net/ethernet/freescale/dpaa2/dprtc.h b/drivers/net/ethernet/freescale/dpaa2/dprtc.h
index be7914c1634d..311c184e1aef 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dprtc.h
+++ b/drivers/net/ethernet/freescale/dpaa2/dprtc.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright 2013-2016 Freescale Semiconductor Inc.
  * Copyright 2016-2018 NXP
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index d4d4c72adf49..22c01b224baa 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3558,7 +3558,7 @@ fec_probe(struct platform_device *pdev)
 
         for (i = 0; i < irq_cnt; i++) {
                 snprintf(irq_name, sizeof(irq_name), "int%d", i);
-                irq = platform_get_irq_byname(pdev, irq_name);
+                irq = platform_get_irq_byname_optional(pdev, irq_name);
                 if (irq < 0)
                         irq = platform_get_irq(pdev, i);
                 if (irq < 0) {
diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
index 19e2365be7d8..945643c02615 100644
--- a/drivers/net/ethernet/freescale/fec_ptp.c
+++ b/drivers/net/ethernet/freescale/fec_ptp.c
@@ -600,9 +600,9 @@ void fec_ptp_init(struct platform_device *pdev, int irq_idx)
 
         INIT_DELAYED_WORK(&fep->time_keep, fec_time_keep);
 
-        irq = platform_get_irq_byname(pdev, "pps");
+        irq = platform_get_irq_byname_optional(pdev, "pps");
         if (irq < 0)
-                irq = platform_get_irq(pdev, irq_idx);
+                irq = platform_get_irq_optional(pdev, irq_idx);
         /* Failure to get an irq is not fatal,
          * only the PTP_CLOCK_PPS clock events should stop
          */
diff --git a/drivers/net/ethernet/google/gve/gve_rx.c b/drivers/net/ethernet/google/gve/gve_rx.c
index 59564ac99d2a..edec61dfc868 100644
--- a/drivers/net/ethernet/google/gve/gve_rx.c
+++ b/drivers/net/ethernet/google/gve/gve_rx.c
@@ -289,6 +289,8 @@ static bool gve_rx(struct gve_rx_ring *rx, struct gve_rx_desc *rx_desc,
 
         len = be16_to_cpu(rx_desc->len) - GVE_RX_PAD;
         page_info = &rx->data.page_info[idx];
+        dma_sync_single_for_cpu(&priv->pdev->dev, rx->data.qpl->page_buses[idx],
+                                PAGE_SIZE, DMA_FROM_DEVICE);
 
         /* gvnic can only receive into registered segments. If the buffer
          * can't be recycled, our only choice is to copy the data out of
diff --git a/drivers/net/ethernet/google/gve/gve_tx.c b/drivers/net/ethernet/google/gve/gve_tx.c
index 778b87b5a06c..0a9a7ee2a866 100644
--- a/drivers/net/ethernet/google/gve/gve_tx.c
+++ b/drivers/net/ethernet/google/gve/gve_tx.c
@@ -390,7 +390,21 @@ static void gve_tx_fill_seg_desc(union gve_tx_desc *seg_desc,
         seg_desc->seg.seg_addr = cpu_to_be64(addr);
 }
 
-static int gve_tx_add_skb(struct gve_tx_ring *tx, struct sk_buff *skb)
+static void gve_dma_sync_for_device(struct device *dev, dma_addr_t *page_buses,
+                                    u64 iov_offset, u64 iov_len)
+{
+        dma_addr_t dma;
+        u64 addr;
+
+        for (addr = iov_offset; addr < iov_offset + iov_len;
+             addr += PAGE_SIZE) {
+                dma = page_buses[addr / PAGE_SIZE];
+                dma_sync_single_for_device(dev, dma, PAGE_SIZE, DMA_TO_DEVICE);
+        }
+}
+
+static int gve_tx_add_skb(struct gve_tx_ring *tx, struct sk_buff *skb,
+                          struct device *dev)
 {
         int pad_bytes, hlen, hdr_nfrags, payload_nfrags, l4_hdr_offset;
         union gve_tx_desc *pkt_desc, *seg_desc;
@@ -432,6 +446,9 @@ static int gve_tx_add_skb(struct gve_tx_ring *tx, struct sk_buff *skb)
         skb_copy_bits(skb, 0,
                       tx->tx_fifo.base + info->iov[hdr_nfrags - 1].iov_offset,
                       hlen);
+        gve_dma_sync_for_device(dev, tx->tx_fifo.qpl->page_buses,
+                                info->iov[hdr_nfrags - 1].iov_offset,
+                                info->iov[hdr_nfrags - 1].iov_len);
         copy_offset = hlen;
 
         for (i = payload_iov; i < payload_nfrags + payload_iov; i++) {
@@ -445,6 +462,9 @@ static int gve_tx_add_skb(struct gve_tx_ring *tx, struct sk_buff *skb)
                 skb_copy_bits(skb, copy_offset,
                               tx->tx_fifo.base + info->iov[i].iov_offset,
                               info->iov[i].iov_len);
+                gve_dma_sync_for_device(dev, tx->tx_fifo.qpl->page_buses,
+                                        info->iov[i].iov_offset,
+                                        info->iov[i].iov_len);
                 copy_offset += info->iov[i].iov_len;
         }
 
@@ -473,7 +493,7 @@ netdev_tx_t gve_tx(struct sk_buff *skb, struct net_device *dev)
                 gve_tx_put_doorbell(priv, tx->q_resources, tx->req);
                 return NETDEV_TX_BUSY;
         }
-        nsegs = gve_tx_add_skb(tx, skb);
+        nsegs = gve_tx_add_skb(tx, skb, &priv->pdev->dev);
 
         netdev_tx_sent_queue(tx->netdev_txq, skb->len);
         skb_tx_timestamp(skb);
diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
index c84167447abe..4606a7e4a6d1 100644
--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
@@ -237,6 +237,7 @@ struct hip04_priv {
         dma_addr_t rx_phys[RX_DESC_NUM];
         unsigned int rx_head;
         unsigned int rx_buf_size;
+        unsigned int rx_cnt_remaining;
 
         struct device_node *phy_node;
         struct phy_device *phy;
@@ -575,7 +576,6 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget)
         struct hip04_priv *priv = container_of(napi, struct hip04_priv, napi);
         struct net_device *ndev = priv->ndev;
         struct net_device_stats *stats = &ndev->stats;
-        unsigned int cnt = hip04_recv_cnt(priv);
         struct rx_desc *desc;
         struct sk_buff *skb;
         unsigned char *buf;
@@ -588,8 +588,8 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget)
 
         /* clean up tx descriptors */
         tx_remaining = hip04_tx_reclaim(ndev, false);
-
-        while (cnt && !last) {
+        priv->rx_cnt_remaining += hip04_recv_cnt(priv);
+        while (priv->rx_cnt_remaining && !last) {
                 buf = priv->rx_buf[priv->rx_head];
                 skb = build_skb(buf, priv->rx_buf_size);
                 if (unlikely(!skb)) {
@@ -635,11 +635,13 @@ refill:
                 hip04_set_recv_desc(priv, phys);
 
                 priv->rx_head = RX_NEXT(priv->rx_head);
-                if (rx >= budget)
+                if (rx >= budget) {
+                        --priv->rx_cnt_remaining;
                         goto done;
+                }
 
-                if (--cnt == 0)
-                        cnt = hip04_recv_cnt(priv);
+                if (--priv->rx_cnt_remaining == 0)
+                        priv->rx_cnt_remaining += hip04_recv_cnt(priv);
         }
 
         if (!(priv->reg_inten & RCV_INT)) {
@@ -724,6 +726,7 @@ static int hip04_mac_open(struct net_device *ndev)
         int i;
 
         priv->rx_head = 0;
+        priv->rx_cnt_remaining = 0;
         priv->tx_head = 0;
         priv->tx_tail = 0;
         hip04_reset_ppe(priv);
@@ -1038,7 +1041,6 @@ static int hip04_remove(struct platform_device *pdev)
 
         hip04_free_ring(ndev, d);
         unregister_netdev(ndev);
-        free_irq(ndev->irq, ndev);
         of_node_put(priv->phy_node);
         cancel_work_sync(&priv->tx_timeout_task);
         free_netdev(ndev);
diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
index 71d3d8854d8f..be56e631d693 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
@@ -607,6 +607,7 @@ static int e1000_set_ringparam(struct net_device *netdev,
         for (i = 0; i < adapter->num_rx_queues; i++)
                 rxdr[i].count = rxdr->count;
 
+        err = 0;
         if (netif_running(adapter->netdev)) {
                 /* Try to get new resources before deleting old */
                 err = e1000_setup_all_rx_resources(adapter);
@@ -627,14 +628,13 @@ static int e1000_set_ringparam(struct net_device *netdev,
                 adapter->rx_ring = rxdr;
                 adapter->tx_ring = txdr;
                 err = e1000_up(adapter);
-                if (err)
-                        goto err_setup;
         }
         kfree(tx_old);
         kfree(rx_old);
 
         clear_bit(__E1000_RESETTING, &adapter->flags);
-        return 0;
+        return err;
+
 err_setup_tx:
         e1000_free_all_rx_resources(adapter);
 err_setup_rx:
@@ -646,7 +646,6 @@ err_alloc_rx:
 err_alloc_tx:
         if (netif_running(adapter->netdev))
                 e1000_up(adapter);
-err_setup:
         clear_bit(__E1000_RESETTING, &adapter->flags);
         return err;
 }
diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
index b1c3227ae4ab..a05dfecdd9b4 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
@@ -157,11 +157,6 @@ static int i40e_xsk_umem_disable(struct i40e_vsi *vsi, u16 qid)
                 err = i40e_queue_pair_enable(vsi, qid);
                 if (err)
                         return err;
-
-                /* Kick start the NAPI context so that receiving will start */
-                err = i40e_xsk_wakeup(vsi->netdev, qid, XDP_WAKEUP_RX);
-                if (err)
-                        return err;
         }
 
         return 0;
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index 3ec2ce0725d5..8a6ef3514129 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -466,7 +466,7 @@ static s32 igb_init_mac_params_82575(struct e1000_hw *hw)
                         ? igb_setup_copper_link_82575
                         : igb_setup_serdes_link_82575;
 
-        if (mac->type == e1000_82580) {
+        if (mac->type == e1000_82580 || mac->type == e1000_i350) {
                 switch (hw->device_id) {
                 /* feature not supported on these id's */
                 case E1000_DEV_ID_DH89XXCC_SGMII:
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 105b0624081a..9148c62d9ac5 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -753,7 +753,8 @@ u32 igb_rd32(struct e1000_hw *hw, u32 reg)
                 struct net_device *netdev = igb->netdev;
                 hw->hw_addr = NULL;
                 netdev_err(netdev, "PCIe link lost\n");
-                WARN(1, "igb: Failed to read reg 0x%x!\n", reg);
+                WARN(pci_device_is_present(igb->pdev),
+                     "igb: Failed to read reg 0x%x!\n", reg);
         }
 
         return value;
@@ -2064,7 +2065,8 @@ static void igb_check_swap_media(struct igb_adapter *adapter)
         if ((hw->phy.media_type == e1000_media_type_copper) &&
             (!(connsw & E1000_CONNSW_AUTOSENSE_EN))) {
                 swap_now = true;
-        } else if (!(connsw & E1000_CONNSW_SERDESD)) {
+        } else if ((hw->phy.media_type != e1000_media_type_copper) &&
+                   !(connsw & E1000_CONNSW_SERDESD)) {
                 /* copper signal takes time to appear */
                 if (adapter->copper_tries < 4) {
                         adapter->copper_tries++;
@@ -2370,7 +2372,7 @@ void igb_reset(struct igb_adapter *adapter)
                 adapter->ei.get_invariants(hw);
                 adapter->flags &= ~IGB_FLAG_MEDIA_RESET;
         }
-        if ((mac->type == e1000_82575) &&
+        if ((mac->type == e1000_82575 || mac->type == e1000_i350) &&
             (adapter->flags & IGB_FLAG_MAS_ENABLE)) {
                 igb_enable_mas(adapter);
         }
diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
index 63b62d74f961..8e424dfab12e 100644
--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
@@ -4047,7 +4047,8 @@ u32 igc_rd32(struct igc_hw *hw, u32 reg)
                 hw->hw_addr = NULL;
                 netif_device_detach(netdev);
                 netdev_err(netdev, "PCIe link lost, device now detached\n");
-                WARN(1, "igc: Failed to read reg 0x%x!\n", reg);
+                WARN(pci_device_is_present(igc->pdev),
+                     "igc: Failed to read reg 0x%x!\n", reg);
         }
 
         return value;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 1ce2397306b9..91b3780ddb04 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -4310,7 +4310,6 @@ static void ixgbe_set_rx_buffer_len(struct ixgbe_adapter *adapter)
                 if (test_bit(__IXGBE_RX_FCOE, &rx_ring->state))
                         set_bit(__IXGBE_RX_3K_BUFFER, &rx_ring->state);
 
-                clear_bit(__IXGBE_RX_BUILD_SKB_ENABLED, &rx_ring->state);
                 if (adapter->flags2 & IXGBE_FLAG2_RX_LEGACY)
                         continue;
 
diff --git a/drivers/net/ethernet/marvell/mvneta_bm.h b/drivers/net/ethernet/marvell/mvneta_bm.h
index c8425d35c049..e47783ce77e0 100644
--- a/drivers/net/ethernet/marvell/mvneta_bm.h
+++ b/drivers/net/ethernet/marvell/mvneta_bm.h
@@ -160,16 +160,23 @@ static inline u32 mvneta_bm_pool_get_bp(struct mvneta_bm *priv,
                              (bm_pool->id << MVNETA_BM_POOL_ACCESS_OFFS));
 }
 #else
-void mvneta_bm_pool_destroy(struct mvneta_bm *priv,
-                            struct mvneta_bm_pool *bm_pool, u8 port_map) {}
-void mvneta_bm_bufs_free(struct mvneta_bm *priv, struct mvneta_bm_pool *bm_pool,
-                         u8 port_map) {}
-int mvneta_bm_construct(struct hwbm_pool *hwbm_pool, void *buf) { return 0; }
-int mvneta_bm_pool_refill(struct mvneta_bm *priv,
-                          struct mvneta_bm_pool *bm_pool) {return 0; }
-struct mvneta_bm_pool *mvneta_bm_pool_use(struct mvneta_bm *priv, u8 pool_id,
-                                          enum mvneta_bm_type type, u8 port_id,
-                                          int pkt_size) { return NULL; }
+static inline void mvneta_bm_pool_destroy(struct mvneta_bm *priv,
+                                          struct mvneta_bm_pool *bm_pool,
+                                          u8 port_map) {}
+static inline void mvneta_bm_bufs_free(struct mvneta_bm *priv,
+                                       struct mvneta_bm_pool *bm_pool,
+                                       u8 port_map) {}
+static inline int mvneta_bm_construct(struct hwbm_pool *hwbm_pool, void *buf)
+{ return 0; }
+static inline int mvneta_bm_pool_refill(struct mvneta_bm *priv,
+                                        struct mvneta_bm_pool *bm_pool)
+{ return 0; }
+static inline struct mvneta_bm_pool *mvneta_bm_pool_use(struct mvneta_bm *priv,
+                                                        u8 pool_id,
+                                                        enum mvneta_bm_type type,
+                                                        u8 port_id,
+                                                        int pkt_size)
+{ return NULL; }
 
 static inline void mvneta_bm_pool_put_bp(struct mvneta_bm *priv,
                                          struct mvneta_bm_pool *bm_pool,
@@ -178,7 +185,8 @@ static inline void mvneta_bm_pool_put_bp(struct mvneta_bm *priv,
 static inline u32 mvneta_bm_pool_get_bp(struct mvneta_bm *priv,
                                         struct mvneta_bm_pool *bm_pool)
 { return 0; }
-struct mvneta_bm *mvneta_bm_get(struct device_node *node) { return NULL; }
-void mvneta_bm_put(struct mvneta_bm *priv) {}
+static inline struct mvneta_bm *mvneta_bm_get(struct device_node *node)
+{ return NULL; }
+static inline void mvneta_bm_put(struct mvneta_bm *priv) {}
 #endif /* CONFIG_MVNETA_BM */
 #endif
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 4356f3a58002..1187ef1375e2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -471,12 +471,31 @@ void mlx4_init_quotas(struct mlx4_dev *dev)
                 priv->mfunc.master.res_tracker.res_alloc[RES_MPT].quota[pf];
 }
 
-static int get_max_gauranteed_vfs_counter(struct mlx4_dev *dev)
+static int
+mlx4_calc_res_counter_guaranteed(struct mlx4_dev *dev,
+                                 struct resource_allocator *res_alloc,
+                                 int vf)
 {
-        /* reduce the sink counter */
-        return (dev->caps.max_counters - 1 -
-                (MLX4_PF_COUNTERS_PER_PORT * MLX4_MAX_PORTS))
-                / MLX4_MAX_PORTS;
+        struct mlx4_active_ports actv_ports;
+        int ports, counters_guaranteed;
+
+        /* For master, only allocate according to the number of phys ports */
+        if (vf == mlx4_master_func_num(dev))
+                return MLX4_PF_COUNTERS_PER_PORT * dev->caps.num_ports;
+
+        /* calculate real number of ports for the VF */
+        actv_ports = mlx4_get_active_ports(dev, vf);
+        ports = bitmap_weight(actv_ports.ports, dev->caps.num_ports);
+        counters_guaranteed = ports * MLX4_VF_COUNTERS_PER_PORT;
+
+        /* If we do not have enough counters for this VF, do not
+         * allocate any for it. '-1' to reduce the sink counter.
+         */
+        if ((res_alloc->res_reserved + counters_guaranteed) >
+            (dev->caps.max_counters - 1))
+                return 0;
+
+        return counters_guaranteed;
 }
 
 int mlx4_init_resource_tracker(struct mlx4_dev *dev)
@@ -484,7 +503,6 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
         struct mlx4_priv *priv = mlx4_priv(dev);
         int i, j;
         int t;
-        int max_vfs_guarantee_counter = get_max_gauranteed_vfs_counter(dev);
 
         priv->mfunc.master.res_tracker.slave_list =
                 kcalloc(dev->num_slaves, sizeof(struct slave_list),
@@ -603,16 +621,8 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
                                 break;
                         case RES_COUNTER:
                                 res_alloc->quota[t] = dev->caps.max_counters;
-                                if (t == mlx4_master_func_num(dev))
-                                        res_alloc->guaranteed[t] =
-                                                MLX4_PF_COUNTERS_PER_PORT *
-                                                MLX4_MAX_PORTS;
-                                else if (t <= max_vfs_guarantee_counter)
-                                        res_alloc->guaranteed[t] =
-                                                MLX4_VF_COUNTERS_PER_PORT *
-                                                MLX4_MAX_PORTS;
-                                else
-                                        res_alloc->guaranteed[t] = 0;
+                                res_alloc->guaranteed[t] =
+                                        mlx4_calc_res_counter_guaranteed(dev, res_alloc, t);
                                 break;
                         default:
                                 break;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 8d76452cacdc..f1a7bc46f1c0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -345,7 +345,7 @@ struct mlx5e_tx_wqe_info {
         u8  num_wqebbs;
         u8  num_dma;
 #ifdef CONFIG_MLX5_EN_TLS
-        skb_frag_t *resync_dump_frag;
+        struct page *resync_dump_frag_page;
 #endif
 };
 
@@ -410,6 +410,7 @@ struct mlx5e_txqsq {
         struct device             *pdev;
         __be32                     mkey_be;
         unsigned long              state;
+        unsigned int               hw_mtu;
         struct hwtstamp_config    *tstamp;
         struct mlx5_clock         *clock;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c
index b3a249b2a482..ac44bbe95c5c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c
@@ -141,7 +141,7 @@ int mlx5e_hv_vhca_stats_create(struct mlx5e_priv *priv)
                                     "Failed to create hv vhca stats agent, err = %ld\n",
                                     PTR_ERR(agent));
 
-                kfree(priv->stats_agent.buf);
+                kvfree(priv->stats_agent.buf);
                 return IS_ERR_OR_NULL(agent);
         }
 
@@ -157,5 +157,5 @@ void mlx5e_hv_vhca_stats_destroy(struct mlx5e_priv *priv)
                 return;
 
         mlx5_hv_vhca_agent_destroy(priv->stats_agent.agent);
-        kfree(priv->stats_agent.buf);
+        kvfree(priv->stats_agent.buf);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
index f8ee18b4da6f..13af72556987 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
@@ -97,15 +97,19 @@ static int mlx5e_route_lookup_ipv4(struct mlx5e_priv *priv,
         if (ret)
                 return ret;
 
-        if (mlx5_lag_is_multipath(mdev) && rt->rt_gw_family != AF_INET)
+        if (mlx5_lag_is_multipath(mdev) && rt->rt_gw_family != AF_INET) {
+                ip_rt_put(rt);
                 return -ENETUNREACH;
+        }
 #else
         return -EOPNOTSUPP;
 #endif
 
         ret = get_route_and_out_devs(priv, rt->dst.dev, route_dev, out_dev);
-        if (ret < 0)
+        if (ret < 0) {
+                ip_rt_put(rt);
                 return ret;
+        }
 
         if (!(*out_ttl))
                 *out_ttl = ip4_dst_hoplimit(&rt->dst);
@@ -149,8 +153,10 @@ static int mlx5e_route_lookup_ipv6(struct mlx5e_priv *priv,
                 *out_ttl = ip6_dst_hoplimit(dst);
 
         ret = get_route_and_out_devs(priv, dst->dev, route_dev, out_dev);
-        if (ret < 0)
+        if (ret < 0) {
+                dst_release(dst);
                 return ret;
+        }
 #else
         return -EOPNOTSUPP;
 #endif
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h
index 87be96747902..7c8796d9743f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h
@@ -15,15 +15,14 @@
 #else
 /* TLS offload requires additional stop_room for:
  *  - a resync SKB.
- * kTLS offload requires additional stop_room for:
- * - static params WQE,
- * - progress params WQE, and
- * - resync DUMP per frag.
+ * kTLS offload requires fixed additional stop_room for:
+ * - a static params WQE, and a progress params WQE.
+ * The additional MTU-depending room for the resync DUMP WQEs
+ * will be calculated and added in runtime.
  */
 #define MLX5E_SQ_TLS_ROOM  \
         (MLX5_SEND_WQE_MAX_WQEBBS + \
-         MLX5E_KTLS_STATIC_WQEBBS + MLX5E_KTLS_PROGRESS_WQEBBS + \
-         MAX_SKB_FRAGS * MLX5E_KTLS_MAX_DUMP_WQEBBS)
+         MLX5E_KTLS_STATIC_WQEBBS + MLX5E_KTLS_PROGRESS_WQEBBS)
 #endif
 
 #define INL_HDR_START_SZ (sizeof(((struct mlx5_wqe_eth_seg *)NULL)->inline_hdr.start))
@@ -92,7 +91,7 @@ mlx5e_fill_sq_frag_edge(struct mlx5e_txqsq *sq, struct mlx5_wq_cyc *wq,
 
         /* fill sq frag edge with nops to avoid wqe wrapping two pages */
         for (; wi < edge_wi; wi++) {
-                wi->skb        = NULL;
+                memset(wi, 0, sizeof(*wi));
                 wi->num_wqebbs = 1;
                 mlx5e_post_nop(wq, sq->sqn, &sq->pc);
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.c
index d2ff74d52720..46725cd743a3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.c
@@ -38,7 +38,7 @@ static int mlx5e_ktls_add(struct net_device *netdev, struct sock *sk,
                 return -ENOMEM;
 
         tx_priv->expected_seq = start_offload_tcp_sn;
-        tx_priv->crypto_info  = crypto_info;
+        tx_priv->crypto_info  = *(struct tls12_crypto_info_aes_gcm_128 *)crypto_info;
         mlx5e_set_ktls_tx_priv_ctx(tls_ctx, tx_priv);
 
         /* tc and underlay_qpn values are not in use for tls tis */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h
index b7298f9ee3d3..a3efa29a4629 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h
@@ -21,7 +21,14 @@
          MLX5_ST_SZ_BYTES(tls_progress_params))
 #define MLX5E_KTLS_PROGRESS_WQEBBS \
         (DIV_ROUND_UP(MLX5E_KTLS_PROGRESS_WQE_SZ, MLX5_SEND_WQE_BB))
-#define MLX5E_KTLS_MAX_DUMP_WQEBBS 2
+
+struct mlx5e_dump_wqe {
+        struct mlx5_wqe_ctrl_seg ctrl;
+        struct mlx5_wqe_data_seg data;
+};
+
+#define MLX5E_KTLS_DUMP_WQEBBS \
+        (DIV_ROUND_UP(sizeof(struct mlx5e_dump_wqe), MLX5_SEND_WQE_BB))
 
 enum {
         MLX5E_TLS_PROGRESS_PARAMS_AUTH_STATE_NO_OFFLOAD     = 0,
@@ -37,7 +44,7 @@ enum {
 
 struct mlx5e_ktls_offload_context_tx {
         struct tls_offload_context_tx *tx_ctx;
-        struct tls_crypto_info *crypto_info;
+        struct tls12_crypto_info_aes_gcm_128 crypto_info;
         u32 expected_seq;
         u32 tisn;
         u32 key_id;
@@ -86,14 +93,28 @@ struct sk_buff *mlx5e_ktls_handle_tx_skb(struct net_device *netdev,
                                          struct mlx5e_tx_wqe **wqe, u16 *pi);
 void mlx5e_ktls_tx_handle_resync_dump_comp(struct mlx5e_txqsq *sq,
                                            struct mlx5e_tx_wqe_info *wi,
-                                           struct mlx5e_sq_dma *dma);
-
+                                           u32 *dma_fifo_cc);
+static inline u8
+mlx5e_ktls_dumps_num_wqebbs(struct mlx5e_txqsq *sq, unsigned int nfrags,
+                            unsigned int sync_len)
+{
+        /* Given the MTU and sync_len, calculates an upper bound for the
+         * number of WQEBBs needed for the TX resync DUMP WQEs of a record.
+         */
+        return MLX5E_KTLS_DUMP_WQEBBS *
+                (nfrags + DIV_ROUND_UP(sync_len, sq->hw_mtu));
+}
 #else
 
 static inline void mlx5e_ktls_build_netdev(struct mlx5e_priv *priv)
 {
 }
 
+static inline void
+mlx5e_ktls_tx_handle_resync_dump_comp(struct mlx5e_txqsq *sq,
+                                      struct mlx5e_tx_wqe_info *wi,
+                                      u32 *dma_fifo_cc) {}
+
 #endif
 
 #endif /* __MLX5E_TLS_H__ */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c
index d195366461c9..778dab1af8fc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c
@@ -24,17 +24,12 @@ enum {
 static void
 fill_static_params_ctx(void *ctx, struct mlx5e_ktls_offload_context_tx *priv_tx)
 {
-        struct tls_crypto_info *crypto_info = priv_tx->crypto_info;
-        struct tls12_crypto_info_aes_gcm_128 *info;
+        struct tls12_crypto_info_aes_gcm_128 *info = &priv_tx->crypto_info;
         char *initial_rn, *gcm_iv;
         u16 salt_sz, rec_seq_sz;
         char *salt, *rec_seq;
         u8 tls_version;
 
-        if (WARN_ON(crypto_info->cipher_type != TLS_CIPHER_AES_GCM_128))
-                return;
-
-        info = (struct tls12_crypto_info_aes_gcm_128 *)crypto_info;
         EXTRACT_INFO_FIELDS;
 
         gcm_iv      = MLX5_ADDR_OF(tls_static_params, ctx, gcm_iv);
@@ -108,16 +103,15 @@ build_progress_params(struct mlx5e_tx_wqe *wqe, u16 pc, u32 sqn,
 }
 
 static void tx_fill_wi(struct mlx5e_txqsq *sq,
-                       u16 pi, u8 num_wqebbs,
-                       skb_frag_t *resync_dump_frag,
-                       u32 num_bytes)
+                       u16 pi, u8 num_wqebbs, u32 num_bytes,
+                       struct page *page)
 {
         struct mlx5e_tx_wqe_info *wi = &sq->db.wqe_info[pi];
 
-        wi->skb              = NULL;
-        wi->num_wqebbs       = num_wqebbs;
-        wi->resync_dump_frag = resync_dump_frag;
-        wi->num_bytes        = num_bytes;
+        memset(wi, 0, sizeof(*wi));
+        wi->num_wqebbs = num_wqebbs;
+        wi->num_bytes  = num_bytes;
+        wi->resync_dump_frag_page = page;
 }
 
 void mlx5e_ktls_tx_offload_set_pending(struct mlx5e_ktls_offload_context_tx *priv_tx)
@@ -145,7 +139,7 @@ post_static_params(struct mlx5e_txqsq *sq,
 
         umr_wqe = mlx5e_sq_fetch_wqe(sq, MLX5E_KTLS_STATIC_UMR_WQE_SZ, &pi);
         build_static_params(umr_wqe, sq->pc, sq->sqn, priv_tx, fence);
-        tx_fill_wi(sq, pi, MLX5E_KTLS_STATIC_WQEBBS, NULL, 0);
+        tx_fill_wi(sq, pi, MLX5E_KTLS_STATIC_WQEBBS, 0, NULL);
         sq->pc += MLX5E_KTLS_STATIC_WQEBBS;
 }
 
@@ -159,7 +153,7 @@ post_progress_params(struct mlx5e_txqsq *sq,
 
         wqe = mlx5e_sq_fetch_wqe(sq, MLX5E_KTLS_PROGRESS_WQE_SZ, &pi);
         build_progress_params(wqe, sq->pc, sq->sqn, priv_tx, fence);
-        tx_fill_wi(sq, pi, MLX5E_KTLS_PROGRESS_WQEBBS, NULL, 0);
+        tx_fill_wi(sq, pi, MLX5E_KTLS_PROGRESS_WQEBBS, 0, NULL);
         sq->pc += MLX5E_KTLS_PROGRESS_WQEBBS;
 }
 
@@ -169,6 +163,14 @@ mlx5e_ktls_tx_post_param_wqes(struct mlx5e_txqsq *sq,
                               bool skip_static_post, bool fence_first_post)
 {
         bool progress_fence = skip_static_post || !fence_first_post;
+        struct mlx5_wq_cyc *wq = &sq->wq;
+        u16 contig_wqebbs_room, pi;
+
+        pi = mlx5_wq_cyc_ctr2ix(wq, sq->pc);
+        contig_wqebbs_room = mlx5_wq_cyc_get_contig_wqebbs(wq, pi);
+        if (unlikely(contig_wqebbs_room <
+                     MLX5E_KTLS_STATIC_WQEBBS + MLX5E_KTLS_PROGRESS_WQEBBS))
+                mlx5e_fill_sq_frag_edge(sq, wq, pi, contig_wqebbs_room);
 
         if (!skip_static_post)
                 post_static_params(sq, priv_tx, fence_first_post);
@@ -180,29 +182,36 @@ struct tx_sync_info {
         u64 rcd_sn;
         s32 sync_len;
         int nr_frags;
-        skb_frag_t *frags[MAX_SKB_FRAGS];
+        skb_frag_t frags[MAX_SKB_FRAGS];
+};
+
+enum mlx5e_ktls_sync_retval {
+        MLX5E_KTLS_SYNC_DONE,
+        MLX5E_KTLS_SYNC_FAIL,
+        MLX5E_KTLS_SYNC_SKIP_NO_DATA,
 };
 
-static bool tx_sync_info_get(struct mlx5e_ktls_offload_context_tx *priv_tx,
-                             u32 tcp_seq, struct tx_sync_info *info)
+static enum mlx5e_ktls_sync_retval
+tx_sync_info_get(struct mlx5e_ktls_offload_context_tx *priv_tx,
+                 u32 tcp_seq, struct tx_sync_info *info)
 {
         struct tls_offload_context_tx *tx_ctx = priv_tx->tx_ctx;
+        enum mlx5e_ktls_sync_retval ret = MLX5E_KTLS_SYNC_DONE;
         struct tls_record_info *record;
         int remaining, i = 0;
         unsigned long flags;
-        bool ret = true;
 
         spin_lock_irqsave(&tx_ctx->lock, flags);
         record = tls_get_record(tx_ctx, tcp_seq, &info->rcd_sn);
 
         if (unlikely(!record)) {
-                ret = false;
+                ret = MLX5E_KTLS_SYNC_FAIL;
                 goto out;
         }
 
         if (unlikely(tcp_seq < tls_record_start_seq(record))) {
-                if (!tls_record_is_start_marker(record))
-                        ret = false;
+                ret = tls_record_is_start_marker(record) ?
+                        MLX5E_KTLS_SYNC_SKIP_NO_DATA : MLX5E_KTLS_SYNC_FAIL;
                 goto out;
         }
 
@@ -211,13 +220,13 @@ static bool tx_sync_info_get(struct mlx5e_ktls_offload_context_tx *priv_tx,
         while (remaining > 0) {
                 skb_frag_t *frag = &record->frags[i];
 
-                __skb_frag_ref(frag);
+                get_page(skb_frag_page(frag));
                 remaining -= skb_frag_size(frag);
-                info->frags[i++] = frag;
+                info->frags[i++] = *frag;
         }
         /* reduce the part which will be sent with the original SKB */
         if (remaining < 0)
-                skb_frag_size_add(info->frags[i - 1], remaining);
+                skb_frag_size_add(&info->frags[i - 1], remaining);
         info->nr_frags = i;
 out:
         spin_unlock_irqrestore(&tx_ctx->lock, flags);
@@ -229,17 +238,12 @@ tx_post_resync_params(struct mlx5e_txqsq *sq,
                       struct mlx5e_ktls_offload_context_tx *priv_tx,
                       u64 rcd_sn)
 {
-        struct tls_crypto_info *crypto_info = priv_tx->crypto_info;
-        struct tls12_crypto_info_aes_gcm_128 *info;
+        struct tls12_crypto_info_aes_gcm_128 *info = &priv_tx->crypto_info;
         __be64 rn_be = cpu_to_be64(rcd_sn);
         bool skip_static_post;
         u16 rec_seq_sz;
         char *rec_seq;
 
-        if (WARN_ON(crypto_info->cipher_type != TLS_CIPHER_AES_GCM_128))
-                return;
-
-        info = (struct tls12_crypto_info_aes_gcm_128 *)crypto_info;
         rec_seq = info->rec_seq;
         rec_seq_sz = sizeof(info->rec_seq);
 
@@ -250,11 +254,6 @@ tx_post_resync_params(struct mlx5e_txqsq *sq,
         mlx5e_ktls_tx_post_param_wqes(sq, priv_tx, skip_static_post, true);
 }
 
-struct mlx5e_dump_wqe {
-        struct mlx5_wqe_ctrl_seg ctrl;
-        struct mlx5_wqe_data_seg data;
-};
-
 static int
 tx_post_resync_dump(struct mlx5e_txqsq *sq, skb_frag_t *frag, u32 tisn, bool first)
 {
@@ -262,7 +261,6 @@ tx_post_resync_dump(struct mlx5e_txqsq *sq, skb_frag_t *frag, u32 tisn, bool fir
         struct mlx5_wqe_data_seg *dseg;
         struct mlx5e_dump_wqe *wqe;
         dma_addr_t dma_addr = 0;
-        u8  num_wqebbs;
         u16 ds_cnt;
         int fsz;
         u16 pi;
@@ -270,7 +268,6 @@ tx_post_resync_dump(struct mlx5e_txqsq *sq, skb_frag_t *frag, u32 tisn, bool fir
         wqe = mlx5e_sq_fetch_wqe(sq, sizeof(*wqe), &pi);
 
         ds_cnt = sizeof(*wqe) / MLX5_SEND_WQE_DS;
-        num_wqebbs = DIV_ROUND_UP(ds_cnt, MLX5_SEND_WQEBB_NUM_DS);
 
         cseg = &wqe->ctrl;
         dseg = &wqe->data;
@@ -291,24 +288,27 @@ tx_post_resync_dump(struct mlx5e_txqsq *sq, skb_frag_t *frag, u32 tisn, bool fir
         dseg->byte_count = cpu_to_be32(fsz);
         mlx5e_dma_push(sq, dma_addr, fsz, MLX5E_DMA_MAP_PAGE);
 
-        tx_fill_wi(sq, pi, num_wqebbs, frag, fsz);
-        sq->pc += num_wqebbs;
-
-        WARN(num_wqebbs > MLX5E_KTLS_MAX_DUMP_WQEBBS,
-             "unexpected DUMP num_wqebbs, %d > %d",
-             num_wqebbs, MLX5E_KTLS_MAX_DUMP_WQEBBS);
+        tx_fill_wi(sq, pi, MLX5E_KTLS_DUMP_WQEBBS, fsz, skb_frag_page(frag));
+        sq->pc += MLX5E_KTLS_DUMP_WQEBBS;
 
         return 0;
 }
 
 void mlx5e_ktls_tx_handle_resync_dump_comp(struct mlx5e_txqsq *sq,
                                            struct mlx5e_tx_wqe_info *wi,
-                                           struct mlx5e_sq_dma *dma)
+                                           u32 *dma_fifo_cc)
 {
-        struct mlx5e_sq_stats *stats = sq->stats;
+        struct mlx5e_sq_stats *stats;
+        struct mlx5e_sq_dma *dma;
+
+        if (!wi->resync_dump_frag_page)
+                return;
+
+        dma = mlx5e_dma_get(sq, (*dma_fifo_cc)++);
+        stats = sq->stats;
 
         mlx5e_tx_dma_unmap(sq->pdev, dma);
-        __skb_frag_unref(wi->resync_dump_frag);
+        put_page(wi->resync_dump_frag_page);
         stats->tls_dump_packets++;
         stats->tls_dump_bytes += wi->num_bytes;
 }
@@ -318,25 +318,31 @@ static void tx_post_fence_nop(struct mlx5e_txqsq *sq)
         struct mlx5_wq_cyc *wq = &sq->wq;
         u16 pi = mlx5_wq_cyc_ctr2ix(wq, sq->pc);
 
-        tx_fill_wi(sq, pi, 1, NULL, 0);
+        tx_fill_wi(sq, pi, 1, 0, NULL);
 
         mlx5e_post_nop_fence(wq, sq->sqn, &sq->pc);
 }
 
-static struct sk_buff *
+static enum mlx5e_ktls_sync_retval
 mlx5e_ktls_tx_handle_ooo(struct mlx5e_ktls_offload_context_tx *priv_tx,
                          struct mlx5e_txqsq *sq,
-                         struct sk_buff *skb,
+                         int datalen,
                          u32 seq)
 {
         struct mlx5e_sq_stats *stats = sq->stats;
         struct mlx5_wq_cyc *wq = &sq->wq;
+        enum mlx5e_ktls_sync_retval ret;
         struct tx_sync_info info = {};
         u16 contig_wqebbs_room, pi;
         u8 num_wqebbs;
-        int i;
-
-        if (!tx_sync_info_get(priv_tx, seq, &info)) {
+        int i = 0;
+
+        ret = tx_sync_info_get(priv_tx, seq, &info);
+        if (unlikely(ret != MLX5E_KTLS_SYNC_DONE)) {
+                if (ret == MLX5E_KTLS_SYNC_SKIP_NO_DATA) {
+                        stats->tls_skip_no_sync_data++;
+                        return MLX5E_KTLS_SYNC_SKIP_NO_DATA;
+                }
                 /* We might get here if a retransmission reaches the driver
                  * after the relevant record is acked.
                  * It should be safe to drop the packet in this case
@@ -346,13 +352,8 @@ mlx5e_ktls_tx_handle_ooo(struct mlx5e_ktls_offload_context_tx *priv_tx,
         }
 
         if (unlikely(info.sync_len < 0)) {
-                u32 payload;
-                int headln;
-
-                headln = skb_transport_offset(skb) + tcp_hdrlen(skb);
-                payload = skb->len - headln;
-                if (likely(payload <= -info.sync_len))
-                        return skb;
+                if (likely(datalen <= -info.sync_len))
+                        return MLX5E_KTLS_SYNC_DONE;
 
                 stats->tls_drop_bypass_req++;
                 goto err_out;
@@ -360,30 +361,62 @@ mlx5e_ktls_tx_handle_ooo(struct mlx5e_ktls_offload_context_tx *priv_tx,
 
         stats->tls_ooo++;
 
-        num_wqebbs = MLX5E_KTLS_STATIC_WQEBBS + MLX5E_KTLS_PROGRESS_WQEBBS +
-                (info.nr_frags ? info.nr_frags * MLX5E_KTLS_MAX_DUMP_WQEBBS : 1);
+        tx_post_resync_params(sq, priv_tx, info.rcd_sn);
+
+        /* If no dump WQE was sent, we need to have a fence NOP WQE before the
+         * actual data xmit.
+         */
+        if (!info.nr_frags) {
+                tx_post_fence_nop(sq);
+                return MLX5E_KTLS_SYNC_DONE;
+        }
+
+        num_wqebbs = mlx5e_ktls_dumps_num_wqebbs(sq, info.nr_frags, info.sync_len);
         pi = mlx5_wq_cyc_ctr2ix(wq, sq->pc);
         contig_wqebbs_room = mlx5_wq_cyc_get_contig_wqebbs(wq, pi);
+
         if (unlikely(contig_wqebbs_room < num_wqebbs))
                 mlx5e_fill_sq_frag_edge(sq, wq, pi, contig_wqebbs_room);
 
         tx_post_resync_params(sq, priv_tx, info.rcd_sn);
 
-        for (i = 0; i < info.nr_frags; i++)
-                if (tx_post_resync_dump(sq, info.frags[i], priv_tx->tisn, !i))
-                        goto err_out;
+        for (; i < info.nr_frags; i++) {
+                unsigned int orig_fsz, frag_offset = 0, n = 0;
+                skb_frag_t *f = &info.frags[i];
 
-        /* If no dump WQE was sent, we need to have a fence NOP WQE before the
-         * actual data xmit.
-         */
-        if (!info.nr_frags)
-                tx_post_fence_nop(sq);
+                orig_fsz = skb_frag_size(f);
 
-        return skb;
+                do {
+                        bool fence = !(i || frag_offset);
+                        unsigned int fsz;
+
+                        n++;
+                        fsz = min_t(unsigned int, sq->hw_mtu, orig_fsz - frag_offset);
+                        skb_frag_size_set(f, fsz);
+                        if (tx_post_resync_dump(sq, f, priv_tx->tisn, fence)) {
+                                page_ref_add(skb_frag_page(f), n - 1);
+                                goto err_out;
+                        }
+
+                        skb_frag_off_add(f, fsz);
+                        frag_offset += fsz;
+                } while (frag_offset < orig_fsz);
+
+                page_ref_add(skb_frag_page(f), n - 1);
+        }
+
+        return MLX5E_KTLS_SYNC_DONE;
 
 err_out:
-        dev_kfree_skb_any(skb);
-        return NULL;
+        for (; i < info.nr_frags; i++)
+                /* The put_page() here undoes the page ref obtained in tx_sync_info_get().
+                 * Page refs obtained for the DUMP WQEs above (by page_ref_add) will be
+                 * released only upon their completions (or in mlx5e_free_txqsq_descs,
+                 * if channel closes).
+                 */
+                put_page(skb_frag_page(&info.frags[i]));
+
+        return MLX5E_KTLS_SYNC_FAIL;
 }
 
 struct sk_buff *mlx5e_ktls_handle_tx_skb(struct net_device *netdev,
@@ -419,10 +452,15 @@ struct sk_buff *mlx5e_ktls_handle_tx_skb(struct net_device *netdev,
 
         seq = ntohl(tcp_hdr(skb)->seq);
         if (unlikely(priv_tx->expected_seq != seq)) {
-                skb = mlx5e_ktls_tx_handle_ooo(priv_tx, sq, skb, seq);
-                if (unlikely(!skb))
+                enum mlx5e_ktls_sync_retval ret =
+                        mlx5e_ktls_tx_handle_ooo(priv_tx, sq, datalen, seq);
+
+                if (likely(ret == MLX5E_KTLS_SYNC_DONE))
+                        *wqe = mlx5e_sq_fetch_wqe(sq, sizeof(**wqe), pi);
+                else if (ret == MLX5E_KTLS_SYNC_FAIL)
+                        goto err_out;
+                else /* ret == MLX5E_KTLS_SYNC_SKIP_NO_DATA */
                         goto out;
-                *wqe = mlx5e_sq_fetch_wqe(sq, sizeof(**wqe), pi);
         }
 
         priv_tx->expected_seq = seq + datalen;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index c5a9c20d7f00..327c93a7bd55 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -1021,7 +1021,7 @@ static bool ext_link_mode_requested(const unsigned long *adver)
 {
 #define MLX5E_MIN_PTYS_EXT_LINK_MODE_BIT ETHTOOL_LINK_MODE_50000baseKR_Full_BIT
         int size = __ETHTOOL_LINK_MODE_MASK_NBITS - MLX5E_MIN_PTYS_EXT_LINK_MODE_BIT;
-        __ETHTOOL_DECLARE_LINK_MODE_MASK(modes);
+        __ETHTOOL_DECLARE_LINK_MODE_MASK(modes) = {0,};
 
         bitmap_set(modes, MLX5E_MIN_PTYS_EXT_LINK_MODE_BIT, size);
         return bitmap_intersects(modes, adver, __ETHTOOL_LINK_MODE_MASK_NBITS);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 7569287f8f3c..772bfdbdeb9c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -1128,6 +1128,7 @@ static int mlx5e_alloc_txqsq(struct mlx5e_channel *c,
         sq->txq_ix    = txq_ix;
         sq->uar_map   = mdev->mlx5e_res.bfreg.map;
         sq->min_inline_mode = params->tx_min_inline_mode;
+        sq->hw_mtu    = MLX5E_SW2HW_MTU(params, params->sw_mtu);
         sq->stats     = &c->priv->channel_stats[c->ix].sq[tc];
         sq->stop_room = MLX5E_SQ_STOP_ROOM;
         INIT_WORK(&sq->recover_work, mlx5e_tx_err_cqe_work);
@@ -1135,10 +1136,14 @@ static int mlx5e_alloc_txqsq(struct mlx5e_channel *c,
                 set_bit(MLX5E_SQ_STATE_VLAN_NEED_L2_INLINE, &sq->state);
         if (MLX5_IPSEC_DEV(c->priv->mdev))
                 set_bit(MLX5E_SQ_STATE_IPSEC, &sq->state);
+#ifdef CONFIG_MLX5_EN_TLS
         if (mlx5_accel_is_tls_device(c->priv->mdev)) {
                 set_bit(MLX5E_SQ_STATE_TLS, &sq->state);
-                sq->stop_room += MLX5E_SQ_TLS_ROOM;
+                sq->stop_room += MLX5E_SQ_TLS_ROOM +
+                        mlx5e_ktls_dumps_num_wqebbs(sq, MAX_SKB_FRAGS,
+                                                    TLS_MAX_PAYLOAD_SIZE);
         }
+#endif
 
         param->wq.db_numa_node = cpu_to_node(c->cpu);
         err = mlx5_wq_cyc_create(mdev, &param->wq, sqc_wq, wq, &sq->wq_ctrl);
@@ -1349,9 +1354,13 @@ static void mlx5e_deactivate_txqsq(struct mlx5e_txqsq *sq)
         /* last doorbell out, godspeed .. */
         if (mlx5e_wqc_has_room_for(wq, sq->cc, sq->pc, 1)) {
                 u16 pi = mlx5_wq_cyc_ctr2ix(wq, sq->pc);
+                struct mlx5e_tx_wqe_info *wi;
                 struct mlx5e_tx_wqe *nop;
 
-                sq->db.wqe_info[pi].skb = NULL;
+                wi = &sq->db.wqe_info[pi];
+
+                memset(wi, 0, sizeof(*wi));
+                wi->num_wqebbs = 1;
                 nop = mlx5e_post_nop(wq, sq->sqn, &sq->pc);
                 mlx5e_notify_hw(wq, sq->pc, sq->uar_map, &nop->ctrl);
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 95892a3b63a1..cd9bb7c7b341 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -611,8 +611,8 @@ static void mlx5e_rep_update_flows(struct mlx5e_priv *priv,
 
         mutex_lock(&esw->offloads.encap_tbl_lock);
         encap_connected = !!(e->flags & MLX5_ENCAP_ENTRY_VALID);
-        if (e->compl_result || (encap_connected == neigh_connected &&
-                                ether_addr_equal(e->h_dest, ha)))
+        if (e->compl_result < 0 || (encap_connected == neigh_connected &&
+                                    ether_addr_equal(e->h_dest, ha)))
                 goto unlock;
 
         mlx5e_take_all_encap_flows(e, &flow_list);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index d6a547238de0..82cffb3a9964 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -1386,8 +1386,11 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget)
         if (unlikely(!test_bit(MLX5E_RQ_STATE_ENABLED, &rq->state)))
                 return 0;
 
-        if (rq->cqd.left)
+        if (rq->cqd.left) {
                 work_done += mlx5e_decompress_cqes_cont(rq, cqwq, 0, budget);
+                if (rq->cqd.left || work_done >= budget)
+                        goto out;
+        }
 
         cqe = mlx5_cqwq_get_cqe(cqwq);
         if (!cqe) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
index 840ec945ccba..bbff8d8ded76 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
@@ -35,6 +35,7 @@
 #include <linux/udp.h>
 #include <net/udp.h>
 #include "en.h"
+#include "en/port.h"
 
 enum {
         MLX5E_ST_LINK_STATE,
@@ -80,22 +81,12 @@ static int mlx5e_test_link_state(struct mlx5e_priv *priv)
 
 static int mlx5e_test_link_speed(struct mlx5e_priv *priv)
 {
-        u32 out[MLX5_ST_SZ_DW(ptys_reg)];
-        u32 eth_proto_oper;
-        int i;
+        u32 speed;
 
         if (!netif_carrier_ok(priv->netdev))
                 return 1;
 
-        if (mlx5_query_port_ptys(priv->mdev, out, sizeof(out), MLX5_PTYS_EN, 1))
-                return 1;
-
-        eth_proto_oper = MLX5_GET(ptys_reg, out, eth_proto_oper);
-        for (i = 0; i < MLX5E_LINK_MODES_NUMBER; i++) {
-                if (eth_proto_oper & MLX5E_PROT_MASK(i))
-                        return 0;
-        }
-        return 1;
+        return mlx5e_port_linkspeed(priv->mdev, &speed);
 }
 
 struct mlx5ehdr {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
index ac6fdcda7019..7e6ebd0505cc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
@@ -52,11 +52,12 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_encrypted_bytes) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_ctx) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_ooo) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_dump_packets) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_dump_bytes) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_resync_bytes) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_skip_no_sync_data) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_drop_no_sync_data) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_drop_bypass_req) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_dump_packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_dump_bytes) },
 #endif
 
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_lro_packets) },
@@ -288,11 +289,12 @@ static void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
                         s->tx_tls_encrypted_bytes   += sq_stats->tls_encrypted_bytes;
                         s->tx_tls_ctx               += sq_stats->tls_ctx;
                         s->tx_tls_ooo               += sq_stats->tls_ooo;
+                        s->tx_tls_dump_bytes        += sq_stats->tls_dump_bytes;
+                        s->tx_tls_dump_packets      += sq_stats->tls_dump_packets;
                         s->tx_tls_resync_bytes      += sq_stats->tls_resync_bytes;
+                        s->tx_tls_skip_no_sync_data += sq_stats->tls_skip_no_sync_data;
                         s->tx_tls_drop_no_sync_data += sq_stats->tls_drop_no_sync_data;
                         s->tx_tls_drop_bypass_req   += sq_stats->tls_drop_bypass_req;
-                        s->tx_tls_dump_bytes        += sq_stats->tls_dump_bytes;
-                        s->tx_tls_dump_packets      += sq_stats->tls_dump_packets;
 #endif
                         s->tx_cqes              += sq_stats->cqes;
                 }
@@ -1472,10 +1474,12 @@ static const struct counter_desc sq_stats_desc[] = {
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_encrypted_bytes) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_ctx) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_ooo) },
-        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_drop_no_sync_data) },
-        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_drop_bypass_req) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_dump_packets) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_dump_bytes) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_resync_bytes) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_skip_no_sync_data) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_drop_no_sync_data) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_drop_bypass_req) },
 #endif
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_none) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, stopped) },
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 79f261bf86ac..869f3502f631 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -129,11 +129,12 @@ struct mlx5e_sw_stats {
         u64 tx_tls_encrypted_bytes;
         u64 tx_tls_ctx;
         u64 tx_tls_ooo;
+        u64 tx_tls_dump_packets;
+        u64 tx_tls_dump_bytes;
         u64 tx_tls_resync_bytes;
+        u64 tx_tls_skip_no_sync_data;
         u64 tx_tls_drop_no_sync_data;
         u64 tx_tls_drop_bypass_req;
-        u64 tx_tls_dump_packets;
-        u64 tx_tls_dump_bytes;
 #endif
 
         u64 rx_xsk_packets;
@@ -273,11 +274,12 @@ struct mlx5e_sq_stats {
         u64 tls_encrypted_bytes;
         u64 tls_ctx;
         u64 tls_ooo;
+        u64 tls_dump_packets;
+        u64 tls_dump_bytes;
         u64 tls_resync_bytes;
+        u64 tls_skip_no_sync_data;
         u64 tls_drop_no_sync_data;
         u64 tls_drop_bypass_req;
-        u64 tls_dump_packets;
-        u64 tls_dump_bytes;
 #endif
         /* less likely accessed in data path */
         u64 csum_none;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 3e78a727f3e6..fda0b37075e8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1278,8 +1278,10 @@ static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv,
         mlx5_eswitch_del_vlan_action(esw, attr);
 
         for (out_index = 0; out_index < MLX5_MAX_FLOW_FWD_VPORTS; out_index++)
-                if (attr->dests[out_index].flags & MLX5_ESW_DEST_ENCAP)
+                if (attr->dests[out_index].flags & MLX5_ESW_DEST_ENCAP) {
                         mlx5e_detach_encap(priv, flow, out_index);
+                        kfree(attr->parse_attr->tun_info[out_index]);
+                }
         kvfree(attr->parse_attr);
 
         if (attr->action & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)
@@ -1559,6 +1561,7 @@ static void mlx5e_encap_dealloc(struct mlx5e_priv *priv, struct mlx5e_encap_entr
                         mlx5_packet_reformat_dealloc(priv->mdev, e->pkt_reformat);
         }
 
+        kfree(e->tun_info);
         kfree(e->encap_header);
         kfree_rcu(e, rcu);
 }
@@ -2972,6 +2975,13 @@ mlx5e_encap_get(struct mlx5e_priv *priv, struct encap_key *key,
         return NULL;
 }
 
+static struct ip_tunnel_info *dup_tun_info(const struct ip_tunnel_info *tun_info)
+{
+        size_t tun_size = sizeof(*tun_info) + tun_info->options_len;
+
+        return kmemdup(tun_info, tun_size, GFP_KERNEL);
+}
+
 static int mlx5e_attach_encap(struct mlx5e_priv *priv,
                               struct mlx5e_tc_flow *flow,
                               struct net_device *mirred_dev,
@@ -3028,13 +3038,15 @@ static int mlx5e_attach_encap(struct mlx5e_priv *priv,
         refcount_set(&e->refcnt, 1);
         init_completion(&e->res_ready);
 
+        tun_info = dup_tun_info(tun_info);
+        if (!tun_info) {
+                err = -ENOMEM;
+                goto out_err_init;
+        }
         e->tun_info = tun_info;
         err = mlx5e_tc_tun_init_encap_attr(mirred_dev, priv, e, extack);
-        if (err) {
-                kfree(e);
-                e = NULL;
-                goto out_err;
-        }
+        if (err)
+                goto out_err_init;
 
         INIT_LIST_HEAD(&e->flows);
         hash_add_rcu(esw->offloads.encap_tbl, &e->encap_hlist, hash_key);
@@ -3075,6 +3087,12 @@ out_err:
         if (e)
                 mlx5e_encap_put(priv, e);
         return err;
+
+out_err_init:
+        mutex_unlock(&esw->offloads.encap_tbl_lock);
+        kfree(tun_info);
+        kfree(e);
+        return err;
 }
 
 static int parse_tc_vlan_action(struct mlx5e_priv *priv,
@@ -3160,7 +3178,7 @@ static int add_vlan_pop_action(struct mlx5e_priv *priv,
                                struct mlx5_esw_flow_attr *attr,
                                u32 *action)
 {
-        int nest_level = vlan_get_encap_level(attr->parse_attr->filter_dev);
+        int nest_level = attr->parse_attr->filter_dev->lower_level;
         struct flow_action_entry vlan_act = {
                 .id = FLOW_ACTION_VLAN_POP,
         };
@@ -3295,7 +3313,9 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv,
                         } else if (encap) {
                                 parse_attr->mirred_ifindex[attr->out_count] =
                                         out_dev->ifindex;
-                                parse_attr->tun_info[attr->out_count] = info;
+                                parse_attr->tun_info[attr->out_count] = dup_tun_info(info);
+                                if (!parse_attr->tun_info[attr->out_count])
+                                        return -ENOMEM;
                                 encap = false;
                                 attr->dests[attr->out_count].flags |=
                                         MLX5_ESW_DEST_ENCAP;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index d3a67a9b4eba..67dc4f0921b6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -403,7 +403,10 @@ netdev_tx_t mlx5e_xmit(struct sk_buff *skb, struct net_device *dev)
 static void mlx5e_dump_error_cqe(struct mlx5e_txqsq *sq,
                                  struct mlx5_err_cqe *err_cqe)
 {
-        u32 ci = mlx5_cqwq_get_ci(&sq->cq.wq);
+        struct mlx5_cqwq *wq = &sq->cq.wq;
+        u32 ci;
+
+        ci = mlx5_cqwq_ctr2ix(wq, wq->cc - 1);
 
         netdev_err(sq->channel->netdev,
                    "Error cqe on cqn 0x%x, ci 0x%x, sqn 0x%x, opcode 0x%x, syndrome 0x%x, vendor syndrome 0x%x\n",
@@ -479,14 +482,7 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
                         skb = wi->skb;
 
                         if (unlikely(!skb)) {
-#ifdef CONFIG_MLX5_EN_TLS
-                                if (wi->resync_dump_frag) {
-                                        struct mlx5e_sq_dma *dma =
-                                                mlx5e_dma_get(sq, dma_fifo_cc++);
-
-                                        mlx5e_ktls_tx_handle_resync_dump_comp(sq, wi, dma);
-                                }
-#endif
+                                mlx5e_ktls_tx_handle_resync_dump_comp(sq, wi, &dma_fifo_cc);
                                 sqcc += wi->num_wqebbs;
                                 continue;
                         }
@@ -542,29 +538,38 @@ void mlx5e_free_txqsq_descs(struct mlx5e_txqsq *sq)
 {
         struct mlx5e_tx_wqe_info *wi;
         struct sk_buff *skb;
+        u32 dma_fifo_cc;
+        u16 sqcc;
         u16 ci;
         int i;
 
-        while (sq->cc != sq->pc) {
-                ci = mlx5_wq_cyc_ctr2ix(&sq->wq, sq->cc);
+        sqcc = sq->cc;
+        dma_fifo_cc = sq->dma_fifo_cc;
+
+        while (sqcc != sq->pc) {
+                ci = mlx5_wq_cyc_ctr2ix(&sq->wq, sqcc);
                 wi = &sq->db.wqe_info[ci];
                 skb = wi->skb;
 
-                if (!skb) { /* nop */
-                        sq->cc++;
+                if (!skb) {
+                        mlx5e_ktls_tx_handle_resync_dump_comp(sq, wi, &dma_fifo_cc);
+                        sqcc += wi->num_wqebbs;
                         continue;
                 }
 
                 for (i = 0; i < wi->num_dma; i++) {
                         struct mlx5e_sq_dma *dma =
-                                mlx5e_dma_get(sq, sq->dma_fifo_cc++);
+                                mlx5e_dma_get(sq, dma_fifo_cc++);
 
                         mlx5e_tx_dma_unmap(sq->pdev, dma);
                 }
 
                 dev_kfree_skb_any(skb);
-                sq->cc += wi->num_wqebbs;
+                sqcc += wi->num_wqebbs;
         }
+
+        sq->dma_fifo_cc = dma_fifo_cc;
+        sq->cc = sqcc;
 }
 
 #ifdef CONFIG_MLX5_CORE_IPOIB
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 00d71db15f22..369499e88fe8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -285,7 +285,6 @@ mlx5_eswitch_add_fwd_rule(struct mlx5_eswitch *esw,
 
         mlx5_eswitch_set_rule_source_port(esw, spec, attr);
 
-        spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS;
         if (attr->outer_match_level != MLX5_MATCH_NONE)
                 spec->match_criteria_enable |= MLX5_MATCH_OUTER_HEADERS;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
index 1d55a324a17e..7879e1746297 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
@@ -177,22 +177,32 @@ mlx5_eswitch_termtbl_actions_move(struct mlx5_flow_act *src,
         memset(&src->vlan[1], 0, sizeof(src->vlan[1]));
 }
 
+static bool mlx5_eswitch_offload_is_uplink_port(const struct mlx5_eswitch *esw,
+                                                const struct mlx5_flow_spec *spec)
+{
+        u32 port_mask, port_value;
+
+        if (MLX5_CAP_ESW_FLOWTABLE(esw->dev, flow_source))
+                return spec->flow_context.flow_source == MLX5_VPORT_UPLINK;
+
+        port_mask = MLX5_GET(fte_match_param, spec->match_criteria,
+                             misc_parameters.source_port);
+        port_value = MLX5_GET(fte_match_param, spec->match_value,
+                              misc_parameters.source_port);
+        return (port_mask & port_value & 0xffff) == MLX5_VPORT_UPLINK;
+}
+
 bool
 mlx5_eswitch_termtbl_required(struct mlx5_eswitch *esw,
                               struct mlx5_flow_act *flow_act,
                               struct mlx5_flow_spec *spec)
 {
-        u32 port_mask = MLX5_GET(fte_match_param, spec->match_criteria,
-                                 misc_parameters.source_port);
-        u32 port_value = MLX5_GET(fte_match_param, spec->match_value,
-                                  misc_parameters.source_port);
-
         if (!MLX5_CAP_ESW_FLOWTABLE_FDB(esw->dev, termination_table))
                 return false;
 
         /* push vlan on RX */
         return (flow_act->action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH) &&
-                ((port_mask & port_value) == MLX5_VPORT_UPLINK);
+                mlx5_eswitch_offload_is_uplink_port(esw, spec);
 }
 
 struct mlx5_flow_handle *
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
index 4c50efe4e7f1..61021133029e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
@@ -464,8 +464,10 @@ static int mlx5_fpga_conn_create_cq(struct mlx5_fpga_conn *conn, int cq_size)
         }
 
         err = mlx5_vector2eqn(mdev, smp_processor_id(), &eqn, &irqn);
-        if (err)
+        if (err) {
+                kvfree(in);
                 goto err_cqwq;
+        }
 
         cqc = MLX5_ADDR_OF(create_cq_in, in, cq_context);
         MLX5_SET(cqc, cqc, log_cq_size, ilog2(cq_size));
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
index 579c306caa7b..3c816e81f8d9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
@@ -507,7 +507,8 @@ static int mlx5_cmd_set_fte(struct mlx5_core_dev *dev,
                                 MLX5_SET(dest_format_struct, in_dests,
                                          destination_eswitch_owner_vhca_id,
                                          dst->dest_attr.vport.vhca_id);
-                                if (extended_dest) {
+                                if (extended_dest &&
+                                    dst->dest_attr.vport.pkt_reformat) {
                                         MLX5_SET(dest_format_struct, in_dests,
                                                  packet_reformat,
                                                  !!(dst->dest_attr.vport.flags &
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index d685122d9ff7..c07f3154437c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -572,7 +572,7 @@ mlx5_fw_fatal_reporter_dump(struct devlink_health_reporter *reporter,
                 return -ENOMEM;
         err = mlx5_crdump_collect(dev, cr_data);
         if (err)
-                return err;
+                goto free_data;
 
         if (priv_ctx) {
                 struct mlx5_fw_reporter_ctx *fw_reporter_ctx = priv_ctx;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
index 14dcc786926d..4421ab22182f 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -1186,7 +1186,7 @@ __mlxsw_core_bus_device_register(const struct mlxsw_bus_info *mlxsw_bus_info,
         if (err)
                 goto err_thermal_init;
 
-        if (mlxsw_driver->params_register && !reload)
+        if (mlxsw_driver->params_register)
                 devlink_params_publish(devlink);
 
         return 0;
@@ -1259,7 +1259,7 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core,
                         return;
         }
 
-        if (mlxsw_core->driver->params_unregister && !reload)
+        if (mlxsw_core->driver->params_unregister)
                 devlink_params_unpublish(devlink);
         mlxsw_thermal_fini(mlxsw_core->thermal);
         mlxsw_hwmon_fini(mlxsw_core->hwmon);
diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
index 4d1bce4389c7..344539c0d3aa 100644
--- a/drivers/net/ethernet/mscc/ocelot.c
+++ b/drivers/net/ethernet/mscc/ocelot.c
@@ -261,8 +261,15 @@ static int ocelot_vlan_vid_add(struct net_device *dev, u16 vid, bool pvid,
                 port->pvid = vid;
 
         /* Untagged egress vlan clasification */
-        if (untagged)
+        if (untagged && port->vid != vid) {
+                if (port->vid) {
+                        dev_err(ocelot->dev,
+                                "Port already has a native VLAN: %d\n",
+                                port->vid);
+                        return -EBUSY;
+                }
                 port->vid = vid;
+        }
 
         ocelot_vlan_port_apply(ocelot, port);
 
@@ -934,7 +941,7 @@ end:
 static int ocelot_vlan_rx_add_vid(struct net_device *dev, __be16 proto,
                                   u16 vid)
 {
-        return ocelot_vlan_vid_add(dev, vid, false, true);
+        return ocelot_vlan_vid_add(dev, vid, false, false);
 }
 
 static int ocelot_vlan_rx_kill_vid(struct net_device *dev, __be16 proto,
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
index 1eef446036d6..79d72c88bbef 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
@@ -299,22 +299,6 @@ static void nfp_repr_clean(struct nfp_repr *repr)
         nfp_port_free(repr->port);
 }
 
-static struct lock_class_key nfp_repr_netdev_xmit_lock_key;
-static struct lock_class_key nfp_repr_netdev_addr_lock_key;
-
-static void nfp_repr_set_lockdep_class_one(struct net_device *dev,
-                                           struct netdev_queue *txq,
-                                           void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock, &nfp_repr_netdev_xmit_lock_key);
-}
-
-static void nfp_repr_set_lockdep_class(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock, &nfp_repr_netdev_addr_lock_key);
-        netdev_for_each_tx_queue(dev, nfp_repr_set_lockdep_class_one, NULL);
-}
-
 int nfp_repr_init(struct nfp_app *app, struct net_device *netdev,
                   u32 cmsg_port_id, struct nfp_port *port,
                   struct net_device *pf_netdev)
@@ -324,8 +308,6 @@ int nfp_repr_init(struct nfp_app *app, struct net_device *netdev,
         u32 repr_cap = nn->tlv_caps.repr_cap;
         int err;
 
-        nfp_repr_set_lockdep_class(netdev);
-
         repr->port = port;
         repr->dst = metadata_dst_alloc(0, METADATA_HW_PORT_MUX, GFP_KERNEL);
         if (!repr->dst)
diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
index 72107a0627a9..20faa8d24c9f 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Copyright(c) 2017 - 2019 Pensando Systems, Inc */
 
+#include <linux/printk.h>
+#include <linux/dynamic_debug.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c
index 15e432386b35..aab311413412 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_main.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c
@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Copyright(c) 2017 - 2019 Pensando Systems, Inc */
 
+#include <linux/printk.h>
+#include <linux/dynamic_debug.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/utsname.h>
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 2ce70097d018..38f7f40b3a4d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -67,10 +67,9 @@
 #define QED_ROCE_QPS                    (8192)
 #define QED_ROCE_DPIS                   (8)
 #define QED_RDMA_SRQS                   QED_ROCE_QPS
-#define QED_NVM_CFG_SET_FLAGS           0xE
-#define QED_NVM_CFG_SET_PF_FLAGS        0x1E
 #define QED_NVM_CFG_GET_FLAGS           0xA
 #define QED_NVM_CFG_GET_PF_FLAGS        0x1A
+#define QED_NVM_CFG_MAX_ATTRS           50
 
 static char version[] =
         "QLogic FastLinQ 4xxxx Core Module qed " DRV_MODULE_VERSION "\n";
@@ -2255,6 +2254,7 @@ static int qed_nvm_flash_cfg_write(struct qed_dev *cdev, const u8 **data)
 {
         struct qed_hwfn *hwfn = QED_LEADING_HWFN(cdev);
         u8 entity_id, len, buf[32];
+        bool need_nvm_init = true;
         struct qed_ptt *ptt;
         u16 cfg_id, count;
         int rc = 0, i;
@@ -2271,8 +2271,10 @@ static int qed_nvm_flash_cfg_write(struct qed_dev *cdev, const u8 **data)
 
         DP_VERBOSE(cdev, NETIF_MSG_DRV,
                    "Read config ids: num_attrs = %0d\n", count);
-        /* NVM CFG ID attributes */
-        for (i = 0; i < count; i++) {
+        /* NVM CFG ID attributes. Start loop index from 1 to avoid additional
+         * arithmetic operations in the implementation.
+         */
+        for (i = 1; i <= count; i++) {
                 cfg_id = *((u16 *)*data);
                 *data += 2;
                 entity_id = **data;
@@ -2282,8 +2284,21 @@ static int qed_nvm_flash_cfg_write(struct qed_dev *cdev, const u8 **data)
                 memcpy(buf, *data, len);
                 *data += len;
 
-                flags = entity_id ? QED_NVM_CFG_SET_PF_FLAGS :
-                        QED_NVM_CFG_SET_FLAGS;
+                flags = 0;
+                if (need_nvm_init) {
+                        flags |= QED_NVM_CFG_OPTION_INIT;
+                        need_nvm_init = false;
+                }
+
+                /* Commit to flash and free the resources */
+                if (!(i % QED_NVM_CFG_MAX_ATTRS) || i == count) {
+                        flags |= QED_NVM_CFG_OPTION_COMMIT |
+                                 QED_NVM_CFG_OPTION_FREE;
+                        need_nvm_init = true;
+                }
+
+                if (entity_id)
+                        flags |= QED_NVM_CFG_OPTION_ENTITY_SEL;
 
                 DP_VERBOSE(cdev, NETIF_MSG_DRV,
                            "cfg_id = %d entity = %d len = %d\n", cfg_id,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
index 78f77b712b10..dcb5c917f373 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
@@ -2005,7 +2005,7 @@ static void qed_iov_vf_mbx_stop_vport(struct qed_hwfn *p_hwfn,
             (qed_iov_validate_active_txq(p_hwfn, vf))) {
                 vf->b_malicious = true;
                 DP_NOTICE(p_hwfn,
-                          "VF [%02x] - considered malicious; Unable to stop RX/TX queuess\n",
+                          "VF [%02x] - considered malicious; Unable to stop RX/TX queues\n",
                           vf->abs_vf_id);
                 status = PFVF_STATUS_MALICIOUS;
                 goto out;
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 350b0d949611..5064c292b873 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -1029,6 +1029,10 @@ static int r8168dp_2_mdio_read(struct rtl8169_private *tp, int reg)
 {
         int value;
 
+        /* Work around issue with chip reporting wrong PHY ID */
+        if (reg == MII_PHYSID2)
+                return 0xc912;
+
         r8168dp_2_mdio_start(tp);
 
         value = r8169_mdio_read(tp, reg);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 3dfd04e0506a..4e9c848c67cc 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2995,6 +2995,7 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
         } else {
                 stmmac_set_desc_addr(priv, first, des);
                 tmp_pay_len = pay_len;
+                des += proto_hdr_len;
         }
 
         stmmac_tso_allocator(priv, des, tmp_pay_len, (nfrags == 0), queue);
diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
index bbbc1dcb6ab5..b517c1af9de0 100644
--- a/drivers/net/fjes/fjes_main.c
+++ b/drivers/net/fjes/fjes_main.c
@@ -1237,8 +1237,17 @@ static int fjes_probe(struct platform_device *plat_dev)
         adapter->open_guard = false;
 
         adapter->txrx_wq = alloc_workqueue(DRV_NAME "/txrx", WQ_MEM_RECLAIM, 0);
+        if (unlikely(!adapter->txrx_wq)) {
+                err = -ENOMEM;
+                goto err_free_netdev;
+        }
+
         adapter->control_wq = alloc_workqueue(DRV_NAME "/control",
                                               WQ_MEM_RECLAIM, 0);
+        if (unlikely(!adapter->control_wq)) {
+                err = -ENOMEM;
+                goto err_free_txrx_wq;
+        }
 
         INIT_WORK(&adapter->tx_stall_task, fjes_tx_stall_task);
         INIT_WORK(&adapter->raise_intr_rxdata_task,
@@ -1255,7 +1264,7 @@ static int fjes_probe(struct platform_device *plat_dev)
         hw->hw_res.irq = platform_get_irq(plat_dev, 0);
         err = fjes_hw_init(&adapter->hw);
         if (err)
-                goto err_free_netdev;
+                goto err_free_control_wq;
 
         /* setup MAC address (02:00:00:00:00:[epid])*/
         netdev->dev_addr[0] = 2;
@@ -1277,6 +1286,10 @@ static int fjes_probe(struct platform_device *plat_dev)
 
 err_hw_exit:
         fjes_hw_exit(&adapter->hw);
+err_free_control_wq:
+        destroy_workqueue(adapter->control_wq);
+err_free_txrx_wq:
+        destroy_workqueue(adapter->txrx_wq);
 err_free_netdev:
         free_netdev(netdev);
 err_out:
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index fbec711ff514..fbea6f232819 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -107,27 +107,6 @@ struct bpqdev {
 
 static LIST_HEAD(bpq_devices);
 
-/*
- * bpqether network devices are paired with ethernet devices below them, so
- * form a special "super class" of normal ethernet devices; split their locks
- * off into a separate class since they always nest.
- */
-static struct lock_class_key bpq_netdev_xmit_lock_key;
-static struct lock_class_key bpq_netdev_addr_lock_key;
-
-static void bpq_set_lockdep_class_one(struct net_device *dev,
-                                      struct netdev_queue *txq,
-                                      void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock, &bpq_netdev_xmit_lock_key);
-}
-
-static void bpq_set_lockdep_class(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock, &bpq_netdev_addr_lock_key);
-        netdev_for_each_tx_queue(dev, bpq_set_lockdep_class_one, NULL);
-}
-
 /* ------------------------------------------------------------------------ */
 
 
@@ -498,7 +477,6 @@ static int bpq_new_device(struct net_device *edev)
         err = register_netdevice(ndev);
         if (err)
                 goto error;
-        bpq_set_lockdep_class(ndev);
 
         /* List protected by RTNL */
         list_add_rcu(&bpq->bpq_list, &bpq_devices);
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 39dddcd8b3cb..963509add611 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -982,7 +982,7 @@ static int netvsc_attach(struct net_device *ndev,
         if (netif_running(ndev)) {
                 ret = rndis_filter_open(nvdev);
                 if (ret)
-                        return ret;
+                        goto err;
 
                 rdev = nvdev->extension;
                 if (!rdev->link_state)
@@ -990,6 +990,13 @@ static int netvsc_attach(struct net_device *ndev,
         }
 
         return 0;
+
+err:
+        netif_device_detach(ndev);
+
+        rndis_filter_device_remove(hdev, nvdev);
+
+        return ret;
 }
 
 static int netvsc_set_channels(struct net_device *net,
@@ -1807,8 +1814,10 @@ static int netvsc_set_features(struct net_device *ndev,
 
         ret = rndis_filter_set_offload_params(ndev, nvdev, &offloads);
 
-        if (ret)
+        if (ret) {
                 features ^= NETIF_F_LRO;
+                ndev->features = features;
+        }
 
 syncvf:
         if (!vf_netdev)
@@ -2335,8 +2344,6 @@ static int netvsc_probe(struct hv_device *dev,
                 NETIF_F_HW_VLAN_CTAG_RX;
         net->vlan_features = net->features;
 
-        netdev_lockdep_set_classes(net);
-
         /* MTU range: 68 - 1500 or 65521 */
         net->min_mtu = NETVSC_MTU_MIN;
         if (nvdev->nvsp_version >= NVSP_PROTOCOL_VERSION_2)
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 887bbba4631e..ba3dfac1d904 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -131,8 +131,6 @@ static int ipvlan_init(struct net_device *dev)
         dev->gso_max_segs = phy_dev->gso_max_segs;
         dev->hard_header_len = phy_dev->hard_header_len;
 
-        netdev_lockdep_set_classes(dev);
-
         ipvlan->pcpu_stats = netdev_alloc_pcpu_stats(struct ipvl_pcpu_stats);
         if (!ipvlan->pcpu_stats)
                 return -ENOMEM;
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index cb7637364b40..afd8b2a08245 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -267,7 +267,6 @@ struct macsec_dev {
         struct pcpu_secy_stats __percpu *stats;
         struct list_head secys;
         struct gro_cells gro_cells;
-        unsigned int nest_level;
 };
 
 /**
@@ -2750,7 +2749,6 @@ static netdev_tx_t macsec_start_xmit(struct sk_buff *skb,
 
 #define MACSEC_FEATURES \
         (NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST)
-static struct lock_class_key macsec_netdev_addr_lock_key;
 
 static int macsec_dev_init(struct net_device *dev)
 {
@@ -2958,11 +2956,6 @@ static int macsec_get_iflink(const struct net_device *dev)
         return macsec_priv(dev)->real_dev->ifindex;
 }
 
-static int macsec_get_nest_level(struct net_device *dev)
-{
-        return macsec_priv(dev)->nest_level;
-}
-
 static const struct net_device_ops macsec_netdev_ops = {
         .ndo_init               = macsec_dev_init,
         .ndo_uninit             = macsec_dev_uninit,
@@ -2976,7 +2969,6 @@ static const struct net_device_ops macsec_netdev_ops = {
         .ndo_start_xmit         = macsec_start_xmit,
         .ndo_get_stats64        = macsec_get_stats64,
         .ndo_get_iflink         = macsec_get_iflink,
-        .ndo_get_lock_subclass  = macsec_get_nest_level,
 };
 
 static const struct device_type macsec_type = {
@@ -3001,12 +2993,10 @@ static const struct nla_policy macsec_rtnl_policy[IFLA_MACSEC_MAX + 1] = {
 static void macsec_free_netdev(struct net_device *dev)
 {
         struct macsec_dev *macsec = macsec_priv(dev);
-        struct net_device *real_dev = macsec->real_dev;
 
         free_percpu(macsec->stats);
         free_percpu(macsec->secy.tx_sc.stats);
 
-        dev_put(real_dev);
 }
 
 static void macsec_setup(struct net_device *dev)
@@ -3261,14 +3251,6 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
         if (err < 0)
                 return err;
 
-        dev_hold(real_dev);
-
-        macsec->nest_level = dev_get_nest_level(real_dev) + 1;
-        netdev_lockdep_set_classes(dev);
-        lockdep_set_class_and_subclass(&dev->addr_list_lock,
-                                       &macsec_netdev_addr_lock_key,
-                                       macsec_get_nest_level(dev));
-
         err = netdev_upper_dev_link(real_dev, dev, extack);
         if (err < 0)
                 goto unregister;
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 940192c057b6..34fc59bd1e20 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -852,8 +852,6 @@ static int macvlan_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
  * "super class" of normal network devices; split their locks off into a
  * separate class since they always nest.
  */
-static struct lock_class_key macvlan_netdev_addr_lock_key;
-
 #define ALWAYS_ON_OFFLOADS \
         (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_GSO_SOFTWARE | \
          NETIF_F_GSO_ROBUST | NETIF_F_GSO_ENCAP_ALL)
@@ -869,19 +867,6 @@ static struct lock_class_key macvlan_netdev_addr_lock_key;
 #define MACVLAN_STATE_MASK \
         ((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT))
 
-static int macvlan_get_nest_level(struct net_device *dev)
-{
-        return ((struct macvlan_dev *)netdev_priv(dev))->nest_level;
-}
-
-static void macvlan_set_lockdep_class(struct net_device *dev)
-{
-        netdev_lockdep_set_classes(dev);
-        lockdep_set_class_and_subclass(&dev->addr_list_lock,
-                                       &macvlan_netdev_addr_lock_key,
-                                       macvlan_get_nest_level(dev));
-}
-
 static int macvlan_init(struct net_device *dev)
 {
         struct macvlan_dev *vlan = netdev_priv(dev);
@@ -900,8 +885,6 @@ static int macvlan_init(struct net_device *dev)
         dev->gso_max_segs       = lowerdev->gso_max_segs;
         dev->hard_header_len    = lowerdev->hard_header_len;
 
-        macvlan_set_lockdep_class(dev);
-
         vlan->pcpu_stats = netdev_alloc_pcpu_stats(struct vlan_pcpu_stats);
         if (!vlan->pcpu_stats)
                 return -ENOMEM;
@@ -1161,7 +1144,6 @@ static const struct net_device_ops macvlan_netdev_ops = {
         .ndo_fdb_add            = macvlan_fdb_add,
         .ndo_fdb_del            = macvlan_fdb_del,
         .ndo_fdb_dump           = ndo_dflt_fdb_dump,
-        .ndo_get_lock_subclass  = macvlan_get_nest_level,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = macvlan_dev_poll_controller,
         .ndo_netpoll_setup      = macvlan_dev_netpoll_setup,
@@ -1445,7 +1427,6 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
         vlan->dev      = dev;
         vlan->port     = port;
         vlan->set_features = MACVLAN_FEATURES;
-        vlan->nest_level = dev_get_nest_level(lowerdev) + 1;
 
         vlan->mode     = MACVLAN_MODE_VEPA;
         if (data && data[IFLA_MACVLAN_MODE])
diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
index 56576d4f34a5..54ca6681ba31 100644
--- a/drivers/net/netdevsim/dev.c
+++ b/drivers/net/netdevsim/dev.c
@@ -806,9 +806,11 @@ static void nsim_dev_port_del_all(struct nsim_dev *nsim_dev)
 {
         struct nsim_dev_port *nsim_dev_port, *tmp;
 
+        mutex_lock(&nsim_dev->port_list_lock);
         list_for_each_entry_safe(nsim_dev_port, tmp,
                                  &nsim_dev->port_list, list)
                 __nsim_dev_port_del(nsim_dev_port);
+        mutex_unlock(&nsim_dev->port_list_lock);
 }
 
 int nsim_dev_probe(struct nsim_bus_dev *nsim_bus_dev)
@@ -822,14 +824,17 @@ int nsim_dev_probe(struct nsim_bus_dev *nsim_bus_dev)
                 return PTR_ERR(nsim_dev);
         dev_set_drvdata(&nsim_bus_dev->dev, nsim_dev);
 
+        mutex_lock(&nsim_dev->port_list_lock);
         for (i = 0; i < nsim_bus_dev->port_count; i++) {
                 err = __nsim_dev_port_add(nsim_dev, i);
                 if (err)
                         goto err_port_del_all;
         }
+        mutex_unlock(&nsim_dev->port_list_lock);
         return 0;
 
 err_port_del_all:
+        mutex_unlock(&nsim_dev->port_list_lock);
         nsim_dev_port_del_all(nsim_dev);
         nsim_dev_destroy(nsim_dev);
         return err;
diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
index 20e2ebe458f2..a578f7ebf715 100644
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -87,8 +87,24 @@ struct phylink {
         phylink_printk(KERN_WARNING, pl, fmt, ##__VA_ARGS__)
 #define phylink_info(pl, fmt, ...) \
         phylink_printk(KERN_INFO, pl, fmt, ##__VA_ARGS__)
+#if defined(CONFIG_DYNAMIC_DEBUG)
 #define phylink_dbg(pl, fmt, ...) \
+do {                                                                    \
+        if ((pl)->config->type == PHYLINK_NETDEV)                       \
+                netdev_dbg((pl)->netdev, fmt, ##__VA_ARGS__);           \
+        else if ((pl)->config->type == PHYLINK_DEV)                     \
+                dev_dbg((pl)->dev, fmt, ##__VA_ARGS__);                 \
+} while (0)
+#elif defined(DEBUG)
+#define phylink_dbg(pl, fmt, ...)                                       \
         phylink_printk(KERN_DEBUG, pl, fmt, ##__VA_ARGS__)
+#else
+#define phylink_dbg(pl, fmt, ...)                                       \
+({                                                                      \
+        if (0)                                                          \
+                phylink_printk(KERN_DEBUG, pl, fmt, ##__VA_ARGS__);     \
+})
+#endif
 
 /**
  * phylink_set_port_modes() - set the port type modes in the ethtool mask
diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c
index dc3d92d340c4..b73298250793 100644
--- a/drivers/net/phy/smsc.c
+++ b/drivers/net/phy/smsc.c
@@ -327,6 +327,7 @@ static struct phy_driver smsc_phy_driver[] = {
         .name           = "SMSC LAN8740",
 
         /* PHY_BASIC_FEATURES */
+        .flags          = PHY_RST_AFTER_CLK_EN,
 
         .probe          = smsc_phy_probe,
 
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 9a1b006904a7..61824bbb5588 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -1324,8 +1324,6 @@ static int ppp_dev_init(struct net_device *dev)
 {
         struct ppp *ppp;
 
-        netdev_lockdep_set_classes(dev);
-
         ppp = netdev_priv(dev);
         /* Let the netdevice take a reference on the ppp file. This ensures
          * that ppp_destroy_interface() won't run before the device gets
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index e8089def5a46..8156b33ee3e7 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1615,7 +1615,6 @@ static int team_init(struct net_device *dev)
         int err;
 
         team->dev = dev;
-        mutex_init(&team->lock);
         team_set_no_mode(team);
 
         team->pcpu_stats = netdev_alloc_pcpu_stats(struct team_pcpu_stats);
@@ -1642,7 +1641,8 @@ static int team_init(struct net_device *dev)
                 goto err_options_register;
         netif_carrier_off(dev);
 
-        netdev_lockdep_set_classes(dev);
+        lockdep_register_key(&team->team_lock_key);
+        __mutex_init(&team->lock, "team->team_lock_key", &team->team_lock_key);
 
         return 0;
 
@@ -1673,6 +1673,7 @@ static void team_uninit(struct net_device *dev)
         team_queue_override_fini(team);
         mutex_unlock(&team->lock);
         netdev_change_features(dev);
+        lockdep_unregister_key(&team->team_lock_key);
 }
 
 static void team_destructor(struct net_device *dev)
@@ -1976,8 +1977,15 @@ static int team_del_slave(struct net_device *dev, struct net_device *port_dev)
         err = team_port_del(team, port_dev);
         mutex_unlock(&team->lock);
 
-        if (!err)
-                netdev_change_features(dev);
+        if (err)
+                return err;
+
+        if (netif_is_team_master(port_dev)) {
+                lockdep_unregister_key(&team->team_lock_key);
+                lockdep_register_key(&team->team_lock_key);
+                lockdep_set_class(&team->lock, &team->team_lock_key);
+        }
+        netdev_change_features(dev);
 
         return err;
 }
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 32f53de5b1fe..fe630438f67b 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -787,6 +787,13 @@ static const struct usb_device_id	products[] = {
         .driver_info = 0,
 },
 
+/* ThinkPad USB-C Dock Gen 2 (based on Realtek RTL8153) */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0xa387, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
+
 /* NVIDIA Tegra USB 3.0 Ethernet Adapters (based on Realtek RTL8153) */
 {
         USB_DEVICE_AND_INTERFACE_INFO(NVIDIA_VENDOR_ID, 0x09ff, USB_CLASS_COMM,
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 62948098191f..f24a1b0b801f 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -1264,8 +1264,11 @@ static void lan78xx_status(struct lan78xx_net *dev, struct urb *urb)
                 netif_dbg(dev, link, dev->net, "PHY INTR: 0x%08x\n", intdata);
                 lan78xx_defer_kevent(dev, EVENT_LINK_RESET);
 
-                if (dev->domain_data.phyirq > 0)
+                if (dev->domain_data.phyirq > 0) {
+                        local_irq_disable();
                         generic_handle_irq(dev->domain_data.phyirq);
+                        local_irq_enable();
+                }
         } else
                 netdev_warn(dev->net,
                             "unexpected interrupt: 0x%08x\n", intdata);
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index cee9fef925cd..d4a95b50bda6 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -5755,6 +5755,7 @@ static const struct usb_device_id rtl8152_table[] = {
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7205)},
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x720c)},
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7214)},
+        {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0xa387)},
         {REALTEK_USB_DEVICE(VENDOR_ID_LINKSYS, 0x0041)},
         {REALTEK_USB_DEVICE(VENDOR_ID_NVIDIA,  0x09ff)},
         {REALTEK_USB_DEVICE(VENDOR_ID_TPLINK,  0x0601)},
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index ee52bde058df..b8228f50bc94 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -865,7 +865,6 @@ static int vrf_dev_init(struct net_device *dev)
 
         /* similarly, oper state is irrelevant; set to up to avoid confusion */
         dev->operstate = IF_OPER_UP;
-        netdev_lockdep_set_classes(dev);
         return 0;
 
 out_rth:
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 3d9bcc957f7d..8869154fad88 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2487,9 +2487,11 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 vni = tunnel_id_to_key32(info->key.tun_id);
                 ifindex = 0;
                 dst_cache = &info->dst_cache;
-                if (info->options_len &&
-                    info->key.tun_flags & TUNNEL_VXLAN_OPT)
+                if (info->key.tun_flags & TUNNEL_VXLAN_OPT) {
+                        if (info->options_len < sizeof(*md))
+                                goto drop;
                         md = ip_tunnel_info_opts(info);
+                }
                 ttl = info->key.ttl;
                 tos = info->key.tos;
                 label = info->key.label;
@@ -3566,10 +3568,13 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
 {
         struct vxlan_net *vn = net_generic(net, vxlan_net_id);
         struct vxlan_dev *vxlan = netdev_priv(dev);
+        struct net_device *remote_dev = NULL;
         struct vxlan_fdb *f = NULL;
         bool unregister = false;
+        struct vxlan_rdst *dst;
         int err;
 
+        dst = &vxlan->default_dst;
         err = vxlan_dev_configure(net, dev, conf, false, extack);
         if (err)
                 return err;
@@ -3577,14 +3582,14 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
         dev->ethtool_ops = &vxlan_ethtool_ops;
 
         /* create an fdb entry for a valid default destination */
-        if (!vxlan_addr_any(&vxlan->default_dst.remote_ip)) {
+        if (!vxlan_addr_any(&dst->remote_ip)) {
                 err = vxlan_fdb_create(vxlan, all_zeros_mac,
-                                       &vxlan->default_dst.remote_ip,
+                                       &dst->remote_ip,
                                        NUD_REACHABLE | NUD_PERMANENT,
                                        vxlan->cfg.dst_port,
-                                       vxlan->default_dst.remote_vni,
-                                       vxlan->default_dst.remote_vni,
-                                       vxlan->default_dst.remote_ifindex,
+                                       dst->remote_vni,
+                                       dst->remote_vni,
+                                       dst->remote_ifindex,
                                        NTF_SELF, &f);
                 if (err)
                         return err;
@@ -3595,26 +3600,41 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
                 goto errout;
         unregister = true;
 
+        if (dst->remote_ifindex) {
+                remote_dev = __dev_get_by_index(net, dst->remote_ifindex);
+                if (!remote_dev)
+                        goto errout;
+
+                err = netdev_upper_dev_link(remote_dev, dev, extack);
+                if (err)
+                        goto errout;
+        }
+
         err = rtnl_configure_link(dev, NULL);
         if (err)
-                goto errout;
+                goto unlink;
 
         if (f) {
-                vxlan_fdb_insert(vxlan, all_zeros_mac,
-                                 vxlan->default_dst.remote_vni, f);
+                vxlan_fdb_insert(vxlan, all_zeros_mac, dst->remote_vni, f);
 
                 /* notify default fdb entry */
                 err = vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f),
                                        RTM_NEWNEIGH, true, extack);
                 if (err) {
                         vxlan_fdb_destroy(vxlan, f, false, false);
+                        if (remote_dev)
+                                netdev_upper_dev_unlink(remote_dev, dev);
                         goto unregister;
                 }
         }
 
         list_add(&vxlan->next, &vn->vxlan_list);
+        if (remote_dev)
+                dst->remote_dev = remote_dev;
         return 0;
-
+unlink:
+        if (remote_dev)
+                netdev_upper_dev_unlink(remote_dev, dev);
 errout:
         /* unregister_netdevice() destroys the default FDB entry with deletion
          * notification. But the addition notification was not sent yet, so
@@ -3932,11 +3952,12 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
                             struct netlink_ext_ack *extack)
 {
         struct vxlan_dev *vxlan = netdev_priv(dev);
-        struct vxlan_rdst *dst = &vxlan->default_dst;
         struct net_device *lowerdev;
         struct vxlan_config conf;
+        struct vxlan_rdst *dst;
         int err;
 
+        dst = &vxlan->default_dst;
         err = vxlan_nl2conf(tb, data, dev, &conf, true, extack);
         if (err)
                 return err;
@@ -3946,6 +3967,14 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
         if (err)
                 return err;
 
+        if (dst->remote_dev == lowerdev)
+                lowerdev = NULL;
+
+        err = netdev_adjacent_change_prepare(dst->remote_dev, lowerdev, dev,
+                                             extack);
+        if (err)
+                return err;
+
         /* handle default dst entry */
         if (!vxlan_addr_equal(&conf.remote_ip, &dst->remote_ip)) {
                 u32 hash_index = fdb_head_index(vxlan, all_zeros_mac, conf.vni);
@@ -3962,6 +3991,8 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
                                                NTF_SELF, true, extack);
                         if (err) {
                                 spin_unlock_bh(&vxlan->hash_lock[hash_index]);
+                                netdev_adjacent_change_abort(dst->remote_dev,
+                                                             lowerdev, dev);
                                 return err;
                         }
                 }
@@ -3979,6 +4010,11 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
         if (conf.age_interval != vxlan->cfg.age_interval)
                 mod_timer(&vxlan->age_timer, jiffies);
 
+        netdev_adjacent_change_commit(dst->remote_dev, lowerdev, dev);
+        if (lowerdev && lowerdev != dst->remote_dev) {
+                dst->remote_dev = lowerdev;
+                netdev_update_lockdep_key(lowerdev);
+        }
         vxlan_config_apply(dev, &conf, lowerdev, vxlan->net, true);
         return 0;
 }
@@ -3991,6 +4027,8 @@ static void vxlan_dellink(struct net_device *dev, struct list_head *head)
 
         list_del(&vxlan->next);
         unregister_netdevice_queue(dev, head);
+        if (vxlan->default_dst.remote_dev)
+                netdev_upper_dev_unlink(vxlan->default_dst.remote_dev, dev);
 }
 
 static size_t vxlan_get_size(const struct net_device *dev)
diff --git a/drivers/net/wimax/i2400m/op-rfkill.c b/drivers/net/wimax/i2400m/op-rfkill.c
index 8efb493ceec2..5c79f052cad2 100644
--- a/drivers/net/wimax/i2400m/op-rfkill.c
+++ b/drivers/net/wimax/i2400m/op-rfkill.c
@@ -127,12 +127,12 @@ int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev,
                         "%d\n", result);
         result = 0;
 error_cmd:
-        kfree(cmd);
         kfree_skb(ack_skb);
 error_msg_to_dev:
 error_alloc:
         d_fnend(4, dev, "(wimax_dev %p state %d) = %d\n",
                 wimax_dev, state, result);
+        kfree(cmd);
         return result;
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
index 39c64850cb6f..c0750ced5ac2 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
@@ -520,7 +520,7 @@ struct iwl_scan_dwell {
 } __packed;
 
 /**
- * struct iwl_scan_config
+ * struct iwl_scan_config_v1
  * @flags:                      enum scan_config_flags
  * @tx_chains:                  valid_tx antenna - ANT_* definitions
  * @rx_chains:                  valid_rx antenna - ANT_* definitions
@@ -552,7 +552,7 @@ struct iwl_scan_config_v1 {
 #define SCAN_LB_LMAC_IDX 0
 #define SCAN_HB_LMAC_IDX 1
 
-struct iwl_scan_config {
+struct iwl_scan_config_v2 {
         __le32 flags;
         __le32 tx_chains;
         __le32 rx_chains;
@@ -564,6 +564,24 @@ struct iwl_scan_config {
         u8 bcast_sta_id;
         u8 channel_flags;
         u8 channel_array[];
+} __packed; /* SCAN_CONFIG_DB_CMD_API_S_2 */
+
+/**
+ * struct iwl_scan_config
+ * @enable_cam_mode: whether to enable CAM mode.
+ * @enable_promiscouos_mode: whether to enable promiscouos mode
+ * @bcast_sta_id: the index of the station in the fw
+ * @reserved: reserved
+ * @tx_chains: valid_tx antenna - ANT_* definitions
+ * @rx_chains: valid_rx antenna - ANT_* definitions
+ */
+struct iwl_scan_config {
+        u8 enable_cam_mode;
+        u8 enable_promiscouos_mode;
+        u8 bcast_sta_id;
+        u8 reserved;
+        __le32 tx_chains;
+        __le32 rx_chains;
 } __packed; /* SCAN_CONFIG_DB_CMD_API_S_3 */
 
 /**
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/file.h b/drivers/net/wireless/intel/iwlwifi/fw/file.h
index 423cc0cf8e78..0d5bc4ce5c07 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h
@@ -288,6 +288,8 @@ typedef unsigned int __bitwise iwl_ucode_tlv_api_t;
  *      STA_CONTEXT_DOT11AX_API_S
  * @IWL_UCODE_TLV_CAPA_SAR_TABLE_VER: This ucode supports different sar
  *      version tables.
+ * @IWL_UCODE_TLV_API_REDUCED_SCAN_CONFIG: This ucode supports v3 of
+ *  SCAN_CONFIG_DB_CMD_API_S.
  *
  * @NUM_IWL_UCODE_TLV_API: number of bits used
  */
@@ -321,6 +323,7 @@ enum iwl_ucode_tlv_api {
         IWL_UCODE_TLV_API_WOWLAN_TCP_SYN_WAKE   = (__force iwl_ucode_tlv_api_t)53,
         IWL_UCODE_TLV_API_FTM_RTT_ACCURACY      = (__force iwl_ucode_tlv_api_t)54,
         IWL_UCODE_TLV_API_SAR_TABLE_VER         = (__force iwl_ucode_tlv_api_t)55,
+        IWL_UCODE_TLV_API_REDUCED_SCAN_CONFIG   = (__force iwl_ucode_tlv_api_t)56,
         IWL_UCODE_TLV_API_ADWELL_HB_DEF_N_AP    = (__force iwl_ucode_tlv_api_t)57,
         IWL_UCODE_TLV_API_SCAN_EXT_CHAN_VER     = (__force iwl_ucode_tlv_api_t)58,
 
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
index cb4c5514a556..695bbaa86273 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
@@ -279,6 +279,7 @@
  *         Indicates MAC is entering a power-saving sleep power-down.
  *         Not a good time to access device-internal resources.
  */
+#define CSR_GP_CNTRL_REG_FLAG_INIT_DONE              (0x00000004)
 #define CSR_GP_CNTRL_REG_FLAG_GOING_TO_SLEEP         (0x00000010)
 #define CSR_GP_CNTRL_REG_FLAG_XTAL_ON                (0x00000400)
 
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
index f47e0f97acf8..23c25a7665f2 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
@@ -449,6 +449,11 @@ enum {
 #define PERSISTENCE_BIT                 BIT(12)
 #define PREG_WFPM_ACCESS                BIT(12)
 
+#define HPM_HIPM_GEN_CFG                        0xA03458
+#define HPM_HIPM_GEN_CFG_CR_PG_EN               BIT(0)
+#define HPM_HIPM_GEN_CFG_CR_SLP_EN              BIT(1)
+#define HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE        BIT(10)
+
 #define UREG_DOORBELL_TO_ISR6           0xA05C04
 #define UREG_DOORBELL_TO_ISR6_NMI_BIT   BIT(0)
 #define UREG_DOORBELL_TO_ISR6_SUSPEND   BIT(18)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 843d00bf2bd5..5ca50f39a023 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -1405,6 +1405,12 @@ static inline bool iwl_mvm_is_scan_ext_chan_supported(struct iwl_mvm *mvm)
                           IWL_UCODE_TLV_API_SCAN_EXT_CHAN_VER);
 }
 
+static inline bool iwl_mvm_is_reduced_config_scan_supported(struct iwl_mvm *mvm)
+{
+        return fw_has_api(&mvm->fw->ucode_capa,
+                          IWL_UCODE_TLV_API_REDUCED_SCAN_CONFIG);
+}
+
 static inline bool iwl_mvm_has_new_rx_stats_api(struct iwl_mvm *mvm)
 {
         return fw_has_api(&mvm->fw->ucode_capa,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index f6b3045badbd..fcafa22ec6ce 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -1137,11 +1137,11 @@ static void iwl_mvm_fill_scan_config_v1(struct iwl_mvm *mvm, void *config,
         iwl_mvm_fill_channels(mvm, cfg->channel_array, max_channels);
 }
 
-static void iwl_mvm_fill_scan_config(struct iwl_mvm *mvm, void *config,
-                                     u32 flags, u8 channel_flags,
-                                     u32 max_channels)
+static void iwl_mvm_fill_scan_config_v2(struct iwl_mvm *mvm, void *config,
+                                        u32 flags, u8 channel_flags,
+                                        u32 max_channels)
 {
-        struct iwl_scan_config *cfg = config;
+        struct iwl_scan_config_v2 *cfg = config;
 
         cfg->flags = cpu_to_le32(flags);
         cfg->tx_chains = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
@@ -1185,7 +1185,7 @@ static void iwl_mvm_fill_scan_config(struct iwl_mvm *mvm, void *config,
         iwl_mvm_fill_channels(mvm, cfg->channel_array, max_channels);
 }
 
-int iwl_mvm_config_scan(struct iwl_mvm *mvm)
+static int iwl_mvm_legacy_config_scan(struct iwl_mvm *mvm)
 {
         void *cfg;
         int ret, cmd_size;
@@ -1217,7 +1217,7 @@ int iwl_mvm_config_scan(struct iwl_mvm *mvm)
         }
 
         if (iwl_mvm_cdb_scan_api(mvm))
-                cmd_size = sizeof(struct iwl_scan_config);
+                cmd_size = sizeof(struct iwl_scan_config_v2);
         else
                 cmd_size = sizeof(struct iwl_scan_config_v1);
         cmd_size += num_channels;
@@ -1254,8 +1254,8 @@ int iwl_mvm_config_scan(struct iwl_mvm *mvm)
                         flags |= (iwl_mvm_is_scan_fragmented(hb_type)) ?
                                  SCAN_CONFIG_FLAG_SET_LMAC2_FRAGMENTED :
                                  SCAN_CONFIG_FLAG_CLEAR_LMAC2_FRAGMENTED;
-                iwl_mvm_fill_scan_config(mvm, cfg, flags, channel_flags,
-                                         num_channels);
+                iwl_mvm_fill_scan_config_v2(mvm, cfg, flags, channel_flags,
+                                            num_channels);
         } else {
                 iwl_mvm_fill_scan_config_v1(mvm, cfg, flags, channel_flags,
                                             num_channels);
@@ -1277,6 +1277,30 @@ int iwl_mvm_config_scan(struct iwl_mvm *mvm)
         return ret;
 }
 
+int iwl_mvm_config_scan(struct iwl_mvm *mvm)
+{
+        struct iwl_scan_config cfg;
+        struct iwl_host_cmd cmd = {
+                .id = iwl_cmd_id(SCAN_CFG_CMD, IWL_ALWAYS_LONG_GROUP, 0),
+                .len[0] = sizeof(cfg),
+                .data[0] = &cfg,
+                .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
+        };
+
+        if (!iwl_mvm_is_reduced_config_scan_supported(mvm))
+                return iwl_mvm_legacy_config_scan(mvm);
+
+        memset(&cfg, 0, sizeof(cfg));
+
+        cfg.bcast_sta_id = mvm->aux_sta.sta_id;
+        cfg.tx_chains = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
+        cfg.rx_chains = cpu_to_le32(iwl_mvm_scan_rx_ant(mvm));
+
+        IWL_DEBUG_SCAN(mvm, "Sending UMAC scan config\n");
+
+        return iwl_mvm_send_cmd(mvm, &cmd);
+}
+
 static int iwl_mvm_scan_uid_by_status(struct iwl_mvm *mvm, int status)
 {
         int i;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 0bedba4c61f2..b3768d5d852a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -1482,6 +1482,13 @@ static void iwl_mvm_realloc_queues_after_restart(struct iwl_mvm *mvm,
                                             mvm_sta->sta_id, i);
                         txq_id = iwl_mvm_tvqm_enable_txq(mvm, mvm_sta->sta_id,
                                                          i, wdg);
+                        /*
+                         * on failures, just set it to IWL_MVM_INVALID_QUEUE
+                         * to try again later, we have no other good way of
+                         * failing here
+                         */
+                        if (txq_id < 0)
+                                txq_id = IWL_MVM_INVALID_QUEUE;
                         tid_data->txq_id = txq_id;
 
                         /*
@@ -1950,30 +1957,73 @@ void iwl_mvm_dealloc_int_sta(struct iwl_mvm *mvm, struct iwl_mvm_int_sta *sta)
         sta->sta_id = IWL_MVM_INVALID_STA;
 }
 
-static void iwl_mvm_enable_aux_snif_queue(struct iwl_mvm *mvm, u16 *queue,
+static void iwl_mvm_enable_aux_snif_queue(struct iwl_mvm *mvm, u16 queue,
                                           u8 sta_id, u8 fifo)
 {
         unsigned int wdg_timeout = iwlmvm_mod_params.tfd_q_hang_detect ?
                 mvm->trans->trans_cfg->base_params->wd_timeout :
                 IWL_WATCHDOG_DISABLED;
+        struct iwl_trans_txq_scd_cfg cfg = {
+                .fifo = fifo,
+                .sta_id = sta_id,
+                .tid = IWL_MAX_TID_COUNT,
+                .aggregate = false,
+                .frame_limit = IWL_FRAME_LIMIT,
+        };
+
+        WARN_ON(iwl_mvm_has_new_tx_api(mvm));
+
+        iwl_mvm_enable_txq(mvm, NULL, queue, 0, &cfg, wdg_timeout);
+}
+
+static int iwl_mvm_enable_aux_snif_queue_tvqm(struct iwl_mvm *mvm, u8 sta_id)
+{
+        unsigned int wdg_timeout = iwlmvm_mod_params.tfd_q_hang_detect ?
+                mvm->trans->trans_cfg->base_params->wd_timeout :
+                IWL_WATCHDOG_DISABLED;
+
+        WARN_ON(!iwl_mvm_has_new_tx_api(mvm));
+
+        return iwl_mvm_tvqm_enable_txq(mvm, sta_id, IWL_MAX_TID_COUNT,
+                                       wdg_timeout);
+}
 
+static int iwl_mvm_add_int_sta_with_queue(struct iwl_mvm *mvm, int macidx,
+                                          int maccolor,
+                                          struct iwl_mvm_int_sta *sta,
+                                          u16 *queue, int fifo)
+{
+        int ret;
+
+        /* Map queue to fifo - needs to happen before adding station */
+        if (!iwl_mvm_has_new_tx_api(mvm))
+                iwl_mvm_enable_aux_snif_queue(mvm, *queue, sta->sta_id, fifo);
+
+        ret = iwl_mvm_add_int_sta_common(mvm, sta, NULL, macidx, maccolor);
+        if (ret) {
+                if (!iwl_mvm_has_new_tx_api(mvm))
+                        iwl_mvm_disable_txq(mvm, NULL, *queue,
+                                            IWL_MAX_TID_COUNT, 0);
+                return ret;
+        }
+
+        /*
+         * For 22000 firmware and on we cannot add queue to a station unknown
+         * to firmware so enable queue here - after the station was added
+         */
         if (iwl_mvm_has_new_tx_api(mvm)) {
-                int tvqm_queue =
-                        iwl_mvm_tvqm_enable_txq(mvm, sta_id,
-                                                IWL_MAX_TID_COUNT,
-                                                wdg_timeout);
-                *queue = tvqm_queue;
-        } else {
-                struct iwl_trans_txq_scd_cfg cfg = {
-                        .fifo = fifo,
-                        .sta_id = sta_id,
-                        .tid = IWL_MAX_TID_COUNT,
-                        .aggregate = false,
-                        .frame_limit = IWL_FRAME_LIMIT,
-                };
+                int txq;
 
-                iwl_mvm_enable_txq(mvm, NULL, *queue, 0, &cfg, wdg_timeout);
+                txq = iwl_mvm_enable_aux_snif_queue_tvqm(mvm, sta->sta_id);
+                if (txq < 0) {
+                        iwl_mvm_rm_sta_common(mvm, sta->sta_id);
+                        return txq;
+                }
+
+                *queue = txq;
         }
+
+        return 0;
 }
 
 int iwl_mvm_add_aux_sta(struct iwl_mvm *mvm)
@@ -1989,59 +2039,26 @@ int iwl_mvm_add_aux_sta(struct iwl_mvm *mvm)
         if (ret)
                 return ret;
 
-        /* Map Aux queue to fifo - needs to happen before adding Aux station */
-        if (!iwl_mvm_has_new_tx_api(mvm))
-                iwl_mvm_enable_aux_snif_queue(mvm, &mvm->aux_queue,
-                                              mvm->aux_sta.sta_id,
-                                              IWL_MVM_TX_FIFO_MCAST);
-
-        ret = iwl_mvm_add_int_sta_common(mvm, &mvm->aux_sta, NULL,
-                                         MAC_INDEX_AUX, 0);
+        ret = iwl_mvm_add_int_sta_with_queue(mvm, MAC_INDEX_AUX, 0,
+                                             &mvm->aux_sta, &mvm->aux_queue,
+                                             IWL_MVM_TX_FIFO_MCAST);
         if (ret) {
                 iwl_mvm_dealloc_int_sta(mvm, &mvm->aux_sta);
                 return ret;
         }
 
-        /*
-         * For 22000 firmware and on we cannot add queue to a station unknown
-         * to firmware so enable queue here - after the station was added
-         */
-        if (iwl_mvm_has_new_tx_api(mvm))
-                iwl_mvm_enable_aux_snif_queue(mvm, &mvm->aux_queue,
-                                              mvm->aux_sta.sta_id,
-                                              IWL_MVM_TX_FIFO_MCAST);
-
         return 0;
 }
 
 int iwl_mvm_add_snif_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        int ret;
 
         lockdep_assert_held(&mvm->mutex);
 
-        /* Map snif queue to fifo - must happen before adding snif station */
-        if (!iwl_mvm_has_new_tx_api(mvm))
-                iwl_mvm_enable_aux_snif_queue(mvm, &mvm->snif_queue,
-                                              mvm->snif_sta.sta_id,
+        return iwl_mvm_add_int_sta_with_queue(mvm, mvmvif->id, mvmvif->color,
+                                              &mvm->snif_sta, &mvm->snif_queue,
                                               IWL_MVM_TX_FIFO_BE);
-
-        ret = iwl_mvm_add_int_sta_common(mvm, &mvm->snif_sta, vif->addr,
-                                         mvmvif->id, 0);
-        if (ret)
-                return ret;
-
-        /*
-         * For 22000 firmware and on we cannot add queue to a station unknown
-         * to firmware so enable queue here - after the station was added
-         */
-        if (iwl_mvm_has_new_tx_api(mvm))
-                iwl_mvm_enable_aux_snif_queue(mvm, &mvm->snif_queue,
-                                              mvm->snif_sta.sta_id,
-                                              IWL_MVM_TX_FIFO_BE);
-
-        return 0;
 }
 
 int iwl_mvm_rm_snif_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
@@ -2133,6 +2150,10 @@ int iwl_mvm_send_add_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                 queue = iwl_mvm_tvqm_enable_txq(mvm, bsta->sta_id,
                                                 IWL_MAX_TID_COUNT,
                                                 wdg_timeout);
+                if (queue < 0) {
+                        iwl_mvm_rm_sta_common(mvm, bsta->sta_id);
+                        return queue;
+                }
 
                 if (vif->type == NL80211_IFTYPE_AP ||
                     vif->type == NL80211_IFTYPE_ADHOC)
@@ -2307,10 +2328,8 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         }
         ret = iwl_mvm_add_int_sta_common(mvm, msta, maddr,
                                          mvmvif->id, mvmvif->color);
-        if (ret) {
-                iwl_mvm_dealloc_int_sta(mvm, msta);
-                return ret;
-        }
+        if (ret)
+                goto err;
 
         /*
          * Enable cab queue after the ADD_STA command is sent.
@@ -2323,6 +2342,10 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                 int queue = iwl_mvm_tvqm_enable_txq(mvm, msta->sta_id,
                                                     0,
                                                     timeout);
+                if (queue < 0) {
+                        ret = queue;
+                        goto err;
+                }
                 mvmvif->cab_queue = queue;
         } else if (!fw_has_api(&mvm->fw->ucode_capa,
                                IWL_UCODE_TLV_API_STA_TYPE))
@@ -2330,6 +2353,9 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                                    timeout);
 
         return 0;
+err:
+        iwl_mvm_dealloc_int_sta(mvm, msta);
+        return ret;
 }
 
 static int __iwl_mvm_remove_sta_key(struct iwl_mvm *mvm, u8 sta_id,
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 6f4bb7ce71a5..040cec17d3ad 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -573,20 +573,20 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x2526, 0x0034, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0038, iwl9560_2ac_160_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x003C, iwl9560_2ac_160_cfg)},
-        {IWL_PCI_DEVICE(0x2526, 0x0060, iwl9460_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x2526, 0x0064, iwl9460_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x2526, 0x00A0, iwl9460_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x2526, 0x00A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0060, iwl9461_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2526, 0x0064, iwl9461_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2526, 0x00A0, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2526, 0x00A4, iwl9462_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x0210, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0214, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0230, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0234, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0238, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x023C, iwl9560_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x2526, 0x0260, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0260, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x0264, iwl9461_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2526, 0x02A0, iwl9460_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x2526, 0x02A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x02A0, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2526, 0x02A4, iwl9462_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x1030, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x1210, iwl9260_2ac_cfg)},
@@ -603,7 +603,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x2526, 0x401C, iwl9260_2ac_160_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_160_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x4034, iwl9560_2ac_160_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9462_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x4234, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x42A4, iwl9462_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x6010, iwl9260_2ac_160_cfg)},
@@ -618,60 +618,61 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x271B, 0x0210, iwl9160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x271B, 0x0214, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x271C, 0x0214, iwl9260_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x2720, 0x0034, iwl9560_2ac_160_cfg)},
-        {IWL_PCI_DEVICE(0x2720, 0x0038, iwl9560_2ac_160_cfg)},
-        {IWL_PCI_DEVICE(0x2720, 0x003C, iwl9560_2ac_160_cfg)},
-        {IWL_PCI_DEVICE(0x2720, 0x0060, iwl9461_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x0064, iwl9461_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x00A0, iwl9462_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x00A4, iwl9462_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x0230, iwl9560_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x2720, 0x0234, iwl9560_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x2720, 0x0238, iwl9560_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x2720, 0x023C, iwl9560_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x2720, 0x0260, iwl9461_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x0264, iwl9461_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x02A0, iwl9462_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x02A4, iwl9462_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x1010, iwl9260_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x2720, 0x1030, iwl9560_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x1210, iwl9260_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x2720, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x1552, iwl9560_killer_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x2030, iwl9560_2ac_160_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x2034, iwl9560_2ac_160_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x4030, iwl9560_2ac_160_cfg)},
-        {IWL_PCI_DEVICE(0x2720, 0x4034, iwl9560_2ac_160_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x40A4, iwl9462_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x4234, iwl9560_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x42A4, iwl9462_2ac_cfg_soc)},
-
-        {IWL_PCI_DEVICE(0x30DC, 0x0030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0038, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x003C, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9461_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0064, iwl9461_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x00A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x00A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0230, iwl9560_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0238, iwl9560_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x023C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0260, iwl9461_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0264, iwl9461_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x02A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x02A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x1551, killer1550s_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x1552, killer1550i_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x4034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x40A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x4234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x30DC, 0x42A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
+
+        {IWL_PCI_DEVICE(0x2720, 0x0034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x0038, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x003C, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x0060, iwl9461_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x0064, iwl9461_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x00A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x00A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x0230, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x0234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x0238, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x023C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x0260, iwl9461_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x0264, iwl9461_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x02A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x02A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x1030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x1551, killer1550s_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x1552, killer1550i_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x2030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x2034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x4030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x4034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x40A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x4234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x2720, 0x42A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
+
+        {IWL_PCI_DEVICE(0x30DC, 0x0030, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0034, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0038, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x003C, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9460_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0064, iwl9461_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x00A0, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x00A4, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0230, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0234, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0238, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x023C, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0260, iwl9461_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0264, iwl9461_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x02A0, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x02A4, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x1010, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x30DC, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x4034, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x40A4, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x4234, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x42A4, iwl9462_2ac_cfg_soc)},
 
         {IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_160_cfg_shared_clk)},
         {IWL_PCI_DEVICE(0x31DC, 0x0034, iwl9560_2ac_cfg_shared_clk)},
@@ -1067,11 +1068,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 }
         } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(iwl_trans->hw_rf_id) ==
                    CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR) &&
-                   ((cfg != &iwl_ax200_cfg_cc &&
-                     cfg != &killer1650x_2ax_cfg &&
-                     cfg != &killer1650w_2ax_cfg &&
-                     cfg != &iwl_ax201_cfg_quz_hr) ||
-                    iwl_trans->hw_rev == CSR_HW_REV_TYPE_QNJ_B0)) {
+                   iwl_trans->hw_rev == CSR_HW_REV_TYPE_QNJ_B0) {
                 u32 hw_status;
 
                 hw_status = iwl_read_prph(iwl_trans, UMAG_GEN_HW_STATUS);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
index df8455f14e4d..ca3bb4d65b00 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
@@ -57,6 +57,24 @@
 #include "internal.h"
 #include "fw/dbg.h"
 
+static int iwl_pcie_gen2_force_power_gating(struct iwl_trans *trans)
+{
+        iwl_set_bits_prph(trans, HPM_HIPM_GEN_CFG,
+                          HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE);
+        udelay(20);
+        iwl_set_bits_prph(trans, HPM_HIPM_GEN_CFG,
+                          HPM_HIPM_GEN_CFG_CR_PG_EN |
+                          HPM_HIPM_GEN_CFG_CR_SLP_EN);
+        udelay(20);
+        iwl_clear_bits_prph(trans, HPM_HIPM_GEN_CFG,
+                            HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE);
+
+        iwl_trans_sw_reset(trans);
+        iwl_clear_bit(trans, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
+
+        return 0;
+}
+
 /*
  * Start up NIC's basic functionality after it has been reset
  * (e.g. after platform boot, or shutdown via iwl_pcie_apm_stop())
@@ -92,6 +110,13 @@ int iwl_pcie_gen2_apm_init(struct iwl_trans *trans)
 
         iwl_pcie_apm_config(trans);
 
+        if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000 &&
+            trans->cfg->integrated) {
+                ret = iwl_pcie_gen2_force_power_gating(trans);
+                if (ret)
+                        return ret;
+        }
+
         ret = iwl_finish_nic_init(trans, trans->trans_cfg);
         if (ret)
                 return ret;
diff --git a/drivers/net/wireless/intersil/hostap/hostap_hw.c b/drivers/net/wireless/intersil/hostap/hostap_hw.c
index 158a3d762e55..e323e9a5999f 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_hw.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_hw.c
@@ -3041,30 +3041,6 @@ static void prism2_clear_set_tim_queue(local_info_t *local)
         }
 }
 
-
-/*
- * HostAP uses two layers of net devices, where the inner
- * layer gets called all the time from the outer layer.
- * This is a natural nesting, which needs a split lock type.
- */
-static struct lock_class_key hostap_netdev_xmit_lock_key;
-static struct lock_class_key hostap_netdev_addr_lock_key;
-
-static void prism2_set_lockdep_class_one(struct net_device *dev,
-                                         struct netdev_queue *txq,
-                                         void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock,
-                          &hostap_netdev_xmit_lock_key);
-}
-
-static void prism2_set_lockdep_class(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock,
-                          &hostap_netdev_addr_lock_key);
-        netdev_for_each_tx_queue(dev, prism2_set_lockdep_class_one, NULL);
-}
-
 static struct net_device *
 prism2_init_local_data(struct prism2_helper_functions *funcs, int card_idx,
                        struct device *sdev)
@@ -3223,7 +3199,6 @@ while (0)
         if (ret >= 0)
                 ret = register_netdevice(dev);
 
-        prism2_set_lockdep_class(dev);
         rtnl_unlock();
         if (ret < 0) {
                 printk(KERN_WARNING "%s: register netdevice failed!\n",
diff --git a/drivers/net/wireless/mediatek/mt76/Makefile b/drivers/net/wireless/mediatek/mt76/Makefile
index 4d03596e891f..d7a1ddc9e407 100644
--- a/drivers/net/wireless/mediatek/mt76/Makefile
+++ b/drivers/net/wireless/mediatek/mt76/Makefile
@@ -8,6 +8,8 @@ mt76-y := \
         mmio.o util.o trace.o dma.o mac80211.o debugfs.o eeprom.o \
         tx.o agg-rx.o mcu.o
 
+mt76-$(CONFIG_PCI) += pci.o
+
 mt76-usb-y := usb.o usb_trace.o
 
 CFLAGS_trace.o := -I$(src)
diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index c747eb24581c..8f69d00bd940 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -53,8 +53,10 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
         u32 ctrl;
         int i, idx = -1;
 
-        if (txwi)
+        if (txwi) {
                 q->entry[q->head].txwi = DMA_DUMMY_DATA;
+                q->entry[q->head].skip_buf0 = true;
+        }
 
         for (i = 0; i < nbufs; i += 2, buf += 2) {
                 u32 buf0 = buf[0].addr, buf1 = 0;
@@ -97,7 +99,7 @@ mt76_dma_tx_cleanup_idx(struct mt76_dev *dev, struct mt76_queue *q, int idx,
         __le32 __ctrl = READ_ONCE(q->desc[idx].ctrl);
         u32 ctrl = le32_to_cpu(__ctrl);
 
-        if (!e->txwi || !e->skb) {
+        if (!e->skip_buf0) {
                 __le32 addr = READ_ONCE(q->desc[idx].buf0);
                 u32 len = FIELD_GET(MT_DMA_CTL_SD_LEN0, ctrl);
 
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index 570c159515a0..8aec7ccf2d79 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -93,8 +93,9 @@ struct mt76_queue_entry {
                 struct urb *urb;
         };
         enum mt76_txq_id qid;
-        bool schedule;
-        bool done;
+        bool skip_buf0:1;
+        bool schedule:1;
+        bool done:1;
 };
 
 struct mt76_queue_regs {
@@ -578,6 +579,7 @@ bool __mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val,
 #define mt76_poll_msec(dev, ...) __mt76_poll_msec(&((dev)->mt76), __VA_ARGS__)
 
 void mt76_mmio_init(struct mt76_dev *dev, void __iomem *regs);
+void mt76_pci_disable_aspm(struct pci_dev *pdev);
 
 static inline u16 mt76_chip(struct mt76_dev *dev)
 {
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c
index 73c3104f8858..cf611d1b817c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c
@@ -81,6 +81,8 @@ mt76pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         /* RG_SSUSB_CDR_BR_PE1D = 0x3 */
         mt76_rmw_field(dev, 0x15c58, 0x3 << 6, 0x3);
 
+        mt76_pci_disable_aspm(pdev);
+
         return 0;
 
 error:
diff --git a/drivers/net/wireless/mediatek/mt76/pci.c b/drivers/net/wireless/mediatek/mt76/pci.c
new file mode 100644
index 000000000000..04c5a692bc85
--- /dev/null
+++ b/drivers/net/wireless/mediatek/mt76/pci.c
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: ISC
+/*
+ * Copyright (C) 2019 Lorenzo Bianconi <lorenzo@kernel.org>
+ */
+
+#include <linux/pci.h>
+
+void mt76_pci_disable_aspm(struct pci_dev *pdev)
+{
+        struct pci_dev *parent = pdev->bus->self;
+        u16 aspm_conf, parent_aspm_conf = 0;
+
+        pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &aspm_conf);
+        aspm_conf &= PCI_EXP_LNKCTL_ASPMC;
+        if (parent) {
+                pcie_capability_read_word(parent, PCI_EXP_LNKCTL,
+                                          &parent_aspm_conf);
+                parent_aspm_conf &= PCI_EXP_LNKCTL_ASPMC;
+        }
+
+        if (!aspm_conf && (!parent || !parent_aspm_conf)) {
+                /* aspm already disabled */
+                return;
+        }
+
+        dev_info(&pdev->dev, "disabling ASPM %s %s\n",
+                 (aspm_conf & PCI_EXP_LNKCTL_ASPM_L0S) ? "L0s" : "",
+                 (aspm_conf & PCI_EXP_LNKCTL_ASPM_L1) ? "L1" : "");
+
+        if (IS_ENABLED(CONFIG_PCIEASPM)) {
+                int err;
+
+                err = pci_disable_link_state(pdev, aspm_conf);
+                if (!err)
+                        return;
+        }
+
+        /* both device and parent should have the same ASPM setting.
+         * disable ASPM in downstream component first and then upstream.
+         */
+        pcie_capability_clear_word(pdev, PCI_EXP_LNKCTL, aspm_conf);
+        if (parent)
+                pcie_capability_clear_word(parent, PCI_EXP_LNKCTL,
+                                           aspm_conf);
+}
+EXPORT_SYMBOL_GPL(mt76_pci_disable_aspm);
diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
index 6087ec7a90a6..f88d26535978 100644
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -822,7 +822,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                 hdr = rtl_get_hdr(skb);
                 fc = rtl_get_fc(skb);
 
-                if (!stats.crc && !stats.hwerror) {
+                if (!stats.crc && !stats.hwerror && (skb->len > FCS_LEN)) {
                         memcpy(IEEE80211_SKB_RXCB(skb), &rx_status,
                                sizeof(rx_status));
 
@@ -859,6 +859,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                                 _rtl_pci_rx_to_mac80211(hw, skb, rx_status);
                         }
                 } else {
+                        /* drop packets with errors or those too short */
                         dev_kfree_skb_any(skb);
                 }
 new_trx_end:
diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c
index 70f04c2f5b17..fff8dda14023 100644
--- a/drivers/net/wireless/realtek/rtlwifi/ps.c
+++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
@@ -754,6 +754,9 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data,
                                 return;
                         } else {
                                 noa_num = (noa_len - 2) / 13;
+                                if (noa_num > P2P_MAX_NOA_NUM)
+                                        noa_num = P2P_MAX_NOA_NUM;
+
                         }
                         noa_index = ie[3];
                         if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
@@ -848,6 +851,9 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data,
                                 return;
                         } else {
                                 noa_num = (noa_len - 2) / 13;
+                                if (noa_num > P2P_MAX_NOA_NUM)
+                                        noa_num = P2P_MAX_NOA_NUM;
+
                         }
                         noa_index = ie[3];
                         if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
diff --git a/drivers/net/wireless/virt_wifi.c b/drivers/net/wireless/virt_wifi.c
index be92e1220284..7997cc6de334 100644
--- a/drivers/net/wireless/virt_wifi.c
+++ b/drivers/net/wireless/virt_wifi.c
@@ -548,6 +548,7 @@ static int virt_wifi_newlink(struct net *src_net, struct net_device *dev,
         priv->is_connected = false;
         priv->is_up = false;
         INIT_DELAYED_WORK(&priv->connect, virt_wifi_connect_complete);
+        __module_get(THIS_MODULE);
 
         return 0;
 unregister_netdev:
@@ -578,6 +579,7 @@ static void virt_wifi_dellink(struct net_device *dev,
         netdev_upper_dev_unlink(priv->lowerdev, dev);
 
         unregister_netdevice_queue(dev, head);
+        module_put(THIS_MODULE);
 
         /* Deleting the wiphy is handled in the module destructor. */
 }
@@ -590,6 +592,42 @@ static struct rtnl_link_ops virt_wifi_link_ops = {
         .priv_size      = sizeof(struct virt_wifi_netdev_priv),
 };
 
+static bool netif_is_virt_wifi_dev(const struct net_device *dev)
+{
+        return rcu_access_pointer(dev->rx_handler) == virt_wifi_rx_handler;
+}
+
+static int virt_wifi_event(struct notifier_block *this, unsigned long event,
+                           void *ptr)
+{
+        struct net_device *lower_dev = netdev_notifier_info_to_dev(ptr);
+        struct virt_wifi_netdev_priv *priv;
+        struct net_device *upper_dev;
+        LIST_HEAD(list_kill);
+
+        if (!netif_is_virt_wifi_dev(lower_dev))
+                return NOTIFY_DONE;
+
+        switch (event) {
+        case NETDEV_UNREGISTER:
+                priv = rtnl_dereference(lower_dev->rx_handler_data);
+                if (!priv)
+                        return NOTIFY_DONE;
+
+                upper_dev = priv->upperdev;
+
+                upper_dev->rtnl_link_ops->dellink(upper_dev, &list_kill);
+                unregister_netdevice_many(&list_kill);
+                break;
+        }
+
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block virt_wifi_notifier = {
+        .notifier_call = virt_wifi_event,
+};
+
 /* Acquires and releases the rtnl lock. */
 static int __init virt_wifi_init_module(void)
 {
@@ -598,14 +636,25 @@ static int __init virt_wifi_init_module(void)
         /* Guaranteed to be locallly-administered and not multicast. */
         eth_random_addr(fake_router_bssid);
 
+        err = register_netdevice_notifier(&virt_wifi_notifier);
+        if (err)
+                return err;
+
+        err = -ENOMEM;
         common_wiphy = virt_wifi_make_wiphy();
         if (!common_wiphy)
-                return -ENOMEM;
+                goto notifier;
 
         err = rtnl_link_register(&virt_wifi_link_ops);
         if (err)
-                virt_wifi_destroy_wiphy(common_wiphy);
+                goto destroy_wiphy;
 
+        return 0;
+
+destroy_wiphy:
+        virt_wifi_destroy_wiphy(common_wiphy);
+notifier:
+        unregister_netdevice_notifier(&virt_wifi_notifier);
         return err;
 }
 
@@ -615,6 +664,7 @@ static void __exit virt_wifi_cleanup_module(void)
         /* Will delete any devices that depend on the wiphy. */
         rtnl_link_unregister(&virt_wifi_link_ops);
         virt_wifi_destroy_wiphy(common_wiphy);
+        unregister_netdevice_notifier(&virt_wifi_notifier);
 }
 
 module_init(virt_wifi_init_module);
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 30de7efef003..fc99a40c1ec4 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -522,14 +522,13 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl,
         return 0;
 }
 
-static int nvme_read_ana_log(struct nvme_ctrl *ctrl, bool groups_only)
+static int nvme_read_ana_log(struct nvme_ctrl *ctrl)
 {
         u32 nr_change_groups = 0;
         int error;
 
         mutex_lock(&ctrl->ana_lock);
-        error = nvme_get_log(ctrl, NVME_NSID_ALL, NVME_LOG_ANA,
-                        groups_only ? NVME_ANA_LOG_RGO : 0,
+        error = nvme_get_log(ctrl, NVME_NSID_ALL, NVME_LOG_ANA, 0,
                         ctrl->ana_log_buf, ctrl->ana_log_size, 0);
         if (error) {
                 dev_warn(ctrl->device, "Failed to get ANA log: %d\n", error);
@@ -565,7 +564,7 @@ static void nvme_ana_work(struct work_struct *work)
 {
         struct nvme_ctrl *ctrl = container_of(work, struct nvme_ctrl, ana_work);
 
-        nvme_read_ana_log(ctrl, false);
+        nvme_read_ana_log(ctrl);
 }
 
 static void nvme_anatt_timeout(struct timer_list *t)
@@ -715,7 +714,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
                 goto out;
         }
 
-        error = nvme_read_ana_log(ctrl, true);
+        error = nvme_read_ana_log(ctrl);
         if (error)
                 goto out_free_ana_log_buf;
         return 0;
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 770dbcbc999e..7544be84ab35 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -2219,7 +2219,7 @@ static int nvme_tcp_poll(struct blk_mq_hw_ctx *hctx)
         struct nvme_tcp_queue *queue = hctx->driver_data;
         struct sock *sk = queue->sock->sk;
 
-        if (sk_can_busy_loop(sk) && skb_queue_empty(&sk->sk_receive_queue))
+        if (sk_can_busy_loop(sk) && skb_queue_empty_lockless(&sk->sk_receive_queue))
                 sk_busy_loop(sk, true);
         nvme_tcp_try_recv(queue);
         return queue->nr_cqe;
diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
index 6ad51aa60c03..f877e77d9184 100644
--- a/drivers/pwm/core.c
+++ b/drivers/pwm/core.c
@@ -472,14 +472,7 @@ int pwm_apply_state(struct pwm_device *pwm, const struct pwm_state *state)
                 if (err)
                         return err;
 
-                /*
-                 * .apply might have to round some values in *state, if possible
-                 * read the actually implemented value back.
-                 */
-                if (chip->ops->get_state)
-                        chip->ops->get_state(chip, pwm, &pwm->state);
-                else
-                        pwm->state = *state;
+                pwm->state = *state;
         } else {
                 /*
                  * FIXME: restore the initial state in case of error.
diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index f4b879d25fe9..fc6e4546d738 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -851,9 +851,9 @@ lpfc_disc_set_adisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
 
         if (!(vport->fc_flag & FC_PT2PT)) {
                 /* Check config parameter use-adisc or FCP-2 */
-                if ((vport->cfg_use_adisc && (vport->fc_flag & FC_RSCN_MODE)) ||
+                if (vport->cfg_use_adisc && ((vport->fc_flag & FC_RSCN_MODE) ||
                     ((ndlp->nlp_fcp_info & NLP_FCP_2_DEVICE) &&
-                     (ndlp->nlp_type & NLP_FCP_TARGET))) {
+                     (ndlp->nlp_type & NLP_FCP_TARGET)))) {
                         spin_lock_irq(shost->host_lock);
                         ndlp->nlp_flag |= NLP_NPR_ADISC;
                         spin_unlock_irq(shost->host_lock);
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index a0c6945b8139..614f78dddafe 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -7866,7 +7866,7 @@ lpfc_sli4_process_missed_mbox_completions(struct lpfc_hba *phba)
         if (sli4_hba->hdwq) {
                 for (eqidx = 0; eqidx < phba->cfg_irq_chann; eqidx++) {
                         eq = phba->sli4_hba.hba_eq_hdl[eqidx].eq;
-                        if (eq->queue_id == sli4_hba->mbx_cq->assoc_qid) {
+                        if (eq && eq->queue_id == sli4_hba->mbx_cq->assoc_qid) {
                                 fpeq = eq;
                                 break;
                         }
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 30bafd9d21e9..7259bce85e0e 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -440,9 +440,6 @@ qla2x00_sysfs_write_optrom_ctl(struct file *filp, struct kobject *kobj,
                 valid = 0;
                 if (ha->optrom_size == OPTROM_SIZE_2300 && start == 0)
                         valid = 1;
-                else if (start == (ha->flt_region_boot * 4) ||
-                    start == (ha->flt_region_fw * 4))
-                        valid = 1;
                 else if (IS_QLA24XX_TYPE(ha) || IS_QLA25XX(ha))
                         valid = 1;
                 if (!valid) {
@@ -489,8 +486,10 @@ qla2x00_sysfs_write_optrom_ctl(struct file *filp, struct kobject *kobj,
                     "Writing flash region -- 0x%x/0x%x.\n",
                     ha->optrom_region_start, ha->optrom_region_size);
 
-                ha->isp_ops->write_optrom(vha, ha->optrom_buffer,
+                rval = ha->isp_ops->write_optrom(vha, ha->optrom_buffer,
                     ha->optrom_region_start, ha->optrom_region_size);
+                if (rval)
+                        rval = -EIO;
                 break;
         default:
                 rval = -EINVAL;
diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
index 28d587a89ba6..99f0a1a08143 100644
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -253,7 +253,7 @@ qla2x00_process_els(struct bsg_job *bsg_job)
         srb_t *sp;
         const char *type;
         int req_sg_cnt, rsp_sg_cnt;
-        int rval =  (DRIVER_ERROR << 16);
+        int rval =  (DID_ERROR << 16);
         uint16_t nextlid = 0;
 
         if (bsg_request->msgcode == FC_BSG_RPT_ELS) {
@@ -432,7 +432,7 @@ qla2x00_process_ct(struct bsg_job *bsg_job)
         struct Scsi_Host *host = fc_bsg_to_shost(bsg_job);
         scsi_qla_host_t *vha = shost_priv(host);
         struct qla_hw_data *ha = vha->hw;
-        int rval = (DRIVER_ERROR << 16);
+        int rval = (DID_ERROR << 16);
         int req_sg_cnt, rsp_sg_cnt;
         uint16_t loop_id;
         struct fc_port *fcport;
@@ -1950,7 +1950,7 @@ qlafx00_mgmt_cmd(struct bsg_job *bsg_job)
         struct Scsi_Host *host = fc_bsg_to_shost(bsg_job);
         scsi_qla_host_t *vha = shost_priv(host);
         struct qla_hw_data *ha = vha->hw;
-        int rval = (DRIVER_ERROR << 16);
+        int rval = (DID_ERROR << 16);
         struct qla_mt_iocb_rqst_fx00 *piocb_rqst;
         srb_t *sp;
         int req_sg_cnt = 0, rsp_sg_cnt = 0;
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 1cc6913f76c4..4a1f21c11758 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -702,6 +702,7 @@ qla2x00_execute_fw(scsi_qla_host_t *vha, uint32_t risc_addr)
                 mcp->mb[2] = LSW(risc_addr);
                 mcp->mb[3] = 0;
                 mcp->mb[4] = 0;
+                mcp->mb[11] = 0;
                 ha->flags.using_lr_setting = 0;
                 if (IS_QLA25XX(ha) || IS_QLA81XX(ha) || IS_QLA83XX(ha) ||
                     IS_QLA27XX(ha) || IS_QLA28XX(ha)) {
@@ -746,7 +747,7 @@ qla2x00_execute_fw(scsi_qla_host_t *vha, uint32_t risc_addr)
                 if (ha->flags.exchoffld_enabled)
                         mcp->mb[4] |= ENABLE_EXCHANGE_OFFLD;
 
-                mcp->out_mb |= MBX_4|MBX_3|MBX_2|MBX_1;
+                mcp->out_mb |= MBX_4 | MBX_3 | MBX_2 | MBX_1 | MBX_11;
                 mcp->in_mb |= MBX_3 | MBX_2 | MBX_1;
         } else {
                 mcp->mb[1] = LSW(risc_addr);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index bcb1e8598888..337162ac3a77 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -3535,6 +3535,10 @@ qla2x00_shutdown(struct pci_dev *pdev)
                 qla2x00_try_to_stop_firmware(vha);
         }
 
+        /* Disable timer */
+        if (vha->timer_active)
+                qla2x00_stop_timer(vha);
+
         /* Turn adapter off line */
         vha->flags.online = 0;
 
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 03163ac5fe95..ebb40160539f 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1166,11 +1166,12 @@ static blk_status_t sd_setup_read_write_cmnd(struct scsi_cmnd *cmd)
         sector_t lba = sectors_to_logical(sdp, blk_rq_pos(rq));
         sector_t threshold;
         unsigned int nr_blocks = sectors_to_logical(sdp, blk_rq_sectors(rq));
-        bool dif, dix;
         unsigned int mask = logical_to_sectors(sdp, 1) - 1;
         bool write = rq_data_dir(rq) == WRITE;
         unsigned char protect, fua;
         blk_status_t ret;
+        unsigned int dif;
+        bool dix;
 
         ret = scsi_init_io(cmd);
         if (ret != BLK_STS_OK)
diff --git a/drivers/scsi/ufs/ufs_bsg.c b/drivers/scsi/ufs/ufs_bsg.c
index a9344eb4e047..dc2f6d2b46ed 100644
--- a/drivers/scsi/ufs/ufs_bsg.c
+++ b/drivers/scsi/ufs/ufs_bsg.c
@@ -98,6 +98,8 @@ static int ufs_bsg_request(struct bsg_job *job)
 
         bsg_reply->reply_payload_rcv_len = 0;
 
+        pm_runtime_get_sync(hba->dev);
+
         msgcode = bsg_request->msgcode;
         switch (msgcode) {
         case UPIU_TRANSACTION_QUERY_REQ:
@@ -135,6 +137,8 @@ static int ufs_bsg_request(struct bsg_job *job)
                 break;
         }
 
+        pm_runtime_put_sync(hba->dev);
+
         if (!desc_buff)
                 goto out;
 
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
index c70caf4ea490..a2b5c796bbc4 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
@@ -1831,7 +1831,7 @@ static void cxgbit_fw4_ack(struct cxgbit_sock *csk, struct sk_buff *skb)
 
         while (credits) {
                 struct sk_buff *p = cxgbit_sock_peek_wr(csk);
-                const u32 csum = (__force u32)p->csum;
+                u32 csum;
 
                 if (unlikely(!p)) {
                         pr_err("csk 0x%p,%u, cr %u,%u+%u, empty.\n",
@@ -1840,6 +1840,7 @@ static void cxgbit_fw4_ack(struct cxgbit_sock *csk, struct sk_buff *skb)
                         break;
                 }
 
+                csum = (__force u32)p->csum;
                 if (unlikely(credits < csum)) {
                         pr_warn("csk 0x%p,%u, cr %u,%u+%u, < %u.\n",
                                 csk,  csk->tid,
diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c
index 9050b380ab83..4c1e75509303 100644
--- a/drivers/usb/cdns3/gadget.c
+++ b/drivers/usb/cdns3/gadget.c
@@ -2329,8 +2329,6 @@ static void cdns3_gadget_config(struct cdns3_device *priv_dev)
         writel(USB_CONF_CLK2OFFDS | USB_CONF_L1DS, &regs->usb_conf);
 
         cdns3_configure_dmult(priv_dev, NULL);
-
-        cdns3_gadget_pullup(&priv_dev->gadget, 1);
 }
 
 /**
@@ -2345,9 +2343,35 @@ static int cdns3_gadget_udc_start(struct usb_gadget *gadget,
 {
         struct cdns3_device *priv_dev = gadget_to_cdns3_device(gadget);
         unsigned long flags;
+        enum usb_device_speed max_speed = driver->max_speed;
 
         spin_lock_irqsave(&priv_dev->lock, flags);
         priv_dev->gadget_driver = driver;
+
+        /* limit speed if necessary */
+        max_speed = min(driver->max_speed, gadget->max_speed);
+
+        switch (max_speed) {
+        case USB_SPEED_FULL:
+                writel(USB_CONF_SFORCE_FS, &priv_dev->regs->usb_conf);
+                writel(USB_CONF_USB3DIS, &priv_dev->regs->usb_conf);
+                break;
+        case USB_SPEED_HIGH:
+                writel(USB_CONF_USB3DIS, &priv_dev->regs->usb_conf);
+                break;
+        case USB_SPEED_SUPER:
+                break;
+        default:
+                dev_err(priv_dev->dev,
+                        "invalid maximum_speed parameter %d\n",
+                        max_speed);
+                /* fall through */
+        case USB_SPEED_UNKNOWN:
+                /* default to superspeed */
+                max_speed = USB_SPEED_SUPER;
+                break;
+        }
+
         cdns3_gadget_config(priv_dev);
         spin_unlock_irqrestore(&priv_dev->lock, flags);
         return 0;
@@ -2381,6 +2405,8 @@ static int cdns3_gadget_udc_stop(struct usb_gadget *gadget)
                 writel(EP_CMD_EPRST, &priv_dev->regs->ep_cmd);
                 readl_poll_timeout_atomic(&priv_dev->regs->ep_cmd, val,
                                           !(val & EP_CMD_EPRST), 1, 100);
+
+                priv_ep->flags &= ~EP_CLAIMED;
         }
 
         /* disable interrupt for device */
@@ -2575,12 +2601,7 @@ static int cdns3_gadget_start(struct cdns3 *cdns)
         /* Check the maximum_speed parameter */
         switch (max_speed) {
         case USB_SPEED_FULL:
-                writel(USB_CONF_SFORCE_FS, &priv_dev->regs->usb_conf);
-                writel(USB_CONF_USB3DIS, &priv_dev->regs->usb_conf);
-                break;
         case USB_SPEED_HIGH:
-                writel(USB_CONF_USB3DIS, &priv_dev->regs->usb_conf);
-                break;
         case USB_SPEED_SUPER:
                 break;
         default:
@@ -2713,8 +2734,6 @@ static int cdns3_gadget_suspend(struct cdns3 *cdns, bool do_wakeup)
         /* disable interrupt for device */
         writel(0, &priv_dev->regs->usb_ien);
 
-        cdns3_gadget_pullup(&priv_dev->gadget, 0);
-
         return 0;
 }
 
diff --git a/drivers/usb/cdns3/host-export.h b/drivers/usb/cdns3/host-export.h
index b498a170b7e8..ae11810f8826 100644
--- a/drivers/usb/cdns3/host-export.h
+++ b/drivers/usb/cdns3/host-export.h
@@ -12,7 +12,6 @@
 #ifdef CONFIG_USB_CDNS3_HOST
 
 int cdns3_host_init(struct cdns3 *cdns);
-void cdns3_host_exit(struct cdns3 *cdns);
 
 #else
 
diff --git a/drivers/usb/cdns3/host.c b/drivers/usb/cdns3/host.c
index 2733a8f71fcd..ad788bf3fe4f 100644
--- a/drivers/usb/cdns3/host.c
+++ b/drivers/usb/cdns3/host.c
@@ -12,6 +12,7 @@
 #include <linux/platform_device.h>
 #include "core.h"
 #include "drd.h"
+#include "host-export.h"
 
 static int __cdns3_host_init(struct cdns3 *cdns)
 {
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 151a74a54386..1ac1095bfeac 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -348,6 +348,11 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
 
         /* Validate the wMaxPacketSize field */
         maxp = usb_endpoint_maxp(&endpoint->desc);
+        if (maxp == 0) {
+                dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has wMaxPacketSize 0, skipping\n",
+                    cfgno, inum, asnum, d->bEndpointAddress);
+                goto skip_to_next_endpoint_or_interface_descriptor;
+        }
 
         /* Find the highest legal maxpacket size for this endpoint */
         i = 0;          /* additional transactions per microframe */
diff --git a/drivers/usb/dwc3/Kconfig b/drivers/usb/dwc3/Kconfig
index 89abc6078703..556a876c7896 100644
--- a/drivers/usb/dwc3/Kconfig
+++ b/drivers/usb/dwc3/Kconfig
@@ -102,6 +102,7 @@ config USB_DWC3_MESON_G12A
        depends on ARCH_MESON || COMPILE_TEST
        default USB_DWC3
        select USB_ROLE_SWITCH
+        select REGMAP_MMIO
        help
          Support USB2/3 functionality in Amlogic G12A platforms.
          Say 'Y' or 'M' if you have one such device.
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 999ce5e84d3c..97d6ae3c4df2 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -312,8 +312,7 @@ static void dwc3_frame_length_adjustment(struct dwc3 *dwc)
 
         reg = dwc3_readl(dwc->regs, DWC3_GFLADJ);
         dft = reg & DWC3_GFLADJ_30MHZ_MASK;
-        if (!dev_WARN_ONCE(dwc->dev, dft == dwc->fladj,
-            "request value same as default, ignoring\n")) {
+        if (dft != dwc->fladj) {
                 reg &= ~DWC3_GFLADJ_30MHZ_MASK;
                 reg |= DWC3_GFLADJ_30MHZ_SDBND_SEL | dwc->fladj;
                 dwc3_writel(dwc->regs, DWC3_GFLADJ, reg);
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 5e8e18222f92..023f0357efd7 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -258,7 +258,7 @@ static int dwc3_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
 
         ret = platform_device_add_properties(dwc->dwc3, p);
         if (ret < 0)
-                return ret;
+                goto err;
 
         ret = dwc3_pci_quirks(dwc);
         if (ret)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 86dc1db788a9..a9aba716bf80 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -707,6 +707,12 @@ static void dwc3_remove_requests(struct dwc3 *dwc, struct dwc3_ep *dep)
 
                 dwc3_gadget_giveback(dep, req, -ESHUTDOWN);
         }
+
+        while (!list_empty(&dep->cancelled_list)) {
+                req = next_request(&dep->cancelled_list);
+
+                dwc3_gadget_giveback(dep, req, -ESHUTDOWN);
+        }
 }
 
 /**
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index d516e8d6cd7f..5ec54b69c29c 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -2170,14 +2170,18 @@ void composite_dev_cleanup(struct usb_composite_dev *cdev)
                         usb_ep_dequeue(cdev->gadget->ep0, cdev->os_desc_req);
 
                 kfree(cdev->os_desc_req->buf);
+                cdev->os_desc_req->buf = NULL;
                 usb_ep_free_request(cdev->gadget->ep0, cdev->os_desc_req);
+                cdev->os_desc_req = NULL;
         }
         if (cdev->req) {
                 if (cdev->setup_pending)
                         usb_ep_dequeue(cdev->gadget->ep0, cdev->req);
 
                 kfree(cdev->req->buf);
+                cdev->req->buf = NULL;
                 usb_ep_free_request(cdev->gadget->ep0, cdev->req);
+                cdev->req = NULL;
         }
         cdev->next_string_id = 0;
         device_remove_file(&cdev->gadget->dev, &dev_attr_suspended);
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 025129942894..33852c2b29d1 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -61,6 +61,8 @@ struct gadget_info {
         bool use_os_desc;
         char b_vendor_code;
         char qw_sign[OS_STRING_QW_SIGN_LEN];
+        spinlock_t spinlock;
+        bool unbind;
 };
 
 static inline struct gadget_info *to_gadget_info(struct config_item *item)
@@ -1244,6 +1246,7 @@ static int configfs_composite_bind(struct usb_gadget *gadget,
         int                             ret;
 
         /* the gi->lock is hold by the caller */
+        gi->unbind = 0;
         cdev->gadget = gadget;
         set_gadget_data(gadget, cdev);
         ret = composite_dev_prepare(composite, cdev);
@@ -1376,31 +1379,128 @@ static void configfs_composite_unbind(struct usb_gadget *gadget)
 {
         struct usb_composite_dev        *cdev;
         struct gadget_info              *gi;
+        unsigned long flags;
 
         /* the gi->lock is hold by the caller */
 
         cdev = get_gadget_data(gadget);
         gi = container_of(cdev, struct gadget_info, cdev);
+        spin_lock_irqsave(&gi->spinlock, flags);
+        gi->unbind = 1;
+        spin_unlock_irqrestore(&gi->spinlock, flags);
 
         kfree(otg_desc[0]);
         otg_desc[0] = NULL;
         purge_configs_funcs(gi);
         composite_dev_cleanup(cdev);
         usb_ep_autoconfig_reset(cdev->gadget);
+        spin_lock_irqsave(&gi->spinlock, flags);
         cdev->gadget = NULL;
         set_gadget_data(gadget, NULL);
+        spin_unlock_irqrestore(&gi->spinlock, flags);
+}
+
+static int configfs_composite_setup(struct usb_gadget *gadget,
+                const struct usb_ctrlrequest *ctrl)
+{
+        struct usb_composite_dev *cdev;
+        struct gadget_info *gi;
+        unsigned long flags;
+        int ret;
+
+        cdev = get_gadget_data(gadget);
+        if (!cdev)
+                return 0;
+
+        gi = container_of(cdev, struct gadget_info, cdev);
+        spin_lock_irqsave(&gi->spinlock, flags);
+        cdev = get_gadget_data(gadget);
+        if (!cdev || gi->unbind) {
+                spin_unlock_irqrestore(&gi->spinlock, flags);
+                return 0;
+        }
+
+        ret = composite_setup(gadget, ctrl);
+        spin_unlock_irqrestore(&gi->spinlock, flags);
+        return ret;
+}
+
+static void configfs_composite_disconnect(struct usb_gadget *gadget)
+{
+        struct usb_composite_dev *cdev;
+        struct gadget_info *gi;
+        unsigned long flags;
+
+        cdev = get_gadget_data(gadget);
+        if (!cdev)
+                return;
+
+        gi = container_of(cdev, struct gadget_info, cdev);
+        spin_lock_irqsave(&gi->spinlock, flags);
+        cdev = get_gadget_data(gadget);
+        if (!cdev || gi->unbind) {
+                spin_unlock_irqrestore(&gi->spinlock, flags);
+                return;
+        }
+
+        composite_disconnect(gadget);
+        spin_unlock_irqrestore(&gi->spinlock, flags);
+}
+
+static void configfs_composite_suspend(struct usb_gadget *gadget)
+{
+        struct usb_composite_dev *cdev;
+        struct gadget_info *gi;
+        unsigned long flags;
+
+        cdev = get_gadget_data(gadget);
+        if (!cdev)
+                return;
+
+        gi = container_of(cdev, struct gadget_info, cdev);
+        spin_lock_irqsave(&gi->spinlock, flags);
+        cdev = get_gadget_data(gadget);
+        if (!cdev || gi->unbind) {
+                spin_unlock_irqrestore(&gi->spinlock, flags);
+                return;
+        }
+
+        composite_suspend(gadget);
+        spin_unlock_irqrestore(&gi->spinlock, flags);
+}
+
+static void configfs_composite_resume(struct usb_gadget *gadget)
+{
+        struct usb_composite_dev *cdev;
+        struct gadget_info *gi;
+        unsigned long flags;
+
+        cdev = get_gadget_data(gadget);
+        if (!cdev)
+                return;
+
+        gi = container_of(cdev, struct gadget_info, cdev);
+        spin_lock_irqsave(&gi->spinlock, flags);
+        cdev = get_gadget_data(gadget);
+        if (!cdev || gi->unbind) {
+                spin_unlock_irqrestore(&gi->spinlock, flags);
+                return;
+        }
+
+        composite_resume(gadget);
+        spin_unlock_irqrestore(&gi->spinlock, flags);
 }
 
 static const struct usb_gadget_driver configfs_driver_template = {
         .bind           = configfs_composite_bind,
         .unbind         = configfs_composite_unbind,
 
-        .setup          = composite_setup,
-        .reset          = composite_disconnect,
-        .disconnect     = composite_disconnect,
+        .setup          = configfs_composite_setup,
+        .reset          = configfs_composite_disconnect,
+        .disconnect     = configfs_composite_disconnect,
 
-        .suspend        = composite_suspend,
-        .resume         = composite_resume,
+        .suspend        = configfs_composite_suspend,
+        .resume         = configfs_composite_resume,
 
         .max_speed      = USB_SPEED_SUPER,
         .driver = {
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index 86ffc8307864..1d0d8952a74b 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -449,9 +449,11 @@ static void submit_request(struct usba_ep *ep, struct usba_request *req)
                 next_fifo_transaction(ep, req);
                 if (req->last_transaction) {
                         usba_ep_writel(ep, CTL_DIS, USBA_TX_PK_RDY);
-                        usba_ep_writel(ep, CTL_ENB, USBA_TX_COMPLETE);
+                        if (ep_is_control(ep))
+                                usba_ep_writel(ep, CTL_ENB, USBA_TX_COMPLETE);
                 } else {
-                        usba_ep_writel(ep, CTL_DIS, USBA_TX_COMPLETE);
+                        if (ep_is_control(ep))
+                                usba_ep_writel(ep, CTL_DIS, USBA_TX_COMPLETE);
                         usba_ep_writel(ep, CTL_ENB, USBA_TX_PK_RDY);
                 }
         }
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 92af8dc98c3d..51fa614b4079 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -98,6 +98,17 @@ int usb_ep_enable(struct usb_ep *ep)
         if (ep->enabled)
                 goto out;
 
+        /* UDC drivers can't handle endpoints with maxpacket size 0 */
+        if (usb_endpoint_maxp(ep->desc) == 0) {
+                /*
+                 * We should log an error message here, but we can't call
+                 * dev_err() because there's no way to find the gadget
+                 * given only ep.
+                 */
+                ret = -EINVAL;
+                goto out;
+        }
+
         ret = ep->ops->enable(ep, ep->desc);
         if (ret)
                 goto out;
diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c
index 20141c3096f6..9a05863b2876 100644
--- a/drivers/usb/gadget/udc/fsl_udc_core.c
+++ b/drivers/usb/gadget/udc/fsl_udc_core.c
@@ -2576,7 +2576,7 @@ static int fsl_udc_remove(struct platform_device *pdev)
         dma_pool_destroy(udc_controller->td_pool);
         free_irq(udc_controller->irq, udc_controller);
         iounmap(dr_regs);
-        if (pdata->operating_mode == FSL_USB2_DR_DEVICE)
+        if (res && (pdata->operating_mode == FSL_USB2_DR_DEVICE))
                 release_mem_region(res->start, resource_size(res));
 
         /* free udc --wait for the release() finished */
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index e098f16c01cb..33703140233a 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -1544,10 +1544,10 @@ static void usb3_set_device_address(struct renesas_usb3 *usb3, u16 addr)
 static bool usb3_std_req_set_address(struct renesas_usb3 *usb3,
                                      struct usb_ctrlrequest *ctrl)
 {
-        if (ctrl->wValue >= 128)
+        if (le16_to_cpu(ctrl->wValue) >= 128)
                 return true;    /* stall */
 
-        usb3_set_device_address(usb3, ctrl->wValue);
+        usb3_set_device_address(usb3, le16_to_cpu(ctrl->wValue));
         usb3_set_p0_con_for_no_data(usb3);
 
         return false;
@@ -1582,6 +1582,7 @@ static bool usb3_std_req_get_status(struct renesas_usb3 *usb3,
         struct renesas_usb3_ep *usb3_ep;
         int num;
         u16 status = 0;
+        __le16 tx_data;
 
         switch (ctrl->bRequestType & USB_RECIP_MASK) {
         case USB_RECIP_DEVICE:
@@ -1604,10 +1605,10 @@ static bool usb3_std_req_get_status(struct renesas_usb3 *usb3,
         }
 
         if (!stall) {
-                status = cpu_to_le16(status);
+                tx_data = cpu_to_le16(status);
                 dev_dbg(usb3_to_dev(usb3), "get_status: req = %p\n",
                         usb_req_to_usb3_req(usb3->ep0_req));
-                usb3_pipe0_internal_xfer(usb3, &status, sizeof(status),
+                usb3_pipe0_internal_xfer(usb3, &tx_data, sizeof(tx_data),
                                          usb3_pipe0_get_status_completion);
         }
 
@@ -1772,7 +1773,7 @@ static bool usb3_std_req_set_sel(struct renesas_usb3 *usb3,
 static bool usb3_std_req_set_configuration(struct renesas_usb3 *usb3,
                                            struct usb_ctrlrequest *ctrl)
 {
-        if (ctrl->wValue > 0)
+        if (le16_to_cpu(ctrl->wValue) > 0)
                 usb3_set_bit(usb3, USB_COM_CON_CONF, USB3_USB_COM_CON);
         else
                 usb3_clear_bit(usb3, USB_COM_CON_CONF, USB3_USB_COM_CON);
diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
index 7ba6afc7ef23..76c3f29562d2 100644
--- a/drivers/usb/host/xhci-debugfs.c
+++ b/drivers/usb/host/xhci-debugfs.c
@@ -202,10 +202,10 @@ static void xhci_ring_dump_segment(struct seq_file *s,
                 trb = &seg->trbs[i];
                 dma = seg->dma + i * sizeof(*trb);
                 seq_printf(s, "%pad: %s\n", &dma,
-                           xhci_decode_trb(trb->generic.field[0],
-                                           trb->generic.field[1],
-                                           trb->generic.field[2],
-                                           trb->generic.field[3]));
+                           xhci_decode_trb(le32_to_cpu(trb->generic.field[0]),
+                                           le32_to_cpu(trb->generic.field[1]),
+                                           le32_to_cpu(trb->generic.field[2]),
+                                           le32_to_cpu(trb->generic.field[3])));
         }
 }
 
@@ -263,10 +263,10 @@ static int xhci_slot_context_show(struct seq_file *s, void *unused)
         xhci = hcd_to_xhci(bus_to_hcd(dev->udev->bus));
         slot_ctx = xhci_get_slot_ctx(xhci, dev->out_ctx);
         seq_printf(s, "%pad: %s\n", &dev->out_ctx->dma,
-                   xhci_decode_slot_context(slot_ctx->dev_info,
-                                            slot_ctx->dev_info2,
-                                            slot_ctx->tt_info,
-                                            slot_ctx->dev_state));
+                   xhci_decode_slot_context(le32_to_cpu(slot_ctx->dev_info),
+                                            le32_to_cpu(slot_ctx->dev_info2),
+                                            le32_to_cpu(slot_ctx->tt_info),
+                                            le32_to_cpu(slot_ctx->dev_state)));
 
         return 0;
 }
@@ -286,10 +286,10 @@ static int xhci_endpoint_context_show(struct seq_file *s, void *unused)
                 ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, dci);
                 dma = dev->out_ctx->dma + dci * CTX_SIZE(xhci->hcc_params);
                 seq_printf(s, "%pad: %s\n", &dma,
-                           xhci_decode_ep_context(ep_ctx->ep_info,
-                                                  ep_ctx->ep_info2,
-                                                  ep_ctx->deq,
-                                                  ep_ctx->tx_info));
+                           xhci_decode_ep_context(le32_to_cpu(ep_ctx->ep_info),
+                                                  le32_to_cpu(ep_ctx->ep_info2),
+                                                  le64_to_cpu(ep_ctx->deq),
+                                                  le32_to_cpu(ep_ctx->tx_info)));
         }
 
         return 0;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 85ceb43e3405..e7aab31fd9a5 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3330,6 +3330,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                         if (xhci_urb_suitable_for_idt(urb)) {
                                 memcpy(&send_addr, urb->transfer_buffer,
                                        trb_buff_len);
+                                le64_to_cpus(&send_addr);
                                 field |= TRB_IDT;
                         }
                 }
@@ -3475,6 +3476,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 if (xhci_urb_suitable_for_idt(urb)) {
                         memcpy(&addr, urb->transfer_buffer,
                                urb->transfer_buffer_length);
+                        le64_to_cpus(&addr);
                         field |= TRB_IDT;
                 } else {
                         addr = (u64) urb->transfer_dma;
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 517ec3206f6e..6c17e3fe181a 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3071,6 +3071,48 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci, unsigned int ep_index,
         }
 }
 
+static void xhci_endpoint_disable(struct usb_hcd *hcd,
+                                  struct usb_host_endpoint *host_ep)
+{
+        struct xhci_hcd         *xhci;
+        struct xhci_virt_device *vdev;
+        struct xhci_virt_ep     *ep;
+        struct usb_device       *udev;
+        unsigned long           flags;
+        unsigned int            ep_index;
+
+        xhci = hcd_to_xhci(hcd);
+rescan:
+        spin_lock_irqsave(&xhci->lock, flags);
+
+        udev = (struct usb_device *)host_ep->hcpriv;
+        if (!udev || !udev->slot_id)
+                goto done;
+
+        vdev = xhci->devs[udev->slot_id];
+        if (!vdev)
+                goto done;
+
+        ep_index = xhci_get_endpoint_index(&host_ep->desc);
+        ep = &vdev->eps[ep_index];
+        if (!ep)
+                goto done;
+
+        /* wait for hub_tt_work to finish clearing hub TT */
+        if (ep->ep_state & EP_CLEARING_TT) {
+                spin_unlock_irqrestore(&xhci->lock, flags);
+                schedule_timeout_uninterruptible(1);
+                goto rescan;
+        }
+
+        if (ep->ep_state)
+                xhci_dbg(xhci, "endpoint disable with ep_state 0x%x\n",
+                         ep->ep_state);
+done:
+        host_ep->hcpriv = NULL;
+        spin_unlock_irqrestore(&xhci->lock, flags);
+}
+
 /*
  * Called after usb core issues a clear halt control message.
  * The host side of the halt should already be cleared by a reset endpoint
@@ -5238,20 +5280,13 @@ static void xhci_clear_tt_buffer_complete(struct usb_hcd *hcd,
         unsigned int ep_index;
         unsigned long flags;
 
-        /*
-         * udev might be NULL if tt buffer is cleared during a failed device
-         * enumeration due to a halted control endpoint. Usb core might
-         * have allocated a new udev for the next enumeration attempt.
-         */
-
         xhci = hcd_to_xhci(hcd);
+
+        spin_lock_irqsave(&xhci->lock, flags);
         udev = (struct usb_device *)ep->hcpriv;
-        if (!udev)
-                return;
         slot_id = udev->slot_id;
         ep_index = xhci_get_endpoint_index(&ep->desc);
 
-        spin_lock_irqsave(&xhci->lock, flags);
         xhci->devs[slot_id]->eps[ep_index].ep_state &= ~EP_CLEARING_TT;
         xhci_ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
         spin_unlock_irqrestore(&xhci->lock, flags);
@@ -5288,6 +5323,7 @@ static const struct hc_driver xhci_hc_driver = {
         .free_streams =         xhci_free_streams,
         .add_endpoint =         xhci_add_endpoint,
         .drop_endpoint =        xhci_drop_endpoint,
+        .endpoint_disable =     xhci_endpoint_disable,
         .endpoint_reset =       xhci_endpoint_reset,
         .check_bandwidth =      xhci_check_bandwidth,
         .reset_bandwidth =      xhci_reset_bandwidth,
diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
index 15b5f06fb0b3..8f86b4ebca89 100644
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -487,7 +487,7 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
         }
         bytes_to_read = min(count, *actual_buffer);
         if (bytes_to_read < *actual_buffer)
-                dev_warn(&dev->intf->dev, "Read buffer overflow, %zd bytes dropped\n",
+                dev_warn(&dev->intf->dev, "Read buffer overflow, %zu bytes dropped\n",
                          *actual_buffer-bytes_to_read);
 
         /* copy one interrupt_in_buffer from ring_buffer into userspace */
@@ -495,11 +495,11 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
                 retval = -EFAULT;
                 goto unlock_exit;
         }
-        dev->ring_tail = (dev->ring_tail+1) % ring_buffer_size;
-
         retval = bytes_to_read;
 
         spin_lock_irq(&dev->rbsl);
+        dev->ring_tail = (dev->ring_tail + 1) % ring_buffer_size;
+
         if (dev->buffer_overflow) {
                 dev->buffer_overflow = 0;
                 spin_unlock_irq(&dev->rbsl);
@@ -562,8 +562,9 @@ static ssize_t ld_usb_write(struct file *file, const char __user *buffer,
         /* write the data into interrupt_out_buffer from userspace */
         bytes_to_write = min(count, write_buffer_size*dev->interrupt_out_endpoint_size);
         if (bytes_to_write < count)
-                dev_warn(&dev->intf->dev, "Write buffer overflow, %zd bytes dropped\n", count-bytes_to_write);
-        dev_dbg(&dev->intf->dev, "%s: count = %zd, bytes_to_write = %zd\n",
+                dev_warn(&dev->intf->dev, "Write buffer overflow, %zu bytes dropped\n",
+                        count - bytes_to_write);
+        dev_dbg(&dev->intf->dev, "%s: count = %zu, bytes_to_write = %zu\n",
                 __func__, count, bytes_to_write);
 
         if (copy_from_user(dev->interrupt_out_buffer, buffer, bytes_to_write)) {
@@ -580,7 +581,7 @@ static ssize_t ld_usb_write(struct file *file, const char __user *buffer,
                                          1 << 8, 0,
                                          dev->interrupt_out_buffer,
                                          bytes_to_write,
-                                         USB_CTRL_SET_TIMEOUT * HZ);
+                                         USB_CTRL_SET_TIMEOUT);
                 if (retval < 0)
                         dev_err(&dev->intf->dev,
                                 "Couldn't submit HID_REQ_SET_REPORT %d\n",
diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
index c3d5c1206eec..9dd02160cca9 100644
--- a/drivers/usb/mtu3/mtu3_core.c
+++ b/drivers/usb/mtu3/mtu3_core.c
@@ -16,6 +16,7 @@
 #include <linux/platform_device.h>
 
 #include "mtu3.h"
+#include "mtu3_dr.h"
 #include "mtu3_debug.h"
 #include "mtu3_trace.h"
 
diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c
index 4c3de777ef6c..a3c30b609433 100644
--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -162,17 +162,17 @@ void usbhs_usbreq_get_val(struct usbhs_priv *priv, struct usb_ctrlrequest *req)
         req->bRequest           = (val >> 8) & 0xFF;
         req->bRequestType       = (val >> 0) & 0xFF;
 
-        req->wValue     = usbhs_read(priv, USBVAL);
-        req->wIndex     = usbhs_read(priv, USBINDX);
-        req->wLength    = usbhs_read(priv, USBLENG);
+        req->wValue     = cpu_to_le16(usbhs_read(priv, USBVAL));
+        req->wIndex     = cpu_to_le16(usbhs_read(priv, USBINDX));
+        req->wLength    = cpu_to_le16(usbhs_read(priv, USBLENG));
 }
 
 void usbhs_usbreq_set_val(struct usbhs_priv *priv, struct usb_ctrlrequest *req)
 {
         usbhs_write(priv, USBREQ,  (req->bRequest << 8) | req->bRequestType);
-        usbhs_write(priv, USBVAL,  req->wValue);
-        usbhs_write(priv, USBINDX, req->wIndex);
-        usbhs_write(priv, USBLENG, req->wLength);
+        usbhs_write(priv, USBVAL,  le16_to_cpu(req->wValue));
+        usbhs_write(priv, USBINDX, le16_to_cpu(req->wIndex));
+        usbhs_write(priv, USBLENG, le16_to_cpu(req->wLength));
 
         usbhs_bset(priv, DCPCTR, SUREQ, SUREQ);
 }
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index e5ef56991dba..cd38d74b3223 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -265,7 +265,7 @@ static int usbhsg_recip_handler_std_set_device(struct usbhs_priv *priv,
         case USB_DEVICE_TEST_MODE:
                 usbhsg_recip_handler_std_control_done(priv, uep, ctrl);
                 udelay(100);
-                usbhs_sys_set_test_mode(priv, le16_to_cpu(ctrl->wIndex >> 8));
+                usbhs_sys_set_test_mode(priv, le16_to_cpu(ctrl->wIndex) >> 8);
                 break;
         default:
                 usbhsg_recip_handler_std_control_done(priv, uep, ctrl);
@@ -315,7 +315,7 @@ static void __usbhsg_recip_send_status(struct usbhsg_gpriv *gpriv,
         struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(dcp);
         struct device *dev = usbhsg_gpriv_to_dev(gpriv);
         struct usb_request *req;
-        unsigned short *buf;
+        __le16 *buf;
 
         /* alloc new usb_request for recip */
         req = usb_ep_alloc_request(&dcp->ep, GFP_ATOMIC);
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index 79314d8c94a4..ca3bd58f2025 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -559,6 +559,10 @@ static int firm_send_command(struct usb_serial_port *port, __u8 command,
 
         command_port = port->serial->port[COMMAND_PORT];
         command_info = usb_get_serial_port_data(command_port);
+
+        if (command_port->bulk_out_size < datasize + 1)
+                return -EIO;
+
         mutex_lock(&command_info->mutex);
         command_info->command_finished = false;
 
@@ -632,6 +636,7 @@ static void firm_setup_port(struct tty_struct *tty)
         struct device *dev = &port->dev;
         struct whiteheat_port_settings port_settings;
         unsigned int cflag = tty->termios.c_cflag;
+        speed_t baud;
 
         port_settings.port = port->port_number + 1;
 
@@ -692,11 +697,13 @@ static void firm_setup_port(struct tty_struct *tty)
         dev_dbg(dev, "%s - XON = %2x, XOFF = %2x\n", __func__, port_settings.xon, port_settings.xoff);
 
         /* get the baud rate wanted */
-        port_settings.baud = tty_get_baud_rate(tty);
-        dev_dbg(dev, "%s - baud rate = %d\n", __func__, port_settings.baud);
+        baud = tty_get_baud_rate(tty);
+        port_settings.baud = cpu_to_le32(baud);
+        dev_dbg(dev, "%s - baud rate = %u\n", __func__, baud);
 
         /* fixme: should set validated settings */
-        tty_encode_baud_rate(tty, port_settings.baud, port_settings.baud);
+        tty_encode_baud_rate(tty, baud, baud);
+
         /* handle any settings that aren't specified in the tty structure */
         port_settings.lloop = 0;
 
diff --git a/drivers/usb/serial/whiteheat.h b/drivers/usb/serial/whiteheat.h
index 00398149cd8d..269e727a92f9 100644
--- a/drivers/usb/serial/whiteheat.h
+++ b/drivers/usb/serial/whiteheat.h
@@ -87,7 +87,7 @@ struct whiteheat_simple {
 
 struct whiteheat_port_settings {
         __u8    port;           /* port number (1 to N) */
-        __u32   baud;           /* any value 7 - 460800, firmware calculates
+        __le32  baud;           /* any value 7 - 460800, firmware calculates
                                    best fit; arrives little endian */
         __u8    bits;           /* 5, 6, 7, or 8 */
         __u8    stop;           /* 1 or 2, default 1 (2 = 1.5 if bits = 5) */
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index 6737fab94959..54a3c8195c96 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -68,7 +68,6 @@ static const char* host_info(struct Scsi_Host *host)
 static int slave_alloc (struct scsi_device *sdev)
 {
         struct us_data *us = host_to_us(sdev->host);
-        int maxp;
 
         /*
          * Set the INQUIRY transfer length to 36.  We don't use any of
@@ -78,15 +77,6 @@ static int slave_alloc (struct scsi_device *sdev)
         sdev->inquiry_len = 36;
 
         /*
-         * USB has unusual scatter-gather requirements: the length of each
-         * scatterlist element except the last must be divisible by the
-         * Bulk maxpacket value.  Fortunately this value is always a
-         * power of 2.  Inform the block layer about this requirement.
-         */
-        maxp = usb_maxpacket(us->pusb_dev, us->recv_bulk_pipe, 0);
-        blk_queue_virt_boundary(sdev->request_queue, maxp - 1);
-
-        /*
          * Some host controllers may have alignment requirements.
          * We'll play it safe by requiring 512-byte alignment always.
          */
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index bf80d6f81f58..34538253f12c 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -789,30 +789,10 @@ static int uas_slave_alloc(struct scsi_device *sdev)
 {
         struct uas_dev_info *devinfo =
                 (struct uas_dev_info *)sdev->host->hostdata;
-        int maxp;
 
         sdev->hostdata = devinfo;
 
         /*
-         * We have two requirements here. We must satisfy the requirements
-         * of the physical HC and the demands of the protocol, as we
-         * definitely want no additional memory allocation in this path
-         * ruling out using bounce buffers.
-         *
-         * For a transmission on USB to continue we must never send
-         * a package that is smaller than maxpacket. Hence the length of each
-         * scatterlist element except the last must be divisible by the
-         * Bulk maxpacket value.
-         * If the HC does not ensure that through SG,
-         * the upper layer must do that. We must assume nothing
-         * about the capabilities off the HC, so we use the most
-         * pessimistic requirement.
-         */
-
-        maxp = usb_maxpacket(devinfo->udev, devinfo->data_in_pipe, 0);
-        blk_queue_virt_boundary(sdev->request_queue, maxp - 1);
-
-        /*
          * The protocol has no requirements on alignment in the strict sense.
          * Controllers may or may not have alignment restrictions.
          * As this is not exported, we use an extremely conservative guess.
diff --git a/drivers/usb/usbip/vhci_tx.c b/drivers/usb/usbip/vhci_tx.c
index c3803785f6ef..0ae40a13a9fe 100644
--- a/drivers/usb/usbip/vhci_tx.c
+++ b/drivers/usb/usbip/vhci_tx.c
@@ -147,7 +147,10 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev)
                 }
 
                 kfree(iov);
+                /* This is only for isochronous case */
                 kfree(iso_buffer);
+                iso_buffer = NULL;
+
                 usbip_dbg_vhci_tx("send txdata\n");
 
                 total_size += txsize;
diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 08ad0d1f0476..a0a2d74967ef 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -852,6 +852,12 @@ static inline int xfer_kern(void *src, void *dst, size_t len)
         return 0;
 }
 
+static inline int kern_xfer(void *dst, void *src, size_t len)
+{
+        memcpy(dst, src, len);
+        return 0;
+}
+
 /**
  * vringh_init_kern - initialize a vringh for a kernelspace vring.
  * @vrh: the vringh to initialize.
@@ -958,7 +964,7 @@ EXPORT_SYMBOL(vringh_iov_pull_kern);
 ssize_t vringh_iov_push_kern(struct vringh_kiov *wiov,
                              const void *src, size_t len)
 {
-        return vringh_iov_xfer(wiov, (void *)src, len, xfer_kern);
+        return vringh_iov_xfer(wiov, (void *)src, len, kern_xfer);
 }
 EXPORT_SYMBOL(vringh_iov_push_kern);
 
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index bdc08244a648..a8041e451e9e 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -1499,9 +1499,6 @@ static bool virtqueue_enable_cb_delayed_packed(struct virtqueue *_vq)
                  * counter first before updating event flags.
                  */
                 virtio_wmb(vq->weak_barriers);
-        } else {
-                used_idx = vq->last_used_idx;
-                wrap_counter = vq->packed.used_wrap_counter;
         }
 
         if (vq->packed.event_flags_shadow == VRING_PACKED_EVENT_FLAG_DISABLE) {
@@ -1518,7 +1515,9 @@ static bool virtqueue_enable_cb_delayed_packed(struct virtqueue *_vq)
          */
         virtio_mb(vq->weak_barriers);
 
-        if (is_used_desc_packed(vq, used_idx, wrap_counter)) {
+        if (is_used_desc_packed(vq,
+                                vq->last_used_idx,
+                                vq->packed.used_wrap_counter)) {
                 END_USE(vq);
                 return false;
         }
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 4c0922596467..cd55af9b7cc5 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -4084,6 +4084,7 @@ free_pages:
 
         kfree(dw->ppages);
         cifs_small_buf_release(dw->buf);
+        kfree(dw);
 }
 
 
@@ -4157,7 +4158,7 @@ receive_encrypted_read(struct TCP_Server_Info *server, struct mid_q_entry **mid,
                 dw->server = server;
                 dw->ppages = pages;
                 dw->len = len;
-                queue_work(cifsiod_wq, &dw->decrypt);
+                queue_work(decrypt_wq, &dw->decrypt);
                 *num_mids = 0; /* worker thread takes care of finding mid */
                 return -1;
         }
diff --git a/fs/fuse/Makefile b/fs/fuse/Makefile
index 6419a2b3510d..3e8cebfb59b7 100644
--- a/fs/fuse/Makefile
+++ b/fs/fuse/Makefile
@@ -5,6 +5,7 @@
 
 obj-$(CONFIG_FUSE_FS) += fuse.o
 obj-$(CONFIG_CUSE) += cuse.o
-obj-$(CONFIG_VIRTIO_FS) += virtio_fs.o
+obj-$(CONFIG_VIRTIO_FS) += virtiofs.o
 
 fuse-objs := dev.o dir.o file.o inode.o control.o xattr.o acl.o readdir.o
+virtiofs-y += virtio_fs.o
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index dadd617d826c..ed1abc9e33cf 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -276,10 +276,12 @@ static void flush_bg_queue(struct fuse_conn *fc)
 void fuse_request_end(struct fuse_conn *fc, struct fuse_req *req)
 {
         struct fuse_iqueue *fiq = &fc->iq;
-        bool async = req->args->end;
+        bool async;
 
         if (test_and_set_bit(FR_FINISHED, &req->flags))
                 goto put_request;
+
+        async = req->args->end;
         /*
          * test_and_set_bit() implies smp_mb() between bit
          * changing and below intr_entry check. Pairs with
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index d572c900bb0f..54d638f9ba1c 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -405,7 +405,8 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
         else
                 fuse_invalidate_entry_cache(entry);
 
-        fuse_advise_use_readdirplus(dir);
+        if (inode)
+                fuse_advise_use_readdirplus(dir);
         return newent;
 
  out_iput:
@@ -1521,6 +1522,19 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr,
                 is_truncate = true;
         }
 
+        /* Flush dirty data/metadata before non-truncate SETATTR */
+        if (is_wb && S_ISREG(inode->i_mode) &&
+            attr->ia_valid &
+                        (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_MTIME_SET |
+                         ATTR_TIMES_SET)) {
+                err = write_inode_now(inode, true);
+                if (err)
+                        return err;
+
+                fuse_set_nowrite(inode);
+                fuse_release_nowrite(inode);
+        }
+
         if (is_truncate) {
                 fuse_set_nowrite(inode);
                 set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 0f0225686aee..db48a5cf8620 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -217,7 +217,7 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir)
 {
         struct fuse_conn *fc = get_fuse_conn(inode);
         int err;
-        bool lock_inode = (file->f_flags & O_TRUNC) &&
+        bool is_wb_truncate = (file->f_flags & O_TRUNC) &&
                           fc->atomic_o_trunc &&
                           fc->writeback_cache;
 
@@ -225,16 +225,20 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir)
         if (err)
                 return err;
 
-        if (lock_inode)
+        if (is_wb_truncate) {
                 inode_lock(inode);
+                fuse_set_nowrite(inode);
+        }
 
         err = fuse_do_open(fc, get_node_id(inode), file, isdir);
 
         if (!err)
                 fuse_finish_open(inode, file);
 
-        if (lock_inode)
+        if (is_wb_truncate) {
+                fuse_release_nowrite(inode);
                 inode_unlock(inode);
+        }
 
         return err;
 }
@@ -1997,7 +2001,7 @@ static int fuse_writepages_fill(struct page *page,
 
         if (!data->ff) {
                 err = -EIO;
-                data->ff = fuse_write_file_get(fc, get_fuse_inode(inode));
+                data->ff = fuse_write_file_get(fc, fi);
                 if (!data->ff)
                         goto out_unlock;
         }
@@ -2042,8 +2046,6 @@ static int fuse_writepages_fill(struct page *page,
          * under writeback, so we can release the page lock.
          */
         if (data->wpa == NULL) {
-                struct fuse_inode *fi = get_fuse_inode(inode);
-
                 err = -ENOMEM;
                 wpa = fuse_writepage_args_alloc();
                 if (!wpa) {
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 956aeaf961ae..d148188cfca4 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -479,6 +479,7 @@ struct fuse_fs_context {
         bool destroy:1;
         bool no_control:1;
         bool no_force_umount:1;
+        bool no_mount_options:1;
         unsigned int max_read;
         unsigned int blksize;
         const char *subtype;
@@ -713,6 +714,9 @@ struct fuse_conn {
         /** Do not allow MNT_FORCE umount */
         unsigned int no_force_umount:1;
 
+        /* Do not show mount options */
+        unsigned int no_mount_options:1;
+
         /** The number of requests waiting for completion */
         atomic_t num_waiting;
 
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index e040e2a2b621..16aec32f7f3d 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -558,6 +558,9 @@ static int fuse_show_options(struct seq_file *m, struct dentry *root)
         struct super_block *sb = root->d_sb;
         struct fuse_conn *fc = get_fuse_conn_super(sb);
 
+        if (fc->no_mount_options)
+                return 0;
+
         seq_printf(m, ",user_id=%u", from_kuid_munged(fc->user_ns, fc->user_id));
         seq_printf(m, ",group_id=%u", from_kgid_munged(fc->user_ns, fc->group_id));
         if (fc->default_permissions)
@@ -1180,6 +1183,7 @@ int fuse_fill_super_common(struct super_block *sb, struct fuse_fs_context *ctx)
         fc->destroy = ctx->destroy;
         fc->no_control = ctx->no_control;
         fc->no_force_umount = ctx->no_force_umount;
+        fc->no_mount_options = ctx->no_mount_options;
 
         err = -ENOMEM;
         root = fuse_get_root_inode(sb, ctx->rootmode);
diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index 6af3f131e468..a5c86048b96e 100644
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -30,6 +30,7 @@ struct virtio_fs_vq {
         struct virtqueue *vq;     /* protected by ->lock */
         struct work_struct done_work;
         struct list_head queued_reqs;
+        struct list_head end_reqs;      /* End these requests */
         struct delayed_work dispatch_work;
         struct fuse_dev *fud;
         bool connected;
@@ -54,6 +55,9 @@ struct virtio_fs_forget {
         struct list_head list;
 };
 
+static int virtio_fs_enqueue_req(struct virtio_fs_vq *fsvq,
+                                 struct fuse_req *req, bool in_flight);
+
 static inline struct virtio_fs_vq *vq_to_fsvq(struct virtqueue *vq)
 {
         struct virtio_fs *fs = vq->vdev->priv;
@@ -66,6 +70,19 @@ static inline struct fuse_pqueue *vq_to_fpq(struct virtqueue *vq)
         return &vq_to_fsvq(vq)->fud->pq;
 }
 
+/* Should be called with fsvq->lock held. */
+static inline void inc_in_flight_req(struct virtio_fs_vq *fsvq)
+{
+        fsvq->in_flight++;
+}
+
+/* Should be called with fsvq->lock held. */
+static inline void dec_in_flight_req(struct virtio_fs_vq *fsvq)
+{
+        WARN_ON(fsvq->in_flight <= 0);
+        fsvq->in_flight--;
+}
+
 static void release_virtio_fs_obj(struct kref *ref)
 {
         struct virtio_fs *vfs = container_of(ref, struct virtio_fs, refcount);
@@ -109,22 +126,6 @@ static void virtio_fs_drain_queue(struct virtio_fs_vq *fsvq)
         flush_delayed_work(&fsvq->dispatch_work);
 }
 
-static inline void drain_hiprio_queued_reqs(struct virtio_fs_vq *fsvq)
-{
-        struct virtio_fs_forget *forget;
-
-        spin_lock(&fsvq->lock);
-        while (1) {
-                forget = list_first_entry_or_null(&fsvq->queued_reqs,
-                                                struct virtio_fs_forget, list);
-                if (!forget)
-                        break;
-                list_del(&forget->list);
-                kfree(forget);
-        }
-        spin_unlock(&fsvq->lock);
-}
-
 static void virtio_fs_drain_all_queues(struct virtio_fs *fs)
 {
         struct virtio_fs_vq *fsvq;
@@ -132,9 +133,6 @@ static void virtio_fs_drain_all_queues(struct virtio_fs *fs)
 
         for (i = 0; i < fs->nvqs; i++) {
                 fsvq = &fs->vqs[i];
-                if (i == VQ_HIPRIO)
-                        drain_hiprio_queued_reqs(fsvq);
-
                 virtio_fs_drain_queue(fsvq);
         }
 }
@@ -253,14 +251,66 @@ static void virtio_fs_hiprio_done_work(struct work_struct *work)
 
                 while ((req = virtqueue_get_buf(vq, &len)) != NULL) {
                         kfree(req);
-                        fsvq->in_flight--;
+                        dec_in_flight_req(fsvq);
                 }
         } while (!virtqueue_enable_cb(vq) && likely(!virtqueue_is_broken(vq)));
         spin_unlock(&fsvq->lock);
 }
 
-static void virtio_fs_dummy_dispatch_work(struct work_struct *work)
+static void virtio_fs_request_dispatch_work(struct work_struct *work)
 {
+        struct fuse_req *req;
+        struct virtio_fs_vq *fsvq = container_of(work, struct virtio_fs_vq,
+                                                 dispatch_work.work);
+        struct fuse_conn *fc = fsvq->fud->fc;
+        int ret;
+
+        pr_debug("virtio-fs: worker %s called.\n", __func__);
+        while (1) {
+                spin_lock(&fsvq->lock);
+                req = list_first_entry_or_null(&fsvq->end_reqs, struct fuse_req,
+                                               list);
+                if (!req) {
+                        spin_unlock(&fsvq->lock);
+                        break;
+                }
+
+                list_del_init(&req->list);
+                spin_unlock(&fsvq->lock);
+                fuse_request_end(fc, req);
+        }
+
+        /* Dispatch pending requests */
+        while (1) {
+                spin_lock(&fsvq->lock);
+                req = list_first_entry_or_null(&fsvq->queued_reqs,
+                                               struct fuse_req, list);
+                if (!req) {
+                        spin_unlock(&fsvq->lock);
+                        return;
+                }
+                list_del_init(&req->list);
+                spin_unlock(&fsvq->lock);
+
+                ret = virtio_fs_enqueue_req(fsvq, req, true);
+                if (ret < 0) {
+                        if (ret == -ENOMEM || ret == -ENOSPC) {
+                                spin_lock(&fsvq->lock);
+                                list_add_tail(&req->list, &fsvq->queued_reqs);
+                                schedule_delayed_work(&fsvq->dispatch_work,
+                                                      msecs_to_jiffies(1));
+                                spin_unlock(&fsvq->lock);
+                                return;
+                        }
+                        req->out.h.error = ret;
+                        spin_lock(&fsvq->lock);
+                        dec_in_flight_req(fsvq);
+                        spin_unlock(&fsvq->lock);
+                        pr_err("virtio-fs: virtio_fs_enqueue_req() failed %d\n",
+                               ret);
+                        fuse_request_end(fc, req);
+                }
+        }
 }
 
 static void virtio_fs_hiprio_dispatch_work(struct work_struct *work)
@@ -286,6 +336,7 @@ static void virtio_fs_hiprio_dispatch_work(struct work_struct *work)
 
                 list_del(&forget->list);
                 if (!fsvq->connected) {
+                        dec_in_flight_req(fsvq);
                         spin_unlock(&fsvq->lock);
                         kfree(forget);
                         continue;
@@ -307,13 +358,13 @@ static void virtio_fs_hiprio_dispatch_work(struct work_struct *work)
                         } else {
                                 pr_debug("virtio-fs: Could not queue FORGET: err=%d. Dropping it.\n",
                                          ret);
+                                dec_in_flight_req(fsvq);
                                 kfree(forget);
                         }
                         spin_unlock(&fsvq->lock);
                         return;
                 }
 
-                fsvq->in_flight++;
                 notify = virtqueue_kick_prepare(vq);
                 spin_unlock(&fsvq->lock);
 
@@ -452,7 +503,7 @@ static void virtio_fs_requests_done_work(struct work_struct *work)
 
                 fuse_request_end(fc, req);
                 spin_lock(&fsvq->lock);
-                fsvq->in_flight--;
+                dec_in_flight_req(fsvq);
                 spin_unlock(&fsvq->lock);
         }
 }
@@ -502,6 +553,7 @@ static int virtio_fs_setup_vqs(struct virtio_device *vdev,
         names[VQ_HIPRIO] = fs->vqs[VQ_HIPRIO].name;
         INIT_WORK(&fs->vqs[VQ_HIPRIO].done_work, virtio_fs_hiprio_done_work);
         INIT_LIST_HEAD(&fs->vqs[VQ_HIPRIO].queued_reqs);
+        INIT_LIST_HEAD(&fs->vqs[VQ_HIPRIO].end_reqs);
         INIT_DELAYED_WORK(&fs->vqs[VQ_HIPRIO].dispatch_work,
                         virtio_fs_hiprio_dispatch_work);
         spin_lock_init(&fs->vqs[VQ_HIPRIO].lock);
@@ -511,8 +563,9 @@ static int virtio_fs_setup_vqs(struct virtio_device *vdev,
                 spin_lock_init(&fs->vqs[i].lock);
                 INIT_WORK(&fs->vqs[i].done_work, virtio_fs_requests_done_work);
                 INIT_DELAYED_WORK(&fs->vqs[i].dispatch_work,
-                                        virtio_fs_dummy_dispatch_work);
+                                  virtio_fs_request_dispatch_work);
                 INIT_LIST_HEAD(&fs->vqs[i].queued_reqs);
+                INIT_LIST_HEAD(&fs->vqs[i].end_reqs);
                 snprintf(fs->vqs[i].name, sizeof(fs->vqs[i].name),
                          "requests.%u", i - VQ_REQUEST);
                 callbacks[i] = virtio_fs_vq_done;
@@ -708,6 +761,7 @@ __releases(fiq->lock)
                         list_add_tail(&forget->list, &fsvq->queued_reqs);
                         schedule_delayed_work(&fsvq->dispatch_work,
                                         msecs_to_jiffies(1));
+                        inc_in_flight_req(fsvq);
                 } else {
                         pr_debug("virtio-fs: Could not queue FORGET: err=%d. Dropping it.\n",
                                  ret);
@@ -717,7 +771,7 @@ __releases(fiq->lock)
                 goto out;
         }
 
-        fsvq->in_flight++;
+        inc_in_flight_req(fsvq);
         notify = virtqueue_kick_prepare(vq);
 
         spin_unlock(&fsvq->lock);
@@ -819,7 +873,7 @@ static unsigned int sg_init_fuse_args(struct scatterlist *sg,
 
 /* Add a request to a virtqueue and kick the device */
 static int virtio_fs_enqueue_req(struct virtio_fs_vq *fsvq,
-                                 struct fuse_req *req)
+                                 struct fuse_req *req, bool in_flight)
 {
         /* requests need at least 4 elements */
         struct scatterlist *stack_sgs[6];
@@ -835,6 +889,7 @@ static int virtio_fs_enqueue_req(struct virtio_fs_vq *fsvq,
         unsigned int i;
         int ret;
         bool notify;
+        struct fuse_pqueue *fpq;
 
         /* Does the sglist fit on the stack? */
         total_sgs = sg_count_fuse_req(req);
@@ -889,7 +944,17 @@ static int virtio_fs_enqueue_req(struct virtio_fs_vq *fsvq,
                 goto out;
         }
 
-        fsvq->in_flight++;
+        /* Request successfully sent. */
+        fpq = &fsvq->fud->pq;
+        spin_lock(&fpq->lock);
+        list_add_tail(&req->list, fpq->processing);
+        spin_unlock(&fpq->lock);
+        set_bit(FR_SENT, &req->flags);
+        /* matches barrier in request_wait_answer() */
+        smp_mb__after_atomic();
+
+        if (!in_flight)
+                inc_in_flight_req(fsvq);
         notify = virtqueue_kick_prepare(vq);
 
         spin_unlock(&fsvq->lock);
@@ -915,9 +980,8 @@ __releases(fiq->lock)
 {
         unsigned int queue_id = VQ_REQUEST; /* TODO multiqueue */
         struct virtio_fs *fs;
-        struct fuse_conn *fc;
         struct fuse_req *req;
-        struct fuse_pqueue *fpq;
+        struct virtio_fs_vq *fsvq;
         int ret;
 
         WARN_ON(list_empty(&fiq->pending));
@@ -928,44 +992,36 @@ __releases(fiq->lock)
         spin_unlock(&fiq->lock);
 
         fs = fiq->priv;
-        fc = fs->vqs[queue_id].fud->fc;
 
         pr_debug("%s: opcode %u unique %#llx nodeid %#llx in.len %u out.len %u\n",
                   __func__, req->in.h.opcode, req->in.h.unique,
                  req->in.h.nodeid, req->in.h.len,
                  fuse_len_args(req->args->out_numargs, req->args->out_args));
 
-        fpq = &fs->vqs[queue_id].fud->pq;
-        spin_lock(&fpq->lock);
-        if (!fpq->connected) {
-                spin_unlock(&fpq->lock);
-                req->out.h.error = -ENODEV;
-                pr_err("virtio-fs: %s disconnected\n", __func__);
-                fuse_request_end(fc, req);
-                return;
-        }
-        list_add_tail(&req->list, fpq->processing);
-        spin_unlock(&fpq->lock);
-        set_bit(FR_SENT, &req->flags);
-        /* matches barrier in request_wait_answer() */
-        smp_mb__after_atomic();
-
-retry:
-        ret = virtio_fs_enqueue_req(&fs->vqs[queue_id], req);
+        fsvq = &fs->vqs[queue_id];
+        ret = virtio_fs_enqueue_req(fsvq, req, false);
         if (ret < 0) {
                 if (ret == -ENOMEM || ret == -ENOSPC) {
-                        /* Virtqueue full. Retry submission */
-                        /* TODO use completion instead of timeout */
-                        usleep_range(20, 30);
-                        goto retry;
+                        /*
+                         * Virtqueue full. Retry submission from worker
+                         * context as we might be holding fc->bg_lock.
+                         */
+                        spin_lock(&fsvq->lock);
+                        list_add_tail(&req->list, &fsvq->queued_reqs);
+                        inc_in_flight_req(fsvq);
+                        schedule_delayed_work(&fsvq->dispatch_work,
+                                                msecs_to_jiffies(1));
+                        spin_unlock(&fsvq->lock);
+                        return;
                 }
                 req->out.h.error = ret;
                 pr_err("virtio-fs: virtio_fs_enqueue_req() failed %d\n", ret);
-                spin_lock(&fpq->lock);
-                clear_bit(FR_SENT, &req->flags);
-                list_del_init(&req->list);
-                spin_unlock(&fpq->lock);
-                fuse_request_end(fc, req);
+
+                /* Can't end request in submission context. Use a worker */
+                spin_lock(&fsvq->lock);
+                list_add_tail(&req->list, &fsvq->end_reqs);
+                schedule_delayed_work(&fsvq->dispatch_work, 0);
+                spin_unlock(&fsvq->lock);
                 return;
         }
 }
@@ -992,6 +1048,7 @@ static int virtio_fs_fill_super(struct super_block *sb)
                 .destroy = true,
                 .no_control = true,
                 .no_force_umount = true,
+                .no_mount_options = true,
         };
 
         mutex_lock(&virtio_fs_mutex);
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index dc61af2c4d5e..18daf494abab 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1540,17 +1540,23 @@ static int gfs2_init_fs_context(struct fs_context *fc)
 {
         struct gfs2_args *args;
 
-        args = kzalloc(sizeof(*args), GFP_KERNEL);
+        args = kmalloc(sizeof(*args), GFP_KERNEL);
         if (args == NULL)
                 return -ENOMEM;
 
-        args->ar_quota = GFS2_QUOTA_DEFAULT;
-        args->ar_data = GFS2_DATA_DEFAULT;
-        args->ar_commit = 30;
-        args->ar_statfs_quantum = 30;
-        args->ar_quota_quantum = 60;
-        args->ar_errors = GFS2_ERRORS_DEFAULT;
+        if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE) {
+                struct gfs2_sbd *sdp = fc->root->d_sb->s_fs_info;
 
+                *args = sdp->sd_args;
+        } else {
+                memset(args, 0, sizeof(*args));
+                args->ar_quota = GFS2_QUOTA_DEFAULT;
+                args->ar_data = GFS2_DATA_DEFAULT;
+                args->ar_commit = 30;
+                args->ar_statfs_quantum = 30;
+                args->ar_quota_quantum = 60;
+                args->ar_errors = GFS2_ERRORS_DEFAULT;
+        }
         fc->fs_private = args;
         fc->ops = &gfs2_context_ops;
         return 0;
diff --git a/fs/io_uring.c b/fs/io_uring.c
index a30c4f622cb3..f9a38998f2fc 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1124,6 +1124,7 @@ static int io_prep_rw(struct io_kiocb *req, const struct sqe_submit *s,
 
                 kiocb->ki_flags |= IOCB_HIPRI;
                 kiocb->ki_complete = io_complete_rw_iopoll;
+                req->result = 0;
         } else {
                 if (kiocb->ki_flags & IOCB_HIPRI)
                         return -EINVAL;
@@ -2413,6 +2414,7 @@ static int io_queue_link_head(struct io_ring_ctx *ctx, struct io_kiocb *req,
         if (ret) {
                 if (ret != -EIOCBQUEUED) {
                         io_free_req(req);
+                        __io_free_req(shadow);
                         io_cqring_add_event(ctx, s->sqe->user_data, ret);
                         return 0;
                 }
@@ -3828,10 +3830,6 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p)
         if (ret)
                 goto err;
 
-        ret = io_uring_get_fd(ctx);
-        if (ret < 0)
-                goto err;
-
         memset(&p->sq_off, 0, sizeof(p->sq_off));
         p->sq_off.head = offsetof(struct io_rings, sq.head);
         p->sq_off.tail = offsetof(struct io_rings, sq.tail);
@@ -3849,6 +3847,14 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p)
         p->cq_off.overflow = offsetof(struct io_rings, cq_overflow);
         p->cq_off.cqes = offsetof(struct io_rings, cqes);
 
+        /*
+         * Install ring fd as the very last thing, so we don't risk someone
+         * having closed it before we finish setup
+         */
+        ret = io_uring_get_fd(ctx);
+        if (ret < 0)
+                goto err;
+
         p->features = IORING_FEAT_SINGLE_MMAP;
         return ret;
 err:
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 071b90a45933..af549d70ec50 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -53,6 +53,16 @@ nfs4_is_valid_delegation(const struct nfs_delegation *delegation,
         return false;
 }
 
+struct nfs_delegation *nfs4_get_valid_delegation(const struct inode *inode)
+{
+        struct nfs_delegation *delegation;
+
+        delegation = rcu_dereference(NFS_I(inode)->delegation);
+        if (nfs4_is_valid_delegation(delegation, 0))
+                return delegation;
+        return NULL;
+}
+
 static int
 nfs4_do_check_delegation(struct inode *inode, fmode_t flags, bool mark)
 {
@@ -1181,7 +1191,7 @@ bool nfs4_refresh_delegation_stateid(nfs4_stateid *dst, struct inode *inode)
         if (delegation != NULL &&
             nfs4_stateid_match_other(dst, &delegation->stateid)) {
                 dst->seqid = delegation->stateid.seqid;
-                return ret;
+                ret = true;
         }
         rcu_read_unlock();
 out:
diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
index 9eb87ae4c982..8b14d441e699 100644
--- a/fs/nfs/delegation.h
+++ b/fs/nfs/delegation.h
@@ -68,6 +68,7 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,
 bool nfs4_copy_delegation_stateid(struct inode *inode, fmode_t flags, nfs4_stateid *dst, const struct cred **cred);
 bool nfs4_refresh_delegation_stateid(nfs4_stateid *dst, struct inode *inode);
 
+struct nfs_delegation *nfs4_get_valid_delegation(const struct inode *inode);
 void nfs_mark_delegation_referenced(struct nfs_delegation *delegation);
 int nfs4_have_delegation(struct inode *inode, fmode_t flags);
 int nfs4_check_delegation(struct inode *inode, fmode_t flags);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ab8ca20fd579..caacf5e7f5e1 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1440,8 +1440,6 @@ static int can_open_delegated(struct nfs_delegation *delegation, fmode_t fmode,
                 return 0;
         if ((delegation->type & fmode) != fmode)
                 return 0;
-        if (test_bit(NFS_DELEGATION_RETURNING, &delegation->flags))
-                return 0;
         switch (claim) {
         case NFS4_OPEN_CLAIM_NULL:
         case NFS4_OPEN_CLAIM_FH:
@@ -1810,7 +1808,6 @@ static void nfs4_return_incompatible_delegation(struct inode *inode, fmode_t fmo
 static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
 {
         struct nfs4_state *state = opendata->state;
-        struct nfs_inode *nfsi = NFS_I(state->inode);
         struct nfs_delegation *delegation;
         int open_mode = opendata->o_arg.open_flags;
         fmode_t fmode = opendata->o_arg.fmode;
@@ -1827,7 +1824,7 @@ static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
                 }
                 spin_unlock(&state->owner->so_lock);
                 rcu_read_lock();
-                delegation = rcu_dereference(nfsi->delegation);
+                delegation = nfs4_get_valid_delegation(state->inode);
                 if (!can_open_delegated(delegation, fmode, claim)) {
                         rcu_read_unlock();
                         break;
@@ -2371,7 +2368,7 @@ static void nfs4_open_prepare(struct rpc_task *task, void *calldata)
                                         data->o_arg.open_flags, claim))
                         goto out_no_action;
                 rcu_read_lock();
-                delegation = rcu_dereference(NFS_I(data->state->inode)->delegation);
+                delegation = nfs4_get_valid_delegation(data->state->inode);
                 if (can_open_delegated(delegation, data->o_arg.fmode, claim))
                         goto unlock_no_action;
                 rcu_read_unlock();
diff --git a/include/linux/dynamic_debug.h b/include/linux/dynamic_debug.h
index 6c809440f319..4cf02ecd67de 100644
--- a/include/linux/dynamic_debug.h
+++ b/include/linux/dynamic_debug.h
@@ -204,6 +204,12 @@ static inline int ddebug_dyndbg_module_param_cb(char *param, char *val,
         do { if (0) printk(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__); } while (0)
 #define dynamic_dev_dbg(dev, fmt, ...)                                  \
         do { if (0) dev_printk(KERN_DEBUG, dev, fmt, ##__VA_ARGS__); } while (0)
+#define dynamic_hex_dump(prefix_str, prefix_type, rowsize,              \
+                         groupsize, buf, len, ascii)                    \
+        do { if (0)                                                     \
+                print_hex_dump(KERN_DEBUG, prefix_str, prefix_type,     \
+                                rowsize, groupsize, buf, len, ascii);   \
+        } while (0)
 #endif
 
 #endif
diff --git a/include/linux/efi.h b/include/linux/efi.h
index bd3837022307..d87acf62958e 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -1579,9 +1579,22 @@ char *efi_convert_cmdline(efi_system_table_t *sys_table_arg,
 efi_status_t efi_get_memory_map(efi_system_table_t *sys_table_arg,
                                 struct efi_boot_memmap *map);
 
+efi_status_t efi_low_alloc_above(efi_system_table_t *sys_table_arg,
+                                 unsigned long size, unsigned long align,
+                                 unsigned long *addr, unsigned long min);
+
+static inline
 efi_status_t efi_low_alloc(efi_system_table_t *sys_table_arg,
                            unsigned long size, unsigned long align,
-                           unsigned long *addr);
+                           unsigned long *addr)
+{
+        /*
+         * Don't allocate at 0x0. It will confuse code that
+         * checks pointers against NULL. Skip the first 8
+         * bytes so we start at a nice even number.
+         */
+        return efi_low_alloc_above(sys_table_arg, size, align, addr, 0x8);
+}
 
 efi_status_t efi_high_alloc(efi_system_table_t *sys_table_arg,
                             unsigned long size, unsigned long align,
@@ -1592,7 +1605,8 @@ efi_status_t efi_relocate_kernel(efi_system_table_t *sys_table_arg,
                                  unsigned long image_size,
                                  unsigned long alloc_size,
                                  unsigned long preferred_addr,
-                                 unsigned long alignment);
+                                 unsigned long alignment,
+                                 unsigned long min_addr);
 
 efi_status_t handle_cmdline_files(efi_system_table_t *sys_table_arg,
                                   efi_loaded_image_t *image,
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 2ce57645f3cd..0367a75f873b 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -1099,7 +1099,6 @@ static inline void bpf_get_prog_name(const struct bpf_prog *prog, char *sym)
 
 #endif /* CONFIG_BPF_JIT */
 
-void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp);
 void bpf_prog_kallsyms_del_all(struct bpf_prog *fp);
 
 #define BPF_ANC         BIT(15)
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index fb07b503dc45..61f2f6ff9467 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -325,6 +325,29 @@ static inline bool gfpflags_allow_blocking(const gfp_t gfp_flags)
         return !!(gfp_flags & __GFP_DIRECT_RECLAIM);
 }
 
+/**
+ * gfpflags_normal_context - is gfp_flags a normal sleepable context?
+ * @gfp_flags: gfp_flags to test
+ *
+ * Test whether @gfp_flags indicates that the allocation is from the
+ * %current context and allowed to sleep.
+ *
+ * An allocation being allowed to block doesn't mean it owns the %current
+ * context.  When direct reclaim path tries to allocate memory, the
+ * allocation context is nested inside whatever %current was doing at the
+ * time of the original allocation.  The nested allocation may be allowed
+ * to block but modifying anything %current owns can corrupt the outer
+ * context's expectations.
+ *
+ * %true result from this function indicates that the allocation context
+ * can sleep and use anything that's associated with %current.
+ */
+static inline bool gfpflags_normal_context(const gfp_t gfp_flags)
+{
+        return (gfp_flags & (__GFP_DIRECT_RECLAIM | __GFP_MEMALLOC)) ==
+                __GFP_DIRECT_RECLAIM;
+}
+
 #ifdef CONFIG_HIGHMEM
 #define OPT_ZONE_HIGHMEM ZONE_HIGHMEM
 #else
diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h
index 2e55e4cdbd8a..a367ead4bf4b 100644
--- a/include/linux/if_macvlan.h
+++ b/include/linux/if_macvlan.h
@@ -29,7 +29,6 @@ struct macvlan_dev {
         netdev_features_t       set_features;
         enum macvlan_mode       mode;
         u16                     flags;
-        int                     nest_level;
         unsigned int            macaddr_count;
 #ifdef CONFIG_NET_POLL_CONTROLLER
         struct netpoll          *netpoll;
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index 06faa066496f..ec7e4bd07f82 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -223,6 +223,7 @@ struct team {
                 atomic_t count_pending;
                 struct delayed_work dw;
         } mcast_rejoin;
+        struct lock_class_key team_lock_key;
         long mode_priv[TEAM_MODE_PRIV_LONGS];
 };
 
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 244278d5c222..b05e855f1ddd 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -182,7 +182,6 @@ struct vlan_dev_priv {
 #ifdef CONFIG_NET_POLL_CONTROLLER
         struct netpoll                          *netpoll;
 #endif
-        unsigned int                            nest_level;
 };
 
 static inline struct vlan_dev_priv *vlan_dev_priv(const struct net_device *dev)
@@ -221,11 +220,6 @@ extern void vlan_vids_del_by_dev(struct net_device *dev,
 
 extern bool vlan_uses_dev(const struct net_device *dev);
 
-static inline int vlan_get_encap_level(struct net_device *dev)
-{
-        BUG_ON(!is_vlan_dev(dev));
-        return vlan_dev_priv(dev)->nest_level;
-}
 #else
 static inline struct net_device *
 __vlan_find_dev_deep_rcu(struct net_device *real_dev,
@@ -295,11 +289,6 @@ static inline bool vlan_uses_dev(const struct net_device *dev)
 {
         return false;
 }
-static inline int vlan_get_encap_level(struct net_device *dev)
-{
-        BUG();
-        return 0;
-}
 #endif
 
 /**
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 138c50d5a353..0836fe232f97 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -1545,9 +1545,8 @@ struct mlx5_ifc_extended_dest_format_bits {
 };
 
 union mlx5_ifc_dest_format_struct_flow_counter_list_auto_bits {
-        struct mlx5_ifc_dest_format_struct_bits dest_format_struct;
+        struct mlx5_ifc_extended_dest_format_bits extended_dest_format;
         struct mlx5_ifc_flow_counter_list_bits flow_counter_list;
-        u8         reserved_at_0[0x40];
 };
 
 struct mlx5_ifc_fte_match_param_bits {
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 9eda1c31d1f7..c20f190b4c18 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -925,6 +925,7 @@ struct dev_ifalias {
 struct devlink;
 struct tlsdev_ops;
 
+
 /*
  * This structure defines the management hooks for network devices.
  * The following hooks can be defined; unless noted otherwise, they are
@@ -1421,7 +1422,6 @@ struct net_device_ops {
         void                    (*ndo_dfwd_del_station)(struct net_device *pdev,
                                                         void *priv);
 
-        int                     (*ndo_get_lock_subclass)(struct net_device *dev);
         int                     (*ndo_set_tx_maxrate)(struct net_device *dev,
                                                       int queue_index,
                                                       u32 maxrate);
@@ -1649,6 +1649,8 @@ enum netdev_priv_flags {
  *      @perm_addr:             Permanent hw address
  *      @addr_assign_type:      Hw address assignment type
  *      @addr_len:              Hardware address length
+ *      @upper_level:           Maximum depth level of upper devices.
+ *      @lower_level:           Maximum depth level of lower devices.
  *      @neigh_priv_len:        Used in neigh_alloc()
  *      @dev_id:                Used to differentiate devices that share
  *                              the same link layer address
@@ -1758,9 +1760,13 @@ enum netdev_priv_flags {
  *      @phydev:        Physical device may attach itself
  *                      for hardware timestamping
  *      @sfp_bus:       attached &struct sfp_bus structure.
- *
- *      @qdisc_tx_busylock: lockdep class annotating Qdisc->busylock spinlock
- *      @qdisc_running_key: lockdep class annotating Qdisc->running seqcount
+ *      @qdisc_tx_busylock_key: lockdep class annotating Qdisc->busylock
+                                spinlock
+ *      @qdisc_running_key:     lockdep class annotating Qdisc->running seqcount
+ *      @qdisc_xmit_lock_key:   lockdep class annotating
+ *                              netdev_queue->_xmit_lock spinlock
+ *      @addr_list_lock_key:    lockdep class annotating
+ *                              net_device->addr_list_lock spinlock
  *
  *      @proto_down:    protocol port state information can be sent to the
  *                      switch driver and used to set the phys state of the
@@ -1875,6 +1881,8 @@ struct net_device {
         unsigned char           perm_addr[MAX_ADDR_LEN];
         unsigned char           addr_assign_type;
         unsigned char           addr_len;
+        unsigned char           upper_level;
+        unsigned char           lower_level;
         unsigned short          neigh_priv_len;
         unsigned short          dev_id;
         unsigned short          dev_port;
@@ -2045,8 +2053,10 @@ struct net_device {
 #endif
         struct phy_device       *phydev;
         struct sfp_bus          *sfp_bus;
-        struct lock_class_key   *qdisc_tx_busylock;
-        struct lock_class_key   *qdisc_running_key;
+        struct lock_class_key   qdisc_tx_busylock_key;
+        struct lock_class_key   qdisc_running_key;
+        struct lock_class_key   qdisc_xmit_lock_key;
+        struct lock_class_key   addr_list_lock_key;
         bool                    proto_down;
         unsigned                wol_enabled:1;
 };
@@ -2124,23 +2134,6 @@ static inline void netdev_for_each_tx_queue(struct net_device *dev,
                 f(dev, &dev->_tx[i], arg);
 }
 
-#define netdev_lockdep_set_classes(dev)                         \
-{                                                               \
-        static struct lock_class_key qdisc_tx_busylock_key;     \
-        static struct lock_class_key qdisc_running_key;         \
-        static struct lock_class_key qdisc_xmit_lock_key;       \
-        static struct lock_class_key dev_addr_list_lock_key;    \
-        unsigned int i;                                         \
-                                                                \
-        (dev)->qdisc_tx_busylock = &qdisc_tx_busylock_key;      \
-        (dev)->qdisc_running_key = &qdisc_running_key;          \
-        lockdep_set_class(&(dev)->addr_list_lock,               \
-                          &dev_addr_list_lock_key);             \
-        for (i = 0; i < (dev)->num_tx_queues; i++)              \
-                lockdep_set_class(&(dev)->_tx[i]._xmit_lock,    \
-                                  &qdisc_xmit_lock_key);        \
-}
-
 u16 netdev_pick_tx(struct net_device *dev, struct sk_buff *skb,
                      struct net_device *sb_dev);
 struct netdev_queue *netdev_core_pick_tx(struct net_device *dev,
@@ -3139,6 +3132,7 @@ static inline void netif_stop_queue(struct net_device *dev)
 }
 
 void netif_tx_stop_all_queues(struct net_device *dev);
+void netdev_update_lockdep_key(struct net_device *dev);
 
 static inline bool netif_tx_queue_stopped(const struct netdev_queue *dev_queue)
 {
@@ -4056,16 +4050,6 @@ static inline void netif_addr_lock(struct net_device *dev)
         spin_lock(&dev->addr_list_lock);
 }
 
-static inline void netif_addr_lock_nested(struct net_device *dev)
-{
-        int subclass = SINGLE_DEPTH_NESTING;
-
-        if (dev->netdev_ops->ndo_get_lock_subclass)
-                subclass = dev->netdev_ops->ndo_get_lock_subclass(dev);
-
-        spin_lock_nested(&dev->addr_list_lock, subclass);
-}
-
 static inline void netif_addr_lock_bh(struct net_device *dev)
 {
         spin_lock_bh(&dev->addr_list_lock);
@@ -4329,6 +4313,16 @@ int netdev_master_upper_dev_link(struct net_device *dev,
                                  struct netlink_ext_ack *extack);
 void netdev_upper_dev_unlink(struct net_device *dev,
                              struct net_device *upper_dev);
+int netdev_adjacent_change_prepare(struct net_device *old_dev,
+                                   struct net_device *new_dev,
+                                   struct net_device *dev,
+                                   struct netlink_ext_ack *extack);
+void netdev_adjacent_change_commit(struct net_device *old_dev,
+                                   struct net_device *new_dev,
+                                   struct net_device *dev);
+void netdev_adjacent_change_abort(struct net_device *old_dev,
+                                  struct net_device *new_dev,
+                                  struct net_device *dev);
 void netdev_adjacent_rename_links(struct net_device *dev, char *oldname);
 void *netdev_lower_dev_get_private(struct net_device *dev,
                                    struct net_device *lower_dev);
@@ -4340,7 +4334,6 @@ void netdev_lower_state_changed(struct net_device *lower_dev,
 extern u8 netdev_rss_key[NETDEV_RSS_KEY_LEN] __read_mostly;
 void netdev_rss_key_fill(void *buffer, size_t len);
 
-int dev_get_nest_level(struct net_device *dev);
 int skb_checksum_help(struct sk_buff *skb);
 int skb_crc32c_csum_help(struct sk_buff *skb);
 int skb_csum_hwoffload_help(struct sk_buff *skb,
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 61448c19a132..68ccc5b1913b 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -292,7 +292,7 @@ struct pmu {
          *  -EBUSY      -- @event is for this PMU but PMU temporarily unavailable
          *  -EINVAL     -- @event is for this PMU but @event is not valid
          *  -EOPNOTSUPP -- @event is for this PMU, @event is valid, but not supported
-         *  -EACCESS    -- @event is for this PMU, @event is valid, but no privilidges
+         *  -EACCES     -- @event is for this PMU, @event is valid, but no privileges
          *
          *  0           -- @event is for this PMU and valid
          *
diff --git a/include/linux/platform_data/dma-imx-sdma.h b/include/linux/platform_data/dma-imx-sdma.h
index 6eaa53cef0bd..30e676b36b24 100644
--- a/include/linux/platform_data/dma-imx-sdma.h
+++ b/include/linux/platform_data/dma-imx-sdma.h
@@ -51,7 +51,10 @@ struct sdma_script_start_addrs {
         /* End of v2 array */
         s32 zcanfd_2_mcu_addr;
         s32 zqspi_2_mcu_addr;
+        s32 mcu_2_ecspi_addr;
         /* End of v3 array */
+        s32 mcu_2_zqspi_addr;
+        /* End of v4 array */
 };
 
 /**
diff --git a/include/linux/security.h b/include/linux/security.h
index a8d59d612d27..9df7547afc0c 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -105,6 +105,7 @@ enum lockdown_reason {
         LOCKDOWN_NONE,
         LOCKDOWN_MODULE_SIGNATURE,
         LOCKDOWN_DEV_MEM,
+        LOCKDOWN_EFI_TEST,
         LOCKDOWN_KEXEC,
         LOCKDOWN_HIBERNATION,
         LOCKDOWN_PCI_ACCESS,
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 7914fdaf4226..64a395c7f689 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1354,7 +1354,8 @@ static inline __u32 skb_get_hash_flowi6(struct sk_buff *skb, const struct flowi6
         return skb->hash;
 }
 
-__u32 skb_get_hash_perturb(const struct sk_buff *skb, u32 perturb);
+__u32 skb_get_hash_perturb(const struct sk_buff *skb,
+                           const siphash_key_t *perturb);
 
 static inline __u32 skb_get_hash_raw(const struct sk_buff *skb)
 {
@@ -1495,6 +1496,19 @@ static inline int skb_queue_empty(const struct sk_buff_head *list)
 }
 
 /**
+ *      skb_queue_empty_lockless - check if a queue is empty
+ *      @list: queue head
+ *
+ *      Returns true if the queue is empty, false otherwise.
+ *      This variant can be used in lockless contexts.
+ */
+static inline bool skb_queue_empty_lockless(const struct sk_buff_head *list)
+{
+        return READ_ONCE(list->next) == (const struct sk_buff *) list;
+}
+
+
+/**
  *      skb_queue_is_last - check if skb is the last entry in the queue
  *      @list: queue head
  *      @skb: buffer
@@ -1847,9 +1861,11 @@ static inline void __skb_insert(struct sk_buff *newsk,
                                 struct sk_buff *prev, struct sk_buff *next,
                                 struct sk_buff_head *list)
 {
-        newsk->next = next;
-        newsk->prev = prev;
-        next->prev  = prev->next = newsk;
+        /* see skb_queue_empty_lockless() for the opposite READ_ONCE() */
+        WRITE_ONCE(newsk->next, next);
+        WRITE_ONCE(newsk->prev, prev);
+        WRITE_ONCE(next->prev, newsk);
+        WRITE_ONCE(prev->next, newsk);
         list->qlen++;
 }
 
@@ -1860,11 +1876,11 @@ static inline void __skb_queue_splice(const struct sk_buff_head *list,
         struct sk_buff *first = list->next;
         struct sk_buff *last = list->prev;
 
-        first->prev = prev;
-        prev->next = first;
+        WRITE_ONCE(first->prev, prev);
+        WRITE_ONCE(prev->next, first);
 
-        last->next = next;
-        next->prev = last;
+        WRITE_ONCE(last->next, next);
+        WRITE_ONCE(next->prev, last);
 }
 
 /**
@@ -2005,8 +2021,8 @@ static inline void __skb_unlink(struct sk_buff *skb, struct sk_buff_head *list)
         next       = skb->next;
         prev       = skb->prev;
         skb->next  = skb->prev = NULL;
-        next->prev = prev;
-        prev->next = next;
+        WRITE_ONCE(next->prev, prev);
+        WRITE_ONCE(prev->next, next);
 }
 
 /**
diff --git a/include/linux/socket.h b/include/linux/socket.h
index fc0bed59fc84..4049d9755cf1 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -263,7 +263,7 @@ struct ucred {
 #define PF_MAX          AF_MAX
 
 /* Maximum queue length specifiable by listen.  */
-#define SOMAXCONN       128
+#define SOMAXCONN       4096
 
 /* Flags we can use with send/ and recv.
    Added those for 1003.1g not all are supported yet
diff --git a/include/linux/sunrpc/bc_xprt.h b/include/linux/sunrpc/bc_xprt.h
index 87d27e13d885..d796058cdff2 100644
--- a/include/linux/sunrpc/bc_xprt.h
+++ b/include/linux/sunrpc/bc_xprt.h
@@ -64,6 +64,11 @@ static inline int xprt_setup_backchannel(struct rpc_xprt *xprt,
         return 0;
 }
 
+static inline void xprt_destroy_backchannel(struct rpc_xprt *xprt,
+                                            unsigned int max_reqs)
+{
+}
+
 static inline bool svc_is_backchannel(const struct svc_rqst *rqstp)
 {
         return false;
diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h
index 4c7781f4b29b..07875ccc7bb5 100644
--- a/include/linux/virtio_vsock.h
+++ b/include/linux/virtio_vsock.h
@@ -48,7 +48,6 @@ struct virtio_vsock_sock {
 
 struct virtio_vsock_pkt {
         struct virtio_vsock_hdr hdr;
-        struct work_struct work;
         struct list_head list;
         /* socket refcnt not held, only use for cancellation */
         struct vsock_sock *vsk;
diff --git a/include/net/bonding.h b/include/net/bonding.h
index f7fe45689142..1afc125014da 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -203,7 +203,6 @@ struct bonding {
         struct   slave __rcu *primary_slave;
         struct   bond_up_slave __rcu *slave_arr; /* Array of usable slaves */
         bool     force_primary;
-        u32      nest_level;
         s32      slave_cnt; /* never change this value outside the attach/detach wrappers */
         int     (*recv_probe)(const struct sk_buff *, struct bonding *,
                               struct slave *);
@@ -239,6 +238,7 @@ struct bonding {
         struct   dentry *debug_dir;
 #endif /* CONFIG_DEBUG_FS */
         struct rtnl_link_stats64 bond_stats;
+        struct lock_class_key stats_lock_key;
 };
 
 #define bond_slave_get_rcu(dev) \
diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h
index 127a5c4e3699..86e028388bad 100644
--- a/include/net/busy_poll.h
+++ b/include/net/busy_poll.h
@@ -122,7 +122,7 @@ static inline void skb_mark_napi_id(struct sk_buff *skb,
 static inline void sk_mark_napi_id(struct sock *sk, const struct sk_buff *skb)
 {
 #ifdef CONFIG_NET_RX_BUSY_POLL
-        sk->sk_napi_id = skb->napi_id;
+        WRITE_ONCE(sk->sk_napi_id, skb->napi_id);
 #endif
         sk_rx_queue_set(sk, skb);
 }
@@ -132,8 +132,8 @@ static inline void sk_mark_napi_id_once(struct sock *sk,
                                         const struct sk_buff *skb)
 {
 #ifdef CONFIG_NET_RX_BUSY_POLL
-        if (!sk->sk_napi_id)
-                sk->sk_napi_id = skb->napi_id;
+        if (!READ_ONCE(sk->sk_napi_id))
+                WRITE_ONCE(sk->sk_napi_id, skb->napi_id);
 #endif
 }
 
diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h
index 90bd210be060..5cd12276ae21 100644
--- a/include/net/flow_dissector.h
+++ b/include/net/flow_dissector.h
@@ -4,6 +4,7 @@
 
 #include <linux/types.h>
 #include <linux/in6.h>
+#include <linux/siphash.h>
 #include <uapi/linux/if_ether.h>
 
 /**
@@ -276,7 +277,7 @@ struct flow_keys_basic {
 struct flow_keys {
         struct flow_dissector_key_control control;
 #define FLOW_KEYS_HASH_START_FIELD basic
-        struct flow_dissector_key_basic basic;
+        struct flow_dissector_key_basic basic __aligned(SIPHASH_ALIGNMENT);
         struct flow_dissector_key_tags tags;
         struct flow_dissector_key_vlan vlan;
         struct flow_dissector_key_vlan cvlan;
diff --git a/include/net/fq.h b/include/net/fq.h
index d126b5d20261..2ad85e683041 100644
--- a/include/net/fq.h
+++ b/include/net/fq.h
@@ -69,7 +69,7 @@ struct fq {
         struct list_head backlogs;
         spinlock_t lock;
         u32 flows_cnt;
-        u32 perturbation;
+        siphash_key_t   perturbation;
         u32 limit;
         u32 memory_limit;
         u32 memory_usage;
diff --git a/include/net/fq_impl.h b/include/net/fq_impl.h
index be40a4b327e3..107c0d700ed6 100644
--- a/include/net/fq_impl.h
+++ b/include/net/fq_impl.h
@@ -108,7 +108,7 @@ begin:
 
 static u32 fq_flow_idx(struct fq *fq, struct sk_buff *skb)
 {
-        u32 hash = skb_get_hash_perturb(skb, fq->perturbation);
+        u32 hash = skb_get_hash_perturb(skb, &fq->perturbation);
 
         return reciprocal_scale(hash, fq->flows_cnt);
 }
@@ -308,7 +308,7 @@ static int fq_init(struct fq *fq, int flows_cnt)
         INIT_LIST_HEAD(&fq->backlogs);
         spin_lock_init(&fq->lock);
         fq->flows_cnt = max_t(u32, flows_cnt, 1);
-        fq->perturbation = prandom_u32();
+        get_random_bytes(&fq->perturbation, sizeof(fq->perturbation));
         fq->quantum = 300;
         fq->limit = 8192;
         fq->memory_limit = 16 << 20; /* 16 MBytes */
diff --git a/include/net/hwbm.h b/include/net/hwbm.h
index 81643cf8a1c4..c81444611a22 100644
--- a/include/net/hwbm.h
+++ b/include/net/hwbm.h
@@ -21,9 +21,13 @@ void hwbm_buf_free(struct hwbm_pool *bm_pool, void *buf);
 int hwbm_pool_refill(struct hwbm_pool *bm_pool, gfp_t gfp);
 int hwbm_pool_add(struct hwbm_pool *bm_pool, unsigned int buf_num);
 #else
-void hwbm_buf_free(struct hwbm_pool *bm_pool, void *buf) {}
-int hwbm_pool_refill(struct hwbm_pool *bm_pool, gfp_t gfp) { return 0; }
-int hwbm_pool_add(struct hwbm_pool *bm_pool, unsigned int buf_num)
+static inline void hwbm_buf_free(struct hwbm_pool *bm_pool, void *buf) {}
+
+static inline int hwbm_pool_refill(struct hwbm_pool *bm_pool, gfp_t gfp)
+{ return 0; }
+
+static inline int hwbm_pool_add(struct hwbm_pool *bm_pool,
+                                unsigned int buf_num)
 { return 0; }
 #endif /* CONFIG_HWBM */
 #endif /* _HWBM_H */
diff --git a/include/net/ip.h b/include/net/ip.h
index 95bb77f95bcc..a2c61c36dc4a 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -185,7 +185,7 @@ static inline struct sk_buff *ip_fraglist_next(struct ip_fraglist_iter *iter)
 }
 
 struct ip_frag_state {
-        struct iphdr    *iph;
+        bool            DF;
         unsigned int    hlen;
         unsigned int    ll_rs;
         unsigned int    mtu;
@@ -196,7 +196,7 @@ struct ip_frag_state {
 };
 
 void ip_frag_init(struct sk_buff *skb, unsigned int hlen, unsigned int ll_rs,
-                  unsigned int mtu, struct ip_frag_state *state);
+                  unsigned int mtu, bool DF, struct ip_frag_state *state);
 struct sk_buff *ip_frag_next(struct sk_buff *skb,
                              struct ip_frag_state *state);
 
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 3759167f91f5..078887c8c586 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -889,6 +889,7 @@ struct netns_ipvs {
         struct delayed_work     defense_work;   /* Work handler */
         int                     drop_rate;
         int                     drop_counter;
+        int                     old_secure_tcp;
         atomic_t                dropentry;
         /* locks in ctl.c */
         spinlock_t              dropentry_lock;  /* drop entry handling */
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 4c2cd9378699..c7e15a213ef2 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -342,7 +342,7 @@ static inline struct net *read_pnet(const possible_net_t *pnet)
 #define __net_initconst __initconst
 #endif
 
-int peernet2id_alloc(struct net *net, struct net *peer);
+int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp);
 int peernet2id(struct net *net, struct net *peer);
 bool peernet_has_id(struct net *net, struct net *peer);
 struct net *get_net_ns_by_id(struct net *net, int id);
diff --git a/include/net/sock.h b/include/net/sock.h
index f69b58bff7e5..8f9adcfac41b 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -954,8 +954,8 @@ static inline void sk_incoming_cpu_update(struct sock *sk)
 {
         int cpu = raw_smp_processor_id();
 
-        if (unlikely(sk->sk_incoming_cpu != cpu))
-                sk->sk_incoming_cpu = cpu;
+        if (unlikely(READ_ONCE(sk->sk_incoming_cpu) != cpu))
+                WRITE_ONCE(sk->sk_incoming_cpu, cpu);
 }
 
 static inline void sock_rps_record_flow_hash(__u32 hash)
@@ -2242,12 +2242,17 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp,
  * sk_page_frag - return an appropriate page_frag
  * @sk: socket
  *
- * If socket allocation mode allows current thread to sleep, it means its
- * safe to use the per task page_frag instead of the per socket one.
+ * Use the per task page_frag instead of the per socket one for
+ * optimization when we know that we're in the normal context and owns
+ * everything that's associated with %current.
+ *
+ * gfpflags_allow_blocking() isn't enough here as direct reclaim may nest
+ * inside other socket operations and end up recursing into sk_page_frag()
+ * while it's already in use.
  */
 static inline struct page_frag *sk_page_frag(struct sock *sk)
 {
-        if (gfpflags_allow_blocking(sk->sk_allocation))
+        if (gfpflags_normal_context(sk->sk_allocation))
                 return &current->task_frag;
 
         return &sk->sk_frag;
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index 335283dbe9b3..373aadcfea21 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -197,6 +197,7 @@ struct vxlan_rdst {
         u8                       offloaded:1;
         __be32                   remote_vni;
         u32                      remote_ifindex;
+        struct net_device        *remote_dev;
         struct list_head         list;
         struct rcu_head          rcu;
         struct dst_cache         dst_cache;
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 6a47ba85c54c..e7e733add99f 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -366,7 +366,7 @@ struct ib_tm_caps {
 
 struct ib_cq_init_attr {
         unsigned int    cqe;
-        int             comp_vector;
+        u32             comp_vector;
         u32             flags;
 };
 
diff --git a/include/uapi/linux/fuse.h b/include/uapi/linux/fuse.h
index 802b0377a49e..373cada89815 100644
--- a/include/uapi/linux/fuse.h
+++ b/include/uapi/linux/fuse.h
@@ -38,6 +38,43 @@
  *
  * Protocol changelog:
  *
+ * 7.1:
+ *  - add the following messages:
+ *      FUSE_SETATTR, FUSE_SYMLINK, FUSE_MKNOD, FUSE_MKDIR, FUSE_UNLINK,
+ *      FUSE_RMDIR, FUSE_RENAME, FUSE_LINK, FUSE_OPEN, FUSE_READ, FUSE_WRITE,
+ *      FUSE_RELEASE, FUSE_FSYNC, FUSE_FLUSH, FUSE_SETXATTR, FUSE_GETXATTR,
+ *      FUSE_LISTXATTR, FUSE_REMOVEXATTR, FUSE_OPENDIR, FUSE_READDIR,
+ *      FUSE_RELEASEDIR
+ *  - add padding to messages to accommodate 32-bit servers on 64-bit kernels
+ *
+ * 7.2:
+ *  - add FOPEN_DIRECT_IO and FOPEN_KEEP_CACHE flags
+ *  - add FUSE_FSYNCDIR message
+ *
+ * 7.3:
+ *  - add FUSE_ACCESS message
+ *  - add FUSE_CREATE message
+ *  - add filehandle to fuse_setattr_in
+ *
+ * 7.4:
+ *  - add frsize to fuse_kstatfs
+ *  - clean up request size limit checking
+ *
+ * 7.5:
+ *  - add flags and max_write to fuse_init_out
+ *
+ * 7.6:
+ *  - add max_readahead to fuse_init_in and fuse_init_out
+ *
+ * 7.7:
+ *  - add FUSE_INTERRUPT message
+ *  - add POSIX file lock support
+ *
+ * 7.8:
+ *  - add lock_owner and flags fields to fuse_release_in
+ *  - add FUSE_BMAP message
+ *  - add FUSE_DESTROY message
+ *
  * 7.9:
  *  - new fuse_getattr_in input argument of GETATTR
  *  - add lk_flags in fuse_lk_in
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 66088a9e9b9e..ef0e1e3e66f4 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -502,7 +502,7 @@ int bpf_remove_insns(struct bpf_prog *prog, u32 off, u32 cnt)
         return WARN_ON_ONCE(bpf_adj_branches(prog, off, off + cnt, off, false));
 }
 
-void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp)
+static void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp)
 {
         int i;
 
diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index d27f3b60ff6d..3867864cdc2f 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -128,7 +128,7 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr)
 
                 if (!dtab->n_buckets) /* Overflow check */
                         return -EINVAL;
-                cost += sizeof(struct hlist_head) * dtab->n_buckets;
+                cost += (u64) sizeof(struct hlist_head) * dtab->n_buckets;
         }
 
         /* if map size is larger than memlock limit, reject it */
@@ -719,6 +719,32 @@ const struct bpf_map_ops dev_map_hash_ops = {
         .map_check_btf = map_check_no_btf,
 };
 
+static void dev_map_hash_remove_netdev(struct bpf_dtab *dtab,
+                                       struct net_device *netdev)
+{
+        unsigned long flags;
+        u32 i;
+
+        spin_lock_irqsave(&dtab->index_lock, flags);
+        for (i = 0; i < dtab->n_buckets; i++) {
+                struct bpf_dtab_netdev *dev;
+                struct hlist_head *head;
+                struct hlist_node *next;
+
+                head = dev_map_index_hash(dtab, i);
+
+                hlist_for_each_entry_safe(dev, next, head, index_hlist) {
+                        if (netdev != dev->dev)
+                                continue;
+
+                        dtab->items--;
+                        hlist_del_rcu(&dev->index_hlist);
+                        call_rcu(&dev->rcu, __dev_map_entry_free);
+                }
+        }
+        spin_unlock_irqrestore(&dtab->index_lock, flags);
+}
+
 static int dev_map_notification(struct notifier_block *notifier,
                                 ulong event, void *ptr)
 {
@@ -735,6 +761,11 @@ static int dev_map_notification(struct notifier_block *notifier,
                  */
                 rcu_read_lock();
                 list_for_each_entry_rcu(dtab, &dev_map_list, list) {
+                        if (dtab->map.map_type == BPF_MAP_TYPE_DEVMAP_HASH) {
+                                dev_map_hash_remove_netdev(dtab, netdev);
+                                continue;
+                        }
+
                         for (i = 0; i < dtab->map.max_entries; i++) {
                                 struct bpf_dtab_netdev *dev, *odev;
 
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 82eabd4e38ad..0937719b87e2 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1326,24 +1326,32 @@ static void __bpf_prog_put_rcu(struct rcu_head *rcu)
 {
         struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu);
 
+        kvfree(aux->func_info);
         free_used_maps(aux);
         bpf_prog_uncharge_memlock(aux->prog);
         security_bpf_prog_free(aux);
         bpf_prog_free(aux->prog);
 }
 
+static void __bpf_prog_put_noref(struct bpf_prog *prog, bool deferred)
+{
+        bpf_prog_kallsyms_del_all(prog);
+        btf_put(prog->aux->btf);
+        bpf_prog_free_linfo(prog);
+
+        if (deferred)
+                call_rcu(&prog->aux->rcu, __bpf_prog_put_rcu);
+        else
+                __bpf_prog_put_rcu(&prog->aux->rcu);
+}
+
 static void __bpf_prog_put(struct bpf_prog *prog, bool do_idr_lock)
 {
         if (atomic_dec_and_test(&prog->aux->refcnt)) {
                 perf_event_bpf_event(prog, PERF_BPF_EVENT_PROG_UNLOAD, 0);
                 /* bpf_prog_free_id() must be called first */
                 bpf_prog_free_id(prog, do_idr_lock);
-                bpf_prog_kallsyms_del_all(prog);
-                btf_put(prog->aux->btf);
-                kvfree(prog->aux->func_info);
-                bpf_prog_free_linfo(prog);
-
-                call_rcu(&prog->aux->rcu, __bpf_prog_put_rcu);
+                __bpf_prog_put_noref(prog, true);
         }
 }
 
@@ -1741,11 +1749,12 @@ static int bpf_prog_load(union bpf_attr *attr, union bpf_attr __user *uattr)
         return err;
 
 free_used_maps:
-        bpf_prog_free_linfo(prog);
-        kvfree(prog->aux->func_info);
-        btf_put(prog->aux->btf);
-        bpf_prog_kallsyms_del_subprogs(prog);
-        free_used_maps(prog->aux);
+        /* In case we have subprogs, we need to wait for a grace
+         * period before we can tear down JIT memory since symbols
+         * are already exposed under kallsyms.
+         */
+        __bpf_prog_put_noref(prog, prog->aux->func_cnt);
+        return err;
 free_prog:
         bpf_prog_uncharge_memlock(prog);
 free_prog_sec:
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index c52bc91f882b..c87ee6412b36 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -798,7 +798,8 @@ static int generate_sched_domains(cpumask_var_t **domains,
                     cpumask_subset(cp->cpus_allowed, top_cpuset.effective_cpus))
                         continue;
 
-                if (is_sched_load_balance(cp))
+                if (is_sched_load_balance(cp) &&
+                    !cpumask_empty(cp->effective_cpus))
                         csa[csn++] = cp;
 
                 /* skip @cp's subtree if not a partition root */
diff --git a/kernel/events/core.c b/kernel/events/core.c
index bb3748d29b04..aec8dba2bea4 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -10635,7 +10635,7 @@ static int perf_copy_attr(struct perf_event_attr __user *uattr,
 
         attr->size = size;
 
-        if (attr->__reserved_1)
+        if (attr->__reserved_1 || attr->__reserved_2)
                 return -EINVAL;
 
         if (attr->sample_type & ~(PERF_SAMPLE_MAX-1))
diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
index b5667a273bf6..49b835f1305f 100644
--- a/kernel/sched/topology.c
+++ b/kernel/sched/topology.c
@@ -1948,7 +1948,7 @@ next_level:
 static int
 build_sched_domains(const struct cpumask *cpu_map, struct sched_domain_attr *attr)
 {
-        enum s_alloc alloc_state;
+        enum s_alloc alloc_state = sa_none;
         struct sched_domain *sd;
         struct s_data d;
         struct rq *rq = NULL;
@@ -1956,6 +1956,9 @@ build_sched_domains(const struct cpumask *cpu_map, struct sched_domain_attr *att
         struct sched_domain_topology_level *tl_asym;
         bool has_asym = false;
 
+        if (WARN_ON(cpumask_empty(cpu_map)))
+                goto error;
+
         alloc_state = __visit_domain_allocation_hell(&d, cpu_map);
         if (alloc_state != sa_rootdomain)
                 goto error;
@@ -2026,7 +2029,7 @@ build_sched_domains(const struct cpumask *cpu_map, struct sched_domain_attr *att
         rcu_read_unlock();
 
         if (has_asym)
-                static_branch_enable_cpuslocked(&sched_asym_cpucapacity);
+                static_branch_inc_cpuslocked(&sched_asym_cpucapacity);
 
         if (rq && sched_debug_enabled) {
                 pr_info("root domain span: %*pbl (max cpu_capacity = %lu)\n",
@@ -2121,8 +2124,12 @@ int sched_init_domains(const struct cpumask *cpu_map)
  */
 static void detach_destroy_domains(const struct cpumask *cpu_map)
 {
+        unsigned int cpu = cpumask_any(cpu_map);
         int i;
 
+        if (rcu_access_pointer(per_cpu(sd_asym_cpucapacity, cpu)))
+                static_branch_dec_cpuslocked(&sched_asym_cpucapacity);
+
         rcu_read_lock();
         for_each_cpu(i, cpu_map)
                 cpu_attach_domain(NULL, &def_root_domain, i);
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 54728d2eda18..d4bcfd8f95bf 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -172,7 +172,6 @@ int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack)
         if (err < 0)
                 goto out_uninit_mvrp;
 
-        vlan->nest_level = dev_get_nest_level(real_dev) + 1;
         err = register_netdevice(dev);
         if (err < 0)
                 goto out_uninit_mvrp;
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 93eadf179123..e5bff5cc6f97 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -489,36 +489,6 @@ static void vlan_dev_set_rx_mode(struct net_device *vlan_dev)
         dev_uc_sync(vlan_dev_priv(vlan_dev)->real_dev, vlan_dev);
 }
 
-/*
- * vlan network devices have devices nesting below it, and are a special
- * "super class" of normal network devices; split their locks off into a
- * separate class since they always nest.
- */
-static struct lock_class_key vlan_netdev_xmit_lock_key;
-static struct lock_class_key vlan_netdev_addr_lock_key;
-
-static void vlan_dev_set_lockdep_one(struct net_device *dev,
-                                     struct netdev_queue *txq,
-                                     void *_subclass)
-{
-        lockdep_set_class_and_subclass(&txq->_xmit_lock,
-                                       &vlan_netdev_xmit_lock_key,
-                                       *(int *)_subclass);
-}
-
-static void vlan_dev_set_lockdep_class(struct net_device *dev, int subclass)
-{
-        lockdep_set_class_and_subclass(&dev->addr_list_lock,
-                                       &vlan_netdev_addr_lock_key,
-                                       subclass);
-        netdev_for_each_tx_queue(dev, vlan_dev_set_lockdep_one, &subclass);
-}
-
-static int vlan_dev_get_lock_subclass(struct net_device *dev)
-{
-        return vlan_dev_priv(dev)->nest_level;
-}
-
 static const struct header_ops vlan_header_ops = {
         .create  = vlan_dev_hard_header,
         .parse   = eth_header_parse,
@@ -609,8 +579,6 @@ static int vlan_dev_init(struct net_device *dev)
 
         SET_NETDEV_DEVTYPE(dev, &vlan_type);
 
-        vlan_dev_set_lockdep_class(dev, vlan_dev_get_lock_subclass(dev));
-
         vlan->vlan_pcpu_stats = netdev_alloc_pcpu_stats(struct vlan_pcpu_stats);
         if (!vlan->vlan_pcpu_stats)
                 return -ENOMEM;
@@ -812,7 +780,6 @@ static const struct net_device_ops vlan_netdev_ops = {
         .ndo_netpoll_cleanup    = vlan_dev_netpoll_cleanup,
 #endif
         .ndo_fix_features       = vlan_dev_fix_features,
-        .ndo_get_lock_subclass  = vlan_dev_get_lock_subclass,
         .ndo_get_iflink         = vlan_dev_get_iflink,
 };
 
diff --git a/net/atm/common.c b/net/atm/common.c
index b7528e77997c..0ce530af534d 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -668,7 +668,7 @@ __poll_t vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
                 mask |= EPOLLHUP;
 
         /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
         /* writable? */
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index d78938e3e008..5b0b20e6da95 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -22,6 +22,8 @@
 #include <linux/kernel.h>
 #include <linux/kref.h>
 #include <linux/list.h>
+#include <linux/lockdep.h>
+#include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/netlink.h>
 #include <linux/pkt_sched.h>
@@ -193,14 +195,18 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface)
         unsigned char *ogm_buff;
         u32 random_seqno;
 
+        mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+
         /* randomize initial seqno to avoid collision */
         get_random_bytes(&random_seqno, sizeof(random_seqno));
         atomic_set(&hard_iface->bat_iv.ogm_seqno, random_seqno);
 
         hard_iface->bat_iv.ogm_buff_len = BATADV_OGM_HLEN;
         ogm_buff = kmalloc(hard_iface->bat_iv.ogm_buff_len, GFP_ATOMIC);
-        if (!ogm_buff)
+        if (!ogm_buff) {
+                mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
                 return -ENOMEM;
+        }
 
         hard_iface->bat_iv.ogm_buff = ogm_buff;
 
@@ -212,35 +218,59 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface)
         batadv_ogm_packet->reserved = 0;
         batadv_ogm_packet->tq = BATADV_TQ_MAX_VALUE;
 
+        mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
+
         return 0;
 }
 
 static void batadv_iv_ogm_iface_disable(struct batadv_hard_iface *hard_iface)
 {
+        mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+
         kfree(hard_iface->bat_iv.ogm_buff);
         hard_iface->bat_iv.ogm_buff = NULL;
+
+        mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
 }
 
 static void batadv_iv_ogm_iface_update_mac(struct batadv_hard_iface *hard_iface)
 {
         struct batadv_ogm_packet *batadv_ogm_packet;
-        unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff;
+        void *ogm_buff;
 
-        batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff;
+        mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+
+        ogm_buff = hard_iface->bat_iv.ogm_buff;
+        if (!ogm_buff)
+                goto unlock;
+
+        batadv_ogm_packet = ogm_buff;
         ether_addr_copy(batadv_ogm_packet->orig,
                         hard_iface->net_dev->dev_addr);
         ether_addr_copy(batadv_ogm_packet->prev_sender,
                         hard_iface->net_dev->dev_addr);
+
+unlock:
+        mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
 }
 
 static void
 batadv_iv_ogm_primary_iface_set(struct batadv_hard_iface *hard_iface)
 {
         struct batadv_ogm_packet *batadv_ogm_packet;
-        unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff;
+        void *ogm_buff;
 
-        batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff;
+        mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+
+        ogm_buff = hard_iface->bat_iv.ogm_buff;
+        if (!ogm_buff)
+                goto unlock;
+
+        batadv_ogm_packet = ogm_buff;
         batadv_ogm_packet->ttl = BATADV_TTL;
+
+unlock:
+        mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
 }
 
 /* when do we schedule our own ogm to be sent */
@@ -742,7 +772,11 @@ batadv_iv_ogm_slide_own_bcast_window(struct batadv_hard_iface *hard_iface)
         }
 }
 
-static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
+/**
+ * batadv_iv_ogm_schedule_buff() - schedule submission of hardif ogm buffer
+ * @hard_iface: interface whose ogm buffer should be transmitted
+ */
+static void batadv_iv_ogm_schedule_buff(struct batadv_hard_iface *hard_iface)
 {
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         unsigned char **ogm_buff = &hard_iface->bat_iv.ogm_buff;
@@ -753,9 +787,7 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
         u16 tvlv_len = 0;
         unsigned long send_time;
 
-        if (hard_iface->if_status == BATADV_IF_NOT_IN_USE ||
-            hard_iface->if_status == BATADV_IF_TO_BE_REMOVED)
-                return;
+        lockdep_assert_held(&hard_iface->bat_iv.ogm_buff_mutex);
 
         /* the interface gets activated here to avoid race conditions between
          * the moment of activating the interface in
@@ -823,6 +855,17 @@ out:
                 batadv_hardif_put(primary_if);
 }
 
+static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
+{
+        if (hard_iface->if_status == BATADV_IF_NOT_IN_USE ||
+            hard_iface->if_status == BATADV_IF_TO_BE_REMOVED)
+                return;
+
+        mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+        batadv_iv_ogm_schedule_buff(hard_iface);
+        mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
+}
+
 /**
  * batadv_iv_orig_ifinfo_sum() - Get bcast_own sum for originator over iterface
  * @orig_node: originator which reproadcasted the OGMs directly
diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
index dc4f7430cb5a..8033f24f506c 100644
--- a/net/batman-adv/bat_v_ogm.c
+++ b/net/batman-adv/bat_v_ogm.c
@@ -18,6 +18,7 @@
 #include <linux/kref.h>
 #include <linux/list.h>
 #include <linux/lockdep.h>
+#include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/random.h>
 #include <linux/rculist.h>
@@ -256,14 +257,12 @@ static void batadv_v_ogm_queue_on_if(struct sk_buff *skb,
 }
 
 /**
- * batadv_v_ogm_send() - periodic worker broadcasting the own OGM
- * @work: work queue item
+ * batadv_v_ogm_send_softif() - periodic worker broadcasting the own OGM
+ * @bat_priv: the bat priv with all the soft interface information
  */
-static void batadv_v_ogm_send(struct work_struct *work)
+static void batadv_v_ogm_send_softif(struct batadv_priv *bat_priv)
 {
         struct batadv_hard_iface *hard_iface;
-        struct batadv_priv_bat_v *bat_v;
-        struct batadv_priv *bat_priv;
         struct batadv_ogm2_packet *ogm_packet;
         struct sk_buff *skb, *skb_tmp;
         unsigned char *ogm_buff;
@@ -271,8 +270,7 @@ static void batadv_v_ogm_send(struct work_struct *work)
         u16 tvlv_len = 0;
         int ret;
 
-        bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work);
-        bat_priv = container_of(bat_v, struct batadv_priv, bat_v);
+        lockdep_assert_held(&bat_priv->bat_v.ogm_buff_mutex);
 
         if (atomic_read(&bat_priv->mesh_state) == BATADV_MESH_DEACTIVATING)
                 goto out;
@@ -364,6 +362,23 @@ out:
 }
 
 /**
+ * batadv_v_ogm_send() - periodic worker broadcasting the own OGM
+ * @work: work queue item
+ */
+static void batadv_v_ogm_send(struct work_struct *work)
+{
+        struct batadv_priv_bat_v *bat_v;
+        struct batadv_priv *bat_priv;
+
+        bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work);
+        bat_priv = container_of(bat_v, struct batadv_priv, bat_v);
+
+        mutex_lock(&bat_priv->bat_v.ogm_buff_mutex);
+        batadv_v_ogm_send_softif(bat_priv);
+        mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex);
+}
+
+/**
  * batadv_v_ogm_aggr_work() - OGM queue periodic task per interface
  * @work: work queue item
  *
@@ -424,11 +439,15 @@ void batadv_v_ogm_primary_iface_set(struct batadv_hard_iface *primary_iface)
         struct batadv_priv *bat_priv = netdev_priv(primary_iface->soft_iface);
         struct batadv_ogm2_packet *ogm_packet;
 
+        mutex_lock(&bat_priv->bat_v.ogm_buff_mutex);
         if (!bat_priv->bat_v.ogm_buff)
-                return;
+                goto unlock;
 
         ogm_packet = (struct batadv_ogm2_packet *)bat_priv->bat_v.ogm_buff;
         ether_addr_copy(ogm_packet->orig, primary_iface->net_dev->dev_addr);
+
+unlock:
+        mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex);
 }
 
 /**
@@ -1050,6 +1069,8 @@ int batadv_v_ogm_init(struct batadv_priv *bat_priv)
         atomic_set(&bat_priv->bat_v.ogm_seqno, random_seqno);
         INIT_DELAYED_WORK(&bat_priv->bat_v.ogm_wq, batadv_v_ogm_send);
 
+        mutex_init(&bat_priv->bat_v.ogm_buff_mutex);
+
         return 0;
 }
 
@@ -1061,7 +1082,11 @@ void batadv_v_ogm_free(struct batadv_priv *bat_priv)
 {
         cancel_delayed_work_sync(&bat_priv->bat_v.ogm_wq);
 
+        mutex_lock(&bat_priv->bat_v.ogm_buff_mutex);
+
         kfree(bat_priv->bat_v.ogm_buff);
         bat_priv->bat_v.ogm_buff = NULL;
         bat_priv->bat_v.ogm_buff_len = 0;
+
+        mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex);
 }
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index c90e47342bb0..afb52282d5bd 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -18,6 +18,7 @@
 #include <linux/kref.h>
 #include <linux/limits.h>
 #include <linux/list.h>
+#include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/printk.h>
 #include <linux/rculist.h>
@@ -929,6 +930,7 @@ batadv_hardif_add_interface(struct net_device *net_dev)
         INIT_LIST_HEAD(&hard_iface->list);
         INIT_HLIST_HEAD(&hard_iface->neigh_list);
 
+        mutex_init(&hard_iface->bat_iv.ogm_buff_mutex);
         spin_lock_init(&hard_iface->neigh_list_lock);
         kref_init(&hard_iface->refcount);
 
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 9cbed6f5a85a..5ee8e9a100f9 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -740,36 +740,6 @@ static int batadv_interface_kill_vid(struct net_device *dev, __be16 proto,
         return 0;
 }
 
-/* batman-adv network devices have devices nesting below it and are a special
- * "super class" of normal network devices; split their locks off into a
- * separate class since they always nest.
- */
-static struct lock_class_key batadv_netdev_xmit_lock_key;
-static struct lock_class_key batadv_netdev_addr_lock_key;
-
-/**
- * batadv_set_lockdep_class_one() - Set lockdep class for a single tx queue
- * @dev: device which owns the tx queue
- * @txq: tx queue to modify
- * @_unused: always NULL
- */
-static void batadv_set_lockdep_class_one(struct net_device *dev,
-                                         struct netdev_queue *txq,
-                                         void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock, &batadv_netdev_xmit_lock_key);
-}
-
-/**
- * batadv_set_lockdep_class() - Set txq and addr_list lockdep class
- * @dev: network device to modify
- */
-static void batadv_set_lockdep_class(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock, &batadv_netdev_addr_lock_key);
-        netdev_for_each_tx_queue(dev, batadv_set_lockdep_class_one, NULL);
-}
-
 /**
  * batadv_softif_init_late() - late stage initialization of soft interface
  * @dev: registered network device to modify
@@ -783,8 +753,6 @@ static int batadv_softif_init_late(struct net_device *dev)
         int ret;
         size_t cnt_len = sizeof(u64) * BATADV_CNT_NUM;
 
-        batadv_set_lockdep_class(dev);
-
         bat_priv = netdev_priv(dev);
         bat_priv->soft_iface = dev;
 
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index be7c02aa91e2..4d7f1baee7b7 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -17,6 +17,7 @@
 #include <linux/if.h>
 #include <linux/if_ether.h>
 #include <linux/kref.h>
+#include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/netlink.h>
 #include <linux/sched.h> /* for linux/wait.h */
@@ -81,6 +82,9 @@ struct batadv_hard_iface_bat_iv {
 
         /** @ogm_seqno: OGM sequence number - used to identify each OGM */
         atomic_t ogm_seqno;
+
+        /** @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len */
+        struct mutex ogm_buff_mutex;
 };
 
 /**
@@ -1539,6 +1543,9 @@ struct batadv_priv_bat_v {
         /** @ogm_seqno: OGM sequence number - used to identify each OGM */
         atomic_t ogm_seqno;
 
+        /** @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len */
+        struct mutex ogm_buff_mutex;
+
         /** @ogm_wq: workqueue used to schedule OGM transmissions */
         struct delayed_work ogm_wq;
 };
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index bb55d92691b0..4febc82a7c76 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -571,15 +571,7 @@ static netdev_tx_t bt_xmit(struct sk_buff *skb, struct net_device *netdev)
         return err < 0 ? NET_XMIT_DROP : err;
 }
 
-static int bt_dev_init(struct net_device *dev)
-{
-        netdev_lockdep_set_classes(dev);
-
-        return 0;
-}
-
 static const struct net_device_ops netdev_ops = {
-        .ndo_init               = bt_dev_init,
         .ndo_start_xmit         = bt_xmit,
 };
 
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 94ddf19998c7..5f508c50649d 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -460,7 +460,7 @@ __poll_t bt_sock_poll(struct file *file, struct socket *sock,
         if (sk->sk_state == BT_LISTEN)
                 return bt_accept_poll(sk);
 
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                 mask |= EPOLLERR |
                         (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
 
@@ -470,7 +470,7 @@ __poll_t bt_sock_poll(struct file *file, struct socket *sock,
         if (sk->sk_shutdown == SHUTDOWN_MASK)
                 mask |= EPOLLHUP;
 
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
         if (sk->sk_state == BT_CLOSED)
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 681b72862c16..e804a3016902 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -24,8 +24,6 @@
 const struct nf_br_ops __rcu *nf_br_ops __read_mostly;
 EXPORT_SYMBOL_GPL(nf_br_ops);
 
-static struct lock_class_key bridge_netdev_addr_lock_key;
-
 /* net device transmit always called with BH disabled */
 netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 {
@@ -108,11 +106,6 @@ out:
         return NETDEV_TX_OK;
 }
 
-static void br_set_lockdep_class(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock, &bridge_netdev_addr_lock_key);
-}
-
 static int br_dev_init(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
@@ -150,7 +143,6 @@ static int br_dev_init(struct net_device *dev)
                 br_mdb_hash_fini(br);
                 br_fdb_hash_fini(br);
         }
-        br_set_lockdep_class(dev);
 
         return err;
 }
diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c
index 506d6141e44e..809673222382 100644
--- a/net/bridge/netfilter/nf_conntrack_bridge.c
+++ b/net/bridge/netfilter/nf_conntrack_bridge.c
@@ -95,7 +95,7 @@ slow_path:
          * This may also be a clone skbuff, we could preserve the geometry for
          * the copies but probably not worth the effort.
          */
-        ip_frag_init(skb, hlen, ll_rs, frag_max_size, &state);
+        ip_frag_init(skb, hlen, ll_rs, frag_max_size, false, &state);
 
         while (state.left > 0) {
                 struct sk_buff *skb2;
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 13ea920600ae..ef14da50a981 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -953,7 +953,7 @@ static __poll_t caif_poll(struct file *file,
                 mask |= EPOLLRDHUP;
 
         /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue) ||
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue) ||
                 (sk->sk_shutdown & RCV_SHUTDOWN))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
diff --git a/net/core/datagram.c b/net/core/datagram.c
index c210fc116103..da3c24ed129c 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -97,7 +97,7 @@ int __skb_wait_for_more_packets(struct sock *sk, int *err, long *timeo_p,
         if (error)
                 goto out_err;
 
-        if (sk->sk_receive_queue.prev != skb)
+        if (READ_ONCE(sk->sk_receive_queue.prev) != skb)
                 goto out;
 
         /* Socket shut down? */
@@ -278,7 +278,7 @@ struct sk_buff *__skb_try_recv_datagram(struct sock *sk, unsigned int flags,
                         break;
 
                 sk_busy_loop(sk, flags & MSG_DONTWAIT);
-        } while (sk->sk_receive_queue.prev != *last);
+        } while (READ_ONCE(sk->sk_receive_queue.prev) != *last);
 
         error = -EAGAIN;
 
@@ -767,7 +767,7 @@ __poll_t datagram_poll(struct file *file, struct socket *sock,
         mask = 0;
 
         /* exceptional events? */
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                 mask |= EPOLLERR |
                         (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
 
@@ -777,7 +777,7 @@ __poll_t datagram_poll(struct file *file, struct socket *sock,
                 mask |= EPOLLHUP;
 
         /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
         /* Connection-based need to check for termination and startup */
diff --git a/net/core/dev.c b/net/core/dev.c
index bf3ed413abaf..99ac84ff398f 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -146,6 +146,7 @@
 #include "net-sysfs.h"
 
 #define MAX_GRO_SKBS 8
+#define MAX_NEST_DEV 8
 
 /* This should be increased if a protocol with a bigger head is added. */
 #define GRO_MAX_HEAD (MAX_HEADER + 128)
@@ -276,88 +277,6 @@ static RAW_NOTIFIER_HEAD(netdev_chain);
 DEFINE_PER_CPU_ALIGNED(struct softnet_data, softnet_data);
 EXPORT_PER_CPU_SYMBOL(softnet_data);
 
-#ifdef CONFIG_LOCKDEP
-/*
- * register_netdevice() inits txq->_xmit_lock and sets lockdep class
- * according to dev->type
- */
-static const unsigned short netdev_lock_type[] = {
-         ARPHRD_NETROM, ARPHRD_ETHER, ARPHRD_EETHER, ARPHRD_AX25,
-         ARPHRD_PRONET, ARPHRD_CHAOS, ARPHRD_IEEE802, ARPHRD_ARCNET,
-         ARPHRD_APPLETLK, ARPHRD_DLCI, ARPHRD_ATM, ARPHRD_METRICOM,
-         ARPHRD_IEEE1394, ARPHRD_EUI64, ARPHRD_INFINIBAND, ARPHRD_SLIP,
-         ARPHRD_CSLIP, ARPHRD_SLIP6, ARPHRD_CSLIP6, ARPHRD_RSRVD,
-         ARPHRD_ADAPT, ARPHRD_ROSE, ARPHRD_X25, ARPHRD_HWX25,
-         ARPHRD_PPP, ARPHRD_CISCO, ARPHRD_LAPB, ARPHRD_DDCMP,
-         ARPHRD_RAWHDLC, ARPHRD_TUNNEL, ARPHRD_TUNNEL6, ARPHRD_FRAD,
-         ARPHRD_SKIP, ARPHRD_LOOPBACK, ARPHRD_LOCALTLK, ARPHRD_FDDI,
-         ARPHRD_BIF, ARPHRD_SIT, ARPHRD_IPDDP, ARPHRD_IPGRE,
-         ARPHRD_PIMREG, ARPHRD_HIPPI, ARPHRD_ASH, ARPHRD_ECONET,
-         ARPHRD_IRDA, ARPHRD_FCPP, ARPHRD_FCAL, ARPHRD_FCPL,
-         ARPHRD_FCFABRIC, ARPHRD_IEEE80211, ARPHRD_IEEE80211_PRISM,
-         ARPHRD_IEEE80211_RADIOTAP, ARPHRD_PHONET, ARPHRD_PHONET_PIPE,
-         ARPHRD_IEEE802154, ARPHRD_VOID, ARPHRD_NONE};
-
-static const char *const netdev_lock_name[] = {
-        "_xmit_NETROM", "_xmit_ETHER", "_xmit_EETHER", "_xmit_AX25",
-        "_xmit_PRONET", "_xmit_CHAOS", "_xmit_IEEE802", "_xmit_ARCNET",
-        "_xmit_APPLETLK", "_xmit_DLCI", "_xmit_ATM", "_xmit_METRICOM",
-        "_xmit_IEEE1394", "_xmit_EUI64", "_xmit_INFINIBAND", "_xmit_SLIP",
-        "_xmit_CSLIP", "_xmit_SLIP6", "_xmit_CSLIP6", "_xmit_RSRVD",
-        "_xmit_ADAPT", "_xmit_ROSE", "_xmit_X25", "_xmit_HWX25",
-        "_xmit_PPP", "_xmit_CISCO", "_xmit_LAPB", "_xmit_DDCMP",
-        "_xmit_RAWHDLC", "_xmit_TUNNEL", "_xmit_TUNNEL6", "_xmit_FRAD",
-        "_xmit_SKIP", "_xmit_LOOPBACK", "_xmit_LOCALTLK", "_xmit_FDDI",
-        "_xmit_BIF", "_xmit_SIT", "_xmit_IPDDP", "_xmit_IPGRE",
-        "_xmit_PIMREG", "_xmit_HIPPI", "_xmit_ASH", "_xmit_ECONET",
-        "_xmit_IRDA", "_xmit_FCPP", "_xmit_FCAL", "_xmit_FCPL",
-        "_xmit_FCFABRIC", "_xmit_IEEE80211", "_xmit_IEEE80211_PRISM",
-        "_xmit_IEEE80211_RADIOTAP", "_xmit_PHONET", "_xmit_PHONET_PIPE",
-        "_xmit_IEEE802154", "_xmit_VOID", "_xmit_NONE"};
-
-static struct lock_class_key netdev_xmit_lock_key[ARRAY_SIZE(netdev_lock_type)];
-static struct lock_class_key netdev_addr_lock_key[ARRAY_SIZE(netdev_lock_type)];
-
-static inline unsigned short netdev_lock_pos(unsigned short dev_type)
-{
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(netdev_lock_type); i++)
-                if (netdev_lock_type[i] == dev_type)
-                        return i;
-        /* the last key is used by default */
-        return ARRAY_SIZE(netdev_lock_type) - 1;
-}
-
-static inline void netdev_set_xmit_lockdep_class(spinlock_t *lock,
-                                                 unsigned short dev_type)
-{
-        int i;
-
-        i = netdev_lock_pos(dev_type);
-        lockdep_set_class_and_name(lock, &netdev_xmit_lock_key[i],
-                                   netdev_lock_name[i]);
-}
-
-static inline void netdev_set_addr_lockdep_class(struct net_device *dev)
-{
-        int i;
-
-        i = netdev_lock_pos(dev->type);
-        lockdep_set_class_and_name(&dev->addr_list_lock,
-                                   &netdev_addr_lock_key[i],
-                                   netdev_lock_name[i]);
-}
-#else
-static inline void netdev_set_xmit_lockdep_class(spinlock_t *lock,
-                                                 unsigned short dev_type)
-{
-}
-static inline void netdev_set_addr_lockdep_class(struct net_device *dev)
-{
-}
-#endif
-
 /*******************************************************************************
  *
  *              Protocol management and registration routines
@@ -6489,6 +6408,9 @@ struct netdev_adjacent {
         /* upper master flag, there can only be one master device per list */
         bool master;
 
+        /* lookup ignore flag */
+        bool ignore;
+
         /* counter for the number of times this device was added to us */
         u16 ref_nr;
 
@@ -6511,7 +6433,7 @@ static struct netdev_adjacent *__netdev_find_adj(struct net_device *adj_dev,
         return NULL;
 }
 
-static int __netdev_has_upper_dev(struct net_device *upper_dev, void *data)
+static int ____netdev_has_upper_dev(struct net_device *upper_dev, void *data)
 {
         struct net_device *dev = data;
 
@@ -6532,7 +6454,7 @@ bool netdev_has_upper_dev(struct net_device *dev,
 {
         ASSERT_RTNL();
 
-        return netdev_walk_all_upper_dev_rcu(dev, __netdev_has_upper_dev,
+        return netdev_walk_all_upper_dev_rcu(dev, ____netdev_has_upper_dev,
                                              upper_dev);
 }
 EXPORT_SYMBOL(netdev_has_upper_dev);
@@ -6550,7 +6472,7 @@ EXPORT_SYMBOL(netdev_has_upper_dev);
 bool netdev_has_upper_dev_all_rcu(struct net_device *dev,
                                   struct net_device *upper_dev)
 {
-        return !!netdev_walk_all_upper_dev_rcu(dev, __netdev_has_upper_dev,
+        return !!netdev_walk_all_upper_dev_rcu(dev, ____netdev_has_upper_dev,
                                                upper_dev);
 }
 EXPORT_SYMBOL(netdev_has_upper_dev_all_rcu);
@@ -6594,6 +6516,22 @@ struct net_device *netdev_master_upper_dev_get(struct net_device *dev)
 }
 EXPORT_SYMBOL(netdev_master_upper_dev_get);
 
+static struct net_device *__netdev_master_upper_dev_get(struct net_device *dev)
+{
+        struct netdev_adjacent *upper;
+
+        ASSERT_RTNL();
+
+        if (list_empty(&dev->adj_list.upper))
+                return NULL;
+
+        upper = list_first_entry(&dev->adj_list.upper,
+                                 struct netdev_adjacent, list);
+        if (likely(upper->master) && !upper->ignore)
+                return upper->dev;
+        return NULL;
+}
+
 /**
  * netdev_has_any_lower_dev - Check if device is linked to some device
  * @dev: device
@@ -6644,6 +6582,23 @@ struct net_device *netdev_upper_get_next_dev_rcu(struct net_device *dev,
 }
 EXPORT_SYMBOL(netdev_upper_get_next_dev_rcu);
 
+static struct net_device *__netdev_next_upper_dev(struct net_device *dev,
+                                                  struct list_head **iter,
+                                                  bool *ignore)
+{
+        struct netdev_adjacent *upper;
+
+        upper = list_entry((*iter)->next, struct netdev_adjacent, list);
+
+        if (&upper->list == &dev->adj_list.upper)
+                return NULL;
+
+        *iter = &upper->list;
+        *ignore = upper->ignore;
+
+        return upper->dev;
+}
+
 static struct net_device *netdev_next_upper_dev_rcu(struct net_device *dev,
                                                     struct list_head **iter)
 {
@@ -6661,34 +6616,111 @@ static struct net_device *netdev_next_upper_dev_rcu(struct net_device *dev,
         return upper->dev;
 }
 
+static int __netdev_walk_all_upper_dev(struct net_device *dev,
+                                       int (*fn)(struct net_device *dev,
+                                                 void *data),
+                                       void *data)
+{
+        struct net_device *udev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
+        struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
+        int ret, cur = 0;
+        bool ignore;
+
+        now = dev;
+        iter = &dev->adj_list.upper;
+
+        while (1) {
+                if (now != dev) {
+                        ret = fn(now, data);
+                        if (ret)
+                                return ret;
+                }
+
+                next = NULL;
+                while (1) {
+                        udev = __netdev_next_upper_dev(now, &iter, &ignore);
+                        if (!udev)
+                                break;
+                        if (ignore)
+                                continue;
+
+                        next = udev;
+                        niter = &udev->adj_list.upper;
+                        dev_stack[cur] = now;
+                        iter_stack[cur++] = iter;
+                        break;
+                }
+
+                if (!next) {
+                        if (!cur)
+                                return 0;
+                        next = dev_stack[--cur];
+                        niter = iter_stack[cur];
+                }
+
+                now = next;
+                iter = niter;
+        }
+
+        return 0;
+}
+
 int netdev_walk_all_upper_dev_rcu(struct net_device *dev,
                                   int (*fn)(struct net_device *dev,
                                             void *data),
                                   void *data)
 {
-        struct net_device *udev;
-        struct list_head *iter;
-        int ret;
+        struct net_device *udev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
+        struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
+        int ret, cur = 0;
 
-        for (iter = &dev->adj_list.upper,
-             udev = netdev_next_upper_dev_rcu(dev, &iter);
-             udev;
-             udev = netdev_next_upper_dev_rcu(dev, &iter)) {
-                /* first is the upper device itself */
-                ret = fn(udev, data);
-                if (ret)
-                        return ret;
+        now = dev;
+        iter = &dev->adj_list.upper;
 
-                /* then look at all of its upper devices */
-                ret = netdev_walk_all_upper_dev_rcu(udev, fn, data);
-                if (ret)
-                        return ret;
+        while (1) {
+                if (now != dev) {
+                        ret = fn(now, data);
+                        if (ret)
+                                return ret;
+                }
+
+                next = NULL;
+                while (1) {
+                        udev = netdev_next_upper_dev_rcu(now, &iter);
+                        if (!udev)
+                                break;
+
+                        next = udev;
+                        niter = &udev->adj_list.upper;
+                        dev_stack[cur] = now;
+                        iter_stack[cur++] = iter;
+                        break;
+                }
+
+                if (!next) {
+                        if (!cur)
+                                return 0;
+                        next = dev_stack[--cur];
+                        niter = iter_stack[cur];
+                }
+
+                now = next;
+                iter = niter;
         }
 
         return 0;
 }
 EXPORT_SYMBOL_GPL(netdev_walk_all_upper_dev_rcu);
 
+static bool __netdev_has_upper_dev(struct net_device *dev,
+                                   struct net_device *upper_dev)
+{
+        ASSERT_RTNL();
+
+        return __netdev_walk_all_upper_dev(dev, ____netdev_has_upper_dev,
+                                           upper_dev);
+}
+
 /**
  * netdev_lower_get_next_private - Get the next ->private from the
  *                                 lower neighbour list
@@ -6785,34 +6817,119 @@ static struct net_device *netdev_next_lower_dev(struct net_device *dev,
         return lower->dev;
 }
 
+static struct net_device *__netdev_next_lower_dev(struct net_device *dev,
+                                                  struct list_head **iter,
+                                                  bool *ignore)
+{
+        struct netdev_adjacent *lower;
+
+        lower = list_entry((*iter)->next, struct netdev_adjacent, list);
+
+        if (&lower->list == &dev->adj_list.lower)
+                return NULL;
+
+        *iter = &lower->list;
+        *ignore = lower->ignore;
+
+        return lower->dev;
+}
+
 int netdev_walk_all_lower_dev(struct net_device *dev,
                               int (*fn)(struct net_device *dev,
                                         void *data),
                               void *data)
 {
-        struct net_device *ldev;
-        struct list_head *iter;
-        int ret;
+        struct net_device *ldev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
+        struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
+        int ret, cur = 0;
 
-        for (iter = &dev->adj_list.lower,
-             ldev = netdev_next_lower_dev(dev, &iter);
-             ldev;
-             ldev = netdev_next_lower_dev(dev, &iter)) {
-                /* first is the lower device itself */
-                ret = fn(ldev, data);
-                if (ret)
-                        return ret;
+        now = dev;
+        iter = &dev->adj_list.lower;
 
-                /* then look at all of its lower devices */
-                ret = netdev_walk_all_lower_dev(ldev, fn, data);
-                if (ret)
-                        return ret;
+        while (1) {
+                if (now != dev) {
+                        ret = fn(now, data);
+                        if (ret)
+                                return ret;
+                }
+
+                next = NULL;
+                while (1) {
+                        ldev = netdev_next_lower_dev(now, &iter);
+                        if (!ldev)
+                                break;
+
+                        next = ldev;
+                        niter = &ldev->adj_list.lower;
+                        dev_stack[cur] = now;
+                        iter_stack[cur++] = iter;
+                        break;
+                }
+
+                if (!next) {
+                        if (!cur)
+                                return 0;
+                        next = dev_stack[--cur];
+                        niter = iter_stack[cur];
+                }
+
+                now = next;
+                iter = niter;
         }
 
         return 0;
 }
 EXPORT_SYMBOL_GPL(netdev_walk_all_lower_dev);
 
+static int __netdev_walk_all_lower_dev(struct net_device *dev,
+                                       int (*fn)(struct net_device *dev,
+                                                 void *data),
+                                       void *data)
+{
+        struct net_device *ldev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
+        struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
+        int ret, cur = 0;
+        bool ignore;
+
+        now = dev;
+        iter = &dev->adj_list.lower;
+
+        while (1) {
+                if (now != dev) {
+                        ret = fn(now, data);
+                        if (ret)
+                                return ret;
+                }
+
+                next = NULL;
+                while (1) {
+                        ldev = __netdev_next_lower_dev(now, &iter, &ignore);
+                        if (!ldev)
+                                break;
+                        if (ignore)
+                                continue;
+
+                        next = ldev;
+                        niter = &ldev->adj_list.lower;
+                        dev_stack[cur] = now;
+                        iter_stack[cur++] = iter;
+                        break;
+                }
+
+                if (!next) {
+                        if (!cur)
+                                return 0;
+                        next = dev_stack[--cur];
+                        niter = iter_stack[cur];
+                }
+
+                now = next;
+                iter = niter;
+        }
+
+        return 0;
+}
+
 static struct net_device *netdev_next_lower_dev_rcu(struct net_device *dev,
                                                     struct list_head **iter)
 {
@@ -6827,28 +6944,99 @@ static struct net_device *netdev_next_lower_dev_rcu(struct net_device *dev,
         return lower->dev;
 }
 
-int netdev_walk_all_lower_dev_rcu(struct net_device *dev,
-                                  int (*fn)(struct net_device *dev,
-                                            void *data),
-                                  void *data)
+static u8 __netdev_upper_depth(struct net_device *dev)
+{
+        struct net_device *udev;
+        struct list_head *iter;
+        u8 max_depth = 0;
+        bool ignore;
+
+        for (iter = &dev->adj_list.upper,
+             udev = __netdev_next_upper_dev(dev, &iter, &ignore);
+             udev;
+             udev = __netdev_next_upper_dev(dev, &iter, &ignore)) {
+                if (ignore)
+                        continue;
+                if (max_depth < udev->upper_level)
+                        max_depth = udev->upper_level;
+        }
+
+        return max_depth;
+}
+
+static u8 __netdev_lower_depth(struct net_device *dev)
 {
         struct net_device *ldev;
         struct list_head *iter;
-        int ret;
+        u8 max_depth = 0;
+        bool ignore;
 
         for (iter = &dev->adj_list.lower,
-             ldev = netdev_next_lower_dev_rcu(dev, &iter);
+             ldev = __netdev_next_lower_dev(dev, &iter, &ignore);
              ldev;
-             ldev = netdev_next_lower_dev_rcu(dev, &iter)) {
-                /* first is the lower device itself */
-                ret = fn(ldev, data);
-                if (ret)
-                        return ret;
+             ldev = __netdev_next_lower_dev(dev, &iter, &ignore)) {
+                if (ignore)
+                        continue;
+                if (max_depth < ldev->lower_level)
+                        max_depth = ldev->lower_level;
+        }
 
-                /* then look at all of its lower devices */
-                ret = netdev_walk_all_lower_dev_rcu(ldev, fn, data);
-                if (ret)
-                        return ret;
+        return max_depth;
+}
+
+static int __netdev_update_upper_level(struct net_device *dev, void *data)
+{
+        dev->upper_level = __netdev_upper_depth(dev) + 1;
+        return 0;
+}
+
+static int __netdev_update_lower_level(struct net_device *dev, void *data)
+{
+        dev->lower_level = __netdev_lower_depth(dev) + 1;
+        return 0;
+}
+
+int netdev_walk_all_lower_dev_rcu(struct net_device *dev,
+                                  int (*fn)(struct net_device *dev,
+                                            void *data),
+                                  void *data)
+{
+        struct net_device *ldev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
+        struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
+        int ret, cur = 0;
+
+        now = dev;
+        iter = &dev->adj_list.lower;
+
+        while (1) {
+                if (now != dev) {
+                        ret = fn(now, data);
+                        if (ret)
+                                return ret;
+                }
+
+                next = NULL;
+                while (1) {
+                        ldev = netdev_next_lower_dev_rcu(now, &iter);
+                        if (!ldev)
+                                break;
+
+                        next = ldev;
+                        niter = &ldev->adj_list.lower;
+                        dev_stack[cur] = now;
+                        iter_stack[cur++] = iter;
+                        break;
+                }
+
+                if (!next) {
+                        if (!cur)
+                                return 0;
+                        next = dev_stack[--cur];
+                        niter = iter_stack[cur];
+                }
+
+                now = next;
+                iter = niter;
         }
 
         return 0;
@@ -6952,6 +7140,7 @@ static int __netdev_adjacent_dev_insert(struct net_device *dev,
         adj->master = master;
         adj->ref_nr = 1;
         adj->private = private;
+        adj->ignore = false;
         dev_hold(adj_dev);
 
         pr_debug("Insert adjacency: dev %s adj_dev %s adj->ref_nr %d; dev_hold on %s\n",
@@ -7102,14 +7291,17 @@ static int __netdev_upper_dev_link(struct net_device *dev,
                 return -EBUSY;
 
         /* To prevent loops, check if dev is not upper device to upper_dev. */
-        if (netdev_has_upper_dev(upper_dev, dev))
+        if (__netdev_has_upper_dev(upper_dev, dev))
                 return -EBUSY;
 
+        if ((dev->lower_level + upper_dev->upper_level) > MAX_NEST_DEV)
+                return -EMLINK;
+
         if (!master) {
-                if (netdev_has_upper_dev(dev, upper_dev))
+                if (__netdev_has_upper_dev(dev, upper_dev))
                         return -EEXIST;
         } else {
-                master_dev = netdev_master_upper_dev_get(dev);
+                master_dev = __netdev_master_upper_dev_get(dev);
                 if (master_dev)
                         return master_dev == upper_dev ? -EEXIST : -EBUSY;
         }
@@ -7131,6 +7323,13 @@ static int __netdev_upper_dev_link(struct net_device *dev,
         if (ret)
                 goto rollback;
 
+        __netdev_update_upper_level(dev, NULL);
+        __netdev_walk_all_lower_dev(dev, __netdev_update_upper_level, NULL);
+
+        __netdev_update_lower_level(upper_dev, NULL);
+        __netdev_walk_all_upper_dev(upper_dev, __netdev_update_lower_level,
+                                    NULL);
+
         return 0;
 
 rollback:
@@ -7213,9 +7412,96 @@ void netdev_upper_dev_unlink(struct net_device *dev,
 
         call_netdevice_notifiers_info(NETDEV_CHANGEUPPER,
                                       &changeupper_info.info);
+
+        __netdev_update_upper_level(dev, NULL);
+        __netdev_walk_all_lower_dev(dev, __netdev_update_upper_level, NULL);
+
+        __netdev_update_lower_level(upper_dev, NULL);
+        __netdev_walk_all_upper_dev(upper_dev, __netdev_update_lower_level,
+                                    NULL);
 }
 EXPORT_SYMBOL(netdev_upper_dev_unlink);
 
+static void __netdev_adjacent_dev_set(struct net_device *upper_dev,
+                                      struct net_device *lower_dev,
+                                      bool val)
+{
+        struct netdev_adjacent *adj;
+
+        adj = __netdev_find_adj(lower_dev, &upper_dev->adj_list.lower);
+        if (adj)
+                adj->ignore = val;
+
+        adj = __netdev_find_adj(upper_dev, &lower_dev->adj_list.upper);
+        if (adj)
+                adj->ignore = val;
+}
+
+static void netdev_adjacent_dev_disable(struct net_device *upper_dev,
+                                        struct net_device *lower_dev)
+{
+        __netdev_adjacent_dev_set(upper_dev, lower_dev, true);
+}
+
+static void netdev_adjacent_dev_enable(struct net_device *upper_dev,
+                                       struct net_device *lower_dev)
+{
+        __netdev_adjacent_dev_set(upper_dev, lower_dev, false);
+}
+
+int netdev_adjacent_change_prepare(struct net_device *old_dev,
+                                   struct net_device *new_dev,
+                                   struct net_device *dev,
+                                   struct netlink_ext_ack *extack)
+{
+        int err;
+
+        if (!new_dev)
+                return 0;
+
+        if (old_dev && new_dev != old_dev)
+                netdev_adjacent_dev_disable(dev, old_dev);
+
+        err = netdev_upper_dev_link(new_dev, dev, extack);
+        if (err) {
+                if (old_dev && new_dev != old_dev)
+                        netdev_adjacent_dev_enable(dev, old_dev);
+                return err;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(netdev_adjacent_change_prepare);
+
+void netdev_adjacent_change_commit(struct net_device *old_dev,
+                                   struct net_device *new_dev,
+                                   struct net_device *dev)
+{
+        if (!new_dev || !old_dev)
+                return;
+
+        if (new_dev == old_dev)
+                return;
+
+        netdev_adjacent_dev_enable(dev, old_dev);
+        netdev_upper_dev_unlink(old_dev, dev);
+}
+EXPORT_SYMBOL(netdev_adjacent_change_commit);
+
+void netdev_adjacent_change_abort(struct net_device *old_dev,
+                                  struct net_device *new_dev,
+                                  struct net_device *dev)
+{
+        if (!new_dev)
+                return;
+
+        if (old_dev && new_dev != old_dev)
+                netdev_adjacent_dev_enable(dev, old_dev);
+
+        netdev_upper_dev_unlink(new_dev, dev);
+}
+EXPORT_SYMBOL(netdev_adjacent_change_abort);
+
 /**
  * netdev_bonding_info_change - Dispatch event about slave change
  * @dev: device
@@ -7329,25 +7615,6 @@ void *netdev_lower_dev_get_private(struct net_device *dev,
 EXPORT_SYMBOL(netdev_lower_dev_get_private);
 
 
-int dev_get_nest_level(struct net_device *dev)
-{
-        struct net_device *lower = NULL;
-        struct list_head *iter;
-        int max_nest = -1;
-        int nest;
-
-        ASSERT_RTNL();
-
-        netdev_for_each_lower_dev(dev, lower, iter) {
-                nest = dev_get_nest_level(lower);
-                if (max_nest < nest)
-                        max_nest = nest;
-        }
-
-        return max_nest + 1;
-}
-EXPORT_SYMBOL(dev_get_nest_level);
-
 /**
  * netdev_lower_change - Dispatch event about lower device state change
  * @lower_dev: device
@@ -8154,7 +8421,8 @@ int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
                         return -EINVAL;
                 }
 
-                if (prog->aux->id == prog_id) {
+                /* prog->aux->id may be 0 for orphaned device-bound progs */
+                if (prog->aux->id && prog->aux->id == prog_id) {
                         bpf_prog_put(prog);
                         return 0;
                 }
@@ -8619,7 +8887,7 @@ static void netdev_init_one_queue(struct net_device *dev,
 {
         /* Initialize queue lock */
         spin_lock_init(&queue->_xmit_lock);
-        netdev_set_xmit_lockdep_class(&queue->_xmit_lock, dev->type);
+        lockdep_set_class(&queue->_xmit_lock, &dev->qdisc_xmit_lock_key);
         queue->xmit_lock_owner = -1;
         netdev_queue_numa_node_write(queue, NUMA_NO_NODE);
         queue->dev = dev;
@@ -8666,6 +8934,43 @@ void netif_tx_stop_all_queues(struct net_device *dev)
 }
 EXPORT_SYMBOL(netif_tx_stop_all_queues);
 
+static void netdev_register_lockdep_key(struct net_device *dev)
+{
+        lockdep_register_key(&dev->qdisc_tx_busylock_key);
+        lockdep_register_key(&dev->qdisc_running_key);
+        lockdep_register_key(&dev->qdisc_xmit_lock_key);
+        lockdep_register_key(&dev->addr_list_lock_key);
+}
+
+static void netdev_unregister_lockdep_key(struct net_device *dev)
+{
+        lockdep_unregister_key(&dev->qdisc_tx_busylock_key);
+        lockdep_unregister_key(&dev->qdisc_running_key);
+        lockdep_unregister_key(&dev->qdisc_xmit_lock_key);
+        lockdep_unregister_key(&dev->addr_list_lock_key);
+}
+
+void netdev_update_lockdep_key(struct net_device *dev)
+{
+        struct netdev_queue *queue;
+        int i;
+
+        lockdep_unregister_key(&dev->qdisc_xmit_lock_key);
+        lockdep_unregister_key(&dev->addr_list_lock_key);
+
+        lockdep_register_key(&dev->qdisc_xmit_lock_key);
+        lockdep_register_key(&dev->addr_list_lock_key);
+
+        lockdep_set_class(&dev->addr_list_lock, &dev->addr_list_lock_key);
+        for (i = 0; i < dev->num_tx_queues; i++) {
+                queue = netdev_get_tx_queue(dev, i);
+
+                lockdep_set_class(&queue->_xmit_lock,
+                                  &dev->qdisc_xmit_lock_key);
+        }
+}
+EXPORT_SYMBOL(netdev_update_lockdep_key);
+
 /**
  *      register_netdevice      - register a network device
  *      @dev: device to register
@@ -8700,7 +9005,7 @@ int register_netdevice(struct net_device *dev)
         BUG_ON(!net);
 
         spin_lock_init(&dev->addr_list_lock);
-        netdev_set_addr_lockdep_class(dev);
+        lockdep_set_class(&dev->addr_list_lock, &dev->addr_list_lock_key);
 
         ret = dev_get_valid_name(net, dev, dev->name);
         if (ret < 0)
@@ -9210,8 +9515,12 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
 
         dev_net_set(dev, &init_net);
 
+        netdev_register_lockdep_key(dev);
+
         dev->gso_max_size = GSO_MAX_SIZE;
         dev->gso_max_segs = GSO_MAX_SEGS;
+        dev->upper_level = 1;
+        dev->lower_level = 1;
 
         INIT_LIST_HEAD(&dev->napi_list);
         INIT_LIST_HEAD(&dev->unreg_list);
@@ -9292,6 +9601,8 @@ void free_netdev(struct net_device *dev)
         free_percpu(dev->pcpu_refcnt);
         dev->pcpu_refcnt = NULL;
 
+        netdev_unregister_lockdep_key(dev);
+
         /*  Compatibility with error handling in drivers */
         if (dev->reg_state == NETREG_UNINITIALIZED) {
                 netdev_freemem(dev);
@@ -9460,7 +9771,7 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
         call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
         rcu_barrier();
 
-        new_nsid = peernet2id_alloc(dev_net(dev), net);
+        new_nsid = peernet2id_alloc(dev_net(dev), net, GFP_KERNEL);
         /* If there is an ifindex conflict assign a new one */
         if (__dev_get_by_index(net, dev->ifindex))
                 new_ifindex = dev_new_index(net);
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index 6393ba930097..2f949b5a1eb9 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -637,7 +637,7 @@ int dev_uc_sync(struct net_device *to, struct net_device *from)
         if (to->addr_len != from->addr_len)
                 return -EINVAL;
 
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
         err = __hw_addr_sync(&to->uc, &from->uc, to->addr_len);
         if (!err)
                 __dev_set_rx_mode(to);
@@ -667,7 +667,7 @@ int dev_uc_sync_multiple(struct net_device *to, struct net_device *from)
         if (to->addr_len != from->addr_len)
                 return -EINVAL;
 
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
         err = __hw_addr_sync_multiple(&to->uc, &from->uc, to->addr_len);
         if (!err)
                 __dev_set_rx_mode(to);
@@ -691,7 +691,7 @@ void dev_uc_unsync(struct net_device *to, struct net_device *from)
                 return;
 
         netif_addr_lock_bh(from);
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
         __hw_addr_unsync(&to->uc, &from->uc, to->addr_len);
         __dev_set_rx_mode(to);
         netif_addr_unlock(to);
@@ -858,7 +858,7 @@ int dev_mc_sync(struct net_device *to, struct net_device *from)
         if (to->addr_len != from->addr_len)
                 return -EINVAL;
 
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
         err = __hw_addr_sync(&to->mc, &from->mc, to->addr_len);
         if (!err)
                 __dev_set_rx_mode(to);
@@ -888,7 +888,7 @@ int dev_mc_sync_multiple(struct net_device *to, struct net_device *from)
         if (to->addr_len != from->addr_len)
                 return -EINVAL;
 
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
         err = __hw_addr_sync_multiple(&to->mc, &from->mc, to->addr_len);
         if (!err)
                 __dev_set_rx_mode(to);
@@ -912,7 +912,7 @@ void dev_mc_unsync(struct net_device *to, struct net_device *from)
                 return;
 
         netif_addr_lock_bh(from);
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
         __hw_addr_unsync(&to->mc, &from->mc, to->addr_len);
         __dev_set_rx_mode(to);
         netif_addr_unlock(to);
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index c763106c73fc..cd9bc67381b2 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1396,11 +1396,13 @@ static int ethtool_reset(struct net_device *dev, char __user *useraddr)
 
 static int ethtool_get_wol(struct net_device *dev, char __user *useraddr)
 {
-        struct ethtool_wolinfo wol = { .cmd = ETHTOOL_GWOL };
+        struct ethtool_wolinfo wol;
 
         if (!dev->ethtool_ops->get_wol)
                 return -EOPNOTSUPP;
 
+        memset(&wol, 0, sizeof(struct ethtool_wolinfo));
+        wol.cmd = ETHTOOL_GWOL;
         dev->ethtool_ops->get_wol(dev, &wol);
 
         if (copy_to_user(useraddr, &wol, sizeof(wol)))
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 7c09d87d3269..68eda10d0680 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -1350,30 +1350,21 @@ out_bad:
 }
 EXPORT_SYMBOL(__skb_flow_dissect);
 
-static u32 hashrnd __read_mostly;
+static siphash_key_t hashrnd __read_mostly;
 static __always_inline void __flow_hash_secret_init(void)
 {
         net_get_random_once(&hashrnd, sizeof(hashrnd));
 }
 
-static __always_inline u32 __flow_hash_words(const u32 *words, u32 length,
-                                             u32 keyval)
+static const void *flow_keys_hash_start(const struct flow_keys *flow)
 {
-        return jhash2(words, length, keyval);
-}
-
-static inline const u32 *flow_keys_hash_start(const struct flow_keys *flow)
-{
-        const void *p = flow;
-
-        BUILD_BUG_ON(FLOW_KEYS_HASH_OFFSET % sizeof(u32));
-        return (const u32 *)(p + FLOW_KEYS_HASH_OFFSET);
+        BUILD_BUG_ON(FLOW_KEYS_HASH_OFFSET % SIPHASH_ALIGNMENT);
+        return &flow->FLOW_KEYS_HASH_START_FIELD;
 }
 
 static inline size_t flow_keys_hash_length(const struct flow_keys *flow)
 {
         size_t diff = FLOW_KEYS_HASH_OFFSET + sizeof(flow->addrs);
-        BUILD_BUG_ON((sizeof(*flow) - FLOW_KEYS_HASH_OFFSET) % sizeof(u32));
         BUILD_BUG_ON(offsetof(typeof(*flow), addrs) !=
                      sizeof(*flow) - sizeof(flow->addrs));
 
@@ -1388,7 +1379,7 @@ static inline size_t flow_keys_hash_length(const struct flow_keys *flow)
                 diff -= sizeof(flow->addrs.tipckey);
                 break;
         }
-        return (sizeof(*flow) - diff) / sizeof(u32);
+        return sizeof(*flow) - diff;
 }
 
 __be32 flow_get_u32_src(const struct flow_keys *flow)
@@ -1454,14 +1445,15 @@ static inline void __flow_hash_consistentify(struct flow_keys *keys)
         }
 }
 
-static inline u32 __flow_hash_from_keys(struct flow_keys *keys, u32 keyval)
+static inline u32 __flow_hash_from_keys(struct flow_keys *keys,
+                                        const siphash_key_t *keyval)
 {
         u32 hash;
 
         __flow_hash_consistentify(keys);
 
-        hash = __flow_hash_words(flow_keys_hash_start(keys),
-                                 flow_keys_hash_length(keys), keyval);
+        hash = siphash(flow_keys_hash_start(keys),
+                       flow_keys_hash_length(keys), keyval);
         if (!hash)
                 hash = 1;
 
@@ -1471,12 +1463,13 @@ static inline u32 __flow_hash_from_keys(struct flow_keys *keys, u32 keyval)
 u32 flow_hash_from_keys(struct flow_keys *keys)
 {
         __flow_hash_secret_init();
-        return __flow_hash_from_keys(keys, hashrnd);
+        return __flow_hash_from_keys(keys, &hashrnd);
 }
 EXPORT_SYMBOL(flow_hash_from_keys);
 
 static inline u32 ___skb_get_hash(const struct sk_buff *skb,
-                                  struct flow_keys *keys, u32 keyval)
+                                  struct flow_keys *keys,
+                                  const siphash_key_t *keyval)
 {
         skb_flow_dissect_flow_keys(skb, keys,
                                    FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
@@ -1524,7 +1517,7 @@ u32 __skb_get_hash_symmetric(const struct sk_buff *skb)
                            &keys, NULL, 0, 0, 0,
                            FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
 
-        return __flow_hash_from_keys(&keys, hashrnd);
+        return __flow_hash_from_keys(&keys, &hashrnd);
 }
 EXPORT_SYMBOL_GPL(__skb_get_hash_symmetric);
 
@@ -1544,13 +1537,14 @@ void __skb_get_hash(struct sk_buff *skb)
 
         __flow_hash_secret_init();
 
-        hash = ___skb_get_hash(skb, &keys, hashrnd);
+        hash = ___skb_get_hash(skb, &keys, &hashrnd);
 
         __skb_set_sw_hash(skb, hash, flow_keys_have_l4(&keys));
 }
 EXPORT_SYMBOL(__skb_get_hash);
 
-__u32 skb_get_hash_perturb(const struct sk_buff *skb, u32 perturb)
+__u32 skb_get_hash_perturb(const struct sk_buff *skb,
+                           const siphash_key_t *perturb)
 {
         struct flow_keys keys;
 
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index f93785e5833c..74cfb8b5ab33 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -88,11 +88,16 @@ static int bpf_lwt_input_reroute(struct sk_buff *skb)
         int err = -EINVAL;
 
         if (skb->protocol == htons(ETH_P_IP)) {
+                struct net_device *dev = skb_dst(skb)->dev;
                 struct iphdr *iph = ip_hdr(skb);
 
+                dev_hold(dev);
+                skb_dst_drop(skb);
                 err = ip_route_input_noref(skb, iph->daddr, iph->saddr,
-                                           iph->tos, skb_dst(skb)->dev);
+                                           iph->tos, dev);
+                dev_put(dev);
         } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                skb_dst_drop(skb);
                 err = ipv6_stub->ipv6_route_input(skb);
         } else {
                 err = -EAFNOSUPPORT;
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 6d3e4821b02d..39402840025e 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -246,11 +246,11 @@ static int __peernet2id(struct net *net, struct net *peer)
 }
 
 static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
-                              struct nlmsghdr *nlh);
+                              struct nlmsghdr *nlh, gfp_t gfp);
 /* This function returns the id of a peer netns. If no id is assigned, one will
  * be allocated and returned.
  */
-int peernet2id_alloc(struct net *net, struct net *peer)
+int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp)
 {
         bool alloc = false, alive = false;
         int id;
@@ -269,7 +269,7 @@ int peernet2id_alloc(struct net *net, struct net *peer)
         id = __peernet2id_alloc(net, peer, &alloc);
         spin_unlock_bh(&net->nsid_lock);
         if (alloc && id >= 0)
-                rtnl_net_notifyid(net, RTM_NEWNSID, id, 0, NULL);
+                rtnl_net_notifyid(net, RTM_NEWNSID, id, 0, NULL, gfp);
         if (alive)
                 put_net(peer);
         return id;
@@ -479,6 +479,7 @@ struct net *copy_net_ns(unsigned long flags,
 
         if (rv < 0) {
 put_userns:
+                key_remove_domain(net->key_domain);
                 put_user_ns(user_ns);
                 net_drop_ns(net);
 dec_ucounts:
@@ -533,7 +534,8 @@ static void unhash_nsid(struct net *net, struct net *last)
                         idr_remove(&tmp->netns_ids, id);
                 spin_unlock_bh(&tmp->nsid_lock);
                 if (id >= 0)
-                        rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL);
+                        rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL,
+                                          GFP_KERNEL);
                 if (tmp == last)
                         break;
         }
@@ -766,7 +768,7 @@ static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh,
         spin_unlock_bh(&net->nsid_lock);
         if (err >= 0) {
                 rtnl_net_notifyid(net, RTM_NEWNSID, err, NETLINK_CB(skb).portid,
-                                  nlh);
+                                  nlh, GFP_KERNEL);
                 err = 0;
         } else if (err == -ENOSPC && nsid >= 0) {
                 err = -EEXIST;
@@ -1054,7 +1056,7 @@ end:
 }
 
 static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
-                              struct nlmsghdr *nlh)
+                              struct nlmsghdr *nlh, gfp_t gfp)
 {
         struct net_fill_args fillargs = {
                 .portid = portid,
@@ -1065,7 +1067,7 @@ static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
         struct sk_buff *msg;
         int err = -ENOMEM;
 
-        msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL);
+        msg = nlmsg_new(rtnl_net_get_size(), gfp);
         if (!msg)
                 goto out;
 
@@ -1073,7 +1075,7 @@ static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
         if (err < 0)
                 goto err_out;
 
-        rtnl_notify(msg, net, portid, RTNLGRP_NSID, nlh, 0);
+        rtnl_notify(msg, net, portid, RTNLGRP_NSID, nlh, gfp);
         return;
 
 err_out:
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 1ee6460f8275..c81cd80114d9 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1523,7 +1523,7 @@ static noinline_for_stack int nla_put_ifalias(struct sk_buff *skb,
 
 static int rtnl_fill_link_netnsid(struct sk_buff *skb,
                                   const struct net_device *dev,
-                                  struct net *src_net)
+                                  struct net *src_net, gfp_t gfp)
 {
         bool put_iflink = false;
 
@@ -1531,7 +1531,7 @@ static int rtnl_fill_link_netnsid(struct sk_buff *skb,
                 struct net *link_net = dev->rtnl_link_ops->get_link_net(dev);
 
                 if (!net_eq(dev_net(dev), link_net)) {
-                        int id = peernet2id_alloc(src_net, link_net);
+                        int id = peernet2id_alloc(src_net, link_net, gfp);
 
                         if (nla_put_s32(skb, IFLA_LINK_NETNSID, id))
                                 return -EMSGSIZE;
@@ -1589,7 +1589,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb,
                             int type, u32 pid, u32 seq, u32 change,
                             unsigned int flags, u32 ext_filter_mask,
                             u32 event, int *new_nsid, int new_ifindex,
-                            int tgt_netnsid)
+                            int tgt_netnsid, gfp_t gfp)
 {
         struct ifinfomsg *ifm;
         struct nlmsghdr *nlh;
@@ -1681,7 +1681,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb,
                         goto nla_put_failure;
         }
 
-        if (rtnl_fill_link_netnsid(skb, dev, src_net))
+        if (rtnl_fill_link_netnsid(skb, dev, src_net, gfp))
                 goto nla_put_failure;
 
         if (new_nsid &&
@@ -2001,7 +2001,7 @@ walk_entries:
                                                NETLINK_CB(cb->skb).portid,
                                                nlh->nlmsg_seq, 0, flags,
                                                ext_filter_mask, 0, NULL, 0,
-                                               netnsid);
+                                               netnsid, GFP_KERNEL);
 
                         if (err < 0) {
                                 if (likely(skb->len))
@@ -2355,6 +2355,7 @@ static int do_set_master(struct net_device *dev, int ifindex,
                         err = ops->ndo_del_slave(upper_dev, dev);
                         if (err)
                                 return err;
+                        netdev_update_lockdep_key(dev);
                 } else {
                         return -EOPNOTSUPP;
                 }
@@ -3359,7 +3360,7 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr *nlh,
         err = rtnl_fill_ifinfo(nskb, dev, net,
                                RTM_NEWLINK, NETLINK_CB(skb).portid,
                                nlh->nlmsg_seq, 0, 0, ext_filter_mask,
-                               0, NULL, 0, netnsid);
+                               0, NULL, 0, netnsid, GFP_KERNEL);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in if_nlmsg_size */
                 WARN_ON(err == -EMSGSIZE);
@@ -3471,7 +3472,7 @@ struct sk_buff *rtmsg_ifinfo_build_skb(int type, struct net_device *dev,
 
         err = rtnl_fill_ifinfo(skb, dev, dev_net(dev),
                                type, 0, 0, change, 0, 0, event,
-                               new_nsid, new_ifindex, -1);
+                               new_nsid, new_ifindex, -1, flags);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in if_nlmsg_size() */
                 WARN_ON(err == -EMSGSIZE);
@@ -3916,7 +3917,7 @@ static int valid_fdb_dump_strict(const struct nlmsghdr *nlh,
         ndm = nlmsg_data(nlh);
         if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_state ||
             ndm->ndm_flags || ndm->ndm_type) {
-                NL_SET_ERR_MSG(extack, "Invalid values in header for fbd dump request");
+                NL_SET_ERR_MSG(extack, "Invalid values in header for fdb dump request");
                 return -EINVAL;
         }
 
diff --git a/net/core/sock.c b/net/core/sock.c
index a515392ba84b..ac78a570e43a 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1127,7 +1127,7 @@ set_rcvbuf:
                 break;
                 }
         case SO_INCOMING_CPU:
-                sk->sk_incoming_cpu = val;
+                WRITE_ONCE(sk->sk_incoming_cpu, val);
                 break;
 
         case SO_CNX_ADVICE:
@@ -1476,7 +1476,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case SO_INCOMING_CPU:
-                v.val = sk->sk_incoming_cpu;
+                v.val = READ_ONCE(sk->sk_incoming_cpu);
                 break;
 
         case SO_MEMINFO:
@@ -3600,7 +3600,7 @@ bool sk_busy_loop_end(void *p, unsigned long start_time)
 {
         struct sock *sk = p;
 
-        return !skb_queue_empty(&sk->sk_receive_queue) ||
+        return !skb_queue_empty_lockless(&sk->sk_receive_queue) ||
                sk_busy_loop_timeout(sk, start_time);
 }
 EXPORT_SYMBOL(sk_busy_loop_end);
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index d9b4200ed12d..0d8f782c25cc 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -117,7 +117,7 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                                                     inet->inet_daddr,
                                                     inet->inet_sport,
                                                     inet->inet_dport);
-        inet->inet_id = dp->dccps_iss ^ jiffies;
+        inet->inet_id = prandom_u32();
 
         err = dccp_connect(sk);
         rt = NULL;
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 0ea75286abf4..3349ea81f901 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1205,7 +1205,7 @@ static __poll_t dn_poll(struct file *file, struct socket *sock, poll_table  *wai
         struct dn_scp *scp = DN_SK(sk);
         __poll_t mask = datagram_poll(file, sock, wait);
 
-        if (!skb_queue_empty(&scp->other_receive_queue))
+        if (!skb_queue_empty_lockless(&scp->other_receive_queue))
                 mask |= EPOLLRDBAND;
 
         return mask;
diff --git a/net/dsa/master.c b/net/dsa/master.c
index a8e52c9967f4..3255dfc97f86 100644
--- a/net/dsa/master.c
+++ b/net/dsa/master.c
@@ -310,8 +310,6 @@ static void dsa_master_reset_mtu(struct net_device *dev)
         rtnl_unlock();
 }
 
-static struct lock_class_key dsa_master_addr_list_lock_key;
-
 int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
 {
         int ret;
@@ -325,9 +323,6 @@ int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
         wmb();
 
         dev->dsa_ptr = cpu_dp;
-        lockdep_set_class(&dev->addr_list_lock,
-                          &dsa_master_addr_list_lock_key);
-
         ret = dsa_master_ethtool_setup(dev);
         if (ret)
                 return ret;
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 75d58229a4bd..028e65f4b5ba 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1341,15 +1341,6 @@ static int dsa_slave_phy_setup(struct net_device *slave_dev)
         return ret;
 }
 
-static struct lock_class_key dsa_slave_netdev_xmit_lock_key;
-static void dsa_slave_set_lockdep_class_one(struct net_device *dev,
-                                            struct netdev_queue *txq,
-                                            void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock,
-                          &dsa_slave_netdev_xmit_lock_key);
-}
-
 int dsa_slave_suspend(struct net_device *slave_dev)
 {
         struct dsa_port *dp = dsa_slave_to_port(slave_dev);
@@ -1433,9 +1424,6 @@ int dsa_slave_create(struct dsa_port *port)
         slave_dev->max_mtu = ETH_MAX_MTU;
         SET_NETDEV_DEVTYPE(slave_dev, &dsa_type);
 
-        netdev_for_each_tx_queue(slave_dev, dsa_slave_set_lockdep_class_one,
-                                 NULL);
-
         SET_NETDEV_DEV(slave_dev, port->ds->dev);
         slave_dev->dev.of_node = port->dn;
         slave_dev->vlan_features = master->vlan_features;
diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
index 3297e7fa9945..c0b107cdd715 100644
--- a/net/ieee802154/6lowpan/core.c
+++ b/net/ieee802154/6lowpan/core.c
@@ -58,13 +58,6 @@ static const struct header_ops lowpan_header_ops = {
         .create = lowpan_header_create,
 };
 
-static int lowpan_dev_init(struct net_device *ldev)
-{
-        netdev_lockdep_set_classes(ldev);
-
-        return 0;
-}
-
 static int lowpan_open(struct net_device *dev)
 {
         if (!open_count)
@@ -96,7 +89,6 @@ static int lowpan_get_iflink(const struct net_device *dev)
 }
 
 static const struct net_device_ops lowpan_netdev_ops = {
-        .ndo_init               = lowpan_dev_init,
         .ndo_start_xmit         = lowpan_xmit,
         .ndo_open               = lowpan_open,
         .ndo_stop               = lowpan_stop,
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 9a0fe0c2fa02..4a8550c49202 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -73,7 +73,7 @@ int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
         reuseport_has_conns(sk, true);
         sk->sk_state = TCP_ESTABLISHED;
         sk_set_txhash(sk);
-        inet->inet_id = jiffies;
+        inet->inet_id = prandom_u32();
 
         sk_dst_set(sk, &rt->dst);
         err = 0;
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index dde77f72e03e..71c78d223dfd 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1148,7 +1148,7 @@ void fib_modify_prefix_metric(struct in_ifaddr *ifa, u32 new_metric)
         if (!(dev->flags & IFF_UP) ||
             ifa->ifa_flags & (IFA_F_SECONDARY | IFA_F_NOPREFIXROUTE) ||
             ipv4_is_zeronet(prefix) ||
-            prefix == ifa->ifa_local || ifa->ifa_prefixlen == 32)
+            (prefix == ifa->ifa_local && ifa->ifa_prefixlen == 32))
                 return;
 
         /* add the new */
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 97824864e40d..83fb00153018 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -240,7 +240,7 @@ static inline int compute_score(struct sock *sk, struct net *net,
                         return -1;
 
                 score = sk->sk_family == PF_INET ? 2 : 1;
-                if (sk->sk_incoming_cpu == raw_smp_processor_id())
+                if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
                         score++;
         }
         return score;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 52690bb3e40f..10636fb6093e 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -509,9 +509,9 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev)
         key = &tun_info->key;
         if (!(tun_info->key.tun_flags & TUNNEL_ERSPAN_OPT))
                 goto err_free_skb;
-        md = ip_tunnel_info_opts(tun_info);
-        if (!md)
+        if (tun_info->options_len < sizeof(*md))
                 goto err_free_skb;
+        md = ip_tunnel_info_opts(tun_info);
 
         /* ERSPAN has fixed 8 byte GRE header */
         version = md->version;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 814b9b8882a0..3d8baaaf7086 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -645,11 +645,12 @@ void ip_fraglist_prepare(struct sk_buff *skb, struct ip_fraglist_iter *iter)
 EXPORT_SYMBOL(ip_fraglist_prepare);
 
 void ip_frag_init(struct sk_buff *skb, unsigned int hlen,
-                  unsigned int ll_rs, unsigned int mtu,
+                  unsigned int ll_rs, unsigned int mtu, bool DF,
                   struct ip_frag_state *state)
 {
         struct iphdr *iph = ip_hdr(skb);
 
+        state->DF = DF;
         state->hlen = hlen;
         state->ll_rs = ll_rs;
         state->mtu = mtu;
@@ -668,9 +669,6 @@ static void ip_frag_ipcb(struct sk_buff *from, struct sk_buff *to,
         /* Copy the flags to each fragment. */
         IPCB(to)->flags = IPCB(from)->flags;
 
-        if (IPCB(from)->flags & IPSKB_FRAG_PMTU)
-                state->iph->frag_off |= htons(IP_DF);
-
         /* ANK: dirty, but effective trick. Upgrade options only if
          * the segment to be fragmented was THE FIRST (otherwise,
          * options are already fixed) and make it ONCE
@@ -738,6 +736,8 @@ struct sk_buff *ip_frag_next(struct sk_buff *skb, struct ip_frag_state *state)
          */
         iph = ip_hdr(skb2);
         iph->frag_off = htons((state->offset >> 3));
+        if (state->DF)
+                iph->frag_off |= htons(IP_DF);
 
         /*
          *      Added AC : If we are fragmenting a fragment that's not the
@@ -883,7 +883,8 @@ slow_path:
          *      Fragment the datagram.
          */
 
-        ip_frag_init(skb, hlen, ll_rs, mtu, &state);
+        ip_frag_init(skb, hlen, ll_rs, mtu, IPCB(skb)->flags & IPSKB_FRAG_PMTU,
+                     &state);
 
         /*
          *      Keep copying data until we run out.
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 42187a3b82f4..d8876f0e9672 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -584,7 +584,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
         }
         /* This barrier is coupled with smp_wmb() in tcp_reset() */
         smp_rmb();
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                 mask |= EPOLLERR;
 
         return mask;
@@ -1964,7 +1964,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
         if (unlikely(flags & MSG_ERRQUEUE))
                 return inet_recv_error(sk, msg, len, addr_len);
 
-        if (sk_can_busy_loop(sk) && skb_queue_empty(&sk->sk_receive_queue) &&
+        if (sk_can_busy_loop(sk) && skb_queue_empty_lockless(&sk->sk_receive_queue) &&
             (sk->sk_state == TCP_ESTABLISHED))
                 sk_busy_loop(sk, nonblock);
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 6be568334848..67b2dc7a1727 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -303,7 +303,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                                                  inet->inet_daddr);
         }
 
-        inet->inet_id = tp->write_seq ^ jiffies;
+        inet->inet_id = prandom_u32();
 
         if (tcp_fastopen_defer_connect(sk, &err))
                 return err;
@@ -1450,7 +1450,7 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
         inet_csk(newsk)->icsk_ext_hdr_len = 0;
         if (inet_opt)
                 inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
-        newinet->inet_id = newtp->write_seq ^ jiffies;
+        newinet->inet_id = prandom_u32();
 
         if (!dst) {
                 dst = inet_csk_route_child_sock(sk, newsk, req);
@@ -2681,7 +2681,7 @@ static int __net_init tcp_sk_init(struct net *net)
         net->ipv4.tcp_death_row.sysctl_max_tw_buckets = cnt / 2;
         net->ipv4.tcp_death_row.hashinfo = &tcp_hashinfo;
 
-        net->ipv4.sysctl_max_syn_backlog = max(128, cnt / 256);
+        net->ipv4.sysctl_max_syn_backlog = max(128, cnt / 128);
         net->ipv4.sysctl_tcp_sack = 1;
         net->ipv4.sysctl_tcp_window_scaling = 1;
         net->ipv4.sysctl_tcp_timestamps = 1;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 14bc654b6842..1d58ce829dca 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -388,7 +388,7 @@ static int compute_score(struct sock *sk, struct net *net,
                 return -1;
         score += 4;
 
-        if (sk->sk_incoming_cpu == raw_smp_processor_id())
+        if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
                 score++;
         return score;
 }
@@ -1316,6 +1316,20 @@ static void udp_set_dev_scratch(struct sk_buff *skb)
                 scratch->_tsize_state |= UDP_SKB_IS_STATELESS;
 }
 
+static void udp_skb_csum_unnecessary_set(struct sk_buff *skb)
+{
+        /* We come here after udp_lib_checksum_complete() returned 0.
+         * This means that __skb_checksum_complete() might have
+         * set skb->csum_valid to 1.
+         * On 64bit platforms, we can set csum_unnecessary
+         * to true, but only if the skb is not shared.
+         */
+#if BITS_PER_LONG == 64
+        if (!skb_shared(skb))
+                udp_skb_scratch(skb)->csum_unnecessary = true;
+#endif
+}
+
 static int udp_skb_truesize(struct sk_buff *skb)
 {
         return udp_skb_scratch(skb)->_tsize_state & ~UDP_SKB_IS_STATELESS;
@@ -1550,10 +1564,7 @@ static struct sk_buff *__first_packet_length(struct sock *sk,
                         *total += skb->truesize;
                         kfree_skb(skb);
                 } else {
-                        /* the csum related bits could be changed, refresh
-                         * the scratch area
-                         */
-                        udp_set_dev_scratch(skb);
+                        udp_skb_csum_unnecessary_set(skb);
                         break;
                 }
         }
@@ -1577,7 +1588,7 @@ static int first_packet_length(struct sock *sk)
 
         spin_lock_bh(&rcvq->lock);
         skb = __first_packet_length(sk, rcvq, &total);
-        if (!skb && !skb_queue_empty(sk_queue)) {
+        if (!skb && !skb_queue_empty_lockless(sk_queue)) {
                 spin_lock(&sk_queue->lock);
                 skb_queue_splice_tail_init(sk_queue, rcvq);
                 spin_unlock(&sk_queue->lock);
@@ -1650,7 +1661,7 @@ struct sk_buff *__skb_recv_udp(struct sock *sk, unsigned int flags,
                                 return skb;
                         }
 
-                        if (skb_queue_empty(sk_queue)) {
+                        if (skb_queue_empty_lockless(sk_queue)) {
                                 spin_unlock_bh(&queue->lock);
                                 goto busy_check;
                         }
@@ -1676,7 +1687,7 @@ busy_check:
                                 break;
 
                         sk_busy_loop(sk, flags & MSG_DONTWAIT);
-                } while (!skb_queue_empty(sk_queue));
+                } while (!skb_queue_empty_lockless(sk_queue));
 
                 /* sk_queue is empty, reader_queue may contain peeked packets */
         } while (timeo &&
@@ -2712,7 +2723,7 @@ __poll_t udp_poll(struct file *file, struct socket *sock, poll_table *wait)
         __poll_t mask = datagram_poll(file, sock, wait);
         struct sock *sk = sock->sk;
 
-        if (!skb_queue_empty(&udp_sk(sk)->reader_queue))
+        if (!skb_queue_empty_lockless(&udp_sk(sk)->reader_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
         /* Check for false positives due to checksum errors */
diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
index 783f3c1466da..2fc079284ca4 100644
--- a/net/ipv6/addrconf_core.c
+++ b/net/ipv6/addrconf_core.c
@@ -7,6 +7,7 @@
 #include <linux/export.h>
 #include <net/ipv6.h>
 #include <net/ipv6_stubs.h>
+#include <net/addrconf.h>
 #include <net/ip.h>
 
 /* if ipv6 module registers this function is used by xfrm to force all
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index cf60fae9533b..fbe9d4295eac 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -105,7 +105,7 @@ static inline int compute_score(struct sock *sk, struct net *net,
                         return -1;
 
                 score = 1;
-                if (sk->sk_incoming_cpu == raw_smp_processor_id())
+                if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
                         score++;
         }
         return score;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 787d9f2a6e99..923034c52ce4 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -980,9 +980,9 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
                 dsfield = key->tos;
                 if (!(tun_info->key.tun_flags & TUNNEL_ERSPAN_OPT))
                         goto tx_err;
-                md = ip_tunnel_info_opts(tun_info);
-                if (!md)
+                if (tun_info->options_len < sizeof(*md))
                         goto tx_err;
+                md = ip_tunnel_info_opts(tun_info);
 
                 tun_id = tunnel_id_to_key32(key->tun_id);
                 if (md->version == 1) {
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 6324d3a8cb53..9fec580c968e 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -135,7 +135,7 @@ static int compute_score(struct sock *sk, struct net *net,
                 return -1;
         score++;
 
-        if (sk->sk_incoming_cpu == raw_smp_processor_id())
+        if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
                 score++;
 
         return score;
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index fd5ac2788e45..d3b520b9b2c9 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -56,7 +56,6 @@ static int l2tp_eth_dev_init(struct net_device *dev)
 {
         eth_hw_addr_random(dev);
         eth_broadcast_addr(dev->broadcast);
-        netdev_lockdep_set_classes(dev);
 
         return 0;
 }
diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
index 4515056ef1c2..f9b16f2b2219 100644
--- a/net/netfilter/ipvs/ip_vs_app.c
+++ b/net/netfilter/ipvs/ip_vs_app.c
@@ -193,21 +193,29 @@ struct ip_vs_app *register_ip_vs_app(struct netns_ipvs *ipvs, struct ip_vs_app *
 
         mutex_lock(&__ip_vs_app_mutex);
 
+        /* increase the module use count */
+        if (!ip_vs_use_count_inc()) {
+                err = -ENOENT;
+                goto out_unlock;
+        }
+
         list_for_each_entry(a, &ipvs->app_list, a_list) {
                 if (!strcmp(app->name, a->name)) {
                         err = -EEXIST;
+                        /* decrease the module use count */
+                        ip_vs_use_count_dec();
                         goto out_unlock;
                 }
         }
         a = kmemdup(app, sizeof(*app), GFP_KERNEL);
         if (!a) {
                 err = -ENOMEM;
+                /* decrease the module use count */
+                ip_vs_use_count_dec();
                 goto out_unlock;
         }
         INIT_LIST_HEAD(&a->incs_list);
         list_add(&a->a_list, &ipvs->app_list);
-        /* increase the module use count */
-        ip_vs_use_count_inc();
 
 out_unlock:
         mutex_unlock(&__ip_vs_app_mutex);
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 8b48e7ce1c2c..3cccc88ef817 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -93,7 +93,6 @@ static bool __ip_vs_addr_is_local_v6(struct net *net,
 static void update_defense_level(struct netns_ipvs *ipvs)
 {
         struct sysinfo i;
-        static int old_secure_tcp = 0;
         int availmem;
         int nomem;
         int to_change = -1;
@@ -174,35 +173,35 @@ static void update_defense_level(struct netns_ipvs *ipvs)
         spin_lock(&ipvs->securetcp_lock);
         switch (ipvs->sysctl_secure_tcp) {
         case 0:
-                if (old_secure_tcp >= 2)
+                if (ipvs->old_secure_tcp >= 2)
                         to_change = 0;
                 break;
         case 1:
                 if (nomem) {
-                        if (old_secure_tcp < 2)
+                        if (ipvs->old_secure_tcp < 2)
                                 to_change = 1;
                         ipvs->sysctl_secure_tcp = 2;
                 } else {
-                        if (old_secure_tcp >= 2)
+                        if (ipvs->old_secure_tcp >= 2)
                                 to_change = 0;
                 }
                 break;
         case 2:
                 if (nomem) {
-                        if (old_secure_tcp < 2)
+                        if (ipvs->old_secure_tcp < 2)
                                 to_change = 1;
                 } else {
-                        if (old_secure_tcp >= 2)
+                        if (ipvs->old_secure_tcp >= 2)
                                 to_change = 0;
                         ipvs->sysctl_secure_tcp = 1;
                 }
                 break;
         case 3:
-                if (old_secure_tcp < 2)
+                if (ipvs->old_secure_tcp < 2)
                         to_change = 1;
                 break;
         }
-        old_secure_tcp = ipvs->sysctl_secure_tcp;
+        ipvs->old_secure_tcp = ipvs->sysctl_secure_tcp;
         if (to_change >= 0)
                 ip_vs_protocol_timeout_change(ipvs,
                                               ipvs->sysctl_secure_tcp > 1);
@@ -1275,7 +1274,8 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
         struct ip_vs_service *svc = NULL;
 
         /* increase the module use count */
-        ip_vs_use_count_inc();
+        if (!ip_vs_use_count_inc())
+                return -ENOPROTOOPT;
 
         /* Lookup the scheduler by 'u->sched_name' */
         if (strcmp(u->sched_name, "none")) {
@@ -2435,9 +2435,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
         if (copy_from_user(arg, user, len) != 0)
                 return -EFAULT;
 
-        /* increase the module use count */
-        ip_vs_use_count_inc();
-
         /* Handle daemons since they have another lock */
         if (cmd == IP_VS_SO_SET_STARTDAEMON ||
             cmd == IP_VS_SO_SET_STOPDAEMON) {
@@ -2450,13 +2447,13 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                         ret = -EINVAL;
                         if (strscpy(cfg.mcast_ifn, dm->mcast_ifn,
                                     sizeof(cfg.mcast_ifn)) <= 0)
-                                goto out_dec;
+                                return ret;
                         cfg.syncid = dm->syncid;
                         ret = start_sync_thread(ipvs, &cfg, dm->state);
                 } else {
                         ret = stop_sync_thread(ipvs, dm->state);
                 }
-                goto out_dec;
+                return ret;
         }
 
         mutex_lock(&__ip_vs_mutex);
@@ -2551,10 +2548,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 
   out_unlock:
         mutex_unlock(&__ip_vs_mutex);
-  out_dec:
-        /* decrease the module use count */
-        ip_vs_use_count_dec();
-
         return ret;
 }
 
diff --git a/net/netfilter/ipvs/ip_vs_pe.c b/net/netfilter/ipvs/ip_vs_pe.c
index 8e104dff7abc..166c669f0763 100644
--- a/net/netfilter/ipvs/ip_vs_pe.c
+++ b/net/netfilter/ipvs/ip_vs_pe.c
@@ -68,7 +68,8 @@ int register_ip_vs_pe(struct ip_vs_pe *pe)
         struct ip_vs_pe *tmp;
 
         /* increase the module use count */
-        ip_vs_use_count_inc();
+        if (!ip_vs_use_count_inc())
+                return -ENOENT;
 
         mutex_lock(&ip_vs_pe_mutex);
         /* Make sure that the pe with this name doesn't exist
diff --git a/net/netfilter/ipvs/ip_vs_sched.c b/net/netfilter/ipvs/ip_vs_sched.c
index 2f9d5cd5daee..d4903723be7e 100644
--- a/net/netfilter/ipvs/ip_vs_sched.c
+++ b/net/netfilter/ipvs/ip_vs_sched.c
@@ -179,7 +179,8 @@ int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
         }
 
         /* increase the module use count */
-        ip_vs_use_count_inc();
+        if (!ip_vs_use_count_inc())
+                return -ENOENT;
 
         mutex_lock(&ip_vs_sched_mutex);
 
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index a4a78c4b06de..8dc892a9dc91 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -1762,6 +1762,10 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
         IP_VS_DBG(7, "Each ip_vs_sync_conn entry needs %zd bytes\n",
                   sizeof(struct ip_vs_sync_conn_v0));
 
+        /* increase the module use count */
+        if (!ip_vs_use_count_inc())
+                return -ENOPROTOOPT;
+
         /* Do not hold one mutex and then to block on another */
         for (;;) {
                 rtnl_lock();
@@ -1892,9 +1896,6 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
         mutex_unlock(&ipvs->sync_mutex);
         rtnl_unlock();
 
-        /* increase the module use count */
-        ip_vs_use_count_inc();
-
         return 0;
 
 out:
@@ -1924,11 +1925,17 @@ out:
                 }
                 kfree(ti);
         }
+
+        /* decrease the module use count */
+        ip_vs_use_count_dec();
         return result;
 
 out_early:
         mutex_unlock(&ipvs->sync_mutex);
         rtnl_unlock();
+
+        /* decrease the module use count */
+        ip_vs_use_count_dec();
         return result;
 }
 
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 132f5228b431..128245efe84a 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -202,6 +202,8 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
 {
         int err;
 
+        flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
+
         err = rhashtable_insert_fast(&flow_table->rhashtable,
                                      &flow->tuplehash[0].node,
                                      nf_flow_offload_rhash_params);
@@ -218,7 +220,6 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
                 return err;
         }
 
-        flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
         return 0;
 }
 EXPORT_SYMBOL_GPL(flow_offload_add);
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index e546f759b7a7..ad783f4840ef 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -347,7 +347,7 @@ int nft_flow_rule_offload_commit(struct net *net)
 
                         policy = nft_trans_chain_policy(trans);
                         err = nft_flow_offload_chain(trans->ctx.chain, &policy,
-                                                     FLOW_BLOCK_BIND);
+                                                     FLOW_BLOCK_UNBIND);
                         break;
                 case NFT_MSG_NEWRULE:
                         if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 22a80eb60222..5cb2d8908d2a 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -161,13 +161,21 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,
 
         switch (priv->offset) {
         case offsetof(struct ethhdr, h_source):
+                if (priv->len != ETH_ALEN)
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_ETH_ADDRS, eth_addrs,
                                   src, ETH_ALEN, reg);
                 break;
         case offsetof(struct ethhdr, h_dest):
+                if (priv->len != ETH_ALEN)
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_ETH_ADDRS, eth_addrs,
                                   dst, ETH_ALEN, reg);
                 break;
+        default:
+                return -EOPNOTSUPP;
         }
 
         return 0;
@@ -181,14 +189,23 @@ static int nft_payload_offload_ip(struct nft_offload_ctx *ctx,
 
         switch (priv->offset) {
         case offsetof(struct iphdr, saddr):
+                if (priv->len != sizeof(struct in_addr))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4, src,
                                   sizeof(struct in_addr), reg);
                 break;
         case offsetof(struct iphdr, daddr):
+                if (priv->len != sizeof(struct in_addr))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4, dst,
                                   sizeof(struct in_addr), reg);
                 break;
         case offsetof(struct iphdr, protocol):
+                if (priv->len != sizeof(__u8))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic, ip_proto,
                                   sizeof(__u8), reg);
                 nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_TRANSPORT);
@@ -208,14 +225,23 @@ static int nft_payload_offload_ip6(struct nft_offload_ctx *ctx,
 
         switch (priv->offset) {
         case offsetof(struct ipv6hdr, saddr):
+                if (priv->len != sizeof(struct in6_addr))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6, src,
                                   sizeof(struct in6_addr), reg);
                 break;
         case offsetof(struct ipv6hdr, daddr):
+                if (priv->len != sizeof(struct in6_addr))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6, dst,
                                   sizeof(struct in6_addr), reg);
                 break;
         case offsetof(struct ipv6hdr, nexthdr):
+                if (priv->len != sizeof(__u8))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic, ip_proto,
                                   sizeof(__u8), reg);
                 nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_TRANSPORT);
@@ -255,10 +281,16 @@ static int nft_payload_offload_tcp(struct nft_offload_ctx *ctx,
 
         switch (priv->offset) {
         case offsetof(struct tcphdr, source):
+                if (priv->len != sizeof(__be16))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, src,
                                   sizeof(__be16), reg);
                 break;
         case offsetof(struct tcphdr, dest):
+                if (priv->len != sizeof(__be16))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, dst,
                                   sizeof(__be16), reg);
                 break;
@@ -277,10 +309,16 @@ static int nft_payload_offload_udp(struct nft_offload_ctx *ctx,
 
         switch (priv->offset) {
         case offsetof(struct udphdr, source):
+                if (priv->len != sizeof(__be16))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, src,
                                   sizeof(__be16), reg);
                 break;
         case offsetof(struct udphdr, dest):
+                if (priv->len != sizeof(__be16))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, dst,
                                   sizeof(__be16), reg);
                 break;
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index c4f54ad2b98a..58d5373c513c 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -64,28 +64,6 @@ static DEFINE_SPINLOCK(nr_list_lock);
 static const struct proto_ops nr_proto_ops;
 
 /*
- * NETROM network devices are virtual network devices encapsulating NETROM
- * frames into AX.25 which will be sent through an AX.25 device, so form a
- * special "super class" of normal net devices; split their locks off into a
- * separate class since they always nest.
- */
-static struct lock_class_key nr_netdev_xmit_lock_key;
-static struct lock_class_key nr_netdev_addr_lock_key;
-
-static void nr_set_lockdep_one(struct net_device *dev,
-                               struct netdev_queue *txq,
-                               void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock, &nr_netdev_xmit_lock_key);
-}
-
-static void nr_set_lockdep_key(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock, &nr_netdev_addr_lock_key);
-        netdev_for_each_tx_queue(dev, nr_set_lockdep_one, NULL);
-}
-
-/*
  *      Socket removal during an interrupt is now safe.
  */
 static void nr_remove_socket(struct sock *sk)
@@ -1414,7 +1392,6 @@ static int __init nr_proto_init(void)
                         free_netdev(dev);
                         goto fail;
                 }
-                nr_set_lockdep_key(dev);
                 dev_nr[i] = dev;
         }
 
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index ccdd790e163a..28604414dec1 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -554,11 +554,11 @@ static __poll_t llcp_sock_poll(struct file *file, struct socket *sock,
         if (sk->sk_state == LLCP_LISTEN)
                 return llcp_accept_poll(sk);
 
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                 mask |= EPOLLERR |
                         (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
 
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
         if (sk->sk_state == LLCP_CLOSED)
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index f30e406fbec5..d8c364d637b1 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1881,7 +1881,7 @@ static struct genl_family dp_datapath_genl_family __ro_after_init = {
 /* Called with ovs_mutex or RCU read lock. */
 static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb,
                                    struct net *net, u32 portid, u32 seq,
-                                   u32 flags, u8 cmd)
+                                   u32 flags, u8 cmd, gfp_t gfp)
 {
         struct ovs_header *ovs_header;
         struct ovs_vport_stats vport_stats;
@@ -1902,7 +1902,7 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb,
                 goto nla_put_failure;
 
         if (!net_eq(net, dev_net(vport->dev))) {
-                int id = peernet2id_alloc(net, dev_net(vport->dev));
+                int id = peernet2id_alloc(net, dev_net(vport->dev), gfp);
 
                 if (nla_put_s32(skb, OVS_VPORT_ATTR_NETNSID, id))
                         goto nla_put_failure;
@@ -1943,11 +1943,12 @@ struct sk_buff *ovs_vport_cmd_build_info(struct vport *vport, struct net *net,
         struct sk_buff *skb;
         int retval;
 
-        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!skb)
                 return ERR_PTR(-ENOMEM);
 
-        retval = ovs_vport_cmd_fill_info(vport, skb, net, portid, seq, 0, cmd);
+        retval = ovs_vport_cmd_fill_info(vport, skb, net, portid, seq, 0, cmd,
+                                         GFP_KERNEL);
         BUG_ON(retval < 0);
 
         return skb;
@@ -2089,7 +2090,7 @@ restart:
 
         err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
                                       info->snd_portid, info->snd_seq, 0,
-                                      OVS_VPORT_CMD_NEW);
+                                      OVS_VPORT_CMD_NEW, GFP_KERNEL);
 
         new_headroom = netdev_get_fwd_headroom(vport->dev);
 
@@ -2150,7 +2151,7 @@ static int ovs_vport_cmd_set(struct sk_buff *skb, struct genl_info *info)
 
         err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
                                       info->snd_portid, info->snd_seq, 0,
-                                      OVS_VPORT_CMD_SET);
+                                      OVS_VPORT_CMD_SET, GFP_KERNEL);
         BUG_ON(err < 0);
 
         ovs_unlock();
@@ -2190,7 +2191,7 @@ static int ovs_vport_cmd_del(struct sk_buff *skb, struct genl_info *info)
 
         err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
                                       info->snd_portid, info->snd_seq, 0,
-                                      OVS_VPORT_CMD_DEL);
+                                      OVS_VPORT_CMD_DEL, GFP_KERNEL);
         BUG_ON(err < 0);
 
         /* the vport deletion may trigger dp headroom update */
@@ -2237,7 +2238,7 @@ static int ovs_vport_cmd_get(struct sk_buff *skb, struct genl_info *info)
                 goto exit_unlock_free;
         err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
                                       info->snd_portid, info->snd_seq, 0,
-                                      OVS_VPORT_CMD_GET);
+                                      OVS_VPORT_CMD_GET, GFP_ATOMIC);
         BUG_ON(err < 0);
         rcu_read_unlock();
 
@@ -2273,7 +2274,8 @@ static int ovs_vport_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
                                                     NETLINK_CB(cb->skb).portid,
                                                     cb->nlh->nlmsg_seq,
                                                     NLM_F_MULTI,
-                                                    OVS_VPORT_CMD_GET) < 0)
+                                                    OVS_VPORT_CMD_GET,
+                                                    GFP_ATOMIC) < 0)
                                 goto out;
 
                         j++;
diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
index 21c90d3a7ebf..58a7b8312c28 100644
--- a/net/openvswitch/vport-internal_dev.c
+++ b/net/openvswitch/vport-internal_dev.c
@@ -137,7 +137,7 @@ static void do_setup(struct net_device *netdev)
         netdev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_OPENVSWITCH |
                               IFF_NO_QUEUE;
         netdev->needs_free_netdev = true;
-        netdev->priv_destructor = internal_dev_destructor;
+        netdev->priv_destructor = NULL;
         netdev->ethtool_ops = &internal_dev_ethtool_ops;
         netdev->rtnl_link_ops = &internal_dev_link_ops;
 
@@ -159,7 +159,6 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
         struct internal_dev *internal_dev;
         struct net_device *dev;
         int err;
-        bool free_vport = true;
 
         vport = ovs_vport_alloc(0, &ovs_internal_vport_ops, parms);
         if (IS_ERR(vport)) {
@@ -190,10 +189,9 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
 
         rtnl_lock();
         err = register_netdevice(vport->dev);
-        if (err) {
-                free_vport = false;
+        if (err)
                 goto error_unlock;
-        }
+        vport->dev->priv_destructor = internal_dev_destructor;
 
         dev_set_promiscuity(vport->dev, 1);
         rtnl_unlock();
@@ -207,8 +205,7 @@ error_unlock:
 error_free_netdev:
         free_netdev(dev);
 error_free_vport:
-        if (free_vport)
-                ovs_vport_free(vport);
+        ovs_vport_free(vport);
 error:
         return ERR_PTR(err);
 }
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 96ea9f254ae9..76d499f6af9a 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -338,9 +338,9 @@ static __poll_t pn_socket_poll(struct file *file, struct socket *sock,
 
         if (sk->sk_state == TCP_CLOSE)
                 return EPOLLERR;
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
-        if (!skb_queue_empty(&pn->ctrlreq_queue))
+        if (!skb_queue_empty_lockless(&pn->ctrlreq_queue))
                 mask |= EPOLLPRI;
         if (!mask && sk->sk_state == TCP_CLOSE_WAIT)
                 return EPOLLHUP;
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index f0e9ccf472a9..6a0df7c8a939 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -65,28 +65,6 @@ static const struct proto_ops rose_proto_ops;
 ax25_address rose_callsign;
 
 /*
- * ROSE network devices are virtual network devices encapsulating ROSE
- * frames into AX.25 which will be sent through an AX.25 device, so form a
- * special "super class" of normal net devices; split their locks off into a
- * separate class since they always nest.
- */
-static struct lock_class_key rose_netdev_xmit_lock_key;
-static struct lock_class_key rose_netdev_addr_lock_key;
-
-static void rose_set_lockdep_one(struct net_device *dev,
-                                 struct netdev_queue *txq,
-                                 void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock, &rose_netdev_xmit_lock_key);
-}
-
-static void rose_set_lockdep_key(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock, &rose_netdev_addr_lock_key);
-        netdev_for_each_tx_queue(dev, rose_set_lockdep_one, NULL);
-}
-
-/*
  *      Convert a ROSE address into text.
  */
 char *rose2asc(char *buf, const rose_address *addr)
@@ -1533,7 +1511,6 @@ static int __init rose_proto_init(void)
                         free_netdev(dev);
                         goto fail;
                 }
-                rose_set_lockdep_key(dev);
                 dev_rose[i] = dev;
         }
 
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index ecc17dabec8f..7c7d10f2e0c1 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -601,6 +601,7 @@ struct rxrpc_call {
         int                     debug_id;       /* debug ID for printks */
         unsigned short          rx_pkt_offset;  /* Current recvmsg packet offset */
         unsigned short          rx_pkt_len;     /* Current recvmsg packet len */
+        bool                    rx_pkt_last;    /* Current recvmsg packet is last */
 
         /* Rx/Tx circular buffer, depending on phase.
          *
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index a4090797c9b2..8578c39ec839 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -267,11 +267,13 @@ static int rxrpc_verify_packet(struct rxrpc_call *call, struct sk_buff *skb,
  */
 static int rxrpc_locate_data(struct rxrpc_call *call, struct sk_buff *skb,
                              u8 *_annotation,
-                             unsigned int *_offset, unsigned int *_len)
+                             unsigned int *_offset, unsigned int *_len,
+                             bool *_last)
 {
         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
         unsigned int offset = sizeof(struct rxrpc_wire_header);
         unsigned int len;
+        bool last = false;
         int ret;
         u8 annotation = *_annotation;
         u8 subpacket = annotation & RXRPC_RX_ANNO_SUBPACKET;
@@ -281,6 +283,8 @@ static int rxrpc_locate_data(struct rxrpc_call *call, struct sk_buff *skb,
         len = skb->len - offset;
         if (subpacket < sp->nr_subpackets - 1)
                 len = RXRPC_JUMBO_DATALEN;
+        else if (sp->rx_flags & RXRPC_SKB_INCL_LAST)
+                last = true;
 
         if (!(annotation & RXRPC_RX_ANNO_VERIFIED)) {
                 ret = rxrpc_verify_packet(call, skb, annotation, offset, len);
@@ -291,6 +295,7 @@ static int rxrpc_locate_data(struct rxrpc_call *call, struct sk_buff *skb,
 
         *_offset = offset;
         *_len = len;
+        *_last = last;
         call->security->locate_data(call, skb, _offset, _len);
         return 0;
 }
@@ -309,7 +314,7 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
         rxrpc_serial_t serial;
         rxrpc_seq_t hard_ack, top, seq;
         size_t remain;
-        bool last;
+        bool rx_pkt_last;
         unsigned int rx_pkt_offset, rx_pkt_len;
         int ix, copy, ret = -EAGAIN, ret2;
 
@@ -319,6 +324,7 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
 
         rx_pkt_offset = call->rx_pkt_offset;
         rx_pkt_len = call->rx_pkt_len;
+        rx_pkt_last = call->rx_pkt_last;
 
         if (call->state >= RXRPC_CALL_SERVER_ACK_REQUEST) {
                 seq = call->rx_hard_ack;
@@ -329,6 +335,7 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
         /* Barriers against rxrpc_input_data(). */
         hard_ack = call->rx_hard_ack;
         seq = hard_ack + 1;
+
         while (top = smp_load_acquire(&call->rx_top),
                before_eq(seq, top)
                ) {
@@ -356,7 +363,8 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
                 if (rx_pkt_offset == 0) {
                         ret2 = rxrpc_locate_data(call, skb,
                                                  &call->rxtx_annotations[ix],
-                                                 &rx_pkt_offset, &rx_pkt_len);
+                                                 &rx_pkt_offset, &rx_pkt_len,
+                                                 &rx_pkt_last);
                         trace_rxrpc_recvmsg(call, rxrpc_recvmsg_next, seq,
                                             rx_pkt_offset, rx_pkt_len, ret2);
                         if (ret2 < 0) {
@@ -396,13 +404,12 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
                 }
 
                 /* The whole packet has been transferred. */
-                last = sp->hdr.flags & RXRPC_LAST_PACKET;
                 if (!(flags & MSG_PEEK))
                         rxrpc_rotate_rx_window(call);
                 rx_pkt_offset = 0;
                 rx_pkt_len = 0;
 
-                if (last) {
+                if (rx_pkt_last) {
                         ASSERTCMP(seq, ==, READ_ONCE(call->rx_top));
                         ret = 1;
                         goto out;
@@ -415,6 +422,7 @@ out:
         if (!(flags & MSG_PEEK)) {
                 call->rx_pkt_offset = rx_pkt_offset;
                 call->rx_pkt_len = rx_pkt_len;
+                call->rx_pkt_last = rx_pkt_last;
         }
 done:
         trace_rxrpc_recvmsg(call, rxrpc_recvmsg_data_return, seq,
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index bf10bdaf5012..8229ed4a67be 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -162,16 +162,20 @@ static int cls_bpf_offload_cmd(struct tcf_proto *tp, struct cls_bpf_prog *prog,
         cls_bpf.name = obj->bpf_name;
         cls_bpf.exts_integrated = obj->exts_integrated;
 
-        if (oldprog)
+        if (oldprog && prog)
                 err = tc_setup_cb_replace(block, tp, TC_SETUP_CLSBPF, &cls_bpf,
                                           skip_sw, &oldprog->gen_flags,
                                           &oldprog->in_hw_count,
                                           &prog->gen_flags, &prog->in_hw_count,
                                           true);
-        else
+        else if (prog)
                 err = tc_setup_cb_add(block, tp, TC_SETUP_CLSBPF, &cls_bpf,
                                       skip_sw, &prog->gen_flags,
                                       &prog->in_hw_count, true);
+        else
+                err = tc_setup_cb_destroy(block, tp, TC_SETUP_CLSBPF, &cls_bpf,
+                                          skip_sw, &oldprog->gen_flags,
+                                          &oldprog->in_hw_count, true);
 
         if (prog && err) {
                 cls_bpf_offload_cmd(tp, oldprog, prog, extack);
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 17bd8f539bc7..8769b4b8807d 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -799,9 +799,6 @@ struct Qdisc_ops pfifo_fast_ops __read_mostly = {
 };
 EXPORT_SYMBOL(pfifo_fast_ops);
 
-static struct lock_class_key qdisc_tx_busylock;
-static struct lock_class_key qdisc_running_key;
-
 struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
                           const struct Qdisc_ops *ops,
                           struct netlink_ext_ack *extack)
@@ -854,17 +851,9 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
         }
 
         spin_lock_init(&sch->busylock);
-        lockdep_set_class(&sch->busylock,
-                          dev->qdisc_tx_busylock ?: &qdisc_tx_busylock);
-
         /* seqlock has the same scope of busylock, for NOLOCK qdisc */
         spin_lock_init(&sch->seqlock);
-        lockdep_set_class(&sch->busylock,
-                          dev->qdisc_tx_busylock ?: &qdisc_tx_busylock);
-
         seqcount_init(&sch->running);
-        lockdep_set_class(&sch->running,
-                          dev->qdisc_running_key ?: &qdisc_running_key);
 
         sch->ops = ops;
         sch->flags = ops->static_flags;
@@ -875,6 +864,12 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
         dev_hold(dev);
         refcount_set(&sch->refcnt, 1);
 
+        if (sch != &noop_qdisc) {
+                lockdep_set_class(&sch->busylock, &dev->qdisc_tx_busylock_key);
+                lockdep_set_class(&sch->seqlock, &dev->qdisc_tx_busylock_key);
+                lockdep_set_class(&sch->running, &dev->qdisc_running_key);
+        }
+
         return sch;
 errout1:
         kfree(p);
@@ -1043,6 +1038,8 @@ static void attach_one_default_qdisc(struct net_device *dev,
 
         if (dev->priv_flags & IFF_NO_QUEUE)
                 ops = &noqueue_qdisc_ops;
+        else if(dev->type == ARPHRD_CAN)
+                ops = &pfifo_fast_ops;
 
         qdisc = qdisc_create_dflt(dev_queue, ops, TC_H_ROOT, NULL);
         if (!qdisc) {
diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
index 23cd1c873a2c..be35f03b657b 100644
--- a/net/sched/sch_hhf.c
+++ b/net/sched/sch_hhf.c
@@ -5,11 +5,11 @@
  * Copyright (C) 2013 Nandita Dukkipati <nanditad@google.com>
  */
 
-#include <linux/jhash.h>
 #include <linux/jiffies.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/vmalloc.h>
+#include <linux/siphash.h>
 #include <net/pkt_sched.h>
 #include <net/sock.h>
 
@@ -126,7 +126,7 @@ struct wdrr_bucket {
 
 struct hhf_sched_data {
         struct wdrr_bucket buckets[WDRR_BUCKET_CNT];
-        u32                perturbation;   /* hash perturbation */
+        siphash_key_t      perturbation;   /* hash perturbation */
         u32                quantum;        /* psched_mtu(qdisc_dev(sch)); */
         u32                drop_overlimit; /* number of times max qdisc packet
                                             * limit was hit
@@ -264,7 +264,7 @@ static enum wdrr_bucket_idx hhf_classify(struct sk_buff *skb, struct Qdisc *sch)
         }
 
         /* Get hashed flow-id of the skb. */
-        hash = skb_get_hash_perturb(skb, q->perturbation);
+        hash = skb_get_hash_perturb(skb, &q->perturbation);
 
         /* Check if this packet belongs to an already established HH flow. */
         flow_pos = hash & HHF_BIT_MASK;
@@ -582,7 +582,7 @@ static int hhf_init(struct Qdisc *sch, struct nlattr *opt,
 
         sch->limit = 1000;
         q->quantum = psched_mtu(qdisc_dev(sch));
-        q->perturbation = prandom_u32();
+        get_random_bytes(&q->perturbation, sizeof(q->perturbation));
         INIT_LIST_HEAD(&q->new_buckets);
         INIT_LIST_HEAD(&q->old_buckets);
 
diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
index d448fe3068e5..4074c50ac3d7 100644
--- a/net/sched/sch_sfb.c
+++ b/net/sched/sch_sfb.c
@@ -18,7 +18,7 @@
 #include <linux/errno.h>
 #include <linux/skbuff.h>
 #include <linux/random.h>
-#include <linux/jhash.h>
+#include <linux/siphash.h>
 #include <net/ip.h>
 #include <net/pkt_sched.h>
 #include <net/pkt_cls.h>
@@ -45,7 +45,7 @@ struct sfb_bucket {
  * (Section 4.4 of SFB reference : moving hash functions)
  */
 struct sfb_bins {
-        u32               perturbation; /* jhash perturbation */
+        siphash_key_t     perturbation; /* siphash key */
         struct sfb_bucket bins[SFB_LEVELS][SFB_NUMBUCKETS];
 };
 
@@ -217,7 +217,8 @@ static u32 sfb_compute_qlen(u32 *prob_r, u32 *avgpm_r, const struct sfb_sched_da
 
 static void sfb_init_perturbation(u32 slot, struct sfb_sched_data *q)
 {
-        q->bins[slot].perturbation = prandom_u32();
+        get_random_bytes(&q->bins[slot].perturbation,
+                         sizeof(q->bins[slot].perturbation));
 }
 
 static void sfb_swap_slot(struct sfb_sched_data *q)
@@ -314,9 +315,9 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                 /* If using external classifiers, get result and record it. */
                 if (!sfb_classify(skb, fl, &ret, &salt))
                         goto other_drop;
-                sfbhash = jhash_1word(salt, q->bins[slot].perturbation);
+                sfbhash = siphash_1u32(salt, &q->bins[slot].perturbation);
         } else {
-                sfbhash = skb_get_hash_perturb(skb, q->bins[slot].perturbation);
+                sfbhash = skb_get_hash_perturb(skb, &q->bins[slot].perturbation);
         }
 
 
@@ -352,7 +353,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                 /* Inelastic flow */
                 if (q->double_buffering) {
                         sfbhash = skb_get_hash_perturb(skb,
-                            q->bins[slot].perturbation);
+                            &q->bins[slot].perturbation);
                         if (!sfbhash)
                                 sfbhash = 1;
                         sfb_skb_cb(skb)->hashes[slot] = sfbhash;
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 68404a9d2ce4..c787d4d46017 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -14,7 +14,7 @@
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/skbuff.h>
-#include <linux/jhash.h>
+#include <linux/siphash.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <net/netlink.h>
@@ -117,7 +117,7 @@ struct sfq_sched_data {
         u8              headdrop;
         u8              maxdepth;       /* limit of packets per flow */
 
-        u32             perturbation;
+        siphash_key_t   perturbation;
         u8              cur_depth;      /* depth of longest slot */
         u8              flags;
         unsigned short  scaled_quantum; /* SFQ_ALLOT_SIZE(quantum) */
@@ -157,7 +157,7 @@ static inline struct sfq_head *sfq_dep_head(struct sfq_sched_data *q, sfq_index
 static unsigned int sfq_hash(const struct sfq_sched_data *q,
                              const struct sk_buff *skb)
 {
-        return skb_get_hash_perturb(skb, q->perturbation) & (q->divisor - 1);
+        return skb_get_hash_perturb(skb, &q->perturbation) & (q->divisor - 1);
 }
 
 static unsigned int sfq_classify(struct sk_buff *skb, struct Qdisc *sch,
@@ -607,9 +607,11 @@ static void sfq_perturbation(struct timer_list *t)
         struct sfq_sched_data *q = from_timer(q, t, perturb_timer);
         struct Qdisc *sch = q->sch;
         spinlock_t *root_lock = qdisc_lock(qdisc_root_sleeping(sch));
+        siphash_key_t nkey;
 
+        get_random_bytes(&nkey, sizeof(nkey));
         spin_lock(root_lock);
-        q->perturbation = prandom_u32();
+        q->perturbation = nkey;
         if (!q->filter_list && q->tail)
                 sfq_rehash(sch);
         spin_unlock(root_lock);
@@ -688,7 +690,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
         del_timer(&q->perturb_timer);
         if (q->perturb_period) {
                 mod_timer(&q->perturb_timer, jiffies + q->perturb_period);
-                q->perturbation = prandom_u32();
+                get_random_bytes(&q->perturbation, sizeof(q->perturbation));
         }
         sch_tree_unlock(sch);
         kfree(p);
@@ -745,7 +747,7 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt,
         q->quantum = psched_mtu(qdisc_dev(sch));
         q->scaled_quantum = SFQ_ALLOT_SIZE(q->quantum);
         q->perturb_period = 0;
-        q->perturbation = prandom_u32();
+        get_random_bytes(&q->perturbation, sizeof(q->perturbation));
 
         if (opt) {
                 int err = sfq_change(sch, opt);
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index 6719a65169d4..2121187229cd 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -1152,7 +1152,7 @@ EXPORT_SYMBOL_GPL(taprio_offload_free);
  * offload state (PENDING, ACTIVE, INACTIVE) so it can be visible in dump().
  * This is left as TODO.
  */
-void taprio_offload_config_changed(struct taprio_sched *q)
+static void taprio_offload_config_changed(struct taprio_sched *q)
 {
         struct sched_gate_list *oper, *admin;
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 5ca0ec0e823c..ffd3262b7a41 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -8476,7 +8476,7 @@ __poll_t sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
         mask = 0;
 
         /* Is there any exceptional events?  */
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                 mask |= EPOLLERR |
                         (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
         if (sk->sk_shutdown & RCV_SHUTDOWN)
@@ -8485,7 +8485,7 @@ __poll_t sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
                 mask |= EPOLLHUP;
 
         /* Is it readable?  Reconsider this code with TCP-style support.  */
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
         /* The association is either gone or not ready.  */
@@ -8871,7 +8871,7 @@ struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags,
                 if (sk_can_busy_loop(sk)) {
                         sk_busy_loop(sk, noblock);
 
-                        if (!skb_queue_empty(&sk->sk_receive_queue))
+                        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                                 continue;
                 }
 
@@ -9306,7 +9306,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
         newinet->inet_rcv_saddr = inet->inet_rcv_saddr;
         newinet->inet_dport = htons(asoc->peer.port);
         newinet->pmtudisc = inet->pmtudisc;
-        newinet->inet_id = asoc->next_tsn ^ jiffies;
+        newinet->inet_id = prandom_u32();
 
         newinet->uc_ttl = inet->uc_ttl;
         newinet->mc_loop = 1;
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 5b932583e407..47946f489fd4 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -123,6 +123,12 @@ struct proto smc_proto6 = {
 };
 EXPORT_SYMBOL_GPL(smc_proto6);
 
+static void smc_restore_fallback_changes(struct smc_sock *smc)
+{
+        smc->clcsock->file->private_data = smc->sk.sk_socket;
+        smc->clcsock->file = NULL;
+}
+
 static int __smc_release(struct smc_sock *smc)
 {
         struct sock *sk = &smc->sk;
@@ -141,6 +147,7 @@ static int __smc_release(struct smc_sock *smc)
                 }
                 sk->sk_state = SMC_CLOSED;
                 sk->sk_state_change(sk);
+                smc_restore_fallback_changes(smc);
         }
 
         sk->sk_prot->unhash(sk);
@@ -700,8 +707,6 @@ static int __smc_connect(struct smc_sock *smc)
         int smc_type;
         int rc = 0;
 
-        sock_hold(&smc->sk); /* sock put in passive closing */
-
         if (smc->use_fallback)
                 return smc_connect_fallback(smc, smc->fallback_rsn);
 
@@ -846,6 +851,8 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr,
         rc = kernel_connect(smc->clcsock, addr, alen, flags);
         if (rc && rc != -EINPROGRESS)
                 goto out;
+
+        sock_hold(&smc->sk); /* sock put in passive closing */
         if (flags & O_NONBLOCK) {
                 if (schedule_work(&smc->connect_work))
                         smc->connect_nonblock = 1;
@@ -1291,8 +1298,8 @@ static void smc_listen_work(struct work_struct *work)
         /* check if RDMA is available */
         if (!ism_supported) { /* SMC_TYPE_R or SMC_TYPE_B */
                 /* prepare RDMA check */
-                memset(&ini, 0, sizeof(ini));
                 ini.is_smcd = false;
+                ini.ism_dev = NULL;
                 ini.ib_lcl = &pclc->lcl;
                 rc = smc_find_rdma_device(new_smc, &ini);
                 if (rc) {
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 88556f0251ab..2ba97ff325a5 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -561,7 +561,7 @@ int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini)
         }
 
         rtnl_lock();
-        nest_lvl = dev_get_nest_level(ndev);
+        nest_lvl = ndev->lower_level;
         for (i = 0; i < nest_lvl; i++) {
                 struct list_head *lower = &ndev->adj_list.lower;
 
diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c
index bab2da8cf17a..2920b006f65c 100644
--- a/net/smc/smc_pnet.c
+++ b/net/smc/smc_pnet.c
@@ -718,7 +718,7 @@ static struct net_device *pnet_find_base_ndev(struct net_device *ndev)
         int i, nest_lvl;
 
         rtnl_lock();
-        nest_lvl = dev_get_nest_level(ndev);
+        nest_lvl = ndev->lower_level;
         for (i = 0; i < nest_lvl; i++) {
                 struct list_head *lower = &ndev->adj_list.lower;
 
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 339e8c077c2d..195b40c5dae4 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -220,7 +220,7 @@ void xprt_destroy_bc(struct rpc_xprt *xprt, unsigned int max_reqs)
                 goto out;
 
         spin_lock_bh(&xprt->bc_pa_lock);
-        xprt->bc_alloc_max -= max_reqs;
+        xprt->bc_alloc_max -= min(max_reqs, xprt->bc_alloc_max);
         list_for_each_entry_safe(req, tmp, &xprt->bc_pa_list, rq_bc_pa_list) {
                 dprintk("RPC:        req=%p\n", req);
                 list_del(&req->rq_bc_pa_list);
@@ -307,8 +307,8 @@ void xprt_free_bc_rqst(struct rpc_rqst *req)
                  */
                 dprintk("RPC:       Last session removed req=%p\n", req);
                 xprt_free_allocation(req);
-                return;
         }
+        xprt_put(xprt);
 }
 
 /*
@@ -339,7 +339,7 @@ found:
                 spin_unlock(&xprt->bc_pa_lock);
                 if (new) {
                         if (req != new)
-                                xprt_free_bc_rqst(new);
+                                xprt_free_allocation(new);
                         break;
                 } else if (req)
                         break;
@@ -368,6 +368,7 @@ void xprt_complete_bc_request(struct rpc_rqst *req, uint32_t copied)
         set_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state);
 
         dprintk("RPC:       add callback request to list\n");
+        xprt_get(xprt);
         spin_lock(&bc_serv->sv_cb_lock);
         list_add(&req->rq_bc_list, &bc_serv->sv_cb_list);
         wake_up(&bc_serv->sv_cb_waitq);
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 8a45b3ccc313..41df4c507193 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1943,6 +1943,11 @@ static void xprt_destroy_cb(struct work_struct *work)
         rpc_destroy_wait_queue(&xprt->backlog);
         kfree(xprt->servername);
         /*
+         * Destroy any existing back channel
+         */
+        xprt_destroy_backchannel(xprt, UINT_MAX);
+
+        /*
          * Tear down transport state and free the rpc_xprt
          */
         xprt->ops->destroy(xprt);
diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
index 50e075fcdd8f..b458bf53ca69 100644
--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -163,6 +163,7 @@ void xprt_rdma_bc_free_rqst(struct rpc_rqst *rqst)
         spin_lock(&xprt->bc_pa_lock);
         list_add_tail(&rqst->rq_bc_pa_list, &xprt->bc_pa_list);
         spin_unlock(&xprt->bc_pa_lock);
+        xprt_put(xprt);
 }
 
 static struct rpc_rqst *rpcrdma_bc_rqst_get(struct rpcrdma_xprt *r_xprt)
@@ -259,6 +260,7 @@ void rpcrdma_bc_receive_call(struct rpcrdma_xprt *r_xprt,
 
         /* Queue rqst for ULP's callback service */
         bc_serv = xprt->bc_serv;
+        xprt_get(xprt);
         spin_lock(&bc_serv->sv_cb_lock);
         list_add(&rqst->rq_bc_list, &bc_serv->sv_cb_list);
         spin_unlock(&bc_serv->sv_cb_lock);
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index f8bbc4aab213..4b92b196cfa6 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -740,7 +740,7 @@ static __poll_t tipc_poll(struct file *file, struct socket *sock,
                 /* fall through */
         case TIPC_LISTEN:
         case TIPC_CONNECTING:
-                if (!skb_queue_empty(&sk->sk_receive_queue))
+                if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                         revents |= EPOLLIN | EPOLLRDNORM;
                 break;
         case TIPC_OPEN:
@@ -748,7 +748,7 @@ static __poll_t tipc_poll(struct file *file, struct socket *sock,
                         revents |= EPOLLOUT;
                 if (!tipc_sk_type_connectionless(sk))
                         break;
-                if (skb_queue_empty(&sk->sk_receive_queue))
+                if (skb_queue_empty_lockless(&sk->sk_receive_queue))
                         break;
                 revents |= EPOLLIN | EPOLLRDNORM;
                 break;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 67e87db5877f..0d8da809bea2 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2599,7 +2599,7 @@ static __poll_t unix_poll(struct file *file, struct socket *sock, poll_table *wa
                 mask |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
 
         /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
         /* Connection-based need to check for termination and startup */
@@ -2628,7 +2628,7 @@ static __poll_t unix_dgram_poll(struct file *file, struct socket *sock,
         mask = 0;
 
         /* exceptional events? */
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                 mask |= EPOLLERR |
                         (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
 
@@ -2638,7 +2638,7 @@ static __poll_t unix_dgram_poll(struct file *file, struct socket *sock,
                 mask |= EPOLLHUP;
 
         /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
         /* Connection-based need to check for termination and startup */
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 2ab43b2bba31..582a3e4dfce2 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -870,7 +870,7 @@ static __poll_t vsock_poll(struct file *file, struct socket *sock,
                  * the queue and write as long as the socket isn't shutdown for
                  * sending.
                  */
-                if (!skb_queue_empty(&sk->sk_receive_queue) ||
+                if (!skb_queue_empty_lockless(&sk->sk_receive_queue) ||
                     (sk->sk_shutdown & RCV_SHUTDOWN)) {
                         mask |= EPOLLIN | EPOLLRDNORM;
                 }
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index e851cafd8e2f..fcac5c6366e1 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -204,6 +204,11 @@ bool cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef)
                 return false;
         }
 
+        /* channel 14 is only for IEEE 802.11b */
+        if (chandef->center_freq1 == 2484 &&
+            chandef->width != NL80211_CHAN_WIDTH_20_NOHT)
+                return false;
+
         if (cfg80211_chandef_is_edmg(chandef) &&
             !cfg80211_edmg_chandef_valid(chandef))
                 return false;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 4453dd375de9..7b72286922f7 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -393,7 +393,7 @@ const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
                                    .len = IEEE80211_MAX_MESH_ID_LEN },
-        [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
+        [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
 
         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 419eb12c1e93..5b4ed5bbc542 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1559,7 +1559,8 @@ bool ieee80211_chandef_to_operating_class(struct cfg80211_chan_def *chandef,
         }
 
         if (freq == 2484) {
-                if (chandef->width > NL80211_CHAN_WIDTH_40)
+                /* channel 14 is only for IEEE 802.11b */
+                if (chandef->width != NL80211_CHAN_WIDTH_20_NOHT)
                         return false;
 
                 *op_class = 82; /* channel 14 */
diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index 16d5f353163a..3049af269fbf 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -27,6 +27,9 @@ void xdp_add_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
 {
         unsigned long flags;
 
+        if (!xs->tx)
+                return;
+
         spin_lock_irqsave(&umem->xsk_list_lock, flags);
         list_add_rcu(&xs->list, &umem->xsk_list);
         spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
@@ -36,6 +39,9 @@ void xdp_del_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
 {
         unsigned long flags;
 
+        if (!xs->tx)
+                return;
+
         spin_lock_irqsave(&umem->xsk_list_lock, flags);
         list_del_rcu(&xs->list);
         spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
index 8a10b43daf74..40b790536def 100644
--- a/security/lockdown/lockdown.c
+++ b/security/lockdown/lockdown.c
@@ -20,6 +20,7 @@ static const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = {
         [LOCKDOWN_NONE] = "none",
         [LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading",
         [LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port",
+        [LOCKDOWN_EFI_TEST] = "/dev/efi_test access",
         [LOCKDOWN_KEXEC] = "kexec of unsigned images",
         [LOCKDOWN_HIBERNATION] = "hibernation",
         [LOCKDOWN_PCI_ACCESS] = "direct PCI access",
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 5c9fbf3f4340..6b724d2ee2de 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -226,7 +226,8 @@ static int snd_timer_check_master(struct snd_timer_instance *master)
         return 0;
 }
 
-static int snd_timer_close_locked(struct snd_timer_instance *timeri);
+static int snd_timer_close_locked(struct snd_timer_instance *timeri,
+                                  struct device **card_devp_to_put);
 
 /*
  * open a timer instance
@@ -238,6 +239,7 @@ int snd_timer_open(struct snd_timer_instance **ti,
 {
         struct snd_timer *timer;
         struct snd_timer_instance *timeri = NULL;
+        struct device *card_dev_to_put = NULL;
         int err;
 
         mutex_lock(&register_mutex);
@@ -261,7 +263,7 @@ int snd_timer_open(struct snd_timer_instance **ti,
                 list_add_tail(&timeri->open_list, &snd_timer_slave_list);
                 err = snd_timer_check_slave(timeri);
                 if (err < 0) {
-                        snd_timer_close_locked(timeri);
+                        snd_timer_close_locked(timeri, &card_dev_to_put);
                         timeri = NULL;
                 }
                 goto unlock;
@@ -313,7 +315,7 @@ int snd_timer_open(struct snd_timer_instance **ti,
                         timeri = NULL;
 
                         if (timer->card)
-                                put_device(&timer->card->card_dev);
+                                card_dev_to_put = &timer->card->card_dev;
                         module_put(timer->module);
                         goto unlock;
                 }
@@ -323,12 +325,15 @@ int snd_timer_open(struct snd_timer_instance **ti,
         timer->num_instances++;
         err = snd_timer_check_master(timeri);
         if (err < 0) {
-                snd_timer_close_locked(timeri);
+                snd_timer_close_locked(timeri, &card_dev_to_put);
                 timeri = NULL;
         }
 
  unlock:
         mutex_unlock(&register_mutex);
+        /* put_device() is called after unlock for avoiding deadlock */
+        if (card_dev_to_put)
+                put_device(card_dev_to_put);
         *ti = timeri;
         return err;
 }
@@ -338,7 +343,8 @@ EXPORT_SYMBOL(snd_timer_open);
  * close a timer instance
  * call this with register_mutex down.
  */
-static int snd_timer_close_locked(struct snd_timer_instance *timeri)
+static int snd_timer_close_locked(struct snd_timer_instance *timeri,
+                                  struct device **card_devp_to_put)
 {
         struct snd_timer *timer = timeri->timer;
         struct snd_timer_instance *slave, *tmp;
@@ -395,7 +401,7 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri)
                         timer->hw.close(timer);
                 /* release a card refcount for safe disconnection */
                 if (timer->card)
-                        put_device(&timer->card->card_dev);
+                        *card_devp_to_put = &timer->card->card_dev;
                 module_put(timer->module);
         }
 
@@ -407,14 +413,18 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri)
  */
 int snd_timer_close(struct snd_timer_instance *timeri)
 {
+        struct device *card_dev_to_put = NULL;
         int err;
 
         if (snd_BUG_ON(!timeri))
                 return -ENXIO;
 
         mutex_lock(&register_mutex);
-        err = snd_timer_close_locked(timeri);
+        err = snd_timer_close_locked(timeri, &card_dev_to_put);
         mutex_unlock(&register_mutex);
+        /* put_device() is called after unlock for avoiding deadlock */
+        if (card_dev_to_put)
+                put_device(card_dev_to_put);
         return err;
 }
 EXPORT_SYMBOL(snd_timer_close);
diff --git a/sound/firewire/bebob/bebob_stream.c b/sound/firewire/bebob/bebob_stream.c
index 73fee991bd75..6c1497d9f52b 100644
--- a/sound/firewire/bebob/bebob_stream.c
+++ b/sound/firewire/bebob/bebob_stream.c
@@ -252,8 +252,7 @@ end:
         return err;
 }
 
-static unsigned int
-map_data_channels(struct snd_bebob *bebob, struct amdtp_stream *s)
+static int map_data_channels(struct snd_bebob *bebob, struct amdtp_stream *s)
 {
         unsigned int sec, sections, ch, channels;
         unsigned int pcm, midi, location;
diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c
index d3999e7b0705..7e7be8e4dcf9 100644
--- a/sound/hda/hdac_controller.c
+++ b/sound/hda/hdac_controller.c
@@ -447,8 +447,6 @@ static void azx_int_disable(struct hdac_bus *bus)
         list_for_each_entry(azx_dev, &bus->stream_list, list)
                 snd_hdac_stream_updateb(azx_dev, SD_CTL, SD_INT_MASK, 0);
 
-        synchronize_irq(bus->irq);
-
         /* disable SIE for all streams */
         snd_hdac_chip_writeb(bus, INTCTL, 0);
 
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index a815bc811799..cf53fbd872ee 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1348,9 +1348,9 @@ static int azx_free(struct azx *chip)
         }
 
         if (bus->chip_init) {
-                azx_stop_chip(chip);
                 azx_clear_irq_pending(chip);
                 azx_stop_all_streams(chip);
+                azx_stop_chip(chip);
         }
 
         if (bus->irq >= 0)
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 795cbda32cbb..b72553710ffb 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -145,6 +145,7 @@ struct hdmi_spec {
         struct snd_array pins; /* struct hdmi_spec_per_pin */
         struct hdmi_pcm pcm_rec[16];
         struct mutex pcm_lock;
+        struct mutex bind_lock; /* for audio component binding */
         /* pcm_bitmap means which pcms have been assigned to pins*/
         unsigned long pcm_bitmap;
         int pcm_used;   /* counter of pcm_rec[] */
@@ -2258,7 +2259,7 @@ static int generic_hdmi_init(struct hda_codec *codec)
         struct hdmi_spec *spec = codec->spec;
         int pin_idx;
 
-        mutex_lock(&spec->pcm_lock);
+        mutex_lock(&spec->bind_lock);
         spec->use_jack_detect = !codec->jackpoll_interval;
         for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) {
                 struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
@@ -2275,7 +2276,7 @@ static int generic_hdmi_init(struct hda_codec *codec)
                         snd_hda_jack_detect_enable_callback(codec, pin_nid,
                                                             jack_callback);
         }
-        mutex_unlock(&spec->pcm_lock);
+        mutex_unlock(&spec->bind_lock);
         return 0;
 }
 
@@ -2382,6 +2383,7 @@ static int alloc_generic_hdmi(struct hda_codec *codec)
         spec->ops = generic_standard_hdmi_ops;
         spec->dev_num = 1;      /* initialize to 1 */
         mutex_init(&spec->pcm_lock);
+        mutex_init(&spec->bind_lock);
         snd_hdac_register_chmap_ops(&codec->core, &spec->chmap);
 
         spec->chmap.ops.get_chmap = hdmi_get_chmap;
@@ -2451,7 +2453,7 @@ static void generic_acomp_notifier_set(struct drm_audio_component *acomp,
         int i;
 
         spec = container_of(acomp->audio_ops, struct hdmi_spec, drm_audio_ops);
-        mutex_lock(&spec->pcm_lock);
+        mutex_lock(&spec->bind_lock);
         spec->use_acomp_notifier = use_acomp;
         spec->codec->relaxed_resume = use_acomp;
         /* reprogram each jack detection logic depending on the notifier */
@@ -2461,7 +2463,7 @@ static void generic_acomp_notifier_set(struct drm_audio_component *acomp,
                                               get_pin(spec, i)->pin_nid,
                                               use_acomp);
         }
-        mutex_unlock(&spec->pcm_lock);
+        mutex_unlock(&spec->bind_lock);
 }
 
 /* enable / disable the notifier via master bind / unbind */
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 085a2f95e076..80f66ba85f87 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -409,6 +409,9 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
         case 0x10ec0672:
                 alc_update_coef_idx(codec, 0xd, 0, 1<<14); /* EAPD Ctrl */
                 break;
+        case 0x10ec0623:
+                alc_update_coef_idx(codec, 0x19, 1<<13, 0);
+                break;
         case 0x10ec0668:
                 alc_update_coef_idx(codec, 0x7, 3<<13, 0);
                 break;
@@ -2920,6 +2923,7 @@ enum {
         ALC269_TYPE_ALC225,
         ALC269_TYPE_ALC294,
         ALC269_TYPE_ALC300,
+        ALC269_TYPE_ALC623,
         ALC269_TYPE_ALC700,
 };
 
@@ -2955,6 +2959,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
         case ALC269_TYPE_ALC225:
         case ALC269_TYPE_ALC294:
         case ALC269_TYPE_ALC300:
+        case ALC269_TYPE_ALC623:
         case ALC269_TYPE_ALC700:
                 ssids = alc269_ssids;
                 break;
@@ -7216,6 +7221,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
         SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
         SND_PCI_QUIRK(0x17aa, 0x3151, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
+        SND_PCI_QUIRK(0x17aa, 0x3176, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
+        SND_PCI_QUIRK(0x17aa, 0x3178, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
         SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
         SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
         SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
@@ -8017,6 +8024,9 @@ static int patch_alc269(struct hda_codec *codec)
                 spec->codec_variant = ALC269_TYPE_ALC300;
                 spec->gen.mixer_nid = 0; /* no loopback on ALC300 */
                 break;
+        case 0x10ec0623:
+                spec->codec_variant = ALC269_TYPE_ALC623;
+                break;
         case 0x10ec0700:
         case 0x10ec0701:
         case 0x10ec0703:
@@ -9218,6 +9228,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
         HDA_CODEC_ENTRY(0x10ec0298, "ALC298", patch_alc269),
         HDA_CODEC_ENTRY(0x10ec0299, "ALC299", patch_alc269),
         HDA_CODEC_ENTRY(0x10ec0300, "ALC300", patch_alc269),
+        HDA_CODEC_ENTRY(0x10ec0623, "ALC623", patch_alc269),
         HDA_CODEC_REV_ENTRY(0x10ec0861, 0x100340, "ALC660", patch_alc861),
         HDA_CODEC_ENTRY(0x10ec0660, "ALC660-VD", patch_alc861vd),
         HDA_CODEC_ENTRY(0x10ec0861, "ALC861", patch_alc861),
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index fbfde996fee7..0bbe1201a6ac 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1657,6 +1657,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
         case 0x23ba:  /* Playback Designs */
         case 0x25ce:  /* Mytek devices */
         case 0x278b:  /* Rotel? */
+        case 0x292b:  /* Gustard/Ess based devices */
         case 0x2ab6:  /* T+A devices */
         case 0x3842:  /* EVGA */
         case 0xc502:  /* HiBy devices */
diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py
index 15a666329a34..1afa22c88e42 100755
--- a/tools/testing/selftests/bpf/test_offload.py
+++ b/tools/testing/selftests/bpf/test_offload.py
@@ -22,6 +22,7 @@ import os
 import pprint
 import random
 import re
+import stat
 import string
 import struct
 import subprocess
@@ -311,7 +312,11 @@ class DebugfsDir:
         for f in out.split():
             if f == "ports":
                 continue
+
             p = os.path.join(path, f)
+            if not os.stat(p).st_mode & stat.S_IRUSR:
+                continue
+
             if os.path.isfile(p):
                 _, out = cmd('cat %s/%s' % (path, f))
                 dfs[f] = out.strip()
diff --git a/tools/testing/selftests/bpf/test_tc_edt.sh b/tools/testing/selftests/bpf/test_tc_edt.sh
index f38567ef694b..daa7d1b8d309 100755
--- a/tools/testing/selftests/bpf/test_tc_edt.sh
+++ b/tools/testing/selftests/bpf/test_tc_edt.sh
@@ -59,7 +59,7 @@ ip netns exec ${NS_SRC} tc filter add dev veth_src egress \
 
 # start the listener
 ip netns exec ${NS_DST} bash -c \
-        "nc -4 -l -s ${IP_DST} -p 9000 >/dev/null &"
+        "nc -4 -l -p 9000 >/dev/null &"
 declare -i NC_PID=$!
 sleep 1
 
diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
index c4ba0ff4a53f..76c1897e6352 100755
--- a/tools/testing/selftests/net/fib_tests.sh
+++ b/tools/testing/selftests/net/fib_tests.sh
@@ -1438,6 +1438,27 @@ ipv4_addr_metric_test()
         fi
         log_test $rc 0 "Prefix route with metric on link up"
 
+        # explicitly check for metric changes on edge scenarios
+        run_cmd "$IP addr flush dev dummy2"
+        run_cmd "$IP addr add dev dummy2 172.16.104.0/24 metric 259"
+        run_cmd "$IP addr change dev dummy2 172.16.104.0/24 metric 260"
+        rc=$?
+        if [ $rc -eq 0 ]; then
+                check_route "172.16.104.0/24 dev dummy2 proto kernel scope link src 172.16.104.0 metric 260"
+                rc=$?
+        fi
+        log_test $rc 0 "Modify metric of .0/24 address"
+
+        run_cmd "$IP addr flush dev dummy2"
+        run_cmd "$IP addr add dev dummy2 172.16.104.1/32 peer 172.16.104.2 metric 260"
+        run_cmd "$IP addr change dev dummy2 172.16.104.1/32 peer 172.16.104.2 metric 261"
+        rc=$?
+        if [ $rc -eq 0 ]; then
+                check_route "172.16.104.2 dev dummy2 proto kernel scope link src 172.16.104.1 metric 261"
+                rc=$?
+        fi
+        log_test $rc 0 "Modify metric of address with peer route"
+
         $IP li del dummy1
         $IP li del dummy2
         cleanup
diff --git a/tools/testing/selftests/net/l2tp.sh b/tools/testing/selftests/net/l2tp.sh
index 5782433886fc..5782433886fc 100644..100755
--- a/tools/testing/selftests/net/l2tp.sh
+++ b/tools/testing/selftests/net/l2tp.sh
diff --git a/tools/testing/selftests/net/reuseport_dualstack.c b/tools/testing/selftests/net/reuseport_dualstack.c
index fe3230c55986..fb7a59ed759e 100644
--- a/tools/testing/selftests/net/reuseport_dualstack.c
+++ b/tools/testing/selftests/net/reuseport_dualstack.c
@@ -129,7 +129,7 @@ static void test(int *rcv_fds, int count, int proto)
 {
         struct epoll_event ev;
         int epfd, i, test_fd;
-        uint16_t test_family;
+        int test_family;
         socklen_t len;
 
         epfd = epoll_create(1);
@@ -146,6 +146,7 @@ static void test(int *rcv_fds, int count, int proto)
         send_from_v4(proto);
 
         test_fd = receive_once(epfd, proto);
+        len = sizeof(test_family);
         if (getsockopt(test_fd, SOL_SOCKET, SO_DOMAIN, &test_family, &len))
                 error(1, errno, "failed to read socket domain");
         if (test_family != AF_INET)
diff --git a/tools/usb/usbip/libsrc/usbip_device_driver.c b/tools/usb/usbip/libsrc/usbip_device_driver.c
index 051d7d3f443b..927a151fa9aa 100644
--- a/tools/usb/usbip/libsrc/usbip_device_driver.c
+++ b/tools/usb/usbip/libsrc/usbip_device_driver.c
@@ -69,7 +69,7 @@ int read_usb_vudc_device(struct udev_device *sdev, struct usbip_usb_device *dev)
         FILE *fd = NULL;
         struct udev_device *plat;
         const char *speed;
-        int ret = 0;
+        size_t ret;
 
         plat = udev_device_get_parent(sdev);
         path = udev_device_get_syspath(plat);
@@ -79,8 +79,10 @@ int read_usb_vudc_device(struct udev_device *sdev, struct usbip_usb_device *dev)
         if (!fd)
                 return -1;
         ret = fread((char *) &descr, sizeof(descr), 1, fd);
-        if (ret < 0)
+        if (ret != 1) {
+                err("Cannot read vudc device descr file: %s", strerror(errno));
                 goto err;
+        }
         fclose(fd);
 
         copy_descr_attr(dev, &descr, bDeviceClass);
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 67ef3f2e19e8..d6f0696d98ef 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -627,8 +627,9 @@ static int kvm_create_vm_debugfs(struct kvm *kvm, int fd)
 
 static struct kvm *kvm_create_vm(unsigned long type)
 {
-        int r, i;
         struct kvm *kvm = kvm_arch_alloc_vm();
+        int r = -ENOMEM;
+        int i;
 
         if (!kvm)
                 return ERR_PTR(-ENOMEM);
@@ -640,44 +641,45 @@ static struct kvm *kvm_create_vm(unsigned long type)
         mutex_init(&kvm->lock);
         mutex_init(&kvm->irq_lock);
         mutex_init(&kvm->slots_lock);
-        refcount_set(&kvm->users_count, 1);
         INIT_LIST_HEAD(&kvm->devices);
 
-        r = kvm_arch_init_vm(kvm, type);
-        if (r)
-                goto out_err_no_disable;
-
-        r = hardware_enable_all();
-        if (r)
-                goto out_err_no_disable;
-
-#ifdef CONFIG_HAVE_KVM_IRQFD
-        INIT_HLIST_HEAD(&kvm->irq_ack_notifier_list);
-#endif
-
         BUILD_BUG_ON(KVM_MEM_SLOTS_NUM > SHRT_MAX);
 
-        r = -ENOMEM;
         for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) {
                 struct kvm_memslots *slots = kvm_alloc_memslots();
+
                 if (!slots)
-                        goto out_err_no_srcu;
+                        goto out_err_no_arch_destroy_vm;
                 /* Generations must be different for each address space. */
                 slots->generation = i;
                 rcu_assign_pointer(kvm->memslots[i], slots);
         }
 
-        if (init_srcu_struct(&kvm->srcu))
-                goto out_err_no_srcu;
-        if (init_srcu_struct(&kvm->irq_srcu))
-                goto out_err_no_irq_srcu;
         for (i = 0; i < KVM_NR_BUSES; i++) {
                 rcu_assign_pointer(kvm->buses[i],
                         kzalloc(sizeof(struct kvm_io_bus), GFP_KERNEL_ACCOUNT));
                 if (!kvm->buses[i])
-                        goto out_err;
+                        goto out_err_no_arch_destroy_vm;
         }
 
+        refcount_set(&kvm->users_count, 1);
+        r = kvm_arch_init_vm(kvm, type);
+        if (r)
+                goto out_err_no_arch_destroy_vm;
+
+        r = hardware_enable_all();
+        if (r)
+                goto out_err_no_disable;
+
+#ifdef CONFIG_HAVE_KVM_IRQFD
+        INIT_HLIST_HEAD(&kvm->irq_ack_notifier_list);
+#endif
+
+        if (init_srcu_struct(&kvm->srcu))
+                goto out_err_no_srcu;
+        if (init_srcu_struct(&kvm->irq_srcu))
+                goto out_err_no_irq_srcu;
+
         r = kvm_init_mmu_notifier(kvm);
         if (r)
                 goto out_err;
@@ -697,7 +699,9 @@ out_err_no_irq_srcu:
 out_err_no_srcu:
         hardware_disable_all();
 out_err_no_disable:
-        refcount_set(&kvm->users_count, 0);
+        kvm_arch_destroy_vm(kvm);
+        WARN_ON_ONCE(!refcount_dec_and_test(&kvm->users_count));
+out_err_no_arch_destroy_vm:
         for (i = 0; i < KVM_NR_BUSES; i++)
                 kfree(kvm_get_bus(kvm, i));
         for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++)