Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Minor comment merge conflict in mlx5.

Staging driver has a fixup due to the skb->xmit_more changes
in 'net-next', but was removed in 'net'.

Signed-off-by: David S. Miller <davem@davemloft.net>

527 files changed, 4631 insertions, 6928 deletions

diff --git a/.mailmap b/.mailmap
index 37e1847c7988..ae2bcad06f4b 100644
--- a/.mailmap
+++ b/.mailmap
@@ -156,6 +156,8 @@ Morten Welinder <welinder@darter.rentec.com>
 Morten Welinder <welinder@troll.com>
 Mythri P K <mythripk@ti.com>
 Nguyen Anh Quynh <aquynh@gmail.com>
+Nicolas Pitre <nico@fluxnic.net> <nicolas.pitre@linaro.org>
+Nicolas Pitre <nico@fluxnic.net> <nico@linaro.org>
 Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
 Patrick Mochel <mochel@digitalimplant.org>
 Paul Burton <paul.burton@mips.com> <paul.burton@imgtec.com>
@@ -224,3 +226,5 @@ Yakir Yang <kuankuan.y@gmail.com> <ykk@rock-chips.com>
 Yusuke Goda <goda.yusuke@renesas.com>
 Gustavo Padovan <gustavo@las.ic.unicamp.br>
 Gustavo Padovan <padovan@profusion.mobi>
+Changbin Du <changbin.du@intel.com> <changbin.du@intel.com>
+Changbin Du <changbin.du@intel.com> <changbin.du@gmail.com>
diff --git a/Documentation/bpf/btf.rst b/Documentation/bpf/btf.rst
index 9a60a5d60e38..7313d354f20e 100644
--- a/Documentation/bpf/btf.rst
+++ b/Documentation/bpf/btf.rst
@@ -148,16 +148,16 @@ The ``btf_type.size * 8`` must be equal to or greater than ``BTF_INT_BITS()``
 for the type. The maximum value of ``BTF_INT_BITS()`` is 128.
 
 The ``BTF_INT_OFFSET()`` specifies the starting bit offset to calculate values
-for this int. For example, a bitfield struct member has: * btf member bit
-offset 100 from the start of the structure, * btf member pointing to an int
-type, * the int type has ``BTF_INT_OFFSET() = 2`` and ``BTF_INT_BITS() = 4``
+for this int. For example, a bitfield struct member has:
+ * btf member bit offset 100 from the start of the structure,
+ * btf member pointing to an int type,
+ * the int type has ``BTF_INT_OFFSET() = 2`` and ``BTF_INT_BITS() = 4``
 
 Then in the struct memory layout, this member will occupy ``4`` bits starting
 from bits ``100 + 2 = 102``.
 
 Alternatively, the bitfield struct member can be the following to access the
 same bits as the above:
-
  * btf member bit offset 102,
  * btf member pointing to an int type,
  * the int type has ``BTF_INT_OFFSET() = 0`` and ``BTF_INT_BITS() = 4``
diff --git a/Documentation/devicetree/bindings/hwmon/adc128d818.txt b/Documentation/devicetree/bindings/hwmon/adc128d818.txt
index 08bab0e94d25..d0ae46d7bac3 100644
--- a/Documentation/devicetree/bindings/hwmon/adc128d818.txt
+++ b/Documentation/devicetree/bindings/hwmon/adc128d818.txt
@@ -26,7 +26,7 @@ Required node properties:
 
 Optional node properties:
 
- - ti,mode:     Operation mode (see above).
+ - ti,mode:     Operation mode (u8) (see above).
 
 
 Example (operation mode 2):
@@ -34,5 +34,5 @@ Example (operation mode 2):
         adc128d818@1d {
                 compatible = "ti,adc128d818";
                 reg = <0x1d>;
-                ti,mode = <2>;
+                ti,mode = /bits/ 8 <2>;
         };
diff --git a/Documentation/devicetree/bindings/i2c/i2c-xscale.txt b/Documentation/devicetree/bindings/i2c/i2c-iop3xx.txt
index dcc8390e0d24..dcc8390e0d24 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-xscale.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-iop3xx.txt
diff --git a/Documentation/devicetree/bindings/i2c/i2c-mtk.txt b/Documentation/devicetree/bindings/i2c/i2c-mt65xx.txt
index ee4c32454198..ee4c32454198 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-mtk.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-mt65xx.txt
diff --git a/Documentation/devicetree/bindings/i2c/i2c-st-ddci2c.txt b/Documentation/devicetree/bindings/i2c/i2c-stu300.txt
index bd81a482634f..bd81a482634f 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-st-ddci2c.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-stu300.txt
diff --git a/Documentation/devicetree/bindings/i2c/i2c-sunxi-p2wi.txt b/Documentation/devicetree/bindings/i2c/i2c-sun6i-p2wi.txt
index 49df0053347a..49df0053347a 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-sunxi-p2wi.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-sun6i-p2wi.txt
diff --git a/Documentation/devicetree/bindings/i2c/i2c-vt8500.txt b/Documentation/devicetree/bindings/i2c/i2c-wmt.txt
index 94a425eaa6c7..94a425eaa6c7 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-vt8500.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-wmt.txt
diff --git a/Documentation/devicetree/bindings/serial/mtk-uart.txt b/Documentation/devicetree/bindings/serial/mtk-uart.txt
index 742cb470595b..bcfb13194f16 100644
--- a/Documentation/devicetree/bindings/serial/mtk-uart.txt
+++ b/Documentation/devicetree/bindings/serial/mtk-uart.txt
@@ -16,6 +16,7 @@ Required properties:
   * "mediatek,mt8127-uart" for MT8127 compatible UARTS
   * "mediatek,mt8135-uart" for MT8135 compatible UARTS
   * "mediatek,mt8173-uart" for MT8173 compatible UARTS
+  * "mediatek,mt8183-uart", "mediatek,mt6577-uart" for MT8183 compatible UARTS
   * "mediatek,mt6577-uart" for MT6577 and all of the above
 
 - reg: The base address of the UART register bank.
diff --git a/Documentation/filesystems/mount_api.txt b/Documentation/filesystems/mount_api.txt
index 944d1965e917..00ff0cfccfa7 100644
--- a/Documentation/filesystems/mount_api.txt
+++ b/Documentation/filesystems/mount_api.txt
@@ -12,11 +12,13 @@ CONTENTS
 
  (4) Filesystem context security.
 
- (5) VFS filesystem context operations.
+ (5) VFS filesystem context API.
 
- (6) Parameter description.
+ (6) Superblock creation helpers.
 
- (7) Parameter helper functions.
+ (7) Parameter description.
+
+ (8) Parameter helper functions.
 
 
 ========
@@ -41,12 +43,15 @@ The creation of new mounts is now to be done in a multistep process:
 
  (7) Destroy the context.
 
-To support this, the file_system_type struct gains a new field:
+To support this, the file_system_type struct gains two new fields:
 
         int (*init_fs_context)(struct fs_context *fc);
+        const struct fs_parameter_description *parameters;
 
-which is invoked to set up the filesystem-specific parts of a filesystem
-context, including the additional space.
+The first is invoked to set up the filesystem-specific parts of a filesystem
+context, including the additional space, and the second points to the
+parameter description for validation at registration time and querying by a
+future system call.
 
 Note that security initialisation is done *after* the filesystem is called so
 that the namespaces may be adjusted first.
@@ -73,9 +78,9 @@ context.  This is represented by the fs_context structure:
                 void                    *s_fs_info;
                 unsigned int            sb_flags;
                 unsigned int            sb_flags_mask;
+                unsigned int            s_iflags;
+                unsigned int            lsm_flags;
                 enum fs_context_purpose purpose:8;
-                bool                    sloppy:1;
-                bool                    silent:1;
                 ...
         };
 
@@ -141,6 +146,10 @@ The fs_context fields are as follows:
 
      Which bits SB_* flags are to be set/cleared in super_block::s_flags.
 
+ (*) unsigned int s_iflags
+
+     These will be bitwise-OR'd with s->s_iflags when a superblock is created.
+
  (*) enum fs_context_purpose
 
      This indicates the purpose for which the context is intended.  The
@@ -150,17 +159,6 @@ The fs_context fields are as follows:
         FS_CONTEXT_FOR_SUBMOUNT         -- New automatic submount of extant mount
         FS_CONTEXT_FOR_RECONFIGURE      -- Change an existing mount
 
- (*) bool sloppy
- (*) bool silent
-
-     These are set if the sloppy or silent mount options are given.
-
-     [NOTE] sloppy is probably unnecessary when userspace passes over one
-     option at a time since the error can just be ignored if userspace deems it
-     to be unimportant.
-
-     [NOTE] silent is probably redundant with sb_flags & SB_SILENT.
-
 The mount context is created by calling vfs_new_fs_context() or
 vfs_dup_fs_context() and is destroyed with put_fs_context().  Note that the
 structure is not refcounted.
@@ -342,28 +340,47 @@ number of operations used by the new mount code for this purpose:
      It should return 0 on success or a negative error code on failure.
 
 
-=================================
-VFS FILESYSTEM CONTEXT OPERATIONS
-=================================
+==========================
+VFS FILESYSTEM CONTEXT API
+==========================
 
-There are four operations for creating a filesystem context and
-one for destroying a context:
+There are four operations for creating a filesystem context and one for
+destroying a context:
 
- (*) struct fs_context *vfs_new_fs_context(struct file_system_type *fs_type,
-                                           struct dentry *reference,
-                                           unsigned int sb_flags,
-                                           unsigned int sb_flags_mask,
-                                           enum fs_context_purpose purpose);
+ (*) struct fs_context *fs_context_for_mount(
+                struct file_system_type *fs_type,
+                unsigned int sb_flags);
 
-     Create a filesystem context for a given filesystem type and purpose.  This
-     allocates the filesystem context, sets the superblock flags, initialises
-     the security and calls fs_type->init_fs_context() to initialise the
-     filesystem private data.
+     Allocate a filesystem context for the purpose of setting up a new mount,
+     whether that be with a new superblock or sharing an existing one.  This
+     sets the superblock flags, initialises the security and calls
+     fs_type->init_fs_context() to initialise the filesystem private data.
 
-     reference can be NULL or it may indicate the root dentry of a superblock
-     that is going to be reconfigured (FS_CONTEXT_FOR_RECONFIGURE) or
-     the automount point that triggered a submount (FS_CONTEXT_FOR_SUBMOUNT).
-     This is provided as a source of namespace information.
+     fs_type specifies the filesystem type that will manage the context and
+     sb_flags presets the superblock flags stored therein.
+
+ (*) struct fs_context *fs_context_for_reconfigure(
+                struct dentry *dentry,
+                unsigned int sb_flags,
+                unsigned int sb_flags_mask);
+
+     Allocate a filesystem context for the purpose of reconfiguring an
+     existing superblock.  dentry provides a reference to the superblock to be
+     configured.  sb_flags and sb_flags_mask indicate which superblock flags
+     need changing and to what.
+
+ (*) struct fs_context *fs_context_for_submount(
+                struct file_system_type *fs_type,
+                struct dentry *reference);
+
+     Allocate a filesystem context for the purpose of creating a new mount for
+     an automount point or other derived superblock.  fs_type specifies the
+     filesystem type that will manage the context and the reference dentry
+     supplies the parameters.  Namespaces are propagated from the reference
+     dentry's superblock also.
+
+     Note that it's not a requirement that the reference dentry be of the same
+     filesystem type as fs_type.
 
  (*) struct fs_context *vfs_dup_fs_context(struct fs_context *src_fc);
 
@@ -390,20 +407,6 @@ context pointer or a negative error code.
 For the remaining operations, if an error occurs, a negative error code will be
 returned.
 
- (*) int vfs_get_tree(struct fs_context *fc);
-
-     Get or create the mountable root and superblock, using the parameters in
-     the filesystem context to select/configure the superblock.  This invokes
-     the ->validate() op and then the ->get_tree() op.
-
-     [NOTE] ->validate() could perhaps be rolled into ->get_tree() and
-     ->reconfigure().
-
- (*) struct vfsmount *vfs_create_mount(struct fs_context *fc);
-
-     Create a mount given the parameters in the specified filesystem context.
-     Note that this does not attach the mount to anything.
-
  (*) int vfs_parse_fs_param(struct fs_context *fc,
                             struct fs_parameter *param);
 
@@ -432,17 +435,80 @@ returned.
      clear the pointer, but then becomes responsible for disposing of the
      object.
 
- (*) int vfs_parse_fs_string(struct fs_context *fc, char *key,
+ (*) int vfs_parse_fs_string(struct fs_context *fc, const char *key,
                              const char *value, size_t v_size);
 
-     A wrapper around vfs_parse_fs_param() that just passes a constant string.
+     A wrapper around vfs_parse_fs_param() that copies the value string it is
+     passed.
 
  (*) int generic_parse_monolithic(struct fs_context *fc, void *data);
 
      Parse a sys_mount() data page, assuming the form to be a text list
      consisting of key[=val] options separated by commas.  Each item in the
      list is passed to vfs_mount_option().  This is the default when the
-     ->parse_monolithic() operation is NULL.
+     ->parse_monolithic() method is NULL.
+
+ (*) int vfs_get_tree(struct fs_context *fc);
+
+     Get or create the mountable root and superblock, using the parameters in
+     the filesystem context to select/configure the superblock.  This invokes
+     the ->get_tree() method.
+
+ (*) struct vfsmount *vfs_create_mount(struct fs_context *fc);
+
+     Create a mount given the parameters in the specified filesystem context.
+     Note that this does not attach the mount to anything.
+
+
+===========================
+SUPERBLOCK CREATION HELPERS
+===========================
+
+A number of VFS helpers are available for use by filesystems for the creation
+or looking up of superblocks.
+
+ (*) struct super_block *
+     sget_fc(struct fs_context *fc,
+             int (*test)(struct super_block *sb, struct fs_context *fc),
+             int (*set)(struct super_block *sb, struct fs_context *fc));
+
+     This is the core routine.  If test is non-NULL, it searches for an
+     existing superblock matching the criteria held in the fs_context, using
+     the test function to match them.  If no match is found, a new superblock
+     is created and the set function is called to set it up.
+
+     Prior to the set function being called, fc->s_fs_info will be transferred
+     to sb->s_fs_info - and fc->s_fs_info will be cleared if set returns
+     success (ie. 0).
+
+The following helpers all wrap sget_fc():
+
+ (*) int vfs_get_super(struct fs_context *fc,
+                       enum vfs_get_super_keying keying,
+                       int (*fill_super)(struct super_block *sb,
+                                         struct fs_context *fc))
+
+     This creates/looks up a deviceless superblock.  The keying indicates how
+     many superblocks of this type may exist and in what manner they may be
+     shared:
+
+        (1) vfs_get_single_super
+
+            Only one such superblock may exist in the system.  Any further
+            attempt to get a new superblock gets this one (and any parameter
+            differences are ignored).
+
+        (2) vfs_get_keyed_super
+
+            Multiple superblocks of this type may exist and they're keyed on
+            their s_fs_info pointer (for example this may refer to a
+            namespace).
+
+        (3) vfs_get_independent_super
+
+            Multiple independent superblocks of this type may exist.  This
+            function never matches an existing one and always creates a new
+            one.
 
 
 =====================
@@ -454,35 +520,22 @@ There's a core description struct that links everything together:
 
         struct fs_parameter_description {
                 const char      name[16];
-                u8              nr_params;
-                u8              nr_alt_keys;
-                u8              nr_enums;
-                bool            ignore_unknown;
-                bool            no_source;
-                const char *const *keys;
-                const struct constant_table *alt_keys;
                 const struct fs_parameter_spec *specs;
                 const struct fs_parameter_enum *enums;
         };
 
 For example:
 
-        enum afs_param {
+        enum {
                 Opt_autocell,
                 Opt_bar,
                 Opt_dyn,
                 Opt_foo,
                 Opt_source,
-                nr__afs_params
         };
 
         static const struct fs_parameter_description afs_fs_parameters = {
                 .name           = "kAFS",
-                .nr_params      = nr__afs_params,
-                .nr_alt_keys    = ARRAY_SIZE(afs_param_alt_keys),
-                .nr_enums       = ARRAY_SIZE(afs_param_enums),
-                .keys           = afs_param_keys,
-                .alt_keys       = afs_param_alt_keys,
                 .specs          = afs_param_specs,
                 .enums          = afs_param_enums,
         };
@@ -494,28 +547,24 @@ The members are as follows:
      The name to be used in error messages generated by the parse helper
      functions.
 
- (2) u8 nr_params;
-
-     The number of discrete parameter identifiers.  This indicates the number
-     of elements in the ->types[] array and also limits the values that may be
-     used in the values that the ->keys[] array maps to.
-
-     It is expected that, for example, two parameters that are related, say
-     "acl" and "noacl" with have the same ID, but will be flagged to indicate
-     that one is the inverse of the other.  The value can then be picked out
-     from the parse result.
+ (2) const struct fs_parameter_specification *specs;
 
- (3) const struct fs_parameter_specification *specs;
+     Table of parameter specifications, terminated with a null entry, where the
+     entries are of type:
 
-     Table of parameter specifications, where the entries are of type:
-
-        struct fs_parameter_type {
-                enum fs_parameter_spec  type:8;
-                u8                      flags;
+        struct fs_parameter_spec {
+                const char              *name;
+                u8                      opt;
+                enum fs_parameter_type  type:8;
+                unsigned short          flags;
         };
 
-     and the parameter identifier is the index to the array.  'type' indicates
-     the desired value type and must be one of:
+     The 'name' field is a string to match exactly to the parameter key (no
+     wildcards, patterns and no case-independence) and 'opt' is the value that
+     will be returned by the fs_parser() function in the case of a successful
+     match.
+
+     The 'type' field indicates the desired value type and must be one of:
 
         TYPE NAME               EXPECTED VALUE          RESULT IN
         ======================= ======================= =====================
@@ -525,85 +574,65 @@ The members are as follows:
         fs_param_is_u32_octal   32-bit octal int        result->uint_32
         fs_param_is_u32_hex     32-bit hex int          result->uint_32
         fs_param_is_s32         32-bit signed int       result->int_32
+        fs_param_is_u64         64-bit unsigned int     result->uint_64
         fs_param_is_enum        Enum value name         result->uint_32
         fs_param_is_string      Arbitrary string        param->string
         fs_param_is_blob        Binary blob             param->blob
         fs_param_is_blockdev    Blockdev path           * Needs lookup
         fs_param_is_path        Path                    * Needs lookup
-        fs_param_is_fd          File descriptor         param->file
-
-     And each parameter can be qualified with 'flags':
-
-        fs_param_v_optional     The value is optional
-        fs_param_neg_with_no    If key name is prefixed with "no", it is false
-        fs_param_neg_with_empty If value is "", it is false
-        fs_param_deprecated     The parameter is deprecated.
-
-     For example:
-
-        static const struct fs_parameter_spec afs_param_specs[nr__afs_params] = {
-                [Opt_autocell]  = { fs_param_is flag },
-                [Opt_bar]       = { fs_param_is_enum },
-                [Opt_dyn]       = { fs_param_is flag },
-                [Opt_foo]       = { fs_param_is_bool, fs_param_neg_with_no },
-                [Opt_source]    = { fs_param_is_string },
-        };
+        fs_param_is_fd          File descriptor         result->int_32
 
      Note that if the value is of fs_param_is_bool type, fs_parse() will try
      to match any string value against "0", "1", "no", "yes", "false", "true".
 
-     [!] NOTE that the table must be sorted according to primary key name so
-         that ->keys[] is also sorted.
-
- (4) const char *const *keys;
-
-     Table of primary key names for the parameters.  There must be one entry
-     per defined parameter.  The table is optional if ->nr_params is 0.  The
-     table is just an array of names e.g.:
+     Each parameter can also be qualified with 'flags':
 
-        static const char *const afs_param_keys[nr__afs_params] = {
-                [Opt_autocell]  = "autocell",
-                [Opt_bar]       = "bar",
-                [Opt_dyn]       = "dyn",
-                [Opt_foo]       = "foo",
-                [Opt_source]    = "source",
-        };
-
-     [!] NOTE that the table must be sorted such that the table can be searched
-         with bsearch() using strcmp().  This means that the Opt_* values must
-         correspond to the entries in this table.
-
- (5) const struct constant_table *alt_keys;
-     u8 nr_alt_keys;
-
-     Table of additional key names and their mappings to parameter ID plus the
-     number of elements in the table.  This is optional.  The table is just an
-     array of { name, integer } pairs, e.g.:
+        fs_param_v_optional     The value is optional
+        fs_param_neg_with_no    result->negated set if key is prefixed with "no"
+        fs_param_neg_with_empty result->negated set if value is ""
+        fs_param_deprecated     The parameter is deprecated.
 
-        static const struct constant_table afs_param_keys[] = {
-                { "baz",        Opt_bar },
-                { "dynamic",    Opt_dyn },
+     These are wrapped with a number of convenience wrappers:
+
+        MACRO                   SPECIFIES
+        ======================= ===============================================
+        fsparam_flag()          fs_param_is_flag
+        fsparam_flag_no()       fs_param_is_flag, fs_param_neg_with_no
+        fsparam_bool()          fs_param_is_bool
+        fsparam_u32()           fs_param_is_u32
+        fsparam_u32oct()        fs_param_is_u32_octal
+        fsparam_u32hex()        fs_param_is_u32_hex
+        fsparam_s32()           fs_param_is_s32
+        fsparam_u64()           fs_param_is_u64
+        fsparam_enum()          fs_param_is_enum
+        fsparam_string()        fs_param_is_string
+        fsparam_blob()          fs_param_is_blob
+        fsparam_bdev()          fs_param_is_blockdev
+        fsparam_path()          fs_param_is_path
+        fsparam_fd()            fs_param_is_fd
+
+     all of which take two arguments, name string and option number - for
+     example:
+
+        static const struct fs_parameter_spec afs_param_specs[] = {
+                fsparam_flag    ("autocell",    Opt_autocell),
+                fsparam_flag    ("dyn",         Opt_dyn),
+                fsparam_string  ("source",      Opt_source),
+                fsparam_flag_no ("foo",         Opt_foo),
+                {}
         };
 
-     [!] NOTE that the table must be sorted such that strcmp() can be used with
-         bsearch() to search the entries.
-
-     The parameter ID can also be fs_param_key_removed to indicate that a
-     deprecated parameter has been removed and that an error will be given.
-     This differs from fs_param_deprecated where the parameter may still have
-     an effect.
-
-     Further, the behaviour of the parameter may differ when an alternate name
-     is used (for instance with NFS, "v3", "v4.2", etc. are alternate names).
+     An addition macro, __fsparam() is provided that takes an additional pair
+     of arguments to specify the type and the flags for anything that doesn't
+     match one of the above macros.
 
  (6) const struct fs_parameter_enum *enums;
-     u8 nr_enums;
 
-     Table of enum value names to integer mappings and the number of elements
-     stored therein.  This is of type:
+     Table of enum value names to integer mappings, terminated with a null
+     entry.  This is of type:
 
         struct fs_parameter_enum {
-                u8              param_id;
+                u8              opt;
                 char            name[14];
                 u8              value;
         };
@@ -621,11 +650,6 @@ The members are as follows:
      try to look the value up in the enum table and the result will be stored
      in the parse result.
 
- (7) bool no_source;
-
-     If this is set, fs_parse() will ignore any "source" parameter and not
-     pass it to the filesystem.
-
 The parser should be pointed to by the parser pointer in the file_system_type
 struct as this will provide validation on registration (if
 CONFIG_VALIDATE_FS_PARSER=y) and will allow the description to be queried from
@@ -650,9 +674,8 @@ process the parameters it is given.
                 int             value;
         };
 
-     and it must be sorted such that it can be searched using bsearch() using
-     strcmp().  If a match is found, the corresponding value is returned.  If a
-     match isn't found, the not_found value is returned instead.
+     If a match is found, the corresponding value is returned.  If a match
+     isn't found, the not_found value is returned instead.
 
  (*) bool validate_constant_table(const struct constant_table *tbl,
                                   size_t tbl_size,
@@ -665,36 +688,36 @@ process the parameters it is given.
      should just be set to lie inside the low-to-high range.
 
      If all is good, true is returned.  If the table is invalid, errors are
-     logged to dmesg, the stack is dumped and false is returned.
+     logged to dmesg and false is returned.
+
+ (*) bool fs_validate_description(const struct fs_parameter_description *desc);
+
+     This performs some validation checks on a parameter description.  It
+     returns true if the description is good and false if it is not.  It will
+     log errors to dmesg if validation fails.
 
  (*) int fs_parse(struct fs_context *fc,
-                  const struct fs_param_parser *parser,
+                  const struct fs_parameter_description *desc,
                   struct fs_parameter *param,
-                  struct fs_param_parse_result *result);
+                  struct fs_parse_result *result);
 
      This is the main interpreter of parameters.  It uses the parameter
-     description (parser) to look up the name of the parameter to use and to
-     convert that to a parameter ID (stored in result->key).
+     description to look up a parameter by key name and to convert that to an
+     option number (which it returns).
 
      If successful, and if the parameter type indicates the result is a
      boolean, integer or enum type, the value is converted by this function and
-     the result stored in result->{boolean,int_32,uint_32}.
+     the result stored in result->{boolean,int_32,uint_32,uint_64}.
 
      If a match isn't initially made, the key is prefixed with "no" and no
      value is present then an attempt will be made to look up the key with the
      prefix removed.  If this matches a parameter for which the type has flag
-     fs_param_neg_with_no set, then a match will be made and the value will be
-     set to false/0/NULL.
-
-     If the parameter is successfully matched and, optionally, parsed
-     correctly, 1 is returned.  If the parameter isn't matched and
-     parser->ignore_unknown is set, then 0 is returned.  Otherwise -EINVAL is
-     returned.
-
- (*) bool fs_validate_description(const struct fs_parameter_description *desc);
+     fs_param_neg_with_no set, then a match will be made and result->negated
+     will be set to true.
 
-     This is validates the parameter description.  It returns true if the
-     description is good and false if it is not.
+     If the parameter isn't matched, -ENOPARAM will be returned; if the
+     parameter is matched, but the value is erroneous, -EINVAL will be
+     returned; otherwise the parameter's option number will be returned.
 
  (*) int fs_lookup_param(struct fs_context *fc,
                          struct fs_parameter *value,
diff --git a/Documentation/i2c/busses/i2c-i801 b/Documentation/i2c/busses/i2c-i801
index d1ee484a787d..ee9984f35868 100644
--- a/Documentation/i2c/busses/i2c-i801
+++ b/Documentation/i2c/busses/i2c-i801
@@ -36,6 +36,7 @@ Supported adapters:
   * Intel Cannon Lake (PCH)
   * Intel Cedar Fork (PCH)
   * Intel Ice Lake (PCH)
+  * Intel Comet Lake (PCH)
    Datasheets: Publicly available at the Intel website
 
 On Intel Patsburg and later chipsets, both the normal host SMBus controller
diff --git a/Documentation/networking/bpf_flow_dissector.rst b/Documentation/networking/bpf_flow_dissector.rst
new file mode 100644
index 000000000000..b375ae2ec2c4
--- /dev/null
+++ b/Documentation/networking/bpf_flow_dissector.rst
@@ -0,0 +1,126 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+==================
+BPF Flow Dissector
+==================
+
+Overview
+========
+
+Flow dissector is a routine that parses metadata out of the packets. It's
+used in the various places in the networking subsystem (RFS, flow hash, etc).
+
+BPF flow dissector is an attempt to reimplement C-based flow dissector logic
+in BPF to gain all the benefits of BPF verifier (namely, limits on the
+number of instructions and tail calls).
+
+API
+===
+
+BPF flow dissector programs operate on an ``__sk_buff``. However, only the
+limited set of fields is allowed: ``data``, ``data_end`` and ``flow_keys``.
+``flow_keys`` is ``struct bpf_flow_keys`` and contains flow dissector input
+and output arguments.
+
+The inputs are:
+  * ``nhoff`` - initial offset of the networking header
+  * ``thoff`` - initial offset of the transport header, initialized to nhoff
+  * ``n_proto`` - L3 protocol type, parsed out of L2 header
+
+Flow dissector BPF program should fill out the rest of the ``struct
+bpf_flow_keys`` fields. Input arguments ``nhoff/thoff/n_proto`` should be
+also adjusted accordingly.
+
+The return code of the BPF program is either BPF_OK to indicate successful
+dissection, or BPF_DROP to indicate parsing error.
+
+__sk_buff->data
+===============
+
+In the VLAN-less case, this is what the initial state of the BPF flow
+dissector looks like::
+
+  +------+------+------------+-----------+
+  | DMAC | SMAC | ETHER_TYPE | L3_HEADER |
+  +------+------+------------+-----------+
+                              ^
+                              |
+                              +-- flow dissector starts here
+
+
+.. code:: c
+
+  skb->data + flow_keys->nhoff point to the first byte of L3_HEADER
+  flow_keys->thoff = nhoff
+  flow_keys->n_proto = ETHER_TYPE
+
+In case of VLAN, flow dissector can be called with the two different states.
+
+Pre-VLAN parsing::
+
+  +------+------+------+-----+-----------+-----------+
+  | DMAC | SMAC | TPID | TCI |ETHER_TYPE | L3_HEADER |
+  +------+------+------+-----+-----------+-----------+
+                        ^
+                        |
+                        +-- flow dissector starts here
+
+.. code:: c
+
+  skb->data + flow_keys->nhoff point the to first byte of TCI
+  flow_keys->thoff = nhoff
+  flow_keys->n_proto = TPID
+
+Please note that TPID can be 802.1AD and, hence, BPF program would
+have to parse VLAN information twice for double tagged packets.
+
+
+Post-VLAN parsing::
+
+  +------+------+------+-----+-----------+-----------+
+  | DMAC | SMAC | TPID | TCI |ETHER_TYPE | L3_HEADER |
+  +------+------+------+-----+-----------+-----------+
+                                          ^
+                                          |
+                                          +-- flow dissector starts here
+
+.. code:: c
+
+  skb->data + flow_keys->nhoff point the to first byte of L3_HEADER
+  flow_keys->thoff = nhoff
+  flow_keys->n_proto = ETHER_TYPE
+
+In this case VLAN information has been processed before the flow dissector
+and BPF flow dissector is not required to handle it.
+
+
+The takeaway here is as follows: BPF flow dissector program can be called with
+the optional VLAN header and should gracefully handle both cases: when single
+or double VLAN is present and when it is not present. The same program
+can be called for both cases and would have to be written carefully to
+handle both cases.
+
+
+Reference Implementation
+========================
+
+See ``tools/testing/selftests/bpf/progs/bpf_flow.c`` for the reference
+implementation and ``tools/testing/selftests/bpf/flow_dissector_load.[hc]``
+for the loader. bpftool can be used to load BPF flow dissector program as well.
+
+The reference implementation is organized as follows:
+  * ``jmp_table`` map that contains sub-programs for each supported L3 protocol
+  * ``_dissect`` routine - entry point; it does input ``n_proto`` parsing and
+    does ``bpf_tail_call`` to the appropriate L3 handler
+
+Since BPF at this point doesn't support looping (or any jumping back),
+jmp_table is used instead to handle multiple levels of encapsulation (and
+IPv6 options).
+
+
+Current Limitations
+===================
+BPF flow dissector doesn't support exporting all the metadata that in-kernel
+C-based implementation can export. Notable example is single VLAN (802.1Q)
+and double VLAN (802.1AD) tags. Please refer to the ``struct bpf_flow_keys``
+for a set of information that's currently can be exported from the BPF context.
diff --git a/Documentation/networking/index.rst b/Documentation/networking/index.rst
index 5449149be496..984e68f9e026 100644
--- a/Documentation/networking/index.rst
+++ b/Documentation/networking/index.rst
@@ -9,6 +9,7 @@ Contents:
    netdev-FAQ
    af_xdp
    batman-adv
+   bpf_flow_dissector
    can
    can_ucan_protocol
    device_drivers/freescale/dpaa2/index
diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
index 7de9eee73fcd..67068c47c591 100644
--- a/Documentation/virtual/kvm/api.txt
+++ b/Documentation/virtual/kvm/api.txt
@@ -5,25 +5,32 @@ The Definitive KVM (Kernel-based Virtual Machine) API Documentation
 ----------------------
 
 The kvm API is a set of ioctls that are issued to control various aspects
-of a virtual machine.  The ioctls belong to three classes
+of a virtual machine.  The ioctls belong to three classes:
 
  - System ioctls: These query and set global attributes which affect the
    whole kvm subsystem.  In addition a system ioctl is used to create
-   virtual machines
+   virtual machines.
 
  - VM ioctls: These query and set attributes that affect an entire virtual
    machine, for example memory layout.  In addition a VM ioctl is used to
-   create virtual cpus (vcpus).
+   create virtual cpus (vcpus) and devices.
 
-   Only run VM ioctls from the same process (address space) that was used
-   to create the VM.
+   VM ioctls must be issued from the same process (address space) that was
+   used to create the VM.
 
  - vcpu ioctls: These query and set attributes that control the operation
    of a single virtual cpu.
 
-   Only run vcpu ioctls from the same thread that was used to create the
-   vcpu.
+   vcpu ioctls should be issued from the same thread that was used to create
+   the vcpu, except for asynchronous vcpu ioctl that are marked as such in
+   the documentation.  Otherwise, the first ioctl after switching threads
+   could see a performance impact.
 
+ - device ioctls: These query and set attributes that control the operation
+   of a single device.
+
+   device ioctls must be issued from the same process (address space) that
+   was used to create the VM.
 
 2. File descriptors
 -------------------
@@ -32,17 +39,34 @@ The kvm API is centered around file descriptors.  An initial
 open("/dev/kvm") obtains a handle to the kvm subsystem; this handle
 can be used to issue system ioctls.  A KVM_CREATE_VM ioctl on this
 handle will create a VM file descriptor which can be used to issue VM
-ioctls.  A KVM_CREATE_VCPU ioctl on a VM fd will create a virtual cpu
-and return a file descriptor pointing to it.  Finally, ioctls on a vcpu
-fd can be used to control the vcpu, including the important task of
-actually running guest code.
+ioctls.  A KVM_CREATE_VCPU or KVM_CREATE_DEVICE ioctl on a VM fd will
+create a virtual cpu or device and return a file descriptor pointing to
+the new resource.  Finally, ioctls on a vcpu or device fd can be used
+to control the vcpu or device.  For vcpus, this includes the important
+task of actually running guest code.
 
 In general file descriptors can be migrated among processes by means
 of fork() and the SCM_RIGHTS facility of unix domain socket.  These
 kinds of tricks are explicitly not supported by kvm.  While they will
 not cause harm to the host, their actual behavior is not guaranteed by
-the API.  The only supported use is one virtual machine per process,
-and one vcpu per thread.
+the API.  See "General description" for details on the ioctl usage
+model that is supported by KVM.
+
+It is important to note that althought VM ioctls may only be issued from
+the process that created the VM, a VM's lifecycle is associated with its
+file descriptor, not its creator (process).  In other words, the VM and
+its resources, *including the associated address space*, are not freed
+until the last reference to the VM's file descriptor has been released.
+For example, if fork() is issued after ioctl(KVM_CREATE_VM), the VM will
+not be freed until both the parent (original) process and its child have
+put their references to the VM's file descriptor.
+
+Because a VM's resources are not freed until the last reference to its
+file descriptor is released, creating additional references to a VM via
+via fork(), dup(), etc... without careful consideration is strongly
+discouraged and may have unwanted side effects, e.g. memory allocated
+by and on behalf of the VM's process may not be freed/unaccounted when
+the VM is shut down.
 
 
 It is important to note that althought VM ioctls may only be issued from
@@ -515,11 +539,15 @@ c) KVM_INTERRUPT_SET_LEVEL
 Note that any value for 'irq' other than the ones stated above is invalid
 and incurs unexpected behavior.
 
+This is an asynchronous vcpu ioctl and can be invoked from any thread.
+
 MIPS:
 
 Queues an external interrupt to be injected into the virtual CPU. A negative
 interrupt number dequeues the interrupt.
 
+This is an asynchronous vcpu ioctl and can be invoked from any thread.
+
 
 4.17 KVM_DEBUG_GUEST
 
@@ -1086,14 +1114,12 @@ struct kvm_userspace_memory_region {
 #define KVM_MEM_LOG_DIRTY_PAGES (1UL << 0)
 #define KVM_MEM_READONLY        (1UL << 1)
 
-This ioctl allows the user to create or modify a guest physical memory
-slot.  When changing an existing slot, it may be moved in the guest
-physical memory space, or its flags may be modified.  It may not be
-resized.  Slots may not overlap in guest physical address space.
-Bits 0-15 of "slot" specifies the slot id and this value should be
-less than the maximum number of user memory slots supported per VM.
-The maximum allowed slots can be queried using KVM_CAP_NR_MEMSLOTS,
-if this capability is supported by the architecture.
+This ioctl allows the user to create, modify or delete a guest physical
+memory slot.  Bits 0-15 of "slot" specify the slot id and this value
+should be less than the maximum number of user memory slots supported per
+VM.  The maximum allowed slots can be queried using KVM_CAP_NR_MEMSLOTS,
+if this capability is supported by the architecture.  Slots may not
+overlap in guest physical address space.
 
 If KVM_CAP_MULTI_ADDRESS_SPACE is available, bits 16-31 of "slot"
 specifies the address space which is being modified.  They must be
@@ -1102,6 +1128,10 @@ KVM_CAP_MULTI_ADDRESS_SPACE capability.  Slots in separate address spaces
 are unrelated; the restriction on overlapping slots only applies within
 each address space.
 
+Deleting a slot is done by passing zero for memory_size.  When changing
+an existing slot, it may be moved in the guest physical memory space,
+or its flags may be modified, but it may not be resized.
+
 Memory for the region is taken starting at the address denoted by the
 field userspace_addr, which must point at user addressable memory for
 the entire memory slot size.  Any object may back this memory, including
@@ -2493,7 +2523,7 @@ KVM_S390_MCHK (vm, vcpu) - machine check interrupt; cr 14 bits in parm,
                            machine checks needing further payload are not
                            supported by this ioctl)
 
-Note that the vcpu ioctl is asynchronous to vcpu execution.
+This is an asynchronous vcpu ioctl and can be invoked from any thread.
 
 4.78 KVM_PPC_GET_HTAB_FD
 
@@ -3042,8 +3072,7 @@ KVM_S390_INT_EMERGENCY - sigp emergency; parameters in .emerg
 KVM_S390_INT_EXTERNAL_CALL - sigp external call; parameters in .extcall
 KVM_S390_MCHK - machine check interrupt; parameters in .mchk
 
-
-Note that the vcpu ioctl is asynchronous to vcpu execution.
+This is an asynchronous vcpu ioctl and can be invoked from any thread.
 
 4.94 KVM_S390_GET_IRQ_STATE
 
diff --git a/Documentation/virtual/kvm/mmu.txt b/Documentation/virtual/kvm/mmu.txt
index f365102c80f5..2efe0efc516e 100644
--- a/Documentation/virtual/kvm/mmu.txt
+++ b/Documentation/virtual/kvm/mmu.txt
@@ -142,7 +142,7 @@ Shadow pages contain the following information:
     If clear, this page corresponds to a guest page table denoted by the gfn
     field.
   role.quadrant:
-    When role.cr4_pae=0, the guest uses 32-bit gptes while the host uses 64-bit
+    When role.gpte_is_8_bytes=0, the guest uses 32-bit gptes while the host uses 64-bit
     sptes.  That means a guest page table contains more ptes than the host,
     so multiple shadow pages are needed to shadow one guest page.
     For first-level shadow pages, role.quadrant can be 0 or 1 and denotes the
@@ -158,9 +158,9 @@ Shadow pages contain the following information:
     The page is invalid and should not be used.  It is a root page that is
     currently pinned (by a cpu hardware register pointing to it); once it is
     unpinned it will be destroyed.
-  role.cr4_pae:
-    Contains the value of cr4.pae for which the page is valid (e.g. whether
-    32-bit or 64-bit gptes are in use).
+  role.gpte_is_8_bytes:
+    Reflects the size of the guest PTE for which the page is valid, i.e. '1'
+    if 64-bit gptes are in use, '0' if 32-bit gptes are in use.
   role.nxe:
     Contains the value of efer.nxe for which the page is valid.
   role.cr0_wp:
@@ -173,6 +173,9 @@ Shadow pages contain the following information:
     Contains the value of cr4.smap && !cr0.wp for which the page is valid
     (pages for which this is true are different from other pages; see the
     treatment of cr0.wp=0 below).
+  role.ept_sp:
+    This is a virtual flag to denote a shadowed nested EPT page.  ept_sp
+    is true if "cr0_wp && smap_andnot_wp", an otherwise invalid combination.
   role.smm:
     Is 1 if the page is valid in system management mode.  This field
     determines which of the kvm_memslots array was used to build this
diff --git a/MAINTAINERS b/MAINTAINERS
index c1e2f4070aa5..cdb088103b2e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2356,7 +2356,7 @@ F:	arch/arm/mm/cache-uniphier.c
 F:      arch/arm64/boot/dts/socionext/uniphier*
 F:      drivers/bus/uniphier-system-bus.c
 F:      drivers/clk/uniphier/
-F:      drivers/dmaengine/uniphier-mdmac.c
+F:      drivers/dma/uniphier-mdmac.c
 F:      drivers/gpio/gpio-uniphier.c
 F:      drivers/i2c/busses/i2c-uniphier*
 F:      drivers/irqchip/irq-uniphier-aidet.c
@@ -4132,7 +4132,7 @@ F:	drivers/cpuidle/*
 F:      include/linux/cpuidle.h
 
 CRAMFS FILESYSTEM
-M:      Nicolas Pitre <nico@linaro.org>
+M:      Nicolas Pitre <nico@fluxnic.net>
 S:      Maintained
 F:      Documentation/filesystems/cramfs.txt
 F:      fs/cramfs/
@@ -5836,7 +5836,7 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 F:      Documentation/ABI/testing/sysfs-bus-mdio
 F:      Documentation/devicetree/bindings/net/mdio*
-F:      Documentation/networking/phy.txt
+F:      Documentation/networking/phy.rst
 F:      drivers/net/phy/
 F:      drivers/of/of_mdio.c
 F:      drivers/of/of_net.c
@@ -6411,7 +6411,6 @@ L:	linux-kernel@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git locking/core
 S:      Maintained
 F:      kernel/futex.c
-F:      kernel/futex_compat.c
 F:      include/asm-generic/futex.h
 F:      include/linux/futex.h
 F:      include/uapi/linux/futex.h
@@ -13976,7 +13975,7 @@ F:	drivers/media/rc/serial_ir.c
 SFC NETWORK DRIVER
 M:      Solarflare linux maintainers <linux-net-drivers@solarflare.com>
 M:      Edward Cree <ecree@solarflare.com>
-M:      Bert Kenward <bkenward@solarflare.com>
+M:      Martin Habets <mhabets@solarflare.com>
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/sfc/
diff --git a/Makefile b/Makefile
index c0a34064c574..026fbc450906 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 1
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 NAME = Shy Crocodile
 
 # *DOCUMENTATION*
@@ -31,26 +31,12 @@ _all:
 # descending is started. They are now explicitly listed as the
 # prepare rule.
 
-# Ugly workaround for Debian make-kpkg:
-# make-kpkg directly includes the top Makefile of Linux kernel. In such a case,
-# skip sub-make to support debian_* targets in ruleset/kernel_version.mk, but
-# displays warning to discourage such abusage.
-ifneq ($(word 2, $(MAKEFILE_LIST)),)
-$(warning Do not include top Makefile of Linux Kernel)
-sub-make-done := 1
-MAKEFLAGS += -rR
-endif
-
-ifneq ($(sub-make-done),1)
+ifneq ($(sub_make_done),1)
 
 # Do not use make's built-in rules and variables
 # (this increases performance and avoids hard-to-debug behaviour)
 MAKEFLAGS += -rR
 
-# 'MAKEFLAGS += -rR' does not become immediately effective for old
-# GNU Make versions. Cancel implicit rules for this Makefile.
-$(lastword $(MAKEFILE_LIST)): ;
-
 # Avoid funny character set dependencies
 unexport LC_ALL
 LC_COLLATE=C
@@ -153,6 +139,7 @@ $(if $(KBUILD_OUTPUT),, \
 # 'sub-make' below.
 MAKEFLAGS += --include-dir=$(CURDIR)
 
+need-sub-make := 1
 else
 
 # Do not print "Entering directory ..." at all for in-tree build.
@@ -160,6 +147,18 @@ MAKEFLAGS += --no-print-directory
 
 endif # ifneq ($(KBUILD_OUTPUT),)
 
+ifneq ($(filter 3.%,$(MAKE_VERSION)),)
+# 'MAKEFLAGS += -rR' does not immediately become effective for GNU Make 3.x
+# We need to invoke sub-make to avoid implicit rules in the top Makefile.
+need-sub-make := 1
+# Cancel implicit rules for this Makefile.
+$(lastword $(MAKEFILE_LIST)): ;
+endif
+
+export sub_make_done := 1
+
+ifeq ($(need-sub-make),1)
+
 PHONY += $(MAKECMDGOALS) sub-make
 
 $(filter-out _all sub-make $(CURDIR)/Makefile, $(MAKECMDGOALS)) _all: sub-make
@@ -167,12 +166,15 @@ $(filter-out _all sub-make $(CURDIR)/Makefile, $(MAKECMDGOALS)) _all: sub-make
 
 # Invoke a second make in the output directory, passing relevant variables
 sub-make:
-        $(Q)$(MAKE) sub-make-done=1 \
+        $(Q)$(MAKE) \
         $(if $(KBUILD_OUTPUT),-C $(KBUILD_OUTPUT) KBUILD_SRC=$(CURDIR)) \
         -f $(CURDIR)/Makefile $(filter-out _all sub-make,$(MAKECMDGOALS))
 
-else # sub-make-done
+endif # need-sub-make
+endif # sub_make_done
+
 # We process the rest of the Makefile if this is the final invocation of make
+ifeq ($(need-sub-make),)
 
 # Do not print "Entering directory ...",
 # but we want to display it when entering to the output directory
@@ -497,7 +499,8 @@ outputmakefile:
 ifneq ($(KBUILD_SRC),)
         $(Q)ln -fsn $(srctree) source
         $(Q)$(CONFIG_SHELL) $(srctree)/scripts/mkmakefile $(srctree)
-        $(Q){ echo "# this is build directory, ignore it"; echo "*"; } > .gitignore
+        $(Q)test -e .gitignore || \
+        { echo "# this is build directory, ignore it"; echo "*"; } > .gitignore
 endif
 
 ifneq ($(shell $(CC) --version 2>&1 | head -n 1 | grep clang),)
@@ -677,7 +680,7 @@ KBUILD_CFLAGS	+= $(call cc-disable-warning, format-overflow)
 KBUILD_CFLAGS   += $(call cc-disable-warning, int-in-bool-context)
 
 ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
-KBUILD_CFLAGS   += $(call cc-option,-Oz,-Os)
+KBUILD_CFLAGS   += -Os
 else
 KBUILD_CFLAGS   += -O2
 endif
@@ -950,9 +953,11 @@ mod_sign_cmd = true
 endif
 export mod_sign_cmd
 
+HOST_LIBELF_LIBS = $(shell pkg-config libelf --libs 2>/dev/null || echo -lelf)
+
 ifdef CONFIG_STACK_VALIDATION
   has_libelf := $(call try-run,\
-                echo "int main() {}" | $(HOSTCC) -xc -o /dev/null -lelf -,1,0)
+                echo "int main() {}" | $(HOSTCC) -xc -o /dev/null $(HOST_LIBELF_LIBS) -,1,0)
   ifeq ($(has_libelf),1)
     objtool_target := tools/objtool FORCE
   else
@@ -1757,7 +1762,7 @@ existing-targets := $(wildcard $(sort $(targets)))
 
 endif   # ifeq ($(config-targets),1)
 endif   # ifeq ($(mixed-targets),1)
-endif   # sub-make-done
+endif   # need-sub-make
 
 PHONY += FORCE
 FORCE:
diff --git a/arch/alpha/include/asm/Kbuild b/arch/alpha/include/asm/Kbuild
index dc0ab28baca1..70b783333965 100644
--- a/arch/alpha/include/asm/Kbuild
+++ b/arch/alpha/include/asm/Kbuild
@@ -6,6 +6,7 @@ generic-y += exec.h
 generic-y += export.h
 generic-y += fb.h
 generic-y += irq_work.h
+generic-y += kvm_para.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
 generic-y += preempt.h
diff --git a/arch/alpha/include/uapi/asm/kvm_para.h b/arch/alpha/include/uapi/asm/kvm_para.h
deleted file mode 100644
index baacc4996d18..000000000000
--- a/arch/alpha/include/uapi/asm/kvm_para.h
+++ /dev/null
@@ -1,2 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#include <asm-generic/kvm_para.h>
diff --git a/arch/arc/include/asm/Kbuild b/arch/arc/include/asm/Kbuild
index b41f8881ecc8..decc306a3b52 100644
--- a/arch/arc/include/asm/Kbuild
+++ b/arch/arc/include/asm/Kbuild
@@ -11,6 +11,7 @@ generic-y += hardirq.h
 generic-y += hw_irq.h
 generic-y += irq_regs.h
 generic-y += irq_work.h
+generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
diff --git a/arch/arc/include/uapi/asm/Kbuild b/arch/arc/include/uapi/asm/Kbuild
index 755bb11323d8..1c72f04ff75d 100644
--- a/arch/arc/include/uapi/asm/Kbuild
+++ b/arch/arc/include/uapi/asm/Kbuild
@@ -1,2 +1 @@
-generic-y += kvm_para.h
 generic-y += ucontext.h
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 054ead960f98..850b4805e2d1 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -596,6 +596,7 @@ config ARCH_DAVINCI
         select HAVE_IDE
         select PM_GENERIC_DOMAINS if PM
         select PM_GENERIC_DOMAINS_OF if PM && OF
+        select REGMAP_MMIO
         select RESET_CONTROLLER
         select SPARSE_IRQ
         select USE_OF
diff --git a/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts b/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts
index 5641d162dfdb..28e7513ce617 100644
--- a/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts
+++ b/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts
@@ -93,7 +93,7 @@
 };
 
 &hdmi {
-        hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+        hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>;
 };
 
 &pwm {
diff --git a/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi b/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
index b715ab0fa1ff..e8d800fec637 100644
--- a/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
+++ b/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
@@ -114,9 +114,9 @@
                         reg = <2>;
                 };
 
-                switch@0 {
+                switch@10 {
                         compatible = "qca,qca8334";
-                        reg = <0>;
+                        reg = <10>;
 
                         switch_ports: ports {
                                 #address-cells = <1>;
@@ -125,7 +125,7 @@
                                 ethphy0: port@0 {
                                         reg = <0>;
                                         label = "cpu";
-                                        phy-mode = "rgmii";
+                                        phy-mode = "rgmii-id";
                                         ethernet = <&fec>;
 
                                         fixed-link {
diff --git a/arch/arm/boot/dts/imx6qdl-icore-rqs.dtsi b/arch/arm/boot/dts/imx6qdl-icore-rqs.dtsi
index 1d1b4bd0670f..a4217f564a53 100644
--- a/arch/arm/boot/dts/imx6qdl-icore-rqs.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-icore-rqs.dtsi
@@ -264,7 +264,7 @@
         pinctrl-2 = <&pinctrl_usdhc3_200mhz>;
         vmcc-supply = <&reg_sd3_vmmc>;
         cd-gpios = <&gpio1 1 GPIO_ACTIVE_LOW>;
-        bus-witdh = <4>;
+        bus-width = <4>;
         no-1-8-v;
         status = "okay";
 };
@@ -275,7 +275,7 @@
         pinctrl-1 = <&pinctrl_usdhc4_100mhz>;
         pinctrl-2 = <&pinctrl_usdhc4_200mhz>;
         vmcc-supply = <&reg_sd4_vmmc>;
-        bus-witdh = <8>;
+        bus-width = <8>;
         no-1-8-v;
         non-removable;
         status = "okay";
diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
index 433bf09a1954..027df06c5dc7 100644
--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
@@ -91,6 +91,7 @@
         pinctrl-0 = <&pinctrl_enet>;
         phy-handle = <&ethphy>;
         phy-mode = "rgmii";
+        phy-reset-duration = <10>; /* in msecs */
         phy-reset-gpios = <&gpio3 23 GPIO_ACTIVE_LOW>;
         phy-supply = <&vdd_eth_io_reg>;
         status = "disabled";
diff --git a/arch/arm/boot/dts/imx6ull-pinfunc-snvs.h b/arch/arm/boot/dts/imx6ull-pinfunc-snvs.h
index f6fb6783c193..54cfe72295aa 100644
--- a/arch/arm/boot/dts/imx6ull-pinfunc-snvs.h
+++ b/arch/arm/boot/dts/imx6ull-pinfunc-snvs.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (C) 2016 Freescale Semiconductor, Inc.
  * Copyright (C) 2017 NXP
diff --git a/arch/arm/boot/dts/ste-nomadik-nhk15.dts b/arch/arm/boot/dts/ste-nomadik-nhk15.dts
index 04066f9cb8a3..f2f6558a00f1 100644
--- a/arch/arm/boot/dts/ste-nomadik-nhk15.dts
+++ b/arch/arm/boot/dts/ste-nomadik-nhk15.dts
@@ -213,12 +213,13 @@
                 gpio-sck = <&gpio0 5 GPIO_ACTIVE_HIGH>;
                 gpio-mosi = <&gpio0 4 GPIO_ACTIVE_HIGH>;
                 /*
-                 * It's not actually active high, but the frameworks assume
-                 * the polarity of the passed-in GPIO is "normal" (active
-                 * high) then actively drives the line low to select the
-                 * chip.
+                 * This chipselect is active high. Just setting the flags
+                 * to GPIO_ACTIVE_HIGH is not enough for the SPI DT bindings,
+                 * it will be ignored, only the special "spi-cs-high" flag
+                 * really counts.
                  */
                 cs-gpios = <&gpio0 6 GPIO_ACTIVE_HIGH>;
+                spi-cs-high;
                 num-chipselects = <1>;
 
                 /*
diff --git a/arch/arm/configs/imx_v4_v5_defconfig b/arch/arm/configs/imx_v4_v5_defconfig
index 8661dd9b064a..b37f8e675e40 100644
--- a/arch/arm/configs/imx_v4_v5_defconfig
+++ b/arch/arm/configs/imx_v4_v5_defconfig
@@ -170,6 +170,9 @@ CONFIG_IMX_SDMA=y
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_IIO=y
 CONFIG_FSL_MX25_ADC=y
+CONFIG_PWM=y
+CONFIG_PWM_IMX1=y
+CONFIG_PWM_IMX27=y
 CONFIG_EXT4_FS=y
 # CONFIG_DNOTIFY is not set
 CONFIG_VFAT_FS=y
diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig
index 5586a5074a96..50fb01d70b10 100644
--- a/arch/arm/configs/imx_v6_v7_defconfig
+++ b/arch/arm/configs/imx_v6_v7_defconfig
@@ -398,7 +398,7 @@ CONFIG_MAG3110=y
 CONFIG_MPL3115=y
 CONFIG_PWM=y
 CONFIG_PWM_FSL_FTM=y
-CONFIG_PWM_IMX=y
+CONFIG_PWM_IMX27=y
 CONFIG_NVMEM_IMX_OCOTP=y
 CONFIG_NVMEM_VF610_OCOTP=y
 CONFIG_TEE=y
diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
index 2de96a180166..31de4ab93005 100644
--- a/arch/arm/include/asm/kvm_mmu.h
+++ b/arch/arm/include/asm/kvm_mmu.h
@@ -381,6 +381,17 @@ static inline int kvm_read_guest_lock(struct kvm *kvm,
         return ret;
 }
 
+static inline int kvm_write_guest_lock(struct kvm *kvm, gpa_t gpa,
+                                       const void *data, unsigned long len)
+{
+        int srcu_idx = srcu_read_lock(&kvm->srcu);
+        int ret = kvm_write_guest(kvm, gpa, data, len);
+
+        srcu_read_unlock(&kvm->srcu, srcu_idx);
+
+        return ret;
+}
+
 static inline void *kvm_get_hyp_vector(void)
 {
         switch(read_cpuid_part()) {
diff --git a/arch/arm/include/asm/stage2_pgtable.h b/arch/arm/include/asm/stage2_pgtable.h
index de2089501b8b..9e11dce55e06 100644
--- a/arch/arm/include/asm/stage2_pgtable.h
+++ b/arch/arm/include/asm/stage2_pgtable.h
@@ -75,6 +75,8 @@ static inline bool kvm_stage2_has_pud(struct kvm *kvm)
 
 #define S2_PMD_MASK                             PMD_MASK
 #define S2_PMD_SIZE                             PMD_SIZE
+#define S2_PUD_MASK                             PUD_MASK
+#define S2_PUD_SIZE                             PUD_SIZE
 
 static inline bool kvm_stage2_has_pmd(struct kvm *kvm)
 {
diff --git a/arch/arm/include/uapi/asm/Kbuild b/arch/arm/include/uapi/asm/Kbuild
index 23b4464c0995..ce8573157774 100644
--- a/arch/arm/include/uapi/asm/Kbuild
+++ b/arch/arm/include/uapi/asm/Kbuild
@@ -3,3 +3,4 @@
 generated-y += unistd-common.h
 generated-y += unistd-oabi.h
 generated-y += unistd-eabi.h
+generic-y += kvm_para.h
diff --git a/arch/arm/include/uapi/asm/kvm_para.h b/arch/arm/include/uapi/asm/kvm_para.h
deleted file mode 100644
index baacc4996d18..000000000000
--- a/arch/arm/include/uapi/asm/kvm_para.h
+++ /dev/null
@@ -1,2 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#include <asm-generic/kvm_para.h>
diff --git a/arch/arm/mach-imx/cpuidle-imx6q.c b/arch/arm/mach-imx/cpuidle-imx6q.c
index bfeb25aaf9a2..326e870d7123 100644
--- a/arch/arm/mach-imx/cpuidle-imx6q.c
+++ b/arch/arm/mach-imx/cpuidle-imx6q.c
@@ -16,30 +16,23 @@
 #include "cpuidle.h"
 #include "hardware.h"
 
-static atomic_t master = ATOMIC_INIT(0);
-static DEFINE_SPINLOCK(master_lock);
+static int num_idle_cpus = 0;
+static DEFINE_SPINLOCK(cpuidle_lock);
 
 static int imx6q_enter_wait(struct cpuidle_device *dev,
                             struct cpuidle_driver *drv, int index)
 {
-        if (atomic_inc_return(&master) == num_online_cpus()) {
-                /*
-                 * With this lock, we prevent other cpu to exit and enter
-                 * this function again and become the master.
-                 */
-                if (!spin_trylock(&master_lock))
-                        goto idle;
+        spin_lock(&cpuidle_lock);
+        if (++num_idle_cpus == num_online_cpus())
                 imx6_set_lpm(WAIT_UNCLOCKED);
-                cpu_do_idle();
-                imx6_set_lpm(WAIT_CLOCKED);
-                spin_unlock(&master_lock);
-                goto done;
-        }
+        spin_unlock(&cpuidle_lock);
 
-idle:
         cpu_do_idle();
-done:
-        atomic_dec(&master);
+
+        spin_lock(&cpuidle_lock);
+        if (num_idle_cpus-- == num_online_cpus())
+                imx6_set_lpm(WAIT_CLOCKED);
+        spin_unlock(&cpuidle_lock);
 
         return index;
 }
diff --git a/arch/arm/mach-imx/mach-imx51.c b/arch/arm/mach-imx/mach-imx51.c
index c7169c2f94c4..08c7892866c2 100644
--- a/arch/arm/mach-imx/mach-imx51.c
+++ b/arch/arm/mach-imx/mach-imx51.c
@@ -59,6 +59,7 @@ static void __init imx51_m4if_setup(void)
                 return;
 
         m4if_base = of_iomap(np, 0);
+        of_node_put(np);
         if (!m4if_base) {
                 pr_err("Unable to map M4IF registers\n");
                 return;
diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms
index 70498a033cf5..b5ca9c50876d 100644
--- a/arch/arm64/Kconfig.platforms
+++ b/arch/arm64/Kconfig.platforms
@@ -27,6 +27,7 @@ config ARCH_BCM2835
         bool "Broadcom BCM2835 family"
         select TIMER_OF
         select GPIOLIB
+        select MFD_CORE
         select PINCTRL
         select PINCTRL_BCM2835
         select ARM_AMBA
diff --git a/arch/arm64/boot/dts/nvidia/tegra186.dtsi b/arch/arm64/boot/dts/nvidia/tegra186.dtsi
index bb2045be8814..97aeb946ed5e 100644
--- a/arch/arm64/boot/dts/nvidia/tegra186.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra186.dtsi
@@ -321,7 +321,6 @@
                 nvidia,default-trim = <0x9>;
                 nvidia,dqs-trim = <63>;
                 mmc-hs400-1_8v;
-                supports-cqe;
                 status = "disabled";
         };
 
diff --git a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi
index 61a0afb74e63..1ea684af99c4 100644
--- a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi
+++ b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi
@@ -2,7 +2,7 @@
 /*
  * Device Tree Source for the RZ/G2E (R8A774C0) SoC
  *
- * Copyright (C) 2018 Renesas Electronics Corp.
+ * Copyright (C) 2018-2019 Renesas Electronics Corp.
  */
 
 #include <dt-bindings/clock/r8a774c0-cpg-mssr.h>
@@ -1150,9 +1150,8 @@
                                  <&cpg CPG_CORE R8A774C0_CLK_S3D1C>,
                                  <&scif_clk>;
                         clock-names = "fck", "brg_int", "scif_clk";
-                        dmas = <&dmac1 0x5b>, <&dmac1 0x5a>,
-                               <&dmac2 0x5b>, <&dmac2 0x5a>;
-                        dma-names = "tx", "rx", "tx", "rx";
+                        dmas = <&dmac0 0x5b>, <&dmac0 0x5a>;
+                        dma-names = "tx", "rx";
                         power-domains = <&sysc R8A774C0_PD_ALWAYS_ON>;
                         resets = <&cpg 202>;
                         status = "disabled";
diff --git a/arch/arm64/boot/dts/renesas/r8a77990.dtsi b/arch/arm64/boot/dts/renesas/r8a77990.dtsi
index a69faa60ea4d..d2ad665fe2d9 100644
--- a/arch/arm64/boot/dts/renesas/r8a77990.dtsi
+++ b/arch/arm64/boot/dts/renesas/r8a77990.dtsi
@@ -2,7 +2,7 @@
 /*
  * Device Tree Source for the R-Car E3 (R8A77990) SoC
  *
- * Copyright (C) 2018 Renesas Electronics Corp.
+ * Copyright (C) 2018-2019 Renesas Electronics Corp.
  */
 
 #include <dt-bindings/clock/r8a77990-cpg-mssr.h>
@@ -1067,9 +1067,8 @@
                                  <&cpg CPG_CORE R8A77990_CLK_S3D1C>,
                                  <&scif_clk>;
                         clock-names = "fck", "brg_int", "scif_clk";
-                        dmas = <&dmac1 0x5b>, <&dmac1 0x5a>,
-                               <&dmac2 0x5b>, <&dmac2 0x5a>;
-                        dma-names = "tx", "rx", "tx", "rx";
+                        dmas = <&dmac0 0x5b>, <&dmac0 0x5a>;
+                        dma-names = "tx", "rx";
                         power-domains = <&sysc R8A77990_PD_ALWAYS_ON>;
                         resets = <&cpg 202>;
                         status = "disabled";
diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index b0742a16c6c9..ebeefcf835e8 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -445,6 +445,17 @@ static inline int kvm_read_guest_lock(struct kvm *kvm,
         return ret;
 }
 
+static inline int kvm_write_guest_lock(struct kvm *kvm, gpa_t gpa,
+                                       const void *data, unsigned long len)
+{
+        int srcu_idx = srcu_read_lock(&kvm->srcu);
+        int ret = kvm_write_guest(kvm, gpa, data, len);
+
+        srcu_read_unlock(&kvm->srcu, srcu_idx);
+
+        return ret;
+}
+
 #ifdef CONFIG_KVM_INDIRECT_VECTORS
 /*
  * EL2 vectors can be mapped and rerouted in a number of ways,
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index f8482fe5a190..413d566405d1 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -217,7 +217,7 @@ static void __init request_standard_resources(void)
 
         num_standard_resources = memblock.memory.cnt;
         res_size = num_standard_resources * sizeof(*standard_resources);
-        standard_resources = memblock_alloc_low(res_size, SMP_CACHE_BYTES);
+        standard_resources = memblock_alloc(res_size, SMP_CACHE_BYTES);
         if (!standard_resources)
                 panic("%s: Failed to allocate %zu bytes\n", __func__, res_size);
 
diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
index f16a5f8ff2b4..e2a0500cd7a2 100644
--- a/arch/arm64/kvm/reset.c
+++ b/arch/arm64/kvm/reset.c
@@ -123,6 +123,9 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
         int ret = -EINVAL;
         bool loaded;
 
+        /* Reset PMU outside of the non-preemptible section */
+        kvm_pmu_vcpu_reset(vcpu);
+
         preempt_disable();
         loaded = (vcpu->cpu != -1);
         if (loaded)
@@ -170,9 +173,6 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
                 vcpu->arch.reset_state.reset = false;
         }
 
-        /* Reset PMU */
-        kvm_pmu_vcpu_reset(vcpu);
-
         /* Default workaround setup is enabled (if supported) */
         if (kvm_arm_have_ssbd() == KVM_SSBD_KERNEL)
                 vcpu->arch.workaround_flags |= VCPU_WORKAROUND_2_FLAG;
diff --git a/arch/c6x/include/asm/Kbuild b/arch/c6x/include/asm/Kbuild
index 63b4a1705182..249c9f6f26dc 100644
--- a/arch/c6x/include/asm/Kbuild
+++ b/arch/c6x/include/asm/Kbuild
@@ -19,6 +19,7 @@ generic-y += irq_work.h
 generic-y += kdebug.h
 generic-y += kmap_types.h
 generic-y += kprobes.h
+generic-y += kvm_para.h
 generic-y += local.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
diff --git a/arch/c6x/include/uapi/asm/Kbuild b/arch/c6x/include/uapi/asm/Kbuild
index 755bb11323d8..1c72f04ff75d 100644
--- a/arch/c6x/include/uapi/asm/Kbuild
+++ b/arch/c6x/include/uapi/asm/Kbuild
@@ -1,2 +1 @@
-generic-y += kvm_para.h
 generic-y += ucontext.h
diff --git a/arch/h8300/include/asm/Kbuild b/arch/h8300/include/asm/Kbuild
index 3e7c8ecf151e..e3dead402e5f 100644
--- a/arch/h8300/include/asm/Kbuild
+++ b/arch/h8300/include/asm/Kbuild
@@ -23,6 +23,7 @@ generic-y += irq_work.h
 generic-y += kdebug.h
 generic-y += kmap_types.h
 generic-y += kprobes.h
+generic-y += kvm_para.h
 generic-y += linkage.h
 generic-y += local.h
 generic-y += local64.h
diff --git a/arch/h8300/include/uapi/asm/Kbuild b/arch/h8300/include/uapi/asm/Kbuild
index 755bb11323d8..1c72f04ff75d 100644
--- a/arch/h8300/include/uapi/asm/Kbuild
+++ b/arch/h8300/include/uapi/asm/Kbuild
@@ -1,2 +1 @@
-generic-y += kvm_para.h
 generic-y += ucontext.h
diff --git a/arch/hexagon/include/asm/Kbuild b/arch/hexagon/include/asm/Kbuild
index b25fd42aa0f4..d046e8ccdf78 100644
--- a/arch/hexagon/include/asm/Kbuild
+++ b/arch/hexagon/include/asm/Kbuild
@@ -19,6 +19,7 @@ generic-y += irq_work.h
 generic-y += kdebug.h
 generic-y += kmap_types.h
 generic-y += kprobes.h
+generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
diff --git a/arch/hexagon/include/uapi/asm/kvm_para.h b/arch/hexagon/include/uapi/asm/kvm_para.h
deleted file mode 100644
index baacc4996d18..000000000000
--- a/arch/hexagon/include/uapi/asm/kvm_para.h
+++ /dev/null
@@ -1,2 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#include <asm-generic/kvm_para.h>
diff --git a/arch/ia64/include/asm/Kbuild b/arch/ia64/include/asm/Kbuild
index 43e21fe3499c..11f191689c9e 100644
--- a/arch/ia64/include/asm/Kbuild
+++ b/arch/ia64/include/asm/Kbuild
@@ -2,6 +2,7 @@ generated-y += syscall_table.h
 generic-y += compat.h
 generic-y += exec.h
 generic-y += irq_work.h
+generic-y += kvm_para.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
 generic-y += preempt.h
diff --git a/arch/ia64/include/uapi/asm/Kbuild b/arch/ia64/include/uapi/asm/Kbuild
index 20018cb883a9..62a9522af51e 100644
--- a/arch/ia64/include/uapi/asm/Kbuild
+++ b/arch/ia64/include/uapi/asm/Kbuild
@@ -1,2 +1 @@
 generated-y += unistd_64.h
-generic-y += kvm_para.h
diff --git a/arch/m68k/include/asm/Kbuild b/arch/m68k/include/asm/Kbuild
index 95f8f631c4df..2c359d9e80f6 100644
--- a/arch/m68k/include/asm/Kbuild
+++ b/arch/m68k/include/asm/Kbuild
@@ -13,6 +13,7 @@ generic-y += irq_work.h
 generic-y += kdebug.h
 generic-y += kmap_types.h
 generic-y += kprobes.h
+generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
diff --git a/arch/m68k/include/uapi/asm/Kbuild b/arch/m68k/include/uapi/asm/Kbuild
index 8a7ad40be463..7417847dc438 100644
--- a/arch/m68k/include/uapi/asm/Kbuild
+++ b/arch/m68k/include/uapi/asm/Kbuild
@@ -1,2 +1 @@
 generated-y += unistd_32.h
-generic-y += kvm_para.h
diff --git a/arch/microblaze/include/asm/Kbuild b/arch/microblaze/include/asm/Kbuild
index 791cc8d54d0a..1a8285c3f693 100644
--- a/arch/microblaze/include/asm/Kbuild
+++ b/arch/microblaze/include/asm/Kbuild
@@ -17,6 +17,7 @@ generic-y += irq_work.h
 generic-y += kdebug.h
 generic-y += kmap_types.h
 generic-y += kprobes.h
+generic-y += kvm_para.h
 generic-y += linkage.h
 generic-y += local.h
 generic-y += local64.h
diff --git a/arch/microblaze/include/uapi/asm/Kbuild b/arch/microblaze/include/uapi/asm/Kbuild
index 3ce84fbb2678..13f59631c576 100644
--- a/arch/microblaze/include/uapi/asm/Kbuild
+++ b/arch/microblaze/include/uapi/asm/Kbuild
@@ -1,3 +1,2 @@
 generated-y += unistd_32.h
-generic-y += kvm_para.h
 generic-y += ucontext.h
diff --git a/arch/nios2/include/asm/Kbuild b/arch/nios2/include/asm/Kbuild
index 8fde4fa2c34f..88a667d12aaa 100644
--- a/arch/nios2/include/asm/Kbuild
+++ b/arch/nios2/include/asm/Kbuild
@@ -23,6 +23,7 @@ generic-y += irq_work.h
 generic-y += kdebug.h
 generic-y += kmap_types.h
 generic-y += kprobes.h
+generic-y += kvm_para.h
 generic-y += local.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
diff --git a/arch/nios2/include/uapi/asm/Kbuild b/arch/nios2/include/uapi/asm/Kbuild
index 755bb11323d8..1c72f04ff75d 100644
--- a/arch/nios2/include/uapi/asm/Kbuild
+++ b/arch/nios2/include/uapi/asm/Kbuild
@@ -1,2 +1 @@
-generic-y += kvm_para.h
 generic-y += ucontext.h
diff --git a/arch/openrisc/include/asm/Kbuild b/arch/openrisc/include/asm/Kbuild
index 5a73e2956ac4..22aa97136c01 100644
--- a/arch/openrisc/include/asm/Kbuild
+++ b/arch/openrisc/include/asm/Kbuild
@@ -20,6 +20,7 @@ generic-y += irq_work.h
 generic-y += kdebug.h
 generic-y += kmap_types.h
 generic-y += kprobes.h
+generic-y += kvm_para.h
 generic-y += local.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
diff --git a/arch/openrisc/include/uapi/asm/Kbuild b/arch/openrisc/include/uapi/asm/Kbuild
index 755bb11323d8..1c72f04ff75d 100644
--- a/arch/openrisc/include/uapi/asm/Kbuild
+++ b/arch/openrisc/include/uapi/asm/Kbuild
@@ -1,2 +1 @@
-generic-y += kvm_para.h
 generic-y += ucontext.h
diff --git a/arch/parisc/include/asm/Kbuild b/arch/parisc/include/asm/Kbuild
index 6f49e77d82a2..9bcd0c903dbb 100644
--- a/arch/parisc/include/asm/Kbuild
+++ b/arch/parisc/include/asm/Kbuild
@@ -11,6 +11,7 @@ generic-y += irq_regs.h
 generic-y += irq_work.h
 generic-y += kdebug.h
 generic-y += kprobes.h
+generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
diff --git a/arch/parisc/include/uapi/asm/Kbuild b/arch/parisc/include/uapi/asm/Kbuild
index 22fdbd08cdc8..2bd5b392277c 100644
--- a/arch/parisc/include/uapi/asm/Kbuild
+++ b/arch/parisc/include/uapi/asm/Kbuild
@@ -1,3 +1,2 @@
 generated-y += unistd_32.h
 generated-y += unistd_64.h
-generic-y += kvm_para.h
diff --git a/arch/powerpc/lib/memcmp_64.S b/arch/powerpc/lib/memcmp_64.S
index 844d8e774492..b7f6f6e0b6e8 100644
--- a/arch/powerpc/lib/memcmp_64.S
+++ b/arch/powerpc/lib/memcmp_64.S
@@ -215,11 +215,20 @@ _GLOBAL_TOC(memcmp)
         beq     .Lzero
 
 .Lcmp_rest_lt8bytes:
-        /* Here we have only less than 8 bytes to compare with. at least s1
-         * Address is aligned with 8 bytes.
-         * The next double words are load and shift right with appropriate
-         * bits.
+        /*
+         * Here we have less than 8 bytes to compare. At least s1 is aligned to
+         * 8 bytes, but s2 may not be. We must make sure s2 + 7 doesn't cross a
+         * page boundary, otherwise we might read past the end of the buffer and
+         * trigger a page fault. We use 4K as the conservative minimum page
+         * size. If we detect that case we go to the byte-by-byte loop.
+         *
+         * Otherwise the next double word is loaded from s1 and s2, and shifted
+         * right to compare the appropriate bits.
          */
+        clrldi  r6,r4,(64-12)   // r6 = r4 & 0xfff
+        cmpdi   r6,0xff8
+        bgt     .Lshort
+
         subfic  r6,r5,8
         slwi    r6,r6,3
         LD      rA,0,r3
diff --git a/arch/powerpc/platforms/pseries/pseries_energy.c b/arch/powerpc/platforms/pseries/pseries_energy.c
index 6ed22127391b..921f12182f3e 100644
--- a/arch/powerpc/platforms/pseries/pseries_energy.c
+++ b/arch/powerpc/platforms/pseries/pseries_energy.c
@@ -77,18 +77,27 @@ static u32 cpu_to_drc_index(int cpu)
 
                 ret = drc.drc_index_start + (thread_index * drc.sequential_inc);
         } else {
-                const __be32 *indexes;
-
-                indexes = of_get_property(dn, "ibm,drc-indexes", NULL);
-                if (indexes == NULL)
-                        goto err_of_node_put;
+                u32 nr_drc_indexes, thread_drc_index;
 
                 /*
-                 * The first element indexes[0] is the number of drc_indexes
-                 * returned in the list.  Hence thread_index+1 will get the
-                 * drc_index corresponding to core number thread_index.
+                 * The first element of ibm,drc-indexes array is the
+                 * number of drc_indexes returned in the list.  Hence
+                 * thread_index+1 will get the drc_index corresponding
+                 * to core number thread_index.
                  */
-                ret = indexes[thread_index + 1];
+                rc = of_property_read_u32_index(dn, "ibm,drc-indexes",
+                                                0, &nr_drc_indexes);
+                if (rc)
+                        goto err_of_node_put;
+
+                WARN_ON_ONCE(thread_index > nr_drc_indexes);
+                rc = of_property_read_u32_index(dn, "ibm,drc-indexes",
+                                                thread_index + 1,
+                                                &thread_drc_index);
+                if (rc)
+                        goto err_of_node_put;
+
+                ret = thread_drc_index;
         }
 
         rc = 0;
diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
index d97d52772789..452dcfd7e5dd 100644
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -550,6 +550,7 @@ static void pseries_print_mce_info(struct pt_regs *regs,
                 "UE",
                 "SLB",
                 "ERAT",
+                "Unknown",
                 "TLB",
                 "D-Cache",
                 "Unknown",
diff --git a/arch/riscv/include/asm/fixmap.h b/arch/riscv/include/asm/fixmap.h
index 57afe604b495..c207f6634b91 100644
--- a/arch/riscv/include/asm/fixmap.h
+++ b/arch/riscv/include/asm/fixmap.h
@@ -26,7 +26,7 @@ enum fixed_addresses {
 };
 
 #define FIXADDR_SIZE            (__end_of_fixed_addresses * PAGE_SIZE)
-#define FIXADDR_TOP             (PAGE_OFFSET)
+#define FIXADDR_TOP             (VMALLOC_START)
 #define FIXADDR_START           (FIXADDR_TOP - FIXADDR_SIZE)
 
 #define FIXMAP_PAGE_IO          PAGE_KERNEL
diff --git a/arch/riscv/include/asm/uaccess.h b/arch/riscv/include/asm/uaccess.h
index a00168b980d2..fb53a8089e76 100644
--- a/arch/riscv/include/asm/uaccess.h
+++ b/arch/riscv/include/asm/uaccess.h
@@ -300,7 +300,7 @@ do {								\
                 "       .balign 4\n"                            \
                 "4:\n"                                          \
                 "       li %0, %6\n"                            \
-                "       jump 2b, %1\n"                          \
+                "       jump 3b, %1\n"                          \
                 "       .previous\n"                            \
                 "       .section __ex_table,\"a\"\n"            \
                 "       .balign " RISCV_SZPTR "\n"                      \
diff --git a/arch/riscv/kernel/Makefile b/arch/riscv/kernel/Makefile
index f13f7f276639..598568168d35 100644
--- a/arch/riscv/kernel/Makefile
+++ b/arch/riscv/kernel/Makefile
@@ -4,7 +4,6 @@
 
 ifdef CONFIG_FTRACE
 CFLAGS_REMOVE_ftrace.o = -pg
-CFLAGS_REMOVE_setup.o = -pg
 endif
 
 extra-y += head.o
@@ -29,8 +28,6 @@ obj-y	+= vdso.o
 obj-y   += cacheinfo.o
 obj-y   += vdso/
 
-CFLAGS_setup.o := -mcmodel=medany
-
 obj-$(CONFIG_FPU)               += fpu.o
 obj-$(CONFIG_SMP)               += smpboot.o
 obj-$(CONFIG_SMP)               += smp.o
diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
index 7dd308129b40..2872edce894d 100644
--- a/arch/riscv/kernel/module.c
+++ b/arch/riscv/kernel/module.c
@@ -141,7 +141,7 @@ static int apply_r_riscv_hi20_rela(struct module *me, u32 *location,
 {
         s32 hi20;
 
-        if (IS_ENABLED(CMODEL_MEDLOW)) {
+        if (IS_ENABLED(CONFIG_CMODEL_MEDLOW)) {
                 pr_err(
                   "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
                   me->name, (long long)v, location);
diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
index ecb654f6a79e..540a331d1376 100644
--- a/arch/riscv/kernel/setup.c
+++ b/arch/riscv/kernel/setup.c
@@ -48,14 +48,6 @@ struct screen_info screen_info = {
 };
 #endif
 
-unsigned long va_pa_offset;
-EXPORT_SYMBOL(va_pa_offset);
-unsigned long pfn_base;
-EXPORT_SYMBOL(pfn_base);
-
-unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)] __page_aligned_bss;
-EXPORT_SYMBOL(empty_zero_page);
-
 /* The lucky hart to first increment this variable will boot the other cores */
 atomic_t hart_lottery;
 unsigned long boot_cpu_hartid;
diff --git a/arch/riscv/mm/Makefile b/arch/riscv/mm/Makefile
index eb22ab49b3e0..b68aac701803 100644
--- a/arch/riscv/mm/Makefile
+++ b/arch/riscv/mm/Makefile
@@ -1,3 +1,9 @@
+
+CFLAGS_init.o := -mcmodel=medany
+ifdef CONFIG_FTRACE
+CFLAGS_REMOVE_init.o = -pg
+endif
+
 obj-y += init.o
 obj-y += fault.o
 obj-y += extable.o
diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index b379a75ac6a6..5fd8c922e1c2 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -25,6 +25,10 @@
 #include <asm/pgtable.h>
 #include <asm/io.h>
 
+unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]
+                                                        __page_aligned_bss;
+EXPORT_SYMBOL(empty_zero_page);
+
 static void __init zone_sizes_init(void)
 {
         unsigned long max_zone_pfns[MAX_NR_ZONES] = { 0, };
@@ -143,6 +147,11 @@ void __init setup_bootmem(void)
         }
 }
 
+unsigned long va_pa_offset;
+EXPORT_SYMBOL(va_pa_offset);
+unsigned long pfn_base;
+EXPORT_SYMBOL(pfn_base);
+
 pgd_t swapper_pg_dir[PTRS_PER_PGD] __page_aligned_bss;
 pgd_t trampoline_pg_dir[PTRS_PER_PGD] __initdata __aligned(PAGE_SIZE);
 
@@ -172,6 +181,25 @@ void __set_fixmap(enum fixed_addresses idx, phys_addr_t phys, pgprot_t prot)
         }
 }
 
+/*
+ * setup_vm() is called from head.S with MMU-off.
+ *
+ * Following requirements should be honoured for setup_vm() to work
+ * correctly:
+ * 1) It should use PC-relative addressing for accessing kernel symbols.
+ *    To achieve this we always use GCC cmodel=medany.
+ * 2) The compiler instrumentation for FTRACE will not work for setup_vm()
+ *    so disable compiler instrumentation when FTRACE is enabled.
+ *
+ * Currently, the above requirements are honoured by using custom CFLAGS
+ * for init.o in mm/Makefile.
+ */
+
+#ifndef __riscv_cmodel_medany
+#error "setup_vm() is called from head.S before relocate so it should "
+        "not use absolute addressing."
+#endif
+
 asmlinkage void __init setup_vm(void)
 {
         extern char _start;
diff --git a/arch/s390/include/asm/ap.h b/arch/s390/include/asm/ap.h
index 1a6a7092d942..e94a0a28b5eb 100644
--- a/arch/s390/include/asm/ap.h
+++ b/arch/s390/include/asm/ap.h
@@ -360,4 +360,15 @@ static inline struct ap_queue_status ap_dqap(ap_qid_t qid,
         return reg1;
 }
 
+/*
+ * Interface to tell the AP bus code that a configuration
+ * change has happened. The bus code should at least do
+ * an ap bus resource rescan.
+ */
+#if IS_ENABLED(CONFIG_ZCRYPT)
+void ap_bus_cfg_chg(void);
+#else
+static inline void ap_bus_cfg_chg(void){};
+#endif
+
 #endif /* _ASM_S390_AP_H_ */
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index 7d22a474a040..f74639a05f0f 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -252,11 +252,14 @@ do {								\
 
 /*
  * Cache aliasing on the latest machines calls for a mapping granularity
- * of 512KB. For 64-bit processes use a 512KB alignment and a randomization
- * of up to 1GB. For 31-bit processes the virtual address space is limited,
- * use no alignment and limit the randomization to 8MB.
+ * of 512KB for the anonymous mapping base. For 64-bit processes use a
+ * 512KB alignment and a randomization of up to 1GB. For 31-bit processes
+ * the virtual address space is limited, use no alignment and limit the
+ * randomization to 8MB.
+ * For the additional randomization of the program break use 32MB for
+ * 64-bit and 8MB for 31-bit.
  */
-#define BRK_RND_MASK    (is_compat_task() ? 0x7ffUL : 0x3ffffUL)
+#define BRK_RND_MASK    (is_compat_task() ? 0x7ffUL : 0x1fffUL)
 #define MMAP_RND_MASK   (is_compat_task() ? 0x7ffUL : 0x3ff80UL)
 #define MMAP_ALIGN_MASK (is_compat_task() ? 0 : 0x7fUL)
 #define STACK_RND_MASK  MMAP_RND_MASK
diff --git a/arch/s390/include/asm/lowcore.h b/arch/s390/include/asm/lowcore.h
index cc0947e08b6f..5b9f10b1e55d 100644
--- a/arch/s390/include/asm/lowcore.h
+++ b/arch/s390/include/asm/lowcore.h
@@ -91,52 +91,53 @@ struct lowcore {
         __u64   hardirq_timer;                  /* 0x02e8 */
         __u64   softirq_timer;                  /* 0x02f0 */
         __u64   steal_timer;                    /* 0x02f8 */
-        __u64   last_update_timer;              /* 0x0300 */
-        __u64   last_update_clock;              /* 0x0308 */
-        __u64   int_clock;                      /* 0x0310 */
-        __u64   mcck_clock;                     /* 0x0318 */
-        __u64   clock_comparator;               /* 0x0320 */
-        __u64   boot_clock[2];                  /* 0x0328 */
+        __u64   avg_steal_timer;                /* 0x0300 */
+        __u64   last_update_timer;              /* 0x0308 */
+        __u64   last_update_clock;              /* 0x0310 */
+        __u64   int_clock;                      /* 0x0318*/
+        __u64   mcck_clock;                     /* 0x0320 */
+        __u64   clock_comparator;               /* 0x0328 */
+        __u64   boot_clock[2];                  /* 0x0330 */
 
         /* Current process. */
-        __u64   current_task;                   /* 0x0338 */
-        __u64   kernel_stack;                   /* 0x0340 */
+        __u64   current_task;                   /* 0x0340 */
+        __u64   kernel_stack;                   /* 0x0348 */
 
         /* Interrupt, DAT-off and restartstack. */
-        __u64   async_stack;                    /* 0x0348 */
-        __u64   nodat_stack;                    /* 0x0350 */
-        __u64   restart_stack;                  /* 0x0358 */
+        __u64   async_stack;                    /* 0x0350 */
+        __u64   nodat_stack;                    /* 0x0358 */
+        __u64   restart_stack;                  /* 0x0360 */
 
         /* Restart function and parameter. */
-        __u64   restart_fn;                     /* 0x0360 */
-        __u64   restart_data;                   /* 0x0368 */
-        __u64   restart_source;                 /* 0x0370 */
+        __u64   restart_fn;                     /* 0x0368 */
+        __u64   restart_data;                   /* 0x0370 */
+        __u64   restart_source;                 /* 0x0378 */
 
         /* Address space pointer. */
-        __u64   kernel_asce;                    /* 0x0378 */
-        __u64   user_asce;                      /* 0x0380 */
-        __u64   vdso_asce;                      /* 0x0388 */
+        __u64   kernel_asce;                    /* 0x0380 */
+        __u64   user_asce;                      /* 0x0388 */
+        __u64   vdso_asce;                      /* 0x0390 */
 
         /*
          * The lpp and current_pid fields form a
          * 64-bit value that is set as program
          * parameter with the LPP instruction.
          */
-        __u32   lpp;                            /* 0x0390 */
-        __u32   current_pid;                    /* 0x0394 */
+        __u32   lpp;                            /* 0x0398 */
+        __u32   current_pid;                    /* 0x039c */
 
         /* SMP info area */
-        __u32   cpu_nr;                         /* 0x0398 */
-        __u32   softirq_pending;                /* 0x039c */
-        __u32   preempt_count;                  /* 0x03a0 */
-        __u32   spinlock_lockval;               /* 0x03a4 */
-        __u32   spinlock_index;                 /* 0x03a8 */
-        __u32   fpu_flags;                      /* 0x03ac */
-        __u64   percpu_offset;                  /* 0x03b0 */
-        __u64   vdso_per_cpu_data;              /* 0x03b8 */
-        __u64   machine_flags;                  /* 0x03c0 */
-        __u64   gmap;                           /* 0x03c8 */
-        __u8    pad_0x03d0[0x0400-0x03d0];      /* 0x03d0 */
+        __u32   cpu_nr;                         /* 0x03a0 */
+        __u32   softirq_pending;                /* 0x03a4 */
+        __u32   preempt_count;                  /* 0x03a8 */
+        __u32   spinlock_lockval;               /* 0x03ac */
+        __u32   spinlock_index;                 /* 0x03b0 */
+        __u32   fpu_flags;                      /* 0x03b4 */
+        __u64   percpu_offset;                  /* 0x03b8 */
+        __u64   vdso_per_cpu_data;              /* 0x03c0 */
+        __u64   machine_flags;                  /* 0x03c8 */
+        __u64   gmap;                           /* 0x03d0 */
+        __u8    pad_0x03d8[0x0400-0x03d8];      /* 0x03d8 */
 
         /* br %r1 trampoline */
         __u16   br_r1_trampoline;               /* 0x0400 */
diff --git a/arch/s390/kernel/perf_cpum_cf_diag.c b/arch/s390/kernel/perf_cpum_cf_diag.c
index c6fad208c2fa..b6854812d2ed 100644
--- a/arch/s390/kernel/perf_cpum_cf_diag.c
+++ b/arch/s390/kernel/perf_cpum_cf_diag.c
@@ -196,23 +196,30 @@ static void cf_diag_perf_event_destroy(struct perf_event *event)
  */
 static int __hw_perf_event_init(struct perf_event *event)
 {
-        struct cpu_cf_events *cpuhw = this_cpu_ptr(&cpu_cf_events);
         struct perf_event_attr *attr = &event->attr;
+        struct cpu_cf_events *cpuhw;
         enum cpumf_ctr_set i;
         int err = 0;
 
-        debug_sprintf_event(cf_diag_dbg, 5,
-                            "%s event %p cpu %d authorized %#x\n", __func__,
-                            event, event->cpu, cpuhw->info.auth_ctl);
+        debug_sprintf_event(cf_diag_dbg, 5, "%s event %p cpu %d\n", __func__,
+                            event, event->cpu);
 
         event->hw.config = attr->config;
         event->hw.config_base = 0;
-        local64_set(&event->count, 0);
 
-        /* Add all authorized counter sets to config_base */
+        /* Add all authorized counter sets to config_base. The
+         * the hardware init function is either called per-cpu or just once
+         * for all CPUS (event->cpu == -1).  This depends on the whether
+         * counting is started for all CPUs or on a per workload base where
+         * the perf event moves from one CPU to another CPU.
+         * Checking the authorization on any CPU is fine as the hardware
+         * applies the same authorization settings to all CPUs.
+         */
+        cpuhw = &get_cpu_var(cpu_cf_events);
         for (i = CPUMF_CTR_SET_BASIC; i < CPUMF_CTR_SET_MAX; ++i)
                 if (cpuhw->info.auth_ctl & cpumf_ctr_ctl[i])
                         event->hw.config_base |= cpumf_ctr_ctl[i];
+        put_cpu_var(cpu_cf_events);
 
         /* No authorized counter sets, nothing to count/sample */
         if (!event->hw.config_base) {
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 3fe1c77c361b..bd197baf1dc3 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -266,7 +266,8 @@ static void pcpu_prepare_secondary(struct pcpu *pcpu, int cpu)
         lc->percpu_offset = __per_cpu_offset[cpu];
         lc->kernel_asce = S390_lowcore.kernel_asce;
         lc->machine_flags = S390_lowcore.machine_flags;
-        lc->user_timer = lc->system_timer = lc->steal_timer = 0;
+        lc->user_timer = lc->system_timer =
+                lc->steal_timer = lc->avg_steal_timer = 0;
         __ctl_store(lc->cregs_save_area, 0, 15);
         save_access_regs((unsigned int *) lc->access_regs_save_area);
         memcpy(lc->stfle_fac_list, S390_lowcore.stfle_fac_list,
diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
index 98f850e00008..a69a0911ed0e 100644
--- a/arch/s390/kernel/vtime.c
+++ b/arch/s390/kernel/vtime.c
@@ -124,7 +124,7 @@ static void account_system_index_scaled(struct task_struct *p, u64 cputime,
  */
 static int do_account_vtime(struct task_struct *tsk)
 {
-        u64 timer, clock, user, guest, system, hardirq, softirq, steal;
+        u64 timer, clock, user, guest, system, hardirq, softirq;
 
         timer = S390_lowcore.last_update_timer;
         clock = S390_lowcore.last_update_clock;
@@ -182,12 +182,6 @@ static int do_account_vtime(struct task_struct *tsk)
         if (softirq)
                 account_system_index_scaled(tsk, softirq, CPUTIME_SOFTIRQ);
 
-        steal = S390_lowcore.steal_timer;
-        if ((s64) steal > 0) {
-                S390_lowcore.steal_timer = 0;
-                account_steal_time(cputime_to_nsecs(steal));
-        }
-
         return virt_timer_forward(user + guest + system + hardirq + softirq);
 }
 
@@ -213,8 +207,19 @@ void vtime_task_switch(struct task_struct *prev)
  */
 void vtime_flush(struct task_struct *tsk)
 {
+        u64 steal, avg_steal;
+
         if (do_account_vtime(tsk))
                 virt_timer_expire();
+
+        steal = S390_lowcore.steal_timer;
+        avg_steal = S390_lowcore.avg_steal_timer / 2;
+        if ((s64) steal > 0) {
+                S390_lowcore.steal_timer = 0;
+                account_steal_time(steal);
+                avg_steal += steal;
+        }
+        S390_lowcore.avg_steal_timer = avg_steal;
 }
 
 /*
diff --git a/arch/sh/include/asm/Kbuild b/arch/sh/include/asm/Kbuild
index a6ef3fee5f85..7bf2cb680d32 100644
--- a/arch/sh/include/asm/Kbuild
+++ b/arch/sh/include/asm/Kbuild
@@ -9,6 +9,7 @@ generic-y += emergency-restart.h
 generic-y += exec.h
 generic-y += irq_regs.h
 generic-y += irq_work.h
+generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
diff --git a/arch/sh/include/uapi/asm/Kbuild b/arch/sh/include/uapi/asm/Kbuild
index ecfbd40924dd..b8812c74c1de 100644
--- a/arch/sh/include/uapi/asm/Kbuild
+++ b/arch/sh/include/uapi/asm/Kbuild
@@ -1,5 +1,4 @@
 # SPDX-License-Identifier: GPL-2.0
 
 generated-y += unistd_32.h
-generic-y += kvm_para.h
 generic-y += ucontext.h
diff --git a/arch/sparc/include/asm/Kbuild b/arch/sparc/include/asm/Kbuild
index b82f64e28f55..a22cfd5c0ee8 100644
--- a/arch/sparc/include/asm/Kbuild
+++ b/arch/sparc/include/asm/Kbuild
@@ -9,6 +9,7 @@ generic-y += exec.h
 generic-y += export.h
 generic-y += irq_regs.h
 generic-y += irq_work.h
+generic-y += kvm_para.h
 generic-y += linkage.h
 generic-y += local.h
 generic-y += local64.h
diff --git a/arch/sparc/include/uapi/asm/kvm_para.h b/arch/sparc/include/uapi/asm/kvm_para.h
deleted file mode 100644
index baacc4996d18..000000000000
--- a/arch/sparc/include/uapi/asm/kvm_para.h
+++ /dev/null
@@ -1,2 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#include <asm-generic/kvm_para.h>
diff --git a/arch/unicore32/include/asm/Kbuild b/arch/unicore32/include/asm/Kbuild
index 1d1544b6ca74..d77d953c04c1 100644
--- a/arch/unicore32/include/asm/Kbuild
+++ b/arch/unicore32/include/asm/Kbuild
@@ -18,6 +18,7 @@ generic-y += irq_work.h
 generic-y += kdebug.h
 generic-y += kmap_types.h
 generic-y += kprobes.h
+generic-y += kvm_para.h
 generic-y += local.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
diff --git a/arch/unicore32/include/uapi/asm/Kbuild b/arch/unicore32/include/uapi/asm/Kbuild
index 755bb11323d8..1c72f04ff75d 100644
--- a/arch/unicore32/include/uapi/asm/Kbuild
+++ b/arch/unicore32/include/uapi/asm/Kbuild
@@ -1,2 +1 @@
-generic-y += kvm_para.h
 generic-y += ucontext.h
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index c1f9b3cf437c..5ad92419be19 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2217,14 +2217,8 @@ config RANDOMIZE_MEMORY_PHYSICAL_PADDING
            If unsure, leave at the default value.
 
 config HOTPLUG_CPU
-        bool "Support for hot-pluggable CPUs"
+        def_bool y
         depends on SMP
-        ---help---
-          Say Y here to allow turning CPUs off and on. CPUs can be
-          controlled through /sys/devices/system/cpu.
-          ( Note: power management support will enable this option
-            automatically on SMP systems. )
-          Say N if you want to disable CPU hotplug.
 
 config BOOTPARAM_HOTPLUG_CPU0
         bool "Set default setting of cpu0_hotpluggable"
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 2d8b9d8ca4f8..a587805c6687 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -219,8 +219,12 @@ ifdef CONFIG_RETPOLINE
   # Additionally, avoid generating expensive indirect jumps which
   # are subject to retpolines for small number of switch cases.
   # clang turns off jump table generation by default when under
-  # retpoline builds, however, gcc does not for x86.
-  KBUILD_CFLAGS += $(call cc-option,--param=case-values-threshold=20)
+  # retpoline builds, however, gcc does not for x86. This has
+  # only been fixed starting from gcc stable version 8.4.0 and
+  # onwards, but not for older ones. See gcc bug #86952.
+  ifndef CONFIG_CC_IS_CLANG
+    KBUILD_CFLAGS += $(call cc-option,-fno-jump-tables)
+  endif
 endif
 
 archscripts: scripts_basic
diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h
index fd13655e0f9b..d2f184165934 100644
--- a/arch/x86/boot/compressed/misc.h
+++ b/arch/x86/boot/compressed/misc.h
@@ -120,8 +120,6 @@ static inline void console_init(void)
 
 void set_sev_encryption_mask(void);
 
-#endif
-
 /* acpi.c */
 #ifdef CONFIG_ACPI
 acpi_physical_address get_rsdp_addr(void);
@@ -135,3 +133,5 @@ int count_immovable_mem_regions(void);
 #else
 static inline int count_immovable_mem_regions(void) { return 0; }
 #endif
+
+#endif /* BOOT_COMPRESSED_MISC_H */
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index ce95b8cbd229..0e56ff7e4848 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -112,8 +112,9 @@ extern const char * const x86_bug_flags[NBUGINTS*32];
          test_cpu_cap(c, bit))
 
 #define this_cpu_has(bit)                                               \
-        (__builtin_constant_p(bit) && REQUIRED_MASK_BIT_SET(bit) ? 1 :  \
-         x86_this_cpu_test_bit(bit, (unsigned long *)&cpu_info.x86_capability))
+        (__builtin_constant_p(bit) && REQUIRED_MASK_BIT_SET(bit) ? 1 :  \
+         x86_this_cpu_test_bit(bit,                                     \
+                (unsigned long __percpu *)&cpu_info.x86_capability))
 
 /*
  * This macro is for detection of features which need kernel
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index a5db4475e72d..159b5988292f 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -253,14 +253,14 @@ struct kvm_mmu_memory_cache {
  * kvm_memory_slot.arch.gfn_track which is 16 bits, so the role bits used
  * by indirect shadow page can not be more than 15 bits.
  *
- * Currently, we used 14 bits that are @level, @cr4_pae, @quadrant, @access,
+ * Currently, we used 14 bits that are @level, @gpte_is_8_bytes, @quadrant, @access,
  * @nxe, @cr0_wp, @smep_andnot_wp and @smap_andnot_wp.
  */
 union kvm_mmu_page_role {
         u32 word;
         struct {
                 unsigned level:4;
-                unsigned cr4_pae:1;
+                unsigned gpte_is_8_bytes:1;
                 unsigned quadrant:2;
                 unsigned direct:1;
                 unsigned access:3;
@@ -350,6 +350,7 @@ struct kvm_mmu_page {
 };
 
 struct kvm_pio_request {
+        unsigned long linear_rip;
         unsigned long count;
         int in;
         int port;
@@ -568,6 +569,7 @@ struct kvm_vcpu_arch {
         bool tpr_access_reporting;
         u64 ia32_xss;
         u64 microcode_version;
+        u64 arch_capabilities;
 
         /*
          * Paging state of the vcpu
@@ -1192,6 +1194,8 @@ struct kvm_x86_ops {
         int (*nested_enable_evmcs)(struct kvm_vcpu *vcpu,
                                    uint16_t *vmcs_version);
         uint16_t (*nested_get_evmcs_version)(struct kvm_vcpu *vcpu);
+
+        bool (*need_emulation_on_page_fault)(struct kvm_vcpu *vcpu);
 };
 
 struct kvm_arch_async_pf {
@@ -1252,7 +1256,7 @@ void kvm_mmu_clear_dirty_pt_masked(struct kvm *kvm,
                                    gfn_t gfn_offset, unsigned long mask);
 void kvm_mmu_zap_all(struct kvm *kvm);
 void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u64 gen);
-unsigned int kvm_mmu_calculate_mmu_pages(struct kvm *kvm);
+unsigned int kvm_mmu_calculate_default_mmu_pages(struct kvm *kvm);
 void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int kvm_nr_mmu_pages);
 
 int load_pdptrs(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, unsigned long cr3);
diff --git a/arch/x86/include/asm/realmode.h b/arch/x86/include/asm/realmode.h
index 63b3393bd98e..c53682303c9c 100644
--- a/arch/x86/include/asm/realmode.h
+++ b/arch/x86/include/asm/realmode.h
@@ -77,7 +77,11 @@ static inline size_t real_mode_size_needed(void)
         return ALIGN(real_mode_blob_end - real_mode_blob, PAGE_SIZE);
 }
 
-void set_real_mode_mem(phys_addr_t mem, size_t size);
+static inline void set_real_mode_mem(phys_addr_t mem)
+{
+        real_mode_header = (struct real_mode_header *) __va(mem);
+}
+
 void reserve_real_mode(void);
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/x86/kernel/cpu/resctrl/monitor.c b/arch/x86/kernel/cpu/resctrl/monitor.c
index f33f11f69078..1573a0a6b525 100644
--- a/arch/x86/kernel/cpu/resctrl/monitor.c
+++ b/arch/x86/kernel/cpu/resctrl/monitor.c
@@ -501,11 +501,8 @@ out_unlock:
 void cqm_setup_limbo_handler(struct rdt_domain *dom, unsigned long delay_ms)
 {
         unsigned long delay = msecs_to_jiffies(delay_ms);
-        struct rdt_resource *r;
         int cpu;
 
-        r = &rdt_resources_all[RDT_RESOURCE_L3];
-
         cpu = cpumask_any(&dom->cpu_mask);
         dom->cqm_work_cpu = cpu;
 
diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
index 27c43525a05f..421899f6ad7b 100644
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -526,7 +526,9 @@ static int stimer_set_config(struct kvm_vcpu_hv_stimer *stimer, u64 config,
                 new_config.enable = 0;
         stimer->config.as_uint64 = new_config.as_uint64;
 
-        stimer_mark_pending(stimer, false);
+        if (stimer->config.enable)
+                stimer_mark_pending(stimer, false);
+
         return 0;
 }
 
@@ -542,7 +544,10 @@ static int stimer_set_count(struct kvm_vcpu_hv_stimer *stimer, u64 count,
                 stimer->config.enable = 0;
         else if (stimer->config.auto_enable)
                 stimer->config.enable = 1;
-        stimer_mark_pending(stimer, false);
+
+        if (stimer->config.enable)
+                stimer_mark_pending(stimer, false);
+
         return 0;
 }
 
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 7837ab001d80..eee455a8a612 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -182,7 +182,7 @@ struct kvm_shadow_walk_iterator {
 
 static const union kvm_mmu_page_role mmu_base_role_mask = {
         .cr0_wp = 1,
-        .cr4_pae = 1,
+        .gpte_is_8_bytes = 1,
         .nxe = 1,
         .smep_andnot_wp = 1,
         .smap_andnot_wp = 1,
@@ -2205,6 +2205,7 @@ static bool kvm_mmu_prepare_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp,
 static void kvm_mmu_commit_zap_page(struct kvm *kvm,
                                     struct list_head *invalid_list);
 
+
 #define for_each_valid_sp(_kvm, _sp, _gfn)                              \
         hlist_for_each_entry(_sp,                                       \
           &(_kvm)->arch.mmu_page_hash[kvm_page_table_hashfn(_gfn)], hash_link) \
@@ -2215,12 +2216,17 @@ static void kvm_mmu_commit_zap_page(struct kvm *kvm,
         for_each_valid_sp(_kvm, _sp, _gfn)                              \
                 if ((_sp)->gfn != (_gfn) || (_sp)->role.direct) {} else
 
+static inline bool is_ept_sp(struct kvm_mmu_page *sp)
+{
+        return sp->role.cr0_wp && sp->role.smap_andnot_wp;
+}
+
 /* @sp->gfn should be write-protected at the call site */
 static bool __kvm_sync_page(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
                             struct list_head *invalid_list)
 {
-        if (sp->role.cr4_pae != !!is_pae(vcpu)
-            || vcpu->arch.mmu->sync_page(vcpu, sp) == 0) {
+        if ((!is_ept_sp(sp) && sp->role.gpte_is_8_bytes != !!is_pae(vcpu)) ||
+            vcpu->arch.mmu->sync_page(vcpu, sp) == 0) {
                 kvm_mmu_prepare_zap_page(vcpu->kvm, sp, invalid_list);
                 return false;
         }
@@ -2423,7 +2429,7 @@ static struct kvm_mmu_page *kvm_mmu_get_page(struct kvm_vcpu *vcpu,
         role.level = level;
         role.direct = direct;
         if (role.direct)
-                role.cr4_pae = 0;
+                role.gpte_is_8_bytes = true;
         role.access = access;
         if (!vcpu->arch.mmu->direct_map
             && vcpu->arch.mmu->root_level <= PT32_ROOT_LEVEL) {
@@ -4794,7 +4800,6 @@ static union kvm_mmu_role kvm_calc_mmu_role_common(struct kvm_vcpu *vcpu,
 
         role.base.access = ACC_ALL;
         role.base.nxe = !!is_nx(vcpu);
-        role.base.cr4_pae = !!is_pae(vcpu);
         role.base.cr0_wp = is_write_protection(vcpu);
         role.base.smm = is_smm(vcpu);
         role.base.guest_mode = is_guest_mode(vcpu);
@@ -4815,6 +4820,7 @@ kvm_calc_tdp_mmu_root_page_role(struct kvm_vcpu *vcpu, bool base_only)
         role.base.ad_disabled = (shadow_accessed_mask == 0);
         role.base.level = kvm_x86_ops->get_tdp_level(vcpu);
         role.base.direct = true;
+        role.base.gpte_is_8_bytes = true;
 
         return role;
 }
@@ -4879,6 +4885,7 @@ kvm_calc_shadow_mmu_root_page_role(struct kvm_vcpu *vcpu, bool base_only)
         role.base.smap_andnot_wp = role.ext.cr4_smap &&
                 !is_write_protection(vcpu);
         role.base.direct = !is_paging(vcpu);
+        role.base.gpte_is_8_bytes = !!is_pae(vcpu);
 
         if (!is_long_mode(vcpu))
                 role.base.level = PT32E_ROOT_LEVEL;
@@ -4918,18 +4925,26 @@ static union kvm_mmu_role
 kvm_calc_shadow_ept_root_page_role(struct kvm_vcpu *vcpu, bool accessed_dirty,
                                    bool execonly)
 {
-        union kvm_mmu_role role;
+        union kvm_mmu_role role = {0};
 
-        /* Base role is inherited from root_mmu */
-        role.base.word = vcpu->arch.root_mmu.mmu_role.base.word;
-        role.ext = kvm_calc_mmu_role_ext(vcpu);
+        /* SMM flag is inherited from root_mmu */
+        role.base.smm = vcpu->arch.root_mmu.mmu_role.base.smm;
 
         role.base.level = PT64_ROOT_4LEVEL;
+        role.base.gpte_is_8_bytes = true;
         role.base.direct = false;
         role.base.ad_disabled = !accessed_dirty;
         role.base.guest_mode = true;
         role.base.access = ACC_ALL;
 
+        /*
+         * WP=1 and NOT_WP=1 is an impossible combination, use WP and the
+         * SMAP variation to denote shadow EPT entries.
+         */
+        role.base.cr0_wp = true;
+        role.base.smap_andnot_wp = true;
+
+        role.ext = kvm_calc_mmu_role_ext(vcpu);
         role.ext.execonly = execonly;
 
         return role;
@@ -5179,7 +5194,7 @@ static bool detect_write_misaligned(struct kvm_mmu_page *sp, gpa_t gpa,
                  gpa, bytes, sp->role.word);
 
         offset = offset_in_page(gpa);
-        pte_size = sp->role.cr4_pae ? 8 : 4;
+        pte_size = sp->role.gpte_is_8_bytes ? 8 : 4;
 
         /*
          * Sometimes, the OS only writes the last one bytes to update status
@@ -5203,7 +5218,7 @@ static u64 *get_written_sptes(struct kvm_mmu_page *sp, gpa_t gpa, int *nspte)
         page_offset = offset_in_page(gpa);
         level = sp->role.level;
         *nspte = 1;
-        if (!sp->role.cr4_pae) {
+        if (!sp->role.gpte_is_8_bytes) {
                 page_offset <<= 1;      /* 32->64 */
                 /*
                  * A 32-bit pde maps 4MB while the shadow pdes map
@@ -5393,10 +5408,12 @@ emulate:
          * This can happen if a guest gets a page-fault on data access but the HW
          * table walker is not able to read the instruction page (e.g instruction
          * page is not present in memory). In those cases we simply restart the
-         * guest.
+         * guest, with the exception of AMD Erratum 1096 which is unrecoverable.
          */
-        if (unlikely(insn && !insn_len))
-                return 1;
+        if (unlikely(insn && !insn_len)) {
+                if (!kvm_x86_ops->need_emulation_on_page_fault(vcpu))
+                        return 1;
+        }
 
         er = x86_emulate_instruction(vcpu, cr2, emulation_type, insn, insn_len);
 
@@ -5509,7 +5526,9 @@ slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot,
 
                 if (need_resched() || spin_needbreak(&kvm->mmu_lock)) {
                         if (flush && lock_flush_tlb) {
-                                kvm_flush_remote_tlbs(kvm);
+                                kvm_flush_remote_tlbs_with_address(kvm,
+                                                start_gfn,
+                                                iterator.gfn - start_gfn + 1);
                                 flush = false;
                         }
                         cond_resched_lock(&kvm->mmu_lock);
@@ -5517,7 +5536,8 @@ slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot,
         }
 
         if (flush && lock_flush_tlb) {
-                kvm_flush_remote_tlbs(kvm);
+                kvm_flush_remote_tlbs_with_address(kvm, start_gfn,
+                                                   end_gfn - start_gfn + 1);
                 flush = false;
         }
 
@@ -6011,7 +6031,7 @@ out:
 /*
  * Calculate mmu pages needed for kvm.
  */
-unsigned int kvm_mmu_calculate_mmu_pages(struct kvm *kvm)
+unsigned int kvm_mmu_calculate_default_mmu_pages(struct kvm *kvm)
 {
         unsigned int nr_mmu_pages;
         unsigned int  nr_pages = 0;
diff --git a/arch/x86/kvm/mmutrace.h b/arch/x86/kvm/mmutrace.h
index 9f6c855a0043..dd30dccd2ad5 100644
--- a/arch/x86/kvm/mmutrace.h
+++ b/arch/x86/kvm/mmutrace.h
@@ -29,10 +29,10 @@
                                                                         \
         role.word = __entry->role;                                      \
                                                                         \
-        trace_seq_printf(p, "sp gfn %llx l%u%s q%u%s %s%s"              \
+        trace_seq_printf(p, "sp gfn %llx l%u %u-byte q%u%s %s%s"        \
                          " %snxe %sad root %u %s%c",                    \
                          __entry->gfn, role.level,                      \
-                         role.cr4_pae ? " pae" : "",                    \
+                         role.gpte_is_8_bytes ? 8 : 4,                  \
                          role.quadrant,                                 \
                          role.direct ? " direct" : "",                  \
                          access_str[role.access],                       \
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index b5b128a0a051..426039285fd1 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -7098,6 +7098,36 @@ static int nested_enable_evmcs(struct kvm_vcpu *vcpu,
         return -ENODEV;
 }
 
+static bool svm_need_emulation_on_page_fault(struct kvm_vcpu *vcpu)
+{
+        bool is_user, smap;
+
+        is_user = svm_get_cpl(vcpu) == 3;
+        smap = !kvm_read_cr4_bits(vcpu, X86_CR4_SMAP);
+
+        /*
+         * Detect and workaround Errata 1096 Fam_17h_00_0Fh
+         *
+         * In non SEV guest, hypervisor will be able to read the guest
+         * memory to decode the instruction pointer when insn_len is zero
+         * so we return true to indicate that decoding is possible.
+         *
+         * But in the SEV guest, the guest memory is encrypted with the
+         * guest specific key and hypervisor will not be able to decode the
+         * instruction pointer so we will not able to workaround it. Lets
+         * print the error and request to kill the guest.
+         */
+        if (is_user && smap) {
+                if (!sev_guest(vcpu->kvm))
+                        return true;
+
+                pr_err_ratelimited("KVM: Guest triggered AMD Erratum 1096\n");
+                kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
+        }
+
+        return false;
+}
+
 static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
         .cpu_has_kvm_support = has_svm,
         .disabled_by_bios = is_disabled,
@@ -7231,6 +7261,8 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
 
         .nested_enable_evmcs = nested_enable_evmcs,
         .nested_get_evmcs_version = nested_get_evmcs_version,
+
+        .need_emulation_on_page_fault = svm_need_emulation_on_page_fault,
 };
 
 static int __init svm_init(void)
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index f24a2c225070..153e539c29c9 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -2585,6 +2585,11 @@ static int nested_check_host_control_regs(struct kvm_vcpu *vcpu,
             !nested_host_cr4_valid(vcpu, vmcs12->host_cr4) ||
             !nested_cr3_valid(vcpu, vmcs12->host_cr3))
                 return -EINVAL;
+
+        if (is_noncanonical_address(vmcs12->host_ia32_sysenter_esp, vcpu) ||
+            is_noncanonical_address(vmcs12->host_ia32_sysenter_eip, vcpu))
+                return -EINVAL;
+
         /*
          * If the load IA32_EFER VM-exit control is 1, bits reserved in the
          * IA32_EFER MSR must be 0 in the field for that register. In addition,
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index c73375e01ab8..ab432a930ae8 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -1683,12 +1683,6 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 
                 msr_info->data = to_vmx(vcpu)->spec_ctrl;
                 break;
-        case MSR_IA32_ARCH_CAPABILITIES:
-                if (!msr_info->host_initiated &&
-                    !guest_cpuid_has(vcpu, X86_FEATURE_ARCH_CAPABILITIES))
-                        return 1;
-                msr_info->data = to_vmx(vcpu)->arch_capabilities;
-                break;
         case MSR_IA32_SYSENTER_CS:
                 msr_info->data = vmcs_read32(GUEST_SYSENTER_CS);
                 break;
@@ -1895,11 +1889,6 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                 vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, MSR_IA32_PRED_CMD,
                                               MSR_TYPE_W);
                 break;
-        case MSR_IA32_ARCH_CAPABILITIES:
-                if (!msr_info->host_initiated)
-                        return 1;
-                vmx->arch_capabilities = data;
-                break;
         case MSR_IA32_CR_PAT:
                 if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) {
                         if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data))
@@ -4088,8 +4077,6 @@ static void vmx_vcpu_setup(struct vcpu_vmx *vmx)
                 ++vmx->nmsrs;
         }
 
-        vmx->arch_capabilities = kvm_get_arch_capabilities();
-
         vm_exit_controls_init(vmx, vmx_vmexit_ctrl());
 
         /* 22.2.1, 20.8.1 */
@@ -7409,6 +7396,11 @@ static int enable_smi_window(struct kvm_vcpu *vcpu)
         return 0;
 }
 
+static bool vmx_need_emulation_on_page_fault(struct kvm_vcpu *vcpu)
+{
+        return 0;
+}
+
 static __init int hardware_setup(void)
 {
         unsigned long host_bndcfgs;
@@ -7711,6 +7703,7 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = {
         .set_nested_state = NULL,
         .get_vmcs12_pages = NULL,
         .nested_enable_evmcs = NULL,
+        .need_emulation_on_page_fault = vmx_need_emulation_on_page_fault,
 };
 
 static void vmx_cleanup_l1d_flush(void)
diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
index 1554cb45b393..a1e00d0a2482 100644
--- a/arch/x86/kvm/vmx/vmx.h
+++ b/arch/x86/kvm/vmx/vmx.h
@@ -190,7 +190,6 @@ struct vcpu_vmx {
         u64                   msr_guest_kernel_gs_base;
 #endif
 
-        u64                   arch_capabilities;
         u64                   spec_ctrl;
 
         u32 vm_entry_controls_shadow;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 65e4559eef2f..099b851dabaf 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1125,7 +1125,7 @@ static u32 msrs_to_save[] = {
 #endif
         MSR_IA32_TSC, MSR_IA32_CR_PAT, MSR_VM_HSAVE_PA,
         MSR_IA32_FEATURE_CONTROL, MSR_IA32_BNDCFGS, MSR_TSC_AUX,
-        MSR_IA32_SPEC_CTRL, MSR_IA32_ARCH_CAPABILITIES,
+        MSR_IA32_SPEC_CTRL,
         MSR_IA32_RTIT_CTL, MSR_IA32_RTIT_STATUS, MSR_IA32_RTIT_CR3_MATCH,
         MSR_IA32_RTIT_OUTPUT_BASE, MSR_IA32_RTIT_OUTPUT_MASK,
         MSR_IA32_RTIT_ADDR0_A, MSR_IA32_RTIT_ADDR0_B,
@@ -1158,6 +1158,7 @@ static u32 emulated_msrs[] = {
 
         MSR_IA32_TSC_ADJUST,
         MSR_IA32_TSCDEADLINE,
+        MSR_IA32_ARCH_CAPABILITIES,
         MSR_IA32_MISC_ENABLE,
         MSR_IA32_MCG_STATUS,
         MSR_IA32_MCG_CTL,
@@ -2443,6 +2444,11 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                 if (msr_info->host_initiated)
                         vcpu->arch.microcode_version = data;
                 break;
+        case MSR_IA32_ARCH_CAPABILITIES:
+                if (!msr_info->host_initiated)
+                        return 1;
+                vcpu->arch.arch_capabilities = data;
+                break;
         case MSR_EFER:
                 return set_efer(vcpu, data);
         case MSR_K7_HWCR:
@@ -2747,6 +2753,12 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
         case MSR_IA32_UCODE_REV:
                 msr_info->data = vcpu->arch.microcode_version;
                 break;
+        case MSR_IA32_ARCH_CAPABILITIES:
+                if (!msr_info->host_initiated &&
+                    !guest_cpuid_has(vcpu, X86_FEATURE_ARCH_CAPABILITIES))
+                        return 1;
+                msr_info->data = vcpu->arch.arch_capabilities;
+                break;
         case MSR_IA32_TSC:
                 msr_info->data = kvm_scale_tsc(vcpu, rdtsc()) + vcpu->arch.tsc_offset;
                 break;
@@ -6523,14 +6535,27 @@ int kvm_emulate_instruction_from_buffer(struct kvm_vcpu *vcpu,
 }
 EXPORT_SYMBOL_GPL(kvm_emulate_instruction_from_buffer);
 
+static int complete_fast_pio_out(struct kvm_vcpu *vcpu)
+{
+        vcpu->arch.pio.count = 0;
+
+        if (unlikely(!kvm_is_linear_rip(vcpu, vcpu->arch.pio.linear_rip)))
+                return 1;
+
+        return kvm_skip_emulated_instruction(vcpu);
+}
+
 static int kvm_fast_pio_out(struct kvm_vcpu *vcpu, int size,
                             unsigned short port)
 {
         unsigned long val = kvm_register_read(vcpu, VCPU_REGS_RAX);
         int ret = emulator_pio_out_emulated(&vcpu->arch.emulate_ctxt,
                                             size, port, &val, 1);
-        /* do not return to emulator after return from userspace */
-        vcpu->arch.pio.count = 0;
+
+        if (!ret) {
+                vcpu->arch.pio.linear_rip = kvm_get_linear_rip(vcpu);
+                vcpu->arch.complete_userspace_io = complete_fast_pio_out;
+        }
         return ret;
 }
 
@@ -6541,6 +6566,11 @@ static int complete_fast_pio_in(struct kvm_vcpu *vcpu)
         /* We should only ever be called with arch.pio.count equal to 1 */
         BUG_ON(vcpu->arch.pio.count != 1);
 
+        if (unlikely(!kvm_is_linear_rip(vcpu, vcpu->arch.pio.linear_rip))) {
+                vcpu->arch.pio.count = 0;
+                return 1;
+        }
+
         /* For size less than 4 we merge, else we zero extend */
         val = (vcpu->arch.pio.size < 4) ? kvm_register_read(vcpu, VCPU_REGS_RAX)
                                         : 0;
@@ -6553,7 +6583,7 @@ static int complete_fast_pio_in(struct kvm_vcpu *vcpu)
                                  vcpu->arch.pio.port, &val, 1);
         kvm_register_write(vcpu, VCPU_REGS_RAX, val);
 
-        return 1;
+        return kvm_skip_emulated_instruction(vcpu);
 }
 
 static int kvm_fast_pio_in(struct kvm_vcpu *vcpu, int size,
@@ -6572,6 +6602,7 @@ static int kvm_fast_pio_in(struct kvm_vcpu *vcpu, int size,
                 return ret;
         }
 
+        vcpu->arch.pio.linear_rip = kvm_get_linear_rip(vcpu);
         vcpu->arch.complete_userspace_io = complete_fast_pio_in;
 
         return 0;
@@ -6579,16 +6610,13 @@ static int kvm_fast_pio_in(struct kvm_vcpu *vcpu, int size,
 
 int kvm_fast_pio(struct kvm_vcpu *vcpu, int size, unsigned short port, int in)
 {
-        int ret = kvm_skip_emulated_instruction(vcpu);
+        int ret;
 
-        /*
-         * TODO: we might be squashing a KVM_GUESTDBG_SINGLESTEP-triggered
-         * KVM_EXIT_DEBUG here.
-         */
         if (in)
-                return kvm_fast_pio_in(vcpu, size, port) && ret;
+                ret = kvm_fast_pio_in(vcpu, size, port);
         else
-                return kvm_fast_pio_out(vcpu, size, port) && ret;
+                ret = kvm_fast_pio_out(vcpu, size, port);
+        return ret && kvm_skip_emulated_instruction(vcpu);
 }
 EXPORT_SYMBOL_GPL(kvm_fast_pio);
 
@@ -8733,6 +8761,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
 
 int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
 {
+        vcpu->arch.arch_capabilities = kvm_get_arch_capabilities();
         vcpu->arch.msr_platform_info = MSR_PLATFORM_INFO_CPUID_FAULT;
         kvm_vcpu_mtrr_init(vcpu);
         vcpu_load(vcpu);
@@ -9429,13 +9458,9 @@ void kvm_arch_commit_memory_region(struct kvm *kvm,
                                 const struct kvm_memory_slot *new,
                                 enum kvm_mr_change change)
 {
-        int nr_mmu_pages = 0;
-
         if (!kvm->arch.n_requested_mmu_pages)
-                nr_mmu_pages = kvm_mmu_calculate_mmu_pages(kvm);
-
-        if (nr_mmu_pages)
-                kvm_mmu_change_mmu_pages(kvm, nr_mmu_pages);
+                kvm_mmu_change_mmu_pages(kvm,
+                                kvm_mmu_calculate_default_mmu_pages(kvm));
 
         /*
          * Dirty logging tracks sptes in 4k granularity, meaning that large
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index db3165714521..dc726e07d8ba 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -230,7 +230,7 @@ bool mmap_address_hint_valid(unsigned long addr, unsigned long len)
 /* Can we access it for direct reading/writing? Must be RAM: */
 int valid_phys_addr_range(phys_addr_t addr, size_t count)
 {
-        return addr + count <= __pa(high_memory);
+        return addr + count - 1 <= __pa(high_memory - 1);
 }
 
 /* Can we access it through mmap? Must be a valid physical address: */
diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
index 458a0e2bcc57..a25a9fd987a9 100644
--- a/arch/x86/platform/efi/quirks.c
+++ b/arch/x86/platform/efi/quirks.c
@@ -449,7 +449,7 @@ void __init efi_free_boot_services(void)
                  */
                 rm_size = real_mode_size_needed();
                 if (rm_size && (start + rm_size) < (1<<20) && size >= rm_size) {
-                        set_real_mode_mem(start, rm_size);
+                        set_real_mode_mem(start);
                         start += rm_size;
                         size -= rm_size;
                 }
diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c
index d10105825d57..7dce39c8c034 100644
--- a/arch/x86/realmode/init.c
+++ b/arch/x86/realmode/init.c
@@ -15,15 +15,6 @@ u32 *trampoline_cr4_features;
 /* Hold the pgd entry used on booting additional CPUs */
 pgd_t trampoline_pgd_entry;
 
-void __init set_real_mode_mem(phys_addr_t mem, size_t size)
-{
-        void *base = __va(mem);
-
-        real_mode_header = (struct real_mode_header *) base;
-        printk(KERN_DEBUG "Base memory trampoline at [%p] %llx size %zu\n",
-               base, (unsigned long long)mem, size);
-}
-
 void __init reserve_real_mode(void)
 {
         phys_addr_t mem;
@@ -42,7 +33,7 @@ void __init reserve_real_mode(void)
         }
 
         memblock_reserve(mem, size);
-        set_real_mode_mem(mem, size);
+        set_real_mode_mem(mem);
 }
 
 static void __init setup_real_mode(void)
diff --git a/arch/xtensa/include/asm/Kbuild b/arch/xtensa/include/asm/Kbuild
index 42b6cb3d16f7..3843198e03d4 100644
--- a/arch/xtensa/include/asm/Kbuild
+++ b/arch/xtensa/include/asm/Kbuild
@@ -15,6 +15,7 @@ generic-y += irq_work.h
 generic-y += kdebug.h
 generic-y += kmap_types.h
 generic-y += kprobes.h
+generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
diff --git a/arch/xtensa/include/uapi/asm/Kbuild b/arch/xtensa/include/uapi/asm/Kbuild
index 8a7ad40be463..7417847dc438 100644
--- a/arch/xtensa/include/uapi/asm/Kbuild
+++ b/arch/xtensa/include/uapi/asm/Kbuild
@@ -1,2 +1 @@
 generated-y += unistd_32.h
-generic-y += kvm_para.h
diff --git a/block/blk-flush.c b/block/blk-flush.c
index 6e0f2d97fc6d..d95f94892015 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -220,7 +220,7 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error)
                 blk_mq_tag_set_rq(hctx, flush_rq->tag, fq->orig_rq);
                 flush_rq->tag = -1;
         } else {
-                blk_mq_put_driver_tag_hctx(hctx, flush_rq);
+                blk_mq_put_driver_tag(flush_rq);
                 flush_rq->internal_tag = -1;
         }
 
@@ -324,7 +324,7 @@ static void mq_flush_data_end_io(struct request *rq, blk_status_t error)
 
         if (q->elevator) {
                 WARN_ON(rq->tag < 0);
-                blk_mq_put_driver_tag_hctx(hctx, rq);
+                blk_mq_put_driver_tag(rq);
         }
 
         /*
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 70b210a308c4..3ff3d7b49969 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -59,7 +59,8 @@ static int blk_mq_poll_stats_bkt(const struct request *rq)
 }
 
 /*
- * Check if any of the ctx's have pending work in this hardware queue
+ * Check if any of the ctx, dispatch list or elevator
+ * have pending work in this hardware queue.
  */
 static bool blk_mq_hctx_has_pending(struct blk_mq_hw_ctx *hctx)
 {
@@ -1071,7 +1072,13 @@ static int blk_mq_dispatch_wake(wait_queue_entry_t *wait, unsigned mode,
         hctx = container_of(wait, struct blk_mq_hw_ctx, dispatch_wait);
 
         spin_lock(&hctx->dispatch_wait_lock);
-        list_del_init(&wait->entry);
+        if (!list_empty(&wait->entry)) {
+                struct sbitmap_queue *sbq;
+
+                list_del_init(&wait->entry);
+                sbq = &hctx->tags->bitmap_tags;
+                atomic_dec(&sbq->ws_active);
+        }
         spin_unlock(&hctx->dispatch_wait_lock);
 
         blk_mq_run_hw_queue(hctx, true);
@@ -1087,6 +1094,7 @@ static int blk_mq_dispatch_wake(wait_queue_entry_t *wait, unsigned mode,
 static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx,
                                  struct request *rq)
 {
+        struct sbitmap_queue *sbq = &hctx->tags->bitmap_tags;
         struct wait_queue_head *wq;
         wait_queue_entry_t *wait;
         bool ret;
@@ -1109,7 +1117,7 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx,
         if (!list_empty_careful(&wait->entry))
                 return false;
 
-        wq = &bt_wait_ptr(&hctx->tags->bitmap_tags, hctx)->wait;
+        wq = &bt_wait_ptr(sbq, hctx)->wait;
 
         spin_lock_irq(&wq->lock);
         spin_lock(&hctx->dispatch_wait_lock);
@@ -1119,6 +1127,7 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx,
                 return false;
         }
 
+        atomic_inc(&sbq->ws_active);
         wait->flags &= ~WQ_FLAG_EXCLUSIVE;
         __add_wait_queue(wq, wait);
 
@@ -1139,6 +1148,7 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx,
          * someone else gets the wakeup.
          */
         list_del_init(&wait->entry);
+        atomic_dec(&sbq->ws_active);
         spin_unlock(&hctx->dispatch_wait_lock);
         spin_unlock_irq(&wq->lock);
 
diff --git a/block/blk-mq.h b/block/blk-mq.h
index 0ed8e5a8729f..d704fc7766f4 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -224,15 +224,6 @@ static inline void __blk_mq_put_driver_tag(struct blk_mq_hw_ctx *hctx,
         }
 }
 
-static inline void blk_mq_put_driver_tag_hctx(struct blk_mq_hw_ctx *hctx,
-                                       struct request *rq)
-{
-        if (rq->tag == -1 || rq->internal_tag == -1)
-                return;
-
-        __blk_mq_put_driver_tag(hctx, rq);
-}
-
 static inline void blk_mq_put_driver_tag(struct request *rq)
 {
         if (rq->tag == -1 || rq->internal_tag == -1)
diff --git a/drivers/acpi/acpica/evgpe.c b/drivers/acpi/acpica/evgpe.c
index 62d3aa74277b..5e9d7348c16f 100644
--- a/drivers/acpi/acpica/evgpe.c
+++ b/drivers/acpi/acpica/evgpe.c
@@ -81,8 +81,12 @@ acpi_status acpi_ev_enable_gpe(struct acpi_gpe_event_info *gpe_event_info)
 
         ACPI_FUNCTION_TRACE(ev_enable_gpe);
 
-        /* Enable the requested GPE */
+        /* Clear the GPE status */
+        status = acpi_hw_clear_gpe(gpe_event_info);
+        if (ACPI_FAILURE(status))
+                return_ACPI_STATUS(status);
 
+        /* Enable the requested GPE */
         status = acpi_hw_low_set_gpe(gpe_event_info, ACPI_GPE_ENABLE);
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 6ecbbabf1233..eec263c9019e 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -1043,9 +1043,6 @@ void __init acpi_early_init(void)
 
         acpi_permanent_mmap = true;
 
-        /* Initialize debug output. Linux does not use ACPICA defaults */
-        acpi_dbg_level = ACPI_LV_INFO | ACPI_LV_REPAIR;
-
 #ifdef CONFIG_X86
         /*
          * If the machine falls into the DMI check table,
diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index 1b207fca1420..d4244e7d0e38 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -1150,8 +1150,13 @@ int cppc_get_perf_caps(int cpunum, struct cppc_perf_caps *perf_caps)
         cpc_read(cpunum, nominal_reg, &nom);
         perf_caps->nominal_perf = nom;
 
-        cpc_read(cpunum, guaranteed_reg, &guaranteed);
-        perf_caps->guaranteed_perf = guaranteed;
+        if (guaranteed_reg->type != ACPI_TYPE_BUFFER  ||
+            IS_NULL_REG(&guaranteed_reg->cpc_entry.reg)) {
+                perf_caps->guaranteed_perf = 0;
+        } else {
+                cpc_read(cpunum, guaranteed_reg, &guaranteed);
+                perf_caps->guaranteed_perf = guaranteed;
+        }
 
         cpc_read(cpunum, lowest_non_linear_reg, &min_nonlinear);
         perf_caps->lowest_nonlinear_perf = min_nonlinear;
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 8685882da64c..4b9c7ca492e6 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2057,7 +2057,8 @@ static size_t binder_get_object(struct binder_proc *proc,
         size_t object_size = 0;
 
         read_size = min_t(size_t, sizeof(*object), buffer->data_size - offset);
-        if (read_size < sizeof(*hdr) || !IS_ALIGNED(offset, sizeof(u32)))
+        if (offset > buffer->data_size || read_size < sizeof(*hdr) ||
+            !IS_ALIGNED(offset, sizeof(u32)))
                 return 0;
         binder_alloc_copy_from_buffer(&proc->alloc, object, buffer,
                                       offset, read_size);
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 6389467670a0..195f120c4e8c 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -927,14 +927,13 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
 
         index = page - alloc->pages;
         page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;
+
+        mm = alloc->vma_vm_mm;
+        if (!mmget_not_zero(mm))
+                goto err_mmget;
+        if (!down_write_trylock(&mm->mmap_sem))
+                goto err_down_write_mmap_sem_failed;
         vma = binder_alloc_get_vma(alloc);
-        if (vma) {
-                if (!mmget_not_zero(alloc->vma_vm_mm))
-                        goto err_mmget;
-                mm = alloc->vma_vm_mm;
-                if (!down_read_trylock(&mm->mmap_sem))
-                        goto err_down_write_mmap_sem_failed;
-        }
 
         list_lru_isolate(lru, item);
         spin_unlock(lock);
@@ -945,10 +944,9 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
                 zap_page_range(vma, page_addr, PAGE_SIZE);
 
                 trace_binder_unmap_user_end(alloc, index);
-
-                up_read(&mm->mmap_sem);
-                mmput(mm);
         }
+        up_write(&mm->mmap_sem);
+        mmput(mm);
 
         trace_binder_unmap_kernel_start(alloc, index);
 
diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c
index b3ed8f9953a8..173e6f2dd9af 100644
--- a/drivers/ata/libata-zpodd.c
+++ b/drivers/ata/libata-zpodd.c
@@ -52,38 +52,52 @@ static int eject_tray(struct ata_device *dev)
 /* Per the spec, only slot type and drawer type ODD can be supported */
 static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev)
 {
-        char buf[16];
+        char *buf;
         unsigned int ret;
-        struct rm_feature_desc *desc = (void *)(buf + 8);
+        struct rm_feature_desc *desc;
         struct ata_taskfile tf;
         static const char cdb[] = {  GPCMD_GET_CONFIGURATION,
                         2,      /* only 1 feature descriptor requested */
                         0, 3,   /* 3, removable medium feature */
                         0, 0, 0,/* reserved */
-                        0, sizeof(buf),
+                        0, 16,
                         0, 0, 0,
         };
 
+        buf = kzalloc(16, GFP_KERNEL);
+        if (!buf)
+                return ODD_MECH_TYPE_UNSUPPORTED;
+        desc = (void *)(buf + 8);
+
         ata_tf_init(dev, &tf);
         tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
         tf.command = ATA_CMD_PACKET;
         tf.protocol = ATAPI_PROT_PIO;
-        tf.lbam = sizeof(buf);
+        tf.lbam = 16;
 
         ret = ata_exec_internal(dev, &tf, cdb, DMA_FROM_DEVICE,
-                                buf, sizeof(buf), 0);
-        if (ret)
+                                buf, 16, 0);
+        if (ret) {
+                kfree(buf);
                 return ODD_MECH_TYPE_UNSUPPORTED;
+        }
 
-        if (be16_to_cpu(desc->feature_code) != 3)
+        if (be16_to_cpu(desc->feature_code) != 3) {
+                kfree(buf);
                 return ODD_MECH_TYPE_UNSUPPORTED;
+        }
 
-        if (desc->mech_type == 0 && desc->load == 0 && desc->eject == 1)
+        if (desc->mech_type == 0 && desc->load == 0 && desc->eject == 1) {
+                kfree(buf);
                 return ODD_MECH_TYPE_SLOT;
-        else if (desc->mech_type == 1 && desc->load == 0 && desc->eject == 1)
+        } else if (desc->mech_type == 1 && desc->load == 0 &&
+                   desc->eject == 1) {
+                kfree(buf);
                 return ODD_MECH_TYPE_DRAWER;
-        else
+        } else {
+                kfree(buf);
                 return ODD_MECH_TYPE_UNSUPPORTED;
+        }
 }
 
 /* Test if ODD is zero power ready by sense code */
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index e7a5f1d1c314..399cad7daae7 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -290,18 +290,8 @@ static ssize_t idle_store(struct device *dev,
         struct zram *zram = dev_to_zram(dev);
         unsigned long nr_pages = zram->disksize >> PAGE_SHIFT;
         int index;
-        char mode_buf[8];
-        ssize_t sz;
 
-        sz = strscpy(mode_buf, buf, sizeof(mode_buf));
-        if (sz <= 0)
-                return -EINVAL;
-
-        /* ignore trailing new line */
-        if (mode_buf[sz - 1] == '\n')
-                mode_buf[sz - 1] = 0x00;
-
-        if (strcmp(mode_buf, "all"))
+        if (!sysfs_streq(buf, "all"))
                 return -EINVAL;
 
         down_read(&zram->init_lock);
@@ -635,25 +625,15 @@ static ssize_t writeback_store(struct device *dev,
         struct bio bio;
         struct bio_vec bio_vec;
         struct page *page;
-        ssize_t ret, sz;
-        char mode_buf[8];
-        int mode = -1;
+        ssize_t ret;
+        int mode;
         unsigned long blk_idx = 0;
 
-        sz = strscpy(mode_buf, buf, sizeof(mode_buf));
-        if (sz <= 0)
-                return -EINVAL;
-
-        /* ignore trailing newline */
-        if (mode_buf[sz - 1] == '\n')
-                mode_buf[sz - 1] = 0x00;
-
-        if (!strcmp(mode_buf, "idle"))
+        if (sysfs_streq(buf, "idle"))
                 mode = IDLE_WRITEBACK;
-        else if (!strcmp(mode_buf, "huge"))
+        else if (sysfs_streq(buf, "huge"))
                 mode = HUGE_WRITEBACK;
-
-        if (mode == -1)
+        else
                 return -EINVAL;
 
         down_read(&zram->init_lock);
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 72866a004f07..466ebd84ad17 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -348,7 +348,7 @@ config XILINX_HWICAP
 
 config R3964
         tristate "Siemens R3964 line discipline"
-        depends on TTY
+        depends on TTY && BROKEN
         ---help---
           This driver allows synchronous communication with devices using the
           Siemens R3964 packet protocol. Unless you are dealing with special
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index e22f0dbaebb1..2986119dd31f 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -385,7 +385,10 @@ static int intel_pstate_get_cppc_guranteed(int cpu)
         if (ret)
                 return ret;
 
-        return cppc_perf.guaranteed_perf;
+        if (cppc_perf.guaranteed_perf)
+                return cppc_perf.guaranteed_perf;
+
+        return cppc_perf.nominal_perf;
 }
 
 #else /* CONFIG_ACPI_CPPC_LIB */
@@ -2593,6 +2596,9 @@ static int __init intel_pstate_init(void)
         const struct x86_cpu_id *id;
         int rc;
 
+        if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL)
+                return -ENODEV;
+
         if (no_load)
                 return -ENODEV;
 
@@ -2608,7 +2614,7 @@ static int __init intel_pstate_init(void)
         } else {
                 id = x86_match_cpu(intel_pstate_cpu_ids);
                 if (!id) {
-                        pr_info("CPU ID not supported\n");
+                        pr_info("CPU model not supported\n");
                         return -ENODEV;
                 }
 
diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
index 3f49427766b8..2b51e0718c9f 100644
--- a/drivers/cpufreq/scpi-cpufreq.c
+++ b/drivers/cpufreq/scpi-cpufreq.c
@@ -189,8 +189,8 @@ static int scpi_cpufreq_exit(struct cpufreq_policy *policy)
 
         clk_put(priv->clk);
         dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
-        kfree(priv);
         dev_pm_opp_remove_all_dynamic(priv->cpu_dev);
+        kfree(priv);
 
         return 0;
 }
diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c
index 4e0eede599a8..ac0301b69593 100644
--- a/drivers/dma/stm32-mdma.c
+++ b/drivers/dma/stm32-mdma.c
@@ -1578,11 +1578,9 @@ static int stm32_mdma_probe(struct platform_device *pdev)
 
         dmadev->nr_channels = nr_channels;
         dmadev->nr_requests = nr_requests;
-        ret = device_property_read_u32_array(&pdev->dev, "st,ahb-addr-masks",
+        device_property_read_u32_array(&pdev->dev, "st,ahb-addr-masks",
                                        dmadev->ahb_addr_masks,
                                        count);
-        if (ret)
-                return ret;
         dmadev->nr_ahb_addr_masks = count;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
diff --git a/drivers/gpio/gpio-adnp.c b/drivers/gpio/gpio-adnp.c
index 91b90c0cea73..12acdac85820 100644
--- a/drivers/gpio/gpio-adnp.c
+++ b/drivers/gpio/gpio-adnp.c
@@ -132,8 +132,10 @@ static int adnp_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
         if (err < 0)
                 goto out;
 
-        if (err & BIT(pos))
-                err = -EACCES;
+        if (value & BIT(pos)) {
+                err = -EPERM;
+                goto out;
+        }
 
         err = 0;
 
diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
index 854bce4fb9e7..217507002dbc 100644
--- a/drivers/gpio/gpio-aspeed.c
+++ b/drivers/gpio/gpio-aspeed.c
@@ -1224,6 +1224,8 @@ static int __init aspeed_gpio_probe(struct platform_device *pdev)
 
         gpio->offset_timer =
                 devm_kzalloc(&pdev->dev, gpio->chip.ngpio, GFP_KERNEL);
+        if (!gpio->offset_timer)
+                return -ENOMEM;
 
         return aspeed_gpio_setup_irqs(gpio, pdev);
 }
diff --git a/drivers/gpio/gpio-exar.c b/drivers/gpio/gpio-exar.c
index 0ecd2369c2ca..a09d2f9ebacc 100644
--- a/drivers/gpio/gpio-exar.c
+++ b/drivers/gpio/gpio-exar.c
@@ -148,6 +148,8 @@ static int gpio_exar_probe(struct platform_device *pdev)
         mutex_init(&exar_gpio->lock);
 
         index = ida_simple_get(&ida_index, 0, 0, GFP_KERNEL);
+        if (index < 0)
+                goto err_destroy;
 
         sprintf(exar_gpio->name, "exar_gpio%d", index);
         exar_gpio->gpio_chip.label = exar_gpio->name;
diff --git a/drivers/gpio/gpio-mockup.c b/drivers/gpio/gpio-mockup.c
index 154d959e8993..b6a4efce7c92 100644
--- a/drivers/gpio/gpio-mockup.c
+++ b/drivers/gpio/gpio-mockup.c
@@ -204,8 +204,8 @@ static ssize_t gpio_mockup_debugfs_read(struct file *file,
         struct gpio_mockup_chip *chip;
         struct seq_file *sfile;
         struct gpio_chip *gc;
+        int val, cnt;
         char buf[3];
-        int val, rv;
 
         if (*ppos != 0)
                 return 0;
@@ -216,13 +216,9 @@ static ssize_t gpio_mockup_debugfs_read(struct file *file,
         gc = &chip->gc;
 
         val = gpio_mockup_get(gc, priv->offset);
-        snprintf(buf, sizeof(buf), "%d\n", val);
+        cnt = snprintf(buf, sizeof(buf), "%d\n", val);
 
-        rv = copy_to_user(usr_buf, buf, sizeof(buf));
-        if (rv)
-                return rv;
-
-        return sizeof(buf) - 1;
+        return simple_read_from_buffer(usr_buf, size, ppos, buf, cnt);
 }
 
 static ssize_t gpio_mockup_debugfs_write(struct file *file,
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index 8b9c3ab70f6e..6a3ec575a404 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -120,7 +120,8 @@ static void of_gpio_flags_quirks(struct device_node *np,
          * to determine if the flags should have inverted semantics.
          */
         if (IS_ENABLED(CONFIG_SPI_MASTER) &&
-            of_property_read_bool(np, "cs-gpios")) {
+            of_property_read_bool(np, "cs-gpios") &&
+            !strcmp(propname, "cs-gpios")) {
                 struct device_node *child;
                 u32 cs;
                 int ret;
@@ -142,16 +143,16 @@ static void of_gpio_flags_quirks(struct device_node *np,
                                  * conflict and the "spi-cs-high" flag will
                                  * take precedence.
                                  */
-                                if (of_property_read_bool(np, "spi-cs-high")) {
+                                if (of_property_read_bool(child, "spi-cs-high")) {
                                         if (*flags & OF_GPIO_ACTIVE_LOW) {
                                                 pr_warn("%s GPIO handle specifies active low - ignored\n",
-                                                        of_node_full_name(np));
+                                                        of_node_full_name(child));
                                                 *flags &= ~OF_GPIO_ACTIVE_LOW;
                                         }
                                 } else {
                                         if (!(*flags & OF_GPIO_ACTIVE_LOW))
                                                 pr_info("%s enforce active low on chipselect handle\n",
-                                                        of_node_full_name(np));
+                                                        of_node_full_name(child));
                                         *flags |= OF_GPIO_ACTIVE_LOW;
                                 }
                                 break;
@@ -717,7 +718,13 @@ int of_gpiochip_add(struct gpio_chip *chip)
 
         of_node_get(chip->of_node);
 
-        return of_gpiochip_scan_gpios(chip);
+        status = of_gpiochip_scan_gpios(chip);
+        if (status) {
+                of_node_put(chip->of_node);
+                gpiochip_remove_pin_ranges(chip);
+        }
+
+        return status;
 }
 
 void of_gpiochip_remove(struct gpio_chip *chip)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 144af0733581..0495bf1d480a 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -2776,7 +2776,7 @@ int gpiod_set_debounce(struct gpio_desc *desc, unsigned debounce)
         }
 
         config = pinconf_to_config_packed(PIN_CONFIG_INPUT_DEBOUNCE, debounce);
-        return gpio_set_config(chip, gpio_chip_hwgpio(desc), config);
+        return chip->set_config(chip, gpio_chip_hwgpio(desc), config);
 }
 EXPORT_SYMBOL_GPL(gpiod_set_debounce);
 
@@ -2813,7 +2813,7 @@ int gpiod_set_transitory(struct gpio_desc *desc, bool transitory)
         packed = pinconf_to_config_packed(PIN_CONFIG_PERSIST_STATE,
                                           !transitory);
         gpio = gpio_chip_hwgpio(desc);
-        rc = gpio_set_config(chip, gpio, packed);
+        rc = chip->set_config(chip, gpio, packed);
         if (rc == -ENOTSUPP) {
                 dev_dbg(&desc->gdev->dev, "Persistence not supported for GPIO %d\n",
                                 gpio);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 4f8fb4ecde34..ac0d646a7b74 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -3625,6 +3625,7 @@ static void amdgpu_device_get_min_pci_speed_width(struct amdgpu_device *adev,
         struct pci_dev *pdev = adev->pdev;
         enum pci_bus_speed cur_speed;
         enum pcie_link_width cur_width;
+        u32 ret = 1;
 
         *speed = PCI_SPEED_UNKNOWN;
         *width = PCIE_LNK_WIDTH_UNKNOWN;
@@ -3632,6 +3633,10 @@ static void amdgpu_device_get_min_pci_speed_width(struct amdgpu_device *adev,
         while (pdev) {
                 cur_speed = pcie_get_speed_cap(pdev);
                 cur_width = pcie_get_width_cap(pdev);
+                ret = pcie_bandwidth_available(adev->pdev, NULL,
+                                                       NULL, &cur_width);
+                if (!ret)
+                        cur_width = PCIE_LNK_WIDTH_RESRV;
 
                 if (cur_speed != PCI_SPEED_UNKNOWN) {
                         if (*speed == PCI_SPEED_UNKNOWN)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index d0309e8c9d12..a11db2b1a63f 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -2405,8 +2405,6 @@ static int gfx_v9_0_rlc_resume(struct amdgpu_device *adev)
         /* disable CG */
         WREG32_SOC15(GC, 0, mmRLC_CGCG_CGLS_CTRL, 0);
 
-        adev->gfx.rlc.funcs->reset(adev);
-
         gfx_v9_0_init_pg(adev);
 
         if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP) {
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index fb27783d7a54..81127f7d6ed1 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -5429,9 +5429,11 @@ static void get_freesync_config_for_crtc(
         struct amdgpu_dm_connector *aconnector =
                         to_amdgpu_dm_connector(new_con_state->base.connector);
         struct drm_display_mode *mode = &new_crtc_state->base.mode;
+        int vrefresh = drm_mode_vrefresh(mode);
 
         new_crtc_state->vrr_supported = new_con_state->freesync_capable &&
-                aconnector->min_vfreq <= drm_mode_vrefresh(mode);
+                                        vrefresh >= aconnector->min_vfreq &&
+                                        vrefresh <= aconnector->max_vfreq;
 
         if (new_crtc_state->vrr_supported) {
                 new_crtc_state->stream->ignore_msa_timing_param = true;
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 4eba3c4800b6..ea18e9c2d8ce 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -2660,12 +2660,18 @@ void core_link_enable_stream(
 void core_link_disable_stream(struct pipe_ctx *pipe_ctx, int option)
 {
         struct dc  *core_dc = pipe_ctx->stream->ctx->dc;
+        struct dc_stream_state *stream = pipe_ctx->stream;
 
         core_dc->hwss.blank_stream(pipe_ctx);
 
         if (pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
                 deallocate_mst_payload(pipe_ctx);
 
+        if (dc_is_hdmi_signal(pipe_ctx->stream->signal))
+                dal_ddc_service_write_scdc_data(
+                        stream->link->ddc, 0,
+                        stream->timing.flags.LTE_340MCSC_SCRAMBLE);
+
         core_dc->hwss.disable_stream(pipe_ctx, option);
 
         disable_link(pipe_ctx->stream->link, pipe_ctx->stream->signal);
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
index 9aa7bec1b5fe..23b5b94a4939 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
@@ -91,6 +91,12 @@ static void vega20_set_default_registry_data(struct pp_hwmgr *hwmgr)
          *   MP0CLK DS
          */
         data->registry_data.disallowed_features = 0xE0041C00;
+        /* ECC feature should be disabled on old SMUs */
+        smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetSmuVersion);
+        hwmgr->smu_version = smum_get_argument(hwmgr);
+        if (hwmgr->smu_version < 0x282100)
+                data->registry_data.disallowed_features |= FEATURE_ECC_MASK;
+
         data->registry_data.od_state_in_dc_support = 0;
         data->registry_data.thermal_support = 1;
         data->registry_data.skip_baco_hardware = 0;
@@ -357,6 +363,7 @@ static void vega20_init_dpm_defaults(struct pp_hwmgr *hwmgr)
         data->smu_features[GNLD_DS_MP1CLK].smu_feature_id = FEATURE_DS_MP1CLK_BIT;
         data->smu_features[GNLD_DS_MP0CLK].smu_feature_id = FEATURE_DS_MP0CLK_BIT;
         data->smu_features[GNLD_XGMI].smu_feature_id = FEATURE_XGMI_BIT;
+        data->smu_features[GNLD_ECC].smu_feature_id = FEATURE_ECC_BIT;
 
         for (i = 0; i < GNLD_FEATURES_MAX; i++) {
                 data->smu_features[i].smu_feature_bitmap =
@@ -3020,7 +3027,8 @@ static int vega20_get_ppfeature_status(struct pp_hwmgr *hwmgr, char *buf)
                                 "FCLK_DS",
                                 "MP1CLK_DS",
                                 "MP0CLK_DS",
-                                "XGMI"};
+                                "XGMI",
+                                "ECC"};
         static const char *output_title[] = {
                                 "FEATURES",
                                 "BITMASK",
@@ -3462,6 +3470,7 @@ static int vega20_apply_clocks_adjust_rules(struct pp_hwmgr *hwmgr)
         struct vega20_single_dpm_table *dpm_table;
         bool vblank_too_short = false;
         bool disable_mclk_switching;
+        bool disable_fclk_switching;
         uint32_t i, latency;
 
         disable_mclk_switching = ((1 < hwmgr->display_config->num_display) &&
@@ -3537,13 +3546,20 @@ static int vega20_apply_clocks_adjust_rules(struct pp_hwmgr *hwmgr)
         if (hwmgr->display_config->nb_pstate_switch_disable)
                 dpm_table->dpm_state.hard_min_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
 
+        if ((disable_mclk_switching &&
+            (dpm_table->dpm_state.hard_min_level == dpm_table->dpm_levels[dpm_table->count - 1].value)) ||
+             hwmgr->display_config->min_mem_set_clock / 100 >= dpm_table->dpm_levels[dpm_table->count - 1].value)
+                disable_fclk_switching = true;
+        else
+                disable_fclk_switching = false;
+
         /* fclk */
         dpm_table = &(data->dpm_table.fclk_table);
         dpm_table->dpm_state.soft_min_level = dpm_table->dpm_levels[0].value;
         dpm_table->dpm_state.soft_max_level = VG20_CLOCK_MAX_DEFAULT;
         dpm_table->dpm_state.hard_min_level = dpm_table->dpm_levels[0].value;
         dpm_table->dpm_state.hard_max_level = VG20_CLOCK_MAX_DEFAULT;
-        if (hwmgr->display_config->nb_pstate_switch_disable)
+        if (hwmgr->display_config->nb_pstate_switch_disable || disable_fclk_switching)
                 dpm_table->dpm_state.soft_min_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
 
         /* vclk */
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h
index a5bc758ae097..ac2a3118a0ae 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h
@@ -80,6 +80,7 @@ enum {
         GNLD_DS_MP1CLK,
         GNLD_DS_MP0CLK,
         GNLD_XGMI,
+        GNLD_ECC,
 
         GNLD_FEATURES_MAX
 };
diff --git a/drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if.h b/drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if.h
index 63d5cf691549..195c4ae67058 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if.h
@@ -99,7 +99,7 @@
 #define FEATURE_DS_MP1CLK_BIT           30
 #define FEATURE_DS_MP0CLK_BIT           31
 #define FEATURE_XGMI_BIT                32
-#define FEATURE_SPARE_33_BIT            33
+#define FEATURE_ECC_BIT                 33
 #define FEATURE_SPARE_34_BIT            34
 #define FEATURE_SPARE_35_BIT            35
 #define FEATURE_SPARE_36_BIT            36
@@ -165,7 +165,8 @@
 #define FEATURE_DS_FCLK_MASK            (1 << FEATURE_DS_FCLK_BIT            )
 #define FEATURE_DS_MP1CLK_MASK          (1 << FEATURE_DS_MP1CLK_BIT          )
 #define FEATURE_DS_MP0CLK_MASK          (1 << FEATURE_DS_MP0CLK_BIT          )
-#define FEATURE_XGMI_MASK               (1 << FEATURE_XGMI_BIT               )
+#define FEATURE_XGMI_MASK               (1ULL << FEATURE_XGMI_BIT               )
+#define FEATURE_ECC_MASK                (1ULL << FEATURE_ECC_BIT                )
 
 #define DPM_OVERRIDE_DISABLE_SOCCLK_PID             0x00000001
 #define DPM_OVERRIDE_DISABLE_UCLK_PID               0x00000002
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 381581b01d48..05bbc2b622fc 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -376,11 +376,7 @@ void drm_dev_unplug(struct drm_device *dev)
         synchronize_srcu(&drm_unplug_srcu);
 
         drm_dev_unregister(dev);
-
-        mutex_lock(&drm_global_mutex);
-        if (dev->open_count == 0)
-                drm_dev_put(dev);
-        mutex_unlock(&drm_global_mutex);
+        drm_dev_put(dev);
 }
 EXPORT_SYMBOL(drm_dev_unplug);
 
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 0e9349ff2d16..af2ab640cadb 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1963,7 +1963,7 @@ static int drm_fb_helper_single_fb_probe(struct drm_fb_helper *fb_helper,
                                 best_depth = fmt->depth;
                 }
         }
-        if (sizes.surface_depth != best_depth) {
+        if (sizes.surface_depth != best_depth && best_depth) {
                 DRM_INFO("requested bpp %d, scaled depth down to %d",
                          sizes.surface_bpp, best_depth);
                 sizes.surface_depth = best_depth;
diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
index 83a5bbca6e7e..7caa3c7ed978 100644
--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c
@@ -489,11 +489,9 @@ int drm_release(struct inode *inode, struct file *filp)
 
         drm_close_helper(filp);
 
-        if (!--dev->open_count) {
+        if (!--dev->open_count)
                 drm_lastclose(dev);
-                if (drm_dev_is_unplugged(dev))
-                        drm_put_dev(dev);
-        }
+
         mutex_unlock(&drm_global_mutex);
 
         drm_minor_release(minor);
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index 35b4ec3f7618..3592d04c33b2 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -1441,7 +1441,7 @@ static inline int cmd_address_audit(struct parser_exec_state *s,
         }
 
         if (index_mode) {
-                if (guest_gma >= I915_GTT_PAGE_SIZE / sizeof(u64)) {
+                if (guest_gma >= I915_GTT_PAGE_SIZE) {
                         ret = -EFAULT;
                         goto err;
                 }
diff --git a/drivers/gpu/drm/i915/gvt/display.c b/drivers/gpu/drm/i915/gvt/display.c
index 035479e273be..e3f9caa7839f 100644
--- a/drivers/gpu/drm/i915/gvt/display.c
+++ b/drivers/gpu/drm/i915/gvt/display.c
@@ -448,7 +448,7 @@ void intel_gvt_emulate_vblank(struct intel_gvt *gvt)
 /**
  * intel_vgpu_emulate_hotplug - trigger hotplug event for vGPU
  * @vgpu: a vGPU
- * @conncted: link state
+ * @connected: link state
  *
  * This function is used to trigger hotplug interrupt for vGPU
  *
diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c
index 3e7e2b80c857..5d887f7cc0d5 100644
--- a/drivers/gpu/drm/i915/gvt/dmabuf.c
+++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
@@ -238,9 +238,6 @@ static int vgpu_get_plane_info(struct drm_device *dev,
                 default:
                         gvt_vgpu_err("invalid tiling mode: %x\n", p.tiled);
                 }
-
-                info->size = (((p.stride * p.height * p.bpp) / 8) +
-                              (PAGE_SIZE - 1)) >> PAGE_SHIFT;
         } else if (plane_id == DRM_PLANE_TYPE_CURSOR) {
                 ret = intel_vgpu_decode_cursor_plane(vgpu, &c);
                 if (ret)
@@ -262,14 +259,13 @@ static int vgpu_get_plane_info(struct drm_device *dev,
                         info->x_hot = UINT_MAX;
                         info->y_hot = UINT_MAX;
                 }
-
-                info->size = (((info->stride * c.height * c.bpp) / 8)
-                                + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
         } else {
                 gvt_vgpu_err("invalid plane id:%d\n", plane_id);
                 return -EINVAL;
         }
 
+        info->size = (info->stride * info->height + PAGE_SIZE - 1)
+                      >> PAGE_SHIFT;
         if (info->size == 0) {
                 gvt_vgpu_err("fb size is zero\n");
                 return -EINVAL;
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index c7103dd2d8d5..cf133ef03873 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -1882,7 +1882,11 @@ struct intel_vgpu_mm *intel_vgpu_create_ppgtt_mm(struct intel_vgpu *vgpu,
         }
 
         list_add_tail(&mm->ppgtt_mm.list, &vgpu->gtt.ppgtt_mm_list_head);
+
+        mutex_lock(&gvt->gtt.ppgtt_mm_lock);
         list_add_tail(&mm->ppgtt_mm.lru_list, &gvt->gtt.ppgtt_mm_lru_list_head);
+        mutex_unlock(&gvt->gtt.ppgtt_mm_lock);
+
         return mm;
 }
 
@@ -1942,7 +1946,7 @@ void _intel_vgpu_mm_release(struct kref *mm_ref)
  */
 void intel_vgpu_unpin_mm(struct intel_vgpu_mm *mm)
 {
-        atomic_dec(&mm->pincount);
+        atomic_dec_if_positive(&mm->pincount);
 }
 
 /**
@@ -1967,9 +1971,10 @@ int intel_vgpu_pin_mm(struct intel_vgpu_mm *mm)
                 if (ret)
                         return ret;
 
+                mutex_lock(&mm->vgpu->gvt->gtt.ppgtt_mm_lock);
                 list_move_tail(&mm->ppgtt_mm.lru_list,
                                &mm->vgpu->gvt->gtt.ppgtt_mm_lru_list_head);
-
+                mutex_unlock(&mm->vgpu->gvt->gtt.ppgtt_mm_lock);
         }
 
         return 0;
@@ -1980,6 +1985,8 @@ static int reclaim_one_ppgtt_mm(struct intel_gvt *gvt)
         struct intel_vgpu_mm *mm;
         struct list_head *pos, *n;
 
+        mutex_lock(&gvt->gtt.ppgtt_mm_lock);
+
         list_for_each_safe(pos, n, &gvt->gtt.ppgtt_mm_lru_list_head) {
                 mm = container_of(pos, struct intel_vgpu_mm, ppgtt_mm.lru_list);
 
@@ -1987,9 +1994,11 @@ static int reclaim_one_ppgtt_mm(struct intel_gvt *gvt)
                         continue;
 
                 list_del_init(&mm->ppgtt_mm.lru_list);
+                mutex_unlock(&gvt->gtt.ppgtt_mm_lock);
                 invalidate_ppgtt_mm(mm);
                 return 1;
         }
+        mutex_unlock(&gvt->gtt.ppgtt_mm_lock);
         return 0;
 }
 
@@ -2659,6 +2668,7 @@ int intel_gvt_init_gtt(struct intel_gvt *gvt)
                 }
         }
         INIT_LIST_HEAD(&gvt->gtt.ppgtt_mm_lru_list_head);
+        mutex_init(&gvt->gtt.ppgtt_mm_lock);
         return 0;
 }
 
@@ -2699,7 +2709,9 @@ void intel_vgpu_invalidate_ppgtt(struct intel_vgpu *vgpu)
         list_for_each_safe(pos, n, &vgpu->gtt.ppgtt_mm_list_head) {
                 mm = container_of(pos, struct intel_vgpu_mm, ppgtt_mm.list);
                 if (mm->type == INTEL_GVT_MM_PPGTT) {
+                        mutex_lock(&vgpu->gvt->gtt.ppgtt_mm_lock);
                         list_del_init(&mm->ppgtt_mm.lru_list);
+                        mutex_unlock(&vgpu->gvt->gtt.ppgtt_mm_lock);
                         if (mm->ppgtt_mm.shadowed)
                                 invalidate_ppgtt_mm(mm);
                 }
diff --git a/drivers/gpu/drm/i915/gvt/gtt.h b/drivers/gpu/drm/i915/gvt/gtt.h
index d8cb04cc946d..edb610dc5d86 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.h
+++ b/drivers/gpu/drm/i915/gvt/gtt.h
@@ -88,6 +88,7 @@ struct intel_gvt_gtt {
         void (*mm_free_page_table)(struct intel_vgpu_mm *mm);
         struct list_head oos_page_use_list_head;
         struct list_head oos_page_free_list_head;
+        struct mutex ppgtt_mm_lock;
         struct list_head ppgtt_mm_lru_list_head;
 
         struct page *scratch_page;
diff --git a/drivers/gpu/drm/i915/gvt/mmio_context.c b/drivers/gpu/drm/i915/gvt/mmio_context.c
index 7d84cfb9051a..7902fb162d09 100644
--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
+++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
@@ -132,6 +132,7 @@ static struct engine_mmio gen9_engine_mmio_list[] __cacheline_aligned = {
 
         {RCS, GEN9_GAMT_ECO_REG_RW_IA, 0x0, false}, /* 0x4ab0 */
         {RCS, GEN9_CSFE_CHICKEN1_RCS, 0xffff, false}, /* 0x20d4 */
+        {RCS, _MMIO(0x20D8), 0xffff, true}, /* 0x20d8 */
 
         {RCS, GEN8_GARBCNTL, 0x0, false}, /* 0xb004 */
         {RCS, GEN7_FF_THREAD_MODE, 0x0, false}, /* 0x20a0 */
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index 1bb8f936fdaa..05b953793316 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -346,7 +346,7 @@ static int set_context_ppgtt_from_shadow(struct intel_vgpu_workload *workload,
         int i = 0;
 
         if (mm->type != INTEL_GVT_MM_PPGTT || !mm->ppgtt_mm.shadowed)
-                return -1;
+                return -EINVAL;
 
         if (mm->ppgtt_mm.root_entry_type == GTT_TYPE_PPGTT_ROOT_L4_ENTRY) {
                 px_dma(&ppgtt->pml4) = mm->ppgtt_mm.shadow_pdps[0];
@@ -410,12 +410,6 @@ int intel_gvt_scan_and_shadow_workload(struct intel_vgpu_workload *workload)
         if (workload->shadow)
                 return 0;
 
-        ret = set_context_ppgtt_from_shadow(workload, shadow_ctx);
-        if (ret < 0) {
-                gvt_vgpu_err("workload shadow ppgtt isn't ready\n");
-                return ret;
-        }
-
         /* pin shadow context by gvt even the shadow context will be pinned
          * when i915 alloc request. That is because gvt will update the guest
          * context from shadow context when workload is completed, and at that
@@ -678,6 +672,9 @@ static int dispatch_workload(struct intel_vgpu_workload *workload)
 {
         struct intel_vgpu *vgpu = workload->vgpu;
         struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
+        struct intel_vgpu_submission *s = &vgpu->submission;
+        struct i915_gem_context *shadow_ctx = s->shadow_ctx;
+        struct i915_request *rq;
         int ring_id = workload->ring_id;
         int ret;
 
@@ -687,6 +684,12 @@ static int dispatch_workload(struct intel_vgpu_workload *workload)
         mutex_lock(&vgpu->vgpu_lock);
         mutex_lock(&dev_priv->drm.struct_mutex);
 
+        ret = set_context_ppgtt_from_shadow(workload, shadow_ctx);
+        if (ret < 0) {
+                gvt_vgpu_err("workload shadow ppgtt isn't ready\n");
+                goto err_req;
+        }
+
         ret = intel_gvt_workload_req_alloc(workload);
         if (ret)
                 goto err_req;
@@ -703,6 +706,14 @@ static int dispatch_workload(struct intel_vgpu_workload *workload)
 
         ret = prepare_workload(workload);
 out:
+        if (ret) {
+                /* We might still need to add request with
+                 * clean ctx to retire it properly..
+                 */
+                rq = fetch_and_zero(&workload->req);
+                i915_request_put(rq);
+        }
+
         if (!IS_ERR_OR_NULL(workload->req)) {
                 gvt_dbg_sched("ring id %d submit workload to i915 %p\n",
                                 ring_id, workload->req);
@@ -739,7 +750,8 @@ static struct intel_vgpu_workload *pick_next_workload(
                 goto out;
         }
 
-        if (list_empty(workload_q_head(scheduler->current_vgpu, ring_id)))
+        if (!scheduler->current_vgpu->active ||
+            list_empty(workload_q_head(scheduler->current_vgpu, ring_id)))
                 goto out;
 
         /*
@@ -1474,8 +1486,9 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id,
                 intel_runtime_pm_put_unchecked(dev_priv);
         }
 
-        if (ret && (vgpu_is_vm_unhealthy(ret))) {
-                enter_failsafe_mode(vgpu, GVT_FAILSAFE_GUEST_ERR);
+        if (ret) {
+                if (vgpu_is_vm_unhealthy(ret))
+                        enter_failsafe_mode(vgpu, GVT_FAILSAFE_GUEST_ERR);
                 intel_vgpu_destroy_workload(workload);
                 return ERR_PTR(ret);
         }
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 0bd890c04fe4..f6f6e5b78e97 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -4830,7 +4830,10 @@ static int i915_dsc_fec_support_show(struct seq_file *m, void *data)
                 ret = drm_modeset_lock(&dev->mode_config.connection_mutex,
                                        &ctx);
                 if (ret) {
-                        ret = -EINTR;
+                        if (ret == -EDEADLK && !drm_modeset_backoff(&ctx)) {
+                                try_again = true;
+                                continue;
+                        }
                         break;
                 }
                 crtc = connector->state->crtc;
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 9adc7bb9e69c..a67a63b5aa84 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -2346,7 +2346,8 @@ static inline unsigned int i915_sg_segment_size(void)
                                  INTEL_DEVID(dev_priv) == 0x5915 || \
                                  INTEL_DEVID(dev_priv) == 0x591E)
 #define IS_AML_ULX(dev_priv)    (INTEL_DEVID(dev_priv) == 0x591C || \
-                                 INTEL_DEVID(dev_priv) == 0x87C0)
+                                 INTEL_DEVID(dev_priv) == 0x87C0 || \
+                                 INTEL_DEVID(dev_priv) == 0x87CA)
 #define IS_SKL_GT2(dev_priv)    (IS_SKYLAKE(dev_priv) && \
                                  INTEL_INFO(dev_priv)->gt == 2)
 #define IS_SKL_GT3(dev_priv)    (IS_SKYLAKE(dev_priv) && \
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 638a586469f9..047855dd8c6b 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -2863,7 +2863,7 @@ enum i915_power_well_id {
 #define GEN11_GT_VEBOX_VDBOX_DISABLE    _MMIO(0x9140)
 #define   GEN11_GT_VDBOX_DISABLE_MASK   0xff
 #define   GEN11_GT_VEBOX_DISABLE_SHIFT  16
-#define   GEN11_GT_VEBOX_DISABLE_MASK   (0xff << GEN11_GT_VEBOX_DISABLE_SHIFT)
+#define   GEN11_GT_VEBOX_DISABLE_MASK   (0x0f << GEN11_GT_VEBOX_DISABLE_SHIFT)
 
 #define GEN11_EU_DISABLE _MMIO(0x9134)
 #define GEN11_EU_DIS_MASK 0xFF
@@ -9243,7 +9243,7 @@ enum skl_power_gate {
 #define TRANS_DDI_FUNC_CTL2(tran)       _MMIO_TRANS2(tran, \
                                                      _TRANS_DDI_FUNC_CTL2_A)
 #define  PORT_SYNC_MODE_ENABLE                  (1 << 4)
-#define  PORT_SYNC_MODE_MASTER_SELECT(x)        ((x) < 0)
+#define  PORT_SYNC_MODE_MASTER_SELECT(x)        ((x) << 0)
 #define  PORT_SYNC_MODE_MASTER_SELECT_MASK      (0x7 << 0)
 #define  PORT_SYNC_MODE_MASTER_SELECT_SHIFT     0
 
diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_evict.c b/drivers/gpu/drm/i915/selftests/i915_gem_evict.c
index 32dce7176f63..b9b0ea4e2404 100644
--- a/drivers/gpu/drm/i915/selftests/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/selftests/i915_gem_evict.c
@@ -455,7 +455,7 @@ static int igt_evict_contexts(void *arg)
                         struct i915_gem_context *ctx;
 
                         ctx = live_context(i915, file);
-                        if (!ctx)
+                        if (IS_ERR(ctx))
                                 break;
 
                         /* We will need some GGTT space for the rq's context */
diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
index 2281ed3eb774..8a4ebcb6405c 100644
--- a/drivers/gpu/drm/meson/meson_drv.c
+++ b/drivers/gpu/drm/meson/meson_drv.c
@@ -337,12 +337,14 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)
 
         ret = drm_dev_register(drm, 0);
         if (ret)
-                goto free_drm;
+                goto uninstall_irq;
 
         drm_fbdev_generic_setup(drm, 32);
 
         return 0;
 
+uninstall_irq:
+        drm_irq_uninstall(drm);
 free_drm:
         drm_dev_put(drm);
 
@@ -356,8 +358,8 @@ static int meson_drv_bind(struct device *dev)
 
 static void meson_drv_unbind(struct device *dev)
 {
-        struct drm_device *drm = dev_get_drvdata(dev);
-        struct meson_drm *priv = drm->dev_private;
+        struct meson_drm *priv = dev_get_drvdata(dev);
+        struct drm_device *drm = priv->drm;
 
         if (priv->canvas) {
                 meson_canvas_free(priv->canvas, priv->canvas_id_osd1);
@@ -367,6 +369,7 @@ static void meson_drv_unbind(struct device *dev)
         }
 
         drm_dev_unregister(drm);
+        drm_irq_uninstall(drm);
         drm_kms_helper_poll_fini(drm);
         drm_mode_config_cleanup(drm);
         drm_dev_put(drm);
diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
index e28814f4ea6c..563953ec6ad0 100644
--- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
+++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c
@@ -569,7 +569,8 @@ dw_hdmi_mode_valid(struct drm_connector *connector,
         DRM_DEBUG_DRIVER("Modeline " DRM_MODE_FMT "\n", DRM_MODE_ARG(mode));
 
         /* If sink max TMDS clock, we reject the mode */
-        if (mode->clock > connector->display_info.max_tmds_clock)
+        if (connector->display_info.max_tmds_clock &&
+            mode->clock > connector->display_info.max_tmds_clock)
                 return MODE_BAD;
 
         /* Check against non-VIC supported modes */
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index c7d4c6073ea5..0d4ade9d4722 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -541,6 +541,18 @@ static void vop_core_clks_disable(struct vop *vop)
         clk_disable(vop->hclk);
 }
 
+static void vop_win_disable(struct vop *vop, const struct vop_win_data *win)
+{
+        if (win->phy->scl && win->phy->scl->ext) {
+                VOP_SCL_SET_EXT(vop, win, yrgb_hor_scl_mode, SCALE_NONE);
+                VOP_SCL_SET_EXT(vop, win, yrgb_ver_scl_mode, SCALE_NONE);
+                VOP_SCL_SET_EXT(vop, win, cbcr_hor_scl_mode, SCALE_NONE);
+                VOP_SCL_SET_EXT(vop, win, cbcr_ver_scl_mode, SCALE_NONE);
+        }
+
+        VOP_WIN_SET(vop, win, enable, 0);
+}
+
 static int vop_enable(struct drm_crtc *crtc)
 {
         struct vop *vop = to_vop(crtc);
@@ -586,7 +598,7 @@ static int vop_enable(struct drm_crtc *crtc)
                 struct vop_win *vop_win = &vop->win[i];
                 const struct vop_win_data *win = vop_win->data;
 
-                VOP_WIN_SET(vop, win, enable, 0);
+                vop_win_disable(vop, win);
         }
         spin_unlock(&vop->reg_lock);
 
@@ -735,7 +747,7 @@ static void vop_plane_atomic_disable(struct drm_plane *plane,
 
         spin_lock(&vop->reg_lock);
 
-        VOP_WIN_SET(vop, win, enable, 0);
+        vop_win_disable(vop, win);
 
         spin_unlock(&vop->reg_lock);
 }
@@ -1622,7 +1634,7 @@ static int vop_initial(struct vop *vop)
                 int channel = i * 2 + 1;
 
                 VOP_WIN_SET(vop, win, channel, (channel + 1) << 4 | channel);
-                VOP_WIN_SET(vop, win, enable, 0);
+                vop_win_disable(vop, win);
                 VOP_WIN_SET(vop, win, gate, 1);
         }
 
diff --git a/drivers/gpu/drm/tegra/hub.c b/drivers/gpu/drm/tegra/hub.c
index ba9b3cfb8c3d..b3436c2aed68 100644
--- a/drivers/gpu/drm/tegra/hub.c
+++ b/drivers/gpu/drm/tegra/hub.c
@@ -378,14 +378,16 @@ static int tegra_shared_plane_atomic_check(struct drm_plane *plane,
 static void tegra_shared_plane_atomic_disable(struct drm_plane *plane,
                                               struct drm_plane_state *old_state)
 {
-        struct tegra_dc *dc = to_tegra_dc(old_state->crtc);
         struct tegra_plane *p = to_tegra_plane(plane);
+        struct tegra_dc *dc;
         u32 value;
 
         /* rien ne va plus */
         if (!old_state || !old_state->crtc)
                 return;
 
+        dc = to_tegra_dc(old_state->crtc);
+
         /*
          * XXX Legacy helpers seem to sometimes call ->atomic_disable() even
          * on planes that are already disabled. Make sure we fallback to the
diff --git a/drivers/gpu/drm/tegra/vic.c b/drivers/gpu/drm/tegra/vic.c
index 39bfed9623de..982ce37ecde1 100644
--- a/drivers/gpu/drm/tegra/vic.c
+++ b/drivers/gpu/drm/tegra/vic.c
@@ -106,6 +106,7 @@ static int vic_boot(struct vic *vic)
         if (vic->booted)
                 return 0;
 
+#ifdef CONFIG_IOMMU_API
         if (vic->config->supports_sid) {
                 struct iommu_fwspec *spec = dev_iommu_fwspec_get(vic->dev);
                 u32 value;
@@ -121,6 +122,7 @@ static int vic_boot(struct vic *vic)
                         vic_writel(vic, value, VIC_THI_STREAMID1);
                 }
         }
+#endif
 
         /* setup clockgating registers */
         vic_writel(vic, CG_IDLE_CG_DLY_CNT(4) |
diff --git a/drivers/gpu/drm/udl/udl_connector.c b/drivers/gpu/drm/udl/udl_connector.c
index 66885c24590f..c1bd5e3d9e4a 100644
--- a/drivers/gpu/drm/udl/udl_connector.c
+++ b/drivers/gpu/drm/udl/udl_connector.c
@@ -18,18 +18,19 @@
 #include "udl_connector.h"
 #include "udl_drv.h"
 
-static bool udl_get_edid_block(struct udl_device *udl, int block_idx,
-                                                           u8 *buff)
+static int udl_get_edid_block(void *data, u8 *buf, unsigned int block,
+                               size_t len)
 {
         int ret, i;
         u8 *read_buff;
+        struct udl_device *udl = data;
 
         read_buff = kmalloc(2, GFP_KERNEL);
         if (!read_buff)
-                return false;
+                return -1;
 
-        for (i = 0; i < EDID_LENGTH; i++) {
-                int bval = (i + block_idx * EDID_LENGTH) << 8;
+        for (i = 0; i < len; i++) {
+                int bval = (i + block * EDID_LENGTH) << 8;
                 ret = usb_control_msg(udl->udev,
                                       usb_rcvctrlpipe(udl->udev, 0),
                                           (0x02), (0x80 | (0x02 << 5)), bval,
@@ -37,60 +38,13 @@ static bool udl_get_edid_block(struct udl_device *udl, int block_idx,
                 if (ret < 1) {
                         DRM_ERROR("Read EDID byte %d failed err %x\n", i, ret);
                         kfree(read_buff);
-                        return false;
+                        return -1;
                 }
-                buff[i] = read_buff[1];
+                buf[i] = read_buff[1];
         }
 
         kfree(read_buff);
-        return true;
-}
-
-static bool udl_get_edid(struct udl_device *udl, u8 **result_buff,
-                         int *result_buff_size)
-{
-        int i, extensions;
-        u8 *block_buff = NULL, *buff_ptr;
-
-        block_buff = kmalloc(EDID_LENGTH, GFP_KERNEL);
-        if (block_buff == NULL)
-                return false;
-
-        if (udl_get_edid_block(udl, 0, block_buff) &&
-            memchr_inv(block_buff, 0, EDID_LENGTH)) {
-                extensions = ((struct edid *)block_buff)->extensions;
-                if (extensions > 0) {
-                        /* we have to read all extensions one by one */
-                        *result_buff_size = EDID_LENGTH * (extensions + 1);
-                        *result_buff = kmalloc(*result_buff_size, GFP_KERNEL);
-                        buff_ptr = *result_buff;
-                        if (buff_ptr == NULL) {
-                                kfree(block_buff);
-                                return false;
-                        }
-                        memcpy(buff_ptr, block_buff, EDID_LENGTH);
-                        kfree(block_buff);
-                        buff_ptr += EDID_LENGTH;
-                        for (i = 1; i < extensions; ++i) {
-                                if (udl_get_edid_block(udl, i, buff_ptr)) {
-                                        buff_ptr += EDID_LENGTH;
-                                } else {
-                                        kfree(*result_buff);
-                                        *result_buff = NULL;
-                                        return false;
-                                }
-                        }
-                        return true;
-                }
-                /* we have only base edid block */
-                *result_buff = block_buff;
-                *result_buff_size = EDID_LENGTH;
-                return true;
-        }
-
-        kfree(block_buff);
-
-        return false;
+        return 0;
 }
 
 static int udl_get_modes(struct drm_connector *connector)
@@ -122,8 +76,6 @@ static enum drm_mode_status udl_mode_valid(struct drm_connector *connector,
 static enum drm_connector_status
 udl_detect(struct drm_connector *connector, bool force)
 {
-        u8 *edid_buff = NULL;
-        int edid_buff_size = 0;
         struct udl_device *udl = connector->dev->dev_private;
         struct udl_drm_connector *udl_connector =
                                         container_of(connector,
@@ -136,12 +88,10 @@ udl_detect(struct drm_connector *connector, bool force)
                 udl_connector->edid = NULL;
         }
 
-
-        if (!udl_get_edid(udl, &edid_buff, &edid_buff_size))
+        udl_connector->edid = drm_do_get_edid(connector, udl_get_edid_block, udl);
+        if (!udl_connector->edid)
                 return connector_status_disconnected;
 
-        udl_connector->edid = (struct edid *)edid_buff;
-        
         return connector_status_connected;
 }
 
diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c
index 5930facd6d2d..11a8f99ba18c 100644
--- a/drivers/gpu/drm/vgem/vgem_drv.c
+++ b/drivers/gpu/drm/vgem/vgem_drv.c
@@ -191,13 +191,9 @@ static struct drm_gem_object *vgem_gem_create(struct drm_device *dev,
         ret = drm_gem_handle_create(file, &obj->base, handle);
         drm_gem_object_put_unlocked(&obj->base);
         if (ret)
-                goto err;
+                return ERR_PTR(ret);
 
         return &obj->base;
-
-err:
-        __vgem_gem_destroy(obj);
-        return ERR_PTR(ret);
 }
 
 static int vgem_gem_dumb_create(struct drm_file *file, struct drm_device *dev,
diff --git a/drivers/gpu/drm/vkms/vkms_gem.c b/drivers/gpu/drm/vkms/vkms_gem.c
index 138b0bb325cf..69048e73377d 100644
--- a/drivers/gpu/drm/vkms/vkms_gem.c
+++ b/drivers/gpu/drm/vkms/vkms_gem.c
@@ -111,11 +111,8 @@ struct drm_gem_object *vkms_gem_create(struct drm_device *dev,
 
         ret = drm_gem_handle_create(file, &obj->gem, handle);
         drm_gem_object_put_unlocked(&obj->gem);
-        if (ret) {
-                drm_gem_object_release(&obj->gem);
-                kfree(obj);
+        if (ret)
                 return ERR_PTR(ret);
-        }
 
         return &obj->gem;
 }
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 6ca8d322b487..4ca0cdfa6b33 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -150,6 +150,7 @@ config HID_ASUS
         tristate "Asus"
         depends on LEDS_CLASS
         depends on ASUS_WMI || ASUS_WMI=n
+        select POWER_SUPPLY
         ---help---
         Support for Asus notebook built-in keyboard and touchpad via i2c, and
         the Asus Republic of Gamers laptop keyboard special keys.
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 9993b692598f..860e21ec6a49 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1301,10 +1301,10 @@ static u32 __extract(u8 *report, unsigned offset, int n)
 u32 hid_field_extract(const struct hid_device *hid, u8 *report,
                         unsigned offset, unsigned n)
 {
-        if (n > 32) {
-                hid_warn(hid, "hid_field_extract() called with n (%d) > 32! (%s)\n",
+        if (n > 256) {
+                hid_warn(hid, "hid_field_extract() called with n (%d) > 256! (%s)\n",
                          n, current->comm);
-                n = 32;
+                n = 256;
         }
 
         return __extract(report, offset, n);
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index ac9fda1b5a72..1384e57182af 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -1060,10 +1060,15 @@ static int hid_debug_rdesc_show(struct seq_file *f, void *p)
         seq_printf(f, "\n\n");
 
         /* dump parsed data and input mappings */
+        if (down_interruptible(&hdev->driver_input_lock))
+                return 0;
+
         hid_dump_device(hdev, f);
         seq_printf(f, "\n");
         hid_dump_input_mapping(hdev, f);
 
+        up(&hdev->driver_input_lock);
+
         return 0;
 }
 
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b6d93f4ad037..adce58f24f76 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -1083,6 +1083,7 @@
 #define USB_DEVICE_ID_SYNAPTICS_HD      0x0ac3
 #define USB_DEVICE_ID_SYNAPTICS_QUAD_HD 0x1ac3
 #define USB_DEVICE_ID_SYNAPTICS_TP_V103 0x5710
+#define I2C_DEVICE_ID_SYNAPTICS_7E7E    0x7e7e
 
 #define USB_VENDOR_ID_TEXAS_INSTRUMENTS 0x2047
 #define USB_DEVICE_ID_TEXAS_INSTRUMENTS_LENOVO_YOGA     0x0855
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index b10b1922c5bd..1fce0076e7dc 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -998,6 +998,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                 case 0x1b8: map_key_clear(KEY_VIDEO);           break;
                 case 0x1bc: map_key_clear(KEY_MESSENGER);       break;
                 case 0x1bd: map_key_clear(KEY_INFO);            break;
+                case 0x1cb: map_key_clear(KEY_ASSISTANT);       break;
                 case 0x201: map_key_clear(KEY_NEW);             break;
                 case 0x202: map_key_clear(KEY_OPEN);            break;
                 case 0x203: map_key_clear(KEY_CLOSE);           break;
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 15ed6177a7a3..199cc256e9d9 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -2111,6 +2111,13 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
                 kfree(data);
                 return -ENOMEM;
         }
+        data->wq = create_singlethread_workqueue("hidpp-ff-sendqueue");
+        if (!data->wq) {
+                kfree(data->effect_ids);
+                kfree(data);
+                return -ENOMEM;
+        }
+
         data->hidpp = hidpp;
         data->feature_index = feature_index;
         data->version = version;
@@ -2155,7 +2162,6 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
         /* ignore boost value at response.fap.params[2] */
 
         /* init the hardware command queue */
-        data->wq = create_singlethread_workqueue("hidpp-ff-sendqueue");
         atomic_set(&data->workqueue_size, 0);
 
         /* initialize with zero autocenter to get wheel in usable state */
@@ -2608,8 +2614,9 @@ static int m560_raw_event(struct hid_device *hdev, u8 *data, int size)
                 input_report_rel(mydata->input, REL_Y, v);
 
                 v = hid_snto32(data[6], 8);
-                hidpp_scroll_counter_handle_scroll(
-                                &hidpp->vertical_wheel_counter, v);
+                if (v != 0)
+                        hidpp_scroll_counter_handle_scroll(
+                                        &hidpp->vertical_wheel_counter, v);
 
                 input_sync(mydata->input);
         }
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 953908f2267c..77ffba48cc73 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -715,7 +715,6 @@ static const struct hid_device_id hid_ignore_list[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_DEALEXTREAME, USB_DEVICE_ID_DEALEXTREAME_RADIO_SI4701) },
         { HID_USB_DEVICE(USB_VENDOR_ID_DELORME, USB_DEVICE_ID_DELORME_EARTHMATE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_DELORME, USB_DEVICE_ID_DELORME_EM_LT20) },
-        { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, 0x0400) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ESSENTIAL_REALITY, USB_DEVICE_ID_ESSENTIAL_REALITY_P5) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC5UH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC4UM) },
@@ -855,7 +854,7 @@ static const struct hid_device_id hid_ignore_list[] = {
         { }
 };
 
-/**
+/*
  * hid_mouse_ignore_list - mouse devices which should not be handled by the hid layer
  *
  * There are composite devices for which we want to ignore only a certain
@@ -996,6 +995,10 @@ bool hid_ignore(struct hid_device *hdev)
                 if (hdev->product == 0x0401 &&
                     strncmp(hdev->name, "ELAN0800", 8) != 0)
                         return true;
+                /* Same with product id 0x0400 */
+                if (hdev->product == 0x0400 &&
+                    strncmp(hdev->name, "QTEC0001", 8) != 0)
+                        return true;
                 break;
         }
 
@@ -1042,7 +1045,7 @@ static struct hid_device_id *hid_exists_dquirk(const struct hid_device *hdev)
         }
 
         if (bl_entry != NULL)
-                dbg_hid("Found dynamic quirk 0x%lx for HID device 0x%hx:0x%hx\n",
+                dbg_hid("Found dynamic quirk 0x%lx for HID device 0x%04x:0x%04x\n",
                         bl_entry->driver_data, bl_entry->vendor,
                         bl_entry->product);
 
@@ -1209,7 +1212,7 @@ static unsigned long hid_gets_squirk(const struct hid_device *hdev)
                 quirks |= bl_entry->driver_data;
 
         if (quirks)
-                dbg_hid("Found squirk 0x%lx for HID device 0x%hx:0x%hx\n",
+                dbg_hid("Found squirk 0x%lx for HID device 0x%04x:0x%04x\n",
                         quirks, hdev->vendor, hdev->product);
         return quirks;
 }
diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
index 8141cadfca0e..8dae0f9b819e 100644
--- a/drivers/hid/hid-steam.c
+++ b/drivers/hid/hid-steam.c
@@ -499,6 +499,7 @@ static void steam_battery_unregister(struct steam_device *steam)
 static int steam_register(struct steam_device *steam)
 {
         int ret;
+        bool client_opened;
 
         /*
          * This function can be called several times in a row with the
@@ -511,9 +512,11 @@ static int steam_register(struct steam_device *steam)
                  * Unlikely, but getting the serial could fail, and it is not so
                  * important, so make up a serial number and go on.
                  */
+                mutex_lock(&steam->mutex);
                 if (steam_get_serial(steam) < 0)
                         strlcpy(steam->serial_no, "XXXXXXXXXX",
                                         sizeof(steam->serial_no));
+                mutex_unlock(&steam->mutex);
 
                 hid_info(steam->hdev, "Steam Controller '%s' connected",
                                 steam->serial_no);
@@ -528,13 +531,15 @@ static int steam_register(struct steam_device *steam)
         }
 
         mutex_lock(&steam->mutex);
-        if (!steam->client_opened) {
+        client_opened = steam->client_opened;
+        if (!client_opened)
                 steam_set_lizard_mode(steam, lizard_mode);
+        mutex_unlock(&steam->mutex);
+
+        if (!client_opened)
                 ret = steam_input_register(steam);
-        } else {
+        else
                 ret = 0;
-        }
-        mutex_unlock(&steam->mutex);
 
         return ret;
 }
@@ -630,14 +635,21 @@ static void steam_client_ll_close(struct hid_device *hdev)
 {
         struct steam_device *steam = hdev->driver_data;
 
+        unsigned long flags;
+        bool connected;
+
+        spin_lock_irqsave(&steam->lock, flags);
+        connected = steam->connected;
+        spin_unlock_irqrestore(&steam->lock, flags);
+
         mutex_lock(&steam->mutex);
         steam->client_opened = false;
+        if (connected)
+                steam_set_lizard_mode(steam, lizard_mode);
         mutex_unlock(&steam->mutex);
 
-        if (steam->connected) {
-                steam_set_lizard_mode(steam, lizard_mode);
+        if (connected)
                 steam_input_register(steam);
-        }
 }
 
 static int steam_client_ll_raw_request(struct hid_device *hdev,
diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c
index 7710d9f957da..0187c9f8fc22 100644
--- a/drivers/hid/hid-uclogic-params.c
+++ b/drivers/hid/hid-uclogic-params.c
@@ -735,10 +735,6 @@ static int uclogic_params_huion_init(struct uclogic_params *params,
                 goto cleanup;
         }
         rc = usb_string(udev, 201, ver_ptr, ver_len);
-        if (ver_ptr == NULL) {
-                rc = -ENOMEM;
-                goto cleanup;
-        }
         if (rc == -EPIPE) {
                 *ver_ptr = '\0';
         } else if (rc < 0) {
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 90164fed08d3..4d1f24ee249c 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -184,6 +184,8 @@ static const struct i2c_hid_quirks {
                 I2C_HID_QUIRK_NO_RUNTIME_PM },
         { USB_VENDOR_ID_ELAN, HID_ANY_ID,
                  I2C_HID_QUIRK_BOGUS_IRQ },
+        { USB_VENDOR_ID_SYNAPTICS, I2C_DEVICE_ID_SYNAPTICS_7E7E,
+                I2C_HID_QUIRK_NO_RUNTIME_PM },
         { 0, 0 }
 };
 
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 6f929bfa9fcd..d0f1dfe2bcbb 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -1759,6 +1759,7 @@ config SENSORS_VT8231
 config SENSORS_W83773G
         tristate "Nuvoton W83773G"
         depends on I2C
+        select REGMAP_I2C
         help
           If you say yes here you get support for the Nuvoton W83773G hardware
           monitoring chip.
diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
index e4f9f7ce92fa..f9abeeeead9e 100644
--- a/drivers/hwmon/ntc_thermistor.c
+++ b/drivers/hwmon/ntc_thermistor.c
@@ -640,7 +640,7 @@ static const struct hwmon_channel_info ntc_chip = {
 };
 
 static const u32 ntc_temp_config[] = {
-        HWMON_T_INPUT, HWMON_T_TYPE,
+        HWMON_T_INPUT | HWMON_T_TYPE,
         0
 };
 
diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
index b91a80abf724..4679acb4918e 100644
--- a/drivers/hwmon/occ/common.c
+++ b/drivers/hwmon/occ/common.c
@@ -890,6 +890,8 @@ static int occ_setup_sensor_attrs(struct occ *occ)
                                 s++;
                         }
                 }
+
+                s = (sensors->power.num_sensors * 4) + 1;
         } else {
                 for (i = 0; i < sensors->power.num_sensors; ++i) {
                         s = i + 1;
@@ -918,11 +920,11 @@ static int occ_setup_sensor_attrs(struct occ *occ)
                                                      show_power, NULL, 3, i);
                         attr++;
                 }
-        }
 
-        if (sensors->caps.num_sensors >= 1) {
                 s = sensors->power.num_sensors + 1;
+        }
 
+        if (sensors->caps.num_sensors >= 1) {
                 snprintf(attr->name, sizeof(attr->name), "power%d_label", s);
                 attr->sensor = OCC_INIT_ATTR(attr->name, 0444, show_caps, NULL,
                                              0, 0);
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index f2c681971201..f8979abb9a19 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -131,6 +131,7 @@ config I2C_I801
             Cannon Lake (PCH)
             Cedar Fork (PCH)
             Ice Lake (PCH)
+            Comet Lake (PCH)
 
           This driver can also be built as a module.  If so, the module
           will be called i2c-i801.
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index c91e145ef5a5..679c6c41f64b 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -71,6 +71,7 @@
  * Cannon Lake-LP (PCH)         0x9da3  32      hard    yes     yes     yes
  * Cedar Fork (PCH)             0x18df  32      hard    yes     yes     yes
  * Ice Lake-LP (PCH)            0x34a3  32      hard    yes     yes     yes
+ * Comet Lake (PCH)             0x02a3  32      hard    yes     yes     yes
  *
  * Features supported by this driver:
  * Software PEC                         no
@@ -240,6 +241,7 @@
 #define PCI_DEVICE_ID_INTEL_LEWISBURG_SSKU_SMBUS        0xa223
 #define PCI_DEVICE_ID_INTEL_KABYLAKE_PCH_H_SMBUS        0xa2a3
 #define PCI_DEVICE_ID_INTEL_CANNONLAKE_H_SMBUS          0xa323
+#define PCI_DEVICE_ID_INTEL_COMETLAKE_SMBUS             0x02a3
 
 struct i801_mux_config {
         char *gpio_chip;
@@ -1038,6 +1040,7 @@ static const struct pci_device_id i801_ids[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CANNONLAKE_H_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CANNONLAKE_LP_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICELAKE_LP_SMBUS) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_COMETLAKE_SMBUS) },
         { 0, }
 };
 
@@ -1534,6 +1537,7 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
         case PCI_DEVICE_ID_INTEL_DNV_SMBUS:
         case PCI_DEVICE_ID_INTEL_KABYLAKE_PCH_H_SMBUS:
         case PCI_DEVICE_ID_INTEL_ICELAKE_LP_SMBUS:
+        case PCI_DEVICE_ID_INTEL_COMETLAKE_SMBUS:
                 priv->features |= FEATURE_I2C_BLOCK_READ;
                 priv->features |= FEATURE_IRQ;
                 priv->features |= FEATURE_SMBUS_PEC;
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 21cb088d6687..f7cdd2ab7f11 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -3169,21 +3169,24 @@ static void amd_iommu_get_resv_regions(struct device *dev,
                 return;
 
         list_for_each_entry(entry, &amd_iommu_unity_map, list) {
+                int type, prot = 0;
                 size_t length;
-                int prot = 0;
 
                 if (devid < entry->devid_start || devid > entry->devid_end)
                         continue;
 
+                type   = IOMMU_RESV_DIRECT;
                 length = entry->address_end - entry->address_start;
                 if (entry->prot & IOMMU_PROT_IR)
                         prot |= IOMMU_READ;
                 if (entry->prot & IOMMU_PROT_IW)
                         prot |= IOMMU_WRITE;
+                if (entry->prot & IOMMU_UNITY_MAP_FLAG_EXCL_RANGE)
+                        /* Exclusion range */
+                        type = IOMMU_RESV_RESERVED;
 
                 region = iommu_alloc_resv_region(entry->address_start,
-                                                 length, prot,
-                                                 IOMMU_RESV_DIRECT);
+                                                 length, prot, type);
                 if (!region) {
                         dev_err(dev, "Out of memory allocating dm-regions\n");
                         return;
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index f773792d77fd..1b1378619fc9 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -2013,6 +2013,9 @@ static int __init init_unity_map_range(struct ivmd_header *m)
         if (e == NULL)
                 return -ENOMEM;
 
+        if (m->flags & IVMD_FLAG_EXCL_RANGE)
+                init_exclusion_range(m);
+
         switch (m->type) {
         default:
                 kfree(e);
@@ -2059,9 +2062,7 @@ static int __init init_memory_definitions(struct acpi_table_header *table)
 
         while (p < end) {
                 m = (struct ivmd_header *)p;
-                if (m->flags & IVMD_FLAG_EXCL_RANGE)
-                        init_exclusion_range(m);
-                else if (m->flags & IVMD_FLAG_UNITY_MAP)
+                if (m->flags & (IVMD_FLAG_UNITY_MAP | IVMD_FLAG_EXCL_RANGE))
                         init_unity_map_range(m);
 
                 p += m->length;
diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
index eae0741f72dc..87965e4d9647 100644
--- a/drivers/iommu/amd_iommu_types.h
+++ b/drivers/iommu/amd_iommu_types.h
@@ -374,6 +374,8 @@
 #define IOMMU_PROT_IR 0x01
 #define IOMMU_PROT_IW 0x02
 
+#define IOMMU_UNITY_MAP_FLAG_EXCL_RANGE (1 << 2)
+
 /* IOMMU capabilities */
 #define IOMMU_CAP_IOTLB   24
 #define IOMMU_CAP_NPCACHE 26
diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
index f101afc315ab..9a8a8870e267 100644
--- a/drivers/iommu/io-pgtable-arm-v7s.c
+++ b/drivers/iommu/io-pgtable-arm-v7s.c
@@ -160,6 +160,14 @@
 
 #define ARM_V7S_TCR_PD1                 BIT(5)
 
+#ifdef CONFIG_ZONE_DMA32
+#define ARM_V7S_TABLE_GFP_DMA GFP_DMA32
+#define ARM_V7S_TABLE_SLAB_FLAGS SLAB_CACHE_DMA32
+#else
+#define ARM_V7S_TABLE_GFP_DMA GFP_DMA
+#define ARM_V7S_TABLE_SLAB_FLAGS SLAB_CACHE_DMA
+#endif
+
 typedef u32 arm_v7s_iopte;
 
 static bool selftest_running;
@@ -197,13 +205,16 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp,
         void *table = NULL;
 
         if (lvl == 1)
-                table = (void *)__get_dma_pages(__GFP_ZERO, get_order(size));
+                table = (void *)__get_free_pages(
+                        __GFP_ZERO | ARM_V7S_TABLE_GFP_DMA, get_order(size));
         else if (lvl == 2)
-                table = kmem_cache_zalloc(data->l2_tables, gfp | GFP_DMA);
+                table = kmem_cache_zalloc(data->l2_tables, gfp);
         phys = virt_to_phys(table);
-        if (phys != (arm_v7s_iopte)phys)
+        if (phys != (arm_v7s_iopte)phys) {
                 /* Doesn't fit in PTE */
+                dev_err(dev, "Page table does not fit in PTE: %pa", &phys);
                 goto out_free;
+        }
         if (table && !(cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA)) {
                 dma = dma_map_single(dev, table, size, DMA_TO_DEVICE);
                 if (dma_mapping_error(dev, dma))
@@ -733,7 +744,7 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg,
         data->l2_tables = kmem_cache_create("io-pgtable_armv7s_l2",
                                             ARM_V7S_TABLE_SIZE(2),
                                             ARM_V7S_TABLE_SIZE(2),
-                                            SLAB_CACHE_DMA, NULL);
+                                            ARM_V7S_TABLE_SLAB_FLAGS, NULL);
         if (!data->l2_tables)
                 goto out_free_data;
 
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 33a982e33716..109de67d5d72 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -1105,10 +1105,12 @@ struct iommu_group *iommu_group_get_for_dev(struct device *dev)
 
                 dom = __iommu_domain_alloc(dev->bus, iommu_def_domain_type);
                 if (!dom && iommu_def_domain_type != IOMMU_DOMAIN_DMA) {
-                        dev_warn(dev,
-                                 "failed to allocate default IOMMU domain of type %u; falling back to IOMMU_DOMAIN_DMA",
-                                 iommu_def_domain_type);
                         dom = __iommu_domain_alloc(dev->bus, IOMMU_DOMAIN_DMA);
+                        if (dom) {
+                                dev_warn(dev,
+                                         "failed to allocate default IOMMU domain of type %u; falling back to IOMMU_DOMAIN_DMA",
+                                         iommu_def_domain_type);
+                        }
                 }
 
                 group->default_domain = dom;
diff --git a/drivers/leds/leds-pca9532.c b/drivers/leds/leds-pca9532.c
index 7fea18b0c15d..7cb4d685a1f1 100644
--- a/drivers/leds/leds-pca9532.c
+++ b/drivers/leds/leds-pca9532.c
@@ -513,6 +513,7 @@ static int pca9532_probe(struct i2c_client *client,
         const struct i2c_device_id *id)
 {
         int devid;
+        const struct of_device_id *of_id;
         struct pca9532_data *data = i2c_get_clientdata(client);
         struct pca9532_platform_data *pca9532_pdata =
                         dev_get_platdata(&client->dev);
@@ -528,8 +529,11 @@ static int pca9532_probe(struct i2c_client *client,
                         dev_err(&client->dev, "no platform data\n");
                         return -EINVAL;
                 }
-                devid = (int)(uintptr_t)of_match_device(
-                        of_pca9532_leds_match, &client->dev)->data;
+                of_id = of_match_device(of_pca9532_leds_match,
+                                &client->dev);
+                if (unlikely(!of_id))
+                        return -EINVAL;
+                devid = (int)(uintptr_t) of_id->data;
         } else {
                 devid = id->driver_data;
         }
diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/ledtrig-netdev.c
index 3dd3ed46d473..136f86a1627d 100644
--- a/drivers/leds/trigger/ledtrig-netdev.c
+++ b/drivers/leds/trigger/ledtrig-netdev.c
@@ -122,7 +122,8 @@ static ssize_t device_name_store(struct device *dev,
                 trigger_data->net_dev = NULL;
         }
 
-        strncpy(trigger_data->device_name, buf, size);
+        memcpy(trigger_data->device_name, buf, size);
+        trigger_data->device_name[size] = 0;
         if (size > 0 && trigger_data->device_name[size - 1] == '\n')
                 trigger_data->device_name[size - 1] = 0;
 
@@ -301,11 +302,11 @@ static int netdev_trig_notify(struct notifier_block *nb,
                 container_of(nb, struct led_netdev_data, notifier);
 
         if (evt != NETDEV_UP && evt != NETDEV_DOWN && evt != NETDEV_CHANGE
-            && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER
-            && evt != NETDEV_CHANGENAME)
+            && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER)
                 return NOTIFY_DONE;
 
-        if (strcmp(dev->name, trigger_data->device_name))
+        if (!(dev == trigger_data->net_dev ||
+              (evt == NETDEV_REGISTER && !strcmp(dev->name, trigger_data->device_name))))
                 return NOTIFY_DONE;
 
         cancel_delayed_work_sync(&trigger_data->work);
@@ -320,12 +321,9 @@ static int netdev_trig_notify(struct notifier_block *nb,
                 dev_hold(dev);
                 trigger_data->net_dev = dev;
                 break;
-        case NETDEV_CHANGENAME:
         case NETDEV_UNREGISTER:
-                if (trigger_data->net_dev) {
-                        dev_put(trigger_data->net_dev);
-                        trigger_data->net_dev = NULL;
-                }
+                dev_put(trigger_data->net_dev);
+                trigger_data->net_dev = NULL;
                 break;
         case NETDEV_UP:
         case NETDEV_CHANGE:
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 0ce2d8dfc5f1..26ad6468d13a 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -1246,7 +1246,7 @@ config MFD_STA2X11
 
 config MFD_SUN6I_PRCM
         bool "Allwinner A31 PRCM controller"
-        depends on ARCH_SUNXI
+        depends on ARCH_SUNXI || COMPILE_TEST
         select MFD_CORE
         help
           Support for the PRCM (Power/Reset/Clock Management) unit available
diff --git a/drivers/mfd/sprd-sc27xx-spi.c b/drivers/mfd/sprd-sc27xx-spi.c
index 69df27769c21..43ac71691fe4 100644
--- a/drivers/mfd/sprd-sc27xx-spi.c
+++ b/drivers/mfd/sprd-sc27xx-spi.c
@@ -53,67 +53,67 @@ static const struct sprd_pmic_data sc2731_data = {
 static const struct mfd_cell sprd_pmic_devs[] = {
         {
                 .name = "sc27xx-wdt",
-                .of_compatible = "sprd,sc27xx-wdt",
+                .of_compatible = "sprd,sc2731-wdt",
         }, {
                 .name = "sc27xx-rtc",
-                .of_compatible = "sprd,sc27xx-rtc",
+                .of_compatible = "sprd,sc2731-rtc",
         }, {
                 .name = "sc27xx-charger",
-                .of_compatible = "sprd,sc27xx-charger",
+                .of_compatible = "sprd,sc2731-charger",
         }, {
                 .name = "sc27xx-chg-timer",
-                .of_compatible = "sprd,sc27xx-chg-timer",
+                .of_compatible = "sprd,sc2731-chg-timer",
         }, {
                 .name = "sc27xx-fast-chg",
-                .of_compatible = "sprd,sc27xx-fast-chg",
+                .of_compatible = "sprd,sc2731-fast-chg",
         }, {
                 .name = "sc27xx-chg-wdt",
-                .of_compatible = "sprd,sc27xx-chg-wdt",
+                .of_compatible = "sprd,sc2731-chg-wdt",
         }, {
                 .name = "sc27xx-typec",
-                .of_compatible = "sprd,sc27xx-typec",
+                .of_compatible = "sprd,sc2731-typec",
         }, {
                 .name = "sc27xx-flash",
-                .of_compatible = "sprd,sc27xx-flash",
+                .of_compatible = "sprd,sc2731-flash",
         }, {
                 .name = "sc27xx-eic",
-                .of_compatible = "sprd,sc27xx-eic",
+                .of_compatible = "sprd,sc2731-eic",
         }, {
                 .name = "sc27xx-efuse",
-                .of_compatible = "sprd,sc27xx-efuse",
+                .of_compatible = "sprd,sc2731-efuse",
         }, {
                 .name = "sc27xx-thermal",
-                .of_compatible = "sprd,sc27xx-thermal",
+                .of_compatible = "sprd,sc2731-thermal",
         }, {
                 .name = "sc27xx-adc",
-                .of_compatible = "sprd,sc27xx-adc",
+                .of_compatible = "sprd,sc2731-adc",
         }, {
                 .name = "sc27xx-audio-codec",
-                .of_compatible = "sprd,sc27xx-audio-codec",
+                .of_compatible = "sprd,sc2731-audio-codec",
         }, {
                 .name = "sc27xx-regulator",
-                .of_compatible = "sprd,sc27xx-regulator",
+                .of_compatible = "sprd,sc2731-regulator",
         }, {
                 .name = "sc27xx-vibrator",
-                .of_compatible = "sprd,sc27xx-vibrator",
+                .of_compatible = "sprd,sc2731-vibrator",
         }, {
                 .name = "sc27xx-keypad-led",
-                .of_compatible = "sprd,sc27xx-keypad-led",
+                .of_compatible = "sprd,sc2731-keypad-led",
         }, {
                 .name = "sc27xx-bltc",
-                .of_compatible = "sprd,sc27xx-bltc",
+                .of_compatible = "sprd,sc2731-bltc",
         }, {
                 .name = "sc27xx-fgu",
-                .of_compatible = "sprd,sc27xx-fgu",
+                .of_compatible = "sprd,sc2731-fgu",
         }, {
                 .name = "sc27xx-7sreset",
-                .of_compatible = "sprd,sc27xx-7sreset",
+                .of_compatible = "sprd,sc2731-7sreset",
         }, {
                 .name = "sc27xx-poweroff",
-                .of_compatible = "sprd,sc27xx-poweroff",
+                .of_compatible = "sprd,sc2731-poweroff",
         }, {
                 .name = "sc27xx-syscon",
-                .of_compatible = "sprd,sc27xx-syscon",
+                .of_compatible = "sprd,sc2731-syscon",
         },
 };
 
diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
index 299016bc46d9..104477b512a2 100644
--- a/drivers/mfd/twl-core.c
+++ b/drivers/mfd/twl-core.c
@@ -1245,6 +1245,28 @@ free:
         return status;
 }
 
+static int __maybe_unused twl_suspend(struct device *dev)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+
+        if (client->irq)
+                disable_irq(client->irq);
+
+        return 0;
+}
+
+static int __maybe_unused twl_resume(struct device *dev)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+
+        if (client->irq)
+                enable_irq(client->irq);
+
+        return 0;
+}
+
+static SIMPLE_DEV_PM_OPS(twl_dev_pm_ops, twl_suspend, twl_resume);
+
 static const struct i2c_device_id twl_ids[] = {
         { "twl4030", TWL4030_VAUX2 },   /* "Triton 2" */
         { "twl5030", 0 },               /* T2 updated */
@@ -1262,6 +1284,7 @@ static const struct i2c_device_id twl_ids[] = {
 /* One Client Driver , 4 Clients */
 static struct i2c_driver twl_driver = {
         .driver.name    = DRIVER_NAME,
+        .driver.pm      = &twl_dev_pm_ops,
         .id_table       = twl_ids,
         .probe          = twl_probe,
         .remove         = twl_remove,
diff --git a/drivers/misc/habanalabs/command_submission.c b/drivers/misc/habanalabs/command_submission.c
index 3525236ed8d9..19c84214a7ea 100644
--- a/drivers/misc/habanalabs/command_submission.c
+++ b/drivers/misc/habanalabs/command_submission.c
@@ -179,6 +179,12 @@ static void cs_do_release(struct kref *ref)
 
         /* We also need to update CI for internal queues */
         if (cs->submitted) {
+                int cs_cnt = atomic_dec_return(&hdev->cs_active_cnt);
+
+                WARN_ONCE((cs_cnt < 0),
+                        "hl%d: error in CS active cnt %d\n",
+                        hdev->id, cs_cnt);
+
                 hl_int_hw_queue_update_ci(cs);
 
                 spin_lock(&hdev->hw_queues_mirror_lock);
diff --git a/drivers/misc/habanalabs/debugfs.c b/drivers/misc/habanalabs/debugfs.c
index a53c12aff6ad..974a87789bd8 100644
--- a/drivers/misc/habanalabs/debugfs.c
+++ b/drivers/misc/habanalabs/debugfs.c
@@ -232,6 +232,7 @@ static int vm_show(struct seq_file *s, void *data)
         struct hl_vm_phys_pg_pack *phys_pg_pack = NULL;
         enum vm_type_t *vm_type;
         bool once = true;
+        u64 j;
         int i;
 
         if (!dev_entry->hdev->mmu_enable)
@@ -260,7 +261,7 @@ static int vm_show(struct seq_file *s, void *data)
                         } else {
                                 phys_pg_pack = hnode->ptr;
                                 seq_printf(s,
-                                        "    0x%-14llx      %-10u       %-4u\n",
+                                        "    0x%-14llx      %-10llu       %-4u\n",
                                         hnode->vaddr, phys_pg_pack->total_size,
                                         phys_pg_pack->handle);
                         }
@@ -282,9 +283,9 @@ static int vm_show(struct seq_file *s, void *data)
                                                 phys_pg_pack->page_size);
                         seq_puts(s, "   physical address\n");
                         seq_puts(s, "---------------------\n");
-                        for (i = 0 ; i < phys_pg_pack->npages ; i++) {
+                        for (j = 0 ; j < phys_pg_pack->npages ; j++) {
                                 seq_printf(s, "    0x%-14llx\n",
-                                                phys_pg_pack->pages[i]);
+                                                phys_pg_pack->pages[j]);
                         }
                 }
                 spin_unlock(&vm->idr_lock);
diff --git a/drivers/misc/habanalabs/device.c b/drivers/misc/habanalabs/device.c
index de46aa6ed154..77d51be66c7e 100644
--- a/drivers/misc/habanalabs/device.c
+++ b/drivers/misc/habanalabs/device.c
@@ -11,6 +11,8 @@
 #include <linux/sched/signal.h>
 #include <linux/hwmon.h>
 
+#define HL_PLDM_PENDING_RESET_PER_SEC   (HL_PENDING_RESET_PER_SEC * 10)
+
 bool hl_device_disabled_or_in_reset(struct hl_device *hdev)
 {
         if ((hdev->disabled) || (atomic_read(&hdev->in_reset)))
@@ -216,6 +218,7 @@ static int device_early_init(struct hl_device *hdev)
         spin_lock_init(&hdev->hw_queues_mirror_lock);
         atomic_set(&hdev->in_reset, 0);
         atomic_set(&hdev->fd_open_cnt, 0);
+        atomic_set(&hdev->cs_active_cnt, 0);
 
         return 0;
 
@@ -413,6 +416,27 @@ int hl_device_suspend(struct hl_device *hdev)
 
         pci_save_state(hdev->pdev);
 
+        /* Block future CS/VM/JOB completion operations */
+        rc = atomic_cmpxchg(&hdev->in_reset, 0, 1);
+        if (rc) {
+                dev_err(hdev->dev, "Can't suspend while in reset\n");
+                return -EIO;
+        }
+
+        /* This blocks all other stuff that is not blocked by in_reset */
+        hdev->disabled = true;
+
+        /*
+         * Flush anyone that is inside the critical section of enqueue
+         * jobs to the H/W
+         */
+        hdev->asic_funcs->hw_queues_lock(hdev);
+        hdev->asic_funcs->hw_queues_unlock(hdev);
+
+        /* Flush processes that are sending message to CPU */
+        mutex_lock(&hdev->send_cpu_message_lock);
+        mutex_unlock(&hdev->send_cpu_message_lock);
+
         rc = hdev->asic_funcs->suspend(hdev);
         if (rc)
                 dev_err(hdev->dev,
@@ -440,21 +464,38 @@ int hl_device_resume(struct hl_device *hdev)
 
         pci_set_power_state(hdev->pdev, PCI_D0);
         pci_restore_state(hdev->pdev);
-        rc = pci_enable_device(hdev->pdev);
+        rc = pci_enable_device_mem(hdev->pdev);
         if (rc) {
                 dev_err(hdev->dev,
                         "Failed to enable PCI device in resume\n");
                 return rc;
         }
 
+        pci_set_master(hdev->pdev);
+
         rc = hdev->asic_funcs->resume(hdev);
         if (rc) {
-                dev_err(hdev->dev,
-                        "Failed to enable PCI access from device CPU\n");
-                return rc;
+                dev_err(hdev->dev, "Failed to resume device after suspend\n");
+                goto disable_device;
+        }
+
+
+        hdev->disabled = false;
+        atomic_set(&hdev->in_reset, 0);
+
+        rc = hl_device_reset(hdev, true, false);
+        if (rc) {
+                dev_err(hdev->dev, "Failed to reset device during resume\n");
+                goto disable_device;
         }
 
         return 0;
+
+disable_device:
+        pci_clear_master(hdev->pdev);
+        pci_disable_device(hdev->pdev);
+
+        return rc;
 }
 
 static void hl_device_hard_reset_pending(struct work_struct *work)
@@ -462,9 +503,16 @@ static void hl_device_hard_reset_pending(struct work_struct *work)
         struct hl_device_reset_work *device_reset_work =
                 container_of(work, struct hl_device_reset_work, reset_work);
         struct hl_device *hdev = device_reset_work->hdev;
-        u16 pending_cnt = HL_PENDING_RESET_PER_SEC;
+        u16 pending_total, pending_cnt;
         struct task_struct *task = NULL;
 
+        if (hdev->pldm)
+                pending_total = HL_PLDM_PENDING_RESET_PER_SEC;
+        else
+                pending_total = HL_PENDING_RESET_PER_SEC;
+
+        pending_cnt = pending_total;
+
         /* Flush all processes that are inside hl_open */
         mutex_lock(&hdev->fd_open_cnt_lock);
 
@@ -489,6 +537,19 @@ static void hl_device_hard_reset_pending(struct work_struct *work)
                 }
         }
 
+        pending_cnt = pending_total;
+
+        while ((atomic_read(&hdev->fd_open_cnt)) && (pending_cnt)) {
+
+                pending_cnt--;
+
+                ssleep(1);
+        }
+
+        if (atomic_read(&hdev->fd_open_cnt))
+                dev_crit(hdev->dev,
+                        "Going to hard reset with open user contexts\n");
+
         mutex_unlock(&hdev->fd_open_cnt_lock);
 
         hl_device_reset(hdev, true, true);
diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c
index 238dd57c541b..ea979ebd62fb 100644
--- a/drivers/misc/habanalabs/goya/goya.c
+++ b/drivers/misc/habanalabs/goya/goya.c
@@ -1201,15 +1201,6 @@ static int goya_stop_external_queues(struct hl_device *hdev)
         return retval;
 }
 
-static void goya_resume_external_queues(struct hl_device *hdev)
-{
-        WREG32(mmDMA_QM_0_GLBL_CFG1, 0);
-        WREG32(mmDMA_QM_1_GLBL_CFG1, 0);
-        WREG32(mmDMA_QM_2_GLBL_CFG1, 0);
-        WREG32(mmDMA_QM_3_GLBL_CFG1, 0);
-        WREG32(mmDMA_QM_4_GLBL_CFG1, 0);
-}
-
 /*
  * goya_init_cpu_queues - Initialize PQ/CQ/EQ of CPU
  *
@@ -2178,36 +2169,6 @@ static int goya_stop_internal_queues(struct hl_device *hdev)
         return retval;
 }
 
-static void goya_resume_internal_queues(struct hl_device *hdev)
-{
-        WREG32(mmMME_QM_GLBL_CFG1, 0);
-        WREG32(mmMME_CMDQ_GLBL_CFG1, 0);
-
-        WREG32(mmTPC0_QM_GLBL_CFG1, 0);
-        WREG32(mmTPC0_CMDQ_GLBL_CFG1, 0);
-
-        WREG32(mmTPC1_QM_GLBL_CFG1, 0);
-        WREG32(mmTPC1_CMDQ_GLBL_CFG1, 0);
-
-        WREG32(mmTPC2_QM_GLBL_CFG1, 0);
-        WREG32(mmTPC2_CMDQ_GLBL_CFG1, 0);
-
-        WREG32(mmTPC3_QM_GLBL_CFG1, 0);
-        WREG32(mmTPC3_CMDQ_GLBL_CFG1, 0);
-
-        WREG32(mmTPC4_QM_GLBL_CFG1, 0);
-        WREG32(mmTPC4_CMDQ_GLBL_CFG1, 0);
-
-        WREG32(mmTPC5_QM_GLBL_CFG1, 0);
-        WREG32(mmTPC5_CMDQ_GLBL_CFG1, 0);
-
-        WREG32(mmTPC6_QM_GLBL_CFG1, 0);
-        WREG32(mmTPC6_CMDQ_GLBL_CFG1, 0);
-
-        WREG32(mmTPC7_QM_GLBL_CFG1, 0);
-        WREG32(mmTPC7_CMDQ_GLBL_CFG1, 0);
-}
-
 static void goya_dma_stall(struct hl_device *hdev)
 {
         WREG32(mmDMA_QM_0_GLBL_CFG1, 1 << DMA_QM_0_GLBL_CFG1_DMA_STOP_SHIFT);
@@ -2905,20 +2866,6 @@ int goya_suspend(struct hl_device *hdev)
 {
         int rc;
 
-        rc = goya_stop_internal_queues(hdev);
-
-        if (rc) {
-                dev_err(hdev->dev, "failed to stop internal queues\n");
-                return rc;
-        }
-
-        rc = goya_stop_external_queues(hdev);
-
-        if (rc) {
-                dev_err(hdev->dev, "failed to stop external queues\n");
-                return rc;
-        }
-
         rc = goya_send_pci_access_msg(hdev, ARMCP_PACKET_DISABLE_PCI_ACCESS);
         if (rc)
                 dev_err(hdev->dev, "Failed to disable PCI access from CPU\n");
@@ -2928,15 +2875,7 @@ int goya_suspend(struct hl_device *hdev)
 
 int goya_resume(struct hl_device *hdev)
 {
-        int rc;
-
-        goya_resume_external_queues(hdev);
-        goya_resume_internal_queues(hdev);
-
-        rc = goya_send_pci_access_msg(hdev, ARMCP_PACKET_ENABLE_PCI_ACCESS);
-        if (rc)
-                dev_err(hdev->dev, "Failed to enable PCI access from CPU\n");
-        return rc;
+        return goya_init_iatu(hdev);
 }
 
 static int goya_cb_mmap(struct hl_device *hdev, struct vm_area_struct *vma,
@@ -3070,7 +3009,7 @@ void *goya_get_int_queue_base(struct hl_device *hdev, u32 queue_id,
 
         *dma_handle = hdev->asic_prop.sram_base_address;
 
-        base = hdev->pcie_bar[SRAM_CFG_BAR_ID];
+        base = (void *) hdev->pcie_bar[SRAM_CFG_BAR_ID];
 
         switch (queue_id) {
         case GOYA_QUEUE_ID_MME:
diff --git a/drivers/misc/habanalabs/habanalabs.h b/drivers/misc/habanalabs/habanalabs.h
index a7c95e9f9b9a..a8ee52c880cd 100644
--- a/drivers/misc/habanalabs/habanalabs.h
+++ b/drivers/misc/habanalabs/habanalabs.h
@@ -793,11 +793,11 @@ struct hl_vm_hash_node {
  * struct hl_vm_phys_pg_pack - physical page pack.
  * @vm_type: describes the type of the virtual area descriptor.
  * @pages: the physical page array.
+ * @npages: num physical pages in the pack.
+ * @total_size: total size of all the pages in this list.
  * @mapping_cnt: number of shared mappings.
  * @asid: the context related to this list.
- * @npages: num physical pages in the pack.
  * @page_size: size of each page in the pack.
- * @total_size: total size of all the pages in this list.
  * @flags: HL_MEM_* flags related to this list.
  * @handle: the provided handle related to this list.
  * @offset: offset from the first page.
@@ -807,11 +807,11 @@ struct hl_vm_hash_node {
 struct hl_vm_phys_pg_pack {
         enum vm_type_t          vm_type; /* must be first */
         u64                     *pages;
+        u64                     npages;
+        u64                     total_size;
         atomic_t                mapping_cnt;
         u32                     asid;
-        u32                     npages;
         u32                     page_size;
-        u32                     total_size;
         u32                     flags;
         u32                     handle;
         u32                     offset;
@@ -1056,13 +1056,15 @@ struct hl_device_reset_work {
  * @cb_pool_lock: protects the CB pool.
  * @user_ctx: current user context executing.
  * @dram_used_mem: current DRAM memory consumption.
- * @in_reset: is device in reset flow.
- * @curr_pll_profile: current PLL profile.
- * @fd_open_cnt: number of open user processes.
  * @timeout_jiffies: device CS timeout value.
  * @max_power: the max power of the device, as configured by the sysadmin. This
  *             value is saved so in case of hard-reset, KMD will restore this
  *             value and update the F/W after the re-initialization
+ * @in_reset: is device in reset flow.
+ * @curr_pll_profile: current PLL profile.
+ * @fd_open_cnt: number of open user processes.
+ * @cs_active_cnt: number of active command submissions on this device (active
+ *                 means already in H/W queues)
  * @major: habanalabs KMD major.
  * @high_pll: high PLL profile frequency.
  * @soft_reset_cnt: number of soft reset since KMD loading.
@@ -1128,11 +1130,12 @@ struct hl_device {
         struct hl_ctx                   *user_ctx;
 
         atomic64_t                      dram_used_mem;
+        u64                             timeout_jiffies;
+        u64                             max_power;
         atomic_t                        in_reset;
         atomic_t                        curr_pll_profile;
         atomic_t                        fd_open_cnt;
-        u64                             timeout_jiffies;
-        u64                             max_power;
+        atomic_t                        cs_active_cnt;
         u32                             major;
         u32                             high_pll;
         u32                             soft_reset_cnt;
diff --git a/drivers/misc/habanalabs/hw_queue.c b/drivers/misc/habanalabs/hw_queue.c
index 67bece26417c..ef3bb6951360 100644
--- a/drivers/misc/habanalabs/hw_queue.c
+++ b/drivers/misc/habanalabs/hw_queue.c
@@ -370,12 +370,13 @@ int hl_hw_queue_schedule_cs(struct hl_cs *cs)
                 spin_unlock(&hdev->hw_queues_mirror_lock);
         }
 
-        list_for_each_entry_safe(job, tmp, &cs->job_list, cs_node) {
+        atomic_inc(&hdev->cs_active_cnt);
+
+        list_for_each_entry_safe(job, tmp, &cs->job_list, cs_node)
                 if (job->ext_queue)
                         ext_hw_queue_schedule_job(job);
                 else
                         int_hw_queue_schedule_job(job);
-        }
 
         cs->submitted = true;
 
diff --git a/drivers/misc/habanalabs/memory.c b/drivers/misc/habanalabs/memory.c
index 3a12fd1a5274..ce1fda40a8b8 100644
--- a/drivers/misc/habanalabs/memory.c
+++ b/drivers/misc/habanalabs/memory.c
@@ -56,9 +56,9 @@ static int alloc_device_memory(struct hl_ctx *ctx, struct hl_mem_in *args,
         struct hl_device *hdev = ctx->hdev;
         struct hl_vm *vm = &hdev->vm;
         struct hl_vm_phys_pg_pack *phys_pg_pack;
-        u64 paddr = 0;
-        u32 total_size, num_pgs, num_curr_pgs, page_size, page_shift;
-        int handle, rc, i;
+        u64 paddr = 0, total_size, num_pgs, i;
+        u32 num_curr_pgs, page_size, page_shift;
+        int handle, rc;
         bool contiguous;
 
         num_curr_pgs = 0;
@@ -73,7 +73,7 @@ static int alloc_device_memory(struct hl_ctx *ctx, struct hl_mem_in *args,
                 paddr = (u64) gen_pool_alloc(vm->dram_pg_pool, total_size);
                 if (!paddr) {
                         dev_err(hdev->dev,
-                                "failed to allocate %u huge contiguous pages\n",
+                                "failed to allocate %llu huge contiguous pages\n",
                                 num_pgs);
                         return -ENOMEM;
                 }
@@ -93,7 +93,7 @@ static int alloc_device_memory(struct hl_ctx *ctx, struct hl_mem_in *args,
         phys_pg_pack->flags = args->flags;
         phys_pg_pack->contiguous = contiguous;
 
-        phys_pg_pack->pages = kcalloc(num_pgs, sizeof(u64), GFP_KERNEL);
+        phys_pg_pack->pages = kvmalloc_array(num_pgs, sizeof(u64), GFP_KERNEL);
         if (!phys_pg_pack->pages) {
                 rc = -ENOMEM;
                 goto pages_arr_err;
@@ -148,7 +148,7 @@ page_err:
                         gen_pool_free(vm->dram_pg_pool, phys_pg_pack->pages[i],
                                         page_size);
 
-        kfree(phys_pg_pack->pages);
+        kvfree(phys_pg_pack->pages);
 pages_arr_err:
         kfree(phys_pg_pack);
 pages_pack_err:
@@ -267,7 +267,7 @@ static void free_phys_pg_pack(struct hl_device *hdev,
                 struct hl_vm_phys_pg_pack *phys_pg_pack)
 {
         struct hl_vm *vm = &hdev->vm;
-        int i;
+        u64 i;
 
         if (!phys_pg_pack->created_from_userptr) {
                 if (phys_pg_pack->contiguous) {
@@ -288,7 +288,7 @@ static void free_phys_pg_pack(struct hl_device *hdev,
                 }
         }
 
-        kfree(phys_pg_pack->pages);
+        kvfree(phys_pg_pack->pages);
         kfree(phys_pg_pack);
 }
 
@@ -519,7 +519,7 @@ static inline int add_va_block(struct hl_device *hdev,
  * - Return the start address of the virtual block
  */
 static u64 get_va_block(struct hl_device *hdev,
-                struct hl_va_range *va_range, u32 size, u64 hint_addr,
+                struct hl_va_range *va_range, u64 size, u64 hint_addr,
                 bool is_userptr)
 {
         struct hl_vm_va_block *va_block, *new_va_block = NULL;
@@ -577,7 +577,8 @@ static u64 get_va_block(struct hl_device *hdev,
         }
 
         if (!new_va_block) {
-                dev_err(hdev->dev, "no available va block for size %u\n", size);
+                dev_err(hdev->dev, "no available va block for size %llu\n",
+                                size);
                 goto out;
         }
 
@@ -648,8 +649,8 @@ static int init_phys_pg_pack_from_userptr(struct hl_ctx *ctx,
         struct hl_vm_phys_pg_pack *phys_pg_pack;
         struct scatterlist *sg;
         dma_addr_t dma_addr;
-        u64 page_mask;
-        u32 npages, total_npages, page_size = PAGE_SIZE;
+        u64 page_mask, total_npages;
+        u32 npages, page_size = PAGE_SIZE;
         bool first = true, is_huge_page_opt = true;
         int rc, i, j;
 
@@ -691,7 +692,8 @@ static int init_phys_pg_pack_from_userptr(struct hl_ctx *ctx,
 
         page_mask = ~(((u64) page_size) - 1);
 
-        phys_pg_pack->pages = kcalloc(total_npages, sizeof(u64), GFP_KERNEL);
+        phys_pg_pack->pages = kvmalloc_array(total_npages, sizeof(u64),
+                                                GFP_KERNEL);
         if (!phys_pg_pack->pages) {
                 rc = -ENOMEM;
                 goto page_pack_arr_mem_err;
@@ -750,9 +752,9 @@ static int map_phys_page_pack(struct hl_ctx *ctx, u64 vaddr,
                 struct hl_vm_phys_pg_pack *phys_pg_pack)
 {
         struct hl_device *hdev = ctx->hdev;
-        u64 next_vaddr = vaddr, paddr;
+        u64 next_vaddr = vaddr, paddr, mapped_pg_cnt = 0, i;
         u32 page_size = phys_pg_pack->page_size;
-        int i, rc = 0, mapped_pg_cnt = 0;
+        int rc = 0;
 
         for (i = 0 ; i < phys_pg_pack->npages ; i++) {
                 paddr = phys_pg_pack->pages[i];
@@ -764,7 +766,7 @@ static int map_phys_page_pack(struct hl_ctx *ctx, u64 vaddr,
                 rc = hl_mmu_map(ctx, next_vaddr, paddr, page_size);
                 if (rc) {
                         dev_err(hdev->dev,
-                                "map failed for handle %u, npages: %d, mapped: %d",
+                                "map failed for handle %u, npages: %llu, mapped: %llu",
                                 phys_pg_pack->handle, phys_pg_pack->npages,
                                 mapped_pg_cnt);
                         goto err;
@@ -985,10 +987,10 @@ static int unmap_device_va(struct hl_ctx *ctx, u64 vaddr)
         struct hl_vm_hash_node *hnode = NULL;
         struct hl_userptr *userptr = NULL;
         enum vm_type_t *vm_type;
-        u64 next_vaddr;
+        u64 next_vaddr, i;
         u32 page_size;
         bool is_userptr;
-        int i, rc;
+        int rc;
 
         /* protect from double entrance */
         mutex_lock(&ctx->mem_hash_lock);
diff --git a/drivers/misc/habanalabs/mmu.c b/drivers/misc/habanalabs/mmu.c
index 2f2e99cb2743..3a5a2cec8305 100644
--- a/drivers/misc/habanalabs/mmu.c
+++ b/drivers/misc/habanalabs/mmu.c
@@ -832,7 +832,7 @@ err:
 int hl_mmu_map(struct hl_ctx *ctx, u64 virt_addr, u64 phys_addr, u32 page_size)
 {
         struct hl_device *hdev = ctx->hdev;
-        u64 real_virt_addr;
+        u64 real_virt_addr, real_phys_addr;
         u32 real_page_size, npages;
         int i, rc, mapped_cnt = 0;
 
@@ -857,14 +857,16 @@ int hl_mmu_map(struct hl_ctx *ctx, u64 virt_addr, u64 phys_addr, u32 page_size)
 
         npages = page_size / real_page_size;
         real_virt_addr = virt_addr;
+        real_phys_addr = phys_addr;
 
         for (i = 0 ; i < npages ; i++) {
-                rc = _hl_mmu_map(ctx, real_virt_addr, phys_addr,
+                rc = _hl_mmu_map(ctx, real_virt_addr, real_phys_addr,
                                 real_page_size);
                 if (rc)
                         goto err;
 
                 real_virt_addr += real_page_size;
+                real_phys_addr += real_page_size;
                 mapped_cnt++;
         }
 
diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c
index 2f120b2ffef0..4985268e2273 100644
--- a/drivers/net/bonding/bond_sysfs_slave.c
+++ b/drivers/net/bonding/bond_sysfs_slave.c
@@ -55,7 +55,9 @@ static SLAVE_ATTR_RO(link_failure_count);
 
 static ssize_t perm_hwaddr_show(struct slave *slave, char *buf)
 {
-        return sprintf(buf, "%pM\n", slave->perm_hwaddr);
+        return sprintf(buf, "%*phC\n",
+                       slave->dev->addr_len,
+                       slave->perm_hwaddr);
 }
 static SLAVE_ATTR_RO(perm_hwaddr);
 
diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c
index dce84a2a65c7..c44b2822e4dd 100644
--- a/drivers/net/dsa/mv88e6xxx/port.c
+++ b/drivers/net/dsa/mv88e6xxx/port.c
@@ -427,18 +427,22 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
                 return 0;
 
         lane = mv88e6390x_serdes_get_lane(chip, port);
-        if (lane < 0)
+        if (lane < 0 && lane != -ENODEV)
                 return lane;
 
-        if (chip->ports[port].serdes_irq) {
-                err = mv88e6390_serdes_irq_disable(chip, port, lane);
+        if (lane >= 0) {
+                if (chip->ports[port].serdes_irq) {
+                        err = mv88e6390_serdes_irq_disable(chip, port, lane);
+                        if (err)
+                                return err;
+                }
+
+                err = mv88e6390x_serdes_power(chip, port, false);
                 if (err)
                         return err;
         }
 
-        err = mv88e6390x_serdes_power(chip, port, false);
-        if (err)
-                return err;
+        chip->ports[port].cmode = 0;
 
         if (cmode) {
                 err = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_STS, &reg);
@@ -452,6 +456,12 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
                 if (err)
                         return err;
 
+                chip->ports[port].cmode = cmode;
+
+                lane = mv88e6390x_serdes_get_lane(chip, port);
+                if (lane < 0)
+                        return lane;
+
                 err = mv88e6390x_serdes_power(chip, port, true);
                 if (err)
                         return err;
@@ -463,8 +473,6 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
                 }
         }
 
-        chip->ports[port].cmode = cmode;
-
         return 0;
 }
 
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index aa2be4807191..28eac9056211 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -1328,10 +1328,11 @@ int nicvf_stop(struct net_device *netdev)
         struct nicvf_cq_poll *cq_poll = NULL;
         union nic_mbx mbx = {};
 
-        cancel_delayed_work_sync(&nic->link_change_work);
-
         /* wait till all queued set_rx_mode tasks completes */
-        drain_workqueue(nic->nicvf_rx_mode_wq);
+        if (nic->nicvf_rx_mode_wq) {
+                cancel_delayed_work_sync(&nic->link_change_work);
+                drain_workqueue(nic->nicvf_rx_mode_wq);
+        }
 
         mbx.msg.msg = NIC_MBOX_MSG_SHUTDOWN;
         nicvf_send_msg_to_pf(nic, &mbx);
@@ -1452,7 +1453,8 @@ int nicvf_open(struct net_device *netdev)
         struct nicvf_cq_poll *cq_poll = NULL;
 
         /* wait till all queued set_rx_mode tasks completes if any */
-        drain_workqueue(nic->nicvf_rx_mode_wq);
+        if (nic->nicvf_rx_mode_wq)
+                drain_workqueue(nic->nicvf_rx_mode_wq);
 
         netif_carrier_off(netdev);
 
@@ -1550,10 +1552,12 @@ int nicvf_open(struct net_device *netdev)
         /* Send VF config done msg to PF */
         nicvf_send_cfg_done(nic);
 
-        INIT_DELAYED_WORK(&nic->link_change_work,
-                          nicvf_link_status_check_task);
-        queue_delayed_work(nic->nicvf_rx_mode_wq,
-                           &nic->link_change_work, 0);
+        if (nic->nicvf_rx_mode_wq) {
+                INIT_DELAYED_WORK(&nic->link_change_work,
+                                  nicvf_link_status_check_task);
+                queue_delayed_work(nic->nicvf_rx_mode_wq,
+                                   &nic->link_change_work, 0);
+        }
 
         return 0;
 cleanup:
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 5b4d3badcb73..e246f9733bb8 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -105,20 +105,19 @@ static inline struct pgcache *nicvf_alloc_page(struct nicvf *nic,
         /* Check if page can be recycled */
         if (page) {
                 ref_count = page_ref_count(page);
-                /* Check if this page has been used once i.e 'put_page'
-                 * called after packet transmission i.e internal ref_count
-                 * and page's ref_count are equal i.e page can be recycled.
+                /* This page can be recycled if internal ref_count and page's
+                 * ref_count are equal, indicating that the page has been used
+                 * once for packet transmission. For non-XDP mode, internal
+                 * ref_count is always '1'.
                  */
-                if (rbdr->is_xdp && (ref_count == pgcache->ref_count))
-                        pgcache->ref_count--;
-                else
-                        page = NULL;
-
-                /* In non-XDP mode, page's ref_count needs to be '1' for it
-                 * to be recycled.
-                 */
-                if (!rbdr->is_xdp && (ref_count != 1))
+                if (rbdr->is_xdp) {
+                        if (ref_count == pgcache->ref_count)
+                                pgcache->ref_count--;
+                        else
+                                page = NULL;
+                } else if (ref_count != 1) {
                         page = NULL;
+                }
         }
 
         if (!page) {
@@ -365,11 +364,10 @@ static void nicvf_free_rbdr(struct nicvf *nic, struct rbdr *rbdr)
         while (head < rbdr->pgcnt) {
                 pgcache = &rbdr->pgcache[head];
                 if (pgcache->page && page_ref_count(pgcache->page) != 0) {
-                        if (!rbdr->is_xdp) {
-                                put_page(pgcache->page);
-                                continue;
+                        if (rbdr->is_xdp) {
+                                page_ref_sub(pgcache->page,
+                                             pgcache->ref_count - 1);
                         }
-                        page_ref_sub(pgcache->page, pgcache->ref_count - 1);
                         put_page(pgcache->page);
                 }
                 head++;
diff --git a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c
index 74849be5f004..e2919005ead3 100644
--- a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c
+++ b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c
@@ -354,7 +354,10 @@ static struct cxgbi_ppm_pool *ppm_alloc_cpu_pool(unsigned int *total,
                 ppmax = max;
 
         /* pool size must be multiple of unsigned long */
-        bmap = BITS_TO_LONGS(ppmax);
+        bmap = ppmax / BITS_PER_TYPE(unsigned long);
+        if (!bmap)
+                return NULL;
+
         ppmax = (bmap * sizeof(unsigned long)) << 3;
 
         alloc_sz = sizeof(*pools) + sizeof(unsigned long) * bmap;
@@ -402,6 +405,10 @@ int cxgbi_ppm_init(void **ppm_pp, struct net_device *ndev,
         if (reserve_factor) {
                 ppmax_pool = ppmax / reserve_factor;
                 pool = ppm_alloc_cpu_pool(&ppmax_pool, &pool_index_max);
+                if (!pool) {
+                        ppmax_pool = 0;
+                        reserve_factor = 0;
+                }
 
                 pr_debug("%s: ppmax %u, cpu total %u, per cpu %u.\n",
                          ndev->name, ppmax, ppmax_pool, pool_index_max);
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c
index 79d03f8ee7b1..c7fa97a7e1f4 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.c
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.c
@@ -150,7 +150,6 @@ out_buffer_fail:
 /* free desc along with its attached buffer */
 static void hnae_free_desc(struct hnae_ring *ring)
 {
-        hnae_free_buffers(ring);
         dma_unmap_single(ring_to_dev(ring), ring->desc_dma_addr,
                          ring->desc_num * sizeof(ring->desc[0]),
                          ring_to_dma_dir(ring));
@@ -183,6 +182,9 @@ static int hnae_alloc_desc(struct hnae_ring *ring)
 /* fini ring, also free the buffer for the ring */
 static void hnae_fini_ring(struct hnae_ring *ring)
 {
+        if (is_rx_ring(ring))
+                hnae_free_buffers(ring);
+
         hnae_free_desc(ring);
         kfree(ring->desc_cb);
         ring->desc_cb = NULL;
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h
index 08a750fb60c4..d6fb83437230 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.h
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.h
@@ -357,7 +357,7 @@ struct hnae_buf_ops {
 };
 
 struct hnae_queue {
-        void __iomem *io_base;
+        u8 __iomem *io_base;
         phys_addr_t phy_base;
         struct hnae_ae_dev *dev;        /* the device who use this queue */
         struct hnae_ring rx_ring ____cacheline_internodealigned_in_smp;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
index a97228c93831..6c0507921623 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
@@ -370,7 +370,7 @@ int hns_mac_clr_multicast(struct hns_mac_cb *mac_cb, int vfn)
 static void hns_mac_param_get(struct mac_params *param,
                               struct hns_mac_cb *mac_cb)
 {
-        param->vaddr = (void *)mac_cb->vaddr;
+        param->vaddr = mac_cb->vaddr;
         param->mac_mode = hns_get_enet_interface(mac_cb);
         ether_addr_copy(param->addr, mac_cb->addr_entry_idx[0].addr);
         param->mac_id = mac_cb->mac_id;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
index fbc75341bef7..22589799f1a5 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
@@ -187,7 +187,7 @@ struct mac_statistics {
 /*mac para struct ,mac get param from nic or dsaf when initialize*/
 struct mac_params {
         char addr[ETH_ALEN];
-        void *vaddr; /*virtual address*/
+        u8 __iomem *vaddr; /*virtual address*/
         struct device *dev;
         u8 mac_id;
         /**< Ethernet operation mode (MAC-PHY interface and speed) */
@@ -402,7 +402,7 @@ struct mac_driver {
         enum mac_mode mac_mode;
         u8 mac_id;
         struct hns_mac_cb *mac_cb;
-        void __iomem *io_base;
+        u8 __iomem *io_base;
         unsigned int mac_en_flg;/*you'd better don't enable mac twice*/
         unsigned int virt_dev_num;
         struct device *dev;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index ac55db065f16..61eea6ac846f 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -1602,8 +1602,6 @@ static void hns_dsaf_set_mac_key(
                        DSAF_TBL_TCAM_KEY_VLAN_S, vlan_id);
         dsaf_set_field(mac_key->low.bits.port_vlan, DSAF_TBL_TCAM_KEY_PORT_M,
                        DSAF_TBL_TCAM_KEY_PORT_S, port);
-
-        mac_key->low.bits.port_vlan = le16_to_cpu(mac_key->low.bits.port_vlan);
 }
 
 /**
@@ -1663,8 +1661,8 @@ int hns_dsaf_set_mac_uc_entry(
         /* default config dvc to 0 */
         mac_data.tbl_ucast_dvc = 0;
         mac_data.tbl_ucast_out_port = mac_entry->port_num;
-        tcam_data.tbl_tcam_data_high = cpu_to_le32(mac_key.high.val);
-        tcam_data.tbl_tcam_data_low = cpu_to_le32(mac_key.low.val);
+        tcam_data.tbl_tcam_data_high = mac_key.high.val;
+        tcam_data.tbl_tcam_data_low = mac_key.low.val;
 
         hns_dsaf_tcam_uc_cfg(dsaf_dev, entry_index, &tcam_data, &mac_data);
 
@@ -1786,9 +1784,6 @@ int hns_dsaf_add_mac_mc_port(struct dsaf_device *dsaf_dev,
                                      0xff,
                                      mc_mask);
 
-                mask_key.high.val = le32_to_cpu(mask_key.high.val);
-                mask_key.low.val = le32_to_cpu(mask_key.low.val);
-
                 pmask_key = (struct dsaf_tbl_tcam_data *)(&mask_key);
         }
 
@@ -1840,8 +1835,8 @@ int hns_dsaf_add_mac_mc_port(struct dsaf_device *dsaf_dev,
                 dsaf_dev->ae_dev.name, mac_key.high.val,
                 mac_key.low.val, entry_index);
 
-        tcam_data.tbl_tcam_data_high = cpu_to_le32(mac_key.high.val);
-        tcam_data.tbl_tcam_data_low = cpu_to_le32(mac_key.low.val);
+        tcam_data.tbl_tcam_data_high = mac_key.high.val;
+        tcam_data.tbl_tcam_data_low = mac_key.low.val;
 
         /* config mc entry with mask */
         hns_dsaf_tcam_mc_cfg(dsaf_dev, entry_index, &tcam_data,
@@ -1956,9 +1951,6 @@ int hns_dsaf_del_mac_mc_port(struct dsaf_device *dsaf_dev,
                 /* config key mask */
                 hns_dsaf_set_mac_key(dsaf_dev, &mask_key, 0x00, 0xff, mc_mask);
 
-                mask_key.high.val = le32_to_cpu(mask_key.high.val);
-                mask_key.low.val = le32_to_cpu(mask_key.low.val);
-
                 pmask_key = (struct dsaf_tbl_tcam_data *)(&mask_key);
         }
 
@@ -2012,8 +2004,8 @@ int hns_dsaf_del_mac_mc_port(struct dsaf_device *dsaf_dev,
                 soft_mac_entry += entry_index;
                 soft_mac_entry->index = DSAF_INVALID_ENTRY_IDX;
         } else { /* not zero, just del port, update */
-                tcam_data.tbl_tcam_data_high = cpu_to_le32(mac_key.high.val);
-                tcam_data.tbl_tcam_data_low = cpu_to_le32(mac_key.low.val);
+                tcam_data.tbl_tcam_data_high = mac_key.high.val;
+                tcam_data.tbl_tcam_data_low = mac_key.low.val;
 
                 hns_dsaf_tcam_mc_cfg(dsaf_dev, entry_index,
                                      &tcam_data,
@@ -2750,6 +2742,17 @@ int hns_dsaf_get_regs_count(void)
         return DSAF_DUMP_REGS_NUM;
 }
 
+static int hns_dsaf_get_port_id(u8 port)
+{
+        if (port < DSAF_SERVICE_NW_NUM)
+                return port;
+
+        if (port >= DSAF_BASE_INNER_PORT_NUM)
+                return port - DSAF_BASE_INNER_PORT_NUM + DSAF_SERVICE_NW_NUM;
+
+        return -EINVAL;
+}
+
 static void set_promisc_tcam_enable(struct dsaf_device *dsaf_dev, u32 port)
 {
         struct dsaf_tbl_tcam_ucast_cfg tbl_tcam_ucast = {0, 1, 0, 0, 0x80};
@@ -2815,23 +2818,33 @@ static void set_promisc_tcam_enable(struct dsaf_device *dsaf_dev, u32 port)
         memset(&temp_key, 0x0, sizeof(temp_key));
         mask_entry.addr[0] = 0x01;
         hns_dsaf_set_mac_key(dsaf_dev, &mask_key, mask_entry.in_vlan_id,
-                             port, mask_entry.addr);
+                             0xf, mask_entry.addr);
         tbl_tcam_mcast.tbl_mcast_item_vld = 1;
         tbl_tcam_mcast.tbl_mcast_old_en = 0;
 
-        if (port < DSAF_SERVICE_NW_NUM) {
-                mskid = port;
-        } else if (port >= DSAF_BASE_INNER_PORT_NUM) {
-                mskid = port - DSAF_BASE_INNER_PORT_NUM + DSAF_SERVICE_NW_NUM;
-        } else {
+        /* set MAC port to handle multicast */
+        mskid = hns_dsaf_get_port_id(port);
+        if (mskid == -EINVAL) {
                 dev_err(dsaf_dev->dev, "%s,pnum(%d)error,key(%#x:%#x)\n",
                         dsaf_dev->ae_dev.name, port,
                         mask_key.high.val, mask_key.low.val);
                 return;
         }
+        dsaf_set_bit(tbl_tcam_mcast.tbl_mcast_port_msk[mskid / 32],
+                     mskid % 32, 1);
 
+        /* set pool bit map to handle multicast */
+        mskid = hns_dsaf_get_port_id(port_num);
+        if (mskid == -EINVAL) {
+                dev_err(dsaf_dev->dev,
+                        "%s, pool bit map pnum(%d)error,key(%#x:%#x)\n",
+                        dsaf_dev->ae_dev.name, port_num,
+                        mask_key.high.val, mask_key.low.val);
+                return;
+        }
         dsaf_set_bit(tbl_tcam_mcast.tbl_mcast_port_msk[mskid / 32],
                      mskid % 32, 1);
+
         memcpy(&temp_key, &mask_key, sizeof(mask_key));
         hns_dsaf_tcam_mc_cfg_vague(dsaf_dev, entry_index, &tbl_tcam_data_mc,
                                    (struct dsaf_tbl_tcam_data *)(&mask_key),
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
index 0e1cd99831a6..76cc8887e1a8 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
@@ -467,4 +467,6 @@ int hns_dsaf_clr_mac_mc_port(struct dsaf_device *dsaf_dev,
                              u8 mac_id, u8 port_num);
 int hns_dsaf_wait_pkt_clean(struct dsaf_device *dsaf_dev, int port);
 
+int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset);
+
 #endif /* __HNS_DSAF_MAIN_H__ */
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
index 16294cd3c954..19b94879691f 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
@@ -670,7 +670,7 @@ static int hns_mac_config_sds_loopback(struct hns_mac_cb *mac_cb, bool en)
                 dsaf_set_field(origin, 1ull << 10, 10, en);
                 dsaf_write_syscon(mac_cb->serdes_ctrl, reg_offset, origin);
         } else {
-                u8 *base_addr = (u8 *)mac_cb->serdes_vaddr +
+                u8 __iomem *base_addr = mac_cb->serdes_vaddr +
                                 (mac_cb->mac_id <= 3 ? 0x00280000 : 0x00200000);
                 dsaf_set_reg_field(base_addr, reg_offset, 1ull << 10, 10, en);
         }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
index 3d07c8a7639d..17c019106e6e 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
@@ -61,7 +61,7 @@ void hns_ppe_set_indir_table(struct hns_ppe_cb *ppe_cb,
         }
 }
 
-static void __iomem *
+static u8 __iomem *
 hns_ppe_common_get_ioaddr(struct ppe_common_cb *ppe_common)
 {
         return ppe_common->dsaf_dev->ppe_base + PPE_COMMON_REG_OFFSET;
@@ -111,8 +111,8 @@ hns_ppe_common_free_cfg(struct dsaf_device *dsaf_dev, u32 comm_index)
         dsaf_dev->ppe_common[comm_index] = NULL;
 }
 
-static void __iomem *hns_ppe_get_iobase(struct ppe_common_cb *ppe_common,
-                                        int ppe_idx)
+static u8 __iomem *hns_ppe_get_iobase(struct ppe_common_cb *ppe_common,
+                                      int ppe_idx)
 {
         return ppe_common->dsaf_dev->ppe_base + ppe_idx * PPE_REG_OFFSET;
 }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
index f670e63a5a01..110c6e8222c7 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
@@ -80,7 +80,7 @@ struct hns_ppe_cb {
         struct hns_ppe_hw_stats hw_stats;
 
         u8 index;       /* index in a ppe common device */
-        void __iomem *io_base;
+        u8 __iomem *io_base;
         int virq;
         u32 rss_indir_table[HNS_PPEV2_RSS_IND_TBL_SIZE]; /*shadow indir tab */
         u32 rss_key[HNS_PPEV2_RSS_KEY_NUM]; /* rss hash key */
@@ -89,7 +89,7 @@ struct hns_ppe_cb {
 struct ppe_common_cb {
         struct device *dev;
         struct dsaf_device *dsaf_dev;
-        void __iomem *io_base;
+        u8 __iomem *io_base;
 
         enum ppe_common_mode ppe_mode;
 
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
index 6bf346c11b25..ac3518ca4d7b 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
@@ -458,7 +458,7 @@ static void hns_rcb_ring_get_cfg(struct hnae_queue *q, int ring_type)
                 mdnum_ppkt = HNS_RCB_RING_MAX_BD_PER_PKT;
         } else {
                 ring = &q->tx_ring;
-                ring->io_base = (u8 __iomem *)ring_pair_cb->q.io_base +
+                ring->io_base = ring_pair_cb->q.io_base +
                         HNS_RCB_TX_REG_OFFSET;
                 irq_idx = HNS_RCB_IRQ_IDX_TX;
                 mdnum_ppkt = is_ver1 ? HNS_RCB_RING_MAX_TXBD_PER_PKT :
@@ -764,7 +764,7 @@ static int hns_rcb_get_ring_num(struct dsaf_device *dsaf_dev)
         }
 }
 
-static void __iomem *hns_rcb_common_get_vaddr(struct rcb_common_cb *rcb_common)
+static u8 __iomem *hns_rcb_common_get_vaddr(struct rcb_common_cb *rcb_common)
 {
         struct dsaf_device *dsaf_dev = rcb_common->dsaf_dev;
 
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
index b9733b0b8482..b9e7f11f0896 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
@@ -1018,7 +1018,7 @@
 #define XGMAC_PAUSE_CTL_RSP_MODE_B      2
 #define XGMAC_PAUSE_CTL_TX_XOFF_B       3
 
-static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
+static inline void dsaf_write_reg(u8 __iomem *base, u32 reg, u32 value)
 {
         writel(value, base + reg);
 }
@@ -1053,7 +1053,7 @@ static inline int dsaf_read_syscon(struct regmap *base, u32 reg, u32 *val)
 #define dsaf_set_bit(origin, shift, val) \
         dsaf_set_field((origin), (1ull << (shift)), (shift), (val))
 
-static inline void dsaf_set_reg_field(void __iomem *base, u32 reg, u32 mask,
+static inline void dsaf_set_reg_field(u8 __iomem *base, u32 reg, u32 mask,
                                       u32 shift, u32 val)
 {
         u32 origin = dsaf_read_reg(base, reg);
@@ -1073,7 +1073,7 @@ static inline void dsaf_set_reg_field(void __iomem *base, u32 reg, u32 mask,
 #define dsaf_get_bit(origin, shift) \
         dsaf_get_field((origin), (1ull << (shift)), (shift))
 
-static inline u32 dsaf_get_reg_field(void __iomem *base, u32 reg, u32 mask,
+static inline u32 dsaf_get_reg_field(u8 __iomem *base, u32 reg, u32 mask,
                                      u32 shift)
 {
         u32 origin;
@@ -1089,11 +1089,11 @@ static inline u32 dsaf_get_reg_field(void __iomem *base, u32 reg, u32 mask,
         dsaf_get_reg_field((dev)->io_base, (reg), (1ull << (bit)), (bit))
 
 #define dsaf_write_b(addr, data)\
-        writeb((data), (__iomem unsigned char *)(addr))
+        writeb((data), (__iomem u8 *)(addr))
 #define dsaf_read_b(addr)\
-        readb((__iomem unsigned char *)(addr))
+        readb((__iomem u8 *)(addr))
 
 #define hns_mac_reg_read64(drv, offset) \
-        readq((__iomem void *)(((u8 *)(drv)->io_base + 0xc00 + (offset))))
+        readq((__iomem void *)(((drv)->io_base + 0xc00 + (offset))))
 
 #endif  /* _DSAF_REG_H */
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c
index ba4316910dea..a60f207768fc 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c
@@ -129,7 +129,7 @@ static void hns_xgmac_lf_rf_control_init(struct mac_driver *mac_drv)
         dsaf_set_bit(val, XGMAC_UNIDIR_EN_B, 0);
         dsaf_set_bit(val, XGMAC_RF_TX_EN_B, 1);
         dsaf_set_field(val, XGMAC_LF_RF_INSERT_M, XGMAC_LF_RF_INSERT_S, 0);
-        dsaf_write_reg(mac_drv, XGMAC_MAC_TX_LF_RF_CONTROL_REG, val);
+        dsaf_write_dev(mac_drv, XGMAC_MAC_TX_LF_RF_CONTROL_REG, val);
 }
 
 /**
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index e37a0ca0db89..297b95c1b3c1 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -29,9 +29,6 @@
 
 #define SERVICE_TIMER_HZ (1 * HZ)
 
-#define NIC_TX_CLEAN_MAX_NUM 256
-#define NIC_RX_CLEAN_MAX_NUM 64
-
 #define RCB_IRQ_NOT_INITED 0
 #define RCB_IRQ_INITED 1
 #define HNS_BUFFER_SIZE_2048 2048
@@ -376,8 +373,6 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev,
         wmb(); /* commit all data before submit */
         assert(skb->queue_mapping < priv->ae_handle->q_num);
         hnae_queue_xmit(priv->ae_handle->qs[skb->queue_mapping], buf_num);
-        ring->stats.tx_pkts++;
-        ring->stats.tx_bytes += skb->len;
 
         return NETDEV_TX_OK;
 
@@ -999,6 +994,9 @@ static int hns_nic_tx_poll_one(struct hns_nic_ring_data *ring_data,
                 /* issue prefetch for next Tx descriptor */
                 prefetch(&ring->desc_cb[ring->next_to_clean]);
         }
+        /* update tx ring statistics. */
+        ring->stats.tx_pkts += pkts;
+        ring->stats.tx_bytes += bytes;
 
         NETIF_TX_UNLOCK(ring);
 
@@ -2151,7 +2149,7 @@ static int hns_nic_init_ring_data(struct hns_nic_priv *priv)
                         hns_nic_tx_fini_pro_v2;
 
                 netif_napi_add(priv->netdev, &rd->napi,
-                               hns_nic_common_poll, NIC_TX_CLEAN_MAX_NUM);
+                               hns_nic_common_poll, NAPI_POLL_WEIGHT);
                 rd->ring->irq_init_flag = RCB_IRQ_NOT_INITED;
         }
         for (i = h->q_num; i < h->q_num * 2; i++) {
@@ -2164,7 +2162,7 @@ static int hns_nic_init_ring_data(struct hns_nic_priv *priv)
                         hns_nic_rx_fini_pro_v2;
 
                 netif_napi_add(priv->netdev, &rd->napi,
-                               hns_nic_common_poll, NIC_RX_CLEAN_MAX_NUM);
+                               hns_nic_common_poll, NAPI_POLL_WEIGHT);
                 rd->ring->irq_init_flag = RCB_IRQ_NOT_INITED;
         }
 
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile b/drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile
index fffe8c1c45d3..0fb61d440d3b 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile
@@ -3,7 +3,7 @@
 # Makefile for the HISILICON network device drivers.
 #
 
-ccflags-y := -Idrivers/net/ethernet/hisilicon/hns3
+ccflags-y := -I $(srctree)/drivers/net/ethernet/hisilicon/hns3
 
 obj-$(CONFIG_HNS3_HCLGE) += hclge.o
 hclge-objs = hclge_main.o hclge_cmd.o hclge_mdio.o hclge_tm.o hclge_mbx.o hclge_err.o  hclge_debugfs.o
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile b/drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile
index fb93bbd35845..6193f8fa7cf3 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile
@@ -3,7 +3,7 @@
 # Makefile for the HISILICON network device drivers.
 #
 
-ccflags-y := -Idrivers/net/ethernet/hisilicon/hns3
+ccflags-y := -I $(srctree)/drivers/net/ethernet/hisilicon/hns3
 
 obj-$(CONFIG_HNS3_HCLGEVF) += hclgevf.o
 hclgevf-objs = hclgevf_main.o hclgevf_cmd.o hclgevf_mbx.o
\ No newline at end of file
diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c
index baf5cc251f32..8b8a7d00e8e0 100644
--- a/drivers/net/ethernet/hisilicon/hns_mdio.c
+++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
@@ -39,7 +39,7 @@ struct hns_mdio_sc_reg {
 };
 
 struct hns_mdio_device {
-        void *vbase;            /* mdio reg base address */
+        u8 __iomem *vbase;              /* mdio reg base address */
         struct regmap *subctrl_vbase;
         struct hns_mdio_sc_reg sc_reg;
 };
@@ -96,21 +96,17 @@ enum mdio_c45_op_seq {
 #define MDIO_SC_CLK_ST          0x531C
 #define MDIO_SC_RESET_ST        0x5A1C
 
-static void mdio_write_reg(void *base, u32 reg, u32 value)
+static void mdio_write_reg(u8 __iomem *base, u32 reg, u32 value)
 {
-        u8 __iomem *reg_addr = (u8 __iomem *)base;
-
-        writel_relaxed(value, reg_addr + reg);
+        writel_relaxed(value, base + reg);
 }
 
 #define MDIO_WRITE_REG(a, reg, value) \
         mdio_write_reg((a)->vbase, (reg), (value))
 
-static u32 mdio_read_reg(void *base, u32 reg)
+static u32 mdio_read_reg(u8 __iomem *base, u32 reg)
 {
-        u8 __iomem *reg_addr = (u8 __iomem *)base;
-
-        return readl_relaxed(reg_addr + reg);
+        return readl_relaxed(base + reg);
 }
 
 #define mdio_set_field(origin, mask, shift, val) \
@@ -121,7 +117,7 @@ static u32 mdio_read_reg(void *base, u32 reg)
 
 #define mdio_get_field(origin, mask, shift) (((origin) >> (shift)) & (mask))
 
-static void mdio_set_reg_field(void *base, u32 reg, u32 mask, u32 shift,
+static void mdio_set_reg_field(u8 __iomem *base, u32 reg, u32 mask, u32 shift,
                                u32 val)
 {
         u32 origin = mdio_read_reg(base, reg);
@@ -133,7 +129,7 @@ static void mdio_set_reg_field(void *base, u32 reg, u32 mask, u32 shift,
 #define MDIO_SET_REG_FIELD(dev, reg, mask, shift, val) \
         mdio_set_reg_field((dev)->vbase, (reg), (mask), (shift), (val))
 
-static u32 mdio_get_reg_field(void *base, u32 reg, u32 mask, u32 shift)
+static u32 mdio_get_reg_field(u8 __iomem *base, u32 reg, u32 mask, u32 shift)
 {
         u32 origin;
 
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 20c4e0835ba8..1de691e76b86 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1886,6 +1886,7 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter,
          */
         adapter->state = VNIC_PROBED;
 
+        reinit_completion(&adapter->init_done);
         rc = init_crq_queue(adapter);
         if (rc) {
                 netdev_err(adapter->netdev,
@@ -4692,7 +4693,7 @@ static int ibmvnic_reset_init(struct ibmvnic_adapter *adapter)
         old_num_rx_queues = adapter->req_rx_queues;
         old_num_tx_queues = adapter->req_tx_queues;
 
-        init_completion(&adapter->init_done);
+        reinit_completion(&adapter->init_done);
         adapter->init_done_rc = 0;
         ibmvnic_send_crq_init(adapter);
         if (!wait_for_completion_timeout(&adapter->init_done, timeout)) {
@@ -4747,7 +4748,6 @@ static int ibmvnic_init(struct ibmvnic_adapter *adapter)
 
         adapter->from_passive_init = false;
 
-        init_completion(&adapter->init_done);
         adapter->init_done_rc = 0;
         ibmvnic_send_crq_init(adapter);
         if (!wait_for_completion_timeout(&adapter->init_done, timeout)) {
@@ -4826,6 +4826,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
         INIT_WORK(&adapter->ibmvnic_reset, __ibmvnic_reset);
         INIT_LIST_HEAD(&adapter->rwi_list);
         spin_lock_init(&adapter->rwi_lock);
+        init_completion(&adapter->init_done);
         adapter->resetting = false;
 
         adapter->mac_change_pending = false;
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_main.c b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
index e2fa112bed9a..2325cee76211 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_main.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
@@ -41,6 +41,8 @@ static int __init fm10k_init_module(void)
         /* create driver workqueue */
         fm10k_workqueue = alloc_workqueue("%s", WQ_MEM_RECLAIM, 0,
                                           fm10k_driver_name);
+        if (!fm10k_workqueue)
+                return -ENOMEM;
 
         fm10k_dbg_init();
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
index d684998ba2b0..d3cc3427caad 100644
--- a/drivers/net/ethernet/intel/i40e/i40e.h
+++ b/drivers/net/ethernet/intel/i40e/i40e.h
@@ -790,6 +790,8 @@ struct i40e_vsi {
 
         /* VSI specific handlers */
         irqreturn_t (*irq_handler)(int irq, void *data);
+
+        unsigned long *af_xdp_zc_qps; /* tracks AF_XDP ZC enabled qps */
 } ____cacheline_internodealigned_in_smp;
 
 struct i40e_netdev_priv {
@@ -1096,20 +1098,6 @@ static inline bool i40e_enabled_xdp_vsi(struct i40e_vsi *vsi)
         return !!vsi->xdp_prog;
 }
 
-static inline struct xdp_umem *i40e_xsk_umem(struct i40e_ring *ring)
-{
-        bool xdp_on = i40e_enabled_xdp_vsi(ring->vsi);
-        int qid = ring->queue_index;
-
-        if (ring_is_xdp(ring))
-                qid -= ring->vsi->alloc_queue_pairs;
-
-        if (!xdp_on)
-                return NULL;
-
-        return xdp_get_umem_from_qid(ring->vsi->netdev, qid);
-}
-
 int i40e_create_queue_channel(struct i40e_vsi *vsi, struct i40e_channel *ch);
 int i40e_set_bw_limit(struct i40e_vsi *vsi, u16 seid, u64 max_tx_rate);
 int i40e_add_del_cloud_filter(struct i40e_vsi *vsi,
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
index 4c885801fa26..7874d0ec7fb0 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -2573,8 +2573,7 @@ static int i40e_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
                 return -EOPNOTSUPP;
 
         /* only magic packet is supported */
-        if (wol->wolopts && (wol->wolopts != WAKE_MAGIC)
-                          | (wol->wolopts != WAKE_FILTER))
+        if (wol->wolopts & ~WAKE_MAGIC)
                 return -EOPNOTSUPP;
 
         /* is this a new value? */
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index da62218eb70a..b1c265012c8a 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -3064,6 +3064,26 @@ static void i40e_config_xps_tx_ring(struct i40e_ring *ring)
 }
 
 /**
+ * i40e_xsk_umem - Retrieve the AF_XDP ZC if XDP and ZC is enabled
+ * @ring: The Tx or Rx ring
+ *
+ * Returns the UMEM or NULL.
+ **/
+static struct xdp_umem *i40e_xsk_umem(struct i40e_ring *ring)
+{
+        bool xdp_on = i40e_enabled_xdp_vsi(ring->vsi);
+        int qid = ring->queue_index;
+
+        if (ring_is_xdp(ring))
+                qid -= ring->vsi->alloc_queue_pairs;
+
+        if (!xdp_on || !test_bit(qid, ring->vsi->af_xdp_zc_qps))
+                return NULL;
+
+        return xdp_get_umem_from_qid(ring->vsi->netdev, qid);
+}
+
+/**
  * i40e_configure_tx_ring - Configure a transmit ring context and rest
  * @ring: The Tx ring to configure
  *
@@ -10064,6 +10084,12 @@ static int i40e_vsi_mem_alloc(struct i40e_pf *pf, enum i40e_vsi_type type)
         hash_init(vsi->mac_filter_hash);
         vsi->irqs_ready = false;
 
+        if (type == I40E_VSI_MAIN) {
+                vsi->af_xdp_zc_qps = bitmap_zalloc(pf->num_lan_qps, GFP_KERNEL);
+                if (!vsi->af_xdp_zc_qps)
+                        goto err_rings;
+        }
+
         ret = i40e_set_num_rings_in_vsi(vsi);
         if (ret)
                 goto err_rings;
@@ -10082,6 +10108,7 @@ static int i40e_vsi_mem_alloc(struct i40e_pf *pf, enum i40e_vsi_type type)
         goto unlock_pf;
 
 err_rings:
+        bitmap_free(vsi->af_xdp_zc_qps);
         pf->next_vsi = i - 1;
         kfree(vsi);
 unlock_pf:
@@ -10162,6 +10189,7 @@ static int i40e_vsi_clear(struct i40e_vsi *vsi)
         i40e_put_lump(pf->qp_pile, vsi->base_queue, vsi->idx);
         i40e_put_lump(pf->irq_pile, vsi->base_vector, vsi->idx);
 
+        bitmap_free(vsi->af_xdp_zc_qps);
         i40e_vsi_free_arrays(vsi, true);
         i40e_clear_rss_config_user(vsi);
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
index 5fb4353c742b..31575c0bb884 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
@@ -146,12 +146,13 @@ static int i40e_ptp_adjfreq(struct ptp_clock_info *ptp, s32 ppb)
 static int i40e_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta)
 {
         struct i40e_pf *pf = container_of(ptp, struct i40e_pf, ptp_caps);
-        struct timespec64 now;
+        struct timespec64 now, then;
 
+        then = ns_to_timespec64(delta);
         mutex_lock(&pf->tmreg_lock);
 
         i40e_ptp_read(pf, &now, NULL);
-        timespec64_add_ns(&now, delta);
+        now = timespec64_add(now, then);
         i40e_ptp_write(pf, (const struct timespec64 *)&now);
 
         mutex_unlock(&pf->tmreg_lock);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
index b5c182e688e3..1b17486543ac 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
@@ -102,6 +102,8 @@ static int i40e_xsk_umem_enable(struct i40e_vsi *vsi, struct xdp_umem *umem,
         if (err)
                 return err;
 
+        set_bit(qid, vsi->af_xdp_zc_qps);
+
         if_running = netif_running(vsi->netdev) && i40e_enabled_xdp_vsi(vsi);
 
         if (if_running) {
@@ -148,6 +150,7 @@ static int i40e_xsk_umem_disable(struct i40e_vsi *vsi, u16 qid)
                         return err;
         }
 
+        clear_bit(qid, vsi->af_xdp_zc_qps);
         i40e_xsk_umem_dma_unmap(vsi, umem);
 
         if (if_running) {
diff --git a/drivers/net/ethernet/intel/igb/e1000_defines.h b/drivers/net/ethernet/intel/igb/e1000_defines.h
index 01fcfc6f3415..d2e2c50ce257 100644
--- a/drivers/net/ethernet/intel/igb/e1000_defines.h
+++ b/drivers/net/ethernet/intel/igb/e1000_defines.h
@@ -194,6 +194,8 @@
 /* enable link status from external LINK_0 and LINK_1 pins */
 #define E1000_CTRL_SWDPIN0  0x00040000  /* SWDPIN 0 value */
 #define E1000_CTRL_SWDPIN1  0x00080000  /* SWDPIN 1 value */
+#define E1000_CTRL_ADVD3WUC 0x00100000  /* D3 WUC */
+#define E1000_CTRL_EN_PHY_PWR_MGMT 0x00200000 /* PHY PM enable */
 #define E1000_CTRL_SDP0_DIR 0x00400000  /* SDP0 Data direction */
 #define E1000_CTRL_SDP1_DIR 0x00800000  /* SDP1 Data direction */
 #define E1000_CTRL_RST      0x04000000  /* Global reset */
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 32d61d5a2706..acbb5b4f333d 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -8743,9 +8743,7 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
         struct e1000_hw *hw = &adapter->hw;
         u32 ctrl, rctl, status;
         u32 wufc = runtime ? E1000_WUFC_LNKC : adapter->wol;
-#ifdef CONFIG_PM
-        int retval = 0;
-#endif
+        bool wake;
 
         rtnl_lock();
         netif_device_detach(netdev);
@@ -8758,14 +8756,6 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
         igb_clear_interrupt_scheme(adapter);
         rtnl_unlock();
 
-#ifdef CONFIG_PM
-        if (!runtime) {
-                retval = pci_save_state(pdev);
-                if (retval)
-                        return retval;
-        }
-#endif
-
         status = rd32(E1000_STATUS);
         if (status & E1000_STATUS_LU)
                 wufc &= ~E1000_WUFC_LNKC;
@@ -8782,10 +8772,6 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
                 }
 
                 ctrl = rd32(E1000_CTRL);
-                /* advertise wake from D3Cold */
-                #define E1000_CTRL_ADVD3WUC 0x00100000
-                /* phy power management enable */
-                #define E1000_CTRL_EN_PHY_PWR_MGMT 0x00200000
                 ctrl |= E1000_CTRL_ADVD3WUC;
                 wr32(E1000_CTRL, ctrl);
 
@@ -8799,12 +8785,15 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
                 wr32(E1000_WUFC, 0);
         }
 
-        *enable_wake = wufc || adapter->en_mng_pt;
-        if (!*enable_wake)
+        wake = wufc || adapter->en_mng_pt;
+        if (!wake)
                 igb_power_down_link(adapter);
         else
                 igb_power_up_link(adapter);
 
+        if (enable_wake)
+                *enable_wake = wake;
+
         /* Release control of h/w to f/w.  If f/w is AMT enabled, this
          * would have already happened in close and is redundant.
          */
@@ -8847,22 +8836,7 @@ static void igb_deliver_wake_packet(struct net_device *netdev)
 
 static int __maybe_unused igb_suspend(struct device *dev)
 {
-        int retval;
-        bool wake;
-        struct pci_dev *pdev = to_pci_dev(dev);
-
-        retval = __igb_shutdown(pdev, &wake, 0);
-        if (retval)
-                return retval;
-
-        if (wake) {
-                pci_prepare_to_sleep(pdev);
-        } else {
-                pci_wake_from_d3(pdev, false);
-                pci_set_power_state(pdev, PCI_D3hot);
-        }
-
-        return 0;
+        return __igb_shutdown(to_pci_dev(dev), NULL, 0);
 }
 
 static int __maybe_unused igb_resume(struct device *dev)
@@ -8933,22 +8907,7 @@ static int __maybe_unused igb_runtime_idle(struct device *dev)
 
 static int __maybe_unused igb_runtime_suspend(struct device *dev)
 {
-        struct pci_dev *pdev = to_pci_dev(dev);
-        int retval;
-        bool wake;
-
-        retval = __igb_shutdown(pdev, &wake, 1);
-        if (retval)
-                return retval;
-
-        if (wake) {
-                pci_prepare_to_sleep(pdev);
-        } else {
-                pci_wake_from_d3(pdev, false);
-                pci_set_power_state(pdev, PCI_D3hot);
-        }
-
-        return 0;
+        return __igb_shutdown(to_pci_dev(dev), NULL, 1);
 }
 
 static int __maybe_unused igb_runtime_resume(struct device *dev)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
index cc4907f9ff02..2fb97967961c 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
@@ -905,13 +905,12 @@ s32 ixgbe_mii_bus_init(struct ixgbe_hw *hw)
         struct pci_dev *pdev = adapter->pdev;
         struct device *dev = &adapter->netdev->dev;
         struct mii_bus *bus;
+        int err = -ENODEV;
 
-        adapter->mii_bus = devm_mdiobus_alloc(dev);
-        if (!adapter->mii_bus)
+        bus = devm_mdiobus_alloc(dev);
+        if (!bus)
                 return -ENOMEM;
 
-        bus = adapter->mii_bus;
-
         switch (hw->device_id) {
         /* C3000 SoCs */
         case IXGBE_DEV_ID_X550EM_A_KR:
@@ -949,12 +948,15 @@ s32 ixgbe_mii_bus_init(struct ixgbe_hw *hw)
          */
         hw->phy.mdio.mode_support = MDIO_SUPPORTS_C45 | MDIO_SUPPORTS_C22;
 
-        return mdiobus_register(bus);
+        err = mdiobus_register(bus);
+        if (!err) {
+                adapter->mii_bus = bus;
+                return 0;
+        }
 
 ixgbe_no_mii_bus:
         devm_mdiobus_free(dev, bus);
-        adapter->mii_bus = NULL;
-        return -ENODEV;
+        return err;
 }
 
 /**
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
index 122927f3a600..d5e5afbdca6d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
@@ -96,9 +96,6 @@ int mlx5_port_query_eth_proto(struct mlx5_core_dev *dev, u8 port, bool ext,
         if (!eproto)
                 return -EINVAL;
 
-        if (ext !=  MLX5_CAP_PCAM_FEATURE(dev, ptys_extended_ethernet))
-                return -EOPNOTSUPP;
-
         err = mlx5_query_port_ptys(dev, out, sizeof(out), MLX5_PTYS_EN, port);
         if (err)
                 return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
index b0ce68feb0f3..633b117eb13e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
@@ -122,7 +122,9 @@ out:
         return err;
 }
 
-/* xoff = ((301+2.16 * len [m]) * speed [Gbps] + 2.72 MTU [B]) */
+/* xoff = ((301+2.16 * len [m]) * speed [Gbps] + 2.72 MTU [B])
+ * minimum speed value is 40Gbps
+ */
 static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
 {
         u32 speed;
@@ -130,10 +132,9 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
         int err;
 
         err = mlx5e_port_linkspeed(priv->mdev, &speed);
-        if (err) {
-                mlx5_core_warn(priv->mdev, "cannot get port speed\n");
-                return 0;
-        }
+        if (err)
+                speed = SPEED_40000;
+        speed = max_t(u32, speed, SPEED_40000);
 
         xoff = (301 + 216 * priv->dcbx.cable_len / 100) * speed / 1000 + 272 * mtu / 100;
 
@@ -142,7 +143,7 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
 }
 
 static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
-                                 u32 xoff, unsigned int mtu)
+                                 u32 xoff, unsigned int max_mtu)
 {
         int i;
 
@@ -154,11 +155,12 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
                 }
 
                 if (port_buffer->buffer[i].size <
-                    (xoff + mtu + (1 << MLX5E_BUFFER_CELL_SHIFT)))
+                    (xoff + max_mtu + (1 << MLX5E_BUFFER_CELL_SHIFT)))
                         return -ENOMEM;
 
                 port_buffer->buffer[i].xoff = port_buffer->buffer[i].size - xoff;
-                port_buffer->buffer[i].xon  = port_buffer->buffer[i].xoff - mtu;
+                port_buffer->buffer[i].xon  =
+                        port_buffer->buffer[i].xoff - max_mtu;
         }
 
         return 0;
@@ -166,7 +168,7 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
 
 /**
  *      update_buffer_lossy     - Update buffer configuration based on pfc
- *      @mtu: device's MTU
+ *      @max_mtu: netdev's max_mtu
  *      @pfc_en: <input> current pfc configuration
  *      @buffer: <input> current prio to buffer mapping
  *      @xoff:   <input> xoff value
@@ -183,7 +185,7 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
  *      @return: 0 if no error,
  *      sets change to true if buffer configuration was modified.
  */
-static int update_buffer_lossy(unsigned int mtu,
+static int update_buffer_lossy(unsigned int max_mtu,
                                u8 pfc_en, u8 *buffer, u32 xoff,
                                struct mlx5e_port_buffer *port_buffer,
                                bool *change)
@@ -220,7 +222,7 @@ static int update_buffer_lossy(unsigned int mtu,
         }
 
         if (changed) {
-                err = update_xoff_threshold(port_buffer, xoff, mtu);
+                err = update_xoff_threshold(port_buffer, xoff, max_mtu);
                 if (err)
                         return err;
 
@@ -230,6 +232,7 @@ static int update_buffer_lossy(unsigned int mtu,
         return 0;
 }
 
+#define MINIMUM_MAX_MTU 9216
 int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
                                     u32 change, unsigned int mtu,
                                     struct ieee_pfc *pfc,
@@ -241,12 +244,14 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
         bool update_prio2buffer = false;
         u8 buffer[MLX5E_MAX_PRIORITY];
         bool update_buffer = false;
+        unsigned int max_mtu;
         u32 total_used = 0;
         u8 curr_pfc_en;
         int err;
         int i;
 
         mlx5e_dbg(HW, priv, "%s: change=%x\n", __func__, change);
+        max_mtu = max_t(unsigned int, priv->netdev->max_mtu, MINIMUM_MAX_MTU);
 
         err = mlx5e_port_query_buffer(priv, &port_buffer);
         if (err)
@@ -254,7 +259,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
 
         if (change & MLX5E_PORT_BUFFER_CABLE_LEN) {
                 update_buffer = true;
-                err = update_xoff_threshold(&port_buffer, xoff, mtu);
+                err = update_xoff_threshold(&port_buffer, xoff, max_mtu);
                 if (err)
                         return err;
         }
@@ -264,7 +269,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
                 if (err)
                         return err;
 
-                err = update_buffer_lossy(mtu, pfc->pfc_en, buffer, xoff,
+                err = update_buffer_lossy(max_mtu, pfc->pfc_en, buffer, xoff,
                                           &port_buffer, &update_buffer);
                 if (err)
                         return err;
@@ -276,8 +281,8 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
                 if (err)
                         return err;
 
-                err = update_buffer_lossy(mtu, curr_pfc_en, prio2buffer, xoff,
-                                          &port_buffer, &update_buffer);
+                err = update_buffer_lossy(max_mtu, curr_pfc_en, prio2buffer,
+                                          xoff, &port_buffer, &update_buffer);
                 if (err)
                         return err;
         }
@@ -301,7 +306,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
                         return -EINVAL;
 
                 update_buffer = true;
-                err = update_xoff_threshold(&port_buffer, xoff, mtu);
+                err = update_xoff_threshold(&port_buffer, xoff, max_mtu);
                 if (err)
                         return err;
         }
@@ -309,7 +314,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
         /* Need to update buffer configuration if xoff value is changed */
         if (!update_buffer && xoff != priv->dcbx.xoff) {
                 update_buffer = true;
-                err = update_xoff_threshold(&port_buffer, xoff, mtu);
+                err = update_xoff_threshold(&port_buffer, xoff, max_mtu);
                 if (err)
                         return err;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
index 3078491cc0d0..1539cf3de5dc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
@@ -45,7 +45,9 @@ int mlx5e_create_tir(struct mlx5_core_dev *mdev,
         if (err)
                 return err;
 
+        mutex_lock(&mdev->mlx5e_res.td.list_lock);
         list_add(&tir->list, &mdev->mlx5e_res.td.tirs_list);
+        mutex_unlock(&mdev->mlx5e_res.td.list_lock);
 
         return 0;
 }
@@ -53,8 +55,10 @@ int mlx5e_create_tir(struct mlx5_core_dev *mdev,
 void mlx5e_destroy_tir(struct mlx5_core_dev *mdev,
                        struct mlx5e_tir *tir)
 {
+        mutex_lock(&mdev->mlx5e_res.td.list_lock);
         mlx5_core_destroy_tir(mdev, tir->tirn);
         list_del(&tir->list);
+        mutex_unlock(&mdev->mlx5e_res.td.list_lock);
 }
 
 static int mlx5e_create_mkey(struct mlx5_core_dev *mdev, u32 pdn,
@@ -114,6 +118,7 @@ int mlx5e_create_mdev_resources(struct mlx5_core_dev *mdev)
         }
 
         INIT_LIST_HEAD(&mdev->mlx5e_res.td.tirs_list);
+        mutex_init(&mdev->mlx5e_res.td.list_lock);
 
         return 0;
 
@@ -141,15 +146,17 @@ int mlx5e_refresh_tirs(struct mlx5e_priv *priv, bool enable_uc_lb)
 {
         struct mlx5_core_dev *mdev = priv->mdev;
         struct mlx5e_tir *tir;
-        int err  = -ENOMEM;
+        int err  = 0;
         u32 tirn = 0;
         int inlen;
         void *in;
 
         inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
         in = kvzalloc(inlen, GFP_KERNEL);
-        if (!in)
+        if (!in) {
+                err = -ENOMEM;
                 goto out;
+        }
 
         if (enable_uc_lb)
                 MLX5_SET(modify_tir_in, in, ctx.self_lb_block,
@@ -157,6 +164,7 @@ int mlx5e_refresh_tirs(struct mlx5e_priv *priv, bool enable_uc_lb)
 
         MLX5_SET(modify_tir_in, in, bitmask.self_lb_en, 1);
 
+        mutex_lock(&mdev->mlx5e_res.td.list_lock);
         list_for_each_entry(tir, &mdev->mlx5e_res.td.tirs_list, list) {
                 tirn = tir->tirn;
                 err = mlx5_core_modify_tir(mdev, tirn, in, inlen);
@@ -168,6 +176,7 @@ out:
         kvfree(in);
         if (err)
                 netdev_err(priv->netdev, "refresh tir(0x%x) failed, %d\n", tirn, err);
+        mutex_unlock(&mdev->mlx5e_res.td.list_lock);
 
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index a0987cc5fe4a..5efce4a3ff79 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -603,16 +603,18 @@ static void ptys2ethtool_supported_link(struct mlx5_core_dev *mdev,
                           __ETHTOOL_LINK_MODE_MASK_NBITS);
 }
 
-static void ptys2ethtool_adver_link(struct mlx5_core_dev *mdev,
-                                    unsigned long *advertising_modes,
-                                    u32 eth_proto_cap)
+static void ptys2ethtool_adver_link(unsigned long *advertising_modes,
+                                    u32 eth_proto_cap, bool ext)
 {
         unsigned long proto_cap = eth_proto_cap;
         struct ptys2ethtool_config *table;
         u32 max_size;
         int proto;
 
-        mlx5e_ethtool_get_speed_arr(mdev, &table, &max_size);
+        table = ext ? ptys2ext_ethtool_table : ptys2legacy_ethtool_table;
+        max_size = ext ? ARRAY_SIZE(ptys2ext_ethtool_table) :
+                         ARRAY_SIZE(ptys2legacy_ethtool_table);
+
         for_each_set_bit(proto, &proto_cap, max_size)
                 bitmap_or(advertising_modes, advertising_modes,
                           table[proto].advertised,
@@ -794,12 +796,12 @@ static void get_supported(struct mlx5_core_dev *mdev, u32 eth_proto_cap,
         ethtool_link_ksettings_add_link_mode(link_ksettings, supported, Pause);
 }
 
-static void get_advertising(struct mlx5_core_dev *mdev, u32 eth_proto_cap,
-                            u8 tx_pause, u8 rx_pause,
-                            struct ethtool_link_ksettings *link_ksettings)
+static void get_advertising(u32 eth_proto_cap, u8 tx_pause, u8 rx_pause,
+                            struct ethtool_link_ksettings *link_ksettings,
+                            bool ext)
 {
         unsigned long *advertising = link_ksettings->link_modes.advertising;
-        ptys2ethtool_adver_link(mdev, advertising, eth_proto_cap);
+        ptys2ethtool_adver_link(advertising, eth_proto_cap, ext);
 
         if (rx_pause)
                 ethtool_link_ksettings_add_link_mode(link_ksettings, advertising, Pause);
@@ -854,8 +856,9 @@ static void get_lp_advertising(struct mlx5_core_dev *mdev, u32 eth_proto_lp,
                                struct ethtool_link_ksettings *link_ksettings)
 {
         unsigned long *lp_advertising = link_ksettings->link_modes.lp_advertising;
+        bool ext = MLX5_CAP_PCAM_FEATURE(mdev, ptys_extended_ethernet);
 
-        ptys2ethtool_adver_link(mdev, lp_advertising, eth_proto_lp);
+        ptys2ethtool_adver_link(lp_advertising, eth_proto_lp, ext);
 }
 
 int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
@@ -872,6 +875,7 @@ int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
         u8 an_disable_admin;
         u8 an_status;
         u8 connector_type;
+        bool admin_ext;
         bool ext;
         int err;
 
@@ -886,6 +890,19 @@ int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
                                               eth_proto_capability);
         eth_proto_admin  = MLX5_GET_ETH_PROTO(ptys_reg, out, ext,
                                               eth_proto_admin);
+        /* Fields: eth_proto_admin and ext_eth_proto_admin  are
+         * mutually exclusive. Hence try reading legacy advertising
+         * when extended advertising is zero.
+         * admin_ext indicates how eth_proto_admin should be
+         * interpreted
+         */
+        admin_ext = ext;
+        if (ext && !eth_proto_admin) {
+                eth_proto_admin  = MLX5_GET_ETH_PROTO(ptys_reg, out, false,
+                                                      eth_proto_admin);
+                admin_ext = false;
+        }
+
         eth_proto_oper   = MLX5_GET_ETH_PROTO(ptys_reg, out, ext,
                                               eth_proto_oper);
         eth_proto_lp        = MLX5_GET(ptys_reg, out, eth_proto_lp_advertise);
@@ -899,7 +916,8 @@ int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
         ethtool_link_ksettings_zero_link_mode(link_ksettings, advertising);
 
         get_supported(mdev, eth_proto_cap, link_ksettings);
-        get_advertising(mdev, eth_proto_admin, tx_pause, rx_pause, link_ksettings);
+        get_advertising(eth_proto_admin, tx_pause, rx_pause, link_ksettings,
+                        admin_ext);
         get_speed_duplex(priv->netdev, eth_proto_oper, link_ksettings);
 
         eth_proto_oper = eth_proto_oper ? eth_proto_oper : eth_proto_cap;
@@ -997,19 +1015,17 @@ int mlx5e_ethtool_set_link_ksettings(struct mlx5e_priv *priv,
 
 #define MLX5E_PTYS_EXT ((1ULL << ETHTOOL_LINK_MODE_50000baseKR_Full_BIT) - 1)
 
-        ext_requested = (link_ksettings->link_modes.advertising[0] >
-                        MLX5E_PTYS_EXT);
+        ext_requested = !!(link_ksettings->link_modes.advertising[0] >
+                        MLX5E_PTYS_EXT ||
+                        link_ksettings->link_modes.advertising[1]);
         ext_supported = MLX5_CAP_PCAM_FEATURE(mdev, ptys_extended_ethernet);
-
-        /*when ptys_extended_ethernet is set legacy link modes are deprecated */
-        if (ext_requested != ext_supported)
-                return -EPROTONOSUPPORT;
+        ext_requested &= ext_supported;
 
         speed = link_ksettings->base.speed;
         ethtool2ptys_adver_func = ext_requested ?
                                   mlx5e_ethtool2ptys_ext_adver_link :
                                   mlx5e_ethtool2ptys_adver_link;
-        err = mlx5_port_query_eth_proto(mdev, 1, ext_supported, &eproto);
+        err = mlx5_port_query_eth_proto(mdev, 1, ext_requested, &eproto);
         if (err) {
                 netdev_err(priv->netdev, "%s: query port eth proto failed: %d\n",
                            __func__, err);
@@ -1037,7 +1053,7 @@ int mlx5e_ethtool_set_link_ksettings(struct mlx5e_priv *priv,
         if (!an_changes && link_modes == eproto.admin)
                 goto out;
 
-        mlx5_port_set_eth_ptys(mdev, an_disable, link_modes, ext_supported);
+        mlx5_port_set_eth_ptys(mdev, an_disable, link_modes, ext_requested);
         mlx5_toggle_port_link(mdev);
 
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 2fd425a7b156..ffc4a36551c8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -2161,6 +2161,52 @@ static bool csum_offload_supported(struct mlx5e_priv *priv,
         return true;
 }
 
+struct ip_ttl_word {
+        __u8    ttl;
+        __u8    protocol;
+        __sum16 check;
+};
+
+struct ipv6_hoplimit_word {
+        __be16  payload_len;
+        __u8    nexthdr;
+        __u8    hop_limit;
+};
+
+static bool is_action_keys_supported(const struct flow_action_entry *act)
+{
+        u32 mask, offset;
+        u8 htype;
+
+        htype = act->mangle.htype;
+        offset = act->mangle.offset;
+        mask = ~act->mangle.mask;
+        /* For IPv4 & IPv6 header check 4 byte word,
+         * to determine that modified fields
+         * are NOT ttl & hop_limit only.
+         */
+        if (htype == FLOW_ACT_MANGLE_HDR_TYPE_IP4) {
+                struct ip_ttl_word *ttl_word =
+                        (struct ip_ttl_word *)&mask;
+
+                if (offset != offsetof(struct iphdr, ttl) ||
+                    ttl_word->protocol ||
+                    ttl_word->check) {
+                        return true;
+                }
+        } else if (htype == FLOW_ACT_MANGLE_HDR_TYPE_IP6) {
+                struct ipv6_hoplimit_word *hoplimit_word =
+                        (struct ipv6_hoplimit_word *)&mask;
+
+                if (offset != offsetof(struct ipv6hdr, payload_len) ||
+                    hoplimit_word->payload_len ||
+                    hoplimit_word->nexthdr) {
+                        return true;
+                }
+        }
+        return false;
+}
+
 static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
                                           struct flow_action *flow_action,
                                           u32 actions,
@@ -2168,9 +2214,9 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
 {
         const struct flow_action_entry *act;
         bool modify_ip_header;
-        u8 htype, ip_proto;
         void *headers_v;
         u16 ethertype;
+        u8 ip_proto;
         int i;
 
         if (actions & MLX5_FLOW_CONTEXT_ACTION_DECAP)
@@ -2190,9 +2236,7 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
                     act->id != FLOW_ACTION_ADD)
                         continue;
 
-                htype = act->mangle.htype;
-                if (htype == FLOW_ACT_MANGLE_HDR_TYPE_IP4 ||
-                    htype == FLOW_ACT_MANGLE_HDR_TYPE_IP6) {
+                if (is_action_keys_supported(act)) {
                         modify_ip_header = true;
                         break;
                 }
@@ -2381,15 +2425,22 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv,
         return 0;
 }
 
-static inline int cmp_encap_info(struct ip_tunnel_key *a,
-                                 struct ip_tunnel_key *b)
+struct encap_key {
+        struct ip_tunnel_key *ip_tun_key;
+        int tunnel_type;
+};
+
+static inline int cmp_encap_info(struct encap_key *a,
+                                 struct encap_key *b)
 {
-        return memcmp(a, b, sizeof(*a));
+        return memcmp(a->ip_tun_key, b->ip_tun_key, sizeof(*a->ip_tun_key)) ||
+               a->tunnel_type != b->tunnel_type;
 }
 
-static inline int hash_encap_info(struct ip_tunnel_key *key)
+static inline int hash_encap_info(struct encap_key *key)
 {
-        return jhash(key, sizeof(*key), 0);
+        return jhash(key->ip_tun_key, sizeof(*key->ip_tun_key),
+                     key->tunnel_type);
 }
 
 
@@ -2420,7 +2471,7 @@ static int mlx5e_attach_encap(struct mlx5e_priv *priv,
         struct mlx5_esw_flow_attr *attr = flow->esw_attr;
         struct mlx5e_tc_flow_parse_attr *parse_attr;
         struct ip_tunnel_info *tun_info;
-        struct ip_tunnel_key *key;
+        struct encap_key key, e_key;
         struct mlx5e_encap_entry *e;
         unsigned short family;
         uintptr_t hash_key;
@@ -2430,13 +2481,16 @@ static int mlx5e_attach_encap(struct mlx5e_priv *priv,
         parse_attr = attr->parse_attr;
         tun_info = &parse_attr->tun_info[out_index];
         family = ip_tunnel_info_af(tun_info);
-        key = &tun_info->key;
+        key.ip_tun_key = &tun_info->key;
+        key.tunnel_type = mlx5e_tc_tun_get_type(mirred_dev);
 
-        hash_key = hash_encap_info(key);
+        hash_key = hash_encap_info(&key);
 
         hash_for_each_possible_rcu(esw->offloads.encap_tbl, e,
                                    encap_hlist, hash_key) {
-                if (!cmp_encap_info(&e->tun_info.key, key)) {
+                e_key.ip_tun_key = &e->tun_info.key;
+                e_key.tunnel_type = e->tunnel_type;
+                if (!cmp_encap_info(&e_key, &key)) {
                         found = true;
                         break;
                 }
@@ -2717,7 +2771,7 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv,
 
         if (hdrs[TCA_PEDIT_KEY_EX_CMD_SET].pedits ||
             hdrs[TCA_PEDIT_KEY_EX_CMD_ADD].pedits) {
-                err = alloc_tc_pedit_action(priv, MLX5_FLOW_NAMESPACE_KERNEL,
+                err = alloc_tc_pedit_action(priv, MLX5_FLOW_NAMESPACE_FDB,
                                             parse_attr, hdrs, extack);
                 if (err)
                         return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index ecd2c747f726..8a67fd197b79 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -105,8 +105,7 @@ static int arm_vport_context_events_cmd(struct mlx5_core_dev *dev, u16 vport,
                  opcode, MLX5_CMD_OP_MODIFY_NIC_VPORT_CONTEXT);
         MLX5_SET(modify_nic_vport_context_in, in, field_select.change_event, 1);
         MLX5_SET(modify_nic_vport_context_in, in, vport_number, vport);
-        if (vport)
-                MLX5_SET(modify_nic_vport_context_in, in, other_vport, 1);
+        MLX5_SET(modify_nic_vport_context_in, in, other_vport, 1);
         nic_vport_ctx = MLX5_ADDR_OF(modify_nic_vport_context_in,
                                      in, nic_vport_context);
 
@@ -134,8 +133,7 @@ static int modify_esw_vport_context_cmd(struct mlx5_core_dev *dev, u16 vport,
         MLX5_SET(modify_esw_vport_context_in, in, opcode,
                  MLX5_CMD_OP_MODIFY_ESW_VPORT_CONTEXT);
         MLX5_SET(modify_esw_vport_context_in, in, vport_number, vport);
-        if (vport)
-                MLX5_SET(modify_esw_vport_context_in, in, other_vport, 1);
+        MLX5_SET(modify_esw_vport_context_in, in, other_vport, 1);
         return mlx5_cmd_exec(dev, in, inlen, out, sizeof(out));
 }
 
@@ -431,6 +429,8 @@ static int esw_create_legacy_table(struct mlx5_eswitch *esw)
 {
         int err;
 
+        memset(&esw->fdb_table.legacy, 0, sizeof(struct legacy_fdb));
+
         err = esw_create_legacy_vepa_table(esw);
         if (err)
                 return err;
@@ -2157,6 +2157,7 @@ static int _mlx5_eswitch_set_vepa_locked(struct mlx5_eswitch *esw,
 
         /* Star rule to forward all traffic to uplink vport */
         memset(spec, 0, sizeof(*spec));
+        memset(&dest, 0, sizeof(dest));
         dest.type = MLX5_FLOW_DESTINATION_TYPE_VPORT;
         dest.vport.num = MLX5_VPORT_UPLINK;
         flow_act.action = MLX5_FLOW_CONTEXT_ACTION_FWD_DEST;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 6c72f33f6d09..fe770cd2151c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -1609,6 +1609,7 @@ static int esw_offloads_steering_init(struct mlx5_eswitch *esw, int nvports)
 {
         int err;
 
+        memset(&esw->fdb_table.offloads, 0, sizeof(struct offloads_fdb));
         mutex_init(&esw->fdb_table.offloads.fdb_prio_lock);
 
         err = esw_create_offloads_fdb_tables(esw, nvports);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
index 5cf5f2a9d51f..8de64e88c670 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
@@ -217,15 +217,21 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq,
         void *cmd;
         int ret;
 
+        rcu_read_lock();
+        flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle));
+        rcu_read_unlock();
+
+        if (!flow) {
+                WARN_ONCE(1, "Received NULL pointer for handle\n");
+                return -EINVAL;
+        }
+
         buf = kzalloc(size, GFP_ATOMIC);
         if (!buf)
                 return -ENOMEM;
 
         cmd = (buf + 1);
 
-        rcu_read_lock();
-        flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle));
-        rcu_read_unlock();
         mlx5_fpga_tls_flow_to_cmd(flow, cmd);
 
         MLX5_SET(tls_cmd, cmd, swid, ntohl(handle));
@@ -238,6 +244,8 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq,
         buf->complete = mlx_tls_kfree_complete;
 
         ret = mlx5_fpga_sbu_conn_sendmsg(mdev->fpga->tls->conn, buf);
+        if (ret < 0)
+                kfree(buf);
 
         return ret;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 70cc906a102b..76716419370d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -164,26 +164,6 @@ static struct mlx5_profile profile[] = {
                         .size   = 8,
                         .limit  = 4
                 },
-                .mr_cache[16]   = {
-                        .size   = 8,
-                        .limit  = 4
-                },
-                .mr_cache[17]   = {
-                        .size   = 8,
-                        .limit  = 4
-                },
-                .mr_cache[18]   = {
-                        .size   = 8,
-                        .limit  = 4
-                },
-                .mr_cache[19]   = {
-                        .size   = 4,
-                        .limit  = 2
-                },
-                .mr_cache[20]   = {
-                        .size   = 4,
-                        .limit  = 2
-                },
         },
 };
 
diff --git a/drivers/net/ethernet/netronome/nfp/flower/action.c b/drivers/net/ethernet/netronome/nfp/flower/action.c
index 6e2a6caec3fb..c56e31d9f8a4 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/action.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/action.c
@@ -48,8 +48,7 @@ nfp_fl_push_vlan(struct nfp_fl_push_vlan *push_vlan,
 
         tmp_push_vlan_tci =
                 FIELD_PREP(NFP_FL_PUSH_VLAN_PRIO, act->vlan.prio) |
-                FIELD_PREP(NFP_FL_PUSH_VLAN_VID, act->vlan.vid) |
-                NFP_FL_PUSH_VLAN_CFI;
+                FIELD_PREP(NFP_FL_PUSH_VLAN_VID, act->vlan.vid);
         push_vlan->vlan_tci = cpu_to_be16(tmp_push_vlan_tci);
 }
 
diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
index 4fcaf11ed56e..0ed51e79db00 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
+++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
@@ -26,7 +26,7 @@
 #define NFP_FLOWER_LAYER2_GENEVE_OP     BIT(6)
 
 #define NFP_FLOWER_MASK_VLAN_PRIO       GENMASK(15, 13)
-#define NFP_FLOWER_MASK_VLAN_CFI        BIT(12)
+#define NFP_FLOWER_MASK_VLAN_PRESENT    BIT(12)
 #define NFP_FLOWER_MASK_VLAN_VID        GENMASK(11, 0)
 
 #define NFP_FLOWER_MASK_MPLS_LB         GENMASK(31, 12)
@@ -82,7 +82,6 @@
 #define NFP_FL_OUT_FLAGS_TYPE_IDX       GENMASK(2, 0)
 
 #define NFP_FL_PUSH_VLAN_PRIO           GENMASK(15, 13)
-#define NFP_FL_PUSH_VLAN_CFI            BIT(12)
 #define NFP_FL_PUSH_VLAN_VID            GENMASK(11, 0)
 
 #define IPV6_FLOW_LABEL_MASK            cpu_to_be32(0x000fffff)
diff --git a/drivers/net/ethernet/netronome/nfp/flower/match.c b/drivers/net/ethernet/netronome/nfp/flower/match.c
index e03c8ef2c28c..9b8b843d0340 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/match.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/match.c
@@ -30,20 +30,19 @@ nfp_flower_compile_meta_tci(struct nfp_flower_meta_tci *ext,
 
                 flow_rule_match_vlan(rule, &match);
                 /* Populate the tci field. */
-                if (match.key->vlan_id || match.key->vlan_priority) {
-                        tmp_tci = FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
-                                             match.key->vlan_priority) |
-                                  FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
-                                             match.key->vlan_id) |
-                                  NFP_FLOWER_MASK_VLAN_CFI;
-                        ext->tci = cpu_to_be16(tmp_tci);
-                        tmp_tci = FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
-                                             match.mask->vlan_priority) |
-                                  FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
-                                             match.mask->vlan_id) |
-                                  NFP_FLOWER_MASK_VLAN_CFI;
-                        msk->tci = cpu_to_be16(tmp_tci);
-                }
+                tmp_tci = NFP_FLOWER_MASK_VLAN_PRESENT;
+                tmp_tci |= FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
+                                      match.key->vlan_priority) |
+                           FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
+                                      match.key->vlan_id);
+                ext->tci = cpu_to_be16(tmp_tci);
+
+                tmp_tci = NFP_FLOWER_MASK_VLAN_PRESENT;
+                tmp_tci |= FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
+                                      match.mask->vlan_priority) |
+                           FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
+                                      match.mask->vlan_id);
+                msk->tci = cpu_to_be16(tmp_tci);
         }
 }
 
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
index c3ad083d36c6..08e9bfa95f9b 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
@@ -195,7 +195,7 @@ static netdev_tx_t nfp_repr_xmit(struct sk_buff *skb, struct net_device *netdev)
         ret = dev_queue_xmit(skb);
         nfp_repr_inc_tx_stats(netdev, len, ret);
 
-        return ret;
+        return NETDEV_TX_OK;
 }
 
 static int nfp_repr_stop(struct net_device *netdev)
@@ -382,7 +382,7 @@ int nfp_repr_init(struct nfp_app *app, struct net_device *netdev,
         netdev->features &= ~(NETIF_F_TSO | NETIF_F_TSO6);
         netdev->gso_max_segs = NFP_NET_LSO_MAX_SEGS;
 
-        netdev->priv_flags |= IFF_NO_QUEUE;
+        netdev->priv_flags |= IFF_NO_QUEUE | IFF_DISABLE_NETPOLL;
         netdev->features |= NETIF_F_LLTX;
 
         if (nfp_app_has_tc(app)) {
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index a8ca26c2ae0c..88eb9e05d2a1 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -5460,7 +5460,7 @@ static void rtl_hw_start_8168(struct rtl8169_private *tp)
         tp->cp_cmd |= PktCntrDisable | INTT_1;
         RTL_W16(tp, CPlusCmd, tp->cp_cmd);
 
-        RTL_W16(tp, IntrMitigate, 0x5151);
+        RTL_W16(tp, IntrMitigate, 0x5100);
 
         /* Work around for RxFIFO overflow. */
         if (tp->mac_version == RTL_GIGA_MAC_VER_11) {
diff --git a/drivers/net/ethernet/stmicro/stmmac/descs_com.h b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
index 40d6356a7e73..3dfb07a78952 100644
--- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h
+++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
@@ -29,11 +29,13 @@
 /* Specific functions used for Ring mode */
 
 /* Enhanced descriptors */
-static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end)
+static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end,
+                                           int bfsize)
 {
-        p->des1 |= cpu_to_le32((BUF_SIZE_8KiB
-                        << ERDES1_BUFFER2_SIZE_SHIFT)
-                   & ERDES1_BUFFER2_SIZE_MASK);
+        if (bfsize == BUF_SIZE_16KiB)
+                p->des1 |= cpu_to_le32((BUF_SIZE_8KiB
+                                << ERDES1_BUFFER2_SIZE_SHIFT)
+                           & ERDES1_BUFFER2_SIZE_MASK);
 
         if (end)
                 p->des1 |= cpu_to_le32(ERDES1_END_RING);
@@ -59,11 +61,15 @@ static inline void enh_set_tx_desc_len_on_ring(struct dma_desc *p, int len)
 }
 
 /* Normal descriptors */
-static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end)
+static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end, int bfsize)
 {
-        p->des1 |= cpu_to_le32(((BUF_SIZE_2KiB - 1)
-                                << RDES1_BUFFER2_SIZE_SHIFT)
-                    & RDES1_BUFFER2_SIZE_MASK);
+        if (bfsize >= BUF_SIZE_2KiB) {
+                int bfsize2;
+
+                bfsize2 = min(bfsize - BUF_SIZE_2KiB + 1, BUF_SIZE_2KiB - 1);
+                p->des1 |= cpu_to_le32((bfsize2 << RDES1_BUFFER2_SIZE_SHIFT)
+                            & RDES1_BUFFER2_SIZE_MASK);
+        }
 
         if (end)
                 p->des1 |= cpu_to_le32(RDES1_END_RING);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
index 7fbb6a4dbf51..e061e9f5fad7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
@@ -296,7 +296,7 @@ exit:
 }
 
 static void dwmac4_rd_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
-                                   int mode, int end)
+                                   int mode, int end, int bfsize)
 {
         dwmac4_set_rx_owner(p, disable_rx_ic);
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
index 1d858fdec997..98fa471da7c0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
@@ -123,7 +123,7 @@ static int dwxgmac2_get_rx_timestamp_status(void *desc, void *next_desc,
 }
 
 static void dwxgmac2_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
-                                  int mode, int end)
+                                  int mode, int end, int bfsize)
 {
         dwxgmac2_set_rx_owner(p, disable_rx_ic);
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
index 5ef91a790f9d..5202d6ad7919 100644
--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
@@ -201,6 +201,11 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
         if (unlikely(rdes0 & RDES0_OWN))
                 return dma_own;
 
+        if (unlikely(!(rdes0 & RDES0_LAST_DESCRIPTOR))) {
+                stats->rx_length_errors++;
+                return discard_frame;
+        }
+
         if (unlikely(rdes0 & RDES0_ERROR_SUMMARY)) {
                 if (unlikely(rdes0 & RDES0_DESCRIPTOR_ERROR)) {
                         x->rx_desc++;
@@ -231,9 +236,10 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
          * It doesn't match with the information reported into the databook.
          * At any rate, we need to understand if the CSUM hw computation is ok
          * and report this info to the upper layers. */
-        ret = enh_desc_coe_rdes0(!!(rdes0 & RDES0_IPC_CSUM_ERROR),
-                                 !!(rdes0 & RDES0_FRAME_TYPE),
-                                 !!(rdes0 & ERDES0_RX_MAC_ADDR));
+        if (likely(ret == good_frame))
+                ret = enh_desc_coe_rdes0(!!(rdes0 & RDES0_IPC_CSUM_ERROR),
+                                         !!(rdes0 & RDES0_FRAME_TYPE),
+                                         !!(rdes0 & ERDES0_RX_MAC_ADDR));
 
         if (unlikely(rdes0 & RDES0_DRIBBLING))
                 x->dribbling_bit++;
@@ -259,15 +265,19 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
 }
 
 static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
-                                  int mode, int end)
+                                  int mode, int end, int bfsize)
 {
+        int bfsize1;
+
         p->des0 |= cpu_to_le32(RDES0_OWN);
-        p->des1 |= cpu_to_le32(BUF_SIZE_8KiB & ERDES1_BUFFER1_SIZE_MASK);
+
+        bfsize1 = min(bfsize, BUF_SIZE_8KiB);
+        p->des1 |= cpu_to_le32(bfsize1 & ERDES1_BUFFER1_SIZE_MASK);
 
         if (mode == STMMAC_CHAIN_MODE)
                 ehn_desc_rx_set_on_chain(p);
         else
-                ehn_desc_rx_set_on_ring(p, end);
+                ehn_desc_rx_set_on_ring(p, end, bfsize);
 
         if (disable_rx_ic)
                 p->des1 |= cpu_to_le32(ERDES1_DISABLE_IC);
diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h
index 92b8944f26e3..5bb00234d961 100644
--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h
+++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h
@@ -33,7 +33,7 @@ struct dma_extended_desc;
 struct stmmac_desc_ops {
         /* DMA RX descriptor ring initialization */
         void (*init_rx_desc)(struct dma_desc *p, int disable_rx_ic, int mode,
-                        int end);
+                        int end, int bfsize);
         /* DMA TX descriptor ring initialization */
         void (*init_tx_desc)(struct dma_desc *p, int mode, int end);
         /* Invoked by the xmit function to prepare the tx descriptor */
diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
index de65bb29feba..b7dd4e3c760d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
@@ -91,8 +91,6 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x,
                 return dma_own;
 
         if (unlikely(!(rdes0 & RDES0_LAST_DESCRIPTOR))) {
-                pr_warn("%s: Oversized frame spanned multiple buffers\n",
-                        __func__);
                 stats->rx_length_errors++;
                 return discard_frame;
         }
@@ -135,15 +133,19 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x,
 }
 
 static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode,
-                               int end)
+                               int end, int bfsize)
 {
+        int bfsize1;
+
         p->des0 |= cpu_to_le32(RDES0_OWN);
-        p->des1 |= cpu_to_le32((BUF_SIZE_2KiB - 1) & RDES1_BUFFER1_SIZE_MASK);
+
+        bfsize1 = min(bfsize, BUF_SIZE_2KiB - 1);
+        p->des1 |= cpu_to_le32(bfsize & RDES1_BUFFER1_SIZE_MASK);
 
         if (mode == STMMAC_CHAIN_MODE)
                 ndesc_rx_set_on_chain(p, end);
         else
-                ndesc_rx_set_on_ring(p, end);
+                ndesc_rx_set_on_ring(p, end, bfsize);
 
         if (disable_rx_ic)
                 p->des1 |= cpu_to_le32(RDES1_DISABLE_IC);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 6a2e1031a62a..a26e36dbb5df 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1136,11 +1136,13 @@ static void stmmac_clear_rx_descriptors(struct stmmac_priv *priv, u32 queue)
                 if (priv->extend_desc)
                         stmmac_init_rx_desc(priv, &rx_q->dma_erx[i].basic,
                                         priv->use_riwt, priv->mode,
-                                        (i == DMA_RX_SIZE - 1));
+                                        (i == DMA_RX_SIZE - 1),
+                                        priv->dma_buf_sz);
                 else
                         stmmac_init_rx_desc(priv, &rx_q->dma_rx[i],
                                         priv->use_riwt, priv->mode,
-                                        (i == DMA_RX_SIZE - 1));
+                                        (i == DMA_RX_SIZE - 1),
+                                        priv->dma_buf_sz);
 }
 
 /**
@@ -3352,9 +3354,8 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
 {
         struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
         struct stmmac_channel *ch = &priv->channel[queue];
-        unsigned int entry = rx_q->cur_rx;
+        unsigned int next_entry = rx_q->cur_rx;
         int coe = priv->hw->rx_csum;
-        unsigned int next_entry;
         unsigned int count = 0;
         bool xmac;
 
@@ -3372,10 +3373,12 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                 stmmac_display_ring(priv, rx_head, DMA_RX_SIZE, true);
         }
         while (count < limit) {
-                int status;
+                int entry, status;
                 struct dma_desc *p;
                 struct dma_desc *np;
 
+                entry = next_entry;
+
                 if (priv->extend_desc)
                         p = (struct dma_desc *)(rx_q->dma_erx + entry);
                 else
@@ -3431,11 +3434,12 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                          *  ignored
                          */
                         if (frame_len > priv->dma_buf_sz) {
-                                netdev_err(priv->dev,
-                                           "len %d larger than size (%d)\n",
-                                           frame_len, priv->dma_buf_sz);
+                                if (net_ratelimit())
+                                        netdev_err(priv->dev,
+                                                   "len %d larger than size (%d)\n",
+                                                   frame_len, priv->dma_buf_sz);
                                 priv->dev->stats.rx_length_errors++;
-                                break;
+                                continue;
                         }
 
                         /* ACS is set; GMAC core strips PAD/FCS for IEEE 802.3
@@ -3470,7 +3474,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                                                 dev_warn(priv->device,
                                                          "packet dropped\n");
                                         priv->dev->stats.rx_dropped++;
-                                        break;
+                                        continue;
                                 }
 
                                 dma_sync_single_for_cpu(priv->device,
@@ -3490,11 +3494,12 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                         } else {
                                 skb = rx_q->rx_skbuff[entry];
                                 if (unlikely(!skb)) {
-                                        netdev_err(priv->dev,
-                                                   "%s: Inconsistent Rx chain\n",
-                                                   priv->dev->name);
+                                        if (net_ratelimit())
+                                                netdev_err(priv->dev,
+                                                           "%s: Inconsistent Rx chain\n",
+                                                           priv->dev->name);
                                         priv->dev->stats.rx_dropped++;
-                                        break;
+                                        continue;
                                 }
                                 prefetch(skb->data - NET_IP_ALIGN);
                                 rx_q->rx_skbuff[entry] = NULL;
@@ -3529,7 +3534,6 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                         priv->dev->stats.rx_packets++;
                         priv->dev->stats.rx_bytes += frame_len;
                 }
-                entry = next_entry;
         }
 
         stmmac_rx_refill(priv, queue);
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index e859ae2e42d5..49f41b64077b 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -987,6 +987,7 @@ struct netvsc_device {
 
         wait_queue_head_t wait_drain;
         bool destroy;
+        bool tx_disable; /* if true, do not wake up queue again */
 
         /* Receive buffer allocated by us but manages by NetVSP */
         void *recv_buf;
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 9a022539d305..fdbeb7070d42 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -110,6 +110,7 @@ static struct netvsc_device *alloc_net_device(void)
 
         init_waitqueue_head(&net_device->wait_drain);
         net_device->destroy = false;
+        net_device->tx_disable = false;
 
         net_device->max_pkt = RNDIS_MAX_PKT_DEFAULT;
         net_device->pkt_align = RNDIS_PKT_ALIGN_DEFAULT;
@@ -719,7 +720,7 @@ static void netvsc_send_tx_complete(struct net_device *ndev,
         } else {
                 struct netdev_queue *txq = netdev_get_tx_queue(ndev, q_idx);
 
-                if (netif_tx_queue_stopped(txq) &&
+                if (netif_tx_queue_stopped(txq) && !net_device->tx_disable &&
                     (hv_get_avail_to_write_percent(&channel->outbound) >
                      RING_AVAIL_PERCENT_HIWATER || queue_sends < 1)) {
                         netif_tx_wake_queue(txq);
@@ -874,7 +875,8 @@ static inline int netvsc_send_pkt(
         } else if (ret == -EAGAIN) {
                 netif_tx_stop_queue(txq);
                 ndev_ctx->eth_stats.stop_queue++;
-                if (atomic_read(&nvchan->queue_sends) < 1) {
+                if (atomic_read(&nvchan->queue_sends) < 1 &&
+                    !net_device->tx_disable) {
                         netif_tx_wake_queue(txq);
                         ndev_ctx->eth_stats.wake_queue++;
                         ret = -ENOSPC;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 1a08679f90ce..06393b215102 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -109,6 +109,15 @@ static void netvsc_set_rx_mode(struct net_device *net)
         rcu_read_unlock();
 }
 
+static void netvsc_tx_enable(struct netvsc_device *nvscdev,
+                             struct net_device *ndev)
+{
+        nvscdev->tx_disable = false;
+        virt_wmb(); /* ensure queue wake up mechanism is on */
+
+        netif_tx_wake_all_queues(ndev);
+}
+
 static int netvsc_open(struct net_device *net)
 {
         struct net_device_context *ndev_ctx = netdev_priv(net);
@@ -129,7 +138,7 @@ static int netvsc_open(struct net_device *net)
         rdev = nvdev->extension;
         if (!rdev->link_state) {
                 netif_carrier_on(net);
-                netif_tx_wake_all_queues(net);
+                netvsc_tx_enable(nvdev, net);
         }
 
         if (vf_netdev) {
@@ -184,6 +193,17 @@ static int netvsc_wait_until_empty(struct netvsc_device *nvdev)
         }
 }
 
+static void netvsc_tx_disable(struct netvsc_device *nvscdev,
+                              struct net_device *ndev)
+{
+        if (nvscdev) {
+                nvscdev->tx_disable = true;
+                virt_wmb(); /* ensure txq will not wake up after stop */
+        }
+
+        netif_tx_disable(ndev);
+}
+
 static int netvsc_close(struct net_device *net)
 {
         struct net_device_context *net_device_ctx = netdev_priv(net);
@@ -192,7 +212,7 @@ static int netvsc_close(struct net_device *net)
         struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
         int ret;
 
-        netif_tx_disable(net);
+        netvsc_tx_disable(nvdev, net);
 
         /* No need to close rndis filter if it is removed already */
         if (!nvdev)
@@ -918,7 +938,7 @@ static int netvsc_detach(struct net_device *ndev,
 
         /* If device was up (receiving) then shutdown */
         if (netif_running(ndev)) {
-                netif_tx_disable(ndev);
+                netvsc_tx_disable(nvdev, ndev);
 
                 ret = rndis_filter_close(nvdev);
                 if (ret) {
@@ -1906,7 +1926,7 @@ static void netvsc_link_change(struct work_struct *w)
                 if (rdev->link_state) {
                         rdev->link_state = false;
                         netif_carrier_on(net);
-                        netif_tx_wake_all_queues(net);
+                        netvsc_tx_enable(net_device, net);
                 } else {
                         notify = true;
                 }
@@ -1916,7 +1936,7 @@ static void netvsc_link_change(struct work_struct *w)
                 if (!rdev->link_state) {
                         rdev->link_state = true;
                         netif_carrier_off(net);
-                        netif_tx_stop_all_queues(net);
+                        netvsc_tx_disable(net_device, net);
                 }
                 kfree(event);
                 break;
@@ -1925,7 +1945,7 @@ static void netvsc_link_change(struct work_struct *w)
                 if (!rdev->link_state) {
                         rdev->link_state = true;
                         netif_carrier_off(net);
-                        netif_tx_stop_all_queues(net);
+                        netvsc_tx_disable(net_device, net);
                         event->event = RNDIS_STATUS_MEDIA_CONNECT;
                         spin_lock_irqsave(&ndev_ctx->lock, flags);
                         list_add(&event->list, &ndev_ctx->reconfig_events);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 74bebbdb4b15..9195f3476b1d 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1203,6 +1203,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x19d2, 0x2002, 4)},    /* ZTE (Vodafone) K3765-Z */
         {QMI_FIXED_INTF(0x2001, 0x7e19, 4)},    /* D-Link DWM-221 B1 */
         {QMI_FIXED_INTF(0x2001, 0x7e35, 4)},    /* D-Link DWM-222 */
+        {QMI_FIXED_INTF(0x2020, 0x2031, 4)},    /* Olicard 600 */
         {QMI_FIXED_INTF(0x2020, 0x2033, 4)},    /* BroadMobi BM806U */
         {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
         {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 7c1430ed0244..6d1a1abbed27 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -1273,6 +1273,7 @@ static void vrf_setup(struct net_device *dev)
 
         /* default to no qdisc; user can add if desired */
         dev->priv_flags |= IFF_NO_QUEUE;
+        dev->priv_flags |= IFF_NO_RX_HANDLER;
 
         dev->min_mtu = 0;
         dev->max_mtu = 0;
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 2839bb70badf..f0716f6ce41f 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -404,15 +404,12 @@ static inline bool nvme_state_is_live(enum nvme_ana_state state)
 static void nvme_update_ns_ana_state(struct nvme_ana_group_desc *desc,
                 struct nvme_ns *ns)
 {
-        enum nvme_ana_state old;
-
         mutex_lock(&ns->head->lock);
-        old = ns->ana_state;
         ns->ana_grpid = le32_to_cpu(desc->grpid);
         ns->ana_state = desc->state;
         clear_bit(NVME_NS_ANA_PENDING, &ns->flags);
 
-        if (nvme_state_is_live(ns->ana_state) && !nvme_state_is_live(old))
+        if (nvme_state_is_live(ns->ana_state))
                 nvme_mpath_set_live(ns);
         mutex_unlock(&ns->head->lock);
 }
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index e7e08889865e..68c49dd67210 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -627,7 +627,7 @@ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb,
         return ret;
 }
 
-static inline void nvme_tcp_end_request(struct request *rq, __le16 status)
+static inline void nvme_tcp_end_request(struct request *rq, u16 status)
 {
         union nvme_result res = {};
 
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 2d73b66e3686..b3e765a95af8 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -509,7 +509,7 @@ int nvmet_ns_enable(struct nvmet_ns *ns)
 
         ret = nvmet_p2pmem_ns_enable(ns);
         if (ret)
-                goto out_unlock;
+                goto out_dev_disable;
 
         list_for_each_entry(ctrl, &subsys->ctrls, subsys_entry)
                 nvmet_p2pmem_ns_add_p2p(ctrl, ns);
@@ -550,7 +550,7 @@ out_unlock:
 out_dev_put:
         list_for_each_entry(ctrl, &subsys->ctrls, subsys_entry)
                 pci_dev_put(radix_tree_delete(&ctrl->p2p_ns_map, ns->nsid));
-
+out_dev_disable:
         nvmet_ns_dev_disable(ns);
         goto out_unlock;
 }
diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c
index 3e43212d3c1c..bc6ebb51b0bf 100644
--- a/drivers/nvme/target/io-cmd-file.c
+++ b/drivers/nvme/target/io-cmd-file.c
@@ -75,11 +75,11 @@ err:
         return ret;
 }
 
-static void nvmet_file_init_bvec(struct bio_vec *bv, struct sg_page_iter *iter)
+static void nvmet_file_init_bvec(struct bio_vec *bv, struct scatterlist *sg)
 {
-        bv->bv_page = sg_page_iter_page(iter);
-        bv->bv_offset = iter->sg->offset;
-        bv->bv_len = PAGE_SIZE - iter->sg->offset;
+        bv->bv_page = sg_page(sg);
+        bv->bv_offset = sg->offset;
+        bv->bv_len = sg->length;
 }
 
 static ssize_t nvmet_file_submit_bvec(struct nvmet_req *req, loff_t pos,
@@ -128,14 +128,14 @@ static void nvmet_file_io_done(struct kiocb *iocb, long ret, long ret2)
 
 static bool nvmet_file_execute_io(struct nvmet_req *req, int ki_flags)
 {
-        ssize_t nr_bvec = DIV_ROUND_UP(req->data_len, PAGE_SIZE);
-        struct sg_page_iter sg_pg_iter;
+        ssize_t nr_bvec = req->sg_cnt;
         unsigned long bv_cnt = 0;
         bool is_sync = false;
         size_t len = 0, total_len = 0;
         ssize_t ret = 0;
         loff_t pos;
-
+        int i;
+        struct scatterlist *sg;
 
         if (req->f.mpool_alloc && nr_bvec > NVMET_MAX_MPOOL_BVEC)
                 is_sync = true;
@@ -147,8 +147,8 @@ static bool nvmet_file_execute_io(struct nvmet_req *req, int ki_flags)
         }
 
         memset(&req->f.iocb, 0, sizeof(struct kiocb));
-        for_each_sg_page(req->sg, &sg_pg_iter, req->sg_cnt, 0) {
-                nvmet_file_init_bvec(&req->f.bvec[bv_cnt], &sg_pg_iter);
+        for_each_sg(req->sg, sg, req->sg_cnt, i) {
+                nvmet_file_init_bvec(&req->f.bvec[bv_cnt], sg);
                 len += req->f.bvec[bv_cnt].bv_len;
                 total_len += req->f.bvec[bv_cnt].bv_len;
                 bv_cnt++;
@@ -225,7 +225,7 @@ static void nvmet_file_submit_buffered_io(struct nvmet_req *req)
 
 static void nvmet_file_execute_rw(struct nvmet_req *req)
 {
-        ssize_t nr_bvec = DIV_ROUND_UP(req->data_len, PAGE_SIZE);
+        ssize_t nr_bvec = req->sg_cnt;
 
         if (!req->sg_cnt || !nr_bvec) {
                 nvmet_req_complete(req, 0);
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 224d88634115..d994839a3e24 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -273,6 +273,7 @@ enum pcie_link_width pcie_get_width_cap(struct pci_dev *dev);
 u32 pcie_bandwidth_capable(struct pci_dev *dev, enum pci_bus_speed *speed,
                            enum pcie_link_width *width);
 void __pcie_print_link_status(struct pci_dev *dev, bool verbose);
+void pcie_report_downtraining(struct pci_dev *dev);
 
 /* Single Root I/O Virtualization */
 struct pci_sriov {
diff --git a/drivers/pci/pcie/bw_notification.c b/drivers/pci/pcie/bw_notification.c
index d2eae3b7cc0f..4fa9e3523ee1 100644
--- a/drivers/pci/pcie/bw_notification.c
+++ b/drivers/pci/pcie/bw_notification.c
@@ -30,6 +30,8 @@ static void pcie_enable_link_bandwidth_notification(struct pci_dev *dev)
 {
         u16 lnk_ctl;
 
+        pcie_capability_write_word(dev, PCI_EXP_LNKSTA, PCI_EXP_LNKSTA_LBMS);
+
         pcie_capability_read_word(dev, PCI_EXP_LNKCTL, &lnk_ctl);
         lnk_ctl |= PCI_EXP_LNKCTL_LBMIE;
         pcie_capability_write_word(dev, PCI_EXP_LNKCTL, lnk_ctl);
@@ -44,11 +46,10 @@ static void pcie_disable_link_bandwidth_notification(struct pci_dev *dev)
         pcie_capability_write_word(dev, PCI_EXP_LNKCTL, lnk_ctl);
 }
 
-static irqreturn_t pcie_bw_notification_handler(int irq, void *context)
+static irqreturn_t pcie_bw_notification_irq(int irq, void *context)
 {
         struct pcie_device *srv = context;
         struct pci_dev *port = srv->port;
-        struct pci_dev *dev;
         u16 link_status, events;
         int ret;
 
@@ -58,17 +59,26 @@ static irqreturn_t pcie_bw_notification_handler(int irq, void *context)
         if (ret != PCIBIOS_SUCCESSFUL || !events)
                 return IRQ_NONE;
 
+        pcie_capability_write_word(port, PCI_EXP_LNKSTA, events);
+        pcie_update_link_speed(port->subordinate, link_status);
+        return IRQ_WAKE_THREAD;
+}
+
+static irqreturn_t pcie_bw_notification_handler(int irq, void *context)
+{
+        struct pcie_device *srv = context;
+        struct pci_dev *port = srv->port;
+        struct pci_dev *dev;
+
         /*
          * Print status from downstream devices, not this root port or
          * downstream switch port.
          */
         down_read(&pci_bus_sem);
         list_for_each_entry(dev, &port->subordinate->devices, bus_list)
-                __pcie_print_link_status(dev, false);
+                pcie_report_downtraining(dev);
         up_read(&pci_bus_sem);
 
-        pcie_update_link_speed(port->subordinate, link_status);
-        pcie_capability_write_word(port, PCI_EXP_LNKSTA, events);
         return IRQ_HANDLED;
 }
 
@@ -80,7 +90,8 @@ static int pcie_bandwidth_notification_probe(struct pcie_device *srv)
         if (!pcie_link_bandwidth_notification_supported(srv->port))
                 return -ENODEV;
 
-        ret = request_threaded_irq(srv->irq, NULL, pcie_bw_notification_handler,
+        ret = request_threaded_irq(srv->irq, pcie_bw_notification_irq,
+                                   pcie_bw_notification_handler,
                                    IRQF_SHARED, "PCIe BW notif", srv);
         if (ret)
                 return ret;
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 2ec0df04e0dc..7e12d0163863 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -2388,7 +2388,7 @@ static struct pci_dev *pci_scan_device(struct pci_bus *bus, int devfn)
         return dev;
 }
 
-static void pcie_report_downtraining(struct pci_dev *dev)
+void pcie_report_downtraining(struct pci_dev *dev)
 {
         if (!pci_is_pcie(dev))
                 return;
diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
index 5163097b43df..4bbd9ede38c8 100644
--- a/drivers/phy/allwinner/phy-sun4i-usb.c
+++ b/drivers/phy/allwinner/phy-sun4i-usb.c
@@ -485,8 +485,11 @@ static int sun4i_usb_phy_set_mode(struct phy *_phy,
         struct sun4i_usb_phy_data *data = to_sun4i_usb_phy_data(phy);
         int new_mode;
 
-        if (phy->index != 0)
+        if (phy->index != 0) {
+                if (mode == PHY_MODE_USB_HOST)
+                        return 0;
                 return -EINVAL;
+        }
 
         switch (mode) {
         case PHY_MODE_USB_HOST:
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 4159c63a5fd2..a835b31aad99 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -24,6 +24,7 @@
 #include <asm/crw.h>
 #include <asm/isc.h>
 #include <asm/ebcdic.h>
+#include <asm/ap.h>
 
 #include "css.h"
 #include "cio.h"
@@ -586,6 +587,15 @@ static void chsc_process_sei_scm_avail(struct chsc_sei_nt0_area *sei_area)
                               " failed (rc=%d).\n", ret);
 }
 
+static void chsc_process_sei_ap_cfg_chg(struct chsc_sei_nt0_area *sei_area)
+{
+        CIO_CRW_EVENT(3, "chsc: ap config changed\n");
+        if (sei_area->rs != 5)
+                return;
+
+        ap_bus_cfg_chg();
+}
+
 static void chsc_process_sei_nt2(struct chsc_sei_nt2_area *sei_area)
 {
         switch (sei_area->cc) {
@@ -612,6 +622,9 @@ static void chsc_process_sei_nt0(struct chsc_sei_nt0_area *sei_area)
         case 2: /* i/o resource accessibility */
                 chsc_process_sei_res_acc(sei_area);
                 break;
+        case 3: /* ap config changed */
+                chsc_process_sei_ap_cfg_chg(sei_area);
+                break;
         case 7: /* channel-path-availability information */
                 chsc_process_sei_chp_avail(sei_area);
                 break;
diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c
index a10cec0e86eb..0b3b9de45c60 100644
--- a/drivers/s390/cio/vfio_ccw_drv.c
+++ b/drivers/s390/cio/vfio_ccw_drv.c
@@ -72,20 +72,24 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work)
 {
         struct vfio_ccw_private *private;
         struct irb *irb;
+        bool is_final;
 
         private = container_of(work, struct vfio_ccw_private, io_work);
         irb = &private->irb;
 
+        is_final = !(scsw_actl(&irb->scsw) &
+                     (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT));
         if (scsw_is_solicited(&irb->scsw)) {
                 cp_update_scsw(&private->cp, &irb->scsw);
-                cp_free(&private->cp);
+                if (is_final)
+                        cp_free(&private->cp);
         }
         memcpy(private->io_region->irb_area, irb, sizeof(*irb));
 
         if (private->io_trigger)
                 eventfd_signal(private->io_trigger, 1);
 
-        if (private->mdev)
+        if (private->mdev && is_final)
                 private->state = VFIO_CCW_STATE_IDLE;
 }
 
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index e15816ff1265..1546389d71db 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -810,11 +810,18 @@ static int ap_device_remove(struct device *dev)
         struct ap_device *ap_dev = to_ap_dev(dev);
         struct ap_driver *ap_drv = ap_dev->drv;
 
+        /* prepare ap queue device removal */
         if (is_queue_dev(dev))
-                ap_queue_remove(to_ap_queue(dev));
+                ap_queue_prepare_remove(to_ap_queue(dev));
+
+        /* driver's chance to clean up gracefully */
         if (ap_drv->remove)
                 ap_drv->remove(ap_dev);
 
+        /* now do the ap queue device remove */
+        if (is_queue_dev(dev))
+                ap_queue_remove(to_ap_queue(dev));
+
         /* Remove queue/card from list of active queues/cards */
         spin_lock_bh(&ap_list_lock);
         if (is_card_dev(dev))
@@ -861,6 +868,16 @@ void ap_bus_force_rescan(void)
 EXPORT_SYMBOL(ap_bus_force_rescan);
 
 /*
+* A config change has happened, force an ap bus rescan.
+*/
+void ap_bus_cfg_chg(void)
+{
+        AP_DBF(DBF_INFO, "%s config change, forcing bus rescan\n", __func__);
+
+        ap_bus_force_rescan();
+}
+
+/*
  * hex2bitmap() - parse hex mask string and set bitmap.
  * Valid strings are "0x012345678" with at least one valid hex number.
  * Rest of the bitmap to the right is padded with 0. No spaces allowed
diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
index d0059eae5d94..15a98a673c5c 100644
--- a/drivers/s390/crypto/ap_bus.h
+++ b/drivers/s390/crypto/ap_bus.h
@@ -91,6 +91,7 @@ enum ap_state {
         AP_STATE_WORKING,
         AP_STATE_QUEUE_FULL,
         AP_STATE_SUSPEND_WAIT,
+        AP_STATE_REMOVE,        /* about to be removed from driver */
         AP_STATE_UNBOUND,       /* momentary not bound to a driver */
         AP_STATE_BORKED,        /* broken */
         NR_AP_STATES
@@ -252,6 +253,7 @@ void ap_bus_force_rescan(void);
 
 void ap_queue_init_reply(struct ap_queue *aq, struct ap_message *ap_msg);
 struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type);
+void ap_queue_prepare_remove(struct ap_queue *aq);
 void ap_queue_remove(struct ap_queue *aq);
 void ap_queue_suspend(struct ap_device *ap_dev);
 void ap_queue_resume(struct ap_device *ap_dev);
diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
index ba261210c6da..6a340f2c3556 100644
--- a/drivers/s390/crypto/ap_queue.c
+++ b/drivers/s390/crypto/ap_queue.c
@@ -420,6 +420,10 @@ static ap_func_t *ap_jumptable[NR_AP_STATES][NR_AP_EVENTS] = {
                 [AP_EVENT_POLL] = ap_sm_suspend_read,
                 [AP_EVENT_TIMEOUT] = ap_sm_nop,
         },
+        [AP_STATE_REMOVE] = {
+                [AP_EVENT_POLL] = ap_sm_nop,
+                [AP_EVENT_TIMEOUT] = ap_sm_nop,
+        },
         [AP_STATE_UNBOUND] = {
                 [AP_EVENT_POLL] = ap_sm_nop,
                 [AP_EVENT_TIMEOUT] = ap_sm_nop,
@@ -740,18 +744,31 @@ void ap_flush_queue(struct ap_queue *aq)
 }
 EXPORT_SYMBOL(ap_flush_queue);
 
-void ap_queue_remove(struct ap_queue *aq)
+void ap_queue_prepare_remove(struct ap_queue *aq)
 {
-        ap_flush_queue(aq);
+        spin_lock_bh(&aq->lock);
+        /* flush queue */
+        __ap_flush_queue(aq);
+        /* set REMOVE state to prevent new messages are queued in */
+        aq->state = AP_STATE_REMOVE;
         del_timer_sync(&aq->timeout);
+        spin_unlock_bh(&aq->lock);
+}
 
-        /* reset with zero, also clears irq registration */
+void ap_queue_remove(struct ap_queue *aq)
+{
+        /*
+         * all messages have been flushed and the state is
+         * AP_STATE_REMOVE. Now reset with zero which also
+         * clears the irq registration and move the state
+         * to AP_STATE_UNBOUND to signal that this queue
+         * is not used by any driver currently.
+         */
         spin_lock_bh(&aq->lock);
         ap_zapq(aq->qid);
         aq->state = AP_STATE_UNBOUND;
         spin_unlock_bh(&aq->lock);
 }
-EXPORT_SYMBOL(ap_queue_remove);
 
 void ap_queue_reinit_state(struct ap_queue *aq)
 {
@@ -760,4 +777,3 @@ void ap_queue_reinit_state(struct ap_queue *aq)
         ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
         spin_unlock_bh(&aq->lock);
 }
-EXPORT_SYMBOL(ap_queue_reinit_state);
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index eb93c2d27d0a..689c2af7026a 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -586,6 +586,7 @@ static inline bool zcrypt_check_queue(struct ap_perms *perms, int queue)
 
 static inline struct zcrypt_queue *zcrypt_pick_queue(struct zcrypt_card *zc,
                                                      struct zcrypt_queue *zq,
+                                                     struct module **pmod,
                                                      unsigned int weight)
 {
         if (!zq || !try_module_get(zq->queue->ap_dev.drv->driver.owner))
@@ -595,15 +596,15 @@ static inline struct zcrypt_queue *zcrypt_pick_queue(struct zcrypt_card *zc,
         atomic_add(weight, &zc->load);
         atomic_add(weight, &zq->load);
         zq->request_count++;
+        *pmod = zq->queue->ap_dev.drv->driver.owner;
         return zq;
 }
 
 static inline void zcrypt_drop_queue(struct zcrypt_card *zc,
                                      struct zcrypt_queue *zq,
+                                     struct module *mod,
                                      unsigned int weight)
 {
-        struct module *mod = zq->queue->ap_dev.drv->driver.owner;
-
         zq->request_count--;
         atomic_sub(weight, &zc->load);
         atomic_sub(weight, &zq->load);
@@ -653,6 +654,7 @@ static long zcrypt_rsa_modexpo(struct ap_perms *perms,
         unsigned int weight, pref_weight;
         unsigned int func_code;
         int qid = 0, rc = -ENODEV;
+        struct module *mod;
 
         trace_s390_zcrypt_req(mex, TP_ICARSAMODEXPO);
 
@@ -706,7 +708,7 @@ static long zcrypt_rsa_modexpo(struct ap_perms *perms,
                         pref_weight = weight;
                 }
         }
-        pref_zq = zcrypt_pick_queue(pref_zc, pref_zq, weight);
+        pref_zq = zcrypt_pick_queue(pref_zc, pref_zq, &mod, weight);
         spin_unlock(&zcrypt_list_lock);
 
         if (!pref_zq) {
@@ -718,7 +720,7 @@ static long zcrypt_rsa_modexpo(struct ap_perms *perms,
         rc = pref_zq->ops->rsa_modexpo(pref_zq, mex);
 
         spin_lock(&zcrypt_list_lock);
-        zcrypt_drop_queue(pref_zc, pref_zq, weight);
+        zcrypt_drop_queue(pref_zc, pref_zq, mod, weight);
         spin_unlock(&zcrypt_list_lock);
 
 out:
@@ -735,6 +737,7 @@ static long zcrypt_rsa_crt(struct ap_perms *perms,
         unsigned int weight, pref_weight;
         unsigned int func_code;
         int qid = 0, rc = -ENODEV;
+        struct module *mod;
 
         trace_s390_zcrypt_req(crt, TP_ICARSACRT);
 
@@ -788,7 +791,7 @@ static long zcrypt_rsa_crt(struct ap_perms *perms,
                         pref_weight = weight;
                 }
         }
-        pref_zq = zcrypt_pick_queue(pref_zc, pref_zq, weight);
+        pref_zq = zcrypt_pick_queue(pref_zc, pref_zq, &mod, weight);
         spin_unlock(&zcrypt_list_lock);
 
         if (!pref_zq) {
@@ -800,7 +803,7 @@ static long zcrypt_rsa_crt(struct ap_perms *perms,
         rc = pref_zq->ops->rsa_modexpo_crt(pref_zq, crt);
 
         spin_lock(&zcrypt_list_lock);
-        zcrypt_drop_queue(pref_zc, pref_zq, weight);
+        zcrypt_drop_queue(pref_zc, pref_zq, mod, weight);
         spin_unlock(&zcrypt_list_lock);
 
 out:
@@ -819,6 +822,7 @@ static long _zcrypt_send_cprb(struct ap_perms *perms,
         unsigned int func_code;
         unsigned short *domain;
         int qid = 0, rc = -ENODEV;
+        struct module *mod;
 
         trace_s390_zcrypt_req(xcRB, TB_ZSECSENDCPRB);
 
@@ -865,7 +869,7 @@ static long _zcrypt_send_cprb(struct ap_perms *perms,
                         pref_weight = weight;
                 }
         }
-        pref_zq = zcrypt_pick_queue(pref_zc, pref_zq, weight);
+        pref_zq = zcrypt_pick_queue(pref_zc, pref_zq, &mod, weight);
         spin_unlock(&zcrypt_list_lock);
 
         if (!pref_zq) {
@@ -881,7 +885,7 @@ static long _zcrypt_send_cprb(struct ap_perms *perms,
         rc = pref_zq->ops->send_cprb(pref_zq, xcRB, &ap_msg);
 
         spin_lock(&zcrypt_list_lock);
-        zcrypt_drop_queue(pref_zc, pref_zq, weight);
+        zcrypt_drop_queue(pref_zc, pref_zq, mod, weight);
         spin_unlock(&zcrypt_list_lock);
 
 out:
@@ -932,6 +936,7 @@ static long zcrypt_send_ep11_cprb(struct ap_perms *perms,
         unsigned int func_code;
         struct ap_message ap_msg;
         int qid = 0, rc = -ENODEV;
+        struct module *mod;
 
         trace_s390_zcrypt_req(xcrb, TP_ZSENDEP11CPRB);
 
@@ -1000,7 +1005,7 @@ static long zcrypt_send_ep11_cprb(struct ap_perms *perms,
                         pref_weight = weight;
                 }
         }
-        pref_zq = zcrypt_pick_queue(pref_zc, pref_zq, weight);
+        pref_zq = zcrypt_pick_queue(pref_zc, pref_zq, &mod, weight);
         spin_unlock(&zcrypt_list_lock);
 
         if (!pref_zq) {
@@ -1012,7 +1017,7 @@ static long zcrypt_send_ep11_cprb(struct ap_perms *perms,
         rc = pref_zq->ops->send_ep11_cprb(pref_zq, xcrb, &ap_msg);
 
         spin_lock(&zcrypt_list_lock);
-        zcrypt_drop_queue(pref_zc, pref_zq, weight);
+        zcrypt_drop_queue(pref_zc, pref_zq, mod, weight);
         spin_unlock(&zcrypt_list_lock);
 
 out_free:
@@ -1033,6 +1038,7 @@ static long zcrypt_rng(char *buffer)
         struct ap_message ap_msg;
         unsigned int domain;
         int qid = 0, rc = -ENODEV;
+        struct module *mod;
 
         trace_s390_zcrypt_req(buffer, TP_HWRNGCPRB);
 
@@ -1064,7 +1070,7 @@ static long zcrypt_rng(char *buffer)
                         pref_weight = weight;
                 }
         }
-        pref_zq = zcrypt_pick_queue(pref_zc, pref_zq, weight);
+        pref_zq = zcrypt_pick_queue(pref_zc, pref_zq, &mod, weight);
         spin_unlock(&zcrypt_list_lock);
 
         if (!pref_zq) {
@@ -1076,7 +1082,7 @@ static long zcrypt_rng(char *buffer)
         rc = pref_zq->ops->rng(pref_zq, buffer, &ap_msg);
 
         spin_lock(&zcrypt_list_lock);
-        zcrypt_drop_queue(pref_zc, pref_zq, weight);
+        zcrypt_drop_queue(pref_zc, pref_zq, mod, weight);
         spin_unlock(&zcrypt_list_lock);
 
 out:
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 744a64680d5b..e8fc28dba8df 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -624,6 +624,20 @@ static void zfcp_erp_strategy_memwait(struct zfcp_erp_action *erp_action)
         add_timer(&erp_action->timer);
 }
 
+void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter,
+                                     int clear, char *dbftag)
+{
+        unsigned long flags;
+        struct zfcp_port *port;
+
+        write_lock_irqsave(&adapter->erp_lock, flags);
+        read_lock(&adapter->port_list_lock);
+        list_for_each_entry(port, &adapter->port_list, list)
+                _zfcp_erp_port_forced_reopen(port, clear, dbftag);
+        read_unlock(&adapter->port_list_lock);
+        write_unlock_irqrestore(&adapter->erp_lock, flags);
+}
+
 static void _zfcp_erp_port_reopen_all(struct zfcp_adapter *adapter,
                                       int clear, char *dbftag)
 {
@@ -1341,6 +1355,9 @@ static void zfcp_erp_try_rport_unblock(struct zfcp_port *port)
                 struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev);
                 int lun_status;
 
+                if (sdev->sdev_state == SDEV_DEL ||
+                    sdev->sdev_state == SDEV_CANCEL)
+                        continue;
                 if (zsdev->port != port)
                         continue;
                 /* LUN under port of interest */
diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
index 3fce47b0b21b..c6acca521ffe 100644
--- a/drivers/s390/scsi/zfcp_ext.h
+++ b/drivers/s390/scsi/zfcp_ext.h
@@ -70,6 +70,8 @@ extern void zfcp_erp_port_reopen(struct zfcp_port *port, int clear,
                                  char *dbftag);
 extern void zfcp_erp_port_shutdown(struct zfcp_port *, int, char *);
 extern void zfcp_erp_port_forced_reopen(struct zfcp_port *, int, char *);
+extern void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter,
+                                            int clear, char *dbftag);
 extern void zfcp_erp_set_lun_status(struct scsi_device *, u32);
 extern void zfcp_erp_clear_lun_status(struct scsi_device *, u32);
 extern void zfcp_erp_lun_reopen(struct scsi_device *, int, char *);
diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c
index db00b5e3abbe..33eddb02ee30 100644
--- a/drivers/s390/scsi/zfcp_fc.c
+++ b/drivers/s390/scsi/zfcp_fc.c
@@ -239,10 +239,6 @@ static void _zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req, u32 range,
         list_for_each_entry(port, &adapter->port_list, list) {
                 if ((port->d_id & range) == (ntoh24(page->rscn_fid) & range))
                         zfcp_fc_test_link(port);
-                if (!port->d_id)
-                        zfcp_erp_port_reopen(port,
-                                             ZFCP_STATUS_COMMON_ERP_FAILED,
-                                             "fcrscn1");
         }
         read_unlock_irqrestore(&adapter->port_list_lock, flags);
 }
@@ -250,6 +246,7 @@ static void _zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req, u32 range,
 static void zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req)
 {
         struct fsf_status_read_buffer *status_buffer = (void *)fsf_req->data;
+        struct zfcp_adapter *adapter = fsf_req->adapter;
         struct fc_els_rscn *head;
         struct fc_els_rscn_page *page;
         u16 i;
@@ -263,6 +260,22 @@ static void zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req)
         no_entries = be16_to_cpu(head->rscn_plen) /
                 sizeof(struct fc_els_rscn_page);
 
+        if (no_entries > 1) {
+                /* handle failed ports */
+                unsigned long flags;
+                struct zfcp_port *port;
+
+                read_lock_irqsave(&adapter->port_list_lock, flags);
+                list_for_each_entry(port, &adapter->port_list, list) {
+                        if (port->d_id)
+                                continue;
+                        zfcp_erp_port_reopen(port,
+                                             ZFCP_STATUS_COMMON_ERP_FAILED,
+                                             "fcrscn1");
+                }
+                read_unlock_irqrestore(&adapter->port_list_lock, flags);
+        }
+
         for (i = 1; i < no_entries; i++) {
                 /* skip head and start with 1st element */
                 page++;
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index f4f6a07c5222..221d0dfb8493 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -368,6 +368,10 @@ static int zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *scpnt)
         struct zfcp_adapter *adapter = zfcp_sdev->port->adapter;
         int ret = SUCCESS, fc_ret;
 
+        if (!(adapter->connection_features & FSF_FEATURE_NPIV_MODE)) {
+                zfcp_erp_port_forced_reopen_all(adapter, 0, "schrh_p");
+                zfcp_erp_wait(adapter);
+        }
         zfcp_erp_adapter_reopen(adapter, 0, "schrh_1");
         zfcp_erp_wait(adapter);
         fc_ret = fc_block_scsi_eh(scpnt);
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index 1df5171594b8..11fb68d7e60d 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -2640,9 +2640,14 @@ static inline unsigned int cap_to_cyls(sector_t capacity, unsigned divisor)
         return capacity;
 }
 
+static inline int aac_pci_offline(struct aac_dev *dev)
+{
+        return pci_channel_offline(dev->pdev) || dev->handle_pci_error;
+}
+
 static inline int aac_adapter_check_health(struct aac_dev *dev)
 {
-        if (unlikely(pci_channel_offline(dev->pdev)))
+        if (unlikely(aac_pci_offline(dev)))
                 return -1;
 
         return (dev)->a_ops.adapter_check_health(dev);
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index e67e032936ef..78430a7b294c 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -672,7 +672,7 @@ int aac_fib_send(u16 command, struct fib *fibptr, unsigned long size,
                                         return -ETIMEDOUT;
                                 }
 
-                                if (unlikely(pci_channel_offline(dev->pdev)))
+                                if (unlikely(aac_pci_offline(dev)))
                                         return -EFAULT;
 
                                 if ((blink = aac_adapter_check_health(dev)) > 0) {
@@ -772,7 +772,7 @@ int aac_hba_send(u8 command, struct fib *fibptr, fib_callback callback,
 
                 spin_unlock_irqrestore(&fibptr->event_lock, flags);
 
-                if (unlikely(pci_channel_offline(dev->pdev)))
+                if (unlikely(aac_pci_offline(dev)))
                         return -EFAULT;
 
                 fibptr->flags |= FIB_CONTEXT_FLAG_WAIT;
diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
index dbaa4f131433..3ad997ac3510 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -139,6 +139,7 @@ static const struct {
         { IBMVFC_FC_FAILURE, IBMVFC_VENDOR_SPECIFIC, DID_ERROR, 1, 1, "vendor specific" },
 
         { IBMVFC_FC_SCSI_ERROR, 0, DID_OK, 1, 0, "SCSI error" },
+        { IBMVFC_FC_SCSI_ERROR, IBMVFC_COMMAND_FAILED, DID_ERROR, 0, 1, "PRLI to device failed." },
 };
 
 static void ibmvfc_npiv_login(struct ibmvfc_host *);
@@ -1494,9 +1495,9 @@ static void ibmvfc_log_error(struct ibmvfc_event *evt)
         if (rsp->flags & FCP_RSP_LEN_VALID)
                 rsp_code = rsp->data.info.rsp_code;
 
-        scmd_printk(KERN_ERR, cmnd, "Command (%02X) failed: %s (%x:%x) "
+        scmd_printk(KERN_ERR, cmnd, "Command (%02X) : %s (%x:%x) "
                     "flags: %x fcp_rsp: %x, resid=%d, scsi_status: %x\n",
-                    cmnd->cmnd[0], err, vfc_cmd->status, vfc_cmd->error,
+                    cmnd->cmnd[0], err, be16_to_cpu(vfc_cmd->status), be16_to_cpu(vfc_cmd->error),
                     rsp->flags, rsp_code, scsi_get_resid(cmnd), rsp->scsi_status);
 }
 
@@ -2022,7 +2023,7 @@ static int ibmvfc_reset_device(struct scsi_device *sdev, int type, char *desc)
                 sdev_printk(KERN_ERR, sdev, "%s reset failed: %s (%x:%x) "
                             "flags: %x fcp_rsp: %x, scsi_status: %x\n", desc,
                             ibmvfc_get_cmd_error(be16_to_cpu(rsp_iu.cmd.status), be16_to_cpu(rsp_iu.cmd.error)),
-                            rsp_iu.cmd.status, rsp_iu.cmd.error, fc_rsp->flags, rsp_code,
+                            be16_to_cpu(rsp_iu.cmd.status), be16_to_cpu(rsp_iu.cmd.error), fc_rsp->flags, rsp_code,
                             fc_rsp->scsi_status);
                 rsp_rc = -EIO;
         } else
@@ -2381,7 +2382,7 @@ static int ibmvfc_abort_task_set(struct scsi_device *sdev)
                 sdev_printk(KERN_ERR, sdev, "Abort failed: %s (%x:%x) "
                             "flags: %x fcp_rsp: %x, scsi_status: %x\n",
                             ibmvfc_get_cmd_error(be16_to_cpu(rsp_iu.cmd.status), be16_to_cpu(rsp_iu.cmd.error)),
-                            rsp_iu.cmd.status, rsp_iu.cmd.error, fc_rsp->flags, rsp_code,
+                            be16_to_cpu(rsp_iu.cmd.status), be16_to_cpu(rsp_iu.cmd.error), fc_rsp->flags, rsp_code,
                             fc_rsp->scsi_status);
                 rsp_rc = -EIO;
         } else
@@ -2755,16 +2756,18 @@ static void ibmvfc_handle_crq(struct ibmvfc_crq *crq, struct ibmvfc_host *vhost)
                 ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_NONE);
                 if (crq->format == IBMVFC_PARTITION_MIGRATED) {
                         /* We need to re-setup the interpartition connection */
-                        dev_info(vhost->dev, "Re-enabling adapter\n");
+                        dev_info(vhost->dev, "Partition migrated, Re-enabling adapter\n");
                         vhost->client_migrated = 1;
                         ibmvfc_purge_requests(vhost, DID_REQUEUE);
                         ibmvfc_link_down(vhost, IBMVFC_LINK_DOWN);
                         ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_REENABLE);
-                } else {
-                        dev_err(vhost->dev, "Virtual adapter failed (rc=%d)\n", crq->format);
+                } else if (crq->format == IBMVFC_PARTNER_FAILED || crq->format == IBMVFC_PARTNER_DEREGISTER) {
+                        dev_err(vhost->dev, "Host partner adapter deregistered or failed (rc=%d)\n", crq->format);
                         ibmvfc_purge_requests(vhost, DID_ERROR);
                         ibmvfc_link_down(vhost, IBMVFC_LINK_DOWN);
                         ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_RESET);
+                } else {
+                        dev_err(vhost->dev, "Received unknown transport event from partner (rc=%d)\n", crq->format);
                 }
                 return;
         case IBMVFC_CRQ_CMD_RSP:
@@ -3348,7 +3351,7 @@ static void ibmvfc_tgt_prli_done(struct ibmvfc_event *evt)
 
                 tgt_log(tgt, level, "Process Login failed: %s (%x:%x) rc=0x%02X\n",
                         ibmvfc_get_cmd_error(be16_to_cpu(rsp->status), be16_to_cpu(rsp->error)),
-                        rsp->status, rsp->error, status);
+                        be16_to_cpu(rsp->status), be16_to_cpu(rsp->error), status);
                 break;
         }
 
@@ -3446,9 +3449,10 @@ static void ibmvfc_tgt_plogi_done(struct ibmvfc_event *evt)
                         ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_DEL_RPORT);
 
                 tgt_log(tgt, level, "Port Login failed: %s (%x:%x) %s (%x) %s (%x) rc=0x%02X\n",
-                        ibmvfc_get_cmd_error(be16_to_cpu(rsp->status), be16_to_cpu(rsp->error)), rsp->status, rsp->error,
-                        ibmvfc_get_fc_type(be16_to_cpu(rsp->fc_type)), rsp->fc_type,
-                        ibmvfc_get_ls_explain(be16_to_cpu(rsp->fc_explain)), rsp->fc_explain, status);
+                        ibmvfc_get_cmd_error(be16_to_cpu(rsp->status), be16_to_cpu(rsp->error)),
+                                             be16_to_cpu(rsp->status), be16_to_cpu(rsp->error),
+                        ibmvfc_get_fc_type(be16_to_cpu(rsp->fc_type)), be16_to_cpu(rsp->fc_type),
+                        ibmvfc_get_ls_explain(be16_to_cpu(rsp->fc_explain)), be16_to_cpu(rsp->fc_explain), status);
                 break;
         }
 
@@ -3619,7 +3623,7 @@ static void ibmvfc_tgt_adisc_done(struct ibmvfc_event *evt)
                 fc_explain = (be32_to_cpu(mad->fc_iu.response[1]) & 0x0000ff00) >> 8;
                 tgt_info(tgt, "ADISC failed: %s (%x:%x) %s (%x) %s (%x) rc=0x%02X\n",
                          ibmvfc_get_cmd_error(be16_to_cpu(mad->iu.status), be16_to_cpu(mad->iu.error)),
-                         mad->iu.status, mad->iu.error,
+                         be16_to_cpu(mad->iu.status), be16_to_cpu(mad->iu.error),
                          ibmvfc_get_fc_type(fc_reason), fc_reason,
                          ibmvfc_get_ls_explain(fc_explain), fc_explain, status);
                 break;
@@ -3831,9 +3835,10 @@ static void ibmvfc_tgt_query_target_done(struct ibmvfc_event *evt)
 
                 tgt_log(tgt, level, "Query Target failed: %s (%x:%x) %s (%x) %s (%x) rc=0x%02X\n",
                         ibmvfc_get_cmd_error(be16_to_cpu(rsp->status), be16_to_cpu(rsp->error)),
-                        rsp->status, rsp->error, ibmvfc_get_fc_type(be16_to_cpu(rsp->fc_type)),
-                        rsp->fc_type, ibmvfc_get_gs_explain(be16_to_cpu(rsp->fc_explain)),
-                        rsp->fc_explain, status);
+                        be16_to_cpu(rsp->status), be16_to_cpu(rsp->error),
+                        ibmvfc_get_fc_type(be16_to_cpu(rsp->fc_type)), be16_to_cpu(rsp->fc_type),
+                        ibmvfc_get_gs_explain(be16_to_cpu(rsp->fc_explain)), be16_to_cpu(rsp->fc_explain),
+                        status);
                 break;
         }
 
@@ -3959,7 +3964,7 @@ static void ibmvfc_discover_targets_done(struct ibmvfc_event *evt)
                 level += ibmvfc_retry_host_init(vhost);
                 ibmvfc_log(vhost, level, "Discover Targets failed: %s (%x:%x)\n",
                            ibmvfc_get_cmd_error(be16_to_cpu(rsp->status), be16_to_cpu(rsp->error)),
-                           rsp->status, rsp->error);
+                           be16_to_cpu(rsp->status), be16_to_cpu(rsp->error));
                 break;
         case IBMVFC_MAD_DRIVER_FAILED:
                 break;
@@ -4024,7 +4029,7 @@ static void ibmvfc_npiv_login_done(struct ibmvfc_event *evt)
                         ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD);
                 ibmvfc_log(vhost, level, "NPIV Login failed: %s (%x:%x)\n",
                            ibmvfc_get_cmd_error(be16_to_cpu(rsp->status), be16_to_cpu(rsp->error)),
-                                                rsp->status, rsp->error);
+                                                be16_to_cpu(rsp->status), be16_to_cpu(rsp->error));
                 ibmvfc_free_event(evt);
                 return;
         case IBMVFC_MAD_CRQ_ERROR:
diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h
index b81a53c4a9a8..459cc288ba1d 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.h
+++ b/drivers/scsi/ibmvscsi/ibmvfc.h
@@ -78,9 +78,14 @@ enum ibmvfc_crq_valid {
         IBMVFC_CRQ_XPORT_EVENT          = 0xFF,
 };
 
-enum ibmvfc_crq_format {
+enum ibmvfc_crq_init_msg {
         IBMVFC_CRQ_INIT                 = 0x01,
         IBMVFC_CRQ_INIT_COMPLETE        = 0x02,
+};
+
+enum ibmvfc_crq_xport_evts {
+        IBMVFC_PARTNER_FAILED           = 0x01,
+        IBMVFC_PARTNER_DEREGISTER       = 0x02,
         IBMVFC_PARTITION_MIGRATED       = 0x06,
 };
 
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index e57774472e75..1d8c584ec1e9 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -3281,12 +3281,18 @@ mpt3sas_base_free_smid(struct MPT3SAS_ADAPTER *ioc, u16 smid)
 
         if (smid < ioc->hi_priority_smid) {
                 struct scsiio_tracker *st;
+                void *request;
 
                 st = _get_st_from_smid(ioc, smid);
                 if (!st) {
                         _base_recovery_check(ioc);
                         return;
                 }
+
+                /* Clear MPI request frame */
+                request = mpt3sas_base_get_msg_frame(ioc, smid);
+                memset(request, 0, ioc->request_sz);
+
                 mpt3sas_base_clear_st(ioc, st);
                 _base_recovery_check(ioc);
                 return;
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 8bb5b8f9f4d2..1ccfbc7eebe0 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -1462,11 +1462,23 @@ mpt3sas_scsih_scsi_lookup_get(struct MPT3SAS_ADAPTER *ioc, u16 smid)
 {
         struct scsi_cmnd *scmd = NULL;
         struct scsiio_tracker *st;
+        Mpi25SCSIIORequest_t *mpi_request;
 
         if (smid > 0  &&
             smid <= ioc->scsiio_depth - INTERNAL_SCSIIO_CMDS_COUNT) {
                 u32 unique_tag = smid - 1;
 
+                mpi_request = mpt3sas_base_get_msg_frame(ioc, smid);
+
+                /*
+                 * If SCSI IO request is outstanding at driver level then
+                 * DevHandle filed must be non-zero. If DevHandle is zero
+                 * then it means that this smid is free at driver level,
+                 * so return NULL.
+                 */
+                if (!mpi_request->DevHandle)
+                        return scmd;
+
                 scmd = scsi_host_find_tag(ioc->shost, unique_tag);
                 if (scmd) {
                         st = scsi_cmd_priv(scmd);
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index 16a18d5d856f..6e4f4931ae17 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -3203,6 +3203,8 @@ static int qla4xxx_conn_bind(struct iscsi_cls_session *cls_session,
         if (iscsi_conn_bind(cls_session, cls_conn, is_leading))
                 return -EINVAL;
         ep = iscsi_lookup_endpoint(transport_fd);
+        if (!ep)
+                return -EINVAL;
         conn = cls_conn->dd_data;
         qla_conn = conn->dd_data;
         qla_conn->qla_ep = ep->dd_data;
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 6a9040faed00..3b119ca0cc0c 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -771,6 +771,12 @@ store_state_field(struct device *dev, struct device_attribute *attr,
 
         mutex_lock(&sdev->state_mutex);
         ret = scsi_device_set_state(sdev, state);
+        /*
+         * If the device state changes to SDEV_RUNNING, we need to run
+         * the queue to avoid I/O hang.
+         */
+        if (ret == 0 && state == SDEV_RUNNING)
+                blk_mq_run_hw_queues(sdev->request_queue, true);
         mutex_unlock(&sdev->state_mutex);
 
         return ret == 0 ? count : -EINVAL;
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 251db30d0882..2b2bc4b49d78 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1415,11 +1415,6 @@ static void sd_release(struct gendisk *disk, fmode_t mode)
                         scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW);
         }
 
-        /*
-         * XXX and what if there are packets in flight and this close()
-         * XXX is followed by a "rmmod sd_mod"?
-         */
-
         scsi_disk_put(sdkp);
 }
 
@@ -3076,6 +3071,9 @@ static bool sd_validate_opt_xfer_size(struct scsi_disk *sdkp,
         unsigned int opt_xfer_bytes =
                 logical_to_bytes(sdp, sdkp->opt_xfer_blocks);
 
+        if (sdkp->opt_xfer_blocks == 0)
+                return false;
+
         if (sdkp->opt_xfer_blocks > dev_max) {
                 sd_first_printk(KERN_WARNING, sdkp,
                                 "Optimal transfer size %u logical blocks " \
@@ -3505,9 +3503,21 @@ static void scsi_disk_release(struct device *dev)
 {
         struct scsi_disk *sdkp = to_scsi_disk(dev);
         struct gendisk *disk = sdkp->disk;
-        
+        struct request_queue *q = disk->queue;
+
         ida_free(&sd_index_ida, sdkp->index);
 
+        /*
+         * Wait until all requests that are in progress have completed.
+         * This is necessary to avoid that e.g. scsi_end_request() crashes
+         * due to clearing the disk->private_data pointer. Wait from inside
+         * scsi_disk_release() instead of from sd_release() to avoid that
+         * freezing and unfreezing the request queue affects user space I/O
+         * in case multiple processes open a /dev/sd... node concurrently.
+         */
+        blk_mq_freeze_queue(q);
+        blk_mq_unfreeze_queue(q);
+
         disk->private_data = NULL;
         put_disk(disk);
         put_device(&sdkp->device->sdev_gendev);
diff --git a/drivers/soc/bcm/bcm2835-power.c b/drivers/soc/bcm/bcm2835-power.c
index 9351349cf0a9..1e0041ec8132 100644
--- a/drivers/soc/bcm/bcm2835-power.c
+++ b/drivers/soc/bcm/bcm2835-power.c
@@ -150,7 +150,12 @@ struct bcm2835_power {
 
 static int bcm2835_asb_enable(struct bcm2835_power *power, u32 reg)
 {
-        u64 start = ktime_get_ns();
+        u64 start;
+
+        if (!reg)
+                return 0;
+
+        start = ktime_get_ns();
 
         /* Enable the module's async AXI bridges. */
         ASB_WRITE(reg, ASB_READ(reg) & ~ASB_REQ_STOP);
@@ -165,7 +170,12 @@ static int bcm2835_asb_enable(struct bcm2835_power *power, u32 reg)
 
 static int bcm2835_asb_disable(struct bcm2835_power *power, u32 reg)
 {
-        u64 start = ktime_get_ns();
+        u64 start;
+
+        if (!reg)
+                return 0;
+
+        start = ktime_get_ns();
 
         /* Enable the module's async AXI bridges. */
         ASB_WRITE(reg, ASB_READ(reg) | ASB_REQ_STOP);
@@ -475,7 +485,7 @@ static int bcm2835_power_pd_power_off(struct generic_pm_domain *domain)
         }
 }
 
-static void
+static int
 bcm2835_init_power_domain(struct bcm2835_power *power,
                           int pd_xlate_index, const char *name)
 {
@@ -483,6 +493,17 @@ bcm2835_init_power_domain(struct bcm2835_power *power,
         struct bcm2835_power_domain *dom = &power->domains[pd_xlate_index];
 
         dom->clk = devm_clk_get(dev->parent, name);
+        if (IS_ERR(dom->clk)) {
+                int ret = PTR_ERR(dom->clk);
+
+                if (ret == -EPROBE_DEFER)
+                        return ret;
+
+                /* Some domains don't have a clk, so make sure that we
+                 * don't deref an error pointer later.
+                 */
+                dom->clk = NULL;
+        }
 
         dom->base.name = name;
         dom->base.power_on = bcm2835_power_pd_power_on;
@@ -495,6 +516,8 @@ bcm2835_init_power_domain(struct bcm2835_power *power,
         pm_genpd_init(&dom->base, NULL, true);
 
         power->pd_xlate.domains[pd_xlate_index] = &dom->base;
+
+        return 0;
 }
 
 /** bcm2835_reset_reset - Resets a block that has a reset line in the
@@ -592,7 +615,7 @@ static int bcm2835_power_probe(struct platform_device *pdev)
                 { BCM2835_POWER_DOMAIN_IMAGE_PERI, BCM2835_POWER_DOMAIN_CAM0 },
                 { BCM2835_POWER_DOMAIN_IMAGE_PERI, BCM2835_POWER_DOMAIN_CAM1 },
         };
-        int ret, i;
+        int ret = 0, i;
         u32 id;
 
         power = devm_kzalloc(dev, sizeof(*power), GFP_KERNEL);
@@ -619,8 +642,11 @@ static int bcm2835_power_probe(struct platform_device *pdev)
 
         power->pd_xlate.num_domains = ARRAY_SIZE(power_domain_names);
 
-        for (i = 0; i < ARRAY_SIZE(power_domain_names); i++)
-                bcm2835_init_power_domain(power, i, power_domain_names[i]);
+        for (i = 0; i < ARRAY_SIZE(power_domain_names); i++) {
+                ret = bcm2835_init_power_domain(power, i, power_domain_names[i]);
+                if (ret)
+                        goto fail;
+        }
 
         for (i = 0; i < ARRAY_SIZE(domain_deps); i++) {
                 pm_genpd_add_subdomain(&power->domains[domain_deps[i].parent].base,
@@ -634,12 +660,21 @@ static int bcm2835_power_probe(struct platform_device *pdev)
 
         ret = devm_reset_controller_register(dev, &power->reset);
         if (ret)
-                return ret;
+                goto fail;
 
         of_genpd_add_provider_onecell(dev->parent->of_node, &power->pd_xlate);
 
         dev_info(dev, "Broadcom BCM2835 power domains driver");
         return 0;
+
+fail:
+        for (i = 0; i < ARRAY_SIZE(power_domain_names); i++) {
+                struct generic_pm_domain *dom = &power->domains[i].base;
+
+                if (dom->name)
+                        pm_genpd_remove(dom);
+        }
+        return ret;
 }
 
 static int bcm2835_power_remove(struct platform_device *pdev)
diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig
index c0901b96cfe4..62951e836cbc 100644
--- a/drivers/staging/Kconfig
+++ b/drivers/staging/Kconfig
@@ -114,8 +114,6 @@ source "drivers/staging/ralink-gdma/Kconfig"
 
 source "drivers/staging/mt7621-mmc/Kconfig"
 
-source "drivers/staging/mt7621-eth/Kconfig"
-
 source "drivers/staging/mt7621-dts/Kconfig"
 
 source "drivers/staging/gasket/Kconfig"
diff --git a/drivers/staging/Makefile b/drivers/staging/Makefile
index 57c6bce13ff4..d1b17ddcd354 100644
--- a/drivers/staging/Makefile
+++ b/drivers/staging/Makefile
@@ -47,7 +47,6 @@ obj-$(CONFIG_SPI_MT7621)	+= mt7621-spi/
 obj-$(CONFIG_SOC_MT7621)        += mt7621-dma/
 obj-$(CONFIG_DMA_RALINK)        += ralink-gdma/
 obj-$(CONFIG_MTK_MMC)           += mt7621-mmc/
-obj-$(CONFIG_NET_MEDIATEK_SOC_STAGING)  += mt7621-eth/
 obj-$(CONFIG_SOC_MT7621)        += mt7621-dts/
 obj-$(CONFIG_STAGING_GASKET_FRAMEWORK)  += gasket/
 obj-$(CONFIG_XIL_AXIS_FIFO)     += axis-fifo/
diff --git a/drivers/staging/axis-fifo/Kconfig b/drivers/staging/axis-fifo/Kconfig
index 687537203d9c..d9725888af6f 100644
--- a/drivers/staging/axis-fifo/Kconfig
+++ b/drivers/staging/axis-fifo/Kconfig
@@ -3,6 +3,7 @@
 #
 config XIL_AXIS_FIFO
         tristate "Xilinx AXI-Stream FIFO IP core driver"
+        depends on OF
         default n
         help
           This adds support for the Xilinx AXI-Stream
diff --git a/drivers/staging/comedi/comedidev.h b/drivers/staging/comedi/comedidev.h
index a7d569cfca5d..0dff1ac057cd 100644
--- a/drivers/staging/comedi/comedidev.h
+++ b/drivers/staging/comedi/comedidev.h
@@ -1001,6 +1001,8 @@ int comedi_dio_insn_config(struct comedi_device *dev,
                            unsigned int mask);
 unsigned int comedi_dio_update_state(struct comedi_subdevice *s,
                                      unsigned int *data);
+unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s,
+                                       struct comedi_cmd *cmd);
 unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s);
 unsigned int comedi_nscans_left(struct comedi_subdevice *s,
                                 unsigned int nscans);
diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index eefa62f42c0f..5a32b8fc000e 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -394,11 +394,13 @@ unsigned int comedi_dio_update_state(struct comedi_subdevice *s,
 EXPORT_SYMBOL_GPL(comedi_dio_update_state);
 
 /**
- * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes
+ * comedi_bytes_per_scan_cmd() - Get length of asynchronous command "scan" in
+ * bytes
  * @s: COMEDI subdevice.
+ * @cmd: COMEDI command.
  *
  * Determines the overall scan length according to the subdevice type and the
- * number of channels in the scan.
+ * number of channels in the scan for the specified command.
  *
  * For digital input, output or input/output subdevices, samples for
  * multiple channels are assumed to be packed into one or more unsigned
@@ -408,9 +410,9 @@ EXPORT_SYMBOL_GPL(comedi_dio_update_state);
  *
  * Returns the overall scan length in bytes.
  */
-unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s)
+unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s,
+                                       struct comedi_cmd *cmd)
 {
-        struct comedi_cmd *cmd = &s->async->cmd;
         unsigned int num_samples;
         unsigned int bits_per_sample;
 
@@ -427,6 +429,29 @@ unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s)
         }
         return comedi_samples_to_bytes(s, num_samples);
 }
+EXPORT_SYMBOL_GPL(comedi_bytes_per_scan_cmd);
+
+/**
+ * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes
+ * @s: COMEDI subdevice.
+ *
+ * Determines the overall scan length according to the subdevice type and the
+ * number of channels in the scan for the current command.
+ *
+ * For digital input, output or input/output subdevices, samples for
+ * multiple channels are assumed to be packed into one or more unsigned
+ * short or unsigned int values according to the subdevice's %SDF_LSAMPL
+ * flag.  For other types of subdevice, samples are assumed to occupy a
+ * whole unsigned short or unsigned int according to the %SDF_LSAMPL flag.
+ *
+ * Returns the overall scan length in bytes.
+ */
+unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s)
+{
+        struct comedi_cmd *cmd = &s->async->cmd;
+
+        return comedi_bytes_per_scan_cmd(s, cmd);
+}
 EXPORT_SYMBOL_GPL(comedi_bytes_per_scan);
 
 static unsigned int __comedi_nscans_left(struct comedi_subdevice *s,
diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
index 5edf59ac6706..b04dad8c7092 100644
--- a/drivers/staging/comedi/drivers/ni_mio_common.c
+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
@@ -3545,6 +3545,7 @@ static int ni_cdio_cmdtest(struct comedi_device *dev,
                            struct comedi_subdevice *s, struct comedi_cmd *cmd)
 {
         struct ni_private *devpriv = dev->private;
+        unsigned int bytes_per_scan;
         int err = 0;
 
         /* Step 1 : check if triggers are trivially valid */
@@ -3579,9 +3580,12 @@ static int ni_cdio_cmdtest(struct comedi_device *dev,
         err |= comedi_check_trigger_arg_is(&cmd->convert_arg, 0);
         err |= comedi_check_trigger_arg_is(&cmd->scan_end_arg,
                                            cmd->chanlist_len);
-        err |= comedi_check_trigger_arg_max(&cmd->stop_arg,
-                                            s->async->prealloc_bufsz /
-                                            comedi_bytes_per_scan(s));
+        bytes_per_scan = comedi_bytes_per_scan_cmd(s, cmd);
+        if (bytes_per_scan) {
+                err |= comedi_check_trigger_arg_max(&cmd->stop_arg,
+                                                    s->async->prealloc_bufsz /
+                                                    bytes_per_scan);
+        }
 
         if (err)
                 return 3;
diff --git a/drivers/staging/erofs/dir.c b/drivers/staging/erofs/dir.c
index 829f7b12e0dc..9bbc68729c11 100644
--- a/drivers/staging/erofs/dir.c
+++ b/drivers/staging/erofs/dir.c
@@ -23,6 +23,21 @@ static const unsigned char erofs_filetype_table[EROFS_FT_MAX] = {
         [EROFS_FT_SYMLINK]      = DT_LNK,
 };
 
+static void debug_one_dentry(unsigned char d_type, const char *de_name,
+                             unsigned int de_namelen)
+{
+#ifdef CONFIG_EROFS_FS_DEBUG
+        /* since the on-disk name could not have the trailing '\0' */
+        unsigned char dbg_namebuf[EROFS_NAME_LEN + 1];
+
+        memcpy(dbg_namebuf, de_name, de_namelen);
+        dbg_namebuf[de_namelen] = '\0';
+
+        debugln("found dirent %s de_len %u d_type %d", dbg_namebuf,
+                de_namelen, d_type);
+#endif
+}
+
 static int erofs_fill_dentries(struct dir_context *ctx,
                                void *dentry_blk, unsigned int *ofs,
                                unsigned int nameoff, unsigned int maxsize)
@@ -33,14 +48,10 @@ static int erofs_fill_dentries(struct dir_context *ctx,
         de = dentry_blk + *ofs;
         while (de < end) {
                 const char *de_name;
-                int de_namelen;
+                unsigned int de_namelen;
                 unsigned char d_type;
-#ifdef CONFIG_EROFS_FS_DEBUG
-                unsigned int dbg_namelen;
-                unsigned char dbg_namebuf[EROFS_NAME_LEN];
-#endif
 
-                if (unlikely(de->file_type < EROFS_FT_MAX))
+                if (de->file_type < EROFS_FT_MAX)
                         d_type = erofs_filetype_table[de->file_type];
                 else
                         d_type = DT_UNKNOWN;
@@ -48,26 +59,20 @@ static int erofs_fill_dentries(struct dir_context *ctx,
                 nameoff = le16_to_cpu(de->nameoff);
                 de_name = (char *)dentry_blk + nameoff;
 
-                de_namelen = unlikely(de + 1 >= end) ?
-                        /* last directory entry */
-                        strnlen(de_name, maxsize - nameoff) :
-                        le16_to_cpu(de[1].nameoff) - nameoff;
+                /* the last dirent in the block? */
+                if (de + 1 >= end)
+                        de_namelen = strnlen(de_name, maxsize - nameoff);
+                else
+                        de_namelen = le16_to_cpu(de[1].nameoff) - nameoff;
 
                 /* a corrupted entry is found */
-                if (unlikely(de_namelen < 0)) {
+                if (unlikely(nameoff + de_namelen > maxsize ||
+                             de_namelen > EROFS_NAME_LEN)) {
                         DBG_BUGON(1);
                         return -EIO;
                 }
 
-#ifdef CONFIG_EROFS_FS_DEBUG
-                dbg_namelen = min(EROFS_NAME_LEN - 1, de_namelen);
-                memcpy(dbg_namebuf, de_name, dbg_namelen);
-                dbg_namebuf[dbg_namelen] = '\0';
-
-                debugln("%s, found de_name %s de_len %d d_type %d", __func__,
-                        dbg_namebuf, de_namelen, d_type);
-#endif
-
+                debug_one_dentry(d_type, de_name, de_namelen);
                 if (!dir_emit(ctx, de_name, de_namelen,
                               le64_to_cpu(de->nid), d_type))
                         /* stopped by some reason */
diff --git a/drivers/staging/erofs/unzip_vle.c b/drivers/staging/erofs/unzip_vle.c
index 8715bc50e09c..31eef8395774 100644
--- a/drivers/staging/erofs/unzip_vle.c
+++ b/drivers/staging/erofs/unzip_vle.c
@@ -972,6 +972,7 @@ repeat:
         overlapped = false;
         compressed_pages = grp->compressed_pages;
 
+        err = 0;
         for (i = 0; i < clusterpages; ++i) {
                 unsigned int pagenr;
 
@@ -981,26 +982,39 @@ repeat:
                 DBG_BUGON(!page);
                 DBG_BUGON(!page->mapping);
 
-                if (z_erofs_is_stagingpage(page))
-                        continue;
+                if (!z_erofs_is_stagingpage(page)) {
 #ifdef EROFS_FS_HAS_MANAGED_CACHE
-                if (page->mapping == MNGD_MAPPING(sbi)) {
-                        DBG_BUGON(!PageUptodate(page));
-                        continue;
-                }
+                        if (page->mapping == MNGD_MAPPING(sbi)) {
+                                if (unlikely(!PageUptodate(page)))
+                                        err = -EIO;
+                                continue;
+                        }
 #endif
 
-                /* only non-head page could be reused as a compressed page */
-                pagenr = z_erofs_onlinepage_index(page);
+                        /*
+                         * only if non-head page can be selected
+                         * for inplace decompression
+                         */
+                        pagenr = z_erofs_onlinepage_index(page);
 
-                DBG_BUGON(pagenr >= nr_pages);
-                DBG_BUGON(pages[pagenr]);
-                ++sparsemem_pages;
-                pages[pagenr] = page;
+                        DBG_BUGON(pagenr >= nr_pages);
+                        DBG_BUGON(pages[pagenr]);
+                        ++sparsemem_pages;
+                        pages[pagenr] = page;
 
-                overlapped = true;
+                        overlapped = true;
+                }
+
+                /* PG_error needs checking for inplaced and staging pages */
+                if (unlikely(PageError(page))) {
+                        DBG_BUGON(PageUptodate(page));
+                        err = -EIO;
+                }
         }
 
+        if (unlikely(err))
+                goto out;
+
         llen = (nr_pages << PAGE_SHIFT) - work->pageofs;
 
         if (z_erofs_vle_workgrp_fmt(grp) == Z_EROFS_VLE_WORKGRP_FMT_PLAIN) {
@@ -1029,6 +1043,10 @@ repeat:
 
 skip_allocpage:
         vout = erofs_vmap(pages, nr_pages);
+        if (!vout) {
+                err = -ENOMEM;
+                goto out;
+        }
 
         err = z_erofs_vle_unzip_vmap(compressed_pages,
                 clusterpages, vout, llen, work->pageofs, overlapped);
@@ -1194,6 +1212,7 @@ repeat:
         if (page->mapping == mc) {
                 WRITE_ONCE(grp->compressed_pages[nr], page);
 
+                ClearPageError(page);
                 if (!PagePrivate(page)) {
                         /*
                          * impossible to be !PagePrivate(page) for
diff --git a/drivers/staging/erofs/unzip_vle_lz4.c b/drivers/staging/erofs/unzip_vle_lz4.c
index 48b263a2731a..0daac9b984a8 100644
--- a/drivers/staging/erofs/unzip_vle_lz4.c
+++ b/drivers/staging/erofs/unzip_vle_lz4.c
@@ -136,10 +136,13 @@ int z_erofs_vle_unzip_fast_percpu(struct page **compressed_pages,
 
         nr_pages = DIV_ROUND_UP(outlen + pageofs, PAGE_SIZE);
 
-        if (clusterpages == 1)
+        if (clusterpages == 1) {
                 vin = kmap_atomic(compressed_pages[0]);
-        else
+        } else {
                 vin = erofs_vmap(compressed_pages, clusterpages);
+                if (!vin)
+                        return -ENOMEM;
+        }
 
         preempt_disable();
         vout = erofs_pcpubuf[smp_processor_id()].data;
diff --git a/drivers/staging/mt7621-dts/gbpc1.dts b/drivers/staging/mt7621-dts/gbpc1.dts
index b73385540216..250c15ace2a7 100644
--- a/drivers/staging/mt7621-dts/gbpc1.dts
+++ b/drivers/staging/mt7621-dts/gbpc1.dts
@@ -117,22 +117,6 @@
         status = "okay";
 };
 
-&ethernet {
-        //mtd-mac-address = <&factory 0xe000>;
-        gmac1: mac@0 {
-                compatible = "mediatek,eth-mac";
-                reg = <0>;
-                phy-handle = <&phy1>;
-        };
-
-        mdio-bus {
-                phy1: ethernet-phy@1 {
-                        reg = <1>;
-                        phy-mode = "rgmii";
-                };
-        };
-};
-
 &pinctrl {
         state_default: pinctrl0 {
                 gpio {
@@ -141,3 +125,16 @@
                 };
         };
 };
+
+&switch0 {
+        ports {
+                port@0 {
+                        label = "ethblack";
+                        status = "ok";
+                };
+                port@4 {
+                        label = "ethblue";
+                        status = "ok";
+                };
+        };
+};
diff --git a/drivers/staging/mt7621-dts/mt7621.dtsi b/drivers/staging/mt7621-dts/mt7621.dtsi
index 6aff3680ce4b..17020e24abd2 100644
--- a/drivers/staging/mt7621-dts/mt7621.dtsi
+++ b/drivers/staging/mt7621-dts/mt7621.dtsi
@@ -372,16 +372,83 @@
 
                 mediatek,ethsys = <&ethsys>;
 
-                mediatek,switch = <&gsw>;
 
+                gmac0: mac@0 {
+                        compatible = "mediatek,eth-mac";
+                        reg = <0>;
+                        phy-mode = "rgmii";
+                        fixed-link {
+                                speed = <1000>;
+                                full-duplex;
+                                pause;
+                        };
+                };
+                gmac1: mac@1 {
+                        compatible = "mediatek,eth-mac";
+                        reg = <1>;
+                        status = "off";
+                        phy-mode = "rgmii";
+                        phy-handle = <&phy5>;
+                };
                 mdio-bus {
                         #address-cells = <1>;
                         #size-cells = <0>;
 
-                        phy1f: ethernet-phy@1f {
-                                reg = <0x1f>;
+                        phy5: ethernet-phy@5 {
+                                reg = <5>;
                                 phy-mode = "rgmii";
                         };
+
+                        switch0: switch0@0 {
+                                compatible = "mediatek,mt7621";
+                                #address-cells = <1>;
+                                #size-cells = <0>;
+                                reg = <0>;
+                                mediatek,mcm;
+                                resets = <&rstctrl 2>;
+                                reset-names = "mcm";
+
+                                ports {
+                                        #address-cells = <1>;
+                                        #size-cells = <0>;
+                                        reg = <0>;
+                                        port@0 {
+                                                status = "off";
+                                                reg = <0>;
+                                                label = "lan0";
+                                        };
+                                        port@1 {
+                                                status = "off";
+                                                reg = <1>;
+                                                label = "lan1";
+                                        };
+                                        port@2 {
+                                                status = "off";
+                                                reg = <2>;
+                                                label = "lan2";
+                                        };
+                                        port@3 {
+                                                status = "off";
+                                                reg = <3>;
+                                                label = "lan3";
+                                        };
+                                        port@4 {
+                                                status = "off";
+                                                reg = <4>;
+                                                label = "lan4";
+                                        };
+                                        port@6 {
+                                                reg = <6>;
+                                                label = "cpu";
+                                                ethernet = <&gmac0>;
+                                                phy-mode = "trgmii";
+                                                fixed-link {
+                                                        speed = <1000>;
+                                                        full-duplex;
+                                                };
+                                        };
+                                };
+                        };
                 };
         };
 
diff --git a/drivers/staging/mt7621-eth/Documentation/devicetree/bindings/net/mediatek-net-gsw.txt b/drivers/staging/mt7621-eth/Documentation/devicetree/bindings/net/mediatek-net-gsw.txt
deleted file mode 100644
index 596b38552697..000000000000
--- a/drivers/staging/mt7621-eth/Documentation/devicetree/bindings/net/mediatek-net-gsw.txt
+++ /dev/null
@@ -1,48 +0,0 @@
-Mediatek Gigabit Switch
-=======================
-
-The mediatek gigabit switch can be found on Mediatek SoCs.
-
-Required properties:
-- compatible: Should be "mediatek,mt7620-gsw", "mediatek,mt7621-gsw",
-  "mediatek,mt7623-gsw"
-- reg: Address and length of the register set for the device
-- interrupts: Should contain the gigabit switches interrupt
-
-
-Additional required properties for ARM based SoCs:
-- mediatek,reset-pin: phandle describing the reset GPIO
-- clocks: the clocks used by the switch
-- clock-names: the names of the clocks listed in the clocks property
-  these should be "trgpll", "esw", "gp2", "gp1"
-- mt7530-supply: the phandle of the regulator used to power the switch
-- mediatek,pctl-regmap: phandle to the port control regmap. this is used to
-  setup the drive current
-
-
-Optional properties:
-- interrupt-parent: Should be the phandle for the interrupt controller
-  that services interrupts for this device
-
-Example:
-
-gsw: switch@1b100000 {
-        compatible = "mediatek,mt7623-gsw";
-        reg = <0 0x1b110000 0 0x300000>;
-
-        interrupt-parent = <&pio>;
-        interrupts = <168 IRQ_TYPE_EDGE_RISING>;
-
-        clocks = <&apmixedsys CLK_APMIXED_TRGPLL>,
-                 <&ethsys CLK_ETHSYS_ESW>,
-                 <&ethsys CLK_ETHSYS_GP2>,
-                 <&ethsys CLK_ETHSYS_GP1>;
-        clock-names = "trgpll", "esw", "gp2", "gp1";
-
-        mt7530-supply = <&mt6323_vpa_reg>;
-
-        mediatek,pctl-regmap = <&syscfg_pctl_a>;
-        mediatek,reset-pin = <&pio 15 0>;
-
-        status = "okay";
-};
diff --git a/drivers/staging/mt7621-eth/Kconfig b/drivers/staging/mt7621-eth/Kconfig
deleted file mode 100644
index 44ea86c7a96c..000000000000
--- a/drivers/staging/mt7621-eth/Kconfig
+++ /dev/null
@@ -1,39 +0,0 @@
-config NET_VENDOR_MEDIATEK_STAGING
-        bool "MediaTek ethernet driver - staging version"
-        depends on RALINK
-        ---help---
-          If you have an MT7621 Mediatek SoC with ethernet, say Y.
-
-if NET_VENDOR_MEDIATEK_STAGING
-choice
-        prompt "MAC type"
-
-config NET_MEDIATEK_MT7621
-        bool "MT7621"
-        depends on MIPS && SOC_MT7621
-
-endchoice
-
-config NET_MEDIATEK_SOC_STAGING
-        tristate "MediaTek SoC Gigabit Ethernet support"
-        depends on NET_VENDOR_MEDIATEK_STAGING
-        select PHYLIB
-        ---help---
-          This driver supports the gigabit ethernet MACs in the
-          MediaTek SoC family.
-
-config NET_MEDIATEK_MDIO
-        def_bool NET_MEDIATEK_SOC_STAGING
-        depends on NET_MEDIATEK_MT7621
-        select PHYLIB
-
-config NET_MEDIATEK_MDIO_MT7620
-        def_bool NET_MEDIATEK_SOC_STAGING
-        depends on NET_MEDIATEK_MT7621
-        select NET_MEDIATEK_MDIO
-
-config NET_MEDIATEK_GSW_MT7621
-        def_tristate NET_MEDIATEK_SOC_STAGING
-        depends on NET_MEDIATEK_MT7621
-
-endif #NET_VENDOR_MEDIATEK_STAGING
diff --git a/drivers/staging/mt7621-eth/Makefile b/drivers/staging/mt7621-eth/Makefile
deleted file mode 100644
index 018bcc3596b3..000000000000
--- a/drivers/staging/mt7621-eth/Makefile
+++ /dev/null
@@ -1,14 +0,0 @@
-#
-# Makefile for the Ralink SoCs built-in ethernet macs
-#
-
-mtk-eth-soc-y                                   += mtk_eth_soc.o ethtool.o
-
-mtk-eth-soc-$(CONFIG_NET_MEDIATEK_MDIO)         += mdio.o
-mtk-eth-soc-$(CONFIG_NET_MEDIATEK_MDIO_MT7620)  += mdio_mt7620.o
-
-mtk-eth-soc-$(CONFIG_NET_MEDIATEK_MT7621)       += soc_mt7621.o
-
-obj-$(CONFIG_NET_MEDIATEK_GSW_MT7621)           += gsw_mt7621.o
-
-obj-$(CONFIG_NET_MEDIATEK_SOC_STAGING)          += mtk-eth-soc.o
diff --git a/drivers/staging/mt7621-eth/TODO b/drivers/staging/mt7621-eth/TODO
deleted file mode 100644
index f9e47d4b4cd4..000000000000
--- a/drivers/staging/mt7621-eth/TODO
+++ /dev/null
@@ -1,13 +0,0 @@
-
-- verify devicetree documentation is consistent with code
-- fix ethtool - currently doesn't return valid data.
-- general code review and clean up
-- add support for second MAC on mt7621
-- convert gsw code to use switchdev interfaces
-- md7620_mmi_write etc should probably be wrapped
-  in a regmap abstraction.
-- Get soc_mt7621 to work with QDMA TX if possible.
-- Ensure phys are correctly configured when a cable
-  is plugged in.
-
-Cc: NeilBrown <neil@brown.name>
diff --git a/drivers/staging/mt7621-eth/ethtool.c b/drivers/staging/mt7621-eth/ethtool.c
deleted file mode 100644
index 8c4228e2c987..000000000000
--- a/drivers/staging/mt7621-eth/ethtool.c
+++ /dev/null
@@ -1,250 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*   This program is free software; you can redistribute it and/or modify
- *   it under the terms of the GNU General Public License as published by
- *   the Free Software Foundation; version 2 of the License
- *
- *   This program is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *   GNU General Public License for more details.
- *
- *   Copyright (C) 2009-2016 John Crispin <blogic@openwrt.org>
- *   Copyright (C) 2009-2016 Felix Fietkau <nbd@openwrt.org>
- *   Copyright (C) 2013-2016 Michael Lee <igvtee@gmail.com>
- */
-
-#include "mtk_eth_soc.h"
-#include "ethtool.h"
-
-struct mtk_stat {
-        char name[ETH_GSTRING_LEN];
-        unsigned int idx;
-};
-
-#define MTK_HW_STAT(stat) { \
-        .name = #stat, \
-        .idx = offsetof(struct mtk_hw_stats, stat) / sizeof(u64) \
-}
-
-static const struct mtk_stat mtk_ethtool_hw_stats[] = {
-        MTK_HW_STAT(tx_bytes),
-        MTK_HW_STAT(tx_packets),
-        MTK_HW_STAT(tx_skip),
-        MTK_HW_STAT(tx_collisions),
-        MTK_HW_STAT(rx_bytes),
-        MTK_HW_STAT(rx_packets),
-        MTK_HW_STAT(rx_overflow),
-        MTK_HW_STAT(rx_fcs_errors),
-        MTK_HW_STAT(rx_short_errors),
-        MTK_HW_STAT(rx_long_errors),
-        MTK_HW_STAT(rx_checksum_errors),
-        MTK_HW_STAT(rx_flow_control_packets),
-};
-
-#define MTK_HW_STATS_LEN        ARRAY_SIZE(mtk_ethtool_hw_stats)
-
-static int mtk_get_link_ksettings(struct net_device *dev,
-                                  struct ethtool_link_ksettings *cmd)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        int err;
-
-        if (!mac->phy_dev)
-                return -ENODEV;
-
-        if (mac->phy_flags == MTK_PHY_FLAG_ATTACH) {
-                err = phy_read_status(mac->phy_dev);
-                if (err)
-                        return -ENODEV;
-        }
-
-        phy_ethtool_ksettings_get(mac->phy_dev, cmd);
-        return 0;
-}
-
-static int mtk_set_link_ksettings(struct net_device *dev,
-                                  const struct ethtool_link_ksettings *cmd)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-
-        if (!mac->phy_dev)
-                return -ENODEV;
-
-        if (cmd->base.phy_address != mac->phy_dev->mdio.addr) {
-                if (mac->hw->phy->phy_node[cmd->base.phy_address]) {
-                        mac->phy_dev = mac->hw->phy->phy[cmd->base.phy_address];
-                        mac->phy_flags = MTK_PHY_FLAG_PORT;
-                } else if (mac->hw->mii_bus) {
-                        mac->phy_dev = mdiobus_get_phy(mac->hw->mii_bus,
-                                                       cmd->base.phy_address);
-                        if (!mac->phy_dev)
-                                return -ENODEV;
-                        mac->phy_flags = MTK_PHY_FLAG_ATTACH;
-                } else {
-                        return -ENODEV;
-                }
-        }
-
-        return phy_ethtool_ksettings_set(mac->phy_dev, cmd);
-}
-
-static void mtk_get_drvinfo(struct net_device *dev,
-                            struct ethtool_drvinfo *info)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        struct mtk_soc_data *soc = mac->hw->soc;
-
-        strlcpy(info->driver, mac->hw->dev->driver->name, sizeof(info->driver));
-        strlcpy(info->bus_info, dev_name(mac->hw->dev), sizeof(info->bus_info));
-
-        if (soc->reg_table[MTK_REG_MTK_COUNTER_BASE])
-                info->n_stats = MTK_HW_STATS_LEN;
-}
-
-static u32 mtk_get_msglevel(struct net_device *dev)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-
-        return mac->hw->msg_enable;
-}
-
-static void mtk_set_msglevel(struct net_device *dev, u32 value)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-
-        mac->hw->msg_enable = value;
-}
-
-static int mtk_nway_reset(struct net_device *dev)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-
-        if (!mac->phy_dev)
-                return -EOPNOTSUPP;
-
-        return genphy_restart_aneg(mac->phy_dev);
-}
-
-static u32 mtk_get_link(struct net_device *dev)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        int err;
-
-        if (!mac->phy_dev)
-                goto out_get_link;
-
-        if (mac->phy_flags == MTK_PHY_FLAG_ATTACH) {
-                err = genphy_update_link(mac->phy_dev);
-                if (err)
-                        goto out_get_link;
-        }
-
-        return mac->phy_dev->link;
-
-out_get_link:
-        return ethtool_op_get_link(dev);
-}
-
-static int mtk_set_ringparam(struct net_device *dev,
-                             struct ethtool_ringparam *ring)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-
-        if ((ring->tx_pending < 2) ||
-            (ring->rx_pending < 2) ||
-            (ring->rx_pending > mac->hw->soc->dma_ring_size) ||
-            (ring->tx_pending > mac->hw->soc->dma_ring_size))
-                return -EINVAL;
-
-        dev->netdev_ops->ndo_stop(dev);
-
-        mac->hw->tx_ring.tx_ring_size = BIT(fls(ring->tx_pending) - 1);
-        mac->hw->rx_ring[0].rx_ring_size = BIT(fls(ring->rx_pending) - 1);
-
-        return dev->netdev_ops->ndo_open(dev);
-}
-
-static void mtk_get_ringparam(struct net_device *dev,
-                              struct ethtool_ringparam *ring)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-
-        ring->rx_max_pending = mac->hw->soc->dma_ring_size;
-        ring->tx_max_pending = mac->hw->soc->dma_ring_size;
-        ring->rx_pending = mac->hw->rx_ring[0].rx_ring_size;
-        ring->tx_pending = mac->hw->tx_ring.tx_ring_size;
-}
-
-static void mtk_get_strings(struct net_device *dev, u32 stringset, u8 *data)
-{
-        int i;
-
-        switch (stringset) {
-        case ETH_SS_STATS:
-                for (i = 0; i < MTK_HW_STATS_LEN; i++) {
-                        memcpy(data, mtk_ethtool_hw_stats[i].name,
-                               ETH_GSTRING_LEN);
-                        data += ETH_GSTRING_LEN;
-                }
-                break;
-        }
-}
-
-static int mtk_get_sset_count(struct net_device *dev, int sset)
-{
-        switch (sset) {
-        case ETH_SS_STATS:
-                return MTK_HW_STATS_LEN;
-        default:
-                return -EOPNOTSUPP;
-        }
-}
-
-static void mtk_get_ethtool_stats(struct net_device *dev,
-                                  struct ethtool_stats *stats, u64 *data)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        struct mtk_hw_stats *hwstats = mac->hw_stats;
-        unsigned int start;
-        int i;
-
-        if (netif_running(dev) && netif_device_present(dev)) {
-                if (spin_trylock(&hwstats->stats_lock)) {
-                        mtk_stats_update_mac(mac);
-                        spin_unlock(&hwstats->stats_lock);
-                }
-        }
-
-        do {
-                start = u64_stats_fetch_begin_irq(&hwstats->syncp);
-                for (i = 0; i < MTK_HW_STATS_LEN; i++)
-                        data[i] = ((u64 *)hwstats)[mtk_ethtool_hw_stats[i].idx];
-
-        } while (u64_stats_fetch_retry_irq(&hwstats->syncp, start));
-}
-
-static struct ethtool_ops mtk_ethtool_ops = {
-        .get_link_ksettings     = mtk_get_link_ksettings,
-        .set_link_ksettings     = mtk_set_link_ksettings,
-        .get_drvinfo            = mtk_get_drvinfo,
-        .get_msglevel           = mtk_get_msglevel,
-        .set_msglevel           = mtk_set_msglevel,
-        .nway_reset             = mtk_nway_reset,
-        .get_link               = mtk_get_link,
-        .set_ringparam          = mtk_set_ringparam,
-        .get_ringparam          = mtk_get_ringparam,
-};
-
-void mtk_set_ethtool_ops(struct net_device *netdev)
-{
-        struct mtk_mac *mac = netdev_priv(netdev);
-        struct mtk_soc_data *soc = mac->hw->soc;
-
-        if (soc->reg_table[MTK_REG_MTK_COUNTER_BASE]) {
-                mtk_ethtool_ops.get_strings = mtk_get_strings;
-                mtk_ethtool_ops.get_sset_count = mtk_get_sset_count;
-                mtk_ethtool_ops.get_ethtool_stats = mtk_get_ethtool_stats;
-        }
-
-        netdev->ethtool_ops = &mtk_ethtool_ops;
-}
diff --git a/drivers/staging/mt7621-eth/ethtool.h b/drivers/staging/mt7621-eth/ethtool.h
deleted file mode 100644
index 0071469aea6c..000000000000
--- a/drivers/staging/mt7621-eth/ethtool.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/*
- *   Copyright (C) 2009-2016 John Crispin <blogic@openwrt.org>
- *   Copyright (C) 2009-2016 Felix Fietkau <nbd@openwrt.org>
- *   Copyright (C) 2013-2016 Michael Lee <igvtee@gmail.com>
- */
-
-#ifndef MTK_ETHTOOL_H
-#define MTK_ETHTOOL_H
-
-#include <linux/ethtool.h>
-
-void mtk_set_ethtool_ops(struct net_device *netdev);
-
-#endif /* MTK_ETHTOOL_H */
diff --git a/drivers/staging/mt7621-eth/gsw_mt7620.h b/drivers/staging/mt7621-eth/gsw_mt7620.h
deleted file mode 100644
index 70f7e5481952..000000000000
--- a/drivers/staging/mt7621-eth/gsw_mt7620.h
+++ /dev/null
@@ -1,277 +0,0 @@
-/*   This program is free software; you can redistribute it and/or modify
- *   it under the terms of the GNU General Public License as published by
- *   the Free Software Foundation; version 2 of the License
- *
- *   This program is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *   GNU General Public License for more details.
- *
- *   Copyright (C) 2009-2016 John Crispin <blogic@openwrt.org>
- *   Copyright (C) 2009-2016 Felix Fietkau <nbd@openwrt.org>
- *   Copyright (C) 2013-2016 Michael Lee <igvtee@gmail.com>
- */
-
-#ifndef _RALINK_GSW_MT7620_H__
-#define _RALINK_GSW_MT7620_H__
-
-#define GSW_REG_PHY_TIMEOUT     (5 * HZ)
-
-#define MT7620_GSW_REG_PIAC     0x0004
-
-#define GSW_NUM_VLANS           16
-#define GSW_NUM_VIDS            4096
-#define GSW_NUM_PORTS           7
-#define GSW_PORT6               6
-
-#define GSW_MDIO_ACCESS         BIT(31)
-#define GSW_MDIO_READ           BIT(19)
-#define GSW_MDIO_WRITE          BIT(18)
-#define GSW_MDIO_START          BIT(16)
-#define GSW_MDIO_ADDR_SHIFT     20
-#define GSW_MDIO_REG_SHIFT      25
-
-#define GSW_REG_PORT_PMCR(x)    (0x3000 + (x * 0x100))
-#define GSW_REG_PORT_STATUS(x)  (0x3008 + (x * 0x100))
-#define GSW_REG_SMACCR0         0x3fE4
-#define GSW_REG_SMACCR1         0x3fE8
-#define GSW_REG_CKGCR           0x3ff0
-
-#define GSW_REG_IMR             0x7008
-#define GSW_REG_ISR             0x700c
-#define GSW_REG_GPC1            0x7014
-
-#define SYSC_REG_CHIP_REV_ID    0x0c
-#define SYSC_REG_CFG            0x10
-#define SYSC_REG_CFG1           0x14
-#define RST_CTRL_MCM            BIT(2)
-#define SYSC_PAD_RGMII2_MDIO    0x58
-#define SYSC_GPIO_MODE          0x60
-
-#define PORT_IRQ_ST_CHG         0x7f
-
-#define MT7621_ESW_PHY_POLLING  0x0000
-#define MT7620_ESW_PHY_POLLING  0x7000
-
-#define PMCR_IPG                BIT(18)
-#define PMCR_MAC_MODE           BIT(16)
-#define PMCR_FORCE              BIT(15)
-#define PMCR_TX_EN              BIT(14)
-#define PMCR_RX_EN              BIT(13)
-#define PMCR_BACKOFF            BIT(9)
-#define PMCR_BACKPRES           BIT(8)
-#define PMCR_RX_FC              BIT(5)
-#define PMCR_TX_FC              BIT(4)
-#define PMCR_SPEED(_x)          (_x << 2)
-#define PMCR_DUPLEX             BIT(1)
-#define PMCR_LINK               BIT(0)
-
-#define PHY_AN_EN               BIT(31)
-#define PHY_PRE_EN              BIT(30)
-#define PMY_MDC_CONF(_x)        ((_x & 0x3f) << 24)
-
-/* ethernet subsystem config register */
-#define ETHSYS_SYSCFG0          0x14
-/* ethernet subsystem clock register */
-#define ETHSYS_CLKCFG0          0x2c
-#define ETHSYS_TRGMII_CLK_SEL362_5      BIT(11)
-
-/* p5 RGMII wrapper TX clock control register */
-#define MT7530_P5RGMIITXCR      0x7b04
-/* p5 RGMII wrapper RX clock control register */
-#define MT7530_P5RGMIIRXCR      0x7b00
-/* TRGMII TDX ODT registers */
-#define MT7530_TRGMII_TD0_ODT   0x7a54
-#define MT7530_TRGMII_TD1_ODT   0x7a5c
-#define MT7530_TRGMII_TD2_ODT   0x7a64
-#define MT7530_TRGMII_TD3_ODT   0x7a6c
-#define MT7530_TRGMII_TD4_ODT   0x7a74
-#define MT7530_TRGMII_TD5_ODT   0x7a7c
-/* TRGMII TCK ctrl register */
-#define MT7530_TRGMII_TCK_CTRL  0x7a78
-/* TRGMII Tx ctrl register */
-#define MT7530_TRGMII_TXCTRL    0x7a40
-/* port 6 extended control register */
-#define MT7530_P6ECR            0x7830
-/* IO driver control register */
-#define MT7530_IO_DRV_CR        0x7810
-/* top signal control register */
-#define MT7530_TOP_SIG_CTRL     0x7808
-/* modified hwtrap register */
-#define MT7530_MHWTRAP          0x7804
-/* hwtrap status register */
-#define MT7530_HWTRAP           0x7800
-/* status interrupt register */
-#define MT7530_SYS_INT_STS      0x700c
-/* system nterrupt register */
-#define MT7530_SYS_INT_EN       0x7008
-/* system control register */
-#define MT7530_SYS_CTRL         0x7000
-/* port MAC status register */
-#define MT7530_PMSR_P(x)        (0x3008 + (x * 0x100))
-/* port MAC control register */
-#define MT7530_PMCR_P(x)        (0x3000 + (x * 0x100))
-
-#define MT7621_XTAL_SHIFT       6
-#define MT7621_XTAL_MASK        0x7
-#define MT7621_XTAL_25          6
-#define MT7621_XTAL_40          3
-#define MT7621_MDIO_DRV_MASK    (3 << 4)
-#define MT7621_GE1_MODE_MASK    (3 << 12)
-
-#define TRGMII_TXCTRL_TXC_INV   BIT(30)
-#define P6ECR_INTF_MODE_RGMII   BIT(1)
-#define P5RGMIIRXCR_C_ALIGN     BIT(8)
-#define P5RGMIIRXCR_DELAY_2     BIT(1)
-#define P5RGMIITXCR_DELAY_2     (BIT(8) | BIT(2))
-
-/* TOP_SIG_CTRL bits */
-#define TOP_SIG_CTRL_NORMAL     (BIT(17) | BIT(16))
-
-/* MHWTRAP bits */
-#define MHWTRAP_MANUAL          BIT(16)
-#define MHWTRAP_P5_MAC_SEL      BIT(13)
-#define MHWTRAP_P6_DIS          BIT(8)
-#define MHWTRAP_P5_RGMII_MODE   BIT(7)
-#define MHWTRAP_P5_DIS          BIT(6)
-#define MHWTRAP_PHY_ACCESS      BIT(5)
-
-/* HWTRAP bits */
-#define HWTRAP_XTAL_SHIFT       9
-#define HWTRAP_XTAL_MASK        0x3
-
-/* SYS_CTRL bits */
-#define SYS_CTRL_SW_RST         BIT(1)
-#define SYS_CTRL_REG_RST        BIT(0)
-
-/* PMCR bits */
-#define PMCR_IFG_XMIT_96        BIT(18)
-#define PMCR_MAC_MODE           BIT(16)
-#define PMCR_FORCE_MODE         BIT(15)
-#define PMCR_TX_EN              BIT(14)
-#define PMCR_RX_EN              BIT(13)
-#define PMCR_BACK_PRES_EN       BIT(9)
-#define PMCR_BACKOFF_EN         BIT(8)
-#define PMCR_TX_FC_EN           BIT(5)
-#define PMCR_RX_FC_EN           BIT(4)
-#define PMCR_FORCE_SPEED_1000   BIT(3)
-#define PMCR_FORCE_FDX          BIT(1)
-#define PMCR_FORCE_LNK          BIT(0)
-#define PMCR_FIXED_LINK         (PMCR_IFG_XMIT_96 | PMCR_MAC_MODE | \
-                                 PMCR_FORCE_MODE | PMCR_TX_EN | PMCR_RX_EN | \
-                                 PMCR_BACK_PRES_EN | PMCR_BACKOFF_EN | \
-                                 PMCR_FORCE_SPEED_1000 | PMCR_FORCE_FDX | \
-                                 PMCR_FORCE_LNK)
-
-#define PMCR_FIXED_LINK_FC      (PMCR_FIXED_LINK | \
-                                 PMCR_TX_FC_EN | PMCR_RX_FC_EN)
-
-/* TRGMII control registers */
-#define GSW_INTF_MODE           0x390
-#define GSW_TRGMII_TD0_ODT      0x354
-#define GSW_TRGMII_TD1_ODT      0x35c
-#define GSW_TRGMII_TD2_ODT      0x364
-#define GSW_TRGMII_TD3_ODT      0x36c
-#define GSW_TRGMII_TXCTL_ODT    0x374
-#define GSW_TRGMII_TCK_ODT      0x37c
-#define GSW_TRGMII_RCK_CTRL     0x300
-
-#define INTF_MODE_TRGMII        BIT(1)
-#define TRGMII_RCK_CTRL_RX_RST  BIT(31)
-
-/* Mac control registers */
-#define MTK_MAC_P2_MCR          0x200
-#define MTK_MAC_P1_MCR          0x100
-
-#define MAC_MCR_MAX_RX_2K       BIT(29)
-#define MAC_MCR_IPG_CFG         (BIT(18) | BIT(16))
-#define MAC_MCR_FORCE_MODE      BIT(15)
-#define MAC_MCR_TX_EN           BIT(14)
-#define MAC_MCR_RX_EN           BIT(13)
-#define MAC_MCR_BACKOFF_EN      BIT(9)
-#define MAC_MCR_BACKPR_EN       BIT(8)
-#define MAC_MCR_FORCE_RX_FC     BIT(5)
-#define MAC_MCR_FORCE_TX_FC     BIT(4)
-#define MAC_MCR_SPEED_1000      BIT(3)
-#define MAC_MCR_FORCE_DPX       BIT(1)
-#define MAC_MCR_FORCE_LINK      BIT(0)
-#define MAC_MCR_FIXED_LINK      (MAC_MCR_MAX_RX_2K | MAC_MCR_IPG_CFG | \
-                                 MAC_MCR_FORCE_MODE | MAC_MCR_TX_EN | \
-                                 MAC_MCR_RX_EN | MAC_MCR_BACKOFF_EN | \
-                                 MAC_MCR_BACKPR_EN | MAC_MCR_FORCE_RX_FC | \
-                                 MAC_MCR_FORCE_TX_FC | MAC_MCR_SPEED_1000 | \
-                                 MAC_MCR_FORCE_DPX | MAC_MCR_FORCE_LINK)
-#define MAC_MCR_FIXED_LINK_FC   (MAC_MCR_MAX_RX_2K | MAC_MCR_IPG_CFG | \
-                                 MAC_MCR_FIXED_LINK)
-
-/* possible XTAL speed */
-#define MT7623_XTAL_40          0
-#define MT7623_XTAL_20          1
-#define MT7623_XTAL_25          3
-
-/* GPIO port control registers */
-#define GPIO_OD33_CTRL8         0x4c0
-#define GPIO_BIAS_CTRL          0xed0
-#define GPIO_DRV_SEL10          0xf00
-
-/* on MT7620 the functio of port 4 can be software configured */
-enum {
-        PORT4_EPHY = 0,
-        PORT4_EXT,
-};
-
-/* struct mt7620_gsw -  the structure that holds the SoC specific data
- * @dev:                The Device struct
- * @base:               The base address
- * @piac_offset:        The PIAC base may change depending on SoC
- * @irq:                The IRQ we are using
- * @port4:              The port4 mode on MT7620
- * @autopoll:           Is MDIO autopolling enabled
- * @ethsys:             The ethsys register map
- * @pctl:               The pin control register map
- * @clk_gsw:            The switch clock
- * @clk_gp1:            The gmac1 clock
- * @clk_gp2:            The gmac2 clock
- * @clk_trgpll:         The trgmii pll clock
- */
-struct mt7620_gsw {
-        struct device           *dev;
-        void __iomem            *base;
-        u32                     piac_offset;
-        int                     irq;
-        int                     port4;
-        unsigned long int       autopoll;
-
-        struct regmap           *ethsys;
-        struct regmap           *pctl;
-
-        struct clk              *clk_gsw;
-        struct clk              *clk_gp1;
-        struct clk              *clk_gp2;
-        struct clk              *clk_trgpll;
-};
-
-/* switch register I/O wrappers */
-void mtk_switch_w32(struct mt7620_gsw *gsw, u32 val, unsigned int reg);
-u32 mtk_switch_r32(struct mt7620_gsw *gsw, unsigned int reg);
-
-/* the callback used by the driver core to bringup the switch */
-int mtk_gsw_init(struct mtk_eth *eth);
-
-/* MDIO access wrappers */
-int mt7620_mdio_write(struct mii_bus *bus, int phy_addr, int phy_reg, u16 val);
-int mt7620_mdio_read(struct mii_bus *bus, int phy_addr, int phy_reg);
-void mt7620_mdio_link_adjust(struct mtk_eth *eth, int port);
-int mt7620_has_carrier(struct mtk_eth *eth);
-void mt7620_print_link_state(struct mtk_eth *eth, int port, int link,
-                             int speed, int duplex);
-void mt7530_mdio_w32(struct mt7620_gsw *gsw, u32 reg, u32 val);
-u32 mt7530_mdio_r32(struct mt7620_gsw *gsw, u32 reg);
-void mt7530_mdio_m32(struct mt7620_gsw *gsw, u32 mask, u32 set, u32 reg);
-
-u32 _mt7620_mii_write(struct mt7620_gsw *gsw, u32 phy_addr,
-                      u32 phy_register, u32 write_data);
-u32 _mt7620_mii_read(struct mt7620_gsw *gsw, int phy_addr, int phy_reg);
-void mt7620_handle_carrier(struct mtk_eth *eth);
-
-#endif
diff --git a/drivers/staging/mt7621-eth/gsw_mt7621.c b/drivers/staging/mt7621-eth/gsw_mt7621.c
deleted file mode 100644
index 53767b17bad9..000000000000
--- a/drivers/staging/mt7621-eth/gsw_mt7621.c
+++ /dev/null
@@ -1,297 +0,0 @@
-/*   This program is free software; you can redistribute it and/or modify
- *   it under the terms of the GNU General Public License as published by
- *   the Free Software Foundation; version 2 of the License
- *
- *   This program is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *   GNU General Public License for more details.
- *
- *   Copyright (C) 2009-2016 John Crispin <blogic@openwrt.org>
- *   Copyright (C) 2009-2016 Felix Fietkau <nbd@openwrt.org>
- *   Copyright (C) 2013-2016 Michael Lee <igvtee@gmail.com>
- */
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/types.h>
-#include <linux/platform_device.h>
-#include <linux/of_device.h>
-#include <linux/of_irq.h>
-
-#include <ralink_regs.h>
-
-#include "mtk_eth_soc.h"
-#include "gsw_mt7620.h"
-
-void mtk_switch_w32(struct mt7620_gsw *gsw, u32 val, unsigned int reg)
-{
-        iowrite32(val, gsw->base + reg);
-}
-EXPORT_SYMBOL_GPL(mtk_switch_w32);
-
-u32 mtk_switch_r32(struct mt7620_gsw *gsw, unsigned int reg)
-{
-        return ioread32(gsw->base + reg);
-}
-EXPORT_SYMBOL_GPL(mtk_switch_r32);
-
-static irqreturn_t gsw_interrupt_mt7621(int irq, void *_eth)
-{
-        struct mtk_eth *eth = (struct mtk_eth *)_eth;
-        struct mt7620_gsw *gsw = (struct mt7620_gsw *)eth->sw_priv;
-        u32 reg, i;
-
-        reg = mt7530_mdio_r32(gsw, MT7530_SYS_INT_STS);
-
-        for (i = 0; i < 5; i++) {
-                unsigned int link;
-
-                if ((reg & BIT(i)) == 0)
-                        continue;
-
-                link = mt7530_mdio_r32(gsw, MT7530_PMSR_P(i)) & 0x1;
-
-                if (link == eth->link[i])
-                        continue;
-
-                eth->link[i] = link;
-                if (link)
-                        netdev_info(*eth->netdev,
-                                    "port %d link up\n", i);
-                else
-                        netdev_info(*eth->netdev,
-                                    "port %d link down\n", i);
-        }
-
-        mt7530_mdio_w32(gsw, MT7530_SYS_INT_STS, 0x1f);
-
-        return IRQ_HANDLED;
-}
-
-static void mt7621_hw_init(struct mtk_eth *eth, struct mt7620_gsw *gsw,
-                           struct device_node *np)
-{
-        u32 i;
-        u32 val;
-
-        /* hardware reset the switch */
-        mtk_reset(eth, RST_CTRL_MCM);
-        mdelay(10);
-
-        /* reduce RGMII2 PAD driving strength */
-        rt_sysc_m32(MT7621_MDIO_DRV_MASK, 0, SYSC_PAD_RGMII2_MDIO);
-
-        /* gpio mux - RGMII1=Normal mode */
-        rt_sysc_m32(BIT(14), 0, SYSC_GPIO_MODE);
-
-        /* set GMAC1 RGMII mode */
-        rt_sysc_m32(MT7621_GE1_MODE_MASK, 0, SYSC_REG_CFG1);
-
-        /* enable MDIO to control MT7530 */
-        rt_sysc_m32(3 << 12, 0, SYSC_GPIO_MODE);
-
-        /* turn off all PHYs */
-        for (i = 0; i <= 4; i++) {
-                val = _mt7620_mii_read(gsw, i, 0x0);
-                val |= BIT(11);
-                _mt7620_mii_write(gsw, i, 0x0, val);
-        }
-
-        /* reset the switch */
-        mt7530_mdio_w32(gsw, MT7530_SYS_CTRL,
-                        SYS_CTRL_SW_RST | SYS_CTRL_REG_RST);
-        usleep_range(10, 20);
-
-        if ((rt_sysc_r32(SYSC_REG_CHIP_REV_ID) & 0xFFFF) == 0x0101) {
-                /* GE1, Force 1000M/FD, FC ON, MAX_RX_LENGTH 1536 */
-                mtk_switch_w32(gsw, MAC_MCR_FIXED_LINK, MTK_MAC_P2_MCR);
-                mt7530_mdio_w32(gsw, MT7530_PMCR_P(6), PMCR_FIXED_LINK);
-        } else {
-                /* GE1, Force 1000M/FD, FC ON, MAX_RX_LENGTH 1536 */
-                mtk_switch_w32(gsw, MAC_MCR_FIXED_LINK_FC, MTK_MAC_P1_MCR);
-                mt7530_mdio_w32(gsw, MT7530_PMCR_P(6), PMCR_FIXED_LINK_FC);
-        }
-
-        /* GE2, Link down */
-        mtk_switch_w32(gsw, MAC_MCR_FORCE_MODE, MTK_MAC_P2_MCR);
-
-        /* Enable Port 6, P5 as GMAC5, P5 disable */
-        val = mt7530_mdio_r32(gsw, MT7530_MHWTRAP);
-        /* Enable Port 6 */
-        val &= ~MHWTRAP_P6_DIS;
-        /* Disable Port 5 */
-        val |= MHWTRAP_P5_DIS;
-        /* manual override of HW-Trap */
-        val |= MHWTRAP_MANUAL;
-        mt7530_mdio_w32(gsw, MT7530_MHWTRAP, val);
-
-        val = rt_sysc_r32(SYSC_REG_CFG);
-        val = (val >> MT7621_XTAL_SHIFT) & MT7621_XTAL_MASK;
-        if (val < MT7621_XTAL_25 && val >= MT7621_XTAL_40) {
-                /* 40Mhz */
-
-                /* disable MT7530 core clock */
-                _mt7620_mii_write(gsw, 0, 13, 0x1f);
-                _mt7620_mii_write(gsw, 0, 14, 0x410);
-                _mt7620_mii_write(gsw, 0, 13, 0x401f);
-                _mt7620_mii_write(gsw, 0, 14, 0x0);
-
-                /* disable MT7530 PLL */
-                _mt7620_mii_write(gsw, 0, 13, 0x1f);
-                _mt7620_mii_write(gsw, 0, 14, 0x40d);
-                _mt7620_mii_write(gsw, 0, 13, 0x401f);
-                _mt7620_mii_write(gsw, 0, 14, 0x2020);
-
-                /* for MT7530 core clock = 500Mhz */
-                _mt7620_mii_write(gsw, 0, 13, 0x1f);
-                _mt7620_mii_write(gsw, 0, 14, 0x40e);
-                _mt7620_mii_write(gsw, 0, 13, 0x401f);
-                _mt7620_mii_write(gsw, 0, 14, 0x119);
-
-                /* enable MT7530 PLL */
-                _mt7620_mii_write(gsw, 0, 13, 0x1f);
-                _mt7620_mii_write(gsw, 0, 14, 0x40d);
-                _mt7620_mii_write(gsw, 0, 13, 0x401f);
-                _mt7620_mii_write(gsw, 0, 14, 0x2820);
-
-                usleep_range(20, 40);
-
-                /* enable MT7530 core clock */
-                _mt7620_mii_write(gsw, 0, 13, 0x1f);
-                _mt7620_mii_write(gsw, 0, 14, 0x410);
-                _mt7620_mii_write(gsw, 0, 13, 0x401f);
-        }
-
-        /* RGMII */
-        _mt7620_mii_write(gsw, 0, 14, 0x1);
-
-        /* set MT7530 central align */
-        mt7530_mdio_m32(gsw, BIT(0), P6ECR_INTF_MODE_RGMII, MT7530_P6ECR);
-        mt7530_mdio_m32(gsw, TRGMII_TXCTRL_TXC_INV, 0,
-                        MT7530_TRGMII_TXCTRL);
-        mt7530_mdio_w32(gsw, MT7530_TRGMII_TCK_CTRL, 0x855);
-
-        /* delay setting for 10/1000M */
-        mt7530_mdio_w32(gsw, MT7530_P5RGMIIRXCR,
-                        P5RGMIIRXCR_C_ALIGN | P5RGMIIRXCR_DELAY_2);
-        mt7530_mdio_w32(gsw, MT7530_P5RGMIITXCR, 0x14);
-
-        /* lower Tx Driving*/
-        mt7530_mdio_w32(gsw, MT7530_TRGMII_TD0_ODT, 0x44);
-        mt7530_mdio_w32(gsw, MT7530_TRGMII_TD1_ODT, 0x44);
-        mt7530_mdio_w32(gsw, MT7530_TRGMII_TD2_ODT, 0x44);
-        mt7530_mdio_w32(gsw, MT7530_TRGMII_TD3_ODT, 0x44);
-        mt7530_mdio_w32(gsw, MT7530_TRGMII_TD4_ODT, 0x44);
-        mt7530_mdio_w32(gsw, MT7530_TRGMII_TD5_ODT, 0x44);
-
-        /* turn on all PHYs */
-        for (i = 0; i <= 4; i++) {
-                val = _mt7620_mii_read(gsw, i, 0);
-                val &= ~BIT(11);
-                _mt7620_mii_write(gsw, i, 0, val);
-        }
-
-#define MT7530_NUM_PORTS 8
-#define REG_ESW_PORT_PCR(x)    (0x2004 | ((x) << 8))
-#define REG_ESW_PORT_PVC(x)    (0x2010 | ((x) << 8))
-#define REG_ESW_PORT_PPBV1(x)  (0x2014 | ((x) << 8))
-#define MT7530_CPU_PORT                6
-
-        /* This is copied from mt7530_apply_config in libreCMC driver */
-        {
-                int i;
-
-                for (i = 0; i < MT7530_NUM_PORTS; i++)
-                        mt7530_mdio_w32(gsw, REG_ESW_PORT_PCR(i), 0x00400000);
-
-                mt7530_mdio_w32(gsw, REG_ESW_PORT_PCR(MT7530_CPU_PORT),
-                                0x00ff0000);
-
-                for (i = 0; i < MT7530_NUM_PORTS; i++)
-                        mt7530_mdio_w32(gsw, REG_ESW_PORT_PVC(i), 0x810000c0);
-        }
-
-        /* enable irq */
-        mt7530_mdio_m32(gsw, 0, 3 << 16, MT7530_TOP_SIG_CTRL);
-        mt7530_mdio_w32(gsw, MT7530_SYS_INT_EN, 0x1f);
-}
-
-static const struct of_device_id mediatek_gsw_match[] = {
-        { .compatible = "mediatek,mt7621-gsw" },
-        {},
-};
-MODULE_DEVICE_TABLE(of, mediatek_gsw_match);
-
-int mtk_gsw_init(struct mtk_eth *eth)
-{
-        struct device_node *np = eth->switch_np;
-        struct platform_device *pdev = of_find_device_by_node(np);
-        struct mt7620_gsw *gsw;
-
-        if (!pdev)
-                return -ENODEV;
-
-        if (!of_device_is_compatible(np, mediatek_gsw_match->compatible))
-                return -EINVAL;
-
-        gsw = platform_get_drvdata(pdev);
-        eth->sw_priv = gsw;
-
-        if (!gsw->irq)
-                return -EINVAL;
-
-        request_irq(gsw->irq, gsw_interrupt_mt7621, 0,
-                    "gsw", eth);
-        disable_irq(gsw->irq);
-
-        mt7621_hw_init(eth, gsw, np);
-
-        enable_irq(gsw->irq);
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(mtk_gsw_init);
-
-static int mt7621_gsw_probe(struct platform_device *pdev)
-{
-        struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        struct mt7620_gsw *gsw;
-
-        gsw = devm_kzalloc(&pdev->dev, sizeof(struct mt7620_gsw), GFP_KERNEL);
-        if (!gsw)
-                return -ENOMEM;
-
-        gsw->base = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(gsw->base))
-                return PTR_ERR(gsw->base);
-
-        gsw->dev = &pdev->dev;
-        gsw->irq = irq_of_parse_and_map(pdev->dev.of_node, 0);
-
-        platform_set_drvdata(pdev, gsw);
-
-        return 0;
-}
-
-static int mt7621_gsw_remove(struct platform_device *pdev)
-{
-        platform_set_drvdata(pdev, NULL);
-
-        return 0;
-}
-
-static struct platform_driver gsw_driver = {
-        .probe = mt7621_gsw_probe,
-        .remove = mt7621_gsw_remove,
-        .driver = {
-                .name = "mt7621-gsw",
-                .of_match_table = mediatek_gsw_match,
-        },
-};
-
-module_platform_driver(gsw_driver);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("John Crispin <blogic@openwrt.org>");
-MODULE_DESCRIPTION("GBit switch driver for Mediatek MT7621 SoC");
diff --git a/drivers/staging/mt7621-eth/mdio.c b/drivers/staging/mt7621-eth/mdio.c
deleted file mode 100644
index 5fea6a447eed..000000000000
--- a/drivers/staging/mt7621-eth/mdio.c
+++ /dev/null
@@ -1,275 +0,0 @@
-/*   This program is free software; you can redistribute it and/or modify
- *   it under the terms of the GNU General Public License as published by
- *   the Free Software Foundation; version 2 of the License
- *
- *   Copyright (C) 2009-2016 John Crispin <blogic@openwrt.org>
- *   Copyright (C) 2009-2016 Felix Fietkau <nbd@openwrt.org>
- *   Copyright (C) 2013-2016 Michael Lee <igvtee@gmail.com>
- */
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/phy.h>
-#include <linux/of_net.h>
-#include <linux/of_mdio.h>
-
-#include "mtk_eth_soc.h"
-#include "mdio.h"
-
-static int mtk_mdio_reset(struct mii_bus *bus)
-{
-        /* TODO */
-        return 0;
-}
-
-static void mtk_phy_link_adjust(struct net_device *dev)
-{
-        struct mtk_eth *eth = netdev_priv(dev);
-        unsigned long flags;
-        int i;
-
-        spin_lock_irqsave(&eth->phy->lock, flags);
-        for (i = 0; i < 8; i++) {
-                if (eth->phy->phy_node[i]) {
-                        struct phy_device *phydev = eth->phy->phy[i];
-                        int status_change = 0;
-
-                        if (phydev->link)
-                                if (eth->phy->duplex[i] != phydev->duplex ||
-                                    eth->phy->speed[i] != phydev->speed)
-                                        status_change = 1;
-
-                        if (phydev->link != eth->link[i])
-                                status_change = 1;
-
-                        switch (phydev->speed) {
-                        case SPEED_1000:
-                        case SPEED_100:
-                        case SPEED_10:
-                                eth->link[i] = phydev->link;
-                                eth->phy->duplex[i] = phydev->duplex;
-                                eth->phy->speed[i] = phydev->speed;
-
-                                if (status_change &&
-                                    eth->soc->mdio_adjust_link)
-                                        eth->soc->mdio_adjust_link(eth, i);
-                                break;
-                        }
-                }
-        }
-        spin_unlock_irqrestore(&eth->phy->lock, flags);
-}
-
-int mtk_connect_phy_node(struct mtk_eth *eth, struct mtk_mac *mac,
-                         struct device_node *phy_node)
-{
-        const __be32 *_port = NULL;
-        struct phy_device *phydev;
-        int phy_mode, port;
-
-        _port = of_get_property(phy_node, "reg", NULL);
-
-        if (!_port || (be32_to_cpu(*_port) >= 0x20)) {
-                pr_err("%pOFn: invalid port id\n", phy_node);
-                return -EINVAL;
-        }
-        port = be32_to_cpu(*_port);
-        phy_mode = of_get_phy_mode(phy_node);
-        if (phy_mode < 0) {
-                dev_err(eth->dev, "incorrect phy-mode %d\n", phy_mode);
-                eth->phy->phy_node[port] = NULL;
-                return -EINVAL;
-        }
-
-        phydev = of_phy_connect(eth->netdev[mac->id], phy_node,
-                                mtk_phy_link_adjust, 0, phy_mode);
-        if (!phydev) {
-                dev_err(eth->dev, "could not connect to PHY\n");
-                eth->phy->phy_node[port] = NULL;
-                return -ENODEV;
-        }
-
-        phydev->supported &= PHY_1000BT_FEATURES;
-        phydev->advertising = phydev->supported;
-
-        dev_info(eth->dev,
-                 "connected port %d to PHY at %s [uid=%08x, driver=%s]\n",
-                 port, phydev_name(phydev), phydev->phy_id,
-                 phydev->drv->name);
-
-        eth->phy->phy[port] = phydev;
-        eth->link[port] = 0;
-
-        return 0;
-}
-
-static void phy_init(struct mtk_eth *eth, struct mtk_mac *mac,
-                     struct phy_device *phy)
-{
-        phy_attach(eth->netdev[mac->id], phydev_name(phy),
-                   PHY_INTERFACE_MODE_MII);
-
-        phy->autoneg = AUTONEG_ENABLE;
-        phy->speed = 0;
-        phy->duplex = 0;
-        phy_set_max_speed(phy, SPEED_100);
-        phy->advertising = phy->supported | ADVERTISED_Autoneg;
-
-        phy_start_aneg(phy);
-}
-
-static int mtk_phy_connect(struct mtk_mac *mac)
-{
-        struct mtk_eth *eth = mac->hw;
-        int i;
-
-        for (i = 0; i < 8; i++) {
-                if (eth->phy->phy_node[i]) {
-                        if (!mac->phy_dev) {
-                                mac->phy_dev = eth->phy->phy[i];
-                                mac->phy_flags = MTK_PHY_FLAG_PORT;
-                        }
-                } else if (eth->mii_bus) {
-                        struct phy_device *phy;
-
-                        phy = mdiobus_get_phy(eth->mii_bus, i);
-                        if (phy) {
-                                phy_init(eth, mac, phy);
-                                if (!mac->phy_dev) {
-                                        mac->phy_dev = phy;
-                                        mac->phy_flags = MTK_PHY_FLAG_ATTACH;
-                                }
-                        }
-                }
-        }
-
-        return 0;
-}
-
-static void mtk_phy_disconnect(struct mtk_mac *mac)
-{
-        struct mtk_eth *eth = mac->hw;
-        unsigned long flags;
-        int i;
-
-        for (i = 0; i < 8; i++)
-                if (eth->phy->phy_fixed[i]) {
-                        spin_lock_irqsave(&eth->phy->lock, flags);
-                        eth->link[i] = 0;
-                        if (eth->soc->mdio_adjust_link)
-                                eth->soc->mdio_adjust_link(eth, i);
-                        spin_unlock_irqrestore(&eth->phy->lock, flags);
-                } else if (eth->phy->phy[i]) {
-                        phy_disconnect(eth->phy->phy[i]);
-                } else if (eth->mii_bus) {
-                        struct phy_device *phy =
-                                mdiobus_get_phy(eth->mii_bus, i);
-
-                        if (phy)
-                                phy_detach(phy);
-                }
-}
-
-static void mtk_phy_start(struct mtk_mac *mac)
-{
-        struct mtk_eth *eth = mac->hw;
-        unsigned long flags;
-        int i;
-
-        for (i = 0; i < 8; i++) {
-                if (eth->phy->phy_fixed[i]) {
-                        spin_lock_irqsave(&eth->phy->lock, flags);
-                        eth->link[i] = 1;
-                        if (eth->soc->mdio_adjust_link)
-                                eth->soc->mdio_adjust_link(eth, i);
-                        spin_unlock_irqrestore(&eth->phy->lock, flags);
-                } else if (eth->phy->phy[i]) {
-                        phy_start(eth->phy->phy[i]);
-                }
-        }
-}
-
-static void mtk_phy_stop(struct mtk_mac *mac)
-{
-        struct mtk_eth *eth = mac->hw;
-        unsigned long flags;
-        int i;
-
-        for (i = 0; i < 8; i++)
-                if (eth->phy->phy_fixed[i]) {
-                        spin_lock_irqsave(&eth->phy->lock, flags);
-                        eth->link[i] = 0;
-                        if (eth->soc->mdio_adjust_link)
-                                eth->soc->mdio_adjust_link(eth, i);
-                        spin_unlock_irqrestore(&eth->phy->lock, flags);
-                } else if (eth->phy->phy[i]) {
-                        phy_stop(eth->phy->phy[i]);
-                }
-}
-
-static struct mtk_phy phy_ralink = {
-        .connect = mtk_phy_connect,
-        .disconnect = mtk_phy_disconnect,
-        .start = mtk_phy_start,
-        .stop = mtk_phy_stop,
-};
-
-int mtk_mdio_init(struct mtk_eth *eth)
-{
-        struct device_node *mii_np;
-        int err;
-
-        if (!eth->soc->mdio_read || !eth->soc->mdio_write)
-                return 0;
-
-        spin_lock_init(&phy_ralink.lock);
-        eth->phy = &phy_ralink;
-
-        mii_np = of_get_child_by_name(eth->dev->of_node, "mdio-bus");
-        if (!mii_np) {
-                dev_err(eth->dev, "no %s child node found", "mdio-bus");
-                return -ENODEV;
-        }
-
-        if (!of_device_is_available(mii_np)) {
-                err = 0;
-                goto err_put_node;
-        }
-
-        eth->mii_bus = mdiobus_alloc();
-        if (!eth->mii_bus) {
-                err = -ENOMEM;
-                goto err_put_node;
-        }
-
-        eth->mii_bus->name = "mdio";
-        eth->mii_bus->read = eth->soc->mdio_read;
-        eth->mii_bus->write = eth->soc->mdio_write;
-        eth->mii_bus->reset = mtk_mdio_reset;
-        eth->mii_bus->priv = eth;
-        eth->mii_bus->parent = eth->dev;
-
-        snprintf(eth->mii_bus->id, MII_BUS_ID_SIZE, "%pOFn", mii_np);
-        err = of_mdiobus_register(eth->mii_bus, mii_np);
-        if (err)
-                goto err_free_bus;
-
-        return 0;
-
-err_free_bus:
-        kfree(eth->mii_bus);
-err_put_node:
-        of_node_put(mii_np);
-        eth->mii_bus = NULL;
-        return err;
-}
-
-void mtk_mdio_cleanup(struct mtk_eth *eth)
-{
-        if (!eth->mii_bus)
-                return;
-
-        mdiobus_unregister(eth->mii_bus);
-        of_node_put(eth->mii_bus->dev.of_node);
-        kfree(eth->mii_bus);
-}
diff --git a/drivers/staging/mt7621-eth/mdio.h b/drivers/staging/mt7621-eth/mdio.h
deleted file mode 100644
index b14e23842a01..000000000000
--- a/drivers/staging/mt7621-eth/mdio.h
+++ /dev/null
@@ -1,27 +0,0 @@
-/*   This program is free software; you can redistribute it and/or modify
- *   it under the terms of the GNU General Public License as published by
- *   the Free Software Foundation; version 2 of the License
- *
- *   This program is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *   GNU General Public License for more details.
- *
- *   Copyright (C) 2009-2016 John Crispin <blogic@openwrt.org>
- *   Copyright (C) 2009-2016 Felix Fietkau <nbd@openwrt.org>
- *   Copyright (C) 2013-2016 Michael Lee <igvtee@gmail.com>
- */
-
-#ifndef _RALINK_MDIO_H__
-#define _RALINK_MDIO_H__
-
-#ifdef CONFIG_NET_MEDIATEK_MDIO
-int mtk_mdio_init(struct mtk_eth *eth);
-void mtk_mdio_cleanup(struct mtk_eth *eth);
-int mtk_connect_phy_node(struct mtk_eth *eth, struct mtk_mac *mac,
-                         struct device_node *phy_node);
-#else
-static inline int mtk_mdio_init(struct mtk_eth *eth) { return 0; }
-static inline void mtk_mdio_cleanup(struct mtk_eth *eth) {}
-#endif
-#endif
diff --git a/drivers/staging/mt7621-eth/mdio_mt7620.c b/drivers/staging/mt7621-eth/mdio_mt7620.c
deleted file mode 100644
index ced605c2914e..000000000000
--- a/drivers/staging/mt7621-eth/mdio_mt7620.c
+++ /dev/null
@@ -1,173 +0,0 @@
-/*   This program is free software; you can redistribute it and/or modify
- *   it under the terms of the GNU General Public License as published by
- *   the Free Software Foundation; version 2 of the License
- *
- *   This program is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *   GNU General Public License for more details.
- *
- *   Copyright (C) 2009-2016 John Crispin <blogic@openwrt.org>
- *   Copyright (C) 2009-2016 Felix Fietkau <nbd@openwrt.org>
- *   Copyright (C) 2013-2016 Michael Lee <igvtee@gmail.com>
- */
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/types.h>
-
-#include "mtk_eth_soc.h"
-#include "gsw_mt7620.h"
-#include "mdio.h"
-
-static int mt7620_mii_busy_wait(struct mt7620_gsw *gsw)
-{
-        unsigned long t_start = jiffies;
-
-        while (1) {
-                if (!(mtk_switch_r32(gsw,
-                                     gsw->piac_offset + MT7620_GSW_REG_PIAC) &
-                                     GSW_MDIO_ACCESS))
-                        return 0;
-                if (time_after(jiffies, t_start + GSW_REG_PHY_TIMEOUT))
-                        break;
-        }
-
-        dev_err(gsw->dev, "mdio: MDIO timeout\n");
-        return -1;
-}
-
-u32 _mt7620_mii_write(struct mt7620_gsw *gsw, u32 phy_addr,
-                      u32 phy_register, u32 write_data)
-{
-        if (mt7620_mii_busy_wait(gsw))
-                return -1;
-
-        write_data &= 0xffff;
-
-        mtk_switch_w32(gsw, GSW_MDIO_ACCESS | GSW_MDIO_START | GSW_MDIO_WRITE |
-                (phy_register << GSW_MDIO_REG_SHIFT) |
-                (phy_addr << GSW_MDIO_ADDR_SHIFT) | write_data,
-                MT7620_GSW_REG_PIAC);
-
-        if (mt7620_mii_busy_wait(gsw))
-                return -1;
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(_mt7620_mii_write);
-
-u32 _mt7620_mii_read(struct mt7620_gsw *gsw, int phy_addr, int phy_reg)
-{
-        u32 d;
-
-        if (mt7620_mii_busy_wait(gsw))
-                return 0xffff;
-
-        mtk_switch_w32(gsw, GSW_MDIO_ACCESS | GSW_MDIO_START | GSW_MDIO_READ |
-                (phy_reg << GSW_MDIO_REG_SHIFT) |
-                (phy_addr << GSW_MDIO_ADDR_SHIFT),
-                MT7620_GSW_REG_PIAC);
-
-        if (mt7620_mii_busy_wait(gsw))
-                return 0xffff;
-
-        d = mtk_switch_r32(gsw, MT7620_GSW_REG_PIAC) & 0xffff;
-
-        return d;
-}
-EXPORT_SYMBOL_GPL(_mt7620_mii_read);
-
-int mt7620_mdio_write(struct mii_bus *bus, int phy_addr, int phy_reg, u16 val)
-{
-        struct mtk_eth *eth = bus->priv;
-        struct mt7620_gsw *gsw = (struct mt7620_gsw *)eth->sw_priv;
-
-        return _mt7620_mii_write(gsw, phy_addr, phy_reg, val);
-}
-
-int mt7620_mdio_read(struct mii_bus *bus, int phy_addr, int phy_reg)
-{
-        struct mtk_eth *eth = bus->priv;
-        struct mt7620_gsw *gsw = (struct mt7620_gsw *)eth->sw_priv;
-
-        return _mt7620_mii_read(gsw, phy_addr, phy_reg);
-}
-
-void mt7530_mdio_w32(struct mt7620_gsw *gsw, u32 reg, u32 val)
-{
-        _mt7620_mii_write(gsw, 0x1f, 0x1f, (reg >> 6) & 0x3ff);
-        _mt7620_mii_write(gsw, 0x1f, (reg >> 2) & 0xf,  val & 0xffff);
-        _mt7620_mii_write(gsw, 0x1f, 0x10, val >> 16);
-}
-EXPORT_SYMBOL_GPL(mt7530_mdio_w32);
-
-u32 mt7530_mdio_r32(struct mt7620_gsw *gsw, u32 reg)
-{
-        u16 high, low;
-
-        _mt7620_mii_write(gsw, 0x1f, 0x1f, (reg >> 6) & 0x3ff);
-        low = _mt7620_mii_read(gsw, 0x1f, (reg >> 2) & 0xf);
-        high = _mt7620_mii_read(gsw, 0x1f, 0x10);
-
-        return (high << 16) | (low & 0xffff);
-}
-EXPORT_SYMBOL_GPL(mt7530_mdio_r32);
-
-void mt7530_mdio_m32(struct mt7620_gsw *gsw, u32 mask, u32 set, u32 reg)
-{
-        u32 val = mt7530_mdio_r32(gsw, reg);
-
-        val &= ~mask;
-        val |= set;
-        mt7530_mdio_w32(gsw, reg, val);
-}
-EXPORT_SYMBOL_GPL(mt7530_mdio_m32);
-
-static unsigned char *mtk_speed_str(int speed)
-{
-        switch (speed) {
-        case 2:
-        case SPEED_1000:
-                return "1000";
-        case 1:
-        case SPEED_100:
-                return "100";
-        case 0:
-        case SPEED_10:
-                return "10";
-        }
-
-        return "? ";
-}
-
-int mt7620_has_carrier(struct mtk_eth *eth)
-{
-        struct mt7620_gsw *gsw = (struct mt7620_gsw *)eth->sw_priv;
-        int i;
-
-        for (i = 0; i < GSW_PORT6; i++)
-                if (mt7530_mdio_r32(gsw, GSW_REG_PORT_STATUS(i)) & 0x1)
-                        return 1;
-        return 0;
-}
-
-void mt7620_print_link_state(struct mtk_eth *eth, int port, int link,
-                             int speed, int duplex)
-{
-        struct mt7620_gsw *gsw = eth->sw_priv;
-
-        if (link)
-                dev_info(gsw->dev, "port %d link up (%sMbps/%s duplex)\n",
-                         port, mtk_speed_str(speed),
-                         (duplex) ? "Full" : "Half");
-        else
-                dev_info(gsw->dev, "port %d link down\n", port);
-}
-
-void mt7620_mdio_link_adjust(struct mtk_eth *eth, int port)
-{
-        mt7620_print_link_state(eth, port, eth->link[port],
-                                eth->phy->speed[port],
-                                (eth->phy->duplex[port] == DUPLEX_FULL));
-}
diff --git a/drivers/staging/mt7621-eth/mtk_eth_soc.c b/drivers/staging/mt7621-eth/mtk_eth_soc.c
deleted file mode 100644
index 02a8584b3d1d..000000000000
--- a/drivers/staging/mt7621-eth/mtk_eth_soc.c
+++ /dev/null
@@ -1,2178 +0,0 @@
-/*   This program is free software; you can redistribute it and/or modify
- *   it under the terms of the GNU General Public License as published by
- *   the Free Software Foundation; version 2 of the License
- *
- *   This program is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *   GNU General Public License for more details.
- *
- *   Copyright (C) 2009-2016 John Crispin <blogic@openwrt.org>
- *   Copyright (C) 2009-2016 Felix Fietkau <nbd@openwrt.org>
- *   Copyright (C) 2013-2016 Michael Lee <igvtee@gmail.com>
- */
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/types.h>
-#include <linux/dma-mapping.h>
-#include <linux/init.h>
-#include <linux/skbuff.h>
-#include <linux/etherdevice.h>
-#include <linux/ethtool.h>
-#include <linux/platform_device.h>
-#include <linux/of_device.h>
-#include <linux/mfd/syscon.h>
-#include <linux/clk.h>
-#include <linux/of_net.h>
-#include <linux/of_mdio.h>
-#include <linux/if_vlan.h>
-#include <linux/reset.h>
-#include <linux/tcp.h>
-#include <linux/io.h>
-#include <linux/bug.h>
-#include <linux/regmap.h>
-
-#include "mtk_eth_soc.h"
-#include "mdio.h"
-#include "ethtool.h"
-
-#define MAX_RX_LENGTH           1536
-#define MTK_RX_ETH_HLEN         (VLAN_ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN)
-#define MTK_RX_HLEN             (NET_SKB_PAD + MTK_RX_ETH_HLEN + NET_IP_ALIGN)
-#define DMA_DUMMY_DESC          0xffffffff
-#define MTK_DEFAULT_MSG_ENABLE \
-                (NETIF_MSG_DRV | \
-                NETIF_MSG_PROBE | \
-                NETIF_MSG_LINK | \
-                NETIF_MSG_TIMER | \
-                NETIF_MSG_IFDOWN | \
-                NETIF_MSG_IFUP | \
-                NETIF_MSG_RX_ERR | \
-                NETIF_MSG_TX_ERR)
-
-#define TX_DMA_DESP2_DEF        (TX_DMA_LS0 | TX_DMA_DONE)
-#define NEXT_TX_DESP_IDX(X)     (((X) + 1) & (ring->tx_ring_size - 1))
-#define NEXT_RX_DESP_IDX(X)     (((X) + 1) & (ring->rx_ring_size - 1))
-
-#define SYSC_REG_RSTCTRL        0x34
-
-static int mtk_msg_level = -1;
-module_param_named(msg_level, mtk_msg_level, int, 0);
-MODULE_PARM_DESC(msg_level, "Message level (-1=defaults,0=none,...,16=all)");
-
-static const u16 mtk_reg_table_default[MTK_REG_COUNT] = {
-        [MTK_REG_PDMA_GLO_CFG] = MTK_PDMA_GLO_CFG,
-        [MTK_REG_PDMA_RST_CFG] = MTK_PDMA_RST_CFG,
-        [MTK_REG_DLY_INT_CFG] = MTK_DLY_INT_CFG,
-        [MTK_REG_TX_BASE_PTR0] = MTK_TX_BASE_PTR0,
-        [MTK_REG_TX_MAX_CNT0] = MTK_TX_MAX_CNT0,
-        [MTK_REG_TX_CTX_IDX0] = MTK_TX_CTX_IDX0,
-        [MTK_REG_TX_DTX_IDX0] = MTK_TX_DTX_IDX0,
-        [MTK_REG_RX_BASE_PTR0] = MTK_RX_BASE_PTR0,
-        [MTK_REG_RX_MAX_CNT0] = MTK_RX_MAX_CNT0,
-        [MTK_REG_RX_CALC_IDX0] = MTK_RX_CALC_IDX0,
-        [MTK_REG_RX_DRX_IDX0] = MTK_RX_DRX_IDX0,
-        [MTK_REG_MTK_INT_ENABLE] = MTK_INT_ENABLE,
-        [MTK_REG_MTK_INT_STATUS] = MTK_INT_STATUS,
-        [MTK_REG_MTK_DMA_VID_BASE] = MTK_DMA_VID0,
-        [MTK_REG_MTK_COUNTER_BASE] = MTK_GDMA1_TX_GBCNT,
-        [MTK_REG_MTK_RST_GL] = MTK_RST_GL,
-};
-
-static const u16 *mtk_reg_table = mtk_reg_table_default;
-
-void mtk_w32(struct mtk_eth *eth, u32 val, unsigned int reg)
-{
-        __raw_writel(val, eth->base + reg);
-}
-
-u32 mtk_r32(struct mtk_eth *eth, unsigned int reg)
-{
-        return __raw_readl(eth->base + reg);
-}
-
-static void mtk_reg_w32(struct mtk_eth *eth, u32 val, enum mtk_reg reg)
-{
-        mtk_w32(eth, val, mtk_reg_table[reg]);
-}
-
-static u32 mtk_reg_r32(struct mtk_eth *eth, enum mtk_reg reg)
-{
-        return mtk_r32(eth, mtk_reg_table[reg]);
-}
-
-/* these bits are also exposed via the reset-controller API. however the switch
- * and FE need to be brought out of reset in the exakt same moemtn and the
- * reset-controller api does not provide this feature yet. Do the reset manually
- * until we fixed the reset-controller api to be able to do this
- */
-void mtk_reset(struct mtk_eth *eth, u32 reset_bits)
-{
-        u32 val;
-
-        regmap_read(eth->ethsys, SYSC_REG_RSTCTRL, &val);
-        val |= reset_bits;
-        regmap_write(eth->ethsys, SYSC_REG_RSTCTRL, val);
-        usleep_range(10, 20);
-        val &= ~reset_bits;
-        regmap_write(eth->ethsys, SYSC_REG_RSTCTRL, val);
-        usleep_range(10, 20);
-}
-EXPORT_SYMBOL(mtk_reset);
-
-static inline void mtk_irq_ack(struct mtk_eth *eth, u32 mask)
-{
-        if (eth->soc->dma_type & MTK_PDMA)
-                mtk_reg_w32(eth, mask, MTK_REG_MTK_INT_STATUS);
-        if (eth->soc->dma_type & MTK_QDMA)
-                mtk_w32(eth, mask, MTK_QMTK_INT_STATUS);
-}
-
-static inline u32 mtk_irq_pending(struct mtk_eth *eth)
-{
-        u32 status = 0;
-
-        if (eth->soc->dma_type & MTK_PDMA)
-                status |= mtk_reg_r32(eth, MTK_REG_MTK_INT_STATUS);
-        if (eth->soc->dma_type & MTK_QDMA)
-                status |= mtk_r32(eth, MTK_QMTK_INT_STATUS);
-
-        return status;
-}
-
-static void mtk_irq_ack_status(struct mtk_eth *eth, u32 mask)
-{
-        u32 status_reg = MTK_REG_MTK_INT_STATUS;
-
-        if (mtk_reg_table[MTK_REG_MTK_INT_STATUS2])
-                status_reg = MTK_REG_MTK_INT_STATUS2;
-
-        mtk_reg_w32(eth, mask, status_reg);
-}
-
-static u32 mtk_irq_pending_status(struct mtk_eth *eth)
-{
-        u32 status_reg = MTK_REG_MTK_INT_STATUS;
-
-        if (mtk_reg_table[MTK_REG_MTK_INT_STATUS2])
-                status_reg = MTK_REG_MTK_INT_STATUS2;
-
-        return mtk_reg_r32(eth, status_reg);
-}
-
-static inline void mtk_irq_disable(struct mtk_eth *eth, u32 mask)
-{
-        u32 val;
-
-        if (eth->soc->dma_type & MTK_PDMA) {
-                val = mtk_reg_r32(eth, MTK_REG_MTK_INT_ENABLE);
-                mtk_reg_w32(eth, val & ~mask, MTK_REG_MTK_INT_ENABLE);
-                /* flush write */
-                mtk_reg_r32(eth, MTK_REG_MTK_INT_ENABLE);
-        }
-        if (eth->soc->dma_type & MTK_QDMA) {
-                val = mtk_r32(eth, MTK_QMTK_INT_ENABLE);
-                mtk_w32(eth, val & ~mask, MTK_QMTK_INT_ENABLE);
-                /* flush write */
-                mtk_r32(eth, MTK_QMTK_INT_ENABLE);
-        }
-}
-
-static inline void mtk_irq_enable(struct mtk_eth *eth, u32 mask)
-{
-        u32 val;
-
-        if (eth->soc->dma_type & MTK_PDMA) {
-                val = mtk_reg_r32(eth, MTK_REG_MTK_INT_ENABLE);
-                mtk_reg_w32(eth, val | mask, MTK_REG_MTK_INT_ENABLE);
-                /* flush write */
-                mtk_reg_r32(eth, MTK_REG_MTK_INT_ENABLE);
-        }
-        if (eth->soc->dma_type & MTK_QDMA) {
-                val = mtk_r32(eth, MTK_QMTK_INT_ENABLE);
-                mtk_w32(eth, val | mask, MTK_QMTK_INT_ENABLE);
-                /* flush write */
-                mtk_r32(eth, MTK_QMTK_INT_ENABLE);
-        }
-}
-
-static inline u32 mtk_irq_enabled(struct mtk_eth *eth)
-{
-        u32 enabled = 0;
-
-        if (eth->soc->dma_type & MTK_PDMA)
-                enabled |= mtk_reg_r32(eth, MTK_REG_MTK_INT_ENABLE);
-        if (eth->soc->dma_type & MTK_QDMA)
-                enabled |= mtk_r32(eth, MTK_QMTK_INT_ENABLE);
-
-        return enabled;
-}
-
-static inline void mtk_hw_set_macaddr(struct mtk_mac *mac,
-                                      unsigned char *macaddr)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&mac->hw->page_lock, flags);
-        mtk_w32(mac->hw, (macaddr[0] << 8) | macaddr[1], MTK_GDMA1_MAC_ADRH);
-        mtk_w32(mac->hw, (macaddr[2] << 24) | (macaddr[3] << 16) |
-                (macaddr[4] << 8) | macaddr[5],
-                MTK_GDMA1_MAC_ADRL);
-        spin_unlock_irqrestore(&mac->hw->page_lock, flags);
-}
-
-static int mtk_set_mac_address(struct net_device *dev, void *p)
-{
-        int ret = eth_mac_addr(dev, p);
-        struct mtk_mac *mac = netdev_priv(dev);
-        struct mtk_eth *eth = mac->hw;
-
-        if (ret)
-                return ret;
-
-        if (eth->soc->set_mac)
-                eth->soc->set_mac(mac, dev->dev_addr);
-        else
-                mtk_hw_set_macaddr(mac, p);
-
-        return 0;
-}
-
-static inline int mtk_max_frag_size(int mtu)
-{
-        /* make sure buf_size will be at least MAX_RX_LENGTH */
-        if (mtu + MTK_RX_ETH_HLEN < MAX_RX_LENGTH)
-                mtu = MAX_RX_LENGTH - MTK_RX_ETH_HLEN;
-
-        return SKB_DATA_ALIGN(MTK_RX_HLEN + mtu) +
-                SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
-}
-
-static inline int mtk_max_buf_size(int frag_size)
-{
-        int buf_size = frag_size - NET_SKB_PAD - NET_IP_ALIGN -
-                       SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
-
-        WARN_ON(buf_size < MAX_RX_LENGTH);
-
-        return buf_size;
-}
-
-static inline void mtk_get_rxd(struct mtk_rx_dma *rxd,
-                               struct mtk_rx_dma *dma_rxd)
-{
-        rxd->rxd1 = READ_ONCE(dma_rxd->rxd1);
-        rxd->rxd2 = READ_ONCE(dma_rxd->rxd2);
-        rxd->rxd3 = READ_ONCE(dma_rxd->rxd3);
-        rxd->rxd4 = READ_ONCE(dma_rxd->rxd4);
-}
-
-static inline void mtk_set_txd_pdma(struct mtk_tx_dma *txd,
-                                    struct mtk_tx_dma *dma_txd)
-{
-        WRITE_ONCE(dma_txd->txd1, txd->txd1);
-        WRITE_ONCE(dma_txd->txd3, txd->txd3);
-        WRITE_ONCE(dma_txd->txd4, txd->txd4);
-        /* clean dma done flag last */
-        WRITE_ONCE(dma_txd->txd2, txd->txd2);
-}
-
-static void mtk_clean_rx(struct mtk_eth *eth, struct mtk_rx_ring *ring)
-{
-        int i;
-
-        if (ring->rx_data && ring->rx_dma) {
-                for (i = 0; i < ring->rx_ring_size; i++) {
-                        if (!ring->rx_data[i])
-                                continue;
-                        if (!ring->rx_dma[i].rxd1)
-                                continue;
-                        dma_unmap_single(eth->dev,
-                                         ring->rx_dma[i].rxd1,
-                                         ring->rx_buf_size,
-                                         DMA_FROM_DEVICE);
-                        skb_free_frag(ring->rx_data[i]);
-                }
-                kfree(ring->rx_data);
-                ring->rx_data = NULL;
-        }
-
-        if (ring->rx_dma) {
-                dma_free_coherent(eth->dev,
-                                  ring->rx_ring_size * sizeof(*ring->rx_dma),
-                                  ring->rx_dma,
-                                  ring->rx_phys);
-                ring->rx_dma = NULL;
-        }
-}
-
-static int mtk_dma_rx_alloc(struct mtk_eth *eth, struct mtk_rx_ring *ring)
-{
-        int i, pad = 0;
-
-        ring->frag_size = mtk_max_frag_size(ETH_DATA_LEN);
-        ring->rx_buf_size = mtk_max_buf_size(ring->frag_size);
-        ring->rx_ring_size = eth->soc->dma_ring_size;
-        ring->rx_data = kcalloc(ring->rx_ring_size, sizeof(*ring->rx_data),
-                                GFP_KERNEL);
-        if (!ring->rx_data)
-                goto no_rx_mem;
-
-        for (i = 0; i < ring->rx_ring_size; i++) {
-                ring->rx_data[i] = netdev_alloc_frag(ring->frag_size);
-                if (!ring->rx_data[i])
-                        goto no_rx_mem;
-        }
-
-        ring->rx_dma =
-                dma_alloc_coherent(eth->dev,
-                                   ring->rx_ring_size * sizeof(*ring->rx_dma),
-                                   &ring->rx_phys, GFP_ATOMIC | __GFP_ZERO);
-        if (!ring->rx_dma)
-                goto no_rx_mem;
-
-        if (!eth->soc->rx_2b_offset)
-                pad = NET_IP_ALIGN;
-
-        for (i = 0; i < ring->rx_ring_size; i++) {
-                dma_addr_t dma_addr = dma_map_single(eth->dev,
-                                ring->rx_data[i] + NET_SKB_PAD + pad,
-                                ring->rx_buf_size,
-                                DMA_FROM_DEVICE);
-                if (unlikely(dma_mapping_error(eth->dev, dma_addr)))
-                        goto no_rx_mem;
-                ring->rx_dma[i].rxd1 = (unsigned int)dma_addr;
-
-                if (eth->soc->rx_sg_dma)
-                        ring->rx_dma[i].rxd2 = RX_DMA_PLEN0(ring->rx_buf_size);
-                else
-                        ring->rx_dma[i].rxd2 = RX_DMA_LSO;
-        }
-        ring->rx_calc_idx = ring->rx_ring_size - 1;
-        /* make sure that all changes to the dma ring are flushed before we
-         * continue
-         */
-        wmb();
-
-        return 0;
-
-no_rx_mem:
-        return -ENOMEM;
-}
-
-static void mtk_txd_unmap(struct device *dev, struct mtk_tx_buf *tx_buf)
-{
-        if (tx_buf->flags & MTK_TX_FLAGS_SINGLE0) {
-                dma_unmap_single(dev,
-                                 dma_unmap_addr(tx_buf, dma_addr0),
-                                 dma_unmap_len(tx_buf, dma_len0),
-                                 DMA_TO_DEVICE);
-        } else if (tx_buf->flags & MTK_TX_FLAGS_PAGE0) {
-                dma_unmap_page(dev,
-                               dma_unmap_addr(tx_buf, dma_addr0),
-                               dma_unmap_len(tx_buf, dma_len0),
-                               DMA_TO_DEVICE);
-        }
-        if (tx_buf->flags & MTK_TX_FLAGS_PAGE1)
-                dma_unmap_page(dev,
-                               dma_unmap_addr(tx_buf, dma_addr1),
-                               dma_unmap_len(tx_buf, dma_len1),
-                               DMA_TO_DEVICE);
-
-        tx_buf->flags = 0;
-        if (tx_buf->skb && (tx_buf->skb != (struct sk_buff *)DMA_DUMMY_DESC))
-                dev_kfree_skb_any(tx_buf->skb);
-        tx_buf->skb = NULL;
-}
-
-static void mtk_pdma_tx_clean(struct mtk_eth *eth)
-{
-        struct mtk_tx_ring *ring = &eth->tx_ring;
-        int i;
-
-        if (ring->tx_buf) {
-                for (i = 0; i < ring->tx_ring_size; i++)
-                        mtk_txd_unmap(eth->dev, &ring->tx_buf[i]);
-                kfree(ring->tx_buf);
-                ring->tx_buf = NULL;
-        }
-
-        if (ring->tx_dma) {
-                dma_free_coherent(eth->dev,
-                                  ring->tx_ring_size * sizeof(*ring->tx_dma),
-                                  ring->tx_dma,
-                                  ring->tx_phys);
-                ring->tx_dma = NULL;
-        }
-}
-
-static void mtk_qdma_tx_clean(struct mtk_eth *eth)
-{
-        struct mtk_tx_ring *ring = &eth->tx_ring;
-        int i;
-
-        if (ring->tx_buf) {
-                for (i = 0; i < ring->tx_ring_size; i++)
-                        mtk_txd_unmap(eth->dev, &ring->tx_buf[i]);
-                kfree(ring->tx_buf);
-                ring->tx_buf = NULL;
-        }
-
-        if (ring->tx_dma) {
-                dma_free_coherent(eth->dev,
-                                  ring->tx_ring_size * sizeof(*ring->tx_dma),
-                                  ring->tx_dma,
-                                  ring->tx_phys);
-                ring->tx_dma = NULL;
-        }
-}
-
-void mtk_stats_update_mac(struct mtk_mac *mac)
-{
-        struct mtk_hw_stats *hw_stats = mac->hw_stats;
-        unsigned int base = mtk_reg_table[MTK_REG_MTK_COUNTER_BASE];
-        u64 stats;
-
-        base += hw_stats->reg_offset;
-
-        u64_stats_update_begin(&hw_stats->syncp);
-
-        if (mac->hw->soc->new_stats) {
-                hw_stats->rx_bytes += mtk_r32(mac->hw, base);
-                stats =  mtk_r32(mac->hw, base + 0x04);
-                if (stats)
-                        hw_stats->rx_bytes += (stats << 32);
-                hw_stats->rx_packets += mtk_r32(mac->hw, base + 0x08);
-                hw_stats->rx_overflow += mtk_r32(mac->hw, base + 0x10);
-                hw_stats->rx_fcs_errors += mtk_r32(mac->hw, base + 0x14);
-                hw_stats->rx_short_errors += mtk_r32(mac->hw, base + 0x18);
-                hw_stats->rx_long_errors += mtk_r32(mac->hw, base + 0x1c);
-                hw_stats->rx_checksum_errors += mtk_r32(mac->hw, base + 0x20);
-                hw_stats->rx_flow_control_packets +=
-                                                mtk_r32(mac->hw, base + 0x24);
-                hw_stats->tx_skip += mtk_r32(mac->hw, base + 0x28);
-                hw_stats->tx_collisions += mtk_r32(mac->hw, base + 0x2c);
-                hw_stats->tx_bytes += mtk_r32(mac->hw, base + 0x30);
-                stats =  mtk_r32(mac->hw, base + 0x34);
-                if (stats)
-                        hw_stats->tx_bytes += (stats << 32);
-                hw_stats->tx_packets += mtk_r32(mac->hw, base + 0x38);
-        } else {
-                hw_stats->tx_bytes += mtk_r32(mac->hw, base);
-                hw_stats->tx_packets += mtk_r32(mac->hw, base + 0x04);
-                hw_stats->tx_skip += mtk_r32(mac->hw, base + 0x08);
-                hw_stats->tx_collisions += mtk_r32(mac->hw, base + 0x0c);
-                hw_stats->rx_bytes += mtk_r32(mac->hw, base + 0x20);
-                hw_stats->rx_packets += mtk_r32(mac->hw, base + 0x24);
-                hw_stats->rx_overflow += mtk_r32(mac->hw, base + 0x28);
-                hw_stats->rx_fcs_errors += mtk_r32(mac->hw, base + 0x2c);
-                hw_stats->rx_short_errors += mtk_r32(mac->hw, base + 0x30);
-                hw_stats->rx_long_errors += mtk_r32(mac->hw, base + 0x34);
-                hw_stats->rx_checksum_errors += mtk_r32(mac->hw, base + 0x38);
-                hw_stats->rx_flow_control_packets +=
-                                                mtk_r32(mac->hw, base + 0x3c);
-        }
-
-        u64_stats_update_end(&hw_stats->syncp);
-}
-
-static void mtk_get_stats64(struct net_device *dev,
-                            struct rtnl_link_stats64 *storage)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        struct mtk_hw_stats *hw_stats = mac->hw_stats;
-        unsigned int base = mtk_reg_table[MTK_REG_MTK_COUNTER_BASE];
-        unsigned int start;
-
-        if (!base) {
-                netdev_stats_to_stats64(storage, &dev->stats);
-                return;
-        }
-
-        if (netif_running(dev) && netif_device_present(dev)) {
-                if (spin_trylock(&hw_stats->stats_lock)) {
-                        mtk_stats_update_mac(mac);
-                        spin_unlock(&hw_stats->stats_lock);
-                }
-        }
-
-        do {
-                start = u64_stats_fetch_begin_irq(&hw_stats->syncp);
-                storage->rx_packets = hw_stats->rx_packets;
-                storage->tx_packets = hw_stats->tx_packets;
-                storage->rx_bytes = hw_stats->rx_bytes;
-                storage->tx_bytes = hw_stats->tx_bytes;
-                storage->collisions = hw_stats->tx_collisions;
-                storage->rx_length_errors = hw_stats->rx_short_errors +
-                        hw_stats->rx_long_errors;
-                storage->rx_over_errors = hw_stats->rx_overflow;
-                storage->rx_crc_errors = hw_stats->rx_fcs_errors;
-                storage->rx_errors = hw_stats->rx_checksum_errors;
-                storage->tx_aborted_errors = hw_stats->tx_skip;
-        } while (u64_stats_fetch_retry_irq(&hw_stats->syncp, start));
-
-        storage->tx_errors = dev->stats.tx_errors;
-        storage->rx_dropped = dev->stats.rx_dropped;
-        storage->tx_dropped = dev->stats.tx_dropped;
-}
-
-static int mtk_vlan_rx_add_vid(struct net_device *dev,
-                               __be16 proto, u16 vid)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        struct mtk_eth *eth = mac->hw;
-        u32 idx = (vid & 0xf);
-        u32 vlan_cfg;
-
-        if (!((mtk_reg_table[MTK_REG_MTK_DMA_VID_BASE]) &&
-              (dev->features & NETIF_F_HW_VLAN_CTAG_TX)))
-                return 0;
-
-        if (test_bit(idx, &eth->vlan_map)) {
-                netdev_warn(dev, "disable tx vlan offload\n");
-                dev->wanted_features &= ~NETIF_F_HW_VLAN_CTAG_TX;
-                netdev_update_features(dev);
-        } else {
-                vlan_cfg = mtk_r32(eth,
-                                   mtk_reg_table[MTK_REG_MTK_DMA_VID_BASE] +
-                                   ((idx >> 1) << 2));
-                if (idx & 0x1) {
-                        vlan_cfg &= 0xffff;
-                        vlan_cfg |= (vid << 16);
-                } else {
-                        vlan_cfg &= 0xffff0000;
-                        vlan_cfg |= vid;
-                }
-                mtk_w32(eth,
-                        vlan_cfg, mtk_reg_table[MTK_REG_MTK_DMA_VID_BASE] +
-                        ((idx >> 1) << 2));
-                set_bit(idx, &eth->vlan_map);
-        }
-
-        return 0;
-}
-
-static int mtk_vlan_rx_kill_vid(struct net_device *dev,
-                                __be16 proto, u16 vid)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        struct mtk_eth *eth = mac->hw;
-        u32 idx = (vid & 0xf);
-
-        if (!((mtk_reg_table[MTK_REG_MTK_DMA_VID_BASE]) &&
-              (dev->features & NETIF_F_HW_VLAN_CTAG_TX)))
-                return 0;
-
-        clear_bit(idx, &eth->vlan_map);
-
-        return 0;
-}
-
-static inline u32 mtk_pdma_empty_txd(struct mtk_tx_ring *ring)
-{
-        barrier();
-        return (u32)(ring->tx_ring_size -
-                     ((ring->tx_next_idx - ring->tx_free_idx) &
-                      (ring->tx_ring_size - 1)));
-}
-
-static int mtk_skb_padto(struct sk_buff *skb, struct mtk_eth *eth)
-{
-        unsigned int len;
-        int ret;
-
-        if (unlikely(skb->len >= VLAN_ETH_ZLEN))
-                return 0;
-
-        if (eth->soc->padding_64b && !eth->soc->padding_bug)
-                return 0;
-
-        if (skb_vlan_tag_present(skb))
-                len = ETH_ZLEN;
-        else if (skb->protocol == cpu_to_be16(ETH_P_8021Q))
-                len = VLAN_ETH_ZLEN;
-        else if (!eth->soc->padding_64b)
-                len = ETH_ZLEN;
-        else
-                return 0;
-
-        if (skb->len >= len)
-                return 0;
-
-        ret = skb_pad(skb, len - skb->len);
-        if (ret < 0)
-                return ret;
-        skb->len = len;
-        skb_set_tail_pointer(skb, len);
-
-        return ret;
-}
-
-static int mtk_pdma_tx_map(struct sk_buff *skb, struct net_device *dev,
-                           int tx_num, struct mtk_tx_ring *ring, bool gso)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        struct mtk_eth *eth = mac->hw;
-        struct skb_frag_struct *frag;
-        struct mtk_tx_dma txd, *ptxd;
-        struct mtk_tx_buf *tx_buf;
-        int i, j, k, frag_size, frag_map_size, offset;
-        dma_addr_t mapped_addr;
-        unsigned int nr_frags;
-        u32 def_txd4;
-
-        if (mtk_skb_padto(skb, eth)) {
-                netif_warn(eth, tx_err, dev, "tx padding failed!\n");
-                return -1;
-        }
-
-        tx_buf = &ring->tx_buf[ring->tx_next_idx];
-        memset(tx_buf, 0, sizeof(*tx_buf));
-        memset(&txd, 0, sizeof(txd));
-        nr_frags = skb_shinfo(skb)->nr_frags;
-
-        /* init tx descriptor */
-        def_txd4 = eth->soc->txd4;
-        txd.txd4 = def_txd4;
-
-        if (eth->soc->mac_count > 1)
-                txd.txd4 |= (mac->id + 1) << TX_DMA_FPORT_SHIFT;
-
-        if (gso)
-                txd.txd4 |= TX_DMA_TSO;
-
-        /* TX Checksum offload */
-        if (skb->ip_summed == CHECKSUM_PARTIAL)
-                txd.txd4 |= TX_DMA_CHKSUM;
-
-        /* VLAN header offload */
-        if (skb_vlan_tag_present(skb)) {
-                u16 tag = skb_vlan_tag_get(skb);
-
-                txd.txd4 |= TX_DMA_INS_VLAN |
-                        ((tag >> VLAN_PRIO_SHIFT) << 4) |
-                        (tag & 0xF);
-        }
-
-        mapped_addr = dma_map_single(&dev->dev, skb->data,
-                                     skb_headlen(skb), DMA_TO_DEVICE);
-        if (unlikely(dma_mapping_error(&dev->dev, mapped_addr)))
-                return -1;
-
-        txd.txd1 = mapped_addr;
-        txd.txd2 = TX_DMA_PLEN0(skb_headlen(skb));
-
-        tx_buf->flags |= MTK_TX_FLAGS_SINGLE0;
-        dma_unmap_addr_set(tx_buf, dma_addr0, mapped_addr);
-        dma_unmap_len_set(tx_buf, dma_len0, skb_headlen(skb));
-
-        /* TX SG offload */
-        j = ring->tx_next_idx;
-        k = 0;
-        for (i = 0; i < nr_frags; i++) {
-                offset = 0;
-                frag = &skb_shinfo(skb)->frags[i];
-                frag_size = skb_frag_size(frag);
-
-                while (frag_size > 0) {
-                        frag_map_size = min(frag_size, TX_DMA_BUF_LEN);
-                        mapped_addr = skb_frag_dma_map(&dev->dev, frag, offset,
-                                                       frag_map_size,
-                                                       DMA_TO_DEVICE);
-                        if (unlikely(dma_mapping_error(&dev->dev, mapped_addr)))
-                                goto err_dma;
-
-                        if (k & 0x1) {
-                                j = NEXT_TX_DESP_IDX(j);
-                                txd.txd1 = mapped_addr;
-                                txd.txd2 = TX_DMA_PLEN0(frag_map_size);
-                                txd.txd4 = def_txd4;
-
-                                tx_buf = &ring->tx_buf[j];
-                                memset(tx_buf, 0, sizeof(*tx_buf));
-
-                                tx_buf->flags |= MTK_TX_FLAGS_PAGE0;
-                                dma_unmap_addr_set(tx_buf, dma_addr0,
-                                                   mapped_addr);
-                                dma_unmap_len_set(tx_buf, dma_len0,
-                                                  frag_map_size);
-                        } else {
-                                txd.txd3 = mapped_addr;
-                                txd.txd2 |= TX_DMA_PLEN1(frag_map_size);
-
-                                tx_buf->skb = (struct sk_buff *)DMA_DUMMY_DESC;
-                                tx_buf->flags |= MTK_TX_FLAGS_PAGE1;
-                                dma_unmap_addr_set(tx_buf, dma_addr1,
-                                                   mapped_addr);
-                                dma_unmap_len_set(tx_buf, dma_len1,
-                                                  frag_map_size);
-
-                                if (!((i == (nr_frags - 1)) &&
-                                      (frag_map_size == frag_size))) {
-                                        mtk_set_txd_pdma(&txd,
-                                                         &ring->tx_dma[j]);
-                                        memset(&txd, 0, sizeof(txd));
-                                }
-                        }
-                        frag_size -= frag_map_size;
-                        offset += frag_map_size;
-                        k++;
-                }
-        }
-
-        /* set last segment */
-        if (k & 0x1)
-                txd.txd2 |= TX_DMA_LS1;
-        else
-                txd.txd2 |= TX_DMA_LS0;
-        mtk_set_txd_pdma(&txd, &ring->tx_dma[j]);
-
-        /* store skb to cleanup */
-        tx_buf->skb = skb;
-
-        netdev_sent_queue(dev, skb->len);
-        skb_tx_timestamp(skb);
-
-        ring->tx_next_idx = NEXT_TX_DESP_IDX(j);
-        /* make sure that all changes to the dma ring are flushed before we
-         * continue
-         */
-        wmb();
-        atomic_set(&ring->tx_free_count, mtk_pdma_empty_txd(ring));
-
-        if (netif_xmit_stopped(netdev_get_tx_queue(dev, 0)) ||
-            !netdev_xmit_more())
-                mtk_reg_w32(eth, ring->tx_next_idx, MTK_REG_TX_CTX_IDX0);
-
-        return 0;
-
-err_dma:
-        j = ring->tx_next_idx;
-        for (i = 0; i < tx_num; i++) {
-                ptxd = &ring->tx_dma[j];
-                tx_buf = &ring->tx_buf[j];
-
-                /* unmap dma */
-                mtk_txd_unmap(&dev->dev, tx_buf);
-
-                ptxd->txd2 = TX_DMA_DESP2_DEF;
-                j = NEXT_TX_DESP_IDX(j);
-        }
-        /* make sure that all changes to the dma ring are flushed before we
-         * continue
-         */
-        wmb();
-        return -1;
-}
-
-/* the qdma core needs scratch memory to be setup */
-static int mtk_init_fq_dma(struct mtk_eth *eth)
-{
-        dma_addr_t dma_addr, phy_ring_head, phy_ring_tail;
-        int cnt = eth->soc->dma_ring_size;
-        int i;
-
-        eth->scratch_ring = dma_alloc_coherent(eth->dev,
-                                               cnt * sizeof(struct mtk_tx_dma),
-                                               &phy_ring_head,
-                                               GFP_ATOMIC | __GFP_ZERO);
-        if (unlikely(!eth->scratch_ring))
-                return -ENOMEM;
-
-        eth->scratch_head = kcalloc(cnt, QDMA_PAGE_SIZE,
-                                    GFP_KERNEL);
-        dma_addr = dma_map_single(eth->dev,
-                                  eth->scratch_head, cnt * QDMA_PAGE_SIZE,
-                                  DMA_FROM_DEVICE);
-        if (unlikely(dma_mapping_error(eth->dev, dma_addr)))
-                return -ENOMEM;
-
-        memset(eth->scratch_ring, 0x0, sizeof(struct mtk_tx_dma) * cnt);
-        phy_ring_tail = phy_ring_head + (sizeof(struct mtk_tx_dma) * (cnt - 1));
-
-        for (i = 0; i < cnt; i++) {
-                eth->scratch_ring[i].txd1 = (dma_addr + (i * QDMA_PAGE_SIZE));
-                if (i < cnt - 1)
-                        eth->scratch_ring[i].txd2 = (phy_ring_head +
-                                ((i + 1) * sizeof(struct mtk_tx_dma)));
-                eth->scratch_ring[i].txd3 = TX_QDMA_SDL(QDMA_PAGE_SIZE);
-        }
-
-        mtk_w32(eth, phy_ring_head, MTK_QDMA_FQ_HEAD);
-        mtk_w32(eth, phy_ring_tail, MTK_QDMA_FQ_TAIL);
-        mtk_w32(eth, (cnt << 16) | cnt, MTK_QDMA_FQ_CNT);
-        mtk_w32(eth, QDMA_PAGE_SIZE << 16, MTK_QDMA_FQ_BLEN);
-
-        return 0;
-}
-
-static void *mtk_qdma_phys_to_virt(struct mtk_tx_ring *ring, u32 desc)
-{
-        void *ret = ring->tx_dma;
-
-        return ret + (desc - ring->tx_phys);
-}
-
-static struct mtk_tx_dma *mtk_tx_next_qdma(struct mtk_tx_ring *ring,
-                                           struct mtk_tx_dma *txd)
-{
-        return mtk_qdma_phys_to_virt(ring, txd->txd2);
-}
-
-static struct mtk_tx_buf *mtk_desc_to_tx_buf(struct mtk_tx_ring *ring,
-                                             struct mtk_tx_dma *txd)
-{
-        int idx = txd - ring->tx_dma;
-
-        return &ring->tx_buf[idx];
-}
-
-static int mtk_qdma_tx_map(struct sk_buff *skb, struct net_device *dev,
-                           int tx_num, struct mtk_tx_ring *ring, bool gso)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        struct mtk_eth *eth = mac->hw;
-        struct mtk_tx_dma *itxd, *txd;
-        struct mtk_tx_buf *tx_buf;
-        dma_addr_t mapped_addr;
-        unsigned int nr_frags;
-        int i, n_desc = 1;
-        u32 txd4 = eth->soc->txd4;
-
-        itxd = ring->tx_next_free;
-        if (itxd == ring->tx_last_free)
-                return -ENOMEM;
-
-        if (eth->soc->mac_count > 1)
-                txd4 |= (mac->id + 1) << TX_DMA_FPORT_SHIFT;
-
-        tx_buf = mtk_desc_to_tx_buf(ring, itxd);
-        memset(tx_buf, 0, sizeof(*tx_buf));
-
-        if (gso)
-                txd4 |= TX_DMA_TSO;
-
-        /* TX Checksum offload */
-        if (skb->ip_summed == CHECKSUM_PARTIAL)
-                txd4 |= TX_DMA_CHKSUM;
-
-        /* VLAN header offload */
-        if (skb_vlan_tag_present(skb))
-                txd4 |= TX_DMA_INS_VLAN_MT7621 | skb_vlan_tag_get(skb);
-
-        mapped_addr = dma_map_single(&dev->dev, skb->data,
-                                     skb_headlen(skb), DMA_TO_DEVICE);
-        if (unlikely(dma_mapping_error(&dev->dev, mapped_addr)))
-                return -ENOMEM;
-
-        WRITE_ONCE(itxd->txd1, mapped_addr);
-        tx_buf->flags |= MTK_TX_FLAGS_SINGLE0;
-        dma_unmap_addr_set(tx_buf, dma_addr0, mapped_addr);
-        dma_unmap_len_set(tx_buf, dma_len0, skb_headlen(skb));
-
-        /* TX SG offload */
-        txd = itxd;
-        nr_frags = skb_shinfo(skb)->nr_frags;
-        for (i = 0; i < nr_frags; i++) {
-                struct skb_frag_struct *frag = &skb_shinfo(skb)->frags[i];
-                unsigned int offset = 0;
-                int frag_size = skb_frag_size(frag);
-
-                while (frag_size) {
-                        bool last_frag = false;
-                        unsigned int frag_map_size;
-
-                        txd = mtk_tx_next_qdma(ring, txd);
-                        if (txd == ring->tx_last_free)
-                                goto err_dma;
-
-                        n_desc++;
-                        frag_map_size = min(frag_size, TX_DMA_BUF_LEN);
-                        mapped_addr = skb_frag_dma_map(&dev->dev, frag, offset,
-                                                       frag_map_size,
-                                                       DMA_TO_DEVICE);
-                        if (unlikely(dma_mapping_error(&dev->dev, mapped_addr)))
-                                goto err_dma;
-
-                        if (i == nr_frags - 1 &&
-                            (frag_size - frag_map_size) == 0)
-                                last_frag = true;
-
-                        WRITE_ONCE(txd->txd1, mapped_addr);
-                        WRITE_ONCE(txd->txd3, (QDMA_TX_SWC |
-                                               TX_DMA_PLEN0(frag_map_size) |
-                                               last_frag * TX_DMA_LS0) |
-                                               mac->id);
-                        WRITE_ONCE(txd->txd4, 0);
-
-                        tx_buf->skb = (struct sk_buff *)DMA_DUMMY_DESC;
-                        tx_buf = mtk_desc_to_tx_buf(ring, txd);
-                        memset(tx_buf, 0, sizeof(*tx_buf));
-
-                        tx_buf->flags |= MTK_TX_FLAGS_PAGE0;
-                        dma_unmap_addr_set(tx_buf, dma_addr0, mapped_addr);
-                        dma_unmap_len_set(tx_buf, dma_len0, frag_map_size);
-                        frag_size -= frag_map_size;
-                        offset += frag_map_size;
-                }
-        }
-
-        /* store skb to cleanup */
-        tx_buf->skb = skb;
-
-        WRITE_ONCE(itxd->txd4, txd4);
-        WRITE_ONCE(itxd->txd3, (QDMA_TX_SWC | TX_DMA_PLEN0(skb_headlen(skb)) |
-                                (!nr_frags * TX_DMA_LS0)));
-
-        netdev_sent_queue(dev, skb->len);
-        skb_tx_timestamp(skb);
-
-        ring->tx_next_free = mtk_tx_next_qdma(ring, txd);
-        atomic_sub(n_desc, &ring->tx_free_count);
-
-        /* make sure that all changes to the dma ring are flushed before we
-         * continue
-         */
-        wmb();
-
-        if (netif_xmit_stopped(netdev_get_tx_queue(dev, 0)) ||
-            !netdev_xmit_more())
-                mtk_w32(eth, txd->txd2, MTK_QTX_CTX_PTR);
-
-        return 0;
-
-err_dma:
-        do {
-                tx_buf = mtk_desc_to_tx_buf(ring, txd);
-
-                /* unmap dma */
-                mtk_txd_unmap(&dev->dev, tx_buf);
-
-                itxd->txd3 = TX_DMA_DESP2_DEF;
-                itxd = mtk_tx_next_qdma(ring, itxd);
-        } while (itxd != txd);
-
-        return -ENOMEM;
-}
-
-static inline int mtk_cal_txd_req(struct sk_buff *skb)
-{
-        int i, nfrags;
-        struct skb_frag_struct *frag;
-
-        nfrags = 1;
-        if (skb_is_gso(skb)) {
-                for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
-                        frag = &skb_shinfo(skb)->frags[i];
-                        nfrags += DIV_ROUND_UP(frag->size, TX_DMA_BUF_LEN);
-                }
-        } else {
-                nfrags += skb_shinfo(skb)->nr_frags;
-        }
-
-        return DIV_ROUND_UP(nfrags, 2);
-}
-
-static int mtk_start_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        struct mtk_eth *eth = mac->hw;
-        struct mtk_tx_ring *ring = &eth->tx_ring;
-        struct net_device_stats *stats = &dev->stats;
-        int tx_num;
-        int len = skb->len;
-        bool gso = false;
-
-        tx_num = mtk_cal_txd_req(skb);
-        if (unlikely(atomic_read(&ring->tx_free_count) <= tx_num)) {
-                netif_stop_queue(dev);
-                netif_err(eth, tx_queued, dev,
-                          "Tx Ring full when queue awake!\n");
-                return NETDEV_TX_BUSY;
-        }
-
-        /* TSO: fill MSS info in tcp checksum field */
-        if (skb_is_gso(skb)) {
-                if (skb_cow_head(skb, 0)) {
-                        netif_warn(eth, tx_err, dev,
-                                   "GSO expand head fail.\n");
-                        goto drop;
-                }
-
-                if (skb_shinfo(skb)->gso_type &
-                                (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) {
-                        gso = true;
-                        tcp_hdr(skb)->check = htons(skb_shinfo(skb)->gso_size);
-                }
-        }
-
-        if (ring->tx_map(skb, dev, tx_num, ring, gso) < 0)
-                goto drop;
-
-        stats->tx_packets++;
-        stats->tx_bytes += len;
-
-        if (unlikely(atomic_read(&ring->tx_free_count) <= ring->tx_thresh)) {
-                netif_stop_queue(dev);
-                smp_mb();
-                if (unlikely(atomic_read(&ring->tx_free_count) >
-                             ring->tx_thresh))
-                        netif_wake_queue(dev);
-        }
-
-        return NETDEV_TX_OK;
-
-drop:
-        stats->tx_dropped++;
-        dev_kfree_skb(skb);
-        return NETDEV_TX_OK;
-}
-
-static int mtk_poll_rx(struct napi_struct *napi, int budget,
-                       struct mtk_eth *eth, u32 rx_intr)
-{
-        struct mtk_soc_data *soc = eth->soc;
-        struct mtk_rx_ring *ring = &eth->rx_ring[0];
-        int idx = ring->rx_calc_idx;
-        u32 checksum_bit;
-        struct sk_buff *skb;
-        u8 *data, *new_data;
-        struct mtk_rx_dma *rxd, trxd;
-        int done = 0, pad;
-
-        if (eth->soc->hw_features & NETIF_F_RXCSUM)
-                checksum_bit = soc->checksum_bit;
-        else
-                checksum_bit = 0;
-
-        if (eth->soc->rx_2b_offset)
-                pad = 0;
-        else
-                pad = NET_IP_ALIGN;
-
-        while (done < budget) {
-                struct net_device *netdev;
-                unsigned int pktlen;
-                dma_addr_t dma_addr;
-                int mac = 0;
-
-                idx = NEXT_RX_DESP_IDX(idx);
-                rxd = &ring->rx_dma[idx];
-                data = ring->rx_data[idx];
-
-                mtk_get_rxd(&trxd, rxd);
-                if (!(trxd.rxd2 & RX_DMA_DONE))
-                        break;
-
-                /* find out which mac the packet come from. values start at 1 */
-                if (eth->soc->mac_count > 1) {
-                        mac = (trxd.rxd4 >> RX_DMA_FPORT_SHIFT) &
-                              RX_DMA_FPORT_MASK;
-                        mac--;
-                        if (mac < 0 || mac >= eth->soc->mac_count)
-                                goto release_desc;
-                }
-
-                netdev = eth->netdev[mac];
-
-                /* alloc new buffer */
-                new_data = napi_alloc_frag(ring->frag_size);
-                if (unlikely(!new_data || !netdev)) {
-                        netdev->stats.rx_dropped++;
-                        goto release_desc;
-                }
-                dma_addr = dma_map_single(&netdev->dev,
-                                          new_data + NET_SKB_PAD + pad,
-                                          ring->rx_buf_size,
-                                          DMA_FROM_DEVICE);
-                if (unlikely(dma_mapping_error(&netdev->dev, dma_addr))) {
-                        skb_free_frag(new_data);
-                        goto release_desc;
-                }
-
-                /* receive data */
-                skb = build_skb(data, ring->frag_size);
-                if (unlikely(!skb)) {
-                        put_page(virt_to_head_page(new_data));
-                        goto release_desc;
-                }
-                skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN);
-
-                dma_unmap_single(&netdev->dev, trxd.rxd1,
-                                 ring->rx_buf_size, DMA_FROM_DEVICE);
-                pktlen = RX_DMA_GET_PLEN0(trxd.rxd2);
-                skb->dev = netdev;
-                skb_put(skb, pktlen);
-                if (trxd.rxd4 & checksum_bit)
-                        skb->ip_summed = CHECKSUM_UNNECESSARY;
-                else
-                        skb_checksum_none_assert(skb);
-                skb->protocol = eth_type_trans(skb, netdev);
-
-                netdev->stats.rx_packets++;
-                netdev->stats.rx_bytes += pktlen;
-
-                if (netdev->features & NETIF_F_HW_VLAN_CTAG_RX &&
-                    RX_DMA_VID(trxd.rxd3))
-                        __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q),
-                                               RX_DMA_VID(trxd.rxd3));
-                napi_gro_receive(napi, skb);
-
-                ring->rx_data[idx] = new_data;
-                rxd->rxd1 = (unsigned int)dma_addr;
-
-release_desc:
-                if (eth->soc->rx_sg_dma)
-                        rxd->rxd2 = RX_DMA_PLEN0(ring->rx_buf_size);
-                else
-                        rxd->rxd2 = RX_DMA_LSO;
-
-                ring->rx_calc_idx = idx;
-                /* make sure that all changes to the dma ring are flushed before
-                 * we continue
-                 */
-                wmb();
-                if (eth->soc->dma_type == MTK_QDMA)
-                        mtk_w32(eth, ring->rx_calc_idx, MTK_QRX_CRX_IDX0);
-                else
-                        mtk_reg_w32(eth, ring->rx_calc_idx,
-                                    MTK_REG_RX_CALC_IDX0);
-                done++;
-        }
-
-        if (done < budget)
-                mtk_irq_ack(eth, rx_intr);
-
-        return done;
-}
-
-static int mtk_pdma_tx_poll(struct mtk_eth *eth, int budget, bool *tx_again)
-{
-        struct sk_buff *skb;
-        struct mtk_tx_buf *tx_buf;
-        int done = 0;
-        u32 idx, hwidx;
-        struct mtk_tx_ring *ring = &eth->tx_ring;
-        unsigned int bytes = 0;
-
-        idx = ring->tx_free_idx;
-        hwidx = mtk_reg_r32(eth, MTK_REG_TX_DTX_IDX0);
-
-        while ((idx != hwidx) && budget) {
-                tx_buf = &ring->tx_buf[idx];
-                skb = tx_buf->skb;
-
-                if (!skb)
-                        break;
-
-                if (skb != (struct sk_buff *)DMA_DUMMY_DESC) {
-                        bytes += skb->len;
-                        done++;
-                        budget--;
-                }
-                mtk_txd_unmap(eth->dev, tx_buf);
-                idx = NEXT_TX_DESP_IDX(idx);
-        }
-        ring->tx_free_idx = idx;
-        atomic_set(&ring->tx_free_count, mtk_pdma_empty_txd(ring));
-
-        /* read hw index again make sure no new tx packet */
-        if (idx != hwidx || idx != mtk_reg_r32(eth, MTK_REG_TX_DTX_IDX0))
-                *tx_again = 1;
-
-        if (done)
-                netdev_completed_queue(*eth->netdev, done, bytes);
-
-        return done;
-}
-
-static int mtk_qdma_tx_poll(struct mtk_eth *eth, int budget, bool *tx_again)
-{
-        struct mtk_tx_ring *ring = &eth->tx_ring;
-        struct mtk_tx_dma *desc;
-        struct sk_buff *skb;
-        struct mtk_tx_buf *tx_buf;
-        int total = 0, done[MTK_MAX_DEVS];
-        unsigned int bytes[MTK_MAX_DEVS];
-        u32 cpu, dma;
-        int i;
-
-        memset(done, 0, sizeof(done));
-        memset(bytes, 0, sizeof(bytes));
-
-        cpu = mtk_r32(eth, MTK_QTX_CRX_PTR);
-        dma = mtk_r32(eth, MTK_QTX_DRX_PTR);
-
-        desc = mtk_qdma_phys_to_virt(ring, cpu);
-
-        while ((cpu != dma) && budget) {
-                u32 next_cpu = desc->txd2;
-                int mac;
-
-                desc = mtk_tx_next_qdma(ring, desc);
-                if ((desc->txd3 & QDMA_TX_OWNER_CPU) == 0)
-                        break;
-
-                mac = (desc->txd4 >> TX_DMA_FPORT_SHIFT) &
-                       TX_DMA_FPORT_MASK;
-                mac--;
-
-                tx_buf = mtk_desc_to_tx_buf(ring, desc);
-                skb = tx_buf->skb;
-                if (!skb)
-                        break;
-
-                if (skb != (struct sk_buff *)DMA_DUMMY_DESC) {
-                        bytes[mac] += skb->len;
-                        done[mac]++;
-                        budget--;
-                }
-                mtk_txd_unmap(eth->dev, tx_buf);
-
-                ring->tx_last_free->txd2 = next_cpu;
-                ring->tx_last_free = desc;
-                atomic_inc(&ring->tx_free_count);
-
-                cpu = next_cpu;
-        }
-
-        mtk_w32(eth, cpu, MTK_QTX_CRX_PTR);
-
-        /* read hw index again make sure no new tx packet */
-        if (cpu != dma || cpu != mtk_r32(eth, MTK_QTX_DRX_PTR))
-                *tx_again = true;
-
-        for (i = 0; i < eth->soc->mac_count; i++) {
-                if (!done[i])
-                        continue;
-                netdev_completed_queue(eth->netdev[i], done[i], bytes[i]);
-                total += done[i];
-        }
-
-        return total;
-}
-
-static int mtk_poll_tx(struct mtk_eth *eth, int budget, u32 tx_intr,
-                       bool *tx_again)
-{
-        struct mtk_tx_ring *ring = &eth->tx_ring;
-        struct net_device *netdev = eth->netdev[0];
-        int done;
-
-        done = eth->tx_ring.tx_poll(eth, budget, tx_again);
-        if (!*tx_again)
-                mtk_irq_ack(eth, tx_intr);
-
-        if (!done)
-                return 0;
-
-        smp_mb();
-        if (unlikely(!netif_queue_stopped(netdev)))
-                return done;
-
-        if (atomic_read(&ring->tx_free_count) > ring->tx_thresh)
-                netif_wake_queue(netdev);
-
-        return done;
-}
-
-static void mtk_stats_update(struct mtk_eth *eth)
-{
-        int i;
-
-        for (i = 0; i < eth->soc->mac_count; i++) {
-                if (!eth->mac[i] || !eth->mac[i]->hw_stats)
-                        continue;
-                if (spin_trylock(&eth->mac[i]->hw_stats->stats_lock)) {
-                        mtk_stats_update_mac(eth->mac[i]);
-                        spin_unlock(&eth->mac[i]->hw_stats->stats_lock);
-                }
-        }
-}
-
-static int mtk_poll(struct napi_struct *napi, int budget)
-{
-        struct mtk_eth *eth = container_of(napi, struct mtk_eth, rx_napi);
-        u32 status, mtk_status, mask, tx_intr, rx_intr, status_intr;
-        int tx_done, rx_done;
-        bool tx_again = false;
-
-        status = mtk_irq_pending(eth);
-        mtk_status = mtk_irq_pending_status(eth);
-        tx_intr = eth->soc->tx_int;
-        rx_intr = eth->soc->rx_int;
-        status_intr = eth->soc->status_int;
-        tx_done = 0;
-        rx_done = 0;
-        tx_again = 0;
-
-        if (status & tx_intr)
-                tx_done = mtk_poll_tx(eth, budget, tx_intr, &tx_again);
-
-        if (status & rx_intr)
-                rx_done = mtk_poll_rx(napi, budget, eth, rx_intr);
-
-        if (unlikely(mtk_status & status_intr)) {
-                mtk_stats_update(eth);
-                mtk_irq_ack_status(eth, status_intr);
-        }
-
-        if (unlikely(netif_msg_intr(eth))) {
-                mask = mtk_irq_enabled(eth);
-                netdev_info(eth->netdev[0],
-                            "done tx %d, rx %d, intr 0x%08x/0x%x\n",
-                            tx_done, rx_done, status, mask);
-        }
-
-        if (tx_again || rx_done == budget)
-                return budget;
-
-        status = mtk_irq_pending(eth);
-        if (status & (tx_intr | rx_intr))
-                return budget;
-
-        napi_complete(napi);
-        mtk_irq_enable(eth, tx_intr | rx_intr);
-
-        return rx_done;
-}
-
-static int mtk_pdma_tx_alloc(struct mtk_eth *eth)
-{
-        int i;
-        struct mtk_tx_ring *ring = &eth->tx_ring;
-
-        ring->tx_ring_size = eth->soc->dma_ring_size;
-        ring->tx_free_idx = 0;
-        ring->tx_next_idx = 0;
-        ring->tx_thresh = max((unsigned long)ring->tx_ring_size >> 2,
-                              MAX_SKB_FRAGS);
-
-        ring->tx_buf = kcalloc(ring->tx_ring_size, sizeof(*ring->tx_buf),
-                               GFP_KERNEL);
-        if (!ring->tx_buf)
-                goto no_tx_mem;
-
-        ring->tx_dma =
-                dma_alloc_coherent(eth->dev,
-                                   ring->tx_ring_size * sizeof(*ring->tx_dma),
-                                   &ring->tx_phys, GFP_ATOMIC | __GFP_ZERO);
-        if (!ring->tx_dma)
-                goto no_tx_mem;
-
-        for (i = 0; i < ring->tx_ring_size; i++) {
-                ring->tx_dma[i].txd2 = TX_DMA_DESP2_DEF;
-                ring->tx_dma[i].txd4 = eth->soc->txd4;
-        }
-
-        atomic_set(&ring->tx_free_count, mtk_pdma_empty_txd(ring));
-        ring->tx_map = mtk_pdma_tx_map;
-        ring->tx_poll = mtk_pdma_tx_poll;
-        ring->tx_clean = mtk_pdma_tx_clean;
-
-        /* make sure that all changes to the dma ring are flushed before we
-         * continue
-         */
-        wmb();
-
-        mtk_reg_w32(eth, ring->tx_phys, MTK_REG_TX_BASE_PTR0);
-        mtk_reg_w32(eth, ring->tx_ring_size, MTK_REG_TX_MAX_CNT0);
-        mtk_reg_w32(eth, 0, MTK_REG_TX_CTX_IDX0);
-        mtk_reg_w32(eth, MTK_PST_DTX_IDX0, MTK_REG_PDMA_RST_CFG);
-
-        return 0;
-
-no_tx_mem:
-        return -ENOMEM;
-}
-
-static int mtk_qdma_tx_alloc_tx(struct mtk_eth *eth)
-{
-        struct mtk_tx_ring *ring = &eth->tx_ring;
-        int i, sz = sizeof(*ring->tx_dma);
-
-        ring->tx_ring_size = eth->soc->dma_ring_size;
-        ring->tx_buf = kcalloc(ring->tx_ring_size, sizeof(*ring->tx_buf),
-                               GFP_KERNEL);
-        if (!ring->tx_buf)
-                goto no_tx_mem;
-
-        ring->tx_dma = dma_alloc_coherent(eth->dev, ring->tx_ring_size * sz,
-                                          &ring->tx_phys,
-                                          GFP_ATOMIC | __GFP_ZERO);
-        if (!ring->tx_dma)
-                goto no_tx_mem;
-
-        for (i = 0; i < ring->tx_ring_size; i++) {
-                int next = (i + 1) % ring->tx_ring_size;
-                u32 next_ptr = ring->tx_phys + next * sz;
-
-                ring->tx_dma[i].txd2 = next_ptr;
-                ring->tx_dma[i].txd3 = TX_DMA_DESP2_DEF;
-        }
-
-        atomic_set(&ring->tx_free_count, ring->tx_ring_size - 2);
-        ring->tx_next_free = &ring->tx_dma[0];
-        ring->tx_last_free = &ring->tx_dma[ring->tx_ring_size - 2];
-        ring->tx_thresh = max((unsigned long)ring->tx_ring_size >> 2,
-                              MAX_SKB_FRAGS);
-
-        ring->tx_map = mtk_qdma_tx_map;
-        ring->tx_poll = mtk_qdma_tx_poll;
-        ring->tx_clean = mtk_qdma_tx_clean;
-
-        /* make sure that all changes to the dma ring are flushed before we
-         * continue
-         */
-        wmb();
-
-        mtk_w32(eth, ring->tx_phys, MTK_QTX_CTX_PTR);
-        mtk_w32(eth, ring->tx_phys, MTK_QTX_DTX_PTR);
-        mtk_w32(eth,
-                ring->tx_phys + ((ring->tx_ring_size - 1) * sz),
-                MTK_QTX_CRX_PTR);
-        mtk_w32(eth,
-                ring->tx_phys + ((ring->tx_ring_size - 1) * sz),
-                MTK_QTX_DRX_PTR);
-
-        return 0;
-
-no_tx_mem:
-        return -ENOMEM;
-}
-
-static int mtk_qdma_init(struct mtk_eth *eth, int ring)
-{
-        int err;
-
-        err = mtk_init_fq_dma(eth);
-        if (err)
-                return err;
-
-        err = mtk_qdma_tx_alloc_tx(eth);
-        if (err)
-                return err;
-
-        err = mtk_dma_rx_alloc(eth, &eth->rx_ring[ring]);
-        if (err)
-                return err;
-
-        mtk_w32(eth, eth->rx_ring[ring].rx_phys, MTK_QRX_BASE_PTR0);
-        mtk_w32(eth, eth->rx_ring[ring].rx_ring_size, MTK_QRX_MAX_CNT0);
-        mtk_w32(eth, eth->rx_ring[ring].rx_calc_idx, MTK_QRX_CRX_IDX0);
-        mtk_w32(eth, MTK_PST_DRX_IDX0, MTK_QDMA_RST_IDX);
-        mtk_w32(eth, (QDMA_RES_THRES << 8) | QDMA_RES_THRES, MTK_QTX_CFG(0));
-
-        /* Enable random early drop and set drop threshold automatically */
-        mtk_w32(eth, 0x174444, MTK_QDMA_FC_THRES);
-        mtk_w32(eth, 0x0, MTK_QDMA_HRED2);
-
-        return 0;
-}
-
-static int mtk_pdma_qdma_init(struct mtk_eth *eth)
-{
-        int err = mtk_qdma_init(eth, 1);
-
-        if (err)
-                return err;
-
-        err = mtk_dma_rx_alloc(eth, &eth->rx_ring[0]);
-        if (err)
-                return err;
-
-        mtk_reg_w32(eth, eth->rx_ring[0].rx_phys, MTK_REG_RX_BASE_PTR0);
-        mtk_reg_w32(eth, eth->rx_ring[0].rx_ring_size, MTK_REG_RX_MAX_CNT0);
-        mtk_reg_w32(eth, eth->rx_ring[0].rx_calc_idx, MTK_REG_RX_CALC_IDX0);
-        mtk_reg_w32(eth, MTK_PST_DRX_IDX0, MTK_REG_PDMA_RST_CFG);
-
-        return 0;
-}
-
-static int mtk_pdma_init(struct mtk_eth *eth)
-{
-        struct mtk_rx_ring *ring = &eth->rx_ring[0];
-        int err;
-
-        err = mtk_pdma_tx_alloc(eth);
-        if (err)
-                return err;
-
-        err = mtk_dma_rx_alloc(eth, ring);
-        if (err)
-                return err;
-
-        mtk_reg_w32(eth, ring->rx_phys, MTK_REG_RX_BASE_PTR0);
-        mtk_reg_w32(eth, ring->rx_ring_size, MTK_REG_RX_MAX_CNT0);
-        mtk_reg_w32(eth, ring->rx_calc_idx, MTK_REG_RX_CALC_IDX0);
-        mtk_reg_w32(eth, MTK_PST_DRX_IDX0, MTK_REG_PDMA_RST_CFG);
-
-        return 0;
-}
-
-static void mtk_dma_free(struct mtk_eth *eth)
-{
-        int i;
-
-        for (i = 0; i < eth->soc->mac_count; i++)
-                if (eth->netdev[i])
-                        netdev_reset_queue(eth->netdev[i]);
-        eth->tx_ring.tx_clean(eth);
-        mtk_clean_rx(eth, &eth->rx_ring[0]);
-        mtk_clean_rx(eth, &eth->rx_ring[1]);
-        kfree(eth->scratch_head);
-}
-
-static void mtk_tx_timeout(struct net_device *dev)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        struct mtk_eth *eth = mac->hw;
-        struct mtk_tx_ring *ring = &eth->tx_ring;
-
-        eth->netdev[mac->id]->stats.tx_errors++;
-        netif_err(eth, tx_err, dev,
-                  "transmit timed out\n");
-        if (eth->soc->dma_type & MTK_PDMA) {
-                netif_info(eth, drv, dev, "pdma_cfg:%08x\n",
-                           mtk_reg_r32(eth, MTK_REG_PDMA_GLO_CFG));
-                netif_info(eth, drv, dev,
-                           "tx_ring=%d, base=%08x, max=%u, ctx=%u, dtx=%u, fdx=%hu, next=%hu\n",
-                           0, mtk_reg_r32(eth, MTK_REG_TX_BASE_PTR0),
-                           mtk_reg_r32(eth, MTK_REG_TX_MAX_CNT0),
-                           mtk_reg_r32(eth, MTK_REG_TX_CTX_IDX0),
-                           mtk_reg_r32(eth, MTK_REG_TX_DTX_IDX0),
-                           ring->tx_free_idx,
-                           ring->tx_next_idx);
-        }
-        if (eth->soc->dma_type & MTK_QDMA) {
-                netif_info(eth, drv, dev, "qdma_cfg:%08x\n",
-                           mtk_r32(eth, MTK_QDMA_GLO_CFG));
-                netif_info(eth, drv, dev,
-                           "tx_ring=%d, ctx=%08x, dtx=%08x, crx=%08x, drx=%08x, free=%hu\n",
-                           0, mtk_r32(eth, MTK_QTX_CTX_PTR),
-                           mtk_r32(eth, MTK_QTX_DTX_PTR),
-                           mtk_r32(eth, MTK_QTX_CRX_PTR),
-                           mtk_r32(eth, MTK_QTX_DRX_PTR),
-                           atomic_read(&ring->tx_free_count));
-        }
-        netif_info(eth, drv, dev,
-                   "rx_ring=%d, base=%08x, max=%u, calc=%u, drx=%u\n",
-                   0, mtk_reg_r32(eth, MTK_REG_RX_BASE_PTR0),
-                   mtk_reg_r32(eth, MTK_REG_RX_MAX_CNT0),
-                   mtk_reg_r32(eth, MTK_REG_RX_CALC_IDX0),
-                   mtk_reg_r32(eth, MTK_REG_RX_DRX_IDX0));
-
-        schedule_work(&mac->pending_work);
-}
-
-static irqreturn_t mtk_handle_irq(int irq, void *_eth)
-{
-        struct mtk_eth *eth = _eth;
-        u32 status, int_mask;
-
-        status = mtk_irq_pending(eth);
-        if (unlikely(!status))
-                return IRQ_NONE;
-
-        int_mask = (eth->soc->rx_int | eth->soc->tx_int);
-        if (likely(status & int_mask)) {
-                if (likely(napi_schedule_prep(&eth->rx_napi)))
-                        __napi_schedule(&eth->rx_napi);
-        } else {
-                mtk_irq_ack(eth, status);
-        }
-        mtk_irq_disable(eth, int_mask);
-
-        return IRQ_HANDLED;
-}
-
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void mtk_poll_controller(struct net_device *dev)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        struct mtk_eth *eth = mac->hw;
-        u32 int_mask = eth->soc->tx_int | eth->soc->rx_int;
-
-        mtk_irq_disable(eth, int_mask);
-        mtk_handle_irq(dev->irq, dev);
-        mtk_irq_enable(eth, int_mask);
-}
-#endif
-
-int mtk_set_clock_cycle(struct mtk_eth *eth)
-{
-        unsigned long sysclk = eth->sysclk;
-
-        sysclk /= MTK_US_CYC_CNT_DIVISOR;
-        sysclk <<= MTK_US_CYC_CNT_SHIFT;
-
-        mtk_w32(eth, (mtk_r32(eth, MTK_GLO_CFG) &
-                        ~(MTK_US_CYC_CNT_MASK << MTK_US_CYC_CNT_SHIFT)) |
-                        sysclk,
-                        MTK_GLO_CFG);
-        return 0;
-}
-
-void mtk_fwd_config(struct mtk_eth *eth)
-{
-        u32 fwd_cfg;
-
-        fwd_cfg = mtk_r32(eth, MTK_GDMA1_FWD_CFG);
-
-        /* disable jumbo frame */
-        if (eth->soc->jumbo_frame)
-                fwd_cfg &= ~MTK_GDM1_JMB_EN;
-
-        /* set unicast/multicast/broadcast frame to cpu */
-        fwd_cfg &= ~0xffff;
-
-        mtk_w32(eth, fwd_cfg, MTK_GDMA1_FWD_CFG);
-}
-
-void mtk_csum_config(struct mtk_eth *eth)
-{
-        if (eth->soc->hw_features & NETIF_F_RXCSUM)
-                mtk_w32(eth, mtk_r32(eth, MTK_GDMA1_FWD_CFG) |
-                        (MTK_GDM1_ICS_EN | MTK_GDM1_TCS_EN | MTK_GDM1_UCS_EN),
-                        MTK_GDMA1_FWD_CFG);
-        else
-                mtk_w32(eth, mtk_r32(eth, MTK_GDMA1_FWD_CFG) &
-                        ~(MTK_GDM1_ICS_EN | MTK_GDM1_TCS_EN | MTK_GDM1_UCS_EN),
-                        MTK_GDMA1_FWD_CFG);
-        if (eth->soc->hw_features & NETIF_F_IP_CSUM)
-                mtk_w32(eth, mtk_r32(eth, MTK_CDMA_CSG_CFG) |
-                        (MTK_ICS_GEN_EN | MTK_TCS_GEN_EN | MTK_UCS_GEN_EN),
-                        MTK_CDMA_CSG_CFG);
-        else
-                mtk_w32(eth, mtk_r32(eth, MTK_CDMA_CSG_CFG) &
-                        ~(MTK_ICS_GEN_EN | MTK_TCS_GEN_EN | MTK_UCS_GEN_EN),
-                        MTK_CDMA_CSG_CFG);
-}
-
-static int mtk_start_dma(struct mtk_eth *eth)
-{
-        unsigned long flags;
-        u32 val;
-        int err;
-
-        if (eth->soc->dma_type == MTK_PDMA)
-                err = mtk_pdma_init(eth);
-        else if (eth->soc->dma_type == MTK_QDMA)
-                err = mtk_qdma_init(eth, 0);
-        else
-                err = mtk_pdma_qdma_init(eth);
-        if (err) {
-                mtk_dma_free(eth);
-                return err;
-        }
-
-        spin_lock_irqsave(&eth->page_lock, flags);
-
-        val = MTK_TX_WB_DDONE | MTK_RX_DMA_EN | MTK_TX_DMA_EN;
-        if (eth->soc->rx_2b_offset)
-                val |= MTK_RX_2B_OFFSET;
-        val |= eth->soc->pdma_glo_cfg;
-
-        if (eth->soc->dma_type & MTK_PDMA)
-                mtk_reg_w32(eth, val, MTK_REG_PDMA_GLO_CFG);
-
-        if (eth->soc->dma_type & MTK_QDMA)
-                mtk_w32(eth, val, MTK_QDMA_GLO_CFG);
-
-        spin_unlock_irqrestore(&eth->page_lock, flags);
-
-        return 0;
-}
-
-static int mtk_open(struct net_device *dev)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        struct mtk_eth *eth = mac->hw;
-
-        dma_coerce_mask_and_coherent(&dev->dev, DMA_BIT_MASK(32));
-
-        if (!atomic_read(&eth->dma_refcnt)) {
-                int err = mtk_start_dma(eth);
-
-                if (err)
-                        return err;
-
-                napi_enable(&eth->rx_napi);
-                mtk_irq_enable(eth, eth->soc->tx_int | eth->soc->rx_int);
-        }
-        atomic_inc(&eth->dma_refcnt);
-
-        if (eth->phy)
-                eth->phy->start(mac);
-
-        if (eth->soc->has_carrier && eth->soc->has_carrier(eth))
-                netif_carrier_on(dev);
-
-        netif_start_queue(dev);
-        eth->soc->fwd_config(eth);
-
-        return 0;
-}
-
-static void mtk_stop_dma(struct mtk_eth *eth, u32 glo_cfg)
-{
-        unsigned long flags;
-        u32 val;
-        int i;
-
-        /* stop the dma enfine */
-        spin_lock_irqsave(&eth->page_lock, flags);
-        val = mtk_r32(eth, glo_cfg);
-        mtk_w32(eth, val & ~(MTK_TX_WB_DDONE | MTK_RX_DMA_EN | MTK_TX_DMA_EN),
-                glo_cfg);
-        spin_unlock_irqrestore(&eth->page_lock, flags);
-
-        /* wait for dma stop */
-        for (i = 0; i < 10; i++) {
-                val = mtk_r32(eth, glo_cfg);
-                if (val & (MTK_TX_DMA_BUSY | MTK_RX_DMA_BUSY)) {
-                        msleep(20);
-                        continue;
-                }
-                break;
-        }
-}
-
-static int mtk_stop(struct net_device *dev)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        struct mtk_eth *eth = mac->hw;
-
-        netif_tx_disable(dev);
-        if (eth->phy)
-                eth->phy->stop(mac);
-
-        if (!atomic_dec_and_test(&eth->dma_refcnt))
-                return 0;
-
-        mtk_irq_disable(eth, eth->soc->tx_int | eth->soc->rx_int);
-        napi_disable(&eth->rx_napi);
-
-        if (eth->soc->dma_type & MTK_PDMA)
-                mtk_stop_dma(eth, mtk_reg_table[MTK_REG_PDMA_GLO_CFG]);
-
-        if (eth->soc->dma_type & MTK_QDMA)
-                mtk_stop_dma(eth, MTK_QDMA_GLO_CFG);
-
-        mtk_dma_free(eth);
-
-        return 0;
-}
-
-static int __init mtk_init_hw(struct mtk_eth *eth)
-{
-        int i, err;
-
-        eth->soc->reset_fe(eth);
-
-        if (eth->soc->switch_init)
-                if (eth->soc->switch_init(eth)) {
-                        dev_err(eth->dev, "failed to initialize switch core\n");
-                        return -ENODEV;
-                }
-
-        err = devm_request_irq(eth->dev, eth->irq, mtk_handle_irq, 0,
-                               dev_name(eth->dev), eth);
-        if (err)
-                return err;
-
-        err = mtk_mdio_init(eth);
-        if (err)
-                return err;
-
-        /* disable delay and normal interrupt */
-        mtk_reg_w32(eth, 0, MTK_REG_DLY_INT_CFG);
-        if (eth->soc->dma_type & MTK_QDMA)
-                mtk_w32(eth, 0, MTK_QDMA_DELAY_INT);
-        mtk_irq_disable(eth, eth->soc->tx_int | eth->soc->rx_int);
-
-        /* frame engine will push VLAN tag regarding to VIDX field in Tx desc */
-        if (mtk_reg_table[MTK_REG_MTK_DMA_VID_BASE])
-                for (i = 0; i < 16; i += 2)
-                        mtk_w32(eth, ((i + 1) << 16) + i,
-                                mtk_reg_table[MTK_REG_MTK_DMA_VID_BASE] +
-                                (i * 2));
-
-        if (eth->soc->fwd_config(eth))
-                dev_err(eth->dev, "unable to get clock\n");
-
-        if (mtk_reg_table[MTK_REG_MTK_RST_GL]) {
-                mtk_reg_w32(eth, 1, MTK_REG_MTK_RST_GL);
-                mtk_reg_w32(eth, 0, MTK_REG_MTK_RST_GL);
-        }
-
-        return 0;
-}
-
-static int __init mtk_init(struct net_device *dev)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        struct mtk_eth *eth = mac->hw;
-        struct device_node *port;
-        const char *mac_addr;
-        int err;
-
-        mac_addr = of_get_mac_address(mac->of_node);
-        if (mac_addr)
-                ether_addr_copy(dev->dev_addr, mac_addr);
-
-        /* If the mac address is invalid, use random mac address  */
-        if (!is_valid_ether_addr(dev->dev_addr)) {
-                eth_hw_addr_random(dev);
-                dev_err(eth->dev, "generated random MAC address %pM\n",
-                        dev->dev_addr);
-        }
-        mac->hw->soc->set_mac(mac, dev->dev_addr);
-
-        if (eth->soc->port_init)
-                for_each_child_of_node(mac->of_node, port)
-                        if (of_device_is_compatible(port,
-                                                    "mediatek,eth-port") &&
-                            of_device_is_available(port))
-                                eth->soc->port_init(eth, mac, port);
-
-        if (eth->phy) {
-                err = eth->phy->connect(mac);
-                if (err)
-                        return err;
-        }
-
-        return 0;
-}
-
-static void mtk_uninit(struct net_device *dev)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        struct mtk_eth *eth = mac->hw;
-
-        if (eth->phy)
-                eth->phy->disconnect(mac);
-        mtk_mdio_cleanup(eth);
-
-        mtk_irq_disable(eth, ~0);
-        free_irq(dev->irq, dev);
-}
-
-static int mtk_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-
-        if (!mac->phy_dev)
-                return -ENODEV;
-
-        switch (cmd) {
-        case SIOCGMIIPHY:
-        case SIOCGMIIREG:
-        case SIOCSMIIREG:
-                return phy_mii_ioctl(mac->phy_dev, ifr, cmd);
-        default:
-                break;
-        }
-
-        return -EOPNOTSUPP;
-}
-
-static int mtk_change_mtu(struct net_device *dev, int new_mtu)
-{
-        struct mtk_mac *mac = netdev_priv(dev);
-        struct mtk_eth *eth = mac->hw;
-        int frag_size, old_mtu;
-        u32 fwd_cfg;
-
-        if (!eth->soc->jumbo_frame)
-                return eth_change_mtu(dev, new_mtu);
-
-        frag_size = mtk_max_frag_size(new_mtu);
-        if (new_mtu < 68 || frag_size > PAGE_SIZE)
-                return -EINVAL;
-
-        old_mtu = dev->mtu;
-        dev->mtu = new_mtu;
-
-        /* return early if the buffer sizes will not change */
-        if (old_mtu <= ETH_DATA_LEN && new_mtu <= ETH_DATA_LEN)
-                return 0;
-        if (old_mtu > ETH_DATA_LEN && new_mtu > ETH_DATA_LEN)
-                return 0;
-
-        if (new_mtu <= ETH_DATA_LEN)
-                eth->rx_ring[0].frag_size = mtk_max_frag_size(ETH_DATA_LEN);
-        else
-                eth->rx_ring[0].frag_size = PAGE_SIZE;
-        eth->rx_ring[0].rx_buf_size =
-                                mtk_max_buf_size(eth->rx_ring[0].frag_size);
-
-        if (!netif_running(dev))
-                return 0;
-
-        mtk_stop(dev);
-        fwd_cfg = mtk_r32(eth, MTK_GDMA1_FWD_CFG);
-        if (new_mtu <= ETH_DATA_LEN) {
-                fwd_cfg &= ~MTK_GDM1_JMB_EN;
-        } else {
-                fwd_cfg &= ~(MTK_GDM1_JMB_LEN_MASK << MTK_GDM1_JMB_LEN_SHIFT);
-                fwd_cfg |= (DIV_ROUND_UP(frag_size, 1024) <<
-                                MTK_GDM1_JMB_LEN_SHIFT) | MTK_GDM1_JMB_EN;
-        }
-        mtk_w32(eth, fwd_cfg, MTK_GDMA1_FWD_CFG);
-
-        return mtk_open(dev);
-}
-
-static void mtk_pending_work(struct work_struct *work)
-{
-        struct mtk_mac *mac = container_of(work, struct mtk_mac, pending_work);
-        struct mtk_eth *eth = mac->hw;
-        struct net_device *dev = eth->netdev[mac->id];
-        int err;
-
-        rtnl_lock();
-        mtk_stop(dev);
-
-        err = mtk_open(dev);
-        if (err) {
-                netif_alert(eth, ifup, dev,
-                            "Driver up/down cycle failed, closing device.\n");
-                dev_close(dev);
-        }
-        rtnl_unlock();
-}
-
-static int mtk_cleanup(struct mtk_eth *eth)
-{
-        int i;
-
-        for (i = 0; i < eth->soc->mac_count; i++) {
-                struct mtk_mac *mac = netdev_priv(eth->netdev[i]);
-
-                if (!eth->netdev[i])
-                        continue;
-
-                unregister_netdev(eth->netdev[i]);
-                free_netdev(eth->netdev[i]);
-                cancel_work_sync(&mac->pending_work);
-        }
-
-        return 0;
-}
-
-static const struct net_device_ops mtk_netdev_ops = {
-        .ndo_init               = mtk_init,
-        .ndo_uninit             = mtk_uninit,
-        .ndo_open               = mtk_open,
-        .ndo_stop               = mtk_stop,
-        .ndo_start_xmit         = mtk_start_xmit,
-        .ndo_set_mac_address    = mtk_set_mac_address,
-        .ndo_validate_addr      = eth_validate_addr,
-        .ndo_do_ioctl           = mtk_do_ioctl,
-        .ndo_change_mtu         = mtk_change_mtu,
-        .ndo_tx_timeout         = mtk_tx_timeout,
-        .ndo_get_stats64        = mtk_get_stats64,
-        .ndo_vlan_rx_add_vid    = mtk_vlan_rx_add_vid,
-        .ndo_vlan_rx_kill_vid   = mtk_vlan_rx_kill_vid,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = mtk_poll_controller,
-#endif
-};
-
-static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
-{
-        struct mtk_mac *mac;
-        const __be32 *_id = of_get_property(np, "reg", NULL);
-        int id, err;
-
-        if (!_id) {
-                dev_err(eth->dev, "missing mac id\n");
-                return -EINVAL;
-        }
-        id = be32_to_cpup(_id);
-        if (id >= eth->soc->mac_count || eth->netdev[id]) {
-                dev_err(eth->dev, "%d is not a valid mac id\n", id);
-                return -EINVAL;
-        }
-
-        eth->netdev[id] = alloc_etherdev(sizeof(*mac));
-        if (!eth->netdev[id]) {
-                dev_err(eth->dev, "alloc_etherdev failed\n");
-                return -ENOMEM;
-        }
-        mac = netdev_priv(eth->netdev[id]);
-        eth->mac[id] = mac;
-        mac->id = id;
-        mac->hw = eth;
-        mac->of_node = np;
-        INIT_WORK(&mac->pending_work, mtk_pending_work);
-
-        if (mtk_reg_table[MTK_REG_MTK_COUNTER_BASE]) {
-                mac->hw_stats = devm_kzalloc(eth->dev,
-                                             sizeof(*mac->hw_stats),
-                                             GFP_KERNEL);
-                if (!mac->hw_stats) {
-                        err = -ENOMEM;
-                        goto free_netdev;
-                }
-                spin_lock_init(&mac->hw_stats->stats_lock);
-                mac->hw_stats->reg_offset = id * MTK_STAT_OFFSET;
-        }
-
-        SET_NETDEV_DEV(eth->netdev[id], eth->dev);
-        eth->netdev[id]->netdev_ops = &mtk_netdev_ops;
-        eth->netdev[id]->base_addr = (unsigned long)eth->base;
-
-        if (eth->soc->init_data)
-                eth->soc->init_data(eth->soc, eth->netdev[id]);
-
-        eth->netdev[id]->vlan_features = eth->soc->hw_features &
-                ~(NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX);
-        eth->netdev[id]->features |= eth->soc->hw_features;
-
-        if (mtk_reg_table[MTK_REG_MTK_DMA_VID_BASE])
-                eth->netdev[id]->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
-
-        mtk_set_ethtool_ops(eth->netdev[id]);
-
-        err = register_netdev(eth->netdev[id]);
-        if (err) {
-                dev_err(eth->dev, "error bringing up device\n");
-                err = -ENOMEM;
-                goto free_netdev;
-        }
-        eth->netdev[id]->irq = eth->irq;
-        netif_info(eth, probe, eth->netdev[id],
-                   "mediatek frame engine at 0x%08lx, irq %d\n",
-                   eth->netdev[id]->base_addr, eth->netdev[id]->irq);
-
-        return 0;
-
-free_netdev:
-        free_netdev(eth->netdev[id]);
-        return err;
-}
-
-static int mtk_probe(struct platform_device *pdev)
-{
-        struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        const struct of_device_id *match;
-        struct device_node *mac_np;
-        struct mtk_soc_data *soc;
-        struct mtk_eth *eth;
-        struct clk *sysclk;
-        int err;
-
-        device_reset(&pdev->dev);
-
-        match = of_match_device(of_mtk_match, &pdev->dev);
-        soc = (struct mtk_soc_data *)match->data;
-
-        if (soc->reg_table)
-                mtk_reg_table = soc->reg_table;
-
-        eth = devm_kzalloc(&pdev->dev, sizeof(*eth), GFP_KERNEL);
-        if (!eth)
-                return -ENOMEM;
-
-        eth->base = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(eth->base))
-                return PTR_ERR(eth->base);
-
-        spin_lock_init(&eth->page_lock);
-
-        eth->ethsys = syscon_regmap_lookup_by_phandle(pdev->dev.of_node,
-                                                      "mediatek,ethsys");
-        if (IS_ERR(eth->ethsys))
-                return PTR_ERR(eth->ethsys);
-
-        eth->irq = platform_get_irq(pdev, 0);
-        if (eth->irq < 0) {
-                dev_err(&pdev->dev, "no IRQ resource found\n");
-                return -ENXIO;
-        }
-
-        sysclk = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(sysclk)) {
-                dev_err(&pdev->dev,
-                        "the clock is not defined in the devicetree\n");
-                return -ENXIO;
-        }
-        eth->sysclk = clk_get_rate(sysclk);
-
-        eth->switch_np = of_parse_phandle(pdev->dev.of_node,
-                                          "mediatek,switch", 0);
-        if (soc->has_switch && !eth->switch_np) {
-                dev_err(&pdev->dev, "failed to read switch phandle\n");
-                return -ENODEV;
-        }
-
-        eth->dev = &pdev->dev;
-        eth->soc = soc;
-        eth->msg_enable = netif_msg_init(mtk_msg_level, MTK_DEFAULT_MSG_ENABLE);
-
-        err = mtk_init_hw(eth);
-        if (err)
-                return err;
-
-        if (eth->soc->mac_count > 1) {
-                for_each_child_of_node(pdev->dev.of_node, mac_np) {
-                        if (!of_device_is_compatible(mac_np,
-                                                     "mediatek,eth-mac"))
-                                continue;
-
-                        if (!of_device_is_available(mac_np))
-                                continue;
-
-                        err = mtk_add_mac(eth, mac_np);
-                        if (err)
-                                goto err_free_dev;
-                }
-
-                init_dummy_netdev(&eth->dummy_dev);
-                netif_napi_add(&eth->dummy_dev, &eth->rx_napi, mtk_poll,
-                               soc->napi_weight);
-        } else {
-                err = mtk_add_mac(eth, pdev->dev.of_node);
-                if (err)
-                        goto err_free_dev;
-                netif_napi_add(eth->netdev[0], &eth->rx_napi, mtk_poll,
-                               soc->napi_weight);
-        }
-
-        platform_set_drvdata(pdev, eth);
-
-        return 0;
-
-err_free_dev:
-        mtk_cleanup(eth);
-        return err;
-}
-
-static int mtk_remove(struct platform_device *pdev)
-{
-        struct mtk_eth *eth = platform_get_drvdata(pdev);
-
-        netif_napi_del(&eth->rx_napi);
-        mtk_cleanup(eth);
-        platform_set_drvdata(pdev, NULL);
-
-        return 0;
-}
-
-static struct platform_driver mtk_driver = {
-        .probe = mtk_probe,
-        .remove = mtk_remove,
-        .driver = {
-                .name = "mtk_soc_eth",
-                .of_match_table = of_mtk_match,
-        },
-};
-
-module_platform_driver(mtk_driver);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("John Crispin <blogic@openwrt.org>");
-MODULE_DESCRIPTION("Ethernet driver for MediaTek SoC");
diff --git a/drivers/staging/mt7621-eth/mtk_eth_soc.h b/drivers/staging/mt7621-eth/mtk_eth_soc.h
deleted file mode 100644
index e6ed80433f49..000000000000
--- a/drivers/staging/mt7621-eth/mtk_eth_soc.h
+++ /dev/null
@@ -1,716 +0,0 @@
-/*   This program is free software; you can redistribute it and/or modify
- *   it under the terms of the GNU General Public License as published by
- *   the Free Software Foundation; version 2 of the License
- *
- *   This program is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *   GNU General Public License for more details.
- *
- *   Copyright (C) 2009-2016 John Crispin <blogic@openwrt.org>
- *   Copyright (C) 2009-2016 Felix Fietkau <nbd@openwrt.org>
- *   Copyright (C) 2013-2016 Michael Lee <igvtee@gmail.com>
- */
-
-#ifndef MTK_ETH_H
-#define MTK_ETH_H
-
-#include <linux/mii.h>
-#include <linux/interrupt.h>
-#include <linux/netdevice.h>
-#include <linux/dma-mapping.h>
-#include <linux/phy.h>
-#include <linux/ethtool.h>
-#include <linux/version.h>
-#include <linux/atomic.h>
-
-/* these registers have different offsets depending on the SoC. we use a lookup
- * table for these
- */
-enum mtk_reg {
-        MTK_REG_PDMA_GLO_CFG = 0,
-        MTK_REG_PDMA_RST_CFG,
-        MTK_REG_DLY_INT_CFG,
-        MTK_REG_TX_BASE_PTR0,
-        MTK_REG_TX_MAX_CNT0,
-        MTK_REG_TX_CTX_IDX0,
-        MTK_REG_TX_DTX_IDX0,
-        MTK_REG_RX_BASE_PTR0,
-        MTK_REG_RX_MAX_CNT0,
-        MTK_REG_RX_CALC_IDX0,
-        MTK_REG_RX_DRX_IDX0,
-        MTK_REG_MTK_INT_ENABLE,
-        MTK_REG_MTK_INT_STATUS,
-        MTK_REG_MTK_DMA_VID_BASE,
-        MTK_REG_MTK_COUNTER_BASE,
-        MTK_REG_MTK_RST_GL,
-        MTK_REG_MTK_INT_STATUS2,
-        MTK_REG_COUNT
-};
-
-/* delayed interrupt bits */
-#define MTK_DELAY_EN_INT        0x80
-#define MTK_DELAY_MAX_INT       0x04
-#define MTK_DELAY_MAX_TOUT      0x04
-#define MTK_DELAY_TIME          20
-#define MTK_DELAY_CHAN          (((MTK_DELAY_EN_INT | MTK_DELAY_MAX_INT) << 8) \
-                                 | MTK_DELAY_MAX_TOUT)
-#define MTK_DELAY_INIT          ((MTK_DELAY_CHAN << 16) | MTK_DELAY_CHAN)
-#define MTK_PSE_FQFC_CFG_INIT   0x80504000
-#define MTK_PSE_FQFC_CFG_256Q   0xff908000
-
-/* interrupt bits */
-#define MTK_CNT_PPE_AF          BIT(31)
-#define MTK_CNT_GDM_AF          BIT(29)
-#define MTK_PSE_P2_FC           BIT(26)
-#define MTK_PSE_BUF_DROP        BIT(24)
-#define MTK_GDM_OTHER_DROP      BIT(23)
-#define MTK_PSE_P1_FC           BIT(22)
-#define MTK_PSE_P0_FC           BIT(21)
-#define MTK_PSE_FQ_EMPTY        BIT(20)
-#define MTK_GE1_STA_CHG         BIT(18)
-#define MTK_TX_COHERENT         BIT(17)
-#define MTK_RX_COHERENT         BIT(16)
-#define MTK_TX_DONE_INT3        BIT(11)
-#define MTK_TX_DONE_INT2        BIT(10)
-#define MTK_TX_DONE_INT1        BIT(9)
-#define MTK_TX_DONE_INT0        BIT(8)
-#define MTK_RX_DONE_INT0        BIT(2)
-#define MTK_TX_DLY_INT          BIT(1)
-#define MTK_RX_DLY_INT          BIT(0)
-
-#define MTK_RX_DONE_INT         MTK_RX_DONE_INT0
-#define MTK_TX_DONE_INT         (MTK_TX_DONE_INT0 | MTK_TX_DONE_INT1 | \
-                                 MTK_TX_DONE_INT2 | MTK_TX_DONE_INT3)
-
-#define RT5350_RX_DLY_INT       BIT(30)
-#define RT5350_TX_DLY_INT       BIT(28)
-#define RT5350_RX_DONE_INT1     BIT(17)
-#define RT5350_RX_DONE_INT0     BIT(16)
-#define RT5350_TX_DONE_INT3     BIT(3)
-#define RT5350_TX_DONE_INT2     BIT(2)
-#define RT5350_TX_DONE_INT1     BIT(1)
-#define RT5350_TX_DONE_INT0     BIT(0)
-
-#define RT5350_RX_DONE_INT      (RT5350_RX_DONE_INT0 | RT5350_RX_DONE_INT1)
-#define RT5350_TX_DONE_INT      (RT5350_TX_DONE_INT0 | RT5350_TX_DONE_INT1 | \
-                                 RT5350_TX_DONE_INT2 | RT5350_TX_DONE_INT3)
-
-/* registers */
-#define MTK_GDMA_OFFSET         0x0020
-#define MTK_PSE_OFFSET          0x0040
-#define MTK_GDMA2_OFFSET        0x0060
-#define MTK_CDMA_OFFSET         0x0080
-#define MTK_DMA_VID0            0x00a8
-#define MTK_PDMA_OFFSET         0x0100
-#define MTK_PPE_OFFSET          0x0200
-#define MTK_CMTABLE_OFFSET      0x0400
-#define MTK_POLICYTABLE_OFFSET  0x1000
-
-#define MT7621_GDMA_OFFSET      0x0500
-#define MT7620_GDMA_OFFSET      0x0600
-
-#define RT5350_PDMA_OFFSET      0x0800
-#define RT5350_SDM_OFFSET       0x0c00
-
-#define MTK_MDIO_ACCESS         0x00
-#define MTK_MDIO_CFG            0x04
-#define MTK_GLO_CFG             0x08
-#define MTK_RST_GL              0x0C
-#define MTK_INT_STATUS          0x10
-#define MTK_INT_ENABLE          0x14
-#define MTK_MDIO_CFG2           0x18
-#define MTK_FOC_TS_T            0x1C
-
-#define MTK_GDMA1_FWD_CFG       (MTK_GDMA_OFFSET + 0x00)
-#define MTK_GDMA1_SCH_CFG       (MTK_GDMA_OFFSET + 0x04)
-#define MTK_GDMA1_SHPR_CFG      (MTK_GDMA_OFFSET + 0x08)
-#define MTK_GDMA1_MAC_ADRL      (MTK_GDMA_OFFSET + 0x0C)
-#define MTK_GDMA1_MAC_ADRH      (MTK_GDMA_OFFSET + 0x10)
-
-#define MTK_GDMA2_FWD_CFG       (MTK_GDMA2_OFFSET + 0x00)
-#define MTK_GDMA2_SCH_CFG       (MTK_GDMA2_OFFSET + 0x04)
-#define MTK_GDMA2_SHPR_CFG      (MTK_GDMA2_OFFSET + 0x08)
-#define MTK_GDMA2_MAC_ADRL      (MTK_GDMA2_OFFSET + 0x0C)
-#define MTK_GDMA2_MAC_ADRH      (MTK_GDMA2_OFFSET + 0x10)
-
-#define MTK_PSE_FQ_CFG          (MTK_PSE_OFFSET + 0x00)
-#define MTK_CDMA_FC_CFG         (MTK_PSE_OFFSET + 0x04)
-#define MTK_GDMA1_FC_CFG        (MTK_PSE_OFFSET + 0x08)
-#define MTK_GDMA2_FC_CFG        (MTK_PSE_OFFSET + 0x0C)
-
-#define MTK_CDMA_CSG_CFG        (MTK_CDMA_OFFSET + 0x00)
-#define MTK_CDMA_SCH_CFG        (MTK_CDMA_OFFSET + 0x04)
-
-#define MT7621_GDMA_FWD_CFG(x)  (MT7621_GDMA_OFFSET + (x * 0x1000))
-
-/* FIXME this might be different for different SOCs */
-#define MT7620_GDMA1_FWD_CFG    (MT7621_GDMA_OFFSET + 0x00)
-
-#define RT5350_TX_BASE_PTR0     (RT5350_PDMA_OFFSET + 0x00)
-#define RT5350_TX_MAX_CNT0      (RT5350_PDMA_OFFSET + 0x04)
-#define RT5350_TX_CTX_IDX0      (RT5350_PDMA_OFFSET + 0x08)
-#define RT5350_TX_DTX_IDX0      (RT5350_PDMA_OFFSET + 0x0C)
-#define RT5350_TX_BASE_PTR1     (RT5350_PDMA_OFFSET + 0x10)
-#define RT5350_TX_MAX_CNT1      (RT5350_PDMA_OFFSET + 0x14)
-#define RT5350_TX_CTX_IDX1      (RT5350_PDMA_OFFSET + 0x18)
-#define RT5350_TX_DTX_IDX1      (RT5350_PDMA_OFFSET + 0x1C)
-#define RT5350_TX_BASE_PTR2     (RT5350_PDMA_OFFSET + 0x20)
-#define RT5350_TX_MAX_CNT2      (RT5350_PDMA_OFFSET + 0x24)
-#define RT5350_TX_CTX_IDX2      (RT5350_PDMA_OFFSET + 0x28)
-#define RT5350_TX_DTX_IDX2      (RT5350_PDMA_OFFSET + 0x2C)
-#define RT5350_TX_BASE_PTR3     (RT5350_PDMA_OFFSET + 0x30)
-#define RT5350_TX_MAX_CNT3      (RT5350_PDMA_OFFSET + 0x34)
-#define RT5350_TX_CTX_IDX3      (RT5350_PDMA_OFFSET + 0x38)
-#define RT5350_TX_DTX_IDX3      (RT5350_PDMA_OFFSET + 0x3C)
-#define RT5350_RX_BASE_PTR0     (RT5350_PDMA_OFFSET + 0x100)
-#define RT5350_RX_MAX_CNT0      (RT5350_PDMA_OFFSET + 0x104)
-#define RT5350_RX_CALC_IDX0     (RT5350_PDMA_OFFSET + 0x108)
-#define RT5350_RX_DRX_IDX0      (RT5350_PDMA_OFFSET + 0x10C)
-#define RT5350_RX_BASE_PTR1     (RT5350_PDMA_OFFSET + 0x110)
-#define RT5350_RX_MAX_CNT1      (RT5350_PDMA_OFFSET + 0x114)
-#define RT5350_RX_CALC_IDX1     (RT5350_PDMA_OFFSET + 0x118)
-#define RT5350_RX_DRX_IDX1      (RT5350_PDMA_OFFSET + 0x11C)
-#define RT5350_PDMA_GLO_CFG     (RT5350_PDMA_OFFSET + 0x204)
-#define RT5350_PDMA_RST_CFG     (RT5350_PDMA_OFFSET + 0x208)
-#define RT5350_DLY_INT_CFG      (RT5350_PDMA_OFFSET + 0x20c)
-#define RT5350_MTK_INT_STATUS   (RT5350_PDMA_OFFSET + 0x220)
-#define RT5350_MTK_INT_ENABLE   (RT5350_PDMA_OFFSET + 0x228)
-#define RT5350_PDMA_SCH_CFG     (RT5350_PDMA_OFFSET + 0x280)
-
-#define MTK_PDMA_GLO_CFG        (MTK_PDMA_OFFSET + 0x00)
-#define MTK_PDMA_RST_CFG        (MTK_PDMA_OFFSET + 0x04)
-#define MTK_PDMA_SCH_CFG        (MTK_PDMA_OFFSET + 0x08)
-#define MTK_DLY_INT_CFG         (MTK_PDMA_OFFSET + 0x0C)
-#define MTK_TX_BASE_PTR0        (MTK_PDMA_OFFSET + 0x10)
-#define MTK_TX_MAX_CNT0         (MTK_PDMA_OFFSET + 0x14)
-#define MTK_TX_CTX_IDX0         (MTK_PDMA_OFFSET + 0x18)
-#define MTK_TX_DTX_IDX0         (MTK_PDMA_OFFSET + 0x1C)
-#define MTK_TX_BASE_PTR1        (MTK_PDMA_OFFSET + 0x20)
-#define MTK_TX_MAX_CNT1         (MTK_PDMA_OFFSET + 0x24)
-#define MTK_TX_CTX_IDX1         (MTK_PDMA_OFFSET + 0x28)
-#define MTK_TX_DTX_IDX1         (MTK_PDMA_OFFSET + 0x2C)
-#define MTK_RX_BASE_PTR0        (MTK_PDMA_OFFSET + 0x30)
-#define MTK_RX_MAX_CNT0         (MTK_PDMA_OFFSET + 0x34)
-#define MTK_RX_CALC_IDX0        (MTK_PDMA_OFFSET + 0x38)
-#define MTK_RX_DRX_IDX0         (MTK_PDMA_OFFSET + 0x3C)
-#define MTK_TX_BASE_PTR2        (MTK_PDMA_OFFSET + 0x40)
-#define MTK_TX_MAX_CNT2         (MTK_PDMA_OFFSET + 0x44)
-#define MTK_TX_CTX_IDX2         (MTK_PDMA_OFFSET + 0x48)
-#define MTK_TX_DTX_IDX2         (MTK_PDMA_OFFSET + 0x4C)
-#define MTK_TX_BASE_PTR3        (MTK_PDMA_OFFSET + 0x50)
-#define MTK_TX_MAX_CNT3         (MTK_PDMA_OFFSET + 0x54)
-#define MTK_TX_CTX_IDX3         (MTK_PDMA_OFFSET + 0x58)
-#define MTK_TX_DTX_IDX3         (MTK_PDMA_OFFSET + 0x5C)
-#define MTK_RX_BASE_PTR1        (MTK_PDMA_OFFSET + 0x60)
-#define MTK_RX_MAX_CNT1         (MTK_PDMA_OFFSET + 0x64)
-#define MTK_RX_CALC_IDX1        (MTK_PDMA_OFFSET + 0x68)
-#define MTK_RX_DRX_IDX1         (MTK_PDMA_OFFSET + 0x6C)
-
-/* Switch DMA configuration */
-#define RT5350_SDM_CFG          (RT5350_SDM_OFFSET + 0x00)
-#define RT5350_SDM_RRING        (RT5350_SDM_OFFSET + 0x04)
-#define RT5350_SDM_TRING        (RT5350_SDM_OFFSET + 0x08)
-#define RT5350_SDM_MAC_ADRL     (RT5350_SDM_OFFSET + 0x0C)
-#define RT5350_SDM_MAC_ADRH     (RT5350_SDM_OFFSET + 0x10)
-#define RT5350_SDM_TPCNT        (RT5350_SDM_OFFSET + 0x100)
-#define RT5350_SDM_TBCNT        (RT5350_SDM_OFFSET + 0x104)
-#define RT5350_SDM_RPCNT        (RT5350_SDM_OFFSET + 0x108)
-#define RT5350_SDM_RBCNT        (RT5350_SDM_OFFSET + 0x10C)
-#define RT5350_SDM_CS_ERR       (RT5350_SDM_OFFSET + 0x110)
-
-#define RT5350_SDM_ICS_EN       BIT(16)
-#define RT5350_SDM_TCS_EN       BIT(17)
-#define RT5350_SDM_UCS_EN       BIT(18)
-
-/* QDMA registers */
-#define MTK_QTX_CFG(x)          (0x1800 + (x * 0x10))
-#define MTK_QTX_SCH(x)          (0x1804 + (x * 0x10))
-#define MTK_QRX_BASE_PTR0       0x1900
-#define MTK_QRX_MAX_CNT0        0x1904
-#define MTK_QRX_CRX_IDX0        0x1908
-#define MTK_QRX_DRX_IDX0        0x190C
-#define MTK_QDMA_GLO_CFG        0x1A04
-#define MTK_QDMA_RST_IDX        0x1A08
-#define MTK_QDMA_DELAY_INT      0x1A0C
-#define MTK_QDMA_FC_THRES       0x1A10
-#define MTK_QMTK_INT_STATUS     0x1A18
-#define MTK_QMTK_INT_ENABLE     0x1A1C
-#define MTK_QDMA_HRED2          0x1A44
-
-#define MTK_QTX_CTX_PTR         0x1B00
-#define MTK_QTX_DTX_PTR         0x1B04
-
-#define MTK_QTX_CRX_PTR         0x1B10
-#define MTK_QTX_DRX_PTR         0x1B14
-
-#define MTK_QDMA_FQ_HEAD        0x1B20
-#define MTK_QDMA_FQ_TAIL        0x1B24
-#define MTK_QDMA_FQ_CNT         0x1B28
-#define MTK_QDMA_FQ_BLEN        0x1B2C
-
-#define QDMA_PAGE_SIZE          2048
-#define QDMA_TX_OWNER_CPU       BIT(31)
-#define QDMA_TX_SWC             BIT(14)
-#define TX_QDMA_SDL(_x)         (((_x) & 0x3fff) << 16)
-#define QDMA_RES_THRES          4
-
-/* MDIO_CFG register bits */
-#define MTK_MDIO_CFG_AUTO_POLL_EN       BIT(29)
-#define MTK_MDIO_CFG_GP1_BP_EN          BIT(16)
-#define MTK_MDIO_CFG_GP1_FRC_EN         BIT(15)
-#define MTK_MDIO_CFG_GP1_SPEED_10       (0 << 13)
-#define MTK_MDIO_CFG_GP1_SPEED_100      (1 << 13)
-#define MTK_MDIO_CFG_GP1_SPEED_1000     (2 << 13)
-#define MTK_MDIO_CFG_GP1_DUPLEX         BIT(12)
-#define MTK_MDIO_CFG_GP1_FC_TX          BIT(11)
-#define MTK_MDIO_CFG_GP1_FC_RX          BIT(10)
-#define MTK_MDIO_CFG_GP1_LNK_DWN        BIT(9)
-#define MTK_MDIO_CFG_GP1_AN_FAIL        BIT(8)
-#define MTK_MDIO_CFG_MDC_CLK_DIV_1      (0 << 6)
-#define MTK_MDIO_CFG_MDC_CLK_DIV_2      (1 << 6)
-#define MTK_MDIO_CFG_MDC_CLK_DIV_4      (2 << 6)
-#define MTK_MDIO_CFG_MDC_CLK_DIV_8      (3 << 6)
-#define MTK_MDIO_CFG_TURBO_MII_FREQ     BIT(5)
-#define MTK_MDIO_CFG_TURBO_MII_MODE     BIT(4)
-#define MTK_MDIO_CFG_RX_CLK_SKEW_0      (0 << 2)
-#define MTK_MDIO_CFG_RX_CLK_SKEW_200    (1 << 2)
-#define MTK_MDIO_CFG_RX_CLK_SKEW_400    (2 << 2)
-#define MTK_MDIO_CFG_RX_CLK_SKEW_INV    (3 << 2)
-#define MTK_MDIO_CFG_TX_CLK_SKEW_0      0
-#define MTK_MDIO_CFG_TX_CLK_SKEW_200    1
-#define MTK_MDIO_CFG_TX_CLK_SKEW_400    2
-#define MTK_MDIO_CFG_TX_CLK_SKEW_INV    3
-
-/* uni-cast port */
-#define MTK_GDM1_JMB_LEN_MASK   0xf
-#define MTK_GDM1_JMB_LEN_SHIFT  28
-#define MTK_GDM1_ICS_EN         BIT(22)
-#define MTK_GDM1_TCS_EN         BIT(21)
-#define MTK_GDM1_UCS_EN         BIT(20)
-#define MTK_GDM1_JMB_EN         BIT(19)
-#define MTK_GDM1_STRPCRC        BIT(16)
-#define MTK_GDM1_UFRC_P_CPU     (0 << 12)
-#define MTK_GDM1_UFRC_P_GDMA1   (1 << 12)
-#define MTK_GDM1_UFRC_P_PPE     (6 << 12)
-
-/* checksums */
-#define MTK_ICS_GEN_EN          BIT(2)
-#define MTK_UCS_GEN_EN          BIT(1)
-#define MTK_TCS_GEN_EN          BIT(0)
-
-/* dma mode */
-#define MTK_PDMA                BIT(0)
-#define MTK_QDMA                BIT(1)
-#define MTK_PDMA_RX_QDMA_TX     (MTK_PDMA | MTK_QDMA)
-
-/* dma ring */
-#define MTK_PST_DRX_IDX0        BIT(16)
-#define MTK_PST_DTX_IDX3        BIT(3)
-#define MTK_PST_DTX_IDX2        BIT(2)
-#define MTK_PST_DTX_IDX1        BIT(1)
-#define MTK_PST_DTX_IDX0        BIT(0)
-
-#define MTK_RX_2B_OFFSET        BIT(31)
-#define MTK_TX_WB_DDONE         BIT(6)
-#define MTK_RX_DMA_BUSY         BIT(3)
-#define MTK_TX_DMA_BUSY         BIT(1)
-#define MTK_RX_DMA_EN           BIT(2)
-#define MTK_TX_DMA_EN           BIT(0)
-
-#define MTK_PDMA_SIZE_4DWORDS   (0 << 4)
-#define MTK_PDMA_SIZE_8DWORDS   (1 << 4)
-#define MTK_PDMA_SIZE_16DWORDS  (2 << 4)
-
-#define MTK_US_CYC_CNT_MASK     0xff
-#define MTK_US_CYC_CNT_SHIFT    0x8
-#define MTK_US_CYC_CNT_DIVISOR  1000000
-
-/* PDMA descriptor rxd2 */
-#define RX_DMA_DONE             BIT(31)
-#define RX_DMA_LSO              BIT(30)
-#define RX_DMA_PLEN0(_x)        (((_x) & 0x3fff) << 16)
-#define RX_DMA_GET_PLEN0(_x)    (((_x) >> 16) & 0x3fff)
-#define RX_DMA_TAG              BIT(15)
-
-/* PDMA descriptor rxd3 */
-#define RX_DMA_TPID(_x)         (((_x) >> 16) & 0xffff)
-#define RX_DMA_VID(_x)          ((_x) & 0xfff)
-
-/* PDMA descriptor rxd4 */
-#define RX_DMA_L4VALID          BIT(30)
-#define RX_DMA_FPORT_SHIFT      19
-#define RX_DMA_FPORT_MASK       0x7
-
-struct mtk_rx_dma {
-        unsigned int rxd1;
-        unsigned int rxd2;
-        unsigned int rxd3;
-        unsigned int rxd4;
-} __packed __aligned(4);
-
-/* PDMA tx descriptor bits */
-#define TX_DMA_BUF_LEN          0x3fff
-#define TX_DMA_PLEN0_MASK       (TX_DMA_BUF_LEN << 16)
-#define TX_DMA_PLEN0(_x)        (((_x) & TX_DMA_BUF_LEN) << 16)
-#define TX_DMA_PLEN1(_x)        ((_x) & TX_DMA_BUF_LEN)
-#define TX_DMA_GET_PLEN0(_x)    (((_x) >> 16) & TX_DMA_BUF_LEN)
-#define TX_DMA_GET_PLEN1(_x)    ((_x) & TX_DMA_BUF_LEN)
-#define TX_DMA_LS1              BIT(14)
-#define TX_DMA_LS0              BIT(30)
-#define TX_DMA_DONE             BIT(31)
-#define TX_DMA_FPORT_SHIFT      25
-#define TX_DMA_FPORT_MASK       0x7
-#define TX_DMA_INS_VLAN_MT7621  BIT(16)
-#define TX_DMA_INS_VLAN         BIT(7)
-#define TX_DMA_INS_PPPOE        BIT(12)
-#define TX_DMA_TAG              BIT(15)
-#define TX_DMA_TAG_MASK         BIT(15)
-#define TX_DMA_QN(_x)           ((_x) << 16)
-#define TX_DMA_PN(_x)           ((_x) << 24)
-#define TX_DMA_QN_MASK          TX_DMA_QN(0x7)
-#define TX_DMA_PN_MASK          TX_DMA_PN(0x7)
-#define TX_DMA_UDF              BIT(20)
-#define TX_DMA_CHKSUM           (0x7 << 29)
-#define TX_DMA_TSO              BIT(28)
-#define TX_DMA_DESP4_DEF        (TX_DMA_QN(3) | TX_DMA_PN(1))
-
-/* frame engine counters */
-#define MTK_PPE_AC_BCNT0        (MTK_CMTABLE_OFFSET + 0x00)
-#define MTK_GDMA1_TX_GBCNT      (MTK_CMTABLE_OFFSET + 0x300)
-#define MTK_GDMA2_TX_GBCNT      (MTK_GDMA1_TX_GBCNT + 0x40)
-
-/* phy device flags */
-#define MTK_PHY_FLAG_PORT       BIT(0)
-#define MTK_PHY_FLAG_ATTACH     BIT(1)
-
-struct mtk_tx_dma {
-        unsigned int txd1;
-        unsigned int txd2;
-        unsigned int txd3;
-        unsigned int txd4;
-} __packed __aligned(4);
-
-struct mtk_eth;
-struct mtk_mac;
-
-/* manage the attached phys */
-struct mtk_phy {
-        spinlock_t              lock;
-
-        struct phy_device       *phy[8];
-        struct device_node      *phy_node[8];
-        const __be32            *phy_fixed[8];
-        int                     duplex[8];
-        int                     speed[8];
-        int                     tx_fc[8];
-        int                     rx_fc[8];
-        int (*connect)(struct mtk_mac *mac);
-        void (*disconnect)(struct mtk_mac *mac);
-        void (*start)(struct mtk_mac *mac);
-        void (*stop)(struct mtk_mac *mac);
-};
-
-/* struct mtk_soc_data - the structure that holds the SoC specific data
- * @reg_table:          Some of the legacy registers changed their location
- *                      over time. Their offsets are stored in this table
- *
- * @init_data:          Some features depend on the silicon revision. This
- *                      callback allows runtime modification of the content of
- *                      this struct
- * @reset_fe:           This callback is used to trigger the reset of the frame
- *                      engine
- * @set_mac:            This callback is used to set the unicast mac address
- *                      filter
- * @fwd_config:         This callback is used to setup the forward config
- *                      register of the MAC
- * @switch_init:        This callback is used to bring up the switch core
- * @port_init:          Some SoCs have ports that can be router to a switch port
- *                      or an external PHY. This callback is used to setup these
- *                      ports.
- * @has_carrier:        This callback allows driver to check if there is a cable
- *                      attached.
- * @mdio_init:          This callbck is used to setup the MDIO bus if one is
- *                      present
- * @mdio_cleanup:       This callback is used to cleanup the MDIO state.
- * @mdio_write:         This callback is used to write data to the MDIO bus.
- * @mdio_read:          This callback is used to write data to the MDIO bus.
- * @mdio_adjust_link:   This callback is used to apply the PHY settings.
- * @piac_offset:        the PIAC register has a different different base offset
- * @hw_features:        feature set depends on the SoC type
- * @dma_ring_size:      allow GBit SoCs to set bigger rings than FE SoCs
- * @napi_weight:        allow GBit SoCs to set bigger napi weight than FE SoCs
- * @dma_type:           SoCs is PDMA, QDMA or a mix of the 2
- * @pdma_glo_cfg:       the default DMA configuration
- * @rx_int:             the TX interrupt bits used by the SoC
- * @tx_int:             the TX interrupt bits used by the SoC
- * @status_int:         the Status interrupt bits used by the SoC
- * @checksum_bit:       the bits used to turn on HW checksumming
- * @txd4:               default value of the TXD4 descriptor
- * @mac_count:          the number of MACs that the SoC has
- * @new_stats:          there is a old and new way to read hardware stats
- *                      registers
- * @jumbo_frame:        does the SoC support jumbo frames ?
- * @rx_2b_offset:       tell the rx dma to offset the data by 2 bytes
- * @rx_sg_dma:          scatter gather support
- * @padding_64b         enable 64 bit padding
- * @padding_bug:        rt2880 has a padding bug
- * @has_switch:         does the SoC have a built-in switch
- *
- * Although all of the supported SoCs share the same basic functionality, there
- * are several SoC specific functions and features that we need to support. This
- * struct holds the SoC specific data so that the common core can figure out
- * how to setup and use these differences.
- */
-struct mtk_soc_data {
-        const u16 *reg_table;
-
-        void (*init_data)(struct mtk_soc_data *data, struct net_device *netdev);
-        void (*reset_fe)(struct mtk_eth *eth);
-        void (*set_mac)(struct mtk_mac *mac, unsigned char *macaddr);
-        int (*fwd_config)(struct mtk_eth *eth);
-        int (*switch_init)(struct mtk_eth *eth);
-        void (*port_init)(struct mtk_eth *eth, struct mtk_mac *mac,
-                          struct device_node *port);
-        int (*has_carrier)(struct mtk_eth *eth);
-        int (*mdio_init)(struct mtk_eth *eth);
-        void (*mdio_cleanup)(struct mtk_eth *eth);
-        int (*mdio_write)(struct mii_bus *bus, int phy_addr, int phy_reg,
-                          u16 val);
-        int (*mdio_read)(struct mii_bus *bus, int phy_addr, int phy_reg);
-        void (*mdio_adjust_link)(struct mtk_eth *eth, int port);
-        u32 piac_offset;
-        netdev_features_t hw_features;
-        u32 dma_ring_size;
-        u32 napi_weight;
-        u32 dma_type;
-        u32 pdma_glo_cfg;
-        u32 rx_int;
-        u32 tx_int;
-        u32 status_int;
-        u32 checksum_bit;
-        u32 txd4;
-        u32 mac_count;
-
-        u32 new_stats:1;
-        u32 jumbo_frame:1;
-        u32 rx_2b_offset:1;
-        u32 rx_sg_dma:1;
-        u32 padding_64b:1;
-        u32 padding_bug:1;
-        u32 has_switch:1;
-};
-
-#define MTK_STAT_OFFSET                 0x40
-
-/* struct mtk_hw_stats - the structure that holds the traffic statistics.
- * @stats_lock:         make sure that stats operations are atomic
- * @reg_offset:         the status register offset of the SoC
- * @syncp:              the refcount
- *
- * All of the supported SoCs have hardware counters for traffic statstics.
- * Whenever the status IRQ triggers we can read the latest stats from these
- * counters and store them in this struct.
- */
-struct mtk_hw_stats {
-        spinlock_t stats_lock;
-        u32 reg_offset;
-        struct u64_stats_sync syncp;
-
-        u64 tx_bytes;
-        u64 tx_packets;
-        u64 tx_skip;
-        u64 tx_collisions;
-        u64 rx_bytes;
-        u64 rx_packets;
-        u64 rx_overflow;
-        u64 rx_fcs_errors;
-        u64 rx_short_errors;
-        u64 rx_long_errors;
-        u64 rx_checksum_errors;
-        u64 rx_flow_control_packets;
-};
-
-/* PDMA descriptor can point at 1-2 segments. This enum allows us to track how
- * memory was allocated so that it can be freed properly
- */
-enum mtk_tx_flags {
-        MTK_TX_FLAGS_SINGLE0    = 0x01,
-        MTK_TX_FLAGS_PAGE0      = 0x02,
-        MTK_TX_FLAGS_PAGE1      = 0x04,
-};
-
-/* struct mtk_tx_buf -  This struct holds the pointers to the memory pointed at
- *                      by the TX descriptor    s
- * @skb:                The SKB pointer of the packet being sent
- * @dma_addr0:          The base addr of the first segment
- * @dma_len0:           The length of the first segment
- * @dma_addr1:          The base addr of the second segment
- * @dma_len1:           The length of the second segment
- */
-struct mtk_tx_buf {
-        struct sk_buff *skb;
-        u32 flags;
-        DEFINE_DMA_UNMAP_ADDR(dma_addr0);
-        DEFINE_DMA_UNMAP_LEN(dma_len0);
-        DEFINE_DMA_UNMAP_ADDR(dma_addr1);
-        DEFINE_DMA_UNMAP_LEN(dma_len1);
-};
-
-/* struct mtk_tx_ring - This struct holds info describing a TX ring
- * @tx_dma:             The descriptor ring
- * @tx_buf:             The memory pointed at by the ring
- * @tx_phys:            The physical addr of tx_buf
- * @tx_next_free:       Pointer to the next free descriptor
- * @tx_last_free:       Pointer to the last free descriptor
- * @tx_thresh:          The threshold of minimum amount of free descriptors
- * @tx_map:             Callback to map a new packet into the ring
- * @tx_poll:            Callback for the housekeeping function
- * @tx_clean:           Callback for the cleanup function
- * @tx_ring_size:       How many descriptors are in the ring
- * @tx_free_idx:        The index of th next free descriptor
- * @tx_next_idx:        QDMA uses a linked list. This element points to the next
- *                      free descriptor in the list
- * @tx_free_count:      QDMA uses a linked list. Track how many free descriptors
- *                      are present
- */
-struct mtk_tx_ring {
-        struct mtk_tx_dma *tx_dma;
-        struct mtk_tx_buf *tx_buf;
-        dma_addr_t tx_phys;
-        struct mtk_tx_dma *tx_next_free;
-        struct mtk_tx_dma *tx_last_free;
-        u16 tx_thresh;
-        int (*tx_map)(struct sk_buff *skb, struct net_device *dev, int tx_num,
-                      struct mtk_tx_ring *ring, bool gso);
-        int (*tx_poll)(struct mtk_eth *eth, int budget, bool *tx_again);
-        void (*tx_clean)(struct mtk_eth *eth);
-
-        /* PDMA only */
-        u16 tx_ring_size;
-        u16 tx_free_idx;
-
-        /* QDMA only */
-        u16 tx_next_idx;
-        atomic_t tx_free_count;
-};
-
-/* struct mtk_rx_ring - This struct holds info describing a RX ring
- * @rx_dma:             The descriptor ring
- * @rx_data:            The memory pointed at by the ring
- * @trx_phys:           The physical addr of rx_buf
- * @rx_ring_size:       How many descriptors are in the ring
- * @rx_buf_size:        The size of each packet buffer
- * @rx_calc_idx:        The current head of ring
- */
-struct mtk_rx_ring {
-        struct mtk_rx_dma *rx_dma;
-        u8 **rx_data;
-        dma_addr_t rx_phys;
-        u16 rx_ring_size;
-        u16 frag_size;
-        u16 rx_buf_size;
-        u16 rx_calc_idx;
-};
-
-/* currently no SoC has more than 2 macs */
-#define MTK_MAX_DEVS                    2
-
-/* struct mtk_eth -     This is the main datasructure for holding the state
- *                      of the driver
- * @dev:                The device pointer
- * @base:               The mapped register i/o base
- * @page_lock:          Make sure that register operations are atomic
- * @soc:                pointer to our SoC specific data
- * @dummy_dev:          we run 2 netdevs on 1 physical DMA ring and need a
- *                      dummy for NAPI to work
- * @netdev:             The netdev instances
- * @mac:                Each netdev is linked to a physical MAC
- * @switch_np:          The phandle for the switch
- * @irq:                The IRQ that we are using
- * @msg_enable:         Ethtool msg level
- * @ysclk:              The sysclk rate - neeed for calibration
- * @ethsys:             The register map pointing at the range used to setup
- *                      MII modes
- * @dma_refcnt:         track how many netdevs are using the DMA engine
- * @tx_ring:            Pointer to the memore holding info about the TX ring
- * @rx_ring:            Pointer to the memore holding info about the RX ring
- * @rx_napi:            The NAPI struct
- * @scratch_ring:       Newer SoCs need memory for a second HW managed TX ring
- * @scratch_head:       The scratch memory that scratch_ring points to.
- * @phy:                Info about the attached PHYs
- * @mii_bus:            If there is a bus we need to create an instance for it
- * @link:               Track if the ports have a physical link
- * @sw_priv:            Pointer to the switches private data
- * @vlan_map:           RX VID tracking
- */
-
-struct mtk_eth {
-        struct device                   *dev;
-        void __iomem                    *base;
-        spinlock_t                      page_lock;
-        struct mtk_soc_data             *soc;
-        struct net_device               dummy_dev;
-        struct net_device               *netdev[MTK_MAX_DEVS];
-        struct mtk_mac                  *mac[MTK_MAX_DEVS];
-        struct device_node              *switch_np;
-        int                             irq;
-        u32                             msg_enable;
-        unsigned long                   sysclk;
-        struct regmap                   *ethsys;
-        atomic_t                        dma_refcnt;
-        struct mtk_tx_ring              tx_ring;
-        struct mtk_rx_ring              rx_ring[2];
-        struct napi_struct              rx_napi;
-        struct mtk_tx_dma               *scratch_ring;
-        void                            *scratch_head;
-        struct mtk_phy                  *phy;
-        struct mii_bus                  *mii_bus;
-        int                             link[8];
-        void                            *sw_priv;
-        unsigned long                   vlan_map;
-};
-
-/* struct mtk_mac -     the structure that holds the info about the MACs of the
- *                      SoC
- * @id:                 The number of the MAC
- * @of_node:            Our devicetree node
- * @hw:                 Backpointer to our main datastruture
- * @hw_stats:           Packet statistics counter
- * @phy_dev:            The attached PHY if available
- * @phy_flags:          The PHYs flags
- * @pending_work:       The workqueue used to reset the dma ring
- */
-struct mtk_mac {
-        int                             id;
-        struct device_node              *of_node;
-        struct mtk_eth                  *hw;
-        struct mtk_hw_stats             *hw_stats;
-        struct phy_device               *phy_dev;
-        u32                             phy_flags;
-        struct work_struct              pending_work;
-};
-
-/* the struct describing the SoC. these are declared in the soc_xyz.c files */
-extern const struct of_device_id of_mtk_match[];
-
-/* read the hardware status register */
-void mtk_stats_update_mac(struct mtk_mac *mac);
-
-/* default checksum setup handler */
-void mtk_reset(struct mtk_eth *eth, u32 reset_bits);
-
-/* register i/o wrappers */
-void mtk_w32(struct mtk_eth *eth, u32 val, unsigned int reg);
-u32 mtk_r32(struct mtk_eth *eth, unsigned int reg);
-
-/* default clock calibration handler */
-int mtk_set_clock_cycle(struct mtk_eth *eth);
-
-/* default checksum setup handler */
-void mtk_csum_config(struct mtk_eth *eth);
-
-/* default forward config handler */
-void mtk_fwd_config(struct mtk_eth *eth);
-
-#endif /* MTK_ETH_H */
diff --git a/drivers/staging/mt7621-eth/soc_mt7621.c b/drivers/staging/mt7621-eth/soc_mt7621.c
deleted file mode 100644
index 5d63b5d96f6b..000000000000
--- a/drivers/staging/mt7621-eth/soc_mt7621.c
+++ /dev/null
@@ -1,161 +0,0 @@
-/*   This program is free software; you can redistribute it and/or modify
- *   it under the terms of the GNU General Public License as published by
- *   the Free Software Foundation; version 2 of the License
- *
- *   This program is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *   GNU General Public License for more details.
- *
- *   Copyright (C) 2009-2016 John Crispin <blogic@openwrt.org>
- *   Copyright (C) 2009-2016 Felix Fietkau <nbd@openwrt.org>
- *   Copyright (C) 2013-2016 Michael Lee <igvtee@gmail.com>
- */
-
-#include <linux/module.h>
-#include <linux/platform_device.h>
-#include <linux/if_vlan.h>
-#include <linux/of_net.h>
-
-#include <asm/mach-ralink/ralink_regs.h>
-
-#include "mtk_eth_soc.h"
-#include "gsw_mt7620.h"
-#include "mdio.h"
-
-#define MT7620_CDMA_CSG_CFG     0x400
-#define MT7621_CDMP_IG_CTRL     (MT7620_CDMA_CSG_CFG + 0x00)
-#define MT7621_CDMP_EG_CTRL     (MT7620_CDMA_CSG_CFG + 0x04)
-#define MT7621_RESET_FE         BIT(6)
-#define MT7621_L4_VALID         BIT(24)
-
-#define MT7621_TX_DMA_UDF       BIT(19)
-
-#define CDMA_ICS_EN             BIT(2)
-#define CDMA_UCS_EN             BIT(1)
-#define CDMA_TCS_EN             BIT(0)
-
-#define GDMA_ICS_EN             BIT(22)
-#define GDMA_TCS_EN             BIT(21)
-#define GDMA_UCS_EN             BIT(20)
-
-/* frame engine counters */
-#define MT7621_REG_MIB_OFFSET   0x2000
-#define MT7621_PPE_AC_BCNT0     (MT7621_REG_MIB_OFFSET + 0x00)
-#define MT7621_GDM1_TX_GBCNT    (MT7621_REG_MIB_OFFSET + 0x400)
-#define MT7621_GDM2_TX_GBCNT    (MT7621_GDM1_TX_GBCNT + 0x40)
-
-#define GSW_REG_GDMA1_MAC_ADRL  0x508
-#define GSW_REG_GDMA1_MAC_ADRH  0x50C
-#define GSW_REG_GDMA2_MAC_ADRL  0x1508
-#define GSW_REG_GDMA2_MAC_ADRH  0x150C
-
-#define MT7621_MTK_RST_GL       0x04
-#define MT7620_MTK_INT_STATUS2  0x08
-
-/* MTK_INT_STATUS reg on mt7620 define CNT_GDM1_AF at BIT(29)
- * but after test it should be BIT(13).
- */
-#define MT7621_MTK_GDM1_AF      BIT(28)
-#define MT7621_MTK_GDM2_AF      BIT(29)
-
-static const u16 mt7621_reg_table[MTK_REG_COUNT] = {
-        [MTK_REG_PDMA_GLO_CFG] = RT5350_PDMA_GLO_CFG,
-        [MTK_REG_PDMA_RST_CFG] = RT5350_PDMA_RST_CFG,
-        [MTK_REG_DLY_INT_CFG] = RT5350_DLY_INT_CFG,
-        [MTK_REG_TX_BASE_PTR0] = RT5350_TX_BASE_PTR0,
-        [MTK_REG_TX_MAX_CNT0] = RT5350_TX_MAX_CNT0,
-        [MTK_REG_TX_CTX_IDX0] = RT5350_TX_CTX_IDX0,
-        [MTK_REG_TX_DTX_IDX0] = RT5350_TX_DTX_IDX0,
-        [MTK_REG_RX_BASE_PTR0] = RT5350_RX_BASE_PTR0,
-        [MTK_REG_RX_MAX_CNT0] = RT5350_RX_MAX_CNT0,
-        [MTK_REG_RX_CALC_IDX0] = RT5350_RX_CALC_IDX0,
-        [MTK_REG_RX_DRX_IDX0] = RT5350_RX_DRX_IDX0,
-        [MTK_REG_MTK_INT_ENABLE] = RT5350_MTK_INT_ENABLE,
-        [MTK_REG_MTK_INT_STATUS] = RT5350_MTK_INT_STATUS,
-        [MTK_REG_MTK_DMA_VID_BASE] = 0,
-        [MTK_REG_MTK_COUNTER_BASE] = MT7621_GDM1_TX_GBCNT,
-        [MTK_REG_MTK_RST_GL] = MT7621_MTK_RST_GL,
-        [MTK_REG_MTK_INT_STATUS2] = MT7620_MTK_INT_STATUS2,
-};
-
-static void mt7621_mtk_reset(struct mtk_eth *eth)
-{
-        mtk_reset(eth, MT7621_RESET_FE);
-}
-
-static int mt7621_fwd_config(struct mtk_eth *eth)
-{
-        /* Setup GMAC1 only, there is no support for GMAC2 yet */
-        mtk_w32(eth, mtk_r32(eth, MT7620_GDMA1_FWD_CFG) & ~0xffff,
-                MT7620_GDMA1_FWD_CFG);
-
-        /* Enable RX checksum */
-        mtk_w32(eth, mtk_r32(eth, MT7620_GDMA1_FWD_CFG) | (GDMA_ICS_EN |
-                       GDMA_TCS_EN | GDMA_UCS_EN),
-                       MT7620_GDMA1_FWD_CFG);
-
-        /* Enable RX VLan Offloading */
-        mtk_w32(eth, 0, MT7621_CDMP_EG_CTRL);
-
-        return 0;
-}
-
-static void mt7621_set_mac(struct mtk_mac *mac, unsigned char *hwaddr)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&mac->hw->page_lock, flags);
-        if (mac->id == 0) {
-                mtk_w32(mac->hw, (hwaddr[0] << 8) | hwaddr[1],
-                        GSW_REG_GDMA1_MAC_ADRH);
-                mtk_w32(mac->hw, (hwaddr[2] << 24) | (hwaddr[3] << 16) |
-                        (hwaddr[4] << 8) | hwaddr[5],
-                        GSW_REG_GDMA1_MAC_ADRL);
-        }
-        if (mac->id == 1) {
-                mtk_w32(mac->hw, (hwaddr[0] << 8) | hwaddr[1],
-                        GSW_REG_GDMA2_MAC_ADRH);
-                mtk_w32(mac->hw, (hwaddr[2] << 24) | (hwaddr[3] << 16) |
-                        (hwaddr[4] << 8) | hwaddr[5],
-                        GSW_REG_GDMA2_MAC_ADRL);
-        }
-        spin_unlock_irqrestore(&mac->hw->page_lock, flags);
-}
-
-static struct mtk_soc_data mt7621_data = {
-        .hw_features = NETIF_F_IP_CSUM | NETIF_F_RXCSUM |
-                       NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX |
-                       NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 |
-                       NETIF_F_IPV6_CSUM,
-        .dma_type = MTK_PDMA,
-        .dma_ring_size = 256,
-        .napi_weight = 64,
-        .new_stats = 1,
-        .padding_64b = 1,
-        .rx_2b_offset = 1,
-        .rx_sg_dma = 1,
-        .has_switch = 1,
-        .mac_count = 2,
-        .reset_fe = mt7621_mtk_reset,
-        .set_mac = mt7621_set_mac,
-        .fwd_config = mt7621_fwd_config,
-        .switch_init = mtk_gsw_init,
-        .reg_table = mt7621_reg_table,
-        .pdma_glo_cfg = MTK_PDMA_SIZE_16DWORDS,
-        .rx_int = RT5350_RX_DONE_INT,
-        .tx_int = RT5350_TX_DONE_INT,
-        .status_int = MT7621_MTK_GDM1_AF | MT7621_MTK_GDM2_AF,
-        .checksum_bit = MT7621_L4_VALID,
-        .has_carrier = mt7620_has_carrier,
-        .mdio_read = mt7620_mdio_read,
-        .mdio_write = mt7620_mdio_write,
-        .mdio_adjust_link = mt7620_mdio_link_adjust,
-};
-
-const struct of_device_id of_mtk_match[] = {
-        { .compatible = "mediatek,mt7621-eth", .data = &mt7621_data },
-        {},
-};
-
-MODULE_DEVICE_TABLE(of, of_mtk_match);
diff --git a/drivers/staging/mt7621-pci/Kconfig b/drivers/staging/mt7621-pci/Kconfig
index d33533872a16..c8fa17cfa807 100644
--- a/drivers/staging/mt7621-pci/Kconfig
+++ b/drivers/staging/mt7621-pci/Kconfig
@@ -1,6 +1,7 @@
 config PCI_MT7621
         tristate "MediaTek MT7621 PCI Controller"
         depends on RALINK
+        depends on PCI
         select PCI_DRIVERS_GENERIC
         help
           This selects a driver for the MediaTek MT7621 PCI Controller.
diff --git a/drivers/staging/octeon/ethernet-mdio.c b/drivers/staging/octeon/ethernet-mdio.c
index d6248eecf123..2aee64fdaec5 100644
--- a/drivers/staging/octeon/ethernet-mdio.c
+++ b/drivers/staging/octeon/ethernet-mdio.c
@@ -163,7 +163,7 @@ int cvm_oct_phy_setup_device(struct net_device *dev)
                 goto no_phy;
 
         phydev = of_phy_connect(dev, phy_node, cvm_oct_adjust_link, 0,
-                                PHY_INTERFACE_MODE_GMII);
+                                priv->phy_mode);
         of_node_put(phy_node);
 
         if (!phydev)
diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
index ce61c5670ef6..986db76705cc 100644
--- a/drivers/staging/octeon/ethernet.c
+++ b/drivers/staging/octeon/ethernet.c
@@ -653,14 +653,37 @@ static struct device_node *cvm_oct_node_for_port(struct device_node *pip,
         return np;
 }
 
-static void cvm_set_rgmii_delay(struct device_node *np, int iface, int port)
+static void cvm_set_rgmii_delay(struct octeon_ethernet *priv, int iface,
+                                int port)
 {
+        struct device_node *np = priv->of_node;
         u32 delay_value;
+        bool rx_delay;
+        bool tx_delay;
 
-        if (!of_property_read_u32(np, "rx-delay", &delay_value))
+        /* By default, both RX/TX delay is enabled in
+         * __cvmx_helper_rgmii_enable().
+         */
+        rx_delay = true;
+        tx_delay = true;
+
+        if (!of_property_read_u32(np, "rx-delay", &delay_value)) {
                 cvmx_write_csr(CVMX_ASXX_RX_CLK_SETX(port, iface), delay_value);
-        if (!of_property_read_u32(np, "tx-delay", &delay_value))
+                rx_delay = delay_value > 0;
+        }
+        if (!of_property_read_u32(np, "tx-delay", &delay_value)) {
                 cvmx_write_csr(CVMX_ASXX_TX_CLK_SETX(port, iface), delay_value);
+                tx_delay = delay_value > 0;
+        }
+
+        if (!rx_delay && !tx_delay)
+                priv->phy_mode = PHY_INTERFACE_MODE_RGMII_ID;
+        else if (!rx_delay)
+                priv->phy_mode = PHY_INTERFACE_MODE_RGMII_RXID;
+        else if (!tx_delay)
+                priv->phy_mode = PHY_INTERFACE_MODE_RGMII_TXID;
+        else
+                priv->phy_mode = PHY_INTERFACE_MODE_RGMII;
 }
 
 static int cvm_oct_probe(struct platform_device *pdev)
@@ -825,6 +848,7 @@ static int cvm_oct_probe(struct platform_device *pdev)
                         priv->port = port;
                         priv->queue = cvmx_pko_get_base_queue(priv->port);
                         priv->fau = fau - cvmx_pko_get_num_queues(port) * 4;
+                        priv->phy_mode = PHY_INTERFACE_MODE_NA;
                         for (qos = 0; qos < 16; qos++)
                                 skb_queue_head_init(&priv->tx_free_list[qos]);
                         for (qos = 0; qos < cvmx_pko_get_num_queues(port);
@@ -856,6 +880,7 @@ static int cvm_oct_probe(struct platform_device *pdev)
                                 break;
 
                         case CVMX_HELPER_INTERFACE_MODE_SGMII:
+                                priv->phy_mode = PHY_INTERFACE_MODE_SGMII;
                                 dev->netdev_ops = &cvm_oct_sgmii_netdev_ops;
                                 strcpy(dev->name, "eth%d");
                                 break;
@@ -865,11 +890,16 @@ static int cvm_oct_probe(struct platform_device *pdev)
                                 strcpy(dev->name, "spi%d");
                                 break;
 
-                        case CVMX_HELPER_INTERFACE_MODE_RGMII:
                         case CVMX_HELPER_INTERFACE_MODE_GMII:
+                                priv->phy_mode = PHY_INTERFACE_MODE_GMII;
+                                dev->netdev_ops = &cvm_oct_rgmii_netdev_ops;
+                                strcpy(dev->name, "eth%d");
+                                break;
+
+                        case CVMX_HELPER_INTERFACE_MODE_RGMII:
                                 dev->netdev_ops = &cvm_oct_rgmii_netdev_ops;
                                 strcpy(dev->name, "eth%d");
-                                cvm_set_rgmii_delay(priv->of_node, interface,
+                                cvm_set_rgmii_delay(priv, interface,
                                                     port_index);
                                 break;
                         }
diff --git a/drivers/staging/octeon/octeon-ethernet.h b/drivers/staging/octeon/octeon-ethernet.h
index 4a07e7f43d12..be570d33685a 100644
--- a/drivers/staging/octeon/octeon-ethernet.h
+++ b/drivers/staging/octeon/octeon-ethernet.h
@@ -12,7 +12,7 @@
 #define OCTEON_ETHERNET_H
 
 #include <linux/of.h>
-
+#include <linux/phy.h>
 #include <asm/octeon/cvmx-helper-board.h>
 
 /**
@@ -33,6 +33,8 @@ struct octeon_ethernet {
          * cvmx_helper_interface_mode_t
          */
         int imode;
+        /* PHY mode */
+        phy_interface_t phy_mode;
         /* List of outstanding tx buffers per queue */
         struct sk_buff_head tx_free_list[16];
         unsigned int last_speed;
diff --git a/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c b/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c
index 80b8d4153414..a54286498a47 100644
--- a/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c
+++ b/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c
@@ -45,7 +45,7 @@ static int dcon_init_xo_1(struct dcon_priv *dcon)
 {
         unsigned char lob;
         int ret, i;
-        struct dcon_gpio *pin = &gpios_asis[0];
+        const struct dcon_gpio *pin = &gpios_asis[0];
 
         for (i = 0; i < ARRAY_SIZE(gpios_asis); i++) {
                 gpios[i] = devm_gpiod_get(&dcon->client->dev, pin[i].name,
diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c
index 1723a47a96b4..952f2ab51347 100644
--- a/drivers/staging/rtl8188eu/core/rtw_xmit.c
+++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c
@@ -174,7 +174,9 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter)
 
         pxmitpriv->free_xmit_extbuf_cnt = num_xmit_extbuf;
 
-        rtw_alloc_hwxmits(padapter);
+        res = rtw_alloc_hwxmits(padapter);
+        if (res == _FAIL)
+                goto exit;
         rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
 
         for (i = 0; i < 4; i++)
@@ -1503,7 +1505,7 @@ exit:
         return res;
 }
 
-void rtw_alloc_hwxmits(struct adapter *padapter)
+s32 rtw_alloc_hwxmits(struct adapter *padapter)
 {
         struct hw_xmit *hwxmits;
         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
@@ -1512,6 +1514,8 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
 
         pxmitpriv->hwxmits = kcalloc(pxmitpriv->hwxmit_entry,
                                      sizeof(struct hw_xmit), GFP_KERNEL);
+        if (!pxmitpriv->hwxmits)
+                return _FAIL;
 
         hwxmits = pxmitpriv->hwxmits;
 
@@ -1519,6 +1523,7 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
         hwxmits[1] .sta_queue = &pxmitpriv->vi_pending;
         hwxmits[2] .sta_queue = &pxmitpriv->be_pending;
         hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
+        return _SUCCESS;
 }
 
 void rtw_free_hwxmits(struct adapter *padapter)
diff --git a/drivers/staging/rtl8188eu/include/rtw_xmit.h b/drivers/staging/rtl8188eu/include/rtw_xmit.h
index 788f59c74ea1..ba7e15fbde72 100644
--- a/drivers/staging/rtl8188eu/include/rtw_xmit.h
+++ b/drivers/staging/rtl8188eu/include/rtw_xmit.h
@@ -336,7 +336,7 @@ s32 rtw_txframes_sta_ac_pending(struct adapter *padapter,
 void rtw_init_hwxmits(struct hw_xmit *phwxmit, int entry);
 s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter);
 void _rtw_free_xmit_priv(struct xmit_priv *pxmitpriv);
-void rtw_alloc_hwxmits(struct adapter *padapter);
+s32 rtw_alloc_hwxmits(struct adapter *padapter);
 void rtw_free_hwxmits(struct adapter *padapter);
 s32 rtw_xmit(struct adapter *padapter, struct sk_buff **pkt);
 
diff --git a/drivers/staging/rtl8712/rtl8712_cmd.c b/drivers/staging/rtl8712/rtl8712_cmd.c
index 1920d02f7c9f..8c36acedf507 100644
--- a/drivers/staging/rtl8712/rtl8712_cmd.c
+++ b/drivers/staging/rtl8712/rtl8712_cmd.c
@@ -147,17 +147,9 @@ static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf)
 
 static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf)
 {
-        u32 val;
-        void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj      *pcmd);
         struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
 
-        if (pcmd->rsp && pcmd->rspsz > 0)
-                memcpy(pcmd->rsp, (u8 *)&val, pcmd->rspsz);
-        pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
-        if (!pcmd_callback)
-                r8712_free_cmd_obj(pcmd);
-        else
-                pcmd_callback(padapter, pcmd);
+        r8712_free_cmd_obj(pcmd);
         return H2C_SUCCESS;
 }
 
diff --git a/drivers/staging/rtl8712/rtl8712_cmd.h b/drivers/staging/rtl8712/rtl8712_cmd.h
index 92fb77666d44..1ef86b8c592f 100644
--- a/drivers/staging/rtl8712/rtl8712_cmd.h
+++ b/drivers/staging/rtl8712/rtl8712_cmd.h
@@ -140,7 +140,7 @@ enum rtl8712_h2c_cmd {
 static struct _cmd_callback     cmd_callback[] = {
         {GEN_CMD_CODE(_Read_MACREG), NULL}, /*0*/
         {GEN_CMD_CODE(_Write_MACREG), NULL},
-        {GEN_CMD_CODE(_Read_BBREG), &r8712_getbbrfreg_cmdrsp_callback},
+        {GEN_CMD_CODE(_Read_BBREG), NULL},
         {GEN_CMD_CODE(_Write_BBREG), NULL},
         {GEN_CMD_CODE(_Read_RFREG), &r8712_getbbrfreg_cmdrsp_callback},
         {GEN_CMD_CODE(_Write_RFREG), NULL}, /*5*/
diff --git a/drivers/staging/rtl8723bs/core/rtw_xmit.c b/drivers/staging/rtl8723bs/core/rtw_xmit.c
index 094d61bcb469..b87f13a0b563 100644
--- a/drivers/staging/rtl8723bs/core/rtw_xmit.c
+++ b/drivers/staging/rtl8723bs/core/rtw_xmit.c
@@ -260,7 +260,9 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter)
                 }
         }
 
-        rtw_alloc_hwxmits(padapter);
+        res = rtw_alloc_hwxmits(padapter);
+        if (res == _FAIL)
+                goto exit;
         rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
 
         for (i = 0; i < 4; i++) {
@@ -2144,7 +2146,7 @@ exit:
         return res;
 }
 
-void rtw_alloc_hwxmits(struct adapter *padapter)
+s32 rtw_alloc_hwxmits(struct adapter *padapter)
 {
         struct hw_xmit *hwxmits;
         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
@@ -2155,10 +2157,8 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
 
         pxmitpriv->hwxmits = rtw_zmalloc(sizeof(struct hw_xmit) * pxmitpriv->hwxmit_entry);
 
-        if (pxmitpriv->hwxmits == NULL) {
-                DBG_871X("alloc hwxmits fail!...\n");
-                return;
-        }
+        if (!pxmitpriv->hwxmits)
+                return _FAIL;
 
         hwxmits = pxmitpriv->hwxmits;
 
@@ -2204,7 +2204,7 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
 
         }
 
-
+        return _SUCCESS;
 }
 
 void rtw_free_hwxmits(struct adapter *padapter)
diff --git a/drivers/staging/rtl8723bs/include/rtw_xmit.h b/drivers/staging/rtl8723bs/include/rtw_xmit.h
index 1b38b9182b31..37f42b2f22f1 100644
--- a/drivers/staging/rtl8723bs/include/rtw_xmit.h
+++ b/drivers/staging/rtl8723bs/include/rtw_xmit.h
@@ -487,7 +487,7 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter);
 void _rtw_free_xmit_priv (struct xmit_priv *pxmitpriv);
 
 
-void rtw_alloc_hwxmits(struct adapter *padapter);
+s32 rtw_alloc_hwxmits(struct adapter *padapter);
 void rtw_free_hwxmits(struct adapter *padapter);
 
 
diff --git a/drivers/staging/rtlwifi/phydm/rtl_phydm.c b/drivers/staging/rtlwifi/phydm/rtl_phydm.c
index 9930ed954abb..4cc77b2016e1 100644
--- a/drivers/staging/rtlwifi/phydm/rtl_phydm.c
+++ b/drivers/staging/rtlwifi/phydm/rtl_phydm.c
@@ -180,6 +180,8 @@ static int rtl_phydm_init_priv(struct rtl_priv *rtlpriv,
 
         rtlpriv->phydm.internal =
                 kzalloc(sizeof(struct phy_dm_struct), GFP_KERNEL);
+        if (!rtlpriv->phydm.internal)
+                return 0;
 
         _rtl_phydm_init_com_info(rtlpriv, ic, params);
 
diff --git a/drivers/staging/rtlwifi/rtl8822be/fw.c b/drivers/staging/rtlwifi/rtl8822be/fw.c
index f061dd1382aa..cf6b7a80b753 100644
--- a/drivers/staging/rtlwifi/rtl8822be/fw.c
+++ b/drivers/staging/rtlwifi/rtl8822be/fw.c
@@ -743,6 +743,8 @@ void rtl8822be_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
                       u1_rsvd_page_loc, 3);
 
         skb = dev_alloc_skb(totalpacketlen);
+        if (!skb)
+                return;
         memcpy((u8 *)skb_put(skb, totalpacketlen), &reserved_page_packet,
                totalpacketlen);
 
diff --git a/drivers/staging/speakup/speakup_soft.c b/drivers/staging/speakup/speakup_soft.c
index edff6ce85655..9d85a3a1af4c 100644
--- a/drivers/staging/speakup/speakup_soft.c
+++ b/drivers/staging/speakup/speakup_soft.c
@@ -210,12 +210,15 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count,
                 return -EINVAL;
 
         spin_lock_irqsave(&speakup_info.spinlock, flags);
+        synth_soft.alive = 1;
         while (1) {
                 prepare_to_wait(&speakup_event, &wait, TASK_INTERRUPTIBLE);
-                if (!unicode)
-                        synth_buffer_skip_nonlatin1();
-                if (!synth_buffer_empty() || speakup_info.flushing)
-                        break;
+                if (synth_current() == &synth_soft) {
+                        if (!unicode)
+                                synth_buffer_skip_nonlatin1();
+                        if (!synth_buffer_empty() || speakup_info.flushing)
+                                break;
+                }
                 spin_unlock_irqrestore(&speakup_info.spinlock, flags);
                 if (fp->f_flags & O_NONBLOCK) {
                         finish_wait(&speakup_event, &wait);
@@ -235,6 +238,8 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count,
 
         /* Keep 3 bytes available for a 16bit UTF-8-encoded character */
         while (chars_sent <= count - bytes_per_ch) {
+                if (synth_current() != &synth_soft)
+                        break;
                 if (speakup_info.flushing) {
                         speakup_info.flushing = 0;
                         ch = '\x18';
@@ -331,7 +336,8 @@ static __poll_t softsynth_poll(struct file *fp, struct poll_table_struct *wait)
         poll_wait(fp, &speakup_event, wait);
 
         spin_lock_irqsave(&speakup_info.spinlock, flags);
-        if (!synth_buffer_empty() || speakup_info.flushing)
+        if (synth_current() == &synth_soft &&
+            (!synth_buffer_empty() || speakup_info.flushing))
                 ret = EPOLLIN | EPOLLRDNORM;
         spin_unlock_irqrestore(&speakup_info.spinlock, flags);
         return ret;
diff --git a/drivers/staging/speakup/spk_priv.h b/drivers/staging/speakup/spk_priv.h
index c8e688878fc7..ac6a74883af4 100644
--- a/drivers/staging/speakup/spk_priv.h
+++ b/drivers/staging/speakup/spk_priv.h
@@ -74,6 +74,7 @@ int synth_request_region(unsigned long start, unsigned long n);
 int synth_release_region(unsigned long start, unsigned long n);
 int synth_add(struct spk_synth *in_synth);
 void synth_remove(struct spk_synth *in_synth);
+struct spk_synth *synth_current(void);
 
 extern struct speakup_info_t speakup_info;
 
diff --git a/drivers/staging/speakup/synth.c b/drivers/staging/speakup/synth.c
index 25f259ee4ffc..3568bfb89912 100644
--- a/drivers/staging/speakup/synth.c
+++ b/drivers/staging/speakup/synth.c
@@ -481,4 +481,10 @@ void synth_remove(struct spk_synth *in_synth)
 }
 EXPORT_SYMBOL_GPL(synth_remove);
 
+struct spk_synth *synth_current(void)
+{
+        return synth;
+}
+EXPORT_SYMBOL_GPL(synth_current);
+
 short spk_punc_masks[] = { 0, SOME, MOST, PUNC, PUNC | B_SYM };
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index 804daf83be35..064d0db4c51e 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -3513,6 +3513,7 @@ static int vchiq_probe(struct platform_device *pdev)
         struct device_node *fw_node;
         const struct of_device_id *of_id;
         struct vchiq_drvdata *drvdata;
+        struct device *vchiq_dev;
         int err;
 
         of_id = of_match_node(vchiq_of_match, pdev->dev.of_node);
@@ -3547,9 +3548,12 @@ static int vchiq_probe(struct platform_device *pdev)
                 goto failed_platform_init;
         }
 
-        if (IS_ERR(device_create(vchiq_class, &pdev->dev, vchiq_devid,
-                                 NULL, "vchiq")))
+        vchiq_dev = device_create(vchiq_class, &pdev->dev, vchiq_devid, NULL,
+                                  "vchiq");
+        if (IS_ERR(vchiq_dev)) {
+                err = PTR_ERR(vchiq_dev);
                 goto failed_device_create;
+        }
 
         vchiq_debugfs_init();
 
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
index b370985b58a1..c6bb4aaf9bd0 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -1033,8 +1033,6 @@ static void vnt_interrupt_process(struct vnt_private *priv)
                 return;
         }
 
-        MACvIntDisable(priv->PortOffset);
-
         spin_lock_irqsave(&priv->lock, flags);
 
         /* Read low level stats */
@@ -1122,8 +1120,6 @@ static void vnt_interrupt_process(struct vnt_private *priv)
         }
 
         spin_unlock_irqrestore(&priv->lock, flags);
-
-        MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE);
 }
 
 static void vnt_interrupt_work(struct work_struct *work)
@@ -1133,14 +1129,17 @@ static void vnt_interrupt_work(struct work_struct *work)
 
         if (priv->vif)
                 vnt_interrupt_process(priv);
+
+        MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE);
 }
 
 static irqreturn_t vnt_interrupt(int irq,  void *arg)
 {
         struct vnt_private *priv = arg;
 
-        if (priv->vif)
-                schedule_work(&priv->interrupt_work);
+        schedule_work(&priv->interrupt_work);
+
+        MACvIntDisable(priv->PortOffset);
 
         return IRQ_HANDLED;
 }
diff --git a/drivers/tty/serial/ar933x_uart.c b/drivers/tty/serial/ar933x_uart.c
index db5df3d54818..3bdd56a1021b 100644
--- a/drivers/tty/serial/ar933x_uart.c
+++ b/drivers/tty/serial/ar933x_uart.c
@@ -49,11 +49,6 @@ struct ar933x_uart_port {
         struct clk              *clk;
 };
 
-static inline bool ar933x_uart_console_enabled(void)
-{
-        return IS_ENABLED(CONFIG_SERIAL_AR933X_CONSOLE);
-}
-
 static inline unsigned int ar933x_uart_read(struct ar933x_uart_port *up,
                                             int offset)
 {
@@ -508,6 +503,7 @@ static const struct uart_ops ar933x_uart_ops = {
         .verify_port    = ar933x_uart_verify_port,
 };
 
+#ifdef CONFIG_SERIAL_AR933X_CONSOLE
 static struct ar933x_uart_port *
 ar933x_console_ports[CONFIG_SERIAL_AR933X_NR_UARTS];
 
@@ -604,14 +600,7 @@ static struct console ar933x_uart_console = {
         .index          = -1,
         .data           = &ar933x_uart_driver,
 };
-
-static void ar933x_uart_add_console_port(struct ar933x_uart_port *up)
-{
-        if (!ar933x_uart_console_enabled())
-                return;
-
-        ar933x_console_ports[up->port.line] = up;
-}
+#endif /* CONFIG_SERIAL_AR933X_CONSOLE */
 
 static struct uart_driver ar933x_uart_driver = {
         .owner          = THIS_MODULE,
@@ -700,7 +689,9 @@ static int ar933x_uart_probe(struct platform_device *pdev)
         baud = ar933x_uart_get_baud(port->uartclk, 0, AR933X_UART_MAX_STEP);
         up->max_baud = min_t(unsigned int, baud, AR933X_UART_MAX_BAUD);
 
-        ar933x_uart_add_console_port(up);
+#ifdef CONFIG_SERIAL_AR933X_CONSOLE
+        ar933x_console_ports[up->port.line] = up;
+#endif
 
         ret = uart_add_one_port(&ar933x_uart_driver, &up->port);
         if (ret)
@@ -749,8 +740,9 @@ static int __init ar933x_uart_init(void)
 {
         int ret;
 
-        if (ar933x_uart_console_enabled())
-                ar933x_uart_driver.cons = &ar933x_uart_console;
+#ifdef CONFIG_SERIAL_AR933X_CONSOLE
+        ar933x_uart_driver.cons = &ar933x_uart_console;
+#endif
 
         ret = uart_register_driver(&ar933x_uart_driver);
         if (ret)
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index 05147fe24343..0b4f36905321 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -166,6 +166,8 @@ struct atmel_uart_port {
         unsigned int            pending_status;
         spinlock_t              lock_suspended;
 
+        bool                    hd_start_rx;    /* can start RX during half-duplex operation */
+
         /* ISO7816 */
         unsigned int            fidi_min;
         unsigned int            fidi_max;
@@ -231,6 +233,13 @@ static inline void atmel_uart_write_char(struct uart_port *port, u8 value)
         __raw_writeb(value, port->membase + ATMEL_US_THR);
 }
 
+static inline int atmel_uart_is_half_duplex(struct uart_port *port)
+{
+        return ((port->rs485.flags & SER_RS485_ENABLED) &&
+                !(port->rs485.flags & SER_RS485_RX_DURING_TX)) ||
+                (port->iso7816.flags & SER_ISO7816_ENABLED);
+}
+
 #ifdef CONFIG_SERIAL_ATMEL_PDC
 static bool atmel_use_pdc_rx(struct uart_port *port)
 {
@@ -608,10 +617,9 @@ static void atmel_stop_tx(struct uart_port *port)
         /* Disable interrupts */
         atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask);
 
-        if (((port->rs485.flags & SER_RS485_ENABLED) &&
-             !(port->rs485.flags & SER_RS485_RX_DURING_TX)) ||
-            port->iso7816.flags & SER_ISO7816_ENABLED)
+        if (atmel_uart_is_half_duplex(port))
                 atmel_start_rx(port);
+
 }
 
 /*
@@ -628,9 +636,7 @@ static void atmel_start_tx(struct uart_port *port)
                 return;
 
         if (atmel_use_pdc_tx(port) || atmel_use_dma_tx(port))
-                if (((port->rs485.flags & SER_RS485_ENABLED) &&
-                     !(port->rs485.flags & SER_RS485_RX_DURING_TX)) ||
-                    port->iso7816.flags & SER_ISO7816_ENABLED)
+                if (atmel_uart_is_half_duplex(port))
                         atmel_stop_rx(port);
 
         if (atmel_use_pdc_tx(port))
@@ -928,11 +934,14 @@ static void atmel_complete_tx_dma(void *arg)
          */
         if (!uart_circ_empty(xmit))
                 atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx);
-        else if (((port->rs485.flags & SER_RS485_ENABLED) &&
-                  !(port->rs485.flags & SER_RS485_RX_DURING_TX)) ||
-                 port->iso7816.flags & SER_ISO7816_ENABLED) {
-                /* DMA done, stop TX, start RX for RS485 */
-                atmel_start_rx(port);
+        else if (atmel_uart_is_half_duplex(port)) {
+                /*
+                 * DMA done, re-enable TXEMPTY and signal that we can stop
+                 * TX and start RX for RS485
+                 */
+                atmel_port->hd_start_rx = true;
+                atmel_uart_writel(port, ATMEL_US_IER,
+                                  atmel_port->tx_done_mask);
         }
 
         spin_unlock_irqrestore(&port->lock, flags);
@@ -1288,6 +1297,10 @@ static int atmel_prepare_rx_dma(struct uart_port *port)
                                          sg_dma_len(&atmel_port->sg_rx)/2,
                                          DMA_DEV_TO_MEM,
                                          DMA_PREP_INTERRUPT);
+        if (!desc) {
+                dev_err(port->dev, "Preparing DMA cyclic failed\n");
+                goto chan_err;
+        }
         desc->callback = atmel_complete_rx_dma;
         desc->callback_param = port;
         atmel_port->desc_rx = desc;
@@ -1376,9 +1389,20 @@ atmel_handle_transmit(struct uart_port *port, unsigned int pending)
         struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
 
         if (pending & atmel_port->tx_done_mask) {
-                /* Either PDC or interrupt transmission */
                 atmel_uart_writel(port, ATMEL_US_IDR,
                                   atmel_port->tx_done_mask);
+
+                /* Start RX if flag was set and FIFO is empty */
+                if (atmel_port->hd_start_rx) {
+                        if (!(atmel_uart_readl(port, ATMEL_US_CSR)
+                                        & ATMEL_US_TXEMPTY))
+                                dev_warn(port->dev, "Should start RX, but TX fifo is not empty\n");
+
+                        atmel_port->hd_start_rx = false;
+                        atmel_start_rx(port);
+                        return;
+                }
+
                 atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx);
         }
 }
@@ -1508,9 +1532,7 @@ static void atmel_tx_pdc(struct uart_port *port)
                 atmel_uart_writel(port, ATMEL_US_IER,
                                   atmel_port->tx_done_mask);
         } else {
-                if (((port->rs485.flags & SER_RS485_ENABLED) &&
-                     !(port->rs485.flags & SER_RS485_RX_DURING_TX)) ||
-                    port->iso7816.flags & SER_ISO7816_ENABLED) {
+                if (atmel_uart_is_half_duplex(port)) {
                         /* DMA done, stop TX, start RX for RS485 */
                         atmel_start_rx(port);
                 }
diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
index 6fb312e7af71..bfe5e9e034ec 100644
--- a/drivers/tty/serial/kgdboc.c
+++ b/drivers/tty/serial/kgdboc.c
@@ -148,8 +148,10 @@ static int configure_kgdboc(void)
         char *cptr = config;
         struct console *cons;
 
-        if (!strlen(config) || isspace(config[0]))
+        if (!strlen(config) || isspace(config[0])) {
+                err = 0;
                 goto noconfig;
+        }
 
         kgdboc_io_ops.is_console = 0;
         kgdb_tty_driver = NULL;
diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
index f5bdde405627..450ba6d7996c 100644
--- a/drivers/tty/serial/max310x.c
+++ b/drivers/tty/serial/max310x.c
@@ -1415,6 +1415,8 @@ static int max310x_spi_probe(struct spi_device *spi)
         if (spi->dev.of_node) {
                 const struct of_device_id *of_id =
                         of_match_device(max310x_dt_ids, &spi->dev);
+                if (!of_id)
+                        return -ENODEV;
 
                 devtype = (struct max310x_devtype *)of_id->data;
         } else {
diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
index 231f751d1ef4..7e7b1559fa36 100644
--- a/drivers/tty/serial/mvebu-uart.c
+++ b/drivers/tty/serial/mvebu-uart.c
@@ -810,6 +810,9 @@ static int mvebu_uart_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
+        if (!match)
+                return -ENODEV;
+
         /* Assume that all UART ports have a DT alias or none has */
         id = of_alias_get_id(pdev->dev.of_node, "serial");
         if (!pdev->dev.of_node || id < 0)
diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
index 27235a526cce..4c188f4079b3 100644
--- a/drivers/tty/serial/mxs-auart.c
+++ b/drivers/tty/serial/mxs-auart.c
@@ -1686,6 +1686,10 @@ static int mxs_auart_probe(struct platform_device *pdev)
 
         s->port.mapbase = r->start;
         s->port.membase = ioremap(r->start, resource_size(r));
+        if (!s->port.membase) {
+                ret = -ENOMEM;
+                goto out_disable_clks;
+        }
         s->port.ops = &mxs_auart_ops;
         s->port.iotype = UPIO_MEM;
         s->port.fifosize = MXS_AUART_FIFO_SIZE;
diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
index 3bcec1c20219..35e5f9c5d5be 100644
--- a/drivers/tty/serial/qcom_geni_serial.c
+++ b/drivers/tty/serial/qcom_geni_serial.c
@@ -1050,7 +1050,7 @@ static int __init qcom_geni_console_setup(struct console *co, char *options)
 {
         struct uart_port *uport;
         struct qcom_geni_serial_port *port;
-        int baud;
+        int baud = 9600;
         int bits = 8;
         int parity = 'n';
         int flow = 'n';
diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index 635178cf3eed..09a183dfc526 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -1507,7 +1507,7 @@ static int __init sc16is7xx_init(void)
         ret = i2c_add_driver(&sc16is7xx_i2c_uart_driver);
         if (ret < 0) {
                 pr_err("failed to init sc16is7xx i2c --> %d\n", ret);
-                return ret;
+                goto err_i2c;
         }
 #endif
 
@@ -1515,10 +1515,18 @@ static int __init sc16is7xx_init(void)
         ret = spi_register_driver(&sc16is7xx_spi_uart_driver);
         if (ret < 0) {
                 pr_err("failed to init sc16is7xx spi --> %d\n", ret);
-                return ret;
+                goto err_spi;
         }
 #endif
         return ret;
+
+err_spi:
+#ifdef CONFIG_SERIAL_SC16IS7XX_I2C
+        i2c_del_driver(&sc16is7xx_i2c_uart_driver);
+#endif
+err_i2c:
+        uart_unregister_driver(&sc16is7xx_uart);
+        return ret;
 }
 module_init(sc16is7xx_init);
 
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 060fcd42b6d5..2d1c626312cd 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -838,19 +838,9 @@ static void sci_transmit_chars(struct uart_port *port)
 
         if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
                 uart_write_wakeup(port);
-        if (uart_circ_empty(xmit)) {
+        if (uart_circ_empty(xmit))
                 sci_stop_tx(port);
-        } else {
-                ctrl = serial_port_in(port, SCSCR);
-
-                if (port->type != PORT_SCI) {
-                        serial_port_in(port, SCxSR); /* Dummy read */
-                        sci_clear_SCxSR(port, SCxSR_TDxE_CLEAR(port));
-                }
 
-                ctrl |= SCSCR_TIE;
-                serial_port_out(port, SCSCR, ctrl);
-        }
 }
 
 /* On SH3, SCIF may read end-of-break as a space->mark char */
diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
index 044c3cbdcfa4..a9e12b3bc31d 100644
--- a/drivers/tty/tty_port.c
+++ b/drivers/tty/tty_port.c
@@ -325,7 +325,7 @@ static void tty_port_shutdown(struct tty_port *port, struct tty_struct *tty)
                 if (tty && C_HUPCL(tty))
                         tty_port_lower_dtr_rts(port);
 
-                if (port->ops->shutdown)
+                if (port->ops && port->ops->shutdown)
                         port->ops->shutdown(port);
         }
 out:
@@ -398,7 +398,7 @@ EXPORT_SYMBOL_GPL(tty_port_tty_wakeup);
  */
 int tty_port_carrier_raised(struct tty_port *port)
 {
-        if (port->ops->carrier_raised == NULL)
+        if (!port->ops || !port->ops->carrier_raised)
                 return 1;
         return port->ops->carrier_raised(port);
 }
@@ -414,7 +414,7 @@ EXPORT_SYMBOL(tty_port_carrier_raised);
  */
 void tty_port_raise_dtr_rts(struct tty_port *port)
 {
-        if (port->ops->dtr_rts)
+        if (port->ops && port->ops->dtr_rts)
                 port->ops->dtr_rts(port, 1);
 }
 EXPORT_SYMBOL(tty_port_raise_dtr_rts);
@@ -429,7 +429,7 @@ EXPORT_SYMBOL(tty_port_raise_dtr_rts);
  */
 void tty_port_lower_dtr_rts(struct tty_port *port)
 {
-        if (port->ops->dtr_rts)
+        if (port->ops && port->ops->dtr_rts)
                 port->ops->dtr_rts(port, 0);
 }
 EXPORT_SYMBOL(tty_port_lower_dtr_rts);
@@ -684,7 +684,7 @@ int tty_port_open(struct tty_port *port, struct tty_struct *tty,
 
         if (!tty_port_initialized(port)) {
                 clear_bit(TTY_IO_ERROR, &tty->flags);
-                if (port->ops->activate) {
+                if (port->ops && port->ops->activate) {
                         int retval = port->ops->activate(port, tty);
                         if (retval) {
                                 mutex_unlock(&port->mutex);
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 739f8960811a..ec666eb4b7b4 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -558,10 +558,8 @@ static void acm_softint(struct work_struct *work)
                 clear_bit(EVENT_RX_STALL, &acm->flags);
         }
 
-        if (test_bit(EVENT_TTY_WAKEUP, &acm->flags)) {
+        if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags))
                 tty_port_tty_wakeup(&acm->port);
-                clear_bit(EVENT_TTY_WAKEUP, &acm->flags);
-        }
 }
 
 /*
diff --git a/drivers/usb/common/common.c b/drivers/usb/common/common.c
index 48277bbc15e4..73c8e6591746 100644
--- a/drivers/usb/common/common.c
+++ b/drivers/usb/common/common.c
@@ -145,6 +145,8 @@ enum usb_dr_mode of_usb_get_dr_mode_by_phy(struct device_node *np, int arg0)
 
         do {
                 controller = of_find_node_with_property(controller, "phys");
+                if (!of_device_is_available(controller))
+                        continue;
                 index = 0;
                 do {
                         if (arg0 == -1) {
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 3189181bb628..975d7c1288e3 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2742,6 +2742,9 @@ int usb_add_hcd(struct usb_hcd *hcd,
                 retval = usb_phy_roothub_set_mode(hcd->phy_roothub,
                                                   PHY_MODE_USB_HOST_SS);
                 if (retval)
+                        retval = usb_phy_roothub_set_mode(hcd->phy_roothub,
+                                                          PHY_MODE_USB_HOST);
+                if (retval)
                         goto err_usb_phy_roothub_power_on;
 
                 retval = usb_phy_roothub_power_on(hcd->phy_roothub);
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index fdc6e4e403e8..8cced3609e24 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -29,6 +29,7 @@
 #define PCI_DEVICE_ID_INTEL_BXT_M               0x1aaa
 #define PCI_DEVICE_ID_INTEL_APL                 0x5aaa
 #define PCI_DEVICE_ID_INTEL_KBP                 0xa2b0
+#define PCI_DEVICE_ID_INTEL_CMLH                0x02ee
 #define PCI_DEVICE_ID_INTEL_GLK                 0x31aa
 #define PCI_DEVICE_ID_INTEL_CNPLP               0x9dee
 #define PCI_DEVICE_ID_INTEL_CNPH                0xa36e
@@ -305,6 +306,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
         { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MRFLD),
           (kernel_ulong_t) &dwc3_pci_mrfld_properties, },
 
+        { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CMLH),
+          (kernel_ulong_t) &dwc3_pci_intel_properties, },
+
         { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_SPTLP),
           (kernel_ulong_t) &dwc3_pci_intel_properties, },
 
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 75b113a5b25c..f3816a5c861e 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -391,20 +391,20 @@ try_again:
         req->complete = f_hidg_req_complete;
         req->context  = hidg;
 
+        spin_unlock_irqrestore(&hidg->write_spinlock, flags);
+
         status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC);
         if (status < 0) {
                 ERROR(hidg->func.config->cdev,
                         "usb_ep_queue error on int endpoint %zd\n", status);
-                goto release_write_pending_unlocked;
+                goto release_write_pending;
         } else {
                 status = count;
         }
-        spin_unlock_irqrestore(&hidg->write_spinlock, flags);
 
         return status;
 release_write_pending:
         spin_lock_irqsave(&hidg->write_spinlock, flags);
-release_write_pending_unlocked:
         hidg->write_pending = 0;
         spin_unlock_irqrestore(&hidg->write_spinlock, flags);
 
diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c
index b77f3126580e..c2011cd7df8c 100644
--- a/drivers/usb/gadget/udc/net2272.c
+++ b/drivers/usb/gadget/udc/net2272.c
@@ -945,6 +945,7 @@ net2272_dequeue(struct usb_ep *_ep, struct usb_request *_req)
                         break;
         }
         if (&req->req != _req) {
+                ep->stopped = stopped;
                 spin_unlock_irqrestore(&ep->dev->lock, flags);
                 return -EINVAL;
         }
diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
index f63f82450bf4..898339e5df10 100644
--- a/drivers/usb/gadget/udc/net2280.c
+++ b/drivers/usb/gadget/udc/net2280.c
@@ -866,9 +866,6 @@ static void start_queue(struct net2280_ep *ep, u32 dmactl, u32 td_dma)
         (void) readl(&ep->dev->pci->pcimstctl);
 
         writel(BIT(DMA_START), &dma->dmastat);
-
-        if (!ep->is_in)
-                stop_out_naking(ep);
 }
 
 static void start_dma(struct net2280_ep *ep, struct net2280_request *req)
@@ -907,6 +904,7 @@ static void start_dma(struct net2280_ep *ep, struct net2280_request *req)
                         writel(BIT(DMA_START), &dma->dmastat);
                         return;
                 }
+                stop_out_naking(ep);
         }
 
         tmp = dmactl_default;
@@ -1275,9 +1273,9 @@ static int net2280_dequeue(struct usb_ep *_ep, struct usb_request *_req)
                         break;
         }
         if (&req->req != _req) {
+                ep->stopped = stopped;
                 spin_unlock_irqrestore(&ep->dev->lock, flags);
-                dev_err(&ep->dev->pdev->dev, "%s: Request mismatch\n",
-                                                                __func__);
+                ep_dbg(ep->dev, "%s: Request mismatch\n", __func__);
                 return -EINVAL;
         }
 
diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c
index 934584f0a20a..6343fbacd244 100644
--- a/drivers/usb/host/u132-hcd.c
+++ b/drivers/usb/host/u132-hcd.c
@@ -3204,6 +3204,9 @@ static int __init u132_hcd_init(void)
         printk(KERN_INFO "driver %s\n", hcd_name);
         workqueue = create_singlethread_workqueue("u132");
         retval = platform_driver_register(&u132_platform_driver);
+        if (retval)
+                destroy_workqueue(workqueue);
+
         return retval;
 }
 
diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c
index c78be578abb0..d932cc31711e 100644
--- a/drivers/usb/host/xhci-dbgcap.c
+++ b/drivers/usb/host/xhci-dbgcap.c
@@ -516,7 +516,6 @@ static int xhci_do_dbc_stop(struct xhci_hcd *xhci)
                 return -1;
 
         writel(0, &dbc->regs->control);
-        xhci_dbc_mem_cleanup(xhci);
         dbc->state = DS_DISABLED;
 
         return 0;
@@ -562,8 +561,10 @@ static void xhci_dbc_stop(struct xhci_hcd *xhci)
         ret = xhci_do_dbc_stop(xhci);
         spin_unlock_irqrestore(&dbc->lock, flags);
 
-        if (!ret)
+        if (!ret) {
+                xhci_dbc_mem_cleanup(xhci);
                 pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller);
+        }
 }
 
 static void
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index e2eece693655..96a740543183 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1545,20 +1545,25 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
         port_index = max_ports;
         while (port_index--) {
                 u32 t1, t2;
-
+                int retries = 10;
+retry:
                 t1 = readl(ports[port_index]->addr);
                 t2 = xhci_port_state_to_neutral(t1);
                 portsc_buf[port_index] = 0;
 
-                /* Bail out if a USB3 port has a new device in link training */
-                if ((hcd->speed >= HCD_USB3) &&
+                /*
+                 * Give a USB3 port in link training time to finish, but don't
+                 * prevent suspend as port might be stuck
+                 */
+                if ((hcd->speed >= HCD_USB3) && retries-- &&
                     (t1 & PORT_PLS_MASK) == XDEV_POLLING) {
-                        bus_state->bus_suspended = 0;
                         spin_unlock_irqrestore(&xhci->lock, flags);
-                        xhci_dbg(xhci, "Bus suspend bailout, port in polling\n");
-                        return -EBUSY;
+                        msleep(XHCI_PORT_POLLING_LFPS_TIME);
+                        spin_lock_irqsave(&xhci->lock, flags);
+                        xhci_dbg(xhci, "port %d polling in bus suspend, waiting\n",
+                                 port_index);
+                        goto retry;
                 }
-
                 /* suspend ports in U0, or bail out for new connect changes */
                 if ((t1 & PORT_PE) && (t1 & PORT_PLS_MASK) == XDEV_U0) {
                         if ((t1 & PORT_CSC) && wake_enabled) {
diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
index a6e463715779..671bce18782c 100644
--- a/drivers/usb/host/xhci-rcar.c
+++ b/drivers/usb/host/xhci-rcar.c
@@ -246,6 +246,7 @@ int xhci_rcar_init_quirk(struct usb_hcd *hcd)
         if (!xhci_rcar_wait_for_pll_active(hcd))
                 return -ETIMEDOUT;
 
+        xhci->quirks |= XHCI_TRUST_TX_LENGTH;
         return xhci_rcar_download_firmware(hcd);
 }
 
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 40fa25c4d041..9215a28dad40 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1647,10 +1647,13 @@ static void handle_port_status(struct xhci_hcd *xhci,
                 }
         }
 
-        if ((portsc & PORT_PLC) && (portsc & PORT_PLS_MASK) == XDEV_U0 &&
-                        DEV_SUPERSPEED_ANY(portsc)) {
+        if ((portsc & PORT_PLC) &&
+            DEV_SUPERSPEED_ANY(portsc) &&
+            ((portsc & PORT_PLS_MASK) == XDEV_U0 ||
+             (portsc & PORT_PLS_MASK) == XDEV_U1 ||
+             (portsc & PORT_PLS_MASK) == XDEV_U2)) {
                 xhci_dbg(xhci, "resume SS port %d finished\n", port_id);
-                /* We've just brought the device into U0 through either the
+                /* We've just brought the device into U0/1/2 through either the
                  * Resume state after a device remote wakeup, or through the
                  * U3Exit state after a host-initiated resume.  If it's a device
                  * initiated remote wake, don't pass up the link state change,
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 652dc36e3012..9334cdee382a 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -452,6 +452,14 @@ struct xhci_op_regs {
  */
 #define XHCI_DEFAULT_BESL       4
 
+/*
+ * USB3 specification define a 360ms tPollingLFPSTiemout for USB3 ports
+ * to complete link training. usually link trainig completes much faster
+ * so check status 10 times with 36ms sleep in places we need to wait for
+ * polling to complete.
+ */
+#define XHCI_PORT_POLLING_LFPS_TIME  36
+
 /**
  * struct xhci_intr_reg - Interrupt Register Set
  * @irq_pending:        IMAN - Interrupt Management Register.  Used to enable
diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c
index 4d72b7d1d383..04684849d683 100644
--- a/drivers/usb/misc/usb251xb.c
+++ b/drivers/usb/misc/usb251xb.c
@@ -547,7 +547,7 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
          */
         hub->port_swap = USB251XB_DEF_PORT_SWAP;
         of_property_for_each_u32(np, "swap-dx-lanes", prop, p, port) {
-                if ((port >= 0) && (port <= data->port_cnt))
+                if (port <= data->port_cnt)
                         hub->port_swap |= BIT(port);
         }
 
@@ -612,7 +612,7 @@ static int usb251xb_probe(struct usb251xb *hub)
                                                            dev);
         int err;
 
-        if (np) {
+        if (np && of_id) {
                 err = usb251xb_get_ofdata(hub,
                                           (struct usb251xb_data *)of_id->data);
                 if (err) {
diff --git a/drivers/usb/mtu3/Kconfig b/drivers/usb/mtu3/Kconfig
index bcc23486c4ed..928c2cd6fc00 100644
--- a/drivers/usb/mtu3/Kconfig
+++ b/drivers/usb/mtu3/Kconfig
@@ -6,6 +6,7 @@ config USB_MTU3
         tristate "MediaTek USB3 Dual Role controller"
         depends on USB || USB_GADGET
         depends on ARCH_MEDIATEK || COMPILE_TEST
+        depends on EXTCON || !EXTCON
         select USB_XHCI_MTK if USB_SUPPORT && USB_XHCI_HCD
         help
           Say Y or M here if your system runs on MediaTek SoCs with
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index fffe23ab0189..979bef9bfb6b 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -80,6 +80,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0x804E) }, /* Software Bisque Paramount ME build-in converter */
         { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */
         { USB_DEVICE(0x10C4, 0x8054) }, /* Enfora GSM2228 */
+        { USB_DEVICE(0x10C4, 0x8056) }, /* Lorenz Messtechnik devices */
         { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */
         { USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */
         { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 8f5b17471759..1d8461ae2c34 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -609,6 +609,8 @@ static const struct usb_device_id id_table_combined[] = {
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+        { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index b863bedb55a1..5755f0df0025 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -567,7 +567,9 @@
 /*
  * NovaTech product ids (FTDI_VID)
  */
-#define FTDI_NT_ORIONLXM_PID    0x7c90  /* OrionLXm Substation Automation Platform */
+#define FTDI_NT_ORIONLXM_PID            0x7c90  /* OrionLXm Substation Automation Platform */
+#define FTDI_NT_ORIONLX_PLUS_PID        0x7c91  /* OrionLX+ Substation Automation Platform */
+#define FTDI_NT_ORION_IO_PID            0x7c92  /* Orion I/O */
 
 /*
  * Synapse Wireless product ids (FTDI_VID)
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index fc52ac75fbf6..18110225d506 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -366,8 +366,6 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
         if (!urbtrack)
                 return -ENOMEM;
 
-        kref_get(&mos_parport->ref_count);
-        urbtrack->mos_parport = mos_parport;
         urbtrack->urb = usb_alloc_urb(0, GFP_ATOMIC);
         if (!urbtrack->urb) {
                 kfree(urbtrack);
@@ -388,6 +386,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
                              usb_sndctrlpipe(usbdev, 0),
                              (unsigned char *)urbtrack->setup,
                              NULL, 0, async_complete, urbtrack);
+        kref_get(&mos_parport->ref_count);
+        urbtrack->mos_parport = mos_parport;
         kref_init(&urbtrack->ref_count);
         INIT_LIST_HEAD(&urbtrack->urblist_entry);
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 11b21d9410f3..83869065b802 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -246,6 +246,7 @@ static void option_instat_callback(struct urb *urb);
 #define QUECTEL_PRODUCT_EC25                    0x0125
 #define QUECTEL_PRODUCT_BG96                    0x0296
 #define QUECTEL_PRODUCT_EP06                    0x0306
+#define QUECTEL_PRODUCT_EM12                    0x0512
 
 #define CMOTECH_VENDOR_ID                       0x16d8
 #define CMOTECH_PRODUCT_6001                    0x6001
@@ -1066,7 +1067,8 @@ static const struct usb_device_id option_ids[] = {
           .driver_info = RSVD(3) },
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
-        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
+        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000), /* SIMCom SIM5218 */
+          .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) | NCTRL(3) | RSVD(4) },
         /* Quectel products using Qualcomm vendor ID */
         { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)},
         { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),
@@ -1087,6 +1089,9 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
           .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
         { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
+        { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff),
+          .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+        { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
@@ -1940,10 +1945,12 @@ static const struct usb_device_id option_ids[] = {
           .driver_info = RSVD(4) },
         { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff),                     /* D-Link DWM-222 */
           .driver_info = RSVD(4) },
-        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
-        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
-        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
-        { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                /* OLICARD300 - MT6225 */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) },    /* D-Link DWM-152/C1 */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) },    /* D-Link DWM-156/C1 */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) },    /* D-Link DWM-156/A3 */
+        { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff),                     /* Olicard 600 */
+          .driver_info = RSVD(4) },
+        { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                   /* OLICARD300 - MT6225 */
         { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
         { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
         { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index 0f62db091d8d..a2233d72ae7c 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -37,6 +37,7 @@
         S(SRC_ATTACHED),                        \
         S(SRC_STARTUP),                         \
         S(SRC_SEND_CAPABILITIES),               \
+        S(SRC_SEND_CAPABILITIES_TIMEOUT),       \
         S(SRC_NEGOTIATE_CAPABILITIES),          \
         S(SRC_TRANSITION_SUPPLY),               \
         S(SRC_READY),                           \
@@ -2966,10 +2967,34 @@ static void run_state_machine(struct tcpm_port *port)
                         /* port->hard_reset_count = 0; */
                         port->caps_count = 0;
                         port->pd_capable = true;
-                        tcpm_set_state_cond(port, hard_reset_state(port),
+                        tcpm_set_state_cond(port, SRC_SEND_CAPABILITIES_TIMEOUT,
                                             PD_T_SEND_SOURCE_CAP);
                 }
                 break;
+        case SRC_SEND_CAPABILITIES_TIMEOUT:
+                /*
+                 * Error recovery for a PD_DATA_SOURCE_CAP reply timeout.
+                 *
+                 * PD 2.0 sinks are supposed to accept src-capabilities with a
+                 * 3.0 header and simply ignore any src PDOs which the sink does
+                 * not understand such as PPS but some 2.0 sinks instead ignore
+                 * the entire PD_DATA_SOURCE_CAP message, causing contract
+                 * negotiation to fail.
+                 *
+                 * After PD_N_HARD_RESET_COUNT hard-reset attempts, we try
+                 * sending src-capabilities with a lower PD revision to
+                 * make these broken sinks work.
+                 */
+                if (port->hard_reset_count < PD_N_HARD_RESET_COUNT) {
+                        tcpm_set_state(port, HARD_RESET_SEND, 0);
+                } else if (port->negotiated_rev > PD_REV20) {
+                        port->negotiated_rev--;
+                        port->hard_reset_count = 0;
+                        tcpm_set_state(port, SRC_SEND_CAPABILITIES, 0);
+                } else {
+                        tcpm_set_state(port, hard_reset_state(port), 0);
+                }
+                break;
         case SRC_NEGOTIATE_CAPABILITIES:
                 ret = tcpm_pd_check_request(port);
                 if (ret < 0) {
diff --git a/drivers/usb/typec/tcpm/wcove.c b/drivers/usb/typec/tcpm/wcove.c
index 423208e19383..6770afd40765 100644
--- a/drivers/usb/typec/tcpm/wcove.c
+++ b/drivers/usb/typec/tcpm/wcove.c
@@ -615,8 +615,13 @@ static int wcove_typec_probe(struct platform_device *pdev)
         wcove->dev = &pdev->dev;
         wcove->regmap = pmic->regmap;
 
-        irq = regmap_irq_get_virq(pmic->irq_chip_data_chgr,
-                                  platform_get_irq(pdev, 0));
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(&pdev->dev, "Failed to get IRQ: %d\n", irq);
+                return irq;
+        }
+
+        irq = regmap_irq_get_virq(pmic->irq_chip_data_chgr, irq);
         if (irq < 0)
                 return irq;
 
diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
index df7d09409efe..8ca333f21292 100644
--- a/drivers/virt/vboxguest/vboxguest_core.c
+++ b/drivers/virt/vboxguest/vboxguest_core.c
@@ -27,6 +27,10 @@
 
 #define GUEST_MAPPINGS_TRIES    5
 
+#define VBG_KERNEL_REQUEST \
+        (VMMDEV_REQUESTOR_KERNEL | VMMDEV_REQUESTOR_USR_DRV | \
+         VMMDEV_REQUESTOR_CON_DONT_KNOW | VMMDEV_REQUESTOR_TRUST_NOT_GIVEN)
+
 /**
  * Reserves memory in which the VMM can relocate any guest mappings
  * that are floating around.
@@ -48,7 +52,8 @@ static void vbg_guest_mappings_init(struct vbg_dev *gdev)
         int i, rc;
 
         /* Query the required space. */
-        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HYPERVISOR_INFO);
+        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HYPERVISOR_INFO,
+                            VBG_KERNEL_REQUEST);
         if (!req)
                 return;
 
@@ -135,7 +140,8 @@ static void vbg_guest_mappings_exit(struct vbg_dev *gdev)
          * Tell the host that we're going to free the memory we reserved for
          * it, the free it up. (Leak the memory if anything goes wrong here.)
          */
-        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_HYPERVISOR_INFO);
+        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_HYPERVISOR_INFO,
+                            VBG_KERNEL_REQUEST);
         if (!req)
                 return;
 
@@ -172,8 +178,10 @@ static int vbg_report_guest_info(struct vbg_dev *gdev)
         struct vmmdev_guest_info2 *req2 = NULL;
         int rc, ret = -ENOMEM;
 
-        req1 = vbg_req_alloc(sizeof(*req1), VMMDEVREQ_REPORT_GUEST_INFO);
-        req2 = vbg_req_alloc(sizeof(*req2), VMMDEVREQ_REPORT_GUEST_INFO2);
+        req1 = vbg_req_alloc(sizeof(*req1), VMMDEVREQ_REPORT_GUEST_INFO,
+                             VBG_KERNEL_REQUEST);
+        req2 = vbg_req_alloc(sizeof(*req2), VMMDEVREQ_REPORT_GUEST_INFO2,
+                             VBG_KERNEL_REQUEST);
         if (!req1 || !req2)
                 goto out_free;
 
@@ -187,8 +195,8 @@ static int vbg_report_guest_info(struct vbg_dev *gdev)
         req2->additions_minor = VBG_VERSION_MINOR;
         req2->additions_build = VBG_VERSION_BUILD;
         req2->additions_revision = VBG_SVN_REV;
-        /* (no features defined yet) */
-        req2->additions_features = 0;
+        req2->additions_features =
+                VMMDEV_GUEST_INFO2_ADDITIONS_FEATURES_REQUESTOR_INFO;
         strlcpy(req2->name, VBG_VERSION_STRING,
                 sizeof(req2->name));
 
@@ -230,7 +238,8 @@ static int vbg_report_driver_status(struct vbg_dev *gdev, bool active)
         struct vmmdev_guest_status *req;
         int rc;
 
-        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_REPORT_GUEST_STATUS);
+        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_REPORT_GUEST_STATUS,
+                            VBG_KERNEL_REQUEST);
         if (!req)
                 return -ENOMEM;
 
@@ -423,7 +432,8 @@ static int vbg_heartbeat_host_config(struct vbg_dev *gdev, bool enabled)
         struct vmmdev_heartbeat *req;
         int rc;
 
-        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_HEARTBEAT_CONFIGURE);
+        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_HEARTBEAT_CONFIGURE,
+                            VBG_KERNEL_REQUEST);
         if (!req)
                 return -ENOMEM;
 
@@ -457,7 +467,8 @@ static int vbg_heartbeat_init(struct vbg_dev *gdev)
 
         gdev->guest_heartbeat_req = vbg_req_alloc(
                                         sizeof(*gdev->guest_heartbeat_req),
-                                        VMMDEVREQ_GUEST_HEARTBEAT);
+                                        VMMDEVREQ_GUEST_HEARTBEAT,
+                                        VBG_KERNEL_REQUEST);
         if (!gdev->guest_heartbeat_req)
                 return -ENOMEM;
 
@@ -528,7 +539,8 @@ static int vbg_reset_host_event_filter(struct vbg_dev *gdev,
         struct vmmdev_mask *req;
         int rc;
 
-        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK);
+        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK,
+                            VBG_KERNEL_REQUEST);
         if (!req)
                 return -ENOMEM;
 
@@ -567,8 +579,14 @@ static int vbg_set_session_event_filter(struct vbg_dev *gdev,
         u32 changed, previous;
         int rc, ret = 0;
 
-        /* Allocate a request buffer before taking the spinlock */
-        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK);
+        /*
+         * Allocate a request buffer before taking the spinlock, when
+         * the session is being terminated the requestor is the kernel,
+         * as we're cleaning up.
+         */
+        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK,
+                            session_termination ? VBG_KERNEL_REQUEST :
+                                                  session->requestor);
         if (!req) {
                 if (!session_termination)
                         return -ENOMEM;
@@ -627,7 +645,8 @@ static int vbg_reset_host_capabilities(struct vbg_dev *gdev)
         struct vmmdev_mask *req;
         int rc;
 
-        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES);
+        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES,
+                            VBG_KERNEL_REQUEST);
         if (!req)
                 return -ENOMEM;
 
@@ -662,8 +681,14 @@ static int vbg_set_session_capabilities(struct vbg_dev *gdev,
         u32 changed, previous;
         int rc, ret = 0;
 
-        /* Allocate a request buffer before taking the spinlock */
-        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES);
+        /*
+         * Allocate a request buffer before taking the spinlock, when
+         * the session is being terminated the requestor is the kernel,
+         * as we're cleaning up.
+         */
+        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES,
+                            session_termination ? VBG_KERNEL_REQUEST :
+                                                  session->requestor);
         if (!req) {
                 if (!session_termination)
                         return -ENOMEM;
@@ -722,7 +747,8 @@ static int vbg_query_host_version(struct vbg_dev *gdev)
         struct vmmdev_host_version *req;
         int rc, ret;
 
-        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HOST_VERSION);
+        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HOST_VERSION,
+                            VBG_KERNEL_REQUEST);
         if (!req)
                 return -ENOMEM;
 
@@ -783,19 +809,24 @@ int vbg_core_init(struct vbg_dev *gdev, u32 fixed_events)
 
         gdev->mem_balloon.get_req =
                 vbg_req_alloc(sizeof(*gdev->mem_balloon.get_req),
-                              VMMDEVREQ_GET_MEMBALLOON_CHANGE_REQ);
+                              VMMDEVREQ_GET_MEMBALLOON_CHANGE_REQ,
+                              VBG_KERNEL_REQUEST);
         gdev->mem_balloon.change_req =
                 vbg_req_alloc(sizeof(*gdev->mem_balloon.change_req),
-                              VMMDEVREQ_CHANGE_MEMBALLOON);
+                              VMMDEVREQ_CHANGE_MEMBALLOON,
+                              VBG_KERNEL_REQUEST);
         gdev->cancel_req =
                 vbg_req_alloc(sizeof(*(gdev->cancel_req)),
-                              VMMDEVREQ_HGCM_CANCEL2);
+                              VMMDEVREQ_HGCM_CANCEL2,
+                              VBG_KERNEL_REQUEST);
         gdev->ack_events_req =
                 vbg_req_alloc(sizeof(*gdev->ack_events_req),
-                              VMMDEVREQ_ACKNOWLEDGE_EVENTS);
+                              VMMDEVREQ_ACKNOWLEDGE_EVENTS,
+                              VBG_KERNEL_REQUEST);
         gdev->mouse_status_req =
                 vbg_req_alloc(sizeof(*gdev->mouse_status_req),
-                              VMMDEVREQ_GET_MOUSE_STATUS);
+                              VMMDEVREQ_GET_MOUSE_STATUS,
+                              VBG_KERNEL_REQUEST);
 
         if (!gdev->mem_balloon.get_req || !gdev->mem_balloon.change_req ||
             !gdev->cancel_req || !gdev->ack_events_req ||
@@ -892,9 +923,9 @@ void vbg_core_exit(struct vbg_dev *gdev)
  * vboxguest_linux.c calls this when userspace opens the char-device.
  * Return: A pointer to the new session or an ERR_PTR on error.
  * @gdev:               The Guest extension device.
- * @user:               Set if this is a session for the vboxuser device.
+ * @requestor:          VMMDEV_REQUESTOR_* flags
  */
-struct vbg_session *vbg_core_open_session(struct vbg_dev *gdev, bool user)
+struct vbg_session *vbg_core_open_session(struct vbg_dev *gdev, u32 requestor)
 {
         struct vbg_session *session;
 
@@ -903,7 +934,7 @@ struct vbg_session *vbg_core_open_session(struct vbg_dev *gdev, bool user)
                 return ERR_PTR(-ENOMEM);
 
         session->gdev = gdev;
-        session->user_session = user;
+        session->requestor = requestor;
 
         return session;
 }
@@ -924,7 +955,9 @@ void vbg_core_close_session(struct vbg_session *session)
                 if (!session->hgcm_client_ids[i])
                         continue;
 
-                vbg_hgcm_disconnect(gdev, session->hgcm_client_ids[i], &rc);
+                /* requestor is kernel here, as we're cleaning up. */
+                vbg_hgcm_disconnect(gdev, VBG_KERNEL_REQUEST,
+                                    session->hgcm_client_ids[i], &rc);
         }
 
         kfree(session);
@@ -1152,7 +1185,8 @@ static int vbg_req_allowed(struct vbg_dev *gdev, struct vbg_session *session,
                 return -EPERM;
         }
 
-        if (trusted_apps_only && session->user_session) {
+        if (trusted_apps_only &&
+            (session->requestor & VMMDEV_REQUESTOR_USER_DEVICE)) {
                 vbg_err("Denying userspace vmm call type %#08x through vboxuser device node\n",
                         req->request_type);
                 return -EPERM;
@@ -1209,8 +1243,8 @@ static int vbg_ioctl_hgcm_connect(struct vbg_dev *gdev,
         if (i >= ARRAY_SIZE(session->hgcm_client_ids))
                 return -EMFILE;
 
-        ret = vbg_hgcm_connect(gdev, &conn->u.in.loc, &client_id,
-                               &conn->hdr.rc);
+        ret = vbg_hgcm_connect(gdev, session->requestor, &conn->u.in.loc,
+                               &client_id, &conn->hdr.rc);
 
         mutex_lock(&gdev->session_mutex);
         if (ret == 0 && conn->hdr.rc >= 0) {
@@ -1251,7 +1285,8 @@ static int vbg_ioctl_hgcm_disconnect(struct vbg_dev *gdev,
         if (i >= ARRAY_SIZE(session->hgcm_client_ids))
                 return -EINVAL;
 
-        ret = vbg_hgcm_disconnect(gdev, client_id, &disconn->hdr.rc);
+        ret = vbg_hgcm_disconnect(gdev, session->requestor, client_id,
+                                  &disconn->hdr.rc);
 
         mutex_lock(&gdev->session_mutex);
         if (ret == 0 && disconn->hdr.rc >= 0)
@@ -1313,12 +1348,12 @@ static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev,
         }
 
         if (IS_ENABLED(CONFIG_COMPAT) && f32bit)
-                ret = vbg_hgcm_call32(gdev, client_id,
+                ret = vbg_hgcm_call32(gdev, session->requestor, client_id,
                                       call->function, call->timeout_ms,
                                       VBG_IOCTL_HGCM_CALL_PARMS32(call),
                                       call->parm_count, &call->hdr.rc);
         else
-                ret = vbg_hgcm_call(gdev, client_id,
+                ret = vbg_hgcm_call(gdev, session->requestor, client_id,
                                     call->function, call->timeout_ms,
                                     VBG_IOCTL_HGCM_CALL_PARMS(call),
                                     call->parm_count, &call->hdr.rc);
@@ -1408,6 +1443,7 @@ static int vbg_ioctl_check_balloon(struct vbg_dev *gdev,
 }
 
 static int vbg_ioctl_write_core_dump(struct vbg_dev *gdev,
+                                     struct vbg_session *session,
                                      struct vbg_ioctl_write_coredump *dump)
 {
         struct vmmdev_write_core_dump *req;
@@ -1415,7 +1451,8 @@ static int vbg_ioctl_write_core_dump(struct vbg_dev *gdev,
         if (vbg_ioctl_chk(&dump->hdr, sizeof(dump->u.in), 0))
                 return -EINVAL;
 
-        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_WRITE_COREDUMP);
+        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_WRITE_COREDUMP,
+                            session->requestor);
         if (!req)
                 return -ENOMEM;
 
@@ -1476,7 +1513,7 @@ int vbg_core_ioctl(struct vbg_session *session, unsigned int req, void *data)
         case VBG_IOCTL_CHECK_BALLOON:
                 return vbg_ioctl_check_balloon(gdev, data);
         case VBG_IOCTL_WRITE_CORE_DUMP:
-                return vbg_ioctl_write_core_dump(gdev, data);
+                return vbg_ioctl_write_core_dump(gdev, session, data);
         }
 
         /* Variable sized requests. */
@@ -1508,7 +1545,8 @@ int vbg_core_set_mouse_status(struct vbg_dev *gdev, u32 features)
         struct vmmdev_mouse_status *req;
         int rc;
 
-        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_MOUSE_STATUS);
+        req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_MOUSE_STATUS,
+                            VBG_KERNEL_REQUEST);
         if (!req)
                 return -ENOMEM;
 
diff --git a/drivers/virt/vboxguest/vboxguest_core.h b/drivers/virt/vboxguest/vboxguest_core.h
index 7ad9ec45bfa9..4188c12b839f 100644
--- a/drivers/virt/vboxguest/vboxguest_core.h
+++ b/drivers/virt/vboxguest/vboxguest_core.h
@@ -154,15 +154,15 @@ struct vbg_session {
          * host. Protected by vbg_gdev.session_mutex.
          */
         u32 guest_caps;
-        /** Does this session belong to a root process or a user one? */
-        bool user_session;
+        /** VMMDEV_REQUESTOR_* flags */
+        u32 requestor;
         /** Set on CANCEL_ALL_WAITEVENTS, protected by vbg_devevent_spinlock. */
         bool cancel_waiters;
 };
 
 int  vbg_core_init(struct vbg_dev *gdev, u32 fixed_events);
 void vbg_core_exit(struct vbg_dev *gdev);
-struct vbg_session *vbg_core_open_session(struct vbg_dev *gdev, bool user);
+struct vbg_session *vbg_core_open_session(struct vbg_dev *gdev, u32 requestor);
 void vbg_core_close_session(struct vbg_session *session);
 int  vbg_core_ioctl(struct vbg_session *session, unsigned int req, void *data);
 int  vbg_core_set_mouse_status(struct vbg_dev *gdev, u32 features);
@@ -172,12 +172,13 @@ irqreturn_t vbg_core_isr(int irq, void *dev_id);
 void vbg_linux_mouse_event(struct vbg_dev *gdev);
 
 /* Private (non exported) functions form vboxguest_utils.c */
-void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type);
+void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type,
+                    u32 requestor);
 void vbg_req_free(void *req, size_t len);
 int vbg_req_perform(struct vbg_dev *gdev, void *req);
 int vbg_hgcm_call32(
-        struct vbg_dev *gdev, u32 client_id, u32 function, u32 timeout_ms,
-        struct vmmdev_hgcm_function_parameter32 *parm32, u32 parm_count,
-        int *vbox_status);
+        struct vbg_dev *gdev, u32 requestor, u32 client_id, u32 function,
+        u32 timeout_ms, struct vmmdev_hgcm_function_parameter32 *parm32,
+        u32 parm_count, int *vbox_status);
 
 #endif
diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c
index 6e2a9619192d..6e8c0f1c1056 100644
--- a/drivers/virt/vboxguest/vboxguest_linux.c
+++ b/drivers/virt/vboxguest/vboxguest_linux.c
@@ -5,6 +5,7 @@
  * Copyright (C) 2006-2016 Oracle Corporation
  */
 
+#include <linux/cred.h>
 #include <linux/input.h>
 #include <linux/kernel.h>
 #include <linux/miscdevice.h>
@@ -28,6 +29,23 @@ static DEFINE_MUTEX(vbg_gdev_mutex);
 /** Global vbg_gdev pointer used by vbg_get/put_gdev. */
 static struct vbg_dev *vbg_gdev;
 
+static u32 vbg_misc_device_requestor(struct inode *inode)
+{
+        u32 requestor = VMMDEV_REQUESTOR_USERMODE |
+                        VMMDEV_REQUESTOR_CON_DONT_KNOW |
+                        VMMDEV_REQUESTOR_TRUST_NOT_GIVEN;
+
+        if (from_kuid(current_user_ns(), current->cred->uid) == 0)
+                requestor |= VMMDEV_REQUESTOR_USR_ROOT;
+        else
+                requestor |= VMMDEV_REQUESTOR_USR_USER;
+
+        if (in_egroup_p(inode->i_gid))
+                requestor |= VMMDEV_REQUESTOR_GRP_VBOX;
+
+        return requestor;
+}
+
 static int vbg_misc_device_open(struct inode *inode, struct file *filp)
 {
         struct vbg_session *session;
@@ -36,7 +54,7 @@ static int vbg_misc_device_open(struct inode *inode, struct file *filp)
         /* misc_open sets filp->private_data to our misc device */
         gdev = container_of(filp->private_data, struct vbg_dev, misc_device);
 
-        session = vbg_core_open_session(gdev, false);
+        session = vbg_core_open_session(gdev, vbg_misc_device_requestor(inode));
         if (IS_ERR(session))
                 return PTR_ERR(session);
 
@@ -53,7 +71,8 @@ static int vbg_misc_device_user_open(struct inode *inode, struct file *filp)
         gdev = container_of(filp->private_data, struct vbg_dev,
                             misc_device_user);
 
-        session = vbg_core_open_session(gdev, false);
+        session = vbg_core_open_session(gdev, vbg_misc_device_requestor(inode) |
+                                              VMMDEV_REQUESTOR_USER_DEVICE);
         if (IS_ERR(session))
                 return PTR_ERR(session);
 
@@ -115,7 +134,8 @@ static long vbg_misc_device_ioctl(struct file *filp, unsigned int req,
                          req == VBG_IOCTL_VMMDEV_REQUEST_BIG;
 
         if (is_vmmdev_req)
-                buf = vbg_req_alloc(size, VBG_IOCTL_HDR_TYPE_DEFAULT);
+                buf = vbg_req_alloc(size, VBG_IOCTL_HDR_TYPE_DEFAULT,
+                                    session->requestor);
         else
                 buf = kmalloc(size, GFP_KERNEL);
         if (!buf)
diff --git a/drivers/virt/vboxguest/vboxguest_utils.c b/drivers/virt/vboxguest/vboxguest_utils.c
index bf4474214b4d..75fd140b02ff 100644
--- a/drivers/virt/vboxguest/vboxguest_utils.c
+++ b/drivers/virt/vboxguest/vboxguest_utils.c
@@ -62,7 +62,8 @@ VBG_LOG(vbg_err, pr_err);
 VBG_LOG(vbg_debug, pr_debug);
 #endif
 
-void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type)
+void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type,
+                    u32 requestor)
 {
         struct vmmdev_request_header *req;
         int order = get_order(PAGE_ALIGN(len));
@@ -78,7 +79,7 @@ void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type)
         req->request_type = req_type;
         req->rc = VERR_GENERAL_FAILURE;
         req->reserved1 = 0;
-        req->reserved2 = 0;
+        req->requestor = requestor;
 
         return req;
 }
@@ -119,7 +120,7 @@ static bool hgcm_req_done(struct vbg_dev *gdev,
         return done;
 }
 
-int vbg_hgcm_connect(struct vbg_dev *gdev,
+int vbg_hgcm_connect(struct vbg_dev *gdev, u32 requestor,
                      struct vmmdev_hgcm_service_location *loc,
                      u32 *client_id, int *vbox_status)
 {
@@ -127,7 +128,7 @@ int vbg_hgcm_connect(struct vbg_dev *gdev,
         int rc;
 
         hgcm_connect = vbg_req_alloc(sizeof(*hgcm_connect),
-                                     VMMDEVREQ_HGCM_CONNECT);
+                                     VMMDEVREQ_HGCM_CONNECT, requestor);
         if (!hgcm_connect)
                 return -ENOMEM;
 
@@ -153,13 +154,15 @@ int vbg_hgcm_connect(struct vbg_dev *gdev,
 }
 EXPORT_SYMBOL(vbg_hgcm_connect);
 
-int vbg_hgcm_disconnect(struct vbg_dev *gdev, u32 client_id, int *vbox_status)
+int vbg_hgcm_disconnect(struct vbg_dev *gdev, u32 requestor,
+                        u32 client_id, int *vbox_status)
 {
         struct vmmdev_hgcm_disconnect *hgcm_disconnect = NULL;
         int rc;
 
         hgcm_disconnect = vbg_req_alloc(sizeof(*hgcm_disconnect),
-                                        VMMDEVREQ_HGCM_DISCONNECT);
+                                        VMMDEVREQ_HGCM_DISCONNECT,
+                                        requestor);
         if (!hgcm_disconnect)
                 return -ENOMEM;
 
@@ -593,9 +596,10 @@ static int hgcm_call_copy_back_result(
         return 0;
 }
 
-int vbg_hgcm_call(struct vbg_dev *gdev, u32 client_id, u32 function,
-                  u32 timeout_ms, struct vmmdev_hgcm_function_parameter *parms,
-                  u32 parm_count, int *vbox_status)
+int vbg_hgcm_call(struct vbg_dev *gdev, u32 requestor, u32 client_id,
+                  u32 function, u32 timeout_ms,
+                  struct vmmdev_hgcm_function_parameter *parms, u32 parm_count,
+                  int *vbox_status)
 {
         struct vmmdev_hgcm_call *call;
         void **bounce_bufs = NULL;
@@ -615,7 +619,7 @@ int vbg_hgcm_call(struct vbg_dev *gdev, u32 client_id, u32 function,
                 goto free_bounce_bufs;
         }
 
-        call = vbg_req_alloc(size, VMMDEVREQ_HGCM_CALL);
+        call = vbg_req_alloc(size, VMMDEVREQ_HGCM_CALL, requestor);
         if (!call) {
                 ret = -ENOMEM;
                 goto free_bounce_bufs;
@@ -647,9 +651,9 @@ EXPORT_SYMBOL(vbg_hgcm_call);
 
 #ifdef CONFIG_COMPAT
 int vbg_hgcm_call32(
-        struct vbg_dev *gdev, u32 client_id, u32 function, u32 timeout_ms,
-        struct vmmdev_hgcm_function_parameter32 *parm32, u32 parm_count,
-        int *vbox_status)
+        struct vbg_dev *gdev, u32 requestor, u32 client_id, u32 function,
+        u32 timeout_ms, struct vmmdev_hgcm_function_parameter32 *parm32,
+        u32 parm_count, int *vbox_status)
 {
         struct vmmdev_hgcm_function_parameter *parm64 = NULL;
         u32 i, size;
@@ -689,7 +693,7 @@ int vbg_hgcm_call32(
                         goto out_free;
         }
 
-        ret = vbg_hgcm_call(gdev, client_id, function, timeout_ms,
+        ret = vbg_hgcm_call(gdev, requestor, client_id, function, timeout_ms,
                             parm64, parm_count, vbox_status);
         if (ret < 0)
                 goto out_free;
diff --git a/drivers/virt/vboxguest/vboxguest_version.h b/drivers/virt/vboxguest/vboxguest_version.h
index 77f0c8f8a231..84834dad38d5 100644
--- a/drivers/virt/vboxguest/vboxguest_version.h
+++ b/drivers/virt/vboxguest/vboxguest_version.h
@@ -9,11 +9,10 @@
 #ifndef __VBOX_VERSION_H__
 #define __VBOX_VERSION_H__
 
-/* Last synced October 4th 2017 */
-#define VBG_VERSION_MAJOR 5
-#define VBG_VERSION_MINOR 2
+#define VBG_VERSION_MAJOR 6
+#define VBG_VERSION_MINOR 0
 #define VBG_VERSION_BUILD 0
-#define VBG_SVN_REV 68940
-#define VBG_VERSION_STRING "5.2.0"
+#define VBG_SVN_REV 127566
+#define VBG_VERSION_STRING "6.0.0"
 
 #endif
diff --git a/drivers/virt/vboxguest/vmmdev.h b/drivers/virt/vboxguest/vmmdev.h
index 5e2ae978935d..6337b8d75d96 100644
--- a/drivers/virt/vboxguest/vmmdev.h
+++ b/drivers/virt/vboxguest/vmmdev.h
@@ -98,8 +98,8 @@ struct vmmdev_request_header {
         s32 rc;
         /** Reserved field no.1. MBZ. */
         u32 reserved1;
-        /** Reserved field no.2. MBZ. */
-        u32 reserved2;
+        /** IN: Requestor information (VMMDEV_REQUESTOR_*) */
+        u32 requestor;
 };
 VMMDEV_ASSERT_SIZE(vmmdev_request_header, 24);
 
@@ -247,6 +247,8 @@ struct vmmdev_guest_info {
 };
 VMMDEV_ASSERT_SIZE(vmmdev_guest_info, 24 + 8);
 
+#define VMMDEV_GUEST_INFO2_ADDITIONS_FEATURES_REQUESTOR_INFO    BIT(0)
+
 /** struct vmmdev_guestinfo2 - Guest information report, version 2. */
 struct vmmdev_guest_info2 {
         /** Header. */
@@ -259,7 +261,7 @@ struct vmmdev_guest_info2 {
         u32 additions_build;
         /** SVN revision. */
         u32 additions_revision;
-        /** Feature mask, currently unused. */
+        /** Feature mask. */
         u32 additions_features;
         /**
          * The intentional meaning of this field was:
diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c
index ca08c83168f5..0b37867b5c20 100644
--- a/fs/afs/fsclient.c
+++ b/fs/afs/fsclient.c
@@ -1515,8 +1515,8 @@ static int afs_fs_setattr_size64(struct afs_fs_cursor *fc, struct iattr *attr)
 
         xdr_encode_AFS_StoreStatus(&bp, attr);
 
-        *bp++ = 0;                              /* position of start of write */
-        *bp++ = 0;
+        *bp++ = htonl(attr->ia_size >> 32);     /* position of start of write */
+        *bp++ = htonl((u32) attr->ia_size);
         *bp++ = 0;                              /* size of write */
         *bp++ = 0;
         *bp++ = htonl(attr->ia_size >> 32);     /* new file length */
@@ -1564,7 +1564,7 @@ static int afs_fs_setattr_size(struct afs_fs_cursor *fc, struct iattr *attr)
 
         xdr_encode_AFS_StoreStatus(&bp, attr);
 
-        *bp++ = 0;                              /* position of start of write */
+        *bp++ = htonl(attr->ia_size);           /* position of start of write */
         *bp++ = 0;                              /* size of write */
         *bp++ = htonl(attr->ia_size);           /* new file length */
 
diff --git a/fs/afs/yfsclient.c b/fs/afs/yfsclient.c
index 5aa57929e8c2..6e97a42d24d1 100644
--- a/fs/afs/yfsclient.c
+++ b/fs/afs/yfsclient.c
@@ -1514,7 +1514,7 @@ static int yfs_fs_setattr_size(struct afs_fs_cursor *fc, struct iattr *attr)
         bp = xdr_encode_u32(bp, 0); /* RPC flags */
         bp = xdr_encode_YFSFid(bp, &vnode->fid);
         bp = xdr_encode_YFS_StoreStatus(bp, attr);
-        bp = xdr_encode_u64(bp, 0);             /* position of start of write */
+        bp = xdr_encode_u64(bp, attr->ia_size); /* position of start of write */
         bp = xdr_encode_u64(bp, 0);             /* size of write */
         bp = xdr_encode_u64(bp, attr->ia_size); /* new file length */
         yfs_check_req(call, bp);
diff --git a/fs/aio.c b/fs/aio.c
index 38b741aef0bf..a4cc2a1cccb7 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -181,7 +181,7 @@ struct poll_iocb {
         struct file             *file;
         struct wait_queue_head  *head;
         __poll_t                events;
-        bool                    woken;
+        bool                    done;
         bool                    cancelled;
         struct wait_queue_entry wait;
         struct work_struct      work;
@@ -204,8 +204,7 @@ struct aio_kiocb {
         struct kioctx           *ki_ctx;
         kiocb_cancel_fn         *ki_cancel;
 
-        struct iocb __user      *ki_user_iocb;  /* user's aiocb */
-        __u64                   ki_user_data;   /* user's data for completion */
+        struct io_event         ki_res;
 
         struct list_head        ki_list;        /* the aio core uses this
                                                  * for cancellation */
@@ -1022,6 +1021,9 @@ static bool get_reqs_available(struct kioctx *ctx)
 /* aio_get_req
  *      Allocate a slot for an aio request.
  * Returns NULL if no requests are free.
+ *
+ * The refcount is initialized to 2 - one for the async op completion,
+ * one for the synchronous code that does this.
  */
 static inline struct aio_kiocb *aio_get_req(struct kioctx *ctx)
 {
@@ -1031,10 +1033,15 @@ static inline struct aio_kiocb *aio_get_req(struct kioctx *ctx)
         if (unlikely(!req))
                 return NULL;
 
+        if (unlikely(!get_reqs_available(ctx))) {
+                kfree(req);
+                return NULL;
+        }
+
         percpu_ref_get(&ctx->reqs);
         req->ki_ctx = ctx;
         INIT_LIST_HEAD(&req->ki_list);
-        refcount_set(&req->ki_refcnt, 0);
+        refcount_set(&req->ki_refcnt, 2);
         req->ki_eventfd = NULL;
         return req;
 }
@@ -1067,30 +1074,20 @@ out:
         return ret;
 }
 
-static inline void iocb_put(struct aio_kiocb *iocb)
-{
-        if (refcount_read(&iocb->ki_refcnt) == 0 ||
-            refcount_dec_and_test(&iocb->ki_refcnt)) {
-                if (iocb->ki_filp)
-                        fput(iocb->ki_filp);
-                percpu_ref_put(&iocb->ki_ctx->reqs);
-                kmem_cache_free(kiocb_cachep, iocb);
-        }
-}
-
-static void aio_fill_event(struct io_event *ev, struct aio_kiocb *iocb,
-                           long res, long res2)
+static inline void iocb_destroy(struct aio_kiocb *iocb)
 {
-        ev->obj = (u64)(unsigned long)iocb->ki_user_iocb;
-        ev->data = iocb->ki_user_data;
-        ev->res = res;
-        ev->res2 = res2;
+        if (iocb->ki_eventfd)
+                eventfd_ctx_put(iocb->ki_eventfd);
+        if (iocb->ki_filp)
+                fput(iocb->ki_filp);
+        percpu_ref_put(&iocb->ki_ctx->reqs);
+        kmem_cache_free(kiocb_cachep, iocb);
 }
 
 /* aio_complete
  *      Called when the io request on the given iocb is complete.
  */
-static void aio_complete(struct aio_kiocb *iocb, long res, long res2)
+static void aio_complete(struct aio_kiocb *iocb)
 {
         struct kioctx   *ctx = iocb->ki_ctx;
         struct aio_ring *ring;
@@ -1114,14 +1111,14 @@ static void aio_complete(struct aio_kiocb *iocb, long res, long res2)
         ev_page = kmap_atomic(ctx->ring_pages[pos / AIO_EVENTS_PER_PAGE]);
         event = ev_page + pos % AIO_EVENTS_PER_PAGE;
 
-        aio_fill_event(event, iocb, res, res2);
+        *event = iocb->ki_res;
 
         kunmap_atomic(ev_page);
         flush_dcache_page(ctx->ring_pages[pos / AIO_EVENTS_PER_PAGE]);
 
-        pr_debug("%p[%u]: %p: %p %Lx %lx %lx\n",
-                 ctx, tail, iocb, iocb->ki_user_iocb, iocb->ki_user_data,
-                 res, res2);
+        pr_debug("%p[%u]: %p: %p %Lx %Lx %Lx\n", ctx, tail, iocb,
+                 (void __user *)(unsigned long)iocb->ki_res.obj,
+                 iocb->ki_res.data, iocb->ki_res.res, iocb->ki_res.res2);
 
         /* after flagging the request as done, we
          * must never even look at it again
@@ -1148,10 +1145,8 @@ static void aio_complete(struct aio_kiocb *iocb, long res, long res2)
          * eventfd. The eventfd_signal() function is safe to be called
          * from IRQ context.
          */
-        if (iocb->ki_eventfd) {
+        if (iocb->ki_eventfd)
                 eventfd_signal(iocb->ki_eventfd, 1);
-                eventfd_ctx_put(iocb->ki_eventfd);
-        }
 
         /*
          * We have to order our ring_info tail store above and test
@@ -1163,7 +1158,14 @@ static void aio_complete(struct aio_kiocb *iocb, long res, long res2)
 
         if (waitqueue_active(&ctx->wait))
                 wake_up(&ctx->wait);
-        iocb_put(iocb);
+}
+
+static inline void iocb_put(struct aio_kiocb *iocb)
+{
+        if (refcount_dec_and_test(&iocb->ki_refcnt)) {
+                aio_complete(iocb);
+                iocb_destroy(iocb);
+        }
 }
 
 /* aio_read_events_ring
@@ -1437,7 +1439,9 @@ static void aio_complete_rw(struct kiocb *kiocb, long res, long res2)
                 file_end_write(kiocb->ki_filp);
         }
 
-        aio_complete(iocb, res, res2);
+        iocb->ki_res.res = res;
+        iocb->ki_res.res2 = res2;
+        iocb_put(iocb);
 }
 
 static int aio_prep_rw(struct kiocb *req, const struct iocb *iocb)
@@ -1514,13 +1518,13 @@ static inline void aio_rw_done(struct kiocb *req, ssize_t ret)
         }
 }
 
-static ssize_t aio_read(struct kiocb *req, const struct iocb *iocb,
+static int aio_read(struct kiocb *req, const struct iocb *iocb,
                         bool vectored, bool compat)
 {
         struct iovec inline_vecs[UIO_FASTIOV], *iovec = inline_vecs;
         struct iov_iter iter;
         struct file *file;
-        ssize_t ret;
+        int ret;
 
         ret = aio_prep_rw(req, iocb);
         if (ret)
@@ -1542,13 +1546,13 @@ static ssize_t aio_read(struct kiocb *req, const struct iocb *iocb,
         return ret;
 }
 
-static ssize_t aio_write(struct kiocb *req, const struct iocb *iocb,
+static int aio_write(struct kiocb *req, const struct iocb *iocb,
                          bool vectored, bool compat)
 {
         struct iovec inline_vecs[UIO_FASTIOV], *iovec = inline_vecs;
         struct iov_iter iter;
         struct file *file;
-        ssize_t ret;
+        int ret;
 
         ret = aio_prep_rw(req, iocb);
         if (ret)
@@ -1585,11 +1589,10 @@ static ssize_t aio_write(struct kiocb *req, const struct iocb *iocb,
 
 static void aio_fsync_work(struct work_struct *work)
 {
-        struct fsync_iocb *req = container_of(work, struct fsync_iocb, work);
-        int ret;
+        struct aio_kiocb *iocb = container_of(work, struct aio_kiocb, fsync.work);
 
-        ret = vfs_fsync(req->file, req->datasync);
-        aio_complete(container_of(req, struct aio_kiocb, fsync), ret, 0);
+        iocb->ki_res.res = vfs_fsync(iocb->fsync.file, iocb->fsync.datasync);
+        iocb_put(iocb);
 }
 
 static int aio_fsync(struct fsync_iocb *req, const struct iocb *iocb,
@@ -1608,11 +1611,6 @@ static int aio_fsync(struct fsync_iocb *req, const struct iocb *iocb,
         return 0;
 }
 
-static inline void aio_poll_complete(struct aio_kiocb *iocb, __poll_t mask)
-{
-        aio_complete(iocb, mangle_poll(mask), 0);
-}
-
 static void aio_poll_complete_work(struct work_struct *work)
 {
         struct poll_iocb *req = container_of(work, struct poll_iocb, work);
@@ -1638,9 +1636,11 @@ static void aio_poll_complete_work(struct work_struct *work)
                 return;
         }
         list_del_init(&iocb->ki_list);
+        iocb->ki_res.res = mangle_poll(mask);
+        req->done = true;
         spin_unlock_irq(&ctx->ctx_lock);
 
-        aio_poll_complete(iocb, mask);
+        iocb_put(iocb);
 }
 
 /* assumes we are called with irqs disabled */
@@ -1668,31 +1668,27 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
         __poll_t mask = key_to_poll(key);
         unsigned long flags;
 
-        req->woken = true;
-
         /* for instances that support it check for an event match first: */
-        if (mask) {
-                if (!(mask & req->events))
-                        return 0;
+        if (mask && !(mask & req->events))
+                return 0;
+
+        list_del_init(&req->wait.entry);
 
+        if (mask && spin_trylock_irqsave(&iocb->ki_ctx->ctx_lock, flags)) {
                 /*
                  * Try to complete the iocb inline if we can. Use
                  * irqsave/irqrestore because not all filesystems (e.g. fuse)
                  * call this function with IRQs disabled and because IRQs
                  * have to be disabled before ctx_lock is obtained.
                  */
-                if (spin_trylock_irqsave(&iocb->ki_ctx->ctx_lock, flags)) {
-                        list_del(&iocb->ki_list);
-                        spin_unlock_irqrestore(&iocb->ki_ctx->ctx_lock, flags);
-
-                        list_del_init(&req->wait.entry);
-                        aio_poll_complete(iocb, mask);
-                        return 1;
-                }
+                list_del(&iocb->ki_list);
+                iocb->ki_res.res = mangle_poll(mask);
+                req->done = true;
+                spin_unlock_irqrestore(&iocb->ki_ctx->ctx_lock, flags);
+                iocb_put(iocb);
+        } else {
+                schedule_work(&req->work);
         }
-
-        list_del_init(&req->wait.entry);
-        schedule_work(&req->work);
         return 1;
 }
 
@@ -1719,11 +1715,12 @@ aio_poll_queue_proc(struct file *file, struct wait_queue_head *head,
         add_wait_queue(head, &pt->iocb->poll.wait);
 }
 
-static ssize_t aio_poll(struct aio_kiocb *aiocb, const struct iocb *iocb)
+static int aio_poll(struct aio_kiocb *aiocb, const struct iocb *iocb)
 {
         struct kioctx *ctx = aiocb->ki_ctx;
         struct poll_iocb *req = &aiocb->poll;
         struct aio_poll_table apt;
+        bool cancel = false;
         __poll_t mask;
 
         /* reject any unknown events outside the normal event mask. */
@@ -1737,7 +1734,7 @@ static ssize_t aio_poll(struct aio_kiocb *aiocb, const struct iocb *iocb)
         req->events = demangle_poll(iocb->aio_buf) | EPOLLERR | EPOLLHUP;
 
         req->head = NULL;
-        req->woken = false;
+        req->done = false;
         req->cancelled = false;
 
         apt.pt._qproc = aio_poll_queue_proc;
@@ -1749,156 +1746,135 @@ static ssize_t aio_poll(struct aio_kiocb *aiocb, const struct iocb *iocb)
         INIT_LIST_HEAD(&req->wait.entry);
         init_waitqueue_func_entry(&req->wait, aio_poll_wake);
 
-        /* one for removal from waitqueue, one for this function */
-        refcount_set(&aiocb->ki_refcnt, 2);
-
         mask = vfs_poll(req->file, &apt.pt) & req->events;
-        if (unlikely(!req->head)) {
-                /* we did not manage to set up a waitqueue, done */
-                goto out;
-        }
-
         spin_lock_irq(&ctx->ctx_lock);
-        spin_lock(&req->head->lock);
-        if (req->woken) {
-                /* wake_up context handles the rest */
-                mask = 0;
+        if (likely(req->head)) {
+                spin_lock(&req->head->lock);
+                if (unlikely(list_empty(&req->wait.entry))) {
+                        if (apt.error)
+                                cancel = true;
+                        apt.error = 0;
+                        mask = 0;
+                }
+                if (mask || apt.error) {
+                        list_del_init(&req->wait.entry);
+                } else if (cancel) {
+                        WRITE_ONCE(req->cancelled, true);
+                } else if (!req->done) { /* actually waiting for an event */
+                        list_add_tail(&aiocb->ki_list, &ctx->active_reqs);
+                        aiocb->ki_cancel = aio_poll_cancel;
+                }
+                spin_unlock(&req->head->lock);
+        }
+        if (mask) { /* no async, we'd stolen it */
+                aiocb->ki_res.res = mangle_poll(mask);
                 apt.error = 0;
-        } else if (mask || apt.error) {
-                /* if we get an error or a mask we are done */
-                WARN_ON_ONCE(list_empty(&req->wait.entry));
-                list_del_init(&req->wait.entry);
-        } else {
-                /* actually waiting for an event */
-                list_add_tail(&aiocb->ki_list, &ctx->active_reqs);
-                aiocb->ki_cancel = aio_poll_cancel;
         }
-        spin_unlock(&req->head->lock);
         spin_unlock_irq(&ctx->ctx_lock);
-
-out:
-        if (unlikely(apt.error))
-                return apt.error;
-
         if (mask)
-                aio_poll_complete(aiocb, mask);
-        iocb_put(aiocb);
-        return 0;
+                iocb_put(aiocb);
+        return apt.error;
 }
 
 static int __io_submit_one(struct kioctx *ctx, const struct iocb *iocb,
-                           struct iocb __user *user_iocb, bool compat)
+                           struct iocb __user *user_iocb, struct aio_kiocb *req,
+                           bool compat)
 {
-        struct aio_kiocb *req;
-        ssize_t ret;
-
-        /* enforce forwards compatibility on users */
-        if (unlikely(iocb->aio_reserved2)) {
-                pr_debug("EINVAL: reserve field set\n");
-                return -EINVAL;
-        }
-
-        /* prevent overflows */
-        if (unlikely(
-            (iocb->aio_buf != (unsigned long)iocb->aio_buf) ||
-            (iocb->aio_nbytes != (size_t)iocb->aio_nbytes) ||
-            ((ssize_t)iocb->aio_nbytes < 0)
-           )) {
-                pr_debug("EINVAL: overflow check\n");
-                return -EINVAL;
-        }
-
-        if (!get_reqs_available(ctx))
-                return -EAGAIN;
-
-        ret = -EAGAIN;
-        req = aio_get_req(ctx);
-        if (unlikely(!req))
-                goto out_put_reqs_available;
-
         req->ki_filp = fget(iocb->aio_fildes);
-        ret = -EBADF;
         if (unlikely(!req->ki_filp))
-                goto out_put_req;
+                return -EBADF;
 
         if (iocb->aio_flags & IOCB_FLAG_RESFD) {
+                struct eventfd_ctx *eventfd;
                 /*
                  * If the IOCB_FLAG_RESFD flag of aio_flags is set, get an
                  * instance of the file* now. The file descriptor must be
                  * an eventfd() fd, and will be signaled for each completed
                  * event using the eventfd_signal() function.
                  */
-                req->ki_eventfd = eventfd_ctx_fdget((int) iocb->aio_resfd);
-                if (IS_ERR(req->ki_eventfd)) {
-                        ret = PTR_ERR(req->ki_eventfd);
-                        req->ki_eventfd = NULL;
-                        goto out_put_req;
-                }
+                eventfd = eventfd_ctx_fdget(iocb->aio_resfd);
+                if (IS_ERR(eventfd))
+                        return PTR_ERR(req->ki_eventfd);
+
+                req->ki_eventfd = eventfd;
         }
 
-        ret = put_user(KIOCB_KEY, &user_iocb->aio_key);
-        if (unlikely(ret)) {
+        if (unlikely(put_user(KIOCB_KEY, &user_iocb->aio_key))) {
                 pr_debug("EFAULT: aio_key\n");
-                goto out_put_req;
+                return -EFAULT;
         }
 
-        req->ki_user_iocb = user_iocb;
-        req->ki_user_data = iocb->aio_data;
+        req->ki_res.obj = (u64)(unsigned long)user_iocb;
+        req->ki_res.data = iocb->aio_data;
+        req->ki_res.res = 0;
+        req->ki_res.res2 = 0;
 
         switch (iocb->aio_lio_opcode) {
         case IOCB_CMD_PREAD:
-                ret = aio_read(&req->rw, iocb, false, compat);
-                break;
+                return aio_read(&req->rw, iocb, false, compat);
         case IOCB_CMD_PWRITE:
-                ret = aio_write(&req->rw, iocb, false, compat);
-                break;
+                return aio_write(&req->rw, iocb, false, compat);
         case IOCB_CMD_PREADV:
-                ret = aio_read(&req->rw, iocb, true, compat);
-                break;
+                return aio_read(&req->rw, iocb, true, compat);
         case IOCB_CMD_PWRITEV:
-                ret = aio_write(&req->rw, iocb, true, compat);
-                break;
+                return aio_write(&req->rw, iocb, true, compat);
         case IOCB_CMD_FSYNC:
-                ret = aio_fsync(&req->fsync, iocb, false);
-                break;
+                return aio_fsync(&req->fsync, iocb, false);
         case IOCB_CMD_FDSYNC:
-                ret = aio_fsync(&req->fsync, iocb, true);
-                break;
+                return aio_fsync(&req->fsync, iocb, true);
         case IOCB_CMD_POLL:
-                ret = aio_poll(req, iocb);
-                break;
+                return aio_poll(req, iocb);
         default:
                 pr_debug("invalid aio operation %d\n", iocb->aio_lio_opcode);
-                ret = -EINVAL;
-                break;
+                return -EINVAL;
         }
-
-        /*
-         * If ret is 0, we'd either done aio_complete() ourselves or have
-         * arranged for that to be done asynchronously.  Anything non-zero
-         * means that we need to destroy req ourselves.
-         */
-        if (ret)
-                goto out_put_req;
-        return 0;
-out_put_req:
-        if (req->ki_eventfd)
-                eventfd_ctx_put(req->ki_eventfd);
-        iocb_put(req);
-out_put_reqs_available:
-        put_reqs_available(ctx, 1);
-        return ret;
 }
 
 static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
                          bool compat)
 {
+        struct aio_kiocb *req;
         struct iocb iocb;
+        int err;
 
         if (unlikely(copy_from_user(&iocb, user_iocb, sizeof(iocb))))
                 return -EFAULT;
 
-        return __io_submit_one(ctx, &iocb, user_iocb, compat);
+        /* enforce forwards compatibility on users */
+        if (unlikely(iocb.aio_reserved2)) {
+                pr_debug("EINVAL: reserve field set\n");
+                return -EINVAL;
+        }
+
+        /* prevent overflows */
+        if (unlikely(
+            (iocb.aio_buf != (unsigned long)iocb.aio_buf) ||
+            (iocb.aio_nbytes != (size_t)iocb.aio_nbytes) ||
+            ((ssize_t)iocb.aio_nbytes < 0)
+           )) {
+                pr_debug("EINVAL: overflow check\n");
+                return -EINVAL;
+        }
+
+        req = aio_get_req(ctx);
+        if (unlikely(!req))
+                return -EAGAIN;
+
+        err = __io_submit_one(ctx, &iocb, user_iocb, req, compat);
+
+        /* Done with the synchronous reference */
+        iocb_put(req);
+
+        /*
+         * If err is 0, we'd either done aio_complete() ourselves or have
+         * arranged for that to be done asynchronously.  Anything non-zero
+         * means that we need to destroy req ourselves.
+         */
+        if (unlikely(err)) {
+                iocb_destroy(req);
+                put_reqs_available(ctx, 1);
+        }
+        return err;
 }
 
 /* sys_io_submit:
@@ -1997,24 +1973,6 @@ COMPAT_SYSCALL_DEFINE3(io_submit, compat_aio_context_t, ctx_id,
 }
 #endif
 
-/* lookup_kiocb
- *      Finds a given iocb for cancellation.
- */
-static struct aio_kiocb *
-lookup_kiocb(struct kioctx *ctx, struct iocb __user *iocb)
-{
-        struct aio_kiocb *kiocb;
-
-        assert_spin_locked(&ctx->ctx_lock);
-
-        /* TODO: use a hash or array, this sucks. */
-        list_for_each_entry(kiocb, &ctx->active_reqs, ki_list) {
-                if (kiocb->ki_user_iocb == iocb)
-                        return kiocb;
-        }
-        return NULL;
-}
-
 /* sys_io_cancel:
  *      Attempts to cancel an iocb previously passed to io_submit.  If
  *      the operation is successfully cancelled, the resulting event is
@@ -2032,6 +1990,7 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb,
         struct aio_kiocb *kiocb;
         int ret = -EINVAL;
         u32 key;
+        u64 obj = (u64)(unsigned long)iocb;
 
         if (unlikely(get_user(key, &iocb->aio_key)))
                 return -EFAULT;
@@ -2043,10 +2002,13 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb,
                 return -EINVAL;
 
         spin_lock_irq(&ctx->ctx_lock);
-        kiocb = lookup_kiocb(ctx, iocb);
-        if (kiocb) {
-                ret = kiocb->ki_cancel(&kiocb->rw);
-                list_del_init(&kiocb->ki_list);
+        /* TODO: use a hash or array, this sucks. */
+        list_for_each_entry(kiocb, &ctx->active_reqs, ki_list) {
+                if (kiocb->ki_res.obj == obj) {
+                        ret = kiocb->ki_cancel(&kiocb->rw);
+                        list_del_init(&kiocb->ki_list);
+                        break;
+                }
         }
         spin_unlock_irq(&ctx->ctx_lock);
 
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index e3346628efe2..2d61ddda9bf5 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -524,6 +524,7 @@ static void ceph_i_callback(struct rcu_head *head)
         struct inode *inode = container_of(head, struct inode, i_rcu);
         struct ceph_inode_info *ci = ceph_inode(inode);
 
+        kfree(ci->i_symlink);
         kmem_cache_free(ceph_inode_cachep, ci);
 }
 
@@ -566,7 +567,6 @@ void ceph_destroy_inode(struct inode *inode)
                 }
         }
 
-        kfree(ci->i_symlink);
         while ((n = rb_first(&ci->i_fragtree)) != NULL) {
                 frag = rb_entry(n, struct ceph_inode_frag, node);
                 rb_erase(n, &ci->i_fragtree);
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index f9b71c12cc9f..a05bf1d6e1d0 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -559,6 +559,8 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
                         tcon->ses->server->echo_interval / HZ);
         if (tcon->snapshot_time)
                 seq_printf(s, ",snapshot=%llu", tcon->snapshot_time);
+        if (tcon->handle_timeout)
+                seq_printf(s, ",handletimeout=%u", tcon->handle_timeout);
         /* convert actimeo and display it in seconds */
         seq_printf(s, ",actimeo=%lu", cifs_sb->actimeo / HZ);
 
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 38feae812b47..5b18d4585740 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -60,6 +60,12 @@
 #define CIFS_MAX_ACTIMEO (1 << 30)
 
 /*
+ * Max persistent and resilient handle timeout (milliseconds).
+ * Windows durable max was 960000 (16 minutes)
+ */
+#define SMB3_MAX_HANDLE_TIMEOUT 960000
+
+/*
  * MAX_REQ is the maximum number of requests that WE will send
  * on one socket concurrently.
  */
@@ -586,6 +592,7 @@ struct smb_vol {
         struct nls_table *local_nls;
         unsigned int echo_interval; /* echo interval in secs */
         __u64 snapshot_time; /* needed for timewarp tokens */
+        __u32 handle_timeout; /* persistent and durable handle timeout in ms */
         unsigned int max_credits; /* smb3 max_credits 10 < credits < 60000 */
 };
 
@@ -1058,6 +1065,7 @@ struct cifs_tcon {
         __u32 vol_serial_number;
         __le64 vol_create_time;
         __u64 snapshot_time; /* for timewarp tokens - timestamp of snapshot */
+        __u32 handle_timeout; /* persistent and durable handle timeout in ms */
         __u32 ss_flags;         /* sector size flags */
         __u32 perf_sector_size; /* best sector size for perf */
         __u32 max_chunks;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index a8e9738db691..4c0e44489f21 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -103,7 +103,7 @@ enum {
         Opt_cruid, Opt_gid, Opt_file_mode,
         Opt_dirmode, Opt_port,
         Opt_blocksize, Opt_rsize, Opt_wsize, Opt_actimeo,
-        Opt_echo_interval, Opt_max_credits,
+        Opt_echo_interval, Opt_max_credits, Opt_handletimeout,
         Opt_snapshot,
 
         /* Mount options which take string value */
@@ -208,6 +208,7 @@ static const match_table_t cifs_mount_option_tokens = {
         { Opt_rsize, "rsize=%s" },
         { Opt_wsize, "wsize=%s" },
         { Opt_actimeo, "actimeo=%s" },
+        { Opt_handletimeout, "handletimeout=%s" },
         { Opt_echo_interval, "echo_interval=%s" },
         { Opt_max_credits, "max_credits=%s" },
         { Opt_snapshot, "snapshot=%s" },
@@ -1619,6 +1620,9 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
 
         vol->actimeo = CIFS_DEF_ACTIMEO;
 
+        /* Most clients set timeout to 0, allows server to use its default */
+        vol->handle_timeout = 0; /* See MS-SMB2 spec section 2.2.14.2.12 */
+
         /* offer SMB2.1 and later (SMB3 etc). Secure and widely accepted */
         vol->ops = &smb30_operations;
         vol->vals = &smbdefault_values;
@@ -2017,6 +2021,18 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                                 goto cifs_parse_mount_err;
                         }
                         break;
+                case Opt_handletimeout:
+                        if (get_option_ul(args, &option)) {
+                                cifs_dbg(VFS, "%s: Invalid handletimeout value\n",
+                                         __func__);
+                                goto cifs_parse_mount_err;
+                        }
+                        vol->handle_timeout = option;
+                        if (vol->handle_timeout > SMB3_MAX_HANDLE_TIMEOUT) {
+                                cifs_dbg(VFS, "Invalid handle cache timeout, longer than 16 minutes\n");
+                                goto cifs_parse_mount_err;
+                        }
+                        break;
                 case Opt_echo_interval:
                         if (get_option_ul(args, &option)) {
                                 cifs_dbg(VFS, "%s: Invalid echo interval value\n",
@@ -3183,6 +3199,8 @@ static int match_tcon(struct cifs_tcon *tcon, struct smb_vol *volume_info)
                 return 0;
         if (tcon->snapshot_time != volume_info->snapshot_time)
                 return 0;
+        if (tcon->handle_timeout != volume_info->handle_timeout)
+                return 0;
         return 1;
 }
 
@@ -3297,6 +3315,16 @@ cifs_get_tcon(struct cifs_ses *ses, struct smb_vol *volume_info)
                         tcon->snapshot_time = volume_info->snapshot_time;
         }
 
+        if (volume_info->handle_timeout) {
+                if (ses->server->vals->protocol_id == 0) {
+                        cifs_dbg(VFS,
+                             "Use SMB2.1 or later for handle timeout option\n");
+                        rc = -EOPNOTSUPP;
+                        goto out_fail;
+                } else
+                        tcon->handle_timeout = volume_info->handle_timeout;
+        }
+
         tcon->ses = ses;
         if (volume_info->password) {
                 tcon->password = kstrdup(volume_info->password, GFP_KERNEL);
diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
index b204e84b87fb..54bffb2a1786 100644
--- a/fs/cifs/smb2file.c
+++ b/fs/cifs/smb2file.c
@@ -68,13 +68,15 @@ smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms,
 
 
          if (oparms->tcon->use_resilient) {
-                nr_ioctl_req.Timeout = 0; /* use server default (120 seconds) */
+                /* default timeout is 0, servers pick default (120 seconds) */
+                nr_ioctl_req.Timeout =
+                        cpu_to_le32(oparms->tcon->handle_timeout);
                 nr_ioctl_req.Reserved = 0;
                 rc = SMB2_ioctl(xid, oparms->tcon, fid->persistent_fid,
                         fid->volatile_fid, FSCTL_LMR_REQUEST_RESILIENCY,
                         true /* is_fsctl */,
                         (char *)&nr_ioctl_req, sizeof(nr_ioctl_req),
-                        NULL, NULL /* no return info */);
+                        CIFSMaxBufSize, NULL, NULL /* no return info */);
                 if (rc == -EOPNOTSUPP) {
                         cifs_dbg(VFS,
                              "resiliency not supported by server, disabling\n");
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 1022a3771e14..00225e699d03 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -581,7 +581,7 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon)
         rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
                         FSCTL_QUERY_NETWORK_INTERFACE_INFO, true /* is_fsctl */,
                         NULL /* no data input */, 0 /* no data input */,
-                        (char **)&out_buf, &ret_data_len);
+                        CIFSMaxBufSize, (char **)&out_buf, &ret_data_len);
         if (rc == -EOPNOTSUPP) {
                 cifs_dbg(FYI,
                          "server does not support query network interfaces\n");
@@ -717,32 +717,28 @@ int open_shroot(unsigned int xid, struct cifs_tcon *tcon, struct cifs_fid *pfid)
         oparms.fid->mid = le64_to_cpu(o_rsp->sync_hdr.MessageId);
 #endif /* CIFS_DEBUG2 */
 
-        if (o_rsp->OplockLevel == SMB2_OPLOCK_LEVEL_LEASE)
-                oplock = smb2_parse_lease_state(server, o_rsp,
-                                                &oparms.fid->epoch,
-                                                oparms.fid->lease_key);
-        else
-                goto oshr_exit;
-
-
         memcpy(tcon->crfid.fid, pfid, sizeof(struct cifs_fid));
         tcon->crfid.tcon = tcon;
         tcon->crfid.is_valid = true;
         kref_init(&tcon->crfid.refcount);
-        kref_get(&tcon->crfid.refcount);
 
+        if (o_rsp->OplockLevel == SMB2_OPLOCK_LEVEL_LEASE) {
+                kref_get(&tcon->crfid.refcount);
+                oplock = smb2_parse_lease_state(server, o_rsp,
+                                                &oparms.fid->epoch,
+                                                oparms.fid->lease_key);
+        } else
+                goto oshr_exit;
 
         qi_rsp = (struct smb2_query_info_rsp *)rsp_iov[1].iov_base;
         if (le32_to_cpu(qi_rsp->OutputBufferLength) < sizeof(struct smb2_file_all_info))
                 goto oshr_exit;
-        rc = smb2_validate_and_copy_iov(
+        if (!smb2_validate_and_copy_iov(
                                 le16_to_cpu(qi_rsp->OutputBufferOffset),
                                 sizeof(struct smb2_file_all_info),
                                 &rsp_iov[1], sizeof(struct smb2_file_all_info),
-                                (char *)&tcon->crfid.file_all_info);
-        if (rc)
-                goto oshr_exit;
-        tcon->crfid.file_all_info_is_valid = 1;
+                                (char *)&tcon->crfid.file_all_info))
+                tcon->crfid.file_all_info_is_valid = 1;
 
  oshr_exit:
         mutex_unlock(&tcon->crfid.fid_mutex);
@@ -1299,7 +1295,7 @@ SMB2_request_res_key(const unsigned int xid, struct cifs_tcon *tcon,
 
         rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid,
                         FSCTL_SRV_REQUEST_RESUME_KEY, true /* is_fsctl */,
-                        NULL, 0 /* no input */,
+                        NULL, 0 /* no input */, CIFSMaxBufSize,
                         (char **)&res_key, &ret_data_len);
 
         if (rc) {
@@ -1404,7 +1400,7 @@ smb2_ioctl_query_info(const unsigned int xid,
                         rc = SMB2_ioctl_init(tcon, &rqst[1],
                                              COMPOUND_FID, COMPOUND_FID,
                                              qi.info_type, true, NULL,
-                                             0);
+                                             0, CIFSMaxBufSize);
                 }
         } else if (qi.flags == PASSTHRU_QUERY_INFO) {
                 memset(&qi_iov, 0, sizeof(qi_iov));
@@ -1532,8 +1528,8 @@ smb2_copychunk_range(const unsigned int xid,
                 rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid,
                         trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE,
                         true /* is_fsctl */, (char *)pcchunk,
-                        sizeof(struct copychunk_ioctl), (char **)&retbuf,
-                        &ret_data_len);
+                        sizeof(struct copychunk_ioctl), CIFSMaxBufSize,
+                        (char **)&retbuf, &ret_data_len);
                 if (rc == 0) {
                         if (ret_data_len !=
                                         sizeof(struct copychunk_ioctl_rsp)) {
@@ -1693,7 +1689,7 @@ static bool smb2_set_sparse(const unsigned int xid, struct cifs_tcon *tcon,
         rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
                         cfile->fid.volatile_fid, FSCTL_SET_SPARSE,
                         true /* is_fctl */,
-                        &setsparse, 1, NULL, NULL);
+                        &setsparse, 1, CIFSMaxBufSize, NULL, NULL);
         if (rc) {
                 tcon->broken_sparse_sup = true;
                 cifs_dbg(FYI, "set sparse rc = %d\n", rc);
@@ -1766,7 +1762,7 @@ smb2_duplicate_extents(const unsigned int xid,
                         true /* is_fsctl */,
                         (char *)&dup_ext_buf,
                         sizeof(struct duplicate_extents_to_file),
-                        NULL,
+                        CIFSMaxBufSize, NULL,
                         &ret_data_len);
 
         if (ret_data_len > 0)
@@ -1801,7 +1797,7 @@ smb3_set_integrity(const unsigned int xid, struct cifs_tcon *tcon,
                         true /* is_fsctl */,
                         (char *)&integr_info,
                         sizeof(struct fsctl_set_integrity_information_req),
-                        NULL,
+                        CIFSMaxBufSize, NULL,
                         &ret_data_len);
 
 }
@@ -1809,6 +1805,8 @@ smb3_set_integrity(const unsigned int xid, struct cifs_tcon *tcon,
 /* GMT Token is @GMT-YYYY.MM.DD-HH.MM.SS Unicode which is 48 bytes + null */
 #define GMT_TOKEN_SIZE 50
 
+#define MIN_SNAPSHOT_ARRAY_SIZE 16 /* See MS-SMB2 section 3.3.5.15.1 */
+
 /*
  * Input buffer contains (empty) struct smb_snapshot array with size filled in
  * For output see struct SRV_SNAPSHOT_ARRAY in MS-SMB2 section 2.2.32.2
@@ -1820,13 +1818,29 @@ smb3_enum_snapshots(const unsigned int xid, struct cifs_tcon *tcon,
         char *retbuf = NULL;
         unsigned int ret_data_len = 0;
         int rc;
+        u32 max_response_size;
         struct smb_snapshot_array snapshot_in;
 
+        if (get_user(ret_data_len, (unsigned int __user *)ioc_buf))
+                return -EFAULT;
+
+        /*
+         * Note that for snapshot queries that servers like Azure expect that
+         * the first query be minimal size (and just used to get the number/size
+         * of previous versions) so response size must be specified as EXACTLY
+         * sizeof(struct snapshot_array) which is 16 when rounded up to multiple
+         * of eight bytes.
+         */
+        if (ret_data_len == 0)
+                max_response_size = MIN_SNAPSHOT_ARRAY_SIZE;
+        else
+                max_response_size = CIFSMaxBufSize;
+
         rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
                         cfile->fid.volatile_fid,
                         FSCTL_SRV_ENUMERATE_SNAPSHOTS,
                         true /* is_fsctl */,
-                        NULL, 0 /* no input data */,
+                        NULL, 0 /* no input data */, max_response_size,
                         (char **)&retbuf,
                         &ret_data_len);
         cifs_dbg(FYI, "enum snaphots ioctl returned %d and ret buflen is %d\n",
@@ -2304,7 +2318,7 @@ smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses,
                 rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
                                 FSCTL_DFS_GET_REFERRALS,
                                 true /* is_fsctl */,
-                                (char *)dfs_req, dfs_req_size,
+                                (char *)dfs_req, dfs_req_size, CIFSMaxBufSize,
                                 (char **)&dfs_rsp, &dfs_rsp_size);
         } while (rc == -EAGAIN);
 
@@ -2658,7 +2672,8 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon,
         rc = SMB2_ioctl_init(tcon, &rqst[num++], cfile->fid.persistent_fid,
                              cfile->fid.volatile_fid, FSCTL_SET_ZERO_DATA,
                              true /* is_fctl */, (char *)&fsctl_buf,
-                             sizeof(struct file_zero_data_information));
+                             sizeof(struct file_zero_data_information),
+                             CIFSMaxBufSize);
         if (rc)
                 goto zero_range_exit;
 
@@ -2735,7 +2750,8 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon,
         rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
                         cfile->fid.volatile_fid, FSCTL_SET_ZERO_DATA,
                         true /* is_fctl */, (char *)&fsctl_buf,
-                        sizeof(struct file_zero_data_information), NULL, NULL);
+                        sizeof(struct file_zero_data_information),
+                        CIFSMaxBufSize, NULL, NULL);
         free_xid(xid);
         return rc;
 }
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 21ac19ff19cb..21ad01d55ab2 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1002,7 +1002,8 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
 
         rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
                 FSCTL_VALIDATE_NEGOTIATE_INFO, true /* is_fsctl */,
-                (char *)pneg_inbuf, inbuflen, (char **)&pneg_rsp, &rsplen);
+                (char *)pneg_inbuf, inbuflen, CIFSMaxBufSize,
+                (char **)&pneg_rsp, &rsplen);
         if (rc == -EOPNOTSUPP) {
                 /*
                  * Old Windows versions or Netapp SMB server can return
@@ -1858,8 +1859,9 @@ add_lease_context(struct TCP_Server_Info *server, struct kvec *iov,
 }
 
 static struct create_durable_v2 *
-create_durable_v2_buf(struct cifs_fid *pfid)
+create_durable_v2_buf(struct cifs_open_parms *oparms)
 {
+        struct cifs_fid *pfid = oparms->fid;
         struct create_durable_v2 *buf;
 
         buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL);
@@ -1873,7 +1875,14 @@ create_durable_v2_buf(struct cifs_fid *pfid)
                                 (struct create_durable_v2, Name));
         buf->ccontext.NameLength = cpu_to_le16(4);
 
-        buf->dcontext.Timeout = 0; /* Should this be configurable by workload */
+        /*
+         * NB: Handle timeout defaults to 0, which allows server to choose
+         * (most servers default to 120 seconds) and most clients default to 0.
+         * This can be overridden at mount ("handletimeout=") if the user wants
+         * a different persistent (or resilient) handle timeout for all opens
+         * opens on a particular SMB3 mount.
+         */
+        buf->dcontext.Timeout = cpu_to_le32(oparms->tcon->handle_timeout);
         buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
         generate_random_uuid(buf->dcontext.CreateGuid);
         memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16);
@@ -1926,7 +1935,7 @@ add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec,
         struct smb2_create_req *req = iov[0].iov_base;
         unsigned int num = *num_iovec;
 
-        iov[num].iov_base = create_durable_v2_buf(oparms->fid);
+        iov[num].iov_base = create_durable_v2_buf(oparms);
         if (iov[num].iov_base == NULL)
                 return -ENOMEM;
         iov[num].iov_len = sizeof(struct create_durable_v2);
@@ -2478,7 +2487,8 @@ creat_exit:
 int
 SMB2_ioctl_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
                 u64 persistent_fid, u64 volatile_fid, u32 opcode,
-                bool is_fsctl, char *in_data, u32 indatalen)
+                bool is_fsctl, char *in_data, u32 indatalen,
+                __u32 max_response_size)
 {
         struct smb2_ioctl_req *req;
         struct kvec *iov = rqst->rq_iov;
@@ -2520,16 +2530,21 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
         req->OutputCount = 0; /* MBZ */
 
         /*
-         * Could increase MaxOutputResponse, but that would require more
-         * than one credit. Windows typically sets this smaller, but for some
+         * In most cases max_response_size is set to 16K (CIFSMaxBufSize)
+         * We Could increase default MaxOutputResponse, but that could require
+         * more credits. Windows typically sets this smaller, but for some
          * ioctls it may be useful to allow server to send more. No point
          * limiting what the server can send as long as fits in one credit
-         * Unfortunately - we can not handle more than CIFS_MAX_MSG_SIZE
-         * (by default, note that it can be overridden to make max larger)
-         * in responses (except for read responses which can be bigger.
-         * We may want to bump this limit up
+         * We can not handle more than CIFS_MAX_BUF_SIZE yet but may want
+         * to increase this limit up in the future.
+         * Note that for snapshot queries that servers like Azure expect that
+         * the first query be minimal size (and just used to get the number/size
+         * of previous versions) so response size must be specified as EXACTLY
+         * sizeof(struct snapshot_array) which is 16 when rounded up to multiple
+         * of eight bytes.  Currently that is the only case where we set max
+         * response size smaller.
          */
-        req->MaxOutputResponse = cpu_to_le32(CIFSMaxBufSize);
+        req->MaxOutputResponse = cpu_to_le32(max_response_size);
 
         if (is_fsctl)
                 req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL);
@@ -2550,13 +2565,14 @@ SMB2_ioctl_free(struct smb_rqst *rqst)
                 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
 }
 
+
 /*
  *      SMB2 IOCTL is used for both IOCTLs and FSCTLs
  */
 int
 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
            u64 volatile_fid, u32 opcode, bool is_fsctl,
-           char *in_data, u32 indatalen,
+           char *in_data, u32 indatalen, u32 max_out_data_len,
            char **out_data, u32 *plen /* returned data len */)
 {
         struct smb_rqst rqst;
@@ -2593,8 +2609,8 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
         rqst.rq_iov = iov;
         rqst.rq_nvec = SMB2_IOCTL_IOV_SIZE;
 
-        rc = SMB2_ioctl_init(tcon, &rqst, persistent_fid, volatile_fid,
-                             opcode, is_fsctl, in_data, indatalen);
+        rc = SMB2_ioctl_init(tcon, &rqst, persistent_fid, volatile_fid, opcode,
+                             is_fsctl, in_data, indatalen, max_out_data_len);
         if (rc)
                 goto ioctl_exit;
 
@@ -2672,7 +2688,8 @@ SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon,
         rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid,
                         FSCTL_SET_COMPRESSION, true /* is_fsctl */,
                         (char *)&fsctl_input /* data input */,
-                        2 /* in data len */, &ret_data /* out data */, NULL);
+                        2 /* in data len */, CIFSMaxBufSize /* max out data */,
+                        &ret_data /* out data */, NULL);
 
         cifs_dbg(FYI, "set compression rc %d\n", rc);
 
diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
index 3c32d0cfea69..52df125e9189 100644
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -142,11 +142,12 @@ extern int SMB2_open_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
 extern void SMB2_open_free(struct smb_rqst *rqst);
 extern int SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon,
                      u64 persistent_fid, u64 volatile_fid, u32 opcode,
-                     bool is_fsctl, char *in_data, u32 indatalen,
+                     bool is_fsctl, char *in_data, u32 indatalen, u32 maxoutlen,
                      char **out_data, u32 *plen /* returned data len */);
 extern int SMB2_ioctl_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
                            u64 persistent_fid, u64 volatile_fid, u32 opcode,
-                           bool is_fsctl, char *in_data, u32 indatalen);
+                           bool is_fsctl, char *in_data, u32 indatalen,
+                           __u32 max_response_size);
 extern void SMB2_ioctl_free(struct smb_rqst *rqst);
 extern int SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
                       u64 persistent_file_id, u64 volatile_file_id);
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index 95b5e78c22b1..f25daa207421 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -163,19 +163,24 @@ static int debugfs_show_options(struct seq_file *m, struct dentry *root)
         return 0;
 }
 
-static void debugfs_evict_inode(struct inode *inode)
+static void debugfs_i_callback(struct rcu_head *head)
 {
-        truncate_inode_pages_final(&inode->i_data);
-        clear_inode(inode);
+        struct inode *inode = container_of(head, struct inode, i_rcu);
         if (S_ISLNK(inode->i_mode))
                 kfree(inode->i_link);
+        free_inode_nonrcu(inode);
+}
+
+static void debugfs_destroy_inode(struct inode *inode)
+{
+        call_rcu(&inode->i_rcu, debugfs_i_callback);
 }
 
 static const struct super_operations debugfs_super_operations = {
         .statfs         = simple_statfs,
         .remount_fs     = debugfs_remount,
         .show_options   = debugfs_show_options,
-        .evict_inode    = debugfs_evict_inode,
+        .destroy_inode  = debugfs_destroy_inode,
 };
 
 static void debugfs_release_dentry(struct dentry *dentry)
diff --git a/fs/fs_parser.c b/fs/fs_parser.c
index 842e8f749db6..570d71043acf 100644
--- a/fs/fs_parser.c
+++ b/fs/fs_parser.c
@@ -410,7 +410,7 @@ bool fs_validate_description(const struct fs_parameter_description *desc)
                         for (param = desc->specs; param->name; param++) {
                                 if (param->opt == e->opt &&
                                     param->type != fs_param_is_enum) {
-                                        pr_err("VALIDATE %s: e[%lu] enum val for %s\n",
+                                        pr_err("VALIDATE %s: e[%tu] enum val for %s\n",
                                                name, e - desc->enums, param->name);
                                         good = false;
                                 }
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 6aaa30580a2b..bbdbd56cf2ac 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1022,6 +1022,8 @@ static int io_write(struct io_kiocb *req, const struct sqe_submit *s,
 
         ret = rw_verify_area(WRITE, file, &kiocb->ki_pos, iov_count);
         if (!ret) {
+                ssize_t ret2;
+
                 /*
                  * Open-code file_start_write here to grab freeze protection,
                  * which will be released by another thread in
@@ -1036,7 +1038,19 @@ static int io_write(struct io_kiocb *req, const struct sqe_submit *s,
                                                 SB_FREEZE_WRITE);
                 }
                 kiocb->ki_flags |= IOCB_WRITE;
-                io_rw_done(kiocb, call_write_iter(file, kiocb, &iter));
+
+                ret2 = call_write_iter(file, kiocb, &iter);
+                if (!force_nonblock || ret2 != -EAGAIN) {
+                        io_rw_done(kiocb, ret2);
+                } else {
+                        /*
+                         * If ->needs_lock is true, we're already in async
+                         * context.
+                         */
+                        if (!s->needs_lock)
+                                io_async_list_note(WRITE, req, iov_count);
+                        ret = -EAGAIN;
+                }
         }
 out_free:
         kfree(iovec);
@@ -1968,7 +1982,15 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events,
                 return 0;
 
         if (sig) {
-                ret = set_user_sigmask(sig, &ksigmask, &sigsaved, sigsz);
+#ifdef CONFIG_COMPAT
+                if (in_compat_syscall())
+                        ret = set_compat_user_sigmask((const compat_sigset_t __user *)sig,
+                                                      &ksigmask, &sigsaved, sigsz);
+                else
+#endif
+                        ret = set_user_sigmask(sig, &ksigmask,
+                                               &sigsaved, sigsz);
+
                 if (ret)
                         return ret;
         }
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index 389ea53ea487..bccfc40b3a74 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -1414,11 +1414,6 @@ void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f)
 
         jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL);
 
-        if (f->target) {
-                kfree(f->target);
-                f->target = NULL;
-        }
-
         fds = f->dents;
         while(fds) {
                 fd = fds;
diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index bb6ae387469f..05d892c79339 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -47,7 +47,10 @@ static struct inode *jffs2_alloc_inode(struct super_block *sb)
 static void jffs2_i_callback(struct rcu_head *head)
 {
         struct inode *inode = container_of(head, struct inode, i_rcu);
-        kmem_cache_free(jffs2_inode_cachep, JFFS2_INODE_INFO(inode));
+        struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
+
+        kfree(f->target);
+        kmem_cache_free(jffs2_inode_cachep, f);
 }
 
 static void jffs2_destroy_inode(struct inode *inode)
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index a35259eebc56..1dc9a08e8bdc 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -4719,22 +4719,23 @@ out:
 
 /* Lock an inode and grab a bh pointing to the inode. */
 int ocfs2_reflink_inodes_lock(struct inode *s_inode,
-                              struct buffer_head **bh1,
+                              struct buffer_head **bh_s,
                               struct inode *t_inode,
-                              struct buffer_head **bh2)
+                              struct buffer_head **bh_t)
 {
-        struct inode *inode1;
-        struct inode *inode2;
+        struct inode *inode1 = s_inode;
+        struct inode *inode2 = t_inode;
         struct ocfs2_inode_info *oi1;
         struct ocfs2_inode_info *oi2;
+        struct buffer_head *bh1 = NULL;
+        struct buffer_head *bh2 = NULL;
         bool same_inode = (s_inode == t_inode);
+        bool need_swap = (inode1->i_ino > inode2->i_ino);
         int status;
 
         /* First grab the VFS and rw locks. */
         lock_two_nondirectories(s_inode, t_inode);
-        inode1 = s_inode;
-        inode2 = t_inode;
-        if (inode1->i_ino > inode2->i_ino)
+        if (need_swap)
                 swap(inode1, inode2);
 
         status = ocfs2_rw_lock(inode1, 1);
@@ -4757,17 +4758,13 @@ int ocfs2_reflink_inodes_lock(struct inode *s_inode,
         trace_ocfs2_double_lock((unsigned long long)oi1->ip_blkno,
                                 (unsigned long long)oi2->ip_blkno);
 
-        if (*bh1)
-                *bh1 = NULL;
-        if (*bh2)
-                *bh2 = NULL;
-
         /* We always want to lock the one with the lower lockid first. */
         if (oi1->ip_blkno > oi2->ip_blkno)
                 mlog_errno(-ENOLCK);
 
         /* lock id1 */
-        status = ocfs2_inode_lock_nested(inode1, bh1, 1, OI_LS_REFLINK_TARGET);
+        status = ocfs2_inode_lock_nested(inode1, &bh1, 1,
+                                         OI_LS_REFLINK_TARGET);
         if (status < 0) {
                 if (status != -ENOENT)
                         mlog_errno(status);
@@ -4776,15 +4773,25 @@ int ocfs2_reflink_inodes_lock(struct inode *s_inode,
 
         /* lock id2 */
         if (!same_inode) {
-                status = ocfs2_inode_lock_nested(inode2, bh2, 1,
+                status = ocfs2_inode_lock_nested(inode2, &bh2, 1,
                                                  OI_LS_REFLINK_TARGET);
                 if (status < 0) {
                         if (status != -ENOENT)
                                 mlog_errno(status);
                         goto out_cl1;
                 }
-        } else
-                *bh2 = *bh1;
+        } else {
+                bh2 = bh1;
+        }
+
+        /*
+         * If we swapped inode order above, we have to swap the buffer heads
+         * before passing them back to the caller.
+         */
+        if (need_swap)
+                swap(bh1, bh2);
+        *bh_s = bh1;
+        *bh_t = bh2;
 
         trace_ocfs2_double_lock_end(
                         (unsigned long long)oi1->ip_blkno,
@@ -4794,8 +4801,7 @@ int ocfs2_reflink_inodes_lock(struct inode *s_inode,
 
 out_cl1:
         ocfs2_inode_unlock(inode1, 1);
-        brelse(*bh1);
-        *bh1 = NULL;
+        brelse(bh1);
 out_rw2:
         ocfs2_rw_unlock(inode2, 1);
 out_i2:
diff --git a/fs/open.c b/fs/open.c
index 0285ce7dbd51..f1c2f855fd43 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -733,6 +733,12 @@ static int do_dentry_open(struct file *f,
                 return 0;
         }
 
+        /* Any file opened for execve()/uselib() has to be a regular file. */
+        if (unlikely(f->f_flags & FMODE_EXEC && !S_ISREG(inode->i_mode))) {
+                error = -EACCES;
+                goto cleanup_file;
+        }
+
         if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
                 error = get_write_access(inode);
                 if (unlikely(error))
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index d29d869abec1..f5834488b67d 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -615,7 +615,7 @@ static void __init proc_kcore_text_init(void)
 /*
  * MODULES_VADDR has no intersection with VMALLOC_ADDR.
  */
-struct kcore_list kcore_modules;
+static struct kcore_list kcore_modules;
 static void __init add_modules_range(void)
 {
         if (MODULES_VADDR != VMALLOC_START && MODULES_END != VMALLOC_END) {
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index 4d598a399bbf..d65390727541 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -1626,7 +1626,8 @@ static void drop_sysctl_table(struct ctl_table_header *header)
         if (--header->nreg)
                 return;
 
-        put_links(header);
+        if (parent)
+                put_links(header);
         start_unregistering(header);
         if (!--header->count)
                 kfree_rcu(header, rcu);
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 8dc2818fdd84..12628184772c 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -276,14 +276,12 @@ static void ubifs_i_callback(struct rcu_head *head)
 {
         struct inode *inode = container_of(head, struct inode, i_rcu);
         struct ubifs_inode *ui = ubifs_inode(inode);
+        kfree(ui->data);
         kmem_cache_free(ubifs_inode_slab, ui);
 }
 
 static void ubifs_destroy_inode(struct inode *inode)
 {
-        struct ubifs_inode *ui = ubifs_inode(inode);
-
-        kfree(ui->data);
         call_rcu(&inode->i_rcu, ubifs_i_callback);
 }
 
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 48502cb9990f..4637ae1ae91c 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -1191,7 +1191,10 @@ xfs_iread_extents(
          * Root level must use BMAP_BROOT_PTR_ADDR macro to get ptr out.
          */
         level = be16_to_cpu(block->bb_level);
-        ASSERT(level > 0);
+        if (unlikely(level == 0)) {
+                XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp);
+                return -EFSCORRUPTED;
+        }
         pp = XFS_BMAP_BROOT_PTR_ADDR(mp, block, 1, ifp->if_broot_bytes);
         bno = be64_to_cpu(*pp);
 
@@ -4249,9 +4252,13 @@ xfs_bmapi_write(
         struct xfs_bmbt_irec    *mval,          /* output: map values */
         int                     *nmap)          /* i/o: mval size/count */
 {
+        struct xfs_bmalloca     bma = {
+                .tp             = tp,
+                .ip             = ip,
+                .total          = total,
+        };
         struct xfs_mount        *mp = ip->i_mount;
         struct xfs_ifork        *ifp;
-        struct xfs_bmalloca     bma = { NULL }; /* args for xfs_bmap_alloc */
         xfs_fileoff_t           end;            /* end of mapped file region */
         bool                    eof = false;    /* after the end of extents */
         int                     error;          /* error return */
@@ -4319,10 +4326,6 @@ xfs_bmapi_write(
                 eof = true;
         if (!xfs_iext_peek_prev_extent(ifp, &bma.icur, &bma.prev))
                 bma.prev.br_startoff = NULLFILEOFF;
-        bma.tp = tp;
-        bma.ip = ip;
-        bma.total = total;
-        bma.datatype = 0;
         bma.minleft = xfs_bmapi_minleft(tp, ip, whichfork);
 
         n = 0;
diff --git a/fs/xfs/scrub/btree.c b/fs/xfs/scrub/btree.c
index 6f94d1f7322d..117910db51b8 100644
--- a/fs/xfs/scrub/btree.c
+++ b/fs/xfs/scrub/btree.c
@@ -415,8 +415,17 @@ xchk_btree_check_owner(
         struct xfs_btree_cur    *cur = bs->cur;
         struct check_owner      *co;
 
-        if ((cur->bc_flags & XFS_BTREE_ROOT_IN_INODE) && bp == NULL)
+        /*
+         * In theory, xfs_btree_get_block should only give us a null buffer
+         * pointer for the root of a root-in-inode btree type, but we need
+         * to check defensively here in case the cursor state is also screwed
+         * up.
+         */
+        if (bp == NULL) {
+                if (!(cur->bc_flags & XFS_BTREE_ROOT_IN_INODE))
+                        xchk_btree_set_corrupt(bs->sc, bs->cur, level);
                 return 0;
+        }
 
         /*
          * We want to cross-reference each btree block with the bnobt
diff --git a/fs/xfs/scrub/dabtree.c b/fs/xfs/scrub/dabtree.c
index f1260b4bfdee..90527b094878 100644
--- a/fs/xfs/scrub/dabtree.c
+++ b/fs/xfs/scrub/dabtree.c
@@ -574,6 +574,11 @@ xchk_da_btree(
                 /* Drill another level deeper. */
                 blkno = be32_to_cpu(key->before);
                 level++;
+                if (level >= XFS_DA_NODE_MAXDEPTH) {
+                        /* Too deep! */
+                        xchk_da_set_corrupt(&ds, level - 1);
+                        break;
+                }
                 ds.tree_level--;
                 error = xchk_da_btree_block(&ds, level, blkno);
                 if (error)
diff --git a/fs/xfs/xfs_discard.c b/fs/xfs/xfs_discard.c
index 93f07edafd81..9ee2a7d02e70 100644
--- a/fs/xfs/xfs_discard.c
+++ b/fs/xfs/xfs_discard.c
@@ -161,6 +161,14 @@ xfs_ioc_trim(
                 return -EPERM;
         if (!blk_queue_discard(q))
                 return -EOPNOTSUPP;
+
+        /*
+         * We haven't recovered the log, so we cannot use our bnobt-guided
+         * storage zapping commands.
+         */
+        if (mp->m_flags & XFS_MOUNT_NORECOVERY)
+                return -EROFS;
+
         if (copy_from_user(&range, urange, sizeof(range)))
                 return -EFAULT;
 
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 1f2e2845eb76..a7ceae90110e 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -529,18 +529,17 @@ xfs_file_dio_aio_write(
         count = iov_iter_count(from);
 
         /*
-         * If we are doing unaligned IO, wait for all other IO to drain,
-         * otherwise demote the lock if we had to take the exclusive lock
-         * for other reasons in xfs_file_aio_write_checks.
+         * If we are doing unaligned IO, we can't allow any other overlapping IO
+         * in-flight at the same time or we risk data corruption. Wait for all
+         * other IO to drain before we submit. If the IO is aligned, demote the
+         * iolock if we had to take the exclusive lock in
+         * xfs_file_aio_write_checks() for other reasons.
          */
         if (unaligned_io) {
-                /* If we are going to wait for other DIO to finish, bail */
-                if (iocb->ki_flags & IOCB_NOWAIT) {
-                        if (atomic_read(&inode->i_dio_count))
-                                return -EAGAIN;
-                } else {
-                        inode_dio_wait(inode);
-                }
+                /* unaligned dio always waits, bail */
+                if (iocb->ki_flags & IOCB_NOWAIT)
+                        return -EAGAIN;
+                inode_dio_wait(inode);
         } else if (iolock == XFS_IOLOCK_EXCL) {
                 xfs_ilock_demote(ip, XFS_IOLOCK_EXCL);
                 iolock = XFS_IOLOCK_SHARED;
@@ -548,6 +547,14 @@ xfs_file_dio_aio_write(
 
         trace_xfs_file_direct_write(ip, count, iocb->ki_pos);
         ret = iomap_dio_rw(iocb, from, &xfs_iomap_ops, xfs_dio_write_end_io);
+
+        /*
+         * If unaligned, this is the only IO in-flight. If it has not yet
+         * completed, wait on it before we release the iolock to prevent
+         * subsequent overlapping IO.
+         */
+        if (ret == -EIOCBQUEUED && unaligned_io)
+                inode_dio_wait(inode);
 out:
         xfs_iunlock(ip, iolock);
 
diff --git a/include/acpi/acoutput.h b/include/acpi/acoutput.h
index 30b1ae53689f..c50542dc71e0 100644
--- a/include/acpi/acoutput.h
+++ b/include/acpi/acoutput.h
@@ -150,7 +150,10 @@
 
 /* Defaults for debug_level, debug and normal */
 
+#ifndef ACPI_DEBUG_DEFAULT
 #define ACPI_DEBUG_DEFAULT          (ACPI_LV_INIT | ACPI_LV_DEBUG_OBJECT | ACPI_LV_EVALUATION | ACPI_LV_REPAIR)
+#endif
+
 #define ACPI_NORMAL_DEFAULT         (ACPI_LV_INIT | ACPI_LV_DEBUG_OBJECT | ACPI_LV_REPAIR)
 #define ACPI_DEBUG_ALL              (ACPI_LV_AML_DISASSEMBLE | ACPI_LV_ALL_EXCEPTIONS | ACPI_LV_ALL)
 
diff --git a/include/acpi/platform/aclinux.h b/include/acpi/platform/aclinux.h
index 9ff328fd946a..624b90b34085 100644
--- a/include/acpi/platform/aclinux.h
+++ b/include/acpi/platform/aclinux.h
@@ -82,6 +82,11 @@
 #define ACPI_NO_ERROR_MESSAGES
 #undef ACPI_DEBUG_OUTPUT
 
+/* Use a specific bugging default separate from ACPICA */
+
+#undef ACPI_DEBUG_DEFAULT
+#define ACPI_DEBUG_DEFAULT          (ACPI_LV_INFO | ACPI_LV_REPAIR)
+
 /* External interface for __KERNEL__, stub is needed */
 
 #define ACPI_EXTERNAL_RETURN_STATUS(prototype) \
diff --git a/include/linux/device.h b/include/linux/device.h
index b425a7ee04ce..4e6987e11f68 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -49,8 +49,6 @@ struct bus_attribute {
         ssize_t (*store)(struct bus_type *bus, const char *buf, size_t count);
 };
 
-#define BUS_ATTR(_name, _mode, _show, _store)   \
-        struct bus_attribute bus_attr_##_name = __ATTR(_name, _mode, _show, _store)
 #define BUS_ATTR_RW(_name) \
         struct bus_attribute bus_attr_##_name = __ATTR_RW(_name)
 #define BUS_ATTR_RO(_name) \
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index ea35263eb76b..11943b60f208 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -203,7 +203,6 @@ static inline void hugetlb_show_meminfo(void)
 #define pud_huge(x)     0
 #define is_hugepage_only_range(mm, addr, len)   0
 #define hugetlb_free_pgd_range(tlb, addr, end, floor, ceiling) ({BUG(); 0; })
-#define hugetlb_fault(mm, vma, addr, flags)     ({ BUG(); 0; })
 #define hugetlb_mcopy_atomic_pte(dst_mm, dst_pte, dst_vma, dst_addr, \
                                 src_addr, pagep)        ({ BUG(); 0; })
 #define huge_pte_offset(mm, address, sz)        0
@@ -234,6 +233,13 @@ static inline void __unmap_hugepage_range(struct mmu_gather *tlb,
 {
         BUG();
 }
+static inline vm_fault_t hugetlb_fault(struct mm_struct *mm,
+                                struct vm_area_struct *vma, unsigned long address,
+                                unsigned int flags)
+{
+        BUG();
+        return 0;
+}
 
 #endif /* !CONFIG_HUGETLB_PAGE */
 /*
diff --git a/include/linux/kcore.h b/include/linux/kcore.h
index c843f4a9c512..da676cdbd727 100644
--- a/include/linux/kcore.h
+++ b/include/linux/kcore.h
@@ -38,12 +38,6 @@ struct vmcoredd_node {
 
 #ifdef CONFIG_PROC_KCORE
 void __init kclist_add(struct kcore_list *, void *, size_t, int type);
-static inline
-void kclist_add_remap(struct kcore_list *m, void *addr, void *vaddr, size_t sz)
-{
-        m->vaddr = (unsigned long)vaddr;
-        kclist_add(m, addr, sz, KCORE_REMAP);
-}
 
 extern int __init register_mem_pfn_is_ram(int (*fn)(unsigned long pfn));
 #else
@@ -51,11 +45,6 @@ static inline
 void kclist_add(struct kcore_list *new, void *addr, size_t size, int type)
 {
 }
-
-static inline
-void kclist_add_remap(struct kcore_list *m, void *addr, void *vaddr, size_t sz)
-{
-}
 #endif
 
 #endif /* _LINUX_KCORE_H */
diff --git a/include/linux/list.h b/include/linux/list.h
index 79626b5ab36c..58aa3adf94e6 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -207,7 +207,7 @@ static inline void list_bulk_move_tail(struct list_head *head,
 }
 
 /**
- * list_is_first -- tests whether @ list is the first entry in list @head
+ * list_is_first -- tests whether @list is the first entry in list @head
  * @list: the entry to test
  * @head: the head of the list
  */
diff --git a/include/linux/mii.h b/include/linux/mii.h
index 6fee8b1a4400..5cd824c1c0ca 100644
--- a/include/linux/mii.h
+++ b/include/linux/mii.h
@@ -469,7 +469,7 @@ static inline u32 linkmode_adv_to_lcl_adv_t(unsigned long *advertising)
         if (linkmode_test_bit(ETHTOOL_LINK_MODE_Pause_BIT,
                               advertising))
                 lcl_adv |= ADVERTISE_PAUSE_CAP;
-        if (linkmode_test_bit(ETHTOOL_LINK_MODE_Pause_BIT,
+        if (linkmode_test_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
                               advertising))
                 lcl_adv |= ADVERTISE_PAUSE_ASYM;
 
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 022541dc5dbf..0d0729648844 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -594,6 +594,8 @@ enum mlx5_pagefault_type_flags {
 };
 
 struct mlx5_td {
+        /* protects tirs list changes while tirs refresh */
+        struct mutex     list_lock;
         struct list_head tirs_list;
         u32              tdn;
 };
diff --git a/include/linux/page-isolation.h b/include/linux/page-isolation.h
index 4eb26d278046..280ae96dc4c3 100644
--- a/include/linux/page-isolation.h
+++ b/include/linux/page-isolation.h
@@ -41,16 +41,6 @@ int move_freepages_block(struct zone *zone, struct page *page,
 
 /*
  * Changes migrate type in [start_pfn, end_pfn) to be MIGRATE_ISOLATE.
- * If specified range includes migrate types other than MOVABLE or CMA,
- * this will fail with -EBUSY.
- *
- * For isolating all pages in the range finally, the caller have to
- * free all pages in the range. test_page_isolated() can be used for
- * test it.
- *
- * The following flags are allowed (they can be combined in a bit mask)
- * SKIP_HWPOISON - ignore hwpoison pages
- * REPORT_FAILURE - report details about the failure to isolate the range
  */
 int
 start_isolate_page_range(unsigned long start_pfn, unsigned long end_pfn,
diff --git a/include/linux/platform_data/gpio/gpio-amd-fch.h b/include/linux/platform_data/gpio/gpio-amd-fch.h
index a867637e172d..9e46678edb2a 100644
--- a/include/linux/platform_data/gpio/gpio-amd-fch.h
+++ b/include/linux/platform_data/gpio/gpio-amd-fch.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL+ */
+/* SPDX-License-Identifier: GPL-2.0+ */
 
 /*
  * AMD FCH gpio driver platform-data
diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h
index ae5655197698..e412c092c1e8 100644
--- a/include/linux/sched/signal.h
+++ b/include/linux/sched/signal.h
@@ -418,10 +418,20 @@ static inline void set_restore_sigmask(void)
         set_thread_flag(TIF_RESTORE_SIGMASK);
         WARN_ON(!test_thread_flag(TIF_SIGPENDING));
 }
+
+static inline void clear_tsk_restore_sigmask(struct task_struct *tsk)
+{
+        clear_tsk_thread_flag(tsk, TIF_RESTORE_SIGMASK);
+}
+
 static inline void clear_restore_sigmask(void)
 {
         clear_thread_flag(TIF_RESTORE_SIGMASK);
 }
+static inline bool test_tsk_restore_sigmask(struct task_struct *tsk)
+{
+        return test_tsk_thread_flag(tsk, TIF_RESTORE_SIGMASK);
+}
 static inline bool test_restore_sigmask(void)
 {
         return test_thread_flag(TIF_RESTORE_SIGMASK);
@@ -439,6 +449,10 @@ static inline void set_restore_sigmask(void)
         current->restore_sigmask = true;
         WARN_ON(!test_thread_flag(TIF_SIGPENDING));
 }
+static inline void clear_tsk_restore_sigmask(struct task_struct *tsk)
+{
+        tsk->restore_sigmask = false;
+}
 static inline void clear_restore_sigmask(void)
 {
         current->restore_sigmask = false;
@@ -447,6 +461,10 @@ static inline bool test_restore_sigmask(void)
 {
         return current->restore_sigmask;
 }
+static inline bool test_tsk_restore_sigmask(struct task_struct *tsk)
+{
+        return tsk->restore_sigmask;
+}
 static inline bool test_and_clear_restore_sigmask(void)
 {
         if (!current->restore_sigmask)
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 11b45f7ae405..9449b19c5f10 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -32,6 +32,8 @@
 #define SLAB_HWCACHE_ALIGN      ((slab_flags_t __force)0x00002000U)
 /* Use GFP_DMA memory */
 #define SLAB_CACHE_DMA          ((slab_flags_t __force)0x00004000U)
+/* Use GFP_DMA32 memory */
+#define SLAB_CACHE_DMA32        ((slab_flags_t __force)0x00008000U)
 /* DEBUG: Store the last owner for bug hunting */
 #define SLAB_STORE_USER         ((slab_flags_t __force)0x00010000U)
 /* Panic if kmem_cache_create() fails */
diff --git a/include/linux/vbox_utils.h b/include/linux/vbox_utils.h
index a240ed2a0372..ff56c443180c 100644
--- a/include/linux/vbox_utils.h
+++ b/include/linux/vbox_utils.h
@@ -24,15 +24,17 @@ __printf(1, 2) void vbg_debug(const char *fmt, ...);
 #define vbg_debug pr_debug
 #endif
 
-int vbg_hgcm_connect(struct vbg_dev *gdev,
+int vbg_hgcm_connect(struct vbg_dev *gdev, u32 requestor,
                      struct vmmdev_hgcm_service_location *loc,
                      u32 *client_id, int *vbox_status);
 
-int vbg_hgcm_disconnect(struct vbg_dev *gdev, u32 client_id, int *vbox_status);
+int vbg_hgcm_disconnect(struct vbg_dev *gdev, u32 requestor,
+                        u32 client_id, int *vbox_status);
 
-int vbg_hgcm_call(struct vbg_dev *gdev, u32 client_id, u32 function,
-                  u32 timeout_ms, struct vmmdev_hgcm_function_parameter *parms,
-                  u32 parm_count, int *vbox_status);
+int vbg_hgcm_call(struct vbg_dev *gdev, u32 requestor, u32 client_id,
+                  u32 function, u32 timeout_ms,
+                  struct vmmdev_hgcm_function_parameter *parms, u32 parm_count,
+                  int *vbox_status);
 
 /**
  * Convert a VirtualBox status code to a standard Linux kernel return value.
diff --git a/include/net/ip.h b/include/net/ip.h
index aa09ae5f01a5..2d3cce7c3e8a 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -681,7 +681,7 @@ int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp,
                              unsigned char __user *data, int optlen);
 void ip_options_undo(struct ip_options *opt);
 void ip_forward_options(struct sk_buff *skb);
-int ip_options_rcv_srr(struct sk_buff *skb);
+int ip_options_rcv_srr(struct sk_buff *skb, struct net_device *dev);
 
 /*
  *      Functions provided by ip_sockglue.c
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index a68ced28d8f4..12689ddfc24c 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -59,6 +59,7 @@ struct net {
                                                  */
         spinlock_t              rules_mod_lock;
 
+        u32                     hash_mix;
         atomic64_t              cookie_gen;
 
         struct list_head        list;           /* list of network namespaces */
diff --git a/include/net/netns/hash.h b/include/net/netns/hash.h
index 16a842456189..d9b665151f3d 100644
--- a/include/net/netns/hash.h
+++ b/include/net/netns/hash.h
@@ -2,16 +2,10 @@
 #ifndef __NET_NS_HASH_H__
 #define __NET_NS_HASH_H__
 
-#include <asm/cache.h>
-
-struct net;
+#include <net/net_namespace.h>
 
 static inline u32 net_hash_mix(const struct net *net)
 {
-#ifdef CONFIG_NET_NS
-        return (u32)(((unsigned long)net) >> ilog2(sizeof(*net)));
-#else
-        return 0;
-#endif
+        return net->hash_mix;
 }
 #endif
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 2269383c1399..0aea0e262452 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -934,6 +934,41 @@ static inline void qdisc_qstats_overlimit(struct Qdisc *sch)
         sch->qstats.overlimits++;
 }
 
+static inline int qdisc_qstats_copy(struct gnet_dump *d, struct Qdisc *sch)
+{
+        __u32 qlen = qdisc_qlen_sum(sch);
+
+        return gnet_stats_copy_queue(d, sch->cpu_qstats, &sch->qstats, qlen);
+}
+
+static inline void qdisc_qstats_qlen_backlog(struct Qdisc *sch,  __u32 *qlen,
+                                             __u32 *backlog)
+{
+        struct gnet_stats_queue qstats = { 0 };
+        __u32 len = qdisc_qlen_sum(sch);
+
+        __gnet_stats_copy_queue(&qstats, sch->cpu_qstats, &sch->qstats, len);
+        *qlen = qstats.qlen;
+        *backlog = qstats.backlog;
+}
+
+static inline void qdisc_tree_flush_backlog(struct Qdisc *sch)
+{
+        __u32 qlen, backlog;
+
+        qdisc_qstats_qlen_backlog(sch, &qlen, &backlog);
+        qdisc_tree_reduce_backlog(sch, qlen, backlog);
+}
+
+static inline void qdisc_purge_queue(struct Qdisc *sch)
+{
+        __u32 qlen, backlog;
+
+        qdisc_qstats_qlen_backlog(sch, &qlen, &backlog);
+        qdisc_reset(sch);
+        qdisc_tree_reduce_backlog(sch, qlen, backlog);
+}
+
 static inline void qdisc_skb_head_init(struct qdisc_skb_head *qh)
 {
         qh->head = NULL;
@@ -1117,13 +1152,8 @@ static inline struct Qdisc *qdisc_replace(struct Qdisc *sch, struct Qdisc *new,
         sch_tree_lock(sch);
         old = *pold;
         *pold = new;
-        if (old != NULL) {
-                unsigned int qlen = old->q.qlen;
-                unsigned int backlog = old->qstats.backlog;
-
-                qdisc_reset(old);
-                qdisc_tree_reduce_backlog(old, qlen, backlog);
-        }
+        if (old != NULL)
+                qdisc_tree_flush_backlog(old);
         sch_tree_unlock(sch);
 
         return old;
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index 5f24b50c9e88..059dc2bedaf6 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -7,5 +7,7 @@ no-export-headers += kvm.h
 endif
 
 ifeq ($(wildcard $(srctree)/arch/$(SRCARCH)/include/uapi/asm/kvm_para.h),)
+ifeq ($(wildcard $(objtree)/arch/$(SRCARCH)/include/generated/uapi/asm/kvm_para.h),)
 no-export-headers += kvm_para.h
 endif
+endif
diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h
index 0e68024f36c7..26f39816af14 100644
--- a/include/uapi/linux/vbox_vmmdev_types.h
+++ b/include/uapi/linux/vbox_vmmdev_types.h
@@ -102,6 +102,66 @@ enum vmmdev_request_type {
 #define VMMDEVREQ_HGCM_CALL VMMDEVREQ_HGCM_CALL32
 #endif
 
+/* vmmdev_request_header.requestor defines */
+
+/* Requestor user not given. */
+#define VMMDEV_REQUESTOR_USR_NOT_GIVEN                      0x00000000
+/* The kernel driver (vboxguest) is the requestor. */
+#define VMMDEV_REQUESTOR_USR_DRV                            0x00000001
+/* Some other kernel driver is the requestor. */
+#define VMMDEV_REQUESTOR_USR_DRV_OTHER                      0x00000002
+/* The root or a admin user is the requestor. */
+#define VMMDEV_REQUESTOR_USR_ROOT                           0x00000003
+/* Regular joe user is making the request. */
+#define VMMDEV_REQUESTOR_USR_USER                           0x00000006
+/* User classification mask. */
+#define VMMDEV_REQUESTOR_USR_MASK                           0x00000007
+
+/* Kernel mode request. Note this is 0, check for !USERMODE instead. */
+#define VMMDEV_REQUESTOR_KERNEL                             0x00000000
+/* User mode request. */
+#define VMMDEV_REQUESTOR_USERMODE                           0x00000008
+/* User or kernel mode classification mask. */
+#define VMMDEV_REQUESTOR_MODE_MASK                          0x00000008
+
+/* Don't know the physical console association of the requestor. */
+#define VMMDEV_REQUESTOR_CON_DONT_KNOW                      0x00000000
+/*
+ * The request originates with a process that is NOT associated with the
+ * physical console.
+ */
+#define VMMDEV_REQUESTOR_CON_NO                             0x00000010
+/* Requestor process is associated with the physical console. */
+#define VMMDEV_REQUESTOR_CON_YES                            0x00000020
+/* Console classification mask. */
+#define VMMDEV_REQUESTOR_CON_MASK                           0x00000030
+
+/* Requestor is member of special VirtualBox user group. */
+#define VMMDEV_REQUESTOR_GRP_VBOX                           0x00000080
+
+/* Note: trust level is for windows guests only, linux always uses not-given */
+/* Requestor trust level: Unspecified */
+#define VMMDEV_REQUESTOR_TRUST_NOT_GIVEN                    0x00000000
+/* Requestor trust level: Untrusted (SID S-1-16-0) */
+#define VMMDEV_REQUESTOR_TRUST_UNTRUSTED                    0x00001000
+/* Requestor trust level: Untrusted (SID S-1-16-4096) */
+#define VMMDEV_REQUESTOR_TRUST_LOW                          0x00002000
+/* Requestor trust level: Medium (SID S-1-16-8192) */
+#define VMMDEV_REQUESTOR_TRUST_MEDIUM                       0x00003000
+/* Requestor trust level: Medium plus (SID S-1-16-8448) */
+#define VMMDEV_REQUESTOR_TRUST_MEDIUM_PLUS                  0x00004000
+/* Requestor trust level: High (SID S-1-16-12288) */
+#define VMMDEV_REQUESTOR_TRUST_HIGH                         0x00005000
+/* Requestor trust level: System (SID S-1-16-16384) */
+#define VMMDEV_REQUESTOR_TRUST_SYSTEM                       0x00006000
+/* Requestor trust level >= Protected (SID S-1-16-20480, S-1-16-28672) */
+#define VMMDEV_REQUESTOR_TRUST_PROTECTED                    0x00007000
+/* Requestor trust level mask */
+#define VMMDEV_REQUESTOR_TRUST_MASK                         0x00007000
+
+/* Requestor is using the less trusted user device node (/dev/vboxuser) */
+#define VMMDEV_REQUESTOR_USER_DEVICE                        0x00008000
+
 /** HGCM service location types. */
 enum vmmdev_hgcm_service_location_type {
         VMMDEV_HGCM_LOC_INVALID    = 0,
diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
index 8974b3755670..3c18260403dd 100644
--- a/kernel/bpf/cpumap.c
+++ b/kernel/bpf/cpumap.c
@@ -162,10 +162,14 @@ static void cpu_map_kthread_stop(struct work_struct *work)
 static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
                                          struct xdp_frame *xdpf)
 {
+        unsigned int hard_start_headroom;
         unsigned int frame_size;
         void *pkt_data_start;
         struct sk_buff *skb;
 
+        /* Part of headroom was reserved to xdpf */
+        hard_start_headroom = sizeof(struct xdp_frame) +  xdpf->headroom;
+
         /* build_skb need to place skb_shared_info after SKB end, and
          * also want to know the memory "truesize".  Thus, need to
          * know the memory frame size backing xdp_buff.
@@ -183,15 +187,15 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
          * is not at a fixed memory location, with mixed length
          * packets, which is bad for cache-line hotness.
          */
-        frame_size = SKB_DATA_ALIGN(xdpf->len + xdpf->headroom) +
+        frame_size = SKB_DATA_ALIGN(xdpf->len + hard_start_headroom) +
                 SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
 
-        pkt_data_start = xdpf->data - xdpf->headroom;
+        pkt_data_start = xdpf->data - hard_start_headroom;
         skb = build_skb(pkt_data_start, frame_size);
         if (!skb)
                 return NULL;
 
-        skb_reserve(skb, xdpf->headroom);
+        skb_reserve(skb, hard_start_headroom);
         __skb_put(skb, xdpf->len);
         if (xdpf->metasize)
                 skb_metadata_set(skb, xdpf->metasize);
@@ -205,6 +209,9 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
          * - RX ring dev queue index    (skb_record_rx_queue)
          */
 
+        /* Allow SKB to reuse area used by xdp_frame */
+        xdp_scrub_frame(xdpf);
+
         return skb;
 }
 
diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
index 2ada5e21dfa6..4a8f390a2b82 100644
--- a/kernel/bpf/inode.c
+++ b/kernel/bpf/inode.c
@@ -554,19 +554,6 @@ struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type typ
 }
 EXPORT_SYMBOL(bpf_prog_get_type_path);
 
-static void bpf_evict_inode(struct inode *inode)
-{
-        enum bpf_type type;
-
-        truncate_inode_pages_final(&inode->i_data);
-        clear_inode(inode);
-
-        if (S_ISLNK(inode->i_mode))
-                kfree(inode->i_link);
-        if (!bpf_inode_type(inode, &type))
-                bpf_any_put(inode->i_private, type);
-}
-
 /*
  * Display the mount options in /proc/mounts.
  */
@@ -579,11 +566,28 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root)
         return 0;
 }
 
+static void bpf_destroy_inode_deferred(struct rcu_head *head)
+{
+        struct inode *inode = container_of(head, struct inode, i_rcu);
+        enum bpf_type type;
+
+        if (S_ISLNK(inode->i_mode))
+                kfree(inode->i_link);
+        if (!bpf_inode_type(inode, &type))
+                bpf_any_put(inode->i_private, type);
+        free_inode_nonrcu(inode);
+}
+
+static void bpf_destroy_inode(struct inode *inode)
+{
+        call_rcu(&inode->i_rcu, bpf_destroy_inode_deferred);
+}
+
 static const struct super_operations bpf_super_ops = {
         .statfs         = simple_statfs,
         .drop_inode     = generic_delete_inode,
         .show_options   = bpf_show_options,
-        .evict_inode    = bpf_evict_inode,
+        .destroy_inode  = bpf_destroy_inode,
 };
 
 enum {
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 2fe89138309a..b7ad8003c4e6 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1898,8 +1898,9 @@ continue_func:
                 }
                 frame++;
                 if (frame >= MAX_CALL_FRAMES) {
-                        WARN_ONCE(1, "verifier bug. Call stack is too deep\n");
-                        return -EFAULT;
+                        verbose(env, "the call stack of %d frames is too deep !\n",
+                                frame);
+                        return -E2BIG;
                 }
                 goto process_func;
         }
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 025f419d16f6..6754f3ecfd94 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -564,6 +564,20 @@ static void undo_cpu_up(unsigned int cpu, struct cpuhp_cpu_state *st)
                 cpuhp_invoke_callback(cpu, st->state, false, NULL, NULL);
 }
 
+static inline bool can_rollback_cpu(struct cpuhp_cpu_state *st)
+{
+        if (IS_ENABLED(CONFIG_HOTPLUG_CPU))
+                return true;
+        /*
+         * When CPU hotplug is disabled, then taking the CPU down is not
+         * possible because takedown_cpu() and the architecture and
+         * subsystem specific mechanisms are not available. So the CPU
+         * which would be completely unplugged again needs to stay around
+         * in the current state.
+         */
+        return st->state <= CPUHP_BRINGUP_CPU;
+}
+
 static int cpuhp_up_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st,
                               enum cpuhp_state target)
 {
@@ -574,8 +588,10 @@ static int cpuhp_up_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st,
                 st->state++;
                 ret = cpuhp_invoke_callback(cpu, st->state, true, NULL, NULL);
                 if (ret) {
-                        st->target = prev_state;
-                        undo_cpu_up(cpu, st);
+                        if (can_rollback_cpu(st)) {
+                                st->target = prev_state;
+                                undo_cpu_up(cpu, st);
+                        }
                         break;
                 }
         }
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 771e93f9c43f..6f357f4fc859 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -29,6 +29,7 @@
 #include <linux/hw_breakpoint.h>
 #include <linux/cn_proc.h>
 #include <linux/compat.h>
+#include <linux/sched/signal.h>
 
 /*
  * Access another process' address space via ptrace.
@@ -924,18 +925,26 @@ int ptrace_request(struct task_struct *child, long request,
                         ret = ptrace_setsiginfo(child, &siginfo);
                 break;
 
-        case PTRACE_GETSIGMASK:
+        case PTRACE_GETSIGMASK: {
+                sigset_t *mask;
+
                 if (addr != sizeof(sigset_t)) {
                         ret = -EINVAL;
                         break;
                 }
 
-                if (copy_to_user(datavp, &child->blocked, sizeof(sigset_t)))
+                if (test_tsk_restore_sigmask(child))
+                        mask = &child->saved_sigmask;
+                else
+                        mask = &child->blocked;
+
+                if (copy_to_user(datavp, mask, sizeof(sigset_t)))
                         ret = -EFAULT;
                 else
                         ret = 0;
 
                 break;
+        }
 
         case PTRACE_SETSIGMASK: {
                 sigset_t new_set;
@@ -961,6 +970,8 @@ int ptrace_request(struct task_struct *child, long request,
                 child->blocked = new_set;
                 spin_unlock_irq(&child->sighand->siglock);
 
+                clear_tsk_restore_sigmask(child);
+
                 ret = 0;
                 break;
         }
diff --git a/kernel/signal.c b/kernel/signal.c
index b7953934aa99..f98448cf2def 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -3605,16 +3605,11 @@ SYSCALL_DEFINE4(pidfd_send_signal, int, pidfd, int, sig,
                 if (unlikely(sig != kinfo.si_signo))
                         goto err;
 
+                /* Only allow sending arbitrary signals to yourself. */
+                ret = -EPERM;
                 if ((task_pid(current) != pid) &&
-                    (kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL)) {
-                        /* Only allow sending arbitrary signals to yourself. */
-                        ret = -EPERM;
-                        if (kinfo.si_code != SI_USER)
-                                goto err;
-
-                        /* Turn this into a regular kill signal. */
-                        prepare_kill_siginfo(sig, &kinfo);
-                }
+                    (kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL))
+                        goto err;
         } else {
                 prepare_kill_siginfo(sig, &kinfo);
         }
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 403c9bd90413..6a5787233113 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -554,13 +554,15 @@ static void softlockup_start_all(void)
 
 int lockup_detector_online_cpu(unsigned int cpu)
 {
-        watchdog_enable(cpu);
+        if (cpumask_test_cpu(cpu, &watchdog_allowed_mask))
+                watchdog_enable(cpu);
         return 0;
 }
 
 int lockup_detector_offline_cpu(unsigned int cpu)
 {
-        watchdog_disable(cpu);
+        if (cpumask_test_cpu(cpu, &watchdog_allowed_mask))
+                watchdog_disable(cpu);
         return 0;
 }
 
diff --git a/lib/sbitmap.c b/lib/sbitmap.c
index 5b382c1244ed..155fe38756ec 100644
--- a/lib/sbitmap.c
+++ b/lib/sbitmap.c
@@ -591,6 +591,17 @@ EXPORT_SYMBOL_GPL(sbitmap_queue_wake_up);
 void sbitmap_queue_clear(struct sbitmap_queue *sbq, unsigned int nr,
                          unsigned int cpu)
 {
+        /*
+         * Once the clear bit is set, the bit may be allocated out.
+         *
+         * Orders READ/WRITE on the asssociated instance(such as request
+         * of blk_mq) by this bit for avoiding race with re-allocation,
+         * and its pair is the memory barrier implied in __sbitmap_get_word.
+         *
+         * One invariant is that the clear bit has to be zero when the bit
+         * is in use.
+         */
+        smp_mb__before_atomic();
         sbitmap_deferred_clear_bit(&sbq->sb, nr);
 
         /*
diff --git a/mm/compaction.c b/mm/compaction.c
index f171a83707ce..3319e0872d01 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -242,6 +242,7 @@ __reset_isolation_pfn(struct zone *zone, unsigned long pfn, bool check_source,
                                                         bool check_target)
 {
         struct page *page = pfn_to_online_page(pfn);
+        struct page *block_page;
         struct page *end_page;
         unsigned long block_pfn;
 
@@ -267,20 +268,26 @@ __reset_isolation_pfn(struct zone *zone, unsigned long pfn, bool check_source,
             get_pageblock_migratetype(page) != MIGRATE_MOVABLE)
                 return false;
 
+        /* Ensure the start of the pageblock or zone is online and valid */
+        block_pfn = pageblock_start_pfn(pfn);
+        block_page = pfn_to_online_page(max(block_pfn, zone->zone_start_pfn));
+        if (block_page) {
+                page = block_page;
+                pfn = block_pfn;
+        }
+
+        /* Ensure the end of the pageblock or zone is online and valid */
+        block_pfn += pageblock_nr_pages;
+        block_pfn = min(block_pfn, zone_end_pfn(zone) - 1);
+        end_page = pfn_to_online_page(block_pfn);
+        if (!end_page)
+                return false;
+
         /*
          * Only clear the hint if a sample indicates there is either a
          * free page or an LRU page in the block. One or other condition
          * is necessary for the block to be a migration source/target.
          */
-        block_pfn = pageblock_start_pfn(pfn);
-        pfn = max(block_pfn, zone->zone_start_pfn);
-        page = pfn_to_page(pfn);
-        if (zone != page_zone(page))
-                return false;
-        pfn = block_pfn + pageblock_nr_pages;
-        pfn = min(pfn, zone_end_pfn(zone));
-        end_page = pfn_to_page(pfn);
-
         do {
                 if (pfn_valid_within(pfn)) {
                         if (check_source && PageLRU(page)) {
@@ -309,7 +316,7 @@ __reset_isolation_pfn(struct zone *zone, unsigned long pfn, bool check_source,
 static void __reset_isolation_suitable(struct zone *zone)
 {
         unsigned long migrate_pfn = zone->zone_start_pfn;
-        unsigned long free_pfn = zone_end_pfn(zone);
+        unsigned long free_pfn = zone_end_pfn(zone) - 1;
         unsigned long reset_migrate = free_pfn;
         unsigned long reset_free = migrate_pfn;
         bool source_set = false;
@@ -1363,7 +1370,7 @@ fast_isolate_freepages(struct compact_control *cc)
                                 count_compact_events(COMPACTISOLATED, nr_isolated);
                         } else {
                                 /* If isolation fails, abort the search */
-                                order = -1;
+                                order = cc->search_order + 1;
                                 page = NULL;
                         }
                 }
diff --git a/mm/debug.c b/mm/debug.c
index c0b31b6c3877..eee9c221280c 100644
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -79,7 +79,7 @@ void __dump_page(struct page *page, const char *reason)
                 pr_warn("ksm ");
         else if (mapping) {
                 pr_warn("%ps ", mapping->a_ops);
-                if (mapping->host->i_dentry.first) {
+                if (mapping->host && mapping->host->i_dentry.first) {
                         struct dentry *dentry;
                         dentry = container_of(mapping->host->i_dentry.first, struct dentry, d_u.d_alias);
                         pr_warn("name:\"%pd\" ", dentry);
@@ -168,7 +168,7 @@ void dump_mm(const struct mm_struct *mm)
                 mm_pgtables_bytes(mm),
                 mm->map_count,
                 mm->hiwater_rss, mm->hiwater_vm, mm->total_vm, mm->locked_vm,
-                atomic64_read(&mm->pinned_vm),
+                (u64)atomic64_read(&mm->pinned_vm),
                 mm->data_vm, mm->exec_vm, mm->stack_vm,
                 mm->start_code, mm->end_code, mm->start_data, mm->end_data,
                 mm->start_brk, mm->brk, mm->start_stack,
diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
index 3e0c11f7d7a1..3ce956efa0cb 100644
--- a/mm/kasan/kasan.h
+++ b/mm/kasan/kasan.h
@@ -163,7 +163,10 @@ static inline u8 random_tag(void)
 #endif
 
 #ifndef arch_kasan_set_tag
-#define arch_kasan_set_tag(addr, tag)   ((void *)(addr))
+static inline const void *arch_kasan_set_tag(const void *addr, u8 tag)
+{
+        return addr;
+}
 #endif
 #ifndef arch_kasan_reset_tag
 #define arch_kasan_reset_tag(addr)      ((void *)(addr))
diff --git a/mm/memory.c b/mm/memory.c
index 47fe250307c7..ab650c21bccd 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1549,10 +1549,12 @@ static vm_fault_t insert_pfn(struct vm_area_struct *vma, unsigned long addr,
                                 WARN_ON_ONCE(!is_zero_pfn(pte_pfn(*pte)));
                                 goto out_unlock;
                         }
-                        entry = *pte;
-                        goto out_mkwrite;
-                } else
-                        goto out_unlock;
+                        entry = pte_mkyoung(*pte);
+                        entry = maybe_mkwrite(pte_mkdirty(entry), vma);
+                        if (ptep_set_access_flags(vma, addr, pte, entry, 1))
+                                update_mmu_cache(vma, addr, pte);
+                }
+                goto out_unlock;
         }
 
         /* Ok, finally just insert the thing.. */
@@ -1561,7 +1563,6 @@ static vm_fault_t insert_pfn(struct vm_area_struct *vma, unsigned long addr,
         else
                 entry = pte_mkspecial(pfn_t_pte(pfn, prot));
 
-out_mkwrite:
         if (mkwrite) {
                 entry = pte_mkyoung(entry);
                 entry = maybe_mkwrite(pte_mkdirty(entry), vma);
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index f767582af4f8..0082d699be94 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1576,7 +1576,7 @@ static int __ref __offline_pages(unsigned long start_pfn,
 {
         unsigned long pfn, nr_pages;
         long offlined_pages;
-        int ret, node;
+        int ret, node, nr_isolate_pageblock;
         unsigned long flags;
         unsigned long valid_start, valid_end;
         struct zone *zone;
@@ -1602,10 +1602,11 @@ static int __ref __offline_pages(unsigned long start_pfn,
         ret = start_isolate_page_range(start_pfn, end_pfn,
                                        MIGRATE_MOVABLE,
                                        SKIP_HWPOISON | REPORT_FAILURE);
-        if (ret) {
+        if (ret < 0) {
                 reason = "failure to isolate range";
                 goto failed_removal;
         }
+        nr_isolate_pageblock = ret;
 
         arg.start_pfn = start_pfn;
         arg.nr_pages = nr_pages;
@@ -1657,8 +1658,16 @@ static int __ref __offline_pages(unsigned long start_pfn,
         /* Ok, all of our target is isolated.
            We cannot do rollback at this point. */
         offline_isolated_pages(start_pfn, end_pfn);
-        /* reset pagetype flags and makes migrate type to be MOVABLE */
-        undo_isolate_page_range(start_pfn, end_pfn, MIGRATE_MOVABLE);
+
+        /*
+         * Onlining will reset pagetype flags and makes migrate type
+         * MOVABLE, so just need to decrease the number of isolated
+         * pageblocks zone counter here.
+         */
+        spin_lock_irqsave(&zone->lock, flags);
+        zone->nr_isolate_pageblock -= nr_isolate_pageblock;
+        spin_unlock_irqrestore(&zone->lock, flags);
+
         /* removal success */
         adjust_managed_page_count(pfn_to_page(start_pfn), -offlined_pages);
         zone->present_pages -= offlined_pages;
@@ -1690,12 +1699,12 @@ static int __ref __offline_pages(unsigned long start_pfn,
 
 failed_removal_isolated:
         undo_isolate_page_range(start_pfn, end_pfn, MIGRATE_MOVABLE);
+        memory_notify(MEM_CANCEL_OFFLINE, &arg);
 failed_removal:
         pr_debug("memory offlining [mem %#010llx-%#010llx] failed due to %s\n",
                  (unsigned long long) start_pfn << PAGE_SHIFT,
                  ((unsigned long long) end_pfn << PAGE_SHIFT) - 1,
                  reason);
-        memory_notify(MEM_CANCEL_OFFLINE, &arg);
         /* pushback to free area */
         mem_hotplug_done();
         return ret;
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index af171ccb56a2..2219e747df49 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -428,6 +428,13 @@ static inline bool queue_pages_required(struct page *page,
         return node_isset(nid, *qp->nmask) == !(flags & MPOL_MF_INVERT);
 }
 
+/*
+ * queue_pages_pmd() has three possible return values:
+ * 1 - pages are placed on the right node or queued successfully.
+ * 0 - THP was split.
+ * -EIO - is migration entry or MPOL_MF_STRICT was specified and an existing
+ *        page was already on a node that does not follow the policy.
+ */
 static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
                                 unsigned long end, struct mm_walk *walk)
 {
@@ -437,7 +444,7 @@ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
         unsigned long flags;
 
         if (unlikely(is_pmd_migration_entry(*pmd))) {
-                ret = 1;
+                ret = -EIO;
                 goto unlock;
         }
         page = pmd_page(*pmd);
@@ -454,8 +461,15 @@ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
         ret = 1;
         flags = qp->flags;
         /* go to thp migration */
-        if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))
+        if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
+                if (!vma_migratable(walk->vma)) {
+                        ret = -EIO;
+                        goto unlock;
+                }
+
                 migrate_page_add(page, qp->pagelist, flags);
+        } else
+                ret = -EIO;
 unlock:
         spin_unlock(ptl);
 out:
@@ -480,8 +494,10 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
         ptl = pmd_trans_huge_lock(pmd, vma);
         if (ptl) {
                 ret = queue_pages_pmd(pmd, ptl, addr, end, walk);
-                if (ret)
+                if (ret > 0)
                         return 0;
+                else if (ret < 0)
+                        return ret;
         }
 
         if (pmd_trans_unstable(pmd))
@@ -502,11 +518,16 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
                         continue;
                 if (!queue_pages_required(page, qp))
                         continue;
-                migrate_page_add(page, qp->pagelist, flags);
+                if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
+                        if (!vma_migratable(vma))
+                                break;
+                        migrate_page_add(page, qp->pagelist, flags);
+                } else
+                        break;
         }
         pte_unmap_unlock(pte - 1, ptl);
         cond_resched();
-        return 0;
+        return addr != end ? -EIO : 0;
 }
 
 static int queue_pages_hugetlb(pte_t *pte, unsigned long hmask,
@@ -576,7 +597,12 @@ static int queue_pages_test_walk(unsigned long start, unsigned long end,
         unsigned long endvma = vma->vm_end;
         unsigned long flags = qp->flags;
 
-        if (!vma_migratable(vma))
+        /*
+         * Need check MPOL_MF_STRICT to return -EIO if possible
+         * regardless of vma_migratable
+         */
+        if (!vma_migratable(vma) &&
+            !(flags & MPOL_MF_STRICT))
                 return 1;
 
         if (endvma > end)
@@ -603,7 +629,7 @@ static int queue_pages_test_walk(unsigned long start, unsigned long end,
         }
 
         /* queue pages from current vma */
-        if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))
+        if (flags & MPOL_MF_VALID)
                 return 0;
         return 1;
 }
diff --git a/mm/migrate.c b/mm/migrate.c
index ac6f4939bb59..663a5449367a 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -248,10 +248,8 @@ static bool remove_migration_pte(struct page *page, struct vm_area_struct *vma,
                                 pte = swp_entry_to_pte(entry);
                         } else if (is_device_public_page(new)) {
                                 pte = pte_mkdevmap(pte);
-                                flush_dcache_page(new);
                         }
-                } else
-                        flush_dcache_page(new);
+                }
 
 #ifdef CONFIG_HUGETLB_PAGE
                 if (PageHuge(new)) {
@@ -995,6 +993,13 @@ static int move_to_new_page(struct page *newpage, struct page *page,
                  */
                 if (!PageMappingFlags(page))
                         page->mapping = NULL;
+
+                if (unlikely(is_zone_device_page(newpage))) {
+                        if (is_device_public_page(newpage))
+                                flush_dcache_page(newpage);
+                } else
+                        flush_dcache_page(newpage);
+
         }
 out:
         return rc;
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 03fcf73d47da..d96ca5bc555b 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -8233,7 +8233,7 @@ int alloc_contig_range(unsigned long start, unsigned long end,
 
         ret = start_isolate_page_range(pfn_max_align_down(start),
                                        pfn_max_align_up(end), migratetype, 0);
-        if (ret)
+        if (ret < 0)
                 return ret;
 
         /*
diff --git a/mm/page_isolation.c b/mm/page_isolation.c
index ce323e56b34d..019280712e1b 100644
--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -59,7 +59,8 @@ static int set_migratetype_isolate(struct page *page, int migratetype, int isol_
          * FIXME: Now, memory hotplug doesn't call shrink_slab() by itself.
          * We just check MOVABLE pages.
          */
-        if (!has_unmovable_pages(zone, page, arg.pages_found, migratetype, flags))
+        if (!has_unmovable_pages(zone, page, arg.pages_found, migratetype,
+                                 isol_flags))
                 ret = 0;
 
         /*
@@ -160,27 +161,36 @@ __first_valid_page(unsigned long pfn, unsigned long nr_pages)
         return NULL;
 }
 
-/*
- * start_isolate_page_range() -- make page-allocation-type of range of pages
- * to be MIGRATE_ISOLATE.
- * @start_pfn: The lower PFN of the range to be isolated.
- * @end_pfn: The upper PFN of the range to be isolated.
- * @migratetype: migrate type to set in error recovery.
+/**
+ * start_isolate_page_range() - make page-allocation-type of range of pages to
+ * be MIGRATE_ISOLATE.
+ * @start_pfn:          The lower PFN of the range to be isolated.
+ * @end_pfn:            The upper PFN of the range to be isolated.
+ *                      start_pfn/end_pfn must be aligned to pageblock_order.
+ * @migratetype:        Migrate type to set in error recovery.
+ * @flags:              The following flags are allowed (they can be combined in
+ *                      a bit mask)
+ *                      SKIP_HWPOISON - ignore hwpoison pages
+ *                      REPORT_FAILURE - report details about the failure to
+ *                      isolate the range
  *
  * Making page-allocation-type to be MIGRATE_ISOLATE means free pages in
  * the range will never be allocated. Any free pages and pages freed in the
- * future will not be allocated again.
- *
- * start_pfn/end_pfn must be aligned to pageblock_order.
- * Return 0 on success and -EBUSY if any part of range cannot be isolated.
+ * future will not be allocated again. If specified range includes migrate types
+ * other than MOVABLE or CMA, this will fail with -EBUSY. For isolating all
+ * pages in the range finally, the caller have to free all pages in the range.
+ * test_page_isolated() can be used for test it.
  *
  * There is no high level synchronization mechanism that prevents two threads
- * from trying to isolate overlapping ranges.  If this happens, one thread
+ * from trying to isolate overlapping ranges. If this happens, one thread
  * will notice pageblocks in the overlapping range already set to isolate.
  * This happens in set_migratetype_isolate, and set_migratetype_isolate
- * returns an error.  We then clean up by restoring the migration type on
- * pageblocks we may have modified and return -EBUSY to caller.  This
+ * returns an error. We then clean up by restoring the migration type on
+ * pageblocks we may have modified and return -EBUSY to caller. This
  * prevents two threads from simultaneously working on overlapping ranges.
+ *
+ * Return: the number of isolated pageblocks on success and -EBUSY if any part
+ * of range cannot be isolated.
  */
 int start_isolate_page_range(unsigned long start_pfn, unsigned long end_pfn,
                              unsigned migratetype, int flags)
@@ -188,6 +198,7 @@ int start_isolate_page_range(unsigned long start_pfn, unsigned long end_pfn,
         unsigned long pfn;
         unsigned long undo_pfn;
         struct page *page;
+        int nr_isolate_pageblock = 0;
 
         BUG_ON(!IS_ALIGNED(start_pfn, pageblock_nr_pages));
         BUG_ON(!IS_ALIGNED(end_pfn, pageblock_nr_pages));
@@ -196,13 +207,15 @@ int start_isolate_page_range(unsigned long start_pfn, unsigned long end_pfn,
              pfn < end_pfn;
              pfn += pageblock_nr_pages) {
                 page = __first_valid_page(pfn, pageblock_nr_pages);
-                if (page &&
-                    set_migratetype_isolate(page, migratetype, flags)) {
-                        undo_pfn = pfn;
-                        goto undo;
+                if (page) {
+                        if (set_migratetype_isolate(page, migratetype, flags)) {
+                                undo_pfn = pfn;
+                                goto undo;
+                        }
+                        nr_isolate_pageblock++;
                 }
         }
-        return 0;
+        return nr_isolate_pageblock;
 undo:
         for (pfn = start_pfn;
              pfn < undo_pfn;
diff --git a/mm/slab.c b/mm/slab.c
index 28652e4218e0..329bfe67f2ca 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -2115,6 +2115,8 @@ done:
         cachep->allocflags = __GFP_COMP;
         if (flags & SLAB_CACHE_DMA)
                 cachep->allocflags |= GFP_DMA;
+        if (flags & SLAB_CACHE_DMA32)
+                cachep->allocflags |= GFP_DMA32;
         if (flags & SLAB_RECLAIM_ACCOUNT)
                 cachep->allocflags |= __GFP_RECLAIMABLE;
         cachep->size = size;
diff --git a/mm/slab.h b/mm/slab.h
index e5e6658eeacc..43ac818b8592 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -127,7 +127,8 @@ static inline slab_flags_t kmem_cache_flags(unsigned int object_size,
 
 
 /* Legal flag mask for kmem_cache_create(), for various configurations */
-#define SLAB_CORE_FLAGS (SLAB_HWCACHE_ALIGN | SLAB_CACHE_DMA | SLAB_PANIC | \
+#define SLAB_CORE_FLAGS (SLAB_HWCACHE_ALIGN | SLAB_CACHE_DMA | \
+                         SLAB_CACHE_DMA32 | SLAB_PANIC | \
                          SLAB_TYPESAFE_BY_RCU | SLAB_DEBUG_OBJECTS )
 
 #if defined(CONFIG_DEBUG_SLAB)
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 03eeb8b7b4b1..58251ba63e4a 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -53,7 +53,7 @@ static DECLARE_WORK(slab_caches_to_rcu_destroy_work,
                 SLAB_FAILSLAB | SLAB_KASAN)
 
 #define SLAB_MERGE_SAME (SLAB_RECLAIM_ACCOUNT | SLAB_CACHE_DMA | \
-                         SLAB_ACCOUNT)
+                         SLAB_CACHE_DMA32 | SLAB_ACCOUNT)
 
 /*
  * Merge control. If this is set then no merging of slab caches will occur.
diff --git a/mm/slub.c b/mm/slub.c
index 1b08fbcb7e61..d30ede89f4a6 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3589,6 +3589,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
         if (s->flags & SLAB_CACHE_DMA)
                 s->allocflags |= GFP_DMA;
 
+        if (s->flags & SLAB_CACHE_DMA32)
+                s->allocflags |= GFP_DMA32;
+
         if (s->flags & SLAB_RECLAIM_ACCOUNT)
                 s->allocflags |= __GFP_RECLAIMABLE;
 
@@ -5679,6 +5682,8 @@ static char *create_unique_id(struct kmem_cache *s)
          */
         if (s->flags & SLAB_CACHE_DMA)
                 *p++ = 'd';
+        if (s->flags & SLAB_CACHE_DMA32)
+                *p++ = 'D';
         if (s->flags & SLAB_RECLAIM_ACCOUNT)
                 *p++ = 'a';
         if (s->flags & SLAB_CONSISTENCY_CHECKS)
diff --git a/mm/sparse.c b/mm/sparse.c
index 69904aa6165b..56e057c432f9 100644
--- a/mm/sparse.c
+++ b/mm/sparse.c
@@ -567,7 +567,7 @@ void online_mem_sections(unsigned long start_pfn, unsigned long end_pfn)
 }
 
 #ifdef CONFIG_MEMORY_HOTREMOVE
-/* Mark all memory sections within the pfn range as online */
+/* Mark all memory sections within the pfn range as offline */
 void offline_mem_sections(unsigned long start_pfn, unsigned long end_pfn)
 {
         unsigned long pfn;
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 15293c2a5dd8..8d77b6ee4477 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -443,27 +443,29 @@ static int vlan_dev_fcoe_disable(struct net_device *dev)
         return rc;
 }
 
-static int vlan_dev_fcoe_get_wwn(struct net_device *dev, u64 *wwn, int type)
+static int vlan_dev_fcoe_ddp_target(struct net_device *dev, u16 xid,
+                                    struct scatterlist *sgl, unsigned int sgc)
 {
         struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
         const struct net_device_ops *ops = real_dev->netdev_ops;
-        int rc = -EINVAL;
+        int rc = 0;
+
+        if (ops->ndo_fcoe_ddp_target)
+                rc = ops->ndo_fcoe_ddp_target(real_dev, xid, sgl, sgc);
 
-        if (ops->ndo_fcoe_get_wwn)
-                rc = ops->ndo_fcoe_get_wwn(real_dev, wwn, type);
         return rc;
 }
+#endif
 
-static int vlan_dev_fcoe_ddp_target(struct net_device *dev, u16 xid,
-                                    struct scatterlist *sgl, unsigned int sgc)
+#ifdef NETDEV_FCOE_WWNN
+static int vlan_dev_fcoe_get_wwn(struct net_device *dev, u64 *wwn, int type)
 {
         struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
         const struct net_device_ops *ops = real_dev->netdev_ops;
-        int rc = 0;
-
-        if (ops->ndo_fcoe_ddp_target)
-                rc = ops->ndo_fcoe_ddp_target(real_dev, xid, sgl, sgc);
+        int rc = -EINVAL;
 
+        if (ops->ndo_fcoe_get_wwn)
+                rc = ops->ndo_fcoe_get_wwn(real_dev, wwn, type);
         return rc;
 }
 #endif
@@ -794,9 +796,11 @@ static const struct net_device_ops vlan_netdev_ops = {
         .ndo_fcoe_ddp_done      = vlan_dev_fcoe_ddp_done,
         .ndo_fcoe_enable        = vlan_dev_fcoe_enable,
         .ndo_fcoe_disable       = vlan_dev_fcoe_disable,
-        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
         .ndo_fcoe_ddp_target    = vlan_dev_fcoe_ddp_target,
 #endif
+#ifdef NETDEV_FCOE_WWNN
+        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
+#endif
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = vlan_dev_poll_controller,
         .ndo_netpoll_setup      = vlan_dev_netpoll_setup,
diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
index 13b9ab860a25..2614a9caee00 100644
--- a/net/batman-adv/bat_v_elp.c
+++ b/net/batman-adv/bat_v_elp.c
@@ -92,8 +92,10 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh)
 
                 ret = cfg80211_get_station(real_netdev, neigh->addr, &sinfo);
 
-                /* free the TID stats immediately */
-                cfg80211_sinfo_release_content(&sinfo);
+                if (!ret) {
+                        /* free the TID stats immediately */
+                        cfg80211_sinfo_release_content(&sinfo);
+                }
 
                 dev_put(real_netdev);
                 if (ret == -ENOENT) {
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index 8d6b7c9c2a7e..663a53b6d36e 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -790,6 +790,8 @@ static void batadv_bla_del_claim(struct batadv_priv *bat_priv,
                                  const u8 *mac, const unsigned short vid)
 {
         struct batadv_bla_claim search_claim, *claim;
+        struct batadv_bla_claim *claim_removed_entry;
+        struct hlist_node *claim_removed_node;
 
         ether_addr_copy(search_claim.addr, mac);
         search_claim.vid = vid;
@@ -800,10 +802,18 @@ static void batadv_bla_del_claim(struct batadv_priv *bat_priv,
         batadv_dbg(BATADV_DBG_BLA, bat_priv, "%s(): %pM, vid %d\n", __func__,
                    mac, batadv_print_vid(vid));
 
-        batadv_hash_remove(bat_priv->bla.claim_hash, batadv_compare_claim,
-                           batadv_choose_claim, claim);
-        batadv_claim_put(claim); /* reference from the hash is gone */
+        claim_removed_node = batadv_hash_remove(bat_priv->bla.claim_hash,
+                                                batadv_compare_claim,
+                                                batadv_choose_claim, claim);
+        if (!claim_removed_node)
+                goto free_claim;
 
+        /* reference from the hash is gone */
+        claim_removed_entry = hlist_entry(claim_removed_node,
+                                          struct batadv_bla_claim, hash_entry);
+        batadv_claim_put(claim_removed_entry);
+
+free_claim:
         /* don't need the reference from hash_find() anymore */
         batadv_claim_put(claim);
 }
diff --git a/net/batman-adv/sysfs.c b/net/batman-adv/sysfs.c
index ad14c8086fe7..80fc3253c336 100644
--- a/net/batman-adv/sysfs.c
+++ b/net/batman-adv/sysfs.c
@@ -1130,9 +1130,9 @@ static ssize_t batadv_store_throughput_override(struct kobject *kobj,
                                                 struct attribute *attr,
                                                 char *buff, size_t count)
 {
-        struct batadv_priv *bat_priv = batadv_kobj_to_batpriv(kobj);
         struct net_device *net_dev = batadv_kobj_to_netdev(kobj);
         struct batadv_hard_iface *hard_iface;
+        struct batadv_priv *bat_priv;
         u32 tp_override;
         u32 old_tp_override;
         bool ret;
@@ -1163,7 +1163,10 @@ static ssize_t batadv_store_throughput_override(struct kobject *kobj,
 
         atomic_set(&hard_iface->bat_v.throughput_override, tp_override);
 
-        batadv_netlink_notify_hardif(bat_priv, hard_iface);
+        if (hard_iface->soft_iface) {
+                bat_priv = netdev_priv(hard_iface->soft_iface);
+                batadv_netlink_notify_hardif(bat_priv, hard_iface);
+        }
 
 out:
         batadv_hardif_put(hard_iface);
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 5d8bf8048e4e..1ddfd5e011ee 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -603,14 +603,26 @@ static void batadv_tt_global_free(struct batadv_priv *bat_priv,
                                   struct batadv_tt_global_entry *tt_global,
                                   const char *message)
 {
+        struct batadv_tt_global_entry *tt_removed_entry;
+        struct hlist_node *tt_removed_node;
+
         batadv_dbg(BATADV_DBG_TT, bat_priv,
                    "Deleting global tt entry %pM (vid: %d): %s\n",
                    tt_global->common.addr,
                    batadv_print_vid(tt_global->common.vid), message);
 
-        batadv_hash_remove(bat_priv->tt.global_hash, batadv_compare_tt,
-                           batadv_choose_tt, &tt_global->common);
-        batadv_tt_global_entry_put(tt_global);
+        tt_removed_node = batadv_hash_remove(bat_priv->tt.global_hash,
+                                             batadv_compare_tt,
+                                             batadv_choose_tt,
+                                             &tt_global->common);
+        if (!tt_removed_node)
+                return;
+
+        /* drop reference of remove hash entry */
+        tt_removed_entry = hlist_entry(tt_removed_node,
+                                       struct batadv_tt_global_entry,
+                                       common.hash_entry);
+        batadv_tt_global_entry_put(tt_removed_entry);
 }
 
 /**
@@ -1324,9 +1336,10 @@ u16 batadv_tt_local_remove(struct batadv_priv *bat_priv, const u8 *addr,
                            unsigned short vid, const char *message,
                            bool roaming)
 {
+        struct batadv_tt_local_entry *tt_removed_entry;
         struct batadv_tt_local_entry *tt_local_entry;
         u16 flags, curr_flags = BATADV_NO_FLAGS;
-        void *tt_entry_exists;
+        struct hlist_node *tt_removed_node;
 
         tt_local_entry = batadv_tt_local_hash_find(bat_priv, addr, vid);
         if (!tt_local_entry)
@@ -1355,15 +1368,18 @@ u16 batadv_tt_local_remove(struct batadv_priv *bat_priv, const u8 *addr,
          */
         batadv_tt_local_event(bat_priv, tt_local_entry, BATADV_TT_CLIENT_DEL);
 
-        tt_entry_exists = batadv_hash_remove(bat_priv->tt.local_hash,
+        tt_removed_node = batadv_hash_remove(bat_priv->tt.local_hash,
                                              batadv_compare_tt,
                                              batadv_choose_tt,
                                              &tt_local_entry->common);
-        if (!tt_entry_exists)
+        if (!tt_removed_node)
                 goto out;
 
-        /* extra call to free the local tt entry */
-        batadv_tt_local_entry_put(tt_local_entry);
+        /* drop reference of remove hash entry */
+        tt_removed_entry = hlist_entry(tt_removed_node,
+                                       struct batadv_tt_local_entry,
+                                       common.hash_entry);
+        batadv_tt_local_entry_put(tt_removed_entry);
 
 out:
         if (tt_local_entry)
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index afef6fc2c074..8d82107c6419 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -584,6 +584,7 @@ static int br_ip4_multicast_add_group(struct net_bridge *br,
         if (ipv4_is_local_multicast(group))
                 return 0;
 
+        memset(&br_group, 0, sizeof(br_group));
         br_group.u.ip4 = group;
         br_group.proto = htons(ETH_P_IP);
         br_group.vid = vid;
@@ -1480,6 +1481,7 @@ static void br_ip4_multicast_leave_group(struct net_bridge *br,
 
         own_query = port ? &port->ip4_own_query : &br->ip4_own_query;
 
+        memset(&br_group, 0, sizeof(br_group));
         br_group.u.ip4 = group;
         br_group.proto = htons(ETH_P_IP);
         br_group.vid = vid;
@@ -1503,6 +1505,7 @@ static void br_ip6_multicast_leave_group(struct net_bridge *br,
 
         own_query = port ? &port->ip6_own_query : &br->ip6_own_query;
 
+        memset(&br_group, 0, sizeof(br_group));
         br_group.u.ip6 = *group;
         br_group.proto = htons(ETH_P_IPV6);
         br_group.vid = vid;
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 7e71b0df1fbc..3083988ce729 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -840,6 +840,7 @@ static bool ceph_msg_data_bio_advance(struct ceph_msg_data_cursor *cursor,
                                         size_t bytes)
 {
         struct ceph_bio_iter *it = &cursor->bio_iter;
+        struct page *page = bio_iter_page(it->bio, it->iter);
 
         BUG_ON(bytes > cursor->resid);
         BUG_ON(bytes > bio_iter_len(it->bio, it->iter));
@@ -851,7 +852,8 @@ static bool ceph_msg_data_bio_advance(struct ceph_msg_data_cursor *cursor,
                 return false;   /* no more data */
         }
 
-        if (!bytes || (it->iter.bi_size && it->iter.bi_bvec_done))
+        if (!bytes || (it->iter.bi_size && it->iter.bi_bvec_done &&
+                       page == bio_iter_page(it->bio, it->iter)))
                 return false;   /* more bytes to process in this segment */
 
         if (!it->iter.bi_size) {
@@ -899,6 +901,7 @@ static bool ceph_msg_data_bvecs_advance(struct ceph_msg_data_cursor *cursor,
                                         size_t bytes)
 {
         struct bio_vec *bvecs = cursor->data->bvec_pos.bvecs;
+        struct page *page = bvec_iter_page(bvecs, cursor->bvec_iter);
 
         BUG_ON(bytes > cursor->resid);
         BUG_ON(bytes > bvec_iter_len(bvecs, cursor->bvec_iter));
@@ -910,7 +913,8 @@ static bool ceph_msg_data_bvecs_advance(struct ceph_msg_data_cursor *cursor,
                 return false;   /* no more data */
         }
 
-        if (!bytes || cursor->bvec_iter.bi_bvec_done)
+        if (!bytes || (cursor->bvec_iter.bi_bvec_done &&
+                       page == bvec_iter_page(bvecs, cursor->bvec_iter)))
                 return false;   /* more bytes to process in this segment */
 
         BUG_ON(cursor->last_piece);
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 0dafec5cada0..91bb5a083fee 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -281,7 +281,7 @@ struct sk_buff *__skb_try_recv_datagram(struct sock *sk, unsigned int flags,
                         break;
 
                 sk_busy_loop(sk, flags & MSG_DONTWAIT);
-        } while (!skb_queue_empty(&sk->sk_receive_queue));
+        } while (sk->sk_receive_queue.prev != *last);
 
         error = -EAGAIN;
 
diff --git a/net/core/dev.c b/net/core/dev.c
index a95782764360..b430f851f377 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5017,8 +5017,10 @@ static inline void __netif_receive_skb_list_ptype(struct list_head *head,
         if (pt_prev->list_func != NULL)
                 pt_prev->list_func(head, pt_prev, orig_dev);
         else
-                list_for_each_entry_safe(skb, next, head, list)
+                list_for_each_entry_safe(skb, next, head, list) {
+                        skb_list_del_init(skb);
                         pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
+                }
 }
 
 static void __netif_receive_skb_list_core(struct list_head *head, bool pfmemalloc)
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 387d67eb75ab..4a593853cbf2 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1798,11 +1798,16 @@ static int ethtool_get_strings(struct net_device *dev, void __user *useraddr)
         WARN_ON_ONCE(!ret);
 
         gstrings.len = ret;
-        data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN));
-        if (gstrings.len && !data)
-                return -ENOMEM;
 
-        __ethtool_get_strings(dev, gstrings.string_set, data);
+        if (gstrings.len) {
+                data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN));
+                if (!data)
+                        return -ENOMEM;
+
+                __ethtool_get_strings(dev, gstrings.string_set, data);
+        } else {
+                data = NULL;
+        }
 
         ret = -EFAULT;
         if (copy_to_user(useraddr, &gstrings, sizeof(gstrings)))
@@ -1898,11 +1903,15 @@ static int ethtool_get_stats(struct net_device *dev, void __user *useraddr)
                 return -EFAULT;
 
         stats.n_stats = n_stats;
-        data = vzalloc(array_size(n_stats, sizeof(u64)));
-        if (n_stats && !data)
-                return -ENOMEM;
 
-        ops->get_ethtool_stats(dev, &stats, data);
+        if (n_stats) {
+                data = vzalloc(array_size(n_stats, sizeof(u64)));
+                if (!data)
+                        return -ENOMEM;
+                ops->get_ethtool_stats(dev, &stats, data);
+        } else {
+                data = NULL;
+        }
 
         ret = -EFAULT;
         if (copy_to_user(useraddr, &stats, sizeof(stats)))
@@ -1942,16 +1951,21 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr)
                 return -EFAULT;
 
         stats.n_stats = n_stats;
-        data = vzalloc(array_size(n_stats, sizeof(u64)));
-        if (n_stats && !data)
-                return -ENOMEM;
 
-        if (dev->phydev && !ops->get_ethtool_phy_stats) {
-                ret = phy_ethtool_get_stats(dev->phydev, &stats, data);
-                if (ret < 0)
-                        return ret;
+        if (n_stats) {
+                data = vzalloc(array_size(n_stats, sizeof(u64)));
+                if (!data)
+                        return -ENOMEM;
+
+                if (dev->phydev && !ops->get_ethtool_phy_stats) {
+                        ret = phy_ethtool_get_stats(dev->phydev, &stats, data);
+                        if (ret < 0)
+                                goto out;
+                } else {
+                        ops->get_ethtool_phy_stats(dev, &stats, data);
+                }
         } else {
-                ops->get_ethtool_phy_stats(dev, &stats, data);
+                data = NULL;
         }
 
         ret = -EFAULT;
diff --git a/net/core/filter.c b/net/core/filter.c
index 08b53af84132..8904e3407163 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -6862,14 +6862,8 @@ static bool flow_dissector_is_valid_access(int off, int size,
                                            const struct bpf_prog *prog,
                                            struct bpf_insn_access_aux *info)
 {
-        if (type == BPF_WRITE) {
-                switch (off) {
-                case bpf_ctx_range_till(struct __sk_buff, cb[0], cb[4]):
-                        break;
-                default:
-                        return false;
-                }
-        }
+        if (type == BPF_WRITE)
+                return false;
 
         switch (off) {
         case bpf_ctx_range(struct __sk_buff, data):
@@ -6881,11 +6875,7 @@ static bool flow_dissector_is_valid_access(int off, int size,
         case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
                 info->reg_type = PTR_TO_FLOW_KEYS;
                 break;
-        case bpf_ctx_range(struct __sk_buff, tc_classid):
-        case bpf_ctx_range(struct __sk_buff, data_meta):
-        case bpf_ctx_range_till(struct __sk_buff, family, local_port):
-        case bpf_ctx_range(struct __sk_buff, tstamp):
-        case bpf_ctx_range(struct __sk_buff, wire_len):
+        default:
                 return false;
         }
 
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index b4d581134ef2..795449713ba4 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -707,6 +707,7 @@ bool __skb_flow_bpf_dissect(struct bpf_prog *prog,
         /* Pass parameters to the BPF program */
         memset(flow_keys, 0, sizeof(*flow_keys));
         cb->qdisc_cb.flow_keys = flow_keys;
+        flow_keys->n_proto = skb->protocol;
         flow_keys->nhoff = skb_network_offset(skb);
         flow_keys->thoff = flow_keys->nhoff;
 
@@ -716,7 +717,8 @@ bool __skb_flow_bpf_dissect(struct bpf_prog *prog,
         /* Restore state */
         memcpy(cb, &cb_saved, sizeof(cb_saved));
 
-        flow_keys->nhoff = clamp_t(u16, flow_keys->nhoff, 0, skb->len);
+        flow_keys->nhoff = clamp_t(u16, flow_keys->nhoff,
+                                   skb_network_offset(skb), skb->len);
         flow_keys->thoff = clamp_t(u16, flow_keys->thoff,
                                    flow_keys->nhoff, skb->len);
 
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 17f36317363d..7e6dcc625701 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -304,6 +304,7 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
 
         refcount_set(&net->count, 1);
         refcount_set(&net->passive, 1);
+        get_random_bytes(&net->hash_mix, sizeof(u32));
         net->dev_base_seq = 1;
         net->user_ns = user_ns;
         idr_init(&net->netns_ids);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 4782f9354dd1..9901f5322852 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3800,7 +3800,7 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
         unsigned int delta_truesize;
         struct sk_buff *lp;
 
-        if (unlikely(p->len + len >= 65536))
+        if (unlikely(p->len + len >= 65536 || NAPI_GRO_CB(skb)->flush))
                 return -E2BIG;
 
         lp = NAPI_GRO_CB(p)->last;
diff --git a/net/dccp/feat.c b/net/dccp/feat.c
index f227f002c73d..db87d9f58019 100644
--- a/net/dccp/feat.c
+++ b/net/dccp/feat.c
@@ -738,7 +738,12 @@ static int __feat_register_sp(struct list_head *fn, u8 feat, u8 is_local,
         if (dccp_feat_clone_sp_val(&fval, sp_val, sp_len))
                 return -ENOMEM;
 
-        return dccp_feat_push_change(fn, feat, is_local, mandatory, &fval);
+        if (dccp_feat_push_change(fn, feat, is_local, mandatory, &fval)) {
+                kfree(fval.sp.vec);
+                return -ENOMEM;
+        }
+
+        return 0;
 }
 
 /**
diff --git a/net/dsa/tag_qca.c b/net/dsa/tag_qca.c
index ed4f6dc26365..85c22ada4744 100644
--- a/net/dsa/tag_qca.c
+++ b/net/dsa/tag_qca.c
@@ -98,8 +98,18 @@ static struct sk_buff *qca_tag_rcv(struct sk_buff *skb, struct net_device *dev,
         return skb;
 }
 
+static int qca_tag_flow_dissect(const struct sk_buff *skb, __be16 *proto,
+                                int *offset)
+{
+        *offset = QCA_HDR_LEN;
+        *proto = ((__be16 *)skb->data)[0];
+
+        return 0;
+}
+
 const struct dsa_device_ops qca_netdev_ops = {
         .xmit   = qca_tag_xmit,
         .rcv    = qca_tag_rcv,
+        .flow_dissect = qca_tag_flow_dissect,
         .overhead = QCA_HDR_LEN,
 };
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index ecce2dc78f17..1132d6d1796a 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -257,11 +257,10 @@ int ip_local_deliver(struct sk_buff *skb)
                        ip_local_deliver_finish);
 }
 
-static inline bool ip_rcv_options(struct sk_buff *skb)
+static inline bool ip_rcv_options(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_options *opt;
         const struct iphdr *iph;
-        struct net_device *dev = skb->dev;
 
         /* It looks as overkill, because not all
            IP options require packet mangling.
@@ -297,7 +296,7 @@ static inline bool ip_rcv_options(struct sk_buff *skb)
                         }
                 }
 
-                if (ip_options_rcv_srr(skb))
+                if (ip_options_rcv_srr(skb, dev))
                         goto drop;
         }
 
@@ -353,7 +352,7 @@ static int ip_rcv_finish_core(struct net *net, struct sock *sk,
         }
 #endif
 
-        if (iph->ihl > 5 && ip_rcv_options(skb))
+        if (iph->ihl > 5 && ip_rcv_options(skb, dev))
                 goto drop;
 
         rt = skb_rtable(skb);
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 32a35043c9f5..3db31bb9df50 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -612,7 +612,7 @@ void ip_forward_options(struct sk_buff *skb)
         }
 }
 
-int ip_options_rcv_srr(struct sk_buff *skb)
+int ip_options_rcv_srr(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_options *opt = &(IPCB(skb)->opt);
         int srrspace, srrptr;
@@ -647,7 +647,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
 
                 orefdst = skb->_skb_refdst;
                 skb_dst_set(skb, NULL);
-                err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, skb->dev);
+                err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, dev);
                 rt2 = skb_rtable(skb);
                 if (err || (rt2->rt_type != RTN_UNICAST && rt2->rt_type != RTN_LOCAL)) {
                         skb_dst_drop(skb);
diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
index cd4814f7e962..359da68d7c06 100644
--- a/net/ipv4/tcp_dctcp.c
+++ b/net/ipv4/tcp_dctcp.c
@@ -67,11 +67,6 @@ static unsigned int dctcp_alpha_on_init __read_mostly = DCTCP_MAX_ALPHA;
 module_param(dctcp_alpha_on_init, uint, 0644);
 MODULE_PARM_DESC(dctcp_alpha_on_init, "parameter for initial alpha value");
 
-static unsigned int dctcp_clamp_alpha_on_loss __read_mostly;
-module_param(dctcp_clamp_alpha_on_loss, uint, 0644);
-MODULE_PARM_DESC(dctcp_clamp_alpha_on_loss,
-                 "parameter for clamping alpha on loss");
-
 static struct tcp_congestion_ops dctcp_reno;
 
 static void dctcp_reset(const struct tcp_sock *tp, struct dctcp *ca)
@@ -164,21 +159,23 @@ static void dctcp_update_alpha(struct sock *sk, u32 flags)
         }
 }
 
-static void dctcp_state(struct sock *sk, u8 new_state)
+static void dctcp_react_to_loss(struct sock *sk)
 {
-        if (dctcp_clamp_alpha_on_loss && new_state == TCP_CA_Loss) {
-                struct dctcp *ca = inet_csk_ca(sk);
+        struct dctcp *ca = inet_csk_ca(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
 
-                /* If this extension is enabled, we clamp dctcp_alpha to
-                 * max on packet loss; the motivation is that dctcp_alpha
-                 * is an indicator to the extend of congestion and packet
-                 * loss is an indicator of extreme congestion; setting
-                 * this in practice turned out to be beneficial, and
-                 * effectively assumes total congestion which reduces the
-                 * window by half.
-                 */
-                ca->dctcp_alpha = DCTCP_MAX_ALPHA;
-        }
+        ca->loss_cwnd = tp->snd_cwnd;
+        tp->snd_ssthresh = max(tp->snd_cwnd >> 1U, 2U);
+}
+
+static void dctcp_state(struct sock *sk, u8 new_state)
+{
+        if (new_state == TCP_CA_Recovery &&
+            new_state != inet_csk(sk)->icsk_ca_state)
+                dctcp_react_to_loss(sk);
+        /* We handle RTO in dctcp_cwnd_event to ensure that we perform only
+         * one loss-adjustment per RTT.
+         */
 }
 
 static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
@@ -190,6 +187,9 @@ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
         case CA_EVENT_ECN_NO_CE:
                 dctcp_ece_ack_update(sk, ev, &ca->prior_rcv_nxt, &ca->ce_state);
                 break;
+        case CA_EVENT_LOSS:
+                dctcp_react_to_loss(sk);
+                break;
         default:
                 /* Don't care for the rest. */
                 break;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 3979939804b7..faa6fa619f59 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2585,7 +2585,8 @@ static void __net_exit tcp_sk_exit(struct net *net)
 {
         int cpu;
 
-        module_put(net->ipv4.tcp_congestion_control->owner);
+        if (net->ipv4.tcp_congestion_control)
+                module_put(net->ipv4.tcp_congestion_control->owner);
 
         for_each_possible_cpu(cpu)
                 inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.tcp_sk, cpu));
diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c
index 79d2e43c05c5..5fc1f4e0c0cf 100644
--- a/net/ipv6/ila/ila_xlat.c
+++ b/net/ipv6/ila/ila_xlat.c
@@ -417,6 +417,7 @@ int ila_xlat_nl_cmd_flush(struct sk_buff *skb, struct genl_info *info)
 
 done:
         rhashtable_walk_stop(&iter);
+        rhashtable_walk_exit(&iter);
         return ret;
 }
 
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index edbd12067170..e51f3c648b09 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -601,7 +601,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
                                 inet6_sk(skb->sk) : NULL;
         struct ipv6hdr *tmp_hdr;
         struct frag_hdr *fh;
-        unsigned int mtu, hlen, left, len;
+        unsigned int mtu, hlen, left, len, nexthdr_offset;
         int hroom, troom;
         __be32 frag_id;
         int ptr, offset = 0, err = 0;
@@ -612,6 +612,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
                 goto fail;
         hlen = err;
         nexthdr = *prevhdr;
+        nexthdr_offset = prevhdr - skb_network_header(skb);
 
         mtu = ip6_skb_dst_mtu(skb);
 
@@ -646,6 +647,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
             (err = skb_checksum_help(skb)))
                 goto fail;
 
+        prevhdr = skb_network_header(skb) + nexthdr_offset;
         hroom = LL_RESERVED_SPACE(rt->dst.dev);
         if (skb_has_frag_list(skb)) {
                 unsigned int first_len = skb_pagelen(skb);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 0c6403cf8b52..ade1390c6348 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -627,7 +627,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
                                            eiph->daddr, eiph->saddr, 0, 0,
                                            IPPROTO_IPIP, RT_TOS(eiph->tos), 0);
-                if (IS_ERR(rt) || rt->dst.dev->type != ARPHRD_TUNNEL) {
+                if (IS_ERR(rt) || rt->dst.dev->type != ARPHRD_TUNNEL6) {
                         if (!IS_ERR(rt))
                                 ip_rt_put(rt);
                         goto out;
@@ -636,7 +636,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         } else {
                 if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
                                    skb2->dev) ||
-                    skb_dst(skb2)->dev->type != ARPHRD_TUNNEL)
+                    skb_dst(skb2)->dev->type != ARPHRD_TUNNEL6)
                         goto out;
         }
 
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 07e21a82ce4c..b2109b74857d 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -669,6 +669,10 @@ static int ipip6_rcv(struct sk_buff *skb)
                     !net_eq(tunnel->net, dev_net(tunnel->dev))))
                         goto out;
 
+                /* skb can be uncloned in iptunnel_pull_header, so
+                 * old iph is no longer valid
+                 */
+                iph = (const struct iphdr *)skb_mac_header(skb);
                 err = IP_ECN_decapsulate(iph, skb);
                 if (unlikely(err)) {
                         if (log_ecn_error)
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index c5c5ab6c5a1c..44fdc641710d 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -2054,14 +2054,14 @@ static int __init kcm_init(void)
         if (err)
                 goto fail;
 
-        err = sock_register(&kcm_family_ops);
-        if (err)
-                goto sock_register_fail;
-
         err = register_pernet_device(&kcm_net_ops);
         if (err)
                 goto net_ops_fail;
 
+        err = sock_register(&kcm_family_ops);
+        if (err)
+                goto sock_register_fail;
+
         err = kcm_proc_init();
         if (err)
                 goto proc_init_fail;
@@ -2069,12 +2069,12 @@ static int __init kcm_init(void)
         return 0;
 
 proc_init_fail:
-        unregister_pernet_device(&kcm_net_ops);
-
-net_ops_fail:
         sock_unregister(PF_KCM);
 
 sock_register_fail:
+        unregister_pernet_device(&kcm_net_ops);
+
+net_ops_fail:
         proto_unregister(&kcm_proto);
 
 fail:
@@ -2090,8 +2090,8 @@ fail:
 static void __exit kcm_exit(void)
 {
         kcm_proc_exit();
-        unregister_pernet_device(&kcm_net_ops);
         sock_unregister(PF_KCM);
+        unregister_pernet_device(&kcm_net_ops);
         proto_unregister(&kcm_proto);
         destroy_workqueue(kcm_wq);
 
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index bd019058fc6f..3563acd5f92e 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -2331,14 +2331,14 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa,
 
         struct sw_flow_actions *acts;
         int new_acts_size;
-        int req_size = NLA_ALIGN(attr_len);
+        size_t req_size = NLA_ALIGN(attr_len);
         int next_offset = offsetof(struct sw_flow_actions, actions) +
                                         (*sfa)->actions_len;
 
         if (req_size <= (ksize(*sfa) - next_offset))
                 goto out;
 
-        new_acts_size = ksize(*sfa) * 2;
+        new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2);
 
         if (new_acts_size > MAX_ACTIONS_BUFSIZE) {
                 if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) {
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index fd2694174607..faf726e00e27 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -608,7 +608,7 @@ static void rds_tcp_kill_sock(struct net *net)
         list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
                 struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
 
-                if (net != c_net || !tc->t_sock)
+                if (net != c_net)
                         continue;
                 if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn)) {
                         list_move_tail(&tc->t_tcp_node, &tmp_list);
diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
index 4060b0955c97..0f82d50ea232 100644
--- a/net/sched/act_sample.c
+++ b/net/sched/act_sample.c
@@ -45,8 +45,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
         struct nlattr *tb[TCA_SAMPLE_MAX + 1];
         struct psample_group *psample_group;
         struct tcf_chain *goto_ch = NULL;
+        u32 psample_group_num, rate;
         struct tc_sample *parm;
-        u32 psample_group_num;
         struct tcf_sample *s;
         bool exists = false;
         int ret, err;
@@ -85,6 +85,12 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
         if (err < 0)
                 goto release_idr;
 
+        rate = nla_get_u32(tb[TCA_SAMPLE_RATE]);
+        if (!rate) {
+                NL_SET_ERR_MSG(extack, "invalid sample rate");
+                err = -EINVAL;
+                goto put_chain;
+        }
         psample_group_num = nla_get_u32(tb[TCA_SAMPLE_PSAMPLE_GROUP]);
         psample_group = psample_group_get(net, psample_group_num);
         if (!psample_group) {
@@ -96,7 +102,7 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
 
         spin_lock_bh(&s->tcf_lock);
         goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
-        s->rate = nla_get_u32(tb[TCA_SAMPLE_RATE]);
+        s->rate = rate;
         s->psample_group_num = psample_group_num;
         RCU_INIT_POINTER(s->psample_group, psample_group);
 
diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
index 459921bd3d87..a13bc351a414 100644
--- a/net/sched/cls_matchall.c
+++ b/net/sched/cls_matchall.c
@@ -130,6 +130,11 @@ static void mall_destroy(struct tcf_proto *tp, bool rtnl_held,
 
 static void *mall_get(struct tcf_proto *tp, u32 handle)
 {
+        struct cls_mall_head *head = rtnl_dereference(tp->root);
+
+        if (head && head->handle == handle)
+                return head;
+
         return NULL;
 }
 
diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
index acc9b9da985f..259d97bc2abd 100644
--- a/net/sched/sch_cake.c
+++ b/net/sched/sch_cake.c
@@ -1517,16 +1517,27 @@ static unsigned int cake_drop(struct Qdisc *sch, struct sk_buff **to_free)
 
 static u8 cake_handle_diffserv(struct sk_buff *skb, u16 wash)
 {
+        int wlen = skb_network_offset(skb);
         u8 dscp;
 
-        switch (skb->protocol) {
+        switch (tc_skb_protocol(skb)) {
         case htons(ETH_P_IP):
+                wlen += sizeof(struct iphdr);
+                if (!pskb_may_pull(skb, wlen) ||
+                    skb_try_make_writable(skb, wlen))
+                        return 0;
+
                 dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2;
                 if (wash && dscp)
                         ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, 0);
                 return dscp;
 
         case htons(ETH_P_IPV6):
+                wlen += sizeof(struct ipv6hdr);
+                if (!pskb_may_pull(skb, wlen) ||
+                    skb_try_make_writable(skb, wlen))
+                        return 0;
+
                 dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2;
                 if (wash && dscp)
                         ipv6_change_dsfield(ipv6_hdr(skb), INET_ECN_MASK, 0);
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 4dc05409e3fb..114b9048ea7e 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1358,9 +1358,11 @@ cbq_dump_class_stats(struct Qdisc *sch, unsigned long arg,
 {
         struct cbq_sched_data *q = qdisc_priv(sch);
         struct cbq_class *cl = (struct cbq_class *)arg;
+        __u32 qlen;
 
         cl->xstats.avgidle = cl->avgidle;
         cl->xstats.undertime = 0;
+        qdisc_qstats_qlen_backlog(cl->q, &qlen, &cl->qstats.backlog);
 
         if (cl->undertime != PSCHED_PASTPERFECT)
                 cl->xstats.undertime = cl->undertime - q->now;
@@ -1368,7 +1370,7 @@ cbq_dump_class_stats(struct Qdisc *sch, unsigned long arg,
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                   d, NULL, &cl->bstats) < 0 ||
             gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &cl->qstats, cl->q->q.qlen) < 0)
+            gnet_stats_copy_queue(d, NULL, &cl->qstats, qlen) < 0)
                 return -1;
 
         return gnet_stats_copy_app(d, &cl->xstats, sizeof(cl->xstats));
@@ -1665,17 +1667,13 @@ static int cbq_delete(struct Qdisc *sch, unsigned long arg)
 {
         struct cbq_sched_data *q = qdisc_priv(sch);
         struct cbq_class *cl = (struct cbq_class *)arg;
-        unsigned int qlen, backlog;
 
         if (cl->filters || cl->children || cl == &q->link)
                 return -EBUSY;
 
         sch_tree_lock(sch);
 
-        qlen = cl->q->q.qlen;
-        backlog = cl->q->qstats.backlog;
-        qdisc_reset(cl->q);
-        qdisc_tree_reduce_backlog(cl->q, qlen, backlog);
+        qdisc_purge_queue(cl->q);
 
         if (cl->next_alive)
                 cbq_deactivate_class(cl);
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 09b800991065..430df9a55ec4 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -50,15 +50,6 @@ static struct drr_class *drr_find_class(struct Qdisc *sch, u32 classid)
         return container_of(clc, struct drr_class, common);
 }
 
-static void drr_purge_queue(struct drr_class *cl)
-{
-        unsigned int len = cl->qdisc->q.qlen;
-        unsigned int backlog = cl->qdisc->qstats.backlog;
-
-        qdisc_reset(cl->qdisc);
-        qdisc_tree_reduce_backlog(cl->qdisc, len, backlog);
-}
-
 static const struct nla_policy drr_policy[TCA_DRR_MAX + 1] = {
         [TCA_DRR_QUANTUM]       = { .type = NLA_U32 },
 };
@@ -167,7 +158,7 @@ static int drr_delete_class(struct Qdisc *sch, unsigned long arg)
 
         sch_tree_lock(sch);
 
-        drr_purge_queue(cl);
+        qdisc_purge_queue(cl->qdisc);
         qdisc_class_hash_remove(&q->clhash, &cl->common);
 
         sch_tree_unlock(sch);
@@ -269,7 +260,8 @@ static int drr_dump_class_stats(struct Qdisc *sch, unsigned long arg,
                                 struct gnet_dump *d)
 {
         struct drr_class *cl = (struct drr_class *)arg;
-        __u32 qlen = cl->qdisc->q.qlen;
+        __u32 qlen = qdisc_qlen_sum(cl->qdisc);
+        struct Qdisc *cl_q = cl->qdisc;
         struct tc_drr_stats xstats;
 
         memset(&xstats, 0, sizeof(xstats));
@@ -279,7 +271,7 @@ static int drr_dump_class_stats(struct Qdisc *sch, unsigned long arg,
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                   d, NULL, &cl->bstats) < 0 ||
             gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &cl->qdisc->qstats, qlen) < 0)
+            gnet_stats_copy_queue(d, cl_q->cpu_qstats, &cl_q->qstats, qlen) < 0)
                 return -1;
 
         return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 24cc220a3218..d2ab463f22ae 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -845,16 +845,6 @@ qdisc_peek_len(struct Qdisc *sch)
 }
 
 static void
-hfsc_purge_queue(struct Qdisc *sch, struct hfsc_class *cl)
-{
-        unsigned int len = cl->qdisc->q.qlen;
-        unsigned int backlog = cl->qdisc->qstats.backlog;
-
-        qdisc_reset(cl->qdisc);
-        qdisc_tree_reduce_backlog(cl->qdisc, len, backlog);
-}
-
-static void
 hfsc_adjust_levels(struct hfsc_class *cl)
 {
         struct hfsc_class *p;
@@ -1076,7 +1066,7 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
         qdisc_class_hash_insert(&q->clhash, &cl->cl_common);
         list_add_tail(&cl->siblings, &parent->children);
         if (parent->level == 0)
-                hfsc_purge_queue(sch, parent);
+                qdisc_purge_queue(parent->qdisc);
         hfsc_adjust_levels(parent);
         sch_tree_unlock(sch);
 
@@ -1112,7 +1102,7 @@ hfsc_delete_class(struct Qdisc *sch, unsigned long arg)
         list_del(&cl->siblings);
         hfsc_adjust_levels(cl->cl_parent);
 
-        hfsc_purge_queue(sch, cl);
+        qdisc_purge_queue(cl->qdisc);
         qdisc_class_hash_remove(&q->clhash, &cl->cl_common);
 
         sch_tree_unlock(sch);
@@ -1328,8 +1318,9 @@ hfsc_dump_class_stats(struct Qdisc *sch, unsigned long arg,
 {
         struct hfsc_class *cl = (struct hfsc_class *)arg;
         struct tc_hfsc_stats xstats;
+        __u32 qlen;
 
-        cl->qstats.backlog = cl->qdisc->qstats.backlog;
+        qdisc_qstats_qlen_backlog(cl->qdisc, &qlen, &cl->qstats.backlog);
         xstats.level   = cl->level;
         xstats.period  = cl->cl_vtperiod;
         xstats.work    = cl->cl_total;
@@ -1337,7 +1328,7 @@ hfsc_dump_class_stats(struct Qdisc *sch, unsigned long arg,
 
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch), d, NULL, &cl->bstats) < 0 ||
             gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &cl->qstats, cl->qdisc->q.qlen) < 0)
+            gnet_stats_copy_queue(d, NULL, &cl->qstats, qlen) < 0)
                 return -1;
 
         return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 30f9da7e1076..2f9883b196e8 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1127,10 +1127,9 @@ htb_dump_class_stats(struct Qdisc *sch, unsigned long arg, struct gnet_dump *d)
         };
         __u32 qlen = 0;
 
-        if (!cl->level && cl->leaf.q) {
-                qlen = cl->leaf.q->q.qlen;
-                qs.backlog = cl->leaf.q->qstats.backlog;
-        }
+        if (!cl->level && cl->leaf.q)
+                qdisc_qstats_qlen_backlog(cl->leaf.q, &qlen, &qs.backlog);
+
         cl->xstats.tokens = clamp_t(s64, PSCHED_NS2TICKS(cl->tokens),
                                     INT_MIN, INT_MAX);
         cl->xstats.ctokens = clamp_t(s64, PSCHED_NS2TICKS(cl->ctokens),
@@ -1270,13 +1269,8 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
 
         sch_tree_lock(sch);
 
-        if (!cl->level) {
-                unsigned int qlen = cl->leaf.q->q.qlen;
-                unsigned int backlog = cl->leaf.q->qstats.backlog;
-
-                qdisc_reset(cl->leaf.q);
-                qdisc_tree_reduce_backlog(cl->leaf.q, qlen, backlog);
-        }
+        if (!cl->level)
+                qdisc_purge_queue(cl->leaf.q);
 
         /* delete from hash and active; remainder in destroy_class */
         qdisc_class_hash_remove(&q->clhash, &cl->common);
@@ -1404,12 +1398,8 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                                           classid, NULL);
                 sch_tree_lock(sch);
                 if (parent && !parent->level) {
-                        unsigned int qlen = parent->leaf.q->q.qlen;
-                        unsigned int backlog = parent->leaf.q->qstats.backlog;
-
                         /* turn parent into inner node */
-                        qdisc_reset(parent->leaf.q);
-                        qdisc_tree_reduce_backlog(parent->leaf.q, qlen, backlog);
+                        qdisc_purge_queue(parent->leaf.q);
                         qdisc_put(parent->leaf.q);
                         if (parent->prio_activity)
                                 htb_deactivate(q, parent);
diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
index 203659bc3906..3a3312467692 100644
--- a/net/sched/sch_mq.c
+++ b/net/sched/sch_mq.c
@@ -249,7 +249,7 @@ static int mq_dump_class_stats(struct Qdisc *sch, unsigned long cl,
 
         sch = dev_queue->qdisc_sleeping;
         if (gnet_stats_copy_basic(&sch->running, d, NULL, &sch->bstats) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &sch->qstats, sch->q.qlen) < 0)
+            qdisc_qstats_copy(d, sch) < 0)
                 return -1;
         return 0;
 }
diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index d364e63c396d..ea0dc112b38d 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -561,8 +561,7 @@ static int mqprio_dump_class_stats(struct Qdisc *sch, unsigned long cl,
                 sch = dev_queue->qdisc_sleeping;
                 if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                           d, NULL, &sch->bstats) < 0 ||
-                    gnet_stats_copy_queue(d, NULL,
-                                          &sch->qstats, sch->q.qlen) < 0)
+                    qdisc_qstats_copy(d, sch) < 0)
                         return -1;
         }
         return 0;
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
index 7410ce4d0321..35b03ae08e0f 100644
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -201,9 +201,9 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt,
         for (i = q->bands; i < q->max_bands; i++) {
                 if (q->queues[i] != &noop_qdisc) {
                         struct Qdisc *child = q->queues[i];
+
                         q->queues[i] = &noop_qdisc;
-                        qdisc_tree_reduce_backlog(child, child->q.qlen,
-                                                  child->qstats.backlog);
+                        qdisc_tree_flush_backlog(child);
                         qdisc_put(child);
                 }
         }
@@ -225,9 +225,7 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt,
                                         qdisc_hash_add(child, true);
 
                                 if (old != &noop_qdisc) {
-                                        qdisc_tree_reduce_backlog(old,
-                                                                  old->q.qlen,
-                                                                  old->qstats.backlog);
+                                        qdisc_tree_flush_backlog(old);
                                         qdisc_put(old);
                                 }
                                 sch_tree_unlock(sch);
@@ -344,7 +342,7 @@ static int multiq_dump_class_stats(struct Qdisc *sch, unsigned long cl,
         cl_q = q->queues[cl - 1];
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                   d, NULL, &cl_q->bstats) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &cl_q->qstats, cl_q->q.qlen) < 0)
+            qdisc_qstats_copy(d, cl_q) < 0)
                 return -1;
 
         return 0;
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 847141cd900f..d519b21535b3 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -216,12 +216,8 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt,
         q->bands = qopt->bands;
         memcpy(q->prio2band, qopt->priomap, TC_PRIO_MAX+1);
 
-        for (i = q->bands; i < oldbands; i++) {
-                struct Qdisc *child = q->queues[i];
-
-                qdisc_tree_reduce_backlog(child, child->q.qlen,
-                                          child->qstats.backlog);
-        }
+        for (i = q->bands; i < oldbands; i++)
+                qdisc_tree_flush_backlog(q->queues[i]);
 
         for (i = oldbands; i < q->bands; i++) {
                 q->queues[i] = queues[i];
@@ -365,7 +361,7 @@ static int prio_dump_class_stats(struct Qdisc *sch, unsigned long cl,
         cl_q = q->queues[cl - 1];
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                   d, NULL, &cl_q->bstats) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &cl_q->qstats, cl_q->q.qlen) < 0)
+            qdisc_qstats_copy(d, cl_q) < 0)
                 return -1;
 
         return 0;
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 29f5c4a24688..1589364b54da 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -217,15 +217,6 @@ static struct qfq_class *qfq_find_class(struct Qdisc *sch, u32 classid)
         return container_of(clc, struct qfq_class, common);
 }
 
-static void qfq_purge_queue(struct qfq_class *cl)
-{
-        unsigned int len = cl->qdisc->q.qlen;
-        unsigned int backlog = cl->qdisc->qstats.backlog;
-
-        qdisc_reset(cl->qdisc);
-        qdisc_tree_reduce_backlog(cl->qdisc, len, backlog);
-}
-
 static const struct nla_policy qfq_policy[TCA_QFQ_MAX + 1] = {
         [TCA_QFQ_WEIGHT] = { .type = NLA_U32 },
         [TCA_QFQ_LMAX] = { .type = NLA_U32 },
@@ -551,7 +542,7 @@ static int qfq_delete_class(struct Qdisc *sch, unsigned long arg)
 
         sch_tree_lock(sch);
 
-        qfq_purge_queue(cl);
+        qdisc_purge_queue(cl->qdisc);
         qdisc_class_hash_remove(&q->clhash, &cl->common);
 
         sch_tree_unlock(sch);
@@ -655,8 +646,7 @@ static int qfq_dump_class_stats(struct Qdisc *sch, unsigned long arg,
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                   d, NULL, &cl->bstats) < 0 ||
             gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
-            gnet_stats_copy_queue(d, NULL,
-                                  &cl->qdisc->qstats, cl->qdisc->q.qlen) < 0)
+            qdisc_qstats_copy(d, cl->qdisc) < 0)
                 return -1;
 
         return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 9df9942340ea..4e8c0abf6194 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -233,8 +233,7 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt,
         q->flags = ctl->flags;
         q->limit = ctl->limit;
         if (child) {
-                qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen,
-                                          q->qdisc->qstats.backlog);
+                qdisc_tree_flush_backlog(q->qdisc);
                 old_child = q->qdisc;
                 q->qdisc = child;
         }
diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
index bab506b01a32..2419fdb75966 100644
--- a/net/sched/sch_sfb.c
+++ b/net/sched/sch_sfb.c
@@ -521,8 +521,7 @@ static int sfb_change(struct Qdisc *sch, struct nlattr *opt,
                 qdisc_hash_add(child, true);
         sch_tree_lock(sch);
 
-        qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen,
-                                  q->qdisc->qstats.backlog);
+        qdisc_tree_flush_backlog(q->qdisc);
         qdisc_put(q->qdisc);
         q->qdisc = child;
 
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index 206e4dbed12f..c7041999eb5d 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -895,7 +895,7 @@ static int taprio_dump_class_stats(struct Qdisc *sch, unsigned long cl,
 
         sch = dev_queue->qdisc_sleeping;
         if (gnet_stats_copy_basic(&sch->running, d, NULL, &sch->bstats) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &sch->qstats, sch->q.qlen) < 0)
+            qdisc_qstats_copy(d, sch) < 0)
                 return -1;
         return 0;
 }
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 7f272a9070c5..f71578dbb9e3 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -391,8 +391,7 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt,
 
         sch_tree_lock(sch);
         if (child) {
-                qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen,
-                                          q->qdisc->qstats.backlog);
+                qdisc_tree_flush_backlog(q->qdisc);
                 qdisc_put(q->qdisc);
                 q->qdisc = child;
         }
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 6abc8b274270..951afdeea5e9 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -600,6 +600,7 @@ out:
 static int sctp_v4_addr_to_user(struct sctp_sock *sp, union sctp_addr *addr)
 {
         /* No address mapping for V4 sockets */
+        memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
         return sizeof(struct sockaddr_in);
 }
 
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 4ad3586da8f0..340a6e7c43a7 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -267,8 +267,14 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
         if (msg->rep_type)
                 tipc_tlv_init(msg->rep, msg->rep_type);
 
-        if (cmd->header)
-                (*cmd->header)(msg);
+        if (cmd->header) {
+                err = (*cmd->header)(msg);
+                if (err) {
+                        kfree_skb(msg->rep);
+                        msg->rep = NULL;
+                        return err;
+                }
+        }
 
         arg = nlmsg_new(0, GFP_KERNEL);
         if (!arg) {
@@ -397,7 +403,12 @@ static int tipc_nl_compat_bearer_enable(struct tipc_nl_compat_cmd_doit *cmd,
         if (!bearer)
                 return -EMSGSIZE;
 
-        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME);
+        len = TLV_GET_DATA_LEN(msg->req);
+        len -= offsetof(struct tipc_bearer_config, name);
+        if (len <= 0)
+                return -EINVAL;
+
+        len = min_t(int, len, TIPC_MAX_BEARER_NAME);
         if (!string_is_valid(b->name, len))
                 return -EINVAL;
 
@@ -766,7 +777,12 @@ static int tipc_nl_compat_link_set(struct tipc_nl_compat_cmd_doit *cmd,
 
         lc = (struct tipc_link_config *)TLV_DATA(msg->req);
 
-        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+        len = TLV_GET_DATA_LEN(msg->req);
+        len -= offsetof(struct tipc_link_config, name);
+        if (len <= 0)
+                return -EINVAL;
+
+        len = min_t(int, len, TIPC_MAX_LINK_NAME);
         if (!string_is_valid(lc->name, len))
                 return -EINVAL;
 
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 4f821edeeae6..4741edf4bb1e 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -1497,6 +1497,8 @@ static int decrypt_skb_update(struct sock *sk, struct sk_buff *skb,
 
                                 return err;
                         }
+                } else {
+                        *zc = false;
                 }
 
                 rxm->full_len -= padding_length(ctx, tls_ctx, skb);
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index 2554a15ecf2b..76ca30cc4791 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -199,11 +199,8 @@ sub_cmd_record_mcount = perl $(srctree)/scripts/recordmcount.pl "$(ARCH)" \
         "$(if $(part-of-module),1,0)" "$(@)";
 recordmcount_source := $(srctree)/scripts/recordmcount.pl
 endif # BUILD_C_RECORDMCOUNT
-cmd_record_mcount =                                             \
-        if [ "$(findstring $(CC_FLAGS_FTRACE),$(_c_flags))" =   \
-             "$(CC_FLAGS_FTRACE)" ]; then                       \
-                $(sub_cmd_record_mcount)                        \
-        fi
+cmd_record_mcount = $(if $(findstring $(strip $(CC_FLAGS_FTRACE)),$(_c_flags)), \
+        $(sub_cmd_record_mcount))
 endif # CC_USING_RECORD_MCOUNT
 endif # CONFIG_FTRACE_MCOUNT_RECORD
 
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 5b756278df13..a09333fd7cef 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -5977,7 +5977,7 @@ sub process {
                                 while ($fmt =~ /(\%[\*\d\.]*p(\w))/g) {
                                         $specifier = $1;
                                         $extension = $2;
-                                        if ($extension !~ /[SsBKRraEhMmIiUDdgVCbGNOx]/) {
+                                        if ($extension !~ /[SsBKRraEhMmIiUDdgVCbGNOxt]/) {
                                                 $bad_specifier = $specifier;
                                                 last;
                                         }
diff --git a/scripts/coccinelle/free/put_device.cocci b/scripts/coccinelle/free/put_device.cocci
index 7395697e7f19..c9f071b0a0ab 100644
--- a/scripts/coccinelle/free/put_device.cocci
+++ b/scripts/coccinelle/free/put_device.cocci
@@ -32,6 +32,7 @@ if (id == NULL || ...) { ... return ...; }
 (    id
 |    (T2)dev_get_drvdata(&id->dev)
 |    (T3)platform_get_drvdata(id)
+|    &id->dev
 );
 | return@p2 ...;
 )
diff --git a/scripts/coccinelle/misc/badty.cocci b/scripts/coccinelle/misc/badty.cocci
index 481cf301ccfc..08470362199c 100644
--- a/scripts/coccinelle/misc/badty.cocci
+++ b/scripts/coccinelle/misc/badty.cocci
@@ -1,4 +1,4 @@
-/// Use ARRAY_SIZE instead of dividing sizeof array with sizeof an element
+/// Correct the size argument to alloc functions
 ///
 //# This makes an effort to find cases where the argument to sizeof is wrong
 //# in memory allocation functions by checking the type of the allocated memory
diff --git a/scripts/kconfig/lxdialog/inputbox.c b/scripts/kconfig/lxdialog/inputbox.c
index 611945611bf8..1dcfb288ee63 100644
--- a/scripts/kconfig/lxdialog/inputbox.c
+++ b/scripts/kconfig/lxdialog/inputbox.c
@@ -113,7 +113,8 @@ do_resize:
                         case KEY_DOWN:
                                 break;
                         case KEY_BACKSPACE:
-                        case 127:
+                        case 8:   /* ^H */
+                        case 127: /* ^? */
                                 if (pos) {
                                         wattrset(dialog, dlg.inputbox.atr);
                                         if (input_x == 0) {
diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c
index a4670f4e825a..ac92c0ded6c5 100644
--- a/scripts/kconfig/nconf.c
+++ b/scripts/kconfig/nconf.c
@@ -1048,7 +1048,7 @@ static int do_match(int key, struct match_state *state, int *ans)
                 state->match_direction = FIND_NEXT_MATCH_UP;
                 *ans = get_mext_match(state->pattern,
                                 state->match_direction);
-        } else if (key == KEY_BACKSPACE || key == 127) {
+        } else if (key == KEY_BACKSPACE || key == 8 || key == 127) {
                 state->pattern[strlen(state->pattern)-1] = '\0';
                 adj_match_dir(&state->match_direction);
         } else
diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c
index 7be620a1fcdb..77f525a8617c 100644
--- a/scripts/kconfig/nconf.gui.c
+++ b/scripts/kconfig/nconf.gui.c
@@ -439,7 +439,8 @@ int dialog_inputbox(WINDOW *main_window,
                 case KEY_F(F_EXIT):
                 case KEY_F(F_BACK):
                         break;
-                case 127:
+                case 8:   /* ^H */
+                case 127: /* ^? */
                 case KEY_BACKSPACE:
                         if (cursor_position > 0) {
                                 memmove(&result[cursor_position-1],
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 0b0d1080b1c5..f277e116e0eb 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -639,7 +639,7 @@ static void handle_modversions(struct module *mod, struct elf_info *info,
                                info->sechdrs[sym->st_shndx].sh_offset -
                                (info->hdr->e_type != ET_REL ?
                                 info->sechdrs[sym->st_shndx].sh_addr : 0);
-                        crc = *crcp;
+                        crc = TO_NATIVE(*crcp);
                 }
                 sym_update_crc(symname + strlen("__crc_"), mod, crc,
                                 export);
diff --git a/security/Kconfig b/security/Kconfig
index 1d6463fb1450..353cfef71d4e 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -239,8 +239,46 @@ source "security/safesetid/Kconfig"
 
 source "security/integrity/Kconfig"
 
+choice
+        prompt "First legacy 'major LSM' to be initialized"
+        default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
+        default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
+        default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
+        default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
+        default DEFAULT_SECURITY_DAC
+
+        help
+          This choice is there only for converting CONFIG_DEFAULT_SECURITY
+          in old kernel configs to CONFIG_LSM in new kernel configs. Don't
+          change this choice unless you are creating a fresh kernel config,
+          for this choice will be ignored after CONFIG_LSM has been set.
+
+          Selects the legacy "major security module" that will be
+          initialized first. Overridden by non-default CONFIG_LSM.
+
+        config DEFAULT_SECURITY_SELINUX
+                bool "SELinux" if SECURITY_SELINUX=y
+
+        config DEFAULT_SECURITY_SMACK
+                bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
+
+        config DEFAULT_SECURITY_TOMOYO
+                bool "TOMOYO" if SECURITY_TOMOYO=y
+
+        config DEFAULT_SECURITY_APPARMOR
+                bool "AppArmor" if SECURITY_APPARMOR=y
+
+        config DEFAULT_SECURITY_DAC
+                bool "Unix Discretionary Access Controls"
+
+endchoice
+
 config LSM
         string "Ordered list of enabled LSMs"
+        default "yama,loadpin,safesetid,integrity,smack,selinux,tomoyo,apparmor" if DEFAULT_SECURITY_SMACK
+        default "yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo" if DEFAULT_SECURITY_APPARMOR
+        default "yama,loadpin,safesetid,integrity,tomoyo" if DEFAULT_SECURITY_TOMOYO
+        default "yama,loadpin,safesetid,integrity" if DEFAULT_SECURITY_DAC
         default "yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor"
         help
           A comma-separated list of LSMs, in initialization order.
diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
index 57cc60722dd3..efac68556b45 100644
--- a/security/yama/yama_lsm.c
+++ b/security/yama/yama_lsm.c
@@ -206,7 +206,7 @@ static void yama_ptracer_del(struct task_struct *tracer,
  * yama_task_free - check for task_pid to remove from exception list
  * @task: task being removed
  */
-void yama_task_free(struct task_struct *task)
+static void yama_task_free(struct task_struct *task)
 {
         yama_ptracer_del(task, task);
 }
@@ -222,7 +222,7 @@ void yama_task_free(struct task_struct *task)
  * Return 0 on success, -ve on error.  -ENOSYS is returned when Yama
  * does not handle the given option.
  */
-int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3,
+static int yama_task_prctl(int option, unsigned long arg2, unsigned long arg3,
                            unsigned long arg4, unsigned long arg5)
 {
         int rc = -ENOSYS;
@@ -401,7 +401,7 @@ static int yama_ptrace_access_check(struct task_struct *child,
  *
  * Returns 0 if following the ptrace is allowed, -ve on error.
  */
-int yama_ptrace_traceme(struct task_struct *parent)
+static int yama_ptrace_traceme(struct task_struct *parent)
 {
         int rc = 0;
 
@@ -452,7 +452,7 @@ static int yama_dointvec_minmax(struct ctl_table *table, int write,
 static int zero;
 static int max_scope = YAMA_SCOPE_NO_ATTACH;
 
-struct ctl_path yama_sysctl_path[] = {
+static struct ctl_path yama_sysctl_path[] = {
         { .procname = "kernel", },
         { .procname = "yama", },
         { }
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index d5b0d7ba83c4..f6ae68017608 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -940,6 +940,28 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
         oss_frame_size = snd_pcm_format_physical_width(params_format(params)) *
                          params_channels(params) / 8;
 
+        err = snd_pcm_oss_period_size(substream, params, sparams);
+        if (err < 0)
+                goto failure;
+
+        n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size);
+        err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL);
+        if (err < 0)
+                goto failure;
+
+        err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS,
+                                     runtime->oss.periods, NULL);
+        if (err < 0)
+                goto failure;
+
+        snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
+
+        err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams);
+        if (err < 0) {
+                pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err);
+                goto failure;
+        }
+
 #ifdef CONFIG_SND_PCM_OSS_PLUGINS
         snd_pcm_oss_plugin_clear(substream);
         if (!direct) {
@@ -974,27 +996,6 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
         }
 #endif
 
-        err = snd_pcm_oss_period_size(substream, params, sparams);
-        if (err < 0)
-                goto failure;
-
-        n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size);
-        err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL);
-        if (err < 0)
-                goto failure;
-
-        err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS,
-                                     runtime->oss.periods, NULL);
-        if (err < 0)
-                goto failure;
-
-        snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
-
-        if ((err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams)) < 0) {
-                pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err);
-                goto failure;
-        }
-
         if (runtime->oss.trigger) {
                 sw_params->start_threshold = 1;
         } else {
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index f731f904e8cc..1d8452912b14 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1445,8 +1445,15 @@ static int snd_pcm_pause(struct snd_pcm_substream *substream, int push)
 static int snd_pcm_pre_suspend(struct snd_pcm_substream *substream, int state)
 {
         struct snd_pcm_runtime *runtime = substream->runtime;
-        if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED)
+        switch (runtime->status->state) {
+        case SNDRV_PCM_STATE_SUSPENDED:
                 return -EBUSY;
+        /* unresumable PCM state; return -EBUSY for skipping suspend */
+        case SNDRV_PCM_STATE_OPEN:
+        case SNDRV_PCM_STATE_SETUP:
+        case SNDRV_PCM_STATE_DISCONNECTED:
+                return -EBUSY;
+        }
         runtime->trigger_master = substream;
         return 0;
 }
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index ee601d7f0926..c0690d1ecd55 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -30,6 +30,7 @@
 #include <linux/module.h>
 #include <linux/delay.h>
 #include <linux/mm.h>
+#include <linux/nospec.h>
 #include <sound/rawmidi.h>
 #include <sound/info.h>
 #include <sound/control.h>
@@ -601,6 +602,7 @@ static int __snd_rawmidi_info_select(struct snd_card *card,
                 return -ENXIO;
         if (info->stream < 0 || info->stream > 1)
                 return -EINVAL;
+        info->stream = array_index_nospec(info->stream, 2);
         pstr = &rmidi->streams[info->stream];
         if (pstr->substream_count == 0)
                 return -ENOENT;
diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
index 278ebb993122..c93945917235 100644
--- a/sound/core/seq/oss/seq_oss_synth.c
+++ b/sound/core/seq/oss/seq_oss_synth.c
@@ -617,13 +617,14 @@ int
 snd_seq_oss_synth_make_info(struct seq_oss_devinfo *dp, int dev, struct synth_info *inf)
 {
         struct seq_oss_synth *rec;
+        struct seq_oss_synthinfo *info = get_synthinfo_nospec(dp, dev);
 
-        if (dev < 0 || dev >= dp->max_synthdev)
+        if (!info)
                 return -ENXIO;
 
-        if (dp->synths[dev].is_midi) {
+        if (info->is_midi) {
                 struct midi_info minf;
-                snd_seq_oss_midi_make_info(dp, dp->synths[dev].midi_mapped, &minf);
+                snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf);
                 inf->synth_type = SYNTH_TYPE_MIDI;
                 inf->synth_subtype = 0;
                 inf->nr_voices = 16;
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index 29882bda7632..e1ebc6d5f382 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -1005,7 +1005,6 @@ struct ca0132_spec {
         unsigned int scp_resp_header;
         unsigned int scp_resp_data[4];
         unsigned int scp_resp_count;
-        bool alt_firmware_present;
         bool startup_check_entered;
         bool dsp_reload;
 
@@ -7518,7 +7517,7 @@ static bool ca0132_download_dsp_images(struct hda_codec *codec)
         bool dsp_loaded = false;
         struct ca0132_spec *spec = codec->spec;
         const struct dsp_image_seg *dsp_os_image;
-        const struct firmware *fw_entry;
+        const struct firmware *fw_entry = NULL;
         /*
          * Alternate firmwares for different variants. The Recon3Di apparently
          * can use the default firmware, but I'll leave the option in case
@@ -7529,33 +7528,26 @@ static bool ca0132_download_dsp_images(struct hda_codec *codec)
         case QUIRK_R3D:
         case QUIRK_AE5:
                 if (request_firmware(&fw_entry, DESKTOP_EFX_FILE,
-                                        codec->card->dev) != 0) {
+                                        codec->card->dev) != 0)
                         codec_dbg(codec, "Desktop firmware not found.");
-                        spec->alt_firmware_present = false;
-                } else {
+                else
                         codec_dbg(codec, "Desktop firmware selected.");
-                        spec->alt_firmware_present = true;
-                }
                 break;
         case QUIRK_R3DI:
                 if (request_firmware(&fw_entry, R3DI_EFX_FILE,
-                                        codec->card->dev) != 0) {
+                                        codec->card->dev) != 0)
                         codec_dbg(codec, "Recon3Di alt firmware not detected.");
-                        spec->alt_firmware_present = false;
-                } else {
+                else
                         codec_dbg(codec, "Recon3Di firmware selected.");
-                        spec->alt_firmware_present = true;
-                }
                 break;
         default:
-                spec->alt_firmware_present = false;
                 break;
         }
         /*
          * Use default ctefx.bin if no alt firmware is detected, or if none
          * exists for your particular codec.
          */
-        if (!spec->alt_firmware_present) {
+        if (!fw_entry) {
                 codec_dbg(codec, "Default firmware selected.");
                 if (request_firmware(&fw_entry, EFX_FILE,
                                         codec->card->dev) != 0)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 191830d4fa40..a3fb3d4c5730 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5688,6 +5688,8 @@ enum {
         ALC225_FIXUP_WYSE_AUTO_MUTE,
         ALC225_FIXUP_WYSE_DISABLE_MIC_VREF,
         ALC286_FIXUP_ACER_AIO_HEADSET_MIC,
+        ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
+        ALC299_FIXUP_PREDATOR_SPK,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -6696,6 +6698,22 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE
         },
+        [ALC256_FIXUP_ASUS_MIC_NO_PRESENCE] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x19, 0x04a11120 }, /* use as headset mic, without its own jack detect */
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
+        },
+        [ALC299_FIXUP_PREDATOR_SPK] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x21, 0x90170150 }, /* use as headset mic, without its own jack detect */
+                        { }
+                }
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6712,9 +6730,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
         SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK),
+        SND_PCI_QUIRK(0x1025, 0x1099, "Acer Aspire E5-523G", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1025, 0x110e, "Acer Aspire ES1-432", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1025, 0x1246, "Acer Predator Helios 500", ALC299_FIXUP_PREDATOR_SPK),
         SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
         SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
         SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+        SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
         SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
         SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
         SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
@@ -7111,6 +7133,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
         {.id = ALC255_FIXUP_DELL_HEADSET_MIC, .name = "alc255-dell-headset"},
         {.id = ALC295_FIXUP_HP_X360, .name = "alc295-hp-x360"},
         {.id = ALC295_FIXUP_CHROME_BOOK, .name = "alc-sense-combo"},
+        {.id = ALC299_FIXUP_PREDATOR_SPK, .name = "predator-spk"},
         {}
 };
 #define ALC225_STANDARD_PINS \
@@ -7331,6 +7354,18 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x14, 0x90170110},
                 {0x1b, 0x90a70130},
                 {0x21, 0x03211020}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
+                {0x12, 0x90a60130},
+                {0x14, 0x90170110},
+                {0x21, 0x03211020}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
+                {0x12, 0x90a60130},
+                {0x14, 0x90170110},
+                {0x21, 0x04211020}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
+                {0x1a, 0x90a70130},
+                {0x1b, 0x90170110},
+                {0x21, 0x03211020}),
         SND_HDA_PIN_QUIRK(0x10ec0274, 0x1028, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
                 {0x12, 0xb7a60130},
                 {0x13, 0xb8a61140},
diff --git a/tools/arch/alpha/include/uapi/asm/mman.h b/tools/arch/alpha/include/uapi/asm/mman.h
index c317d3e6867a..ea6a255ae61f 100644
--- a/tools/arch/alpha/include/uapi/asm/mman.h
+++ b/tools/arch/alpha/include/uapi/asm/mman.h
@@ -27,8 +27,6 @@
 #define MAP_NONBLOCK    0x40000
 #define MAP_NORESERVE   0x10000
 #define MAP_POPULATE    0x20000
-#define MAP_PRIVATE     0x02
-#define MAP_SHARED      0x01
 #define MAP_STACK       0x80000
 #define PROT_EXEC       0x4
 #define PROT_GROWSDOWN  0x01000000
diff --git a/tools/arch/mips/include/uapi/asm/mman.h b/tools/arch/mips/include/uapi/asm/mman.h
index de2206883abc..c8acaa138d46 100644
--- a/tools/arch/mips/include/uapi/asm/mman.h
+++ b/tools/arch/mips/include/uapi/asm/mman.h
@@ -28,8 +28,6 @@
 #define MAP_NONBLOCK    0x20000
 #define MAP_NORESERVE   0x0400
 #define MAP_POPULATE    0x10000
-#define MAP_PRIVATE     0x002
-#define MAP_SHARED      0x001
 #define MAP_STACK       0x40000
 #define PROT_EXEC       0x04
 #define PROT_GROWSDOWN  0x01000000
diff --git a/tools/arch/parisc/include/uapi/asm/mman.h b/tools/arch/parisc/include/uapi/asm/mman.h
index 1bd78758bde9..f9fd1325f5bd 100644
--- a/tools/arch/parisc/include/uapi/asm/mman.h
+++ b/tools/arch/parisc/include/uapi/asm/mman.h
@@ -27,8 +27,6 @@
 #define MAP_NONBLOCK    0x20000
 #define MAP_NORESERVE   0x4000
 #define MAP_POPULATE    0x10000
-#define MAP_PRIVATE     0x02
-#define MAP_SHARED      0x01
 #define MAP_STACK       0x40000
 #define PROT_EXEC       0x4
 #define PROT_GROWSDOWN  0x01000000
diff --git a/tools/arch/powerpc/include/uapi/asm/kvm.h b/tools/arch/powerpc/include/uapi/asm/kvm.h
index 8c876c166ef2..26ca425f4c2c 100644
--- a/tools/arch/powerpc/include/uapi/asm/kvm.h
+++ b/tools/arch/powerpc/include/uapi/asm/kvm.h
@@ -463,10 +463,12 @@ struct kvm_ppc_cpu_char {
 #define KVM_PPC_CPU_CHAR_BR_HINT_HONOURED       (1ULL << 58)
 #define KVM_PPC_CPU_CHAR_MTTRIG_THR_RECONF      (1ULL << 57)
 #define KVM_PPC_CPU_CHAR_COUNT_CACHE_DIS        (1ULL << 56)
+#define KVM_PPC_CPU_CHAR_BCCTR_FLUSH_ASSIST     (1ull << 54)
 
 #define KVM_PPC_CPU_BEHAV_FAVOUR_SECURITY       (1ULL << 63)
 #define KVM_PPC_CPU_BEHAV_L1D_FLUSH_PR          (1ULL << 62)
 #define KVM_PPC_CPU_BEHAV_BNDS_CHK_SPEC_BAR     (1ULL << 61)
+#define KVM_PPC_CPU_BEHAV_FLUSH_COUNT_CACHE     (1ull << 58)
 
 /* Per-vcpu XICS interrupt controller state */
 #define KVM_REG_PPC_ICP_STATE   (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0x8c)
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index 6d6122524711..981ff9479648 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -344,6 +344,7 @@
 /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */
 #define X86_FEATURE_AVX512_4VNNIW       (18*32+ 2) /* AVX-512 Neural Network Instructions */
 #define X86_FEATURE_AVX512_4FMAPS       (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */
+#define X86_FEATURE_TSX_FORCE_ABORT     (18*32+13) /* "" TSX_FORCE_ABORT */
 #define X86_FEATURE_PCONFIG             (18*32+18) /* Intel PCONFIG */
 #define X86_FEATURE_SPEC_CTRL           (18*32+26) /* "" Speculation Control (IBRS + IBPB) */
 #define X86_FEATURE_INTEL_STIBP         (18*32+27) /* "" Single Thread Indirect Branch Predictors */
diff --git a/tools/arch/xtensa/include/uapi/asm/mman.h b/tools/arch/xtensa/include/uapi/asm/mman.h
index 34dde6f44dae..f2b08c990afc 100644
--- a/tools/arch/xtensa/include/uapi/asm/mman.h
+++ b/tools/arch/xtensa/include/uapi/asm/mman.h
@@ -27,8 +27,6 @@
 #define MAP_NONBLOCK    0x20000
 #define MAP_NORESERVE   0x0400
 #define MAP_POPULATE    0x10000
-#define MAP_PRIVATE     0x002
-#define MAP_SHARED      0x001
 #define MAP_STACK       0x40000
 #define PROT_EXEC       0x4
 #define PROT_GROWSDOWN  0x01000000
diff --git a/tools/build/feature/test-libopencsd.c b/tools/build/feature/test-libopencsd.c
index d68eb4fb40cc..2b0e02c38870 100644
--- a/tools/build/feature/test-libopencsd.c
+++ b/tools/build/feature/test-libopencsd.c
@@ -4,9 +4,9 @@
 /*
  * Check OpenCSD library version is sufficient to provide required features
  */
-#define OCSD_MIN_VER ((0 << 16) | (10 << 8) | (0))
+#define OCSD_MIN_VER ((0 << 16) | (11 << 8) | (0))
 #if !defined(OCSD_VER_NUM) || (OCSD_VER_NUM < OCSD_MIN_VER)
-#error "OpenCSD >= 0.10.0 is required"
+#error "OpenCSD >= 0.11.0 is required"
 #endif
 
 int main(void)
diff --git a/tools/include/uapi/asm-generic/mman-common-tools.h b/tools/include/uapi/asm-generic/mman-common-tools.h
new file mode 100644
index 000000000000..af7d0d3a3182
--- /dev/null
+++ b/tools/include/uapi/asm-generic/mman-common-tools.h
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_GENERIC_MMAN_COMMON_TOOLS_ONLY_H
+#define __ASM_GENERIC_MMAN_COMMON_TOOLS_ONLY_H
+
+#include <asm-generic/mman-common.h>
+
+/* We need this because we need to have tools/include/uapi/ included in the tools
+ * header search path to get access to stuff that is not yet in the system's
+ * copy of the files in that directory, but since this cset:
+ *
+ *     746c9398f5ac ("arch: move common mmap flags to linux/mman.h")
+ *
+ * We end up making sys/mman.h, that is in the system headers, to not find the
+ * MAP_SHARED and MAP_PRIVATE defines because they are not anymore in our copy
+ * of asm-generic/mman-common.h. So we define them here and include this header
+ * from each of the per arch mman.h headers.
+ */
+#ifndef MAP_SHARED
+#define MAP_SHARED      0x01            /* Share changes */
+#define MAP_PRIVATE     0x02            /* Changes are private */
+#define MAP_SHARED_VALIDATE 0x03        /* share + validate extension flags */
+#endif
+#endif // __ASM_GENERIC_MMAN_COMMON_TOOLS_ONLY_H
diff --git a/tools/include/uapi/asm-generic/mman-common.h b/tools/include/uapi/asm-generic/mman-common.h
index e7ee32861d51..abd238d0f7a4 100644
--- a/tools/include/uapi/asm-generic/mman-common.h
+++ b/tools/include/uapi/asm-generic/mman-common.h
@@ -15,9 +15,7 @@
 #define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
 #define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
 
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_SHARED_VALIDATE 0x03        /* share + validate extension flags */
+/* 0x01 - 0x03 are defined in linux/mman.h */
 #define MAP_TYPE        0x0f            /* Mask for type of mapping */
 #define MAP_FIXED       0x10            /* Interpret addr exactly */
 #define MAP_ANONYMOUS   0x20            /* don't use a file */
diff --git a/tools/include/uapi/asm-generic/mman.h b/tools/include/uapi/asm-generic/mman.h
index 653687d9771b..36c197fc44a0 100644
--- a/tools/include/uapi/asm-generic/mman.h
+++ b/tools/include/uapi/asm-generic/mman.h
@@ -2,7 +2,7 @@
 #ifndef __ASM_GENERIC_MMAN_H
 #define __ASM_GENERIC_MMAN_H
 
-#include <asm-generic/mman-common.h>
+#include <asm-generic/mman-common-tools.h>
 
 #define MAP_GROWSDOWN   0x0100          /* stack-like segment */
 #define MAP_DENYWRITE   0x0800          /* ETXTBSY */
diff --git a/tools/include/uapi/asm-generic/unistd.h b/tools/include/uapi/asm-generic/unistd.h
index 12cdf611d217..dee7292e1df6 100644
--- a/tools/include/uapi/asm-generic/unistd.h
+++ b/tools/include/uapi/asm-generic/unistd.h
@@ -824,8 +824,17 @@ __SYSCALL(__NR_futex_time64, sys_futex)
 __SYSCALL(__NR_sched_rr_get_interval_time64, sys_sched_rr_get_interval)
 #endif
 
+#define __NR_pidfd_send_signal 424
+__SYSCALL(__NR_pidfd_send_signal, sys_pidfd_send_signal)
+#define __NR_io_uring_setup 425
+__SYSCALL(__NR_io_uring_setup, sys_io_uring_setup)
+#define __NR_io_uring_enter 426
+__SYSCALL(__NR_io_uring_enter, sys_io_uring_enter)
+#define __NR_io_uring_register 427
+__SYSCALL(__NR_io_uring_register, sys_io_uring_register)
+
 #undef __NR_syscalls
-#define __NR_syscalls 424
+#define __NR_syscalls 428
 
 /*
  * 32 bit systems traditionally used different
diff --git a/tools/include/uapi/drm/i915_drm.h b/tools/include/uapi/drm/i915_drm.h
index 298b2e197744..397810fa2d33 100644
--- a/tools/include/uapi/drm/i915_drm.h
+++ b/tools/include/uapi/drm/i915_drm.h
@@ -1486,9 +1486,73 @@ struct drm_i915_gem_context_param {
 #define   I915_CONTEXT_MAX_USER_PRIORITY        1023 /* inclusive */
 #define   I915_CONTEXT_DEFAULT_PRIORITY         0
 #define   I915_CONTEXT_MIN_USER_PRIORITY        -1023 /* inclusive */
+        /*
+         * When using the following param, value should be a pointer to
+         * drm_i915_gem_context_param_sseu.
+         */
+#define I915_CONTEXT_PARAM_SSEU         0x7
         __u64 value;
 };
 
+/**
+ * Context SSEU programming
+ *
+ * It may be necessary for either functional or performance reason to configure
+ * a context to run with a reduced number of SSEU (where SSEU stands for Slice/
+ * Sub-slice/EU).
+ *
+ * This is done by configuring SSEU configuration using the below
+ * @struct drm_i915_gem_context_param_sseu for every supported engine which
+ * userspace intends to use.
+ *
+ * Not all GPUs or engines support this functionality in which case an error
+ * code -ENODEV will be returned.
+ *
+ * Also, flexibility of possible SSEU configuration permutations varies between
+ * GPU generations and software imposed limitations. Requesting such a
+ * combination will return an error code of -EINVAL.
+ *
+ * NOTE: When perf/OA is active the context's SSEU configuration is ignored in
+ * favour of a single global setting.
+ */
+struct drm_i915_gem_context_param_sseu {
+        /*
+         * Engine class & instance to be configured or queried.
+         */
+        __u16 engine_class;
+        __u16 engine_instance;
+
+        /*
+         * Unused for now. Must be cleared to zero.
+         */
+        __u32 flags;
+
+        /*
+         * Mask of slices to enable for the context. Valid values are a subset
+         * of the bitmask value returned for I915_PARAM_SLICE_MASK.
+         */
+        __u64 slice_mask;
+
+        /*
+         * Mask of subslices to enable for the context. Valid values are a
+         * subset of the bitmask value return by I915_PARAM_SUBSLICE_MASK.
+         */
+        __u64 subslice_mask;
+
+        /*
+         * Minimum/Maximum number of EUs to enable per subslice for the
+         * context. min_eus_per_subslice must be inferior or equal to
+         * max_eus_per_subslice.
+         */
+        __u16 min_eus_per_subslice;
+        __u16 max_eus_per_subslice;
+
+        /*
+         * Unused for now. Must be cleared to zero.
+         */
+        __u32 rsvd;
+};
+
 enum drm_i915_oa_format {
         I915_OA_FORMAT_A13 = 1,     /* HSW only */
         I915_OA_FORMAT_A29,         /* HSW only */
diff --git a/tools/include/uapi/linux/fcntl.h b/tools/include/uapi/linux/fcntl.h
index 6448cdd9a350..a2f8658f1c55 100644
--- a/tools/include/uapi/linux/fcntl.h
+++ b/tools/include/uapi/linux/fcntl.h
@@ -41,6 +41,7 @@
 #define F_SEAL_SHRINK   0x0002  /* prevent file from shrinking */
 #define F_SEAL_GROW     0x0004  /* prevent file from growing */
 #define F_SEAL_WRITE    0x0008  /* prevent writes */
+#define F_SEAL_FUTURE_WRITE     0x0010  /* prevent future writes while mapped */
 /* (1U << 31) is reserved for signed error codes */
 
 /*
diff --git a/tools/include/uapi/linux/mman.h b/tools/include/uapi/linux/mman.h
index d0f515d53299..fc1a64c3447b 100644
--- a/tools/include/uapi/linux/mman.h
+++ b/tools/include/uapi/linux/mman.h
@@ -12,6 +12,10 @@
 #define OVERCOMMIT_ALWAYS               1
 #define OVERCOMMIT_NEVER                2
 
+#define MAP_SHARED      0x01            /* Share changes */
+#define MAP_PRIVATE     0x02            /* Changes are private */
+#define MAP_SHARED_VALIDATE 0x03        /* share + validate extension flags */
+
 /*
  * Huge page size encoding when MAP_HUGETLB is specified, and a huge page
  * size other than the default is desired.  See hugetlb_encode.h.
diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
index 5bf8e52c41fc..8e7c56e9590f 100644
--- a/tools/lib/bpf/Makefile
+++ b/tools/lib/bpf/Makefile
@@ -177,7 +177,7 @@ $(OUTPUT)libbpf.so: $(OUTPUT)libbpf.so.$(LIBBPF_VERSION)
 
 $(OUTPUT)libbpf.so.$(LIBBPF_VERSION): $(BPF_IN)
         $(QUIET_LINK)$(CC) --shared -Wl,-soname,libbpf.so.$(VERSION) \
-                                    -Wl,--version-script=$(VERSION_SCRIPT) $^ -o $@
+                                    -Wl,--version-script=$(VERSION_SCRIPT) $^ -lelf -o $@
         @ln -sf $(@F) $(OUTPUT)libbpf.so
         @ln -sf $(@F) $(OUTPUT)libbpf.so.$(VERSION)
 
@@ -220,8 +220,9 @@ install_lib: all_cmd
 install_headers:
         $(call QUIET_INSTALL, headers) \
                 $(call do_install,bpf.h,$(prefix)/include/bpf,644); \
-                $(call do_install,libbpf.h,$(prefix)/include/bpf,644);
-                $(call do_install,btf.h,$(prefix)/include/bpf,644);
+                $(call do_install,libbpf.h,$(prefix)/include/bpf,644); \
+                $(call do_install,btf.h,$(prefix)/include/bpf,644); \
+                $(call do_install,xsk.h,$(prefix)/include/bpf,644);
 
 install: install_lib
 
diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 87e3020ac1bc..cf119c9b6f27 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -2107,6 +2107,9 @@ static int btf_dedup_is_equiv(struct btf_dedup *d, __u32 cand_id,
                 return fwd_kind == real_kind;
         }
 
+        if (cand_kind != canon_kind)
+                return 0;
+
         switch (cand_kind) {
         case BTF_KIND_INT:
                 return btf_equal_int(cand_type, canon_type);
diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile
index c9d038f91af6..53f8be0f4a1f 100644
--- a/tools/objtool/Makefile
+++ b/tools/objtool/Makefile
@@ -25,14 +25,17 @@ LIBSUBCMD		= $(LIBSUBCMD_OUTPUT)libsubcmd.a
 OBJTOOL    := $(OUTPUT)objtool
 OBJTOOL_IN := $(OBJTOOL)-in.o
 
+LIBELF_FLAGS := $(shell pkg-config libelf --cflags 2>/dev/null)
+LIBELF_LIBS  := $(shell pkg-config libelf --libs 2>/dev/null || echo -lelf)
+
 all: $(OBJTOOL)
 
 INCLUDES := -I$(srctree)/tools/include \
             -I$(srctree)/tools/arch/$(HOSTARCH)/include/uapi \
             -I$(srctree)/tools/objtool/arch/$(ARCH)/include
 WARNINGS := $(EXTRA_WARNINGS) -Wno-switch-default -Wno-switch-enum -Wno-packed
-CFLAGS   += -Werror $(WARNINGS) $(KBUILD_HOSTCFLAGS) -g $(INCLUDES)
-LDFLAGS  += -lelf $(LIBSUBCMD) $(KBUILD_HOSTLDFLAGS)
+CFLAGS   += -Werror $(WARNINGS) $(KBUILD_HOSTCFLAGS) -g $(INCLUDES) $(LIBELF_FLAGS)
+LDFLAGS  += $(LIBELF_LIBS) $(LIBSUBCMD) $(KBUILD_HOSTLDFLAGS)
 
 # Allow old libelf to be used:
 elfshdr := $(shell echo '$(pound)include <libelf.h>' | $(CC) $(CFLAGS) -x c -E - | grep elf_getshdr)
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index 01f7555fd933..e8c9f77e9010 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -481,8 +481,8 @@ $(madvise_behavior_array): $(madvise_hdr_dir)/mman-common.h $(madvise_behavior_t
 mmap_flags_array := $(beauty_outdir)/mmap_flags_array.c
 mmap_flags_tbl := $(srctree)/tools/perf/trace/beauty/mmap_flags.sh
 
-$(mmap_flags_array): $(asm_generic_uapi_dir)/mman.h $(asm_generic_uapi_dir)/mman-common.h $(mmap_flags_tbl)
-        $(Q)$(SHELL) '$(mmap_flags_tbl)' $(asm_generic_uapi_dir) $(arch_asm_uapi_dir) > $@
+$(mmap_flags_array): $(linux_uapi_dir)/mman.h $(asm_generic_uapi_dir)/mman.h $(asm_generic_uapi_dir)/mman-common.h $(mmap_flags_tbl)
+        $(Q)$(SHELL) '$(mmap_flags_tbl)' $(linux_uapi_dir) $(asm_generic_uapi_dir) $(arch_asm_uapi_dir) > $@
 
 mount_flags_array := $(beauty_outdir)/mount_flags_array.c
 mount_flags_tbl := $(srctree)/tools/perf/trace/beauty/mount_flags.sh
diff --git a/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl b/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl
index 2ae92fddb6d5..92ee0b4378d4 100644
--- a/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl
+++ b/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl
@@ -345,6 +345,10 @@
 334     common  rseq                    __x64_sys_rseq
 # don't use numbers 387 through 423, add new calls after the last
 # 'common' entry
+424     common  pidfd_send_signal       __x64_sys_pidfd_send_signal
+425     common  io_uring_setup          __x64_sys_io_uring_setup
+426     common  io_uring_enter          __x64_sys_io_uring_enter
+427     common  io_uring_register       __x64_sys_io_uring_register
 
 #
 # x32-specific system call numbers start at 512 to avoid cache impact
diff --git a/tools/perf/check-headers.sh b/tools/perf/check-headers.sh
index 7b55613924de..c68ee06cae63 100755
--- a/tools/perf/check-headers.sh
+++ b/tools/perf/check-headers.sh
@@ -103,7 +103,7 @@ done
 # diff with extra ignore lines
 check arch/x86/lib/memcpy_64.S        '-I "^EXPORT_SYMBOL" -I "^#include <asm/export.h>"'
 check arch/x86/lib/memset_64.S        '-I "^EXPORT_SYMBOL" -I "^#include <asm/export.h>"'
-check include/uapi/asm-generic/mman.h '-I "^#include <\(uapi/\)*asm-generic/mman-common.h>"'
+check include/uapi/asm-generic/mman.h '-I "^#include <\(uapi/\)*asm-generic/mman-common\(-tools\)*.h>"'
 check include/uapi/linux/mman.h       '-I "^#include <\(uapi/\)*asm/mman.h>"'
 
 # diff non-symmetric files
diff --git a/tools/perf/scripts/python/exported-sql-viewer.py b/tools/perf/scripts/python/exported-sql-viewer.py
index e38518cdcbc3..74ef92f1d19a 100755
--- a/tools/perf/scripts/python/exported-sql-viewer.py
+++ b/tools/perf/scripts/python/exported-sql-viewer.py
@@ -107,6 +107,7 @@ import os
 from PySide.QtCore import *
 from PySide.QtGui import *
 from PySide.QtSql import *
+pyside_version_1 = True
 from decimal import *
 from ctypes import *
 from multiprocessing import Process, Array, Value, Event
@@ -1526,6 +1527,19 @@ def BranchDataPrep(query):
                         " (" + dsoname(query.value(15)) + ")")
         return data
 
+def BranchDataPrepWA(query):
+        data = []
+        data.append(query.value(0))
+        # Workaround pyside failing to handle large integers (i.e. time) in python3 by converting to a string
+        data.append("{:>19}".format(query.value(1)))
+        for i in xrange(2, 8):
+                data.append(query.value(i))
+        data.append(tohex(query.value(8)).rjust(16) + " " + query.value(9) + offstr(query.value(10)) +
+                        " (" + dsoname(query.value(11)) + ")" + " -> " +
+                        tohex(query.value(12)) + " " + query.value(13) + offstr(query.value(14)) +
+                        " (" + dsoname(query.value(15)) + ")")
+        return data
+
 # Branch data model
 
 class BranchModel(TreeModel):
@@ -1553,7 +1567,11 @@ class BranchModel(TreeModel):
                         " AND evsel_id = " + str(self.event_id) +
                         " ORDER BY samples.id"
                         " LIMIT " + str(glb_chunk_sz))
-                self.fetcher = SQLFetcher(glb, sql, BranchDataPrep, self.AddSample)
+                if pyside_version_1 and sys.version_info[0] == 3:
+                        prep = BranchDataPrepWA
+                else:
+                        prep = BranchDataPrep
+                self.fetcher = SQLFetcher(glb, sql, prep, self.AddSample)
                 self.fetcher.done.connect(self.Update)
                 self.fetcher.Fetch(glb_chunk_sz)
 
@@ -2079,14 +2097,6 @@ def IsSelectable(db, table, sql = ""):
                 return False
         return True
 
-# SQL data preparation
-
-def SQLTableDataPrep(query, count):
-        data = []
-        for i in xrange(count):
-                data.append(query.value(i))
-        return data
-
 # SQL table data model item
 
 class SQLTableItem():
@@ -2110,7 +2120,7 @@ class SQLTableModel(TableModel):
                 self.more = True
                 self.populated = 0
                 self.column_headers = column_headers
-                self.fetcher = SQLFetcher(glb, sql, lambda x, y=len(column_headers): SQLTableDataPrep(x, y), self.AddSample)
+                self.fetcher = SQLFetcher(glb, sql, lambda x, y=len(column_headers): self.SQLTableDataPrep(x, y), self.AddSample)
                 self.fetcher.done.connect(self.Update)
                 self.fetcher.Fetch(glb_chunk_sz)
 
@@ -2154,6 +2164,12 @@ class SQLTableModel(TableModel):
         def columnHeader(self, column):
                 return self.column_headers[column]
 
+        def SQLTableDataPrep(self, query, count):
+                data = []
+                for i in xrange(count):
+                        data.append(query.value(i))
+                return data
+
 # SQL automatic table data model
 
 class SQLAutoTableModel(SQLTableModel):
@@ -2182,8 +2198,32 @@ class SQLAutoTableModel(SQLTableModel):
                         QueryExec(query, "SELECT column_name FROM information_schema.columns WHERE table_schema = '" + schema + "' and table_name = '" + select_table_name + "'")
                         while query.next():
                                 column_headers.append(query.value(0))
+                if pyside_version_1 and sys.version_info[0] == 3:
+                        if table_name == "samples_view":
+                                self.SQLTableDataPrep = self.samples_view_DataPrep
+                        if table_name == "samples":
+                                self.SQLTableDataPrep = self.samples_DataPrep
                 super(SQLAutoTableModel, self).__init__(glb, sql, column_headers, parent)
 
+        def samples_view_DataPrep(self, query, count):
+                data = []
+                data.append(query.value(0))
+                # Workaround pyside failing to handle large integers (i.e. time) in python3 by converting to a string
+                data.append("{:>19}".format(query.value(1)))
+                for i in xrange(2, count):
+                        data.append(query.value(i))
+                return data
+
+        def samples_DataPrep(self, query, count):
+                data = []
+                for i in xrange(9):
+                        data.append(query.value(i))
+                # Workaround pyside failing to handle large integers (i.e. time) in python3 by converting to a string
+                data.append("{:>19}".format(query.value(9)))
+                for i in xrange(10, count):
+                        data.append(query.value(i))
+                return data
+
 # Base class for custom ResizeColumnsToContents
 
 class ResizeColumnsToContentsBase(QObject):
@@ -2868,9 +2908,13 @@ class LibXED():
                 ok = self.xed_format_context(2, inst.xedp, inst.bufferp, sizeof(inst.buffer), ip, 0, 0)
                 if not ok:
                         return 0, ""
+                if sys.version_info[0] == 2:
+                        result = inst.buffer.value
+                else:
+                        result = inst.buffer.value.decode()
                 # Return instruction length and the disassembled instruction text
                 # For now, assume the length is in byte 166
-                return inst.xedd[166], inst.buffer.value
+                return inst.xedd[166], result
 
 def TryOpen(file_name):
         try:
@@ -2886,9 +2930,14 @@ def Is64Bit(f):
         header = f.read(7)
         f.seek(pos)
         magic = header[0:4]
-        eclass = ord(header[4])
-        encoding = ord(header[5])
-        version = ord(header[6])
+        if sys.version_info[0] == 2:
+                eclass = ord(header[4])
+                encoding = ord(header[5])
+                version = ord(header[6])
+        else:
+                eclass = header[4]
+                encoding = header[5]
+                version = header[6]
         if magic == chr(127) + "ELF" and eclass > 0 and eclass < 3 and encoding > 0 and encoding < 3 and version == 1:
                 result = True if eclass == 2 else False
         return result
diff --git a/tools/perf/trace/beauty/mmap_flags.sh b/tools/perf/trace/beauty/mmap_flags.sh
index 32bac9c0d694..5f5eefcb3c74 100755
--- a/tools/perf/trace/beauty/mmap_flags.sh
+++ b/tools/perf/trace/beauty/mmap_flags.sh
@@ -1,15 +1,18 @@
 #!/bin/sh
 # SPDX-License-Identifier: LGPL-2.1
 
-if [ $# -ne 2 ] ; then
+if [ $# -ne 3 ] ; then
         [ $# -eq 1 ] && hostarch=$1 || hostarch=`uname -m | sed -e s/i.86/x86/ -e s/x86_64/x86/`
+        linux_header_dir=tools/include/uapi/linux
         header_dir=tools/include/uapi/asm-generic
         arch_header_dir=tools/arch/${hostarch}/include/uapi/asm
 else
-        header_dir=$1
-        arch_header_dir=$2
+        linux_header_dir=$1
+        header_dir=$2
+        arch_header_dir=$3
 fi
 
+linux_mman=${linux_header_dir}/mman.h
 arch_mman=${arch_header_dir}/mman.h
 
 # those in egrep -vw are flags, we want just the bits
@@ -20,6 +23,11 @@ egrep -q $regex ${arch_mman} && \
 (egrep $regex ${arch_mman} | \
         sed -r "s/$regex/\2 \1/g"       | \
         xargs printf "\t[ilog2(%s) + 1] = \"%s\",\n")
+egrep -q $regex ${linux_mman} && \
+(egrep $regex ${linux_mman} | \
+        egrep -vw 'MAP_(UNINITIALIZED|TYPE|SHARED_VALIDATE)' | \
+        sed -r "s/$regex/\2 \1/g"       | \
+        xargs printf "\t[ilog2(%s) + 1] = \"%s\",\n")
 ([ ! -f ${arch_mman} ] || egrep -q '#[[:space:]]*include[[:space:]]+<uapi/asm-generic/mman.*' ${arch_mman}) &&
 (egrep $regex ${header_dir}/mman-common.h | \
         egrep -vw 'MAP_(UNINITIALIZED|TYPE|SHARED_VALIDATE)' | \
diff --git a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
index ba4c623cd8de..39fe21e1cf93 100644
--- a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
+++ b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
@@ -387,6 +387,7 @@ cs_etm_decoder__buffer_range(struct cs_etm_decoder *decoder,
                 break;
         case OCSD_INSTR_ISB:
         case OCSD_INSTR_DSB_DMB:
+        case OCSD_INSTR_WFI_WFE:
         case OCSD_INSTR_OTHER:
         default:
                 packet->last_instr_taken_branch = false;
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index ec78e93085de..6689378ee577 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -231,35 +231,6 @@ void perf_evlist__set_leader(struct perf_evlist *evlist)
         }
 }
 
-void perf_event_attr__set_max_precise_ip(struct perf_event_attr *pattr)
-{
-        struct perf_event_attr attr = {
-                .type           = PERF_TYPE_HARDWARE,
-                .config         = PERF_COUNT_HW_CPU_CYCLES,
-                .exclude_kernel = 1,
-                .precise_ip     = 3,
-        };
-
-        event_attr_init(&attr);
-
-        /*
-         * Unnamed union member, not supported as struct member named
-         * initializer in older compilers such as gcc 4.4.7
-         */
-        attr.sample_period = 1;
-
-        while (attr.precise_ip != 0) {
-                int fd = sys_perf_event_open(&attr, 0, -1, -1, 0);
-                if (fd != -1) {
-                        close(fd);
-                        break;
-                }
-                --attr.precise_ip;
-        }
-
-        pattr->precise_ip = attr.precise_ip;
-}
-
 int __perf_evlist__add_default(struct perf_evlist *evlist, bool precise)
 {
         struct perf_evsel *evsel = perf_evsel__new_cycles(precise);
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index dcb68f34d2cd..6a94785b9100 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -315,8 +315,6 @@ void perf_evlist__to_front(struct perf_evlist *evlist,
 void perf_evlist__set_tracking_event(struct perf_evlist *evlist,
                                      struct perf_evsel *tracking_evsel);
 
-void perf_event_attr__set_max_precise_ip(struct perf_event_attr *attr);
-
 struct perf_evsel *
 perf_evlist__find_evsel_by_str(struct perf_evlist *evlist, const char *str);
 
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 7835e05f0c0a..66d066f18b5b 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -295,7 +295,6 @@ struct perf_evsel *perf_evsel__new_cycles(bool precise)
         if (!precise)
                 goto new_event;
 
-        perf_event_attr__set_max_precise_ip(&attr);
         /*
          * Now let the usual logic to set up the perf_event_attr defaults
          * to kick in when we return and before perf_evsel__open() is called.
@@ -305,6 +304,8 @@ new_event:
         if (evsel == NULL)
                 goto out;
 
+        evsel->precise_max = true;
+
         /* use asprintf() because free(evsel) assumes name is allocated */
         if (asprintf(&evsel->name, "cycles%s%s%.*s",
                      (attr.precise_ip || attr.exclude_kernel) ? ":" : "",
@@ -1083,7 +1084,7 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts,
         }
 
         if (evsel->precise_max)
-                perf_event_attr__set_max_precise_ip(attr);
+                attr->precise_ip = 3;
 
         if (opts->all_user) {
                 attr->exclude_kernel = 1;
@@ -1749,6 +1750,59 @@ static bool ignore_missing_thread(struct perf_evsel *evsel,
         return true;
 }
 
+static void display_attr(struct perf_event_attr *attr)
+{
+        if (verbose >= 2) {
+                fprintf(stderr, "%.60s\n", graph_dotted_line);
+                fprintf(stderr, "perf_event_attr:\n");
+                perf_event_attr__fprintf(stderr, attr, __open_attr__fprintf, NULL);
+                fprintf(stderr, "%.60s\n", graph_dotted_line);
+        }
+}
+
+static int perf_event_open(struct perf_evsel *evsel,
+                           pid_t pid, int cpu, int group_fd,
+                           unsigned long flags)
+{
+        int precise_ip = evsel->attr.precise_ip;
+        int fd;
+
+        while (1) {
+                pr_debug2("sys_perf_event_open: pid %d  cpu %d  group_fd %d  flags %#lx",
+                          pid, cpu, group_fd, flags);
+
+                fd = sys_perf_event_open(&evsel->attr, pid, cpu, group_fd, flags);
+                if (fd >= 0)
+                        break;
+
+                /*
+                 * Do quick precise_ip fallback if:
+                 *  - there is precise_ip set in perf_event_attr
+                 *  - maximum precise is requested
+                 *  - sys_perf_event_open failed with ENOTSUP error,
+                 *    which is associated with wrong precise_ip
+                 */
+                if (!precise_ip || !evsel->precise_max || (errno != ENOTSUP))
+                        break;
+
+                /*
+                 * We tried all the precise_ip values, and it's
+                 * still failing, so leave it to standard fallback.
+                 */
+                if (!evsel->attr.precise_ip) {
+                        evsel->attr.precise_ip = precise_ip;
+                        break;
+                }
+
+                pr_debug2("\nsys_perf_event_open failed, error %d\n", -ENOTSUP);
+                evsel->attr.precise_ip--;
+                pr_debug2("decreasing precise_ip by one (%d)\n", evsel->attr.precise_ip);
+                display_attr(&evsel->attr);
+        }
+
+        return fd;
+}
+
 int perf_evsel__open(struct perf_evsel *evsel, struct cpu_map *cpus,
                      struct thread_map *threads)
 {
@@ -1824,12 +1878,7 @@ retry_sample_id:
         if (perf_missing_features.sample_id_all)
                 evsel->attr.sample_id_all = 0;
 
-        if (verbose >= 2) {
-                fprintf(stderr, "%.60s\n", graph_dotted_line);
-                fprintf(stderr, "perf_event_attr:\n");
-                perf_event_attr__fprintf(stderr, &evsel->attr, __open_attr__fprintf, NULL);
-                fprintf(stderr, "%.60s\n", graph_dotted_line);
-        }
+        display_attr(&evsel->attr);
 
         for (cpu = 0; cpu < cpus->nr; cpu++) {
 
@@ -1841,13 +1890,10 @@ retry_sample_id:
 
                         group_fd = get_group_fd(evsel, cpu, thread);
 retry_open:
-                        pr_debug2("sys_perf_event_open: pid %d  cpu %d  group_fd %d  flags %#lx",
-                                  pid, cpus->map[cpu], group_fd, flags);
-
                         test_attr__ready();
 
-                        fd = sys_perf_event_open(&evsel->attr, pid, cpus->map[cpu],
-                                                 group_fd, flags);
+                        fd = perf_event_open(evsel, pid, cpus->map[cpu],
+                                             group_fd, flags);
 
                         FD(evsel, cpu, thread) = fd;
 
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
index 6e03db142091..872fab163585 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
@@ -251,19 +251,15 @@ struct intel_pt_decoder *intel_pt_decoder_new(struct intel_pt_params *params)
                 if (!(decoder->tsc_ctc_ratio_n % decoder->tsc_ctc_ratio_d))
                         decoder->tsc_ctc_mult = decoder->tsc_ctc_ratio_n /
                                                 decoder->tsc_ctc_ratio_d;
-
-                /*
-                 * Allow for timestamps appearing to backwards because a TSC
-                 * packet has slipped past a MTC packet, so allow 2 MTC ticks
-                 * or ...
-                 */
-                decoder->tsc_slip = multdiv(2 << decoder->mtc_shift,
-                                        decoder->tsc_ctc_ratio_n,
-                                        decoder->tsc_ctc_ratio_d);
         }
-        /* ... or 0x100 paranoia */
-        if (decoder->tsc_slip < 0x100)
-                decoder->tsc_slip = 0x100;
+
+        /*
+         * A TSC packet can slip past MTC packets so that the timestamp appears
+         * to go backwards. One estimate is that can be up to about 40 CPU
+         * cycles, which is certainly less than 0x1000 TSC ticks, but accept
+         * slippage an order of magnitude more to be on the safe side.
+         */
+        decoder->tsc_slip = 0x10000;
 
         intel_pt_log("timestamp: mtc_shift %u\n", decoder->mtc_shift);
         intel_pt_log("timestamp: tsc_ctc_ratio_n %u\n", decoder->tsc_ctc_ratio_n);
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 61959aba7e27..3c520baa198c 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -1421,6 +1421,20 @@ static void machine__set_kernel_mmap(struct machine *machine,
                 machine->vmlinux_map->end = ~0ULL;
 }
 
+static void machine__update_kernel_mmap(struct machine *machine,
+                                     u64 start, u64 end)
+{
+        struct map *map = machine__kernel_map(machine);
+
+        map__get(map);
+        map_groups__remove(&machine->kmaps, map);
+
+        machine__set_kernel_mmap(machine, start, end);
+
+        map_groups__insert(&machine->kmaps, map);
+        map__put(map);
+}
+
 int machine__create_kernel_maps(struct machine *machine)
 {
         struct dso *kernel = machine__get_kernel(machine);
@@ -1453,17 +1467,11 @@ int machine__create_kernel_maps(struct machine *machine)
                         goto out_put;
                 }
 
-                /* we have a real start address now, so re-order the kmaps */
-                map = machine__kernel_map(machine);
-
-                map__get(map);
-                map_groups__remove(&machine->kmaps, map);
-
-                /* assume it's the last in the kmaps */
-                machine__set_kernel_mmap(machine, addr, ~0ULL);
-
-                map_groups__insert(&machine->kmaps, map);
-                map__put(map);
+                /*
+                 * we have a real start address now, so re-order the kmaps
+                 * assume it's the last in the kmaps
+                 */
+                machine__update_kernel_mmap(machine, addr, ~0ULL);
         }
 
         if (machine__create_extra_kernel_maps(machine, kernel))
@@ -1599,7 +1607,7 @@ static int machine__process_kernel_mmap_event(struct machine *machine,
                 if (strstr(kernel->long_name, "vmlinux"))
                         dso__set_short_name(kernel, "[kernel.vmlinux]", false);
 
-                machine__set_kernel_mmap(machine, event->mmap.start,
+                machine__update_kernel_mmap(machine, event->mmap.start,
                                          event->mmap.start + event->mmap.len);
 
                 /*
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index 6199a3174ab9..e0429f4ef335 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -732,10 +732,20 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu)
 
                 if (!is_arm_pmu_core(name)) {
                         pname = pe->pmu ? pe->pmu : "cpu";
+
+                        /*
+                         * uncore alias may be from different PMU
+                         * with common prefix
+                         */
+                        if (pmu_is_uncore(name) &&
+                            !strncmp(pname, name, strlen(pname)))
+                                goto new_alias;
+
                         if (strcmp(pname, name))
                                 continue;
                 }
 
+new_alias:
                 /* need type casts to override 'const' */
                 __perf_pmu__new_alias(head, NULL, (char *)pe->name,
                                 (char *)pe->desc, (char *)pe->event,
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index c3fad065c89c..c7727be9719f 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -44,6 +44,7 @@
 #include <cpuid.h>
 #include <linux/capability.h>
 #include <errno.h>
+#include <math.h>
 
 char *proc_stat = "/proc/stat";
 FILE *outf;
@@ -63,7 +64,6 @@ unsigned int dump_only;
 unsigned int do_snb_cstates;
 unsigned int do_knl_cstates;
 unsigned int do_slm_cstates;
-unsigned int do_cnl_cstates;
 unsigned int use_c1_residency_msr;
 unsigned int has_aperf;
 unsigned int has_epb;
@@ -141,9 +141,21 @@ unsigned int first_counter_read = 1;
 
 #define RAPL_CORES_ENERGY_STATUS        (1 << 9)
                                         /* 0x639 MSR_PP0_ENERGY_STATUS */
+#define RAPL_PER_CORE_ENERGY    (1 << 10)
+                                        /* Indicates cores energy collection is per-core,
+                                         * not per-package. */
+#define RAPL_AMD_F17H           (1 << 11)
+                                        /* 0xc0010299 MSR_RAPL_PWR_UNIT */
+                                        /* 0xc001029a MSR_CORE_ENERGY_STAT */
+                                        /* 0xc001029b MSR_PKG_ENERGY_STAT */
 #define RAPL_CORES (RAPL_CORES_ENERGY_STATUS | RAPL_CORES_POWER_LIMIT)
 #define TJMAX_DEFAULT   100
 
+/* MSRs that are not yet in the kernel-provided header. */
+#define MSR_RAPL_PWR_UNIT       0xc0010299
+#define MSR_CORE_ENERGY_STAT    0xc001029a
+#define MSR_PKG_ENERGY_STAT     0xc001029b
+
 #define MAX(a, b) ((a) > (b) ? (a) : (b))
 
 /*
@@ -187,6 +199,7 @@ struct core_data {
         unsigned long long c7;
         unsigned long long mc6_us;      /* duplicate as per-core for now, even though per module */
         unsigned int core_temp_c;
+        unsigned int core_energy;       /* MSR_CORE_ENERGY_STAT */
         unsigned int core_id;
         unsigned long long counter[MAX_ADDED_COUNTERS];
 } *core_even, *core_odd;
@@ -273,6 +286,7 @@ struct system_summary {
 
 struct cpu_topology {
         int physical_package_id;
+        int die_id;
         int logical_cpu_id;
         int physical_node_id;
         int logical_node_id;    /* 0-based count within the package */
@@ -283,6 +297,7 @@ struct cpu_topology {
 
 struct topo_params {
         int num_packages;
+        int num_die;
         int num_cpus;
         int num_cores;
         int max_cpu_num;
@@ -314,9 +329,8 @@ int for_all_cpus(int (func)(struct thread_data *, struct core_data *, struct pkg
         int retval, pkg_no, core_no, thread_no, node_no;
 
         for (pkg_no = 0; pkg_no < topo.num_packages; ++pkg_no) {
-                for (core_no = 0; core_no < topo.cores_per_node; ++core_no) {
-                        for (node_no = 0; node_no < topo.nodes_per_pkg;
-                             node_no++) {
+                for (node_no = 0; node_no < topo.nodes_per_pkg; node_no++) {
+                        for (core_no = 0; core_no < topo.cores_per_node; ++core_no) {
                                 for (thread_no = 0; thread_no <
                                         topo.threads_per_core; ++thread_no) {
                                         struct thread_data *t;
@@ -442,6 +456,7 @@ struct msr_counter bic[] = {
         { 0x0, "CPU" },
         { 0x0, "APIC" },
         { 0x0, "X2APIC" },
+        { 0x0, "Die" },
 };
 
 #define MAX_BIC (sizeof(bic) / sizeof(struct msr_counter))
@@ -495,6 +510,7 @@ struct msr_counter bic[] = {
 #define BIC_CPU         (1ULL << 47)
 #define BIC_APIC        (1ULL << 48)
 #define BIC_X2APIC      (1ULL << 49)
+#define BIC_Die         (1ULL << 50)
 
 #define BIC_DISABLED_BY_DEFAULT (BIC_USEC | BIC_TOD | BIC_APIC | BIC_X2APIC)
 
@@ -621,6 +637,8 @@ void print_header(char *delim)
                 outp += sprintf(outp, "%sTime_Of_Day_Seconds", (printed++ ? delim : ""));
         if (DO_BIC(BIC_Package))
                 outp += sprintf(outp, "%sPackage", (printed++ ? delim : ""));
+        if (DO_BIC(BIC_Die))
+                outp += sprintf(outp, "%sDie", (printed++ ? delim : ""));
         if (DO_BIC(BIC_Node))
                 outp += sprintf(outp, "%sNode", (printed++ ? delim : ""));
         if (DO_BIC(BIC_Core))
@@ -667,7 +685,7 @@ void print_header(char *delim)
 
         if (DO_BIC(BIC_CPU_c1))
                 outp += sprintf(outp, "%sCPU%%c1", (printed++ ? delim : ""));
-        if (DO_BIC(BIC_CPU_c3) && !do_slm_cstates && !do_knl_cstates && !do_cnl_cstates)
+        if (DO_BIC(BIC_CPU_c3))
                 outp += sprintf(outp, "%sCPU%%c3", (printed++ ? delim : ""));
         if (DO_BIC(BIC_CPU_c6))
                 outp += sprintf(outp, "%sCPU%%c6", (printed++ ? delim : ""));
@@ -680,6 +698,14 @@ void print_header(char *delim)
         if (DO_BIC(BIC_CoreTmp))
                 outp += sprintf(outp, "%sCoreTmp", (printed++ ? delim : ""));
 
+        if (do_rapl && !rapl_joules) {
+                if (DO_BIC(BIC_CorWatt) && (do_rapl & RAPL_PER_CORE_ENERGY))
+                        outp += sprintf(outp, "%sCorWatt", (printed++ ? delim : ""));
+        } else if (do_rapl && rapl_joules) {
+                if (DO_BIC(BIC_Cor_J) && (do_rapl & RAPL_PER_CORE_ENERGY))
+                        outp += sprintf(outp, "%sCor_J", (printed++ ? delim : ""));
+        }
+
         for (mp = sys.cp; mp; mp = mp->next) {
                 if (mp->format == FORMAT_RAW) {
                         if (mp->width == 64)
@@ -734,7 +760,7 @@ void print_header(char *delim)
         if (do_rapl && !rapl_joules) {
                 if (DO_BIC(BIC_PkgWatt))
                         outp += sprintf(outp, "%sPkgWatt", (printed++ ? delim : ""));
-                if (DO_BIC(BIC_CorWatt))
+                if (DO_BIC(BIC_CorWatt) && !(do_rapl & RAPL_PER_CORE_ENERGY))
                         outp += sprintf(outp, "%sCorWatt", (printed++ ? delim : ""));
                 if (DO_BIC(BIC_GFXWatt))
                         outp += sprintf(outp, "%sGFXWatt", (printed++ ? delim : ""));
@@ -747,7 +773,7 @@ void print_header(char *delim)
         } else if (do_rapl && rapl_joules) {
                 if (DO_BIC(BIC_Pkg_J))
                         outp += sprintf(outp, "%sPkg_J", (printed++ ? delim : ""));
-                if (DO_BIC(BIC_Cor_J))
+                if (DO_BIC(BIC_Cor_J) && !(do_rapl & RAPL_PER_CORE_ENERGY))
                         outp += sprintf(outp, "%sCor_J", (printed++ ? delim : ""));
                 if (DO_BIC(BIC_GFX_J))
                         outp += sprintf(outp, "%sGFX_J", (printed++ ? delim : ""));
@@ -808,6 +834,7 @@ int dump_counters(struct thread_data *t, struct core_data *c,
                 outp += sprintf(outp, "c6: %016llX\n", c->c6);
                 outp += sprintf(outp, "c7: %016llX\n", c->c7);
                 outp += sprintf(outp, "DTS: %dC\n", c->core_temp_c);
+                outp += sprintf(outp, "Joules: %0X\n", c->core_energy);
 
                 for (i = 0, mp = sys.cp; mp; i++, mp = mp->next) {
                         outp += sprintf(outp, "cADDED [%d] msr0x%x: %08llX\n",
@@ -904,6 +931,8 @@ int format_counters(struct thread_data *t, struct core_data *c,
         if (t == &average.threads) {
                 if (DO_BIC(BIC_Package))
                         outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
+                if (DO_BIC(BIC_Die))
+                        outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
                 if (DO_BIC(BIC_Node))
                         outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
                 if (DO_BIC(BIC_Core))
@@ -921,6 +950,12 @@ int format_counters(struct thread_data *t, struct core_data *c,
                         else
                                 outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
                 }
+                if (DO_BIC(BIC_Die)) {
+                        if (c)
+                                outp += sprintf(outp, "%s%d", (printed++ ? delim : ""), cpus[t->cpu_id].die_id);
+                        else
+                                outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
+                }
                 if (DO_BIC(BIC_Node)) {
                         if (t)
                                 outp += sprintf(outp, "%s%d",
@@ -1003,7 +1038,7 @@ int format_counters(struct thread_data *t, struct core_data *c,
         if (!(t->flags & CPU_IS_FIRST_THREAD_IN_CORE))
                 goto done;
 
-        if (DO_BIC(BIC_CPU_c3) && !do_slm_cstates && !do_knl_cstates && !do_cnl_cstates)
+        if (DO_BIC(BIC_CPU_c3))
                 outp += sprintf(outp, "%s%.2f", (printed++ ? delim : ""), 100.0 * c->c3/tsc);
         if (DO_BIC(BIC_CPU_c6))
                 outp += sprintf(outp, "%s%.2f", (printed++ ? delim : ""), 100.0 * c->c6/tsc);
@@ -1033,6 +1068,20 @@ int format_counters(struct thread_data *t, struct core_data *c,
                 }
         }
 
+        /*
+         * If measurement interval exceeds minimum RAPL Joule Counter range,
+         * indicate that results are suspect by printing "**" in fraction place.
+         */
+        if (interval_float < rapl_joule_counter_range)
+                fmt8 = "%s%.2f";
+        else
+                fmt8 = "%6.0f**";
+
+        if (DO_BIC(BIC_CorWatt) && (do_rapl & RAPL_PER_CORE_ENERGY))
+                outp += sprintf(outp, fmt8, (printed++ ? delim : ""), c->core_energy * rapl_energy_units / interval_float);
+        if (DO_BIC(BIC_Cor_J) && (do_rapl & RAPL_PER_CORE_ENERGY))
+                outp += sprintf(outp, fmt8, (printed++ ? delim : ""), c->core_energy * rapl_energy_units);
+
         /* print per-package data only for 1st core in package */
         if (!(t->flags & CPU_IS_FIRST_CORE_IN_PACKAGE))
                 goto done;
@@ -1085,18 +1134,9 @@ int format_counters(struct thread_data *t, struct core_data *c,
         if (DO_BIC(BIC_SYS_LPI))
                 outp += sprintf(outp, "%s%.2f", (printed++ ? delim : ""), 100.0 * p->sys_lpi / 1000000.0 / interval_float);
 
-        /*
-         * If measurement interval exceeds minimum RAPL Joule Counter range,
-         * indicate that results are suspect by printing "**" in fraction place.
-         */
-        if (interval_float < rapl_joule_counter_range)
-                fmt8 = "%s%.2f";
-        else
-                fmt8 = "%6.0f**";
-
         if (DO_BIC(BIC_PkgWatt))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_pkg * rapl_energy_units / interval_float);
-        if (DO_BIC(BIC_CorWatt))
+        if (DO_BIC(BIC_CorWatt) && !(do_rapl & RAPL_PER_CORE_ENERGY))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_cores * rapl_energy_units / interval_float);
         if (DO_BIC(BIC_GFXWatt))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_gfx * rapl_energy_units / interval_float);
@@ -1104,7 +1144,7 @@ int format_counters(struct thread_data *t, struct core_data *c,
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_dram * rapl_dram_energy_units / interval_float);
         if (DO_BIC(BIC_Pkg_J))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_pkg * rapl_energy_units);
-        if (DO_BIC(BIC_Cor_J))
+        if (DO_BIC(BIC_Cor_J) && !(do_rapl & RAPL_PER_CORE_ENERGY))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_cores * rapl_energy_units);
         if (DO_BIC(BIC_GFX_J))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_gfx * rapl_energy_units);
@@ -1249,6 +1289,8 @@ delta_core(struct core_data *new, struct core_data *old)
         old->core_temp_c = new->core_temp_c;
         old->mc6_us = new->mc6_us - old->mc6_us;
 
+        DELTA_WRAP32(new->core_energy, old->core_energy);
+
         for (i = 0, mp = sys.cp; mp; i++, mp = mp->next) {
                 if (mp->format == FORMAT_RAW)
                         old->counter[i] = new->counter[i];
@@ -1391,6 +1433,7 @@ void clear_counters(struct thread_data *t, struct core_data *c, struct pkg_data
         c->c7 = 0;
         c->mc6_us = 0;
         c->core_temp_c = 0;
+        c->core_energy = 0;
 
         p->pkg_wtd_core_c0 = 0;
         p->pkg_any_core_c0 = 0;
@@ -1473,6 +1516,8 @@ int sum_counters(struct thread_data *t, struct core_data *c,
 
         average.cores.core_temp_c = MAX(average.cores.core_temp_c, c->core_temp_c);
 
+        average.cores.core_energy += c->core_energy;
+
         for (i = 0, mp = sys.cp; mp; i++, mp = mp->next) {
                 if (mp->format == FORMAT_RAW)
                         continue;
@@ -1818,7 +1863,7 @@ retry:
         if (!(t->flags & CPU_IS_FIRST_THREAD_IN_CORE))
                 goto done;
 
-        if (DO_BIC(BIC_CPU_c3) && !do_slm_cstates && !do_knl_cstates && !do_cnl_cstates) {
+        if (DO_BIC(BIC_CPU_c3)) {
                 if (get_msr(cpu, MSR_CORE_C3_RESIDENCY, &c->c3))
                         return -6;
         }
@@ -1845,6 +1890,12 @@ retry:
                 c->core_temp_c = tcc_activation_temp - ((msr >> 16) & 0x7F);
         }
 
+        if (do_rapl & RAPL_AMD_F17H) {
+                if (get_msr(cpu, MSR_CORE_ENERGY_STAT, &msr))
+                        return -14;
+                c->core_energy = msr & 0xFFFFFFFF;
+        }
+
         for (i = 0, mp = sys.cp; mp; i++, mp = mp->next) {
                 if (get_mp(cpu, mp, &c->counter[i]))
                         return -10;
@@ -1934,6 +1985,11 @@ retry:
                         return -16;
                 p->rapl_dram_perf_status = msr & 0xFFFFFFFF;
         }
+        if (do_rapl & RAPL_AMD_F17H) {
+                if (get_msr(cpu, MSR_PKG_ENERGY_STAT, &msr))
+                        return -13;
+                p->energy_pkg = msr & 0xFFFFFFFF;
+        }
         if (DO_BIC(BIC_PkgTmp)) {
                 if (get_msr(cpu, MSR_IA32_PACKAGE_THERM_STATUS, &msr))
                         return -17;
@@ -2456,6 +2512,8 @@ void free_all_buffers(void)
 
 /*
  * Parse a file containing a single int.
+ * Return 0 if file can not be opened
+ * Exit if file can be opened, but can not be parsed
  */
 int parse_int_file(const char *fmt, ...)
 {
@@ -2467,7 +2525,9 @@ int parse_int_file(const char *fmt, ...)
         va_start(args, fmt);
         vsnprintf(path, sizeof(path), fmt, args);
         va_end(args);
-        filep = fopen_or_die(path, "r");
+        filep = fopen(path, "r");
+        if (!filep)
+                return 0;
         if (fscanf(filep, "%d", &value) != 1)
                 err(1, "%s: failed to parse number from file", path);
         fclose(filep);
@@ -2488,6 +2548,11 @@ int get_physical_package_id(int cpu)
         return parse_int_file("/sys/devices/system/cpu/cpu%d/topology/physical_package_id", cpu);
 }
 
+int get_die_id(int cpu)
+{
+        return parse_int_file("/sys/devices/system/cpu/cpu%d/topology/die_id", cpu);
+}
+
 int get_core_id(int cpu)
 {
         return parse_int_file("/sys/devices/system/cpu/cpu%d/topology/core_id", cpu);
@@ -2578,7 +2643,8 @@ int get_thread_siblings(struct cpu_topology *thiscpu)
         filep = fopen_or_die(path, "r");
         do {
                 offset -= BITMASK_SIZE;
-                fscanf(filep, "%lx%c", &map, &character);
+                if (fscanf(filep, "%lx%c", &map, &character) != 2)
+                        err(1, "%s: failed to parse file", path);
                 for (shift = 0; shift < BITMASK_SIZE; shift++) {
                         if ((map >> shift) & 0x1) {
                                 so = shift + offset;
@@ -2855,8 +2921,11 @@ int snapshot_cpu_lpi_us(void)
         fp = fopen_or_die("/sys/devices/system/cpu/cpuidle/low_power_idle_cpu_residency_us", "r");
 
         retval = fscanf(fp, "%lld", &cpuidle_cur_cpu_lpi_us);
-        if (retval != 1)
-                err(1, "CPU LPI");
+        if (retval != 1) {
+                fprintf(stderr, "Disabling Low Power Idle CPU output\n");
+                BIC_NOT_PRESENT(BIC_CPU_LPI);
+                return -1;
+        }
 
         fclose(fp);
 
@@ -2878,9 +2947,11 @@ int snapshot_sys_lpi_us(void)
         fp = fopen_or_die("/sys/devices/system/cpu/cpuidle/low_power_idle_system_residency_us", "r");
 
         retval = fscanf(fp, "%lld", &cpuidle_cur_sys_lpi_us);
-        if (retval != 1)
-                err(1, "SYS LPI");
-
+        if (retval != 1) {
+                fprintf(stderr, "Disabling Low Power Idle System output\n");
+                BIC_NOT_PRESENT(BIC_SYS_LPI);
+                return -1;
+        }
         fclose(fp);
 
         return 0;
@@ -3410,14 +3481,14 @@ dump_sysfs_cstate_config(void)
                 input = fopen(path, "r");
                 if (input == NULL)
                         continue;
-                fgets(name_buf, sizeof(name_buf), input);
+                if (!fgets(name_buf, sizeof(name_buf), input))
+                        err(1, "%s: failed to read file", path);
 
                  /* truncate "C1-HSW\n" to "C1", or truncate "C1\n" to "C1" */
                 sp = strchr(name_buf, '-');
                 if (!sp)
                         sp = strchrnul(name_buf, '\n');
                 *sp = '\0';
-
                 fclose(input);
 
                 sprintf(path, "/sys/devices/system/cpu/cpu%d/cpuidle/state%d/desc",
@@ -3425,7 +3496,8 @@ dump_sysfs_cstate_config(void)
                 input = fopen(path, "r");
                 if (input == NULL)
                         continue;
-                fgets(desc, sizeof(desc), input);
+                if (!fgets(desc, sizeof(desc), input))
+                        err(1, "%s: failed to read file", path);
 
                 fprintf(outf, "cpu%d: %s: %s", base_cpu, name_buf, desc);
                 fclose(input);
@@ -3444,20 +3516,22 @@ dump_sysfs_pstate_config(void)
                         base_cpu);
         input = fopen(path, "r");
         if (input == NULL) {
-                fprintf(stderr, "NSFOD %s\n", path);
+                fprintf(outf, "NSFOD %s\n", path);
                 return;
         }
-        fgets(driver_buf, sizeof(driver_buf), input);
+        if (!fgets(driver_buf, sizeof(driver_buf), input))
+                err(1, "%s: failed to read file", path);
         fclose(input);
 
         sprintf(path, "/sys/devices/system/cpu/cpu%d/cpufreq/scaling_governor",
                         base_cpu);
         input = fopen(path, "r");
         if (input == NULL) {
-                fprintf(stderr, "NSFOD %s\n", path);
+                fprintf(outf, "NSFOD %s\n", path);
                 return;
         }
-        fgets(governor_buf, sizeof(governor_buf), input);
+        if (!fgets(governor_buf, sizeof(governor_buf), input))
+                err(1, "%s: failed to read file", path);
         fclose(input);
 
         fprintf(outf, "cpu%d: cpufreq driver: %s", base_cpu, driver_buf);
@@ -3466,7 +3540,8 @@ dump_sysfs_pstate_config(void)
         sprintf(path, "/sys/devices/system/cpu/cpufreq/boost");
         input = fopen(path, "r");
         if (input != NULL) {
-                fscanf(input, "%d", &turbo);
+                if (fscanf(input, "%d", &turbo) != 1)
+                        err(1, "%s: failed to parse number from file", path);
                 fprintf(outf, "cpufreq boost: %d\n", turbo);
                 fclose(input);
         }
@@ -3474,7 +3549,8 @@ dump_sysfs_pstate_config(void)
         sprintf(path, "/sys/devices/system/cpu/intel_pstate/no_turbo");
         input = fopen(path, "r");
         if (input != NULL) {
-                fscanf(input, "%d", &turbo);
+                if (fscanf(input, "%d", &turbo) != 1)
+                        err(1, "%s: failed to parse number from file", path);
                 fprintf(outf, "cpufreq intel_pstate no_turbo: %d\n", turbo);
                 fclose(input);
         }
@@ -3718,7 +3794,7 @@ int print_perf_limit(struct thread_data *t, struct core_data *c, struct pkg_data
 #define RAPL_POWER_GRANULARITY  0x7FFF  /* 15 bit power granularity */
 #define RAPL_TIME_GRANULARITY   0x3F /* 6 bit time granularity */
 
-double get_tdp(unsigned int model)
+double get_tdp_intel(unsigned int model)
 {
         unsigned long long msr;
 
@@ -3735,6 +3811,16 @@ double get_tdp(unsigned int model)
         }
 }
 
+double get_tdp_amd(unsigned int family)
+{
+        switch (family) {
+        case 0x17:
+        default:
+                /* This is the max stock TDP of HEDT/Server Fam17h chips */
+                return 250.0;
+        }
+}
+
 /*
  * rapl_dram_energy_units_probe()
  * Energy units are either hard-coded, or come from RAPL Energy Unit MSR.
@@ -3754,21 +3840,12 @@ rapl_dram_energy_units_probe(int  model, double rapl_energy_units)
         }
 }
 
-
-/*
- * rapl_probe()
- *
- * sets do_rapl, rapl_power_units, rapl_energy_units, rapl_time_units
- */
-void rapl_probe(unsigned int family, unsigned int model)
+void rapl_probe_intel(unsigned int family, unsigned int model)
 {
         unsigned long long msr;
         unsigned int time_unit;
         double tdp;
 
-        if (!genuine_intel)
-                return;
-
         if (family != 6)
                 return;
 
@@ -3892,13 +3969,69 @@ void rapl_probe(unsigned int family, unsigned int model)
 
         rapl_time_units = 1.0 / (1 << (time_unit));
 
-        tdp = get_tdp(model);
+        tdp = get_tdp_intel(model);
 
         rapl_joule_counter_range = 0xFFFFFFFF * rapl_energy_units / tdp;
         if (!quiet)
                 fprintf(outf, "RAPL: %.0f sec. Joule Counter Range, at %.0f Watts\n", rapl_joule_counter_range, tdp);
+}
 
-        return;
+void rapl_probe_amd(unsigned int family, unsigned int model)
+{
+        unsigned long long msr;
+        unsigned int eax, ebx, ecx, edx;
+        unsigned int has_rapl = 0;
+        double tdp;
+
+        if (max_extended_level >= 0x80000007) {
+                __cpuid(0x80000007, eax, ebx, ecx, edx);
+                /* RAPL (Fam 17h) */
+                has_rapl = edx & (1 << 14);
+        }
+
+        if (!has_rapl)
+                return;
+
+        switch (family) {
+        case 0x17: /* Zen, Zen+ */
+                do_rapl = RAPL_AMD_F17H | RAPL_PER_CORE_ENERGY;
+                if (rapl_joules) {
+                        BIC_PRESENT(BIC_Pkg_J);
+                        BIC_PRESENT(BIC_Cor_J);
+                } else {
+                        BIC_PRESENT(BIC_PkgWatt);
+                        BIC_PRESENT(BIC_CorWatt);
+                }
+                break;
+        default:
+                return;
+        }
+
+        if (get_msr(base_cpu, MSR_RAPL_PWR_UNIT, &msr))
+                return;
+
+        rapl_time_units = ldexp(1.0, -(msr >> 16 & 0xf));
+        rapl_energy_units = ldexp(1.0, -(msr >> 8 & 0x1f));
+        rapl_power_units = ldexp(1.0, -(msr & 0xf));
+
+        tdp = get_tdp_amd(model);
+
+        rapl_joule_counter_range = 0xFFFFFFFF * rapl_energy_units / tdp;
+        if (!quiet)
+                fprintf(outf, "RAPL: %.0f sec. Joule Counter Range, at %.0f Watts\n", rapl_joule_counter_range, tdp);
+}
+
+/*
+ * rapl_probe()
+ *
+ * sets do_rapl, rapl_power_units, rapl_energy_units, rapl_time_units
+ */
+void rapl_probe(unsigned int family, unsigned int model)
+{
+        if (genuine_intel)
+                rapl_probe_intel(family, model);
+        if (authentic_amd)
+                rapl_probe_amd(family, model);
 }
 
 void perf_limit_reasons_probe(unsigned int family, unsigned int model)
@@ -4003,6 +4136,7 @@ void print_power_limit_msr(int cpu, unsigned long long msr, char *label)
 int print_rapl(struct thread_data *t, struct core_data *c, struct pkg_data *p)
 {
         unsigned long long msr;
+        const char *msr_name;
         int cpu;
 
         if (!do_rapl)
@@ -4018,10 +4152,17 @@ int print_rapl(struct thread_data *t, struct core_data *c, struct pkg_data *p)
                 return -1;
         }
 
-        if (get_msr(cpu, MSR_RAPL_POWER_UNIT, &msr))
-                return -1;
+        if (do_rapl & RAPL_AMD_F17H) {
+                msr_name = "MSR_RAPL_PWR_UNIT";
+                if (get_msr(cpu, MSR_RAPL_PWR_UNIT, &msr))
+                        return -1;
+        } else {
+                msr_name = "MSR_RAPL_POWER_UNIT";
+                if (get_msr(cpu, MSR_RAPL_POWER_UNIT, &msr))
+                        return -1;
+        }
 
-        fprintf(outf, "cpu%d: MSR_RAPL_POWER_UNIT: 0x%08llx (%f Watts, %f Joules, %f sec.)\n", cpu, msr,
+        fprintf(outf, "cpu%d: %s: 0x%08llx (%f Watts, %f Joules, %f sec.)\n", cpu, msr_name, msr,
                 rapl_power_units, rapl_energy_units, rapl_time_units);
 
         if (do_rapl & RAPL_PKG_POWER_INFO) {
@@ -4451,6 +4592,9 @@ unsigned int intel_model_duplicates(unsigned int model)
         case INTEL_FAM6_KABYLAKE_MOBILE:
         case INTEL_FAM6_KABYLAKE_DESKTOP:
                 return INTEL_FAM6_SKYLAKE_MOBILE;
+
+        case INTEL_FAM6_ICELAKE_MOBILE:
+                return INTEL_FAM6_CANNONLAKE_MOBILE;
         }
         return model;
 }
@@ -4702,7 +4846,9 @@ void process_cpuid()
         }
         do_slm_cstates = is_slm(family, model);
         do_knl_cstates  = is_knl(family, model);
-        do_cnl_cstates = is_cnl(family, model);
+
+        if (do_slm_cstates || do_knl_cstates || is_cnl(family, model))
+                BIC_NOT_PRESENT(BIC_CPU_c3);
 
         if (!quiet)
                 decode_misc_pwr_mgmt_msr();
@@ -4769,6 +4915,7 @@ void topology_probe()
         int i;
         int max_core_id = 0;
         int max_package_id = 0;
+        int max_die_id = 0;
         int max_siblings = 0;
 
         /* Initialize num_cpus, max_cpu_num */
@@ -4835,6 +4982,11 @@ void topology_probe()
                 if (cpus[i].physical_package_id > max_package_id)
                         max_package_id = cpus[i].physical_package_id;
 
+                /* get die information */
+                cpus[i].die_id = get_die_id(i);
+                if (cpus[i].die_id > max_die_id)
+                        max_die_id = cpus[i].die_id;
+
                 /* get numa node information */
                 cpus[i].physical_node_id = get_physical_node_id(&cpus[i]);
                 if (cpus[i].physical_node_id > topo.max_node_num)
@@ -4860,6 +5012,13 @@ void topology_probe()
         if (!summary_only && topo.cores_per_node > 1)
                 BIC_PRESENT(BIC_Core);
 
+        topo.num_die = max_die_id + 1;
+        if (debug > 1)
+                fprintf(outf, "max_die_id %d, sizing for %d die\n",
+                                max_die_id, topo.num_die);
+        if (!summary_only && topo.num_die > 1)
+                BIC_PRESENT(BIC_Die);
+
         topo.num_packages = max_package_id + 1;
         if (debug > 1)
                 fprintf(outf, "max_package_id %d, sizing for %d packages\n",
@@ -4884,8 +5043,8 @@ void topology_probe()
                 if (cpu_is_not_present(i))
                         continue;
                 fprintf(outf,
-                        "cpu %d pkg %d node %d lnode %d core %d thread %d\n",
-                        i, cpus[i].physical_package_id,
+                        "cpu %d pkg %d die %d node %d lnode %d core %d thread %d\n",
+                        i, cpus[i].physical_package_id, cpus[i].die_id,
                         cpus[i].physical_node_id,
                         cpus[i].logical_node_id,
                         cpus[i].physical_core_id,
@@ -5122,7 +5281,7 @@ int get_and_dump_counters(void)
 }
 
 void print_version() {
-        fprintf(outf, "turbostat version 18.07.27"
+        fprintf(outf, "turbostat version 19.03.20"
                 " - Len Brown <lenb@kernel.org>\n");
 }
 
@@ -5319,7 +5478,8 @@ void probe_sysfs(void)
                 input = fopen(path, "r");
                 if (input == NULL)
                         continue;
-                fgets(name_buf, sizeof(name_buf), input);
+                if (!fgets(name_buf, sizeof(name_buf), input))
+                        err(1, "%s: failed to read file", path);
 
                  /* truncate "C1-HSW\n" to "C1", or truncate "C1\n" to "C1" */
                 sp = strchr(name_buf, '-');
@@ -5346,7 +5506,8 @@ void probe_sysfs(void)
                 input = fopen(path, "r");
                 if (input == NULL)
                         continue;
-                fgets(name_buf, sizeof(name_buf), input);
+                if (!fgets(name_buf, sizeof(name_buf), input))
+                        err(1, "%s: failed to read file", path);
                  /* truncate "C1-HSW\n" to "C1", or truncate "C1\n" to "C1" */
                 sp = strchr(name_buf, '-');
                 if (!sp)
diff --git a/tools/testing/selftests/bpf/prog_tests/flow_dissector.c b/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
index bcbd928c96ab..fc818bc1d729 100644
--- a/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
+++ b/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
@@ -39,6 +39,58 @@ static struct bpf_flow_keys pkt_v6_flow_keys = {
         .n_proto = __bpf_constant_htons(ETH_P_IPV6),
 };
 
+#define VLAN_HLEN       4
+
+static struct {
+        struct ethhdr eth;
+        __u16 vlan_tci;
+        __u16 vlan_proto;
+        struct iphdr iph;
+        struct tcphdr tcp;
+} __packed pkt_vlan_v4 = {
+        .eth.h_proto = __bpf_constant_htons(ETH_P_8021Q),
+        .vlan_proto = __bpf_constant_htons(ETH_P_IP),
+        .iph.ihl = 5,
+        .iph.protocol = IPPROTO_TCP,
+        .iph.tot_len = __bpf_constant_htons(MAGIC_BYTES),
+        .tcp.urg_ptr = 123,
+        .tcp.doff = 5,
+};
+
+static struct bpf_flow_keys pkt_vlan_v4_flow_keys = {
+        .nhoff = VLAN_HLEN,
+        .thoff = VLAN_HLEN + sizeof(struct iphdr),
+        .addr_proto = ETH_P_IP,
+        .ip_proto = IPPROTO_TCP,
+        .n_proto = __bpf_constant_htons(ETH_P_IP),
+};
+
+static struct {
+        struct ethhdr eth;
+        __u16 vlan_tci;
+        __u16 vlan_proto;
+        __u16 vlan_tci2;
+        __u16 vlan_proto2;
+        struct ipv6hdr iph;
+        struct tcphdr tcp;
+} __packed pkt_vlan_v6 = {
+        .eth.h_proto = __bpf_constant_htons(ETH_P_8021AD),
+        .vlan_proto = __bpf_constant_htons(ETH_P_8021Q),
+        .vlan_proto2 = __bpf_constant_htons(ETH_P_IPV6),
+        .iph.nexthdr = IPPROTO_TCP,
+        .iph.payload_len = __bpf_constant_htons(MAGIC_BYTES),
+        .tcp.urg_ptr = 123,
+        .tcp.doff = 5,
+};
+
+static struct bpf_flow_keys pkt_vlan_v6_flow_keys = {
+        .nhoff = VLAN_HLEN * 2,
+        .thoff = VLAN_HLEN * 2 + sizeof(struct ipv6hdr),
+        .addr_proto = ETH_P_IPV6,
+        .ip_proto = IPPROTO_TCP,
+        .n_proto = __bpf_constant_htons(ETH_P_IPV6),
+};
+
 void test_flow_dissector(void)
 {
         struct bpf_flow_keys flow_keys;
@@ -68,5 +120,21 @@ void test_flow_dissector(void)
               err, errno, retval, duration, size, sizeof(flow_keys));
         CHECK_FLOW_KEYS("ipv6_flow_keys", flow_keys, pkt_v6_flow_keys);
 
+        err = bpf_prog_test_run(prog_fd, 10, &pkt_vlan_v4, sizeof(pkt_vlan_v4),
+                                &flow_keys, &size, &retval, &duration);
+        CHECK(size != sizeof(flow_keys) || err || retval != 1, "vlan_ipv4",
+              "err %d errno %d retval %d duration %d size %u/%lu\n",
+              err, errno, retval, duration, size, sizeof(flow_keys));
+        CHECK_FLOW_KEYS("vlan_ipv4_flow_keys", flow_keys,
+                        pkt_vlan_v4_flow_keys);
+
+        err = bpf_prog_test_run(prog_fd, 10, &pkt_vlan_v6, sizeof(pkt_vlan_v6),
+                                &flow_keys, &size, &retval, &duration);
+        CHECK(size != sizeof(flow_keys) || err || retval != 1, "vlan_ipv6",
+              "err %d errno %d retval %d duration %d size %u/%lu\n",
+              err, errno, retval, duration, size, sizeof(flow_keys));
+        CHECK_FLOW_KEYS("vlan_ipv6_flow_keys", flow_keys,
+                        pkt_vlan_v6_flow_keys);
+
         bpf_object__close(obj);
 }
diff --git a/tools/testing/selftests/bpf/progs/bpf_flow.c b/tools/testing/selftests/bpf/progs/bpf_flow.c
index 284660f5aa95..75b17cada539 100644
--- a/tools/testing/selftests/bpf/progs/bpf_flow.c
+++ b/tools/testing/selftests/bpf/progs/bpf_flow.c
@@ -92,7 +92,6 @@ static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto)
 {
         struct bpf_flow_keys *keys = skb->flow_keys;
 
-        keys->n_proto = proto;
         switch (proto) {
         case bpf_htons(ETH_P_IP):
                 bpf_tail_call(skb, &jmp_table, IP);
@@ -119,10 +118,9 @@ static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto)
 SEC("flow_dissector")
 int _dissect(struct __sk_buff *skb)
 {
-        if (!skb->vlan_present)
-                return parse_eth_proto(skb, skb->protocol);
-        else
-                return parse_eth_proto(skb, skb->vlan_proto);
+        struct bpf_flow_keys *keys = skb->flow_keys;
+
+        return parse_eth_proto(skb, keys->n_proto);
 }
 
 /* Parses on IPPROTO_* */
@@ -336,15 +334,9 @@ PROG(VLAN)(struct __sk_buff *skb)
 {
         struct bpf_flow_keys *keys = skb->flow_keys;
         struct vlan_hdr *vlan, _vlan;
-        __be16 proto;
-
-        /* Peek back to see if single or double-tagging */
-        if (bpf_skb_load_bytes(skb, keys->thoff - sizeof(proto), &proto,
-                               sizeof(proto)))
-                return BPF_DROP;
 
         /* Account for double-tagging */
-        if (proto == bpf_htons(ETH_P_8021AD)) {
+        if (keys->n_proto == bpf_htons(ETH_P_8021AD)) {
                 vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
                 if (!vlan)
                         return BPF_DROP;
@@ -352,6 +344,7 @@ PROG(VLAN)(struct __sk_buff *skb)
                 if (vlan->h_vlan_encapsulated_proto != bpf_htons(ETH_P_8021Q))
                         return BPF_DROP;
 
+                keys->nhoff += sizeof(*vlan);
                 keys->thoff += sizeof(*vlan);
         }
 
@@ -359,12 +352,14 @@ PROG(VLAN)(struct __sk_buff *skb)
         if (!vlan)
                 return BPF_DROP;
 
+        keys->nhoff += sizeof(*vlan);
         keys->thoff += sizeof(*vlan);
         /* Only allow 8021AD + 8021Q double tagging and no triple tagging.*/
         if (vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021AD) ||
             vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021Q))
                 return BPF_DROP;
 
+        keys->n_proto = vlan->h_vlan_encapsulated_proto;
         return parse_eth_proto(skb, vlan->h_vlan_encapsulated_proto);
 }
 
diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c
index 23e3b314ca60..ec5794e4205b 100644
--- a/tools/testing/selftests/bpf/test_btf.c
+++ b/tools/testing/selftests/bpf/test_btf.c
@@ -5777,6 +5777,53 @@ const struct btf_dedup_test dedup_tests[] = {
         },
 },
 {
+        .descr = "dedup: void equiv check",
+        /*
+         * // CU 1:
+         * struct s {
+         *      struct {} *x;
+         * };
+         * // CU 2:
+         * struct s {
+         *      int *x;
+         * };
+         */
+        .input = {
+                .raw_types = {
+                        /* CU 1 */
+                        BTF_STRUCT_ENC(0, 0, 1),                                /* [1] struct {}  */
+                        BTF_PTR_ENC(1),                                         /* [2] ptr -> [1] */
+                        BTF_STRUCT_ENC(NAME_NTH(1), 1, 8),                      /* [3] struct s   */
+                                BTF_MEMBER_ENC(NAME_NTH(2), 2, 0),
+                        /* CU 2 */
+                        BTF_PTR_ENC(0),                                         /* [4] ptr -> void */
+                        BTF_STRUCT_ENC(NAME_NTH(1), 1, 8),                      /* [5] struct s   */
+                                BTF_MEMBER_ENC(NAME_NTH(2), 4, 0),
+                        BTF_END_RAW,
+                },
+                BTF_STR_SEC("\0s\0x"),
+        },
+        .expect = {
+                .raw_types = {
+                        /* CU 1 */
+                        BTF_STRUCT_ENC(0, 0, 1),                                /* [1] struct {}  */
+                        BTF_PTR_ENC(1),                                         /* [2] ptr -> [1] */
+                        BTF_STRUCT_ENC(NAME_NTH(1), 1, 8),                      /* [3] struct s   */
+                                BTF_MEMBER_ENC(NAME_NTH(2), 2, 0),
+                        /* CU 2 */
+                        BTF_PTR_ENC(0),                                         /* [4] ptr -> void */
+                        BTF_STRUCT_ENC(NAME_NTH(1), 1, 8),                      /* [5] struct s   */
+                                BTF_MEMBER_ENC(NAME_NTH(2), 4, 0),
+                        BTF_END_RAW,
+                },
+                BTF_STR_SEC("\0s\0x"),
+        },
+        .opts = {
+                .dont_resolve_fwds = false,
+                .dedup_table_size = 1, /* force hash collisions */
+        },
+},
+{
         .descr = "dedup: all possible kinds (no duplicates)",
         .input = {
                 .raw_types = {
diff --git a/tools/testing/selftests/bpf/verifier/calls.c b/tools/testing/selftests/bpf/verifier/calls.c
index f2ccae39ee66..fb11240b758b 100644
--- a/tools/testing/selftests/bpf/verifier/calls.c
+++ b/tools/testing/selftests/bpf/verifier/calls.c
@@ -908,6 +908,44 @@
         .result = REJECT,
 },
 {
+        "calls: stack depth check in dead code",
+        .insns = {
+        /* main */
+        BPF_MOV64_IMM(BPF_REG_1, 0),
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */
+        BPF_EXIT_INSN(),
+        /* A */
+        BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2), /* call B */
+        BPF_MOV64_IMM(BPF_REG_0, 0),
+        BPF_EXIT_INSN(),
+        /* B */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */
+        BPF_EXIT_INSN(),
+        /* C */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */
+        BPF_EXIT_INSN(),
+        /* D */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */
+        BPF_EXIT_INSN(),
+        /* E */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */
+        BPF_EXIT_INSN(),
+        /* F */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */
+        BPF_EXIT_INSN(),
+        /* G */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */
+        BPF_EXIT_INSN(),
+        /* H */
+        BPF_MOV64_IMM(BPF_REG_0, 0),
+        BPF_EXIT_INSN(),
+        },
+        .prog_type = BPF_PROG_TYPE_XDP,
+        .errstr = "call stack",
+        .result = REJECT,
+},
+{
         "calls: spill into caller stack frame",
         .insns = {
         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile
index 3c1f4bdf9000..7514fcea91a7 100644
--- a/tools/testing/selftests/kvm/Makefile
+++ b/tools/testing/selftests/kvm/Makefile
@@ -29,8 +29,8 @@ LIBKVM += $(LIBKVM_$(UNAME_M))
 INSTALL_HDR_PATH = $(top_srcdir)/usr
 LINUX_HDR_PATH = $(INSTALL_HDR_PATH)/include/
 LINUX_TOOL_INCLUDE = $(top_srcdir)/tools/include
-CFLAGS += -O2 -g -std=gnu99 -I$(LINUX_TOOL_INCLUDE) -I$(LINUX_HDR_PATH) -Iinclude -I$(<D) -Iinclude/$(UNAME_M) -I..
-LDFLAGS += -pthread
+CFLAGS += -O2 -g -std=gnu99 -fno-stack-protector -fno-PIE -I$(LINUX_TOOL_INCLUDE) -I$(LINUX_HDR_PATH) -Iinclude -I$(<D) -Iinclude/$(UNAME_M) -I..
+LDFLAGS += -pthread -no-pie
 
 # After inclusion, $(OUTPUT) is defined and
 # $(TEST_GEN_PROGS) starts with $(OUTPUT)/
diff --git a/tools/testing/selftests/kvm/include/kvm_util.h b/tools/testing/selftests/kvm/include/kvm_util.h
index a84785b02557..07b71ad9734a 100644
--- a/tools/testing/selftests/kvm/include/kvm_util.h
+++ b/tools/testing/selftests/kvm/include/kvm_util.h
@@ -102,6 +102,7 @@ vm_paddr_t addr_gva2gpa(struct kvm_vm *vm, vm_vaddr_t gva);
 struct kvm_run *vcpu_state(struct kvm_vm *vm, uint32_t vcpuid);
 void vcpu_run(struct kvm_vm *vm, uint32_t vcpuid);
 int _vcpu_run(struct kvm_vm *vm, uint32_t vcpuid);
+void vcpu_run_complete_io(struct kvm_vm *vm, uint32_t vcpuid);
 void vcpu_set_mp_state(struct kvm_vm *vm, uint32_t vcpuid,
                        struct kvm_mp_state *mp_state);
 void vcpu_regs_get(struct kvm_vm *vm, uint32_t vcpuid, struct kvm_regs *regs);
diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
index b52cfdefecbf..efa0aad8b3c6 100644
--- a/tools/testing/selftests/kvm/lib/kvm_util.c
+++ b/tools/testing/selftests/kvm/lib/kvm_util.c
@@ -1121,6 +1121,22 @@ int _vcpu_run(struct kvm_vm *vm, uint32_t vcpuid)
         return rc;
 }
 
+void vcpu_run_complete_io(struct kvm_vm *vm, uint32_t vcpuid)
+{
+        struct vcpu *vcpu = vcpu_find(vm, vcpuid);
+        int ret;
+
+        TEST_ASSERT(vcpu != NULL, "vcpu not found, vcpuid: %u", vcpuid);
+
+        vcpu->state->immediate_exit = 1;
+        ret = ioctl(vcpu->fd, KVM_RUN, NULL);
+        vcpu->state->immediate_exit = 0;
+
+        TEST_ASSERT(ret == -1 && errno == EINTR,
+                    "KVM_RUN IOCTL didn't exit immediately, rc: %i, errno: %i",
+                    ret, errno);
+}
+
 /*
  * VM VCPU Set MP State
  *
diff --git a/tools/testing/selftests/kvm/x86_64/cr4_cpuid_sync_test.c b/tools/testing/selftests/kvm/x86_64/cr4_cpuid_sync_test.c
index d503a51fad30..7c2c4d4055a8 100644
--- a/tools/testing/selftests/kvm/x86_64/cr4_cpuid_sync_test.c
+++ b/tools/testing/selftests/kvm/x86_64/cr4_cpuid_sync_test.c
@@ -87,22 +87,25 @@ int main(int argc, char *argv[])
         while (1) {
                 rc = _vcpu_run(vm, VCPU_ID);
 
-                if (run->exit_reason == KVM_EXIT_IO) {
-                        switch (get_ucall(vm, VCPU_ID, &uc)) {
-                        case UCALL_SYNC:
-                                /* emulate hypervisor clearing CR4.OSXSAVE */
-                                vcpu_sregs_get(vm, VCPU_ID, &sregs);
-                                sregs.cr4 &= ~X86_CR4_OSXSAVE;
-                                vcpu_sregs_set(vm, VCPU_ID, &sregs);
-                                break;
-                        case UCALL_ABORT:
-                                TEST_ASSERT(false, "Guest CR4 bit (OSXSAVE) unsynchronized with CPUID bit.");
-                                break;
-                        case UCALL_DONE:
-                                goto done;
-                        default:
-                                TEST_ASSERT(false, "Unknown ucall 0x%x.", uc.cmd);
-                        }
+                TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
+                            "Unexpected exit reason: %u (%s),\n",
+                            run->exit_reason,
+                            exit_reason_str(run->exit_reason));
+
+                switch (get_ucall(vm, VCPU_ID, &uc)) {
+                case UCALL_SYNC:
+                        /* emulate hypervisor clearing CR4.OSXSAVE */
+                        vcpu_sregs_get(vm, VCPU_ID, &sregs);
+                        sregs.cr4 &= ~X86_CR4_OSXSAVE;
+                        vcpu_sregs_set(vm, VCPU_ID, &sregs);
+                        break;
+                case UCALL_ABORT:
+                        TEST_ASSERT(false, "Guest CR4 bit (OSXSAVE) unsynchronized with CPUID bit.");
+                        break;
+                case UCALL_DONE:
+                        goto done;
+                default:
+                        TEST_ASSERT(false, "Unknown ucall 0x%x.", uc.cmd);
                 }
         }
 
diff --git a/tools/testing/selftests/kvm/x86_64/state_test.c b/tools/testing/selftests/kvm/x86_64/state_test.c
index 4b3f556265f1..30f75856cf39 100644
--- a/tools/testing/selftests/kvm/x86_64/state_test.c
+++ b/tools/testing/selftests/kvm/x86_64/state_test.c
@@ -134,6 +134,11 @@ int main(int argc, char *argv[])
 
         struct kvm_cpuid_entry2 *entry = kvm_get_supported_cpuid_entry(1);
 
+        if (!kvm_check_cap(KVM_CAP_IMMEDIATE_EXIT)) {
+                fprintf(stderr, "immediate_exit not available, skipping test\n");
+                exit(KSFT_SKIP);
+        }
+
         /* Create VM */
         vm = vm_create_default(VCPU_ID, 0, guest_code);
         vcpu_set_cpuid(vm, VCPU_ID, kvm_get_supported_cpuid());
@@ -156,8 +161,6 @@ int main(int argc, char *argv[])
                             stage, run->exit_reason,
                             exit_reason_str(run->exit_reason));
 
-                memset(&regs1, 0, sizeof(regs1));
-                vcpu_regs_get(vm, VCPU_ID, &regs1);
                 switch (get_ucall(vm, VCPU_ID, &uc)) {
                 case UCALL_ABORT:
                         TEST_ASSERT(false, "%s at %s:%d", (const char *)uc.args[0],
@@ -176,6 +179,17 @@ int main(int argc, char *argv[])
                             uc.args[1] == stage, "Unexpected register values vmexit #%lx, got %lx",
                             stage, (ulong)uc.args[1]);
 
+                /*
+                 * When KVM exits to userspace with KVM_EXIT_IO, KVM guarantees
+                 * guest state is consistent only after userspace re-enters the
+                 * kernel with KVM_RUN.  Complete IO prior to migrating state
+                 * to a new VM.
+                 */
+                vcpu_run_complete_io(vm, VCPU_ID);
+
+                memset(&regs1, 0, sizeof(regs1));
+                vcpu_regs_get(vm, VCPU_ID, &regs1);
+
                 state = vcpu_save_state(vm, VCPU_ID);
                 kvm_vm_release(vm);
 
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/sample.json b/tools/testing/selftests/tc-testing/tc-tests/actions/sample.json
index 27f0acaed880..ddabb160a11b 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/sample.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/sample.json
@@ -144,6 +144,30 @@
         ]
     },
     {
+        "id": "7571",
+        "name": "Add sample action with invalid rate",
+        "category": [
+            "actions",
+            "sample"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action sample",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action sample rate 0 group 1 index 2",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions get action sample index 2",
+        "matchPattern": "action order [0-9]+: sample rate 1/0 group 1.*index 2 ref",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action sample"
+        ]
+    },
+    {
         "id": "b6d4",
         "name": "Add sample action with mandatory arguments and invalid control action",
         "category": [
diff --git a/virt/kvm/arm/hyp/vgic-v3-sr.c b/virt/kvm/arm/hyp/vgic-v3-sr.c
index 264d92da3240..370bd6c5e6cb 100644
--- a/virt/kvm/arm/hyp/vgic-v3-sr.c
+++ b/virt/kvm/arm/hyp/vgic-v3-sr.c
@@ -222,7 +222,7 @@ void __hyp_text __vgic_v3_save_state(struct kvm_vcpu *vcpu)
                 }
         }
 
-        if (used_lrs) {
+        if (used_lrs || cpu_if->its_vpe.its_vm) {
                 int i;
                 u32 elrsr;
 
@@ -247,7 +247,7 @@ void __hyp_text __vgic_v3_restore_state(struct kvm_vcpu *vcpu)
         u64 used_lrs = vcpu->arch.vgic_cpu.used_lrs;
         int i;
 
-        if (used_lrs) {
+        if (used_lrs || cpu_if->its_vpe.its_vm) {
                 write_gicreg(cpu_if->vgic_hcr, ICH_HCR_EL2);
 
                 for (i = 0; i < used_lrs; i++)
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index ffd7acdceac7..27c958306449 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -102,8 +102,7 @@ static bool kvm_is_device_pfn(unsigned long pfn)
  * @addr:       IPA
  * @pmd:        pmd pointer for IPA
  *
- * Function clears a PMD entry, flushes addr 1st and 2nd stage TLBs. Marks all
- * pages in the range dirty.
+ * Function clears a PMD entry, flushes addr 1st and 2nd stage TLBs.
  */
 static void stage2_dissolve_pmd(struct kvm *kvm, phys_addr_t addr, pmd_t *pmd)
 {
@@ -121,8 +120,7 @@ static void stage2_dissolve_pmd(struct kvm *kvm, phys_addr_t addr, pmd_t *pmd)
  * @addr:       IPA
  * @pud:        pud pointer for IPA
  *
- * Function clears a PUD entry, flushes addr 1st and 2nd stage TLBs. Marks all
- * pages in the range dirty.
+ * Function clears a PUD entry, flushes addr 1st and 2nd stage TLBs.
  */
 static void stage2_dissolve_pud(struct kvm *kvm, phys_addr_t addr, pud_t *pudp)
 {
@@ -899,9 +897,8 @@ int create_hyp_exec_mappings(phys_addr_t phys_addr, size_t size,
  * kvm_alloc_stage2_pgd - allocate level-1 table for stage-2 translation.
  * @kvm:        The KVM struct pointer for the VM.
  *
- * Allocates only the stage-2 HW PGD level table(s) (can support either full
- * 40-bit input addresses or limited to 32-bit input addresses). Clears the
- * allocated pages.
+ * Allocates only the stage-2 HW PGD level table(s) of size defined by
+ * stage2_pgd_size(kvm).
  *
  * Note we don't need locking here as this is only called when the VM is
  * created, which can only be done once.
@@ -1067,25 +1064,43 @@ static int stage2_set_pmd_huge(struct kvm *kvm, struct kvm_mmu_memory_cache
 {
         pmd_t *pmd, old_pmd;
 
+retry:
         pmd = stage2_get_pmd(kvm, cache, addr);
         VM_BUG_ON(!pmd);
 
         old_pmd = *pmd;
+        /*
+         * Multiple vcpus faulting on the same PMD entry, can
+         * lead to them sequentially updating the PMD with the
+         * same value. Following the break-before-make
+         * (pmd_clear() followed by tlb_flush()) process can
+         * hinder forward progress due to refaults generated
+         * on missing translations.
+         *
+         * Skip updating the page table if the entry is
+         * unchanged.
+         */
+        if (pmd_val(old_pmd) == pmd_val(*new_pmd))
+                return 0;
+
         if (pmd_present(old_pmd)) {
                 /*
-                 * Multiple vcpus faulting on the same PMD entry, can
-                 * lead to them sequentially updating the PMD with the
-                 * same value. Following the break-before-make
-                 * (pmd_clear() followed by tlb_flush()) process can
-                 * hinder forward progress due to refaults generated
-                 * on missing translations.
+                 * If we already have PTE level mapping for this block,
+                 * we must unmap it to avoid inconsistent TLB state and
+                 * leaking the table page. We could end up in this situation
+                 * if the memory slot was marked for dirty logging and was
+                 * reverted, leaving PTE level mappings for the pages accessed
+                 * during the period. So, unmap the PTE level mapping for this
+                 * block and retry, as we could have released the upper level
+                 * table in the process.
                  *
-                 * Skip updating the page table if the entry is
-                 * unchanged.
+                 * Normal THP split/merge follows mmu_notifier callbacks and do
+                 * get handled accordingly.
                  */
-                if (pmd_val(old_pmd) == pmd_val(*new_pmd))
-                        return 0;
-
+                if (!pmd_thp_or_huge(old_pmd)) {
+                        unmap_stage2_range(kvm, addr & S2_PMD_MASK, S2_PMD_SIZE);
+                        goto retry;
+                }
                 /*
                  * Mapping in huge pages should only happen through a
                  * fault.  If a page is merged into a transparent huge
@@ -1097,8 +1112,7 @@ static int stage2_set_pmd_huge(struct kvm *kvm, struct kvm_mmu_memory_cache
                  * should become splitting first, unmapped, merged,
                  * and mapped back in on-demand.
                  */
-                VM_BUG_ON(pmd_pfn(old_pmd) != pmd_pfn(*new_pmd));
-
+                WARN_ON_ONCE(pmd_pfn(old_pmd) != pmd_pfn(*new_pmd));
                 pmd_clear(pmd);
                 kvm_tlb_flush_vmid_ipa(kvm, addr);
         } else {
@@ -1114,6 +1128,7 @@ static int stage2_set_pud_huge(struct kvm *kvm, struct kvm_mmu_memory_cache *cac
 {
         pud_t *pudp, old_pud;
 
+retry:
         pudp = stage2_get_pud(kvm, cache, addr);
         VM_BUG_ON(!pudp);
 
@@ -1121,14 +1136,23 @@ static int stage2_set_pud_huge(struct kvm *kvm, struct kvm_mmu_memory_cache *cac
 
         /*
          * A large number of vcpus faulting on the same stage 2 entry,
-         * can lead to a refault due to the
-         * stage2_pud_clear()/tlb_flush(). Skip updating the page
-         * tables if there is no change.
+         * can lead to a refault due to the stage2_pud_clear()/tlb_flush().
+         * Skip updating the page tables if there is no change.
          */
         if (pud_val(old_pud) == pud_val(*new_pudp))
                 return 0;
 
         if (stage2_pud_present(kvm, old_pud)) {
+                /*
+                 * If we already have table level mapping for this block, unmap
+                 * the range for this block and retry.
+                 */
+                if (!stage2_pud_huge(kvm, old_pud)) {
+                        unmap_stage2_range(kvm, addr & S2_PUD_MASK, S2_PUD_SIZE);
+                        goto retry;
+                }
+
+                WARN_ON_ONCE(kvm_pud_pfn(old_pud) != kvm_pud_pfn(*new_pudp));
                 stage2_pud_clear(kvm, pudp);
                 kvm_tlb_flush_vmid_ipa(kvm, addr);
         } else {
@@ -1451,13 +1475,11 @@ static void stage2_wp_pmds(struct kvm *kvm, pud_t *pud,
 }
 
 /**
-  * stage2_wp_puds - write protect PGD range
-  * @pgd:       pointer to pgd entry
-  * @addr:      range start address
-  * @end:       range end address
-  *
-  * Process PUD entries, for a huge PUD we cause a panic.
-  */
+ * stage2_wp_puds - write protect PGD range
+ * @pgd:        pointer to pgd entry
+ * @addr:       range start address
+ * @end:        range end address
+ */
 static void  stage2_wp_puds(struct kvm *kvm, pgd_t *pgd,
                             phys_addr_t addr, phys_addr_t end)
 {
@@ -1594,8 +1616,9 @@ static void kvm_send_hwpoison_signal(unsigned long address,
         send_sig_mceerr(BUS_MCEERR_AR, (void __user *)address, lsb, current);
 }
 
-static bool fault_supports_stage2_pmd_mappings(struct kvm_memory_slot *memslot,
-                                               unsigned long hva)
+static bool fault_supports_stage2_huge_mapping(struct kvm_memory_slot *memslot,
+                                               unsigned long hva,
+                                               unsigned long map_size)
 {
         gpa_t gpa_start;
         hva_t uaddr_start, uaddr_end;
@@ -1610,34 +1633,34 @@ static bool fault_supports_stage2_pmd_mappings(struct kvm_memory_slot *memslot,
 
         /*
          * Pages belonging to memslots that don't have the same alignment
-         * within a PMD for userspace and IPA cannot be mapped with stage-2
-         * PMD entries, because we'll end up mapping the wrong pages.
+         * within a PMD/PUD for userspace and IPA cannot be mapped with stage-2
+         * PMD/PUD entries, because we'll end up mapping the wrong pages.
          *
          * Consider a layout like the following:
          *
          *    memslot->userspace_addr:
          *    +-----+--------------------+--------------------+---+
-         *    |abcde|fgh  Stage-1 PMD    |    Stage-1 PMD   tv|xyz|
+         *    |abcde|fgh  Stage-1 block  |    Stage-1 block tv|xyz|
          *    +-----+--------------------+--------------------+---+
          *
          *    memslot->base_gfn << PAGE_SIZE:
          *      +---+--------------------+--------------------+-----+
-         *      |abc|def  Stage-2 PMD    |    Stage-2 PMD     |tvxyz|
+         *      |abc|def  Stage-2 block  |    Stage-2 block   |tvxyz|
          *      +---+--------------------+--------------------+-----+
          *
-         * If we create those stage-2 PMDs, we'll end up with this incorrect
+         * If we create those stage-2 blocks, we'll end up with this incorrect
          * mapping:
          *   d -> f
          *   e -> g
          *   f -> h
          */
-        if ((gpa_start & ~S2_PMD_MASK) != (uaddr_start & ~S2_PMD_MASK))
+        if ((gpa_start & (map_size - 1)) != (uaddr_start & (map_size - 1)))
                 return false;
 
         /*
          * Next, let's make sure we're not trying to map anything not covered
-         * by the memslot. This means we have to prohibit PMD size mappings
-         * for the beginning and end of a non-PMD aligned and non-PMD sized
+         * by the memslot. This means we have to prohibit block size mappings
+         * for the beginning and end of a non-block aligned and non-block sized
          * memory slot (illustrated by the head and tail parts of the
          * userspace view above containing pages 'abcde' and 'xyz',
          * respectively).
@@ -1646,8 +1669,8 @@ static bool fault_supports_stage2_pmd_mappings(struct kvm_memory_slot *memslot,
          * userspace_addr or the base_gfn, as both are equally aligned (per
          * the check above) and equally sized.
          */
-        return (hva & S2_PMD_MASK) >= uaddr_start &&
-               (hva & S2_PMD_MASK) + S2_PMD_SIZE <= uaddr_end;
+        return (hva & ~(map_size - 1)) >= uaddr_start &&
+               (hva & ~(map_size - 1)) + map_size <= uaddr_end;
 }
 
 static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
@@ -1676,12 +1699,6 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
                 return -EFAULT;
         }
 
-        if (!fault_supports_stage2_pmd_mappings(memslot, hva))
-                force_pte = true;
-
-        if (logging_active)
-                force_pte = true;
-
         /* Let's check if we will get back a huge page backed by hugetlbfs */
         down_read(&current->mm->mmap_sem);
         vma = find_vma_intersection(current->mm, hva, hva + 1);
@@ -1692,6 +1709,12 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
         }
 
         vma_pagesize = vma_kernel_pagesize(vma);
+        if (logging_active ||
+            !fault_supports_stage2_huge_mapping(memslot, hva, vma_pagesize)) {
+                force_pte = true;
+                vma_pagesize = PAGE_SIZE;
+        }
+
         /*
          * The stage2 has a minimum of 2 level table (For arm64 see
          * kvm_arm_setup_stage2()). Hence, we are guaranteed that we can
@@ -1699,11 +1722,9 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
          * As for PUD huge maps, we must make sure that we have at least
          * 3 levels, i.e, PMD is not folded.
          */
-        if ((vma_pagesize == PMD_SIZE ||
-             (vma_pagesize == PUD_SIZE && kvm_stage2_has_pmd(kvm))) &&
-            !force_pte) {
+        if (vma_pagesize == PMD_SIZE ||
+            (vma_pagesize == PUD_SIZE && kvm_stage2_has_pmd(kvm)))
                 gfn = (fault_ipa & huge_page_mask(hstate_vma(vma))) >> PAGE_SHIFT;
-        }
         up_read(&current->mm->mmap_sem);
 
         /* We need minimum second+third level pages */
diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
index ab3f47745d9c..44ceaccb18cf 100644
--- a/virt/kvm/arm/vgic/vgic-its.c
+++ b/virt/kvm/arm/vgic/vgic-its.c
@@ -754,8 +754,9 @@ static bool vgic_its_check_id(struct vgic_its *its, u64 baser, u32 id,
         u64 indirect_ptr, type = GITS_BASER_TYPE(baser);
         phys_addr_t base = GITS_BASER_ADDR_48_to_52(baser);
         int esz = GITS_BASER_ENTRY_SIZE(baser);
-        int index;
+        int index, idx;
         gfn_t gfn;
+        bool ret;
 
         switch (type) {
         case GITS_BASER_TYPE_DEVICE:
@@ -782,7 +783,8 @@ static bool vgic_its_check_id(struct vgic_its *its, u64 baser, u32 id,
 
                 if (eaddr)
                         *eaddr = addr;
-                return kvm_is_visible_gfn(its->dev->kvm, gfn);
+
+                goto out;
         }
 
         /* calculate and check the index into the 1st level */
@@ -812,7 +814,12 @@ static bool vgic_its_check_id(struct vgic_its *its, u64 baser, u32 id,
 
         if (eaddr)
                 *eaddr = indirect_ptr;
-        return kvm_is_visible_gfn(its->dev->kvm, gfn);
+
+out:
+        idx = srcu_read_lock(&its->dev->kvm->srcu);
+        ret = kvm_is_visible_gfn(its->dev->kvm, gfn);
+        srcu_read_unlock(&its->dev->kvm->srcu, idx);
+        return ret;
 }
 
 static int vgic_its_alloc_collection(struct vgic_its *its,
@@ -1729,8 +1736,8 @@ static void vgic_its_destroy(struct kvm_device *kvm_dev)
         kfree(its);
 }
 
-int vgic_its_has_attr_regs(struct kvm_device *dev,
-                           struct kvm_device_attr *attr)
+static int vgic_its_has_attr_regs(struct kvm_device *dev,
+                                  struct kvm_device_attr *attr)
 {
         const struct vgic_register_region *region;
         gpa_t offset = attr->attr;
@@ -1750,9 +1757,9 @@ int vgic_its_has_attr_regs(struct kvm_device *dev,
         return 0;
 }
 
-int vgic_its_attr_regs_access(struct kvm_device *dev,
-                              struct kvm_device_attr *attr,
-                              u64 *reg, bool is_write)
+static int vgic_its_attr_regs_access(struct kvm_device *dev,
+                                     struct kvm_device_attr *attr,
+                                     u64 *reg, bool is_write)
 {
         const struct vgic_register_region *region;
         struct vgic_its *its;
@@ -1919,7 +1926,7 @@ static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev,
                ((u64)ite->irq->intid << KVM_ITS_ITE_PINTID_SHIFT) |
                 ite->collection->collection_id;
         val = cpu_to_le64(val);
-        return kvm_write_guest(kvm, gpa, &val, ite_esz);
+        return kvm_write_guest_lock(kvm, gpa, &val, ite_esz);
 }
 
 /**
@@ -2066,7 +2073,7 @@ static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev,
                (itt_addr_field << KVM_ITS_DTE_ITTADDR_SHIFT) |
                 (dev->num_eventid_bits - 1));
         val = cpu_to_le64(val);
-        return kvm_write_guest(kvm, ptr, &val, dte_esz);
+        return kvm_write_guest_lock(kvm, ptr, &val, dte_esz);
 }
 
 /**
@@ -2246,7 +2253,7 @@ static int vgic_its_save_cte(struct vgic_its *its,
                ((u64)collection->target_addr << KVM_ITS_CTE_RDBASE_SHIFT) |
                collection->collection_id);
         val = cpu_to_le64(val);
-        return kvm_write_guest(its->dev->kvm, gpa, &val, esz);
+        return kvm_write_guest_lock(its->dev->kvm, gpa, &val, esz);
 }
 
 static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz)
@@ -2317,7 +2324,7 @@ static int vgic_its_save_collection_table(struct vgic_its *its)
          */
         val = 0;
         BUG_ON(cte_esz > sizeof(val));
-        ret = kvm_write_guest(its->dev->kvm, gpa, &val, cte_esz);
+        ret = kvm_write_guest_lock(its->dev->kvm, gpa, &val, cte_esz);
         return ret;
 }
 
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 408a78eb6a97..9f87e58dbd4a 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -358,7 +358,7 @@ retry:
         if (status) {
                 /* clear consumed data */
                 val &= ~(1 << bit_nr);
-                ret = kvm_write_guest(kvm, ptr, &val, 1);
+                ret = kvm_write_guest_lock(kvm, ptr, &val, 1);
                 if (ret)
                         return ret;
         }
@@ -409,7 +409,7 @@ int vgic_v3_save_pending_tables(struct kvm *kvm)
                 else
                         val &= ~(1 << bit_nr);
 
-                ret = kvm_write_guest(kvm, ptr, &val, 1);
+                ret = kvm_write_guest_lock(kvm, ptr, &val, 1);
                 if (ret)
                         return ret;
         }
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index abd9c7352677..3af69f2a3866 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -867,15 +867,21 @@ void kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu)
          * either observe the new interrupt before or after doing this check,
          * and introducing additional synchronization mechanism doesn't change
          * this.
+         *
+         * Note that we still need to go through the whole thing if anything
+         * can be directly injected (GICv4).
          */
-        if (list_empty(&vcpu->arch.vgic_cpu.ap_list_head))
+        if (list_empty(&vcpu->arch.vgic_cpu.ap_list_head) &&
+            !vgic_supports_direct_msis(vcpu->kvm))
                 return;
 
         DEBUG_SPINLOCK_BUG_ON(!irqs_disabled());
 
-        raw_spin_lock(&vcpu->arch.vgic_cpu.ap_list_lock);
-        vgic_flush_lr_state(vcpu);
-        raw_spin_unlock(&vcpu->arch.vgic_cpu.ap_list_lock);
+        if (!list_empty(&vcpu->arch.vgic_cpu.ap_list_head)) {
+                raw_spin_lock(&vcpu->arch.vgic_cpu.ap_list_lock);
+                vgic_flush_lr_state(vcpu);
+                raw_spin_unlock(&vcpu->arch.vgic_cpu.ap_list_lock);
+        }
 
         if (can_access_vgic_from_kernel())
                 vgic_restore_state(vcpu);
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index 4325250afd72..001aeda4c154 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -214,9 +214,9 @@ irqfd_wakeup(wait_queue_entry_t *wait, unsigned mode, int sync, void *key)
 
         if (flags & EPOLLHUP) {
                 /* The eventfd is closing, detach from KVM */
-                unsigned long flags;
+                unsigned long iflags;
 
-                spin_lock_irqsave(&kvm->irqfds.lock, flags);
+                spin_lock_irqsave(&kvm->irqfds.lock, iflags);
 
                 /*
                  * We must check if someone deactivated the irqfd before
@@ -230,7 +230,7 @@ irqfd_wakeup(wait_queue_entry_t *wait, unsigned mode, int sync, void *key)
                 if (irqfd_is_active(irqfd))
                         irqfd_deactivate(irqfd);
 
-                spin_unlock_irqrestore(&kvm->irqfds.lock, flags);
+                spin_unlock_irqrestore(&kvm->irqfds.lock, iflags);
         }
 
         return 0;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index f25aa98a94df..55fe8e20d8fd 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2905,6 +2905,9 @@ static long kvm_device_ioctl(struct file *filp, unsigned int ioctl,
 {
         struct kvm_device *dev = filp->private_data;
 
+        if (dev->kvm->mm != current->mm)
+                return -EIO;
+
         switch (ioctl) {
         case KVM_SET_DEVICE_ATTR:
                 return kvm_device_ioctl_attr(dev, dev->ops->set_attr, arg);