320 files changed, 3150 insertions, 1886 deletions

diff --git a/.mailmap b/.mailmap
index b2cde8668dcc..ae2bcad06f4b 100644
--- a/.mailmap
+++ b/.mailmap
@@ -156,6 +156,8 @@ Morten Welinder <welinder@darter.rentec.com>
 Morten Welinder <welinder@troll.com>
 Mythri P K <mythripk@ti.com>
 Nguyen Anh Quynh <aquynh@gmail.com>
+Nicolas Pitre <nico@fluxnic.net> <nicolas.pitre@linaro.org>
+Nicolas Pitre <nico@fluxnic.net> <nico@linaro.org>
 Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
 Patrick Mochel <mochel@digitalimplant.org>
 Paul Burton <paul.burton@mips.com> <paul.burton@imgtec.com>
diff --git a/Documentation/accounting/psi.txt b/Documentation/accounting/psi.txt
index b8ca28b60215..7e71c9c1d8e9 100644
--- a/Documentation/accounting/psi.txt
+++ b/Documentation/accounting/psi.txt
@@ -56,12 +56,12 @@ situation from a state where some tasks are stalled but the CPU is
 still doing productive work. As such, time spent in this subset of the
 stall state is tracked separately and exported in the "full" averages.
 
-The ratios are tracked as recent trends over ten, sixty, and three
-hundred second windows, which gives insight into short term events as
-well as medium and long term trends. The total absolute stall time is
-tracked and exported as well, to allow detection of latency spikes
-which wouldn't necessarily make a dent in the time averages, or to
-average trends over custom time frames.
+The ratios (in %) are tracked as recent trends over ten, sixty, and
+three hundred second windows, which gives insight into short term events
+as well as medium and long term trends. The total absolute stall time
+(in us) is tracked and exported as well, to allow detection of latency
+spikes which wouldn't necessarily make a dent in the time averages,
+or to average trends over custom time frames.
 
 Cgroup2 interface
 =================
diff --git a/Documentation/bpf/btf.rst b/Documentation/bpf/btf.rst
index 9a60a5d60e38..7313d354f20e 100644
--- a/Documentation/bpf/btf.rst
+++ b/Documentation/bpf/btf.rst
@@ -148,16 +148,16 @@ The ``btf_type.size * 8`` must be equal to or greater than ``BTF_INT_BITS()``
 for the type. The maximum value of ``BTF_INT_BITS()`` is 128.
 
 The ``BTF_INT_OFFSET()`` specifies the starting bit offset to calculate values
-for this int. For example, a bitfield struct member has: * btf member bit
-offset 100 from the start of the structure, * btf member pointing to an int
-type, * the int type has ``BTF_INT_OFFSET() = 2`` and ``BTF_INT_BITS() = 4``
+for this int. For example, a bitfield struct member has:
+ * btf member bit offset 100 from the start of the structure,
+ * btf member pointing to an int type,
+ * the int type has ``BTF_INT_OFFSET() = 2`` and ``BTF_INT_BITS() = 4``
 
 Then in the struct memory layout, this member will occupy ``4`` bits starting
 from bits ``100 + 2 = 102``.
 
 Alternatively, the bitfield struct member can be the following to access the
 same bits as the above:
-
  * btf member bit offset 102,
  * btf member pointing to an int type,
  * the int type has ``BTF_INT_OFFSET() = 0`` and ``BTF_INT_BITS() = 4``
diff --git a/Documentation/devicetree/bindings/arm/cpus.yaml b/Documentation/devicetree/bindings/arm/cpus.yaml
index 365dcf384d73..82dd7582e945 100644
--- a/Documentation/devicetree/bindings/arm/cpus.yaml
+++ b/Documentation/devicetree/bindings/arm/cpus.yaml
@@ -228,7 +228,7 @@ patternProperties:
                 - renesas,r9a06g032-smp
                 - rockchip,rk3036-smp
                 - rockchip,rk3066-smp
-                - socionext,milbeaut-m10v-smp
+                - socionext,milbeaut-m10v-smp
                 - ste,dbx500-smp
 
       cpu-release-addr:
diff --git a/Documentation/devicetree/bindings/hwmon/adc128d818.txt b/Documentation/devicetree/bindings/hwmon/adc128d818.txt
index 08bab0e94d25..d0ae46d7bac3 100644
--- a/Documentation/devicetree/bindings/hwmon/adc128d818.txt
+++ b/Documentation/devicetree/bindings/hwmon/adc128d818.txt
@@ -26,7 +26,7 @@ Required node properties:
 
 Optional node properties:
 
- - ti,mode:     Operation mode (see above).
+ - ti,mode:     Operation mode (u8) (see above).
 
 
 Example (operation mode 2):
@@ -34,5 +34,5 @@ Example (operation mode 2):
         adc128d818@1d {
                 compatible = "ti,adc128d818";
                 reg = <0x1d>;
-                ti,mode = <2>;
+                ti,mode = /bits/ 8 <2>;
         };
diff --git a/Documentation/lzo.txt b/Documentation/lzo.txt
index f79934225d8d..ca983328976b 100644
--- a/Documentation/lzo.txt
+++ b/Documentation/lzo.txt
@@ -102,9 +102,11 @@ Byte sequences
                 dictionary which is empty, and that it will always be
                 invalid at this place.
 
-      17      : bitstream version. If the first byte is 17, the next byte
-                gives the bitstream version (version 1 only). If the first byte
-                is not 17, the bitstream version is 0.
+      17      : bitstream version. If the first byte is 17, and compressed
+                stream length is at least 5 bytes (length of shortest possible
+                versioned bitstream), the next byte gives the bitstream version
+                (version 1 only).
+                Otherwise, the bitstream version is 0.
 
       18..21  : copy 0..3 literals
                 state = (byte - 17) = 0..3  [ copy <state> literals ]
diff --git a/Documentation/networking/bpf_flow_dissector.rst b/Documentation/networking/bpf_flow_dissector.rst
new file mode 100644
index 000000000000..b375ae2ec2c4
--- /dev/null
+++ b/Documentation/networking/bpf_flow_dissector.rst
@@ -0,0 +1,126 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+==================
+BPF Flow Dissector
+==================
+
+Overview
+========
+
+Flow dissector is a routine that parses metadata out of the packets. It's
+used in the various places in the networking subsystem (RFS, flow hash, etc).
+
+BPF flow dissector is an attempt to reimplement C-based flow dissector logic
+in BPF to gain all the benefits of BPF verifier (namely, limits on the
+number of instructions and tail calls).
+
+API
+===
+
+BPF flow dissector programs operate on an ``__sk_buff``. However, only the
+limited set of fields is allowed: ``data``, ``data_end`` and ``flow_keys``.
+``flow_keys`` is ``struct bpf_flow_keys`` and contains flow dissector input
+and output arguments.
+
+The inputs are:
+  * ``nhoff`` - initial offset of the networking header
+  * ``thoff`` - initial offset of the transport header, initialized to nhoff
+  * ``n_proto`` - L3 protocol type, parsed out of L2 header
+
+Flow dissector BPF program should fill out the rest of the ``struct
+bpf_flow_keys`` fields. Input arguments ``nhoff/thoff/n_proto`` should be
+also adjusted accordingly.
+
+The return code of the BPF program is either BPF_OK to indicate successful
+dissection, or BPF_DROP to indicate parsing error.
+
+__sk_buff->data
+===============
+
+In the VLAN-less case, this is what the initial state of the BPF flow
+dissector looks like::
+
+  +------+------+------------+-----------+
+  | DMAC | SMAC | ETHER_TYPE | L3_HEADER |
+  +------+------+------------+-----------+
+                              ^
+                              |
+                              +-- flow dissector starts here
+
+
+.. code:: c
+
+  skb->data + flow_keys->nhoff point to the first byte of L3_HEADER
+  flow_keys->thoff = nhoff
+  flow_keys->n_proto = ETHER_TYPE
+
+In case of VLAN, flow dissector can be called with the two different states.
+
+Pre-VLAN parsing::
+
+  +------+------+------+-----+-----------+-----------+
+  | DMAC | SMAC | TPID | TCI |ETHER_TYPE | L3_HEADER |
+  +------+------+------+-----+-----------+-----------+
+                        ^
+                        |
+                        +-- flow dissector starts here
+
+.. code:: c
+
+  skb->data + flow_keys->nhoff point the to first byte of TCI
+  flow_keys->thoff = nhoff
+  flow_keys->n_proto = TPID
+
+Please note that TPID can be 802.1AD and, hence, BPF program would
+have to parse VLAN information twice for double tagged packets.
+
+
+Post-VLAN parsing::
+
+  +------+------+------+-----+-----------+-----------+
+  | DMAC | SMAC | TPID | TCI |ETHER_TYPE | L3_HEADER |
+  +------+------+------+-----+-----------+-----------+
+                                          ^
+                                          |
+                                          +-- flow dissector starts here
+
+.. code:: c
+
+  skb->data + flow_keys->nhoff point the to first byte of L3_HEADER
+  flow_keys->thoff = nhoff
+  flow_keys->n_proto = ETHER_TYPE
+
+In this case VLAN information has been processed before the flow dissector
+and BPF flow dissector is not required to handle it.
+
+
+The takeaway here is as follows: BPF flow dissector program can be called with
+the optional VLAN header and should gracefully handle both cases: when single
+or double VLAN is present and when it is not present. The same program
+can be called for both cases and would have to be written carefully to
+handle both cases.
+
+
+Reference Implementation
+========================
+
+See ``tools/testing/selftests/bpf/progs/bpf_flow.c`` for the reference
+implementation and ``tools/testing/selftests/bpf/flow_dissector_load.[hc]``
+for the loader. bpftool can be used to load BPF flow dissector program as well.
+
+The reference implementation is organized as follows:
+  * ``jmp_table`` map that contains sub-programs for each supported L3 protocol
+  * ``_dissect`` routine - entry point; it does input ``n_proto`` parsing and
+    does ``bpf_tail_call`` to the appropriate L3 handler
+
+Since BPF at this point doesn't support looping (or any jumping back),
+jmp_table is used instead to handle multiple levels of encapsulation (and
+IPv6 options).
+
+
+Current Limitations
+===================
+BPF flow dissector doesn't support exporting all the metadata that in-kernel
+C-based implementation can export. Notable example is single VLAN (802.1Q)
+and double VLAN (802.1AD) tags. Please refer to the ``struct bpf_flow_keys``
+for a set of information that's currently can be exported from the BPF context.
diff --git a/Documentation/networking/index.rst b/Documentation/networking/index.rst
index 5449149be496..984e68f9e026 100644
--- a/Documentation/networking/index.rst
+++ b/Documentation/networking/index.rst
@@ -9,6 +9,7 @@ Contents:
    netdev-FAQ
    af_xdp
    batman-adv
+   bpf_flow_dissector
    can
    can_ucan_protocol
    device_drivers/freescale/dpaa2/index
diff --git a/MAINTAINERS b/MAINTAINERS
index 8876f5de7738..8b63d0a3f2bf 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1893,14 +1893,15 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-nomadik.git
 ARM/NUVOTON NPCM ARCHITECTURE
 M:      Avi Fishman <avifishman70@gmail.com>
 M:      Tomer Maimon <tmaimon77@gmail.com>
+M:      Tali Perry <tali.perry1@gmail.com>
 R:      Patrick Venture <venture@google.com>
 R:      Nancy Yuen <yuenn@google.com>
-R:      Brendan Higgins <brendanhiggins@google.com>
+R:      Benjamin Fair <benjaminfair@google.com>
 L:      openbmc@lists.ozlabs.org (moderated for non-subscribers)
 S:      Supported
 F:      arch/arm/mach-npcm/
 F:      arch/arm/boot/dts/nuvoton-npcm*
-F:      include/dt-bindings/clock/nuvoton,npcm7xx-clks.h
+F:      include/dt-bindings/clock/nuvoton,npcm7xx-clock.h
 F:      drivers/*/*npcm*
 F:      Documentation/devicetree/bindings/*/*npcm*
 F:      Documentation/devicetree/bindings/*/*/*npcm*
@@ -4129,7 +4130,7 @@ F:	drivers/cpuidle/*
 F:      include/linux/cpuidle.h
 
 CRAMFS FILESYSTEM
-M:      Nicolas Pitre <nico@linaro.org>
+M:      Nicolas Pitre <nico@fluxnic.net>
 S:      Maintained
 F:      Documentation/filesystems/cramfs.txt
 F:      fs/cramfs/
@@ -5833,7 +5834,7 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 F:      Documentation/ABI/testing/sysfs-bus-mdio
 F:      Documentation/devicetree/bindings/net/mdio*
-F:      Documentation/networking/phy.txt
+F:      Documentation/networking/phy.rst
 F:      drivers/net/phy/
 F:      drivers/of/of_mdio.c
 F:      drivers/of/of_net.c
@@ -7515,7 +7516,7 @@ F:	include/net/mac802154.h
 F:      include/net/af_ieee802154.h
 F:      include/net/cfg802154.h
 F:      include/net/ieee802154_netdev.h
-F:      Documentation/networking/ieee802154.txt
+F:      Documentation/networking/ieee802154.rst
 
 IFE PROTOCOL
 M:      Yotam Gigi <yotam.gi@gmail.com>
@@ -13980,7 +13981,7 @@ F:	drivers/media/rc/serial_ir.c
 SFC NETWORK DRIVER
 M:      Solarflare linux maintainers <linux-net-drivers@solarflare.com>
 M:      Edward Cree <ecree@solarflare.com>
-M:      Bert Kenward <bkenward@solarflare.com>
+M:      Martin Habets <mhabets@solarflare.com>
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/sfc/
diff --git a/Makefile b/Makefile
index 026fbc450906..15c8251d4d5e 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 1
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME = Shy Crocodile
 
 # *DOCUMENTATION*
diff --git a/arch/arc/include/asm/syscall.h b/arch/arc/include/asm/syscall.h
index 29de09804306..c7a4201ed62b 100644
--- a/arch/arc/include/asm/syscall.h
+++ b/arch/arc/include/asm/syscall.h
@@ -55,12 +55,11 @@ syscall_set_return_value(struct task_struct *task, struct pt_regs *regs,
  */
 static inline void
 syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
-                      unsigned int i, unsigned int n, unsigned long *args)
+                      unsigned long *args)
 {
         unsigned long *inside_ptregs = &(regs->r0);
-        inside_ptregs -= i;
-
-        BUG_ON((i + n) > 6);
+        unsigned int n = 6;
+        unsigned int i = 0;
 
         while (n--) {
                 args[i++] = (*inside_ptregs);
diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts
index dce5be5df97b..edcff79879e7 100644
--- a/arch/arm/boot/dts/am335x-evm.dts
+++ b/arch/arm/boot/dts/am335x-evm.dts
@@ -57,6 +57,24 @@
                 enable-active-high;
         };
 
+        /* TPS79501 */
+        v1_8d_reg: fixedregulator-v1_8d {
+                compatible = "regulator-fixed";
+                regulator-name = "v1_8d";
+                vin-supply = <&vbat>;
+                regulator-min-microvolt = <1800000>;
+                regulator-max-microvolt = <1800000>;
+        };
+
+        /* TPS79501 */
+        v3_3d_reg: fixedregulator-v3_3d {
+                compatible = "regulator-fixed";
+                regulator-name = "v3_3d";
+                vin-supply = <&vbat>;
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+        };
+
         matrix_keypad: matrix_keypad0 {
                 compatible = "gpio-matrix-keypad";
                 debounce-delay-ms = <5>;
@@ -499,10 +517,10 @@
                 status = "okay";
 
                 /* Regulators */
-                AVDD-supply = <&vaux2_reg>;
-                IOVDD-supply = <&vaux2_reg>;
-                DRVDD-supply = <&vaux2_reg>;
-                DVDD-supply = <&vbat>;
+                AVDD-supply = <&v3_3d_reg>;
+                IOVDD-supply = <&v3_3d_reg>;
+                DRVDD-supply = <&v3_3d_reg>;
+                DVDD-supply = <&v1_8d_reg>;
         };
 };
 
diff --git a/arch/arm/boot/dts/am335x-evmsk.dts b/arch/arm/boot/dts/am335x-evmsk.dts
index b128998097ce..2c2d8b5b8cf5 100644
--- a/arch/arm/boot/dts/am335x-evmsk.dts
+++ b/arch/arm/boot/dts/am335x-evmsk.dts
@@ -73,6 +73,24 @@
                 enable-active-high;
         };
 
+        /* TPS79518 */
+        v1_8d_reg: fixedregulator-v1_8d {
+                compatible = "regulator-fixed";
+                regulator-name = "v1_8d";
+                vin-supply = <&vbat>;
+                regulator-min-microvolt = <1800000>;
+                regulator-max-microvolt = <1800000>;
+        };
+
+        /* TPS78633 */
+        v3_3d_reg: fixedregulator-v3_3d {
+                compatible = "regulator-fixed";
+                regulator-name = "v3_3d";
+                vin-supply = <&vbat>;
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+        };
+
         leds {
                 pinctrl-names = "default";
                 pinctrl-0 = <&user_leds_s0>;
@@ -501,10 +519,10 @@
                 status = "okay";
 
                 /* Regulators */
-                AVDD-supply = <&vaux2_reg>;
-                IOVDD-supply = <&vaux2_reg>;
-                DRVDD-supply = <&vaux2_reg>;
-                DVDD-supply = <&vbat>;
+                AVDD-supply = <&v3_3d_reg>;
+                IOVDD-supply = <&v3_3d_reg>;
+                DRVDD-supply = <&v3_3d_reg>;
+                DVDD-supply = <&v1_8d_reg>;
         };
 };
 
diff --git a/arch/arm/boot/dts/am33xx-l4.dtsi b/arch/arm/boot/dts/am33xx-l4.dtsi
index f459ec316a22..ca6d9f02a800 100644
--- a/arch/arm/boot/dts/am33xx-l4.dtsi
+++ b/arch/arm/boot/dts/am33xx-l4.dtsi
@@ -1762,7 +1762,7 @@
                         reg = <0xcc000 0x4>;
                         reg-names = "rev";
                         /* Domains (P, C): per_pwrdm, l4ls_clkdm */
-                        clocks = <&l4ls_clkctrl AM3_D_CAN0_CLKCTRL 0>;
+                        clocks = <&l4ls_clkctrl AM3_L4LS_D_CAN0_CLKCTRL 0>;
                         clock-names = "fck";
                         #address-cells = <1>;
                         #size-cells = <1>;
@@ -1785,7 +1785,7 @@
                         reg = <0xd0000 0x4>;
                         reg-names = "rev";
                         /* Domains (P, C): per_pwrdm, l4ls_clkdm */
-                        clocks = <&l4ls_clkctrl AM3_D_CAN1_CLKCTRL 0>;
+                        clocks = <&l4ls_clkctrl AM3_L4LS_D_CAN1_CLKCTRL 0>;
                         clock-names = "fck";
                         #address-cells = <1>;
                         #size-cells = <1>;
diff --git a/arch/arm/boot/dts/rk3288-tinker.dtsi b/arch/arm/boot/dts/rk3288-tinker.dtsi
index aa107ee41b8b..ef653c3209bc 100644
--- a/arch/arm/boot/dts/rk3288-tinker.dtsi
+++ b/arch/arm/boot/dts/rk3288-tinker.dtsi
@@ -254,6 +254,7 @@
                         };
 
                         vccio_sd: LDO_REG5 {
+                                regulator-boot-on;
                                 regulator-min-microvolt = <1800000>;
                                 regulator-max-microvolt = <3300000>;
                                 regulator-name = "vccio_sd";
@@ -430,7 +431,7 @@
         bus-width = <4>;
         cap-mmc-highspeed;
         cap-sd-highspeed;
-        card-detect-delay = <200>;
+        broken-cd;
         disable-wp;                     /* wp not hooked up */
         pinctrl-names = "default";
         pinctrl-0 = <&sdmmc_clk &sdmmc_cmd &sdmmc_cd &sdmmc_bus4>;
diff --git a/arch/arm/boot/dts/rk3288-veyron.dtsi b/arch/arm/boot/dts/rk3288-veyron.dtsi
index 0bc2409f6903..192dbc089ade 100644
--- a/arch/arm/boot/dts/rk3288-veyron.dtsi
+++ b/arch/arm/boot/dts/rk3288-veyron.dtsi
@@ -25,8 +25,6 @@
 
         gpio_keys: gpio-keys {
                 compatible = "gpio-keys";
-                #address-cells = <1>;
-                #size-cells = <0>;
 
                 pinctrl-names = "default";
                 pinctrl-0 = <&pwr_key_l>;
diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
index ca7d52daa8fb..a024d1e7e74c 100644
--- a/arch/arm/boot/dts/rk3288.dtsi
+++ b/arch/arm/boot/dts/rk3288.dtsi
@@ -70,7 +70,7 @@
                         compatible = "arm,cortex-a12";
                         reg = <0x501>;
                         resets = <&cru SRST_CORE1>;
-                        operating-points = <&cpu_opp_table>;
+                        operating-points-v2 = <&cpu_opp_table>;
                         #cooling-cells = <2>; /* min followed by max */
                         clock-latency = <40000>;
                         clocks = <&cru ARMCLK>;
@@ -80,7 +80,7 @@
                         compatible = "arm,cortex-a12";
                         reg = <0x502>;
                         resets = <&cru SRST_CORE2>;
-                        operating-points = <&cpu_opp_table>;
+                        operating-points-v2 = <&cpu_opp_table>;
                         #cooling-cells = <2>; /* min followed by max */
                         clock-latency = <40000>;
                         clocks = <&cru ARMCLK>;
@@ -90,7 +90,7 @@
                         compatible = "arm,cortex-a12";
                         reg = <0x503>;
                         resets = <&cru SRST_CORE3>;
-                        operating-points = <&cpu_opp_table>;
+                        operating-points-v2 = <&cpu_opp_table>;
                         #cooling-cells = <2>; /* min followed by max */
                         clock-latency = <40000>;
                         clocks = <&cru ARMCLK>;
@@ -1119,8 +1119,6 @@
                 clock-names = "ref", "pclk";
                 power-domains = <&power RK3288_PD_VIO>;
                 rockchip,grf = <&grf>;
-                #address-cells = <1>;
-                #size-cells = <0>;
                 status = "disabled";
 
                 ports {
@@ -1282,27 +1280,27 @@
         gpu_opp_table: gpu-opp-table {
                 compatible = "operating-points-v2";
 
-                opp@100000000 {
+                opp-100000000 {
                         opp-hz = /bits/ 64 <100000000>;
                         opp-microvolt = <950000>;
                 };
-                opp@200000000 {
+                opp-200000000 {
                         opp-hz = /bits/ 64 <200000000>;
                         opp-microvolt = <950000>;
                 };
-                opp@300000000 {
+                opp-300000000 {
                         opp-hz = /bits/ 64 <300000000>;
                         opp-microvolt = <1000000>;
                 };
-                opp@400000000 {
+                opp-400000000 {
                         opp-hz = /bits/ 64 <400000000>;
                         opp-microvolt = <1100000>;
                 };
-                opp@500000000 {
+                opp-500000000 {
                         opp-hz = /bits/ 64 <500000000>;
                         opp-microvolt = <1200000>;
                 };
-                opp@600000000 {
+                opp-600000000 {
                         opp-hz = /bits/ 64 <600000000>;
                         opp-microvolt = <1250000>;
                 };
diff --git a/arch/arm/boot/dts/sama5d2-pinfunc.h b/arch/arm/boot/dts/sama5d2-pinfunc.h
index 1c01a6f843d8..28a2e45752fe 100644
--- a/arch/arm/boot/dts/sama5d2-pinfunc.h
+++ b/arch/arm/boot/dts/sama5d2-pinfunc.h
@@ -518,7 +518,7 @@
 #define PIN_PC9__GPIO                   PINMUX_PIN(PIN_PC9, 0, 0)
 #define PIN_PC9__FIQ                    PINMUX_PIN(PIN_PC9, 1, 3)
 #define PIN_PC9__GTSUCOMP               PINMUX_PIN(PIN_PC9, 2, 1)
-#define PIN_PC9__ISC_D0                 PINMUX_PIN(PIN_PC9, 2, 1)
+#define PIN_PC9__ISC_D0                 PINMUX_PIN(PIN_PC9, 3, 1)
 #define PIN_PC9__TIOA4                  PINMUX_PIN(PIN_PC9, 4, 2)
 #define PIN_PC10                        74
 #define PIN_PC10__GPIO                  PINMUX_PIN(PIN_PC10, 0, 0)
diff --git a/arch/arm/boot/dts/ste-nomadik-nhk15.dts b/arch/arm/boot/dts/ste-nomadik-nhk15.dts
index f2f6558a00f1..04066f9cb8a3 100644
--- a/arch/arm/boot/dts/ste-nomadik-nhk15.dts
+++ b/arch/arm/boot/dts/ste-nomadik-nhk15.dts
@@ -213,13 +213,12 @@
                 gpio-sck = <&gpio0 5 GPIO_ACTIVE_HIGH>;
                 gpio-mosi = <&gpio0 4 GPIO_ACTIVE_HIGH>;
                 /*
-                 * This chipselect is active high. Just setting the flags
-                 * to GPIO_ACTIVE_HIGH is not enough for the SPI DT bindings,
-                 * it will be ignored, only the special "spi-cs-high" flag
-                 * really counts.
+                 * It's not actually active high, but the frameworks assume
+                 * the polarity of the passed-in GPIO is "normal" (active
+                 * high) then actively drives the line low to select the
+                 * chip.
                  */
                 cs-gpios = <&gpio0 6 GPIO_ACTIVE_HIGH>;
-                spi-cs-high;
                 num-chipselects = <1>;
 
                 /*
diff --git a/arch/arm/include/asm/syscall.h b/arch/arm/include/asm/syscall.h
index 06dea6bce293..080ce70cab12 100644
--- a/arch/arm/include/asm/syscall.h
+++ b/arch/arm/include/asm/syscall.h
@@ -55,53 +55,22 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        if (n == 0)
-                return;
-
-        if (i + n > SYSCALL_MAX_ARGS) {
-                unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i;
-                unsigned int n_bad = n + i - SYSCALL_MAX_ARGS;
-                pr_warn("%s called with max args %d, handling only %d\n",
-                        __func__, i + n, SYSCALL_MAX_ARGS);
-                memset(args_bad, 0, n_bad * sizeof(args[0]));
-                n = SYSCALL_MAX_ARGS - i;
-        }
-
-        if (i == 0) {
-                args[0] = regs->ARM_ORIG_r0;
-                args++;
-                i++;
-                n--;
-        }
-
-        memcpy(args, &regs->ARM_r0 + i, n * sizeof(args[0]));
+        args[0] = regs->ARM_ORIG_r0;
+        args++;
+
+        memcpy(args, &regs->ARM_r0 + 1, 5 * sizeof(args[0]));
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        if (n == 0)
-                return;
-
-        if (i + n > SYSCALL_MAX_ARGS) {
-                pr_warn("%s called with max args %d, handling only %d\n",
-                        __func__, i + n, SYSCALL_MAX_ARGS);
-                n = SYSCALL_MAX_ARGS - i;
-        }
-
-        if (i == 0) {
-                regs->ARM_ORIG_r0 = args[0];
-                args++;
-                i++;
-                n--;
-        }
-
-        memcpy(&regs->ARM_r0 + i, args, n * sizeof(args[0]));
+        regs->ARM_ORIG_r0 = args[0];
+        args++;
+
+        memcpy(&regs->ARM_r0 + 1, args, 5 * sizeof(args[0]));
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 51e808adb00c..2a757dcaa1a5 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -591,13 +591,13 @@ static int __init at91_pm_backup_init(void)
 
         np = of_find_compatible_node(NULL, NULL, "atmel,sama5d2-securam");
         if (!np)
-                goto securam_fail;
+                goto securam_fail_no_ref_dev;
 
         pdev = of_find_device_by_node(np);
         of_node_put(np);
         if (!pdev) {
                 pr_warn("%s: failed to find securam device!\n", __func__);
-                goto securam_fail;
+                goto securam_fail_no_ref_dev;
         }
 
         sram_pool = gen_pool_get(&pdev->dev, NULL);
@@ -620,6 +620,8 @@ static int __init at91_pm_backup_init(void)
         return 0;
 
 securam_fail:
+        put_device(&pdev->dev);
+securam_fail_no_ref_dev:
         iounmap(pm_data.sfrbu);
         pm_data.sfrbu = NULL;
         return ret;
diff --git a/arch/arm/mach-iop13xx/setup.c b/arch/arm/mach-iop13xx/setup.c
index 53c316f7301e..fe4932fda01d 100644
--- a/arch/arm/mach-iop13xx/setup.c
+++ b/arch/arm/mach-iop13xx/setup.c
@@ -300,7 +300,7 @@ static struct resource iop13xx_adma_2_resources[] = {
         }
 };
 
-static u64 iop13xx_adma_dmamask = DMA_BIT_MASK(64);
+static u64 iop13xx_adma_dmamask = DMA_BIT_MASK(32);
 static struct iop_adma_platform_data iop13xx_adma_0_data = {
         .hw_id = 0,
         .pool_size = PAGE_SIZE,
@@ -324,7 +324,7 @@ static struct platform_device iop13xx_adma_0_channel = {
         .resource = iop13xx_adma_0_resources,
         .dev = {
                 .dma_mask = &iop13xx_adma_dmamask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
                 .platform_data = (void *) &iop13xx_adma_0_data,
         },
 };
@@ -336,7 +336,7 @@ static struct platform_device iop13xx_adma_1_channel = {
         .resource = iop13xx_adma_1_resources,
         .dev = {
                 .dma_mask = &iop13xx_adma_dmamask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
                 .platform_data = (void *) &iop13xx_adma_1_data,
         },
 };
@@ -348,7 +348,7 @@ static struct platform_device iop13xx_adma_2_channel = {
         .resource = iop13xx_adma_2_resources,
         .dev = {
                 .dma_mask = &iop13xx_adma_dmamask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
                 .platform_data = (void *) &iop13xx_adma_2_data,
         },
 };
diff --git a/arch/arm/mach-iop13xx/tpmi.c b/arch/arm/mach-iop13xx/tpmi.c
index db511ec2b1df..116feb6b261e 100644
--- a/arch/arm/mach-iop13xx/tpmi.c
+++ b/arch/arm/mach-iop13xx/tpmi.c
@@ -152,7 +152,7 @@ static struct resource iop13xx_tpmi_3_resources[] = {
         }
 };
 
-u64 iop13xx_tpmi_mask = DMA_BIT_MASK(64);
+u64 iop13xx_tpmi_mask = DMA_BIT_MASK(32);
 static struct platform_device iop13xx_tpmi_0_device = {
         .name = "iop-tpmi",
         .id = 0,
@@ -160,7 +160,7 @@ static struct platform_device iop13xx_tpmi_0_device = {
         .resource = iop13xx_tpmi_0_resources,
         .dev = {
                 .dma_mask          = &iop13xx_tpmi_mask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
         },
 };
 
@@ -171,7 +171,7 @@ static struct platform_device iop13xx_tpmi_1_device = {
         .resource = iop13xx_tpmi_1_resources,
         .dev = {
                 .dma_mask          = &iop13xx_tpmi_mask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
         },
 };
 
@@ -182,7 +182,7 @@ static struct platform_device iop13xx_tpmi_2_device = {
         .resource = iop13xx_tpmi_2_resources,
         .dev = {
                 .dma_mask          = &iop13xx_tpmi_mask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
         },
 };
 
@@ -193,7 +193,7 @@ static struct platform_device iop13xx_tpmi_3_device = {
         .resource = iop13xx_tpmi_3_resources,
         .dev = {
                 .dma_mask          = &iop13xx_tpmi_mask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
         },
 };
 
diff --git a/arch/arm/mach-milbeaut/platsmp.c b/arch/arm/mach-milbeaut/platsmp.c
index 591543c81399..3ea880f5fcb7 100644
--- a/arch/arm/mach-milbeaut/platsmp.c
+++ b/arch/arm/mach-milbeaut/platsmp.c
@@ -65,6 +65,7 @@ static void m10v_smp_init(unsigned int max_cpus)
                 writel(KERNEL_UNBOOT_FLAG, m10v_smp_base + cpu * 4);
 }
 
+#ifdef CONFIG_HOTPLUG_CPU
 static void m10v_cpu_die(unsigned int l_cpu)
 {
         gic_cpu_if_down(0);
@@ -83,12 +84,15 @@ static int m10v_cpu_kill(unsigned int l_cpu)
 
         return 1;
 }
+#endif
 
 static struct smp_operations m10v_smp_ops __initdata = {
         .smp_prepare_cpus       = m10v_smp_init,
         .smp_boot_secondary     = m10v_boot_secondary,
+#ifdef CONFIG_HOTPLUG_CPU
         .cpu_die                = m10v_cpu_die,
         .cpu_kill               = m10v_cpu_kill,
+#endif
 };
 CPU_METHOD_OF_DECLARE(m10v_smp, "socionext,milbeaut-m10v-smp", &m10v_smp_ops);
 
diff --git a/arch/arm/mach-omap1/board-ams-delta.c b/arch/arm/mach-omap1/board-ams-delta.c
index be30c3c061b4..1b15d593837e 100644
--- a/arch/arm/mach-omap1/board-ams-delta.c
+++ b/arch/arm/mach-omap1/board-ams-delta.c
@@ -182,6 +182,7 @@ static struct resource latch1_resources[] = {
 
 static struct bgpio_pdata latch1_pdata = {
         .label  = LATCH1_LABEL,
+        .base   = -1,
         .ngpio  = LATCH1_NGPIO,
 };
 
@@ -219,6 +220,7 @@ static struct resource latch2_resources[] = {
 
 static struct bgpio_pdata latch2_pdata = {
         .label  = LATCH2_LABEL,
+        .base   = -1,
         .ngpio  = LATCH2_NGPIO,
 };
 
diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c
index 1444b4b4bd9f..439e143cad7b 100644
--- a/arch/arm/mach-omap2/display.c
+++ b/arch/arm/mach-omap2/display.c
@@ -250,8 +250,10 @@ static int __init omapdss_init_of(void)
         if (!node)
                 return 0;
 
-        if (!of_device_is_available(node))
+        if (!of_device_is_available(node)) {
+                of_node_put(node);
                 return 0;
+        }
 
         pdev = of_find_device_by_node(node);
 
diff --git a/arch/arm/plat-iop/adma.c b/arch/arm/plat-iop/adma.c
index a4d1f8de3b5b..d9612221e484 100644
--- a/arch/arm/plat-iop/adma.c
+++ b/arch/arm/plat-iop/adma.c
@@ -143,7 +143,7 @@ struct platform_device iop3xx_dma_0_channel = {
         .resource = iop3xx_dma_0_resources,
         .dev = {
                 .dma_mask = &iop3xx_adma_dmamask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
                 .platform_data = (void *) &iop3xx_dma_0_data,
         },
 };
@@ -155,7 +155,7 @@ struct platform_device iop3xx_dma_1_channel = {
         .resource = iop3xx_dma_1_resources,
         .dev = {
                 .dma_mask = &iop3xx_adma_dmamask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
                 .platform_data = (void *) &iop3xx_dma_1_data,
         },
 };
@@ -167,7 +167,7 @@ struct platform_device iop3xx_aau_channel = {
         .resource = iop3xx_aau_resources,
         .dev = {
                 .dma_mask = &iop3xx_adma_dmamask,
-                .coherent_dma_mask = DMA_BIT_MASK(64),
+                .coherent_dma_mask = DMA_BIT_MASK(32),
                 .platform_data = (void *) &iop3xx_aau_data,
         },
 };
diff --git a/arch/arm/plat-orion/common.c b/arch/arm/plat-orion/common.c
index a6c81ce00f52..8647cb80a93b 100644
--- a/arch/arm/plat-orion/common.c
+++ b/arch/arm/plat-orion/common.c
@@ -622,7 +622,7 @@ static struct platform_device orion_xor0_shared = {
         .resource       = orion_xor0_shared_resources,
         .dev            = {
                 .dma_mask               = &orion_xor_dmamask,
-                .coherent_dma_mask      = DMA_BIT_MASK(64),
+                .coherent_dma_mask      = DMA_BIT_MASK(32),
                 .platform_data          = &orion_xor0_pdata,
         },
 };
@@ -683,7 +683,7 @@ static struct platform_device orion_xor1_shared = {
         .resource       = orion_xor1_shared_resources,
         .dev            = {
                 .dma_mask               = &orion_xor_dmamask,
-                .coherent_dma_mask      = DMA_BIT_MASK(64),
+                .coherent_dma_mask      = DMA_BIT_MASK(32),
                 .platform_data          = &orion_xor1_pdata,
         },
 };
diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
index 7c649f6b14cb..cd7c76e58b09 100644
--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
@@ -162,6 +162,7 @@
                         rx-fifo-depth = <16384>;
                         snps,multicast-filter-bins = <256>;
                         iommus = <&smmu 1>;
+                        altr,sysmgr-syscon = <&sysmgr 0x44 0>;
                         status = "disabled";
                 };
 
@@ -179,6 +180,7 @@
                         rx-fifo-depth = <16384>;
                         snps,multicast-filter-bins = <256>;
                         iommus = <&smmu 2>;
+                        altr,sysmgr-syscon = <&sysmgr 0x48 0>;
                         status = "disabled";
                 };
 
@@ -196,6 +198,7 @@
                         rx-fifo-depth = <16384>;
                         snps,multicast-filter-bins = <256>;
                         iommus = <&smmu 3>;
+                        altr,sysmgr-syscon = <&sysmgr 0x4c 0>;
                         status = "disabled";
                 };
 
diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
index 33c44e857247..0e34354b2092 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
@@ -108,8 +108,8 @@
         snps,reset-gpio = <&gpio1 RK_PC2 GPIO_ACTIVE_LOW>;
         snps,reset-active-low;
         snps,reset-delays-us = <0 10000 50000>;
-        tx_delay = <0x25>;
-        rx_delay = <0x11>;
+        tx_delay = <0x24>;
+        rx_delay = <0x18>;
         status = "okay";
 };
 
diff --git a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
index 2157a528276b..79b4d1d4b5d6 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
@@ -46,8 +46,7 @@
 
         vcc_host1_5v: vcc_otg_5v: vcc-host1-5v-regulator {
                 compatible = "regulator-fixed";
-                enable-active-high;
-                gpio = <&gpio0 RK_PA2 GPIO_ACTIVE_HIGH>;
+                gpio = <&gpio0 RK_PA2 GPIO_ACTIVE_LOW>;
                 pinctrl-names = "default";
                 pinctrl-0 = <&usb20_host_drv>;
                 regulator-name = "vcc_host1_5v";
diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
index 84f14b132e8f..dabef1a21649 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
@@ -1445,11 +1445,11 @@
 
                 sdmmc0 {
                         sdmmc0_clk: sdmmc0-clk {
-                                rockchip,pins = <1 RK_PA6 1 &pcfg_pull_none_4ma>;
+                                rockchip,pins = <1 RK_PA6 1 &pcfg_pull_none_8ma>;
                         };
 
                         sdmmc0_cmd: sdmmc0-cmd {
-                                rockchip,pins = <1 RK_PA4 1 &pcfg_pull_up_4ma>;
+                                rockchip,pins = <1 RK_PA4 1 &pcfg_pull_up_8ma>;
                         };
 
                         sdmmc0_dectn: sdmmc0-dectn {
@@ -1461,14 +1461,14 @@
                         };
 
                         sdmmc0_bus1: sdmmc0-bus1 {
-                                rockchip,pins = <1 RK_PA0 1 &pcfg_pull_up_4ma>;
+                                rockchip,pins = <1 RK_PA0 1 &pcfg_pull_up_8ma>;
                         };
 
                         sdmmc0_bus4: sdmmc0-bus4 {
-                                rockchip,pins = <1 RK_PA0 1 &pcfg_pull_up_4ma>,
-                                                <1 RK_PA1 1 &pcfg_pull_up_4ma>,
-                                                <1 RK_PA2 1 &pcfg_pull_up_4ma>,
-                                                <1 RK_PA3 1 &pcfg_pull_up_4ma>;
+                                rockchip,pins = <1 RK_PA0 1 &pcfg_pull_up_8ma>,
+                                                <1 RK_PA1 1 &pcfg_pull_up_8ma>,
+                                                <1 RK_PA2 1 &pcfg_pull_up_8ma>,
+                                                <1 RK_PA3 1 &pcfg_pull_up_8ma>;
                         };
 
                         sdmmc0_gpio: sdmmc0-gpio {
@@ -1642,50 +1642,50 @@
                         rgmiim1_pins: rgmiim1-pins {
                                 rockchip,pins =
                                         /* mac_txclk */
-                                        <1 RK_PB4 2 &pcfg_pull_none_12ma>,
+                                        <1 RK_PB4 2 &pcfg_pull_none_8ma>,
                                         /* mac_rxclk */
-                                        <1 RK_PB5 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PB5 2 &pcfg_pull_none_4ma>,
                                         /* mac_mdio */
-                                        <1 RK_PC3 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PC3 2 &pcfg_pull_none_4ma>,
                                         /* mac_txen */
-                                        <1 RK_PD1 2 &pcfg_pull_none_12ma>,
+                                        <1 RK_PD1 2 &pcfg_pull_none_8ma>,
                                         /* mac_clk */
-                                        <1 RK_PC5 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PC5 2 &pcfg_pull_none_4ma>,
                                         /* mac_rxdv */
-                                        <1 RK_PC6 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PC6 2 &pcfg_pull_none_4ma>,
                                         /* mac_mdc */
-                                        <1 RK_PC7 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PC7 2 &pcfg_pull_none_4ma>,
                                         /* mac_rxd1 */
-                                        <1 RK_PB2 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PB2 2 &pcfg_pull_none_4ma>,
                                         /* mac_rxd0 */
-                                        <1 RK_PB3 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PB3 2 &pcfg_pull_none_4ma>,
                                         /* mac_txd1 */
-                                        <1 RK_PB0 2 &pcfg_pull_none_12ma>,
+                                        <1 RK_PB0 2 &pcfg_pull_none_8ma>,
                                         /* mac_txd0 */
-                                        <1 RK_PB1 2 &pcfg_pull_none_12ma>,
+                                        <1 RK_PB1 2 &pcfg_pull_none_8ma>,
                                         /* mac_rxd3 */
-                                        <1 RK_PB6 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PB6 2 &pcfg_pull_none_4ma>,
                                         /* mac_rxd2 */
-                                        <1 RK_PB7 2 &pcfg_pull_none_2ma>,
+                                        <1 RK_PB7 2 &pcfg_pull_none_4ma>,
                                         /* mac_txd3 */
-                                        <1 RK_PC0 2 &pcfg_pull_none_12ma>,
+                                        <1 RK_PC0 2 &pcfg_pull_none_8ma>,
                                         /* mac_txd2 */
-                                        <1 RK_PC1 2 &pcfg_pull_none_12ma>,
+                                        <1 RK_PC1 2 &pcfg_pull_none_8ma>,
 
                                         /* mac_txclk */
-                                        <0 RK_PB0 1 &pcfg_pull_none>,
+                                        <0 RK_PB0 1 &pcfg_pull_none_8ma>,
                                         /* mac_txen */
-                                        <0 RK_PB4 1 &pcfg_pull_none>,
+                                        <0 RK_PB4 1 &pcfg_pull_none_8ma>,
                                         /* mac_clk */
-                                        <0 RK_PD0 1 &pcfg_pull_none>,
+                                        <0 RK_PD0 1 &pcfg_pull_none_4ma>,
                                         /* mac_txd1 */
-                                        <0 RK_PC0 1 &pcfg_pull_none>,
+                                        <0 RK_PC0 1 &pcfg_pull_none_8ma>,
                                         /* mac_txd0 */
-                                        <0 RK_PC1 1 &pcfg_pull_none>,
+                                        <0 RK_PC1 1 &pcfg_pull_none_8ma>,
                                         /* mac_txd3 */
-                                        <0 RK_PC7 1 &pcfg_pull_none>,
+                                        <0 RK_PC7 1 &pcfg_pull_none_8ma>,
                                         /* mac_txd2 */
-                                        <0 RK_PC6 1 &pcfg_pull_none>;
+                                        <0 RK_PC6 1 &pcfg_pull_none_8ma>;
                         };
 
                         rmiim1_pins: rmiim1-pins {
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dts b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dts
index 4a543f2117d4..844eac939a97 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dts
@@ -158,6 +158,7 @@
 };
 
 &hdmi {
+        ddc-i2c-bus = <&i2c3>;
         pinctrl-names = "default";
         pinctrl-0 = <&hdmi_cec>;
         status = "okay";
diff --git a/arch/arm64/include/asm/syscall.h b/arch/arm64/include/asm/syscall.h
index ad8be16a39c9..a179df3674a1 100644
--- a/arch/arm64/include/asm/syscall.h
+++ b/arch/arm64/include/asm/syscall.h
@@ -65,52 +65,22 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        if (n == 0)
-                return;
-
-        if (i + n > SYSCALL_MAX_ARGS) {
-                unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i;
-                unsigned int n_bad = n + i - SYSCALL_MAX_ARGS;
-                pr_warning("%s called with max args %d, handling only %d\n",
-                           __func__, i + n, SYSCALL_MAX_ARGS);
-                memset(args_bad, 0, n_bad * sizeof(args[0]));
-        }
-
-        if (i == 0) {
-                args[0] = regs->orig_x0;
-                args++;
-                i++;
-                n--;
-        }
-
-        memcpy(args, &regs->regs[i], n * sizeof(args[0]));
+        args[0] = regs->orig_x0;
+        args++;
+
+        memcpy(args, &regs->regs[1], 5 * sizeof(args[0]));
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        if (n == 0)
-                return;
-
-        if (i + n > SYSCALL_MAX_ARGS) {
-                pr_warning("%s called with max args %d, handling only %d\n",
-                           __func__, i + n, SYSCALL_MAX_ARGS);
-                n = SYSCALL_MAX_ARGS - i;
-        }
-
-        if (i == 0) {
-                regs->orig_x0 = args[0];
-                args++;
-                i++;
-                n--;
-        }
-
-        memcpy(&regs->regs[i], args, n * sizeof(args[0]));
+        regs->orig_x0 = args[0];
+        args++;
+
+        memcpy(&regs->regs[1], args, 5 * sizeof(args[0]));
 }
 
 /*
diff --git a/arch/arm64/kernel/sdei.c b/arch/arm64/kernel/sdei.c
index 5ba4465e44f0..ea94cf8f9dc6 100644
--- a/arch/arm64/kernel/sdei.c
+++ b/arch/arm64/kernel/sdei.c
@@ -94,6 +94,9 @@ static bool on_sdei_normal_stack(unsigned long sp, struct stack_info *info)
         unsigned long low = (unsigned long)raw_cpu_read(sdei_stack_normal_ptr);
         unsigned long high = low + SDEI_STACK_SIZE;
 
+        if (!low)
+                return false;
+
         if (sp < low || sp >= high)
                 return false;
 
@@ -111,6 +114,9 @@ static bool on_sdei_critical_stack(unsigned long sp, struct stack_info *info)
         unsigned long low = (unsigned long)raw_cpu_read(sdei_stack_critical_ptr);
         unsigned long high = low + SDEI_STACK_SIZE;
 
+        if (!low)
+                return false;
+
         if (sp < low || sp >= high)
                 return false;
 
diff --git a/arch/c6x/include/asm/syscall.h b/arch/c6x/include/asm/syscall.h
index ae2be315ee9c..15ba8599858e 100644
--- a/arch/c6x/include/asm/syscall.h
+++ b/arch/c6x/include/asm/syscall.h
@@ -46,78 +46,27 @@ static inline void syscall_set_return_value(struct task_struct *task,
 }
 
 static inline void syscall_get_arguments(struct task_struct *task,
-                                         struct pt_regs *regs, unsigned int i,
-                                         unsigned int n, unsigned long *args)
+                                         struct pt_regs *regs,
+                                         unsigned long *args)
 {
-        switch (i) {
-        case 0:
-                if (!n--)
-                        break;
-                *args++ = regs->a4;
-        case 1:
-                if (!n--)
-                        break;
-                *args++ = regs->b4;
-        case 2:
-                if (!n--)
-                        break;
-                *args++ = regs->a6;
-        case 3:
-                if (!n--)
-                        break;
-                *args++ = regs->b6;
-        case 4:
-                if (!n--)
-                        break;
-                *args++ = regs->a8;
-        case 5:
-                if (!n--)
-                        break;
-                *args++ = regs->b8;
-        case 6:
-                if (!n--)
-                        break;
-        default:
-                BUG();
-        }
+        *args++ = regs->a4;
+        *args++ = regs->b4;
+        *args++ = regs->a6;
+        *args++ = regs->b6;
+        *args++ = regs->a8;
+        *args   = regs->b8;
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        switch (i) {
-        case 0:
-                if (!n--)
-                        break;
-                regs->a4 = *args++;
-        case 1:
-                if (!n--)
-                        break;
-                regs->b4 = *args++;
-        case 2:
-                if (!n--)
-                        break;
-                regs->a6 = *args++;
-        case 3:
-                if (!n--)
-                        break;
-                regs->b6 = *args++;
-        case 4:
-                if (!n--)
-                        break;
-                regs->a8 = *args++;
-        case 5:
-                if (!n--)
-                        break;
-                regs->a9 = *args++;
-        case 6:
-                if (!n)
-                        break;
-        default:
-                BUG();
-        }
+        regs->a4 = *args++;
+        regs->b4 = *args++;
+        regs->a6 = *args++;
+        regs->b6 = *args++;
+        regs->a8 = *args++;
+        regs->a9 = *args;
 }
 
 #endif /* __ASM_C6X_SYSCALLS_H */
diff --git a/arch/csky/include/asm/syscall.h b/arch/csky/include/asm/syscall.h
index d637445737b7..bda0a446c63e 100644
--- a/arch/csky/include/asm/syscall.h
+++ b/arch/csky/include/asm/syscall.h
@@ -43,30 +43,20 @@ syscall_set_return_value(struct task_struct *task, struct pt_regs *regs,
 
 static inline void
 syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
-                      unsigned int i, unsigned int n, unsigned long *args)
+                      unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        if (i == 0) {
-                args[0] = regs->orig_a0;
-                args++;
-                i++;
-                n--;
-        }
-        memcpy(args, &regs->a1 + i * sizeof(regs->a1), n * sizeof(args[0]));
+        args[0] = regs->orig_a0;
+        args++;
+        memcpy(args, &regs->a1, 5 * sizeof(args[0]));
 }
 
 static inline void
 syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
-                      unsigned int i, unsigned int n, const unsigned long *args)
+                      const unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        if (i == 0) {
-                regs->orig_a0 = args[0];
-                args++;
-                i++;
-                n--;
-        }
-        memcpy(&regs->a1 + i * sizeof(regs->a1), args, n * sizeof(regs->a0));
+        regs->orig_a0 = args[0];
+        args++;
+        memcpy(&regs->a1, args, 5 * sizeof(regs->a1));
 }
 
 static inline int
diff --git a/arch/h8300/include/asm/syscall.h b/arch/h8300/include/asm/syscall.h
index 924990401237..ddd483c6ca95 100644
--- a/arch/h8300/include/asm/syscall.h
+++ b/arch/h8300/include/asm/syscall.h
@@ -17,34 +17,14 @@ syscall_get_nr(struct task_struct *task, struct pt_regs *regs)
 
 static inline void
 syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
-                      unsigned int i, unsigned int n, unsigned long *args)
+                      unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-
-        while (n > 0) {
-                switch (i) {
-                case 0:
-                        *args++ = regs->er1;
-                        break;
-                case 1:
-                        *args++ = regs->er2;
-                        break;
-                case 2:
-                        *args++ = regs->er3;
-                        break;
-                case 3:
-                        *args++ = regs->er4;
-                        break;
-                case 4:
-                        *args++ = regs->er5;
-                        break;
-                case 5:
-                        *args++ = regs->er6;
-                        break;
-                }
-                i++;
-                n--;
-        }
+        *args++ = regs->er1;
+        *args++ = regs->er2;
+        *args++ = regs->er3;
+        *args++ = regs->er4;
+        *args++ = regs->er5;
+        *args   = regs->er6;
 }
 
 
diff --git a/arch/hexagon/include/asm/syscall.h b/arch/hexagon/include/asm/syscall.h
index 4af9c7b6f13a..ae3a1e24fabd 100644
--- a/arch/hexagon/include/asm/syscall.h
+++ b/arch/hexagon/include/asm/syscall.h
@@ -37,10 +37,8 @@ static inline long syscall_get_nr(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        memcpy(args, &(&regs->r00)[i], n * sizeof(args[0]));
+        memcpy(args, &(&regs->r00)[0], 6 * sizeof(args[0]));
 }
 #endif
diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h
index 1d0b875fec44..0d9e7fab4a79 100644
--- a/arch/ia64/include/asm/syscall.h
+++ b/arch/ia64/include/asm/syscall.h
@@ -59,26 +59,19 @@ static inline void syscall_set_return_value(struct task_struct *task,
 }
 
 extern void ia64_syscall_get_set_arguments(struct task_struct *task,
-        struct pt_regs *regs, unsigned int i, unsigned int n,
-        unsigned long *args, int rw);
+        struct pt_regs *regs, unsigned long *args, int rw);
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-
-        ia64_syscall_get_set_arguments(task, regs, i, n, args, 0);
+        ia64_syscall_get_set_arguments(task, regs, args, 0);
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-
-        ia64_syscall_get_set_arguments(task, regs, i, n, args, 1);
+        ia64_syscall_get_set_arguments(task, regs, args, 1);
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
index 6d50ede0ed69..bf9c24d9ce84 100644
--- a/arch/ia64/kernel/ptrace.c
+++ b/arch/ia64/kernel/ptrace.c
@@ -2179,12 +2179,11 @@ static void syscall_get_set_args_cb(struct unw_frame_info *info, void *data)
 }
 
 void ia64_syscall_get_set_arguments(struct task_struct *task,
-        struct pt_regs *regs, unsigned int i, unsigned int n,
-        unsigned long *args, int rw)
+        struct pt_regs *regs, unsigned long *args, int rw)
 {
         struct syscall_get_set_args data = {
-                .i = i,
-                .n = n,
+                .i = 0,
+                .n = 6,
                 .args = args,
                 .regs = regs,
                 .rw = rw,
diff --git a/arch/microblaze/include/asm/syscall.h b/arch/microblaze/include/asm/syscall.h
index 220decd605a4..833d3a53dab3 100644
--- a/arch/microblaze/include/asm/syscall.h
+++ b/arch/microblaze/include/asm/syscall.h
@@ -82,18 +82,22 @@ static inline void microblaze_set_syscall_arg(struct pt_regs *regs,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
+        unsigned int i = 0;
+        unsigned int n = 6;
+
         while (n--)
                 *args++ = microblaze_get_syscall_arg(regs, i++);
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
+        unsigned int i = 0;
+        unsigned int n = 6;
+
         while (n--)
                 microblaze_set_syscall_arg(regs, i++, *args++);
 }
diff --git a/arch/mips/configs/generic/board-ocelot.config b/arch/mips/configs/generic/board-ocelot.config
index f607888d2483..184eb65a6ba7 100644
--- a/arch/mips/configs/generic/board-ocelot.config
+++ b/arch/mips/configs/generic/board-ocelot.config
@@ -1,6 +1,10 @@
 # require CONFIG_CPU_MIPS32_R2=y
 
 CONFIG_LEGACY_BOARD_OCELOT=y
+CONFIG_FIT_IMAGE_FDT_OCELOT=y
+
+CONFIG_BRIDGE=y
+CONFIG_GENERIC_PHY=y
 
 CONFIG_MTD=y
 CONFIG_MTD_CMDLINE_PARTS=y
@@ -19,6 +23,8 @@ CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_OF_PLATFORM=y
 
 CONFIG_NETDEVICES=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NET_DSA=y
 CONFIG_MSCC_OCELOT_SWITCH=y
 CONFIG_MSCC_OCELOT_SWITCH_OCELOT=y
 CONFIG_MDIO_MSCC_MIIM=y
@@ -35,6 +41,8 @@ CONFIG_SPI_DESIGNWARE=y
 CONFIG_SPI_DW_MMIO=y
 CONFIG_SPI_SPIDEV=y
 
+CONFIG_PINCTRL_OCELOT=y
+
 CONFIG_GPIO_SYSFS=y
 
 CONFIG_POWER_RESET=y
diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
index 6cf8ffb5367e..a2b4748655df 100644
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -116,9 +116,10 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
+        unsigned int i = 0;
+        unsigned int n = 6;
         int ret;
 
         /* O32 ABI syscall() */
diff --git a/arch/mips/kernel/kgdb.c b/arch/mips/kernel/kgdb.c
index 6e574c02e4c3..ea781b29f7f1 100644
--- a/arch/mips/kernel/kgdb.c
+++ b/arch/mips/kernel/kgdb.c
@@ -33,6 +33,7 @@
 #include <asm/processor.h>
 #include <asm/sigcontext.h>
 #include <linux/uaccess.h>
+#include <asm/irq_regs.h>
 
 static struct hard_trap_info {
         unsigned char tt;       /* Trap type code for MIPS R3xxx and R4xxx */
@@ -214,7 +215,7 @@ void kgdb_call_nmi_hook(void *ignored)
         old_fs = get_fs();
         set_fs(KERNEL_DS);
 
-        kgdb_nmicallback(raw_smp_processor_id(), NULL);
+        kgdb_nmicallback(raw_smp_processor_id(), get_irq_regs());
 
         set_fs(old_fs);
 }
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 0057c910bc2f..3a62f80958e1 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -1419,7 +1419,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall)
 
                 sd.nr = syscall;
                 sd.arch = syscall_get_arch();
-                syscall_get_arguments(current, regs, 0, 6, args);
+                syscall_get_arguments(current, regs, args);
                 for (i = 0; i < 6; i++)
                         sd.args[i] = args[i];
                 sd.instruction_pointer = KSTK_EIP(current);
diff --git a/arch/mips/sgi-ip27/ip27-irq.c b/arch/mips/sgi-ip27/ip27-irq.c
index 710a59764b01..a32f843cdbe0 100644
--- a/arch/mips/sgi-ip27/ip27-irq.c
+++ b/arch/mips/sgi-ip27/ip27-irq.c
@@ -118,7 +118,6 @@ static void shutdown_bridge_irq(struct irq_data *d)
 {
         struct hub_irq_data *hd = irq_data_get_irq_chip_data(d);
         struct bridge_controller *bc;
-        int pin = hd->pin;
 
         if (!hd)
                 return;
@@ -126,7 +125,7 @@ static void shutdown_bridge_irq(struct irq_data *d)
         disable_hub_irq(d);
 
         bc = hd->bc;
-        bridge_clr(bc, b_int_enable, (1 << pin));
+        bridge_clr(bc, b_int_enable, (1 << hd->pin));
         bridge_read(bc, b_wid_tflush);
 }
 
diff --git a/arch/nds32/include/asm/syscall.h b/arch/nds32/include/asm/syscall.h
index f7e5e86765fe..671ebd357496 100644
--- a/arch/nds32/include/asm/syscall.h
+++ b/arch/nds32/include/asm/syscall.h
@@ -108,81 +108,41 @@ void syscall_set_return_value(struct task_struct *task, struct pt_regs *regs,
  * syscall_get_arguments - extract system call parameter values
  * @task:       task of interest, must be blocked
  * @regs:       task_pt_regs() of @task
- * @i:          argument index [0,5]
- * @n:          number of arguments; n+i must be [1,6].
  * @args:       array filled with argument values
  *
- * Fetches @n arguments to the system call starting with the @i'th argument
- * (from 0 through 5).  Argument @i is stored in @args[0], and so on.
- * An arch inline version is probably optimal when @i and @n are constants.
+ * Fetches 6 arguments to the system call (from 0 through 5). The first
+ * argument is stored in @args[0], and so on.
  *
  * It's only valid to call this when @task is stopped for tracing on
  * entry to a system call, due to %TIF_SYSCALL_TRACE or %TIF_SYSCALL_AUDIT.
- * It's invalid to call this with @i + @n > 6; we only support system calls
- * taking up to 6 arguments.
  */
 #define SYSCALL_MAX_ARGS 6
 void syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
-                           unsigned int i, unsigned int n, unsigned long *args)
+                           unsigned long *args)
 {
-        if (n == 0)
-                return;
-        if (i + n > SYSCALL_MAX_ARGS) {
-                unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i;
-                unsigned int n_bad = n + i - SYSCALL_MAX_ARGS;
-                pr_warning("%s called with max args %d, handling only %d\n",
-                           __func__, i + n, SYSCALL_MAX_ARGS);
-                memset(args_bad, 0, n_bad * sizeof(args[0]));
-                memset(args_bad, 0, n_bad * sizeof(args[0]));
-        }
-
-        if (i == 0) {
-                args[0] = regs->orig_r0;
-                args++;
-                i++;
-                n--;
-        }
-
-        memcpy(args, &regs->uregs[0] + i, n * sizeof(args[0]));
+        args[0] = regs->orig_r0;
+        args++;
+        memcpy(args, &regs->uregs[0] + 1, 5 * sizeof(args[0]));
 }
 
 /**
  * syscall_set_arguments - change system call parameter value
  * @task:       task of interest, must be in system call entry tracing
  * @regs:       task_pt_regs() of @task
- * @i:          argument index [0,5]
- * @n:          number of arguments; n+i must be [1,6].
  * @args:       array of argument values to store
  *
- * Changes @n arguments to the system call starting with the @i'th argument.
- * Argument @i gets value @args[0], and so on.
- * An arch inline version is probably optimal when @i and @n are constants.
+ * Changes 6 arguments to the system call. The first argument gets value
+ * @args[0], and so on.
  *
  * It's only valid to call this when @task is stopped for tracing on
  * entry to a system call, due to %TIF_SYSCALL_TRACE or %TIF_SYSCALL_AUDIT.
- * It's invalid to call this with @i + @n > 6; we only support system calls
- * taking up to 6 arguments.
  */
 void syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
-                           unsigned int i, unsigned int n,
                            const unsigned long *args)
 {
-        if (n == 0)
-                return;
-
-        if (i + n > SYSCALL_MAX_ARGS) {
-                pr_warn("%s called with max args %d, handling only %d\n",
-                        __func__, i + n, SYSCALL_MAX_ARGS);
-                n = SYSCALL_MAX_ARGS - i;
-        }
-
-        if (i == 0) {
-                regs->orig_r0 = args[0];
-                args++;
-                i++;
-                n--;
-        }
+        regs->orig_r0 = args[0];
+        args++;
 
-        memcpy(&regs->uregs[0] + i, args, n * sizeof(args[0]));
+        memcpy(&regs->uregs[0] + 1, args, 5 * sizeof(args[0]));
 }
 #endif /* _ASM_NDS32_SYSCALL_H */
diff --git a/arch/nios2/include/asm/syscall.h b/arch/nios2/include/asm/syscall.h
index 9de220854c4a..d7624ed06efb 100644
--- a/arch/nios2/include/asm/syscall.h
+++ b/arch/nios2/include/asm/syscall.h
@@ -58,81 +58,25 @@ static inline void syscall_set_return_value(struct task_struct *task,
 }
 
 static inline void syscall_get_arguments(struct task_struct *task,
-        struct pt_regs *regs, unsigned int i, unsigned int n,
-        unsigned long *args)
+        struct pt_regs *regs, unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-
-        switch (i) {
-        case 0:
-                if (!n--)
-                        break;
-                *args++ = regs->r4;
-        case 1:
-                if (!n--)
-                        break;
-                *args++ = regs->r5;
-        case 2:
-                if (!n--)
-                        break;
-                *args++ = regs->r6;
-        case 3:
-                if (!n--)
-                        break;
-                *args++ = regs->r7;
-        case 4:
-                if (!n--)
-                        break;
-                *args++ = regs->r8;
-        case 5:
-                if (!n--)
-                        break;
-                *args++ = regs->r9;
-        case 6:
-                if (!n--)
-                        break;
-        default:
-                BUG();
-        }
+        *args++ = regs->r4;
+        *args++ = regs->r5;
+        *args++ = regs->r6;
+        *args++ = regs->r7;
+        *args++ = regs->r8;
+        *args   = regs->r9;
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
-        struct pt_regs *regs, unsigned int i, unsigned int n,
-        const unsigned long *args)
+        struct pt_regs *regs, const unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-
-        switch (i) {
-        case 0:
-                if (!n--)
-                        break;
-                regs->r4 = *args++;
-        case 1:
-                if (!n--)
-                        break;
-                regs->r5 = *args++;
-        case 2:
-                if (!n--)
-                        break;
-                regs->r6 = *args++;
-        case 3:
-                if (!n--)
-                        break;
-                regs->r7 = *args++;
-        case 4:
-                if (!n--)
-                        break;
-                regs->r8 = *args++;
-        case 5:
-                if (!n--)
-                        break;
-                regs->r9 = *args++;
-        case 6:
-                if (!n)
-                        break;
-        default:
-                BUG();
-        }
+        regs->r4 = *args++;
+        regs->r5 = *args++;
+        regs->r6 = *args++;
+        regs->r7 = *args++;
+        regs->r8 = *args++;
+        regs->r9 = *args;
 }
 
 #endif
diff --git a/arch/openrisc/include/asm/syscall.h b/arch/openrisc/include/asm/syscall.h
index 2db9f1cf0694..b4ff07c1baed 100644
--- a/arch/openrisc/include/asm/syscall.h
+++ b/arch/openrisc/include/asm/syscall.h
@@ -56,20 +56,16 @@ syscall_set_return_value(struct task_struct *task, struct pt_regs *regs,
 
 static inline void
 syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
-                      unsigned int i, unsigned int n, unsigned long *args)
+                      unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-
-        memcpy(args, &regs->gpr[3 + i], n * sizeof(args[0]));
+        memcpy(args, &regs->gpr[3], 6 * sizeof(args[0]));
 }
 
 static inline void
 syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
-                      unsigned int i, unsigned int n, const unsigned long *args)
+                      const unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-
-        memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
+        memcpy(&regs->gpr[3], args, 6 * sizeof(args[0]));
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/parisc/include/asm/ptrace.h b/arch/parisc/include/asm/ptrace.h
index 2a27b275ab09..9ff033d261ab 100644
--- a/arch/parisc/include/asm/ptrace.h
+++ b/arch/parisc/include/asm/ptrace.h
@@ -22,13 +22,14 @@ unsigned long profile_pc(struct pt_regs *);
 
 static inline unsigned long regs_return_value(struct pt_regs *regs)
 {
-        return regs->gr[20];
+        return regs->gr[28];
 }
 
 static inline void instruction_pointer_set(struct pt_regs *regs,
                                                 unsigned long val)
 {
-        regs->iaoq[0] = val;
+        regs->iaoq[0] = val;
+        regs->iaoq[1] = val + 4;
 }
 
 /* Query offset/name of register from its name/offset */
diff --git a/arch/parisc/include/asm/syscall.h b/arch/parisc/include/asm/syscall.h
index 8bff1a58c97f..62a6d477fae0 100644
--- a/arch/parisc/include/asm/syscall.h
+++ b/arch/parisc/include/asm/syscall.h
@@ -18,29 +18,15 @@ static inline long syscall_get_nr(struct task_struct *tsk,
 }
 
 static inline void syscall_get_arguments(struct task_struct *tsk,
-                                         struct pt_regs *regs, unsigned int i,
-                                         unsigned int n, unsigned long *args)
+                                         struct pt_regs *regs,
+                                         unsigned long *args)
 {
-        BUG_ON(i);
-
-        switch (n) {
-        case 6:
-                args[5] = regs->gr[21];
-        case 5:
-                args[4] = regs->gr[22];
-        case 4:
-                args[3] = regs->gr[23];
-        case 3:
-                args[2] = regs->gr[24];
-        case 2:
-                args[1] = regs->gr[25];
-        case 1:
-                args[0] = regs->gr[26];
-        case 0:
-                break;
-        default:
-                BUG();
-        }
+        args[5] = regs->gr[21];
+        args[4] = regs->gr[22];
+        args[3] = regs->gr[23];
+        args[2] = regs->gr[24];
+        args[1] = regs->gr[25];
+        args[0] = regs->gr[26];
 }
 
 static inline long syscall_get_return_value(struct task_struct *task,
diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
index eb39e7e380d7..841db71958cd 100644
--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -210,12 +210,6 @@ void __cpuidle arch_cpu_idle(void)
 
 static int __init parisc_idle_init(void)
 {
-        const char *marker;
-
-        /* check QEMU/SeaBIOS marker in PAGE0 */
-        marker = (char *) &PAGE0->pad0;
-        running_on_qemu = (memcmp(marker, "SeaBIOS", 8) == 0);
-
         if (!running_on_qemu)
                 cpu_idle_poll_ctrl(1);
 
diff --git a/arch/parisc/kernel/setup.c b/arch/parisc/kernel/setup.c
index 15dd9e21be7e..d908058d05c1 100644
--- a/arch/parisc/kernel/setup.c
+++ b/arch/parisc/kernel/setup.c
@@ -397,6 +397,9 @@ void __init start_parisc(void)
         int ret, cpunum;
         struct pdc_coproc_cfg coproc_cfg;
 
+        /* check QEMU/SeaBIOS marker in PAGE0 */
+        running_on_qemu = (memcmp(&PAGE0->pad0, "SeaBIOS", 8) == 0);
+
         cpunum = smp_processor_id();
 
         init_cpu_topology();
diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
index 1a0e7a8b1c81..1243045bad2d 100644
--- a/arch/powerpc/include/asm/syscall.h
+++ b/arch/powerpc/include/asm/syscall.h
@@ -65,22 +65,20 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
         unsigned long val, mask = -1UL;
-
-        BUG_ON(i + n > 6);
+        unsigned int n = 6;
 
 #ifdef CONFIG_COMPAT
         if (test_tsk_thread_flag(task, TIF_32BIT))
                 mask = 0xffffffff;
 #endif
         while (n--) {
-                if (n == 0 && i == 0)
+                if (n == 0)
                         val = regs->orig_gpr3;
                 else
-                        val = regs->gpr[3 + i + n];
+                        val = regs->gpr[3 + n];
 
                 args[n] = val & mask;
         }
@@ -88,15 +86,12 @@ static inline void syscall_get_arguments(struct task_struct *task,
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
+        memcpy(&regs->gpr[3], args, 6 * sizeof(args[0]));
 
         /* Also copy the first argument into orig_gpr3 */
-        if (i == 0 && n > 0)
-                regs->orig_gpr3 = args[0];
+        regs->orig_gpr3 = args[0];
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/powerpc/kernel/kvm.c b/arch/powerpc/kernel/kvm.c
index 683b5b3805bd..cd381e2291df 100644
--- a/arch/powerpc/kernel/kvm.c
+++ b/arch/powerpc/kernel/kvm.c
@@ -22,6 +22,7 @@
 #include <linux/kvm_host.h>
 #include <linux/init.h>
 #include <linux/export.h>
+#include <linux/kmemleak.h>
 #include <linux/kvm_para.h>
 #include <linux/slab.h>
 #include <linux/of.h>
@@ -712,6 +713,12 @@ static void kvm_use_magic_page(void)
 
 static __init void kvm_free_tmp(void)
 {
+        /*
+         * Inform kmemleak about the hole in the .bss section since the
+         * corresponding pages will be unmapped with DEBUG_PAGEALLOC=y.
+         */
+        kmemleak_free_part(&kvm_tmp[kvm_tmp_index],
+                           ARRAY_SIZE(kvm_tmp) - kvm_tmp_index);
         free_reserved_area(&kvm_tmp[kvm_tmp_index],
                            &kvm_tmp[ARRAY_SIZE(kvm_tmp)], -1, NULL);
 }
diff --git a/arch/riscv/include/asm/fixmap.h b/arch/riscv/include/asm/fixmap.h
index 57afe604b495..c207f6634b91 100644
--- a/arch/riscv/include/asm/fixmap.h
+++ b/arch/riscv/include/asm/fixmap.h
@@ -26,7 +26,7 @@ enum fixed_addresses {
 };
 
 #define FIXADDR_SIZE            (__end_of_fixed_addresses * PAGE_SIZE)
-#define FIXADDR_TOP             (PAGE_OFFSET)
+#define FIXADDR_TOP             (VMALLOC_START)
 #define FIXADDR_START           (FIXADDR_TOP - FIXADDR_SIZE)
 
 #define FIXMAP_PAGE_IO          PAGE_KERNEL
diff --git a/arch/riscv/include/asm/syscall.h b/arch/riscv/include/asm/syscall.h
index bba3da6ef157..a3d5273ded7c 100644
--- a/arch/riscv/include/asm/syscall.h
+++ b/arch/riscv/include/asm/syscall.h
@@ -72,32 +72,20 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        if (i == 0) {
-                args[0] = regs->orig_a0;
-                args++;
-                i++;
-                n--;
-        }
-        memcpy(args, &regs->a1 + i * sizeof(regs->a1), n * sizeof(args[0]));
+        args[0] = regs->orig_a0;
+        args++;
+        memcpy(args, &regs->a1, 5 * sizeof(args[0]));
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        if (i == 0) {
-                regs->orig_a0 = args[0];
-                args++;
-                i++;
-                n--;
-        }
-        memcpy(&regs->a1 + i * sizeof(regs->a1), args, n * sizeof(regs->a0));
+        regs->orig_a0 = args[0];
+        args++;
+        memcpy(&regs->a1, args, 5 * sizeof(regs->a1));
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/riscv/include/asm/uaccess.h b/arch/riscv/include/asm/uaccess.h
index a00168b980d2..fb53a8089e76 100644
--- a/arch/riscv/include/asm/uaccess.h
+++ b/arch/riscv/include/asm/uaccess.h
@@ -300,7 +300,7 @@ do {								\
                 "       .balign 4\n"                            \
                 "4:\n"                                          \
                 "       li %0, %6\n"                            \
-                "       jump 2b, %1\n"                          \
+                "       jump 3b, %1\n"                          \
                 "       .previous\n"                            \
                 "       .section __ex_table,\"a\"\n"            \
                 "       .balign " RISCV_SZPTR "\n"                      \
diff --git a/arch/riscv/kernel/Makefile b/arch/riscv/kernel/Makefile
index f13f7f276639..598568168d35 100644
--- a/arch/riscv/kernel/Makefile
+++ b/arch/riscv/kernel/Makefile
@@ -4,7 +4,6 @@
 
 ifdef CONFIG_FTRACE
 CFLAGS_REMOVE_ftrace.o = -pg
-CFLAGS_REMOVE_setup.o = -pg
 endif
 
 extra-y += head.o
@@ -29,8 +28,6 @@ obj-y	+= vdso.o
 obj-y   += cacheinfo.o
 obj-y   += vdso/
 
-CFLAGS_setup.o := -mcmodel=medany
-
 obj-$(CONFIG_FPU)               += fpu.o
 obj-$(CONFIG_SMP)               += smpboot.o
 obj-$(CONFIG_SMP)               += smp.o
diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
index 7dd308129b40..2872edce894d 100644
--- a/arch/riscv/kernel/module.c
+++ b/arch/riscv/kernel/module.c
@@ -141,7 +141,7 @@ static int apply_r_riscv_hi20_rela(struct module *me, u32 *location,
 {
         s32 hi20;
 
-        if (IS_ENABLED(CMODEL_MEDLOW)) {
+        if (IS_ENABLED(CONFIG_CMODEL_MEDLOW)) {
                 pr_err(
                   "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
                   me->name, (long long)v, location);
diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
index ecb654f6a79e..540a331d1376 100644
--- a/arch/riscv/kernel/setup.c
+++ b/arch/riscv/kernel/setup.c
@@ -48,14 +48,6 @@ struct screen_info screen_info = {
 };
 #endif
 
-unsigned long va_pa_offset;
-EXPORT_SYMBOL(va_pa_offset);
-unsigned long pfn_base;
-EXPORT_SYMBOL(pfn_base);
-
-unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)] __page_aligned_bss;
-EXPORT_SYMBOL(empty_zero_page);
-
 /* The lucky hart to first increment this variable will boot the other cores */
 atomic_t hart_lottery;
 unsigned long boot_cpu_hartid;
diff --git a/arch/riscv/mm/Makefile b/arch/riscv/mm/Makefile
index eb22ab49b3e0..b68aac701803 100644
--- a/arch/riscv/mm/Makefile
+++ b/arch/riscv/mm/Makefile
@@ -1,3 +1,9 @@
+
+CFLAGS_init.o := -mcmodel=medany
+ifdef CONFIG_FTRACE
+CFLAGS_REMOVE_init.o = -pg
+endif
+
 obj-y += init.o
 obj-y += fault.o
 obj-y += extable.o
diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index b379a75ac6a6..5fd8c922e1c2 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -25,6 +25,10 @@
 #include <asm/pgtable.h>
 #include <asm/io.h>
 
+unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]
+                                                        __page_aligned_bss;
+EXPORT_SYMBOL(empty_zero_page);
+
 static void __init zone_sizes_init(void)
 {
         unsigned long max_zone_pfns[MAX_NR_ZONES] = { 0, };
@@ -143,6 +147,11 @@ void __init setup_bootmem(void)
         }
 }
 
+unsigned long va_pa_offset;
+EXPORT_SYMBOL(va_pa_offset);
+unsigned long pfn_base;
+EXPORT_SYMBOL(pfn_base);
+
 pgd_t swapper_pg_dir[PTRS_PER_PGD] __page_aligned_bss;
 pgd_t trampoline_pg_dir[PTRS_PER_PGD] __initdata __aligned(PAGE_SIZE);
 
@@ -172,6 +181,25 @@ void __set_fixmap(enum fixed_addresses idx, phys_addr_t phys, pgprot_t prot)
         }
 }
 
+/*
+ * setup_vm() is called from head.S with MMU-off.
+ *
+ * Following requirements should be honoured for setup_vm() to work
+ * correctly:
+ * 1) It should use PC-relative addressing for accessing kernel symbols.
+ *    To achieve this we always use GCC cmodel=medany.
+ * 2) The compiler instrumentation for FTRACE will not work for setup_vm()
+ *    so disable compiler instrumentation when FTRACE is enabled.
+ *
+ * Currently, the above requirements are honoured by using custom CFLAGS
+ * for init.o in mm/Makefile.
+ */
+
+#ifndef __riscv_cmodel_medany
+#error "setup_vm() is called from head.S before relocate so it should "
+        "not use absolute addressing."
+#endif
+
 asmlinkage void __init setup_vm(void)
 {
         extern char _start;
diff --git a/arch/s390/include/asm/syscall.h b/arch/s390/include/asm/syscall.h
index 96f9a9151fde..59c3e91f2cdb 100644
--- a/arch/s390/include/asm/syscall.h
+++ b/arch/s390/include/asm/syscall.h
@@ -56,40 +56,32 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
         unsigned long mask = -1UL;
+        unsigned int n = 6;
 
-        /*
-         * No arguments for this syscall, there's nothing to do.
-         */
-        if (!n)
-                return;
-
-        BUG_ON(i + n > 6);
 #ifdef CONFIG_COMPAT
         if (test_tsk_thread_flag(task, TIF_31BIT))
                 mask = 0xffffffff;
 #endif
         while (n-- > 0)
-                if (i + n > 0)
-                        args[n] = regs->gprs[2 + i + n] & mask;
-        if (i == 0)
-                args[0] = regs->orig_gpr2 & mask;
+                if (n > 0)
+                        args[n] = regs->gprs[2 + n] & mask;
+
+        args[0] = regs->orig_gpr2 & mask;
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        BUG_ON(i + n > 6);
+        unsigned int n = 6;
+
         while (n-- > 0)
-                if (i + n > 0)
-                        regs->gprs[2 + i + n] = args[n];
-        if (i == 0)
-                regs->orig_gpr2 = args[0];
+                if (n > 0)
+                        regs->gprs[2 + n] = args[n];
+        regs->orig_gpr2 = args[0];
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/sh/boards/of-generic.c b/arch/sh/boards/of-generic.c
index 958f46da3a79..d91065e81a4e 100644
--- a/arch/sh/boards/of-generic.c
+++ b/arch/sh/boards/of-generic.c
@@ -164,10 +164,10 @@ static struct sh_machine_vector __initmv sh_of_generic_mv = {
 
 struct sh_clk_ops;
 
-void __init arch_init_clk_ops(struct sh_clk_ops **ops, int idx)
+void __init __weak arch_init_clk_ops(struct sh_clk_ops **ops, int idx)
 {
 }
 
-void __init plat_irq_setup(void)
+void __init __weak plat_irq_setup(void)
 {
 }
diff --git a/arch/sh/include/asm/syscall_32.h b/arch/sh/include/asm/syscall_32.h
index 6e118799831c..8c9d7e5e5dcc 100644
--- a/arch/sh/include/asm/syscall_32.h
+++ b/arch/sh/include/asm/syscall_32.h
@@ -48,51 +48,28 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        /*
-         * Do this simply for now. If we need to start supporting
-         * fetching arguments from arbitrary indices, this will need some
-         * extra logic. Presently there are no in-tree users that depend
-         * on this behaviour.
-         */
-        BUG_ON(i);
 
         /* Argument pattern is: R4, R5, R6, R7, R0, R1 */
-        switch (n) {
-        case 6: args[5] = regs->regs[1];
-        case 5: args[4] = regs->regs[0];
-        case 4: args[3] = regs->regs[7];
-        case 3: args[2] = regs->regs[6];
-        case 2: args[1] = regs->regs[5];
-        case 1: args[0] = regs->regs[4];
-        case 0:
-                break;
-        default:
-                BUG();
-        }
+        args[5] = regs->regs[1];
+        args[4] = regs->regs[0];
+        args[3] = regs->regs[7];
+        args[2] = regs->regs[6];
+        args[1] = regs->regs[5];
+        args[0] = regs->regs[4];
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        /* Same note as above applies */
-        BUG_ON(i);
-
-        switch (n) {
-        case 6: regs->regs[1] = args[5];
-        case 5: regs->regs[0] = args[4];
-        case 4: regs->regs[7] = args[3];
-        case 3: regs->regs[6] = args[2];
-        case 2: regs->regs[5] = args[1];
-        case 1: regs->regs[4] = args[0];
-                break;
-        default:
-                BUG();
-        }
+        regs->regs[1] = args[5];
+        regs->regs[0] = args[4];
+        regs->regs[7] = args[3];
+        regs->regs[6] = args[2];
+        regs->regs[5] = args[1];
+        regs->regs[4] = args[0];
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/sh/include/asm/syscall_64.h b/arch/sh/include/asm/syscall_64.h
index 43882580c7f9..22fad97da066 100644
--- a/arch/sh/include/asm/syscall_64.h
+++ b/arch/sh/include/asm/syscall_64.h
@@ -47,20 +47,16 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        memcpy(args, &regs->regs[2 + i], n * sizeof(args[0]));
+        memcpy(args, &regs->regs[2], 6 * sizeof(args[0]));
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        memcpy(&regs->regs[2 + i], args, n * sizeof(args[0]));
+        memcpy(&regs->regs[2], args, 6 * sizeof(args[0]));
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/sparc/include/asm/syscall.h b/arch/sparc/include/asm/syscall.h
index 053989e3f6a6..4d075434e816 100644
--- a/arch/sparc/include/asm/syscall.h
+++ b/arch/sparc/include/asm/syscall.h
@@ -96,11 +96,11 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
         int zero_extend = 0;
         unsigned int j;
+        unsigned int n = 6;
 
 #ifdef CONFIG_SPARC64
         if (test_tsk_thread_flag(task, TIF_32BIT))
@@ -108,7 +108,7 @@ static inline void syscall_get_arguments(struct task_struct *task,
 #endif
 
         for (j = 0; j < n; j++) {
-                unsigned long val = regs->u_regs[UREG_I0 + i + j];
+                unsigned long val = regs->u_regs[UREG_I0 + j];
 
                 if (zero_extend)
                         args[j] = (u32) val;
@@ -119,13 +119,12 @@ static inline void syscall_get_arguments(struct task_struct *task,
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
-        unsigned int j;
+        unsigned int i;
 
-        for (j = 0; j < n; j++)
-                regs->u_regs[UREG_I0 + i + j] = args[j];
+        for (i = 0; i < 6; i++)
+                regs->u_regs[UREG_I0 + i] = args[i];
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/um/include/asm/syscall-generic.h b/arch/um/include/asm/syscall-generic.h
index 9fb9cf8cd39a..98e50c50c12e 100644
--- a/arch/um/include/asm/syscall-generic.h
+++ b/arch/um/include/asm/syscall-generic.h
@@ -53,84 +53,30 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
         const struct uml_pt_regs *r = &regs->regs;
 
-        switch (i) {
-        case 0:
-                if (!n--)
-                        break;
-                *args++ = UPT_SYSCALL_ARG1(r);
-        case 1:
-                if (!n--)
-                        break;
-                *args++ = UPT_SYSCALL_ARG2(r);
-        case 2:
-                if (!n--)
-                        break;
-                *args++ = UPT_SYSCALL_ARG3(r);
-        case 3:
-                if (!n--)
-                        break;
-                *args++ = UPT_SYSCALL_ARG4(r);
-        case 4:
-                if (!n--)
-                        break;
-                *args++ = UPT_SYSCALL_ARG5(r);
-        case 5:
-                if (!n--)
-                        break;
-                *args++ = UPT_SYSCALL_ARG6(r);
-        case 6:
-                if (!n--)
-                        break;
-        default:
-                BUG();
-                break;
-        }
+        *args++ = UPT_SYSCALL_ARG1(r);
+        *args++ = UPT_SYSCALL_ARG2(r);
+        *args++ = UPT_SYSCALL_ARG3(r);
+        *args++ = UPT_SYSCALL_ARG4(r);
+        *args++ = UPT_SYSCALL_ARG5(r);
+        *args   = UPT_SYSCALL_ARG6(r);
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
         struct uml_pt_regs *r = &regs->regs;
 
-        switch (i) {
-        case 0:
-                if (!n--)
-                        break;
-                UPT_SYSCALL_ARG1(r) = *args++;
-        case 1:
-                if (!n--)
-                        break;
-                UPT_SYSCALL_ARG2(r) = *args++;
-        case 2:
-                if (!n--)
-                        break;
-                UPT_SYSCALL_ARG3(r) = *args++;
-        case 3:
-                if (!n--)
-                        break;
-                UPT_SYSCALL_ARG4(r) = *args++;
-        case 4:
-                if (!n--)
-                        break;
-                UPT_SYSCALL_ARG5(r) = *args++;
-        case 5:
-                if (!n--)
-                        break;
-                UPT_SYSCALL_ARG6(r) = *args++;
-        case 6:
-                if (!n--)
-                        break;
-        default:
-                BUG();
-                break;
-        }
+        UPT_SYSCALL_ARG1(r) = *args++;
+        UPT_SYSCALL_ARG2(r) = *args++;
+        UPT_SYSCALL_ARG3(r) = *args++;
+        UPT_SYSCALL_ARG4(r) = *args++;
+        UPT_SYSCALL_ARG5(r) = *args++;
+        UPT_SYSCALL_ARG6(r) = *args;
 }
 
 /* See arch/x86/um/asm/syscall.h for syscall_get_arch() definition. */
diff --git a/arch/x86/include/asm/syscall.h b/arch/x86/include/asm/syscall.h
index d653139857af..4c305471ec33 100644
--- a/arch/x86/include/asm/syscall.h
+++ b/arch/x86/include/asm/syscall.h
@@ -91,11 +91,9 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        BUG_ON(i + n > 6);
-        memcpy(args, &regs->bx + i, n * sizeof(args[0]));
+        memcpy(args, &regs->bx, 6 * sizeof(args[0]));
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
@@ -116,124 +114,50 @@ static inline int syscall_get_arch(void)
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
 # ifdef CONFIG_IA32_EMULATION
-        if (task->thread_info.status & TS_COMPAT)
-                switch (i) {
-                case 0:
-                        if (!n--) break;
-                        *args++ = regs->bx;
-                case 1:
-                        if (!n--) break;
-                        *args++ = regs->cx;
-                case 2:
-                        if (!n--) break;
-                        *args++ = regs->dx;
-                case 3:
-                        if (!n--) break;
-                        *args++ = regs->si;
-                case 4:
-                        if (!n--) break;
-                        *args++ = regs->di;
-                case 5:
-                        if (!n--) break;
-                        *args++ = regs->bp;
-                case 6:
-                        if (!n--) break;
-                default:
-                        BUG();
-                        break;
-                }
-        else
+        if (task->thread_info.status & TS_COMPAT) {
+                *args++ = regs->bx;
+                *args++ = regs->cx;
+                *args++ = regs->dx;
+                *args++ = regs->si;
+                *args++ = regs->di;
+                *args   = regs->bp;
+        } else
 # endif
-                switch (i) {
-                case 0:
-                        if (!n--) break;
-                        *args++ = regs->di;
-                case 1:
-                        if (!n--) break;
-                        *args++ = regs->si;
-                case 2:
-                        if (!n--) break;
-                        *args++ = regs->dx;
-                case 3:
-                        if (!n--) break;
-                        *args++ = regs->r10;
-                case 4:
-                        if (!n--) break;
-                        *args++ = regs->r8;
-                case 5:
-                        if (!n--) break;
-                        *args++ = regs->r9;
-                case 6:
-                        if (!n--) break;
-                default:
-                        BUG();
-                        break;
-                }
+        {
+                *args++ = regs->di;
+                *args++ = regs->si;
+                *args++ = regs->dx;
+                *args++ = regs->r10;
+                *args++ = regs->r8;
+                *args   = regs->r9;
+        }
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
 # ifdef CONFIG_IA32_EMULATION
-        if (task->thread_info.status & TS_COMPAT)
-                switch (i) {
-                case 0:
-                        if (!n--) break;
-                        regs->bx = *args++;
-                case 1:
-                        if (!n--) break;
-                        regs->cx = *args++;
-                case 2:
-                        if (!n--) break;
-                        regs->dx = *args++;
-                case 3:
-                        if (!n--) break;
-                        regs->si = *args++;
-                case 4:
-                        if (!n--) break;
-                        regs->di = *args++;
-                case 5:
-                        if (!n--) break;
-                        regs->bp = *args++;
-                case 6:
-                        if (!n--) break;
-                default:
-                        BUG();
-                        break;
-                }
-        else
+        if (task->thread_info.status & TS_COMPAT) {
+                regs->bx = *args++;
+                regs->cx = *args++;
+                regs->dx = *args++;
+                regs->si = *args++;
+                regs->di = *args++;
+                regs->bp = *args;
+        } else
 # endif
-                switch (i) {
-                case 0:
-                        if (!n--) break;
-                        regs->di = *args++;
-                case 1:
-                        if (!n--) break;
-                        regs->si = *args++;
-                case 2:
-                        if (!n--) break;
-                        regs->dx = *args++;
-                case 3:
-                        if (!n--) break;
-                        regs->r10 = *args++;
-                case 4:
-                        if (!n--) break;
-                        regs->r8 = *args++;
-                case 5:
-                        if (!n--) break;
-                        regs->r9 = *args++;
-                case 6:
-                        if (!n--) break;
-                default:
-                        BUG();
-                        break;
-                }
+        {
+                regs->di = *args++;
+                regs->si = *args++;
+                regs->dx = *args++;
+                regs->r10 = *args++;
+                regs->r8 = *args++;
+                regs->r9 = *args;
+        }
 }
 
 static inline int syscall_get_arch(void)
diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
index de6f0d59a24f..2863c2026655 100644
--- a/arch/x86/include/asm/xen/hypercall.h
+++ b/arch/x86/include/asm/xen/hypercall.h
@@ -206,6 +206,9 @@ xen_single_call(unsigned int call,
         __HYPERCALL_DECLS;
         __HYPERCALL_5ARG(a1, a2, a3, a4, a5);
 
+        if (call >= PAGE_SIZE / sizeof(hypercall_page[0]))
+                return -EINVAL;
+
         asm volatile(CALL_NOSPEC
                      : __HYPERCALL_5PARAM
                      : [thunk_target] "a" (&hypercall_page[call])
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 426039285fd1..e0a791c3d4fc 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -6422,11 +6422,11 @@ e_free:
         return ret;
 }
 
-static int get_num_contig_pages(int idx, struct page **inpages,
-                                unsigned long npages)
+static unsigned long get_num_contig_pages(unsigned long idx,
+                                struct page **inpages, unsigned long npages)
 {
         unsigned long paddr, next_paddr;
-        int i = idx + 1, pages = 1;
+        unsigned long i = idx + 1, pages = 1;
 
         /* find the number of contiguous pages starting from idx */
         paddr = __sme_page_pa(inpages[idx]);
@@ -6445,12 +6445,12 @@ static int get_num_contig_pages(int idx, struct page **inpages,
 
 static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
 {
-        unsigned long vaddr, vaddr_end, next_vaddr, npages, size;
+        unsigned long vaddr, vaddr_end, next_vaddr, npages, pages, size, i;
         struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
         struct kvm_sev_launch_update_data params;
         struct sev_data_launch_update_data *data;
         struct page **inpages;
-        int i, ret, pages;
+        int ret;
 
         if (!sev_guest(kvm))
                 return -ENOTTY;
@@ -6799,7 +6799,8 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec)
         struct page **src_p, **dst_p;
         struct kvm_sev_dbg debug;
         unsigned long n;
-        int ret, size;
+        unsigned int size;
+        int ret;
 
         if (!sev_guest(kvm))
                 return -ENOTTY;
@@ -6807,6 +6808,11 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec)
         if (copy_from_user(&debug, (void __user *)(uintptr_t)argp->data, sizeof(debug)))
                 return -EFAULT;
 
+        if (!debug.len || debug.src_uaddr + debug.len < debug.src_uaddr)
+                return -EINVAL;
+        if (!debug.dst_uaddr)
+                return -EINVAL;
+
         vaddr = debug.src_uaddr;
         size = debug.len;
         vaddr_end = vaddr + size;
@@ -6857,8 +6863,8 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec)
                                                      dst_vaddr,
                                                      len, &argp->error);
 
-                sev_unpin_memory(kvm, src_p, 1);
-                sev_unpin_memory(kvm, dst_p, 1);
+                sev_unpin_memory(kvm, src_p, n);
+                sev_unpin_memory(kvm, dst_p, n);
 
                 if (ret)
                         goto err;
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 153e539c29c9..7ec9bb1dd723 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -500,6 +500,17 @@ static void nested_vmx_disable_intercept_for_msr(unsigned long *msr_bitmap_l1,
         }
 }
 
+static inline void enable_x2apic_msr_intercepts(unsigned long *msr_bitmap) {
+        int msr;
+
+        for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
+                unsigned word = msr / BITS_PER_LONG;
+
+                msr_bitmap[word] = ~0;
+                msr_bitmap[word + (0x800 / sizeof(long))] = ~0;
+        }
+}
+
 /*
  * Merge L0's and L1's MSR bitmap, return false to indicate that
  * we do not use the hardware.
@@ -541,39 +552,44 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,
                 return false;
 
         msr_bitmap_l1 = (unsigned long *)kmap(page);
-        if (nested_cpu_has_apic_reg_virt(vmcs12)) {
-                /*
-                 * L0 need not intercept reads for MSRs between 0x800 and 0x8ff, it
-                 * just lets the processor take the value from the virtual-APIC page;
-                 * take those 256 bits directly from the L1 bitmap.
-                 */
-                for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
-                        unsigned word = msr / BITS_PER_LONG;
-                        msr_bitmap_l0[word] = msr_bitmap_l1[word];
-                        msr_bitmap_l0[word + (0x800 / sizeof(long))] = ~0;
-                }
-        } else {
-                for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
-                        unsigned word = msr / BITS_PER_LONG;
-                        msr_bitmap_l0[word] = ~0;
-                        msr_bitmap_l0[word + (0x800 / sizeof(long))] = ~0;
-                }
-        }
 
-        nested_vmx_disable_intercept_for_msr(
-                msr_bitmap_l1, msr_bitmap_l0,
-                X2APIC_MSR(APIC_TASKPRI),
-                MSR_TYPE_W);
+        /*
+         * To keep the control flow simple, pay eight 8-byte writes (sixteen
+         * 4-byte writes on 32-bit systems) up front to enable intercepts for
+         * the x2APIC MSR range and selectively disable them below.
+         */
+        enable_x2apic_msr_intercepts(msr_bitmap_l0);
+
+        if (nested_cpu_has_virt_x2apic_mode(vmcs12)) {
+                if (nested_cpu_has_apic_reg_virt(vmcs12)) {
+                        /*
+                         * L0 need not intercept reads for MSRs between 0x800
+                         * and 0x8ff, it just lets the processor take the value
+                         * from the virtual-APIC page; take those 256 bits
+                         * directly from the L1 bitmap.
+                         */
+                        for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
+                                unsigned word = msr / BITS_PER_LONG;
+
+                                msr_bitmap_l0[word] = msr_bitmap_l1[word];
+                        }
+                }
 
-        if (nested_cpu_has_vid(vmcs12)) {
-                nested_vmx_disable_intercept_for_msr(
-                        msr_bitmap_l1, msr_bitmap_l0,
-                        X2APIC_MSR(APIC_EOI),
-                        MSR_TYPE_W);
                 nested_vmx_disable_intercept_for_msr(
                         msr_bitmap_l1, msr_bitmap_l0,
-                        X2APIC_MSR(APIC_SELF_IPI),
-                        MSR_TYPE_W);
+                        X2APIC_MSR(APIC_TASKPRI),
+                        MSR_TYPE_R | MSR_TYPE_W);
+
+                if (nested_cpu_has_vid(vmcs12)) {
+                        nested_vmx_disable_intercept_for_msr(
+                                msr_bitmap_l1, msr_bitmap_l0,
+                                X2APIC_MSR(APIC_EOI),
+                                MSR_TYPE_W);
+                        nested_vmx_disable_intercept_for_msr(
+                                msr_bitmap_l1, msr_bitmap_l0,
+                                X2APIC_MSR(APIC_SELF_IPI),
+                                MSR_TYPE_W);
+                }
         }
 
         if (spec_ctrl)
diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h
index f7dd895b2353..0c14018d1c26 100644
--- a/arch/xtensa/include/asm/processor.h
+++ b/arch/xtensa/include/asm/processor.h
@@ -187,15 +187,18 @@ struct thread_struct {
 
 /* Clearing a0 terminates the backtrace. */
 #define start_thread(regs, new_pc, new_sp) \
-        memset(regs, 0, sizeof(*regs)); \
-        regs->pc = new_pc; \
-        regs->ps = USER_PS_VALUE; \
-        regs->areg[1] = new_sp; \
-        regs->areg[0] = 0; \
-        regs->wmask = 1; \
-        regs->depc = 0; \
-        regs->windowbase = 0; \
-        regs->windowstart = 1;
+        do { \
+                memset((regs), 0, sizeof(*(regs))); \
+                (regs)->pc = (new_pc); \
+                (regs)->ps = USER_PS_VALUE; \
+                (regs)->areg[1] = (new_sp); \
+                (regs)->areg[0] = 0; \
+                (regs)->wmask = 1; \
+                (regs)->depc = 0; \
+                (regs)->windowbase = 0; \
+                (regs)->windowstart = 1; \
+                (regs)->syscall = NO_SYSCALL; \
+        } while (0)
 
 /* Forward declaration */
 struct task_struct;
diff --git a/arch/xtensa/include/asm/syscall.h b/arch/xtensa/include/asm/syscall.h
index a168bf81c7f4..91dc06d58060 100644
--- a/arch/xtensa/include/asm/syscall.h
+++ b/arch/xtensa/include/asm/syscall.h
@@ -59,45 +59,24 @@ static inline void syscall_set_return_value(struct task_struct *task,
 
 static inline void syscall_get_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
         static const unsigned int reg[] = XTENSA_SYSCALL_ARGUMENT_REGS;
-        unsigned int j;
+        unsigned int i;
 
-        if (n == 0)
-                return;
-
-        WARN_ON_ONCE(i + n > SYSCALL_MAX_ARGS);
-
-        for (j = 0; j < n; ++j) {
-                if (i + j < SYSCALL_MAX_ARGS)
-                        args[j] = regs->areg[reg[i + j]];
-                else
-                        args[j] = 0;
-        }
+        for (i = 0; i < 6; ++i)
+                args[i] = regs->areg[reg[i]];
 }
 
 static inline void syscall_set_arguments(struct task_struct *task,
                                          struct pt_regs *regs,
-                                         unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
         static const unsigned int reg[] = XTENSA_SYSCALL_ARGUMENT_REGS;
-        unsigned int j;
-
-        if (n == 0)
-                return;
-
-        if (WARN_ON_ONCE(i + n > SYSCALL_MAX_ARGS)) {
-                if (i < SYSCALL_MAX_ARGS)
-                        n = SYSCALL_MAX_ARGS - i;
-                else
-                        return;
-        }
+        unsigned int i;
 
-        for (j = 0; j < n; ++j)
-                regs->areg[reg[i + j]] = args[j];
+        for (i = 0; i < 6; ++i)
+                regs->areg[reg[i]] = args[i];
 }
 
 asmlinkage long xtensa_rt_sigreturn(struct pt_regs*);
diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S
index e50f5124dc6f..e54af8b7e0f8 100644
--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -1860,6 +1860,8 @@ ENTRY(system_call)
         l32i    a7, a2, PT_SYSCALL
 
 1:
+        s32i    a7, a1, 4
+
         /* syscall = sys_call_table[syscall_nr] */
 
         movi    a4, sys_call_table
@@ -1893,8 +1895,12 @@ ENTRY(system_call)
         retw
 
 1:
+        l32i    a4, a1, 4
+        l32i    a3, a2, PT_SYSCALL
+        s32i    a4, a2, PT_SYSCALL
         mov     a6, a2
         call4   do_syscall_trace_leave
+        s32i    a3, a2, PT_SYSCALL
         retw
 
 ENDPROC(system_call)
diff --git a/arch/xtensa/kernel/stacktrace.c b/arch/xtensa/kernel/stacktrace.c
index 174c11f13bba..b9f82510c650 100644
--- a/arch/xtensa/kernel/stacktrace.c
+++ b/arch/xtensa/kernel/stacktrace.c
@@ -253,10 +253,14 @@ static int return_address_cb(struct stackframe *frame, void *data)
         return 1;
 }
 
+/*
+ * level == 0 is for the return address from the caller of this function,
+ * not from this function itself.
+ */
 unsigned long return_address(unsigned level)
 {
         struct return_addr_data r = {
-                .skip = level + 1,
+                .skip = level,
         };
         walk_stackframe(stack_pointer(NULL), return_address_cb, &r);
         return r.addr;
diff --git a/arch/xtensa/mm/mmu.c b/arch/xtensa/mm/mmu.c
index 2fb7d1172228..03678c4afc39 100644
--- a/arch/xtensa/mm/mmu.c
+++ b/arch/xtensa/mm/mmu.c
@@ -33,7 +33,7 @@ static void * __init init_pmd(unsigned long vaddr, unsigned long n_pages)
 
         pte = memblock_alloc_low(n_pages * sizeof(pte_t), PAGE_SIZE);
         if (!pte)
-                panic("%s: Failed to allocate %zu bytes align=%lx\n",
+                panic("%s: Failed to allocate %lu bytes align=%lx\n",
                       __func__, n_pages * sizeof(pte_t), PAGE_SIZE);
 
         for (i = 0; i < n_pages; ++i)
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 4c592496a16a..fac188dd78fa 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -674,7 +674,7 @@ static bool bfq_symmetric_scenario(struct bfq_data *bfqd)
          * at least two nodes.
          */
         return !(varied_queue_weights || multiple_classes_busy
-#ifdef BFQ_GROUP_IOSCHED_ENABLED
+#ifdef CONFIG_BFQ_GROUP_IOSCHED
                || bfqd->num_groups_with_pending_reqs > 0
 #endif
                 );
diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c
index 63311d1ff1ed..a11bef75483d 100644
--- a/block/bfq-wf2q.c
+++ b/block/bfq-wf2q.c
@@ -1012,7 +1012,7 @@ static void __bfq_activate_entity(struct bfq_entity *entity,
                 entity->on_st = true;
         }
 
-#ifdef BFQ_GROUP_IOSCHED_ENABLED
+#ifdef CONFIG_BFQ_GROUP_IOSCHED
         if (!bfq_entity_to_bfqq(entity)) { /* bfq_group */
                 struct bfq_group *bfqg =
                         container_of(entity, struct bfq_group, entity);
diff --git a/block/blk-core.c b/block/blk-core.c
index 4673ebe42255..a55389ba8779 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1245,8 +1245,6 @@ static int blk_cloned_rq_check_limits(struct request_queue *q,
  */
 blk_status_t blk_insert_cloned_request(struct request_queue *q, struct request *rq)
 {
-        blk_qc_t unused;
-
         if (blk_cloned_rq_check_limits(q, rq))
                 return BLK_STS_IOERR;
 
@@ -1262,7 +1260,7 @@ blk_status_t blk_insert_cloned_request(struct request_queue *q, struct request *
          * bypass a potential scheduler on the bottom device for
          * insert.
          */
-        return blk_mq_try_issue_directly(rq->mq_hctx, rq, &unused, true, true);
+        return blk_mq_request_issue_directly(rq, true);
 }
 EXPORT_SYMBOL_GPL(blk_insert_cloned_request);
 
diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
index 40905539afed..aa6bc5c02643 100644
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -423,10 +423,12 @@ void blk_mq_sched_insert_requests(struct blk_mq_hw_ctx *hctx,
                  * busy in case of 'none' scheduler, and this way may save
                  * us one extra enqueue & dequeue to sw queue.
                  */
-                if (!hctx->dispatch_busy && !e && !run_queue_async)
+                if (!hctx->dispatch_busy && !e && !run_queue_async) {
                         blk_mq_try_issue_list_directly(hctx, list);
-                else
-                        blk_mq_insert_requests(hctx, ctx, list);
+                        if (list_empty(list))
+                                return;
+                }
+                blk_mq_insert_requests(hctx, ctx, list);
         }
 
         blk_mq_run_hw_queue(hctx, run_queue_async);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 3ff3d7b49969..a9354835cf51 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1711,11 +1711,12 @@ void blk_mq_flush_plug_list(struct blk_plug *plug, bool from_schedule)
         unsigned int depth;
 
         list_splice_init(&plug->mq_list, &list);
-        plug->rq_count = 0;
 
         if (plug->rq_count > 2 && plug->multiple_queues)
                 list_sort(NULL, &list, plug_rq_cmp);
 
+        plug->rq_count = 0;
+
         this_q = NULL;
         this_hctx = NULL;
         this_ctx = NULL;
@@ -1800,74 +1801,76 @@ static blk_status_t __blk_mq_issue_directly(struct blk_mq_hw_ctx *hctx,
         return ret;
 }
 
-blk_status_t blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
+static blk_status_t __blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
                                                 struct request *rq,
                                                 blk_qc_t *cookie,
-                                                bool bypass, bool last)
+                                                bool bypass_insert, bool last)
 {
         struct request_queue *q = rq->q;
         bool run_queue = true;
-        blk_status_t ret = BLK_STS_RESOURCE;
-        int srcu_idx;
-        bool force = false;
 
-        hctx_lock(hctx, &srcu_idx);
         /*
-         * hctx_lock is needed before checking quiesced flag.
+         * RCU or SRCU read lock is needed before checking quiesced flag.
          *
-         * When queue is stopped or quiesced, ignore 'bypass', insert
-         * and return BLK_STS_OK to caller, and avoid driver to try to
-         * dispatch again.
+         * When queue is stopped or quiesced, ignore 'bypass_insert' from
+         * blk_mq_request_issue_directly(), and return BLK_STS_OK to caller,
+         * and avoid driver to try to dispatch again.
          */
-        if (unlikely(blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(q))) {
+        if (blk_mq_hctx_stopped(hctx) || blk_queue_quiesced(q)) {
                 run_queue = false;
-                bypass = false;
-                goto out_unlock;
+                bypass_insert = false;
+                goto insert;
         }
 
-        if (unlikely(q->elevator && !bypass))
-                goto out_unlock;
+        if (q->elevator && !bypass_insert)
+                goto insert;
 
         if (!blk_mq_get_dispatch_budget(hctx))
-                goto out_unlock;
+                goto insert;
 
         if (!blk_mq_get_driver_tag(rq)) {
                 blk_mq_put_dispatch_budget(hctx);
-                goto out_unlock;
+                goto insert;
         }
 
-        /*
-         * Always add a request that has been through
-         *.queue_rq() to the hardware dispatch list.
-         */
-        force = true;
-        ret = __blk_mq_issue_directly(hctx, rq, cookie, last);
-out_unlock:
+        return __blk_mq_issue_directly(hctx, rq, cookie, last);
+insert:
+        if (bypass_insert)
+                return BLK_STS_RESOURCE;
+
+        blk_mq_request_bypass_insert(rq, run_queue);
+        return BLK_STS_OK;
+}
+
+static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
+                struct request *rq, blk_qc_t *cookie)
+{
+        blk_status_t ret;
+        int srcu_idx;
+
+        might_sleep_if(hctx->flags & BLK_MQ_F_BLOCKING);
+
+        hctx_lock(hctx, &srcu_idx);
+
+        ret = __blk_mq_try_issue_directly(hctx, rq, cookie, false, true);
+        if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE)
+                blk_mq_request_bypass_insert(rq, true);
+        else if (ret != BLK_STS_OK)
+                blk_mq_end_request(rq, ret);
+
+        hctx_unlock(hctx, srcu_idx);
+}
+
+blk_status_t blk_mq_request_issue_directly(struct request *rq, bool last)
+{
+        blk_status_t ret;
+        int srcu_idx;
+        blk_qc_t unused_cookie;
+        struct blk_mq_hw_ctx *hctx = rq->mq_hctx;
+
+        hctx_lock(hctx, &srcu_idx);
+        ret = __blk_mq_try_issue_directly(hctx, rq, &unused_cookie, true, last);
         hctx_unlock(hctx, srcu_idx);
-        switch (ret) {
-        case BLK_STS_OK:
-                break;
-        case BLK_STS_DEV_RESOURCE:
-        case BLK_STS_RESOURCE:
-                if (force) {
-                        blk_mq_request_bypass_insert(rq, run_queue);
-                        /*
-                         * We have to return BLK_STS_OK for the DM
-                         * to avoid livelock. Otherwise, we return
-                         * the real result to indicate whether the
-                         * request is direct-issued successfully.
-                         */
-                        ret = bypass ? BLK_STS_OK : ret;
-                } else if (!bypass) {
-                        blk_mq_sched_insert_request(rq, false,
-                                                    run_queue, false);
-                }
-                break;
-        default:
-                if (!bypass)
-                        blk_mq_end_request(rq, ret);
-                break;
-        }
 
         return ret;
 }
@@ -1875,20 +1878,22 @@ out_unlock:
 void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx,
                 struct list_head *list)
 {
-        blk_qc_t unused;
-        blk_status_t ret = BLK_STS_OK;
-
         while (!list_empty(list)) {
+                blk_status_t ret;
                 struct request *rq = list_first_entry(list, struct request,
                                 queuelist);
 
                 list_del_init(&rq->queuelist);
-                if (ret == BLK_STS_OK)
-                        ret = blk_mq_try_issue_directly(hctx, rq, &unused,
-                                                        false,
+                ret = blk_mq_request_issue_directly(rq, list_empty(list));
+                if (ret != BLK_STS_OK) {
+                        if (ret == BLK_STS_RESOURCE ||
+                                        ret == BLK_STS_DEV_RESOURCE) {
+                                blk_mq_request_bypass_insert(rq,
                                                         list_empty(list));
-                else
-                        blk_mq_sched_insert_request(rq, false, true, false);
+                                break;
+                        }
+                        blk_mq_end_request(rq, ret);
+                }
         }
 
         /*
@@ -1896,7 +1901,7 @@ void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx,
          * the driver there was more coming, but that turned out to
          * be a lie.
          */
-        if (ret != BLK_STS_OK && hctx->queue->mq_ops->commit_rqs)
+        if (!list_empty(list) && hctx->queue->mq_ops->commit_rqs)
                 hctx->queue->mq_ops->commit_rqs(hctx);
 }
 
@@ -2003,19 +2008,21 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
                         plug->rq_count--;
                 }
                 blk_add_rq_to_plug(plug, rq);
+                trace_block_plug(q);
 
                 blk_mq_put_ctx(data.ctx);
 
                 if (same_queue_rq) {
                         data.hctx = same_queue_rq->mq_hctx;
+                        trace_block_unplug(q, 1, true);
                         blk_mq_try_issue_directly(data.hctx, same_queue_rq,
-                                        &cookie, false, true);
+                                        &cookie);
                 }
         } else if ((q->nr_hw_queues > 1 && is_sync) || (!q->elevator &&
                         !data.hctx->dispatch_busy)) {
                 blk_mq_put_ctx(data.ctx);
                 blk_mq_bio_to_request(rq, bio);
-                blk_mq_try_issue_directly(data.hctx, rq, &cookie, false, true);
+                blk_mq_try_issue_directly(data.hctx, rq, &cookie);
         } else {
                 blk_mq_put_ctx(data.ctx);
                 blk_mq_bio_to_request(rq, bio);
@@ -2332,7 +2339,7 @@ static int blk_mq_init_hctx(struct request_queue *q,
         return 0;
 
  free_fq:
-        kfree(hctx->fq);
+        blk_free_flush_queue(hctx->fq);
  exit_hctx:
         if (set->ops->exit_hctx)
                 set->ops->exit_hctx(hctx, hctx_idx);
diff --git a/block/blk-mq.h b/block/blk-mq.h
index d704fc7766f4..423ea88ab6fb 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -70,10 +70,8 @@ void blk_mq_request_bypass_insert(struct request *rq, bool run_queue);
 void blk_mq_insert_requests(struct blk_mq_hw_ctx *hctx, struct blk_mq_ctx *ctx,
                                 struct list_head *list);
 
-blk_status_t blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
-                                                struct request *rq,
-                                                blk_qc_t *cookie,
-                                                bool bypass, bool last);
+/* Used by blk_insert_cloned_request() to issue request directly */
+blk_status_t blk_mq_request_issue_directly(struct request *rq, bool last);
 void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx,
                                     struct list_head *list);
 
diff --git a/drivers/acpi/acpica/evgpe.c b/drivers/acpi/acpica/evgpe.c
index 62d3aa74277b..5e9d7348c16f 100644
--- a/drivers/acpi/acpica/evgpe.c
+++ b/drivers/acpi/acpica/evgpe.c
@@ -81,8 +81,12 @@ acpi_status acpi_ev_enable_gpe(struct acpi_gpe_event_info *gpe_event_info)
 
         ACPI_FUNCTION_TRACE(ev_enable_gpe);
 
-        /* Enable the requested GPE */
+        /* Clear the GPE status */
+        status = acpi_hw_clear_gpe(gpe_event_info);
+        if (ACPI_FAILURE(status))
+                return_ACPI_STATUS(status);
 
+        /* Enable the requested GPE */
         status = acpi_hw_low_set_gpe(gpe_event_info, ACPI_GPE_ENABLE);
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
index 417a9f15c116..d7ac09c092f2 100644
--- a/drivers/block/null_blk_main.c
+++ b/drivers/block/null_blk_main.c
@@ -1748,6 +1748,11 @@ static int __init null_init(void)
                 return -EINVAL;
         }
 
+        if (g_home_node != NUMA_NO_NODE && g_home_node >= nr_online_nodes) {
+                pr_err("null_blk: invalid home_node value\n");
+                g_home_node = NUMA_NO_NODE;
+        }
+
         if (g_queue_mode == NULL_Q_RQ) {
                 pr_err("null_blk: legacy IO path no longer available\n");
                 return -EINVAL;
diff --git a/drivers/block/paride/pcd.c b/drivers/block/paride/pcd.c
index 377a694dc228..6d415b20fb70 100644
--- a/drivers/block/paride/pcd.c
+++ b/drivers/block/paride/pcd.c
@@ -314,6 +314,7 @@ static void pcd_init_units(void)
                 disk->queue = blk_mq_init_sq_queue(&cd->tag_set, &pcd_mq_ops,
                                                    1, BLK_MQ_F_SHOULD_MERGE);
                 if (IS_ERR(disk->queue)) {
+                        put_disk(disk);
                         disk->queue = NULL;
                         continue;
                 }
@@ -750,6 +751,8 @@ static int pcd_detect(void)
 
         printk("%s: No CD-ROM drive found\n", name);
         for (unit = 0, cd = pcd; unit < PCD_UNITS; unit++, cd++) {
+                if (!cd->disk)
+                        continue;
                 blk_cleanup_queue(cd->disk->queue);
                 cd->disk->queue = NULL;
                 blk_mq_free_tag_set(&cd->tag_set);
@@ -1010,8 +1013,14 @@ static int __init pcd_init(void)
         pcd_probe_capabilities();
 
         if (register_blkdev(major, name)) {
-                for (unit = 0, cd = pcd; unit < PCD_UNITS; unit++, cd++)
+                for (unit = 0, cd = pcd; unit < PCD_UNITS; unit++, cd++) {
+                        if (!cd->disk)
+                                continue;
+
+                        blk_cleanup_queue(cd->disk->queue);
+                        blk_mq_free_tag_set(&cd->tag_set);
                         put_disk(cd->disk);
+                }
                 return -EBUSY;
         }
 
@@ -1032,6 +1041,9 @@ static void __exit pcd_exit(void)
         int unit;
 
         for (unit = 0, cd = pcd; unit < PCD_UNITS; unit++, cd++) {
+                if (!cd->disk)
+                        continue;
+
                 if (cd->present) {
                         del_gendisk(cd->disk);
                         pi_release(cd->pi);
diff --git a/drivers/block/paride/pf.c b/drivers/block/paride/pf.c
index 103b617cdc31..35e6e271b219 100644
--- a/drivers/block/paride/pf.c
+++ b/drivers/block/paride/pf.c
@@ -762,6 +762,8 @@ static int pf_detect(void)
 
         printk("%s: No ATAPI disk detected\n", name);
         for (pf = units, unit = 0; unit < PF_UNITS; pf++, unit++) {
+                if (!pf->disk)
+                        continue;
                 blk_cleanup_queue(pf->disk->queue);
                 pf->disk->queue = NULL;
                 blk_mq_free_tag_set(&pf->tag_set);
@@ -1029,8 +1031,13 @@ static int __init pf_init(void)
         pf_busy = 0;
 
         if (register_blkdev(major, name)) {
-                for (pf = units, unit = 0; unit < PF_UNITS; pf++, unit++)
+                for (pf = units, unit = 0; unit < PF_UNITS; pf++, unit++) {
+                        if (!pf->disk)
+                                continue;
+                        blk_cleanup_queue(pf->disk->queue);
+                        blk_mq_free_tag_set(&pf->tag_set);
                         put_disk(pf->disk);
+                }
                 return -EBUSY;
         }
 
@@ -1051,6 +1058,9 @@ static void __exit pf_exit(void)
         int unit;
         unregister_blkdev(major, name);
         for (pf = units, unit = 0; unit < PF_UNITS; pf++, unit++) {
+                if (!pf->disk)
+                        continue;
+
                 if (pf->present)
                         del_gendisk(pf->disk);
 
diff --git a/drivers/block/xsysace.c b/drivers/block/xsysace.c
index 87ccef4bd69e..32a21b8d1d85 100644
--- a/drivers/block/xsysace.c
+++ b/drivers/block/xsysace.c
@@ -1090,6 +1090,8 @@ static int ace_setup(struct ace_device *ace)
         return 0;
 
 err_read:
+        /* prevent double queue cleanup */
+        ace->gd->queue = NULL;
         put_disk(ace->gd);
 err_alloc_disk:
         blk_cleanup_queue(ace->queue);
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index ded198328f21..7db48ae65cd2 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2942,6 +2942,7 @@ static int btusb_config_oob_wake(struct hci_dev *hdev)
                 return 0;
         }
 
+        irq_set_status_flags(irq, IRQ_NOAUTOEN);
         ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
                                0, "OOB Wake-on-BT", data);
         if (ret) {
@@ -2956,7 +2957,6 @@ static int btusb_config_oob_wake(struct hci_dev *hdev)
         }
 
         data->oob_wake_irq = irq;
-        disable_irq(irq);
         bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
         return 0;
 }
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 72866a004f07..466ebd84ad17 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -348,7 +348,7 @@ config XILINX_HWICAP
 
 config R3964
         tristate "Siemens R3964 line discipline"
-        depends on TTY
+        depends on TTY && BROKEN
         ---help---
           This driver allows synchronous communication with devices using the
           Siemens R3964 packet protocol. Unless you are dealing with special
diff --git a/drivers/char/tpm/eventlog/tpm2.c b/drivers/char/tpm/eventlog/tpm2.c
index d8b77133a83a..f824563fc28d 100644
--- a/drivers/char/tpm/eventlog/tpm2.c
+++ b/drivers/char/tpm/eventlog/tpm2.c
@@ -37,8 +37,8 @@
  *
  * Returns size of the event. If it is an invalid event, returns 0.
  */
-static int calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
-                                struct tcg_pcr_event *event_header)
+static size_t calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
+                                   struct tcg_pcr_event *event_header)
 {
         struct tcg_efi_specid_event_head *efispecid;
         struct tcg_event_field *event_field;
diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c
index 8856cce5a23b..817ae09a369e 100644
--- a/drivers/char/tpm/tpm-dev-common.c
+++ b/drivers/char/tpm/tpm-dev-common.c
@@ -233,12 +233,19 @@ __poll_t tpm_common_poll(struct file *file, poll_table *wait)
         __poll_t mask = 0;
 
         poll_wait(file, &priv->async_wait, wait);
+        mutex_lock(&priv->buffer_mutex);
 
-        if (!priv->response_read || priv->response_length)
+        /*
+         * The response_length indicates if there is still response
+         * (or part of it) to be consumed. Partial reads decrease it
+         * by the number of bytes read, and write resets it the zero.
+         */
+        if (priv->response_length)
                 mask = EPOLLIN | EPOLLRDNORM;
         else
                 mask = EPOLLOUT | EPOLLWRNORM;
 
+        mutex_unlock(&priv->buffer_mutex);
         return mask;
 }
 
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index 83ece5639f86..ae1030c9b086 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -402,15 +402,13 @@ int tpm_pm_suspend(struct device *dev)
         if (chip->flags & TPM_CHIP_FLAG_ALWAYS_POWERED)
                 return 0;
 
-        if (chip->flags & TPM_CHIP_FLAG_TPM2) {
-                mutex_lock(&chip->tpm_mutex);
-                if (!tpm_chip_start(chip)) {
+        if (!tpm_chip_start(chip)) {
+                if (chip->flags & TPM_CHIP_FLAG_TPM2)
                         tpm2_shutdown(chip, TPM2_SU_STATE);
-                        tpm_chip_stop(chip);
-                }
-                mutex_unlock(&chip->tpm_mutex);
-        } else {
-                rc = tpm1_pm_suspend(chip, tpm_suspend_pcr);
+                else
+                        rc = tpm1_pm_suspend(chip, tpm_suspend_pcr);
+
+                tpm_chip_stop(chip);
         }
 
         return rc;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index b599c7318aab..2986119dd31f 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -2596,6 +2596,9 @@ static int __init intel_pstate_init(void)
         const struct x86_cpu_id *id;
         int rc;
 
+        if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL)
+                return -ENODEV;
+
         if (no_load)
                 return -ENODEV;
 
@@ -2611,7 +2614,7 @@ static int __init intel_pstate_init(void)
         } else {
                 id = x86_match_cpu(intel_pstate_cpu_ids);
                 if (!id) {
-                        pr_info("CPU ID not supported\n");
+                        pr_info("CPU model not supported\n");
                         return -ENODEV;
                 }
 
diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
index b1eadc6652b5..7205d9f4029e 100644
--- a/drivers/crypto/caam/caamhash.c
+++ b/drivers/crypto/caam/caamhash.c
@@ -865,19 +865,18 @@ static int ahash_update_ctx(struct ahash_request *req)
                 if (ret)
                         goto unmap_ctx;
 
-                if (mapped_nents) {
+                if (mapped_nents)
                         sg_to_sec4_sg_last(req->src, mapped_nents,
                                            edesc->sec4_sg + sec4_sg_src_index,
                                            0);
-                        if (*next_buflen)
-                                scatterwalk_map_and_copy(next_buf, req->src,
-                                                         to_hash - *buflen,
-                                                         *next_buflen, 0);
-                } else {
+                else
                         sg_to_sec4_set_last(edesc->sec4_sg + sec4_sg_src_index -
                                             1);
-                }
 
+                if (*next_buflen)
+                        scatterwalk_map_and_copy(next_buf, req->src,
+                                                 to_hash - *buflen,
+                                                 *next_buflen, 0);
                 desc = edesc->hw_desc;
 
                 edesc->sec4_sg_dma = dma_map_single(jrdev, edesc->sec4_sg,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 4f8fb4ecde34..ac0d646a7b74 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -3625,6 +3625,7 @@ static void amdgpu_device_get_min_pci_speed_width(struct amdgpu_device *adev,
         struct pci_dev *pdev = adev->pdev;
         enum pci_bus_speed cur_speed;
         enum pcie_link_width cur_width;
+        u32 ret = 1;
 
         *speed = PCI_SPEED_UNKNOWN;
         *width = PCIE_LNK_WIDTH_UNKNOWN;
@@ -3632,6 +3633,10 @@ static void amdgpu_device_get_min_pci_speed_width(struct amdgpu_device *adev,
         while (pdev) {
                 cur_speed = pcie_get_speed_cap(pdev);
                 cur_width = pcie_get_width_cap(pdev);
+                ret = pcie_bandwidth_available(adev->pdev, NULL,
+                                                       NULL, &cur_width);
+                if (!ret)
+                        cur_width = PCIE_LNK_WIDTH_RESRV;
 
                 if (cur_speed != PCI_SPEED_UNKNOWN) {
                         if (*speed == PCI_SPEED_UNKNOWN)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index d0309e8c9d12..a11db2b1a63f 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -2405,8 +2405,6 @@ static int gfx_v9_0_rlc_resume(struct amdgpu_device *adev)
         /* disable CG */
         WREG32_SOC15(GC, 0, mmRLC_CGCG_CGLS_CTRL, 0);
 
-        adev->gfx.rlc.funcs->reset(adev);
-
         gfx_v9_0_init_pg(adev);
 
         if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP) {
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 4eba3c4800b6..ea18e9c2d8ce 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -2660,12 +2660,18 @@ void core_link_enable_stream(
 void core_link_disable_stream(struct pipe_ctx *pipe_ctx, int option)
 {
         struct dc  *core_dc = pipe_ctx->stream->ctx->dc;
+        struct dc_stream_state *stream = pipe_ctx->stream;
 
         core_dc->hwss.blank_stream(pipe_ctx);
 
         if (pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
                 deallocate_mst_payload(pipe_ctx);
 
+        if (dc_is_hdmi_signal(pipe_ctx->stream->signal))
+                dal_ddc_service_write_scdc_data(
+                        stream->link->ddc, 0,
+                        stream->timing.flags.LTE_340MCSC_SCRAMBLE);
+
         core_dc->hwss.disable_stream(pipe_ctx, option);
 
         disable_link(pipe_ctx->stream->link, pipe_ctx->stream->signal);
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
index 9aa7bec1b5fe..23b5b94a4939 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
@@ -91,6 +91,12 @@ static void vega20_set_default_registry_data(struct pp_hwmgr *hwmgr)
          *   MP0CLK DS
          */
         data->registry_data.disallowed_features = 0xE0041C00;
+        /* ECC feature should be disabled on old SMUs */
+        smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetSmuVersion);
+        hwmgr->smu_version = smum_get_argument(hwmgr);
+        if (hwmgr->smu_version < 0x282100)
+                data->registry_data.disallowed_features |= FEATURE_ECC_MASK;
+
         data->registry_data.od_state_in_dc_support = 0;
         data->registry_data.thermal_support = 1;
         data->registry_data.skip_baco_hardware = 0;
@@ -357,6 +363,7 @@ static void vega20_init_dpm_defaults(struct pp_hwmgr *hwmgr)
         data->smu_features[GNLD_DS_MP1CLK].smu_feature_id = FEATURE_DS_MP1CLK_BIT;
         data->smu_features[GNLD_DS_MP0CLK].smu_feature_id = FEATURE_DS_MP0CLK_BIT;
         data->smu_features[GNLD_XGMI].smu_feature_id = FEATURE_XGMI_BIT;
+        data->smu_features[GNLD_ECC].smu_feature_id = FEATURE_ECC_BIT;
 
         for (i = 0; i < GNLD_FEATURES_MAX; i++) {
                 data->smu_features[i].smu_feature_bitmap =
@@ -3020,7 +3027,8 @@ static int vega20_get_ppfeature_status(struct pp_hwmgr *hwmgr, char *buf)
                                 "FCLK_DS",
                                 "MP1CLK_DS",
                                 "MP0CLK_DS",
-                                "XGMI"};
+                                "XGMI",
+                                "ECC"};
         static const char *output_title[] = {
                                 "FEATURES",
                                 "BITMASK",
@@ -3462,6 +3470,7 @@ static int vega20_apply_clocks_adjust_rules(struct pp_hwmgr *hwmgr)
         struct vega20_single_dpm_table *dpm_table;
         bool vblank_too_short = false;
         bool disable_mclk_switching;
+        bool disable_fclk_switching;
         uint32_t i, latency;
 
         disable_mclk_switching = ((1 < hwmgr->display_config->num_display) &&
@@ -3537,13 +3546,20 @@ static int vega20_apply_clocks_adjust_rules(struct pp_hwmgr *hwmgr)
         if (hwmgr->display_config->nb_pstate_switch_disable)
                 dpm_table->dpm_state.hard_min_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
 
+        if ((disable_mclk_switching &&
+            (dpm_table->dpm_state.hard_min_level == dpm_table->dpm_levels[dpm_table->count - 1].value)) ||
+             hwmgr->display_config->min_mem_set_clock / 100 >= dpm_table->dpm_levels[dpm_table->count - 1].value)
+                disable_fclk_switching = true;
+        else
+                disable_fclk_switching = false;
+
         /* fclk */
         dpm_table = &(data->dpm_table.fclk_table);
         dpm_table->dpm_state.soft_min_level = dpm_table->dpm_levels[0].value;
         dpm_table->dpm_state.soft_max_level = VG20_CLOCK_MAX_DEFAULT;
         dpm_table->dpm_state.hard_min_level = dpm_table->dpm_levels[0].value;
         dpm_table->dpm_state.hard_max_level = VG20_CLOCK_MAX_DEFAULT;
-        if (hwmgr->display_config->nb_pstate_switch_disable)
+        if (hwmgr->display_config->nb_pstate_switch_disable || disable_fclk_switching)
                 dpm_table->dpm_state.soft_min_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
 
         /* vclk */
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h
index a5bc758ae097..ac2a3118a0ae 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h
@@ -80,6 +80,7 @@ enum {
         GNLD_DS_MP1CLK,
         GNLD_DS_MP0CLK,
         GNLD_XGMI,
+        GNLD_ECC,
 
         GNLD_FEATURES_MAX
 };
diff --git a/drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if.h b/drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if.h
index 63d5cf691549..195c4ae67058 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if.h
@@ -99,7 +99,7 @@
 #define FEATURE_DS_MP1CLK_BIT           30
 #define FEATURE_DS_MP0CLK_BIT           31
 #define FEATURE_XGMI_BIT                32
-#define FEATURE_SPARE_33_BIT            33
+#define FEATURE_ECC_BIT                 33
 #define FEATURE_SPARE_34_BIT            34
 #define FEATURE_SPARE_35_BIT            35
 #define FEATURE_SPARE_36_BIT            36
@@ -165,7 +165,8 @@
 #define FEATURE_DS_FCLK_MASK            (1 << FEATURE_DS_FCLK_BIT            )
 #define FEATURE_DS_MP1CLK_MASK          (1 << FEATURE_DS_MP1CLK_BIT          )
 #define FEATURE_DS_MP0CLK_MASK          (1 << FEATURE_DS_MP0CLK_BIT          )
-#define FEATURE_XGMI_MASK               (1 << FEATURE_XGMI_BIT               )
+#define FEATURE_XGMI_MASK               (1ULL << FEATURE_XGMI_BIT               )
+#define FEATURE_ECC_MASK                (1ULL << FEATURE_ECC_BIT                )
 
 #define DPM_OVERRIDE_DISABLE_SOCCLK_PID             0x00000001
 #define DPM_OVERRIDE_DISABLE_UCLK_PID               0x00000002
diff --git a/drivers/gpu/drm/i915/gvt/display.c b/drivers/gpu/drm/i915/gvt/display.c
index 035479e273be..e3f9caa7839f 100644
--- a/drivers/gpu/drm/i915/gvt/display.c
+++ b/drivers/gpu/drm/i915/gvt/display.c
@@ -448,7 +448,7 @@ void intel_gvt_emulate_vblank(struct intel_gvt *gvt)
 /**
  * intel_vgpu_emulate_hotplug - trigger hotplug event for vGPU
  * @vgpu: a vGPU
- * @conncted: link state
+ * @connected: link state
  *
  * This function is used to trigger hotplug interrupt for vGPU
  *
diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c
index 3e7e2b80c857..5d887f7cc0d5 100644
--- a/drivers/gpu/drm/i915/gvt/dmabuf.c
+++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
@@ -238,9 +238,6 @@ static int vgpu_get_plane_info(struct drm_device *dev,
                 default:
                         gvt_vgpu_err("invalid tiling mode: %x\n", p.tiled);
                 }
-
-                info->size = (((p.stride * p.height * p.bpp) / 8) +
-                              (PAGE_SIZE - 1)) >> PAGE_SHIFT;
         } else if (plane_id == DRM_PLANE_TYPE_CURSOR) {
                 ret = intel_vgpu_decode_cursor_plane(vgpu, &c);
                 if (ret)
@@ -262,14 +259,13 @@ static int vgpu_get_plane_info(struct drm_device *dev,
                         info->x_hot = UINT_MAX;
                         info->y_hot = UINT_MAX;
                 }
-
-                info->size = (((info->stride * c.height * c.bpp) / 8)
-                                + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
         } else {
                 gvt_vgpu_err("invalid plane id:%d\n", plane_id);
                 return -EINVAL;
         }
 
+        info->size = (info->stride * info->height + PAGE_SIZE - 1)
+                      >> PAGE_SHIFT;
         if (info->size == 0) {
                 gvt_vgpu_err("fb size is zero\n");
                 return -EINVAL;
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index d7052ab7908c..cf133ef03873 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -1946,7 +1946,7 @@ void _intel_vgpu_mm_release(struct kref *mm_ref)
  */
 void intel_vgpu_unpin_mm(struct intel_vgpu_mm *mm)
 {
-        atomic_dec(&mm->pincount);
+        atomic_dec_if_positive(&mm->pincount);
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index 159192c097cc..05b953793316 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -1486,8 +1486,9 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id,
                 intel_runtime_pm_put_unchecked(dev_priv);
         }
 
-        if (ret && (vgpu_is_vm_unhealthy(ret))) {
-                enter_failsafe_mode(vgpu, GVT_FAILSAFE_GUEST_ERR);
+        if (ret) {
+                if (vgpu_is_vm_unhealthy(ret))
+                        enter_failsafe_mode(vgpu, GVT_FAILSAFE_GUEST_ERR);
                 intel_vgpu_destroy_workload(workload);
                 return ERR_PTR(ret);
         }
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 0bd890c04fe4..f6f6e5b78e97 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -4830,7 +4830,10 @@ static int i915_dsc_fec_support_show(struct seq_file *m, void *data)
                 ret = drm_modeset_lock(&dev->mode_config.connection_mutex,
                                        &ctx);
                 if (ret) {
-                        ret = -EINTR;
+                        if (ret == -EDEADLK && !drm_modeset_backoff(&ctx)) {
+                                try_again = true;
+                                continue;
+                        }
                         break;
                 }
                 crtc = connector->state->crtc;
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 6ca8d322b487..4ca0cdfa6b33 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -150,6 +150,7 @@ config HID_ASUS
         tristate "Asus"
         depends on LEDS_CLASS
         depends on ASUS_WMI || ASUS_WMI=n
+        select POWER_SUPPLY
         ---help---
         Support for Asus notebook built-in keyboard and touchpad via i2c, and
         the Asus Republic of Gamers laptop keyboard special keys.
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 9993b692598f..860e21ec6a49 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1301,10 +1301,10 @@ static u32 __extract(u8 *report, unsigned offset, int n)
 u32 hid_field_extract(const struct hid_device *hid, u8 *report,
                         unsigned offset, unsigned n)
 {
-        if (n > 32) {
-                hid_warn(hid, "hid_field_extract() called with n (%d) > 32! (%s)\n",
+        if (n > 256) {
+                hid_warn(hid, "hid_field_extract() called with n (%d) > 256! (%s)\n",
                          n, current->comm);
-                n = 32;
+                n = 256;
         }
 
         return __extract(report, offset, n);
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index ac9fda1b5a72..1384e57182af 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -1060,10 +1060,15 @@ static int hid_debug_rdesc_show(struct seq_file *f, void *p)
         seq_printf(f, "\n\n");
 
         /* dump parsed data and input mappings */
+        if (down_interruptible(&hdev->driver_input_lock))
+                return 0;
+
         hid_dump_device(hdev, f);
         seq_printf(f, "\n");
         hid_dump_input_mapping(hdev, f);
 
+        up(&hdev->driver_input_lock);
+
         return 0;
 }
 
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b6d93f4ad037..adce58f24f76 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -1083,6 +1083,7 @@
 #define USB_DEVICE_ID_SYNAPTICS_HD      0x0ac3
 #define USB_DEVICE_ID_SYNAPTICS_QUAD_HD 0x1ac3
 #define USB_DEVICE_ID_SYNAPTICS_TP_V103 0x5710
+#define I2C_DEVICE_ID_SYNAPTICS_7E7E    0x7e7e
 
 #define USB_VENDOR_ID_TEXAS_INSTRUMENTS 0x2047
 #define USB_DEVICE_ID_TEXAS_INSTRUMENTS_LENOVO_YOGA     0x0855
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index b10b1922c5bd..1fce0076e7dc 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -998,6 +998,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                 case 0x1b8: map_key_clear(KEY_VIDEO);           break;
                 case 0x1bc: map_key_clear(KEY_MESSENGER);       break;
                 case 0x1bd: map_key_clear(KEY_INFO);            break;
+                case 0x1cb: map_key_clear(KEY_ASSISTANT);       break;
                 case 0x201: map_key_clear(KEY_NEW);             break;
                 case 0x202: map_key_clear(KEY_OPEN);            break;
                 case 0x203: map_key_clear(KEY_CLOSE);           break;
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 15ed6177a7a3..199cc256e9d9 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -2111,6 +2111,13 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
                 kfree(data);
                 return -ENOMEM;
         }
+        data->wq = create_singlethread_workqueue("hidpp-ff-sendqueue");
+        if (!data->wq) {
+                kfree(data->effect_ids);
+                kfree(data);
+                return -ENOMEM;
+        }
+
         data->hidpp = hidpp;
         data->feature_index = feature_index;
         data->version = version;
@@ -2155,7 +2162,6 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
         /* ignore boost value at response.fap.params[2] */
 
         /* init the hardware command queue */
-        data->wq = create_singlethread_workqueue("hidpp-ff-sendqueue");
         atomic_set(&data->workqueue_size, 0);
 
         /* initialize with zero autocenter to get wheel in usable state */
@@ -2608,8 +2614,9 @@ static int m560_raw_event(struct hid_device *hdev, u8 *data, int size)
                 input_report_rel(mydata->input, REL_Y, v);
 
                 v = hid_snto32(data[6], 8);
-                hidpp_scroll_counter_handle_scroll(
-                                &hidpp->vertical_wheel_counter, v);
+                if (v != 0)
+                        hidpp_scroll_counter_handle_scroll(
+                                        &hidpp->vertical_wheel_counter, v);
 
                 input_sync(mydata->input);
         }
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 953908f2267c..77ffba48cc73 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -715,7 +715,6 @@ static const struct hid_device_id hid_ignore_list[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_DEALEXTREAME, USB_DEVICE_ID_DEALEXTREAME_RADIO_SI4701) },
         { HID_USB_DEVICE(USB_VENDOR_ID_DELORME, USB_DEVICE_ID_DELORME_EARTHMATE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_DELORME, USB_DEVICE_ID_DELORME_EM_LT20) },
-        { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, 0x0400) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ESSENTIAL_REALITY, USB_DEVICE_ID_ESSENTIAL_REALITY_P5) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC5UH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC4UM) },
@@ -855,7 +854,7 @@ static const struct hid_device_id hid_ignore_list[] = {
         { }
 };
 
-/**
+/*
  * hid_mouse_ignore_list - mouse devices which should not be handled by the hid layer
  *
  * There are composite devices for which we want to ignore only a certain
@@ -996,6 +995,10 @@ bool hid_ignore(struct hid_device *hdev)
                 if (hdev->product == 0x0401 &&
                     strncmp(hdev->name, "ELAN0800", 8) != 0)
                         return true;
+                /* Same with product id 0x0400 */
+                if (hdev->product == 0x0400 &&
+                    strncmp(hdev->name, "QTEC0001", 8) != 0)
+                        return true;
                 break;
         }
 
@@ -1042,7 +1045,7 @@ static struct hid_device_id *hid_exists_dquirk(const struct hid_device *hdev)
         }
 
         if (bl_entry != NULL)
-                dbg_hid("Found dynamic quirk 0x%lx for HID device 0x%hx:0x%hx\n",
+                dbg_hid("Found dynamic quirk 0x%lx for HID device 0x%04x:0x%04x\n",
                         bl_entry->driver_data, bl_entry->vendor,
                         bl_entry->product);
 
@@ -1209,7 +1212,7 @@ static unsigned long hid_gets_squirk(const struct hid_device *hdev)
                 quirks |= bl_entry->driver_data;
 
         if (quirks)
-                dbg_hid("Found squirk 0x%lx for HID device 0x%hx:0x%hx\n",
+                dbg_hid("Found squirk 0x%lx for HID device 0x%04x:0x%04x\n",
                         quirks, hdev->vendor, hdev->product);
         return quirks;
 }
diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
index 8141cadfca0e..8dae0f9b819e 100644
--- a/drivers/hid/hid-steam.c
+++ b/drivers/hid/hid-steam.c
@@ -499,6 +499,7 @@ static void steam_battery_unregister(struct steam_device *steam)
 static int steam_register(struct steam_device *steam)
 {
         int ret;
+        bool client_opened;
 
         /*
          * This function can be called several times in a row with the
@@ -511,9 +512,11 @@ static int steam_register(struct steam_device *steam)
                  * Unlikely, but getting the serial could fail, and it is not so
                  * important, so make up a serial number and go on.
                  */
+                mutex_lock(&steam->mutex);
                 if (steam_get_serial(steam) < 0)
                         strlcpy(steam->serial_no, "XXXXXXXXXX",
                                         sizeof(steam->serial_no));
+                mutex_unlock(&steam->mutex);
 
                 hid_info(steam->hdev, "Steam Controller '%s' connected",
                                 steam->serial_no);
@@ -528,13 +531,15 @@ static int steam_register(struct steam_device *steam)
         }
 
         mutex_lock(&steam->mutex);
-        if (!steam->client_opened) {
+        client_opened = steam->client_opened;
+        if (!client_opened)
                 steam_set_lizard_mode(steam, lizard_mode);
+        mutex_unlock(&steam->mutex);
+
+        if (!client_opened)
                 ret = steam_input_register(steam);
-        } else {
+        else
                 ret = 0;
-        }
-        mutex_unlock(&steam->mutex);
 
         return ret;
 }
@@ -630,14 +635,21 @@ static void steam_client_ll_close(struct hid_device *hdev)
 {
         struct steam_device *steam = hdev->driver_data;
 
+        unsigned long flags;
+        bool connected;
+
+        spin_lock_irqsave(&steam->lock, flags);
+        connected = steam->connected;
+        spin_unlock_irqrestore(&steam->lock, flags);
+
         mutex_lock(&steam->mutex);
         steam->client_opened = false;
+        if (connected)
+                steam_set_lizard_mode(steam, lizard_mode);
         mutex_unlock(&steam->mutex);
 
-        if (steam->connected) {
-                steam_set_lizard_mode(steam, lizard_mode);
+        if (connected)
                 steam_input_register(steam);
-        }
 }
 
 static int steam_client_ll_raw_request(struct hid_device *hdev,
diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c
index 7710d9f957da..0187c9f8fc22 100644
--- a/drivers/hid/hid-uclogic-params.c
+++ b/drivers/hid/hid-uclogic-params.c
@@ -735,10 +735,6 @@ static int uclogic_params_huion_init(struct uclogic_params *params,
                 goto cleanup;
         }
         rc = usb_string(udev, 201, ver_ptr, ver_len);
-        if (ver_ptr == NULL) {
-                rc = -ENOMEM;
-                goto cleanup;
-        }
         if (rc == -EPIPE) {
                 *ver_ptr = '\0';
         } else if (rc < 0) {
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 90164fed08d3..4d1f24ee249c 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -184,6 +184,8 @@ static const struct i2c_hid_quirks {
                 I2C_HID_QUIRK_NO_RUNTIME_PM },
         { USB_VENDOR_ID_ELAN, HID_ANY_ID,
                  I2C_HID_QUIRK_BOGUS_IRQ },
+        { USB_VENDOR_ID_SYNAPTICS, I2C_DEVICE_ID_SYNAPTICS_7E7E,
+                I2C_HID_QUIRK_NO_RUNTIME_PM },
         { 0, 0 }
 };
 
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 6f929bfa9fcd..d0f1dfe2bcbb 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -1759,6 +1759,7 @@ config SENSORS_VT8231
 config SENSORS_W83773G
         tristate "Nuvoton W83773G"
         depends on I2C
+        select REGMAP_I2C
         help
           If you say yes here you get support for the Nuvoton W83773G hardware
           monitoring chip.
diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
index e4f9f7ce92fa..f9abeeeead9e 100644
--- a/drivers/hwmon/ntc_thermistor.c
+++ b/drivers/hwmon/ntc_thermistor.c
@@ -640,7 +640,7 @@ static const struct hwmon_channel_info ntc_chip = {
 };
 
 static const u32 ntc_temp_config[] = {
-        HWMON_T_INPUT, HWMON_T_TYPE,
+        HWMON_T_INPUT | HWMON_T_TYPE,
         0
 };
 
diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
index b91a80abf724..4679acb4918e 100644
--- a/drivers/hwmon/occ/common.c
+++ b/drivers/hwmon/occ/common.c
@@ -890,6 +890,8 @@ static int occ_setup_sensor_attrs(struct occ *occ)
                                 s++;
                         }
                 }
+
+                s = (sensors->power.num_sensors * 4) + 1;
         } else {
                 for (i = 0; i < sensors->power.num_sensors; ++i) {
                         s = i + 1;
@@ -918,11 +920,11 @@ static int occ_setup_sensor_attrs(struct occ *occ)
                                                      show_power, NULL, 3, i);
                         attr++;
                 }
-        }
 
-        if (sensors->caps.num_sensors >= 1) {
                 s = sensors->power.num_sensors + 1;
+        }
 
+        if (sensors->caps.num_sensors >= 1) {
                 snprintf(attr->name, sizeof(attr->name), "power%d_label", s);
                 attr->sensor = OCC_INIT_ATTR(attr->name, 0444, show_caps, NULL,
                                              0, 0);
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 42fed40198a0..c0c3043b5d61 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -1169,11 +1169,13 @@ static int i2c_imx_probe(struct platform_device *pdev)
         /* Init DMA config if supported */
         ret = i2c_imx_dma_request(i2c_imx, phy_addr);
         if (ret < 0)
-                goto clk_notifier_unregister;
+                goto del_adapter;
 
         dev_info(&i2c_imx->adapter.dev, "IMX I2C adapter registered\n");
         return 0;   /* Return OK */
 
+del_adapter:
+        i2c_del_adapter(&i2c_imx->adapter);
 clk_notifier_unregister:
         clk_notifier_unregister(i2c_imx->clk, &i2c_imx->clk_change_nb);
 rpm_disable:
diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h
index 95c6d86ab5e8..c4ef1fceead6 100644
--- a/drivers/md/dm-core.h
+++ b/drivers/md/dm-core.h
@@ -115,6 +115,7 @@ struct mapped_device {
         struct srcu_struct io_barrier;
 };
 
+void disable_discard(struct mapped_device *md);
 void disable_write_same(struct mapped_device *md);
 void disable_write_zeroes(struct mapped_device *md);
 
diff --git a/drivers/md/dm-init.c b/drivers/md/dm-init.c
index b53f30f16b4d..4b76f84424c3 100644
--- a/drivers/md/dm-init.c
+++ b/drivers/md/dm-init.c
@@ -36,7 +36,7 @@ struct dm_device {
         struct list_head list;
 };
 
-const char *dm_allowed_targets[] __initconst = {
+const char * const dm_allowed_targets[] __initconst = {
         "crypt",
         "delay",
         "linear",
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index d57d997a52c8..7c678f50aaa3 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -913,7 +913,7 @@ static void copy_from_journal(struct dm_integrity_c *ic, unsigned section, unsig
 static bool ranges_overlap(struct dm_integrity_range *range1, struct dm_integrity_range *range2)
 {
         return range1->logical_sector < range2->logical_sector + range2->n_sectors &&
-               range2->logical_sector + range2->n_sectors > range2->logical_sector;
+               range1->logical_sector + range1->n_sectors > range2->logical_sector;
 }
 
 static bool add_new_range(struct dm_integrity_c *ic, struct dm_integrity_range *new_range, bool check_waiting)
@@ -959,8 +959,6 @@ static void remove_range_unlocked(struct dm_integrity_c *ic, struct dm_integrity
                 struct dm_integrity_range *last_range =
                         list_first_entry(&ic->wait_list, struct dm_integrity_range, wait_entry);
                 struct task_struct *last_range_task;
-                if (!ranges_overlap(range, last_range))
-                        break;
                 last_range_task = last_range->task;
                 list_del(&last_range->wait_entry);
                 if (!add_new_range(ic, last_range, false)) {
@@ -3185,7 +3183,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
                         journal_watermark = val;
                 else if (sscanf(opt_string, "commit_time:%u%c", &val, &dummy) == 1)
                         sync_msec = val;
-                else if (!memcmp(opt_string, "meta_device:", strlen("meta_device:"))) {
+                else if (!strncmp(opt_string, "meta_device:", strlen("meta_device:"))) {
                         if (ic->meta_dev) {
                                 dm_put_device(ti, ic->meta_dev);
                                 ic->meta_dev = NULL;
@@ -3204,17 +3202,17 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
                                 goto bad;
                         }
                         ic->sectors_per_block = val >> SECTOR_SHIFT;
-                } else if (!memcmp(opt_string, "internal_hash:", strlen("internal_hash:"))) {
+                } else if (!strncmp(opt_string, "internal_hash:", strlen("internal_hash:"))) {
                         r = get_alg_and_key(opt_string, &ic->internal_hash_alg, &ti->error,
                                             "Invalid internal_hash argument");
                         if (r)
                                 goto bad;
-                } else if (!memcmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) {
+                } else if (!strncmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) {
                         r = get_alg_and_key(opt_string, &ic->journal_crypt_alg, &ti->error,
                                             "Invalid journal_crypt argument");
                         if (r)
                                 goto bad;
-                } else if (!memcmp(opt_string, "journal_mac:", strlen("journal_mac:"))) {
+                } else if (!strncmp(opt_string, "journal_mac:", strlen("journal_mac:"))) {
                         r = get_alg_and_key(opt_string, &ic->journal_mac_alg,  &ti->error,
                                             "Invalid journal_mac argument");
                         if (r)
@@ -3616,7 +3614,7 @@ static struct target_type integrity_target = {
         .io_hints               = dm_integrity_io_hints,
 };
 
-int __init dm_integrity_init(void)
+static int __init dm_integrity_init(void)
 {
         int r;
 
@@ -3635,7 +3633,7 @@ int __init dm_integrity_init(void)
         return r;
 }
 
-void dm_integrity_exit(void)
+static void __exit dm_integrity_exit(void)
 {
         dm_unregister_target(&integrity_target);
         kmem_cache_destroy(journal_io_cache);
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 09773636602d..b66745bd08bb 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -222,11 +222,14 @@ static void dm_done(struct request *clone, blk_status_t error, bool mapped)
         }
 
         if (unlikely(error == BLK_STS_TARGET)) {
-                if (req_op(clone) == REQ_OP_WRITE_SAME &&
-                    !clone->q->limits.max_write_same_sectors)
+                if (req_op(clone) == REQ_OP_DISCARD &&
+                    !clone->q->limits.max_discard_sectors)
+                        disable_discard(tio->md);
+                else if (req_op(clone) == REQ_OP_WRITE_SAME &&
+                         !clone->q->limits.max_write_same_sectors)
                         disable_write_same(tio->md);
-                if (req_op(clone) == REQ_OP_WRITE_ZEROES &&
-                    !clone->q->limits.max_write_zeroes_sectors)
+                else if (req_op(clone) == REQ_OP_WRITE_ZEROES &&
+                         !clone->q->limits.max_write_zeroes_sectors)
                         disable_write_zeroes(tio->md);
         }
 
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index ba9481f1bf3c..cde3b49b2a91 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1844,6 +1844,36 @@ static bool dm_table_supports_secure_erase(struct dm_table *t)
         return true;
 }
 
+static int device_requires_stable_pages(struct dm_target *ti,
+                                        struct dm_dev *dev, sector_t start,
+                                        sector_t len, void *data)
+{
+        struct request_queue *q = bdev_get_queue(dev->bdev);
+
+        return q && bdi_cap_stable_pages_required(q->backing_dev_info);
+}
+
+/*
+ * If any underlying device requires stable pages, a table must require
+ * them as well.  Only targets that support iterate_devices are considered:
+ * don't want error, zero, etc to require stable pages.
+ */
+static bool dm_table_requires_stable_pages(struct dm_table *t)
+{
+        struct dm_target *ti;
+        unsigned i;
+
+        for (i = 0; i < dm_table_get_num_targets(t); i++) {
+                ti = dm_table_get_target(t, i);
+
+                if (ti->type->iterate_devices &&
+                    ti->type->iterate_devices(ti, device_requires_stable_pages, NULL))
+                        return true;
+        }
+
+        return false;
+}
+
 void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
                                struct queue_limits *limits)
 {
@@ -1897,6 +1927,15 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
         dm_table_verify_integrity(t);
 
         /*
+         * Some devices don't use blk_integrity but still want stable pages
+         * because they do their own checksumming.
+         */
+        if (dm_table_requires_stable_pages(t))
+                q->backing_dev_info->capabilities |= BDI_CAP_STABLE_WRITES;
+        else
+                q->backing_dev_info->capabilities &= ~BDI_CAP_STABLE_WRITES;
+
+        /*
          * Determine whether or not this queue's I/O timings contribute
          * to the entropy pool, Only request-based targets use this.
          * Clear QUEUE_FLAG_ADD_RANDOM if any underlying device does not
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 68d24056d0b1..043f0761e4a0 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -945,6 +945,15 @@ static void dec_pending(struct dm_io *io, blk_status_t error)
         }
 }
 
+void disable_discard(struct mapped_device *md)
+{
+        struct queue_limits *limits = dm_get_queue_limits(md);
+
+        /* device doesn't really support DISCARD, disable it */
+        limits->max_discard_sectors = 0;
+        blk_queue_flag_clear(QUEUE_FLAG_DISCARD, md->queue);
+}
+
 void disable_write_same(struct mapped_device *md)
 {
         struct queue_limits *limits = dm_get_queue_limits(md);
@@ -970,11 +979,14 @@ static void clone_endio(struct bio *bio)
         dm_endio_fn endio = tio->ti->type->end_io;
 
         if (unlikely(error == BLK_STS_TARGET) && md->type != DM_TYPE_NVME_BIO_BASED) {
-                if (bio_op(bio) == REQ_OP_WRITE_SAME &&
-                    !bio->bi_disk->queue->limits.max_write_same_sectors)
+                if (bio_op(bio) == REQ_OP_DISCARD &&
+                    !bio->bi_disk->queue->limits.max_discard_sectors)
+                        disable_discard(md);
+                else if (bio_op(bio) == REQ_OP_WRITE_SAME &&
+                         !bio->bi_disk->queue->limits.max_write_same_sectors)
                         disable_write_same(md);
-                if (bio_op(bio) == REQ_OP_WRITE_ZEROES &&
-                    !bio->bi_disk->queue->limits.max_write_zeroes_sectors)
+                else if (bio_op(bio) == REQ_OP_WRITE_ZEROES &&
+                         !bio->bi_disk->queue->limits.max_write_zeroes_sectors)
                         disable_write_zeroes(md);
         }
 
@@ -1042,15 +1054,7 @@ int dm_set_target_max_io_len(struct dm_target *ti, sector_t len)
                 return -EINVAL;
         }
 
-        /*
-         * BIO based queue uses its own splitting. When multipage bvecs
-         * is switched on, size of the incoming bio may be too big to
-         * be handled in some targets, such as crypt.
-         *
-         * When these targets are ready for the big bio, we can remove
-         * the limit.
-         */
-        ti->max_io_len = min_t(uint32_t, len, BIO_MAX_PAGES * PAGE_SIZE);
+        ti->max_io_len = (uint32_t) len;
 
         return 0;
 }
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 0ce2d8dfc5f1..26ad6468d13a 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -1246,7 +1246,7 @@ config MFD_STA2X11
 
 config MFD_SUN6I_PRCM
         bool "Allwinner A31 PRCM controller"
-        depends on ARCH_SUNXI
+        depends on ARCH_SUNXI || COMPILE_TEST
         select MFD_CORE
         help
           Support for the PRCM (Power/Reset/Clock Management) unit available
diff --git a/drivers/mfd/sprd-sc27xx-spi.c b/drivers/mfd/sprd-sc27xx-spi.c
index 69df27769c21..43ac71691fe4 100644
--- a/drivers/mfd/sprd-sc27xx-spi.c
+++ b/drivers/mfd/sprd-sc27xx-spi.c
@@ -53,67 +53,67 @@ static const struct sprd_pmic_data sc2731_data = {
 static const struct mfd_cell sprd_pmic_devs[] = {
         {
                 .name = "sc27xx-wdt",
-                .of_compatible = "sprd,sc27xx-wdt",
+                .of_compatible = "sprd,sc2731-wdt",
         }, {
                 .name = "sc27xx-rtc",
-                .of_compatible = "sprd,sc27xx-rtc",
+                .of_compatible = "sprd,sc2731-rtc",
         }, {
                 .name = "sc27xx-charger",
-                .of_compatible = "sprd,sc27xx-charger",
+                .of_compatible = "sprd,sc2731-charger",
         }, {
                 .name = "sc27xx-chg-timer",
-                .of_compatible = "sprd,sc27xx-chg-timer",
+                .of_compatible = "sprd,sc2731-chg-timer",
         }, {
                 .name = "sc27xx-fast-chg",
-                .of_compatible = "sprd,sc27xx-fast-chg",
+                .of_compatible = "sprd,sc2731-fast-chg",
         }, {
                 .name = "sc27xx-chg-wdt",
-                .of_compatible = "sprd,sc27xx-chg-wdt",
+                .of_compatible = "sprd,sc2731-chg-wdt",
         }, {
                 .name = "sc27xx-typec",
-                .of_compatible = "sprd,sc27xx-typec",
+                .of_compatible = "sprd,sc2731-typec",
         }, {
                 .name = "sc27xx-flash",
-                .of_compatible = "sprd,sc27xx-flash",
+                .of_compatible = "sprd,sc2731-flash",
         }, {
                 .name = "sc27xx-eic",
-                .of_compatible = "sprd,sc27xx-eic",
+                .of_compatible = "sprd,sc2731-eic",
         }, {
                 .name = "sc27xx-efuse",
-                .of_compatible = "sprd,sc27xx-efuse",
+                .of_compatible = "sprd,sc2731-efuse",
         }, {
                 .name = "sc27xx-thermal",
-                .of_compatible = "sprd,sc27xx-thermal",
+                .of_compatible = "sprd,sc2731-thermal",
         }, {
                 .name = "sc27xx-adc",
-                .of_compatible = "sprd,sc27xx-adc",
+                .of_compatible = "sprd,sc2731-adc",
         }, {
                 .name = "sc27xx-audio-codec",
-                .of_compatible = "sprd,sc27xx-audio-codec",
+                .of_compatible = "sprd,sc2731-audio-codec",
         }, {
                 .name = "sc27xx-regulator",
-                .of_compatible = "sprd,sc27xx-regulator",
+                .of_compatible = "sprd,sc2731-regulator",
         }, {
                 .name = "sc27xx-vibrator",
-                .of_compatible = "sprd,sc27xx-vibrator",
+                .of_compatible = "sprd,sc2731-vibrator",
         }, {
                 .name = "sc27xx-keypad-led",
-                .of_compatible = "sprd,sc27xx-keypad-led",
+                .of_compatible = "sprd,sc2731-keypad-led",
         }, {
                 .name = "sc27xx-bltc",
-                .of_compatible = "sprd,sc27xx-bltc",
+                .of_compatible = "sprd,sc2731-bltc",
         }, {
                 .name = "sc27xx-fgu",
-                .of_compatible = "sprd,sc27xx-fgu",
+                .of_compatible = "sprd,sc2731-fgu",
         }, {
                 .name = "sc27xx-7sreset",
-                .of_compatible = "sprd,sc27xx-7sreset",
+                .of_compatible = "sprd,sc2731-7sreset",
         }, {
                 .name = "sc27xx-poweroff",
-                .of_compatible = "sprd,sc27xx-poweroff",
+                .of_compatible = "sprd,sc2731-poweroff",
         }, {
                 .name = "sc27xx-syscon",
-                .of_compatible = "sprd,sc27xx-syscon",
+                .of_compatible = "sprd,sc2731-syscon",
         },
 };
 
diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
index 299016bc46d9..104477b512a2 100644
--- a/drivers/mfd/twl-core.c
+++ b/drivers/mfd/twl-core.c
@@ -1245,6 +1245,28 @@ free:
         return status;
 }
 
+static int __maybe_unused twl_suspend(struct device *dev)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+
+        if (client->irq)
+                disable_irq(client->irq);
+
+        return 0;
+}
+
+static int __maybe_unused twl_resume(struct device *dev)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+
+        if (client->irq)
+                enable_irq(client->irq);
+
+        return 0;
+}
+
+static SIMPLE_DEV_PM_OPS(twl_dev_pm_ops, twl_suspend, twl_resume);
+
 static const struct i2c_device_id twl_ids[] = {
         { "twl4030", TWL4030_VAUX2 },   /* "Triton 2" */
         { "twl5030", 0 },               /* T2 updated */
@@ -1262,6 +1284,7 @@ static const struct i2c_device_id twl_ids[] = {
 /* One Client Driver , 4 Clients */
 static struct i2c_driver twl_driver = {
         .driver.name    = DRIVER_NAME,
+        .driver.pm      = &twl_dev_pm_ops,
         .id_table       = twl_ids,
         .probe          = twl_probe,
         .remove         = twl_remove,
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 72428b6bfc47..7b7286b4d81e 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -1876,7 +1876,11 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
                         continue;
                 }
 
-                if (time_after(jiffies, timeo) && !chip_ready(map, adr))
+                /*
+                 * We check "time_after" and "!chip_good" before checking "chip_good" to avoid
+                 * the failure due to scheduling.
+                 */
+                if (time_after(jiffies, timeo) && !chip_good(map, adr, datum))
                         break;
 
                 if (chip_good(map, adr, datum)) {
diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c
index 2f120b2ffef0..4985268e2273 100644
--- a/drivers/net/bonding/bond_sysfs_slave.c
+++ b/drivers/net/bonding/bond_sysfs_slave.c
@@ -55,7 +55,9 @@ static SLAVE_ATTR_RO(link_failure_count);
 
 static ssize_t perm_hwaddr_show(struct slave *slave, char *buf)
 {
-        return sprintf(buf, "%pM\n", slave->perm_hwaddr);
+        return sprintf(buf, "%*phC\n",
+                       slave->dev->addr_len,
+                       slave->perm_hwaddr);
 }
 static SLAVE_ATTR_RO(perm_hwaddr);
 
diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c
index dce84a2a65c7..c44b2822e4dd 100644
--- a/drivers/net/dsa/mv88e6xxx/port.c
+++ b/drivers/net/dsa/mv88e6xxx/port.c
@@ -427,18 +427,22 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
                 return 0;
 
         lane = mv88e6390x_serdes_get_lane(chip, port);
-        if (lane < 0)
+        if (lane < 0 && lane != -ENODEV)
                 return lane;
 
-        if (chip->ports[port].serdes_irq) {
-                err = mv88e6390_serdes_irq_disable(chip, port, lane);
+        if (lane >= 0) {
+                if (chip->ports[port].serdes_irq) {
+                        err = mv88e6390_serdes_irq_disable(chip, port, lane);
+                        if (err)
+                                return err;
+                }
+
+                err = mv88e6390x_serdes_power(chip, port, false);
                 if (err)
                         return err;
         }
 
-        err = mv88e6390x_serdes_power(chip, port, false);
-        if (err)
-                return err;
+        chip->ports[port].cmode = 0;
 
         if (cmode) {
                 err = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_STS, &reg);
@@ -452,6 +456,12 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
                 if (err)
                         return err;
 
+                chip->ports[port].cmode = cmode;
+
+                lane = mv88e6390x_serdes_get_lane(chip, port);
+                if (lane < 0)
+                        return lane;
+
                 err = mv88e6390x_serdes_power(chip, port, true);
                 if (err)
                         return err;
@@ -463,8 +473,6 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
                 }
         }
 
-        chip->ports[port].cmode = cmode;
-
         return 0;
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 0bb9d7b3a2b6..4c586ba4364b 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1133,6 +1133,8 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
         tpa_info = &rxr->rx_tpa[agg_id];
 
         if (unlikely(cons != rxr->rx_next_cons)) {
+                netdev_warn(bp->dev, "TPA cons %x != expected cons %x\n",
+                            cons, rxr->rx_next_cons);
                 bnxt_sched_reset(bp, rxr);
                 return;
         }
@@ -1585,15 +1587,17 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
         }
 
         cons = rxcmp->rx_cmp_opaque;
-        rx_buf = &rxr->rx_buf_ring[cons];
-        data = rx_buf->data;
-        data_ptr = rx_buf->data_ptr;
         if (unlikely(cons != rxr->rx_next_cons)) {
                 int rc1 = bnxt_discard_rx(bp, cpr, raw_cons, rxcmp);
 
+                netdev_warn(bp->dev, "RX cons %x != expected cons %x\n",
+                            cons, rxr->rx_next_cons);
                 bnxt_sched_reset(bp, rxr);
                 return rc1;
         }
+        rx_buf = &rxr->rx_buf_ring[cons];
+        data = rx_buf->data;
+        data_ptr = rx_buf->data_ptr;
         prefetch(data_ptr);
 
         misc = le32_to_cpu(rxcmp->rx_cmp_misc_v1);
@@ -1610,11 +1614,17 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
 
         rx_buf->data = NULL;
         if (rxcmp1->rx_cmp_cfa_code_errors_v2 & RX_CMP_L2_ERRORS) {
+                u32 rx_err = le32_to_cpu(rxcmp1->rx_cmp_cfa_code_errors_v2);
+
                 bnxt_reuse_rx_data(rxr, cons, data);
                 if (agg_bufs)
                         bnxt_reuse_rx_agg_bufs(cpr, cp_cons, agg_bufs);
 
                 rc = -EIO;
+                if (rx_err & RX_CMPL_ERRORS_BUFFER_ERROR_MASK) {
+                        netdev_warn(bp->dev, "RX buffer error %x\n", rx_err);
+                        bnxt_sched_reset(bp, rxr);
+                }
                 goto next_rx;
         }
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 328373e0578f..060a6f386104 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -4283,7 +4283,7 @@ static void tg3_power_down(struct tg3 *tp)
         pci_set_power_state(tp->pdev, PCI_D3hot);
 }
 
-static void tg3_aux_stat_to_speed_duplex(struct tg3 *tp, u32 val, u16 *speed, u8 *duplex)
+static void tg3_aux_stat_to_speed_duplex(struct tg3 *tp, u32 val, u32 *speed, u8 *duplex)
 {
         switch (val & MII_TG3_AUX_STAT_SPDMASK) {
         case MII_TG3_AUX_STAT_10HALF:
@@ -4787,7 +4787,7 @@ static int tg3_setup_copper_phy(struct tg3 *tp, bool force_reset)
         bool current_link_up;
         u32 bmsr, val;
         u32 lcl_adv, rmt_adv;
-        u16 current_speed;
+        u32 current_speed;
         u8 current_duplex;
         int i, err;
 
@@ -5719,7 +5719,7 @@ out:
 static int tg3_setup_fiber_phy(struct tg3 *tp, bool force_reset)
 {
         u32 orig_pause_cfg;
-        u16 orig_active_speed;
+        u32 orig_active_speed;
         u8 orig_active_duplex;
         u32 mac_status;
         bool current_link_up;
@@ -5823,7 +5823,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, bool force_reset)
 {
         int err = 0;
         u32 bmsr, bmcr;
-        u16 current_speed = SPEED_UNKNOWN;
+        u32 current_speed = SPEED_UNKNOWN;
         u8 current_duplex = DUPLEX_UNKNOWN;
         bool current_link_up = false;
         u32 local_adv, remote_adv, sgsr;
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index a772a33b685c..6953d0546acb 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -2873,7 +2873,7 @@ struct tg3_tx_ring_info {
 struct tg3_link_config {
         /* Describes what we're trying to get. */
         u32                             advertising;
-        u16                             speed;
+        u32                             speed;
         u8                              duplex;
         u8                              autoneg;
         u8                              flowctrl;
@@ -2882,7 +2882,7 @@ struct tg3_link_config {
         u8                              active_flowctrl;
 
         u8                              active_duplex;
-        u16                             active_speed;
+        u32                             active_speed;
         u32                             rmt_adv;
 };
 
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 1522aee81884..3da2795e2486 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -898,7 +898,9 @@ static void macb_tx_interrupt(struct macb_queue *queue)
 
                         /* First, update TX stats if needed */
                         if (skb) {
-                                if (gem_ptp_do_txstamp(queue, skb, desc) == 0) {
+                                if (unlikely(skb_shinfo(skb)->tx_flags &
+                                             SKBTX_HW_TSTAMP) &&
+                                    gem_ptp_do_txstamp(queue, skb, desc) == 0) {
                                         /* skb now belongs to timestamp buffer
                                          * and will be removed later
                                          */
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index aa2be4807191..28eac9056211 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -1328,10 +1328,11 @@ int nicvf_stop(struct net_device *netdev)
         struct nicvf_cq_poll *cq_poll = NULL;
         union nic_mbx mbx = {};
 
-        cancel_delayed_work_sync(&nic->link_change_work);
-
         /* wait till all queued set_rx_mode tasks completes */
-        drain_workqueue(nic->nicvf_rx_mode_wq);
+        if (nic->nicvf_rx_mode_wq) {
+                cancel_delayed_work_sync(&nic->link_change_work);
+                drain_workqueue(nic->nicvf_rx_mode_wq);
+        }
 
         mbx.msg.msg = NIC_MBOX_MSG_SHUTDOWN;
         nicvf_send_msg_to_pf(nic, &mbx);
@@ -1452,7 +1453,8 @@ int nicvf_open(struct net_device *netdev)
         struct nicvf_cq_poll *cq_poll = NULL;
 
         /* wait till all queued set_rx_mode tasks completes if any */
-        drain_workqueue(nic->nicvf_rx_mode_wq);
+        if (nic->nicvf_rx_mode_wq)
+                drain_workqueue(nic->nicvf_rx_mode_wq);
 
         netif_carrier_off(netdev);
 
@@ -1550,10 +1552,12 @@ int nicvf_open(struct net_device *netdev)
         /* Send VF config done msg to PF */
         nicvf_send_cfg_done(nic);
 
-        INIT_DELAYED_WORK(&nic->link_change_work,
-                          nicvf_link_status_check_task);
-        queue_delayed_work(nic->nicvf_rx_mode_wq,
-                           &nic->link_change_work, 0);
+        if (nic->nicvf_rx_mode_wq) {
+                INIT_DELAYED_WORK(&nic->link_change_work,
+                                  nicvf_link_status_check_task);
+                queue_delayed_work(nic->nicvf_rx_mode_wq,
+                                   &nic->link_change_work, 0);
+        }
 
         return 0;
 cleanup:
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 5b4d3badcb73..e246f9733bb8 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -105,20 +105,19 @@ static inline struct pgcache *nicvf_alloc_page(struct nicvf *nic,
         /* Check if page can be recycled */
         if (page) {
                 ref_count = page_ref_count(page);
-                /* Check if this page has been used once i.e 'put_page'
-                 * called after packet transmission i.e internal ref_count
-                 * and page's ref_count are equal i.e page can be recycled.
+                /* This page can be recycled if internal ref_count and page's
+                 * ref_count are equal, indicating that the page has been used
+                 * once for packet transmission. For non-XDP mode, internal
+                 * ref_count is always '1'.
                  */
-                if (rbdr->is_xdp && (ref_count == pgcache->ref_count))
-                        pgcache->ref_count--;
-                else
-                        page = NULL;
-
-                /* In non-XDP mode, page's ref_count needs to be '1' for it
-                 * to be recycled.
-                 */
-                if (!rbdr->is_xdp && (ref_count != 1))
+                if (rbdr->is_xdp) {
+                        if (ref_count == pgcache->ref_count)
+                                pgcache->ref_count--;
+                        else
+                                page = NULL;
+                } else if (ref_count != 1) {
                         page = NULL;
+                }
         }
 
         if (!page) {
@@ -365,11 +364,10 @@ static void nicvf_free_rbdr(struct nicvf *nic, struct rbdr *rbdr)
         while (head < rbdr->pgcnt) {
                 pgcache = &rbdr->pgcache[head];
                 if (pgcache->page && page_ref_count(pgcache->page) != 0) {
-                        if (!rbdr->is_xdp) {
-                                put_page(pgcache->page);
-                                continue;
+                        if (rbdr->is_xdp) {
+                                page_ref_sub(pgcache->page,
+                                             pgcache->ref_count - 1);
                         }
-                        page_ref_sub(pgcache->page, pgcache->ref_count - 1);
                         put_page(pgcache->page);
                 }
                 head++;
diff --git a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c
index 74849be5f004..e2919005ead3 100644
--- a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c
+++ b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c
@@ -354,7 +354,10 @@ static struct cxgbi_ppm_pool *ppm_alloc_cpu_pool(unsigned int *total,
                 ppmax = max;
 
         /* pool size must be multiple of unsigned long */
-        bmap = BITS_TO_LONGS(ppmax);
+        bmap = ppmax / BITS_PER_TYPE(unsigned long);
+        if (!bmap)
+                return NULL;
+
         ppmax = (bmap * sizeof(unsigned long)) << 3;
 
         alloc_sz = sizeof(*pools) + sizeof(unsigned long) * bmap;
@@ -402,6 +405,10 @@ int cxgbi_ppm_init(void **ppm_pp, struct net_device *ndev,
         if (reserve_factor) {
                 ppmax_pool = ppmax / reserve_factor;
                 pool = ppm_alloc_cpu_pool(&ppmax_pool, &pool_index_max);
+                if (!pool) {
+                        ppmax_pool = 0;
+                        reserve_factor = 0;
+                }
 
                 pr_debug("%s: ppmax %u, cpu total %u, per cpu %u.\n",
                          ndev->name, ppmax, ppmax_pool, pool_index_max);
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c
index 79d03f8ee7b1..c7fa97a7e1f4 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.c
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.c
@@ -150,7 +150,6 @@ out_buffer_fail:
 /* free desc along with its attached buffer */
 static void hnae_free_desc(struct hnae_ring *ring)
 {
-        hnae_free_buffers(ring);
         dma_unmap_single(ring_to_dev(ring), ring->desc_dma_addr,
                          ring->desc_num * sizeof(ring->desc[0]),
                          ring_to_dma_dir(ring));
@@ -183,6 +182,9 @@ static int hnae_alloc_desc(struct hnae_ring *ring)
 /* fini ring, also free the buffer for the ring */
 static void hnae_fini_ring(struct hnae_ring *ring)
 {
+        if (is_rx_ring(ring))
+                hnae_free_buffers(ring);
+
         hnae_free_desc(ring);
         kfree(ring->desc_cb);
         ring->desc_cb = NULL;
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h
index 08a750fb60c4..d6fb83437230 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.h
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.h
@@ -357,7 +357,7 @@ struct hnae_buf_ops {
 };
 
 struct hnae_queue {
-        void __iomem *io_base;
+        u8 __iomem *io_base;
         phys_addr_t phy_base;
         struct hnae_ae_dev *dev;        /* the device who use this queue */
         struct hnae_ring rx_ring ____cacheline_internodealigned_in_smp;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
index a97228c93831..6c0507921623 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
@@ -370,7 +370,7 @@ int hns_mac_clr_multicast(struct hns_mac_cb *mac_cb, int vfn)
 static void hns_mac_param_get(struct mac_params *param,
                               struct hns_mac_cb *mac_cb)
 {
-        param->vaddr = (void *)mac_cb->vaddr;
+        param->vaddr = mac_cb->vaddr;
         param->mac_mode = hns_get_enet_interface(mac_cb);
         ether_addr_copy(param->addr, mac_cb->addr_entry_idx[0].addr);
         param->mac_id = mac_cb->mac_id;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
index fbc75341bef7..22589799f1a5 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
@@ -187,7 +187,7 @@ struct mac_statistics {
 /*mac para struct ,mac get param from nic or dsaf when initialize*/
 struct mac_params {
         char addr[ETH_ALEN];
-        void *vaddr; /*virtual address*/
+        u8 __iomem *vaddr; /*virtual address*/
         struct device *dev;
         u8 mac_id;
         /**< Ethernet operation mode (MAC-PHY interface and speed) */
@@ -402,7 +402,7 @@ struct mac_driver {
         enum mac_mode mac_mode;
         u8 mac_id;
         struct hns_mac_cb *mac_cb;
-        void __iomem *io_base;
+        u8 __iomem *io_base;
         unsigned int mac_en_flg;/*you'd better don't enable mac twice*/
         unsigned int virt_dev_num;
         struct device *dev;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index ac55db065f16..61eea6ac846f 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -1602,8 +1602,6 @@ static void hns_dsaf_set_mac_key(
                        DSAF_TBL_TCAM_KEY_VLAN_S, vlan_id);
         dsaf_set_field(mac_key->low.bits.port_vlan, DSAF_TBL_TCAM_KEY_PORT_M,
                        DSAF_TBL_TCAM_KEY_PORT_S, port);
-
-        mac_key->low.bits.port_vlan = le16_to_cpu(mac_key->low.bits.port_vlan);
 }
 
 /**
@@ -1663,8 +1661,8 @@ int hns_dsaf_set_mac_uc_entry(
         /* default config dvc to 0 */
         mac_data.tbl_ucast_dvc = 0;
         mac_data.tbl_ucast_out_port = mac_entry->port_num;
-        tcam_data.tbl_tcam_data_high = cpu_to_le32(mac_key.high.val);
-        tcam_data.tbl_tcam_data_low = cpu_to_le32(mac_key.low.val);
+        tcam_data.tbl_tcam_data_high = mac_key.high.val;
+        tcam_data.tbl_tcam_data_low = mac_key.low.val;
 
         hns_dsaf_tcam_uc_cfg(dsaf_dev, entry_index, &tcam_data, &mac_data);
 
@@ -1786,9 +1784,6 @@ int hns_dsaf_add_mac_mc_port(struct dsaf_device *dsaf_dev,
                                      0xff,
                                      mc_mask);
 
-                mask_key.high.val = le32_to_cpu(mask_key.high.val);
-                mask_key.low.val = le32_to_cpu(mask_key.low.val);
-
                 pmask_key = (struct dsaf_tbl_tcam_data *)(&mask_key);
         }
 
@@ -1840,8 +1835,8 @@ int hns_dsaf_add_mac_mc_port(struct dsaf_device *dsaf_dev,
                 dsaf_dev->ae_dev.name, mac_key.high.val,
                 mac_key.low.val, entry_index);
 
-        tcam_data.tbl_tcam_data_high = cpu_to_le32(mac_key.high.val);
-        tcam_data.tbl_tcam_data_low = cpu_to_le32(mac_key.low.val);
+        tcam_data.tbl_tcam_data_high = mac_key.high.val;
+        tcam_data.tbl_tcam_data_low = mac_key.low.val;
 
         /* config mc entry with mask */
         hns_dsaf_tcam_mc_cfg(dsaf_dev, entry_index, &tcam_data,
@@ -1956,9 +1951,6 @@ int hns_dsaf_del_mac_mc_port(struct dsaf_device *dsaf_dev,
                 /* config key mask */
                 hns_dsaf_set_mac_key(dsaf_dev, &mask_key, 0x00, 0xff, mc_mask);
 
-                mask_key.high.val = le32_to_cpu(mask_key.high.val);
-                mask_key.low.val = le32_to_cpu(mask_key.low.val);
-
                 pmask_key = (struct dsaf_tbl_tcam_data *)(&mask_key);
         }
 
@@ -2012,8 +2004,8 @@ int hns_dsaf_del_mac_mc_port(struct dsaf_device *dsaf_dev,
                 soft_mac_entry += entry_index;
                 soft_mac_entry->index = DSAF_INVALID_ENTRY_IDX;
         } else { /* not zero, just del port, update */
-                tcam_data.tbl_tcam_data_high = cpu_to_le32(mac_key.high.val);
-                tcam_data.tbl_tcam_data_low = cpu_to_le32(mac_key.low.val);
+                tcam_data.tbl_tcam_data_high = mac_key.high.val;
+                tcam_data.tbl_tcam_data_low = mac_key.low.val;
 
                 hns_dsaf_tcam_mc_cfg(dsaf_dev, entry_index,
                                      &tcam_data,
@@ -2750,6 +2742,17 @@ int hns_dsaf_get_regs_count(void)
         return DSAF_DUMP_REGS_NUM;
 }
 
+static int hns_dsaf_get_port_id(u8 port)
+{
+        if (port < DSAF_SERVICE_NW_NUM)
+                return port;
+
+        if (port >= DSAF_BASE_INNER_PORT_NUM)
+                return port - DSAF_BASE_INNER_PORT_NUM + DSAF_SERVICE_NW_NUM;
+
+        return -EINVAL;
+}
+
 static void set_promisc_tcam_enable(struct dsaf_device *dsaf_dev, u32 port)
 {
         struct dsaf_tbl_tcam_ucast_cfg tbl_tcam_ucast = {0, 1, 0, 0, 0x80};
@@ -2815,23 +2818,33 @@ static void set_promisc_tcam_enable(struct dsaf_device *dsaf_dev, u32 port)
         memset(&temp_key, 0x0, sizeof(temp_key));
         mask_entry.addr[0] = 0x01;
         hns_dsaf_set_mac_key(dsaf_dev, &mask_key, mask_entry.in_vlan_id,
-                             port, mask_entry.addr);
+                             0xf, mask_entry.addr);
         tbl_tcam_mcast.tbl_mcast_item_vld = 1;
         tbl_tcam_mcast.tbl_mcast_old_en = 0;
 
-        if (port < DSAF_SERVICE_NW_NUM) {
-                mskid = port;
-        } else if (port >= DSAF_BASE_INNER_PORT_NUM) {
-                mskid = port - DSAF_BASE_INNER_PORT_NUM + DSAF_SERVICE_NW_NUM;
-        } else {
+        /* set MAC port to handle multicast */
+        mskid = hns_dsaf_get_port_id(port);
+        if (mskid == -EINVAL) {
                 dev_err(dsaf_dev->dev, "%s,pnum(%d)error,key(%#x:%#x)\n",
                         dsaf_dev->ae_dev.name, port,
                         mask_key.high.val, mask_key.low.val);
                 return;
         }
+        dsaf_set_bit(tbl_tcam_mcast.tbl_mcast_port_msk[mskid / 32],
+                     mskid % 32, 1);
 
+        /* set pool bit map to handle multicast */
+        mskid = hns_dsaf_get_port_id(port_num);
+        if (mskid == -EINVAL) {
+                dev_err(dsaf_dev->dev,
+                        "%s, pool bit map pnum(%d)error,key(%#x:%#x)\n",
+                        dsaf_dev->ae_dev.name, port_num,
+                        mask_key.high.val, mask_key.low.val);
+                return;
+        }
         dsaf_set_bit(tbl_tcam_mcast.tbl_mcast_port_msk[mskid / 32],
                      mskid % 32, 1);
+
         memcpy(&temp_key, &mask_key, sizeof(mask_key));
         hns_dsaf_tcam_mc_cfg_vague(dsaf_dev, entry_index, &tbl_tcam_data_mc,
                                    (struct dsaf_tbl_tcam_data *)(&mask_key),
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
index 0e1cd99831a6..76cc8887e1a8 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
@@ -467,4 +467,6 @@ int hns_dsaf_clr_mac_mc_port(struct dsaf_device *dsaf_dev,
                              u8 mac_id, u8 port_num);
 int hns_dsaf_wait_pkt_clean(struct dsaf_device *dsaf_dev, int port);
 
+int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset);
+
 #endif /* __HNS_DSAF_MAIN_H__ */
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
index 16294cd3c954..19b94879691f 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
@@ -670,7 +670,7 @@ static int hns_mac_config_sds_loopback(struct hns_mac_cb *mac_cb, bool en)
                 dsaf_set_field(origin, 1ull << 10, 10, en);
                 dsaf_write_syscon(mac_cb->serdes_ctrl, reg_offset, origin);
         } else {
-                u8 *base_addr = (u8 *)mac_cb->serdes_vaddr +
+                u8 __iomem *base_addr = mac_cb->serdes_vaddr +
                                 (mac_cb->mac_id <= 3 ? 0x00280000 : 0x00200000);
                 dsaf_set_reg_field(base_addr, reg_offset, 1ull << 10, 10, en);
         }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
index 3d07c8a7639d..17c019106e6e 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
@@ -61,7 +61,7 @@ void hns_ppe_set_indir_table(struct hns_ppe_cb *ppe_cb,
         }
 }
 
-static void __iomem *
+static u8 __iomem *
 hns_ppe_common_get_ioaddr(struct ppe_common_cb *ppe_common)
 {
         return ppe_common->dsaf_dev->ppe_base + PPE_COMMON_REG_OFFSET;
@@ -111,8 +111,8 @@ hns_ppe_common_free_cfg(struct dsaf_device *dsaf_dev, u32 comm_index)
         dsaf_dev->ppe_common[comm_index] = NULL;
 }
 
-static void __iomem *hns_ppe_get_iobase(struct ppe_common_cb *ppe_common,
-                                        int ppe_idx)
+static u8 __iomem *hns_ppe_get_iobase(struct ppe_common_cb *ppe_common,
+                                      int ppe_idx)
 {
         return ppe_common->dsaf_dev->ppe_base + ppe_idx * PPE_REG_OFFSET;
 }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
index f670e63a5a01..110c6e8222c7 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
@@ -80,7 +80,7 @@ struct hns_ppe_cb {
         struct hns_ppe_hw_stats hw_stats;
 
         u8 index;       /* index in a ppe common device */
-        void __iomem *io_base;
+        u8 __iomem *io_base;
         int virq;
         u32 rss_indir_table[HNS_PPEV2_RSS_IND_TBL_SIZE]; /*shadow indir tab */
         u32 rss_key[HNS_PPEV2_RSS_KEY_NUM]; /* rss hash key */
@@ -89,7 +89,7 @@ struct hns_ppe_cb {
 struct ppe_common_cb {
         struct device *dev;
         struct dsaf_device *dsaf_dev;
-        void __iomem *io_base;
+        u8 __iomem *io_base;
 
         enum ppe_common_mode ppe_mode;
 
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
index 6bf346c11b25..ac3518ca4d7b 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
@@ -458,7 +458,7 @@ static void hns_rcb_ring_get_cfg(struct hnae_queue *q, int ring_type)
                 mdnum_ppkt = HNS_RCB_RING_MAX_BD_PER_PKT;
         } else {
                 ring = &q->tx_ring;
-                ring->io_base = (u8 __iomem *)ring_pair_cb->q.io_base +
+                ring->io_base = ring_pair_cb->q.io_base +
                         HNS_RCB_TX_REG_OFFSET;
                 irq_idx = HNS_RCB_IRQ_IDX_TX;
                 mdnum_ppkt = is_ver1 ? HNS_RCB_RING_MAX_TXBD_PER_PKT :
@@ -764,7 +764,7 @@ static int hns_rcb_get_ring_num(struct dsaf_device *dsaf_dev)
         }
 }
 
-static void __iomem *hns_rcb_common_get_vaddr(struct rcb_common_cb *rcb_common)
+static u8 __iomem *hns_rcb_common_get_vaddr(struct rcb_common_cb *rcb_common)
 {
         struct dsaf_device *dsaf_dev = rcb_common->dsaf_dev;
 
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
index b9733b0b8482..b9e7f11f0896 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
@@ -1018,7 +1018,7 @@
 #define XGMAC_PAUSE_CTL_RSP_MODE_B      2
 #define XGMAC_PAUSE_CTL_TX_XOFF_B       3
 
-static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
+static inline void dsaf_write_reg(u8 __iomem *base, u32 reg, u32 value)
 {
         writel(value, base + reg);
 }
@@ -1053,7 +1053,7 @@ static inline int dsaf_read_syscon(struct regmap *base, u32 reg, u32 *val)
 #define dsaf_set_bit(origin, shift, val) \
         dsaf_set_field((origin), (1ull << (shift)), (shift), (val))
 
-static inline void dsaf_set_reg_field(void __iomem *base, u32 reg, u32 mask,
+static inline void dsaf_set_reg_field(u8 __iomem *base, u32 reg, u32 mask,
                                       u32 shift, u32 val)
 {
         u32 origin = dsaf_read_reg(base, reg);
@@ -1073,7 +1073,7 @@ static inline void dsaf_set_reg_field(void __iomem *base, u32 reg, u32 mask,
 #define dsaf_get_bit(origin, shift) \
         dsaf_get_field((origin), (1ull << (shift)), (shift))
 
-static inline u32 dsaf_get_reg_field(void __iomem *base, u32 reg, u32 mask,
+static inline u32 dsaf_get_reg_field(u8 __iomem *base, u32 reg, u32 mask,
                                      u32 shift)
 {
         u32 origin;
@@ -1089,11 +1089,11 @@ static inline u32 dsaf_get_reg_field(void __iomem *base, u32 reg, u32 mask,
         dsaf_get_reg_field((dev)->io_base, (reg), (1ull << (bit)), (bit))
 
 #define dsaf_write_b(addr, data)\
-        writeb((data), (__iomem unsigned char *)(addr))
+        writeb((data), (__iomem u8 *)(addr))
 #define dsaf_read_b(addr)\
-        readb((__iomem unsigned char *)(addr))
+        readb((__iomem u8 *)(addr))
 
 #define hns_mac_reg_read64(drv, offset) \
-        readq((__iomem void *)(((u8 *)(drv)->io_base + 0xc00 + (offset))))
+        readq((__iomem void *)(((drv)->io_base + 0xc00 + (offset))))
 
 #endif  /* _DSAF_REG_H */
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c
index ba4316910dea..a60f207768fc 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c
@@ -129,7 +129,7 @@ static void hns_xgmac_lf_rf_control_init(struct mac_driver *mac_drv)
         dsaf_set_bit(val, XGMAC_UNIDIR_EN_B, 0);
         dsaf_set_bit(val, XGMAC_RF_TX_EN_B, 1);
         dsaf_set_field(val, XGMAC_LF_RF_INSERT_M, XGMAC_LF_RF_INSERT_S, 0);
-        dsaf_write_reg(mac_drv, XGMAC_MAC_TX_LF_RF_CONTROL_REG, val);
+        dsaf_write_dev(mac_drv, XGMAC_MAC_TX_LF_RF_CONTROL_REG, val);
 }
 
 /**
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 60e7d7ae3787..4cd86ba1f050 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -29,9 +29,6 @@
 
 #define SERVICE_TIMER_HZ (1 * HZ)
 
-#define NIC_TX_CLEAN_MAX_NUM 256
-#define NIC_RX_CLEAN_MAX_NUM 64
-
 #define RCB_IRQ_NOT_INITED 0
 #define RCB_IRQ_INITED 1
 #define HNS_BUFFER_SIZE_2048 2048
@@ -376,8 +373,6 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev,
         wmb(); /* commit all data before submit */
         assert(skb->queue_mapping < priv->ae_handle->q_num);
         hnae_queue_xmit(priv->ae_handle->qs[skb->queue_mapping], buf_num);
-        ring->stats.tx_pkts++;
-        ring->stats.tx_bytes += skb->len;
 
         return NETDEV_TX_OK;
 
@@ -999,6 +994,9 @@ static int hns_nic_tx_poll_one(struct hns_nic_ring_data *ring_data,
                 /* issue prefetch for next Tx descriptor */
                 prefetch(&ring->desc_cb[ring->next_to_clean]);
         }
+        /* update tx ring statistics. */
+        ring->stats.tx_pkts += pkts;
+        ring->stats.tx_bytes += bytes;
 
         NETIF_TX_UNLOCK(ring);
 
@@ -2152,7 +2150,7 @@ static int hns_nic_init_ring_data(struct hns_nic_priv *priv)
                         hns_nic_tx_fini_pro_v2;
 
                 netif_napi_add(priv->netdev, &rd->napi,
-                               hns_nic_common_poll, NIC_TX_CLEAN_MAX_NUM);
+                               hns_nic_common_poll, NAPI_POLL_WEIGHT);
                 rd->ring->irq_init_flag = RCB_IRQ_NOT_INITED;
         }
         for (i = h->q_num; i < h->q_num * 2; i++) {
@@ -2165,7 +2163,7 @@ static int hns_nic_init_ring_data(struct hns_nic_priv *priv)
                         hns_nic_rx_fini_pro_v2;
 
                 netif_napi_add(priv->netdev, &rd->napi,
-                               hns_nic_common_poll, NIC_RX_CLEAN_MAX_NUM);
+                               hns_nic_common_poll, NAPI_POLL_WEIGHT);
                 rd->ring->irq_init_flag = RCB_IRQ_NOT_INITED;
         }
 
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile b/drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile
index fffe8c1c45d3..0fb61d440d3b 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile
@@ -3,7 +3,7 @@
 # Makefile for the HISILICON network device drivers.
 #
 
-ccflags-y := -Idrivers/net/ethernet/hisilicon/hns3
+ccflags-y := -I $(srctree)/drivers/net/ethernet/hisilicon/hns3
 
 obj-$(CONFIG_HNS3_HCLGE) += hclge.o
 hclge-objs = hclge_main.o hclge_cmd.o hclge_mdio.o hclge_tm.o hclge_mbx.o hclge_err.o  hclge_debugfs.o
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile b/drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile
index fb93bbd35845..6193f8fa7cf3 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile
@@ -3,7 +3,7 @@
 # Makefile for the HISILICON network device drivers.
 #
 
-ccflags-y := -Idrivers/net/ethernet/hisilicon/hns3
+ccflags-y := -I $(srctree)/drivers/net/ethernet/hisilicon/hns3
 
 obj-$(CONFIG_HNS3_HCLGEVF) += hclgevf.o
 hclgevf-objs = hclgevf_main.o hclgevf_cmd.o hclgevf_mbx.o
\ No newline at end of file
diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c
index baf5cc251f32..8b8a7d00e8e0 100644
--- a/drivers/net/ethernet/hisilicon/hns_mdio.c
+++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
@@ -39,7 +39,7 @@ struct hns_mdio_sc_reg {
 };
 
 struct hns_mdio_device {
-        void *vbase;            /* mdio reg base address */
+        u8 __iomem *vbase;              /* mdio reg base address */
         struct regmap *subctrl_vbase;
         struct hns_mdio_sc_reg sc_reg;
 };
@@ -96,21 +96,17 @@ enum mdio_c45_op_seq {
 #define MDIO_SC_CLK_ST          0x531C
 #define MDIO_SC_RESET_ST        0x5A1C
 
-static void mdio_write_reg(void *base, u32 reg, u32 value)
+static void mdio_write_reg(u8 __iomem *base, u32 reg, u32 value)
 {
-        u8 __iomem *reg_addr = (u8 __iomem *)base;
-
-        writel_relaxed(value, reg_addr + reg);
+        writel_relaxed(value, base + reg);
 }
 
 #define MDIO_WRITE_REG(a, reg, value) \
         mdio_write_reg((a)->vbase, (reg), (value))
 
-static u32 mdio_read_reg(void *base, u32 reg)
+static u32 mdio_read_reg(u8 __iomem *base, u32 reg)
 {
-        u8 __iomem *reg_addr = (u8 __iomem *)base;
-
-        return readl_relaxed(reg_addr + reg);
+        return readl_relaxed(base + reg);
 }
 
 #define mdio_set_field(origin, mask, shift, val) \
@@ -121,7 +117,7 @@ static u32 mdio_read_reg(void *base, u32 reg)
 
 #define mdio_get_field(origin, mask, shift) (((origin) >> (shift)) & (mask))
 
-static void mdio_set_reg_field(void *base, u32 reg, u32 mask, u32 shift,
+static void mdio_set_reg_field(u8 __iomem *base, u32 reg, u32 mask, u32 shift,
                                u32 val)
 {
         u32 origin = mdio_read_reg(base, reg);
@@ -133,7 +129,7 @@ static void mdio_set_reg_field(void *base, u32 reg, u32 mask, u32 shift,
 #define MDIO_SET_REG_FIELD(dev, reg, mask, shift, val) \
         mdio_set_reg_field((dev)->vbase, (reg), (mask), (shift), (val))
 
-static u32 mdio_get_reg_field(void *base, u32 reg, u32 mask, u32 shift)
+static u32 mdio_get_reg_field(u8 __iomem *base, u32 reg, u32 mask, u32 shift)
 {
         u32 origin;
 
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 5ecbb1adcf3b..51cfe95f3e24 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1885,6 +1885,7 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter,
          */
         adapter->state = VNIC_PROBED;
 
+        reinit_completion(&adapter->init_done);
         rc = init_crq_queue(adapter);
         if (rc) {
                 netdev_err(adapter->netdev,
@@ -4625,7 +4626,7 @@ static int ibmvnic_reset_init(struct ibmvnic_adapter *adapter)
         old_num_rx_queues = adapter->req_rx_queues;
         old_num_tx_queues = adapter->req_tx_queues;
 
-        init_completion(&adapter->init_done);
+        reinit_completion(&adapter->init_done);
         adapter->init_done_rc = 0;
         ibmvnic_send_crq_init(adapter);
         if (!wait_for_completion_timeout(&adapter->init_done, timeout)) {
@@ -4680,7 +4681,6 @@ static int ibmvnic_init(struct ibmvnic_adapter *adapter)
 
         adapter->from_passive_init = false;
 
-        init_completion(&adapter->init_done);
         adapter->init_done_rc = 0;
         ibmvnic_send_crq_init(adapter);
         if (!wait_for_completion_timeout(&adapter->init_done, timeout)) {
@@ -4759,6 +4759,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
         INIT_WORK(&adapter->ibmvnic_reset, __ibmvnic_reset);
         INIT_LIST_HEAD(&adapter->rwi_list);
         spin_lock_init(&adapter->rwi_lock);
+        init_completion(&adapter->init_done);
         adapter->resetting = false;
 
         adapter->mac_change_pending = false;
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_main.c b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
index 5a0419421511..ecef949f3baa 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_main.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
@@ -41,6 +41,8 @@ static int __init fm10k_init_module(void)
         /* create driver workqueue */
         fm10k_workqueue = alloc_workqueue("%s", WQ_MEM_RECLAIM, 0,
                                           fm10k_driver_name);
+        if (!fm10k_workqueue)
+                return -ENOMEM;
 
         fm10k_dbg_init();
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
index d684998ba2b0..d3cc3427caad 100644
--- a/drivers/net/ethernet/intel/i40e/i40e.h
+++ b/drivers/net/ethernet/intel/i40e/i40e.h
@@ -790,6 +790,8 @@ struct i40e_vsi {
 
         /* VSI specific handlers */
         irqreturn_t (*irq_handler)(int irq, void *data);
+
+        unsigned long *af_xdp_zc_qps; /* tracks AF_XDP ZC enabled qps */
 } ____cacheline_internodealigned_in_smp;
 
 struct i40e_netdev_priv {
@@ -1096,20 +1098,6 @@ static inline bool i40e_enabled_xdp_vsi(struct i40e_vsi *vsi)
         return !!vsi->xdp_prog;
 }
 
-static inline struct xdp_umem *i40e_xsk_umem(struct i40e_ring *ring)
-{
-        bool xdp_on = i40e_enabled_xdp_vsi(ring->vsi);
-        int qid = ring->queue_index;
-
-        if (ring_is_xdp(ring))
-                qid -= ring->vsi->alloc_queue_pairs;
-
-        if (!xdp_on)
-                return NULL;
-
-        return xdp_get_umem_from_qid(ring->vsi->netdev, qid);
-}
-
 int i40e_create_queue_channel(struct i40e_vsi *vsi, struct i40e_channel *ch);
 int i40e_set_bw_limit(struct i40e_vsi *vsi, u16 seid, u64 max_tx_rate);
 int i40e_add_del_cloud_filter(struct i40e_vsi *vsi,
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
index 4c885801fa26..7874d0ec7fb0 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -2573,8 +2573,7 @@ static int i40e_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
                 return -EOPNOTSUPP;
 
         /* only magic packet is supported */
-        if (wol->wolopts && (wol->wolopts != WAKE_MAGIC)
-                          | (wol->wolopts != WAKE_FILTER))
+        if (wol->wolopts & ~WAKE_MAGIC)
                 return -EOPNOTSUPP;
 
         /* is this a new value? */
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index da62218eb70a..b1c265012c8a 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -3064,6 +3064,26 @@ static void i40e_config_xps_tx_ring(struct i40e_ring *ring)
 }
 
 /**
+ * i40e_xsk_umem - Retrieve the AF_XDP ZC if XDP and ZC is enabled
+ * @ring: The Tx or Rx ring
+ *
+ * Returns the UMEM or NULL.
+ **/
+static struct xdp_umem *i40e_xsk_umem(struct i40e_ring *ring)
+{
+        bool xdp_on = i40e_enabled_xdp_vsi(ring->vsi);
+        int qid = ring->queue_index;
+
+        if (ring_is_xdp(ring))
+                qid -= ring->vsi->alloc_queue_pairs;
+
+        if (!xdp_on || !test_bit(qid, ring->vsi->af_xdp_zc_qps))
+                return NULL;
+
+        return xdp_get_umem_from_qid(ring->vsi->netdev, qid);
+}
+
+/**
  * i40e_configure_tx_ring - Configure a transmit ring context and rest
  * @ring: The Tx ring to configure
  *
@@ -10064,6 +10084,12 @@ static int i40e_vsi_mem_alloc(struct i40e_pf *pf, enum i40e_vsi_type type)
         hash_init(vsi->mac_filter_hash);
         vsi->irqs_ready = false;
 
+        if (type == I40E_VSI_MAIN) {
+                vsi->af_xdp_zc_qps = bitmap_zalloc(pf->num_lan_qps, GFP_KERNEL);
+                if (!vsi->af_xdp_zc_qps)
+                        goto err_rings;
+        }
+
         ret = i40e_set_num_rings_in_vsi(vsi);
         if (ret)
                 goto err_rings;
@@ -10082,6 +10108,7 @@ static int i40e_vsi_mem_alloc(struct i40e_pf *pf, enum i40e_vsi_type type)
         goto unlock_pf;
 
 err_rings:
+        bitmap_free(vsi->af_xdp_zc_qps);
         pf->next_vsi = i - 1;
         kfree(vsi);
 unlock_pf:
@@ -10162,6 +10189,7 @@ static int i40e_vsi_clear(struct i40e_vsi *vsi)
         i40e_put_lump(pf->qp_pile, vsi->base_queue, vsi->idx);
         i40e_put_lump(pf->irq_pile, vsi->base_vector, vsi->idx);
 
+        bitmap_free(vsi->af_xdp_zc_qps);
         i40e_vsi_free_arrays(vsi, true);
         i40e_clear_rss_config_user(vsi);
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
index 5fb4353c742b..31575c0bb884 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
@@ -146,12 +146,13 @@ static int i40e_ptp_adjfreq(struct ptp_clock_info *ptp, s32 ppb)
 static int i40e_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta)
 {
         struct i40e_pf *pf = container_of(ptp, struct i40e_pf, ptp_caps);
-        struct timespec64 now;
+        struct timespec64 now, then;
 
+        then = ns_to_timespec64(delta);
         mutex_lock(&pf->tmreg_lock);
 
         i40e_ptp_read(pf, &now, NULL);
-        timespec64_add_ns(&now, delta);
+        now = timespec64_add(now, then);
         i40e_ptp_write(pf, (const struct timespec64 *)&now);
 
         mutex_unlock(&pf->tmreg_lock);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
index b5c182e688e3..1b17486543ac 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
@@ -102,6 +102,8 @@ static int i40e_xsk_umem_enable(struct i40e_vsi *vsi, struct xdp_umem *umem,
         if (err)
                 return err;
 
+        set_bit(qid, vsi->af_xdp_zc_qps);
+
         if_running = netif_running(vsi->netdev) && i40e_enabled_xdp_vsi(vsi);
 
         if (if_running) {
@@ -148,6 +150,7 @@ static int i40e_xsk_umem_disable(struct i40e_vsi *vsi, u16 qid)
                         return err;
         }
 
+        clear_bit(qid, vsi->af_xdp_zc_qps);
         i40e_xsk_umem_dma_unmap(vsi, umem);
 
         if (if_running) {
diff --git a/drivers/net/ethernet/intel/igb/e1000_defines.h b/drivers/net/ethernet/intel/igb/e1000_defines.h
index 01fcfc6f3415..d2e2c50ce257 100644
--- a/drivers/net/ethernet/intel/igb/e1000_defines.h
+++ b/drivers/net/ethernet/intel/igb/e1000_defines.h
@@ -194,6 +194,8 @@
 /* enable link status from external LINK_0 and LINK_1 pins */
 #define E1000_CTRL_SWDPIN0  0x00040000  /* SWDPIN 0 value */
 #define E1000_CTRL_SWDPIN1  0x00080000  /* SWDPIN 1 value */
+#define E1000_CTRL_ADVD3WUC 0x00100000  /* D3 WUC */
+#define E1000_CTRL_EN_PHY_PWR_MGMT 0x00200000 /* PHY PM enable */
 #define E1000_CTRL_SDP0_DIR 0x00400000  /* SDP0 Data direction */
 #define E1000_CTRL_SDP1_DIR 0x00800000  /* SDP1 Data direction */
 #define E1000_CTRL_RST      0x04000000  /* Global reset */
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 69b230c53fed..3269d8e94744 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -8740,9 +8740,7 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
         struct e1000_hw *hw = &adapter->hw;
         u32 ctrl, rctl, status;
         u32 wufc = runtime ? E1000_WUFC_LNKC : adapter->wol;
-#ifdef CONFIG_PM
-        int retval = 0;
-#endif
+        bool wake;
 
         rtnl_lock();
         netif_device_detach(netdev);
@@ -8755,14 +8753,6 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
         igb_clear_interrupt_scheme(adapter);
         rtnl_unlock();
 
-#ifdef CONFIG_PM
-        if (!runtime) {
-                retval = pci_save_state(pdev);
-                if (retval)
-                        return retval;
-        }
-#endif
-
         status = rd32(E1000_STATUS);
         if (status & E1000_STATUS_LU)
                 wufc &= ~E1000_WUFC_LNKC;
@@ -8779,10 +8769,6 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
                 }
 
                 ctrl = rd32(E1000_CTRL);
-                /* advertise wake from D3Cold */
-                #define E1000_CTRL_ADVD3WUC 0x00100000
-                /* phy power management enable */
-                #define E1000_CTRL_EN_PHY_PWR_MGMT 0x00200000
                 ctrl |= E1000_CTRL_ADVD3WUC;
                 wr32(E1000_CTRL, ctrl);
 
@@ -8796,12 +8782,15 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
                 wr32(E1000_WUFC, 0);
         }
 
-        *enable_wake = wufc || adapter->en_mng_pt;
-        if (!*enable_wake)
+        wake = wufc || adapter->en_mng_pt;
+        if (!wake)
                 igb_power_down_link(adapter);
         else
                 igb_power_up_link(adapter);
 
+        if (enable_wake)
+                *enable_wake = wake;
+
         /* Release control of h/w to f/w.  If f/w is AMT enabled, this
          * would have already happened in close and is redundant.
          */
@@ -8844,22 +8833,7 @@ static void igb_deliver_wake_packet(struct net_device *netdev)
 
 static int __maybe_unused igb_suspend(struct device *dev)
 {
-        int retval;
-        bool wake;
-        struct pci_dev *pdev = to_pci_dev(dev);
-
-        retval = __igb_shutdown(pdev, &wake, 0);
-        if (retval)
-                return retval;
-
-        if (wake) {
-                pci_prepare_to_sleep(pdev);
-        } else {
-                pci_wake_from_d3(pdev, false);
-                pci_set_power_state(pdev, PCI_D3hot);
-        }
-
-        return 0;
+        return __igb_shutdown(to_pci_dev(dev), NULL, 0);
 }
 
 static int __maybe_unused igb_resume(struct device *dev)
@@ -8930,22 +8904,7 @@ static int __maybe_unused igb_runtime_idle(struct device *dev)
 
 static int __maybe_unused igb_runtime_suspend(struct device *dev)
 {
-        struct pci_dev *pdev = to_pci_dev(dev);
-        int retval;
-        bool wake;
-
-        retval = __igb_shutdown(pdev, &wake, 1);
-        if (retval)
-                return retval;
-
-        if (wake) {
-                pci_prepare_to_sleep(pdev);
-        } else {
-                pci_wake_from_d3(pdev, false);
-                pci_set_power_state(pdev, PCI_D3hot);
-        }
-
-        return 0;
+        return __igb_shutdown(to_pci_dev(dev), NULL, 1);
 }
 
 static int __maybe_unused igb_runtime_resume(struct device *dev)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
index cc4907f9ff02..2fb97967961c 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
@@ -905,13 +905,12 @@ s32 ixgbe_mii_bus_init(struct ixgbe_hw *hw)
         struct pci_dev *pdev = adapter->pdev;
         struct device *dev = &adapter->netdev->dev;
         struct mii_bus *bus;
+        int err = -ENODEV;
 
-        adapter->mii_bus = devm_mdiobus_alloc(dev);
-        if (!adapter->mii_bus)
+        bus = devm_mdiobus_alloc(dev);
+        if (!bus)
                 return -ENOMEM;
 
-        bus = adapter->mii_bus;
-
         switch (hw->device_id) {
         /* C3000 SoCs */
         case IXGBE_DEV_ID_X550EM_A_KR:
@@ -949,12 +948,15 @@ s32 ixgbe_mii_bus_init(struct ixgbe_hw *hw)
          */
         hw->phy.mdio.mode_support = MDIO_SUPPORTS_C45 | MDIO_SUPPORTS_C22;
 
-        return mdiobus_register(bus);
+        err = mdiobus_register(bus);
+        if (!err) {
+                adapter->mii_bus = bus;
+                return 0;
+        }
 
 ixgbe_no_mii_bus:
         devm_mdiobus_free(dev, bus);
-        adapter->mii_bus = NULL;
-        return -ENODEV;
+        return err;
 }
 
 /**
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
index 122927f3a600..d5e5afbdca6d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
@@ -96,9 +96,6 @@ int mlx5_port_query_eth_proto(struct mlx5_core_dev *dev, u8 port, bool ext,
         if (!eproto)
                 return -EINVAL;
 
-        if (ext !=  MLX5_CAP_PCAM_FEATURE(dev, ptys_extended_ethernet))
-                return -EOPNOTSUPP;
-
         err = mlx5_query_port_ptys(dev, out, sizeof(out), MLX5_PTYS_EN, port);
         if (err)
                 return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
index eac245a93f91..4ab0d030b544 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
@@ -122,7 +122,9 @@ out:
         return err;
 }
 
-/* xoff = ((301+2.16 * len [m]) * speed [Gbps] + 2.72 MTU [B]) */
+/* xoff = ((301+2.16 * len [m]) * speed [Gbps] + 2.72 MTU [B])
+ * minimum speed value is 40Gbps
+ */
 static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
 {
         u32 speed;
@@ -130,10 +132,9 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
         int err;
 
         err = mlx5e_port_linkspeed(priv->mdev, &speed);
-        if (err) {
-                mlx5_core_warn(priv->mdev, "cannot get port speed\n");
-                return 0;
-        }
+        if (err)
+                speed = SPEED_40000;
+        speed = max_t(u32, speed, SPEED_40000);
 
         xoff = (301 + 216 * priv->dcbx.cable_len / 100) * speed / 1000 + 272 * mtu / 100;
 
@@ -142,7 +143,7 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
 }
 
 static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
-                                 u32 xoff, unsigned int mtu)
+                                 u32 xoff, unsigned int max_mtu)
 {
         int i;
 
@@ -154,11 +155,12 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
                 }
 
                 if (port_buffer->buffer[i].size <
-                    (xoff + mtu + (1 << MLX5E_BUFFER_CELL_SHIFT)))
+                    (xoff + max_mtu + (1 << MLX5E_BUFFER_CELL_SHIFT)))
                         return -ENOMEM;
 
                 port_buffer->buffer[i].xoff = port_buffer->buffer[i].size - xoff;
-                port_buffer->buffer[i].xon  = port_buffer->buffer[i].xoff - mtu;
+                port_buffer->buffer[i].xon  =
+                        port_buffer->buffer[i].xoff - max_mtu;
         }
 
         return 0;
@@ -166,7 +168,7 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
 
 /**
  * update_buffer_lossy()
- *   mtu: device's MTU
+ *   max_mtu: netdev's max_mtu
  *   pfc_en: <input> current pfc configuration
  *   buffer: <input> current prio to buffer mapping
  *   xoff:   <input> xoff value
@@ -183,7 +185,7 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
  *     Return 0 if no error.
  *     Set change to true if buffer configuration is modified.
  */
-static int update_buffer_lossy(unsigned int mtu,
+static int update_buffer_lossy(unsigned int max_mtu,
                                u8 pfc_en, u8 *buffer, u32 xoff,
                                struct mlx5e_port_buffer *port_buffer,
                                bool *change)
@@ -220,7 +222,7 @@ static int update_buffer_lossy(unsigned int mtu,
         }
 
         if (changed) {
-                err = update_xoff_threshold(port_buffer, xoff, mtu);
+                err = update_xoff_threshold(port_buffer, xoff, max_mtu);
                 if (err)
                         return err;
 
@@ -230,6 +232,7 @@ static int update_buffer_lossy(unsigned int mtu,
         return 0;
 }
 
+#define MINIMUM_MAX_MTU 9216
 int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
                                     u32 change, unsigned int mtu,
                                     struct ieee_pfc *pfc,
@@ -241,12 +244,14 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
         bool update_prio2buffer = false;
         u8 buffer[MLX5E_MAX_PRIORITY];
         bool update_buffer = false;
+        unsigned int max_mtu;
         u32 total_used = 0;
         u8 curr_pfc_en;
         int err;
         int i;
 
         mlx5e_dbg(HW, priv, "%s: change=%x\n", __func__, change);
+        max_mtu = max_t(unsigned int, priv->netdev->max_mtu, MINIMUM_MAX_MTU);
 
         err = mlx5e_port_query_buffer(priv, &port_buffer);
         if (err)
@@ -254,7 +259,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
 
         if (change & MLX5E_PORT_BUFFER_CABLE_LEN) {
                 update_buffer = true;
-                err = update_xoff_threshold(&port_buffer, xoff, mtu);
+                err = update_xoff_threshold(&port_buffer, xoff, max_mtu);
                 if (err)
                         return err;
         }
@@ -264,7 +269,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
                 if (err)
                         return err;
 
-                err = update_buffer_lossy(mtu, pfc->pfc_en, buffer, xoff,
+                err = update_buffer_lossy(max_mtu, pfc->pfc_en, buffer, xoff,
                                           &port_buffer, &update_buffer);
                 if (err)
                         return err;
@@ -276,8 +281,8 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
                 if (err)
                         return err;
 
-                err = update_buffer_lossy(mtu, curr_pfc_en, prio2buffer, xoff,
-                                          &port_buffer, &update_buffer);
+                err = update_buffer_lossy(max_mtu, curr_pfc_en, prio2buffer,
+                                          xoff, &port_buffer, &update_buffer);
                 if (err)
                         return err;
         }
@@ -301,7 +306,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
                         return -EINVAL;
 
                 update_buffer = true;
-                err = update_xoff_threshold(&port_buffer, xoff, mtu);
+                err = update_xoff_threshold(&port_buffer, xoff, max_mtu);
                 if (err)
                         return err;
         }
@@ -309,7 +314,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
         /* Need to update buffer configuration if xoff value is changed */
         if (!update_buffer && xoff != priv->dcbx.xoff) {
                 update_buffer = true;
-                err = update_xoff_threshold(&port_buffer, xoff, mtu);
+                err = update_xoff_threshold(&port_buffer, xoff, max_mtu);
                 if (err)
                         return err;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
index 3078491cc0d0..1539cf3de5dc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
@@ -45,7 +45,9 @@ int mlx5e_create_tir(struct mlx5_core_dev *mdev,
         if (err)
                 return err;
 
+        mutex_lock(&mdev->mlx5e_res.td.list_lock);
         list_add(&tir->list, &mdev->mlx5e_res.td.tirs_list);
+        mutex_unlock(&mdev->mlx5e_res.td.list_lock);
 
         return 0;
 }
@@ -53,8 +55,10 @@ int mlx5e_create_tir(struct mlx5_core_dev *mdev,
 void mlx5e_destroy_tir(struct mlx5_core_dev *mdev,
                        struct mlx5e_tir *tir)
 {
+        mutex_lock(&mdev->mlx5e_res.td.list_lock);
         mlx5_core_destroy_tir(mdev, tir->tirn);
         list_del(&tir->list);
+        mutex_unlock(&mdev->mlx5e_res.td.list_lock);
 }
 
 static int mlx5e_create_mkey(struct mlx5_core_dev *mdev, u32 pdn,
@@ -114,6 +118,7 @@ int mlx5e_create_mdev_resources(struct mlx5_core_dev *mdev)
         }
 
         INIT_LIST_HEAD(&mdev->mlx5e_res.td.tirs_list);
+        mutex_init(&mdev->mlx5e_res.td.list_lock);
 
         return 0;
 
@@ -141,15 +146,17 @@ int mlx5e_refresh_tirs(struct mlx5e_priv *priv, bool enable_uc_lb)
 {
         struct mlx5_core_dev *mdev = priv->mdev;
         struct mlx5e_tir *tir;
-        int err  = -ENOMEM;
+        int err  = 0;
         u32 tirn = 0;
         int inlen;
         void *in;
 
         inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
         in = kvzalloc(inlen, GFP_KERNEL);
-        if (!in)
+        if (!in) {
+                err = -ENOMEM;
                 goto out;
+        }
 
         if (enable_uc_lb)
                 MLX5_SET(modify_tir_in, in, ctx.self_lb_block,
@@ -157,6 +164,7 @@ int mlx5e_refresh_tirs(struct mlx5e_priv *priv, bool enable_uc_lb)
 
         MLX5_SET(modify_tir_in, in, bitmask.self_lb_en, 1);
 
+        mutex_lock(&mdev->mlx5e_res.td.list_lock);
         list_for_each_entry(tir, &mdev->mlx5e_res.td.tirs_list, list) {
                 tirn = tir->tirn;
                 err = mlx5_core_modify_tir(mdev, tirn, in, inlen);
@@ -168,6 +176,7 @@ out:
         kvfree(in);
         if (err)
                 netdev_err(priv->netdev, "refresh tir(0x%x) failed, %d\n", tirn, err);
+        mutex_unlock(&mdev->mlx5e_res.td.list_lock);
 
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index a0987cc5fe4a..5efce4a3ff79 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -603,16 +603,18 @@ static void ptys2ethtool_supported_link(struct mlx5_core_dev *mdev,
                           __ETHTOOL_LINK_MODE_MASK_NBITS);
 }
 
-static void ptys2ethtool_adver_link(struct mlx5_core_dev *mdev,
-                                    unsigned long *advertising_modes,
-                                    u32 eth_proto_cap)
+static void ptys2ethtool_adver_link(unsigned long *advertising_modes,
+                                    u32 eth_proto_cap, bool ext)
 {
         unsigned long proto_cap = eth_proto_cap;
         struct ptys2ethtool_config *table;
         u32 max_size;
         int proto;
 
-        mlx5e_ethtool_get_speed_arr(mdev, &table, &max_size);
+        table = ext ? ptys2ext_ethtool_table : ptys2legacy_ethtool_table;
+        max_size = ext ? ARRAY_SIZE(ptys2ext_ethtool_table) :
+                         ARRAY_SIZE(ptys2legacy_ethtool_table);
+
         for_each_set_bit(proto, &proto_cap, max_size)
                 bitmap_or(advertising_modes, advertising_modes,
                           table[proto].advertised,
@@ -794,12 +796,12 @@ static void get_supported(struct mlx5_core_dev *mdev, u32 eth_proto_cap,
         ethtool_link_ksettings_add_link_mode(link_ksettings, supported, Pause);
 }
 
-static void get_advertising(struct mlx5_core_dev *mdev, u32 eth_proto_cap,
-                            u8 tx_pause, u8 rx_pause,
-                            struct ethtool_link_ksettings *link_ksettings)
+static void get_advertising(u32 eth_proto_cap, u8 tx_pause, u8 rx_pause,
+                            struct ethtool_link_ksettings *link_ksettings,
+                            bool ext)
 {
         unsigned long *advertising = link_ksettings->link_modes.advertising;
-        ptys2ethtool_adver_link(mdev, advertising, eth_proto_cap);
+        ptys2ethtool_adver_link(advertising, eth_proto_cap, ext);
 
         if (rx_pause)
                 ethtool_link_ksettings_add_link_mode(link_ksettings, advertising, Pause);
@@ -854,8 +856,9 @@ static void get_lp_advertising(struct mlx5_core_dev *mdev, u32 eth_proto_lp,
                                struct ethtool_link_ksettings *link_ksettings)
 {
         unsigned long *lp_advertising = link_ksettings->link_modes.lp_advertising;
+        bool ext = MLX5_CAP_PCAM_FEATURE(mdev, ptys_extended_ethernet);
 
-        ptys2ethtool_adver_link(mdev, lp_advertising, eth_proto_lp);
+        ptys2ethtool_adver_link(lp_advertising, eth_proto_lp, ext);
 }
 
 int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
@@ -872,6 +875,7 @@ int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
         u8 an_disable_admin;
         u8 an_status;
         u8 connector_type;
+        bool admin_ext;
         bool ext;
         int err;
 
@@ -886,6 +890,19 @@ int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
                                               eth_proto_capability);
         eth_proto_admin  = MLX5_GET_ETH_PROTO(ptys_reg, out, ext,
                                               eth_proto_admin);
+        /* Fields: eth_proto_admin and ext_eth_proto_admin  are
+         * mutually exclusive. Hence try reading legacy advertising
+         * when extended advertising is zero.
+         * admin_ext indicates how eth_proto_admin should be
+         * interpreted
+         */
+        admin_ext = ext;
+        if (ext && !eth_proto_admin) {
+                eth_proto_admin  = MLX5_GET_ETH_PROTO(ptys_reg, out, false,
+                                                      eth_proto_admin);
+                admin_ext = false;
+        }
+
         eth_proto_oper   = MLX5_GET_ETH_PROTO(ptys_reg, out, ext,
                                               eth_proto_oper);
         eth_proto_lp        = MLX5_GET(ptys_reg, out, eth_proto_lp_advertise);
@@ -899,7 +916,8 @@ int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
         ethtool_link_ksettings_zero_link_mode(link_ksettings, advertising);
 
         get_supported(mdev, eth_proto_cap, link_ksettings);
-        get_advertising(mdev, eth_proto_admin, tx_pause, rx_pause, link_ksettings);
+        get_advertising(eth_proto_admin, tx_pause, rx_pause, link_ksettings,
+                        admin_ext);
         get_speed_duplex(priv->netdev, eth_proto_oper, link_ksettings);
 
         eth_proto_oper = eth_proto_oper ? eth_proto_oper : eth_proto_cap;
@@ -997,19 +1015,17 @@ int mlx5e_ethtool_set_link_ksettings(struct mlx5e_priv *priv,
 
 #define MLX5E_PTYS_EXT ((1ULL << ETHTOOL_LINK_MODE_50000baseKR_Full_BIT) - 1)
 
-        ext_requested = (link_ksettings->link_modes.advertising[0] >
-                        MLX5E_PTYS_EXT);
+        ext_requested = !!(link_ksettings->link_modes.advertising[0] >
+                        MLX5E_PTYS_EXT ||
+                        link_ksettings->link_modes.advertising[1]);
         ext_supported = MLX5_CAP_PCAM_FEATURE(mdev, ptys_extended_ethernet);
-
-        /*when ptys_extended_ethernet is set legacy link modes are deprecated */
-        if (ext_requested != ext_supported)
-                return -EPROTONOSUPPORT;
+        ext_requested &= ext_supported;
 
         speed = link_ksettings->base.speed;
         ethtool2ptys_adver_func = ext_requested ?
                                   mlx5e_ethtool2ptys_ext_adver_link :
                                   mlx5e_ethtool2ptys_adver_link;
-        err = mlx5_port_query_eth_proto(mdev, 1, ext_supported, &eproto);
+        err = mlx5_port_query_eth_proto(mdev, 1, ext_requested, &eproto);
         if (err) {
                 netdev_err(priv->netdev, "%s: query port eth proto failed: %d\n",
                            __func__, err);
@@ -1037,7 +1053,7 @@ int mlx5e_ethtool_set_link_ksettings(struct mlx5e_priv *priv,
         if (!an_changes && link_modes == eproto.admin)
                 goto out;
 
-        mlx5_port_set_eth_ptys(mdev, an_disable, link_modes, ext_supported);
+        mlx5_port_set_eth_ptys(mdev, an_disable, link_modes, ext_requested);
         mlx5_toggle_port_link(mdev);
 
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index b4967a0ff8c7..d75dc44eb2ff 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -2158,6 +2158,52 @@ static bool csum_offload_supported(struct mlx5e_priv *priv,
         return true;
 }
 
+struct ip_ttl_word {
+        __u8    ttl;
+        __u8    protocol;
+        __sum16 check;
+};
+
+struct ipv6_hoplimit_word {
+        __be16  payload_len;
+        __u8    nexthdr;
+        __u8    hop_limit;
+};
+
+static bool is_action_keys_supported(const struct flow_action_entry *act)
+{
+        u32 mask, offset;
+        u8 htype;
+
+        htype = act->mangle.htype;
+        offset = act->mangle.offset;
+        mask = ~act->mangle.mask;
+        /* For IPv4 & IPv6 header check 4 byte word,
+         * to determine that modified fields
+         * are NOT ttl & hop_limit only.
+         */
+        if (htype == FLOW_ACT_MANGLE_HDR_TYPE_IP4) {
+                struct ip_ttl_word *ttl_word =
+                        (struct ip_ttl_word *)&mask;
+
+                if (offset != offsetof(struct iphdr, ttl) ||
+                    ttl_word->protocol ||
+                    ttl_word->check) {
+                        return true;
+                }
+        } else if (htype == FLOW_ACT_MANGLE_HDR_TYPE_IP6) {
+                struct ipv6_hoplimit_word *hoplimit_word =
+                        (struct ipv6_hoplimit_word *)&mask;
+
+                if (offset != offsetof(struct ipv6hdr, payload_len) ||
+                    hoplimit_word->payload_len ||
+                    hoplimit_word->nexthdr) {
+                        return true;
+                }
+        }
+        return false;
+}
+
 static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
                                           struct flow_action *flow_action,
                                           u32 actions,
@@ -2165,9 +2211,9 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
 {
         const struct flow_action_entry *act;
         bool modify_ip_header;
-        u8 htype, ip_proto;
         void *headers_v;
         u16 ethertype;
+        u8 ip_proto;
         int i;
 
         if (actions & MLX5_FLOW_CONTEXT_ACTION_DECAP)
@@ -2187,9 +2233,7 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
                     act->id != FLOW_ACTION_ADD)
                         continue;
 
-                htype = act->mangle.htype;
-                if (htype == FLOW_ACT_MANGLE_HDR_TYPE_IP4 ||
-                    htype == FLOW_ACT_MANGLE_HDR_TYPE_IP6) {
+                if (is_action_keys_supported(act)) {
                         modify_ip_header = true;
                         break;
                 }
@@ -2340,15 +2384,22 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv,
         return 0;
 }
 
-static inline int cmp_encap_info(struct ip_tunnel_key *a,
-                                 struct ip_tunnel_key *b)
+struct encap_key {
+        struct ip_tunnel_key *ip_tun_key;
+        int tunnel_type;
+};
+
+static inline int cmp_encap_info(struct encap_key *a,
+                                 struct encap_key *b)
 {
-        return memcmp(a, b, sizeof(*a));
+        return memcmp(a->ip_tun_key, b->ip_tun_key, sizeof(*a->ip_tun_key)) ||
+               a->tunnel_type != b->tunnel_type;
 }
 
-static inline int hash_encap_info(struct ip_tunnel_key *key)
+static inline int hash_encap_info(struct encap_key *key)
 {
-        return jhash(key, sizeof(*key), 0);
+        return jhash(key->ip_tun_key, sizeof(*key->ip_tun_key),
+                     key->tunnel_type);
 }
 
 
@@ -2379,7 +2430,7 @@ static int mlx5e_attach_encap(struct mlx5e_priv *priv,
         struct mlx5_esw_flow_attr *attr = flow->esw_attr;
         struct mlx5e_tc_flow_parse_attr *parse_attr;
         struct ip_tunnel_info *tun_info;
-        struct ip_tunnel_key *key;
+        struct encap_key key, e_key;
         struct mlx5e_encap_entry *e;
         unsigned short family;
         uintptr_t hash_key;
@@ -2389,13 +2440,16 @@ static int mlx5e_attach_encap(struct mlx5e_priv *priv,
         parse_attr = attr->parse_attr;
         tun_info = &parse_attr->tun_info[out_index];
         family = ip_tunnel_info_af(tun_info);
-        key = &tun_info->key;
+        key.ip_tun_key = &tun_info->key;
+        key.tunnel_type = mlx5e_tc_tun_get_type(mirred_dev);
 
-        hash_key = hash_encap_info(key);
+        hash_key = hash_encap_info(&key);
 
         hash_for_each_possible_rcu(esw->offloads.encap_tbl, e,
                                    encap_hlist, hash_key) {
-                if (!cmp_encap_info(&e->tun_info.key, key)) {
+                e_key.ip_tun_key = &e->tun_info.key;
+                e_key.tunnel_type = e->tunnel_type;
+                if (!cmp_encap_info(&e_key, &key)) {
                         found = true;
                         break;
                 }
@@ -2657,7 +2711,7 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv,
 
         if (hdrs[TCA_PEDIT_KEY_EX_CMD_SET].pedits ||
             hdrs[TCA_PEDIT_KEY_EX_CMD_ADD].pedits) {
-                err = alloc_tc_pedit_action(priv, MLX5_FLOW_NAMESPACE_KERNEL,
+                err = alloc_tc_pedit_action(priv, MLX5_FLOW_NAMESPACE_FDB,
                                             parse_attr, hdrs, extack);
                 if (err)
                         return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index ecd2c747f726..8a67fd197b79 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -105,8 +105,7 @@ static int arm_vport_context_events_cmd(struct mlx5_core_dev *dev, u16 vport,
                  opcode, MLX5_CMD_OP_MODIFY_NIC_VPORT_CONTEXT);
         MLX5_SET(modify_nic_vport_context_in, in, field_select.change_event, 1);
         MLX5_SET(modify_nic_vport_context_in, in, vport_number, vport);
-        if (vport)
-                MLX5_SET(modify_nic_vport_context_in, in, other_vport, 1);
+        MLX5_SET(modify_nic_vport_context_in, in, other_vport, 1);
         nic_vport_ctx = MLX5_ADDR_OF(modify_nic_vport_context_in,
                                      in, nic_vport_context);
 
@@ -134,8 +133,7 @@ static int modify_esw_vport_context_cmd(struct mlx5_core_dev *dev, u16 vport,
         MLX5_SET(modify_esw_vport_context_in, in, opcode,
                  MLX5_CMD_OP_MODIFY_ESW_VPORT_CONTEXT);
         MLX5_SET(modify_esw_vport_context_in, in, vport_number, vport);
-        if (vport)
-                MLX5_SET(modify_esw_vport_context_in, in, other_vport, 1);
+        MLX5_SET(modify_esw_vport_context_in, in, other_vport, 1);
         return mlx5_cmd_exec(dev, in, inlen, out, sizeof(out));
 }
 
@@ -431,6 +429,8 @@ static int esw_create_legacy_table(struct mlx5_eswitch *esw)
 {
         int err;
 
+        memset(&esw->fdb_table.legacy, 0, sizeof(struct legacy_fdb));
+
         err = esw_create_legacy_vepa_table(esw);
         if (err)
                 return err;
@@ -2157,6 +2157,7 @@ static int _mlx5_eswitch_set_vepa_locked(struct mlx5_eswitch *esw,
 
         /* Star rule to forward all traffic to uplink vport */
         memset(spec, 0, sizeof(*spec));
+        memset(&dest, 0, sizeof(dest));
         dest.type = MLX5_FLOW_DESTINATION_TYPE_VPORT;
         dest.vport.num = MLX5_VPORT_UPLINK;
         flow_act.action = MLX5_FLOW_CONTEXT_ACTION_FWD_DEST;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index f2260391be5b..9b2d78ee22b8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -1611,6 +1611,7 @@ static int esw_offloads_steering_init(struct mlx5_eswitch *esw, int nvports)
 {
         int err;
 
+        memset(&esw->fdb_table.offloads, 0, sizeof(struct offloads_fdb));
         mutex_init(&esw->fdb_table.offloads.fdb_prio_lock);
 
         err = esw_create_offloads_fdb_tables(esw, nvports);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
index 5cf5f2a9d51f..8de64e88c670 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
@@ -217,15 +217,21 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq,
         void *cmd;
         int ret;
 
+        rcu_read_lock();
+        flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle));
+        rcu_read_unlock();
+
+        if (!flow) {
+                WARN_ONCE(1, "Received NULL pointer for handle\n");
+                return -EINVAL;
+        }
+
         buf = kzalloc(size, GFP_ATOMIC);
         if (!buf)
                 return -ENOMEM;
 
         cmd = (buf + 1);
 
-        rcu_read_lock();
-        flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle));
-        rcu_read_unlock();
         mlx5_fpga_tls_flow_to_cmd(flow, cmd);
 
         MLX5_SET(tls_cmd, cmd, swid, ntohl(handle));
@@ -238,6 +244,8 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq,
         buf->complete = mlx_tls_kfree_complete;
 
         ret = mlx5_fpga_sbu_conn_sendmsg(mdev->fpga->tls->conn, buf);
+        if (ret < 0)
+                kfree(buf);
 
         return ret;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 70cc906a102b..76716419370d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -164,26 +164,6 @@ static struct mlx5_profile profile[] = {
                         .size   = 8,
                         .limit  = 4
                 },
-                .mr_cache[16]   = {
-                        .size   = 8,
-                        .limit  = 4
-                },
-                .mr_cache[17]   = {
-                        .size   = 8,
-                        .limit  = 4
-                },
-                .mr_cache[18]   = {
-                        .size   = 8,
-                        .limit  = 4
-                },
-                .mr_cache[19]   = {
-                        .size   = 4,
-                        .limit  = 2
-                },
-                .mr_cache[20]   = {
-                        .size   = 4,
-                        .limit  = 2
-                },
         },
 };
 
diff --git a/drivers/net/ethernet/netronome/nfp/flower/action.c b/drivers/net/ethernet/netronome/nfp/flower/action.c
index eeda4ed98333..e336f6ee94f5 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/action.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/action.c
@@ -48,8 +48,7 @@ nfp_fl_push_vlan(struct nfp_fl_push_vlan *push_vlan,
 
         tmp_push_vlan_tci =
                 FIELD_PREP(NFP_FL_PUSH_VLAN_PRIO, act->vlan.prio) |
-                FIELD_PREP(NFP_FL_PUSH_VLAN_VID, act->vlan.vid) |
-                NFP_FL_PUSH_VLAN_CFI;
+                FIELD_PREP(NFP_FL_PUSH_VLAN_VID, act->vlan.vid);
         push_vlan->vlan_tci = cpu_to_be16(tmp_push_vlan_tci);
 }
 
diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
index 4fcaf11ed56e..0ed51e79db00 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
+++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
@@ -26,7 +26,7 @@
 #define NFP_FLOWER_LAYER2_GENEVE_OP     BIT(6)
 
 #define NFP_FLOWER_MASK_VLAN_PRIO       GENMASK(15, 13)
-#define NFP_FLOWER_MASK_VLAN_CFI        BIT(12)
+#define NFP_FLOWER_MASK_VLAN_PRESENT    BIT(12)
 #define NFP_FLOWER_MASK_VLAN_VID        GENMASK(11, 0)
 
 #define NFP_FLOWER_MASK_MPLS_LB         GENMASK(31, 12)
@@ -82,7 +82,6 @@
 #define NFP_FL_OUT_FLAGS_TYPE_IDX       GENMASK(2, 0)
 
 #define NFP_FL_PUSH_VLAN_PRIO           GENMASK(15, 13)
-#define NFP_FL_PUSH_VLAN_CFI            BIT(12)
 #define NFP_FL_PUSH_VLAN_VID            GENMASK(11, 0)
 
 #define IPV6_FLOW_LABEL_MASK            cpu_to_be32(0x000fffff)
diff --git a/drivers/net/ethernet/netronome/nfp/flower/match.c b/drivers/net/ethernet/netronome/nfp/flower/match.c
index e03c8ef2c28c..9b8b843d0340 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/match.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/match.c
@@ -30,20 +30,19 @@ nfp_flower_compile_meta_tci(struct nfp_flower_meta_tci *ext,
 
                 flow_rule_match_vlan(rule, &match);
                 /* Populate the tci field. */
-                if (match.key->vlan_id || match.key->vlan_priority) {
-                        tmp_tci = FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
-                                             match.key->vlan_priority) |
-                                  FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
-                                             match.key->vlan_id) |
-                                  NFP_FLOWER_MASK_VLAN_CFI;
-                        ext->tci = cpu_to_be16(tmp_tci);
-                        tmp_tci = FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
-                                             match.mask->vlan_priority) |
-                                  FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
-                                             match.mask->vlan_id) |
-                                  NFP_FLOWER_MASK_VLAN_CFI;
-                        msk->tci = cpu_to_be16(tmp_tci);
-                }
+                tmp_tci = NFP_FLOWER_MASK_VLAN_PRESENT;
+                tmp_tci |= FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
+                                      match.key->vlan_priority) |
+                           FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
+                                      match.key->vlan_id);
+                ext->tci = cpu_to_be16(tmp_tci);
+
+                tmp_tci = NFP_FLOWER_MASK_VLAN_PRESENT;
+                tmp_tci |= FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
+                                      match.mask->vlan_priority) |
+                           FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
+                                      match.mask->vlan_id);
+                msk->tci = cpu_to_be16(tmp_tci);
         }
 }
 
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
index d2c803bb4e56..94d228c04496 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
@@ -195,7 +195,7 @@ static netdev_tx_t nfp_repr_xmit(struct sk_buff *skb, struct net_device *netdev)
         ret = dev_queue_xmit(skb);
         nfp_repr_inc_tx_stats(netdev, len, ret);
 
-        return ret;
+        return NETDEV_TX_OK;
 }
 
 static int nfp_repr_stop(struct net_device *netdev)
@@ -383,7 +383,7 @@ int nfp_repr_init(struct nfp_app *app, struct net_device *netdev,
         netdev->features &= ~(NETIF_F_TSO | NETIF_F_TSO6);
         netdev->gso_max_segs = NFP_NET_LSO_MAX_SEGS;
 
-        netdev->priv_flags |= IFF_NO_QUEUE;
+        netdev->priv_flags |= IFF_NO_QUEUE | IFF_DISABLE_NETPOLL;
         netdev->features |= NETIF_F_LLTX;
 
         if (nfp_app_has_tc(app)) {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 0c443ea98479..374a4d4371f9 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -497,7 +497,7 @@ struct qlcnic_hardware_context {
         u16 board_type;
         u16 supported_type;
 
-        u16 link_speed;
+        u32 link_speed;
         u16 link_duplex;
         u16 link_autoneg;
         u16 module_type;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 7562ccbbb39a..ed651dde6ef9 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -28,6 +28,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/firmware.h>
 #include <linux/prefetch.h>
+#include <linux/pci-aspm.h>
 #include <linux/ipv6.h>
 #include <net/ip6_checksum.h>
 
@@ -5460,7 +5461,7 @@ static void rtl_hw_start_8168(struct rtl8169_private *tp)
         tp->cp_cmd |= PktCntrDisable | INTT_1;
         RTL_W16(tp, CPlusCmd, tp->cp_cmd);
 
-        RTL_W16(tp, IntrMitigate, 0x5151);
+        RTL_W16(tp, IntrMitigate, 0x5100);
 
         /* Work around for RxFIFO overflow. */
         if (tp->mac_version == RTL_GIGA_MAC_VER_11) {
@@ -7352,6 +7353,11 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (rc)
                 return rc;
 
+        /* Disable ASPM completely as that cause random device stop working
+         * problems as well as full system hangs for some PCIe devices users.
+         */
+        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1);
+
         /* enable device (incl. PCI PM wakeup and hotplug setup) */
         rc = pcim_enable_device(pdev);
         if (rc < 0) {
diff --git a/drivers/net/ethernet/stmicro/stmmac/descs_com.h b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
index 40d6356a7e73..3dfb07a78952 100644
--- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h
+++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
@@ -29,11 +29,13 @@
 /* Specific functions used for Ring mode */
 
 /* Enhanced descriptors */
-static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end)
+static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end,
+                                           int bfsize)
 {
-        p->des1 |= cpu_to_le32((BUF_SIZE_8KiB
-                        << ERDES1_BUFFER2_SIZE_SHIFT)
-                   & ERDES1_BUFFER2_SIZE_MASK);
+        if (bfsize == BUF_SIZE_16KiB)
+                p->des1 |= cpu_to_le32((BUF_SIZE_8KiB
+                                << ERDES1_BUFFER2_SIZE_SHIFT)
+                           & ERDES1_BUFFER2_SIZE_MASK);
 
         if (end)
                 p->des1 |= cpu_to_le32(ERDES1_END_RING);
@@ -59,11 +61,15 @@ static inline void enh_set_tx_desc_len_on_ring(struct dma_desc *p, int len)
 }
 
 /* Normal descriptors */
-static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end)
+static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end, int bfsize)
 {
-        p->des1 |= cpu_to_le32(((BUF_SIZE_2KiB - 1)
-                                << RDES1_BUFFER2_SIZE_SHIFT)
-                    & RDES1_BUFFER2_SIZE_MASK);
+        if (bfsize >= BUF_SIZE_2KiB) {
+                int bfsize2;
+
+                bfsize2 = min(bfsize - BUF_SIZE_2KiB + 1, BUF_SIZE_2KiB - 1);
+                p->des1 |= cpu_to_le32((bfsize2 << RDES1_BUFFER2_SIZE_SHIFT)
+                            & RDES1_BUFFER2_SIZE_MASK);
+        }
 
         if (end)
                 p->des1 |= cpu_to_le32(RDES1_END_RING);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
index 7fbb6a4dbf51..e061e9f5fad7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
@@ -296,7 +296,7 @@ exit:
 }
 
 static void dwmac4_rd_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
-                                   int mode, int end)
+                                   int mode, int end, int bfsize)
 {
         dwmac4_set_rx_owner(p, disable_rx_ic);
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
index 1d858fdec997..98fa471da7c0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
@@ -123,7 +123,7 @@ static int dwxgmac2_get_rx_timestamp_status(void *desc, void *next_desc,
 }
 
 static void dwxgmac2_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
-                                  int mode, int end)
+                                  int mode, int end, int bfsize)
 {
         dwxgmac2_set_rx_owner(p, disable_rx_ic);
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
index 5ef91a790f9d..5202d6ad7919 100644
--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
@@ -201,6 +201,11 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
         if (unlikely(rdes0 & RDES0_OWN))
                 return dma_own;
 
+        if (unlikely(!(rdes0 & RDES0_LAST_DESCRIPTOR))) {
+                stats->rx_length_errors++;
+                return discard_frame;
+        }
+
         if (unlikely(rdes0 & RDES0_ERROR_SUMMARY)) {
                 if (unlikely(rdes0 & RDES0_DESCRIPTOR_ERROR)) {
                         x->rx_desc++;
@@ -231,9 +236,10 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
          * It doesn't match with the information reported into the databook.
          * At any rate, we need to understand if the CSUM hw computation is ok
          * and report this info to the upper layers. */
-        ret = enh_desc_coe_rdes0(!!(rdes0 & RDES0_IPC_CSUM_ERROR),
-                                 !!(rdes0 & RDES0_FRAME_TYPE),
-                                 !!(rdes0 & ERDES0_RX_MAC_ADDR));
+        if (likely(ret == good_frame))
+                ret = enh_desc_coe_rdes0(!!(rdes0 & RDES0_IPC_CSUM_ERROR),
+                                         !!(rdes0 & RDES0_FRAME_TYPE),
+                                         !!(rdes0 & ERDES0_RX_MAC_ADDR));
 
         if (unlikely(rdes0 & RDES0_DRIBBLING))
                 x->dribbling_bit++;
@@ -259,15 +265,19 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
 }
 
 static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
-                                  int mode, int end)
+                                  int mode, int end, int bfsize)
 {
+        int bfsize1;
+
         p->des0 |= cpu_to_le32(RDES0_OWN);
-        p->des1 |= cpu_to_le32(BUF_SIZE_8KiB & ERDES1_BUFFER1_SIZE_MASK);
+
+        bfsize1 = min(bfsize, BUF_SIZE_8KiB);
+        p->des1 |= cpu_to_le32(bfsize1 & ERDES1_BUFFER1_SIZE_MASK);
 
         if (mode == STMMAC_CHAIN_MODE)
                 ehn_desc_rx_set_on_chain(p);
         else
-                ehn_desc_rx_set_on_ring(p, end);
+                ehn_desc_rx_set_on_ring(p, end, bfsize);
 
         if (disable_rx_ic)
                 p->des1 |= cpu_to_le32(ERDES1_DISABLE_IC);
diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h
index 92b8944f26e3..5bb00234d961 100644
--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h
+++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h
@@ -33,7 +33,7 @@ struct dma_extended_desc;
 struct stmmac_desc_ops {
         /* DMA RX descriptor ring initialization */
         void (*init_rx_desc)(struct dma_desc *p, int disable_rx_ic, int mode,
-                        int end);
+                        int end, int bfsize);
         /* DMA TX descriptor ring initialization */
         void (*init_tx_desc)(struct dma_desc *p, int mode, int end);
         /* Invoked by the xmit function to prepare the tx descriptor */
diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
index de65bb29feba..b7dd4e3c760d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
@@ -91,8 +91,6 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x,
                 return dma_own;
 
         if (unlikely(!(rdes0 & RDES0_LAST_DESCRIPTOR))) {
-                pr_warn("%s: Oversized frame spanned multiple buffers\n",
-                        __func__);
                 stats->rx_length_errors++;
                 return discard_frame;
         }
@@ -135,15 +133,19 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x,
 }
 
 static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode,
-                               int end)
+                               int end, int bfsize)
 {
+        int bfsize1;
+
         p->des0 |= cpu_to_le32(RDES0_OWN);
-        p->des1 |= cpu_to_le32((BUF_SIZE_2KiB - 1) & RDES1_BUFFER1_SIZE_MASK);
+
+        bfsize1 = min(bfsize, BUF_SIZE_2KiB - 1);
+        p->des1 |= cpu_to_le32(bfsize & RDES1_BUFFER1_SIZE_MASK);
 
         if (mode == STMMAC_CHAIN_MODE)
                 ndesc_rx_set_on_chain(p, end);
         else
-                ndesc_rx_set_on_ring(p, end);
+                ndesc_rx_set_on_ring(p, end, bfsize);
 
         if (disable_rx_ic)
                 p->des1 |= cpu_to_le32(RDES1_DISABLE_IC);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 6a2e1031a62a..a26e36dbb5df 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1136,11 +1136,13 @@ static void stmmac_clear_rx_descriptors(struct stmmac_priv *priv, u32 queue)
                 if (priv->extend_desc)
                         stmmac_init_rx_desc(priv, &rx_q->dma_erx[i].basic,
                                         priv->use_riwt, priv->mode,
-                                        (i == DMA_RX_SIZE - 1));
+                                        (i == DMA_RX_SIZE - 1),
+                                        priv->dma_buf_sz);
                 else
                         stmmac_init_rx_desc(priv, &rx_q->dma_rx[i],
                                         priv->use_riwt, priv->mode,
-                                        (i == DMA_RX_SIZE - 1));
+                                        (i == DMA_RX_SIZE - 1),
+                                        priv->dma_buf_sz);
 }
 
 /**
@@ -3352,9 +3354,8 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
 {
         struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
         struct stmmac_channel *ch = &priv->channel[queue];
-        unsigned int entry = rx_q->cur_rx;
+        unsigned int next_entry = rx_q->cur_rx;
         int coe = priv->hw->rx_csum;
-        unsigned int next_entry;
         unsigned int count = 0;
         bool xmac;
 
@@ -3372,10 +3373,12 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                 stmmac_display_ring(priv, rx_head, DMA_RX_SIZE, true);
         }
         while (count < limit) {
-                int status;
+                int entry, status;
                 struct dma_desc *p;
                 struct dma_desc *np;
 
+                entry = next_entry;
+
                 if (priv->extend_desc)
                         p = (struct dma_desc *)(rx_q->dma_erx + entry);
                 else
@@ -3431,11 +3434,12 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                          *  ignored
                          */
                         if (frame_len > priv->dma_buf_sz) {
-                                netdev_err(priv->dev,
-                                           "len %d larger than size (%d)\n",
-                                           frame_len, priv->dma_buf_sz);
+                                if (net_ratelimit())
+                                        netdev_err(priv->dev,
+                                                   "len %d larger than size (%d)\n",
+                                                   frame_len, priv->dma_buf_sz);
                                 priv->dev->stats.rx_length_errors++;
-                                break;
+                                continue;
                         }
 
                         /* ACS is set; GMAC core strips PAD/FCS for IEEE 802.3
@@ -3470,7 +3474,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                                                 dev_warn(priv->device,
                                                          "packet dropped\n");
                                         priv->dev->stats.rx_dropped++;
-                                        break;
+                                        continue;
                                 }
 
                                 dma_sync_single_for_cpu(priv->device,
@@ -3490,11 +3494,12 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                         } else {
                                 skb = rx_q->rx_skbuff[entry];
                                 if (unlikely(!skb)) {
-                                        netdev_err(priv->dev,
-                                                   "%s: Inconsistent Rx chain\n",
-                                                   priv->dev->name);
+                                        if (net_ratelimit())
+                                                netdev_err(priv->dev,
+                                                           "%s: Inconsistent Rx chain\n",
+                                                           priv->dev->name);
                                         priv->dev->stats.rx_dropped++;
-                                        break;
+                                        continue;
                                 }
                                 prefetch(skb->data - NET_IP_ALIGN);
                                 rx_q->rx_skbuff[entry] = NULL;
@@ -3529,7 +3534,6 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                         priv->dev->stats.rx_packets++;
                         priv->dev->stats.rx_bytes += frame_len;
                 }
-                entry = next_entry;
         }
 
         stmmac_rx_refill(priv, queue);
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index e859ae2e42d5..49f41b64077b 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -987,6 +987,7 @@ struct netvsc_device {
 
         wait_queue_head_t wait_drain;
         bool destroy;
+        bool tx_disable; /* if true, do not wake up queue again */
 
         /* Receive buffer allocated by us but manages by NetVSP */
         void *recv_buf;
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 813d195bbd57..e0dce373cdd9 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -110,6 +110,7 @@ static struct netvsc_device *alloc_net_device(void)
 
         init_waitqueue_head(&net_device->wait_drain);
         net_device->destroy = false;
+        net_device->tx_disable = false;
 
         net_device->max_pkt = RNDIS_MAX_PKT_DEFAULT;
         net_device->pkt_align = RNDIS_PKT_ALIGN_DEFAULT;
@@ -719,7 +720,7 @@ static void netvsc_send_tx_complete(struct net_device *ndev,
         } else {
                 struct netdev_queue *txq = netdev_get_tx_queue(ndev, q_idx);
 
-                if (netif_tx_queue_stopped(txq) &&
+                if (netif_tx_queue_stopped(txq) && !net_device->tx_disable &&
                     (hv_get_avail_to_write_percent(&channel->outbound) >
                      RING_AVAIL_PERCENT_HIWATER || queue_sends < 1)) {
                         netif_tx_wake_queue(txq);
@@ -874,7 +875,8 @@ static inline int netvsc_send_pkt(
         } else if (ret == -EAGAIN) {
                 netif_tx_stop_queue(txq);
                 ndev_ctx->eth_stats.stop_queue++;
-                if (atomic_read(&nvchan->queue_sends) < 1) {
+                if (atomic_read(&nvchan->queue_sends) < 1 &&
+                    !net_device->tx_disable) {
                         netif_tx_wake_queue(txq);
                         ndev_ctx->eth_stats.wake_queue++;
                         ret = -ENOSPC;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index cf4897043e83..b20fb0fb595b 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -109,6 +109,15 @@ static void netvsc_set_rx_mode(struct net_device *net)
         rcu_read_unlock();
 }
 
+static void netvsc_tx_enable(struct netvsc_device *nvscdev,
+                             struct net_device *ndev)
+{
+        nvscdev->tx_disable = false;
+        virt_wmb(); /* ensure queue wake up mechanism is on */
+
+        netif_tx_wake_all_queues(ndev);
+}
+
 static int netvsc_open(struct net_device *net)
 {
         struct net_device_context *ndev_ctx = netdev_priv(net);
@@ -129,7 +138,7 @@ static int netvsc_open(struct net_device *net)
         rdev = nvdev->extension;
         if (!rdev->link_state) {
                 netif_carrier_on(net);
-                netif_tx_wake_all_queues(net);
+                netvsc_tx_enable(nvdev, net);
         }
 
         if (vf_netdev) {
@@ -184,6 +193,17 @@ static int netvsc_wait_until_empty(struct netvsc_device *nvdev)
         }
 }
 
+static void netvsc_tx_disable(struct netvsc_device *nvscdev,
+                              struct net_device *ndev)
+{
+        if (nvscdev) {
+                nvscdev->tx_disable = true;
+                virt_wmb(); /* ensure txq will not wake up after stop */
+        }
+
+        netif_tx_disable(ndev);
+}
+
 static int netvsc_close(struct net_device *net)
 {
         struct net_device_context *net_device_ctx = netdev_priv(net);
@@ -192,7 +212,7 @@ static int netvsc_close(struct net_device *net)
         struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
         int ret;
 
-        netif_tx_disable(net);
+        netvsc_tx_disable(nvdev, net);
 
         /* No need to close rndis filter if it is removed already */
         if (!nvdev)
@@ -920,7 +940,7 @@ static int netvsc_detach(struct net_device *ndev,
 
         /* If device was up (receiving) then shutdown */
         if (netif_running(ndev)) {
-                netif_tx_disable(ndev);
+                netvsc_tx_disable(nvdev, ndev);
 
                 ret = rndis_filter_close(nvdev);
                 if (ret) {
@@ -1908,7 +1928,7 @@ static void netvsc_link_change(struct work_struct *w)
                 if (rdev->link_state) {
                         rdev->link_state = false;
                         netif_carrier_on(net);
-                        netif_tx_wake_all_queues(net);
+                        netvsc_tx_enable(net_device, net);
                 } else {
                         notify = true;
                 }
@@ -1918,7 +1938,7 @@ static void netvsc_link_change(struct work_struct *w)
                 if (!rdev->link_state) {
                         rdev->link_state = true;
                         netif_carrier_off(net);
-                        netif_tx_stop_all_queues(net);
+                        netvsc_tx_disable(net_device, net);
                 }
                 kfree(event);
                 break;
@@ -1927,7 +1947,7 @@ static void netvsc_link_change(struct work_struct *w)
                 if (!rdev->link_state) {
                         rdev->link_state = true;
                         netif_carrier_off(net);
-                        netif_tx_stop_all_queues(net);
+                        netvsc_tx_disable(net_device, net);
                         event->event = RNDIS_STATUS_MEDIA_CONNECT;
                         spin_lock_irqsave(&ndev_ctx->lock, flags);
                         list_add(&event->list, &ndev_ctx->reconfig_events);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 74bebbdb4b15..9195f3476b1d 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1203,6 +1203,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x19d2, 0x2002, 4)},    /* ZTE (Vodafone) K3765-Z */
         {QMI_FIXED_INTF(0x2001, 0x7e19, 4)},    /* D-Link DWM-221 B1 */
         {QMI_FIXED_INTF(0x2001, 0x7e35, 4)},    /* D-Link DWM-222 */
+        {QMI_FIXED_INTF(0x2020, 0x2031, 4)},    /* Olicard 600 */
         {QMI_FIXED_INTF(0x2020, 0x2033, 4)},    /* BroadMobi BM806U */
         {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
         {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 7c1430ed0244..cd15c32b2e43 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -1273,9 +1273,14 @@ static void vrf_setup(struct net_device *dev)
 
         /* default to no qdisc; user can add if desired */
         dev->priv_flags |= IFF_NO_QUEUE;
+        dev->priv_flags |= IFF_NO_RX_HANDLER;
 
-        dev->min_mtu = 0;
-        dev->max_mtu = 0;
+        /* VRF devices do not care about MTU, but if the MTU is set
+         * too low then the ipv4 and ipv6 protocols are disabled
+         * which breaks networking.
+         */
+        dev->min_mtu = IPV6_MIN_MTU;
+        dev->max_mtu = ETH_MAX_MTU;
 }
 
 static int vrf_validate(struct nlattr *tb[], struct nlattr *data[],
diff --git a/drivers/parisc/iosapic.c b/drivers/parisc/iosapic.c
index 1be571c20062..6bad04cbb1d3 100644
--- a/drivers/parisc/iosapic.c
+++ b/drivers/parisc/iosapic.c
@@ -157,8 +157,12 @@
 #define DBG_IRT(x...)
 #endif
 
+#ifdef CONFIG_64BIT
+#define COMPARE_IRTE_ADDR(irte, hpa)    ((irte)->dest_iosapic_addr == (hpa))
+#else
 #define COMPARE_IRTE_ADDR(irte, hpa)    \
-                ((irte)->dest_iosapic_addr == F_EXTEND(hpa))
+                ((irte)->dest_iosapic_addr == ((hpa) | 0xffffffff00000000ULL))
+#endif
 
 #define IOSAPIC_REG_SELECT              0x00
 #define IOSAPIC_REG_WINDOW              0x10
diff --git a/drivers/reset/reset-meson-audio-arb.c b/drivers/reset/reset-meson-audio-arb.c
index 91751617b37a..c53a2185a039 100644
--- a/drivers/reset/reset-meson-audio-arb.c
+++ b/drivers/reset/reset-meson-audio-arb.c
@@ -130,6 +130,7 @@ static int meson_audio_arb_probe(struct platform_device *pdev)
         arb->rstc.nr_resets = ARRAY_SIZE(axg_audio_arb_reset_bits);
         arb->rstc.ops = &meson_audio_arb_rstc_ops;
         arb->rstc.of_node = dev->of_node;
+        arb->rstc.owner = THIS_MODULE;
 
         /*
          * Enable general :
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index a71734c41693..f933c06bff4f 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -667,9 +667,9 @@ config RTC_DRV_S5M
           will be called rtc-s5m.
 
 config RTC_DRV_SD3078
-    tristate "ZXW Crystal SD3078"
+    tristate "ZXW Shenzhen whwave SD3078"
     help
-      If you say yes here you get support for the ZXW Crystal
+      If you say yes here you get support for the ZXW Shenzhen whwave
       SD3078 RTC chips.
 
       This driver can also be built as a module. If so, the module
diff --git a/drivers/rtc/rtc-cros-ec.c b/drivers/rtc/rtc-cros-ec.c
index e5444296075e..4d6bf9304ceb 100644
--- a/drivers/rtc/rtc-cros-ec.c
+++ b/drivers/rtc/rtc-cros-ec.c
@@ -298,7 +298,7 @@ static int cros_ec_rtc_suspend(struct device *dev)
         struct cros_ec_rtc *cros_ec_rtc = dev_get_drvdata(&pdev->dev);
 
         if (device_may_wakeup(dev))
-                enable_irq_wake(cros_ec_rtc->cros_ec->irq);
+                return enable_irq_wake(cros_ec_rtc->cros_ec->irq);
 
         return 0;
 }
@@ -309,7 +309,7 @@ static int cros_ec_rtc_resume(struct device *dev)
         struct cros_ec_rtc *cros_ec_rtc = dev_get_drvdata(&pdev->dev);
 
         if (device_may_wakeup(dev))
-                disable_irq_wake(cros_ec_rtc->cros_ec->irq);
+                return disable_irq_wake(cros_ec_rtc->cros_ec->irq);
 
         return 0;
 }
diff --git a/drivers/rtc/rtc-da9063.c b/drivers/rtc/rtc-da9063.c
index b4e054c64bad..69b54e5556c0 100644
--- a/drivers/rtc/rtc-da9063.c
+++ b/drivers/rtc/rtc-da9063.c
@@ -480,6 +480,13 @@ static int da9063_rtc_probe(struct platform_device *pdev)
         da9063_data_to_tm(data, &rtc->alarm_time, rtc);
         rtc->rtc_sync = false;
 
+        /*
+         * TODO: some models have alarms on a minute boundary but still support
+         * real hardware interrupts. Add this once the core supports it.
+         */
+        if (config->rtc_data_start != RTC_SEC)
+                rtc->rtc_dev->uie_unsupported = 1;
+
         irq_alarm = platform_get_irq_byname(pdev, "ALARM");
         ret = devm_request_threaded_irq(&pdev->dev, irq_alarm, NULL,
                                         da9063_alarm_event,
diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c
index d417b203cbc5..1d3de2a3d1a4 100644
--- a/drivers/rtc/rtc-sh.c
+++ b/drivers/rtc/rtc-sh.c
@@ -374,7 +374,7 @@ static int sh_rtc_set_time(struct device *dev, struct rtc_time *tm)
 static inline int sh_rtc_read_alarm_value(struct sh_rtc *rtc, int reg_off)
 {
         unsigned int byte;
-        int value = 0xff;       /* return 0xff for ignored values */
+        int value = -1;                 /* return -1 for ignored values */
 
         byte = readb(rtc->regbase + reg_off);
         if (byte & AR_ENB) {
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index c98f264f1d83..a497b2c0cb79 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -3878,10 +3878,9 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
          * wake up the thread.
          */
         spin_lock(&lpfc_cmd->buf_lock);
-        if (unlikely(lpfc_cmd->cur_iocbq.iocb_flag & LPFC_DRIVER_ABORTED)) {
-                lpfc_cmd->cur_iocbq.iocb_flag &= ~LPFC_DRIVER_ABORTED;
-                if (lpfc_cmd->waitq)
-                        wake_up(lpfc_cmd->waitq);
+        lpfc_cmd->cur_iocbq.iocb_flag &= ~LPFC_DRIVER_ABORTED;
+        if (lpfc_cmd->waitq) {
+                wake_up(lpfc_cmd->waitq);
                 lpfc_cmd->waitq = NULL;
         }
         spin_unlock(&lpfc_cmd->buf_lock);
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index e74a62448ba4..e5db9a9954dc 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -1392,10 +1392,8 @@ static void qedi_free_nvm_iscsi_cfg(struct qedi_ctx *qedi)
 
 static int qedi_alloc_nvm_iscsi_cfg(struct qedi_ctx *qedi)
 {
-        struct qedi_nvm_iscsi_image nvm_image;
-
         qedi->iscsi_image = dma_alloc_coherent(&qedi->pdev->dev,
-                                               sizeof(nvm_image),
+                                               sizeof(struct qedi_nvm_iscsi_image),
                                                &qedi->nvm_buf_dma, GFP_KERNEL);
         if (!qedi->iscsi_image) {
                 QEDI_ERR(&qedi->dbg_ctx, "Could not allocate NVM BUF.\n");
@@ -2236,14 +2234,13 @@ static void qedi_boot_release(void *data)
 static int qedi_get_boot_info(struct qedi_ctx *qedi)
 {
         int ret = 1;
-        struct qedi_nvm_iscsi_image nvm_image;
 
         QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
                   "Get NVM iSCSI CFG image\n");
         ret = qedi_ops->common->nvm_get_image(qedi->cdev,
                                               QED_NVM_IMAGE_ISCSI_CFG,
                                               (char *)qedi->iscsi_image,
-                                              sizeof(nvm_image));
+                                              sizeof(struct qedi_nvm_iscsi_image));
         if (ret)
                 QEDI_ERR(&qedi->dbg_ctx,
                          "Could not get NVM image. ret = %d\n", ret);
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index c4cbfd07b916..a08ff3bd6310 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -238,6 +238,7 @@ static struct {
         {"NETAPP", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"LSI", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"ENGENIO", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"LENOVO", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"SMSC", "USB 2 HS-CF", NULL, BLIST_SPARSELUN | BLIST_INQUIRY_36},
         {"SONY", "CD-ROM CDU-8001", NULL, BLIST_BORKEN},
         {"SONY", "TSL", NULL, BLIST_FORCELUN},          /* DDS3 & DDS4 autoloaders */
diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c
index 5a58cbf3a75d..c14006ac98f9 100644
--- a/drivers/scsi/scsi_dh.c
+++ b/drivers/scsi/scsi_dh.c
@@ -75,6 +75,7 @@ static const struct scsi_dh_blist scsi_dh_blist[] = {
         {"NETAPP", "INF-01-00",         "rdac", },
         {"LSI", "INF-01-00",            "rdac", },
         {"ENGENIO", "INF-01-00",        "rdac", },
+        {"LENOVO", "DE_Series",         "rdac", },
         {NULL, NULL,                    NULL },
 };
 
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 84380bae20f1..8472de1007ff 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -385,7 +385,7 @@ enum storvsc_request_type {
  * This is the end of Protocol specific defines.
  */
 
-static int storvsc_ringbuffer_size = (256 * PAGE_SIZE);
+static int storvsc_ringbuffer_size = (128 * 1024);
 static u32 max_outstanding_req_per_channel;
 
 static int storvsc_vcpus_per_sub_channel = 4;
@@ -668,13 +668,22 @@ static void  handle_multichannel_storage(struct hv_device *device, int max_chns)
 {
         struct device *dev = &device->device;
         struct storvsc_device *stor_device;
-        int num_cpus = num_online_cpus();
         int num_sc;
         struct storvsc_cmd_request *request;
         struct vstor_packet *vstor_packet;
         int ret, t;
 
-        num_sc = ((max_chns > num_cpus) ? num_cpus : max_chns);
+        /*
+         * If the number of CPUs is artificially restricted, such as
+         * with maxcpus=1 on the kernel boot line, Hyper-V could offer
+         * sub-channels >= the number of CPUs. These sub-channels
+         * should not be created. The primary channel is already created
+         * and assigned to one CPU, so check against # CPUs - 1.
+         */
+        num_sc = min((int)(num_online_cpus() - 1), max_chns);
+        if (!num_sc)
+                return;
+
         stor_device = get_out_stor_device(device);
         if (!stor_device)
                 return;
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index a25659b5a5d1..3fa20e95a6bb 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -1661,11 +1661,11 @@ static void __init vfio_pci_fill_ids(void)
                 rc = pci_add_dynid(&vfio_pci_driver, vendor, device,
                                    subvendor, subdevice, class, class_mask, 0);
                 if (rc)
-                        pr_warn("failed to add dynamic id [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x (%d)\n",
+                        pr_warn("failed to add dynamic id [%04x:%04x[%04x:%04x]] class %#08x/%08x (%d)\n",
                                 vendor, device, subvendor, subdevice,
                                 class, class_mask, rc);
                 else
-                        pr_info("add [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x\n",
+                        pr_info("add [%04x:%04x[%04x:%04x]] class %#08x/%08x\n",
                                 vendor, device, subvendor, subdevice,
                                 class, class_mask);
         }
diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c
index 8dbb270998f4..6b64e45a5269 100644
--- a/drivers/vfio/vfio_iommu_spapr_tce.c
+++ b/drivers/vfio/vfio_iommu_spapr_tce.c
@@ -1398,7 +1398,7 @@ unlock_exit:
         mutex_unlock(&container->lock);
 }
 
-const struct vfio_iommu_driver_ops tce_iommu_driver_ops = {
+static const struct vfio_iommu_driver_ops tce_iommu_driver_ops = {
         .name           = "iommu-vfio-powerpc",
         .owner          = THIS_MODULE,
         .open           = tce_iommu_open,
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 73652e21efec..d0f731c9920a 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -58,12 +58,18 @@ module_param_named(disable_hugepages,
 MODULE_PARM_DESC(disable_hugepages,
                  "Disable VFIO IOMMU support for IOMMU hugepages.");
 
+static unsigned int dma_entry_limit __read_mostly = U16_MAX;
+module_param_named(dma_entry_limit, dma_entry_limit, uint, 0644);
+MODULE_PARM_DESC(dma_entry_limit,
+                 "Maximum number of user DMA mappings per container (65535).");
+
 struct vfio_iommu {
         struct list_head        domain_list;
         struct vfio_domain      *external_domain; /* domain for external user */
         struct mutex            lock;
         struct rb_root          dma_list;
         struct blocking_notifier_head notifier;
+        unsigned int            dma_avail;
         bool                    v2;
         bool                    nesting;
 };
@@ -836,6 +842,7 @@ static void vfio_remove_dma(struct vfio_iommu *iommu, struct vfio_dma *dma)
         vfio_unlink_dma(iommu, dma);
         put_task_struct(dma->task);
         kfree(dma);
+        iommu->dma_avail++;
 }
 
 static unsigned long vfio_pgsize_bitmap(struct vfio_iommu *iommu)
@@ -1081,12 +1088,18 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
                 goto out_unlock;
         }
 
+        if (!iommu->dma_avail) {
+                ret = -ENOSPC;
+                goto out_unlock;
+        }
+
         dma = kzalloc(sizeof(*dma), GFP_KERNEL);
         if (!dma) {
                 ret = -ENOMEM;
                 goto out_unlock;
         }
 
+        iommu->dma_avail--;
         dma->iova = iova;
         dma->vaddr = vaddr;
         dma->prot = prot;
@@ -1583,6 +1596,7 @@ static void *vfio_iommu_type1_open(unsigned long arg)
 
         INIT_LIST_HEAD(&iommu->domain_list);
         iommu->dma_list = RB_ROOT;
+        iommu->dma_avail = dma_entry_limit;
         mutex_init(&iommu->lock);
         BLOCKING_INIT_NOTIFIER_HEAD(&iommu->notifier);
 
diff --git a/drivers/xen/privcmd-buf.c b/drivers/xen/privcmd-buf.c
index de01a6d0059d..a1c61e351d3f 100644
--- a/drivers/xen/privcmd-buf.c
+++ b/drivers/xen/privcmd-buf.c
@@ -140,8 +140,7 @@ static int privcmd_buf_mmap(struct file *file, struct vm_area_struct *vma)
         if (!(vma->vm_flags & VM_SHARED))
                 return -EINVAL;
 
-        vma_priv = kzalloc(sizeof(*vma_priv) + count * sizeof(void *),
-                           GFP_KERNEL);
+        vma_priv = kzalloc(struct_size(vma_priv, pages, count), GFP_KERNEL);
         if (!vma_priv)
                 return -ENOMEM;
 
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index c3e201025ef0..0782ff3c2273 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -622,9 +622,7 @@ static int xenbus_file_open(struct inode *inode, struct file *filp)
         if (xen_store_evtchn == 0)
                 return -ENOENT;
 
-        nonseekable_open(inode, filp);
-
-        filp->f_mode &= ~FMODE_ATOMIC_POS; /* cdev-style semantics */
+        stream_open(inode, filp);
 
         u = kzalloc(sizeof(*u), GFP_KERNEL);
         if (u == NULL)
diff --git a/fs/aio.c b/fs/aio.c
index a4cc2a1cccb7..3490d1fa0e16 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1034,7 +1034,7 @@ static inline struct aio_kiocb *aio_get_req(struct kioctx *ctx)
                 return NULL;
 
         if (unlikely(!get_reqs_available(ctx))) {
-                kfree(req);
+                kmem_cache_free(kiocb_cachep, req);
                 return NULL;
         }
 
@@ -1794,7 +1794,7 @@ static int __io_submit_one(struct kioctx *ctx, const struct iocb *iocb,
                  */
                 eventfd = eventfd_ctx_fdget(iocb->aio_resfd);
                 if (IS_ERR(eventfd))
-                        return PTR_ERR(req->ki_eventfd);
+                        return PTR_ERR(eventfd);
 
                 req->ki_eventfd = eventfd;
         }
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index f9b71c12cc9f..a05bf1d6e1d0 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -559,6 +559,8 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
                         tcon->ses->server->echo_interval / HZ);
         if (tcon->snapshot_time)
                 seq_printf(s, ",snapshot=%llu", tcon->snapshot_time);
+        if (tcon->handle_timeout)
+                seq_printf(s, ",handletimeout=%u", tcon->handle_timeout);
         /* convert actimeo and display it in seconds */
         seq_printf(s, ",actimeo=%lu", cifs_sb->actimeo / HZ);
 
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 38feae812b47..5b18d4585740 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -60,6 +60,12 @@
 #define CIFS_MAX_ACTIMEO (1 << 30)
 
 /*
+ * Max persistent and resilient handle timeout (milliseconds).
+ * Windows durable max was 960000 (16 minutes)
+ */
+#define SMB3_MAX_HANDLE_TIMEOUT 960000
+
+/*
  * MAX_REQ is the maximum number of requests that WE will send
  * on one socket concurrently.
  */
@@ -586,6 +592,7 @@ struct smb_vol {
         struct nls_table *local_nls;
         unsigned int echo_interval; /* echo interval in secs */
         __u64 snapshot_time; /* needed for timewarp tokens */
+        __u32 handle_timeout; /* persistent and durable handle timeout in ms */
         unsigned int max_credits; /* smb3 max_credits 10 < credits < 60000 */
 };
 
@@ -1058,6 +1065,7 @@ struct cifs_tcon {
         __u32 vol_serial_number;
         __le64 vol_create_time;
         __u64 snapshot_time; /* for timewarp tokens - timestamp of snapshot */
+        __u32 handle_timeout; /* persistent and durable handle timeout in ms */
         __u32 ss_flags;         /* sector size flags */
         __u32 perf_sector_size; /* best sector size for perf */
         __u32 max_chunks;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index a8e9738db691..4c0e44489f21 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -103,7 +103,7 @@ enum {
         Opt_cruid, Opt_gid, Opt_file_mode,
         Opt_dirmode, Opt_port,
         Opt_blocksize, Opt_rsize, Opt_wsize, Opt_actimeo,
-        Opt_echo_interval, Opt_max_credits,
+        Opt_echo_interval, Opt_max_credits, Opt_handletimeout,
         Opt_snapshot,
 
         /* Mount options which take string value */
@@ -208,6 +208,7 @@ static const match_table_t cifs_mount_option_tokens = {
         { Opt_rsize, "rsize=%s" },
         { Opt_wsize, "wsize=%s" },
         { Opt_actimeo, "actimeo=%s" },
+        { Opt_handletimeout, "handletimeout=%s" },
         { Opt_echo_interval, "echo_interval=%s" },
         { Opt_max_credits, "max_credits=%s" },
         { Opt_snapshot, "snapshot=%s" },
@@ -1619,6 +1620,9 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
 
         vol->actimeo = CIFS_DEF_ACTIMEO;
 
+        /* Most clients set timeout to 0, allows server to use its default */
+        vol->handle_timeout = 0; /* See MS-SMB2 spec section 2.2.14.2.12 */
+
         /* offer SMB2.1 and later (SMB3 etc). Secure and widely accepted */
         vol->ops = &smb30_operations;
         vol->vals = &smbdefault_values;
@@ -2017,6 +2021,18 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                                 goto cifs_parse_mount_err;
                         }
                         break;
+                case Opt_handletimeout:
+                        if (get_option_ul(args, &option)) {
+                                cifs_dbg(VFS, "%s: Invalid handletimeout value\n",
+                                         __func__);
+                                goto cifs_parse_mount_err;
+                        }
+                        vol->handle_timeout = option;
+                        if (vol->handle_timeout > SMB3_MAX_HANDLE_TIMEOUT) {
+                                cifs_dbg(VFS, "Invalid handle cache timeout, longer than 16 minutes\n");
+                                goto cifs_parse_mount_err;
+                        }
+                        break;
                 case Opt_echo_interval:
                         if (get_option_ul(args, &option)) {
                                 cifs_dbg(VFS, "%s: Invalid echo interval value\n",
@@ -3183,6 +3199,8 @@ static int match_tcon(struct cifs_tcon *tcon, struct smb_vol *volume_info)
                 return 0;
         if (tcon->snapshot_time != volume_info->snapshot_time)
                 return 0;
+        if (tcon->handle_timeout != volume_info->handle_timeout)
+                return 0;
         return 1;
 }
 
@@ -3297,6 +3315,16 @@ cifs_get_tcon(struct cifs_ses *ses, struct smb_vol *volume_info)
                         tcon->snapshot_time = volume_info->snapshot_time;
         }
 
+        if (volume_info->handle_timeout) {
+                if (ses->server->vals->protocol_id == 0) {
+                        cifs_dbg(VFS,
+                             "Use SMB2.1 or later for handle timeout option\n");
+                        rc = -EOPNOTSUPP;
+                        goto out_fail;
+                } else
+                        tcon->handle_timeout = volume_info->handle_timeout;
+        }
+
         tcon->ses = ses;
         if (volume_info->password) {
                 tcon->password = kstrdup(volume_info->password, GFP_KERNEL);
diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
index b204e84b87fb..54bffb2a1786 100644
--- a/fs/cifs/smb2file.c
+++ b/fs/cifs/smb2file.c
@@ -68,13 +68,15 @@ smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms,
 
 
          if (oparms->tcon->use_resilient) {
-                nr_ioctl_req.Timeout = 0; /* use server default (120 seconds) */
+                /* default timeout is 0, servers pick default (120 seconds) */
+                nr_ioctl_req.Timeout =
+                        cpu_to_le32(oparms->tcon->handle_timeout);
                 nr_ioctl_req.Reserved = 0;
                 rc = SMB2_ioctl(xid, oparms->tcon, fid->persistent_fid,
                         fid->volatile_fid, FSCTL_LMR_REQUEST_RESILIENCY,
                         true /* is_fsctl */,
                         (char *)&nr_ioctl_req, sizeof(nr_ioctl_req),
-                        NULL, NULL /* no return info */);
+                        CIFSMaxBufSize, NULL, NULL /* no return info */);
                 if (rc == -EOPNOTSUPP) {
                         cifs_dbg(VFS,
                              "resiliency not supported by server, disabling\n");
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 1022a3771e14..00225e699d03 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -581,7 +581,7 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon)
         rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
                         FSCTL_QUERY_NETWORK_INTERFACE_INFO, true /* is_fsctl */,
                         NULL /* no data input */, 0 /* no data input */,
-                        (char **)&out_buf, &ret_data_len);
+                        CIFSMaxBufSize, (char **)&out_buf, &ret_data_len);
         if (rc == -EOPNOTSUPP) {
                 cifs_dbg(FYI,
                          "server does not support query network interfaces\n");
@@ -717,32 +717,28 @@ int open_shroot(unsigned int xid, struct cifs_tcon *tcon, struct cifs_fid *pfid)
         oparms.fid->mid = le64_to_cpu(o_rsp->sync_hdr.MessageId);
 #endif /* CIFS_DEBUG2 */
 
-        if (o_rsp->OplockLevel == SMB2_OPLOCK_LEVEL_LEASE)
-                oplock = smb2_parse_lease_state(server, o_rsp,
-                                                &oparms.fid->epoch,
-                                                oparms.fid->lease_key);
-        else
-                goto oshr_exit;
-
-
         memcpy(tcon->crfid.fid, pfid, sizeof(struct cifs_fid));
         tcon->crfid.tcon = tcon;
         tcon->crfid.is_valid = true;
         kref_init(&tcon->crfid.refcount);
-        kref_get(&tcon->crfid.refcount);
 
+        if (o_rsp->OplockLevel == SMB2_OPLOCK_LEVEL_LEASE) {
+                kref_get(&tcon->crfid.refcount);
+                oplock = smb2_parse_lease_state(server, o_rsp,
+                                                &oparms.fid->epoch,
+                                                oparms.fid->lease_key);
+        } else
+                goto oshr_exit;
 
         qi_rsp = (struct smb2_query_info_rsp *)rsp_iov[1].iov_base;
         if (le32_to_cpu(qi_rsp->OutputBufferLength) < sizeof(struct smb2_file_all_info))
                 goto oshr_exit;
-        rc = smb2_validate_and_copy_iov(
+        if (!smb2_validate_and_copy_iov(
                                 le16_to_cpu(qi_rsp->OutputBufferOffset),
                                 sizeof(struct smb2_file_all_info),
                                 &rsp_iov[1], sizeof(struct smb2_file_all_info),
-                                (char *)&tcon->crfid.file_all_info);
-        if (rc)
-                goto oshr_exit;
-        tcon->crfid.file_all_info_is_valid = 1;
+                                (char *)&tcon->crfid.file_all_info))
+                tcon->crfid.file_all_info_is_valid = 1;
 
  oshr_exit:
         mutex_unlock(&tcon->crfid.fid_mutex);
@@ -1299,7 +1295,7 @@ SMB2_request_res_key(const unsigned int xid, struct cifs_tcon *tcon,
 
         rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid,
                         FSCTL_SRV_REQUEST_RESUME_KEY, true /* is_fsctl */,
-                        NULL, 0 /* no input */,
+                        NULL, 0 /* no input */, CIFSMaxBufSize,
                         (char **)&res_key, &ret_data_len);
 
         if (rc) {
@@ -1404,7 +1400,7 @@ smb2_ioctl_query_info(const unsigned int xid,
                         rc = SMB2_ioctl_init(tcon, &rqst[1],
                                              COMPOUND_FID, COMPOUND_FID,
                                              qi.info_type, true, NULL,
-                                             0);
+                                             0, CIFSMaxBufSize);
                 }
         } else if (qi.flags == PASSTHRU_QUERY_INFO) {
                 memset(&qi_iov, 0, sizeof(qi_iov));
@@ -1532,8 +1528,8 @@ smb2_copychunk_range(const unsigned int xid,
                 rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid,
                         trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE,
                         true /* is_fsctl */, (char *)pcchunk,
-                        sizeof(struct copychunk_ioctl), (char **)&retbuf,
-                        &ret_data_len);
+                        sizeof(struct copychunk_ioctl), CIFSMaxBufSize,
+                        (char **)&retbuf, &ret_data_len);
                 if (rc == 0) {
                         if (ret_data_len !=
                                         sizeof(struct copychunk_ioctl_rsp)) {
@@ -1693,7 +1689,7 @@ static bool smb2_set_sparse(const unsigned int xid, struct cifs_tcon *tcon,
         rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
                         cfile->fid.volatile_fid, FSCTL_SET_SPARSE,
                         true /* is_fctl */,
-                        &setsparse, 1, NULL, NULL);
+                        &setsparse, 1, CIFSMaxBufSize, NULL, NULL);
         if (rc) {
                 tcon->broken_sparse_sup = true;
                 cifs_dbg(FYI, "set sparse rc = %d\n", rc);
@@ -1766,7 +1762,7 @@ smb2_duplicate_extents(const unsigned int xid,
                         true /* is_fsctl */,
                         (char *)&dup_ext_buf,
                         sizeof(struct duplicate_extents_to_file),
-                        NULL,
+                        CIFSMaxBufSize, NULL,
                         &ret_data_len);
 
         if (ret_data_len > 0)
@@ -1801,7 +1797,7 @@ smb3_set_integrity(const unsigned int xid, struct cifs_tcon *tcon,
                         true /* is_fsctl */,
                         (char *)&integr_info,
                         sizeof(struct fsctl_set_integrity_information_req),
-                        NULL,
+                        CIFSMaxBufSize, NULL,
                         &ret_data_len);
 
 }
@@ -1809,6 +1805,8 @@ smb3_set_integrity(const unsigned int xid, struct cifs_tcon *tcon,
 /* GMT Token is @GMT-YYYY.MM.DD-HH.MM.SS Unicode which is 48 bytes + null */
 #define GMT_TOKEN_SIZE 50
 
+#define MIN_SNAPSHOT_ARRAY_SIZE 16 /* See MS-SMB2 section 3.3.5.15.1 */
+
 /*
  * Input buffer contains (empty) struct smb_snapshot array with size filled in
  * For output see struct SRV_SNAPSHOT_ARRAY in MS-SMB2 section 2.2.32.2
@@ -1820,13 +1818,29 @@ smb3_enum_snapshots(const unsigned int xid, struct cifs_tcon *tcon,
         char *retbuf = NULL;
         unsigned int ret_data_len = 0;
         int rc;
+        u32 max_response_size;
         struct smb_snapshot_array snapshot_in;
 
+        if (get_user(ret_data_len, (unsigned int __user *)ioc_buf))
+                return -EFAULT;
+
+        /*
+         * Note that for snapshot queries that servers like Azure expect that
+         * the first query be minimal size (and just used to get the number/size
+         * of previous versions) so response size must be specified as EXACTLY
+         * sizeof(struct snapshot_array) which is 16 when rounded up to multiple
+         * of eight bytes.
+         */
+        if (ret_data_len == 0)
+                max_response_size = MIN_SNAPSHOT_ARRAY_SIZE;
+        else
+                max_response_size = CIFSMaxBufSize;
+
         rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
                         cfile->fid.volatile_fid,
                         FSCTL_SRV_ENUMERATE_SNAPSHOTS,
                         true /* is_fsctl */,
-                        NULL, 0 /* no input data */,
+                        NULL, 0 /* no input data */, max_response_size,
                         (char **)&retbuf,
                         &ret_data_len);
         cifs_dbg(FYI, "enum snaphots ioctl returned %d and ret buflen is %d\n",
@@ -2304,7 +2318,7 @@ smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses,
                 rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
                                 FSCTL_DFS_GET_REFERRALS,
                                 true /* is_fsctl */,
-                                (char *)dfs_req, dfs_req_size,
+                                (char *)dfs_req, dfs_req_size, CIFSMaxBufSize,
                                 (char **)&dfs_rsp, &dfs_rsp_size);
         } while (rc == -EAGAIN);
 
@@ -2658,7 +2672,8 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon,
         rc = SMB2_ioctl_init(tcon, &rqst[num++], cfile->fid.persistent_fid,
                              cfile->fid.volatile_fid, FSCTL_SET_ZERO_DATA,
                              true /* is_fctl */, (char *)&fsctl_buf,
-                             sizeof(struct file_zero_data_information));
+                             sizeof(struct file_zero_data_information),
+                             CIFSMaxBufSize);
         if (rc)
                 goto zero_range_exit;
 
@@ -2735,7 +2750,8 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon,
         rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
                         cfile->fid.volatile_fid, FSCTL_SET_ZERO_DATA,
                         true /* is_fctl */, (char *)&fsctl_buf,
-                        sizeof(struct file_zero_data_information), NULL, NULL);
+                        sizeof(struct file_zero_data_information),
+                        CIFSMaxBufSize, NULL, NULL);
         free_xid(xid);
         return rc;
 }
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 21ac19ff19cb..21ad01d55ab2 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1002,7 +1002,8 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
 
         rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
                 FSCTL_VALIDATE_NEGOTIATE_INFO, true /* is_fsctl */,
-                (char *)pneg_inbuf, inbuflen, (char **)&pneg_rsp, &rsplen);
+                (char *)pneg_inbuf, inbuflen, CIFSMaxBufSize,
+                (char **)&pneg_rsp, &rsplen);
         if (rc == -EOPNOTSUPP) {
                 /*
                  * Old Windows versions or Netapp SMB server can return
@@ -1858,8 +1859,9 @@ add_lease_context(struct TCP_Server_Info *server, struct kvec *iov,
 }
 
 static struct create_durable_v2 *
-create_durable_v2_buf(struct cifs_fid *pfid)
+create_durable_v2_buf(struct cifs_open_parms *oparms)
 {
+        struct cifs_fid *pfid = oparms->fid;
         struct create_durable_v2 *buf;
 
         buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL);
@@ -1873,7 +1875,14 @@ create_durable_v2_buf(struct cifs_fid *pfid)
                                 (struct create_durable_v2, Name));
         buf->ccontext.NameLength = cpu_to_le16(4);
 
-        buf->dcontext.Timeout = 0; /* Should this be configurable by workload */
+        /*
+         * NB: Handle timeout defaults to 0, which allows server to choose
+         * (most servers default to 120 seconds) and most clients default to 0.
+         * This can be overridden at mount ("handletimeout=") if the user wants
+         * a different persistent (or resilient) handle timeout for all opens
+         * opens on a particular SMB3 mount.
+         */
+        buf->dcontext.Timeout = cpu_to_le32(oparms->tcon->handle_timeout);
         buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
         generate_random_uuid(buf->dcontext.CreateGuid);
         memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16);
@@ -1926,7 +1935,7 @@ add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec,
         struct smb2_create_req *req = iov[0].iov_base;
         unsigned int num = *num_iovec;
 
-        iov[num].iov_base = create_durable_v2_buf(oparms->fid);
+        iov[num].iov_base = create_durable_v2_buf(oparms);
         if (iov[num].iov_base == NULL)
                 return -ENOMEM;
         iov[num].iov_len = sizeof(struct create_durable_v2);
@@ -2478,7 +2487,8 @@ creat_exit:
 int
 SMB2_ioctl_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
                 u64 persistent_fid, u64 volatile_fid, u32 opcode,
-                bool is_fsctl, char *in_data, u32 indatalen)
+                bool is_fsctl, char *in_data, u32 indatalen,
+                __u32 max_response_size)
 {
         struct smb2_ioctl_req *req;
         struct kvec *iov = rqst->rq_iov;
@@ -2520,16 +2530,21 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
         req->OutputCount = 0; /* MBZ */
 
         /*
-         * Could increase MaxOutputResponse, but that would require more
-         * than one credit. Windows typically sets this smaller, but for some
+         * In most cases max_response_size is set to 16K (CIFSMaxBufSize)
+         * We Could increase default MaxOutputResponse, but that could require
+         * more credits. Windows typically sets this smaller, but for some
          * ioctls it may be useful to allow server to send more. No point
          * limiting what the server can send as long as fits in one credit
-         * Unfortunately - we can not handle more than CIFS_MAX_MSG_SIZE
-         * (by default, note that it can be overridden to make max larger)
-         * in responses (except for read responses which can be bigger.
-         * We may want to bump this limit up
+         * We can not handle more than CIFS_MAX_BUF_SIZE yet but may want
+         * to increase this limit up in the future.
+         * Note that for snapshot queries that servers like Azure expect that
+         * the first query be minimal size (and just used to get the number/size
+         * of previous versions) so response size must be specified as EXACTLY
+         * sizeof(struct snapshot_array) which is 16 when rounded up to multiple
+         * of eight bytes.  Currently that is the only case where we set max
+         * response size smaller.
          */
-        req->MaxOutputResponse = cpu_to_le32(CIFSMaxBufSize);
+        req->MaxOutputResponse = cpu_to_le32(max_response_size);
 
         if (is_fsctl)
                 req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL);
@@ -2550,13 +2565,14 @@ SMB2_ioctl_free(struct smb_rqst *rqst)
                 cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
 }
 
+
 /*
  *      SMB2 IOCTL is used for both IOCTLs and FSCTLs
  */
 int
 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
            u64 volatile_fid, u32 opcode, bool is_fsctl,
-           char *in_data, u32 indatalen,
+           char *in_data, u32 indatalen, u32 max_out_data_len,
            char **out_data, u32 *plen /* returned data len */)
 {
         struct smb_rqst rqst;
@@ -2593,8 +2609,8 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
         rqst.rq_iov = iov;
         rqst.rq_nvec = SMB2_IOCTL_IOV_SIZE;
 
-        rc = SMB2_ioctl_init(tcon, &rqst, persistent_fid, volatile_fid,
-                             opcode, is_fsctl, in_data, indatalen);
+        rc = SMB2_ioctl_init(tcon, &rqst, persistent_fid, volatile_fid, opcode,
+                             is_fsctl, in_data, indatalen, max_out_data_len);
         if (rc)
                 goto ioctl_exit;
 
@@ -2672,7 +2688,8 @@ SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon,
         rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid,
                         FSCTL_SET_COMPRESSION, true /* is_fsctl */,
                         (char *)&fsctl_input /* data input */,
-                        2 /* in data len */, &ret_data /* out data */, NULL);
+                        2 /* in data len */, CIFSMaxBufSize /* max out data */,
+                        &ret_data /* out data */, NULL);
 
         cifs_dbg(FYI, "set compression rc %d\n", rc);
 
diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
index 3c32d0cfea69..52df125e9189 100644
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -142,11 +142,12 @@ extern int SMB2_open_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
 extern void SMB2_open_free(struct smb_rqst *rqst);
 extern int SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon,
                      u64 persistent_fid, u64 volatile_fid, u32 opcode,
-                     bool is_fsctl, char *in_data, u32 indatalen,
+                     bool is_fsctl, char *in_data, u32 indatalen, u32 maxoutlen,
                      char **out_data, u32 *plen /* returned data len */);
 extern int SMB2_ioctl_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
                            u64 persistent_fid, u64 volatile_fid, u32 opcode,
-                           bool is_fsctl, char *in_data, u32 indatalen);
+                           bool is_fsctl, char *in_data, u32 indatalen,
+                           __u32 max_response_size);
 extern void SMB2_ioctl_free(struct smb_rqst *rqst);
 extern int SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
                       u64 persistent_file_id, u64 volatile_file_id);
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index ec32fece5e1e..9285dd4f4b1c 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -755,11 +755,17 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
                                         umode_t mode, dev_t dev)
 {
         struct inode *inode;
-        struct resv_map *resv_map;
+        struct resv_map *resv_map = NULL;
 
-        resv_map = resv_map_alloc();
-        if (!resv_map)
-                return NULL;
+        /*
+         * Reserve maps are only needed for inodes that can have associated
+         * page allocations.
+         */
+        if (S_ISREG(mode) || S_ISLNK(mode)) {
+                resv_map = resv_map_alloc();
+                if (!resv_map)
+                        return NULL;
+        }
 
         inode = new_inode(sb);
         if (inode) {
@@ -794,8 +800,10 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
                         break;
                 }
                 lockdep_annotate_inode_mutex_key(inode);
-        } else
-                kref_put(&resv_map->refs, resv_map_release);
+        } else {
+                if (resv_map)
+                        kref_put(&resv_map->refs, resv_map_release);
+        }
 
         return inode;
 }
diff --git a/fs/io_uring.c b/fs/io_uring.c
index bbdbd56cf2ac..07d6ef195d05 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2215,6 +2215,7 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
                         fput(ctx->user_files[i]);
 
                 kfree(ctx->user_files);
+                ctx->user_files = NULL;
                 ctx->nr_user_files = 0;
                 return ret;
         }
diff --git a/fs/open.c b/fs/open.c
index f1c2f855fd43..a00350018a47 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -1215,3 +1215,21 @@ int nonseekable_open(struct inode *inode, struct file *filp)
 }
 
 EXPORT_SYMBOL(nonseekable_open);
+
+/*
+ * stream_open is used by subsystems that want stream-like file descriptors.
+ * Such file descriptors are not seekable and don't have notion of position
+ * (file.f_pos is always 0). Contrary to file descriptors of other regular
+ * files, .read() and .write() can run simultaneously.
+ *
+ * stream_open never fails and is marked to return int so that it could be
+ * directly used as file_operations.open .
+ */
+int stream_open(struct inode *inode, struct file *filp)
+{
+        filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE | FMODE_ATOMIC_POS);
+        filp->f_mode |= FMODE_STREAM;
+        return 0;
+}
+
+EXPORT_SYMBOL(stream_open);
diff --git a/fs/proc/base.c b/fs/proc/base.c
index ddef482f1334..6a803a0b75df 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -616,24 +616,25 @@ static int proc_pid_limits(struct seq_file *m, struct pid_namespace *ns,
 static int proc_pid_syscall(struct seq_file *m, struct pid_namespace *ns,
                             struct pid *pid, struct task_struct *task)
 {
-        long nr;
-        unsigned long args[6], sp, pc;
+        struct syscall_info info;
+        u64 *args = &info.data.args[0];
         int res;
 
         res = lock_trace(task);
         if (res)
                 return res;
 
-        if (task_current_syscall(task, &nr, args, 6, &sp, &pc))
+        if (task_current_syscall(task, &info))
                 seq_puts(m, "running\n");
-        else if (nr < 0)
-                seq_printf(m, "%ld 0x%lx 0x%lx\n", nr, sp, pc);
+        else if (info.data.nr < 0)
+                seq_printf(m, "%d 0x%llx 0x%llx\n",
+                           info.data.nr, info.sp, info.data.instruction_pointer);
         else
                 seq_printf(m,
-                       "%ld 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx\n",
-                       nr,
+                       "%d 0x%llx 0x%llx 0x%llx 0x%llx 0x%llx 0x%llx 0x%llx 0x%llx\n",
+                       info.data.nr,
                        args[0], args[1], args[2], args[3], args[4], args[5],
-                       sp, pc);
+                       info.sp, info.data.instruction_pointer);
         unlock_trace(task);
 
         return 0;
diff --git a/fs/read_write.c b/fs/read_write.c
index 177ccc3d405a..61b43ad7608e 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -560,12 +560,13 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_
 
 static inline loff_t file_pos_read(struct file *file)
 {
-        return file->f_pos;
+        return file->f_mode & FMODE_STREAM ? 0 : file->f_pos;
 }
 
 static inline void file_pos_write(struct file *file, loff_t pos)
 {
-        file->f_pos = pos;
+        if ((file->f_mode & FMODE_STREAM) == 0)
+                file->f_pos = pos;
 }
 
 ssize_t ksys_read(unsigned int fd, char __user *buf, size_t count)
diff --git a/include/asm-generic/syscall.h b/include/asm-generic/syscall.h
index 0c938a4354f6..b88239e9efe4 100644
--- a/include/asm-generic/syscall.h
+++ b/include/asm-generic/syscall.h
@@ -105,41 +105,30 @@ void syscall_set_return_value(struct task_struct *task, struct pt_regs *regs,
  * syscall_get_arguments - extract system call parameter values
  * @task:       task of interest, must be blocked
  * @regs:       task_pt_regs() of @task
- * @i:          argument index [0,5]
- * @n:          number of arguments; n+i must be [1,6].
  * @args:       array filled with argument values
  *
- * Fetches @n arguments to the system call starting with the @i'th argument
- * (from 0 through 5).  Argument @i is stored in @args[0], and so on.
- * An arch inline version is probably optimal when @i and @n are constants.
+ * Fetches 6 arguments to the system call.  First argument is stored in
+*  @args[0], and so on.
  *
  * It's only valid to call this when @task is stopped for tracing on
  * entry to a system call, due to %TIF_SYSCALL_TRACE or %TIF_SYSCALL_AUDIT.
- * It's invalid to call this with @i + @n > 6; we only support system calls
- * taking up to 6 arguments.
  */
 void syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
-                           unsigned int i, unsigned int n, unsigned long *args);
+                           unsigned long *args);
 
 /**
  * syscall_set_arguments - change system call parameter value
  * @task:       task of interest, must be in system call entry tracing
  * @regs:       task_pt_regs() of @task
- * @i:          argument index [0,5]
- * @n:          number of arguments; n+i must be [1,6].
  * @args:       array of argument values to store
  *
- * Changes @n arguments to the system call starting with the @i'th argument.
- * Argument @i gets value @args[0], and so on.
- * An arch inline version is probably optimal when @i and @n are constants.
+ * Changes 6 arguments to the system call.
+ * The first argument gets value @args[0], and so on.
  *
  * It's only valid to call this when @task is stopped for tracing on
  * entry to a system call, due to %TIF_SYSCALL_TRACE or %TIF_SYSCALL_AUDIT.
- * It's invalid to call this with @i + @n > 6; we only support system calls
- * taking up to 6 arguments.
  */
 void syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
-                           unsigned int i, unsigned int n,
                            const unsigned long *args);
 
 /**
diff --git a/include/dt-bindings/reset/amlogic,meson-g12a-reset.h b/include/dt-bindings/reset/amlogic,meson-g12a-reset.h
index 8063e8314eef..6d487c5eba2c 100644
--- a/include/dt-bindings/reset/amlogic,meson-g12a-reset.h
+++ b/include/dt-bindings/reset/amlogic,meson-g12a-reset.h
@@ -51,7 +51,10 @@
 #define RESET_SD_EMMC_A                 44
 #define RESET_SD_EMMC_B                 45
 #define RESET_SD_EMMC_C                 46
-/*                                      47-60 */
+/*                                      47      */
+#define RESET_USB_PHY20                 48
+#define RESET_USB_PHY21                 49
+/*                                      50-60   */
 #define RESET_AUDIO_CODEC               61
 /*                                      62-63   */
 /*      RESET2                                  */
diff --git a/include/keys/trusted.h b/include/keys/trusted.h
index adbcb6817826..0071298b9b28 100644
--- a/include/keys/trusted.h
+++ b/include/keys/trusted.h
@@ -38,7 +38,7 @@ enum {
 
 int TSS_authhmac(unsigned char *digest, const unsigned char *key,
                         unsigned int keylen, unsigned char *h1,
-                        unsigned char *h2, unsigned char h3, ...);
+                        unsigned char *h2, unsigned int h3, ...);
 int TSS_checkhmac1(unsigned char *buffer,
                           const uint32_t command,
                           const unsigned char *ononce,
diff --git a/include/linux/bitrev.h b/include/linux/bitrev.h
index 50fb0dee23e8..d35b8ec1c485 100644
--- a/include/linux/bitrev.h
+++ b/include/linux/bitrev.h
@@ -34,41 +34,41 @@ static inline u32 __bitrev32(u32 x)
 
 #define __constant_bitrev32(x)  \
 ({                                      \
-        u32 __x = x;                    \
-        __x = (__x >> 16) | (__x << 16);        \
-        __x = ((__x & (u32)0xFF00FF00UL) >> 8) | ((__x & (u32)0x00FF00FFUL) << 8);      \
-        __x = ((__x & (u32)0xF0F0F0F0UL) >> 4) | ((__x & (u32)0x0F0F0F0FUL) << 4);      \
-        __x = ((__x & (u32)0xCCCCCCCCUL) >> 2) | ((__x & (u32)0x33333333UL) << 2);      \
-        __x = ((__x & (u32)0xAAAAAAAAUL) >> 1) | ((__x & (u32)0x55555555UL) << 1);      \
-        __x;                                                            \
+        u32 ___x = x;                   \
+        ___x = (___x >> 16) | (___x << 16);     \
+        ___x = ((___x & (u32)0xFF00FF00UL) >> 8) | ((___x & (u32)0x00FF00FFUL) << 8);   \
+        ___x = ((___x & (u32)0xF0F0F0F0UL) >> 4) | ((___x & (u32)0x0F0F0F0FUL) << 4);   \
+        ___x = ((___x & (u32)0xCCCCCCCCUL) >> 2) | ((___x & (u32)0x33333333UL) << 2);   \
+        ___x = ((___x & (u32)0xAAAAAAAAUL) >> 1) | ((___x & (u32)0x55555555UL) << 1);   \
+        ___x;                                                           \
 })
 
 #define __constant_bitrev16(x)  \
 ({                                      \
-        u16 __x = x;                    \
-        __x = (__x >> 8) | (__x << 8);  \
-        __x = ((__x & (u16)0xF0F0U) >> 4) | ((__x & (u16)0x0F0FU) << 4);        \
-        __x = ((__x & (u16)0xCCCCU) >> 2) | ((__x & (u16)0x3333U) << 2);        \
-        __x = ((__x & (u16)0xAAAAU) >> 1) | ((__x & (u16)0x5555U) << 1);        \
-        __x;                                                            \
+        u16 ___x = x;                   \
+        ___x = (___x >> 8) | (___x << 8);       \
+        ___x = ((___x & (u16)0xF0F0U) >> 4) | ((___x & (u16)0x0F0FU) << 4);     \
+        ___x = ((___x & (u16)0xCCCCU) >> 2) | ((___x & (u16)0x3333U) << 2);     \
+        ___x = ((___x & (u16)0xAAAAU) >> 1) | ((___x & (u16)0x5555U) << 1);     \
+        ___x;                                                           \
 })
 
 #define __constant_bitrev8x4(x) \
 ({                      \
-        u32 __x = x;    \
-        __x = ((__x & (u32)0xF0F0F0F0UL) >> 4) | ((__x & (u32)0x0F0F0F0FUL) << 4);      \
-        __x = ((__x & (u32)0xCCCCCCCCUL) >> 2) | ((__x & (u32)0x33333333UL) << 2);      \
-        __x = ((__x & (u32)0xAAAAAAAAUL) >> 1) | ((__x & (u32)0x55555555UL) << 1);      \
-        __x;                                                            \
+        u32 ___x = x;   \
+        ___x = ((___x & (u32)0xF0F0F0F0UL) >> 4) | ((___x & (u32)0x0F0F0F0FUL) << 4);   \
+        ___x = ((___x & (u32)0xCCCCCCCCUL) >> 2) | ((___x & (u32)0x33333333UL) << 2);   \
+        ___x = ((___x & (u32)0xAAAAAAAAUL) >> 1) | ((___x & (u32)0x55555555UL) << 1);   \
+        ___x;                                                           \
 })
 
 #define __constant_bitrev8(x)   \
 ({                                      \
-        u8 __x = x;                     \
-        __x = (__x >> 4) | (__x << 4);  \
-        __x = ((__x & (u8)0xCCU) >> 2) | ((__x & (u8)0x33U) << 2);      \
-        __x = ((__x & (u8)0xAAU) >> 1) | ((__x & (u8)0x55U) << 1);      \
-        __x;                                                            \
+        u8 ___x = x;                    \
+        ___x = (___x >> 4) | (___x << 4);       \
+        ___x = ((___x & (u8)0xCCU) >> 2) | ((___x & (u8)0x33U) << 2);   \
+        ___x = ((___x & (u8)0xAAU) >> 1) | ((___x & (u8)0x55U) << 1);   \
+        ___x;                                                           \
 })
 
 #define bitrev32(x) \
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 8b42df09b04c..dd28e7679089 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -158,6 +158,9 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
 #define FMODE_OPENED            ((__force fmode_t)0x80000)
 #define FMODE_CREATED           ((__force fmode_t)0x100000)
 
+/* File is stream-like */
+#define FMODE_STREAM            ((__force fmode_t)0x200000)
+
 /* File was opened by fanotify and shouldn't generate fanotify events */
 #define FMODE_NONOTIFY          ((__force fmode_t)0x4000000)
 
@@ -3074,6 +3077,7 @@ extern loff_t no_seek_end_llseek_size(struct file *, loff_t, int, loff_t);
 extern loff_t no_seek_end_llseek(struct file *, loff_t, int);
 extern int generic_file_open(struct inode * inode, struct file * filp);
 extern int nonseekable_open(struct inode * inode, struct file * filp);
+extern int stream_open(struct inode * inode, struct file * filp);
 
 #ifdef CONFIG_BLOCK
 typedef void (dio_submit_t)(struct bio *bio, struct inode *inode,
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 1f3d880b7ca1..dbb6118370c1 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -566,7 +566,10 @@ struct mem_cgroup *lock_page_memcg(struct page *page);
 void __unlock_page_memcg(struct mem_cgroup *memcg);
 void unlock_page_memcg(struct page *page);
 
-/* idx can be of type enum memcg_stat_item or node_stat_item */
+/*
+ * idx can be of type enum memcg_stat_item or node_stat_item.
+ * Keep in sync with memcg_exact_page_state().
+ */
 static inline unsigned long memcg_page_state(struct mem_cgroup *memcg,
                                              int idx)
 {
diff --git a/include/linux/mii.h b/include/linux/mii.h
index 6fee8b1a4400..5cd824c1c0ca 100644
--- a/include/linux/mii.h
+++ b/include/linux/mii.h
@@ -469,7 +469,7 @@ static inline u32 linkmode_adv_to_lcl_adv_t(unsigned long *advertising)
         if (linkmode_test_bit(ETHTOOL_LINK_MODE_Pause_BIT,
                               advertising))
                 lcl_adv |= ADVERTISE_PAUSE_CAP;
-        if (linkmode_test_bit(ETHTOOL_LINK_MODE_Pause_BIT,
+        if (linkmode_test_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
                               advertising))
                 lcl_adv |= ADVERTISE_PAUSE_ASYM;
 
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 022541dc5dbf..0d0729648844 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -594,6 +594,8 @@ enum mlx5_pagefault_type_flags {
 };
 
 struct mlx5_td {
+        /* protects tirs list changes while tirs refresh */
+        struct mutex     list_lock;
         struct list_head tirs_list;
         u32              tdn;
 };
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 7eade9132f02..4ef4bbe78a1d 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -671,7 +671,7 @@ enum vm_fault_reason {
 
 /* Encode hstate index for a hwpoisoned large page */
 #define VM_FAULT_SET_HINDEX(x) ((__force vm_fault_t)((x) << 16))
-#define VM_FAULT_GET_HINDEX(x) (((x) >> 16) & 0xf)
+#define VM_FAULT_GET_HINDEX(x) (((__force unsigned int)(x) >> 16) & 0xf)
 
 #define VM_FAULT_ERROR (VM_FAULT_OOM | VM_FAULT_SIGBUS |        \
                         VM_FAULT_SIGSEGV | VM_FAULT_HWPOISON |  \
diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
index edb9b040c94c..d5084ebd9f03 100644
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -9,6 +9,13 @@
 #include <linux/bug.h>                  /* For BUG_ON.  */
 #include <linux/pid_namespace.h>        /* For task_active_pid_ns.  */
 #include <uapi/linux/ptrace.h>
+#include <linux/seccomp.h>
+
+/* Add sp to seccomp_data, as seccomp is user API, we don't want to modify it */
+struct syscall_info {
+        __u64                   sp;
+        struct seccomp_data     data;
+};
 
 extern int ptrace_access_vm(struct task_struct *tsk, unsigned long addr,
                             void *buf, int len, unsigned int gup_flags);
@@ -407,9 +414,7 @@ static inline void user_single_step_report(struct pt_regs *regs)
 #define current_user_stack_pointer() user_stack_pointer(current_pt_regs())
 #endif
 
-extern int task_current_syscall(struct task_struct *target, long *callno,
-                                unsigned long args[6], unsigned int maxargs,
-                                unsigned long *sp, unsigned long *pc);
+extern int task_current_syscall(struct task_struct *target, struct syscall_info *info);
 
 extern void sigaction_compat_abi(struct k_sigaction *act, struct k_sigaction *oact);
 #endif
diff --git a/include/linux/string.h b/include/linux/string.h
index 7927b875f80c..6ab0a6fa512e 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -150,6 +150,9 @@ extern void * memscan(void *,int,__kernel_size_t);
 #ifndef __HAVE_ARCH_MEMCMP
 extern int memcmp(const void *,const void *,__kernel_size_t);
 #endif
+#ifndef __HAVE_ARCH_BCMP
+extern int bcmp(const void *,const void *,__kernel_size_t);
+#endif
 #ifndef __HAVE_ARCH_MEMCHR
 extern void * memchr(const void *,int,__kernel_size_t);
 #endif
diff --git a/include/net/ip.h b/include/net/ip.h
index be3cad9c2e4c..583526aad1d0 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -677,7 +677,7 @@ int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp,
                              unsigned char __user *data, int optlen);
 void ip_options_undo(struct ip_options *opt);
 void ip_forward_options(struct sk_buff *skb);
-int ip_options_rcv_srr(struct sk_buff *skb);
+int ip_options_rcv_srr(struct sk_buff *skb, struct net_device *dev);
 
 /*
  *      Functions provided by ip_sockglue.c
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index a68ced28d8f4..12689ddfc24c 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -59,6 +59,7 @@ struct net {
                                                  */
         spinlock_t              rules_mod_lock;
 
+        u32                     hash_mix;
         atomic64_t              cookie_gen;
 
         struct list_head        list;           /* list of network namespaces */
diff --git a/include/net/netns/hash.h b/include/net/netns/hash.h
index 16a842456189..d9b665151f3d 100644
--- a/include/net/netns/hash.h
+++ b/include/net/netns/hash.h
@@ -2,16 +2,10 @@
 #ifndef __NET_NS_HASH_H__
 #define __NET_NS_HASH_H__
 
-#include <asm/cache.h>
-
-struct net;
+#include <net/net_namespace.h>
 
 static inline u32 net_hash_mix(const struct net *net)
 {
-#ifdef CONFIG_NET_NS
-        return (u32)(((unsigned long)net) >> ilog2(sizeof(*net)));
-#else
-        return 0;
-#endif
+        return net->hash_mix;
 }
 #endif
diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
index 87499b6b35d6..df5c69db68af 100644
--- a/include/net/nfc/nci_core.h
+++ b/include/net/nfc/nci_core.h
@@ -166,7 +166,7 @@ struct nci_conn_info {
  * According to specification 102 622 chapter 4.4 Pipes,
  * the pipe identifier is 7 bits long.
  */
-#define NCI_HCI_MAX_PIPES          127
+#define NCI_HCI_MAX_PIPES          128
 
 struct nci_hci_gate {
         u8 gate;
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 7d1a0483a17b..a2b38b3deeca 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -923,6 +923,41 @@ static inline void qdisc_qstats_overlimit(struct Qdisc *sch)
         sch->qstats.overlimits++;
 }
 
+static inline int qdisc_qstats_copy(struct gnet_dump *d, struct Qdisc *sch)
+{
+        __u32 qlen = qdisc_qlen_sum(sch);
+
+        return gnet_stats_copy_queue(d, sch->cpu_qstats, &sch->qstats, qlen);
+}
+
+static inline void qdisc_qstats_qlen_backlog(struct Qdisc *sch,  __u32 *qlen,
+                                             __u32 *backlog)
+{
+        struct gnet_stats_queue qstats = { 0 };
+        __u32 len = qdisc_qlen_sum(sch);
+
+        __gnet_stats_copy_queue(&qstats, sch->cpu_qstats, &sch->qstats, len);
+        *qlen = qstats.qlen;
+        *backlog = qstats.backlog;
+}
+
+static inline void qdisc_tree_flush_backlog(struct Qdisc *sch)
+{
+        __u32 qlen, backlog;
+
+        qdisc_qstats_qlen_backlog(sch, &qlen, &backlog);
+        qdisc_tree_reduce_backlog(sch, qlen, backlog);
+}
+
+static inline void qdisc_purge_queue(struct Qdisc *sch)
+{
+        __u32 qlen, backlog;
+
+        qdisc_qstats_qlen_backlog(sch, &qlen, &backlog);
+        qdisc_reset(sch);
+        qdisc_tree_reduce_backlog(sch, qlen, backlog);
+}
+
 static inline void qdisc_skb_head_init(struct qdisc_skb_head *qh)
 {
         qh->head = NULL;
@@ -1106,13 +1141,8 @@ static inline struct Qdisc *qdisc_replace(struct Qdisc *sch, struct Qdisc *new,
         sch_tree_lock(sch);
         old = *pold;
         *pold = new;
-        if (old != NULL) {
-                unsigned int qlen = old->q.qlen;
-                unsigned int backlog = old->qstats.backlog;
-
-                qdisc_reset(old);
-                qdisc_tree_reduce_backlog(old, qlen, backlog);
-        }
+        if (old != NULL)
+                qdisc_tree_flush_backlog(old);
         sch_tree_unlock(sch);
 
         return old;
diff --git a/include/trace/events/syscalls.h b/include/trace/events/syscalls.h
index 44a3259ed4a5..b6e0cbc2c71f 100644
--- a/include/trace/events/syscalls.h
+++ b/include/trace/events/syscalls.h
@@ -28,7 +28,7 @@ TRACE_EVENT_FN(sys_enter,
 
         TP_fast_assign(
                 __entry->id     = id;
-                syscall_get_arguments(current, regs, 0, 6, __entry->args);
+                syscall_get_arguments(current, regs, __entry->args);
         ),
 
         TP_printk("NR %ld (%lx, %lx, %lx, %lx, %lx, %lx)",
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index 3652b239dad1..d473e5ed044c 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -1591,7 +1591,7 @@ enum ethtool_link_mode_bit_indices {
 
 static inline int ethtool_validate_speed(__u32 speed)
 {
-        return speed <= INT_MAX || speed == SPEED_UNKNOWN;
+        return speed <= INT_MAX || speed == (__u32)SPEED_UNKNOWN;
 }
 
 /* Duplex, half or full. */
diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
index 8974b3755670..3c18260403dd 100644
--- a/kernel/bpf/cpumap.c
+++ b/kernel/bpf/cpumap.c
@@ -162,10 +162,14 @@ static void cpu_map_kthread_stop(struct work_struct *work)
 static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
                                          struct xdp_frame *xdpf)
 {
+        unsigned int hard_start_headroom;
         unsigned int frame_size;
         void *pkt_data_start;
         struct sk_buff *skb;
 
+        /* Part of headroom was reserved to xdpf */
+        hard_start_headroom = sizeof(struct xdp_frame) +  xdpf->headroom;
+
         /* build_skb need to place skb_shared_info after SKB end, and
          * also want to know the memory "truesize".  Thus, need to
          * know the memory frame size backing xdp_buff.
@@ -183,15 +187,15 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
          * is not at a fixed memory location, with mixed length
          * packets, which is bad for cache-line hotness.
          */
-        frame_size = SKB_DATA_ALIGN(xdpf->len + xdpf->headroom) +
+        frame_size = SKB_DATA_ALIGN(xdpf->len + hard_start_headroom) +
                 SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
 
-        pkt_data_start = xdpf->data - xdpf->headroom;
+        pkt_data_start = xdpf->data - hard_start_headroom;
         skb = build_skb(pkt_data_start, frame_size);
         if (!skb)
                 return NULL;
 
-        skb_reserve(skb, xdpf->headroom);
+        skb_reserve(skb, hard_start_headroom);
         __skb_put(skb, xdpf->len);
         if (xdpf->metasize)
                 skb_metadata_set(skb, xdpf->metasize);
@@ -205,6 +209,9 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
          * - RX ring dev queue index    (skb_record_rx_queue)
          */
 
+        /* Allow SKB to reuse area used by xdp_frame */
+        xdp_scrub_frame(xdpf);
+
         return skb;
 }
 
diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
index 2ada5e21dfa6..4a8f390a2b82 100644
--- a/kernel/bpf/inode.c
+++ b/kernel/bpf/inode.c
@@ -554,19 +554,6 @@ struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type typ
 }
 EXPORT_SYMBOL(bpf_prog_get_type_path);
 
-static void bpf_evict_inode(struct inode *inode)
-{
-        enum bpf_type type;
-
-        truncate_inode_pages_final(&inode->i_data);
-        clear_inode(inode);
-
-        if (S_ISLNK(inode->i_mode))
-                kfree(inode->i_link);
-        if (!bpf_inode_type(inode, &type))
-                bpf_any_put(inode->i_private, type);
-}
-
 /*
  * Display the mount options in /proc/mounts.
  */
@@ -579,11 +566,28 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root)
         return 0;
 }
 
+static void bpf_destroy_inode_deferred(struct rcu_head *head)
+{
+        struct inode *inode = container_of(head, struct inode, i_rcu);
+        enum bpf_type type;
+
+        if (S_ISLNK(inode->i_mode))
+                kfree(inode->i_link);
+        if (!bpf_inode_type(inode, &type))
+                bpf_any_put(inode->i_private, type);
+        free_inode_nonrcu(inode);
+}
+
+static void bpf_destroy_inode(struct inode *inode)
+{
+        call_rcu(&inode->i_rcu, bpf_destroy_inode_deferred);
+}
+
 static const struct super_operations bpf_super_ops = {
         .statfs         = simple_statfs,
         .drop_inode     = generic_delete_inode,
         .show_options   = bpf_show_options,
-        .evict_inode    = bpf_evict_inode,
+        .destroy_inode  = bpf_destroy_inode,
 };
 
 enum {
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index fd502c1f71eb..6c5a41f7f338 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1897,8 +1897,9 @@ continue_func:
                 }
                 frame++;
                 if (frame >= MAX_CALL_FRAMES) {
-                        WARN_ONCE(1, "verifier bug. Call stack is too deep\n");
-                        return -EFAULT;
+                        verbose(env, "the call stack of %d frames is too deep !\n",
+                                frame);
+                        return -E2BIG;
                 }
                 goto process_func;
         }
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 54a0347ca812..df27e499956a 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -149,7 +149,7 @@ static void populate_seccomp_data(struct seccomp_data *sd)
 
         sd->nr = syscall_get_nr(task, regs);
         sd->arch = syscall_get_arch();
-        syscall_get_arguments(task, regs, 0, 6, args);
+        syscall_get_arguments(task, regs, args);
         sd->args[0] = args[0];
         sd->args[1] = args[1];
         sd->args[2] = args[2];
diff --git a/kernel/signal.c b/kernel/signal.c
index b7953934aa99..f98448cf2def 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -3605,16 +3605,11 @@ SYSCALL_DEFINE4(pidfd_send_signal, int, pidfd, int, sig,
                 if (unlikely(sig != kinfo.si_signo))
                         goto err;
 
+                /* Only allow sending arbitrary signals to yourself. */
+                ret = -EPERM;
                 if ((task_pid(current) != pid) &&
-                    (kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL)) {
-                        /* Only allow sending arbitrary signals to yourself. */
-                        ret = -EPERM;
-                        if (kinfo.si_code != SI_USER)
-                                goto err;
-
-                        /* Turn this into a regular kill signal. */
-                        prepare_kill_siginfo(sig, &kinfo);
-                }
+                    (kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL))
+                        goto err;
         } else {
                 prepare_kill_siginfo(sig, &kinfo);
         }
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index e5da394d1ca3..c9ec050bcf46 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -128,6 +128,7 @@ static int zero;
 static int __maybe_unused one = 1;
 static int __maybe_unused two = 2;
 static int __maybe_unused four = 4;
+static unsigned long zero_ul;
 static unsigned long one_ul = 1;
 static unsigned long long_max = LONG_MAX;
 static int one_hundred = 100;
@@ -1750,7 +1751,7 @@ static struct ctl_table fs_table[] = {
                 .maxlen         = sizeof(files_stat.max_files),
                 .mode           = 0644,
                 .proc_handler   = proc_doulongvec_minmax,
-                .extra1         = &zero,
+                .extra1         = &zero_ul,
                 .extra2         = &long_max,
         },
         {
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index f93a56d2db27..fa8fbff736d6 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -314,6 +314,7 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
         struct ring_buffer_event *event;
         struct ring_buffer *buffer;
         unsigned long irq_flags;
+        unsigned long args[6];
         int pc;
         int syscall_nr;
         int size;
@@ -347,7 +348,8 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
 
         entry = ring_buffer_event_data(event);
         entry->nr = syscall_nr;
-        syscall_get_arguments(current, regs, 0, sys_data->nb_args, entry->args);
+        syscall_get_arguments(current, regs, args);
+        memcpy(entry->args, args, sizeof(unsigned long) * sys_data->nb_args);
 
         event_trigger_unlock_commit(trace_file, buffer, event, entry,
                                     irq_flags, pc);
@@ -583,6 +585,7 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
         struct syscall_metadata *sys_data;
         struct syscall_trace_enter *rec;
         struct hlist_head *head;
+        unsigned long args[6];
         bool valid_prog_array;
         int syscall_nr;
         int rctx;
@@ -613,8 +616,8 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
                 return;
 
         rec->nr = syscall_nr;
-        syscall_get_arguments(current, regs, 0, sys_data->nb_args,
-                               (unsigned long *)&rec->args);
+        syscall_get_arguments(current, regs, args);
+        memcpy(&rec->args, args, sizeof(unsigned long) * sys_data->nb_args);
 
         if ((valid_prog_array &&
              !perf_call_bpf_enter(sys_data->enter_event, regs, sys_data, rec)) ||
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index ea36dc355da1..b396d328a764 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -1528,6 +1528,7 @@ EXPORT_SYMBOL(csum_and_copy_to_iter);
 size_t hash_and_copy_to_iter(const void *addr, size_t bytes, void *hashp,
                 struct iov_iter *i)
 {
+#ifdef CONFIG_CRYPTO
         struct ahash_request *hash = hashp;
         struct scatterlist sg;
         size_t copied;
@@ -1537,6 +1538,9 @@ size_t hash_and_copy_to_iter(const void *addr, size_t bytes, void *hashp,
         ahash_request_set_crypt(hash, &sg, NULL, copied);
         crypto_ahash_update(hash);
         return copied;
+#else
+        return 0;
+#endif
 }
 EXPORT_SYMBOL(hash_and_copy_to_iter);
 
diff --git a/lib/lzo/lzo1x_compress.c b/lib/lzo/lzo1x_compress.c
index 4525fb094844..a8ede77afe0d 100644
--- a/lib/lzo/lzo1x_compress.c
+++ b/lib/lzo/lzo1x_compress.c
@@ -291,13 +291,14 @@ int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len,
 {
         const unsigned char *ip = in;
         unsigned char *op = out;
+        unsigned char *data_start;
         size_t l = in_len;
         size_t t = 0;
         signed char state_offset = -2;
         unsigned int m4_max_offset;
 
-        // LZO v0 will never write 17 as first byte,
-        // so this is used to version the bitstream
+        // LZO v0 will never write 17 as first byte (except for zero-length
+        // input), so this is used to version the bitstream
         if (bitstream_version > 0) {
                 *op++ = 17;
                 *op++ = bitstream_version;
@@ -306,6 +307,8 @@ int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len,
                 m4_max_offset = M4_MAX_OFFSET_V0;
         }
 
+        data_start = op;
+
         while (l > 20) {
                 size_t ll = l <= (m4_max_offset + 1) ? l : (m4_max_offset + 1);
                 uintptr_t ll_end = (uintptr_t) ip + ll;
@@ -324,7 +327,7 @@ int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len,
         if (t > 0) {
                 const unsigned char *ii = in + in_len - t;
 
-                if (op == out && t <= 238) {
+                if (op == data_start && t <= 238) {
                         *op++ = (17 + t);
                 } else if (t <= 3) {
                         op[state_offset] |= t;
diff --git a/lib/lzo/lzo1x_decompress_safe.c b/lib/lzo/lzo1x_decompress_safe.c
index 6d2600ea3b55..9e07e9ef1aad 100644
--- a/lib/lzo/lzo1x_decompress_safe.c
+++ b/lib/lzo/lzo1x_decompress_safe.c
@@ -54,11 +54,9 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
         if (unlikely(in_len < 3))
                 goto input_overrun;
 
-        if (likely(*ip == 17)) {
+        if (likely(in_len >= 5) && likely(*ip == 17)) {
                 bitstream_version = ip[1];
                 ip += 2;
-                if (unlikely(in_len < 5))
-                        goto input_overrun;
         } else {
                 bitstream_version = 0;
         }
diff --git a/lib/string.c b/lib/string.c
index 38e4ca08e757..3ab861c1a857 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -866,6 +866,26 @@ __visible int memcmp(const void *cs, const void *ct, size_t count)
 EXPORT_SYMBOL(memcmp);
 #endif
 
+#ifndef __HAVE_ARCH_BCMP
+/**
+ * bcmp - returns 0 if and only if the buffers have identical contents.
+ * @a: pointer to first buffer.
+ * @b: pointer to second buffer.
+ * @len: size of buffers.
+ *
+ * The sign or magnitude of a non-zero return value has no particular
+ * meaning, and architectures may implement their own more efficient bcmp(). So
+ * while this particular implementation is a simple (tail) call to memcmp, do
+ * not rely on anything but whether the return value is zero or non-zero.
+ */
+#undef bcmp
+int bcmp(const void *a, const void *b, size_t len)
+{
+        return memcmp(a, b, len);
+}
+EXPORT_SYMBOL(bcmp);
+#endif
+
 #ifndef __HAVE_ARCH_MEMSCAN
 /**
  * memscan - Find a character in an area of memory.
diff --git a/lib/syscall.c b/lib/syscall.c
index 1a7077f20eae..fb328e7ccb08 100644
--- a/lib/syscall.c
+++ b/lib/syscall.c
@@ -5,16 +5,14 @@
 #include <linux/export.h>
 #include <asm/syscall.h>
 
-static int collect_syscall(struct task_struct *target, long *callno,
-                           unsigned long args[6], unsigned int maxargs,
-                           unsigned long *sp, unsigned long *pc)
+static int collect_syscall(struct task_struct *target, struct syscall_info *info)
 {
         struct pt_regs *regs;
 
         if (!try_get_task_stack(target)) {
                 /* Task has no stack, so the task isn't in a syscall. */
-                *sp = *pc = 0;
-                *callno = -1;
+                memset(info, 0, sizeof(*info));
+                info->data.nr = -1;
                 return 0;
         }
 
@@ -24,12 +22,13 @@ static int collect_syscall(struct task_struct *target, long *callno,
                 return -EAGAIN;
         }
 
-        *sp = user_stack_pointer(regs);
-        *pc = instruction_pointer(regs);
+        info->sp = user_stack_pointer(regs);
+        info->data.instruction_pointer = instruction_pointer(regs);
 
-        *callno = syscall_get_nr(target, regs);
-        if (*callno != -1L && maxargs > 0)
-                syscall_get_arguments(target, regs, 0, maxargs, args);
+        info->data.nr = syscall_get_nr(target, regs);
+        if (info->data.nr != -1L)
+                syscall_get_arguments(target, regs,
+                                      (unsigned long *)&info->data.args[0]);
 
         put_task_stack(target);
         return 0;
@@ -38,41 +37,35 @@ static int collect_syscall(struct task_struct *target, long *callno,
 /**
  * task_current_syscall - Discover what a blocked task is doing.
  * @target:             thread to examine
- * @callno:             filled with system call number or -1
- * @args:               filled with @maxargs system call arguments
- * @maxargs:            number of elements in @args to fill
- * @sp:                 filled with user stack pointer
- * @pc:                 filled with user PC
+ * @info:               structure with the following fields:
+ *                       .sp        - filled with user stack pointer
+ *                       .data.nr   - filled with system call number or -1
+ *                       .data.args - filled with @maxargs system call arguments
+ *                       .data.instruction_pointer - filled with user PC
  *
- * If @target is blocked in a system call, returns zero with *@callno
- * set to the the call's number and @args filled in with its arguments.
- * Registers not used for system call arguments may not be available and
- * it is not kosher to use &struct user_regset calls while the system
+ * If @target is blocked in a system call, returns zero with @info.data.nr
+ * set to the the call's number and @info.data.args filled in with its
+ * arguments. Registers not used for system call arguments may not be available
+ * and it is not kosher to use &struct user_regset calls while the system
  * call is still in progress.  Note we may get this result if @target
  * has finished its system call but not yet returned to user mode, such
  * as when it's stopped for signal handling or syscall exit tracing.
  *
  * If @target is blocked in the kernel during a fault or exception,
- * returns zero with *@callno set to -1 and does not fill in @args.
- * If so, it's now safe to examine @target using &struct user_regset
- * get() calls as long as we're sure @target won't return to user mode.
+ * returns zero with *@info.data.nr set to -1 and does not fill in
+ * @info.data.args. If so, it's now safe to examine @target using
+ * &struct user_regset get() calls as long as we're sure @target won't return
+ * to user mode.
  *
  * Returns -%EAGAIN if @target does not remain blocked.
- *
- * Returns -%EINVAL if @maxargs is too large (maximum is six).
  */
-int task_current_syscall(struct task_struct *target, long *callno,
-                         unsigned long args[6], unsigned int maxargs,
-                         unsigned long *sp, unsigned long *pc)
+int task_current_syscall(struct task_struct *target, struct syscall_info *info)
 {
         long state;
         unsigned long ncsw;
 
-        if (unlikely(maxargs > 6))
-                return -EINVAL;
-
         if (target == current)
-                return collect_syscall(target, callno, args, maxargs, sp, pc);
+                return collect_syscall(target, info);
 
         state = target->state;
         if (unlikely(!state))
@@ -80,7 +73,7 @@ int task_current_syscall(struct task_struct *target, long *callno,
 
         ncsw = wait_task_inactive(target, state);
         if (unlikely(!ncsw) ||
-            unlikely(collect_syscall(target, callno, args, maxargs, sp, pc)) ||
+            unlikely(collect_syscall(target, info)) ||
             unlikely(wait_task_inactive(target, state) != ncsw))
                 return -EAGAIN;
 
diff --git a/mm/compaction.c b/mm/compaction.c
index f171a83707ce..3319e0872d01 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -242,6 +242,7 @@ __reset_isolation_pfn(struct zone *zone, unsigned long pfn, bool check_source,
                                                         bool check_target)
 {
         struct page *page = pfn_to_online_page(pfn);
+        struct page *block_page;
         struct page *end_page;
         unsigned long block_pfn;
 
@@ -267,20 +268,26 @@ __reset_isolation_pfn(struct zone *zone, unsigned long pfn, bool check_source,
             get_pageblock_migratetype(page) != MIGRATE_MOVABLE)
                 return false;
 
+        /* Ensure the start of the pageblock or zone is online and valid */
+        block_pfn = pageblock_start_pfn(pfn);
+        block_page = pfn_to_online_page(max(block_pfn, zone->zone_start_pfn));
+        if (block_page) {
+                page = block_page;
+                pfn = block_pfn;
+        }
+
+        /* Ensure the end of the pageblock or zone is online and valid */
+        block_pfn += pageblock_nr_pages;
+        block_pfn = min(block_pfn, zone_end_pfn(zone) - 1);
+        end_page = pfn_to_online_page(block_pfn);
+        if (!end_page)
+                return false;
+
         /*
          * Only clear the hint if a sample indicates there is either a
          * free page or an LRU page in the block. One or other condition
          * is necessary for the block to be a migration source/target.
          */
-        block_pfn = pageblock_start_pfn(pfn);
-        pfn = max(block_pfn, zone->zone_start_pfn);
-        page = pfn_to_page(pfn);
-        if (zone != page_zone(page))
-                return false;
-        pfn = block_pfn + pageblock_nr_pages;
-        pfn = min(pfn, zone_end_pfn(zone));
-        end_page = pfn_to_page(pfn);
-
         do {
                 if (pfn_valid_within(pfn)) {
                         if (check_source && PageLRU(page)) {
@@ -309,7 +316,7 @@ __reset_isolation_pfn(struct zone *zone, unsigned long pfn, bool check_source,
 static void __reset_isolation_suitable(struct zone *zone)
 {
         unsigned long migrate_pfn = zone->zone_start_pfn;
-        unsigned long free_pfn = zone_end_pfn(zone);
+        unsigned long free_pfn = zone_end_pfn(zone) - 1;
         unsigned long reset_migrate = free_pfn;
         unsigned long reset_free = migrate_pfn;
         bool source_set = false;
@@ -1363,7 +1370,7 @@ fast_isolate_freepages(struct compact_control *cc)
                                 count_compact_events(COMPACTISOLATED, nr_isolated);
                         } else {
                                 /* If isolation fails, abort the search */
-                                order = -1;
+                                order = cc->search_order + 1;
                                 page = NULL;
                         }
                 }
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 404acdcd0455..165ea46bf149 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -755,6 +755,21 @@ static void insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
         spinlock_t *ptl;
 
         ptl = pmd_lock(mm, pmd);
+        if (!pmd_none(*pmd)) {
+                if (write) {
+                        if (pmd_pfn(*pmd) != pfn_t_to_pfn(pfn)) {
+                                WARN_ON_ONCE(!is_huge_zero_pmd(*pmd));
+                                goto out_unlock;
+                        }
+                        entry = pmd_mkyoung(*pmd);
+                        entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
+                        if (pmdp_set_access_flags(vma, addr, pmd, entry, 1))
+                                update_mmu_cache_pmd(vma, addr, pmd);
+                }
+
+                goto out_unlock;
+        }
+
         entry = pmd_mkhuge(pfn_t_pmd(pfn, prot));
         if (pfn_t_devmap(pfn))
                 entry = pmd_mkdevmap(entry);
@@ -766,11 +781,16 @@ static void insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
         if (pgtable) {
                 pgtable_trans_huge_deposit(mm, pmd, pgtable);
                 mm_inc_nr_ptes(mm);
+                pgtable = NULL;
         }
 
         set_pmd_at(mm, addr, pmd, entry);
         update_mmu_cache_pmd(vma, addr, pmd);
+
+out_unlock:
         spin_unlock(ptl);
+        if (pgtable)
+                pte_free(mm, pgtable);
 }
 
 vm_fault_t vmf_insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
@@ -821,6 +841,20 @@ static void insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr,
         spinlock_t *ptl;
 
         ptl = pud_lock(mm, pud);
+        if (!pud_none(*pud)) {
+                if (write) {
+                        if (pud_pfn(*pud) != pfn_t_to_pfn(pfn)) {
+                                WARN_ON_ONCE(!is_huge_zero_pud(*pud));
+                                goto out_unlock;
+                        }
+                        entry = pud_mkyoung(*pud);
+                        entry = maybe_pud_mkwrite(pud_mkdirty(entry), vma);
+                        if (pudp_set_access_flags(vma, addr, pud, entry, 1))
+                                update_mmu_cache_pud(vma, addr, pud);
+                }
+                goto out_unlock;
+        }
+
         entry = pud_mkhuge(pfn_t_pud(pfn, prot));
         if (pfn_t_devmap(pfn))
                 entry = pud_mkdevmap(entry);
@@ -830,6 +864,8 @@ static void insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr,
         }
         set_pud_at(mm, addr, pud, entry);
         update_mmu_cache_pud(vma, addr, pud);
+
+out_unlock:
         spin_unlock(ptl);
 }
 
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 707fa5579f66..6c318f5ac234 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1529,11 +1529,6 @@ static void kmemleak_scan(void)
         }
         rcu_read_unlock();
 
-        /* data/bss scanning */
-        scan_large_block(_sdata, _edata);
-        scan_large_block(__bss_start, __bss_stop);
-        scan_large_block(__start_ro_after_init, __end_ro_after_init);
-
 #ifdef CONFIG_SMP
         /* per-cpu sections scanning */
         for_each_possible_cpu(i)
@@ -2071,6 +2066,17 @@ void __init kmemleak_init(void)
         }
         local_irq_restore(flags);
 
+        /* register the data/bss sections */
+        create_object((unsigned long)_sdata, _edata - _sdata,
+                      KMEMLEAK_GREY, GFP_ATOMIC);
+        create_object((unsigned long)__bss_start, __bss_stop - __bss_start,
+                      KMEMLEAK_GREY, GFP_ATOMIC);
+        /* only register .data..ro_after_init if not within .data */
+        if (__start_ro_after_init < _sdata || __end_ro_after_init > _edata)
+                create_object((unsigned long)__start_ro_after_init,
+                              __end_ro_after_init - __start_ro_after_init,
+                              KMEMLEAK_GREY, GFP_ATOMIC);
+
         /*
          * This is the point where tracking allocations is safe. Automatic
          * scanning is started during the late initcall. Add the early logged
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 532e0e2a4817..81a0d3914ec9 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3882,6 +3882,22 @@ struct wb_domain *mem_cgroup_wb_domain(struct bdi_writeback *wb)
         return &memcg->cgwb_domain;
 }
 
+/*
+ * idx can be of type enum memcg_stat_item or node_stat_item.
+ * Keep in sync with memcg_exact_page().
+ */
+static unsigned long memcg_exact_page_state(struct mem_cgroup *memcg, int idx)
+{
+        long x = atomic_long_read(&memcg->stat[idx]);
+        int cpu;
+
+        for_each_online_cpu(cpu)
+                x += per_cpu_ptr(memcg->stat_cpu, cpu)->count[idx];
+        if (x < 0)
+                x = 0;
+        return x;
+}
+
 /**
  * mem_cgroup_wb_stats - retrieve writeback related stats from its memcg
  * @wb: bdi_writeback in question
@@ -3907,10 +3923,10 @@ void mem_cgroup_wb_stats(struct bdi_writeback *wb, unsigned long *pfilepages,
         struct mem_cgroup *memcg = mem_cgroup_from_css(wb->memcg_css);
         struct mem_cgroup *parent;
 
-        *pdirty = memcg_page_state(memcg, NR_FILE_DIRTY);
+        *pdirty = memcg_exact_page_state(memcg, NR_FILE_DIRTY);
 
         /* this should eventually include NR_UNSTABLE_NFS */
-        *pwriteback = memcg_page_state(memcg, NR_WRITEBACK);
+        *pwriteback = memcg_exact_page_state(memcg, NR_WRITEBACK);
         *pfilepages = mem_cgroup_nr_lru_pages(memcg, (1 << LRU_INACTIVE_FILE) |
                                                      (1 << LRU_ACTIVE_FILE));
         *pheadroom = PAGE_COUNTER_MAX;
diff --git a/mm/slab.c b/mm/slab.c
index 329bfe67f2ca..47a380a486ee 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -4308,7 +4308,8 @@ static void show_symbol(struct seq_file *m, unsigned long address)
 
 static int leaks_show(struct seq_file *m, void *p)
 {
-        struct kmem_cache *cachep = list_entry(p, struct kmem_cache, list);
+        struct kmem_cache *cachep = list_entry(p, struct kmem_cache,
+                                               root_caches_node);
         struct page *page;
         struct kmem_cache_node *n;
         const char *name;
diff --git a/mm/util.c b/mm/util.c
index d559bde497a9..43a2984bccaa 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -204,7 +204,7 @@ EXPORT_SYMBOL(vmemdup_user);
  * @s: The string to duplicate
  * @n: Maximum number of bytes to copy, including the trailing NUL.
  *
- * Return: newly allocated copy of @s or %NULL in case of error
+ * Return: newly allocated copy of @s or an ERR_PTR() in case of error
  */
 char *strndup_user(const char __user *s, long n)
 {
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 15293c2a5dd8..8d77b6ee4477 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -443,27 +443,29 @@ static int vlan_dev_fcoe_disable(struct net_device *dev)
         return rc;
 }
 
-static int vlan_dev_fcoe_get_wwn(struct net_device *dev, u64 *wwn, int type)
+static int vlan_dev_fcoe_ddp_target(struct net_device *dev, u16 xid,
+                                    struct scatterlist *sgl, unsigned int sgc)
 {
         struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
         const struct net_device_ops *ops = real_dev->netdev_ops;
-        int rc = -EINVAL;
+        int rc = 0;
+
+        if (ops->ndo_fcoe_ddp_target)
+                rc = ops->ndo_fcoe_ddp_target(real_dev, xid, sgl, sgc);
 
-        if (ops->ndo_fcoe_get_wwn)
-                rc = ops->ndo_fcoe_get_wwn(real_dev, wwn, type);
         return rc;
 }
+#endif
 
-static int vlan_dev_fcoe_ddp_target(struct net_device *dev, u16 xid,
-                                    struct scatterlist *sgl, unsigned int sgc)
+#ifdef NETDEV_FCOE_WWNN
+static int vlan_dev_fcoe_get_wwn(struct net_device *dev, u64 *wwn, int type)
 {
         struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
         const struct net_device_ops *ops = real_dev->netdev_ops;
-        int rc = 0;
-
-        if (ops->ndo_fcoe_ddp_target)
-                rc = ops->ndo_fcoe_ddp_target(real_dev, xid, sgl, sgc);
+        int rc = -EINVAL;
 
+        if (ops->ndo_fcoe_get_wwn)
+                rc = ops->ndo_fcoe_get_wwn(real_dev, wwn, type);
         return rc;
 }
 #endif
@@ -794,9 +796,11 @@ static const struct net_device_ops vlan_netdev_ops = {
         .ndo_fcoe_ddp_done      = vlan_dev_fcoe_ddp_done,
         .ndo_fcoe_enable        = vlan_dev_fcoe_enable,
         .ndo_fcoe_disable       = vlan_dev_fcoe_disable,
-        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
         .ndo_fcoe_ddp_target    = vlan_dev_fcoe_ddp_target,
 #endif
+#ifdef NETDEV_FCOE_WWNN
+        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
+#endif
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = vlan_dev_poll_controller,
         .ndo_netpoll_setup      = vlan_dev_netpoll_setup,
diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
index a9b7919c9de5..d5df0114f08a 100644
--- a/net/batman-adv/bat_v_elp.c
+++ b/net/batman-adv/bat_v_elp.c
@@ -104,8 +104,10 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh)
 
                 ret = cfg80211_get_station(real_netdev, neigh->addr, &sinfo);
 
-                /* free the TID stats immediately */
-                cfg80211_sinfo_release_content(&sinfo);
+                if (!ret) {
+                        /* free the TID stats immediately */
+                        cfg80211_sinfo_release_content(&sinfo);
+                }
 
                 dev_put(real_netdev);
                 if (ret == -ENOENT) {
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index ef39aabdb694..4fb01108e5f5 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -803,6 +803,8 @@ static void batadv_bla_del_claim(struct batadv_priv *bat_priv,
                                  const u8 *mac, const unsigned short vid)
 {
         struct batadv_bla_claim search_claim, *claim;
+        struct batadv_bla_claim *claim_removed_entry;
+        struct hlist_node *claim_removed_node;
 
         ether_addr_copy(search_claim.addr, mac);
         search_claim.vid = vid;
@@ -813,10 +815,18 @@ static void batadv_bla_del_claim(struct batadv_priv *bat_priv,
         batadv_dbg(BATADV_DBG_BLA, bat_priv, "%s(): %pM, vid %d\n", __func__,
                    mac, batadv_print_vid(vid));
 
-        batadv_hash_remove(bat_priv->bla.claim_hash, batadv_compare_claim,
-                           batadv_choose_claim, claim);
-        batadv_claim_put(claim); /* reference from the hash is gone */
+        claim_removed_node = batadv_hash_remove(bat_priv->bla.claim_hash,
+                                                batadv_compare_claim,
+                                                batadv_choose_claim, claim);
+        if (!claim_removed_node)
+                goto free_claim;
 
+        /* reference from the hash is gone */
+        claim_removed_entry = hlist_entry(claim_removed_node,
+                                          struct batadv_bla_claim, hash_entry);
+        batadv_claim_put(claim_removed_entry);
+
+free_claim:
         /* don't need the reference from hash_find() anymore */
         batadv_claim_put(claim);
 }
diff --git a/net/batman-adv/sysfs.c b/net/batman-adv/sysfs.c
index 0b4b3fb778a6..208655cf6717 100644
--- a/net/batman-adv/sysfs.c
+++ b/net/batman-adv/sysfs.c
@@ -1116,9 +1116,9 @@ static ssize_t batadv_store_throughput_override(struct kobject *kobj,
                                                 struct attribute *attr,
                                                 char *buff, size_t count)
 {
-        struct batadv_priv *bat_priv = batadv_kobj_to_batpriv(kobj);
         struct net_device *net_dev = batadv_kobj_to_netdev(kobj);
         struct batadv_hard_iface *hard_iface;
+        struct batadv_priv *bat_priv;
         u32 tp_override;
         u32 old_tp_override;
         bool ret;
@@ -1147,7 +1147,10 @@ static ssize_t batadv_store_throughput_override(struct kobject *kobj,
 
         atomic_set(&hard_iface->bat_v.throughput_override, tp_override);
 
-        batadv_netlink_notify_hardif(bat_priv, hard_iface);
+        if (hard_iface->soft_iface) {
+                bat_priv = netdev_priv(hard_iface->soft_iface);
+                batadv_netlink_notify_hardif(bat_priv, hard_iface);
+        }
 
 out:
         batadv_hardif_put(hard_iface);
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index f73d79139ae7..26c4e2493ddf 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -616,14 +616,26 @@ static void batadv_tt_global_free(struct batadv_priv *bat_priv,
                                   struct batadv_tt_global_entry *tt_global,
                                   const char *message)
 {
+        struct batadv_tt_global_entry *tt_removed_entry;
+        struct hlist_node *tt_removed_node;
+
         batadv_dbg(BATADV_DBG_TT, bat_priv,
                    "Deleting global tt entry %pM (vid: %d): %s\n",
                    tt_global->common.addr,
                    batadv_print_vid(tt_global->common.vid), message);
 
-        batadv_hash_remove(bat_priv->tt.global_hash, batadv_compare_tt,
-                           batadv_choose_tt, &tt_global->common);
-        batadv_tt_global_entry_put(tt_global);
+        tt_removed_node = batadv_hash_remove(bat_priv->tt.global_hash,
+                                             batadv_compare_tt,
+                                             batadv_choose_tt,
+                                             &tt_global->common);
+        if (!tt_removed_node)
+                return;
+
+        /* drop reference of remove hash entry */
+        tt_removed_entry = hlist_entry(tt_removed_node,
+                                       struct batadv_tt_global_entry,
+                                       common.hash_entry);
+        batadv_tt_global_entry_put(tt_removed_entry);
 }
 
 /**
@@ -1337,9 +1349,10 @@ u16 batadv_tt_local_remove(struct batadv_priv *bat_priv, const u8 *addr,
                            unsigned short vid, const char *message,
                            bool roaming)
 {
+        struct batadv_tt_local_entry *tt_removed_entry;
         struct batadv_tt_local_entry *tt_local_entry;
         u16 flags, curr_flags = BATADV_NO_FLAGS;
-        void *tt_entry_exists;
+        struct hlist_node *tt_removed_node;
 
         tt_local_entry = batadv_tt_local_hash_find(bat_priv, addr, vid);
         if (!tt_local_entry)
@@ -1368,15 +1381,18 @@ u16 batadv_tt_local_remove(struct batadv_priv *bat_priv, const u8 *addr,
          */
         batadv_tt_local_event(bat_priv, tt_local_entry, BATADV_TT_CLIENT_DEL);
 
-        tt_entry_exists = batadv_hash_remove(bat_priv->tt.local_hash,
+        tt_removed_node = batadv_hash_remove(bat_priv->tt.local_hash,
                                              batadv_compare_tt,
                                              batadv_choose_tt,
                                              &tt_local_entry->common);
-        if (!tt_entry_exists)
+        if (!tt_removed_node)
                 goto out;
 
-        /* extra call to free the local tt entry */
-        batadv_tt_local_entry_put(tt_local_entry);
+        /* drop reference of remove hash entry */
+        tt_removed_entry = hlist_entry(tt_removed_node,
+                                       struct batadv_tt_local_entry,
+                                       common.hash_entry);
+        batadv_tt_local_entry_put(tt_removed_entry);
 
 out:
         if (tt_local_entry)
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index a0e369179f6d..02da21d771c9 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -601,6 +601,7 @@ static int br_ip4_multicast_add_group(struct net_bridge *br,
         if (ipv4_is_local_multicast(group))
                 return 0;
 
+        memset(&br_group, 0, sizeof(br_group));
         br_group.u.ip4 = group;
         br_group.proto = htons(ETH_P_IP);
         br_group.vid = vid;
@@ -1497,6 +1498,7 @@ static void br_ip4_multicast_leave_group(struct net_bridge *br,
 
         own_query = port ? &port->ip4_own_query : &br->ip4_own_query;
 
+        memset(&br_group, 0, sizeof(br_group));
         br_group.u.ip4 = group;
         br_group.proto = htons(ETH_P_IP);
         br_group.vid = vid;
@@ -1520,6 +1522,7 @@ static void br_ip6_multicast_leave_group(struct net_bridge *br,
 
         own_query = port ? &port->ip6_own_query : &br->ip6_own_query;
 
+        memset(&br_group, 0, sizeof(br_group));
         br_group.u.ip6 = *group;
         br_group.proto = htons(ETH_P_IPV6);
         br_group.vid = vid;
diff --git a/net/core/datagram.c b/net/core/datagram.c
index b2651bb6d2a3..e657289db4ac 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -279,7 +279,7 @@ struct sk_buff *__skb_try_recv_datagram(struct sock *sk, unsigned int flags,
                         break;
 
                 sk_busy_loop(sk, flags & MSG_DONTWAIT);
-        } while (!skb_queue_empty(&sk->sk_receive_queue));
+        } while (sk->sk_receive_queue.prev != *last);
 
         error = -EAGAIN;
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 2b67f2aa59dd..fdcff29df915 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5014,8 +5014,10 @@ static inline void __netif_receive_skb_list_ptype(struct list_head *head,
         if (pt_prev->list_func != NULL)
                 pt_prev->list_func(head, pt_prev, orig_dev);
         else
-                list_for_each_entry_safe(skb, next, head, list)
+                list_for_each_entry_safe(skb, next, head, list) {
+                        skb_list_del_init(skb);
                         pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
+                }
 }
 
 static void __netif_receive_skb_list_core(struct list_head *head, bool pfmemalloc)
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index b1eb32419732..36ed619faf36 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1797,11 +1797,16 @@ static int ethtool_get_strings(struct net_device *dev, void __user *useraddr)
         WARN_ON_ONCE(!ret);
 
         gstrings.len = ret;
-        data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN));
-        if (gstrings.len && !data)
-                return -ENOMEM;
 
-        __ethtool_get_strings(dev, gstrings.string_set, data);
+        if (gstrings.len) {
+                data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN));
+                if (!data)
+                        return -ENOMEM;
+
+                __ethtool_get_strings(dev, gstrings.string_set, data);
+        } else {
+                data = NULL;
+        }
 
         ret = -EFAULT;
         if (copy_to_user(useraddr, &gstrings, sizeof(gstrings)))
@@ -1897,11 +1902,15 @@ static int ethtool_get_stats(struct net_device *dev, void __user *useraddr)
                 return -EFAULT;
 
         stats.n_stats = n_stats;
-        data = vzalloc(array_size(n_stats, sizeof(u64)));
-        if (n_stats && !data)
-                return -ENOMEM;
 
-        ops->get_ethtool_stats(dev, &stats, data);
+        if (n_stats) {
+                data = vzalloc(array_size(n_stats, sizeof(u64)));
+                if (!data)
+                        return -ENOMEM;
+                ops->get_ethtool_stats(dev, &stats, data);
+        } else {
+                data = NULL;
+        }
 
         ret = -EFAULT;
         if (copy_to_user(useraddr, &stats, sizeof(stats)))
@@ -1941,16 +1950,21 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr)
                 return -EFAULT;
 
         stats.n_stats = n_stats;
-        data = vzalloc(array_size(n_stats, sizeof(u64)));
-        if (n_stats && !data)
-                return -ENOMEM;
 
-        if (dev->phydev && !ops->get_ethtool_phy_stats) {
-                ret = phy_ethtool_get_stats(dev->phydev, &stats, data);
-                if (ret < 0)
-                        return ret;
+        if (n_stats) {
+                data = vzalloc(array_size(n_stats, sizeof(u64)));
+                if (!data)
+                        return -ENOMEM;
+
+                if (dev->phydev && !ops->get_ethtool_phy_stats) {
+                        ret = phy_ethtool_get_stats(dev->phydev, &stats, data);
+                        if (ret < 0)
+                                goto out;
+                } else {
+                        ops->get_ethtool_phy_stats(dev, &stats, data);
+                }
         } else {
-                ops->get_ethtool_phy_stats(dev, &stats, data);
+                data = NULL;
         }
 
         ret = -EFAULT;
diff --git a/net/core/filter.c b/net/core/filter.c
index 647c63a7b25b..fc92ebc4e200 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -6613,14 +6613,8 @@ static bool flow_dissector_is_valid_access(int off, int size,
                                            const struct bpf_prog *prog,
                                            struct bpf_insn_access_aux *info)
 {
-        if (type == BPF_WRITE) {
-                switch (off) {
-                case bpf_ctx_range_till(struct __sk_buff, cb[0], cb[4]):
-                        break;
-                default:
-                        return false;
-                }
-        }
+        if (type == BPF_WRITE)
+                return false;
 
         switch (off) {
         case bpf_ctx_range(struct __sk_buff, data):
@@ -6632,11 +6626,7 @@ static bool flow_dissector_is_valid_access(int off, int size,
         case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
                 info->reg_type = PTR_TO_FLOW_KEYS;
                 break;
-        case bpf_ctx_range(struct __sk_buff, tc_classid):
-        case bpf_ctx_range(struct __sk_buff, data_meta):
-        case bpf_ctx_range_till(struct __sk_buff, family, local_port):
-        case bpf_ctx_range(struct __sk_buff, tstamp):
-        case bpf_ctx_range(struct __sk_buff, wire_len):
+        default:
                 return false;
         }
 
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index bb1a54747d64..94a450b2191a 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -707,6 +707,7 @@ bool __skb_flow_bpf_dissect(struct bpf_prog *prog,
         /* Pass parameters to the BPF program */
         memset(flow_keys, 0, sizeof(*flow_keys));
         cb->qdisc_cb.flow_keys = flow_keys;
+        flow_keys->n_proto = skb->protocol;
         flow_keys->nhoff = skb_network_offset(skb);
         flow_keys->thoff = flow_keys->nhoff;
 
@@ -716,7 +717,8 @@ bool __skb_flow_bpf_dissect(struct bpf_prog *prog,
         /* Restore state */
         memcpy(cb, &cb_saved, sizeof(cb_saved));
 
-        flow_keys->nhoff = clamp_t(u16, flow_keys->nhoff, 0, skb->len);
+        flow_keys->nhoff = clamp_t(u16, flow_keys->nhoff,
+                                   skb_network_offset(skb), skb->len);
         flow_keys->thoff = clamp_t(u16, flow_keys->thoff,
                                    flow_keys->nhoff, skb->len);
 
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 17f36317363d..7e6dcc625701 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -304,6 +304,7 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
 
         refcount_set(&net->count, 1);
         refcount_set(&net->passive, 1);
+        get_random_bytes(&net->hash_mix, sizeof(u32));
         net->dev_base_seq = 1;
         net->user_ns = user_ns;
         idr_init(&net->netns_ids);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 2415d9cb9b89..ef2cd5712098 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3801,7 +3801,7 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
         unsigned int delta_truesize;
         struct sk_buff *lp;
 
-        if (unlikely(p->len + len >= 65536))
+        if (unlikely(p->len + len >= 65536 || NAPI_GRO_CB(skb)->flush))
                 return -E2BIG;
 
         lp = NAPI_GRO_CB(p)->last;
diff --git a/net/dccp/feat.c b/net/dccp/feat.c
index f227f002c73d..db87d9f58019 100644
--- a/net/dccp/feat.c
+++ b/net/dccp/feat.c
@@ -738,7 +738,12 @@ static int __feat_register_sp(struct list_head *fn, u8 feat, u8 is_local,
         if (dccp_feat_clone_sp_val(&fval, sp_val, sp_len))
                 return -ENOMEM;
 
-        return dccp_feat_push_change(fn, feat, is_local, mandatory, &fval);
+        if (dccp_feat_push_change(fn, feat, is_local, mandatory, &fval)) {
+                kfree(fval.sp.vec);
+                return -ENOMEM;
+        }
+
+        return 0;
 }
 
 /**
diff --git a/net/dsa/tag_qca.c b/net/dsa/tag_qca.c
index ed4f6dc26365..85c22ada4744 100644
--- a/net/dsa/tag_qca.c
+++ b/net/dsa/tag_qca.c
@@ -98,8 +98,18 @@ static struct sk_buff *qca_tag_rcv(struct sk_buff *skb, struct net_device *dev,
         return skb;
 }
 
+static int qca_tag_flow_dissect(const struct sk_buff *skb, __be16 *proto,
+                                int *offset)
+{
+        *offset = QCA_HDR_LEN;
+        *proto = ((__be16 *)skb->data)[0];
+
+        return 0;
+}
+
 const struct dsa_device_ops qca_netdev_ops = {
         .xmit   = qca_tag_xmit,
         .rcv    = qca_tag_rcv,
+        .flow_dissect = qca_tag_flow_dissect,
         .overhead = QCA_HDR_LEN,
 };
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index fd219f7bd3ea..4b0526441476 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -259,7 +259,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
         struct net *net = dev_net(skb->dev);
         struct metadata_dst *tun_dst = NULL;
         struct erspan_base_hdr *ershdr;
-        struct erspan_metadata *pkt_md;
         struct ip_tunnel_net *itn;
         struct ip_tunnel *tunnel;
         const struct iphdr *iph;
@@ -282,9 +281,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
                 if (unlikely(!pskb_may_pull(skb, len)))
                         return PACKET_REJECT;
 
-                ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len);
-                pkt_md = (struct erspan_metadata *)(ershdr + 1);
-
                 if (__iptunnel_pull_header(skb,
                                            len,
                                            htons(ETH_P_TEB),
@@ -292,8 +288,9 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
                         goto drop;
 
                 if (tunnel->collect_md) {
+                        struct erspan_metadata *pkt_md, *md;
                         struct ip_tunnel_info *info;
-                        struct erspan_metadata *md;
+                        unsigned char *gh;
                         __be64 tun_id;
                         __be16 flags;
 
@@ -306,6 +303,14 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
                         if (!tun_dst)
                                 return PACKET_REJECT;
 
+                        /* skb can be uncloned in __iptunnel_pull_header, so
+                         * old pkt_md is no longer valid and we need to reset
+                         * it
+                         */
+                        gh = skb_network_header(skb) +
+                             skb_network_header_len(skb);
+                        pkt_md = (struct erspan_metadata *)(gh + gre_hdr_len +
+                                                            sizeof(*ershdr));
                         md = ip_tunnel_info_opts(&tun_dst->u.tun_info);
                         md->version = ver;
                         md2 = &md->u.md2;
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index ecce2dc78f17..1132d6d1796a 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -257,11 +257,10 @@ int ip_local_deliver(struct sk_buff *skb)
                        ip_local_deliver_finish);
 }
 
-static inline bool ip_rcv_options(struct sk_buff *skb)
+static inline bool ip_rcv_options(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_options *opt;
         const struct iphdr *iph;
-        struct net_device *dev = skb->dev;
 
         /* It looks as overkill, because not all
            IP options require packet mangling.
@@ -297,7 +296,7 @@ static inline bool ip_rcv_options(struct sk_buff *skb)
                         }
                 }
 
-                if (ip_options_rcv_srr(skb))
+                if (ip_options_rcv_srr(skb, dev))
                         goto drop;
         }
 
@@ -353,7 +352,7 @@ static int ip_rcv_finish_core(struct net *net, struct sock *sk,
         }
 #endif
 
-        if (iph->ihl > 5 && ip_rcv_options(skb))
+        if (iph->ihl > 5 && ip_rcv_options(skb, dev))
                 goto drop;
 
         rt = skb_rtable(skb);
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 32a35043c9f5..3db31bb9df50 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -612,7 +612,7 @@ void ip_forward_options(struct sk_buff *skb)
         }
 }
 
-int ip_options_rcv_srr(struct sk_buff *skb)
+int ip_options_rcv_srr(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_options *opt = &(IPCB(skb)->opt);
         int srrspace, srrptr;
@@ -647,7 +647,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
 
                 orefdst = skb->_skb_refdst;
                 skb_dst_set(skb, NULL);
-                err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, skb->dev);
+                err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, dev);
                 rt2 = skb_rtable(skb);
                 if (err || (rt2->rt_type != RTN_UNICAST && rt2->rt_type != RTN_LOCAL)) {
                         skb_dst_drop(skb);
diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
index cd4814f7e962..359da68d7c06 100644
--- a/net/ipv4/tcp_dctcp.c
+++ b/net/ipv4/tcp_dctcp.c
@@ -67,11 +67,6 @@ static unsigned int dctcp_alpha_on_init __read_mostly = DCTCP_MAX_ALPHA;
 module_param(dctcp_alpha_on_init, uint, 0644);
 MODULE_PARM_DESC(dctcp_alpha_on_init, "parameter for initial alpha value");
 
-static unsigned int dctcp_clamp_alpha_on_loss __read_mostly;
-module_param(dctcp_clamp_alpha_on_loss, uint, 0644);
-MODULE_PARM_DESC(dctcp_clamp_alpha_on_loss,
-                 "parameter for clamping alpha on loss");
-
 static struct tcp_congestion_ops dctcp_reno;
 
 static void dctcp_reset(const struct tcp_sock *tp, struct dctcp *ca)
@@ -164,21 +159,23 @@ static void dctcp_update_alpha(struct sock *sk, u32 flags)
         }
 }
 
-static void dctcp_state(struct sock *sk, u8 new_state)
+static void dctcp_react_to_loss(struct sock *sk)
 {
-        if (dctcp_clamp_alpha_on_loss && new_state == TCP_CA_Loss) {
-                struct dctcp *ca = inet_csk_ca(sk);
+        struct dctcp *ca = inet_csk_ca(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
 
-                /* If this extension is enabled, we clamp dctcp_alpha to
-                 * max on packet loss; the motivation is that dctcp_alpha
-                 * is an indicator to the extend of congestion and packet
-                 * loss is an indicator of extreme congestion; setting
-                 * this in practice turned out to be beneficial, and
-                 * effectively assumes total congestion which reduces the
-                 * window by half.
-                 */
-                ca->dctcp_alpha = DCTCP_MAX_ALPHA;
-        }
+        ca->loss_cwnd = tp->snd_cwnd;
+        tp->snd_ssthresh = max(tp->snd_cwnd >> 1U, 2U);
+}
+
+static void dctcp_state(struct sock *sk, u8 new_state)
+{
+        if (new_state == TCP_CA_Recovery &&
+            new_state != inet_csk(sk)->icsk_ca_state)
+                dctcp_react_to_loss(sk);
+        /* We handle RTO in dctcp_cwnd_event to ensure that we perform only
+         * one loss-adjustment per RTT.
+         */
 }
 
 static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
@@ -190,6 +187,9 @@ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
         case CA_EVENT_ECN_NO_CE:
                 dctcp_ece_ack_update(sk, ev, &ca->prior_rcv_nxt, &ca->ce_state);
                 break;
+        case CA_EVENT_LOSS:
+                dctcp_react_to_loss(sk);
+                break;
         default:
                 /* Don't care for the rest. */
                 break;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 277d71239d75..2f8039a26b08 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2578,7 +2578,8 @@ static void __net_exit tcp_sk_exit(struct net *net)
 {
         int cpu;
 
-        module_put(net->ipv4.tcp_congestion_control->owner);
+        if (net->ipv4.tcp_congestion_control)
+                module_put(net->ipv4.tcp_congestion_control->owner);
 
         for_each_possible_cpu(cpu)
                 inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.tcp_sk, cpu));
diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c
index 79d2e43c05c5..5fc1f4e0c0cf 100644
--- a/net/ipv6/ila/ila_xlat.c
+++ b/net/ipv6/ila/ila_xlat.c
@@ -417,6 +417,7 @@ int ila_xlat_nl_cmd_flush(struct sk_buff *skb, struct genl_info *info)
 
 done:
         rhashtable_walk_stop(&iter);
+        rhashtable_walk_exit(&iter);
         return ret;
 }
 
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index b32c95f02128..655e46b227f9 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -525,10 +525,10 @@ static int ip6gre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi)
 }
 
 static int ip6erspan_rcv(struct sk_buff *skb,
-                         struct tnl_ptk_info *tpi)
+                         struct tnl_ptk_info *tpi,
+                         int gre_hdr_len)
 {
         struct erspan_base_hdr *ershdr;
-        struct erspan_metadata *pkt_md;
         const struct ipv6hdr *ipv6h;
         struct erspan_md2 *md2;
         struct ip6_tnl *tunnel;
@@ -547,18 +547,16 @@ static int ip6erspan_rcv(struct sk_buff *skb,
                 if (unlikely(!pskb_may_pull(skb, len)))
                         return PACKET_REJECT;
 
-                ershdr = (struct erspan_base_hdr *)skb->data;
-                pkt_md = (struct erspan_metadata *)(ershdr + 1);
-
                 if (__iptunnel_pull_header(skb, len,
                                            htons(ETH_P_TEB),
                                            false, false) < 0)
                         return PACKET_REJECT;
 
                 if (tunnel->parms.collect_md) {
+                        struct erspan_metadata *pkt_md, *md;
                         struct metadata_dst *tun_dst;
                         struct ip_tunnel_info *info;
-                        struct erspan_metadata *md;
+                        unsigned char *gh;
                         __be64 tun_id;
                         __be16 flags;
 
@@ -571,6 +569,14 @@ static int ip6erspan_rcv(struct sk_buff *skb,
                         if (!tun_dst)
                                 return PACKET_REJECT;
 
+                        /* skb can be uncloned in __iptunnel_pull_header, so
+                         * old pkt_md is no longer valid and we need to reset
+                         * it
+                         */
+                        gh = skb_network_header(skb) +
+                             skb_network_header_len(skb);
+                        pkt_md = (struct erspan_metadata *)(gh + gre_hdr_len +
+                                                            sizeof(*ershdr));
                         info = &tun_dst->u.tun_info;
                         md = ip_tunnel_info_opts(info);
                         md->version = ver;
@@ -607,7 +613,7 @@ static int gre_rcv(struct sk_buff *skb)
 
         if (unlikely(tpi.proto == htons(ETH_P_ERSPAN) ||
                      tpi.proto == htons(ETH_P_ERSPAN2))) {
-                if (ip6erspan_rcv(skb, &tpi) == PACKET_RCVD)
+                if (ip6erspan_rcv(skb, &tpi, hdr_len) == PACKET_RCVD)
                         return 0;
                 goto out;
         }
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index edbd12067170..e51f3c648b09 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -601,7 +601,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
                                 inet6_sk(skb->sk) : NULL;
         struct ipv6hdr *tmp_hdr;
         struct frag_hdr *fh;
-        unsigned int mtu, hlen, left, len;
+        unsigned int mtu, hlen, left, len, nexthdr_offset;
         int hroom, troom;
         __be32 frag_id;
         int ptr, offset = 0, err = 0;
@@ -612,6 +612,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
                 goto fail;
         hlen = err;
         nexthdr = *prevhdr;
+        nexthdr_offset = prevhdr - skb_network_header(skb);
 
         mtu = ip6_skb_dst_mtu(skb);
 
@@ -646,6 +647,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
             (err = skb_checksum_help(skb)))
                 goto fail;
 
+        prevhdr = skb_network_header(skb) + nexthdr_offset;
         hroom = LL_RESERVED_SPACE(rt->dst.dev);
         if (skb_has_frag_list(skb)) {
                 unsigned int first_len = skb_pagelen(skb);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 0c6403cf8b52..ade1390c6348 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -627,7 +627,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
                                            eiph->daddr, eiph->saddr, 0, 0,
                                            IPPROTO_IPIP, RT_TOS(eiph->tos), 0);
-                if (IS_ERR(rt) || rt->dst.dev->type != ARPHRD_TUNNEL) {
+                if (IS_ERR(rt) || rt->dst.dev->type != ARPHRD_TUNNEL6) {
                         if (!IS_ERR(rt))
                                 ip_rt_put(rt);
                         goto out;
@@ -636,7 +636,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         } else {
                 if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
                                    skb2->dev) ||
-                    skb_dst(skb2)->dev->type != ARPHRD_TUNNEL)
+                    skb_dst(skb2)->dev->type != ARPHRD_TUNNEL6)
                         goto out;
         }
 
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 07e21a82ce4c..b2109b74857d 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -669,6 +669,10 @@ static int ipip6_rcv(struct sk_buff *skb)
                     !net_eq(tunnel->net, dev_net(tunnel->dev))))
                         goto out;
 
+                /* skb can be uncloned in iptunnel_pull_header, so
+                 * old iph is no longer valid
+                 */
+                iph = (const struct iphdr *)skb_mac_header(skb);
                 err = IP_ECN_decapsulate(iph, skb);
                 if (unlikely(err)) {
                         if (log_ecn_error)
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index c5c5ab6c5a1c..44fdc641710d 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -2054,14 +2054,14 @@ static int __init kcm_init(void)
         if (err)
                 goto fail;
 
-        err = sock_register(&kcm_family_ops);
-        if (err)
-                goto sock_register_fail;
-
         err = register_pernet_device(&kcm_net_ops);
         if (err)
                 goto net_ops_fail;
 
+        err = sock_register(&kcm_family_ops);
+        if (err)
+                goto sock_register_fail;
+
         err = kcm_proc_init();
         if (err)
                 goto proc_init_fail;
@@ -2069,12 +2069,12 @@ static int __init kcm_init(void)
         return 0;
 
 proc_init_fail:
-        unregister_pernet_device(&kcm_net_ops);
-
-net_ops_fail:
         sock_unregister(PF_KCM);
 
 sock_register_fail:
+        unregister_pernet_device(&kcm_net_ops);
+
+net_ops_fail:
         proto_unregister(&kcm_proto);
 
 fail:
@@ -2090,8 +2090,8 @@ fail:
 static void __exit kcm_exit(void)
 {
         kcm_proc_exit();
-        unregister_pernet_device(&kcm_net_ops);
         sock_unregister(PF_KCM);
+        unregister_pernet_device(&kcm_net_ops);
         proto_unregister(&kcm_proto);
         destroy_workqueue(kcm_wq);
 
diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c
index ddfc52ac1f9b..c0d323b58e73 100644
--- a/net/nfc/nci/hci.c
+++ b/net/nfc/nci/hci.c
@@ -312,6 +312,10 @@ static void nci_hci_cmd_received(struct nci_dev *ndev, u8 pipe,
                 create_info = (struct nci_hci_create_pipe_resp *)skb->data;
                 dest_gate = create_info->dest_gate;
                 new_pipe = create_info->pipe;
+                if (new_pipe >= NCI_HCI_MAX_PIPES) {
+                        status = NCI_HCI_ANY_E_NOK;
+                        goto exit;
+                }
 
                 /* Save the new created pipe and bind with local gate,
                  * the description for skb->data[3] is destination gate id
@@ -336,6 +340,10 @@ static void nci_hci_cmd_received(struct nci_dev *ndev, u8 pipe,
                         goto exit;
                 }
                 delete_info = (struct nci_hci_delete_pipe_noti *)skb->data;
+                if (delete_info->pipe >= NCI_HCI_MAX_PIPES) {
+                        status = NCI_HCI_ANY_E_NOK;
+                        goto exit;
+                }
 
                 ndev->hci_dev->pipes[delete_info->pipe].gate =
                                                 NCI_HCI_INVALID_GATE;
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 691da853bef5..4bdf5e3ac208 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -2306,14 +2306,14 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa,
 
         struct sw_flow_actions *acts;
         int new_acts_size;
-        int req_size = NLA_ALIGN(attr_len);
+        size_t req_size = NLA_ALIGN(attr_len);
         int next_offset = offsetof(struct sw_flow_actions, actions) +
                                         (*sfa)->actions_len;
 
         if (req_size <= (ksize(*sfa) - next_offset))
                 goto out;
 
-        new_acts_size = ksize(*sfa) * 2;
+        new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2);
 
         if (new_acts_size > MAX_ACTIONS_BUFSIZE) {
                 if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) {
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index fd2694174607..faf726e00e27 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -608,7 +608,7 @@ static void rds_tcp_kill_sock(struct net *net)
         list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
                 struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
 
-                if (net != c_net || !tc->t_sock)
+                if (net != c_net)
                         continue;
                 if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn)) {
                         list_move_tail(&tc->t_tcp_node, &tmp_list);
diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
index 4060b0955c97..0f82d50ea232 100644
--- a/net/sched/act_sample.c
+++ b/net/sched/act_sample.c
@@ -45,8 +45,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
         struct nlattr *tb[TCA_SAMPLE_MAX + 1];
         struct psample_group *psample_group;
         struct tcf_chain *goto_ch = NULL;
+        u32 psample_group_num, rate;
         struct tc_sample *parm;
-        u32 psample_group_num;
         struct tcf_sample *s;
         bool exists = false;
         int ret, err;
@@ -85,6 +85,12 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
         if (err < 0)
                 goto release_idr;
 
+        rate = nla_get_u32(tb[TCA_SAMPLE_RATE]);
+        if (!rate) {
+                NL_SET_ERR_MSG(extack, "invalid sample rate");
+                err = -EINVAL;
+                goto put_chain;
+        }
         psample_group_num = nla_get_u32(tb[TCA_SAMPLE_PSAMPLE_GROUP]);
         psample_group = psample_group_get(net, psample_group_num);
         if (!psample_group) {
@@ -96,7 +102,7 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
 
         spin_lock_bh(&s->tcf_lock);
         goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
-        s->rate = nla_get_u32(tb[TCA_SAMPLE_RATE]);
+        s->rate = rate;
         s->psample_group_num = psample_group_num;
         RCU_INIT_POINTER(s->psample_group, psample_group);
 
diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
index 459921bd3d87..a13bc351a414 100644
--- a/net/sched/cls_matchall.c
+++ b/net/sched/cls_matchall.c
@@ -130,6 +130,11 @@ static void mall_destroy(struct tcf_proto *tp, bool rtnl_held,
 
 static void *mall_get(struct tcf_proto *tp, u32 handle)
 {
+        struct cls_mall_head *head = rtnl_dereference(tp->root);
+
+        if (head && head->handle == handle)
+                return head;
+
         return NULL;
 }
 
diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
index acc9b9da985f..259d97bc2abd 100644
--- a/net/sched/sch_cake.c
+++ b/net/sched/sch_cake.c
@@ -1517,16 +1517,27 @@ static unsigned int cake_drop(struct Qdisc *sch, struct sk_buff **to_free)
 
 static u8 cake_handle_diffserv(struct sk_buff *skb, u16 wash)
 {
+        int wlen = skb_network_offset(skb);
         u8 dscp;
 
-        switch (skb->protocol) {
+        switch (tc_skb_protocol(skb)) {
         case htons(ETH_P_IP):
+                wlen += sizeof(struct iphdr);
+                if (!pskb_may_pull(skb, wlen) ||
+                    skb_try_make_writable(skb, wlen))
+                        return 0;
+
                 dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2;
                 if (wash && dscp)
                         ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, 0);
                 return dscp;
 
         case htons(ETH_P_IPV6):
+                wlen += sizeof(struct ipv6hdr);
+                if (!pskb_may_pull(skb, wlen) ||
+                    skb_try_make_writable(skb, wlen))
+                        return 0;
+
                 dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2;
                 if (wash && dscp)
                         ipv6_change_dsfield(ipv6_hdr(skb), INET_ECN_MASK, 0);
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 4dc05409e3fb..114b9048ea7e 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1358,9 +1358,11 @@ cbq_dump_class_stats(struct Qdisc *sch, unsigned long arg,
 {
         struct cbq_sched_data *q = qdisc_priv(sch);
         struct cbq_class *cl = (struct cbq_class *)arg;
+        __u32 qlen;
 
         cl->xstats.avgidle = cl->avgidle;
         cl->xstats.undertime = 0;
+        qdisc_qstats_qlen_backlog(cl->q, &qlen, &cl->qstats.backlog);
 
         if (cl->undertime != PSCHED_PASTPERFECT)
                 cl->xstats.undertime = cl->undertime - q->now;
@@ -1368,7 +1370,7 @@ cbq_dump_class_stats(struct Qdisc *sch, unsigned long arg,
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                   d, NULL, &cl->bstats) < 0 ||
             gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &cl->qstats, cl->q->q.qlen) < 0)
+            gnet_stats_copy_queue(d, NULL, &cl->qstats, qlen) < 0)
                 return -1;
 
         return gnet_stats_copy_app(d, &cl->xstats, sizeof(cl->xstats));
@@ -1665,17 +1667,13 @@ static int cbq_delete(struct Qdisc *sch, unsigned long arg)
 {
         struct cbq_sched_data *q = qdisc_priv(sch);
         struct cbq_class *cl = (struct cbq_class *)arg;
-        unsigned int qlen, backlog;
 
         if (cl->filters || cl->children || cl == &q->link)
                 return -EBUSY;
 
         sch_tree_lock(sch);
 
-        qlen = cl->q->q.qlen;
-        backlog = cl->q->qstats.backlog;
-        qdisc_reset(cl->q);
-        qdisc_tree_reduce_backlog(cl->q, qlen, backlog);
+        qdisc_purge_queue(cl->q);
 
         if (cl->next_alive)
                 cbq_deactivate_class(cl);
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 09b800991065..430df9a55ec4 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -50,15 +50,6 @@ static struct drr_class *drr_find_class(struct Qdisc *sch, u32 classid)
         return container_of(clc, struct drr_class, common);
 }
 
-static void drr_purge_queue(struct drr_class *cl)
-{
-        unsigned int len = cl->qdisc->q.qlen;
-        unsigned int backlog = cl->qdisc->qstats.backlog;
-
-        qdisc_reset(cl->qdisc);
-        qdisc_tree_reduce_backlog(cl->qdisc, len, backlog);
-}
-
 static const struct nla_policy drr_policy[TCA_DRR_MAX + 1] = {
         [TCA_DRR_QUANTUM]       = { .type = NLA_U32 },
 };
@@ -167,7 +158,7 @@ static int drr_delete_class(struct Qdisc *sch, unsigned long arg)
 
         sch_tree_lock(sch);
 
-        drr_purge_queue(cl);
+        qdisc_purge_queue(cl->qdisc);
         qdisc_class_hash_remove(&q->clhash, &cl->common);
 
         sch_tree_unlock(sch);
@@ -269,7 +260,8 @@ static int drr_dump_class_stats(struct Qdisc *sch, unsigned long arg,
                                 struct gnet_dump *d)
 {
         struct drr_class *cl = (struct drr_class *)arg;
-        __u32 qlen = cl->qdisc->q.qlen;
+        __u32 qlen = qdisc_qlen_sum(cl->qdisc);
+        struct Qdisc *cl_q = cl->qdisc;
         struct tc_drr_stats xstats;
 
         memset(&xstats, 0, sizeof(xstats));
@@ -279,7 +271,7 @@ static int drr_dump_class_stats(struct Qdisc *sch, unsigned long arg,
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                   d, NULL, &cl->bstats) < 0 ||
             gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &cl->qdisc->qstats, qlen) < 0)
+            gnet_stats_copy_queue(d, cl_q->cpu_qstats, &cl_q->qstats, qlen) < 0)
                 return -1;
 
         return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 24cc220a3218..d2ab463f22ae 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -845,16 +845,6 @@ qdisc_peek_len(struct Qdisc *sch)
 }
 
 static void
-hfsc_purge_queue(struct Qdisc *sch, struct hfsc_class *cl)
-{
-        unsigned int len = cl->qdisc->q.qlen;
-        unsigned int backlog = cl->qdisc->qstats.backlog;
-
-        qdisc_reset(cl->qdisc);
-        qdisc_tree_reduce_backlog(cl->qdisc, len, backlog);
-}
-
-static void
 hfsc_adjust_levels(struct hfsc_class *cl)
 {
         struct hfsc_class *p;
@@ -1076,7 +1066,7 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
         qdisc_class_hash_insert(&q->clhash, &cl->cl_common);
         list_add_tail(&cl->siblings, &parent->children);
         if (parent->level == 0)
-                hfsc_purge_queue(sch, parent);
+                qdisc_purge_queue(parent->qdisc);
         hfsc_adjust_levels(parent);
         sch_tree_unlock(sch);
 
@@ -1112,7 +1102,7 @@ hfsc_delete_class(struct Qdisc *sch, unsigned long arg)
         list_del(&cl->siblings);
         hfsc_adjust_levels(cl->cl_parent);
 
-        hfsc_purge_queue(sch, cl);
+        qdisc_purge_queue(cl->qdisc);
         qdisc_class_hash_remove(&q->clhash, &cl->cl_common);
 
         sch_tree_unlock(sch);
@@ -1328,8 +1318,9 @@ hfsc_dump_class_stats(struct Qdisc *sch, unsigned long arg,
 {
         struct hfsc_class *cl = (struct hfsc_class *)arg;
         struct tc_hfsc_stats xstats;
+        __u32 qlen;
 
-        cl->qstats.backlog = cl->qdisc->qstats.backlog;
+        qdisc_qstats_qlen_backlog(cl->qdisc, &qlen, &cl->qstats.backlog);
         xstats.level   = cl->level;
         xstats.period  = cl->cl_vtperiod;
         xstats.work    = cl->cl_total;
@@ -1337,7 +1328,7 @@ hfsc_dump_class_stats(struct Qdisc *sch, unsigned long arg,
 
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch), d, NULL, &cl->bstats) < 0 ||
             gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &cl->qstats, cl->qdisc->q.qlen) < 0)
+            gnet_stats_copy_queue(d, NULL, &cl->qstats, qlen) < 0)
                 return -1;
 
         return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 30f9da7e1076..2f9883b196e8 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1127,10 +1127,9 @@ htb_dump_class_stats(struct Qdisc *sch, unsigned long arg, struct gnet_dump *d)
         };
         __u32 qlen = 0;
 
-        if (!cl->level && cl->leaf.q) {
-                qlen = cl->leaf.q->q.qlen;
-                qs.backlog = cl->leaf.q->qstats.backlog;
-        }
+        if (!cl->level && cl->leaf.q)
+                qdisc_qstats_qlen_backlog(cl->leaf.q, &qlen, &qs.backlog);
+
         cl->xstats.tokens = clamp_t(s64, PSCHED_NS2TICKS(cl->tokens),
                                     INT_MIN, INT_MAX);
         cl->xstats.ctokens = clamp_t(s64, PSCHED_NS2TICKS(cl->ctokens),
@@ -1270,13 +1269,8 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
 
         sch_tree_lock(sch);
 
-        if (!cl->level) {
-                unsigned int qlen = cl->leaf.q->q.qlen;
-                unsigned int backlog = cl->leaf.q->qstats.backlog;
-
-                qdisc_reset(cl->leaf.q);
-                qdisc_tree_reduce_backlog(cl->leaf.q, qlen, backlog);
-        }
+        if (!cl->level)
+                qdisc_purge_queue(cl->leaf.q);
 
         /* delete from hash and active; remainder in destroy_class */
         qdisc_class_hash_remove(&q->clhash, &cl->common);
@@ -1404,12 +1398,8 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                                           classid, NULL);
                 sch_tree_lock(sch);
                 if (parent && !parent->level) {
-                        unsigned int qlen = parent->leaf.q->q.qlen;
-                        unsigned int backlog = parent->leaf.q->qstats.backlog;
-
                         /* turn parent into inner node */
-                        qdisc_reset(parent->leaf.q);
-                        qdisc_tree_reduce_backlog(parent->leaf.q, qlen, backlog);
+                        qdisc_purge_queue(parent->leaf.q);
                         qdisc_put(parent->leaf.q);
                         if (parent->prio_activity)
                                 htb_deactivate(q, parent);
diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
index 203659bc3906..3a3312467692 100644
--- a/net/sched/sch_mq.c
+++ b/net/sched/sch_mq.c
@@ -249,7 +249,7 @@ static int mq_dump_class_stats(struct Qdisc *sch, unsigned long cl,
 
         sch = dev_queue->qdisc_sleeping;
         if (gnet_stats_copy_basic(&sch->running, d, NULL, &sch->bstats) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &sch->qstats, sch->q.qlen) < 0)
+            qdisc_qstats_copy(d, sch) < 0)
                 return -1;
         return 0;
 }
diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index d364e63c396d..ea0dc112b38d 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -561,8 +561,7 @@ static int mqprio_dump_class_stats(struct Qdisc *sch, unsigned long cl,
                 sch = dev_queue->qdisc_sleeping;
                 if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                           d, NULL, &sch->bstats) < 0 ||
-                    gnet_stats_copy_queue(d, NULL,
-                                          &sch->qstats, sch->q.qlen) < 0)
+                    qdisc_qstats_copy(d, sch) < 0)
                         return -1;
         }
         return 0;
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
index 7410ce4d0321..35b03ae08e0f 100644
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -201,9 +201,9 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt,
         for (i = q->bands; i < q->max_bands; i++) {
                 if (q->queues[i] != &noop_qdisc) {
                         struct Qdisc *child = q->queues[i];
+
                         q->queues[i] = &noop_qdisc;
-                        qdisc_tree_reduce_backlog(child, child->q.qlen,
-                                                  child->qstats.backlog);
+                        qdisc_tree_flush_backlog(child);
                         qdisc_put(child);
                 }
         }
@@ -225,9 +225,7 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt,
                                         qdisc_hash_add(child, true);
 
                                 if (old != &noop_qdisc) {
-                                        qdisc_tree_reduce_backlog(old,
-                                                                  old->q.qlen,
-                                                                  old->qstats.backlog);
+                                        qdisc_tree_flush_backlog(old);
                                         qdisc_put(old);
                                 }
                                 sch_tree_unlock(sch);
@@ -344,7 +342,7 @@ static int multiq_dump_class_stats(struct Qdisc *sch, unsigned long cl,
         cl_q = q->queues[cl - 1];
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                   d, NULL, &cl_q->bstats) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &cl_q->qstats, cl_q->q.qlen) < 0)
+            qdisc_qstats_copy(d, cl_q) < 0)
                 return -1;
 
         return 0;
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 847141cd900f..d519b21535b3 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -216,12 +216,8 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt,
         q->bands = qopt->bands;
         memcpy(q->prio2band, qopt->priomap, TC_PRIO_MAX+1);
 
-        for (i = q->bands; i < oldbands; i++) {
-                struct Qdisc *child = q->queues[i];
-
-                qdisc_tree_reduce_backlog(child, child->q.qlen,
-                                          child->qstats.backlog);
-        }
+        for (i = q->bands; i < oldbands; i++)
+                qdisc_tree_flush_backlog(q->queues[i]);
 
         for (i = oldbands; i < q->bands; i++) {
                 q->queues[i] = queues[i];
@@ -365,7 +361,7 @@ static int prio_dump_class_stats(struct Qdisc *sch, unsigned long cl,
         cl_q = q->queues[cl - 1];
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                   d, NULL, &cl_q->bstats) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &cl_q->qstats, cl_q->q.qlen) < 0)
+            qdisc_qstats_copy(d, cl_q) < 0)
                 return -1;
 
         return 0;
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 29f5c4a24688..1589364b54da 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -217,15 +217,6 @@ static struct qfq_class *qfq_find_class(struct Qdisc *sch, u32 classid)
         return container_of(clc, struct qfq_class, common);
 }
 
-static void qfq_purge_queue(struct qfq_class *cl)
-{
-        unsigned int len = cl->qdisc->q.qlen;
-        unsigned int backlog = cl->qdisc->qstats.backlog;
-
-        qdisc_reset(cl->qdisc);
-        qdisc_tree_reduce_backlog(cl->qdisc, len, backlog);
-}
-
 static const struct nla_policy qfq_policy[TCA_QFQ_MAX + 1] = {
         [TCA_QFQ_WEIGHT] = { .type = NLA_U32 },
         [TCA_QFQ_LMAX] = { .type = NLA_U32 },
@@ -551,7 +542,7 @@ static int qfq_delete_class(struct Qdisc *sch, unsigned long arg)
 
         sch_tree_lock(sch);
 
-        qfq_purge_queue(cl);
+        qdisc_purge_queue(cl->qdisc);
         qdisc_class_hash_remove(&q->clhash, &cl->common);
 
         sch_tree_unlock(sch);
@@ -655,8 +646,7 @@ static int qfq_dump_class_stats(struct Qdisc *sch, unsigned long arg,
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                   d, NULL, &cl->bstats) < 0 ||
             gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
-            gnet_stats_copy_queue(d, NULL,
-                                  &cl->qdisc->qstats, cl->qdisc->q.qlen) < 0)
+            qdisc_qstats_copy(d, cl->qdisc) < 0)
                 return -1;
 
         return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 9df9942340ea..4e8c0abf6194 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -233,8 +233,7 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt,
         q->flags = ctl->flags;
         q->limit = ctl->limit;
         if (child) {
-                qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen,
-                                          q->qdisc->qstats.backlog);
+                qdisc_tree_flush_backlog(q->qdisc);
                 old_child = q->qdisc;
                 q->qdisc = child;
         }
diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
index bab506b01a32..2419fdb75966 100644
--- a/net/sched/sch_sfb.c
+++ b/net/sched/sch_sfb.c
@@ -521,8 +521,7 @@ static int sfb_change(struct Qdisc *sch, struct nlattr *opt,
                 qdisc_hash_add(child, true);
         sch_tree_lock(sch);
 
-        qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen,
-                                  q->qdisc->qstats.backlog);
+        qdisc_tree_flush_backlog(q->qdisc);
         qdisc_put(q->qdisc);
         q->qdisc = child;
 
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index 206e4dbed12f..c7041999eb5d 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -895,7 +895,7 @@ static int taprio_dump_class_stats(struct Qdisc *sch, unsigned long cl,
 
         sch = dev_queue->qdisc_sleeping;
         if (gnet_stats_copy_basic(&sch->running, d, NULL, &sch->bstats) < 0 ||
-            gnet_stats_copy_queue(d, NULL, &sch->qstats, sch->q.qlen) < 0)
+            qdisc_qstats_copy(d, sch) < 0)
                 return -1;
         return 0;
 }
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 7f272a9070c5..f71578dbb9e3 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -391,8 +391,7 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt,
 
         sch_tree_lock(sch);
         if (child) {
-                qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen,
-                                          q->qdisc->qstats.backlog);
+                qdisc_tree_flush_backlog(q->qdisc);
                 qdisc_put(q->qdisc);
                 q->qdisc = child;
         }
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 6abc8b274270..951afdeea5e9 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -600,6 +600,7 @@ out:
 static int sctp_v4_addr_to_user(struct sctp_sock *sp, union sctp_addr *addr)
 {
         /* No address mapping for V4 sockets */
+        memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
         return sizeof(struct sockaddr_in);
 }
 
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 4ad3586da8f0..340a6e7c43a7 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -267,8 +267,14 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
         if (msg->rep_type)
                 tipc_tlv_init(msg->rep, msg->rep_type);
 
-        if (cmd->header)
-                (*cmd->header)(msg);
+        if (cmd->header) {
+                err = (*cmd->header)(msg);
+                if (err) {
+                        kfree_skb(msg->rep);
+                        msg->rep = NULL;
+                        return err;
+                }
+        }
 
         arg = nlmsg_new(0, GFP_KERNEL);
         if (!arg) {
@@ -397,7 +403,12 @@ static int tipc_nl_compat_bearer_enable(struct tipc_nl_compat_cmd_doit *cmd,
         if (!bearer)
                 return -EMSGSIZE;
 
-        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME);
+        len = TLV_GET_DATA_LEN(msg->req);
+        len -= offsetof(struct tipc_bearer_config, name);
+        if (len <= 0)
+                return -EINVAL;
+
+        len = min_t(int, len, TIPC_MAX_BEARER_NAME);
         if (!string_is_valid(b->name, len))
                 return -EINVAL;
 
@@ -766,7 +777,12 @@ static int tipc_nl_compat_link_set(struct tipc_nl_compat_cmd_doit *cmd,
 
         lc = (struct tipc_link_config *)TLV_DATA(msg->req);
 
-        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+        len = TLV_GET_DATA_LEN(msg->req);
+        len -= offsetof(struct tipc_link_config, name);
+        if (len <= 0)
+                return -EINVAL;
+
+        len = min_t(int, len, TIPC_MAX_LINK_NAME);
         if (!string_is_valid(lc->name, len))
                 return -EINVAL;
 
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 425351ac2a9b..20b191227969 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -1484,6 +1484,8 @@ static int decrypt_skb_update(struct sock *sk, struct sk_buff *skb,
 
                                 return err;
                         }
+                } else {
+                        *zc = false;
                 }
 
                 rxm->full_len -= padding_length(ctx, tls_ctx, skb);
diff --git a/scripts/coccinelle/api/stream_open.cocci b/scripts/coccinelle/api/stream_open.cocci
new file mode 100644
index 000000000000..350145da7669
--- /dev/null
+++ b/scripts/coccinelle/api/stream_open.cocci
@@ -0,0 +1,363 @@
+// SPDX-License-Identifier: GPL-2.0
+// Author: Kirill Smelkov (kirr@nexedi.com)
+//
+// Search for stream-like files that are using nonseekable_open and convert
+// them to stream_open. A stream-like file is a file that does not use ppos in
+// its read and write. Rationale for the conversion is to avoid deadlock in
+// between read and write.
+
+virtual report
+virtual patch
+virtual explain  // explain decisions in the patch (SPFLAGS="-D explain")
+
+// stream-like reader & writer - ones that do not depend on f_pos.
+@ stream_reader @
+identifier readstream, ppos;
+identifier f, buf, len;
+type loff_t;
+@@
+  ssize_t readstream(struct file *f, char *buf, size_t len, loff_t *ppos)
+  {
+    ... when != ppos
+  }
+
+@ stream_writer @
+identifier writestream, ppos;
+identifier f, buf, len;
+type loff_t;
+@@
+  ssize_t writestream(struct file *f, const char *buf, size_t len, loff_t *ppos)
+  {
+    ... when != ppos
+  }
+
+
+// a function that blocks
+@ blocks @
+identifier block_f;
+identifier wait_event =~ "^wait_event_.*";
+@@
+  block_f(...) {
+    ... when exists
+    wait_event(...)
+    ... when exists
+  }
+
+// stream_reader that can block inside.
+//
+// XXX wait_* can be called not directly from current function (e.g. func -> f -> g -> wait())
+// XXX currently reader_blocks supports only direct and 1-level indirect cases.
+@ reader_blocks_direct @
+identifier stream_reader.readstream;
+identifier wait_event =~ "^wait_event_.*";
+@@
+  readstream(...)
+  {
+    ... when exists
+    wait_event(...)
+    ... when exists
+  }
+
+@ reader_blocks_1 @
+identifier stream_reader.readstream;
+identifier blocks.block_f;
+@@
+  readstream(...)
+  {
+    ... when exists
+    block_f(...)
+    ... when exists
+  }
+
+@ reader_blocks depends on reader_blocks_direct || reader_blocks_1 @
+identifier stream_reader.readstream;
+@@
+  readstream(...) {
+    ...
+  }
+
+
+// file_operations + whether they have _any_ .read, .write, .llseek ... at all.
+//
+// XXX add support for file_operations xxx[N] = ...     (sound/core/pcm_native.c)
+@ fops0 @
+identifier fops;
+@@
+  struct file_operations fops = {
+    ...
+  };
+
+@ has_read @
+identifier fops0.fops;
+identifier read_f;
+@@
+  struct file_operations fops = {
+    .read = read_f,
+  };
+
+@ has_read_iter @
+identifier fops0.fops;
+identifier read_iter_f;
+@@
+  struct file_operations fops = {
+    .read_iter = read_iter_f,
+  };
+
+@ has_write @
+identifier fops0.fops;
+identifier write_f;
+@@
+  struct file_operations fops = {
+    .write = write_f,
+  };
+
+@ has_write_iter @
+identifier fops0.fops;
+identifier write_iter_f;
+@@
+  struct file_operations fops = {
+    .write_iter = write_iter_f,
+  };
+
+@ has_llseek @
+identifier fops0.fops;
+identifier llseek_f;
+@@
+  struct file_operations fops = {
+    .llseek = llseek_f,
+  };
+
+@ has_no_llseek @
+identifier fops0.fops;
+@@
+  struct file_operations fops = {
+    .llseek = no_llseek,
+  };
+
+@ has_mmap @
+identifier fops0.fops;
+identifier mmap_f;
+@@
+  struct file_operations fops = {
+    .mmap = mmap_f,
+  };
+
+@ has_copy_file_range @
+identifier fops0.fops;
+identifier copy_file_range_f;
+@@
+  struct file_operations fops = {
+    .copy_file_range = copy_file_range_f,
+  };
+
+@ has_remap_file_range @
+identifier fops0.fops;
+identifier remap_file_range_f;
+@@
+  struct file_operations fops = {
+    .remap_file_range = remap_file_range_f,
+  };
+
+@ has_splice_read @
+identifier fops0.fops;
+identifier splice_read_f;
+@@
+  struct file_operations fops = {
+    .splice_read = splice_read_f,
+  };
+
+@ has_splice_write @
+identifier fops0.fops;
+identifier splice_write_f;
+@@
+  struct file_operations fops = {
+    .splice_write = splice_write_f,
+  };
+
+
+// file_operations that is candidate for stream_open conversion - it does not
+// use mmap and other methods that assume @offset access to file.
+//
+// XXX for simplicity require no .{read/write}_iter and no .splice_{read/write} for now.
+// XXX maybe_steam.fops cannot be used in other rules - it gives "bad rule maybe_stream or bad variable fops".
+@ maybe_stream depends on (!has_llseek || has_no_llseek) && !has_mmap && !has_copy_file_range && !has_remap_file_range && !has_read_iter && !has_write_iter && !has_splice_read && !has_splice_write @
+identifier fops0.fops;
+@@
+  struct file_operations fops = {
+  };
+
+
+// ---- conversions ----
+
+// XXX .open = nonseekable_open -> .open = stream_open
+// XXX .open = func -> openfunc -> nonseekable_open
+
+// read & write
+//
+// if both are used in the same file_operations together with an opener -
+// under that conditions we can use stream_open instead of nonseekable_open.
+@ fops_rw depends on maybe_stream @
+identifier fops0.fops, openfunc;
+identifier stream_reader.readstream;
+identifier stream_writer.writestream;
+@@
+  struct file_operations fops = {
+      .open  = openfunc,
+      .read  = readstream,
+      .write = writestream,
+  };
+
+@ report_rw depends on report @
+identifier fops_rw.openfunc;
+position p1;
+@@
+  openfunc(...) {
+    <...
+     nonseekable_open@p1
+    ...>
+  }
+
+@ script:python depends on report && reader_blocks @
+fops << fops0.fops;
+p << report_rw.p1;
+@@
+coccilib.report.print_report(p[0],
+  "ERROR: %s: .read() can deadlock .write(); change nonseekable_open -> stream_open to fix." % (fops,))
+
+@ script:python depends on report && !reader_blocks @
+fops << fops0.fops;
+p << report_rw.p1;
+@@
+coccilib.report.print_report(p[0],
+  "WARNING: %s: .read() and .write() have stream semantic; safe to change nonseekable_open -> stream_open." % (fops,))
+
+
+@ explain_rw_deadlocked depends on explain && reader_blocks @
+identifier fops_rw.openfunc;
+@@
+  openfunc(...) {
+    <...
+-    nonseekable_open
++    nonseekable_open /* read & write (was deadlock) */
+    ...>
+  }
+
+
+@ explain_rw_nodeadlock depends on explain && !reader_blocks @
+identifier fops_rw.openfunc;
+@@
+  openfunc(...) {
+    <...
+-    nonseekable_open
++    nonseekable_open /* read & write (no direct deadlock) */
+    ...>
+  }
+
+@ patch_rw depends on patch @
+identifier fops_rw.openfunc;
+@@
+  openfunc(...) {
+    <...
+-   nonseekable_open
++   stream_open
+    ...>
+  }
+
+
+// read, but not write
+@ fops_r depends on maybe_stream && !has_write @
+identifier fops0.fops, openfunc;
+identifier stream_reader.readstream;
+@@
+  struct file_operations fops = {
+      .open  = openfunc,
+      .read  = readstream,
+  };
+
+@ report_r depends on report @
+identifier fops_r.openfunc;
+position p1;
+@@
+  openfunc(...) {
+    <...
+    nonseekable_open@p1
+    ...>
+  }
+
+@ script:python depends on report @
+fops << fops0.fops;
+p << report_r.p1;
+@@
+coccilib.report.print_report(p[0],
+  "WARNING: %s: .read() has stream semantic; safe to change nonseekable_open -> stream_open." % (fops,))
+
+@ explain_r depends on explain @
+identifier fops_r.openfunc;
+@@
+  openfunc(...) {
+    <...
+-   nonseekable_open
++   nonseekable_open /* read only */
+    ...>
+  }
+
+@ patch_r depends on patch @
+identifier fops_r.openfunc;
+@@
+  openfunc(...) {
+    <...
+-   nonseekable_open
++   stream_open
+    ...>
+  }
+
+
+// write, but not read
+@ fops_w depends on maybe_stream && !has_read @
+identifier fops0.fops, openfunc;
+identifier stream_writer.writestream;
+@@
+  struct file_operations fops = {
+      .open  = openfunc,
+      .write = writestream,
+  };
+
+@ report_w depends on report @
+identifier fops_w.openfunc;
+position p1;
+@@
+  openfunc(...) {
+    <...
+    nonseekable_open@p1
+    ...>
+  }
+
+@ script:python depends on report @
+fops << fops0.fops;
+p << report_w.p1;
+@@
+coccilib.report.print_report(p[0],
+  "WARNING: %s: .write() has stream semantic; safe to change nonseekable_open -> stream_open." % (fops,))
+
+@ explain_w depends on explain @
+identifier fops_w.openfunc;
+@@
+  openfunc(...) {
+    <...
+-   nonseekable_open
++   nonseekable_open /* write only */
+    ...>
+  }
+
+@ patch_w depends on patch @
+identifier fops_w.openfunc;
+@@
+  openfunc(...) {
+    <...
+-   nonseekable_open
++   stream_open
+    ...>
+  }
+
+
+// no read, no write - don't change anything
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index bcc9c6ead7fd..efdbf17f3915 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -125,7 +125,7 @@ out:
  */
 int TSS_authhmac(unsigned char *digest, const unsigned char *key,
                         unsigned int keylen, unsigned char *h1,
-                        unsigned char *h2, unsigned char h3, ...)
+                        unsigned char *h2, unsigned int h3, ...)
 {
         unsigned char paramdigest[SHA1_DIGEST_SIZE];
         struct sdesc *sdesc;
@@ -135,13 +135,16 @@ int TSS_authhmac(unsigned char *digest, const unsigned char *key,
         int ret;
         va_list argp;
 
+        if (!chip)
+                return -ENODEV;
+
         sdesc = init_sdesc(hashalg);
         if (IS_ERR(sdesc)) {
                 pr_info("trusted_key: can't alloc %s\n", hash_alg);
                 return PTR_ERR(sdesc);
         }
 
-        c = h3;
+        c = !!h3;
         ret = crypto_shash_init(&sdesc->shash);
         if (ret < 0)
                 goto out;
@@ -196,6 +199,9 @@ int TSS_checkhmac1(unsigned char *buffer,
         va_list argp;
         int ret;
 
+        if (!chip)
+                return -ENODEV;
+
         bufsize = LOAD32(buffer, TPM_SIZE_OFFSET);
         tag = LOAD16(buffer, 0);
         ordinal = command;
@@ -363,6 +369,9 @@ int trusted_tpm_send(unsigned char *cmd, size_t buflen)
 {
         int rc;
 
+        if (!chip)
+                return -ENODEV;
+
         dump_tpm_buf(cmd);
         rc = tpm_send(chip, cmd, buflen);
         dump_tpm_buf(cmd);
@@ -429,6 +438,9 @@ int oiap(struct tpm_buf *tb, uint32_t *handle, unsigned char *nonce)
 {
         int ret;
 
+        if (!chip)
+                return -ENODEV;
+
         INIT_BUF(tb);
         store16(tb, TPM_TAG_RQU_COMMAND);
         store32(tb, TPM_OIAP_SIZE);
@@ -1245,9 +1257,13 @@ static int __init init_trusted(void)
 {
         int ret;
 
+        /* encrypted_keys.ko depends on successful load of this module even if
+         * TPM is not used.
+         */
         chip = tpm_default_chip();
         if (!chip)
-                return -ENOENT;
+                return 0;
+
         ret = init_digests();
         if (ret < 0)
                 goto err_put;
@@ -1269,10 +1285,12 @@ err_put:
 
 static void __exit cleanup_trusted(void)
 {
-        put_device(&chip->dev);
-        kfree(digests);
-        trusted_shash_release();
-        unregister_key_type(&key_type_trusted);
+        if (chip) {
+                put_device(&chip->dev);
+                kfree(digests);
+                trusted_shash_release();
+                unregister_key_type(&key_type_trusted);
+        }
 }
 
 late_initcall(init_trusted);
diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
index 5bf8e52c41fc..8e7c56e9590f 100644
--- a/tools/lib/bpf/Makefile
+++ b/tools/lib/bpf/Makefile
@@ -177,7 +177,7 @@ $(OUTPUT)libbpf.so: $(OUTPUT)libbpf.so.$(LIBBPF_VERSION)
 
 $(OUTPUT)libbpf.so.$(LIBBPF_VERSION): $(BPF_IN)
         $(QUIET_LINK)$(CC) --shared -Wl,-soname,libbpf.so.$(VERSION) \
-                                    -Wl,--version-script=$(VERSION_SCRIPT) $^ -o $@
+                                    -Wl,--version-script=$(VERSION_SCRIPT) $^ -lelf -o $@
         @ln -sf $(@F) $(OUTPUT)libbpf.so
         @ln -sf $(@F) $(OUTPUT)libbpf.so.$(VERSION)
 
@@ -220,8 +220,9 @@ install_lib: all_cmd
 install_headers:
         $(call QUIET_INSTALL, headers) \
                 $(call do_install,bpf.h,$(prefix)/include/bpf,644); \
-                $(call do_install,libbpf.h,$(prefix)/include/bpf,644);
-                $(call do_install,btf.h,$(prefix)/include/bpf,644);
+                $(call do_install,libbpf.h,$(prefix)/include/bpf,644); \
+                $(call do_install,btf.h,$(prefix)/include/bpf,644); \
+                $(call do_install,xsk.h,$(prefix)/include/bpf,644);
 
 install: install_lib
 
diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 87e3020ac1bc..cf119c9b6f27 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -2107,6 +2107,9 @@ static int btf_dedup_is_equiv(struct btf_dedup *d, __u32 cand_id,
                 return fwd_kind == real_kind;
         }
 
+        if (cand_kind != canon_kind)
+                return 0;
+
         switch (cand_kind) {
         case BTF_KIND_INT:
                 return btf_equal_int(cand_type, canon_type);
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index c3fad065c89c..c7727be9719f 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -44,6 +44,7 @@
 #include <cpuid.h>
 #include <linux/capability.h>
 #include <errno.h>
+#include <math.h>
 
 char *proc_stat = "/proc/stat";
 FILE *outf;
@@ -63,7 +64,6 @@ unsigned int dump_only;
 unsigned int do_snb_cstates;
 unsigned int do_knl_cstates;
 unsigned int do_slm_cstates;
-unsigned int do_cnl_cstates;
 unsigned int use_c1_residency_msr;
 unsigned int has_aperf;
 unsigned int has_epb;
@@ -141,9 +141,21 @@ unsigned int first_counter_read = 1;
 
 #define RAPL_CORES_ENERGY_STATUS        (1 << 9)
                                         /* 0x639 MSR_PP0_ENERGY_STATUS */
+#define RAPL_PER_CORE_ENERGY    (1 << 10)
+                                        /* Indicates cores energy collection is per-core,
+                                         * not per-package. */
+#define RAPL_AMD_F17H           (1 << 11)
+                                        /* 0xc0010299 MSR_RAPL_PWR_UNIT */
+                                        /* 0xc001029a MSR_CORE_ENERGY_STAT */
+                                        /* 0xc001029b MSR_PKG_ENERGY_STAT */
 #define RAPL_CORES (RAPL_CORES_ENERGY_STATUS | RAPL_CORES_POWER_LIMIT)
 #define TJMAX_DEFAULT   100
 
+/* MSRs that are not yet in the kernel-provided header. */
+#define MSR_RAPL_PWR_UNIT       0xc0010299
+#define MSR_CORE_ENERGY_STAT    0xc001029a
+#define MSR_PKG_ENERGY_STAT     0xc001029b
+
 #define MAX(a, b) ((a) > (b) ? (a) : (b))
 
 /*
@@ -187,6 +199,7 @@ struct core_data {
         unsigned long long c7;
         unsigned long long mc6_us;      /* duplicate as per-core for now, even though per module */
         unsigned int core_temp_c;
+        unsigned int core_energy;       /* MSR_CORE_ENERGY_STAT */
         unsigned int core_id;
         unsigned long long counter[MAX_ADDED_COUNTERS];
 } *core_even, *core_odd;
@@ -273,6 +286,7 @@ struct system_summary {
 
 struct cpu_topology {
         int physical_package_id;
+        int die_id;
         int logical_cpu_id;
         int physical_node_id;
         int logical_node_id;    /* 0-based count within the package */
@@ -283,6 +297,7 @@ struct cpu_topology {
 
 struct topo_params {
         int num_packages;
+        int num_die;
         int num_cpus;
         int num_cores;
         int max_cpu_num;
@@ -314,9 +329,8 @@ int for_all_cpus(int (func)(struct thread_data *, struct core_data *, struct pkg
         int retval, pkg_no, core_no, thread_no, node_no;
 
         for (pkg_no = 0; pkg_no < topo.num_packages; ++pkg_no) {
-                for (core_no = 0; core_no < topo.cores_per_node; ++core_no) {
-                        for (node_no = 0; node_no < topo.nodes_per_pkg;
-                             node_no++) {
+                for (node_no = 0; node_no < topo.nodes_per_pkg; node_no++) {
+                        for (core_no = 0; core_no < topo.cores_per_node; ++core_no) {
                                 for (thread_no = 0; thread_no <
                                         topo.threads_per_core; ++thread_no) {
                                         struct thread_data *t;
@@ -442,6 +456,7 @@ struct msr_counter bic[] = {
         { 0x0, "CPU" },
         { 0x0, "APIC" },
         { 0x0, "X2APIC" },
+        { 0x0, "Die" },
 };
 
 #define MAX_BIC (sizeof(bic) / sizeof(struct msr_counter))
@@ -495,6 +510,7 @@ struct msr_counter bic[] = {
 #define BIC_CPU         (1ULL << 47)
 #define BIC_APIC        (1ULL << 48)
 #define BIC_X2APIC      (1ULL << 49)
+#define BIC_Die         (1ULL << 50)
 
 #define BIC_DISABLED_BY_DEFAULT (BIC_USEC | BIC_TOD | BIC_APIC | BIC_X2APIC)
 
@@ -621,6 +637,8 @@ void print_header(char *delim)
                 outp += sprintf(outp, "%sTime_Of_Day_Seconds", (printed++ ? delim : ""));
         if (DO_BIC(BIC_Package))
                 outp += sprintf(outp, "%sPackage", (printed++ ? delim : ""));
+        if (DO_BIC(BIC_Die))
+                outp += sprintf(outp, "%sDie", (printed++ ? delim : ""));
         if (DO_BIC(BIC_Node))
                 outp += sprintf(outp, "%sNode", (printed++ ? delim : ""));
         if (DO_BIC(BIC_Core))
@@ -667,7 +685,7 @@ void print_header(char *delim)
 
         if (DO_BIC(BIC_CPU_c1))
                 outp += sprintf(outp, "%sCPU%%c1", (printed++ ? delim : ""));
-        if (DO_BIC(BIC_CPU_c3) && !do_slm_cstates && !do_knl_cstates && !do_cnl_cstates)
+        if (DO_BIC(BIC_CPU_c3))
                 outp += sprintf(outp, "%sCPU%%c3", (printed++ ? delim : ""));
         if (DO_BIC(BIC_CPU_c6))
                 outp += sprintf(outp, "%sCPU%%c6", (printed++ ? delim : ""));
@@ -680,6 +698,14 @@ void print_header(char *delim)
         if (DO_BIC(BIC_CoreTmp))
                 outp += sprintf(outp, "%sCoreTmp", (printed++ ? delim : ""));
 
+        if (do_rapl && !rapl_joules) {
+                if (DO_BIC(BIC_CorWatt) && (do_rapl & RAPL_PER_CORE_ENERGY))
+                        outp += sprintf(outp, "%sCorWatt", (printed++ ? delim : ""));
+        } else if (do_rapl && rapl_joules) {
+                if (DO_BIC(BIC_Cor_J) && (do_rapl & RAPL_PER_CORE_ENERGY))
+                        outp += sprintf(outp, "%sCor_J", (printed++ ? delim : ""));
+        }
+
         for (mp = sys.cp; mp; mp = mp->next) {
                 if (mp->format == FORMAT_RAW) {
                         if (mp->width == 64)
@@ -734,7 +760,7 @@ void print_header(char *delim)
         if (do_rapl && !rapl_joules) {
                 if (DO_BIC(BIC_PkgWatt))
                         outp += sprintf(outp, "%sPkgWatt", (printed++ ? delim : ""));
-                if (DO_BIC(BIC_CorWatt))
+                if (DO_BIC(BIC_CorWatt) && !(do_rapl & RAPL_PER_CORE_ENERGY))
                         outp += sprintf(outp, "%sCorWatt", (printed++ ? delim : ""));
                 if (DO_BIC(BIC_GFXWatt))
                         outp += sprintf(outp, "%sGFXWatt", (printed++ ? delim : ""));
@@ -747,7 +773,7 @@ void print_header(char *delim)
         } else if (do_rapl && rapl_joules) {
                 if (DO_BIC(BIC_Pkg_J))
                         outp += sprintf(outp, "%sPkg_J", (printed++ ? delim : ""));
-                if (DO_BIC(BIC_Cor_J))
+                if (DO_BIC(BIC_Cor_J) && !(do_rapl & RAPL_PER_CORE_ENERGY))
                         outp += sprintf(outp, "%sCor_J", (printed++ ? delim : ""));
                 if (DO_BIC(BIC_GFX_J))
                         outp += sprintf(outp, "%sGFX_J", (printed++ ? delim : ""));
@@ -808,6 +834,7 @@ int dump_counters(struct thread_data *t, struct core_data *c,
                 outp += sprintf(outp, "c6: %016llX\n", c->c6);
                 outp += sprintf(outp, "c7: %016llX\n", c->c7);
                 outp += sprintf(outp, "DTS: %dC\n", c->core_temp_c);
+                outp += sprintf(outp, "Joules: %0X\n", c->core_energy);
 
                 for (i = 0, mp = sys.cp; mp; i++, mp = mp->next) {
                         outp += sprintf(outp, "cADDED [%d] msr0x%x: %08llX\n",
@@ -904,6 +931,8 @@ int format_counters(struct thread_data *t, struct core_data *c,
         if (t == &average.threads) {
                 if (DO_BIC(BIC_Package))
                         outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
+                if (DO_BIC(BIC_Die))
+                        outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
                 if (DO_BIC(BIC_Node))
                         outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
                 if (DO_BIC(BIC_Core))
@@ -921,6 +950,12 @@ int format_counters(struct thread_data *t, struct core_data *c,
                         else
                                 outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
                 }
+                if (DO_BIC(BIC_Die)) {
+                        if (c)
+                                outp += sprintf(outp, "%s%d", (printed++ ? delim : ""), cpus[t->cpu_id].die_id);
+                        else
+                                outp += sprintf(outp, "%s-", (printed++ ? delim : ""));
+                }
                 if (DO_BIC(BIC_Node)) {
                         if (t)
                                 outp += sprintf(outp, "%s%d",
@@ -1003,7 +1038,7 @@ int format_counters(struct thread_data *t, struct core_data *c,
         if (!(t->flags & CPU_IS_FIRST_THREAD_IN_CORE))
                 goto done;
 
-        if (DO_BIC(BIC_CPU_c3) && !do_slm_cstates && !do_knl_cstates && !do_cnl_cstates)
+        if (DO_BIC(BIC_CPU_c3))
                 outp += sprintf(outp, "%s%.2f", (printed++ ? delim : ""), 100.0 * c->c3/tsc);
         if (DO_BIC(BIC_CPU_c6))
                 outp += sprintf(outp, "%s%.2f", (printed++ ? delim : ""), 100.0 * c->c6/tsc);
@@ -1033,6 +1068,20 @@ int format_counters(struct thread_data *t, struct core_data *c,
                 }
         }
 
+        /*
+         * If measurement interval exceeds minimum RAPL Joule Counter range,
+         * indicate that results are suspect by printing "**" in fraction place.
+         */
+        if (interval_float < rapl_joule_counter_range)
+                fmt8 = "%s%.2f";
+        else
+                fmt8 = "%6.0f**";
+
+        if (DO_BIC(BIC_CorWatt) && (do_rapl & RAPL_PER_CORE_ENERGY))
+                outp += sprintf(outp, fmt8, (printed++ ? delim : ""), c->core_energy * rapl_energy_units / interval_float);
+        if (DO_BIC(BIC_Cor_J) && (do_rapl & RAPL_PER_CORE_ENERGY))
+                outp += sprintf(outp, fmt8, (printed++ ? delim : ""), c->core_energy * rapl_energy_units);
+
         /* print per-package data only for 1st core in package */
         if (!(t->flags & CPU_IS_FIRST_CORE_IN_PACKAGE))
                 goto done;
@@ -1085,18 +1134,9 @@ int format_counters(struct thread_data *t, struct core_data *c,
         if (DO_BIC(BIC_SYS_LPI))
                 outp += sprintf(outp, "%s%.2f", (printed++ ? delim : ""), 100.0 * p->sys_lpi / 1000000.0 / interval_float);
 
-        /*
-         * If measurement interval exceeds minimum RAPL Joule Counter range,
-         * indicate that results are suspect by printing "**" in fraction place.
-         */
-        if (interval_float < rapl_joule_counter_range)
-                fmt8 = "%s%.2f";
-        else
-                fmt8 = "%6.0f**";
-
         if (DO_BIC(BIC_PkgWatt))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_pkg * rapl_energy_units / interval_float);
-        if (DO_BIC(BIC_CorWatt))
+        if (DO_BIC(BIC_CorWatt) && !(do_rapl & RAPL_PER_CORE_ENERGY))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_cores * rapl_energy_units / interval_float);
         if (DO_BIC(BIC_GFXWatt))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_gfx * rapl_energy_units / interval_float);
@@ -1104,7 +1144,7 @@ int format_counters(struct thread_data *t, struct core_data *c,
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_dram * rapl_dram_energy_units / interval_float);
         if (DO_BIC(BIC_Pkg_J))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_pkg * rapl_energy_units);
-        if (DO_BIC(BIC_Cor_J))
+        if (DO_BIC(BIC_Cor_J) && !(do_rapl & RAPL_PER_CORE_ENERGY))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_cores * rapl_energy_units);
         if (DO_BIC(BIC_GFX_J))
                 outp += sprintf(outp, fmt8, (printed++ ? delim : ""), p->energy_gfx * rapl_energy_units);
@@ -1249,6 +1289,8 @@ delta_core(struct core_data *new, struct core_data *old)
         old->core_temp_c = new->core_temp_c;
         old->mc6_us = new->mc6_us - old->mc6_us;
 
+        DELTA_WRAP32(new->core_energy, old->core_energy);
+
         for (i = 0, mp = sys.cp; mp; i++, mp = mp->next) {
                 if (mp->format == FORMAT_RAW)
                         old->counter[i] = new->counter[i];
@@ -1391,6 +1433,7 @@ void clear_counters(struct thread_data *t, struct core_data *c, struct pkg_data
         c->c7 = 0;
         c->mc6_us = 0;
         c->core_temp_c = 0;
+        c->core_energy = 0;
 
         p->pkg_wtd_core_c0 = 0;
         p->pkg_any_core_c0 = 0;
@@ -1473,6 +1516,8 @@ int sum_counters(struct thread_data *t, struct core_data *c,
 
         average.cores.core_temp_c = MAX(average.cores.core_temp_c, c->core_temp_c);
 
+        average.cores.core_energy += c->core_energy;
+
         for (i = 0, mp = sys.cp; mp; i++, mp = mp->next) {
                 if (mp->format == FORMAT_RAW)
                         continue;
@@ -1818,7 +1863,7 @@ retry:
         if (!(t->flags & CPU_IS_FIRST_THREAD_IN_CORE))
                 goto done;
 
-        if (DO_BIC(BIC_CPU_c3) && !do_slm_cstates && !do_knl_cstates && !do_cnl_cstates) {
+        if (DO_BIC(BIC_CPU_c3)) {
                 if (get_msr(cpu, MSR_CORE_C3_RESIDENCY, &c->c3))
                         return -6;
         }
@@ -1845,6 +1890,12 @@ retry:
                 c->core_temp_c = tcc_activation_temp - ((msr >> 16) & 0x7F);
         }
 
+        if (do_rapl & RAPL_AMD_F17H) {
+                if (get_msr(cpu, MSR_CORE_ENERGY_STAT, &msr))
+                        return -14;
+                c->core_energy = msr & 0xFFFFFFFF;
+        }
+
         for (i = 0, mp = sys.cp; mp; i++, mp = mp->next) {
                 if (get_mp(cpu, mp, &c->counter[i]))
                         return -10;
@@ -1934,6 +1985,11 @@ retry:
                         return -16;
                 p->rapl_dram_perf_status = msr & 0xFFFFFFFF;
         }
+        if (do_rapl & RAPL_AMD_F17H) {
+                if (get_msr(cpu, MSR_PKG_ENERGY_STAT, &msr))
+                        return -13;
+                p->energy_pkg = msr & 0xFFFFFFFF;
+        }
         if (DO_BIC(BIC_PkgTmp)) {
                 if (get_msr(cpu, MSR_IA32_PACKAGE_THERM_STATUS, &msr))
                         return -17;
@@ -2456,6 +2512,8 @@ void free_all_buffers(void)
 
 /*
  * Parse a file containing a single int.
+ * Return 0 if file can not be opened
+ * Exit if file can be opened, but can not be parsed
  */
 int parse_int_file(const char *fmt, ...)
 {
@@ -2467,7 +2525,9 @@ int parse_int_file(const char *fmt, ...)
         va_start(args, fmt);
         vsnprintf(path, sizeof(path), fmt, args);
         va_end(args);
-        filep = fopen_or_die(path, "r");
+        filep = fopen(path, "r");
+        if (!filep)
+                return 0;
         if (fscanf(filep, "%d", &value) != 1)
                 err(1, "%s: failed to parse number from file", path);
         fclose(filep);
@@ -2488,6 +2548,11 @@ int get_physical_package_id(int cpu)
         return parse_int_file("/sys/devices/system/cpu/cpu%d/topology/physical_package_id", cpu);
 }
 
+int get_die_id(int cpu)
+{
+        return parse_int_file("/sys/devices/system/cpu/cpu%d/topology/die_id", cpu);
+}
+
 int get_core_id(int cpu)
 {
         return parse_int_file("/sys/devices/system/cpu/cpu%d/topology/core_id", cpu);
@@ -2578,7 +2643,8 @@ int get_thread_siblings(struct cpu_topology *thiscpu)
         filep = fopen_or_die(path, "r");
         do {
                 offset -= BITMASK_SIZE;
-                fscanf(filep, "%lx%c", &map, &character);
+                if (fscanf(filep, "%lx%c", &map, &character) != 2)
+                        err(1, "%s: failed to parse file", path);
                 for (shift = 0; shift < BITMASK_SIZE; shift++) {
                         if ((map >> shift) & 0x1) {
                                 so = shift + offset;
@@ -2855,8 +2921,11 @@ int snapshot_cpu_lpi_us(void)
         fp = fopen_or_die("/sys/devices/system/cpu/cpuidle/low_power_idle_cpu_residency_us", "r");
 
         retval = fscanf(fp, "%lld", &cpuidle_cur_cpu_lpi_us);
-        if (retval != 1)
-                err(1, "CPU LPI");
+        if (retval != 1) {
+                fprintf(stderr, "Disabling Low Power Idle CPU output\n");
+                BIC_NOT_PRESENT(BIC_CPU_LPI);
+                return -1;
+        }
 
         fclose(fp);
 
@@ -2878,9 +2947,11 @@ int snapshot_sys_lpi_us(void)
         fp = fopen_or_die("/sys/devices/system/cpu/cpuidle/low_power_idle_system_residency_us", "r");
 
         retval = fscanf(fp, "%lld", &cpuidle_cur_sys_lpi_us);
-        if (retval != 1)
-                err(1, "SYS LPI");
-
+        if (retval != 1) {
+                fprintf(stderr, "Disabling Low Power Idle System output\n");
+                BIC_NOT_PRESENT(BIC_SYS_LPI);
+                return -1;
+        }
         fclose(fp);
 
         return 0;
@@ -3410,14 +3481,14 @@ dump_sysfs_cstate_config(void)
                 input = fopen(path, "r");
                 if (input == NULL)
                         continue;
-                fgets(name_buf, sizeof(name_buf), input);
+                if (!fgets(name_buf, sizeof(name_buf), input))
+                        err(1, "%s: failed to read file", path);
 
                  /* truncate "C1-HSW\n" to "C1", or truncate "C1\n" to "C1" */
                 sp = strchr(name_buf, '-');
                 if (!sp)
                         sp = strchrnul(name_buf, '\n');
                 *sp = '\0';
-
                 fclose(input);
 
                 sprintf(path, "/sys/devices/system/cpu/cpu%d/cpuidle/state%d/desc",
@@ -3425,7 +3496,8 @@ dump_sysfs_cstate_config(void)
                 input = fopen(path, "r");
                 if (input == NULL)
                         continue;
-                fgets(desc, sizeof(desc), input);
+                if (!fgets(desc, sizeof(desc), input))
+                        err(1, "%s: failed to read file", path);
 
                 fprintf(outf, "cpu%d: %s: %s", base_cpu, name_buf, desc);
                 fclose(input);
@@ -3444,20 +3516,22 @@ dump_sysfs_pstate_config(void)
                         base_cpu);
         input = fopen(path, "r");
         if (input == NULL) {
-                fprintf(stderr, "NSFOD %s\n", path);
+                fprintf(outf, "NSFOD %s\n", path);
                 return;
         }
-        fgets(driver_buf, sizeof(driver_buf), input);
+        if (!fgets(driver_buf, sizeof(driver_buf), input))
+                err(1, "%s: failed to read file", path);
         fclose(input);
 
         sprintf(path, "/sys/devices/system/cpu/cpu%d/cpufreq/scaling_governor",
                         base_cpu);
         input = fopen(path, "r");
         if (input == NULL) {
-                fprintf(stderr, "NSFOD %s\n", path);
+                fprintf(outf, "NSFOD %s\n", path);
                 return;
         }
-        fgets(governor_buf, sizeof(governor_buf), input);
+        if (!fgets(governor_buf, sizeof(governor_buf), input))
+                err(1, "%s: failed to read file", path);
         fclose(input);
 
         fprintf(outf, "cpu%d: cpufreq driver: %s", base_cpu, driver_buf);
@@ -3466,7 +3540,8 @@ dump_sysfs_pstate_config(void)
         sprintf(path, "/sys/devices/system/cpu/cpufreq/boost");
         input = fopen(path, "r");
         if (input != NULL) {
-                fscanf(input, "%d", &turbo);
+                if (fscanf(input, "%d", &turbo) != 1)
+                        err(1, "%s: failed to parse number from file", path);
                 fprintf(outf, "cpufreq boost: %d\n", turbo);
                 fclose(input);
         }
@@ -3474,7 +3549,8 @@ dump_sysfs_pstate_config(void)
         sprintf(path, "/sys/devices/system/cpu/intel_pstate/no_turbo");
         input = fopen(path, "r");
         if (input != NULL) {
-                fscanf(input, "%d", &turbo);
+                if (fscanf(input, "%d", &turbo) != 1)
+                        err(1, "%s: failed to parse number from file", path);
                 fprintf(outf, "cpufreq intel_pstate no_turbo: %d\n", turbo);
                 fclose(input);
         }
@@ -3718,7 +3794,7 @@ int print_perf_limit(struct thread_data *t, struct core_data *c, struct pkg_data
 #define RAPL_POWER_GRANULARITY  0x7FFF  /* 15 bit power granularity */
 #define RAPL_TIME_GRANULARITY   0x3F /* 6 bit time granularity */
 
-double get_tdp(unsigned int model)
+double get_tdp_intel(unsigned int model)
 {
         unsigned long long msr;
 
@@ -3735,6 +3811,16 @@ double get_tdp(unsigned int model)
         }
 }
 
+double get_tdp_amd(unsigned int family)
+{
+        switch (family) {
+        case 0x17:
+        default:
+                /* This is the max stock TDP of HEDT/Server Fam17h chips */
+                return 250.0;
+        }
+}
+
 /*
  * rapl_dram_energy_units_probe()
  * Energy units are either hard-coded, or come from RAPL Energy Unit MSR.
@@ -3754,21 +3840,12 @@ rapl_dram_energy_units_probe(int  model, double rapl_energy_units)
         }
 }
 
-
-/*
- * rapl_probe()
- *
- * sets do_rapl, rapl_power_units, rapl_energy_units, rapl_time_units
- */
-void rapl_probe(unsigned int family, unsigned int model)
+void rapl_probe_intel(unsigned int family, unsigned int model)
 {
         unsigned long long msr;
         unsigned int time_unit;
         double tdp;
 
-        if (!genuine_intel)
-                return;
-
         if (family != 6)
                 return;
 
@@ -3892,13 +3969,69 @@ void rapl_probe(unsigned int family, unsigned int model)
 
         rapl_time_units = 1.0 / (1 << (time_unit));
 
-        tdp = get_tdp(model);
+        tdp = get_tdp_intel(model);
 
         rapl_joule_counter_range = 0xFFFFFFFF * rapl_energy_units / tdp;
         if (!quiet)
                 fprintf(outf, "RAPL: %.0f sec. Joule Counter Range, at %.0f Watts\n", rapl_joule_counter_range, tdp);
+}
 
-        return;
+void rapl_probe_amd(unsigned int family, unsigned int model)
+{
+        unsigned long long msr;
+        unsigned int eax, ebx, ecx, edx;
+        unsigned int has_rapl = 0;
+        double tdp;
+
+        if (max_extended_level >= 0x80000007) {
+                __cpuid(0x80000007, eax, ebx, ecx, edx);
+                /* RAPL (Fam 17h) */
+                has_rapl = edx & (1 << 14);
+        }
+
+        if (!has_rapl)
+                return;
+
+        switch (family) {
+        case 0x17: /* Zen, Zen+ */
+                do_rapl = RAPL_AMD_F17H | RAPL_PER_CORE_ENERGY;
+                if (rapl_joules) {
+                        BIC_PRESENT(BIC_Pkg_J);
+                        BIC_PRESENT(BIC_Cor_J);
+                } else {
+                        BIC_PRESENT(BIC_PkgWatt);
+                        BIC_PRESENT(BIC_CorWatt);
+                }
+                break;
+        default:
+                return;
+        }
+
+        if (get_msr(base_cpu, MSR_RAPL_PWR_UNIT, &msr))
+                return;
+
+        rapl_time_units = ldexp(1.0, -(msr >> 16 & 0xf));
+        rapl_energy_units = ldexp(1.0, -(msr >> 8 & 0x1f));
+        rapl_power_units = ldexp(1.0, -(msr & 0xf));
+
+        tdp = get_tdp_amd(model);
+
+        rapl_joule_counter_range = 0xFFFFFFFF * rapl_energy_units / tdp;
+        if (!quiet)
+                fprintf(outf, "RAPL: %.0f sec. Joule Counter Range, at %.0f Watts\n", rapl_joule_counter_range, tdp);
+}
+
+/*
+ * rapl_probe()
+ *
+ * sets do_rapl, rapl_power_units, rapl_energy_units, rapl_time_units
+ */
+void rapl_probe(unsigned int family, unsigned int model)
+{
+        if (genuine_intel)
+                rapl_probe_intel(family, model);
+        if (authentic_amd)
+                rapl_probe_amd(family, model);
 }
 
 void perf_limit_reasons_probe(unsigned int family, unsigned int model)
@@ -4003,6 +4136,7 @@ void print_power_limit_msr(int cpu, unsigned long long msr, char *label)
 int print_rapl(struct thread_data *t, struct core_data *c, struct pkg_data *p)
 {
         unsigned long long msr;
+        const char *msr_name;
         int cpu;
 
         if (!do_rapl)
@@ -4018,10 +4152,17 @@ int print_rapl(struct thread_data *t, struct core_data *c, struct pkg_data *p)
                 return -1;
         }
 
-        if (get_msr(cpu, MSR_RAPL_POWER_UNIT, &msr))
-                return -1;
+        if (do_rapl & RAPL_AMD_F17H) {
+                msr_name = "MSR_RAPL_PWR_UNIT";
+                if (get_msr(cpu, MSR_RAPL_PWR_UNIT, &msr))
+                        return -1;
+        } else {
+                msr_name = "MSR_RAPL_POWER_UNIT";
+                if (get_msr(cpu, MSR_RAPL_POWER_UNIT, &msr))
+                        return -1;
+        }
 
-        fprintf(outf, "cpu%d: MSR_RAPL_POWER_UNIT: 0x%08llx (%f Watts, %f Joules, %f sec.)\n", cpu, msr,
+        fprintf(outf, "cpu%d: %s: 0x%08llx (%f Watts, %f Joules, %f sec.)\n", cpu, msr_name, msr,
                 rapl_power_units, rapl_energy_units, rapl_time_units);
 
         if (do_rapl & RAPL_PKG_POWER_INFO) {
@@ -4451,6 +4592,9 @@ unsigned int intel_model_duplicates(unsigned int model)
         case INTEL_FAM6_KABYLAKE_MOBILE:
         case INTEL_FAM6_KABYLAKE_DESKTOP:
                 return INTEL_FAM6_SKYLAKE_MOBILE;
+
+        case INTEL_FAM6_ICELAKE_MOBILE:
+                return INTEL_FAM6_CANNONLAKE_MOBILE;
         }
         return model;
 }
@@ -4702,7 +4846,9 @@ void process_cpuid()
         }
         do_slm_cstates = is_slm(family, model);
         do_knl_cstates  = is_knl(family, model);
-        do_cnl_cstates = is_cnl(family, model);
+
+        if (do_slm_cstates || do_knl_cstates || is_cnl(family, model))
+                BIC_NOT_PRESENT(BIC_CPU_c3);
 
         if (!quiet)
                 decode_misc_pwr_mgmt_msr();
@@ -4769,6 +4915,7 @@ void topology_probe()
         int i;
         int max_core_id = 0;
         int max_package_id = 0;
+        int max_die_id = 0;
         int max_siblings = 0;
 
         /* Initialize num_cpus, max_cpu_num */
@@ -4835,6 +4982,11 @@ void topology_probe()
                 if (cpus[i].physical_package_id > max_package_id)
                         max_package_id = cpus[i].physical_package_id;
 
+                /* get die information */
+                cpus[i].die_id = get_die_id(i);
+                if (cpus[i].die_id > max_die_id)
+                        max_die_id = cpus[i].die_id;
+
                 /* get numa node information */
                 cpus[i].physical_node_id = get_physical_node_id(&cpus[i]);
                 if (cpus[i].physical_node_id > topo.max_node_num)
@@ -4860,6 +5012,13 @@ void topology_probe()
         if (!summary_only && topo.cores_per_node > 1)
                 BIC_PRESENT(BIC_Core);
 
+        topo.num_die = max_die_id + 1;
+        if (debug > 1)
+                fprintf(outf, "max_die_id %d, sizing for %d die\n",
+                                max_die_id, topo.num_die);
+        if (!summary_only && topo.num_die > 1)
+                BIC_PRESENT(BIC_Die);
+
         topo.num_packages = max_package_id + 1;
         if (debug > 1)
                 fprintf(outf, "max_package_id %d, sizing for %d packages\n",
@@ -4884,8 +5043,8 @@ void topology_probe()
                 if (cpu_is_not_present(i))
                         continue;
                 fprintf(outf,
-                        "cpu %d pkg %d node %d lnode %d core %d thread %d\n",
-                        i, cpus[i].physical_package_id,
+                        "cpu %d pkg %d die %d node %d lnode %d core %d thread %d\n",
+                        i, cpus[i].physical_package_id, cpus[i].die_id,
                         cpus[i].physical_node_id,
                         cpus[i].logical_node_id,
                         cpus[i].physical_core_id,
@@ -5122,7 +5281,7 @@ int get_and_dump_counters(void)
 }
 
 void print_version() {
-        fprintf(outf, "turbostat version 18.07.27"
+        fprintf(outf, "turbostat version 19.03.20"
                 " - Len Brown <lenb@kernel.org>\n");
 }
 
@@ -5319,7 +5478,8 @@ void probe_sysfs(void)
                 input = fopen(path, "r");
                 if (input == NULL)
                         continue;
-                fgets(name_buf, sizeof(name_buf), input);
+                if (!fgets(name_buf, sizeof(name_buf), input))
+                        err(1, "%s: failed to read file", path);
 
                  /* truncate "C1-HSW\n" to "C1", or truncate "C1\n" to "C1" */
                 sp = strchr(name_buf, '-');
@@ -5346,7 +5506,8 @@ void probe_sysfs(void)
                 input = fopen(path, "r");
                 if (input == NULL)
                         continue;
-                fgets(name_buf, sizeof(name_buf), input);
+                if (!fgets(name_buf, sizeof(name_buf), input))
+                        err(1, "%s: failed to read file", path);
                  /* truncate "C1-HSW\n" to "C1", or truncate "C1\n" to "C1" */
                 sp = strchr(name_buf, '-');
                 if (!sp)
diff --git a/tools/testing/selftests/bpf/prog_tests/flow_dissector.c b/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
index bcbd928c96ab..fc818bc1d729 100644
--- a/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
+++ b/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
@@ -39,6 +39,58 @@ static struct bpf_flow_keys pkt_v6_flow_keys = {
         .n_proto = __bpf_constant_htons(ETH_P_IPV6),
 };
 
+#define VLAN_HLEN       4
+
+static struct {
+        struct ethhdr eth;
+        __u16 vlan_tci;
+        __u16 vlan_proto;
+        struct iphdr iph;
+        struct tcphdr tcp;
+} __packed pkt_vlan_v4 = {
+        .eth.h_proto = __bpf_constant_htons(ETH_P_8021Q),
+        .vlan_proto = __bpf_constant_htons(ETH_P_IP),
+        .iph.ihl = 5,
+        .iph.protocol = IPPROTO_TCP,
+        .iph.tot_len = __bpf_constant_htons(MAGIC_BYTES),
+        .tcp.urg_ptr = 123,
+        .tcp.doff = 5,
+};
+
+static struct bpf_flow_keys pkt_vlan_v4_flow_keys = {
+        .nhoff = VLAN_HLEN,
+        .thoff = VLAN_HLEN + sizeof(struct iphdr),
+        .addr_proto = ETH_P_IP,
+        .ip_proto = IPPROTO_TCP,
+        .n_proto = __bpf_constant_htons(ETH_P_IP),
+};
+
+static struct {
+        struct ethhdr eth;
+        __u16 vlan_tci;
+        __u16 vlan_proto;
+        __u16 vlan_tci2;
+        __u16 vlan_proto2;
+        struct ipv6hdr iph;
+        struct tcphdr tcp;
+} __packed pkt_vlan_v6 = {
+        .eth.h_proto = __bpf_constant_htons(ETH_P_8021AD),
+        .vlan_proto = __bpf_constant_htons(ETH_P_8021Q),
+        .vlan_proto2 = __bpf_constant_htons(ETH_P_IPV6),
+        .iph.nexthdr = IPPROTO_TCP,
+        .iph.payload_len = __bpf_constant_htons(MAGIC_BYTES),
+        .tcp.urg_ptr = 123,
+        .tcp.doff = 5,
+};
+
+static struct bpf_flow_keys pkt_vlan_v6_flow_keys = {
+        .nhoff = VLAN_HLEN * 2,
+        .thoff = VLAN_HLEN * 2 + sizeof(struct ipv6hdr),
+        .addr_proto = ETH_P_IPV6,
+        .ip_proto = IPPROTO_TCP,
+        .n_proto = __bpf_constant_htons(ETH_P_IPV6),
+};
+
 void test_flow_dissector(void)
 {
         struct bpf_flow_keys flow_keys;
@@ -68,5 +120,21 @@ void test_flow_dissector(void)
               err, errno, retval, duration, size, sizeof(flow_keys));
         CHECK_FLOW_KEYS("ipv6_flow_keys", flow_keys, pkt_v6_flow_keys);
 
+        err = bpf_prog_test_run(prog_fd, 10, &pkt_vlan_v4, sizeof(pkt_vlan_v4),
+                                &flow_keys, &size, &retval, &duration);
+        CHECK(size != sizeof(flow_keys) || err || retval != 1, "vlan_ipv4",
+              "err %d errno %d retval %d duration %d size %u/%lu\n",
+              err, errno, retval, duration, size, sizeof(flow_keys));
+        CHECK_FLOW_KEYS("vlan_ipv4_flow_keys", flow_keys,
+                        pkt_vlan_v4_flow_keys);
+
+        err = bpf_prog_test_run(prog_fd, 10, &pkt_vlan_v6, sizeof(pkt_vlan_v6),
+                                &flow_keys, &size, &retval, &duration);
+        CHECK(size != sizeof(flow_keys) || err || retval != 1, "vlan_ipv6",
+              "err %d errno %d retval %d duration %d size %u/%lu\n",
+              err, errno, retval, duration, size, sizeof(flow_keys));
+        CHECK_FLOW_KEYS("vlan_ipv6_flow_keys", flow_keys,
+                        pkt_vlan_v6_flow_keys);
+
         bpf_object__close(obj);
 }
diff --git a/tools/testing/selftests/bpf/progs/bpf_flow.c b/tools/testing/selftests/bpf/progs/bpf_flow.c
index 284660f5aa95..75b17cada539 100644
--- a/tools/testing/selftests/bpf/progs/bpf_flow.c
+++ b/tools/testing/selftests/bpf/progs/bpf_flow.c
@@ -92,7 +92,6 @@ static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto)
 {
         struct bpf_flow_keys *keys = skb->flow_keys;
 
-        keys->n_proto = proto;
         switch (proto) {
         case bpf_htons(ETH_P_IP):
                 bpf_tail_call(skb, &jmp_table, IP);
@@ -119,10 +118,9 @@ static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto)
 SEC("flow_dissector")
 int _dissect(struct __sk_buff *skb)
 {
-        if (!skb->vlan_present)
-                return parse_eth_proto(skb, skb->protocol);
-        else
-                return parse_eth_proto(skb, skb->vlan_proto);
+        struct bpf_flow_keys *keys = skb->flow_keys;
+
+        return parse_eth_proto(skb, keys->n_proto);
 }
 
 /* Parses on IPPROTO_* */
@@ -336,15 +334,9 @@ PROG(VLAN)(struct __sk_buff *skb)
 {
         struct bpf_flow_keys *keys = skb->flow_keys;
         struct vlan_hdr *vlan, _vlan;
-        __be16 proto;
-
-        /* Peek back to see if single or double-tagging */
-        if (bpf_skb_load_bytes(skb, keys->thoff - sizeof(proto), &proto,
-                               sizeof(proto)))
-                return BPF_DROP;
 
         /* Account for double-tagging */
-        if (proto == bpf_htons(ETH_P_8021AD)) {
+        if (keys->n_proto == bpf_htons(ETH_P_8021AD)) {
                 vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
                 if (!vlan)
                         return BPF_DROP;
@@ -352,6 +344,7 @@ PROG(VLAN)(struct __sk_buff *skb)
                 if (vlan->h_vlan_encapsulated_proto != bpf_htons(ETH_P_8021Q))
                         return BPF_DROP;
 
+                keys->nhoff += sizeof(*vlan);
                 keys->thoff += sizeof(*vlan);
         }
 
@@ -359,12 +352,14 @@ PROG(VLAN)(struct __sk_buff *skb)
         if (!vlan)
                 return BPF_DROP;
 
+        keys->nhoff += sizeof(*vlan);
         keys->thoff += sizeof(*vlan);
         /* Only allow 8021AD + 8021Q double tagging and no triple tagging.*/
         if (vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021AD) ||
             vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021Q))
                 return BPF_DROP;
 
+        keys->n_proto = vlan->h_vlan_encapsulated_proto;
         return parse_eth_proto(skb, vlan->h_vlan_encapsulated_proto);
 }
 
diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c
index 23e3b314ca60..ec5794e4205b 100644
--- a/tools/testing/selftests/bpf/test_btf.c
+++ b/tools/testing/selftests/bpf/test_btf.c
@@ -5777,6 +5777,53 @@ const struct btf_dedup_test dedup_tests[] = {
         },
 },
 {
+        .descr = "dedup: void equiv check",
+        /*
+         * // CU 1:
+         * struct s {
+         *      struct {} *x;
+         * };
+         * // CU 2:
+         * struct s {
+         *      int *x;
+         * };
+         */
+        .input = {
+                .raw_types = {
+                        /* CU 1 */
+                        BTF_STRUCT_ENC(0, 0, 1),                                /* [1] struct {}  */
+                        BTF_PTR_ENC(1),                                         /* [2] ptr -> [1] */
+                        BTF_STRUCT_ENC(NAME_NTH(1), 1, 8),                      /* [3] struct s   */
+                                BTF_MEMBER_ENC(NAME_NTH(2), 2, 0),
+                        /* CU 2 */
+                        BTF_PTR_ENC(0),                                         /* [4] ptr -> void */
+                        BTF_STRUCT_ENC(NAME_NTH(1), 1, 8),                      /* [5] struct s   */
+                                BTF_MEMBER_ENC(NAME_NTH(2), 4, 0),
+                        BTF_END_RAW,
+                },
+                BTF_STR_SEC("\0s\0x"),
+        },
+        .expect = {
+                .raw_types = {
+                        /* CU 1 */
+                        BTF_STRUCT_ENC(0, 0, 1),                                /* [1] struct {}  */
+                        BTF_PTR_ENC(1),                                         /* [2] ptr -> [1] */
+                        BTF_STRUCT_ENC(NAME_NTH(1), 1, 8),                      /* [3] struct s   */
+                                BTF_MEMBER_ENC(NAME_NTH(2), 2, 0),
+                        /* CU 2 */
+                        BTF_PTR_ENC(0),                                         /* [4] ptr -> void */
+                        BTF_STRUCT_ENC(NAME_NTH(1), 1, 8),                      /* [5] struct s   */
+                                BTF_MEMBER_ENC(NAME_NTH(2), 4, 0),
+                        BTF_END_RAW,
+                },
+                BTF_STR_SEC("\0s\0x"),
+        },
+        .opts = {
+                .dont_resolve_fwds = false,
+                .dedup_table_size = 1, /* force hash collisions */
+        },
+},
+{
         .descr = "dedup: all possible kinds (no duplicates)",
         .input = {
                 .raw_types = {
diff --git a/tools/testing/selftests/bpf/verifier/calls.c b/tools/testing/selftests/bpf/verifier/calls.c
index f2ccae39ee66..fb11240b758b 100644
--- a/tools/testing/selftests/bpf/verifier/calls.c
+++ b/tools/testing/selftests/bpf/verifier/calls.c
@@ -908,6 +908,44 @@
         .result = REJECT,
 },
 {
+        "calls: stack depth check in dead code",
+        .insns = {
+        /* main */
+        BPF_MOV64_IMM(BPF_REG_1, 0),
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */
+        BPF_EXIT_INSN(),
+        /* A */
+        BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2), /* call B */
+        BPF_MOV64_IMM(BPF_REG_0, 0),
+        BPF_EXIT_INSN(),
+        /* B */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */
+        BPF_EXIT_INSN(),
+        /* C */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */
+        BPF_EXIT_INSN(),
+        /* D */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */
+        BPF_EXIT_INSN(),
+        /* E */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */
+        BPF_EXIT_INSN(),
+        /* F */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */
+        BPF_EXIT_INSN(),
+        /* G */
+        BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */
+        BPF_EXIT_INSN(),
+        /* H */
+        BPF_MOV64_IMM(BPF_REG_0, 0),
+        BPF_EXIT_INSN(),
+        },
+        .prog_type = BPF_PROG_TYPE_XDP,
+        .errstr = "call stack",
+        .result = REJECT,
+},
+{
         "calls: spill into caller stack frame",
         .insns = {
         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/sample.json b/tools/testing/selftests/tc-testing/tc-tests/actions/sample.json
index 27f0acaed880..ddabb160a11b 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/sample.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/sample.json
@@ -144,6 +144,30 @@
         ]
     },
     {
+        "id": "7571",
+        "name": "Add sample action with invalid rate",
+        "category": [
+            "actions",
+            "sample"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action sample",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action sample rate 0 group 1 index 2",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions get action sample index 2",
+        "matchPattern": "action order [0-9]+: sample rate 1/0 group 1.*index 2 ref",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action sample"
+        ]
+    },
+    {
         "id": "b6d4",
         "name": "Add sample action with mandatory arguments and invalid control action",
         "category": [
diff --git a/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json b/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json
index 99a5ffca1088..2d096b2abf2c 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json
@@ -19,6 +19,26 @@
         ]
     },
     {
+        "id": "2638",
+        "name": "Add matchall and try to get it",
+        "category": [
+            "filter",
+            "matchall"
+        ],
+        "setup": [
+            "$TC qdisc add dev $DEV1 clsact",
+            "$TC filter add dev $DEV1 protocol all pref 1 ingress handle 0x1234 matchall action ok"
+        ],
+        "cmdUnderTest": "$TC filter get dev $DEV1 protocol all pref 1 ingress handle 0x1234 matchall",
+        "expExitCode": "0",
+        "verifyCmd": "$TC filter show dev $DEV1 ingress",
+        "matchPattern": "filter protocol all pref 1 matchall chain 0 handle 0x1234",
+        "matchCount": "1",
+        "teardown": [
+            "$TC qdisc del dev $DEV1 clsact"
+        ]
+    },
+    {
         "id": "d052",
         "name": "Add 1M filters with the same action",
         "category": [
diff --git a/tools/testing/selftests/tpm2/tpm2.py b/tools/testing/selftests/tpm2/tpm2.py
index 40ea95ce2ead..828c18584624 100644
--- a/tools/testing/selftests/tpm2/tpm2.py
+++ b/tools/testing/selftests/tpm2/tpm2.py
@@ -22,6 +22,7 @@ TPM2_CC_UNSEAL = 0x015E
 TPM2_CC_FLUSH_CONTEXT = 0x0165
 TPM2_CC_START_AUTH_SESSION = 0x0176
 TPM2_CC_GET_CAPABILITY  = 0x017A
+TPM2_CC_GET_RANDOM = 0x017B
 TPM2_CC_PCR_READ = 0x017E
 TPM2_CC_POLICY_PCR = 0x017F
 TPM2_CC_PCR_EXTEND = 0x0182
@@ -357,9 +358,9 @@ class Client:
         self.flags = flags
 
         if (self.flags & Client.FLAG_SPACE) == 0:
-            self.tpm = open('/dev/tpm0', 'r+b')
+            self.tpm = open('/dev/tpm0', 'r+b', buffering=0)
         else:
-            self.tpm = open('/dev/tpmrm0', 'r+b')
+            self.tpm = open('/dev/tpmrm0', 'r+b', buffering=0)
 
     def close(self):
         self.tpm.close()
diff --git a/tools/testing/selftests/tpm2/tpm2_tests.py b/tools/testing/selftests/tpm2/tpm2_tests.py
index 3bb066fea4a0..d4973be53493 100644
--- a/tools/testing/selftests/tpm2/tpm2_tests.py
+++ b/tools/testing/selftests/tpm2/tpm2_tests.py
@@ -158,6 +158,69 @@ class SmokeTest(unittest.TestCase):
             pass
         self.assertEqual(rejected, True)
 
+    def test_read_partial_resp(self):
+        try:
+            fmt = '>HIIH'
+            cmd = struct.pack(fmt,
+                              tpm2.TPM2_ST_NO_SESSIONS,
+                              struct.calcsize(fmt),
+                              tpm2.TPM2_CC_GET_RANDOM,
+                              0x20)
+            self.client.tpm.write(cmd)
+            hdr = self.client.tpm.read(10)
+            sz = struct.unpack('>I', hdr[2:6])[0]
+            rsp = self.client.tpm.read()
+        except:
+            pass
+        self.assertEqual(sz, 10 + 2 + 32)
+        self.assertEqual(len(rsp), 2 + 32)
+
+    def test_read_partial_overwrite(self):
+        try:
+            fmt = '>HIIH'
+            cmd = struct.pack(fmt,
+                              tpm2.TPM2_ST_NO_SESSIONS,
+                              struct.calcsize(fmt),
+                              tpm2.TPM2_CC_GET_RANDOM,
+                              0x20)
+            self.client.tpm.write(cmd)
+            # Read part of the respone
+            rsp1 = self.client.tpm.read(15)
+
+            # Send a new cmd
+            self.client.tpm.write(cmd)
+
+            # Read the whole respone
+            rsp2 = self.client.tpm.read()
+        except:
+            pass
+        self.assertEqual(len(rsp1), 15)
+        self.assertEqual(len(rsp2), 10 + 2 + 32)
+
+    def test_send_two_cmds(self):
+        rejected = False
+        try:
+            fmt = '>HIIH'
+            cmd = struct.pack(fmt,
+                              tpm2.TPM2_ST_NO_SESSIONS,
+                              struct.calcsize(fmt),
+                              tpm2.TPM2_CC_GET_RANDOM,
+                              0x20)
+            self.client.tpm.write(cmd)
+
+            # expect the second one to raise -EBUSY error
+            self.client.tpm.write(cmd)
+            rsp = self.client.tpm.read()
+
+        except IOError, e:
+            # read the response
+            rsp = self.client.tpm.read()
+            rejected = True
+            pass
+        except:
+            pass
+        self.assertEqual(rejected, True)
+
 class SpaceTest(unittest.TestCase):
     def setUp(self):
         logging.basicConfig(filename='SpaceTest.log', level=logging.DEBUG)