Merge branch 'x86/pti-urgent' into x86/pti

Integrate the PTI Global bit fixes which conflict with the 32bit PTI
support.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

702 files changed, 6806 insertions, 3450 deletions

diff --git a/Documentation/device-mapper/writecache.txt b/Documentation/device-mapper/writecache.txt
index 4424fa2c67d7..01532b3008ae 100644
--- a/Documentation/device-mapper/writecache.txt
+++ b/Documentation/device-mapper/writecache.txt
@@ -15,6 +15,8 @@ Constructor parameters:
    size)
 5. the number of optional parameters (the parameters with an argument
    count as two)
+        start_sector n          (default: 0)
+                offset from the start of cache device in 512-byte sectors
         high_watermark n        (default: 50)
                 start writeback when the number of used blocks reach this
                 watermark
diff --git a/Documentation/devicetree/bindings/arm/samsung/samsung-boards.txt b/Documentation/devicetree/bindings/arm/samsung/samsung-boards.txt
index bdadc3da9556..6970f30a3770 100644
--- a/Documentation/devicetree/bindings/arm/samsung/samsung-boards.txt
+++ b/Documentation/devicetree/bindings/arm/samsung/samsung-boards.txt
@@ -66,7 +66,7 @@ Required root node properties:
         - "insignal,arndale-octa" - for Exynos5420-based Insignal Arndale
                                     Octa board.
         - "insignal,origen"       - for Exynos4210-based Insignal Origen board.
-        - "insignal,origen4412    - for Exynos4412-based Insignal Origen board.
+        - "insignal,origen4412"   - for Exynos4412-based Insignal Origen board.
 
 
 Optional nodes:
diff --git a/Documentation/devicetree/bindings/display/tilcdc/tilcdc.txt b/Documentation/devicetree/bindings/display/tilcdc/tilcdc.txt
index 6fddb4f4f71a..3055d5c2c04e 100644
--- a/Documentation/devicetree/bindings/display/tilcdc/tilcdc.txt
+++ b/Documentation/devicetree/bindings/display/tilcdc/tilcdc.txt
@@ -36,7 +36,7 @@ Optional nodes:
 
  - port/ports: to describe a connection to an external encoder. The
    binding follows Documentation/devicetree/bindings/graph.txt and
-   suppors a single port with a single endpoint.
+   supports a single port with a single endpoint.
 
  - See also Documentation/devicetree/bindings/display/tilcdc/panel.txt and
    Documentation/devicetree/bindings/display/tilcdc/tfp410.txt for connecting
diff --git a/Documentation/devicetree/bindings/gpio/nintendo,hollywood-gpio.txt b/Documentation/devicetree/bindings/gpio/nintendo,hollywood-gpio.txt
index 20fc72d9e61e..45a61b462287 100644
--- a/Documentation/devicetree/bindings/gpio/nintendo,hollywood-gpio.txt
+++ b/Documentation/devicetree/bindings/gpio/nintendo,hollywood-gpio.txt
@@ -1,7 +1,7 @@
 Nintendo Wii (Hollywood) GPIO controller
 
 Required properties:
-- compatible: "nintendo,hollywood-gpio
+- compatible: "nintendo,hollywood-gpio"
 - reg: Physical base address and length of the controller's registers.
 - gpio-controller: Marks the device node as a GPIO controller.
 - #gpio-cells: Should be <2>. The first cell is the pin number and the
diff --git a/Documentation/devicetree/bindings/input/touchscreen/hideep.txt b/Documentation/devicetree/bindings/input/touchscreen/hideep.txt
index 121d9b7c79a2..1063c30d53f7 100644
--- a/Documentation/devicetree/bindings/input/touchscreen/hideep.txt
+++ b/Documentation/devicetree/bindings/input/touchscreen/hideep.txt
@@ -32,7 +32,7 @@ i2c@00000000 {
                 reg = <0x6c>;
                 interrupt-parent = <&gpx1>;
                 interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
-                vdd-supply = <&ldo15_reg>";
+                vdd-supply = <&ldo15_reg>;
                 vid-supply = <&ldo18_reg>;
                 reset-gpios = <&gpx1 5 0>;
                 touchscreen-size-x = <1080>;
diff --git a/Documentation/devicetree/bindings/interrupt-controller/nvidia,tegra20-ictlr.txt b/Documentation/devicetree/bindings/interrupt-controller/nvidia,tegra20-ictlr.txt
index 1099fe0788fa..f246ccbf8838 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/nvidia,tegra20-ictlr.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/nvidia,tegra20-ictlr.txt
@@ -15,7 +15,7 @@ Required properties:
   include "nvidia,tegra30-ictlr".       
 - reg : Specifies base physical address and size of the registers.
   Each controller must be described separately (Tegra20 has 4 of them,
-  whereas Tegra30 and later have 5"  
+  whereas Tegra30 and later have 5).
 - interrupt-controller : Identifies the node as an interrupt controller.
 - #interrupt-cells : Specifies the number of cells needed to encode an
   interrupt source. The value must be 3.
diff --git a/Documentation/devicetree/bindings/interrupt-controller/st,stm32-exti.txt b/Documentation/devicetree/bindings/interrupt-controller/st,stm32-exti.txt
index 136bd612bd83..6a36bf66d932 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/st,stm32-exti.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/st,stm32-exti.txt
@@ -12,7 +12,7 @@ Required properties:
   specifier, shall be 2
 - interrupts: interrupts references to primary interrupt controller
   (only needed for exti controller with multiple exti under
-  same parent interrupt: st,stm32-exti and st,stm32h7-exti")
+  same parent interrupt: st,stm32-exti and st,stm32h7-exti)
 
 Example:
 
diff --git a/Documentation/devicetree/bindings/mips/brcm/soc.txt b/Documentation/devicetree/bindings/mips/brcm/soc.txt
index 356c29789cf5..3a66d3c483e1 100644
--- a/Documentation/devicetree/bindings/mips/brcm/soc.txt
+++ b/Documentation/devicetree/bindings/mips/brcm/soc.txt
@@ -152,7 +152,7 @@ Required properties:
 - compatible    : should contain one of:
                   "brcm,bcm7425-timers"
                   "brcm,bcm7429-timers"
-                  "brcm,bcm7435-timers and
+                  "brcm,bcm7435-timers" and
                   "brcm,brcmstb-timers"
 - reg           : the timers register range
 - interrupts    : the interrupt line for this timer block
diff --git a/Documentation/devicetree/bindings/net/fsl-fman.txt b/Documentation/devicetree/bindings/net/fsl-fman.txt
index df873d1f3b7c..f8c33890bc29 100644
--- a/Documentation/devicetree/bindings/net/fsl-fman.txt
+++ b/Documentation/devicetree/bindings/net/fsl-fman.txt
@@ -238,7 +238,7 @@ PROPERTIES
                 Must include one of the following:
                 - "fsl,fman-dtsec" for dTSEC MAC
                 - "fsl,fman-xgec" for XGEC MAC
-                - "fsl,fman-memac for mEMAC MAC
+                - "fsl,fman-memac" for mEMAC MAC
 
 - cell-index
                 Usage: required
diff --git a/Documentation/devicetree/bindings/power/power_domain.txt b/Documentation/devicetree/bindings/power/power_domain.txt
index 9b387f861aed..7dec508987c7 100644
--- a/Documentation/devicetree/bindings/power/power_domain.txt
+++ b/Documentation/devicetree/bindings/power/power_domain.txt
@@ -133,7 +133,7 @@ located inside a PM domain with index 0 of a power controller represented by a
 node with the label "power".
 In the second example the consumer device are partitioned across two PM domains,
 the first with index 0 and the second with index 1, of a power controller that
-is represented by a node with the label "power.
+is represented by a node with the label "power".
 
 Optional properties:
 - required-opps: This contains phandle to an OPP node in another device's OPP
diff --git a/Documentation/devicetree/bindings/regulator/tps65090.txt b/Documentation/devicetree/bindings/regulator/tps65090.txt
index ca69f5e3040c..ae326f263597 100644
--- a/Documentation/devicetree/bindings/regulator/tps65090.txt
+++ b/Documentation/devicetree/bindings/regulator/tps65090.txt
@@ -16,7 +16,7 @@ Required properties:
 Optional properties:
 - ti,enable-ext-control: This is applicable for DCDC1, DCDC2 and DCDC3.
   If DCDCs are externally controlled then this property should be there.
-- "dcdc-ext-control-gpios: This is applicable for DCDC1, DCDC2 and DCDC3.
+- dcdc-ext-control-gpios: This is applicable for DCDC1, DCDC2 and DCDC3.
   If DCDCs are externally controlled and if it is from GPIO then GPIO
   number should be provided. If it is externally controlled and no GPIO
   entry then driver will just configure this rails as external control
diff --git a/Documentation/devicetree/bindings/reset/st,sti-softreset.txt b/Documentation/devicetree/bindings/reset/st,sti-softreset.txt
index a21658f18fe6..3661e6153a92 100644
--- a/Documentation/devicetree/bindings/reset/st,sti-softreset.txt
+++ b/Documentation/devicetree/bindings/reset/st,sti-softreset.txt
@@ -15,7 +15,7 @@ Please refer to reset.txt in this directory for common reset
 controller binding usage.
 
 Required properties:
-- compatible: Should be st,stih407-softreset";
+- compatible: Should be "st,stih407-softreset";
 - #reset-cells: 1, see below
 
 example:
diff --git a/Documentation/devicetree/bindings/soc/qcom/qcom,geni-se.txt b/Documentation/devicetree/bindings/soc/qcom/qcom,geni-se.txt
index d330c73de9a2..68b7d6207e3d 100644
--- a/Documentation/devicetree/bindings/soc/qcom/qcom,geni-se.txt
+++ b/Documentation/devicetree/bindings/soc/qcom/qcom,geni-se.txt
@@ -39,7 +39,7 @@ Required properties:
 
 Optional property:
 - clock-frequency:      Desired I2C bus clock frequency in Hz.
-                        When missing default to 400000Hz.
+                        When missing default to 100000Hz.
 
 Child nodes should conform to I2C bus binding as described in i2c.txt.
 
diff --git a/Documentation/devicetree/bindings/sound/qcom,apq8016-sbc.txt b/Documentation/devicetree/bindings/sound/qcom,apq8016-sbc.txt
index 6a4aadc4ce06..84b28dbe9f15 100644
--- a/Documentation/devicetree/bindings/sound/qcom,apq8016-sbc.txt
+++ b/Documentation/devicetree/bindings/sound/qcom,apq8016-sbc.txt
@@ -30,7 +30,7 @@ Required properties:
 
                           Board connectors:
                           * Headset Mic
-                          * Secondary Mic",
+                          * Secondary Mic
                           * DMIC
                           * Ext Spk
 
diff --git a/Documentation/devicetree/bindings/sound/qcom,apq8096.txt b/Documentation/devicetree/bindings/sound/qcom,apq8096.txt
index aa54e49fc8a2..c7600a93ab39 100644
--- a/Documentation/devicetree/bindings/sound/qcom,apq8096.txt
+++ b/Documentation/devicetree/bindings/sound/qcom,apq8096.txt
@@ -35,7 +35,7 @@ This binding describes the APQ8096 sound card, which uses qdsp for audio.
                         "Digital Mic3"
 
                 Audio pins and MicBias on WCD9335 Codec:
-                        "MIC_BIAS1
+                        "MIC_BIAS1"
                         "MIC_BIAS2"
                         "MIC_BIAS3"
                         "MIC_BIAS4"
diff --git a/Documentation/devicetree/bindings/usb/rockchip,dwc3.txt b/Documentation/devicetree/bindings/usb/rockchip,dwc3.txt
index 252a05c5d976..c8c4b00ecb94 100644
--- a/Documentation/devicetree/bindings/usb/rockchip,dwc3.txt
+++ b/Documentation/devicetree/bindings/usb/rockchip,dwc3.txt
@@ -16,7 +16,8 @@ A child node must exist to represent the core DWC3 IP block. The name of
 the node is not important. The content of the node is defined in dwc3.txt.
 
 Phy documentation is provided in the following places:
-Documentation/devicetree/bindings/phy/qcom-dwc3-usb-phy.txt
+Documentation/devicetree/bindings/phy/phy-rockchip-inno-usb2.txt - USB2.0 PHY
+Documentation/devicetree/bindings/phy/phy-rockchip-typec.txt     - Type-C PHY
 
 Example device nodes:
 
diff --git a/Documentation/devicetree/bindings/w1/w1-gpio.txt b/Documentation/devicetree/bindings/w1/w1-gpio.txt
index 6e09c35d9f1a..37091902a021 100644
--- a/Documentation/devicetree/bindings/w1/w1-gpio.txt
+++ b/Documentation/devicetree/bindings/w1/w1-gpio.txt
@@ -15,7 +15,7 @@ Optional properties:
 
 Examples:
 
-        onewire@0 {
+        onewire {
                 compatible = "w1-gpio";
                 gpios = <&gpio 126 0>, <&gpio 105 0>;
         };
diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
index c13214d073a4..d3e5dd26db12 100644
--- a/Documentation/networking/bonding.txt
+++ b/Documentation/networking/bonding.txt
@@ -1490,7 +1490,7 @@ To remove an ARP target:
 
 To configure the interval between learning packet transmits:
 # echo 12 > /sys/class/net/bond0/bonding/lp_interval
-        NOTE: the lp_inteval is the number of seconds between instances where
+        NOTE: the lp_interval is the number of seconds between instances where
 the bonding driver sends learning packets to each slaves peer switch.  The
 default interval is 1 second.
 
diff --git a/Documentation/networking/dpaa2/overview.rst b/Documentation/networking/dpaa2/overview.rst
index 79fede4447d6..d638b5a8aadd 100644
--- a/Documentation/networking/dpaa2/overview.rst
+++ b/Documentation/networking/dpaa2/overview.rst
@@ -1,5 +1,6 @@
 .. include:: <isonum.txt>
 
+=========================================================
 DPAA2 (Data Path Acceleration Architecture Gen2) Overview
 =========================================================
 
diff --git a/Documentation/networking/e100.rst b/Documentation/networking/e100.rst
index 9708f5fa76de..f81111eba9c5 100644
--- a/Documentation/networking/e100.rst
+++ b/Documentation/networking/e100.rst
@@ -47,41 +47,45 @@ Driver Configuration Parameters
 The default value for each parameter is generally the recommended setting,
 unless otherwise noted.
 
-Rx Descriptors: Number of receive descriptors. A receive descriptor is a data
+Rx Descriptors:
+   Number of receive descriptors. A receive descriptor is a data
    structure that describes a receive buffer and its attributes to the network
    controller. The data in the descriptor is used by the controller to write
    data from the controller to host memory. In the 3.x.x driver the valid range
    for this parameter is 64-256. The default value is 256. This parameter can be
    changed using the command::
 
-   ethtool -G eth? rx n
+     ethtool -G eth? rx n
 
    Where n is the number of desired Rx descriptors.
 
-Tx Descriptors: Number of transmit descriptors. A transmit descriptor is a data
+Tx Descriptors:
+   Number of transmit descriptors. A transmit descriptor is a data
    structure that describes a transmit buffer and its attributes to the network
    controller. The data in the descriptor is used by the controller to read
    data from the host memory to the controller. In the 3.x.x driver the valid
    range for this parameter is 64-256. The default value is 128. This parameter
    can be changed using the command::
 
-   ethtool -G eth? tx n
+     ethtool -G eth? tx n
 
    Where n is the number of desired Tx descriptors.
 
-Speed/Duplex: The driver auto-negotiates the link speed and duplex settings by
+Speed/Duplex:
+   The driver auto-negotiates the link speed and duplex settings by
    default. The ethtool utility can be used as follows to force speed/duplex.::
 
-   ethtool -s eth?  autoneg off speed {10|100} duplex {full|half}
+     ethtool -s eth?  autoneg off speed {10|100} duplex {full|half}
 
    NOTE: setting the speed/duplex to incorrect values will cause the link to
    fail.
 
-Event Log Message Level:  The driver uses the message level flag to log events
+Event Log Message Level:
+   The driver uses the message level flag to log events
    to syslog. The message level can be set at driver load time. It can also be
    set using the command::
 
-   ethtool -s eth? msglvl n
+     ethtool -s eth? msglvl n
 
 
 Additional Configurations
@@ -92,7 +96,7 @@ Configuring the Driver on Different Distributions
 
 Configuring a network driver to load properly when the system is started
 is distribution dependent.  Typically, the configuration process involves
-adding an alias line to /etc/modprobe.d/*.conf as well as editing other
+adding an alias line to `/etc/modprobe.d/*.conf` as well as editing other
 system startup scripts and/or configuration files.  Many popular Linux
 distributions ship with tools to make these changes for you.  To learn
 the proper way to configure a network device for your system, refer to
@@ -160,7 +164,10 @@ This results in unbalanced receive traffic.
 If you have multiple interfaces in a server, either turn on ARP
 filtering by
 
-(1) entering:: echo 1 > /proc/sys/net/ipv4/conf/all/arp_filter
+(1) entering::
+
+        echo 1 > /proc/sys/net/ipv4/conf/all/arp_filter
+
     (this only works if your kernel's version is higher than 2.4.5), or
 
 (2) installing the interfaces in separate broadcast domains (either
diff --git a/Documentation/networking/e1000.rst b/Documentation/networking/e1000.rst
index 144b87eef153..f10dd4086921 100644
--- a/Documentation/networking/e1000.rst
+++ b/Documentation/networking/e1000.rst
@@ -34,7 +34,8 @@ Command Line Parameters
 The default value for each parameter is generally the recommended setting,
 unless otherwise noted.
 
-NOTES:  For more information about the AutoNeg, Duplex, and Speed
+NOTES:
+        For more information about the AutoNeg, Duplex, and Speed
         parameters, see the "Speed and Duplex Configuration" section in
         this document.
 
@@ -45,22 +46,27 @@ NOTES:  For more information about the AutoNeg, Duplex, and Speed
 
 AutoNeg
 -------
+
 (Supported only on adapters with copper connections)
-Valid Range:   0x01-0x0F, 0x20-0x2F
-Default Value: 0x2F
+
+:Valid Range:   0x01-0x0F, 0x20-0x2F
+:Default Value: 0x2F
 
 This parameter is a bit-mask that specifies the speed and duplex settings
 advertised by the adapter.  When this parameter is used, the Speed and
 Duplex parameters must not be specified.
 
-NOTE:  Refer to the Speed and Duplex section of this readme for more
+NOTE:
+       Refer to the Speed and Duplex section of this readme for more
        information on the AutoNeg parameter.
 
 Duplex
 ------
+
 (Supported only on adapters with copper connections)
-Valid Range:   0-2 (0=auto-negotiate, 1=half, 2=full)
-Default Value: 0
+
+:Valid Range:   0-2 (0=auto-negotiate, 1=half, 2=full)
+:Default Value: 0
 
 This defines the direction in which data is allowed to flow.  Can be
 either one or two-directional.  If both Duplex and the link partner are
@@ -70,18 +76,22 @@ duplex.
 
 FlowControl
 -----------
-Valid Range:   0-3 (0=none, 1=Rx only, 2=Tx only, 3=Rx&Tx)
-Default Value: Reads flow control settings from the EEPROM
+
+:Valid Range:   0-3 (0=none, 1=Rx only, 2=Tx only, 3=Rx&Tx)
+:Default Value: Reads flow control settings from the EEPROM
 
 This parameter controls the automatic generation(Tx) and response(Rx)
 to Ethernet PAUSE frames.
 
 InterruptThrottleRate
 ---------------------
+
 (not supported on Intel(R) 82542, 82543 or 82544-based adapters)
-Valid Range:   0,1,3,4,100-100000 (0=off, 1=dynamic, 3=dynamic conservative,
-                                 4=simplified balancing)
-Default Value: 3
+
+:Valid Range:
+   0,1,3,4,100-100000 (0=off, 1=dynamic, 3=dynamic conservative,
+   4=simplified balancing)
+:Default Value: 3
 
 The driver can limit the amount of interrupts per second that the adapter
 will generate for incoming packets. It does this by writing a value to the
@@ -135,13 +145,15 @@ Setting InterruptThrottleRate to 0 turns off any interrupt moderation
 and may improve small packet latency, but is generally not suitable
 for bulk throughput traffic.
 
-NOTE:  InterruptThrottleRate takes precedence over the TxAbsIntDelay and
+NOTE:
+       InterruptThrottleRate takes precedence over the TxAbsIntDelay and
        RxAbsIntDelay parameters.  In other words, minimizing the receive
        and/or transmit absolute delays does not force the controller to
        generate more interrupts than what the Interrupt Throttle Rate
        allows.
 
-CAUTION:  If you are using the Intel(R) PRO/1000 CT Network Connection
+CAUTION:
+          If you are using the Intel(R) PRO/1000 CT Network Connection
           (controller 82547), setting InterruptThrottleRate to a value
           greater than 75,000, may hang (stop transmitting) adapters
           under certain network conditions.  If this occurs a NETDEV
@@ -151,7 +163,8 @@ CAUTION:  If you are using the Intel(R) PRO/1000 CT Network Connection
           hang, ensure that InterruptThrottleRate is set no greater
           than 75,000 and is not set to 0.
 
-NOTE:  When e1000 is loaded with default settings and multiple adapters
+NOTE:
+       When e1000 is loaded with default settings and multiple adapters
        are in use simultaneously, the CPU utilization may increase non-
        linearly.  In order to limit the CPU utilization without impacting
        the overall throughput, we recommend that you load the driver as
@@ -168,9 +181,11 @@ NOTE:  When e1000 is loaded with default settings and multiple adapters
 
 RxDescriptors
 -------------
-Valid Range:   48-256 for 82542 and 82543-based adapters
-               48-4096 for all other supported adapters
-Default Value: 256
+
+:Valid Range:
+ - 48-256 for 82542 and 82543-based adapters
+ - 48-4096 for all other supported adapters
+:Default Value: 256
 
 This value specifies the number of receive buffer descriptors allocated
 by the driver.  Increasing this value allows the driver to buffer more
@@ -180,15 +195,17 @@ Each descriptor is 16 bytes.  A receive buffer is also allocated for each
 descriptor and can be either 2048, 4096, 8192, or 16384 bytes, depending
 on the MTU setting. The maximum MTU size is 16110.
 
-NOTE:  MTU designates the frame size.  It only needs to be set for Jumbo
+NOTE:
+       MTU designates the frame size.  It only needs to be set for Jumbo
        Frames.  Depending on the available system resources, the request
        for a higher number of receive descriptors may be denied.  In this
        case, use a lower number.
 
 RxIntDelay
 ----------
-Valid Range:   0-65535 (0=off)
-Default Value: 0
+
+:Valid Range:   0-65535 (0=off)
+:Default Value: 0
 
 This value delays the generation of receive interrupts in units of 1.024
 microseconds.  Receive interrupt reduction can improve CPU efficiency if
@@ -198,7 +215,8 @@ of TCP traffic.  If the system is reporting dropped receives, this value
 may be set too high, causing the driver to run out of available receive
 descriptors.
 
-CAUTION:  When setting RxIntDelay to a value other than 0, adapters may
+CAUTION:
+          When setting RxIntDelay to a value other than 0, adapters may
           hang (stop transmitting) under certain network conditions.  If
           this occurs a NETDEV WATCHDOG message is logged in the system
           event log.  In addition, the controller is automatically reset,
@@ -207,9 +225,11 @@ CAUTION:  When setting RxIntDelay to a value other than 0, adapters may
 
 RxAbsIntDelay
 -------------
+
 (This parameter is supported only on 82540, 82545 and later adapters.)
-Valid Range:   0-65535 (0=off)
-Default Value: 128
+
+:Valid Range:   0-65535 (0=off)
+:Default Value: 128
 
 This value, in units of 1.024 microseconds, limits the delay in which a
 receive interrupt is generated.  Useful only if RxIntDelay is non-zero,
@@ -220,9 +240,11 @@ conditions.
 
 Speed
 -----
+
 (This parameter is supported only on adapters with copper connections.)
-Valid Settings: 0, 10, 100, 1000
-Default Value:  0 (auto-negotiate at all supported speeds)
+
+:Valid Settings: 0, 10, 100, 1000
+:Default Value:  0 (auto-negotiate at all supported speeds)
 
 Speed forces the line speed to the specified value in megabits per second
 (Mbps).  If this parameter is not specified or is set to 0 and the link
@@ -231,22 +253,26 @@ speed.  Duplex should also be set when Speed is set to either 10 or 100.
 
 TxDescriptors
 -------------
-Valid Range:   48-256 for 82542 and 82543-based adapters
-               48-4096 for all other supported adapters
-Default Value: 256
+
+:Valid Range:
+  - 48-256 for 82542 and 82543-based adapters
+  - 48-4096 for all other supported adapters
+:Default Value: 256
 
 This value is the number of transmit descriptors allocated by the driver.
 Increasing this value allows the driver to queue more transmits.  Each
 descriptor is 16 bytes.
 
-NOTE:  Depending on the available system resources, the request for a
+NOTE:
+       Depending on the available system resources, the request for a
        higher number of transmit descriptors may be denied.  In this case,
        use a lower number.
 
 TxIntDelay
 ----------
-Valid Range:   0-65535 (0=off)
-Default Value: 8
+
+:Valid Range:   0-65535 (0=off)
+:Default Value: 8
 
 This value delays the generation of transmit interrupts in units of
 1.024 microseconds.  Transmit interrupt reduction can improve CPU
@@ -256,9 +282,11 @@ causing the driver to run out of available transmit descriptors.
 
 TxAbsIntDelay
 -------------
+
 (This parameter is supported only on 82540, 82545 and later adapters.)
-Valid Range:   0-65535 (0=off)
-Default Value: 32
+
+:Valid Range:   0-65535 (0=off)
+:Default Value: 32
 
 This value, in units of 1.024 microseconds, limits the delay in which a
 transmit interrupt is generated.  Useful only if TxIntDelay is non-zero,
@@ -269,18 +297,21 @@ network conditions.
 
 XsumRX
 ------
+
 (This parameter is NOT supported on the 82542-based adapter.)
-Valid Range:   0-1
-Default Value: 1
+
+:Valid Range:   0-1
+:Default Value: 1
 
 A value of '1' indicates that the driver should enable IP checksum
 offload for received packets (both UDP and TCP) to the adapter hardware.
 
 Copybreak
 ---------
-Valid Range:   0-xxxxxxx (0=off)
-Default Value: 256
-Usage: modprobe e1000.ko copybreak=128
+
+:Valid Range:   0-xxxxxxx (0=off)
+:Default Value: 256
+:Usage: modprobe e1000.ko copybreak=128
 
 Driver copies all packets below or equaling this size to a fresh RX
 buffer before handing it up the stack.
@@ -292,8 +323,9 @@ it is also available during runtime at
 
 SmartPowerDownEnable
 --------------------
-Valid Range: 0-1
-Default Value:  0 (disabled)
+
+:Valid Range: 0-1
+:Default Value:  0 (disabled)
 
 Allows PHY to turn off in lower power states. The user can turn off
 this parameter in supported chipsets.
@@ -309,14 +341,14 @@ fiber interface board only links at 1000 Mbps full-duplex.
 
 For copper-based boards, the keywords interact as follows:
 
-  The default operation is auto-negotiate.  The board advertises all
+- The default operation is auto-negotiate.  The board advertises all
   supported speed and duplex combinations, and it links at the highest
   common speed and duplex mode IF the link partner is set to auto-negotiate.
 
-  If Speed = 1000, limited auto-negotiation is enabled and only 1000 Mbps
+- If Speed = 1000, limited auto-negotiation is enabled and only 1000 Mbps
   is advertised (The 1000BaseT spec requires auto-negotiation.)
 
-  If Speed = 10 or 100, then both Speed and Duplex should be set.  Auto-
+- If Speed = 10 or 100, then both Speed and Duplex should be set.  Auto-
   negotiation is disabled, and the AutoNeg parameter is ignored.  Partner
   SHOULD also be forced.
 
@@ -328,13 +360,15 @@ process.
 The parameter may be specified as either a decimal or hexadecimal value as
 determined by the bitmap below.
 
+============== ====== ====== ======= ======= ====== ====== ======= ======
 Bit position   7      6      5       4       3      2      1       0
 Decimal Value  128    64     32      16      8      4      2       1
 Hex value      80     40     20      10      8      4      2       1
 Speed (Mbps)   N/A    N/A    1000    N/A     100    100    10      10
 Duplex                       Full            Full   Half   Full    Half
+============== ====== ====== ======= ======= ====== ====== ======= ======
 
-Some examples of using AutoNeg:
+Some examples of using AutoNeg::
 
   modprobe e1000 AutoNeg=0x01 (Restricts autonegotiation to 10 Half)
   modprobe e1000 AutoNeg=1 (Same as above)
@@ -357,56 +391,59 @@ Additional Configurations
 
 Jumbo Frames
 ------------
-Jumbo Frames support is enabled by changing the MTU to a value larger
-than the default of 1500.  Use the ifconfig command to increase the MTU
-size.  For example::
+
+  Jumbo Frames support is enabled by changing the MTU to a value larger than
+  the default of 1500.  Use the ifconfig command to increase the MTU size.
+  For example::
 
        ifconfig eth<x> mtu 9000 up
 
-This setting is not saved across reboots.  It can be made permanent if
-you add::
+  This setting is not saved across reboots.  It can be made permanent if
+  you add::
 
        MTU=9000
 
-to the file /etc/sysconfig/network-scripts/ifcfg-eth<x>.  This example
-applies to the Red Hat distributions; other distributions may store this
-setting in a different location.
+  to the file /etc/sysconfig/network-scripts/ifcfg-eth<x>.  This example
+  applies to the Red Hat distributions; other distributions may store this
+  setting in a different location.
+
+Notes:
+  Degradation in throughput performance may be observed in some Jumbo frames
+  environments. If this is observed, increasing the application's socket buffer
+  size and/or increasing the /proc/sys/net/ipv4/tcp_*mem entry values may help.
+  See the specific application manual and /usr/src/linux*/Documentation/
+  networking/ip-sysctl.txt for more details.
 
-Notes: Degradation in throughput performance may be observed in some
-Jumbo frames environments.  If this is observed, increasing the
-application's socket buffer size and/or increasing the
-/proc/sys/net/ipv4/tcp_*mem entry values may help.  See the specific
-application manual and /usr/src/linux*/Documentation/
-networking/ip-sysctl.txt for more details.
+  - The maximum MTU setting for Jumbo Frames is 16110.  This value coincides
+    with the maximum Jumbo Frames size of 16128.
 
-- The maximum MTU setting for Jumbo Frames is 16110.  This value
-  coincides with the maximum Jumbo Frames size of 16128.
+  - Using Jumbo frames at 10 or 100 Mbps is not supported and may result in
+    poor performance or loss of link.
 
-- Using Jumbo frames at 10 or 100 Mbps is not supported and may result
-  in poor performance or loss of link.
+  - Adapters based on the Intel(R) 82542 and 82573V/E controller do not
+    support Jumbo Frames. These correspond to the following product names::
 
-- Adapters based on the Intel(R) 82542 and 82573V/E controller do not
-  support Jumbo Frames.  These correspond to the following product names:
-  Intel(R) PRO/1000 Gigabit Server Adapter Intel(R) PRO/1000 PM Network
-  Connection
+     Intel(R) PRO/1000 Gigabit Server Adapter
+     Intel(R) PRO/1000 PM Network Connection
 
 ethtool
 -------
-The driver utilizes the ethtool interface for driver configuration and
-diagnostics, as well as displaying statistical information.  The ethtool
-version 1.6 or later is required for this functionality.
 
-The latest release of ethtool can be found from
-https://www.kernel.org/pub/software/network/ethtool/
+  The driver utilizes the ethtool interface for driver configuration and
+  diagnostics, as well as displaying statistical information.  The ethtool
+  version 1.6 or later is required for this functionality.
+
+  The latest release of ethtool can be found from
+  https://www.kernel.org/pub/software/network/ethtool/
 
 Enabling Wake on LAN* (WoL)
 ---------------------------
-WoL is configured through the ethtool* utility.
 
-WoL will be enabled on the system during the next shut down or reboot.
-For this driver version, in order to enable WoL, the e1000 driver must be
-loaded when shutting down or rebooting the system.
+  WoL is configured through the ethtool* utility.
 
+  WoL will be enabled on the system during the next shut down or reboot.
+  For this driver version, in order to enable WoL, the e1000 driver must be
+  loaded when shutting down or rebooting the system.
 
 Support
 =======
diff --git a/MAINTAINERS b/MAINTAINERS
index 192d7f73fd01..7cebd5bba8a8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2523,7 +2523,7 @@ S:	Supported
 F:      drivers/scsi/esas2r
 
 ATUSB IEEE 802.15.4 RADIO DRIVER
-M:      Stefan Schmidt <stefan@osg.samsung.com>
+M:      Stefan Schmidt <stefan@datenfreihafen.org>
 L:      linux-wpan@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ieee802154/atusb.c
@@ -5444,6 +5444,7 @@ F:	drivers/iommu/exynos-iommu.c
 
 EZchip NPS platform support
 M:      Vineet Gupta <vgupta@synopsys.com>
+M:      Ofer Levi <oferle@mellanox.com>
 S:      Supported
 F:      arch/arc/plat-eznps
 F:      arch/arc/boot/dts/eznps.dts
@@ -5790,7 +5791,6 @@ F:	include/linux/fsl/
 
 FREESCALE SOC FS_ENET DRIVER
 M:      Pantelis Antoniou <pantelis.antoniou@gmail.com>
-M:      Vitaly Bordug <vbordug@ru.mvista.com>
 L:      linuxppc-dev@lists.ozlabs.org
 L:      netdev@vger.kernel.org
 S:      Maintained
@@ -6909,7 +6909,7 @@ F:	drivers/clk/clk-versaclock5.c
 
 IEEE 802.15.4 SUBSYSTEM
 M:      Alexander Aring <alex.aring@gmail.com>
-M:      Stefan Schmidt <stefan@osg.samsung.com>
+M:      Stefan Schmidt <stefan@datenfreihafen.org>
 L:      linux-wpan@vger.kernel.org
 W:      http://wpan.cakelab.org/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan.git
@@ -7096,6 +7096,7 @@ F:	include/uapi/linux/input.h
 F:      include/uapi/linux/input-event-codes.h
 F:      include/linux/input/
 F:      Documentation/devicetree/bindings/input/
+F:      Documentation/devicetree/bindings/serio/
 F:      Documentation/input/
 
 INPUT MULTITOUCH (MT) PROTOCOL
@@ -7985,7 +7986,7 @@ F:	lib/test_kmod.c
 F:      tools/testing/selftests/kmod/
 
 KPROBES
-M:      Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com>
+M:      Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
 M:      Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
 M:      "David S. Miller" <davem@davemloft.net>
 M:      Masami Hiramatsu <mhiramat@kernel.org>
@@ -8629,7 +8630,7 @@ MARVELL MWIFIEX WIRELESS DRIVER
 M:      Amitkumar Karwar <amitkarwar@gmail.com>
 M:      Nishant Sarmukadam <nishants@marvell.com>
 M:      Ganapathi Bhat <gbhat@marvell.com>
-M:      Xinming Hu <huxm@marvell.com>
+M:      Xinming Hu <huxinming820@gmail.com>
 L:      linux-wireless@vger.kernel.org
 S:      Maintained
 F:      drivers/net/wireless/marvell/mwifiex/
@@ -9075,7 +9076,7 @@ S:	Maintained
 F:      drivers/usb/mtu3/
 
 MEGACHIPS STDPXXXX-GE-B850V3-FW LVDS/DP++ BRIDGES
-M:      Peter Senna Tschudin <peter.senna@collabora.com>
+M:      Peter Senna Tschudin <peter.senna@gmail.com>
 M:      Martin Donnelly <martin.donnelly@ge.com>
 M:      Martyn Welch <martyn.welch@collabora.co.uk>
 S:      Maintained
diff --git a/Makefile b/Makefile
index 2d80fbbe51a8..7a3c4548162b 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 18
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc8
 NAME = Merciless Moray
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 6e921754c8fc..c210a25dd6da 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -1180,13 +1180,10 @@ SYSCALL_DEFINE2(osf_getrusage, int, who, struct rusage32 __user *, ru)
 SYSCALL_DEFINE4(osf_wait4, pid_t, pid, int __user *, ustatus, int, options,
                 struct rusage32 __user *, ur)
 {
-        unsigned int status = 0;
         struct rusage r;
-        long err = kernel_wait4(pid, &status, options, &r);
+        long err = kernel_wait4(pid, ustatus, options, &r);
         if (err <= 0)
                 return err;
-        if (put_user(status, ustatus))
-                return -EFAULT;
         if (!ur)
                 return err;
         if (put_tv_to_tv32(&ur->ru_utime, &r.ru_utime))
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index e81bcd271be7..5151d81476a1 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -50,6 +50,9 @@ config ARC
         select HAVE_KERNEL_LZMA
         select ARCH_HAS_PTE_SPECIAL
 
+config ARCH_HAS_CACHE_LINE_SIZE
+        def_bool y
+
 config MIGHT_HAVE_PCI
         bool
 
@@ -413,7 +416,7 @@ config ARC_HAS_DIV_REM
 
 config ARC_HAS_ACCL_REGS
         bool "Reg Pair ACCL:ACCH (FPU and/or MPY > 6)"
-        default n
+        default y
         help
           Depending on the configuration, CPU can contain accumulator reg-pair
           (also referred to as r58:r59). These can also be used by gcc as GPR so
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index d37f49d6a27f..6c1b20dd76ad 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -16,7 +16,7 @@ endif
 
 KBUILD_DEFCONFIG := nsim_700_defconfig
 
-cflags-y        += -fno-common -pipe -fno-builtin -D__linux__
+cflags-y        += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
 cflags-$(CONFIG_ISA_ARCOMPACT)  += -mA7
 cflags-$(CONFIG_ISA_ARCV2)      += -mcpu=archs
 
@@ -140,16 +140,3 @@ dtbs: scripts
 
 archclean:
         $(Q)$(MAKE) $(clean)=$(boot)
-
-# Hacks to enable final link due to absence of link-time branch relexation
-# and gcc choosing optimal(shorter) branches at -O3
-#
-# vineetg Feb 2010: -mlong-calls switched off for overall kernel build
-# However lib/decompress_inflate.o (.init.text) calls
-# zlib_inflate_workspacesize (.text) causing relocation errors.
-# Thus forcing all exten calls in this file to be long calls
-export CFLAGS_decompress_inflate.o = -mmedium-calls
-export CFLAGS_initramfs.o = -mmedium-calls
-ifdef CONFIG_SMP
-export CFLAGS_core.o = -mmedium-calls
-endif
diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig
index 09f85154c5a4..a635ea972304 100644
--- a/arch/arc/configs/axs101_defconfig
+++ b/arch/arc/configs/axs101_defconfig
@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
 # CONFIG_PID_NS is not set
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="../arc_initramfs/"
 CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
 # CONFIG_VM_EVENT_COUNTERS is not set
diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig
index 09fed3ef22b6..aa507e423075 100644
--- a/arch/arc/configs/axs103_defconfig
+++ b/arch/arc/configs/axs103_defconfig
@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
 # CONFIG_PID_NS is not set
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
 CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
 # CONFIG_VM_EVENT_COUNTERS is not set
diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig
index ea2f6d817d1a..eba07f468654 100644
--- a/arch/arc/configs/axs103_smp_defconfig
+++ b/arch/arc/configs/axs103_smp_defconfig
@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
 # CONFIG_PID_NS is not set
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
 CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
 # CONFIG_VM_EVENT_COUNTERS is not set
diff --git a/arch/arc/configs/haps_hs_defconfig b/arch/arc/configs/haps_hs_defconfig
index ab231c040efe..098b19fbaa51 100644
--- a/arch/arc/configs/haps_hs_defconfig
+++ b/arch/arc/configs/haps_hs_defconfig
@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
 # CONFIG_PID_NS is not set
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
 CONFIG_EXPERT=y
 CONFIG_PERF_EVENTS=y
 # CONFIG_COMPAT_BRK is not set
diff --git a/arch/arc/configs/haps_hs_smp_defconfig b/arch/arc/configs/haps_hs_smp_defconfig
index cf449cbf440d..0104c404d897 100644
--- a/arch/arc/configs/haps_hs_smp_defconfig
+++ b/arch/arc/configs/haps_hs_smp_defconfig
@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
 # CONFIG_PID_NS is not set
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
 CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
 # CONFIG_VM_EVENT_COUNTERS is not set
diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig
index 1b54c72f4296..6491be0ddbc9 100644
--- a/arch/arc/configs/hsdk_defconfig
+++ b/arch/arc/configs/hsdk_defconfig
@@ -9,7 +9,6 @@ CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
 # CONFIG_PID_NS is not set
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
 CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
 # CONFIG_VM_EVENT_COUNTERS is not set
diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig
index 31c2c70b34a1..99e05cf63fca 100644
--- a/arch/arc/configs/nsim_700_defconfig
+++ b/arch/arc/configs/nsim_700_defconfig
@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
 # CONFIG_PID_NS is not set
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="../arc_initramfs/"
 CONFIG_KALLSYMS_ALL=y
 CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
diff --git a/arch/arc/configs/nsim_hs_defconfig b/arch/arc/configs/nsim_hs_defconfig
index a578c721d50f..0dc4f9b737e7 100644
--- a/arch/arc/configs/nsim_hs_defconfig
+++ b/arch/arc/configs/nsim_hs_defconfig
@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
 # CONFIG_PID_NS is not set
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
 CONFIG_KALLSYMS_ALL=y
 CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
diff --git a/arch/arc/configs/nsim_hs_smp_defconfig b/arch/arc/configs/nsim_hs_smp_defconfig
index 37d7395f3272..be3c30a15e54 100644
--- a/arch/arc/configs/nsim_hs_smp_defconfig
+++ b/arch/arc/configs/nsim_hs_smp_defconfig
@@ -9,7 +9,6 @@ CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
 # CONFIG_PID_NS is not set
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/"
 CONFIG_KALLSYMS_ALL=y
 CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig
index 1e1470e2a7f0..3a74b9b21772 100644
--- a/arch/arc/configs/nsimosci_defconfig
+++ b/arch/arc/configs/nsimosci_defconfig
@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
 # CONFIG_PID_NS is not set
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="../arc_initramfs/"
 CONFIG_KALLSYMS_ALL=y
 CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig
index 084a6e42685b..ea2834b4dc1d 100644
--- a/arch/arc/configs/nsimosci_hs_defconfig
+++ b/arch/arc/configs/nsimosci_hs_defconfig
@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
 # CONFIG_PID_NS is not set
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/"
 CONFIG_KALLSYMS_ALL=y
 CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig
index f36d47990415..80a5a1b4924b 100644
--- a/arch/arc/configs/nsimosci_hs_smp_defconfig
+++ b/arch/arc/configs/nsimosci_hs_smp_defconfig
@@ -9,7 +9,6 @@ CONFIG_IKCONFIG_PROC=y
 # CONFIG_UTS_NS is not set
 # CONFIG_PID_NS is not set
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/"
 CONFIG_PERF_EVENTS=y
 # CONFIG_COMPAT_BRK is not set
 CONFIG_KPROBES=y
diff --git a/arch/arc/configs/tb10x_defconfig b/arch/arc/configs/tb10x_defconfig
index 1aca2e8fd1ba..2cc87f909747 100644
--- a/arch/arc/configs/tb10x_defconfig
+++ b/arch/arc/configs/tb10x_defconfig
@@ -56,7 +56,6 @@ CONFIG_STMMAC_ETH=y
 # CONFIG_INPUT is not set
 # CONFIG_SERIO is not set
 # CONFIG_VT is not set
-CONFIG_DEVPTS_MULTIPLE_INSTANCES=y
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
index 8486f328cc5d..ff7d3232764a 100644
--- a/arch/arc/include/asm/cache.h
+++ b/arch/arc/include/asm/cache.h
@@ -48,7 +48,9 @@
 })
 
 /* Largest line length for either L1 or L2 is 128 bytes */
-#define ARCH_DMA_MINALIGN      128
+#define SMP_CACHE_BYTES         128
+#define cache_line_size()       SMP_CACHE_BYTES
+#define ARCH_DMA_MINALIGN       SMP_CACHE_BYTES
 
 extern void arc_cache_init(void);
 extern char *arc_cache_mumbojumbo(int cpu_id, char *buf, int len);
diff --git a/arch/arc/include/asm/delay.h b/arch/arc/include/asm/delay.h
index d5da2115d78a..03d6bb0f4e13 100644
--- a/arch/arc/include/asm/delay.h
+++ b/arch/arc/include/asm/delay.h
@@ -17,8 +17,11 @@
 #ifndef __ASM_ARC_UDELAY_H
 #define __ASM_ARC_UDELAY_H
 
+#include <asm-generic/types.h>
 #include <asm/param.h>          /* HZ */
 
+extern unsigned long loops_per_jiffy;
+
 static inline void __delay(unsigned long loops)
 {
         __asm__ __volatile__(
diff --git a/arch/arc/include/asm/entry-compact.h b/arch/arc/include/asm/entry-compact.h
index ec36d5b6d435..29f3988c9424 100644
--- a/arch/arc/include/asm/entry-compact.h
+++ b/arch/arc/include/asm/entry-compact.h
@@ -234,6 +234,9 @@
         POP     gp
         RESTORE_R12_TO_R0
 
+#ifdef CONFIG_ARC_CURR_IN_REG
+        ld      r25, [sp, 12]
+#endif
         ld  sp, [sp] /* restore original sp */
         /* orig_r0, ECR, user_r25 skipped automatically */
 .endm
@@ -315,6 +318,9 @@
         POP     gp
         RESTORE_R12_TO_R0
 
+#ifdef CONFIG_ARC_CURR_IN_REG
+        ld      r25, [sp, 12]
+#endif
         ld  sp, [sp] /* restore original sp */
         /* orig_r0, ECR, user_r25 skipped automatically */
 .endm
diff --git a/arch/arc/include/asm/entry.h b/arch/arc/include/asm/entry.h
index 51597f344a62..302b0db8ea2b 100644
--- a/arch/arc/include/asm/entry.h
+++ b/arch/arc/include/asm/entry.h
@@ -86,9 +86,6 @@
         POP     r1
         POP     r0
 
-#ifdef CONFIG_ARC_CURR_IN_REG
-        ld      r25, [sp, 12]
-#endif
 .endm
 
 /*--------------------------------------------------------------
diff --git a/arch/arc/include/asm/mach_desc.h b/arch/arc/include/asm/mach_desc.h
index c28e6c347b49..871f3cb16af9 100644
--- a/arch/arc/include/asm/mach_desc.h
+++ b/arch/arc/include/asm/mach_desc.h
@@ -34,9 +34,7 @@ struct machine_desc {
         const char              *name;
         const char              **dt_compat;
         void                    (*init_early)(void);
-#ifdef CONFIG_SMP
         void                    (*init_per_cpu)(unsigned int);
-#endif
         void                    (*init_machine)(void);
         void                    (*init_late)(void);
 
diff --git a/arch/arc/include/asm/page.h b/arch/arc/include/asm/page.h
index 109baa06831c..09ddddf71cc5 100644
--- a/arch/arc/include/asm/page.h
+++ b/arch/arc/include/asm/page.h
@@ -105,7 +105,7 @@ typedef pte_t * pgtable_t;
 #define virt_addr_valid(kaddr)  pfn_valid(virt_to_pfn(kaddr))
 
 /* Default Permissions for stack/heaps pages (Non Executable) */
-#define VM_DATA_DEFAULT_FLAGS   (VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE)
+#define VM_DATA_DEFAULT_FLAGS   (VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
 
 #define WANT_PAGE_VIRTUAL   1
 
diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
index 8ec5599a0957..cf4be70d5892 100644
--- a/arch/arc/include/asm/pgtable.h
+++ b/arch/arc/include/asm/pgtable.h
@@ -377,7 +377,7 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long address,
 
 /* Decode a PTE containing swap "identifier "into constituents */
 #define __swp_type(pte_lookalike)       (((pte_lookalike).val) & 0x1f)
-#define __swp_offset(pte_lookalike)     ((pte_lookalike).val << 13)
+#define __swp_offset(pte_lookalike)     ((pte_lookalike).val >> 13)
 
 /* NOPs, to keep generic kernel happy */
 #define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val(pte) })
diff --git a/arch/arc/kernel/irq.c b/arch/arc/kernel/irq.c
index 538b36afe89e..62b185057c04 100644
--- a/arch/arc/kernel/irq.c
+++ b/arch/arc/kernel/irq.c
@@ -31,10 +31,10 @@ void __init init_IRQ(void)
         /* a SMP H/w block could do IPI IRQ request here */
         if (plat_smp_ops.init_per_cpu)
                 plat_smp_ops.init_per_cpu(smp_processor_id());
+#endif
 
         if (machine_desc->init_per_cpu)
                 machine_desc->init_per_cpu(smp_processor_id());
-#endif
 }
 
 /*
diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
index 5ac3b547453f..4674541eba3f 100644
--- a/arch/arc/kernel/process.c
+++ b/arch/arc/kernel/process.c
@@ -47,7 +47,8 @@ SYSCALL_DEFINE0(arc_gettls)
 SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new)
 {
         struct pt_regs *regs = current_pt_regs();
-        int uval = -EFAULT;
+        u32 uval;
+        int ret;
 
         /*
          * This is only for old cores lacking LLOCK/SCOND, which by defintion
@@ -60,23 +61,47 @@ SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new)
         /* Z indicates to userspace if operation succeded */
         regs->status32 &= ~STATUS_Z_MASK;
 
-        if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
-                return -EFAULT;
+        ret = access_ok(VERIFY_WRITE, uaddr, sizeof(*uaddr));
+        if (!ret)
+                 goto fail;
 
+again:
         preempt_disable();
 
-        if (__get_user(uval, uaddr))
-                goto done;
+        ret = __get_user(uval, uaddr);
+        if (ret)
+                 goto fault;
 
-        if (uval == expected) {
-                if (!__put_user(new, uaddr))
-                        regs->status32 |= STATUS_Z_MASK;
-        }
+        if (uval != expected)
+                 goto out;
 
-done:
-        preempt_enable();
+        ret = __put_user(new, uaddr);
+        if (ret)
+                 goto fault;
+
+        regs->status32 |= STATUS_Z_MASK;
 
+out:
+        preempt_enable();
         return uval;
+
+fault:
+        preempt_enable();
+
+        if (unlikely(ret != -EFAULT))
+                 goto fail;
+
+        down_read(&current->mm->mmap_sem);
+        ret = fixup_user_fault(current, current->mm, (unsigned long) uaddr,
+                               FAULT_FLAG_WRITE, NULL);
+        up_read(&current->mm->mmap_sem);
+
+        if (likely(!ret))
+                 goto again;
+
+fail:
+        force_sig(SIGSEGV, current);
+        return ret;
 }
 
 #ifdef CONFIG_ISA_ARCV2
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index 9dbe645ee127..25c631942500 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -1038,7 +1038,7 @@ void flush_cache_mm(struct mm_struct *mm)
 void flush_cache_page(struct vm_area_struct *vma, unsigned long u_vaddr,
                       unsigned long pfn)
 {
-        unsigned int paddr = pfn << PAGE_SHIFT;
+        phys_addr_t paddr = pfn << PAGE_SHIFT;
 
         u_vaddr &= PAGE_MASK;
 
@@ -1058,8 +1058,9 @@ void flush_anon_page(struct vm_area_struct *vma, struct page *page,
                      unsigned long u_vaddr)
 {
         /* TBD: do we really need to clear the kernel mapping */
-        __flush_dcache_page(page_address(page), u_vaddr);
-        __flush_dcache_page(page_address(page), page_address(page));
+        __flush_dcache_page((phys_addr_t)page_address(page), u_vaddr);
+        __flush_dcache_page((phys_addr_t)page_address(page),
+                            (phys_addr_t)page_address(page));
 
 }
 
@@ -1246,6 +1247,16 @@ void __init arc_cache_init_master(void)
                 }
         }
 
+        /*
+         * Check that SMP_CACHE_BYTES (and hence ARCH_DMA_MINALIGN) is larger
+         * or equal to any cache line length.
+         */
+        BUILD_BUG_ON_MSG(L1_CACHE_BYTES > SMP_CACHE_BYTES,
+                         "SMP_CACHE_BYTES must be >= any cache line length");
+        if (is_isa_arcv2() && (l2_line_sz > SMP_CACHE_BYTES))
+                panic("L2 Cache line [%d] > kernel Config [%d]\n",
+                      l2_line_sz, SMP_CACHE_BYTES);
+
         /* Note that SLC disable not formally supported till HS 3.0 */
         if (is_isa_arcv2() && l2_line_sz && !slc_enable)
                 arc_slc_disable();
diff --git a/arch/arc/mm/dma.c b/arch/arc/mm/dma.c
index 8c1071840979..ec47e6079f5d 100644
--- a/arch/arc/mm/dma.c
+++ b/arch/arc/mm/dma.c
@@ -129,14 +129,59 @@ int arch_dma_mmap(struct device *dev, struct vm_area_struct *vma,
         return ret;
 }
 
+/*
+ * Cache operations depending on function and direction argument, inspired by
+ * https://lkml.org/lkml/2018/5/18/979
+ * "dma_sync_*_for_cpu and direction=TO_DEVICE (was Re: [PATCH 02/20]
+ * dma-mapping: provide a generic dma-noncoherent implementation)"
+ *
+ *          |   map          ==  for_device     |   unmap     ==  for_cpu
+ *          |----------------------------------------------------------------
+ * TO_DEV   |   writeback        writeback      |   none          none
+ * FROM_DEV |   invalidate       invalidate     |   invalidate*   invalidate*
+ * BIDIR    |   writeback+inv    writeback+inv  |   invalidate    invalidate
+ *
+ *     [*] needed for CPU speculative prefetches
+ *
+ * NOTE: we don't check the validity of direction argument as it is done in
+ * upper layer functions (in include/linux/dma-mapping.h)
+ */
+
 void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr,
                 size_t size, enum dma_data_direction dir)
 {
-        dma_cache_wback(paddr, size);
+        switch (dir) {
+        case DMA_TO_DEVICE:
+                dma_cache_wback(paddr, size);
+                break;
+
+        case DMA_FROM_DEVICE:
+                dma_cache_inv(paddr, size);
+                break;
+
+        case DMA_BIDIRECTIONAL:
+                dma_cache_wback_inv(paddr, size);
+                break;
+
+        default:
+                break;
+        }
 }
 
 void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr,
                 size_t size, enum dma_data_direction dir)
 {
-        dma_cache_inv(paddr, size);
+        switch (dir) {
+        case DMA_TO_DEVICE:
+                break;
+
+        /* FROM_DEVICE invalidate needed if speculative CPU prefetch only */
+        case DMA_FROM_DEVICE:
+        case DMA_BIDIRECTIONAL:
+                dma_cache_inv(paddr, size);
+                break;
+
+        default:
+                break;
+        }
 }
diff --git a/arch/arc/plat-eznps/include/plat/ctop.h b/arch/arc/plat-eznps/include/plat/ctop.h
index 0c7d11022d0f..4f6a1673b3a6 100644
--- a/arch/arc/plat-eznps/include/plat/ctop.h
+++ b/arch/arc/plat-eznps/include/plat/ctop.h
@@ -21,6 +21,7 @@
 #error "Incorrect ctop.h include"
 #endif
 
+#include <linux/types.h>
 #include <soc/nps/common.h>
 
 /* core auxiliary registers */
@@ -143,6 +144,15 @@ struct nps_host_reg_gim_p_int_dst {
 };
 
 /* AUX registers definition */
+struct nps_host_reg_aux_dpc {
+        union {
+                struct {
+                        u32 ien:1, men:1, hen:1, reserved:29;
+                };
+                u32 value;
+        };
+};
+
 struct nps_host_reg_aux_udmc {
         union {
                 struct {
diff --git a/arch/arc/plat-eznps/mtm.c b/arch/arc/plat-eznps/mtm.c
index 2388de3d09ef..ed0077ef666e 100644
--- a/arch/arc/plat-eznps/mtm.c
+++ b/arch/arc/plat-eznps/mtm.c
@@ -15,6 +15,8 @@
  */
 
 #include <linux/smp.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
 #include <linux/io.h>
 #include <linux/log2.h>
 #include <asm/arcregs.h>
@@ -157,10 +159,10 @@ void mtm_enable_core(unsigned int cpu)
 /* Verify and set the value of the mtm hs counter */
 static int __init set_mtm_hs_ctr(char *ctr_str)
 {
-        long hs_ctr;
+        int hs_ctr;
         int ret;
 
-        ret = kstrtol(ctr_str, 0, &hs_ctr);
+        ret = kstrtoint(ctr_str, 0, &hs_ctr);
 
         if (ret || hs_ctr > MT_HS_CNT_MAX || hs_ctr < MT_HS_CNT_MIN) {
                 pr_err("** Invalid @nps_mtm_hs_ctr [%d] needs to be [%d:%d] (incl)\n",
diff --git a/arch/arc/plat-hsdk/Kconfig b/arch/arc/plat-hsdk/Kconfig
index 19ab3cf98f0f..9356753c2ed8 100644
--- a/arch/arc/plat-hsdk/Kconfig
+++ b/arch/arc/plat-hsdk/Kconfig
@@ -7,5 +7,8 @@
 
 menuconfig ARC_SOC_HSDK
         bool "ARC HS Development Kit SOC"
+        depends on ISA_ARCV2
+        select ARC_HAS_ACCL_REGS
         select CLK_HSDK
         select RESET_HSDK
+        select MIGHT_HAVE_PCI
diff --git a/arch/arc/plat-hsdk/platform.c b/arch/arc/plat-hsdk/platform.c
index 2958aedb649a..2588b842407c 100644
--- a/arch/arc/plat-hsdk/platform.c
+++ b/arch/arc/plat-hsdk/platform.c
@@ -42,6 +42,66 @@ static void __init hsdk_init_per_cpu(unsigned int cpu)
 #define SDIO_UHS_REG_EXT        (SDIO_BASE + 0x108)
 #define SDIO_UHS_REG_EXT_DIV_2  (2 << 30)
 
+#define HSDK_GPIO_INTC          (ARC_PERIPHERAL_BASE + 0x3000)
+
+static void __init hsdk_enable_gpio_intc_wire(void)
+{
+        /*
+         * Peripherals on CPU Card are wired to cpu intc via intermediate
+         * DW APB GPIO blocks (mainly for debouncing)
+         *
+         *         ---------------------
+         *        |  snps,archs-intc  |
+         *        ---------------------
+         *                  |
+         *        ----------------------
+         *        | snps,archs-idu-intc |
+         *        ----------------------
+         *         |   |     |   |    |
+         *         | [eth] [USB]    [... other peripherals]
+         *         |
+         * -------------------
+         * | snps,dw-apb-intc |
+         * -------------------
+         *  |      |   |   |
+         * [Bt] [HAPS]   [... other peripherals]
+         *
+         * Current implementation of "irq-dw-apb-ictl" driver doesn't work well
+         * with stacked INTCs. In particular problem happens if its master INTC
+         * not yet instantiated. See discussion here -
+         * https://lkml.org/lkml/2015/3/4/755
+         *
+         * So setup the first gpio block as a passive pass thru and hide it from
+         * DT hardware topology - connect intc directly to cpu intc
+         * The GPIO "wire" needs to be init nevertheless (here)
+         *
+         * One side adv is that peripheral interrupt handling avoids one nested
+         * intc ISR hop
+         *
+         * According to HSDK User's Manual [1], "Table 2 Interrupt Mapping"
+         * we have the following GPIO input lines used as sources of interrupt:
+         * - GPIO[0] - Bluetooth interrupt of RS9113 module
+         * - GPIO[2] - HAPS interrupt (on HapsTrak 3 connector)
+         * - GPIO[3] - Audio codec (MAX9880A) interrupt
+         * - GPIO[8-23] - Available on Arduino and PMOD_x headers
+         * For now there's no use of Arduino and PMOD_x headers in Linux
+         * use-case so we only enable lines 0, 2 and 3.
+         *
+         * [1] https://github.com/foss-for-synopsys-dwc-arc-processors/ARC-Development-Systems-Forum/wiki/docs/ARC_HSDK_User_Guide.pdf
+         */
+#define GPIO_INTEN              (HSDK_GPIO_INTC + 0x30)
+#define GPIO_INTMASK            (HSDK_GPIO_INTC + 0x34)
+#define GPIO_INTTYPE_LEVEL      (HSDK_GPIO_INTC + 0x38)
+#define GPIO_INT_POLARITY       (HSDK_GPIO_INTC + 0x3c)
+#define GPIO_INT_CONNECTED_MASK 0x0d
+
+        iowrite32(0xffffffff, (void __iomem *) GPIO_INTMASK);
+        iowrite32(~GPIO_INT_CONNECTED_MASK, (void __iomem *) GPIO_INTMASK);
+        iowrite32(0x00000000, (void __iomem *) GPIO_INTTYPE_LEVEL);
+        iowrite32(0xffffffff, (void __iomem *) GPIO_INT_POLARITY);
+        iowrite32(GPIO_INT_CONNECTED_MASK, (void __iomem *) GPIO_INTEN);
+}
+
 static void __init hsdk_init_early(void)
 {
         /*
@@ -62,6 +122,8 @@ static void __init hsdk_init_early(void)
          * minimum possible div-by-2.
          */
         iowrite32(SDIO_UHS_REG_EXT_DIV_2, (void __iomem *) SDIO_UHS_REG_EXT);
+
+        hsdk_enable_gpio_intc_wire();
 }
 
 static const char *hsdk_compat[] __initconst = {
diff --git a/arch/arm/boot/dts/am3517.dtsi b/arch/arm/boot/dts/am3517.dtsi
index 4b6062b631b1..23ea381d363f 100644
--- a/arch/arm/boot/dts/am3517.dtsi
+++ b/arch/arm/boot/dts/am3517.dtsi
@@ -91,6 +91,11 @@
         };
 };
 
+/* Table Table 5-79 of the TRM shows 480ab000 is reserved */
+&usb_otg_hs {
+        status = "disabled";
+};
+
 &iva {
         status = "disabled";
 };
diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-38x.dtsi
index 18edc9bc7927..929459c42760 100644
--- a/arch/arm/boot/dts/armada-38x.dtsi
+++ b/arch/arm/boot/dts/armada-38x.dtsi
@@ -547,7 +547,7 @@
 
                         thermal: thermal@e8078 {
                                 compatible = "marvell,armada380-thermal";
-                                reg = <0xe4078 0x4>, <0xe4074 0x4>;
+                                reg = <0xe4078 0x4>, <0xe4070 0x8>;
                                 status = "okay";
                         };
 
diff --git a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
index 19a075aee19e..f14df0baf2ab 100644
--- a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
@@ -692,7 +692,7 @@
                         dsa,member = <0 0>;
                         eeprom-length = <512>;
                         interrupt-parent = <&gpio6>;
-                        interrupts = <3 IRQ_TYPE_EDGE_FALLING>;
+                        interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
                         interrupt-controller;
                         #interrupt-cells = <2>;
 
diff --git a/arch/arm/boot/dts/omap4-droid4-xt894.dts b/arch/arm/boot/dts/omap4-droid4-xt894.dts
index bdf73cbcec3a..e7c3c563ff8f 100644
--- a/arch/arm/boot/dts/omap4-droid4-xt894.dts
+++ b/arch/arm/boot/dts/omap4-droid4-xt894.dts
@@ -159,13 +159,7 @@
 
                 dais = <&mcbsp2_port>, <&mcbsp3_port>;
         };
-};
-
-&dss {
-        status = "okay";
-};
 
-&gpio6 {
         pwm8: dmtimer-pwm-8 {
                 pinctrl-names = "default";
                 pinctrl-0 = <&vibrator_direction_pin>;
@@ -192,7 +186,10 @@
                 pwm-names = "enable", "direction";
                 direction-duty-cycle-ns = <10000000>;
         };
+};
 
+&dss {
+        status = "okay";
 };
 
 &dsi1 {
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index 106a1466518d..746565a876dc 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -48,6 +48,7 @@ saved_pc	.req	lr
  * from those features make this path too inefficient.
  */
 ret_fast_syscall:
+__ret_fast_syscall:
  UNWIND(.fnstart        )
  UNWIND(.cantunwind     )
         disable_irq_notrace                     @ disable interrupts
@@ -78,6 +79,7 @@ fast_work_pending:
  * call.
  */
 ret_fast_syscall:
+__ret_fast_syscall:
  UNWIND(.fnstart        )
  UNWIND(.cantunwind     )
         str     r0, [sp, #S_R0 + S_OFF]!        @ save returned r0
@@ -255,7 +257,7 @@ local_restart:
         tst     r10, #_TIF_SYSCALL_WORK         @ are we tracing syscalls?
         bne     __sys_trace
 
-        invoke_syscall tbl, scno, r10, ret_fast_syscall
+        invoke_syscall tbl, scno, r10, __ret_fast_syscall
 
         add     r1, sp, #S_OFF
 2:      cmp     scno, #(__ARM_NR_BASE - __NR_SYSCALL_BASE)
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 225d1c58d2de..d9c299133111 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -338,6 +338,7 @@ static struct vm_area_struct gate_vma = {
 
 static int __init gate_vma_init(void)
 {
+        vma_init(&gate_vma, NULL);
         gate_vma.vm_page_prot = PAGE_READONLY_EXEC;
         return 0;
 }
diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c
index 69df3620eca5..1c73694c871a 100644
--- a/arch/arm/mach-omap2/omap-smp.c
+++ b/arch/arm/mach-omap2/omap-smp.c
@@ -109,6 +109,45 @@ void omap5_erratum_workaround_801819(void)
 static inline void omap5_erratum_workaround_801819(void) { }
 #endif
 
+#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
+/*
+ * Configure ACR and enable ACTLR[0] (Enable invalidates of BTB with
+ * ICIALLU) to activate the workaround for secondary Core.
+ * NOTE: it is assumed that the primary core's configuration is done
+ * by the boot loader (kernel will detect a misconfiguration and complain
+ * if this is not done).
+ *
+ * In General Purpose(GP) devices, ACR bit settings can only be done
+ * by ROM code in "secure world" using the smc call and there is no
+ * option to update the "firmware" on such devices. This also works for
+ * High security(HS) devices, as a backup option in case the
+ * "update" is not done in the "security firmware".
+ */
+static void omap5_secondary_harden_predictor(void)
+{
+        u32 acr, acr_mask;
+
+        asm volatile ("mrc p15, 0, %0, c1, c0, 1" : "=r" (acr));
+
+        /*
+         * ACTLR[0] (Enable invalidates of BTB with ICIALLU)
+         */
+        acr_mask = BIT(0);
+
+        /* Do we already have it done.. if yes, skip expensive smc */
+        if ((acr & acr_mask) == acr_mask)
+                return;
+
+        acr |= acr_mask;
+        omap_smc1(OMAP5_DRA7_MON_SET_ACR_INDEX, acr);
+
+        pr_debug("%s: ARM ACR setup for CVE_2017_5715 applied on CPU%d\n",
+                 __func__, smp_processor_id());
+}
+#else
+static inline void omap5_secondary_harden_predictor(void) { }
+#endif
+
 static void omap4_secondary_init(unsigned int cpu)
 {
         /*
@@ -131,6 +170,8 @@ static void omap4_secondary_init(unsigned int cpu)
                 set_cntfreq();
                 /* Configure ACR to disable streaming WA for 801819 */
                 omap5_erratum_workaround_801819();
+                /* Enable ACR to allow for ICUALLU workaround */
+                omap5_secondary_harden_predictor();
         }
 
         /*
diff --git a/arch/arm/mach-pxa/irq.c b/arch/arm/mach-pxa/irq.c
index 9c10248fadcc..4e8c2116808e 100644
--- a/arch/arm/mach-pxa/irq.c
+++ b/arch/arm/mach-pxa/irq.c
@@ -185,7 +185,7 @@ static int pxa_irq_suspend(void)
 {
         int i;
 
-        for (i = 0; i < pxa_internal_irq_nr / 32; i++) {
+        for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) {
                 void __iomem *base = irq_base(i);
 
                 saved_icmr[i] = __raw_readl(base + ICMR);
@@ -204,7 +204,7 @@ static void pxa_irq_resume(void)
 {
         int i;
 
-        for (i = 0; i < pxa_internal_irq_nr / 32; i++) {
+        for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) {
                 void __iomem *base = irq_base(i);
 
                 __raw_writel(saved_icmr[i], base + ICMR);
diff --git a/arch/arm/mach-rpc/ecard.c b/arch/arm/mach-rpc/ecard.c
index 39aef4876ed4..04b2f22c2739 100644
--- a/arch/arm/mach-rpc/ecard.c
+++ b/arch/arm/mach-rpc/ecard.c
@@ -212,7 +212,7 @@ static DEFINE_MUTEX(ecard_mutex);
  */
 static void ecard_init_pgtables(struct mm_struct *mm)
 {
-        struct vm_area_struct vma;
+        struct vm_area_struct vma = TLB_FLUSH_VMA(mm, VM_EXEC);
 
         /* We want to set up the page tables for the following mapping:
          *  Virtual     Physical
@@ -237,9 +237,6 @@ static void ecard_init_pgtables(struct mm_struct *mm)
 
         memcpy(dst_pgd, src_pgd, sizeof(pgd_t) * (EASI_SIZE / PGDIR_SIZE));
 
-        vma.vm_flags = VM_EXEC;
-        vma.vm_mm = mm;
-
         flush_tlb_range(&vma, IO_START, IO_START + IO_SIZE);
         flush_tlb_range(&vma, EASI_START, EASI_START + EASI_SIZE);
 }
diff --git a/arch/arm64/crypto/ghash-ce-glue.c b/arch/arm64/crypto/ghash-ce-glue.c
index 7cf0b1aa6ea8..8a10f1d7199a 100644
--- a/arch/arm64/crypto/ghash-ce-glue.c
+++ b/arch/arm64/crypto/ghash-ce-glue.c
@@ -488,9 +488,13 @@ static int gcm_decrypt(struct aead_request *req)
                         err = skcipher_walk_done(&walk,
                                                  walk.nbytes % AES_BLOCK_SIZE);
                 }
-                if (walk.nbytes)
-                        pmull_gcm_encrypt_block(iv, iv, NULL,
+                if (walk.nbytes) {
+                        kernel_neon_begin();
+                        pmull_gcm_encrypt_block(iv, iv, ctx->aes_key.key_enc,
                                                 num_rounds(&ctx->aes_key));
+                        kernel_neon_end();
+                }
+
         } else {
                 __aes_arm64_encrypt(ctx->aes_key.key_enc, tag, iv,
                                     num_rounds(&ctx->aes_key));
diff --git a/arch/arm64/include/asm/tlb.h b/arch/arm64/include/asm/tlb.h
index ffdaea7954bb..0ad1cf233470 100644
--- a/arch/arm64/include/asm/tlb.h
+++ b/arch/arm64/include/asm/tlb.h
@@ -37,7 +37,7 @@ static inline void __tlb_remove_table(void *_table)
 
 static inline void tlb_flush(struct mmu_gather *tlb)
 {
-        struct vm_area_struct vma = { .vm_mm = tlb->mm, };
+        struct vm_area_struct vma = TLB_FLUSH_VMA(tlb->mm, 0);
 
         /*
          * The ASID allocator will either invalidate the ASID or mark
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index f24892a40d2c..c6d80743f4ed 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -1351,9 +1351,9 @@ static void __update_cpu_capabilities(const struct arm64_cpu_capabilities *caps,
 
 static void update_cpu_capabilities(u16 scope_mask)
 {
-        __update_cpu_capabilities(arm64_features, scope_mask, "detected:");
         __update_cpu_capabilities(arm64_errata, scope_mask,
                                   "enabling workaround for");
+        __update_cpu_capabilities(arm64_features, scope_mask, "detected:");
 }
 
 static int __enable_cpu_capability(void *arg)
@@ -1408,8 +1408,8 @@ __enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps,
 
 static void __init enable_cpu_capabilities(u16 scope_mask)
 {
-        __enable_cpu_capabilities(arm64_features, scope_mask);
         __enable_cpu_capabilities(arm64_errata, scope_mask);
+        __enable_cpu_capabilities(arm64_features, scope_mask);
 }
 
 /*
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index ecc6818191df..192b3ba07075 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -108,7 +108,6 @@ static pte_t get_clear_flush(struct mm_struct *mm,
                              unsigned long pgsize,
                              unsigned long ncontig)
 {
-        struct vm_area_struct vma = { .vm_mm = mm };
         pte_t orig_pte = huge_ptep_get(ptep);
         bool valid = pte_valid(orig_pte);
         unsigned long i, saddr = addr;
@@ -125,8 +124,10 @@ static pte_t get_clear_flush(struct mm_struct *mm,
                         orig_pte = pte_mkdirty(orig_pte);
         }
 
-        if (valid)
+        if (valid) {
+                struct vm_area_struct vma = TLB_FLUSH_VMA(mm, 0);
                 flush_tlb_range(&vma, saddr, addr);
+        }
         return orig_pte;
 }
 
@@ -145,7 +146,7 @@ static void clear_flush(struct mm_struct *mm,
                              unsigned long pgsize,
                              unsigned long ncontig)
 {
-        struct vm_area_struct vma = { .vm_mm = mm };
+        struct vm_area_struct vma = TLB_FLUSH_VMA(mm, 0);
         unsigned long i, saddr = addr;
 
         for (i = 0; i < ncontig; i++, addr += pgsize, ptep++)
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 325cfb3b858a..9abf8a1e7b25 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -611,11 +611,13 @@ void __init mem_init(void)
         BUILD_BUG_ON(TASK_SIZE_32                       > TASK_SIZE_64);
 #endif
 
+#ifdef CONFIG_SPARSEMEM_VMEMMAP
         /*
          * Make sure we chose the upper bound of sizeof(struct page)
-         * correctly.
+         * correctly when sizing the VMEMMAP array.
          */
         BUILD_BUG_ON(sizeof(struct page) > (1 << STRUCT_PAGE_MAX_SHIFT));
+#endif
 
         if (PAGE_SIZE >= 16384 && get_num_physpages() <= 128) {
                 extern int sysctl_overcommit_memory;
diff --git a/arch/ia64/include/asm/tlb.h b/arch/ia64/include/asm/tlb.h
index 44f0ac0df308..516355a774bf 100644
--- a/arch/ia64/include/asm/tlb.h
+++ b/arch/ia64/include/asm/tlb.h
@@ -115,12 +115,11 @@ ia64_tlb_flush_mmu_tlbonly(struct mmu_gather *tlb, unsigned long start, unsigned
                 flush_tlb_all();
         } else {
                 /*
-                 * XXX fix me: flush_tlb_range() should take an mm pointer instead of a
-                 * vma pointer.
+                 * flush_tlb_range() takes a vma instead of a mm pointer because
+                 * some architectures want the vm_flags for ITLB/DTLB flush.
                  */
-                struct vm_area_struct vma;
+                struct vm_area_struct vma = TLB_FLUSH_VMA(tlb->mm, 0);
 
-                vma.vm_mm = tlb->mm;
                 /* flush the address range from the tlb: */
                 flush_tlb_range(&vma, start, end);
                 /* now flush the virt. page-table area mapping the address range: */
diff --git a/arch/ia64/kernel/perfmon.c b/arch/ia64/kernel/perfmon.c
index 3b38c717008a..46bff1661836 100644
--- a/arch/ia64/kernel/perfmon.c
+++ b/arch/ia64/kernel/perfmon.c
@@ -2278,17 +2278,15 @@ pfm_smpl_buffer_alloc(struct task_struct *task, struct file *filp, pfm_context_t
         DPRINT(("smpl_buf @%p\n", smpl_buf));
 
         /* allocate vma */
-        vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+        vma = vm_area_alloc(mm);
         if (!vma) {
                 DPRINT(("Cannot allocate vma\n"));
                 goto error_kmem;
         }
-        INIT_LIST_HEAD(&vma->anon_vma_chain);
 
         /*
          * partially initialize the vma for the sampling buffer
          */
-        vma->vm_mm           = mm;
         vma->vm_file         = get_file(filp);
         vma->vm_flags        = VM_READ|VM_MAYREAD|VM_DONTEXPAND|VM_DONTDUMP;
         vma->vm_page_prot    = PAGE_READONLY; /* XXX may need to change */
@@ -2346,7 +2344,7 @@ pfm_smpl_buffer_alloc(struct task_struct *task, struct file *filp, pfm_context_t
         return 0;
 
 error:
-        kmem_cache_free(vm_area_cachep, vma);
+        vm_area_free(vma);
 error_kmem:
         pfm_rvfree(smpl_buf, size);
 
diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
index 18278b448530..3b85c3ecac38 100644
--- a/arch/ia64/mm/init.c
+++ b/arch/ia64/mm/init.c
@@ -114,10 +114,9 @@ ia64_init_addr_space (void)
          * the problem.  When the process attempts to write to the register backing store
          * for the first time, it will get a SEGFAULT in this case.
          */
-        vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+        vma = vm_area_alloc(current->mm);
         if (vma) {
-                INIT_LIST_HEAD(&vma->anon_vma_chain);
-                vma->vm_mm = current->mm;
+                vma_set_anonymous(vma);
                 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
                 vma->vm_end = vma->vm_start + PAGE_SIZE;
                 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
@@ -125,7 +124,7 @@ ia64_init_addr_space (void)
                 down_write(&current->mm->mmap_sem);
                 if (insert_vm_struct(current->mm, vma)) {
                         up_write(&current->mm->mmap_sem);
-                        kmem_cache_free(vm_area_cachep, vma);
+                        vm_area_free(vma);
                         return;
                 }
                 up_write(&current->mm->mmap_sem);
@@ -133,10 +132,9 @@ ia64_init_addr_space (void)
 
         /* map NaT-page at address zero to speed up speculative dereferencing of NULL: */
         if (!(current->personality & MMAP_PAGE_ZERO)) {
-                vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+                vma = vm_area_alloc(current->mm);
                 if (vma) {
-                        INIT_LIST_HEAD(&vma->anon_vma_chain);
-                        vma->vm_mm = current->mm;
+                        vma_set_anonymous(vma);
                         vma->vm_end = PAGE_SIZE;
                         vma->vm_page_prot = __pgprot(pgprot_val(PAGE_READONLY) | _PAGE_MA_NAT);
                         vma->vm_flags = VM_READ | VM_MAYREAD | VM_IO |
@@ -144,7 +142,7 @@ ia64_init_addr_space (void)
                         down_write(&current->mm->mmap_sem);
                         if (insert_vm_struct(current->mm, vma)) {
                                 up_write(&current->mm->mmap_sem);
-                                kmem_cache_free(vm_area_cachep, vma);
+                                vm_area_free(vma);
                                 return;
                         }
                         up_write(&current->mm->mmap_sem);
@@ -277,7 +275,7 @@ static struct vm_area_struct gate_vma;
 
 static int __init gate_vma_init(void)
 {
-        gate_vma.vm_mm = NULL;
+        vma_init(&gate_vma, NULL);
         gate_vma.vm_start = FIXADDR_USER_START;
         gate_vma.vm_end = FIXADDR_USER_END;
         gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
diff --git a/arch/mips/ath79/common.c b/arch/mips/ath79/common.c
index 10a405d593df..c782b10ddf50 100644
--- a/arch/mips/ath79/common.c
+++ b/arch/mips/ath79/common.c
@@ -58,7 +58,7 @@ EXPORT_SYMBOL_GPL(ath79_ddr_ctrl_init);
 
 void ath79_ddr_wb_flush(u32 reg)
 {
-        void __iomem *flush_reg = ath79_ddr_wb_flush_base + reg;
+        void __iomem *flush_reg = ath79_ddr_wb_flush_base + (reg * 4);
 
         /* Flush the DDR write buffer. */
         __raw_writel(0x1, flush_reg);
diff --git a/arch/mips/bcm47xx/setup.c b/arch/mips/bcm47xx/setup.c
index 8c9cbf13d32a..6054d49e608e 100644
--- a/arch/mips/bcm47xx/setup.c
+++ b/arch/mips/bcm47xx/setup.c
@@ -212,12 +212,6 @@ static int __init bcm47xx_cpu_fixes(void)
                  */
                 if (bcm47xx_bus.bcma.bus.chipinfo.id == BCMA_CHIP_ID_BCM4706)
                         cpu_wait = NULL;
-
-                /*
-                 * BCM47XX Erratum "R10: PCIe Transactions Periodically Fail"
-                 * Enable ExternalSync for sync instruction to take effect
-                 */
-                set_c0_config7(MIPS_CONF7_ES);
                 break;
 #endif
         }
diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
index 0bc270806ec5..ae461d91cd1f 100644
--- a/arch/mips/include/asm/mipsregs.h
+++ b/arch/mips/include/asm/mipsregs.h
@@ -681,8 +681,6 @@
 #define MIPS_CONF7_WII          (_ULCAST_(1) << 31)
 
 #define MIPS_CONF7_RPS          (_ULCAST_(1) << 2)
-/* ExternalSync */
-#define MIPS_CONF7_ES           (_ULCAST_(1) << 8)
 
 #define MIPS_CONF7_IAR          (_ULCAST_(1) << 10)
 #define MIPS_CONF7_AR           (_ULCAST_(1) << 16)
@@ -2767,7 +2765,6 @@ __BUILD_SET_C0(status)
 __BUILD_SET_C0(cause)
 __BUILD_SET_C0(config)
 __BUILD_SET_C0(config5)
-__BUILD_SET_C0(config7)
 __BUILD_SET_C0(intcontrol)
 __BUILD_SET_C0(intctl)
 __BUILD_SET_C0(srsmap)
diff --git a/arch/mips/pci/pci.c b/arch/mips/pci/pci.c
index 9632436d74d7..c2e94cf5ecda 100644
--- a/arch/mips/pci/pci.c
+++ b/arch/mips/pci/pci.c
@@ -54,5 +54,5 @@ void pci_resource_to_user(const struct pci_dev *dev, int bar,
         phys_addr_t size = resource_size(rsrc);
 
         *start = fixup_bigphys_addr(rsrc->start, size);
-        *end = rsrc->start + size;
+        *end = rsrc->start + size - 1;
 }
diff --git a/arch/nds32/Kconfig b/arch/nds32/Kconfig
index 6aed974276d8..34f7222c5efe 100644
--- a/arch/nds32/Kconfig
+++ b/arch/nds32/Kconfig
@@ -12,17 +12,17 @@ config NDS32
         select CLONE_BACKWARDS
         select COMMON_CLK
         select DMA_NONCOHERENT_OPS
-        select GENERIC_ASHLDI3
-        select GENERIC_ASHRDI3
-        select GENERIC_LSHRDI3
-        select GENERIC_CMPDI2
-        select GENERIC_MULDI3
-        select GENERIC_UCMPDI2
         select GENERIC_ATOMIC64
         select GENERIC_CPU_DEVICES
         select GENERIC_CLOCKEVENTS
         select GENERIC_IRQ_CHIP
         select GENERIC_IRQ_SHOW
+        select GENERIC_LIB_ASHLDI3
+        select GENERIC_LIB_ASHRDI3
+        select GENERIC_LIB_CMPDI2
+        select GENERIC_LIB_LSHRDI3
+        select GENERIC_LIB_MULDI3
+        select GENERIC_LIB_UCMPDI2
         select GENERIC_STRNCPY_FROM_USER
         select GENERIC_STRNLEN_USER
         select GENERIC_TIME_VSYSCALL
diff --git a/arch/nds32/Makefile b/arch/nds32/Makefile
index 513bb2e9baf9..031c676821ff 100644
--- a/arch/nds32/Makefile
+++ b/arch/nds32/Makefile
@@ -34,10 +34,12 @@ ifdef CONFIG_CPU_LITTLE_ENDIAN
 KBUILD_CFLAGS   += $(call cc-option, -EL)
 KBUILD_AFLAGS   += $(call cc-option, -EL)
 LDFLAGS         += $(call cc-option, -EL)
+CHECKFLAGS      += -D__NDS32_EL__
 else
 KBUILD_CFLAGS   += $(call cc-option, -EB)
 KBUILD_AFLAGS   += $(call cc-option, -EB)
 LDFLAGS         += $(call cc-option, -EB)
+CHECKFLAGS      += -D__NDS32_EB__
 endif
 
 boot := arch/nds32/boot
diff --git a/arch/nds32/include/asm/cacheflush.h b/arch/nds32/include/asm/cacheflush.h
index 10b48f0d8e85..8b26198d51bb 100644
--- a/arch/nds32/include/asm/cacheflush.h
+++ b/arch/nds32/include/asm/cacheflush.h
@@ -8,6 +8,8 @@
 
 #define PG_dcache_dirty PG_arch_1
 
+void flush_icache_range(unsigned long start, unsigned long end);
+void flush_icache_page(struct vm_area_struct *vma, struct page *page);
 #ifdef CONFIG_CPU_CACHE_ALIASING
 void flush_cache_mm(struct mm_struct *mm);
 void flush_cache_dup_mm(struct mm_struct *mm);
@@ -34,13 +36,16 @@ void flush_anon_page(struct vm_area_struct *vma,
 void flush_kernel_dcache_page(struct page *page);
 void flush_kernel_vmap_range(void *addr, int size);
 void invalidate_kernel_vmap_range(void *addr, int size);
-void flush_icache_range(unsigned long start, unsigned long end);
-void flush_icache_page(struct vm_area_struct *vma, struct page *page);
 #define flush_dcache_mmap_lock(mapping)   xa_lock_irq(&(mapping)->i_pages)
 #define flush_dcache_mmap_unlock(mapping) xa_unlock_irq(&(mapping)->i_pages)
 
 #else
 #include <asm-generic/cacheflush.h>
+#undef flush_icache_range
+#undef flush_icache_page
+#undef flush_icache_user_range
+void flush_icache_user_range(struct vm_area_struct *vma, struct page *page,
+                             unsigned long addr, int len);
 #endif
 
 #endif /* __NDS32_CACHEFLUSH_H__ */
diff --git a/arch/nds32/include/asm/futex.h b/arch/nds32/include/asm/futex.h
index eab5e84bd991..cb6cb91cfdf8 100644
--- a/arch/nds32/include/asm/futex.h
+++ b/arch/nds32/include/asm/futex.h
@@ -16,7 +16,7 @@
         "       .popsection\n"                                  \
         "       .pushsection .fixup,\"ax\"\n"                   \
         "4:     move    %0, " err_reg "\n"                      \
-        "       j       3b\n"                                   \
+        "       b       3b\n"                                   \
         "       .popsection"
 
 #define __futex_atomic_op(insn, ret, oldval, tmp, uaddr, oparg) \
diff --git a/arch/nds32/kernel/setup.c b/arch/nds32/kernel/setup.c
index 2f5b2ccebe47..63a1a5ef5219 100644
--- a/arch/nds32/kernel/setup.c
+++ b/arch/nds32/kernel/setup.c
@@ -278,7 +278,8 @@ static void __init setup_memory(void)
 
 void __init setup_arch(char **cmdline_p)
 {
-        early_init_devtree( __dtb_start);
+        early_init_devtree(__atags_pointer ? \
+                phys_to_virt(__atags_pointer) : __dtb_start);
 
         setup_cpuinfo();
 
diff --git a/arch/nds32/mm/cacheflush.c b/arch/nds32/mm/cacheflush.c
index ce8fd34497bf..254703653b6f 100644
--- a/arch/nds32/mm/cacheflush.c
+++ b/arch/nds32/mm/cacheflush.c
@@ -13,7 +13,39 @@
 
 extern struct cache_info L1_cache_info[2];
 
-#ifndef CONFIG_CPU_CACHE_ALIASING
+void flush_icache_range(unsigned long start, unsigned long end)
+{
+        unsigned long line_size, flags;
+        line_size = L1_cache_info[DCACHE].line_size;
+        start = start & ~(line_size - 1);
+        end = (end + line_size - 1) & ~(line_size - 1);
+        local_irq_save(flags);
+        cpu_cache_wbinval_range(start, end, 1);
+        local_irq_restore(flags);
+}
+EXPORT_SYMBOL(flush_icache_range);
+
+void flush_icache_page(struct vm_area_struct *vma, struct page *page)
+{
+        unsigned long flags;
+        unsigned long kaddr;
+        local_irq_save(flags);
+        kaddr = (unsigned long)kmap_atomic(page);
+        cpu_cache_wbinval_page(kaddr, vma->vm_flags & VM_EXEC);
+        kunmap_atomic((void *)kaddr);
+        local_irq_restore(flags);
+}
+EXPORT_SYMBOL(flush_icache_page);
+
+void flush_icache_user_range(struct vm_area_struct *vma, struct page *page,
+                             unsigned long addr, int len)
+{
+        unsigned long kaddr;
+        kaddr = (unsigned long)kmap_atomic(page) + (addr & ~PAGE_MASK);
+        flush_icache_range(kaddr, kaddr + len);
+        kunmap_atomic((void *)kaddr);
+}
+
 void update_mmu_cache(struct vm_area_struct *vma, unsigned long addr,
                       pte_t * pte)
 {
@@ -35,19 +67,15 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long addr,
 
         if ((test_and_clear_bit(PG_dcache_dirty, &page->flags)) ||
             (vma->vm_flags & VM_EXEC)) {
-
-                if (!PageHighMem(page)) {
-                        cpu_cache_wbinval_page((unsigned long)
-                                               page_address(page),
-                                               vma->vm_flags & VM_EXEC);
-                } else {
-                        unsigned long kaddr = (unsigned long)kmap_atomic(page);
-                        cpu_cache_wbinval_page(kaddr, vma->vm_flags & VM_EXEC);
-                        kunmap_atomic((void *)kaddr);
-                }
+                unsigned long kaddr;
+                local_irq_save(flags);
+                kaddr = (unsigned long)kmap_atomic(page);
+                cpu_cache_wbinval_page(kaddr, vma->vm_flags & VM_EXEC);
+                kunmap_atomic((void *)kaddr);
+                local_irq_restore(flags);
         }
 }
-#else
+#ifdef CONFIG_CPU_CACHE_ALIASING
 extern pte_t va_present(struct mm_struct *mm, unsigned long addr);
 
 static inline unsigned long aliasing(unsigned long addr, unsigned long page)
@@ -317,52 +345,4 @@ void invalidate_kernel_vmap_range(void *addr, int size)
         local_irq_restore(flags);
 }
 EXPORT_SYMBOL(invalidate_kernel_vmap_range);
-
-void flush_icache_range(unsigned long start, unsigned long end)
-{
-        unsigned long line_size, flags;
-        line_size = L1_cache_info[DCACHE].line_size;
-        start = start & ~(line_size - 1);
-        end = (end + line_size - 1) & ~(line_size - 1);
-        local_irq_save(flags);
-        cpu_cache_wbinval_range(start, end, 1);
-        local_irq_restore(flags);
-}
-EXPORT_SYMBOL(flush_icache_range);
-
-void flush_icache_page(struct vm_area_struct *vma, struct page *page)
-{
-        unsigned long flags;
-        local_irq_save(flags);
-        cpu_cache_wbinval_page((unsigned long)page_address(page),
-                               vma->vm_flags & VM_EXEC);
-        local_irq_restore(flags);
-}
-
-void update_mmu_cache(struct vm_area_struct *vma, unsigned long addr,
-                      pte_t * pte)
-{
-        struct page *page;
-        unsigned long flags;
-        unsigned long pfn = pte_pfn(*pte);
-
-        if (!pfn_valid(pfn))
-                return;
-
-        if (vma->vm_mm == current->active_mm) {
-                local_irq_save(flags);
-                __nds32__mtsr_dsb(addr, NDS32_SR_TLB_VPN);
-                __nds32__tlbop_rwr(*pte);
-                __nds32__isb();
-                local_irq_restore(flags);
-        }
-
-        page = pfn_to_page(pfn);
-        if (test_and_clear_bit(PG_dcache_dirty, &page->flags) ||
-            (vma->vm_flags & VM_EXEC)) {
-                local_irq_save(flags);
-                cpu_dcache_wbinval_page((unsigned long)page_address(page));
-                local_irq_restore(flags);
-        }
-}
 #endif
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 2ea575cb3401..fb96206de317 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -243,6 +243,7 @@ endif
 cpu-as-$(CONFIG_4xx)            += -Wa,-m405
 cpu-as-$(CONFIG_ALTIVEC)        += $(call as-option,-Wa$(comma)-maltivec)
 cpu-as-$(CONFIG_E200)           += -Wa,-me200
+cpu-as-$(CONFIG_E500)           += -Wa,-me500
 cpu-as-$(CONFIG_PPC_BOOK3S_64)  += -Wa,-mpower4
 cpu-as-$(CONFIG_PPC_E500MC)     += $(call as-option,-Wa$(comma)-me500mc)
 
diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h
index 896efa559996..b2f89b621b15 100644
--- a/arch/powerpc/include/asm/mmu_context.h
+++ b/arch/powerpc/include/asm/mmu_context.h
@@ -35,9 +35,9 @@ extern struct mm_iommu_table_group_mem_t *mm_iommu_lookup_rm(
 extern struct mm_iommu_table_group_mem_t *mm_iommu_find(struct mm_struct *mm,
                 unsigned long ua, unsigned long entries);
 extern long mm_iommu_ua_to_hpa(struct mm_iommu_table_group_mem_t *mem,
-                unsigned long ua, unsigned long *hpa);
+                unsigned long ua, unsigned int pageshift, unsigned long *hpa);
 extern long mm_iommu_ua_to_hpa_rm(struct mm_iommu_table_group_mem_t *mem,
-                unsigned long ua, unsigned long *hpa);
+                unsigned long ua, unsigned int pageshift, unsigned long *hpa);
 extern long mm_iommu_mapped_inc(struct mm_iommu_table_group_mem_t *mem);
 extern void mm_iommu_mapped_dec(struct mm_iommu_table_group_mem_t *mem);
 #endif
@@ -143,24 +143,33 @@ static inline void mm_context_remove_copro(struct mm_struct *mm)
 {
         int c;
 
-        c = atomic_dec_if_positive(&mm->context.copros);
-
-        /* Detect imbalance between add and remove */
-        WARN_ON(c < 0);
-
         /*
-         * Need to broadcast a global flush of the full mm before
-         * decrementing active_cpus count, as the next TLBI may be
-         * local and the nMMU and/or PSL need to be cleaned up.
-         * Should be rare enough so that it's acceptable.
+         * When removing the last copro, we need to broadcast a global
+         * flush of the full mm, as the next TLBI may be local and the
+         * nMMU and/or PSL need to be cleaned up.
+         *
+         * Both the 'copros' and 'active_cpus' counts are looked at in
+         * flush_all_mm() to determine the scope (local/global) of the
+         * TLBIs, so we need to flush first before decrementing
+         * 'copros'. If this API is used by several callers for the
+         * same context, it can lead to over-flushing. It's hopefully
+         * not common enough to be a problem.
          *
          * Skip on hash, as we don't know how to do the proper flush
          * for the time being. Invalidations will remain global if
-         * used on hash.
+         * used on hash. Note that we can't drop 'copros' either, as
+         * it could make some invalidations local with no flush
+         * in-between.
          */
-        if (c == 0 && radix_enabled()) {
+        if (radix_enabled()) {
                 flush_all_mm(mm);
-                dec_mm_active_cpus(mm);
+
+                c = atomic_dec_if_positive(&mm->context.copros);
+                /* Detect imbalance between add and remove */
+                WARN_ON(c < 0);
+
+                if (c == 0)
+                        dec_mm_active_cpus(mm);
         }
 }
 #else
diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
index e734f6e45abc..689306118b48 100644
--- a/arch/powerpc/kernel/idle_book3s.S
+++ b/arch/powerpc/kernel/idle_book3s.S
@@ -144,7 +144,9 @@ power9_restore_additional_sprs:
         mtspr   SPRN_MMCR1, r4
 
         ld      r3, STOP_MMCR2(r13)
+        ld      r4, PACA_SPRG_VDSO(r13)
         mtspr   SPRN_MMCR2, r3
+        mtspr   SPRN_SPRG3, r4
         blr
 
 /*
diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
index fe9733ffffaa..471aac313b89 100644
--- a/arch/powerpc/kernel/pci-common.c
+++ b/arch/powerpc/kernel/pci-common.c
@@ -42,6 +42,8 @@
 #include <asm/ppc-pci.h>
 #include <asm/eeh.h>
 
+#include "../../../drivers/pci/pci.h"
+
 /* hose_spinlock protects accesses to the the phb_bitmap. */
 static DEFINE_SPINLOCK(hose_spinlock);
 LIST_HEAD(hose_list);
@@ -1014,7 +1016,7 @@ void pcibios_setup_bus_devices(struct pci_bus *bus)
                 /* Cardbus can call us to add new devices to a bus, so ignore
                  * those who are already fully discovered
                  */
-                if (dev->is_added)
+                if (pci_dev_is_added(dev))
                         continue;
 
                 pcibios_setup_device(dev);
diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
index d066e37551ec..8c456fa691a5 100644
--- a/arch/powerpc/kvm/book3s_64_vio.c
+++ b/arch/powerpc/kvm/book3s_64_vio.c
@@ -449,7 +449,7 @@ long kvmppc_tce_iommu_do_map(struct kvm *kvm, struct iommu_table *tbl,
                 /* This only handles v2 IOMMU type, v1 is handled via ioctl() */
                 return H_TOO_HARD;
 
-        if (WARN_ON_ONCE(mm_iommu_ua_to_hpa(mem, ua, &hpa)))
+        if (WARN_ON_ONCE(mm_iommu_ua_to_hpa(mem, ua, tbl->it_page_shift, &hpa)))
                 return H_HARDWARE;
 
         if (mm_iommu_mapped_inc(mem))
diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c
index 925fc316a104..5b298f5a1a14 100644
--- a/arch/powerpc/kvm/book3s_64_vio_hv.c
+++ b/arch/powerpc/kvm/book3s_64_vio_hv.c
@@ -279,7 +279,8 @@ static long kvmppc_rm_tce_iommu_do_map(struct kvm *kvm, struct iommu_table *tbl,
         if (!mem)
                 return H_TOO_HARD;
 
-        if (WARN_ON_ONCE_RM(mm_iommu_ua_to_hpa_rm(mem, ua, &hpa)))
+        if (WARN_ON_ONCE_RM(mm_iommu_ua_to_hpa_rm(mem, ua, tbl->it_page_shift,
+                        &hpa)))
                 return H_HARDWARE;
 
         pua = (void *) vmalloc_to_phys(pua);
@@ -469,7 +470,8 @@ long kvmppc_rm_h_put_tce_indirect(struct kvm_vcpu *vcpu,
 
                 mem = mm_iommu_lookup_rm(vcpu->kvm->mm, ua, IOMMU_PAGE_SIZE_4K);
                 if (mem)
-                        prereg = mm_iommu_ua_to_hpa_rm(mem, ua, &tces) == 0;
+                        prereg = mm_iommu_ua_to_hpa_rm(mem, ua,
+                                        IOMMU_PAGE_SHIFT_4K, &tces) == 0;
         }
 
         if (!prereg) {
diff --git a/arch/powerpc/mm/mmu_context_iommu.c b/arch/powerpc/mm/mmu_context_iommu.c
index abb43646927a..a4ca57612558 100644
--- a/arch/powerpc/mm/mmu_context_iommu.c
+++ b/arch/powerpc/mm/mmu_context_iommu.c
@@ -19,6 +19,7 @@
 #include <linux/hugetlb.h>
 #include <linux/swap.h>
 #include <asm/mmu_context.h>
+#include <asm/pte-walk.h>
 
 static DEFINE_MUTEX(mem_list_mutex);
 
@@ -27,6 +28,7 @@ struct mm_iommu_table_group_mem_t {
         struct rcu_head rcu;
         unsigned long used;
         atomic64_t mapped;
+        unsigned int pageshift;
         u64 ua;                 /* userspace address */
         u64 entries;            /* number of entries in hpas[] */
         u64 *hpas;              /* vmalloc'ed */
@@ -125,6 +127,8 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries,
 {
         struct mm_iommu_table_group_mem_t *mem;
         long i, j, ret = 0, locked_entries = 0;
+        unsigned int pageshift;
+        unsigned long flags;
         struct page *page = NULL;
 
         mutex_lock(&mem_list_mutex);
@@ -159,6 +163,12 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries,
                 goto unlock_exit;
         }
 
+        /*
+         * For a starting point for a maximum page size calculation
+         * we use @ua and @entries natural alignment to allow IOMMU pages
+         * smaller than huge pages but still bigger than PAGE_SIZE.
+         */
+        mem->pageshift = __ffs(ua | (entries << PAGE_SHIFT));
         mem->hpas = vzalloc(array_size(entries, sizeof(mem->hpas[0])));
         if (!mem->hpas) {
                 kfree(mem);
@@ -199,6 +209,23 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries,
                         }
                 }
 populate:
+                pageshift = PAGE_SHIFT;
+                if (PageCompound(page)) {
+                        pte_t *pte;
+                        struct page *head = compound_head(page);
+                        unsigned int compshift = compound_order(head);
+
+                        local_irq_save(flags); /* disables as well */
+                        pte = find_linux_pte(mm->pgd, ua, NULL, &pageshift);
+                        local_irq_restore(flags);
+
+                        /* Double check it is still the same pinned page */
+                        if (pte && pte_page(*pte) == head &&
+                                        pageshift == compshift)
+                                pageshift = max_t(unsigned int, pageshift,
+                                                PAGE_SHIFT);
+                }
+                mem->pageshift = min(mem->pageshift, pageshift);
                 mem->hpas[i] = page_to_pfn(page) << PAGE_SHIFT;
         }
 
@@ -349,7 +376,7 @@ struct mm_iommu_table_group_mem_t *mm_iommu_find(struct mm_struct *mm,
 EXPORT_SYMBOL_GPL(mm_iommu_find);
 
 long mm_iommu_ua_to_hpa(struct mm_iommu_table_group_mem_t *mem,
-                unsigned long ua, unsigned long *hpa)
+                unsigned long ua, unsigned int pageshift, unsigned long *hpa)
 {
         const long entry = (ua - mem->ua) >> PAGE_SHIFT;
         u64 *va = &mem->hpas[entry];
@@ -357,6 +384,9 @@ long mm_iommu_ua_to_hpa(struct mm_iommu_table_group_mem_t *mem,
         if (entry >= mem->entries)
                 return -EFAULT;
 
+        if (pageshift > mem->pageshift)
+                return -EFAULT;
+
         *hpa = *va | (ua & ~PAGE_MASK);
 
         return 0;
@@ -364,7 +394,7 @@ long mm_iommu_ua_to_hpa(struct mm_iommu_table_group_mem_t *mem,
 EXPORT_SYMBOL_GPL(mm_iommu_ua_to_hpa);
 
 long mm_iommu_ua_to_hpa_rm(struct mm_iommu_table_group_mem_t *mem,
-                unsigned long ua, unsigned long *hpa)
+                unsigned long ua, unsigned int pageshift, unsigned long *hpa)
 {
         const long entry = (ua - mem->ua) >> PAGE_SHIFT;
         void *va = &mem->hpas[entry];
@@ -373,6 +403,9 @@ long mm_iommu_ua_to_hpa_rm(struct mm_iommu_table_group_mem_t *mem,
         if (entry >= mem->entries)
                 return -EFAULT;
 
+        if (pageshift > mem->pageshift)
+                return -EFAULT;
+
         pa = (void *) vmalloc_to_phys(va);
         if (!pa)
                 return -EFAULT;
diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index 380cbf9a40d9..c0a9bcd28356 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -286,6 +286,7 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
                 u64 imm64;
                 u8 *func;
                 u32 true_cond;
+                u32 tmp_idx;
 
                 /*
                  * addrs[] maps a BPF bytecode address into a real offset from
@@ -637,11 +638,7 @@ emit_clear:
                 case BPF_STX | BPF_XADD | BPF_W:
                         /* Get EA into TMP_REG_1 */
                         PPC_ADDI(b2p[TMP_REG_1], dst_reg, off);
-                        /* error if EA is not word-aligned */
-                        PPC_ANDI(b2p[TMP_REG_2], b2p[TMP_REG_1], 0x03);
-                        PPC_BCC_SHORT(COND_EQ, (ctx->idx * 4) + 12);
-                        PPC_LI(b2p[BPF_REG_0], 0);
-                        PPC_JMP(exit_addr);
+                        tmp_idx = ctx->idx * 4;
                         /* load value from memory into TMP_REG_2 */
                         PPC_BPF_LWARX(b2p[TMP_REG_2], 0, b2p[TMP_REG_1], 0);
                         /* add value from src_reg into this */
@@ -649,32 +646,16 @@ emit_clear:
                         /* store result back */
                         PPC_BPF_STWCX(b2p[TMP_REG_2], 0, b2p[TMP_REG_1]);
                         /* we're done if this succeeded */
-                        PPC_BCC_SHORT(COND_EQ, (ctx->idx * 4) + (7*4));
-                        /* otherwise, let's try once more */
-                        PPC_BPF_LWARX(b2p[TMP_REG_2], 0, b2p[TMP_REG_1], 0);
-                        PPC_ADD(b2p[TMP_REG_2], b2p[TMP_REG_2], src_reg);
-                        PPC_BPF_STWCX(b2p[TMP_REG_2], 0, b2p[TMP_REG_1]);
-                        /* exit if the store was not successful */
-                        PPC_LI(b2p[BPF_REG_0], 0);
-                        PPC_BCC(COND_NE, exit_addr);
+                        PPC_BCC_SHORT(COND_NE, tmp_idx);
                         break;
                 /* *(u64 *)(dst + off) += src */
                 case BPF_STX | BPF_XADD | BPF_DW:
                         PPC_ADDI(b2p[TMP_REG_1], dst_reg, off);
-                        /* error if EA is not doubleword-aligned */
-                        PPC_ANDI(b2p[TMP_REG_2], b2p[TMP_REG_1], 0x07);
-                        PPC_BCC_SHORT(COND_EQ, (ctx->idx * 4) + (3*4));
-                        PPC_LI(b2p[BPF_REG_0], 0);
-                        PPC_JMP(exit_addr);
-                        PPC_BPF_LDARX(b2p[TMP_REG_2], 0, b2p[TMP_REG_1], 0);
-                        PPC_ADD(b2p[TMP_REG_2], b2p[TMP_REG_2], src_reg);
-                        PPC_BPF_STDCX(b2p[TMP_REG_2], 0, b2p[TMP_REG_1]);
-                        PPC_BCC_SHORT(COND_EQ, (ctx->idx * 4) + (7*4));
+                        tmp_idx = ctx->idx * 4;
                         PPC_BPF_LDARX(b2p[TMP_REG_2], 0, b2p[TMP_REG_1], 0);
                         PPC_ADD(b2p[TMP_REG_2], b2p[TMP_REG_2], src_reg);
                         PPC_BPF_STDCX(b2p[TMP_REG_2], 0, b2p[TMP_REG_1]);
-                        PPC_LI(b2p[BPF_REG_0], 0);
-                        PPC_BCC(COND_NE, exit_addr);
+                        PPC_BCC_SHORT(COND_NE, tmp_idx);
                         break;
 
                 /*
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 5bd0eb6681bc..70b2e1e0f23c 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -46,6 +46,7 @@
 
 #include "powernv.h"
 #include "pci.h"
+#include "../../../../drivers/pci/pci.h"
 
 #define PNV_IODA1_M64_NUM       16      /* Number of M64 BARs   */
 #define PNV_IODA1_M64_SEGS      8       /* Segments per M64 BAR */
@@ -3138,7 +3139,7 @@ static void pnv_pci_ioda_fixup_iov_resources(struct pci_dev *pdev)
         struct pci_dn *pdn;
         int mul, total_vfs;
 
-        if (!pdev->is_physfn || pdev->is_added)
+        if (!pdev->is_physfn || pci_dev_is_added(pdev))
                 return;
 
         pdn = pci_get_pdn(pdev);
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 139f0af6c3d9..8a4868a3964b 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -71,6 +71,7 @@
 #include <asm/security_features.h>
 
 #include "pseries.h"
+#include "../../../../drivers/pci/pci.h"
 
 int CMO_PrPSP = -1;
 int CMO_SecPSP = -1;
@@ -664,7 +665,7 @@ static void pseries_pci_fixup_iov_resources(struct pci_dev *pdev)
         const int *indexes;
         struct device_node *dn = pci_device_to_OF_node(pdev);
 
-        if (!pdev->is_physfn || pdev->is_added)
+        if (!pdev->is_physfn || pci_dev_is_added(pdev))
                 return;
         /*Firmware must support open sriov otherwise dont configure*/
         indexes = of_get_property(dn, "ibm,open-sriov-vf-bar-info", NULL);
diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index 47166ad2a669..196978733e64 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -2734,7 +2734,7 @@ generic_inst_dump(unsigned long adr, long count, int praddr,
 {
         int nr, dotted;
         unsigned long first_adr;
-        unsigned long inst, last_inst = 0;
+        unsigned int inst, last_inst = 0;
         unsigned char val[4];
 
         dotted = 0;
@@ -2758,7 +2758,7 @@ generic_inst_dump(unsigned long adr, long count, int praddr,
                 dotted = 0;
                 last_inst = inst;
                 if (praddr)
-                        printf(REG"  %.8lx", adr, inst);
+                        printf(REG"  %.8x", adr, inst);
                 printf("\t");
                 dump_func(inst, adr);
                 printf("\n");
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index e44bb2b2873e..8a1863d9ed53 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -140,7 +140,7 @@ config S390
         select HAVE_FUNCTION_GRAPH_TRACER
         select HAVE_FUNCTION_TRACER
         select HAVE_FUTEX_CMPXCHG if FUTEX
-        select HAVE_GCC_PLUGINS
+        select HAVE_GCC_PLUGINS if BROKEN
         select HAVE_KERNEL_BZIP2
         select HAVE_KERNEL_GZIP
         select HAVE_KERNEL_LZ4
diff --git a/arch/sparc/include/asm/Kbuild b/arch/sparc/include/asm/Kbuild
index ac67828da201..410b263ef5c8 100644
--- a/arch/sparc/include/asm/Kbuild
+++ b/arch/sparc/include/asm/Kbuild
@@ -13,6 +13,7 @@ generic-y += local64.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
 generic-y += module.h
+generic-y += msi.h
 generic-y += preempt.h
 generic-y += rwsem.h
 generic-y += serial.h
diff --git a/arch/sparc/include/asm/msi.h b/arch/sparc/include/asm/msi.h
deleted file mode 100644
index 3c17c1074431..000000000000
--- a/arch/sparc/include/asm/msi.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/*
- * msi.h:  Defines specific to the MBus - Sbus - Interface.
- *
- * Copyright (C) 1996 David S. Miller (davem@caip.rutgers.edu)
- * Copyright (C) 1996 Eddie C. Dost   (ecd@skynet.be)
- */
-
-#ifndef _SPARC_MSI_H
-#define _SPARC_MSI_H
-
-/*
- * Locations of MSI Registers.
- */
-#define MSI_MBUS_ARBEN  0xe0001008      /* MBus Arbiter Enable register */
-
-/*
- * Useful bits in the MSI Registers.
- */
-#define MSI_ASYNC_MODE  0x80000000      /* Operate the MSI asynchronously */
-
-
-static inline void msi_set_sync(void)
-{
-        __asm__ __volatile__ ("lda [%0] %1, %%g3\n\t"
-                              "andn %%g3, %2, %%g3\n\t"
-                              "sta %%g3, [%0] %1\n\t" : :
-                              "r" (MSI_MBUS_ARBEN),
-                              "i" (ASI_M_CTL), "r" (MSI_ASYNC_MODE) : "g3");
-}
-
-#endif /* !(_SPARC_MSI_H) */
diff --git a/arch/sparc/kernel/time_64.c b/arch/sparc/kernel/time_64.c
index 2ef8cfa9677e..f0eba72aa1ad 100644
--- a/arch/sparc/kernel/time_64.c
+++ b/arch/sparc/kernel/time_64.c
@@ -814,7 +814,7 @@ static void __init get_tick_patch(void)
         }
 }
 
-static void init_tick_ops(struct sparc64_tick_ops *ops)
+static void __init init_tick_ops(struct sparc64_tick_ops *ops)
 {
         unsigned long freq, quotient, tick;
 
diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
index 1d70c3f6d986..be9cb0065179 100644
--- a/arch/sparc/mm/srmmu.c
+++ b/arch/sparc/mm/srmmu.c
@@ -37,7 +37,6 @@
 #include <asm/mbus.h>
 #include <asm/page.h>
 #include <asm/asi.h>
-#include <asm/msi.h>
 #include <asm/smp.h>
 #include <asm/io.h>
 
@@ -116,6 +115,25 @@ static inline void srmmu_ctxd_set(ctxd_t *ctxp, pgd_t *pgdp)
         set_pte((pte_t *)ctxp, pte);
 }
 
+/*
+ * Locations of MSI Registers.
+ */
+#define MSI_MBUS_ARBEN  0xe0001008      /* MBus Arbiter Enable register */
+
+/*
+ * Useful bits in the MSI Registers.
+ */
+#define MSI_ASYNC_MODE  0x80000000      /* Operate the MSI asynchronously */
+
+static void msi_set_sync(void)
+{
+        __asm__ __volatile__ ("lda [%0] %1, %%g3\n\t"
+                              "andn %%g3, %2, %%g3\n\t"
+                              "sta %%g3, [%0] %1\n\t" : :
+                              "r" (MSI_MBUS_ARBEN),
+                              "i" (ASI_M_CTL), "r" (MSI_ASYNC_MODE) : "g3");
+}
+
 void pmd_set(pmd_t *pmdp, pte_t *ptep)
 {
         unsigned long ptp;      /* Physical address, shifted right by 4 */
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index f1dbb4ee19d7..887d3a7bb646 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -63,7 +63,7 @@ config X86
         select ARCH_HAS_PTE_SPECIAL
         select ARCH_HAS_REFCOUNT
         select ARCH_HAS_UACCESS_FLUSHCACHE      if X86_64
-        select ARCH_HAS_UACCESS_MCSAFE          if X86_64
+        select ARCH_HAS_UACCESS_MCSAFE          if X86_64 && X86_MCE
         select ARCH_HAS_SET_MEMORY
         select ARCH_HAS_SG_CHAIN
         select ARCH_HAS_STRICT_KERNEL_RWX
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index fa42f895fdde..169c2feda14a 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -106,9 +106,13 @@ define cmd_check_data_rel
         done
 endef
 
+# We need to run two commands under "if_changed", so merge them into a
+# single invocation.
+quiet_cmd_check-and-link-vmlinux = LD      $@
+      cmd_check-and-link-vmlinux = $(cmd_check_data_rel); $(cmd_ld)
+
 $(obj)/vmlinux: $(vmlinux-objs-y) FORCE
-        $(call if_changed,check_data_rel)
-        $(call if_changed,ld)
+        $(call if_changed,check-and-link-vmlinux)
 
 OBJCOPYFLAGS_vmlinux.bin :=  -R .comment -S
 $(obj)/vmlinux.bin: vmlinux FORCE
diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compressed/pgtable_64.c
index 8c5107545251..9e2157371491 100644
--- a/arch/x86/boot/compressed/pgtable_64.c
+++ b/arch/x86/boot/compressed/pgtable_64.c
@@ -1,3 +1,4 @@
+#include <asm/e820/types.h>
 #include <asm/processor.h>
 #include "pgtable.h"
 #include "../string.h"
@@ -34,10 +35,62 @@ unsigned long *trampoline_32bit __section(.data);
 extern struct boot_params *boot_params;
 int cmdline_find_option_bool(const char *option);
 
+static unsigned long find_trampoline_placement(void)
+{
+        unsigned long bios_start, ebda_start;
+        unsigned long trampoline_start;
+        struct boot_e820_entry *entry;
+        int i;
+
+        /*
+         * Find a suitable spot for the trampoline.
+         * This code is based on reserve_bios_regions().
+         */
+
+        ebda_start = *(unsigned short *)0x40e << 4;
+        bios_start = *(unsigned short *)0x413 << 10;
+
+        if (bios_start < BIOS_START_MIN || bios_start > BIOS_START_MAX)
+                bios_start = BIOS_START_MAX;
+
+        if (ebda_start > BIOS_START_MIN && ebda_start < bios_start)
+                bios_start = ebda_start;
+
+        bios_start = round_down(bios_start, PAGE_SIZE);
+
+        /* Find the first usable memory region under bios_start. */
+        for (i = boot_params->e820_entries - 1; i >= 0; i--) {
+                entry = &boot_params->e820_table[i];
+
+                /* Skip all entries above bios_start. */
+                if (bios_start <= entry->addr)
+                        continue;
+
+                /* Skip non-RAM entries. */
+                if (entry->type != E820_TYPE_RAM)
+                        continue;
+
+                /* Adjust bios_start to the end of the entry if needed. */
+                if (bios_start > entry->addr + entry->size)
+                        bios_start = entry->addr + entry->size;
+
+                /* Keep bios_start page-aligned. */
+                bios_start = round_down(bios_start, PAGE_SIZE);
+
+                /* Skip the entry if it's too small. */
+                if (bios_start - TRAMPOLINE_32BIT_SIZE < entry->addr)
+                        continue;
+
+                break;
+        }
+
+        /* Place the trampoline just below the end of low memory */
+        return bios_start - TRAMPOLINE_32BIT_SIZE;
+}
+
 struct paging_config paging_prepare(void *rmode)
 {
         struct paging_config paging_config = {};
-        unsigned long bios_start, ebda_start;
 
         /* Initialize boot_params. Required for cmdline_find_option_bool(). */
         boot_params = rmode;
@@ -61,23 +114,7 @@ struct paging_config paging_prepare(void *rmode)
                 paging_config.l5_required = 1;
         }
 
-        /*
-         * Find a suitable spot for the trampoline.
-         * This code is based on reserve_bios_regions().
-         */
-
-        ebda_start = *(unsigned short *)0x40e << 4;
-        bios_start = *(unsigned short *)0x413 << 10;
-
-        if (bios_start < BIOS_START_MIN || bios_start > BIOS_START_MAX)
-                bios_start = BIOS_START_MAX;
-
-        if (ebda_start > BIOS_START_MIN && ebda_start < bios_start)
-                bios_start = ebda_start;
-
-        /* Place the trampoline just below the end of low memory, aligned to 4k */
-        paging_config.trampoline_start = bios_start - TRAMPOLINE_32BIT_SIZE;
-        paging_config.trampoline_start = round_down(paging_config.trampoline_start, PAGE_SIZE);
+        paging_config.trampoline_start = find_trampoline_placement();
 
         trampoline_32bit = (unsigned long *)paging_config.trampoline_start;
 
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 73a522d53b53..8ae7ffda8f98 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -981,7 +981,7 @@ ENTRY(\sym)
 
         call    \do_sym
 
-        jmp     error_exit                      /* %ebx: no swapgs flag */
+        jmp     error_exit
         .endif
 END(\sym)
 .endm
@@ -1222,7 +1222,6 @@ END(paranoid_exit)
 
 /*
  * Save all registers in pt_regs, and switch GS if needed.
- * Return: EBX=0: came from user mode; EBX=1: otherwise
  */
 ENTRY(error_entry)
         UNWIND_HINT_FUNC
@@ -1269,7 +1268,6 @@ ENTRY(error_entry)
          * for these here too.
          */
 .Lerror_kernelspace:
-        incl    %ebx
         leaq    native_irq_return_iret(%rip), %rcx
         cmpq    %rcx, RIP+8(%rsp)
         je      .Lerror_bad_iret
@@ -1303,28 +1301,20 @@ ENTRY(error_entry)
 
         /*
          * Pretend that the exception came from user mode: set up pt_regs
-         * as if we faulted immediately after IRET and clear EBX so that
-         * error_exit knows that we will be returning to user mode.
+         * as if we faulted immediately after IRET.
          */
         mov     %rsp, %rdi
         call    fixup_bad_iret
         mov     %rax, %rsp
-        decl    %ebx
         jmp     .Lerror_entry_from_usermode_after_swapgs
 END(error_entry)
 
-
-/*
- * On entry, EBX is a "return to kernel mode" flag:
- *   1: already in kernel mode, don't need SWAPGS
- *   0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode
- */
 ENTRY(error_exit)
         UNWIND_HINT_REGS
         DISABLE_INTERRUPTS(CLBR_ANY)
         TRACE_IRQS_OFF
-        testl   %ebx, %ebx
-        jnz     retint_kernel
+        testb   $3, CS(%rsp)
+        jz      retint_kernel
         jmp     retint_user
 END(error_exit)
 
diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
index 4b98101209a1..d50bb4dc0650 100644
--- a/arch/x86/events/amd/ibs.c
+++ b/arch/x86/events/amd/ibs.c
@@ -579,7 +579,7 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs)
 {
         struct cpu_perf_ibs *pcpu = this_cpu_ptr(perf_ibs->pcpu);
         struct perf_event *event = pcpu->event;
-        struct hw_perf_event *hwc = &event->hw;
+        struct hw_perf_event *hwc;
         struct perf_sample_data data;
         struct perf_raw_record raw;
         struct pt_regs regs;
@@ -602,6 +602,10 @@ fail:
                 return 0;
         }
 
+        if (WARN_ON_ONCE(!event))
+                goto fail;
+
+        hwc = &event->hw;
         msr = hwc->config_base;
         buf = ibs_data.regs;
         rdmsrl(msr, *buf);
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 707b2a96e516..86f0c15dcc2d 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -2997,6 +2997,9 @@ static int intel_pmu_hw_config(struct perf_event *event)
                 }
                 if (x86_pmu.pebs_aliases)
                         x86_pmu.pebs_aliases(event);
+
+                if (event->attr.sample_type & PERF_SAMPLE_CALLCHAIN)
+                        event->attr.sample_type |= __PERF_SAMPLE_CALLCHAIN_EARLY;
         }
 
         if (needs_branch_stack(event)) {
diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
index 8cf03f101938..8dbba77e0518 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -1186,16 +1186,20 @@ static void setup_pebs_sample_data(struct perf_event *event,
         }
 
         /*
+         * We must however always use iregs for the unwinder to stay sane; the
+         * record BP,SP,IP can point into thin air when the record is from a
+         * previous PMI context or an (I)RET happend between the record and
+         * PMI.
+         */
+        if (sample_type & PERF_SAMPLE_CALLCHAIN)
+                data->callchain = perf_callchain(event, iregs);
+
+        /*
          * We use the interrupt regs as a base because the PEBS record does not
          * contain a full regs set, specifically it seems to lack segment
          * descriptors, which get used by things like user_mode().
          *
          * In the simple case fix up only the IP for PERF_SAMPLE_IP.
-         *
-         * We must however always use BP,SP from iregs for the unwinder to stay
-         * sane; the record BP,SP can point into thin air when the record is
-         * from a previous PMI context or an (I)RET happend between the record
-         * and PMI.
          */
         *regs = *iregs;
 
@@ -1214,15 +1218,8 @@ static void setup_pebs_sample_data(struct perf_event *event,
                 regs->si = pebs->si;
                 regs->di = pebs->di;
 
-                /*
-                 * Per the above; only set BP,SP if we don't need callchains.
-                 *
-                 * XXX: does this make sense?
-                 */
-                if (!(sample_type & PERF_SAMPLE_CALLCHAIN)) {
-                        regs->bp = pebs->bp;
-                        regs->sp = pebs->sp;
-                }
+                regs->bp = pebs->bp;
+                regs->sp = pebs->sp;
 
 #ifndef CONFIG_X86_32
                 regs->r8 = pebs->r8;
diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h
index c9e1e0bef3c3..e17ab885b1e9 100644
--- a/arch/x86/events/intel/uncore.h
+++ b/arch/x86/events/intel/uncore.h
@@ -28,7 +28,7 @@
 #define UNCORE_PCI_DEV_TYPE(data)       ((data >> 8) & 0xff)
 #define UNCORE_PCI_DEV_IDX(data)        (data & 0xff)
 #define UNCORE_EXTRA_PCI_DEV            0xff
-#define UNCORE_EXTRA_PCI_DEV_MAX        3
+#define UNCORE_EXTRA_PCI_DEV_MAX        4
 
 #define UNCORE_EVENT_CONSTRAINT(c, n) EVENT_CONSTRAINT(c, n, 0xff)
 
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index 87dc0263a2e1..51d7c117e3c7 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -1029,6 +1029,7 @@ void snbep_uncore_cpu_init(void)
 enum {
         SNBEP_PCI_QPI_PORT0_FILTER,
         SNBEP_PCI_QPI_PORT1_FILTER,
+        BDX_PCI_QPI_PORT2_FILTER,
         HSWEP_PCI_PCU_3,
 };
 
@@ -3286,15 +3287,18 @@ static const struct pci_device_id bdx_uncore_pci_ids[] = {
         },
         { /* QPI Port 0 filter  */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x6f86),
-                .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV, 0),
+                .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
+                                                   SNBEP_PCI_QPI_PORT0_FILTER),
         },
         { /* QPI Port 1 filter  */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x6f96),
-                .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV, 1),
+                .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
+                                                   SNBEP_PCI_QPI_PORT1_FILTER),
         },
         { /* QPI Port 2 filter  */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x6f46),
-                .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV, 2),
+                .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
+                                                   BDX_PCI_QPI_PORT2_FILTER),
         },
         { /* PCU.3 (for Capability registers) */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x6fc0),
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index cfd29ee8c3da..59663c08c949 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -966,6 +966,7 @@ static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves)
 
 extern unsigned long arch_align_stack(unsigned long sp);
 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
+extern void free_kernel_image_pages(void *begin, void *end);
 
 void default_idle(void);
 #ifdef  CONFIG_XEN
diff --git a/arch/x86/include/asm/qspinlock_paravirt.h b/arch/x86/include/asm/qspinlock_paravirt.h
index 9ef5ee03d2d7..159622ee0674 100644
--- a/arch/x86/include/asm/qspinlock_paravirt.h
+++ b/arch/x86/include/asm/qspinlock_paravirt.h
@@ -43,7 +43,7 @@ asm    (".pushsection .text;"
         "push  %rdx;"
         "mov   $0x1,%eax;"
         "xor   %edx,%edx;"
-        "lock cmpxchg %dl,(%rdi);"
+        LOCK_PREFIX "cmpxchg %dl,(%rdi);"
         "cmp   $0x1,%al;"
         "jne   .slowpath;"
         "pop   %rdx;"
diff --git a/arch/x86/include/asm/set_memory.h b/arch/x86/include/asm/set_memory.h
index bd090367236c..34cffcef7375 100644
--- a/arch/x86/include/asm/set_memory.h
+++ b/arch/x86/include/asm/set_memory.h
@@ -46,6 +46,7 @@ int set_memory_np(unsigned long addr, int numpages);
 int set_memory_4k(unsigned long addr, int numpages);
 int set_memory_encrypted(unsigned long addr, int numpages);
 int set_memory_decrypted(unsigned long addr, int numpages);
+int set_memory_np_noalias(unsigned long addr, int numpages);
 
 int set_memory_array_uc(unsigned long *addr, int addrinarray);
 int set_memory_array_wc(unsigned long *addr, int addrinarray);
diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
index 62acb613114b..a9d637bc301d 100644
--- a/arch/x86/include/asm/uaccess_64.h
+++ b/arch/x86/include/asm/uaccess_64.h
@@ -52,7 +52,12 @@ copy_to_user_mcsafe(void *to, const void *from, unsigned len)
         unsigned long ret;
 
         __uaccess_begin();
-        ret = memcpy_mcsafe(to, from, len);
+        /*
+         * Note, __memcpy_mcsafe() is explicitly used since it can
+         * handle exceptions / faults.  memcpy_mcsafe() may fall back to
+         * memcpy() which lacks this handling.
+         */
+        ret = __memcpy_mcsafe(to, from, len);
         __uaccess_end();
         return ret;
 }
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 2aabd4cb0e3f..adbda5847b14 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -573,6 +573,9 @@ static u32 skx_deadline_rev(void)
         case 0x04: return 0x02000014;
         }
 
+        if (boot_cpu_data.x86_stepping > 4)
+                return 0;
+
         return ~0U;
 }
 
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index c102ad51025e..8c50754c09c1 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -2165,9 +2165,6 @@ static ssize_t store_int_with_restart(struct device *s,
         if (check_interval == old_check_interval)
                 return ret;
 
-        if (check_interval < 1)
-                check_interval = 1;
-
         mutex_lock(&mce_sysfs_mutex);
         mce_restart();
         mutex_unlock(&mce_sysfs_mutex);
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index bf8d1eb7fca3..3b8e7c13c614 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -138,6 +138,7 @@ static unsigned long kvm_get_tsc_khz(void)
         src = &hv_clock[cpu].pvti;
         tsc_khz = pvclock_tsc_khz(src);
         put_cpu();
+        setup_force_cpu_cap(X86_FEATURE_TSC_KNOWN_FREQ);
         return tsc_khz;
 }
 
@@ -319,6 +320,8 @@ void __init kvmclock_init(void)
         printk(KERN_INFO "kvm-clock: Using msrs %x and %x",
                 msr_kvm_system_time, msr_kvm_wall_clock);
 
+        pvclock_set_pvti_cpu0_va(hv_clock);
+
         if (kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE_STABLE_BIT))
                 pvclock_set_flags(PVCLOCK_TSC_STABLE_BIT);
 
@@ -366,14 +369,11 @@ int __init kvm_setup_vsyscall_timeinfo(void)
         vcpu_time = &hv_clock[cpu].pvti;
         flags = pvclock_read_flags(vcpu_time);
 
-        if (!(flags & PVCLOCK_TSC_STABLE_BIT)) {
-                put_cpu();
-                return 1;
-        }
-
-        pvclock_set_pvti_cpu0_va(hv_clock);
         put_cpu();
 
+        if (!(flags & PVCLOCK_TSC_STABLE_BIT))
+                return 1;
+
         kvm_clock.archdata.vclock_mode = VCLOCK_PVCLOCK;
 #endif
         return 0;
diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
index 92fd433c50b9..1bbec387d289 100644
--- a/arch/x86/kvm/Kconfig
+++ b/arch/x86/kvm/Kconfig
@@ -85,7 +85,7 @@ config KVM_AMD_SEV
         def_bool y
         bool "AMD Secure Encrypted Virtualization (SEV) support"
         depends on KVM_AMD && X86_64
-        depends on CRYPTO_DEV_CCP && CRYPTO_DEV_CCP_DD && CRYPTO_DEV_SP_PSP
+        depends on CRYPTO_DEV_SP_PSP && !(KVM_AMD=y && CRYPTO_DEV_CCP_DD=m)
         ---help---
         Provides support for launching Encrypted VMs on AMD processors.
 
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index d594690d8b95..6b8f11521c41 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -890,7 +890,7 @@ static int mmu_topup_memory_cache_page(struct kvm_mmu_memory_cache *cache,
         if (cache->nobjs >= min)
                 return 0;
         while (cache->nobjs < ARRAY_SIZE(cache->objects)) {
-                page = (void *)__get_free_page(GFP_KERNEL);
+                page = (void *)__get_free_page(GFP_KERNEL_ACCOUNT);
                 if (!page)
                         return -ENOMEM;
                 cache->objects[cache->nobjs++] = page;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 1689f433f3a0..5d8e317c2b04 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2571,6 +2571,7 @@ static void vmx_save_host_state(struct kvm_vcpu *vcpu)
         struct vcpu_vmx *vmx = to_vmx(vcpu);
 #ifdef CONFIG_X86_64
         int cpu = raw_smp_processor_id();
+        unsigned long fs_base, kernel_gs_base;
 #endif
         int i;
 
@@ -2586,12 +2587,20 @@ static void vmx_save_host_state(struct kvm_vcpu *vcpu)
         vmx->host_state.gs_ldt_reload_needed = vmx->host_state.ldt_sel;
 
 #ifdef CONFIG_X86_64
-        save_fsgs_for_kvm();
-        vmx->host_state.fs_sel = current->thread.fsindex;
-        vmx->host_state.gs_sel = current->thread.gsindex;
-#else
-        savesegment(fs, vmx->host_state.fs_sel);
-        savesegment(gs, vmx->host_state.gs_sel);
+        if (likely(is_64bit_mm(current->mm))) {
+                save_fsgs_for_kvm();
+                vmx->host_state.fs_sel = current->thread.fsindex;
+                vmx->host_state.gs_sel = current->thread.gsindex;
+                fs_base = current->thread.fsbase;
+                kernel_gs_base = current->thread.gsbase;
+        } else {
+#endif
+                savesegment(fs, vmx->host_state.fs_sel);
+                savesegment(gs, vmx->host_state.gs_sel);
+#ifdef CONFIG_X86_64
+                fs_base = read_msr(MSR_FS_BASE);
+                kernel_gs_base = read_msr(MSR_KERNEL_GS_BASE);
+        }
 #endif
         if (!(vmx->host_state.fs_sel & 7)) {
                 vmcs_write16(HOST_FS_SELECTOR, vmx->host_state.fs_sel);
@@ -2611,10 +2620,10 @@ static void vmx_save_host_state(struct kvm_vcpu *vcpu)
         savesegment(ds, vmx->host_state.ds_sel);
         savesegment(es, vmx->host_state.es_sel);
 
-        vmcs_writel(HOST_FS_BASE, current->thread.fsbase);
+        vmcs_writel(HOST_FS_BASE, fs_base);
         vmcs_writel(HOST_GS_BASE, cpu_kernelmode_gs_base(cpu));
 
-        vmx->msr_host_kernel_gs_base = current->thread.gsbase;
+        vmx->msr_host_kernel_gs_base = kernel_gs_base;
         if (is_long_mode(&vmx->vcpu))
                 wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
 #else
@@ -4322,11 +4331,7 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf)
         vmcs_conf->order = get_order(vmcs_conf->size);
         vmcs_conf->basic_cap = vmx_msr_high & ~0x1fff;
 
-        /* KVM supports Enlightened VMCS v1 only */
-        if (static_branch_unlikely(&enable_evmcs))
-                vmcs_conf->revision_id = KVM_EVMCS_VERSION;
-        else
-                vmcs_conf->revision_id = vmx_msr_low;
+        vmcs_conf->revision_id = vmx_msr_low;
 
         vmcs_conf->pin_based_exec_ctrl = _pin_based_exec_control;
         vmcs_conf->cpu_based_exec_ctrl = _cpu_based_exec_control;
@@ -4396,7 +4401,13 @@ static struct vmcs *alloc_vmcs_cpu(int cpu)
                 return NULL;
         vmcs = page_address(pages);
         memset(vmcs, 0, vmcs_config.size);
-        vmcs->revision_id = vmcs_config.revision_id; /* vmcs revision id */
+
+        /* KVM supports Enlightened VMCS v1 only */
+        if (static_branch_unlikely(&enable_evmcs))
+                vmcs->revision_id = KVM_EVMCS_VERSION;
+        else
+                vmcs->revision_id = vmcs_config.revision_id;
+
         return vmcs;
 }
 
@@ -4564,6 +4575,19 @@ static __init int alloc_kvm_area(void)
                         return -ENOMEM;
                 }
 
+                /*
+                 * When eVMCS is enabled, alloc_vmcs_cpu() sets
+                 * vmcs->revision_id to KVM_EVMCS_VERSION instead of
+                 * revision_id reported by MSR_IA32_VMX_BASIC.
+                 *
+                 * However, even though not explictly documented by
+                 * TLFS, VMXArea passed as VMXON argument should
+                 * still be marked with revision_id reported by
+                 * physical CPU.
+                 */
+                if (static_branch_unlikely(&enable_evmcs))
+                        vmcs->revision_id = vmcs_config.revision_id;
+
                 per_cpu(vmxarea, cpu) = vmcs;
         }
         return 0;
@@ -7869,6 +7893,8 @@ static int enter_vmx_operation(struct kvm_vcpu *vcpu)
                      HRTIMER_MODE_REL_PINNED);
         vmx->nested.preemption_timer.function = vmx_preemption_timer_fn;
 
+        vmx->nested.vpid02 = allocate_vpid();
+
         vmx->nested.vmxon = true;
         return 0;
 
@@ -8456,21 +8482,20 @@ static int handle_vmptrld(struct kvm_vcpu *vcpu)
 /* Emulate the VMPTRST instruction */
 static int handle_vmptrst(struct kvm_vcpu *vcpu)
 {
-        unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
-        u32 vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
-        gva_t vmcs_gva;
+        unsigned long exit_qual = vmcs_readl(EXIT_QUALIFICATION);
+        u32 instr_info = vmcs_read32(VMX_INSTRUCTION_INFO);
+        gpa_t current_vmptr = to_vmx(vcpu)->nested.current_vmptr;
         struct x86_exception e;
+        gva_t gva;
 
         if (!nested_vmx_check_permission(vcpu))
                 return 1;
 
-        if (get_vmx_mem_address(vcpu, exit_qualification,
-                        vmx_instruction_info, true, &vmcs_gva))
+        if (get_vmx_mem_address(vcpu, exit_qual, instr_info, true, &gva))
                 return 1;
         /* *_system ok, nested_vmx_check_permission has verified cpl=0 */
-        if (kvm_write_guest_virt_system(vcpu, vmcs_gva,
-                                        (void *)&to_vmx(vcpu)->nested.current_vmptr,
-                                        sizeof(u64), &e)) {
+        if (kvm_write_guest_virt_system(vcpu, gva, (void *)&current_vmptr,
+                                        sizeof(gpa_t), &e)) {
                 kvm_inject_page_fault(vcpu, &e);
                 return 1;
         }
@@ -10346,11 +10371,9 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
                         goto free_vmcs;
         }
 
-        if (nested) {
+        if (nested)
                 nested_vmx_setup_ctls_msrs(&vmx->nested.msrs,
                                            kvm_vcpu_apicv_active(&vmx->vcpu));
-                vmx->nested.vpid02 = allocate_vpid();
-        }
 
         vmx->nested.posted_intr_nv = -1;
         vmx->nested.current_vmptr = -1ull;
@@ -10367,7 +10390,6 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
         return &vmx->vcpu;
 
 free_vmcs:
-        free_vpid(vmx->nested.vpid02);
         free_loaded_vmcs(vmx->loaded_vmcs);
 free_msrs:
         kfree(vmx->guest_msrs);
@@ -11753,7 +11775,6 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu)
 {
         struct vcpu_vmx *vmx = to_vmx(vcpu);
         struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
-        u32 msr_entry_idx;
         u32 exit_qual;
         int r;
 
@@ -11775,10 +11796,10 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu)
         nested_get_vmcs12_pages(vcpu, vmcs12);
 
         r = EXIT_REASON_MSR_LOAD_FAIL;
-        msr_entry_idx = nested_vmx_load_msr(vcpu,
-                                            vmcs12->vm_entry_msr_load_addr,
-                                            vmcs12->vm_entry_msr_load_count);
-        if (msr_entry_idx)
+        exit_qual = nested_vmx_load_msr(vcpu,
+                                        vmcs12->vm_entry_msr_load_addr,
+                                        vmcs12->vm_entry_msr_load_count);
+        if (exit_qual)
                 goto fail;
 
         /*
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 0046aa70205a..2b812b3c5088 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1097,6 +1097,7 @@ static u32 msr_based_features[] = {
 
         MSR_F10H_DECFG,
         MSR_IA32_UCODE_REV,
+        MSR_IA32_ARCH_CAPABILITIES,
 };
 
 static unsigned int num_msr_based_features;
@@ -1105,7 +1106,8 @@ static int kvm_get_msr_feature(struct kvm_msr_entry *msr)
 {
         switch (msr->index) {
         case MSR_IA32_UCODE_REV:
-                rdmsrl(msr->index, msr->data);
+        case MSR_IA32_ARCH_CAPABILITIES:
+                rdmsrl_safe(msr->index, &msr->data);
                 break;
         default:
                 if (kvm_x86_ops->get_msr_feature(msr))
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index cee58a972cb2..74b157ac078d 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -773,13 +773,44 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
         }
 }
 
+/*
+ * begin/end can be in the direct map or the "high kernel mapping"
+ * used for the kernel image only.  free_init_pages() will do the
+ * right thing for either kind of address.
+ */
+void free_kernel_image_pages(void *begin, void *end)
+{
+        unsigned long begin_ul = (unsigned long)begin;
+        unsigned long end_ul = (unsigned long)end;
+        unsigned long len_pages = (end_ul - begin_ul) >> PAGE_SHIFT;
+
+
+        free_init_pages("unused kernel image", begin_ul, end_ul);
+
+        /*
+         * PTI maps some of the kernel into userspace.  For performance,
+         * this includes some kernel areas that do not contain secrets.
+         * Those areas might be adjacent to the parts of the kernel image
+         * being freed, which may contain secrets.  Remove the "high kernel
+         * image mapping" for these freed areas, ensuring they are not even
+         * potentially vulnerable to Meltdown regardless of the specific
+         * optimizations PTI is currently using.
+         *
+         * The "noalias" prevents unmapping the direct map alias which is
+         * needed to access the freed pages.
+         *
+         * This is only valid for 64bit kernels. 32bit has only one mapping
+         * which can't be treated in this way for obvious reasons.
+         */
+        if (IS_ENABLED(CONFIG_X86_64) && cpu_feature_enabled(X86_FEATURE_PTI))
+                set_memory_np_noalias(begin_ul, len_pages);
+}
+
 void __ref free_initmem(void)
 {
         e820__reallocate_tables();
 
-        free_init_pages("unused kernel",
-                        (unsigned long)(&__init_begin),
-                        (unsigned long)(&__init_end));
+        free_kernel_image_pages(&__init_begin, &__init_end);
 }
 
 #ifdef CONFIG_BLK_DEV_INITRD
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 9b19f9a8948e..dd519f372169 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -1283,12 +1283,8 @@ void mark_rodata_ro(void)
         set_memory_ro(start, (end-start) >> PAGE_SHIFT);
 #endif
 
-        free_init_pages("unused kernel",
-                        (unsigned long) __va(__pa_symbol(text_end)),
-                        (unsigned long) __va(__pa_symbol(rodata_start)));
-        free_init_pages("unused kernel",
-                        (unsigned long) __va(__pa_symbol(rodata_end)),
-                        (unsigned long) __va(__pa_symbol(_sdata)));
+        free_kernel_image_pages((void *)text_end, (void *)rodata_start);
+        free_kernel_image_pages((void *)rodata_end, (void *)_sdata);
 
         debug_checkwx();
 }
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 3bded76e8d5c..0a74996a1149 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -53,6 +53,7 @@ static DEFINE_SPINLOCK(cpa_lock);
 #define CPA_FLUSHTLB 1
 #define CPA_ARRAY 2
 #define CPA_PAGES_ARRAY 4
+#define CPA_NO_CHECK_ALIAS 8 /* Do not search for aliases */
 
 #ifdef CONFIG_PROC_FS
 static unsigned long direct_pages_count[PG_LEVEL_NUM];
@@ -1486,6 +1487,9 @@ static int change_page_attr_set_clr(unsigned long *addr, int numpages,
 
         /* No alias checking for _NX bit modifications */
         checkalias = (pgprot_val(mask_set) | pgprot_val(mask_clr)) != _PAGE_NX;
+        /* Has caller explicitly disabled alias checking? */
+        if (in_flag & CPA_NO_CHECK_ALIAS)
+                checkalias = 0;
 
         ret = __change_page_attr_set_clr(&cpa, checkalias);
 
@@ -1772,6 +1776,15 @@ int set_memory_np(unsigned long addr, int numpages)
         return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_PRESENT), 0);
 }
 
+int set_memory_np_noalias(unsigned long addr, int numpages)
+{
+        int cpa_flags = CPA_NO_CHECK_ALIAS;
+
+        return change_page_attr_set_clr(&addr, numpages, __pgprot(0),
+                                        __pgprot(_PAGE_PRESENT), 0,
+                                        cpa_flags, NULL);
+}
+
 int set_memory_4k(unsigned long addr, int numpages)
 {
         return change_page_attr_set_clr(&addr, numpages, __pgprot(0),
@@ -1784,6 +1797,12 @@ int set_memory_nonglobal(unsigned long addr, int numpages)
                                       __pgprot(_PAGE_GLOBAL), 0);
 }
 
+int set_memory_global(unsigned long addr, int numpages)
+{
+        return change_page_attr_set(&addr, numpages,
+                                    __pgprot(_PAGE_GLOBAL), 0);
+}
+
 static int __set_memory_enc_dec(unsigned long addr, int numpages, bool enc)
 {
         struct cpa_data cpa;
diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
index bcf35dac1920..ef8db6ffc836 100644
--- a/arch/x86/mm/pti.c
+++ b/arch/x86/mm/pti.c
@@ -470,6 +470,13 @@ static inline bool pti_kernel_image_global_ok(void)
 }
 
 /*
+ * This is the only user for these and it is not arch-generic
+ * like the other set_memory.h functions.  Just extern them.
+ */
+extern int set_memory_nonglobal(unsigned long addr, int numpages);
+extern int set_memory_global(unsigned long addr, int numpages);
+
+/*
  * For some configurations, map all of kernel text into the user page
  * tables.  This reduces TLB misses, especially on non-PCID systems.
  */
@@ -481,7 +488,8 @@ static void pti_clone_kernel_text(void)
          * clone the areas past rodata, they might contain secrets.
          */
         unsigned long start = PFN_ALIGN(_text);
-        unsigned long end = (unsigned long)__end_rodata_aligned;
+        unsigned long end_clone  = (unsigned long)__end_rodata_aligned;
+        unsigned long end_global = PFN_ALIGN((unsigned long)__stop___ex_table);
 
         if (!pti_kernel_image_global_ok())
                 return;
@@ -493,15 +501,19 @@ static void pti_clone_kernel_text(void)
          * pti_set_kernel_image_nonglobal() did to clear the
          * global bit.
          */
-        pti_clone_pmds(start, end, 0);
+        pti_clone_pmds(start, end_clone, _PAGE_RW);
+
+        /*
+         * pti_clone_pmds() will set the global bit in any PMDs
+         * that it clones, but we also need to get any PTEs in
+         * the last level for areas that are not huge-page-aligned.
+         */
+
+        /* Set the global bit for normal non-__init kernel text: */
+        set_memory_global(start, (end_global - start) >> PAGE_SHIFT);
 }
 
-/*
- * This is the only user for it and it is not arch-generic like
- * the other set_memory.h functions.  Just extern it.
- */
-extern int set_memory_nonglobal(unsigned long addr, int numpages);
-static void pti_set_kernel_image_nonglobal(void)
+void pti_set_kernel_image_nonglobal(void)
 {
         /*
          * The identity map is created with PMDs, regardless of the
@@ -512,9 +524,11 @@ static void pti_set_kernel_image_nonglobal(void)
         unsigned long start = PFN_ALIGN(_text);
         unsigned long end = ALIGN((unsigned long)_end, PMD_PAGE_SIZE);
 
-        if (pti_kernel_image_global_ok())
-                return;
-
+        /*
+         * This clears _PAGE_GLOBAL from the entire kernel image.
+         * pti_clone_kernel_text() map put _PAGE_GLOBAL back for
+         * areas that are mapped to userspace.
+         */
         set_memory_nonglobal(start, (end - start) >> PAGE_SHIFT);
 }
 
diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c
index 55799873ebe5..8f6cc71e0848 100644
--- a/arch/x86/net/bpf_jit_comp32.c
+++ b/arch/x86/net/bpf_jit_comp32.c
@@ -1441,8 +1441,8 @@ static void emit_prologue(u8 **pprog, u32 stack_depth)
 
         /* sub esp,STACK_SIZE */
         EMIT2_off32(0x81, 0xEC, STACK_SIZE);
-        /* sub ebp,SCRATCH_SIZE+4+12*/
-        EMIT3(0x83, add_1reg(0xE8, IA32_EBP), SCRATCH_SIZE + 16);
+        /* sub ebp,SCRATCH_SIZE+12*/
+        EMIT3(0x83, add_1reg(0xE8, IA32_EBP), SCRATCH_SIZE + 12);
         /* xor ebx,ebx */
         EMIT2(0x31, add_2reg(0xC0, IA32_EBX, IA32_EBX));
 
@@ -1475,8 +1475,8 @@ static void emit_epilogue(u8 **pprog, u32 stack_depth)
         /* mov edx,dword ptr [ebp+off]*/
         EMIT3(0x8B, add_2reg(0x40, IA32_EBP, IA32_EDX), STACK_VAR(r0[1]));
 
-        /* add ebp,SCRATCH_SIZE+4+12*/
-        EMIT3(0x83, add_1reg(0xC0, IA32_EBP), SCRATCH_SIZE + 16);
+        /* add ebp,SCRATCH_SIZE+12*/
+        EMIT3(0x83, add_1reg(0xC0, IA32_EBP), SCRATCH_SIZE + 12);
 
         /* mov ebx,dword ptr [ebp-12]*/
         EMIT3(0x8B, add_2reg(0x40, IA32_EBP, IA32_EBX), -12);
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 77873ce700ae..5f2eb3231607 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -417,7 +417,7 @@ static void __init __map_region(efi_memory_desc_t *md, u64 va)
         if (!(md->attribute & EFI_MEMORY_WB))
                 flags |= _PAGE_PCD;
 
-        if (sev_active())
+        if (sev_active() && md->type != EFI_MEMORY_MAPPED_IO)
                 flags |= _PAGE_ENC;
 
         pfn = md->phys_addr >> PAGE_SHIFT;
diff --git a/arch/x86/um/mem_32.c b/arch/x86/um/mem_32.c
index 744afdc18cf3..56c44d865f7b 100644
--- a/arch/x86/um/mem_32.c
+++ b/arch/x86/um/mem_32.c
@@ -16,7 +16,7 @@ static int __init gate_vma_init(void)
         if (!FIXADDR_USER_START)
                 return 0;
 
-        gate_vma.vm_mm = NULL;
+        vma_init(&gate_vma, NULL);
         gate_vma.vm_start = FIXADDR_USER_START;
         gate_vma.vm_end = FIXADDR_USER_END;
         gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
diff --git a/block/bio.c b/block/bio.c
index 67eff5eddc49..047c5dca6d90 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -903,25 +903,27 @@ int bio_add_page(struct bio *bio, struct page *page,
 EXPORT_SYMBOL(bio_add_page);
 
 /**
- * bio_iov_iter_get_pages - pin user or kernel pages and add them to a bio
+ * __bio_iov_iter_get_pages - pin user or kernel pages and add them to a bio
  * @bio: bio to add pages to
  * @iter: iov iterator describing the region to be mapped
  *
- * Pins as many pages from *iter and appends them to @bio's bvec array. The
+ * Pins pages from *iter and appends them to @bio's bvec array. The
  * pages will have to be released using put_page() when done.
+ * For multi-segment *iter, this function only adds pages from the
+ * the next non-empty segment of the iov iterator.
  */
-int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
+static int __bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
 {
-        unsigned short nr_pages = bio->bi_max_vecs - bio->bi_vcnt;
+        unsigned short nr_pages = bio->bi_max_vecs - bio->bi_vcnt, idx;
         struct bio_vec *bv = bio->bi_io_vec + bio->bi_vcnt;
         struct page **pages = (struct page **)bv;
-        size_t offset, diff;
+        size_t offset;
         ssize_t size;
 
         size = iov_iter_get_pages(iter, pages, LONG_MAX, nr_pages, &offset);
         if (unlikely(size <= 0))
                 return size ? size : -EFAULT;
-        nr_pages = (size + offset + PAGE_SIZE - 1) / PAGE_SIZE;
+        idx = nr_pages = (size + offset + PAGE_SIZE - 1) / PAGE_SIZE;
 
         /*
          * Deep magic below:  We need to walk the pinned pages backwards
@@ -934,21 +936,46 @@ int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
         bio->bi_iter.bi_size += size;
         bio->bi_vcnt += nr_pages;
 
-        diff = (nr_pages * PAGE_SIZE - offset) - size;
-        while (nr_pages--) {
-                bv[nr_pages].bv_page = pages[nr_pages];
-                bv[nr_pages].bv_len = PAGE_SIZE;
-                bv[nr_pages].bv_offset = 0;
+        while (idx--) {
+                bv[idx].bv_page = pages[idx];
+                bv[idx].bv_len = PAGE_SIZE;
+                bv[idx].bv_offset = 0;
         }
 
         bv[0].bv_offset += offset;
         bv[0].bv_len -= offset;
-        if (diff)
-                bv[bio->bi_vcnt - 1].bv_len -= diff;
+        bv[nr_pages - 1].bv_len -= nr_pages * PAGE_SIZE - offset - size;
 
         iov_iter_advance(iter, size);
         return 0;
 }
+
+/**
+ * bio_iov_iter_get_pages - pin user or kernel pages and add them to a bio
+ * @bio: bio to add pages to
+ * @iter: iov iterator describing the region to be mapped
+ *
+ * Pins pages from *iter and appends them to @bio's bvec array. The
+ * pages will have to be released using put_page() when done.
+ * The function tries, but does not guarantee, to pin as many pages as
+ * fit into the bio, or are requested in *iter, whatever is smaller.
+ * If MM encounters an error pinning the requested pages, it stops.
+ * Error is returned only if 0 pages could be pinned.
+ */
+int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
+{
+        unsigned short orig_vcnt = bio->bi_vcnt;
+
+        do {
+                int ret = __bio_iov_iter_get_pages(bio, iter);
+
+                if (unlikely(ret))
+                        return bio->bi_vcnt > orig_vcnt ? 0 : ret;
+
+        } while (iov_iter_count(iter) && !bio_full(bio));
+
+        return 0;
+}
 EXPORT_SYMBOL_GPL(bio_iov_iter_get_pages);
 
 static void submit_bio_wait_endio(struct bio *bio)
@@ -1866,6 +1893,7 @@ struct bio *bio_split(struct bio *bio, int sectors,
                 bio_integrity_trim(split);
 
         bio_advance(bio, split->bi_iter.bi_size);
+        bio->bi_iter.bi_done = 0;
 
         if (bio_flagged(bio, BIO_TRACE_COMPLETION))
                 bio_set_flag(split, BIO_TRACE_COMPLETION);
diff --git a/block/blk-core.c b/block/blk-core.c
index f84a9b7b6f5a..ee33590f54eb 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -2155,11 +2155,12 @@ static inline bool bio_check_ro(struct bio *bio, struct hd_struct *part)
         if (part->policy && op_is_write(bio_op(bio))) {
                 char b[BDEVNAME_SIZE];
 
-                printk(KERN_ERR
+                WARN_ONCE(1,
                        "generic_make_request: Trying to write "
                         "to read-only block-device %s (partno %d)\n",
                         bio_devname(bio, b), part->partno);
-                return true;
+                /* Older lvm-tools actually trigger this */
+                return false;
         }
 
         return false;
diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index 09b2ee6694fb..3de0836163c2 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -271,7 +271,7 @@ static bool bt_tags_iter(struct sbitmap *bitmap, unsigned int bitnr, void *data)
          * test and set the bit before assining ->rqs[].
          */
         rq = tags->rqs[bitnr];
-        if (rq && blk_mq_rq_state(rq) == MQ_RQ_IN_FLIGHT)
+        if (rq && blk_mq_request_started(rq))
                 iter_data->fn(rq, iter_data->data, reserved);
 
         return true;
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 95919268564b..654b0dc7e001 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -558,10 +558,8 @@ static void __blk_mq_complete_request(struct request *rq)
         bool shared = false;
         int cpu;
 
-        if (cmpxchg(&rq->state, MQ_RQ_IN_FLIGHT, MQ_RQ_COMPLETE) !=
-                        MQ_RQ_IN_FLIGHT)
+        if (!blk_mq_mark_complete(rq))
                 return;
-
         if (rq->internal_tag != -1)
                 blk_mq_sched_completed_request(rq);
 
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 314c52c967e5..c166f424871c 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -1155,8 +1155,10 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags,
 
                 /* make one iovec available as scatterlist */
                 err = af_alg_make_sg(&rsgl->sgl, &msg->msg_iter, seglen);
-                if (err < 0)
+                if (err < 0) {
+                        rsgl->sg_num_bytes = 0;
                         return err;
+                }
 
                 /* chain the new scatterlist with previous one */
                 if (areq->last_rsgl)
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index f8fecfec5df9..9706613eecf9 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -879,6 +879,7 @@ static void acpi_lpss_dismiss(struct device *dev)
 #define LPSS_GPIODEF0_DMA_LLP           BIT(13)
 
 static DEFINE_MUTEX(lpss_iosf_mutex);
+static bool lpss_iosf_d3_entered;
 
 static void lpss_iosf_enter_d3_state(void)
 {
@@ -921,6 +922,9 @@ static void lpss_iosf_enter_d3_state(void)
 
         iosf_mbi_modify(LPSS_IOSF_UNIT_LPIOEP, MBI_CR_WRITE,
                         LPSS_IOSF_GPIODEF0, value1, mask1);
+
+        lpss_iosf_d3_entered = true;
+
 exit:
         mutex_unlock(&lpss_iosf_mutex);
 }
@@ -935,6 +939,11 @@ static void lpss_iosf_exit_d3_state(void)
 
         mutex_lock(&lpss_iosf_mutex);
 
+        if (!lpss_iosf_d3_entered)
+                goto exit;
+
+        lpss_iosf_d3_entered = false;
+
         iosf_mbi_modify(LPSS_IOSF_UNIT_LPIOEP, MBI_CR_WRITE,
                         LPSS_IOSF_GPIODEF0, value1, mask1);
 
@@ -944,13 +953,13 @@ static void lpss_iosf_exit_d3_state(void)
         iosf_mbi_modify(LPSS_IOSF_UNIT_LPIO1, MBI_CFG_WRITE,
                         LPSS_IOSF_PMCSR, value2, mask2);
 
+exit:
         mutex_unlock(&lpss_iosf_mutex);
 }
 
-static int acpi_lpss_suspend(struct device *dev, bool runtime)
+static int acpi_lpss_suspend(struct device *dev, bool wakeup)
 {
         struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
-        bool wakeup = runtime || device_may_wakeup(dev);
         int ret;
 
         if (pdata->dev_desc->flags & LPSS_SAVE_CTX)
@@ -963,14 +972,14 @@ static int acpi_lpss_suspend(struct device *dev, bool runtime)
          * wrong status for devices being about to be powered off. See
          * lpss_iosf_enter_d3_state() for further information.
          */
-        if ((runtime || !pm_suspend_via_firmware()) &&
+        if (acpi_target_system_state() == ACPI_STATE_S0 &&
             lpss_quirks & LPSS_QUIRK_ALWAYS_POWER_ON && iosf_mbi_available())
                 lpss_iosf_enter_d3_state();
 
         return ret;
 }
 
-static int acpi_lpss_resume(struct device *dev, bool runtime)
+static int acpi_lpss_resume(struct device *dev)
 {
         struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
         int ret;
@@ -979,8 +988,7 @@ static int acpi_lpss_resume(struct device *dev, bool runtime)
          * This call is kept first to be in symmetry with
          * acpi_lpss_runtime_suspend() one.
          */
-        if ((runtime || !pm_resume_via_firmware()) &&
-            lpss_quirks & LPSS_QUIRK_ALWAYS_POWER_ON && iosf_mbi_available())
+        if (lpss_quirks & LPSS_QUIRK_ALWAYS_POWER_ON && iosf_mbi_available())
                 lpss_iosf_exit_d3_state();
 
         ret = acpi_dev_resume(dev);
@@ -1004,12 +1012,12 @@ static int acpi_lpss_suspend_late(struct device *dev)
                 return 0;
 
         ret = pm_generic_suspend_late(dev);
-        return ret ? ret : acpi_lpss_suspend(dev, false);
+        return ret ? ret : acpi_lpss_suspend(dev, device_may_wakeup(dev));
 }
 
 static int acpi_lpss_resume_early(struct device *dev)
 {
-        int ret = acpi_lpss_resume(dev, false);
+        int ret = acpi_lpss_resume(dev);
 
         return ret ? ret : pm_generic_resume_early(dev);
 }
@@ -1024,7 +1032,7 @@ static int acpi_lpss_runtime_suspend(struct device *dev)
 
 static int acpi_lpss_runtime_resume(struct device *dev)
 {
-        int ret = acpi_lpss_resume(dev, true);
+        int ret = acpi_lpss_resume(dev);
 
         return ret ? ret : pm_generic_runtime_resume(dev);
 }
diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c
index bc5f05906bd1..44f35ab3347d 100644
--- a/drivers/acpi/acpica/psloop.c
+++ b/drivers/acpi/acpica/psloop.c
@@ -497,6 +497,18 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
                         status =
                             acpi_ps_create_op(walk_state, aml_op_start, &op);
                         if (ACPI_FAILURE(status)) {
+                                /*
+                                 * ACPI_PARSE_MODULE_LEVEL means that we are loading a table by
+                                 * executing it as a control method. However, if we encounter
+                                 * an error while loading the table, we need to keep trying to
+                                 * load the table rather than aborting the table load. Set the
+                                 * status to AE_OK to proceed with the table load.
+                                 */
+                                if ((walk_state->
+                                     parse_flags & ACPI_PARSE_MODULE_LEVEL)
+                                    && status == AE_ALREADY_EXISTS) {
+                                        status = AE_OK;
+                                }
                                 if (status == AE_CTRL_PARSE_CONTINUE) {
                                         continue;
                                 }
@@ -694,6 +706,25 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
                             acpi_ps_next_parse_state(walk_state, op, status);
                         if (status == AE_CTRL_PENDING) {
                                 status = AE_OK;
+                        } else
+                            if ((walk_state->
+                                 parse_flags & ACPI_PARSE_MODULE_LEVEL)
+                                && status != AE_CTRL_TRANSFER
+                                && ACPI_FAILURE(status)) {
+                                /*
+                                 * ACPI_PARSE_MODULE_LEVEL flag means that we are currently
+                                 * loading a table by executing it as a control method.
+                                 * However, if we encounter an error while loading the table,
+                                 * we need to keep trying to load the table rather than
+                                 * aborting the table load (setting the status to AE_OK
+                                 * continues the table load). If we get a failure at this
+                                 * point, it means that the dispatcher got an error while
+                                 * processing Op (most likely an AML operand error) or a
+                                 * control method was called from module level and the
+                                 * dispatcher returned AE_CTRL_TRANSFER. In the latter case,
+                                 * leave the status alone, there's nothing wrong with it.
+                                 */
+                                status = AE_OK;
                         }
                 }
 
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 442a9e24f439..917f77f4cb55 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -2042,7 +2042,7 @@ static const struct dmi_system_id acpi_ec_no_wakeup[] = {
                 .ident = "Thinkpad X1 Carbon 6th",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "20KGS3JF01"),
+                        DMI_MATCH(DMI_PRODUCT_FAMILY, "Thinkpad X1 Carbon 6th"),
                 },
         },
         { },
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 1435d7281c66..6ebcd65d64b6 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -434,14 +434,6 @@ re_probe:
                         goto probe_failed;
         }
 
-        /*
-         * Ensure devices are listed in devices_kset in correct order
-         * It's important to move Dev to the end of devices_kset before
-         * calling .probe, because it could be recursive and parent Dev
-         * should always go first
-         */
-        devices_kset_move_last(dev);
-
         if (dev->bus->probe) {
                 ret = dev->bus->probe(dev);
                 if (ret)
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 74a05561b620..3fb95c8d9fd8 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -112,12 +112,16 @@ struct nbd_device {
         struct task_struct *task_setup;
 };
 
+#define NBD_CMD_REQUEUED        1
+
 struct nbd_cmd {
         struct nbd_device *nbd;
+        struct mutex lock;
         int index;
         int cookie;
-        struct completion send_complete;
         blk_status_t status;
+        unsigned long flags;
+        u32 cmd_cookie;
 };
 
 #if IS_ENABLED(CONFIG_DEBUG_FS)
@@ -146,6 +150,35 @@ static inline struct device *nbd_to_dev(struct nbd_device *nbd)
         return disk_to_dev(nbd->disk);
 }
 
+static void nbd_requeue_cmd(struct nbd_cmd *cmd)
+{
+        struct request *req = blk_mq_rq_from_pdu(cmd);
+
+        if (!test_and_set_bit(NBD_CMD_REQUEUED, &cmd->flags))
+                blk_mq_requeue_request(req, true);
+}
+
+#define NBD_COOKIE_BITS 32
+
+static u64 nbd_cmd_handle(struct nbd_cmd *cmd)
+{
+        struct request *req = blk_mq_rq_from_pdu(cmd);
+        u32 tag = blk_mq_unique_tag(req);
+        u64 cookie = cmd->cmd_cookie;
+
+        return (cookie << NBD_COOKIE_BITS) | tag;
+}
+
+static u32 nbd_handle_to_tag(u64 handle)
+{
+        return (u32)handle;
+}
+
+static u32 nbd_handle_to_cookie(u64 handle)
+{
+        return (u32)(handle >> NBD_COOKIE_BITS);
+}
+
 static const char *nbdcmd_to_ascii(int cmd)
 {
         switch (cmd) {
@@ -319,6 +352,9 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
         }
         config = nbd->config;
 
+        if (!mutex_trylock(&cmd->lock))
+                return BLK_EH_RESET_TIMER;
+
         if (config->num_connections > 1) {
                 dev_err_ratelimited(nbd_to_dev(nbd),
                                     "Connection timed out, retrying (%d/%d alive)\n",
@@ -343,7 +379,8 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
                                         nbd_mark_nsock_dead(nbd, nsock, 1);
                                 mutex_unlock(&nsock->tx_lock);
                         }
-                        blk_mq_requeue_request(req, true);
+                        mutex_unlock(&cmd->lock);
+                        nbd_requeue_cmd(cmd);
                         nbd_config_put(nbd);
                         return BLK_EH_DONE;
                 }
@@ -353,6 +390,7 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
         }
         set_bit(NBD_TIMEDOUT, &config->runtime_flags);
         cmd->status = BLK_STS_IOERR;
+        mutex_unlock(&cmd->lock);
         sock_shutdown(nbd);
         nbd_config_put(nbd);
 done:
@@ -430,9 +468,9 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
         struct iov_iter from;
         unsigned long size = blk_rq_bytes(req);
         struct bio *bio;
+        u64 handle;
         u32 type;
         u32 nbd_cmd_flags = 0;
-        u32 tag = blk_mq_unique_tag(req);
         int sent = nsock->sent, skip = 0;
 
         iov_iter_kvec(&from, WRITE | ITER_KVEC, &iov, 1, sizeof(request));
@@ -474,6 +512,8 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                         goto send_pages;
                 }
                 iov_iter_advance(&from, sent);
+        } else {
+                cmd->cmd_cookie++;
         }
         cmd->index = index;
         cmd->cookie = nsock->cookie;
@@ -482,7 +522,8 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                 request.from = cpu_to_be64((u64)blk_rq_pos(req) << 9);
                 request.len = htonl(size);
         }
-        memcpy(request.handle, &tag, sizeof(tag));
+        handle = nbd_cmd_handle(cmd);
+        memcpy(request.handle, &handle, sizeof(handle));
 
         dev_dbg(nbd_to_dev(nbd), "request %p: sending control (%s@%llu,%uB)\n",
                 req, nbdcmd_to_ascii(type),
@@ -500,6 +541,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                                 nsock->pending = req;
                                 nsock->sent = sent;
                         }
+                        set_bit(NBD_CMD_REQUEUED, &cmd->flags);
                         return BLK_STS_RESOURCE;
                 }
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
@@ -541,6 +583,7 @@ send_pages:
                                          */
                                         nsock->pending = req;
                                         nsock->sent = sent;
+                                        set_bit(NBD_CMD_REQUEUED, &cmd->flags);
                                         return BLK_STS_RESOURCE;
                                 }
                                 dev_err(disk_to_dev(nbd->disk),
@@ -573,10 +616,12 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
         struct nbd_reply reply;
         struct nbd_cmd *cmd;
         struct request *req = NULL;
+        u64 handle;
         u16 hwq;
         u32 tag;
         struct kvec iov = {.iov_base = &reply, .iov_len = sizeof(reply)};
         struct iov_iter to;
+        int ret = 0;
 
         reply.magic = 0;
         iov_iter_kvec(&to, READ | ITER_KVEC, &iov, 1, sizeof(reply));
@@ -594,8 +639,8 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
                 return ERR_PTR(-EPROTO);
         }
 
-        memcpy(&tag, reply.handle, sizeof(u32));
-
+        memcpy(&handle, reply.handle, sizeof(handle));
+        tag = nbd_handle_to_tag(handle);
         hwq = blk_mq_unique_tag_to_hwq(tag);
         if (hwq < nbd->tag_set.nr_hw_queues)
                 req = blk_mq_tag_to_rq(nbd->tag_set.tags[hwq],
@@ -606,11 +651,25 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
                 return ERR_PTR(-ENOENT);
         }
         cmd = blk_mq_rq_to_pdu(req);
+
+        mutex_lock(&cmd->lock);
+        if (cmd->cmd_cookie != nbd_handle_to_cookie(handle)) {
+                dev_err(disk_to_dev(nbd->disk), "Double reply on req %p, cmd_cookie %u, handle cookie %u\n",
+                        req, cmd->cmd_cookie, nbd_handle_to_cookie(handle));
+                ret = -ENOENT;
+                goto out;
+        }
+        if (test_bit(NBD_CMD_REQUEUED, &cmd->flags)) {
+                dev_err(disk_to_dev(nbd->disk), "Raced with timeout on req %p\n",
+                        req);
+                ret = -ENOENT;
+                goto out;
+        }
         if (ntohl(reply.error)) {
                 dev_err(disk_to_dev(nbd->disk), "Other side returned error (%d)\n",
                         ntohl(reply.error));
                 cmd->status = BLK_STS_IOERR;
-                return cmd;
+                goto out;
         }
 
         dev_dbg(nbd_to_dev(nbd), "request %p: got reply\n", req);
@@ -635,18 +694,18 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
                                 if (nbd_disconnected(config) ||
                                     config->num_connections <= 1) {
                                         cmd->status = BLK_STS_IOERR;
-                                        return cmd;
+                                        goto out;
                                 }
-                                return ERR_PTR(-EIO);
+                                ret = -EIO;
+                                goto out;
                         }
                         dev_dbg(nbd_to_dev(nbd), "request %p: got %d bytes data\n",
                                 req, bvec.bv_len);
                 }
-        } else {
-                /* See the comment in nbd_queue_rq. */
-                wait_for_completion(&cmd->send_complete);
         }
-        return cmd;
+out:
+        mutex_unlock(&cmd->lock);
+        return ret ? ERR_PTR(ret) : cmd;
 }
 
 static void recv_work(struct work_struct *work)
@@ -805,7 +864,7 @@ again:
          */
         blk_mq_start_request(req);
         if (unlikely(nsock->pending && nsock->pending != req)) {
-                blk_mq_requeue_request(req, true);
+                nbd_requeue_cmd(cmd);
                 ret = 0;
                 goto out;
         }
@@ -818,7 +877,7 @@ again:
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
                                     "Request send failed, requeueing\n");
                 nbd_mark_nsock_dead(nbd, nsock, 1);
-                blk_mq_requeue_request(req, true);
+                nbd_requeue_cmd(cmd);
                 ret = 0;
         }
 out:
@@ -842,7 +901,8 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
          * that the server is misbehaving (or there was an error) before we're
          * done sending everything over the wire.
          */
-        init_completion(&cmd->send_complete);
+        mutex_lock(&cmd->lock);
+        clear_bit(NBD_CMD_REQUEUED, &cmd->flags);
 
         /* We can be called directly from the user space process, which means we
          * could possibly have signals pending so our sendmsg will fail.  In
@@ -854,7 +914,7 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
                 ret = BLK_STS_IOERR;
         else if (!ret)
                 ret = BLK_STS_OK;
-        complete(&cmd->send_complete);
+        mutex_unlock(&cmd->lock);
 
         return ret;
 }
@@ -1460,6 +1520,8 @@ static int nbd_init_request(struct blk_mq_tag_set *set, struct request *rq,
 {
         struct nbd_cmd *cmd = blk_mq_rq_to_pdu(rq);
         cmd->nbd = set->driver_data;
+        cmd->flags = 0;
+        mutex_init(&cmd->lock);
         return 0;
 }
 
diff --git a/drivers/char/agp/alpha-agp.c b/drivers/char/agp/alpha-agp.c
index 53fe633df1e8..c9bf2c219841 100644
--- a/drivers/char/agp/alpha-agp.c
+++ b/drivers/char/agp/alpha-agp.c
@@ -11,7 +11,7 @@
 
 #include "agp.h"
 
-static int alpha_core_agp_vm_fault(struct vm_fault *vmf)
+static vm_fault_t alpha_core_agp_vm_fault(struct vm_fault *vmf)
 {
         alpha_agp_info *agp = agp_bridge->dev_private_data;
         dma_addr_t dma_addr;
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index e50c29c97ca7..c69e39fdd02b 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -156,7 +156,7 @@ static u64 amd64_configure(struct pci_dev *hammer, u64 gatt_table)
 
         /* Address to map to */
         pci_read_config_dword(hammer, AMD64_GARTAPERTUREBASE, &tmp);
-        aperturebase = tmp << 25;
+        aperturebase = (u64)tmp << 25;
         aper_base = (aperturebase & PCI_BASE_ADDRESS_MEM_MASK);
 
         enable_gart_translation(hammer, gatt_table);
@@ -277,7 +277,7 @@ static int fix_northbridge(struct pci_dev *nb, struct pci_dev *agp, u16 cap)
         pci_read_config_dword(nb, AMD64_GARTAPERTURECTL, &nb_order);
         nb_order = (nb_order >> 1) & 7;
         pci_read_config_dword(nb, AMD64_GARTAPERTUREBASE, &nb_base);
-        nb_aper = nb_base << 25;
+        nb_aper = (u64)nb_base << 25;
 
         /* Northbridge seems to contain crap. Try the AGP bridge. */
 
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index ffeb60d3434c..df66a9dd0aae 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -708,6 +708,7 @@ static int mmap_zero(struct file *file, struct vm_area_struct *vma)
 #endif
         if (vma->vm_flags & VM_SHARED)
                 return shmem_zero_setup(vma);
+        vma_set_anonymous(vma);
         return 0;
 }
 
diff --git a/drivers/char/random.c b/drivers/char/random.c
index cd888d4ee605..bd449ad52442 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1895,14 +1895,22 @@ static int
 write_pool(struct entropy_store *r, const char __user *buffer, size_t count)
 {
         size_t bytes;
-        __u32 buf[16];
+        __u32 t, buf[16];
         const char __user *p = buffer;
 
         while (count > 0) {
+                int b, i = 0;
+
                 bytes = min(count, sizeof(buf));
                 if (copy_from_user(&buf, p, bytes))
                         return -EFAULT;
 
+                for (b = bytes ; b > 0 ; b -= sizeof(__u32), i++) {
+                        if (!arch_get_random_int(&t))
+                                break;
+                        buf[i] ^= t;
+                }
+
                 count -= bytes;
                 p += bytes;
 
diff --git a/drivers/clk/clk-aspeed.c b/drivers/clk/clk-aspeed.c
index 38b366b00c57..7b70a074095d 100644
--- a/drivers/clk/clk-aspeed.c
+++ b/drivers/clk/clk-aspeed.c
@@ -24,7 +24,7 @@
 #define ASPEED_MPLL_PARAM       0x20
 #define ASPEED_HPLL_PARAM       0x24
 #define  AST2500_HPLL_BYPASS_EN BIT(20)
-#define  AST2400_HPLL_STRAPPED  BIT(18)
+#define  AST2400_HPLL_PROGRAMMED BIT(18)
 #define  AST2400_HPLL_BYPASS_EN BIT(17)
 #define ASPEED_MISC_CTRL        0x2c
 #define  UART_DIV13_EN          BIT(12)
@@ -91,8 +91,8 @@ static const struct aspeed_gate_data aspeed_gates[] = {
         [ASPEED_CLK_GATE_GCLK] =        {  1,  7, "gclk-gate",          NULL,   0 }, /* 2D engine */
         [ASPEED_CLK_GATE_MCLK] =        {  2, -1, "mclk-gate",          "mpll", CLK_IS_CRITICAL }, /* SDRAM */
         [ASPEED_CLK_GATE_VCLK] =        {  3,  6, "vclk-gate",          NULL,   0 }, /* Video Capture */
-        [ASPEED_CLK_GATE_BCLK] =        {  4,  8, "bclk-gate",          "bclk", 0 }, /* PCIe/PCI */
-        [ASPEED_CLK_GATE_DCLK] =        {  5, -1, "dclk-gate",          NULL,   0 }, /* DAC */
+        [ASPEED_CLK_GATE_BCLK] =        {  4,  8, "bclk-gate",          "bclk", CLK_IS_CRITICAL }, /* PCIe/PCI */
+        [ASPEED_CLK_GATE_DCLK] =        {  5, -1, "dclk-gate",          NULL,   CLK_IS_CRITICAL }, /* DAC */
         [ASPEED_CLK_GATE_REFCLK] =      {  6, -1, "refclk-gate",        "clkin", CLK_IS_CRITICAL },
         [ASPEED_CLK_GATE_USBPORT2CLK] = {  7,  3, "usb-port2-gate",     NULL,   0 }, /* USB2.0 Host port 2 */
         [ASPEED_CLK_GATE_LCLK] =        {  8,  5, "lclk-gate",          NULL,   0 }, /* LPC */
@@ -212,9 +212,22 @@ static int aspeed_clk_is_enabled(struct clk_hw *hw)
 {
         struct aspeed_clk_gate *gate = to_aspeed_clk_gate(hw);
         u32 clk = BIT(gate->clock_idx);
+        u32 rst = BIT(gate->reset_idx);
         u32 enval = (gate->flags & CLK_GATE_SET_TO_DISABLE) ? 0 : clk;
         u32 reg;
 
+        /*
+         * If the IP is in reset, treat the clock as not enabled,
+         * this happens with some clocks such as the USB one when
+         * coming from cold reset. Without this, aspeed_clk_enable()
+         * will fail to lift the reset.
+         */
+        if (gate->reset_idx >= 0) {
+                regmap_read(gate->map, ASPEED_RESET_CTRL, &reg);
+                if (reg & rst)
+                        return 0;
+        }
+
         regmap_read(gate->map, ASPEED_CLK_STOP_CTRL, &reg);
 
         return ((reg & clk) == enval) ? 1 : 0;
@@ -565,29 +578,45 @@ builtin_platform_driver(aspeed_clk_driver);
 static void __init aspeed_ast2400_cc(struct regmap *map)
 {
         struct clk_hw *hw;
-        u32 val, freq, div;
+        u32 val, div, clkin, hpll;
+        const u16 hpll_rates[][4] = {
+                {384, 360, 336, 408},
+                {400, 375, 350, 425},
+        };
+        int rate;
 
         /*
          * CLKIN is the crystal oscillator, 24, 48 or 25MHz selected by
          * strapping
          */
         regmap_read(map, ASPEED_STRAP, &val);
-        if (val & CLKIN_25MHZ_EN)
-                freq = 25000000;
-        else if (val & AST2400_CLK_SOURCE_SEL)
-                freq = 48000000;
-        else
-                freq = 24000000;
-        hw = clk_hw_register_fixed_rate(NULL, "clkin", NULL, 0, freq);
-        pr_debug("clkin @%u MHz\n", freq / 1000000);
+        rate = (val >> 8) & 3;
+        if (val & CLKIN_25MHZ_EN) {
+                clkin = 25000000;
+                hpll = hpll_rates[1][rate];
+        } else if (val & AST2400_CLK_SOURCE_SEL) {
+                clkin = 48000000;
+                hpll = hpll_rates[0][rate];
+        } else {
+                clkin = 24000000;
+                hpll = hpll_rates[0][rate];
+        }
+        hw = clk_hw_register_fixed_rate(NULL, "clkin", NULL, 0, clkin);
+        pr_debug("clkin @%u MHz\n", clkin / 1000000);
 
         /*
          * High-speed PLL clock derived from the crystal. This the CPU clock,
-         * and we assume that it is enabled
+         * and we assume that it is enabled. It can be configured through the
+         * HPLL_PARAM register, or set to a specified frequency by strapping.
          */
         regmap_read(map, ASPEED_HPLL_PARAM, &val);
-        WARN(val & AST2400_HPLL_STRAPPED, "hpll is strapped not configured");
-        aspeed_clk_data->hws[ASPEED_CLK_HPLL] = aspeed_ast2400_calc_pll("hpll", val);
+        if (val & AST2400_HPLL_PROGRAMMED)
+                hw = aspeed_ast2400_calc_pll("hpll", val);
+        else
+                hw = clk_hw_register_fixed_rate(NULL, "hpll", "clkin", 0,
+                                hpll * 1000000);
+
+        aspeed_clk_data->hws[ASPEED_CLK_HPLL] = hw;
 
         /*
          * Strap bits 11:10 define the CPU/AHB clock frequency ratio (aka HCLK)
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 9760b526ca31..e2ed078abd90 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -24,7 +24,6 @@
 #include <linux/pm_runtime.h>
 #include <linux/sched.h>
 #include <linux/clkdev.h>
-#include <linux/stringify.h>
 
 #include "clk.h"
 
@@ -2559,7 +2558,7 @@ static const struct {
         unsigned long flag;
         const char *name;
 } clk_flags[] = {
-#define ENTRY(f) { f, __stringify(f) }
+#define ENTRY(f) { f, #f }
         ENTRY(CLK_SET_RATE_GATE),
         ENTRY(CLK_SET_PARENT_GATE),
         ENTRY(CLK_SET_RATE_PARENT),
diff --git a/drivers/clk/meson/clk-audio-divider.c b/drivers/clk/meson/clk-audio-divider.c
index 58f546e04807..e4cf96ba704e 100644
--- a/drivers/clk/meson/clk-audio-divider.c
+++ b/drivers/clk/meson/clk-audio-divider.c
@@ -51,7 +51,7 @@ static unsigned long audio_divider_recalc_rate(struct clk_hw *hw,
         struct meson_clk_audio_div_data *adiv = meson_clk_audio_div_data(clk);
         unsigned long divider;
 
-        divider = meson_parm_read(clk->map, &adiv->div);
+        divider = meson_parm_read(clk->map, &adiv->div) + 1;
 
         return DIV_ROUND_UP_ULL((u64)parent_rate, divider);
 }
diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
index 240658404367..177fffb9ebef 100644
--- a/drivers/clk/meson/gxbb.c
+++ b/drivers/clk/meson/gxbb.c
@@ -498,6 +498,7 @@ static struct clk_regmap gxbb_fclk_div2 = {
                 .ops = &clk_regmap_gate_ops,
                 .parent_names = (const char *[]){ "fclk_div2_div" },
                 .num_parents = 1,
+                .flags = CLK_IS_CRITICAL,
         },
 };
 
diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c
index 6860bd5a37c5..44e4e27eddad 100644
--- a/drivers/clk/mvebu/armada-37xx-periph.c
+++ b/drivers/clk/mvebu/armada-37xx-periph.c
@@ -35,6 +35,7 @@
 #define CLK_SEL         0x10
 #define CLK_DIS         0x14
 
+#define  ARMADA_37XX_DVFS_LOAD_1 1
 #define LOAD_LEVEL_NR   4
 
 #define ARMADA_37XX_NB_L0L1     0x18
@@ -507,6 +508,40 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate,
         return -EINVAL;
 }
 
+/*
+ * Switching the CPU from the L2 or L3 frequencies (300 and 200 Mhz
+ * respectively) to L0 frequency (1.2 Ghz) requires a significant
+ * amount of time to let VDD stabilize to the appropriate
+ * voltage. This amount of time is large enough that it cannot be
+ * covered by the hardware countdown register. Due to this, the CPU
+ * might start operating at L0 before the voltage is stabilized,
+ * leading to CPU stalls.
+ *
+ * To work around this problem, we prevent switching directly from the
+ * L2/L3 frequencies to the L0 frequency, and instead switch to the L1
+ * frequency in-between. The sequence therefore becomes:
+ * 1. First switch from L2/L3(200/300MHz) to L1(600MHZ)
+ * 2. Sleep 20ms for stabling VDD voltage
+ * 3. Then switch from L1(600MHZ) to L0(1200Mhz).
+ */
+static void clk_pm_cpu_set_rate_wa(unsigned long rate, struct regmap *base)
+{
+        unsigned int cur_level;
+
+        if (rate != 1200 * 1000 * 1000)
+                return;
+
+        regmap_read(base, ARMADA_37XX_NB_CPU_LOAD, &cur_level);
+        cur_level &= ARMADA_37XX_NB_CPU_LOAD_MASK;
+        if (cur_level <= ARMADA_37XX_DVFS_LOAD_1)
+                return;
+
+        regmap_update_bits(base, ARMADA_37XX_NB_CPU_LOAD,
+                           ARMADA_37XX_NB_CPU_LOAD_MASK,
+                           ARMADA_37XX_DVFS_LOAD_1);
+        msleep(20);
+}
+
 static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate,
                                unsigned long parent_rate)
 {
@@ -537,6 +572,9 @@ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate,
                          */
                         reg = ARMADA_37XX_NB_CPU_LOAD;
                         mask = ARMADA_37XX_NB_CPU_LOAD_MASK;
+
+                        clk_pm_cpu_set_rate_wa(rate, base);
+
                         regmap_update_bits(base, reg, mask, load_level);
 
                         return rate;
diff --git a/drivers/clk/qcom/gcc-msm8996.c b/drivers/clk/qcom/gcc-msm8996.c
index 9f35b3fe1d97..ff8d66fd94e6 100644
--- a/drivers/clk/qcom/gcc-msm8996.c
+++ b/drivers/clk/qcom/gcc-msm8996.c
@@ -2781,6 +2781,7 @@ static struct clk_branch gcc_ufs_rx_cfg_clk = {
 
 static struct clk_branch gcc_ufs_tx_symbol_0_clk = {
         .halt_reg = 0x75018,
+        .halt_check = BRANCH_HALT_SKIP,
         .clkr = {
                 .enable_reg = 0x75018,
                 .enable_mask = BIT(0),
diff --git a/drivers/clk/qcom/mmcc-msm8996.c b/drivers/clk/qcom/mmcc-msm8996.c
index 1a25ee4f3658..4b20d1b67a1b 100644
--- a/drivers/clk/qcom/mmcc-msm8996.c
+++ b/drivers/clk/qcom/mmcc-msm8996.c
@@ -2910,6 +2910,7 @@ static struct gdsc mmagic_bimc_gdsc = {
                 .name = "mmagic_bimc",
         },
         .pwrsts = PWRSTS_OFF_ON,
+        .flags = ALWAYS_ON,
 };
 
 static struct gdsc mmagic_video_gdsc = {
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index ece120da3353..d4ed0022b0dd 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -311,12 +311,20 @@ static DEFINE_MUTEX(intel_pstate_limits_lock);
 
 #ifdef CONFIG_ACPI
 
-static bool intel_pstate_get_ppc_enable_status(void)
+static bool intel_pstate_acpi_pm_profile_server(void)
 {
         if (acpi_gbl_FADT.preferred_profile == PM_ENTERPRISE_SERVER ||
             acpi_gbl_FADT.preferred_profile == PM_PERFORMANCE_SERVER)
                 return true;
 
+        return false;
+}
+
+static bool intel_pstate_get_ppc_enable_status(void)
+{
+        if (intel_pstate_acpi_pm_profile_server())
+                return true;
+
         return acpi_ppc;
 }
 
@@ -459,6 +467,11 @@ static inline void intel_pstate_init_acpi_perf_limits(struct cpufreq_policy *pol
 static inline void intel_pstate_exit_perf_limits(struct cpufreq_policy *policy)
 {
 }
+
+static inline bool intel_pstate_acpi_pm_profile_server(void)
+{
+        return false;
+}
 #endif
 
 static inline void update_turbo_state(void)
@@ -1841,7 +1854,7 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
                 intel_pstate_hwp_enable(cpu);
 
                 id = x86_match_cpu(intel_pstate_hwp_boost_ids);
-                if (id)
+                if (id && intel_pstate_acpi_pm_profile_server())
                         hwp_boost = true;
         }
 
@@ -2394,6 +2407,18 @@ static bool __init intel_pstate_no_acpi_pss(void)
         return true;
 }
 
+static bool __init intel_pstate_no_acpi_pcch(void)
+{
+        acpi_status status;
+        acpi_handle handle;
+
+        status = acpi_get_handle(NULL, "\\_SB", &handle);
+        if (ACPI_FAILURE(status))
+                return true;
+
+        return !acpi_has_method(handle, "PCCH");
+}
+
 static bool __init intel_pstate_has_acpi_ppc(void)
 {
         int i;
@@ -2453,7 +2478,10 @@ static bool __init intel_pstate_platform_pwr_mgmt_exists(void)
 
         switch (plat_info[idx].data) {
         case PSS:
-                return intel_pstate_no_acpi_pss();
+                if (!intel_pstate_no_acpi_pss())
+                        return false;
+
+                return intel_pstate_no_acpi_pcch();
         case PPC:
                 return intel_pstate_has_acpi_ppc() && !force_load;
         }
diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
index 3f0ce2ae35ee..0c56c9759672 100644
--- a/drivers/cpufreq/pcc-cpufreq.c
+++ b/drivers/cpufreq/pcc-cpufreq.c
@@ -580,6 +580,10 @@ static int __init pcc_cpufreq_init(void)
 {
         int ret;
 
+        /* Skip initialization if another cpufreq driver is there. */
+        if (cpufreq_get_current_driver())
+                return 0;
+
         if (acpi_disabled)
                 return 0;
 
diff --git a/drivers/cpufreq/qcom-cpufreq-kryo.c b/drivers/cpufreq/qcom-cpufreq-kryo.c
index 29389accf3e9..efc9a7ae4857 100644
--- a/drivers/cpufreq/qcom-cpufreq-kryo.c
+++ b/drivers/cpufreq/qcom-cpufreq-kryo.c
@@ -183,6 +183,7 @@ static struct platform_driver qcom_cpufreq_kryo_driver = {
 static const struct of_device_id qcom_cpufreq_kryo_match_list[] __initconst = {
         { .compatible = "qcom,apq8096", },
         { .compatible = "qcom,msm8996", },
+        {}
 };
 
 /*
diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
index 1c6cbda56afe..09d823d36d3a 100644
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -266,6 +266,8 @@ static inline void padlock_xcrypt_ecb(const u8 *input, u8 *output, void *key,
                 return;
         }
 
+        count -= initial;
+
         if (initial)
                 asm volatile (".byte 0xf3,0x0f,0xa7,0xc8"       /* rep xcryptecb */
                               : "+S"(input), "+D"(output)
@@ -273,7 +275,7 @@ static inline void padlock_xcrypt_ecb(const u8 *input, u8 *output, void *key,
 
         asm volatile (".byte 0xf3,0x0f,0xa7,0xc8"       /* rep xcryptecb */
                       : "+S"(input), "+D"(output)
-                      : "d"(control_word), "b"(key), "c"(count - initial));
+                      : "d"(control_word), "b"(key), "c"(count));
 }
 
 static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key,
@@ -284,6 +286,8 @@ static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key,
         if (count < cbc_fetch_blocks)
                 return cbc_crypt(input, output, key, iv, control_word, count);
 
+        count -= initial;
+
         if (initial)
                 asm volatile (".byte 0xf3,0x0f,0xa7,0xd0"       /* rep xcryptcbc */
                               : "+S" (input), "+D" (output), "+a" (iv)
@@ -291,7 +295,7 @@ static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key,
 
         asm volatile (".byte 0xf3,0x0f,0xa7,0xd0"       /* rep xcryptcbc */
                       : "+S" (input), "+D" (output), "+a" (iv)
-                      : "d" (control_word), "b" (key), "c" (count-initial));
+                      : "d" (control_word), "b" (key), "c" (count));
         return iv;
 }
 
diff --git a/drivers/gpio/gpio-uniphier.c b/drivers/gpio/gpio-uniphier.c
index d3cf9502e7e7..58faeb1cef63 100644
--- a/drivers/gpio/gpio-uniphier.c
+++ b/drivers/gpio/gpio-uniphier.c
@@ -181,7 +181,11 @@ static int uniphier_gpio_to_irq(struct gpio_chip *chip, unsigned int offset)
         fwspec.fwnode = of_node_to_fwnode(chip->parent->of_node);
         fwspec.param_count = 2;
         fwspec.param[0] = offset - UNIPHIER_GPIO_IRQ_OFFSET;
-        fwspec.param[1] = IRQ_TYPE_NONE;
+        /*
+         * IRQ_TYPE_NONE is rejected by the parent irq domain. Set LEVEL_HIGH
+         * temporarily. Anyway, ->irq_set_type() will override it later.
+         */
+        fwspec.param[1] = IRQ_TYPE_LEVEL_HIGH;
 
         return irq_create_fwspec_mapping(&fwspec);
 }
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index 28d968088131..53a14ee8ad6d 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -64,7 +64,8 @@ static void of_gpio_flags_quirks(struct device_node *np,
          * Note that active low is the default.
          */
         if (IS_ENABLED(CONFIG_REGULATOR) &&
-            (of_device_is_compatible(np, "reg-fixed-voltage") ||
+            (of_device_is_compatible(np, "regulator-fixed") ||
+             of_device_is_compatible(np, "reg-fixed-voltage") ||
              of_device_is_compatible(np, "regulator-gpio"))) {
                 /*
                  * The regulator GPIO handles are specified such that the
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
index f4c474a95875..71efcf38f11b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
@@ -57,6 +57,10 @@
 #define ACP_I2S_COMP2_CAP_REG_OFFSET            0xa8
 #define ACP_I2S_COMP1_PLAY_REG_OFFSET           0x6c
 #define ACP_I2S_COMP2_PLAY_REG_OFFSET           0x68
+#define ACP_BT_PLAY_REGS_START                  0x14970
+#define ACP_BT_PLAY_REGS_END                    0x14a24
+#define ACP_BT_COMP1_REG_OFFSET                 0xac
+#define ACP_BT_COMP2_REG_OFFSET                 0xa8
 
 #define mmACP_PGFSM_RETAIN_REG                  0x51c9
 #define mmACP_PGFSM_CONFIG_REG                  0x51ca
@@ -77,7 +81,7 @@
 #define ACP_SOFT_RESET_DONE_TIME_OUT_VALUE      0x000000FF
 
 #define ACP_TIMEOUT_LOOP                        0x000000FF
-#define ACP_DEVS                                3
+#define ACP_DEVS                                4
 #define ACP_SRC_ID                              162
 
 enum {
@@ -316,14 +320,13 @@ static int acp_hw_init(void *handle)
         if (adev->acp.acp_cell == NULL)
                 return -ENOMEM;
 
-        adev->acp.acp_res = kcalloc(4, sizeof(struct resource), GFP_KERNEL);
-
+        adev->acp.acp_res = kcalloc(5, sizeof(struct resource), GFP_KERNEL);
         if (adev->acp.acp_res == NULL) {
                 kfree(adev->acp.acp_cell);
                 return -ENOMEM;
         }
 
-        i2s_pdata = kcalloc(2, sizeof(struct i2s_platform_data), GFP_KERNEL);
+        i2s_pdata = kcalloc(3, sizeof(struct i2s_platform_data), GFP_KERNEL);
         if (i2s_pdata == NULL) {
                 kfree(adev->acp.acp_res);
                 kfree(adev->acp.acp_cell);
@@ -358,6 +361,20 @@ static int acp_hw_init(void *handle)
         i2s_pdata[1].i2s_reg_comp1 = ACP_I2S_COMP1_CAP_REG_OFFSET;
         i2s_pdata[1].i2s_reg_comp2 = ACP_I2S_COMP2_CAP_REG_OFFSET;
 
+        i2s_pdata[2].quirks = DW_I2S_QUIRK_COMP_REG_OFFSET;
+        switch (adev->asic_type) {
+        case CHIP_STONEY:
+                i2s_pdata[2].quirks |= DW_I2S_QUIRK_16BIT_IDX_OVERRIDE;
+                break;
+        default:
+                break;
+        }
+
+        i2s_pdata[2].cap = DWC_I2S_PLAY | DWC_I2S_RECORD;
+        i2s_pdata[2].snd_rates = SNDRV_PCM_RATE_8000_96000;
+        i2s_pdata[2].i2s_reg_comp1 = ACP_BT_COMP1_REG_OFFSET;
+        i2s_pdata[2].i2s_reg_comp2 = ACP_BT_COMP2_REG_OFFSET;
+
         adev->acp.acp_res[0].name = "acp2x_dma";
         adev->acp.acp_res[0].flags = IORESOURCE_MEM;
         adev->acp.acp_res[0].start = acp_base;
@@ -373,13 +390,18 @@ static int acp_hw_init(void *handle)
         adev->acp.acp_res[2].start = acp_base + ACP_I2S_CAP_REGS_START;
         adev->acp.acp_res[2].end = acp_base + ACP_I2S_CAP_REGS_END;
 
-        adev->acp.acp_res[3].name = "acp2x_dma_irq";
-        adev->acp.acp_res[3].flags = IORESOURCE_IRQ;
-        adev->acp.acp_res[3].start = amdgpu_irq_create_mapping(adev, 162);
-        adev->acp.acp_res[3].end = adev->acp.acp_res[3].start;
+        adev->acp.acp_res[3].name = "acp2x_dw_bt_i2s_play_cap";
+        adev->acp.acp_res[3].flags = IORESOURCE_MEM;
+        adev->acp.acp_res[3].start = acp_base + ACP_BT_PLAY_REGS_START;
+        adev->acp.acp_res[3].end = acp_base + ACP_BT_PLAY_REGS_END;
+
+        adev->acp.acp_res[4].name = "acp2x_dma_irq";
+        adev->acp.acp_res[4].flags = IORESOURCE_IRQ;
+        adev->acp.acp_res[4].start = amdgpu_irq_create_mapping(adev, 162);
+        adev->acp.acp_res[4].end = adev->acp.acp_res[4].start;
 
         adev->acp.acp_cell[0].name = "acp_audio_dma";
-        adev->acp.acp_cell[0].num_resources = 4;
+        adev->acp.acp_cell[0].num_resources = 5;
         adev->acp.acp_cell[0].resources = &adev->acp.acp_res[0];
         adev->acp.acp_cell[0].platform_data = &adev->asic_type;
         adev->acp.acp_cell[0].pdata_size = sizeof(adev->asic_type);
@@ -396,6 +418,12 @@ static int acp_hw_init(void *handle)
         adev->acp.acp_cell[2].platform_data = &i2s_pdata[1];
         adev->acp.acp_cell[2].pdata_size = sizeof(struct i2s_platform_data);
 
+        adev->acp.acp_cell[3].name = "designware-i2s";
+        adev->acp.acp_cell[3].num_resources = 1;
+        adev->acp.acp_cell[3].resources = &adev->acp.acp_res[3];
+        adev->acp.acp_cell[3].platform_data = &i2s_pdata[2];
+        adev->acp.acp_cell[3].pdata_size = sizeof(struct i2s_platform_data);
+
         r = mfd_add_hotplug_devices(adev->acp.parent, adev->acp.acp_cell,
                                                                 ACP_DEVS);
         if (r)
@@ -451,7 +479,6 @@ static int acp_hw_init(void *handle)
         val = cgs_read_register(adev->acp.cgs_device, mmACP_SOFT_RESET);
         val &= ~ACP_SOFT_RESET__SoftResetAud_MASK;
         cgs_write_register(adev->acp.cgs_device, mmACP_SOFT_RESET, val);
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index 9ab89371d9e8..ca8bf1c9a98e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -575,6 +575,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
         { 0x1002, 0x6900, 0x1002, 0x0124, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
+        { 0x1002, 0x6900, 0x1025, 0x125A, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0, 0, 0, 0, 0 },
 };
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 82312a7bc6ad..9c85a90be293 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -927,6 +927,10 @@ static int amdgpu_cs_ib_vm_chunk(struct amdgpu_device *adev,
                 r = amdgpu_bo_vm_update_pte(p);
                 if (r)
                         return r;
+
+                r = reservation_object_reserve_shared(vm->root.base.bo->tbo.resv);
+                if (r)
+                        return r;
         }
 
         return amdgpu_cs_sync_rings(p);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 6e5284e6c028..2c5f093e79e3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2747,6 +2747,9 @@ int amdgpu_device_resume(struct drm_device *dev, bool resume, bool fbcon)
         if (r)
                 return r;
 
+        /* Make sure IB tests flushed */
+        flush_delayed_work(&adev->late_init_work);
+
         /* blat the mode back in */
         if (fbcon) {
                 if (!amdgpu_device_has_dc_support(adev)) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index edf16b2b957a..fdcb498f6d19 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -107,6 +107,9 @@ static void amdgpu_vm_bo_base_init(struct amdgpu_vm_bo_base *base,
                 return;
         list_add_tail(&base->bo_list, &bo->va);
 
+        if (bo->tbo.type == ttm_bo_type_kernel)
+                list_move(&base->vm_status, &vm->relocated);
+
         if (bo->tbo.resv != vm->root.base.bo->tbo.resv)
                 return;
 
@@ -468,7 +471,6 @@ static int amdgpu_vm_alloc_levels(struct amdgpu_device *adev,
                         pt->parent = amdgpu_bo_ref(parent->base.bo);
 
                         amdgpu_vm_bo_base_init(&entry->base, vm, pt);
-                        list_move(&entry->base.vm_status, &vm->relocated);
                 }
 
                 if (level < AMDGPU_VM_PTB) {
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index 4304d9e408b8..ace9ad578ca0 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -83,22 +83,21 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux,
         enum i2c_mot_mode mot = (msg->request & DP_AUX_I2C_MOT) ?
                 I2C_MOT_TRUE : I2C_MOT_FALSE;
         enum ddc_result res;
-        uint32_t read_bytes = msg->size;
+        ssize_t read_bytes;
 
         if (WARN_ON(msg->size > 16))
                 return -E2BIG;
 
         switch (msg->request & ~DP_AUX_I2C_MOT) {
         case DP_AUX_NATIVE_READ:
-                res = dal_ddc_service_read_dpcd_data(
+                read_bytes = dal_ddc_service_read_dpcd_data(
                                 TO_DM_AUX(aux)->ddc_service,
                                 false,
                                 I2C_MOT_UNDEF,
                                 msg->address,
                                 msg->buffer,
-                                msg->size,
-                                &read_bytes);
-                break;
+                                msg->size);
+                return read_bytes;
         case DP_AUX_NATIVE_WRITE:
                 res = dal_ddc_service_write_dpcd_data(
                                 TO_DM_AUX(aux)->ddc_service,
@@ -109,15 +108,14 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux,
                                 msg->size);
                 break;
         case DP_AUX_I2C_READ:
-                res = dal_ddc_service_read_dpcd_data(
+                read_bytes = dal_ddc_service_read_dpcd_data(
                                 TO_DM_AUX(aux)->ddc_service,
                                 true,
                                 mot,
                                 msg->address,
                                 msg->buffer,
-                                msg->size,
-                                &read_bytes);
-                break;
+                                msg->size);
+                return read_bytes;
         case DP_AUX_I2C_WRITE:
                 res = dal_ddc_service_write_dpcd_data(
                                 TO_DM_AUX(aux)->ddc_service,
@@ -139,9 +137,7 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux,
                  r == DDC_RESULT_SUCESSFULL);
 #endif
 
-        if (res != DDC_RESULT_SUCESSFULL)
-                return -EIO;
-        return read_bytes;
+        return msg->size;
 }
 
 static enum drm_connector_status
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_services.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_services.c
index 5a3346124a01..5a2e952c5bea 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_services.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_services.c
@@ -255,8 +255,9 @@ static void pp_to_dc_clock_levels_with_latency(
                         DC_DECODE_PP_CLOCK_TYPE(dc_clk_type));
 
         for (i = 0; i < clk_level_info->num_levels; i++) {
-                DRM_DEBUG("DM_PPLIB:\t %d\n", pp_clks->data[i].clocks_in_khz);
-                clk_level_info->data[i].clocks_in_khz = pp_clks->data[i].clocks_in_khz;
+                DRM_DEBUG("DM_PPLIB:\t %d in 10kHz\n", pp_clks->data[i].clocks_in_khz);
+                /* translate 10kHz to kHz */
+                clk_level_info->data[i].clocks_in_khz = pp_clks->data[i].clocks_in_khz * 10;
                 clk_level_info->data[i].latency_in_us = pp_clks->data[i].latency_in_us;
         }
 }
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
index ae48d603ebd6..49c2face1e7a 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
@@ -629,14 +629,13 @@ bool dal_ddc_service_query_ddc_data(
         return ret;
 }
 
-enum ddc_result dal_ddc_service_read_dpcd_data(
+ssize_t dal_ddc_service_read_dpcd_data(
         struct ddc_service *ddc,
         bool i2c,
         enum i2c_mot_mode mot,
         uint32_t address,
         uint8_t *data,
-        uint32_t len,
-        uint32_t *read)
+        uint32_t len)
 {
         struct aux_payload read_payload = {
                 .i2c_over_aux = i2c,
@@ -653,8 +652,6 @@ enum ddc_result dal_ddc_service_read_dpcd_data(
                 .mot = mot
         };
 
-        *read = 0;
-
         if (len > DEFAULT_AUX_MAX_DATA_SIZE) {
                 BREAK_TO_DEBUGGER();
                 return DDC_RESULT_FAILED_INVALID_OPERATION;
@@ -664,8 +661,7 @@ enum ddc_result dal_ddc_service_read_dpcd_data(
                 ddc->ctx->i2caux,
                 ddc->ddc_pin,
                 &command)) {
-                *read = command.payloads->length;
-                return DDC_RESULT_SUCESSFULL;
+                return (ssize_t)command.payloads->length;
         }
 
         return DDC_RESULT_FAILED_OPERATION;
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index 7857cb42b3e6..bdd121485cbc 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -1767,12 +1767,10 @@ static void dp_test_send_link_training(struct dc_link *link)
         dp_retrain_link_dp_test(link, &link_settings, false);
 }
 
-/* TODO hbr2 compliance eye output is unstable
+/* TODO Raven hbr2 compliance eye output is unstable
  * (toggling on and off) with debugger break
  * This caueses intermittent PHY automation failure
  * Need to look into the root cause */
-static uint8_t force_tps4_for_cp2520 = 1;
-
 static void dp_test_send_phy_test_pattern(struct dc_link *link)
 {
         union phy_test_pattern dpcd_test_pattern;
@@ -1832,13 +1830,13 @@ static void dp_test_send_phy_test_pattern(struct dc_link *link)
                 break;
         case PHY_TEST_PATTERN_CP2520_1:
                 /* CP2520 pattern is unstable, temporarily use TPS4 instead */
-                test_pattern = (force_tps4_for_cp2520 == 1) ?
+                test_pattern = (link->dc->caps.force_dp_tps4_for_cp2520 == 1) ?
                                 DP_TEST_PATTERN_TRAINING_PATTERN4 :
                                 DP_TEST_PATTERN_HBR2_COMPLIANCE_EYE;
                 break;
         case PHY_TEST_PATTERN_CP2520_2:
                 /* CP2520 pattern is unstable, temporarily use TPS4 instead */
-                test_pattern = (force_tps4_for_cp2520 == 1) ?
+                test_pattern = (link->dc->caps.force_dp_tps4_for_cp2520 == 1) ?
                                 DP_TEST_PATTERN_TRAINING_PATTERN4 :
                                 DP_TEST_PATTERN_HBR2_COMPLIANCE_EYE;
                 break;
diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h
index 9cfde0ccf4e9..53c71296f3dd 100644
--- a/drivers/gpu/drm/amd/display/dc/dc.h
+++ b/drivers/gpu/drm/amd/display/dc/dc.h
@@ -76,6 +76,7 @@ struct dc_caps {
         bool is_apu;
         bool dual_link_dvi;
         bool post_blend_color_processing;
+        bool force_dp_tps4_for_cp2520;
 };
 
 struct dc_dcc_surface_param {
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_mem_input.c b/drivers/gpu/drm/amd/display/dc/dce/dce_mem_input.c
index b235a75355b8..bae752332a9f 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_mem_input.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_mem_input.c
@@ -741,6 +741,29 @@ static struct mem_input_funcs dce_mi_funcs = {
         .mem_input_is_flip_pending = dce_mi_is_flip_pending
 };
 
+static struct mem_input_funcs dce112_mi_funcs = {
+        .mem_input_program_display_marks = dce112_mi_program_display_marks,
+        .allocate_mem_input = dce_mi_allocate_dmif,
+        .free_mem_input = dce_mi_free_dmif,
+        .mem_input_program_surface_flip_and_addr =
+                        dce_mi_program_surface_flip_and_addr,
+        .mem_input_program_pte_vm = dce_mi_program_pte_vm,
+        .mem_input_program_surface_config =
+                        dce_mi_program_surface_config,
+        .mem_input_is_flip_pending = dce_mi_is_flip_pending
+};
+
+static struct mem_input_funcs dce120_mi_funcs = {
+        .mem_input_program_display_marks = dce120_mi_program_display_marks,
+        .allocate_mem_input = dce_mi_allocate_dmif,
+        .free_mem_input = dce_mi_free_dmif,
+        .mem_input_program_surface_flip_and_addr =
+                        dce_mi_program_surface_flip_and_addr,
+        .mem_input_program_pte_vm = dce_mi_program_pte_vm,
+        .mem_input_program_surface_config =
+                        dce_mi_program_surface_config,
+        .mem_input_is_flip_pending = dce_mi_is_flip_pending
+};
 
 void dce_mem_input_construct(
         struct dce_mem_input *dce_mi,
@@ -769,7 +792,7 @@ void dce112_mem_input_construct(
         const struct dce_mem_input_mask *mi_mask)
 {
         dce_mem_input_construct(dce_mi, ctx, inst, regs, mi_shift, mi_mask);
-        dce_mi->base.funcs->mem_input_program_display_marks = dce112_mi_program_display_marks;
+        dce_mi->base.funcs = &dce112_mi_funcs;
 }
 
 void dce120_mem_input_construct(
@@ -781,5 +804,5 @@ void dce120_mem_input_construct(
         const struct dce_mem_input_mask *mi_mask)
 {
         dce_mem_input_construct(dce_mi, ctx, inst, regs, mi_shift, mi_mask);
-        dce_mi->base.funcs->mem_input_program_display_marks = dce120_mi_program_display_marks;
+        dce_mi->base.funcs = &dce120_mi_funcs;
 }
diff --git a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
index 38ec0d609297..344dd2e69e7c 100644
--- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
@@ -678,9 +678,22 @@ bool dce100_validate_bandwidth(
         struct dc  *dc,
         struct dc_state *context)
 {
-        /* TODO implement when needed but for now hardcode max value*/
-        context->bw.dce.dispclk_khz = 681000;
-        context->bw.dce.yclk_khz = 250000 * MEMORY_TYPE_MULTIPLIER;
+        int i;
+        bool at_least_one_pipe = false;
+
+        for (i = 0; i < dc->res_pool->pipe_count; i++) {
+                if (context->res_ctx.pipe_ctx[i].stream)
+                        at_least_one_pipe = true;
+        }
+
+        if (at_least_one_pipe) {
+                /* TODO implement when needed but for now hardcode max value*/
+                context->bw.dce.dispclk_khz = 681000;
+                context->bw.dce.yclk_khz = 250000 * MEMORY_TYPE_MULTIPLIER;
+        } else {
+                context->bw.dce.dispclk_khz = 0;
+                context->bw.dce.yclk_khz = 0;
+        }
 
         return true;
 }
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
index df5cb2d1d164..34dac84066a0 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
@@ -1027,6 +1027,8 @@ static bool construct(
         dc->caps.max_slave_planes = 1;
         dc->caps.is_apu = true;
         dc->caps.post_blend_color_processing = false;
+        /* Raven DP PHY HBR2 eye diagram pattern is not stable. Use TP4 */
+        dc->caps.force_dp_tps4_for_cp2520 = true;
 
         if (dc->ctx->dce_environment == DCE_ENV_PRODUCTION_DRV)
                 dc->debug = debug_defaults_drv;
diff --git a/drivers/gpu/drm/amd/display/dc/inc/dc_link_ddc.h b/drivers/gpu/drm/amd/display/dc/inc/dc_link_ddc.h
index 30b3a08b91be..090b7a8dd67b 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/dc_link_ddc.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/dc_link_ddc.h
@@ -102,14 +102,13 @@ bool dal_ddc_service_query_ddc_data(
                 uint8_t *read_buf,
                 uint32_t read_size);
 
-enum ddc_result dal_ddc_service_read_dpcd_data(
+ssize_t dal_ddc_service_read_dpcd_data(
                 struct ddc_service *ddc,
                 bool i2c,
                 enum i2c_mot_mode mot,
                 uint32_t address,
                 uint8_t *data,
-                uint32_t len,
-                uint32_t *read);
+                uint32_t len);
 
 enum ddc_result dal_ddc_service_write_dpcd_data(
                 struct ddc_service *ddc,
diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/smu7_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/smu7_smumgr.c
index d644a9bb9078..9f407c48d4f0 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/smu7_smumgr.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/smu7_smumgr.c
@@ -381,6 +381,7 @@ int smu7_request_smu_load_fw(struct pp_hwmgr *hwmgr)
         uint32_t fw_to_load;
         int result = 0;
         struct SMU_DRAMData_TOC *toc;
+        uint32_t num_entries = 0;
 
         if (!hwmgr->reload_fw) {
                 pr_info("skip reloading...\n");
@@ -422,41 +423,41 @@ int smu7_request_smu_load_fw(struct pp_hwmgr *hwmgr)
         }
 
         toc = (struct SMU_DRAMData_TOC *)smu_data->header;
-        toc->num_entries = 0;
         toc->structure_version = 1;
 
         PP_ASSERT_WITH_CODE(0 == smu7_populate_single_firmware_entry(hwmgr,
-                                UCODE_ID_RLC_G, &toc->entry[toc->num_entries++]),
+                                UCODE_ID_RLC_G, &toc->entry[num_entries++]),
                                 "Failed to Get Firmware Entry.", return -EINVAL);
         PP_ASSERT_WITH_CODE(0 == smu7_populate_single_firmware_entry(hwmgr,
-                                UCODE_ID_CP_CE, &toc->entry[toc->num_entries++]),
+                                UCODE_ID_CP_CE, &toc->entry[num_entries++]),
                                 "Failed to Get Firmware Entry.", return -EINVAL);
         PP_ASSERT_WITH_CODE(0 == smu7_populate_single_firmware_entry(hwmgr,
-                                UCODE_ID_CP_PFP, &toc->entry[toc->num_entries++]),
+                                UCODE_ID_CP_PFP, &toc->entry[num_entries++]),
                                 "Failed to Get Firmware Entry.", return -EINVAL);
         PP_ASSERT_WITH_CODE(0 == smu7_populate_single_firmware_entry(hwmgr,
-                                UCODE_ID_CP_ME, &toc->entry[toc->num_entries++]),
+                                UCODE_ID_CP_ME, &toc->entry[num_entries++]),
                                 "Failed to Get Firmware Entry.", return -EINVAL);
         PP_ASSERT_WITH_CODE(0 == smu7_populate_single_firmware_entry(hwmgr,
-                                UCODE_ID_CP_MEC, &toc->entry[toc->num_entries++]),
+                                UCODE_ID_CP_MEC, &toc->entry[num_entries++]),
                                 "Failed to Get Firmware Entry.", return -EINVAL);
         PP_ASSERT_WITH_CODE(0 == smu7_populate_single_firmware_entry(hwmgr,
-                                UCODE_ID_CP_MEC_JT1, &toc->entry[toc->num_entries++]),
+                                UCODE_ID_CP_MEC_JT1, &toc->entry[num_entries++]),
                                 "Failed to Get Firmware Entry.", return -EINVAL);
         PP_ASSERT_WITH_CODE(0 == smu7_populate_single_firmware_entry(hwmgr,
-                                UCODE_ID_CP_MEC_JT2, &toc->entry[toc->num_entries++]),
+                                UCODE_ID_CP_MEC_JT2, &toc->entry[num_entries++]),
                                 "Failed to Get Firmware Entry.", return -EINVAL);
         PP_ASSERT_WITH_CODE(0 == smu7_populate_single_firmware_entry(hwmgr,
-                                UCODE_ID_SDMA0, &toc->entry[toc->num_entries++]),
+                                UCODE_ID_SDMA0, &toc->entry[num_entries++]),
                                 "Failed to Get Firmware Entry.", return -EINVAL);
         PP_ASSERT_WITH_CODE(0 == smu7_populate_single_firmware_entry(hwmgr,
-                                UCODE_ID_SDMA1, &toc->entry[toc->num_entries++]),
+                                UCODE_ID_SDMA1, &toc->entry[num_entries++]),
                                 "Failed to Get Firmware Entry.", return -EINVAL);
         if (!hwmgr->not_vf)
                 PP_ASSERT_WITH_CODE(0 == smu7_populate_single_firmware_entry(hwmgr,
-                                UCODE_ID_MEC_STORAGE, &toc->entry[toc->num_entries++]),
+                                UCODE_ID_MEC_STORAGE, &toc->entry[num_entries++]),
                                 "Failed to Get Firmware Entry.", return -EINVAL);
 
+        toc->num_entries = num_entries;
         smu7_send_msg_to_smc_with_parameter(hwmgr, PPSMC_MSG_DRV_DRAM_ADDR_HI, upper_32_bits(smu_data->header_buffer.mc_addr));
         smu7_send_msg_to_smc_with_parameter(hwmgr, PPSMC_MSG_DRV_DRAM_ADDR_LO, lower_32_bits(smu_data->header_buffer.mc_addr));
 
diff --git a/drivers/gpu/drm/armada/armada_crtc.c b/drivers/gpu/drm/armada/armada_crtc.c
index 03eeee11dd5b..42a40daff132 100644
--- a/drivers/gpu/drm/armada/armada_crtc.c
+++ b/drivers/gpu/drm/armada/armada_crtc.c
@@ -519,8 +519,9 @@ static irqreturn_t armada_drm_irq(int irq, void *arg)
         u32 v, stat = readl_relaxed(dcrtc->base + LCD_SPU_IRQ_ISR);
 
         /*
-         * This is rediculous - rather than writing bits to clear, we
-         * have to set the actual status register value.  This is racy.
+         * Reading the ISR appears to clear bits provided CLEAN_SPU_IRQ_ISR
+         * is set.  Writing has some other effect to acknowledge the IRQ -
+         * without this, we only get a single IRQ.
          */
         writel_relaxed(0, dcrtc->base + LCD_SPU_IRQ_ISR);
 
@@ -1116,16 +1117,22 @@ armada_drm_crtc_set_property(struct drm_crtc *crtc,
 static int armada_drm_crtc_enable_vblank(struct drm_crtc *crtc)
 {
         struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc);
+        unsigned long flags;
 
+        spin_lock_irqsave(&dcrtc->irq_lock, flags);
         armada_drm_crtc_enable_irq(dcrtc, VSYNC_IRQ_ENA);
+        spin_unlock_irqrestore(&dcrtc->irq_lock, flags);
         return 0;
 }
 
 static void armada_drm_crtc_disable_vblank(struct drm_crtc *crtc)
 {
         struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc);
+        unsigned long flags;
 
+        spin_lock_irqsave(&dcrtc->irq_lock, flags);
         armada_drm_crtc_disable_irq(dcrtc, VSYNC_IRQ_ENA);
+        spin_unlock_irqrestore(&dcrtc->irq_lock, flags);
 }
 
 static const struct drm_crtc_funcs armada_crtc_funcs = {
@@ -1415,6 +1422,7 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev,
                        CFG_PDWN64x66, dcrtc->base + LCD_SPU_SRAM_PARA1);
         writel_relaxed(0x2032ff81, dcrtc->base + LCD_SPU_DMA_CTRL1);
         writel_relaxed(dcrtc->irq_ena, dcrtc->base + LCD_SPU_IRQ_ENA);
+        readl_relaxed(dcrtc->base + LCD_SPU_IRQ_ISR);
         writel_relaxed(0, dcrtc->base + LCD_SPU_IRQ_ISR);
 
         ret = devm_request_irq(dev, irq, armada_drm_irq, 0, "armada_drm_crtc",
diff --git a/drivers/gpu/drm/armada/armada_hw.h b/drivers/gpu/drm/armada/armada_hw.h
index 27319a8335e2..345dc4d0851e 100644
--- a/drivers/gpu/drm/armada/armada_hw.h
+++ b/drivers/gpu/drm/armada/armada_hw.h
@@ -160,6 +160,7 @@ enum {
         CFG_ALPHAM_GRA          = 0x1 << 16,
         CFG_ALPHAM_CFG          = 0x2 << 16,
         CFG_ALPHA_MASK          = 0xff << 8,
+#define CFG_ALPHA(x)            ((x) << 8)
         CFG_PIXCMD_MASK         = 0xff,
 };
 
diff --git a/drivers/gpu/drm/armada/armada_overlay.c b/drivers/gpu/drm/armada/armada_overlay.c
index c391955009d6..afa7ded3ae31 100644
--- a/drivers/gpu/drm/armada/armada_overlay.c
+++ b/drivers/gpu/drm/armada/armada_overlay.c
@@ -28,6 +28,7 @@ struct armada_ovl_plane_properties {
         uint16_t contrast;
         uint16_t saturation;
         uint32_t colorkey_mode;
+        uint32_t colorkey_enable;
 };
 
 struct armada_ovl_plane {
@@ -54,11 +55,13 @@ armada_ovl_update_attr(struct armada_ovl_plane_properties *prop,
         writel_relaxed(0x00002000, dcrtc->base + LCD_SPU_CBSH_HUE);
 
         spin_lock_irq(&dcrtc->irq_lock);
-        armada_updatel(prop->colorkey_mode | CFG_ALPHAM_GRA,
-                     CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
-                     dcrtc->base + LCD_SPU_DMA_CTRL1);
-
-        armada_updatel(ADV_GRACOLORKEY, 0, dcrtc->base + LCD_SPU_ADV_REG);
+        armada_updatel(prop->colorkey_mode,
+                       CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
+                       dcrtc->base + LCD_SPU_DMA_CTRL1);
+        if (dcrtc->variant->has_spu_adv_reg)
+                armada_updatel(prop->colorkey_enable,
+                               ADV_GRACOLORKEY | ADV_VIDCOLORKEY,
+                               dcrtc->base + LCD_SPU_ADV_REG);
         spin_unlock_irq(&dcrtc->irq_lock);
 }
 
@@ -321,8 +324,17 @@ static int armada_ovl_plane_set_property(struct drm_plane *plane,
                 dplane->prop.colorkey_vb |= K2B(val);
                 update_attr = true;
         } else if (property == priv->colorkey_mode_prop) {
-                dplane->prop.colorkey_mode &= ~CFG_CKMODE_MASK;
-                dplane->prop.colorkey_mode |= CFG_CKMODE(val);
+                if (val == CKMODE_DISABLE) {
+                        dplane->prop.colorkey_mode =
+                                CFG_CKMODE(CKMODE_DISABLE) |
+                                CFG_ALPHAM_CFG | CFG_ALPHA(255);
+                        dplane->prop.colorkey_enable = 0;
+                } else {
+                        dplane->prop.colorkey_mode =
+                                CFG_CKMODE(val) |
+                                CFG_ALPHAM_GRA | CFG_ALPHA(0);
+                        dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
+                }
                 update_attr = true;
         } else if (property == priv->brightness_prop) {
                 dplane->prop.brightness = val - 256;
@@ -453,7 +465,9 @@ int armada_overlay_plane_create(struct drm_device *dev, unsigned long crtcs)
         dplane->prop.colorkey_yr = 0xfefefe00;
         dplane->prop.colorkey_ug = 0x01010100;
         dplane->prop.colorkey_vb = 0x01010100;
-        dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB);
+        dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB) |
+                                     CFG_ALPHAM_GRA | CFG_ALPHA(0);
+        dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
         dplane->prop.brightness = 0;
         dplane->prop.contrast = 0x4000;
         dplane->prop.saturation = 0x4000;
diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
index 73021b388e12..dd3ff2f2cdce 100644
--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
@@ -429,6 +429,18 @@ static void adv7511_hpd_work(struct work_struct *work)
         else
                 status = connector_status_disconnected;
 
+        /*
+         * The bridge resets its registers on unplug. So when we get a plug
+         * event and we're already supposed to be powered, cycle the bridge to
+         * restore its state.
+         */
+        if (status == connector_status_connected &&
+            adv7511->connector.status == connector_status_disconnected &&
+            adv7511->powered) {
+                regcache_mark_dirty(adv7511->regmap);
+                adv7511_power_on(adv7511);
+        }
+
         if (adv7511->connector.status != status) {
                 adv7511->connector.status = status;
                 if (status == connector_status_disconnected)
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 130da5195f3b..81e32199d3ef 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1510,8 +1510,9 @@ int drm_atomic_helper_async_check(struct drm_device *dev,
 {
         struct drm_crtc *crtc;
         struct drm_crtc_state *crtc_state;
-        struct drm_plane *plane;
-        struct drm_plane_state *old_plane_state, *new_plane_state;
+        struct drm_plane *plane = NULL;
+        struct drm_plane_state *old_plane_state = NULL;
+        struct drm_plane_state *new_plane_state = NULL;
         const struct drm_plane_helper_funcs *funcs;
         int i, n_planes = 0;
 
@@ -1527,7 +1528,8 @@ int drm_atomic_helper_async_check(struct drm_device *dev,
         if (n_planes != 1)
                 return -EINVAL;
 
-        if (!new_plane_state->crtc)
+        if (!new_plane_state->crtc ||
+            old_plane_state->crtc != new_plane_state->crtc)
                 return -EINVAL;
 
         funcs = plane->helper_private;
diff --git a/drivers/gpu/drm/drm_context.c b/drivers/gpu/drm/drm_context.c
index 3c4000facb36..f973d287696a 100644
--- a/drivers/gpu/drm/drm_context.c
+++ b/drivers/gpu/drm/drm_context.c
@@ -372,7 +372,7 @@ int drm_legacy_addctx(struct drm_device *dev, void *data,
                 ctx->handle = drm_legacy_ctxbitmap_next(dev);
         }
         DRM_DEBUG("%d\n", ctx->handle);
-        if (ctx->handle == -1) {
+        if (ctx->handle < 0) {
                 DRM_DEBUG("Not enough free contexts.\n");
                 /* Should this return -EBUSY instead? */
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index 50c73c0a20b9..d638c0fb3418 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -553,24 +553,13 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 
         /* Clone the lessor file to create a new file for us */
         DRM_DEBUG_LEASE("Allocating lease file\n");
-        path_get(&lessor_file->f_path);
-        lessee_file = alloc_file(&lessor_file->f_path,
-                                 lessor_file->f_mode,
-                                 fops_get(lessor_file->f_inode->i_fop));
-
+        lessee_file = filp_clone_open(lessor_file);
         if (IS_ERR(lessee_file)) {
                 ret = PTR_ERR(lessee_file);
                 goto out_lessee;
         }
 
-        /* Initialize the new file for DRM */
-        DRM_DEBUG_LEASE("Initializing the file with %p\n", lessee_file->f_op->open);
-        ret = lessee_file->f_op->open(lessee_file->f_inode, lessee_file);
-        if (ret)
-                goto out_lessee_file;
-
         lessee_priv = lessee_file->private_data;
-
         /* Change the file to a master one */
         drm_master_put(&lessee_priv->master);
         lessee_priv->master = lessee;
@@ -588,9 +577,6 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
         DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl succeeded\n");
         return 0;
 
-out_lessee_file:
-        fput(lessee_file);
-
 out_lessee:
         drm_master_put(&lessee);
 
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index b51c05d03f14..7f562410f9cf 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -862,6 +862,7 @@ static int cmd_reg_handler(struct parser_exec_state *s,
 {
         struct intel_vgpu *vgpu = s->vgpu;
         struct intel_gvt *gvt = vgpu->gvt;
+        u32 ctx_sr_ctl;
 
         if (offset + 4 > gvt->device_info.mmio_size) {
                 gvt_vgpu_err("%s access to (%x) outside of MMIO range\n",
@@ -894,6 +895,28 @@ static int cmd_reg_handler(struct parser_exec_state *s,
                 patch_value(s, cmd_ptr(s, index), VGT_PVINFO_PAGE);
         }
 
+        /* TODO
+         * Right now only scan LRI command on KBL and in inhibit context.
+         * It's good enough to support initializing mmio by lri command in
+         * vgpu inhibit context on KBL.
+         */
+        if (IS_KABYLAKE(s->vgpu->gvt->dev_priv) &&
+                        intel_gvt_mmio_is_in_ctx(gvt, offset) &&
+                        !strncmp(cmd, "lri", 3)) {
+                intel_gvt_hypervisor_read_gpa(s->vgpu,
+                        s->workload->ring_context_gpa + 12, &ctx_sr_ctl, 4);
+                /* check inhibit context */
+                if (ctx_sr_ctl & 1) {
+                        u32 data = cmd_val(s, index + 1);
+
+                        if (intel_gvt_mmio_has_mode_mask(s->vgpu->gvt, offset))
+                                intel_vgpu_mask_mmio_write(vgpu,
+                                                        offset, &data, 4);
+                        else
+                                vgpu_vreg(vgpu, offset) = data;
+                }
+        }
+
         /* TODO: Update the global mask if this MMIO is a masked-MMIO */
         intel_gvt_mmio_set_cmd_accessed(gvt, offset);
         return 0;
diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h
index 05d15a095310..858967daf04b 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.h
+++ b/drivers/gpu/drm/i915/gvt/gvt.h
@@ -268,6 +268,8 @@ struct intel_gvt_mmio {
 #define F_CMD_ACCESSED  (1 << 5)
 /* This reg could be accessed by unaligned address */
 #define F_UNALIGN       (1 << 6)
+/* This reg is saved/restored in context */
+#define F_IN_CTX        (1 << 7)
 
         struct gvt_mmio_block *mmio_block;
         unsigned int num_mmio_block;
@@ -639,6 +641,33 @@ static inline bool intel_gvt_mmio_has_mode_mask(
         return gvt->mmio.mmio_attribute[offset >> 2] & F_MODE_MASK;
 }
 
+/**
+ * intel_gvt_mmio_is_in_ctx - check if a MMIO has in-ctx mask
+ * @gvt: a GVT device
+ * @offset: register offset
+ *
+ * Returns:
+ * True if a MMIO has a in-context mask, false if it isn't.
+ *
+ */
+static inline bool intel_gvt_mmio_is_in_ctx(
+                        struct intel_gvt *gvt, unsigned int offset)
+{
+        return gvt->mmio.mmio_attribute[offset >> 2] & F_IN_CTX;
+}
+
+/**
+ * intel_gvt_mmio_set_in_ctx - mask a MMIO in logical context
+ * @gvt: a GVT device
+ * @offset: register offset
+ *
+ */
+static inline void intel_gvt_mmio_set_in_ctx(
+                        struct intel_gvt *gvt, unsigned int offset)
+{
+        gvt->mmio.mmio_attribute[offset >> 2] |= F_IN_CTX;
+}
+
 int intel_gvt_debugfs_add_vgpu(struct intel_vgpu *vgpu);
 void intel_gvt_debugfs_remove_vgpu(struct intel_vgpu *vgpu);
 int intel_gvt_debugfs_init(struct intel_gvt *gvt);
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index bcbc47a88a70..8f1caacdc78a 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -3046,6 +3046,30 @@ int intel_vgpu_default_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
 }
 
 /**
+ * intel_vgpu_mask_mmio_write - write mask register
+ * @vgpu: a vGPU
+ * @offset: access offset
+ * @p_data: write data buffer
+ * @bytes: access data length
+ *
+ * Returns:
+ * Zero on success, negative error code if failed.
+ */
+int intel_vgpu_mask_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
+                void *p_data, unsigned int bytes)
+{
+        u32 mask, old_vreg;
+
+        old_vreg = vgpu_vreg(vgpu, offset);
+        write_vreg(vgpu, offset, p_data, bytes);
+        mask = vgpu_vreg(vgpu, offset) >> 16;
+        vgpu_vreg(vgpu, offset) = (old_vreg & ~mask) |
+                                (vgpu_vreg(vgpu, offset) & mask);
+
+        return 0;
+}
+
+/**
  * intel_gvt_in_force_nonpriv_whitelist - if a mmio is in whitelist to be
  * force-nopriv register
  *
diff --git a/drivers/gpu/drm/i915/gvt/mmio.h b/drivers/gpu/drm/i915/gvt/mmio.h
index 71b620875943..dac8c6401e26 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.h
+++ b/drivers/gpu/drm/i915/gvt/mmio.h
@@ -98,4 +98,6 @@ bool intel_gvt_in_force_nonpriv_whitelist(struct intel_gvt *gvt,
 int intel_vgpu_mmio_reg_rw(struct intel_vgpu *vgpu, unsigned int offset,
                            void *pdata, unsigned int bytes, bool is_read);
 
+int intel_vgpu_mask_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
+                                  void *p_data, unsigned int bytes);
 #endif
diff --git a/drivers/gpu/drm/i915/gvt/mmio_context.c b/drivers/gpu/drm/i915/gvt/mmio_context.c
index 0f949554d118..5ca9caf7552a 100644
--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
+++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
@@ -581,7 +581,9 @@ void intel_gvt_init_engine_mmio_context(struct intel_gvt *gvt)
 
         for (mmio = gvt->engine_mmio_list.mmio;
              i915_mmio_reg_valid(mmio->reg); mmio++) {
-                if (mmio->in_context)
+                if (mmio->in_context) {
                         gvt->engine_mmio_list.ctx_mmio_count[mmio->ring_id]++;
+                        intel_gvt_mmio_set_in_ctx(gvt, mmio->reg.reg);
+                }
         }
 }
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 52f3b91d14fd..71e1aa54f774 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -652,6 +652,7 @@ enum intel_sbi_destination {
 #define QUIRK_BACKLIGHT_PRESENT (1<<3)
 #define QUIRK_PIN_SWIZZLED_PAGES (1<<5)
 #define QUIRK_INCREASE_T12_DELAY (1<<6)
+#define QUIRK_INCREASE_DDI_DISABLED_TIME (1<<7)
 
 struct intel_fbdev;
 struct intel_fbc_work;
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 4a02747ac658..c16cb025755e 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1998,10 +1998,38 @@ static void valleyview_pipestat_irq_handler(struct drm_i915_private *dev_priv,
 
 static u32 i9xx_hpd_irq_ack(struct drm_i915_private *dev_priv)
 {
-        u32 hotplug_status = I915_READ(PORT_HOTPLUG_STAT);
+        u32 hotplug_status = 0, hotplug_status_mask;
+        int i;
+
+        if (IS_G4X(dev_priv) ||
+            IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv))
+                hotplug_status_mask = HOTPLUG_INT_STATUS_G4X |
+                        DP_AUX_CHANNEL_MASK_INT_STATUS_G4X;
+        else
+                hotplug_status_mask = HOTPLUG_INT_STATUS_I915;
 
-        if (hotplug_status)
+        /*
+         * We absolutely have to clear all the pending interrupt
+         * bits in PORT_HOTPLUG_STAT. Otherwise the ISR port
+         * interrupt bit won't have an edge, and the i965/g4x
+         * edge triggered IIR will not notice that an interrupt
+         * is still pending. We can't use PORT_HOTPLUG_EN to
+         * guarantee the edge as the act of toggling the enable
+         * bits can itself generate a new hotplug interrupt :(
+         */
+        for (i = 0; i < 10; i++) {
+                u32 tmp = I915_READ(PORT_HOTPLUG_STAT) & hotplug_status_mask;
+
+                if (tmp == 0)
+                        return hotplug_status;
+
+                hotplug_status |= tmp;
                 I915_WRITE(PORT_HOTPLUG_STAT, hotplug_status);
+        }
+
+        WARN_ONCE(1,
+                  "PORT_HOTPLUG_STAT did not clear (0x%08x)\n",
+                  I915_READ(PORT_HOTPLUG_STAT));
 
         return hotplug_status;
 }
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index f4a8598a2d39..fed26d6e4e27 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1782,15 +1782,24 @@ void intel_ddi_enable_transcoder_func(const struct intel_crtc_state *crtc_state)
         I915_WRITE(TRANS_DDI_FUNC_CTL(cpu_transcoder), temp);
 }
 
-void intel_ddi_disable_transcoder_func(struct drm_i915_private *dev_priv,
-                                       enum transcoder cpu_transcoder)
+void intel_ddi_disable_transcoder_func(const struct intel_crtc_state *crtc_state)
 {
+        struct intel_crtc *crtc = to_intel_crtc(crtc_state->base.crtc);
+        struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
+        enum transcoder cpu_transcoder = crtc_state->cpu_transcoder;
         i915_reg_t reg = TRANS_DDI_FUNC_CTL(cpu_transcoder);
         uint32_t val = I915_READ(reg);
 
         val &= ~(TRANS_DDI_FUNC_ENABLE | TRANS_DDI_PORT_MASK | TRANS_DDI_DP_VC_PAYLOAD_ALLOC);
         val |= TRANS_DDI_PORT_NONE;
         I915_WRITE(reg, val);
+
+        if (dev_priv->quirks & QUIRK_INCREASE_DDI_DISABLED_TIME &&
+            intel_crtc_has_type(crtc_state, INTEL_OUTPUT_HDMI)) {
+                DRM_DEBUG_KMS("Quirk Increase DDI disabled time\n");
+                /* Quirk time at 100ms for reliable operation */
+                msleep(100);
+        }
 }
 
 int intel_ddi_toggle_hdcp_signalling(struct intel_encoder *intel_encoder,
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 2cc6faa1daa8..dec0d60921bf 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -5809,7 +5809,7 @@ static void haswell_crtc_disable(struct intel_crtc_state *old_crtc_state,
                 intel_ddi_set_vc_payload_alloc(intel_crtc->config, false);
 
         if (!transcoder_is_dsi(cpu_transcoder))
-                intel_ddi_disable_transcoder_func(dev_priv, cpu_transcoder);
+                intel_ddi_disable_transcoder_func(old_crtc_state);
 
         if (INTEL_GEN(dev_priv) >= 9)
                 skylake_scaler_disable(intel_crtc);
@@ -14646,6 +14646,18 @@ static void quirk_increase_t12_delay(struct drm_device *dev)
         DRM_INFO("Applying T12 delay quirk\n");
 }
 
+/*
+ * GeminiLake NUC HDMI outputs require additional off time
+ * this allows the onboard retimer to correctly sync to signal
+ */
+static void quirk_increase_ddi_disabled_time(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = to_i915(dev);
+
+        dev_priv->quirks |= QUIRK_INCREASE_DDI_DISABLED_TIME;
+        DRM_INFO("Applying Increase DDI Disabled quirk\n");
+}
+
 struct intel_quirk {
         int device;
         int subsystem_vendor;
@@ -14732,6 +14744,13 @@ static struct intel_quirk intel_quirks[] = {
 
         /* Toshiba Satellite P50-C-18C */
         { 0x191B, 0x1179, 0xF840, quirk_increase_t12_delay },
+
+        /* GeminiLake NUC */
+        { 0x3185, 0x8086, 0x2072, quirk_increase_ddi_disabled_time },
+        { 0x3184, 0x8086, 0x2072, quirk_increase_ddi_disabled_time },
+        /* ASRock ITX*/
+        { 0x3185, 0x1849, 0x2212, quirk_increase_ddi_disabled_time },
+        { 0x3184, 0x1849, 0x2212, quirk_increase_ddi_disabled_time },
 };
 
 static void intel_init_quirks(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 0361130500a6..b8eefbffc77d 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -1388,8 +1388,7 @@ void hsw_fdi_link_train(struct intel_crtc *crtc,
 void intel_ddi_init(struct drm_i915_private *dev_priv, enum port port);
 bool intel_ddi_get_hw_state(struct intel_encoder *encoder, enum pipe *pipe);
 void intel_ddi_enable_transcoder_func(const struct intel_crtc_state *crtc_state);
-void intel_ddi_disable_transcoder_func(struct drm_i915_private *dev_priv,
-                                       enum transcoder cpu_transcoder);
+void intel_ddi_disable_transcoder_func(const struct intel_crtc_state *crtc_state);
 void intel_ddi_enable_pipe_clock(const struct intel_crtc_state *crtc_state);
 void intel_ddi_disable_pipe_clock(const  struct intel_crtc_state *crtc_state);
 struct intel_encoder *
diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index 56dd7a9a8e25..dd5312b02a8d 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -612,6 +612,9 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 return PTR_ERR(imx_ldb->regmap);
         }
 
+        /* disable LDB by resetting the control register to POR default */
+        regmap_write(imx_ldb->regmap, IOMUXC_GPR2, 0);
+
         imx_ldb->dev = dev;
 
         if (of_id)
@@ -652,14 +655,14 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 if (ret || i < 0 || i > 1)
                         return -EINVAL;
 
+                if (!of_device_is_available(child))
+                        continue;
+
                 if (dual && i > 0) {
                         dev_warn(dev, "dual-channel mode, ignoring second output\n");
                         continue;
                 }
 
-                if (!of_device_is_available(child))
-                        continue;
-
                 channel = &imx_ldb->channel[i];
                 channel->ldb = imx_ldb;
                 channel->chno = i;
diff --git a/drivers/gpu/drm/nouveau/dispnv04/disp.c b/drivers/gpu/drm/nouveau/dispnv04/disp.c
index 501d2d290e9c..70dce544984e 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/disp.c
@@ -55,6 +55,9 @@ nv04_display_create(struct drm_device *dev)
         nouveau_display(dev)->init = nv04_display_init;
         nouveau_display(dev)->fini = nv04_display_fini;
 
+        /* Pre-nv50 doesn't support atomic, so don't expose the ioctls */
+        dev->driver->driver_features &= ~DRIVER_ATOMIC;
+
         nouveau_hw_save_vga_fonts(dev, 1);
 
         nv04_crtc_create(dev, 0);
diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
index b83465ae7c1b..9bae4db84cfb 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -1585,8 +1585,9 @@ nv50_pior_create(struct drm_connector *connector, struct dcb_output *dcbe)
  *****************************************************************************/
 
 static void
-nv50_disp_atomic_commit_core(struct nouveau_drm *drm, u32 *interlock)
+nv50_disp_atomic_commit_core(struct drm_atomic_state *state, u32 *interlock)
 {
+        struct nouveau_drm *drm = nouveau_drm(state->dev);
         struct nv50_disp *disp = nv50_disp(drm->dev);
         struct nv50_core *core = disp->core;
         struct nv50_mstm *mstm;
@@ -1618,6 +1619,22 @@ nv50_disp_atomic_commit_core(struct nouveau_drm *drm, u32 *interlock)
 }
 
 static void
+nv50_disp_atomic_commit_wndw(struct drm_atomic_state *state, u32 *interlock)
+{
+        struct drm_plane_state *new_plane_state;
+        struct drm_plane *plane;
+        int i;
+
+        for_each_new_plane_in_state(state, plane, new_plane_state, i) {
+                struct nv50_wndw *wndw = nv50_wndw(plane);
+                if (interlock[wndw->interlock.type] & wndw->interlock.data) {
+                        if (wndw->func->update)
+                                wndw->func->update(wndw, interlock);
+                }
+        }
+}
+
+static void
 nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
 {
         struct drm_device *dev = state->dev;
@@ -1684,7 +1701,8 @@ nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
                         help->disable(encoder);
                         interlock[NV50_DISP_INTERLOCK_CORE] |= 1;
                         if (outp->flush_disable) {
-                                nv50_disp_atomic_commit_core(drm, interlock);
+                                nv50_disp_atomic_commit_wndw(state, interlock);
+                                nv50_disp_atomic_commit_core(state, interlock);
                                 memset(interlock, 0x00, sizeof(interlock));
                         }
                 }
@@ -1693,15 +1711,8 @@ nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
         /* Flush disable. */
         if (interlock[NV50_DISP_INTERLOCK_CORE]) {
                 if (atom->flush_disable) {
-                        for_each_new_plane_in_state(state, plane, new_plane_state, i) {
-                                struct nv50_wndw *wndw = nv50_wndw(plane);
-                                if (interlock[wndw->interlock.type] & wndw->interlock.data) {
-                                        if (wndw->func->update)
-                                                wndw->func->update(wndw, interlock);
-                                }
-                        }
-
-                        nv50_disp_atomic_commit_core(drm, interlock);
+                        nv50_disp_atomic_commit_wndw(state, interlock);
+                        nv50_disp_atomic_commit_core(state, interlock);
                         memset(interlock, 0x00, sizeof(interlock));
                 }
         }
@@ -1762,18 +1773,14 @@ nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
         }
 
         /* Flush update. */
-        for_each_new_plane_in_state(state, plane, new_plane_state, i) {
-                struct nv50_wndw *wndw = nv50_wndw(plane);
-                if (interlock[wndw->interlock.type] & wndw->interlock.data) {
-                        if (wndw->func->update)
-                                wndw->func->update(wndw, interlock);
-                }
-        }
+        nv50_disp_atomic_commit_wndw(state, interlock);
 
         if (interlock[NV50_DISP_INTERLOCK_CORE]) {
                 if (interlock[NV50_DISP_INTERLOCK_BASE] ||
+                    interlock[NV50_DISP_INTERLOCK_OVLY] ||
+                    interlock[NV50_DISP_INTERLOCK_WNDW] ||
                     !atom->state.legacy_cursor_update)
-                        nv50_disp_atomic_commit_core(drm, interlock);
+                        nv50_disp_atomic_commit_core(state, interlock);
                 else
                         disp->core->func->update(disp->core, interlock, false);
         }
@@ -1871,7 +1878,7 @@ nv50_disp_atomic_commit(struct drm_device *dev,
                 nv50_disp_atomic_commit_tail(state);
 
         drm_for_each_crtc(crtc, dev) {
-                if (crtc->state->enable) {
+                if (crtc->state->active) {
                         if (!drm->have_disp_power_ref) {
                                 drm->have_disp_power_ref = true;
                                 return 0;
@@ -2119,10 +2126,6 @@ nv50_display_destroy(struct drm_device *dev)
         kfree(disp);
 }
 
-MODULE_PARM_DESC(atomic, "Expose atomic ioctl (default: disabled)");
-static int nouveau_atomic = 0;
-module_param_named(atomic, nouveau_atomic, int, 0400);
-
 int
 nv50_display_create(struct drm_device *dev)
 {
@@ -2147,8 +2150,6 @@ nv50_display_create(struct drm_device *dev)
         disp->disp = &nouveau_display(dev)->disp;
         dev->mode_config.funcs = &nv50_disp_func;
         dev->driver->driver_features |= DRIVER_PREFER_XBGR_30BPP;
-        if (nouveau_atomic)
-                dev->driver->driver_features |= DRIVER_ATOMIC;
 
         /* small shared memory area we use for notifiers and semaphores */
         ret = nouveau_bo_new(&drm->client, 4096, 0x1000, TTM_PL_FLAG_VRAM,
diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c
index debbbf0fd4bd..408b955e5c39 100644
--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c
+++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c
@@ -267,6 +267,7 @@ nouveau_backlight_init(struct drm_device *dev)
         struct nouveau_drm *drm = nouveau_drm(dev);
         struct nvif_device *device = &drm->client.device;
         struct drm_connector *connector;
+        struct drm_connector_list_iter conn_iter;
 
         INIT_LIST_HEAD(&drm->bl_connectors);
 
@@ -275,7 +276,8 @@ nouveau_backlight_init(struct drm_device *dev)
                 return 0;
         }
 
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+        drm_connector_list_iter_begin(dev, &conn_iter);
+        drm_for_each_connector_iter(connector, &conn_iter) {
                 if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS &&
                     connector->connector_type != DRM_MODE_CONNECTOR_eDP)
                         continue;
@@ -292,7 +294,7 @@ nouveau_backlight_init(struct drm_device *dev)
                         break;
                 }
         }
-
+        drm_connector_list_iter_end(&conn_iter);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 7b557c354307..af68eae4c626 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -1208,14 +1208,19 @@ nouveau_connector_create(struct drm_device *dev, int index)
         struct nouveau_display *disp = nouveau_display(dev);
         struct nouveau_connector *nv_connector = NULL;
         struct drm_connector *connector;
+        struct drm_connector_list_iter conn_iter;
         int type, ret = 0;
         bool dummy;
 
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+        drm_connector_list_iter_begin(dev, &conn_iter);
+        nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
                 nv_connector = nouveau_connector(connector);
-                if (nv_connector->index == index)
+                if (nv_connector->index == index) {
+                        drm_connector_list_iter_end(&conn_iter);
                         return connector;
+                }
         }
+        drm_connector_list_iter_end(&conn_iter);
 
         nv_connector = kzalloc(sizeof(*nv_connector), GFP_KERNEL);
         if (!nv_connector)
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.h b/drivers/gpu/drm/nouveau/nouveau_connector.h
index a4d1a059bd3d..dc7454e7f19a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.h
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.h
@@ -33,6 +33,7 @@
 #include <drm/drm_encoder.h>
 #include <drm/drm_dp_helper.h>
 #include "nouveau_crtc.h"
+#include "nouveau_encoder.h"
 
 struct nvkm_i2c_port;
 
@@ -60,19 +61,46 @@ static inline struct nouveau_connector *nouveau_connector(
         return container_of(con, struct nouveau_connector, base);
 }
 
+static inline bool
+nouveau_connector_is_mst(struct drm_connector *connector)
+{
+        const struct nouveau_encoder *nv_encoder;
+        const struct drm_encoder *encoder;
+
+        if (connector->connector_type != DRM_MODE_CONNECTOR_DisplayPort)
+                return false;
+
+        nv_encoder = find_encoder(connector, DCB_OUTPUT_ANY);
+        if (!nv_encoder)
+                return false;
+
+        encoder = &nv_encoder->base.base;
+        return encoder->encoder_type == DRM_MODE_ENCODER_DPMST;
+}
+
+#define nouveau_for_each_non_mst_connector_iter(connector, iter) \
+        drm_for_each_connector_iter(connector, iter) \
+                for_each_if(!nouveau_connector_is_mst(connector))
+
 static inline struct nouveau_connector *
 nouveau_crtc_connector_get(struct nouveau_crtc *nv_crtc)
 {
         struct drm_device *dev = nv_crtc->base.dev;
         struct drm_connector *connector;
+        struct drm_connector_list_iter conn_iter;
+        struct nouveau_connector *nv_connector = NULL;
         struct drm_crtc *crtc = to_drm_crtc(nv_crtc);
 
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                if (connector->encoder && connector->encoder->crtc == crtc)
-                        return nouveau_connector(connector);
+        drm_connector_list_iter_begin(dev, &conn_iter);
+        nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
+                if (connector->encoder && connector->encoder->crtc == crtc) {
+                        nv_connector = nouveau_connector(connector);
+                        break;
+                }
         }
+        drm_connector_list_iter_end(&conn_iter);
 
-        return NULL;
+        return nv_connector;
 }
 
 struct drm_connector *
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 774b429142bc..ec7861457b84 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -404,6 +404,7 @@ nouveau_display_init(struct drm_device *dev)
         struct nouveau_display *disp = nouveau_display(dev);
         struct nouveau_drm *drm = nouveau_drm(dev);
         struct drm_connector *connector;
+        struct drm_connector_list_iter conn_iter;
         int ret;
 
         ret = disp->init(dev);
@@ -411,10 +412,12 @@ nouveau_display_init(struct drm_device *dev)
                 return ret;
 
         /* enable hotplug interrupts */
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+        drm_connector_list_iter_begin(dev, &conn_iter);
+        nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
                 struct nouveau_connector *conn = nouveau_connector(connector);
                 nvif_notify_get(&conn->hpd);
         }
+        drm_connector_list_iter_end(&conn_iter);
 
         /* enable flip completion events */
         nvif_notify_get(&drm->flip);
@@ -427,6 +430,7 @@ nouveau_display_fini(struct drm_device *dev, bool suspend)
         struct nouveau_display *disp = nouveau_display(dev);
         struct nouveau_drm *drm = nouveau_drm(dev);
         struct drm_connector *connector;
+        struct drm_connector_list_iter conn_iter;
 
         if (!suspend) {
                 if (drm_drv_uses_atomic_modeset(dev))
@@ -439,10 +443,12 @@ nouveau_display_fini(struct drm_device *dev, bool suspend)
         nvif_notify_put(&drm->flip);
 
         /* disable hotplug interrupts */
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+        drm_connector_list_iter_begin(dev, &conn_iter);
+        nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
                 struct nouveau_connector *conn = nouveau_connector(connector);
                 nvif_notify_put(&conn->hpd);
         }
+        drm_connector_list_iter_end(&conn_iter);
 
         drm_kms_helper_poll_disable(dev);
         disp->fini(dev);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 775443c9af94..f5d3158f0378 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -81,6 +81,10 @@ MODULE_PARM_DESC(modeset, "enable driver (default: auto, "
 int nouveau_modeset = -1;
 module_param_named(modeset, nouveau_modeset, int, 0400);
 
+MODULE_PARM_DESC(atomic, "Expose atomic ioctl (default: disabled)");
+static int nouveau_atomic = 0;
+module_param_named(atomic, nouveau_atomic, int, 0400);
+
 MODULE_PARM_DESC(runpm, "disable (0), force enable (1), optimus only default (-1)");
 static int nouveau_runtime_pm = -1;
 module_param_named(runpm, nouveau_runtime_pm, int, 0400);
@@ -509,6 +513,9 @@ static int nouveau_drm_probe(struct pci_dev *pdev,
 
         pci_set_master(pdev);
 
+        if (nouveau_atomic)
+                driver_pci.driver_features |= DRIVER_ATOMIC;
+
         ret = drm_get_pci_dev(pdev, pent, &driver_pci);
         if (ret) {
                 nvkm_device_del(&device);
@@ -874,22 +881,11 @@ nouveau_pmops_runtime_resume(struct device *dev)
 static int
 nouveau_pmops_runtime_idle(struct device *dev)
 {
-        struct pci_dev *pdev = to_pci_dev(dev);
-        struct drm_device *drm_dev = pci_get_drvdata(pdev);
-        struct nouveau_drm *drm = nouveau_drm(drm_dev);
-        struct drm_crtc *crtc;
-
         if (!nouveau_pmops_runtime()) {
                 pm_runtime_forbid(dev);
                 return -EBUSY;
         }
 
-        list_for_each_entry(crtc, &drm->dev->mode_config.crtc_list, head) {
-                if (crtc->enabled) {
-                        DRM_DEBUG_DRIVER("failing to power off - crtc active\n");
-                        return -EBUSY;
-                }
-        }
         pm_runtime_mark_last_busy(dev);
         pm_runtime_autosuspend(dev);
         /* we don't want the main rpm_idle to call suspend - we want to autosuspend */
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index 300daee74209..e6ccafcb9c41 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -616,7 +616,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli,
                 struct nouveau_bo *nvbo;
                 uint32_t data;
 
-                if (unlikely(r->bo_index > req->nr_buffers)) {
+                if (unlikely(r->bo_index >= req->nr_buffers)) {
                         NV_PRINTK(err, cli, "reloc bo index invalid\n");
                         ret = -EINVAL;
                         break;
@@ -626,7 +626,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli,
                 if (b->presumed.valid)
                         continue;
 
-                if (unlikely(r->reloc_bo_index > req->nr_buffers)) {
+                if (unlikely(r->reloc_bo_index >= req->nr_buffers)) {
                         NV_PRINTK(err, cli, "reloc container bo index invalid\n");
                         ret = -EINVAL;
                         break;
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c
index 73b5d46104bd..434d2fc5bb1c 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c
@@ -140,6 +140,9 @@ nvkm_fb_init(struct nvkm_subdev *subdev)
         if (fb->func->init)
                 fb->func->init(fb);
 
+        if (fb->func->init_remapper)
+                fb->func->init_remapper(fb);
+
         if (fb->func->init_page) {
                 ret = fb->func->init_page(fb);
                 if (WARN_ON(ret))
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gp100.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gp100.c
index dffe1f5e1071..8205ce436b3e 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gp100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gp100.c
@@ -37,6 +37,14 @@ gp100_fb_init_unkn(struct nvkm_fb *base)
 }
 
 void
+gp100_fb_init_remapper(struct nvkm_fb *fb)
+{
+        struct nvkm_device *device = fb->subdev.device;
+        /* Disable address remapper. */
+        nvkm_mask(device, 0x100c14, 0x00040000, 0x00000000);
+}
+
+void
 gp100_fb_init(struct nvkm_fb *base)
 {
         struct gf100_fb *fb = gf100_fb(base);
@@ -56,6 +64,7 @@ gp100_fb = {
         .dtor = gf100_fb_dtor,
         .oneinit = gf100_fb_oneinit,
         .init = gp100_fb_init,
+        .init_remapper = gp100_fb_init_remapper,
         .init_page = gm200_fb_init_page,
         .init_unkn = gp100_fb_init_unkn,
         .ram_new = gp100_ram_new,
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gp102.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gp102.c
index b84b9861ef26..b4d74e815674 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gp102.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gp102.c
@@ -31,6 +31,7 @@ gp102_fb = {
         .dtor = gf100_fb_dtor,
         .oneinit = gf100_fb_oneinit,
         .init = gp100_fb_init,
+        .init_remapper = gp100_fb_init_remapper,
         .init_page = gm200_fb_init_page,
         .ram_new = gp100_ram_new,
 };
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/priv.h b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/priv.h
index 2857f31466bf..1e4ad61c19e1 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/priv.h
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/priv.h
@@ -11,6 +11,7 @@ struct nvkm_fb_func {
         u32 (*tags)(struct nvkm_fb *);
         int (*oneinit)(struct nvkm_fb *);
         void (*init)(struct nvkm_fb *);
+        void (*init_remapper)(struct nvkm_fb *);
         int (*init_page)(struct nvkm_fb *);
         void (*init_unkn)(struct nvkm_fb *);
         void (*intr)(struct nvkm_fb *);
@@ -69,5 +70,6 @@ int gf100_fb_init_page(struct nvkm_fb *);
 
 int gm200_fb_init_page(struct nvkm_fb *);
 
+void gp100_fb_init_remapper(struct nvkm_fb *);
 void gp100_fb_init_unkn(struct nvkm_fb *);
 #endif
diff --git a/drivers/gpu/drm/sun4i/Makefile b/drivers/gpu/drm/sun4i/Makefile
index 2589f4acd5ae..9c81301d0eed 100644
--- a/drivers/gpu/drm/sun4i/Makefile
+++ b/drivers/gpu/drm/sun4i/Makefile
@@ -32,7 +32,10 @@ obj-$(CONFIG_DRM_SUN4I)		+= sun4i-tcon.o
 obj-$(CONFIG_DRM_SUN4I)         += sun4i_tv.o
 obj-$(CONFIG_DRM_SUN4I)         += sun6i_drc.o
 
-obj-$(CONFIG_DRM_SUN4I_BACKEND) += sun4i-backend.o sun4i-frontend.o
+obj-$(CONFIG_DRM_SUN4I_BACKEND) += sun4i-backend.o
+ifdef CONFIG_DRM_SUN4I_BACKEND
+obj-$(CONFIG_DRM_SUN4I)         += sun4i-frontend.o
+endif
 obj-$(CONFIG_DRM_SUN4I_HDMI)    += sun4i-drm-hdmi.o
 obj-$(CONFIG_DRM_SUN6I_DSI)     += sun6i-dsi.o
 obj-$(CONFIG_DRM_SUN8I_DW_HDMI) += sun8i-drm-hdmi.o
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index 776c1513e582..a2bd5876c633 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -398,7 +398,7 @@ int tegra_drm_submit(struct tegra_drm_context *context,
                  * unaligned offset is malformed and cause commands stream
                  * corruption on the buffer address relocation.
                  */
-                if (offset & 3 || offset >= obj->gem.size) {
+                if (offset & 3 || offset > obj->gem.size) {
                         err = -EINVAL;
                         goto fail;
                 }
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 1d34619eb3fe..a951ec75d01f 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -320,6 +320,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
                         vc4_state->x_scaling[0] = VC4_SCALING_TPZ;
                 if (vc4_state->y_scaling[0] == VC4_SCALING_NONE)
                         vc4_state->y_scaling[0] = VC4_SCALING_TPZ;
+        } else {
+                vc4_state->x_scaling[1] = VC4_SCALING_NONE;
+                vc4_state->y_scaling[1] = VC4_SCALING_NONE;
         }
 
         vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE &&
diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c
index f1d5f76e9c33..d88073e7d22d 100644
--- a/drivers/gpu/host1x/dev.c
+++ b/drivers/gpu/host1x/dev.c
@@ -218,6 +218,9 @@ static int host1x_probe(struct platform_device *pdev)
                 return err;
         }
 
+        if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL))
+                goto skip_iommu;
+
         host->group = iommu_group_get(&pdev->dev);
         if (host->group) {
                 struct iommu_domain_geometry *geometry;
diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c
index e2f4a4d93d20..527a1cddb14f 100644
--- a/drivers/gpu/host1x/job.c
+++ b/drivers/gpu/host1x/job.c
@@ -569,7 +569,8 @@ void host1x_job_unpin(struct host1x_job *job)
         for (i = 0; i < job->num_unpins; i++) {
                 struct host1x_job_unpin_data *unpin = &job->unpins[i];
 
-                if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && host->domain) {
+                if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) &&
+                    unpin->size && host->domain) {
                         iommu_unmap(host->domain, job->addr_phys[i],
                                     unpin->size);
                         free_iova(&host->iova,
diff --git a/drivers/gpu/ipu-v3/ipu-csi.c b/drivers/gpu/ipu-v3/ipu-csi.c
index caa05b0702e1..5450a2db1219 100644
--- a/drivers/gpu/ipu-v3/ipu-csi.c
+++ b/drivers/gpu/ipu-v3/ipu-csi.c
@@ -339,7 +339,8 @@ static void fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg,
                 break;
         case V4L2_MBUS_BT656:
                 csicfg->ext_vsync = 0;
-                if (V4L2_FIELD_HAS_BOTH(mbus_fmt->field))
+                if (V4L2_FIELD_HAS_BOTH(mbus_fmt->field) ||
+                    mbus_fmt->field == V4L2_FIELD_ALTERNATE)
                         csicfg->clk_mode = IPU_CSI_CLK_MODE_CCIR656_INTERLACED;
                 else
                         csicfg->clk_mode = IPU_CSI_CLK_MODE_CCIR656_PROGRESSIVE;
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index 75d6ab177055..7379043711df 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -237,12 +237,16 @@ static void i2c_davinci_calc_clk_dividers(struct davinci_i2c_dev *dev)
         /*
          * It's not always possible to have 1 to 2 ratio when d=7, so fall back
          * to minimal possible clkh in this case.
+         *
+         * Note:
+         * CLKH is not allowed to be 0, in this case I2C clock is not generated
+         * at all
          */
-        if (clk >= clkl + d) {
+        if (clk > clkl + d) {
                 clkh = clk - clkl - d;
                 clkl -= d;
         } else {
-                clkh = 0;
+                clkh = 1;
                 clkl = clk - (d << 1);
         }
 
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 0207e194f84b..498c5e891649 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -368,6 +368,7 @@ static int i2c_imx_dma_xfer(struct imx_i2c_struct *i2c_imx,
                 goto err_desc;
         }
 
+        reinit_completion(&dma->cmd_complete);
         txdesc->callback = i2c_imx_dma_callback;
         txdesc->callback_param = i2c_imx;
         if (dma_submit_error(dmaengine_submit(txdesc))) {
@@ -622,7 +623,6 @@ static int i2c_imx_dma_write(struct imx_i2c_struct *i2c_imx,
          * The first byte must be transmitted by the CPU.
          */
         imx_i2c_write_reg(i2c_8bit_addr_from_msg(msgs), i2c_imx, IMX_I2C_I2DR);
-        reinit_completion(&i2c_imx->dma->cmd_complete);
         time_left = wait_for_completion_timeout(
                                 &i2c_imx->dma->cmd_complete,
                                 msecs_to_jiffies(DMA_TIMEOUT));
@@ -681,7 +681,6 @@ static int i2c_imx_dma_read(struct imx_i2c_struct *i2c_imx,
         if (result)
                 return result;
 
-        reinit_completion(&i2c_imx->dma->cmd_complete);
         time_left = wait_for_completion_timeout(
                                 &i2c_imx->dma->cmd_complete,
                                 msecs_to_jiffies(DMA_TIMEOUT));
@@ -1010,7 +1009,7 @@ static int i2c_imx_init_recovery_info(struct imx_i2c_struct *i2c_imx,
         i2c_imx->pinctrl_pins_gpio = pinctrl_lookup_state(i2c_imx->pinctrl,
                         "gpio");
         rinfo->sda_gpiod = devm_gpiod_get(&pdev->dev, "sda", GPIOD_IN);
-        rinfo->scl_gpiod = devm_gpiod_get(&pdev->dev, "scl", GPIOD_OUT_HIGH);
+        rinfo->scl_gpiod = devm_gpiod_get(&pdev->dev, "scl", GPIOD_OUT_HIGH_OPEN_DRAIN);
 
         if (PTR_ERR(rinfo->sda_gpiod) == -EPROBE_DEFER ||
             PTR_ERR(rinfo->scl_gpiod) == -EPROBE_DEFER) {
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index 5e310efd9446..3c1c817f6968 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -32,6 +32,7 @@
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
+#include <linux/reset.h>
 #include <linux/slab.h>
 
 /* register offsets */
@@ -111,8 +112,9 @@
 #define ID_ARBLOST      (1 << 3)
 #define ID_NACK         (1 << 4)
 /* persistent flags */
+#define ID_P_NO_RXDMA   (1 << 30) /* HW forbids RXDMA sometimes */
 #define ID_P_PM_BLOCKED (1 << 31)
-#define ID_P_MASK       ID_P_PM_BLOCKED
+#define ID_P_MASK       (ID_P_PM_BLOCKED | ID_P_NO_RXDMA)
 
 enum rcar_i2c_type {
         I2C_RCAR_GEN1,
@@ -141,6 +143,8 @@ struct rcar_i2c_priv {
         struct dma_chan *dma_rx;
         struct scatterlist sg;
         enum dma_data_direction dma_direction;
+
+        struct reset_control *rstc;
 };
 
 #define rcar_i2c_priv_to_dev(p)         ((p)->adap.dev.parent)
@@ -370,6 +374,11 @@ static void rcar_i2c_dma_unmap(struct rcar_i2c_priv *priv)
         dma_unmap_single(chan->device->dev, sg_dma_address(&priv->sg),
                          sg_dma_len(&priv->sg), priv->dma_direction);
 
+        /* Gen3 can only do one RXDMA per transfer and we just completed it */
+        if (priv->devtype == I2C_RCAR_GEN3 &&
+            priv->dma_direction == DMA_FROM_DEVICE)
+                priv->flags |= ID_P_NO_RXDMA;
+
         priv->dma_direction = DMA_NONE;
 }
 
@@ -407,8 +416,9 @@ static void rcar_i2c_dma(struct rcar_i2c_priv *priv)
         unsigned char *buf;
         int len;
 
-        /* Do not use DMA if it's not available or for messages < 8 bytes */
-        if (IS_ERR(chan) || msg->len < 8 || !(msg->flags & I2C_M_DMA_SAFE))
+        /* Do various checks to see if DMA is feasible at all */
+        if (IS_ERR(chan) || msg->len < 8 || !(msg->flags & I2C_M_DMA_SAFE) ||
+            (read && priv->flags & ID_P_NO_RXDMA))
                 return;
 
         if (read) {
@@ -739,6 +749,25 @@ static void rcar_i2c_release_dma(struct rcar_i2c_priv *priv)
         }
 }
 
+/* I2C is a special case, we need to poll the status of a reset */
+static int rcar_i2c_do_reset(struct rcar_i2c_priv *priv)
+{
+        int i, ret;
+
+        ret = reset_control_reset(priv->rstc);
+        if (ret)
+                return ret;
+
+        for (i = 0; i < LOOP_TIMEOUT; i++) {
+                ret = reset_control_status(priv->rstc);
+                if (ret == 0)
+                        return 0;
+                udelay(1);
+        }
+
+        return -ETIMEDOUT;
+}
+
 static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
                                 struct i2c_msg *msgs,
                                 int num)
@@ -750,6 +779,16 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
 
         pm_runtime_get_sync(dev);
 
+        /* Gen3 needs a reset before allowing RXDMA once */
+        if (priv->devtype == I2C_RCAR_GEN3) {
+                priv->flags |= ID_P_NO_RXDMA;
+                if (!IS_ERR(priv->rstc)) {
+                        ret = rcar_i2c_do_reset(priv);
+                        if (ret == 0)
+                                priv->flags &= ~ID_P_NO_RXDMA;
+                }
+        }
+
         rcar_i2c_init(priv);
 
         ret = rcar_i2c_bus_barrier(priv);
@@ -920,6 +959,15 @@ static int rcar_i2c_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto out_pm_put;
 
+        if (priv->devtype == I2C_RCAR_GEN3) {
+                priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
+                if (!IS_ERR(priv->rstc)) {
+                        ret = reset_control_status(priv->rstc);
+                        if (ret < 0)
+                                priv->rstc = ERR_PTR(-ENOTSUPP);
+                }
+        }
+
         /* Stay always active when multi-master to keep arbitration working */
         if (of_property_read_bool(dev->of_node, "multi-master"))
                 priv->flags |= ID_P_PM_BLOCKED;
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index 301285c54603..15c95aaa484c 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -624,7 +624,7 @@ static int i2c_check_addr_busy(struct i2c_adapter *adapter, int addr)
 static void i2c_adapter_lock_bus(struct i2c_adapter *adapter,
                                  unsigned int flags)
 {
-        rt_mutex_lock(&adapter->bus_lock);
+        rt_mutex_lock_nested(&adapter->bus_lock, i2c_adapter_depth(adapter));
 }
 
 /**
diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
index 300ab4b672e4..29646aa6132e 100644
--- a/drivers/i2c/i2c-mux.c
+++ b/drivers/i2c/i2c-mux.c
@@ -144,7 +144,7 @@ static void i2c_mux_lock_bus(struct i2c_adapter *adapter, unsigned int flags)
         struct i2c_mux_priv *priv = adapter->algo_data;
         struct i2c_adapter *parent = priv->muxc->parent;
 
-        rt_mutex_lock(&parent->mux_lock);
+        rt_mutex_lock_nested(&parent->mux_lock, i2c_adapter_depth(adapter));
         if (!(flags & I2C_LOCK_ROOT_ADAPTER))
                 return;
         i2c_lock_bus(parent, flags);
@@ -181,7 +181,7 @@ static void i2c_parent_lock_bus(struct i2c_adapter *adapter,
         struct i2c_mux_priv *priv = adapter->algo_data;
         struct i2c_adapter *parent = priv->muxc->parent;
 
-        rt_mutex_lock(&parent->mux_lock);
+        rt_mutex_lock_nested(&parent->mux_lock, i2c_adapter_depth(adapter));
         i2c_lock_bus(parent, flags);
 }
 
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index cc06e8404e9b..583d3a10b940 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1984,15 +1984,64 @@ static int modify_qp(struct ib_uverbs_file *file,
                 goto release_qp;
         }
 
-        if ((cmd->base.attr_mask & IB_QP_AV) &&
-            !rdma_is_port_valid(qp->device, cmd->base.dest.port_num)) {
-                ret = -EINVAL;
-                goto release_qp;
+        if ((cmd->base.attr_mask & IB_QP_AV)) {
+                if (!rdma_is_port_valid(qp->device, cmd->base.dest.port_num)) {
+                        ret = -EINVAL;
+                        goto release_qp;
+                }
+
+                if (cmd->base.attr_mask & IB_QP_STATE &&
+                    cmd->base.qp_state == IB_QPS_RTR) {
+                /* We are in INIT->RTR TRANSITION (if we are not,
+                 * this transition will be rejected in subsequent checks).
+                 * In the INIT->RTR transition, we cannot have IB_QP_PORT set,
+                 * but the IB_QP_STATE flag is required.
+                 *
+                 * Since kernel 3.14 (commit dbf727de7440), the uverbs driver,
+                 * when IB_QP_AV is set, has required inclusion of a valid
+                 * port number in the primary AV. (AVs are created and handled
+                 * differently for infiniband and ethernet (RoCE) ports).
+                 *
+                 * Check the port number included in the primary AV against
+                 * the port number in the qp struct, which was set (and saved)
+                 * in the RST->INIT transition.
+                 */
+                        if (cmd->base.dest.port_num != qp->real_qp->port) {
+                                ret = -EINVAL;
+                                goto release_qp;
+                        }
+                } else {
+                /* We are in SQD->SQD. (If we are not, this transition will
+                 * be rejected later in the verbs layer checks).
+                 * Check for both IB_QP_PORT and IB_QP_AV, these can be set
+                 * together in the SQD->SQD transition.
+                 *
+                 * If only IP_QP_AV was set, add in IB_QP_PORT as well (the
+                 * verbs layer driver does not track primary port changes
+                 * resulting from path migration. Thus, in SQD, if the primary
+                 * AV is modified, the primary port should also be modified).
+                 *
+                 * Note that in this transition, the IB_QP_STATE flag
+                 * is not allowed.
+                 */
+                        if (((cmd->base.attr_mask & (IB_QP_AV | IB_QP_PORT))
+                             == (IB_QP_AV | IB_QP_PORT)) &&
+                            cmd->base.port_num != cmd->base.dest.port_num) {
+                                ret = -EINVAL;
+                                goto release_qp;
+                        }
+                        if ((cmd->base.attr_mask & (IB_QP_AV | IB_QP_PORT))
+                            == IB_QP_AV) {
+                                cmd->base.attr_mask |= IB_QP_PORT;
+                                cmd->base.port_num = cmd->base.dest.port_num;
+                        }
+                }
         }
 
         if ((cmd->base.attr_mask & IB_QP_ALT_PATH) &&
             (!rdma_is_port_valid(qp->device, cmd->base.alt_port_num) ||
-            !rdma_is_port_valid(qp->device, cmd->base.alt_dest.port_num))) {
+            !rdma_is_port_valid(qp->device, cmd->base.alt_dest.port_num) ||
+            cmd->base.alt_port_num != cmd->base.alt_dest.port_num)) {
                 ret = -EINVAL;
                 goto release_qp;
         }
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 1f9cd7d8b7ad..f5ae24865355 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1346,6 +1346,8 @@ static const struct acpi_device_id elan_acpi_id[] = {
         { "ELAN0611", 0 },
         { "ELAN0612", 0 },
         { "ELAN0618", 0 },
+        { "ELAN061D", 0 },
+        { "ELAN0622", 0 },
         { "ELAN1000", 0 },
         { }
 };
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index b353d494ad40..136f6e7bf797 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -527,6 +527,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"),
                 },
         },
+        {
+                /* Lenovo LaVie Z */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo LaVie Z"),
+                },
+        },
         { }
 };
 
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index b344a883f116..115ff26e9ced 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -484,14 +484,37 @@ static int dmar_forcedac;
 static int intel_iommu_strict;
 static int intel_iommu_superpage = 1;
 static int intel_iommu_ecs = 1;
+static int intel_iommu_pasid28;
 static int iommu_identity_mapping;
 
 #define IDENTMAP_ALL            1
 #define IDENTMAP_GFX            2
 #define IDENTMAP_AZALIA         4
 
-#define ecs_enabled(iommu)      (intel_iommu_ecs && ecap_ecs(iommu->ecap))
-#define pasid_enabled(iommu)    (ecs_enabled(iommu) && ecap_pasid(iommu->ecap))
+/* Broadwell and Skylake have broken ECS support — normal so-called "second
+ * level" translation of DMA requests-without-PASID doesn't actually happen
+ * unless you also set the NESTE bit in an extended context-entry. Which of
+ * course means that SVM doesn't work because it's trying to do nested
+ * translation of the physical addresses it finds in the process page tables,
+ * through the IOVA->phys mapping found in the "second level" page tables.
+ *
+ * The VT-d specification was retroactively changed to change the definition
+ * of the capability bits and pretend that Broadwell/Skylake never happened...
+ * but unfortunately the wrong bit was changed. It's ECS which is broken, but
+ * for some reason it was the PASID capability bit which was redefined (from
+ * bit 28 on BDW/SKL to bit 40 in future).
+ *
+ * So our test for ECS needs to eschew those implementations which set the old
+ * PASID capabiity bit 28, since those are the ones on which ECS is broken.
+ * Unless we are working around the 'pasid28' limitations, that is, by putting
+ * the device into passthrough mode for normal DMA and thus masking the bug.
+ */
+#define ecs_enabled(iommu) (intel_iommu_ecs && ecap_ecs(iommu->ecap) && \
+                            (intel_iommu_pasid28 || !ecap_broken_pasid(iommu->ecap)))
+/* PASID support is thus enabled if ECS is enabled and *either* of the old
+ * or new capability bits are set. */
+#define pasid_enabled(iommu) (ecs_enabled(iommu) &&                     \
+                              (ecap_pasid(iommu->ecap) || ecap_broken_pasid(iommu->ecap)))
 
 int intel_iommu_gfx_mapped;
 EXPORT_SYMBOL_GPL(intel_iommu_gfx_mapped);
@@ -554,6 +577,11 @@ static int __init intel_iommu_setup(char *str)
                         printk(KERN_INFO
                                 "Intel-IOMMU: disable extended context table support\n");
                         intel_iommu_ecs = 0;
+                } else if (!strncmp(str, "pasid28", 7)) {
+                        printk(KERN_INFO
+                                "Intel-IOMMU: enable pre-production PASID support\n");
+                        intel_iommu_pasid28 = 1;
+                        iommu_identity_mapping |= IDENTMAP_GFX;
                 } else if (!strncmp(str, "tboot_noforce", 13)) {
                         printk(KERN_INFO
                                 "Intel-IOMMU: not forcing on after tboot. This could expose security risk for tboot\n");
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index 07ea6a48aac6..87107c995cb5 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -136,6 +136,7 @@ struct dm_writecache {
         struct dm_target *ti;
         struct dm_dev *dev;
         struct dm_dev *ssd_dev;
+        sector_t start_sector;
         void *memory_map;
         uint64_t memory_map_size;
         size_t metadata_sectors;
@@ -293,6 +294,10 @@ static int persistent_memory_claim(struct dm_writecache *wc)
         }
 
         dax_read_unlock(id);
+
+        wc->memory_map += (size_t)wc->start_sector << SECTOR_SHIFT;
+        wc->memory_map_size -= (size_t)wc->start_sector << SECTOR_SHIFT;
+
         return 0;
 err3:
         kvfree(pages);
@@ -311,7 +316,7 @@ static int persistent_memory_claim(struct dm_writecache *wc)
 static void persistent_memory_release(struct dm_writecache *wc)
 {
         if (wc->memory_vmapped)
-                vunmap(wc->memory_map);
+                vunmap(wc->memory_map - ((size_t)wc->start_sector << SECTOR_SHIFT));
 }
 
 static struct page *persistent_memory_page(void *addr)
@@ -359,7 +364,7 @@ static void *memory_data(struct dm_writecache *wc, struct wc_entry *e)
 
 static sector_t cache_sector(struct dm_writecache *wc, struct wc_entry *e)
 {
-        return wc->metadata_sectors +
+        return wc->start_sector + wc->metadata_sectors +
                 ((sector_t)e->index << (wc->block_size_bits - SECTOR_SHIFT));
 }
 
@@ -471,6 +476,7 @@ static void ssd_commit_flushed(struct dm_writecache *wc)
                 if (unlikely(region.sector + region.count > wc->metadata_sectors))
                         region.count = wc->metadata_sectors - region.sector;
 
+                region.sector += wc->start_sector;
                 atomic_inc(&endio.count);
                 req.bi_op = REQ_OP_WRITE;
                 req.bi_op_flags = REQ_SYNC;
@@ -1946,14 +1952,6 @@ static int writecache_ctr(struct dm_target *ti, unsigned argc, char **argv)
         }
         wc->memory_map_size = i_size_read(wc->ssd_dev->bdev->bd_inode);
 
-        if (WC_MODE_PMEM(wc)) {
-                r = persistent_memory_claim(wc);
-                if (r) {
-                        ti->error = "Unable to map persistent memory for cache";
-                        goto bad;
-                }
-        }
-
         /*
          * Parse the cache block size
          */
@@ -1982,7 +1980,16 @@ static int writecache_ctr(struct dm_target *ti, unsigned argc, char **argv)
 
         while (opt_params) {
                 string = dm_shift_arg(&as), opt_params--;
-                if (!strcasecmp(string, "high_watermark") && opt_params >= 1) {
+                if (!strcasecmp(string, "start_sector") && opt_params >= 1) {
+                        unsigned long long start_sector;
+                        string = dm_shift_arg(&as), opt_params--;
+                        if (sscanf(string, "%llu%c", &start_sector, &dummy) != 1)
+                                goto invalid_optional;
+                        wc->start_sector = start_sector;
+                        if (wc->start_sector != start_sector ||
+                            wc->start_sector >= wc->memory_map_size >> SECTOR_SHIFT)
+                                goto invalid_optional;
+                } else if (!strcasecmp(string, "high_watermark") && opt_params >= 1) {
                         string = dm_shift_arg(&as), opt_params--;
                         if (sscanf(string, "%d%c", &high_wm_percent, &dummy) != 1)
                                 goto invalid_optional;
@@ -2039,12 +2046,20 @@ invalid_optional:
                 goto bad;
         }
 
-        if (!WC_MODE_PMEM(wc)) {
+        if (WC_MODE_PMEM(wc)) {
+                r = persistent_memory_claim(wc);
+                if (r) {
+                        ti->error = "Unable to map persistent memory for cache";
+                        goto bad;
+                }
+        } else {
                 struct dm_io_region region;
                 struct dm_io_request req;
                 size_t n_blocks, n_metadata_blocks;
                 uint64_t n_bitmap_bits;
 
+                wc->memory_map_size -= (uint64_t)wc->start_sector << SECTOR_SHIFT;
+
                 bio_list_init(&wc->flush_list);
                 wc->flush_thread = kthread_create(writecache_flush_thread, wc, "dm_writecache_flush");
                 if (IS_ERR(wc->flush_thread)) {
@@ -2097,7 +2112,7 @@ invalid_optional:
                 }
 
                 region.bdev = wc->ssd_dev->bdev;
-                region.sector = 0;
+                region.sector = wc->start_sector;
                 region.count = wc->metadata_sectors;
                 req.bi_op = REQ_OP_READ;
                 req.bi_op_flags = REQ_SYNC;
@@ -2265,7 +2280,7 @@ static void writecache_status(struct dm_target *ti, status_type_t type,
 
 static struct target_type writecache_target = {
         .name                   = "writecache",
-        .version                = {1, 0, 0},
+        .version                = {1, 1, 0},
         .module                 = THIS_MODULE,
         .ctr                    = writecache_ctr,
         .dtr                    = writecache_dtr,
diff --git a/drivers/media/platform/vsp1/vsp1_drm.c b/drivers/media/platform/vsp1/vsp1_drm.c
index edb35a5c57ea..a99fc0ced7a7 100644
--- a/drivers/media/platform/vsp1/vsp1_drm.c
+++ b/drivers/media/platform/vsp1/vsp1_drm.c
@@ -728,9 +728,6 @@ EXPORT_SYMBOL_GPL(vsp1_du_setup_lif);
  */
 void vsp1_du_atomic_begin(struct device *dev, unsigned int pipe_index)
 {
-        struct vsp1_device *vsp1 = dev_get_drvdata(dev);
-
-        mutex_lock(&vsp1->drm->lock);
 }
 EXPORT_SYMBOL_GPL(vsp1_du_atomic_begin);
 
@@ -846,6 +843,7 @@ void vsp1_du_atomic_flush(struct device *dev, unsigned int pipe_index,
 
         drm_pipe->crc = cfg->crc;
 
+        mutex_lock(&vsp1->drm->lock);
         vsp1_du_pipeline_setup_inputs(vsp1, pipe);
         vsp1_du_pipeline_configure(pipe);
         mutex_unlock(&vsp1->drm->lock);
diff --git a/drivers/media/rc/bpf-lirc.c b/drivers/media/rc/bpf-lirc.c
index fcfab6635f9c..81b150e5dfdb 100644
--- a/drivers/media/rc/bpf-lirc.c
+++ b/drivers/media/rc/bpf-lirc.c
@@ -174,6 +174,7 @@ static int lirc_bpf_detach(struct rc_dev *rcdev, struct bpf_prog *prog)
 
         rcu_assign_pointer(raw->progs, new_array);
         bpf_prog_array_free(old_array);
+        bpf_prog_put(prog);
 unlock:
         mutex_unlock(&ir_raw_handler_lock);
         return ret;
diff --git a/drivers/media/rc/rc-ir-raw.c b/drivers/media/rc/rc-ir-raw.c
index 2e0066b1a31c..e7948908e78c 100644
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -30,13 +30,13 @@ static int ir_raw_event_thread(void *data)
                 while (kfifo_out(&raw->kfifo, &ev, 1)) {
                         if (is_timing_event(ev)) {
                                 if (ev.duration == 0)
-                                        dev_err(&dev->dev, "nonsensical timing event of duration 0");
+                                        dev_warn_once(&dev->dev, "nonsensical timing event of duration 0");
                                 if (is_timing_event(raw->prev_ev) &&
                                     !is_transition(&ev, &raw->prev_ev))
-                                        dev_err(&dev->dev, "two consecutive events of type %s",
-                                                TO_STR(ev.pulse));
+                                        dev_warn_once(&dev->dev, "two consecutive events of type %s",
+                                                      TO_STR(ev.pulse));
                                 if (raw->prev_ev.reset && ev.pulse == 0)
-                                        dev_err(&dev->dev, "timing event after reset should be pulse");
+                                        dev_warn_once(&dev->dev, "timing event after reset should be pulse");
                         }
                         list_for_each_entry(handler, &ir_raw_handler_list, list)
                                 if (dev->enabled_protocols &
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 2e222d9ee01f..ca68e1d2b2f9 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -679,6 +679,14 @@ static void ir_timer_repeat(struct timer_list *t)
         spin_unlock_irqrestore(&dev->keylock, flags);
 }
 
+static unsigned int repeat_period(int protocol)
+{
+        if (protocol >= ARRAY_SIZE(protocols))
+                return 100;
+
+        return protocols[protocol].repeat_period;
+}
+
 /**
  * rc_repeat() - signals that a key is still pressed
  * @dev:        the struct rc_dev descriptor of the device
@@ -691,7 +699,7 @@ void rc_repeat(struct rc_dev *dev)
 {
         unsigned long flags;
         unsigned int timeout = nsecs_to_jiffies(dev->timeout) +
-                msecs_to_jiffies(protocols[dev->last_protocol].repeat_period);
+                msecs_to_jiffies(repeat_period(dev->last_protocol));
         struct lirc_scancode sc = {
                 .scancode = dev->last_scancode, .rc_proto = dev->last_protocol,
                 .keycode = dev->keypressed ? dev->last_keycode : KEY_RESERVED,
@@ -803,7 +811,7 @@ void rc_keydown(struct rc_dev *dev, enum rc_proto protocol, u32 scancode,
 
         if (dev->keypressed) {
                 dev->keyup_jiffies = jiffies + nsecs_to_jiffies(dev->timeout) +
-                        msecs_to_jiffies(protocols[protocol].repeat_period);
+                        msecs_to_jiffies(repeat_period(protocol));
                 mod_timer(&dev->timer_keyup, dev->keyup_jiffies);
         }
         spin_unlock_irqrestore(&dev->keylock, flags);
diff --git a/drivers/misc/cxl/api.c b/drivers/misc/cxl/api.c
index 753b1a698fc4..6b16946f9b05 100644
--- a/drivers/misc/cxl/api.c
+++ b/drivers/misc/cxl/api.c
@@ -103,15 +103,15 @@ static struct file *cxl_getfile(const char *name,
         d_instantiate(path.dentry, inode);
 
         file = alloc_file(&path, OPEN_FMODE(flags), fops);
-        if (IS_ERR(file))
-                goto err_dput;
+        if (IS_ERR(file)) {
+                path_put(&path);
+                goto err_fs;
+        }
         file->f_flags = flags & (O_ACCMODE | O_NONBLOCK);
         file->private_data = priv;
 
         return file;
 
-err_dput:
-        path_put(&path);
 err_inode:
         iput(inode);
 err_fs:
diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c
index 75f781c11e89..de4e6e5bf304 100644
--- a/drivers/mmc/host/mxcmmc.c
+++ b/drivers/mmc/host/mxcmmc.c
@@ -293,9 +293,10 @@ static void mxcmci_swap_buffers(struct mmc_data *data)
         int i;
 
         for_each_sg(data->sg, sg, data->sg_len, i) {
-                void *buf = kmap_atomic(sg_page(sg) + sg->offset;
+                void *buf = kmap_atomic(sg_page(sg) + sg->offset);
                 buffer_swap32(buf, sg->length);
                 kunmap_atomic(buf);
+        }
 }
 #else
 static inline void mxcmci_swap_buffers(struct mmc_data *data) {}
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 63e3844c5bec..217b790d22ed 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1717,6 +1717,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
                 goto err_upper_unlink;
         }
 
+        bond->nest_level = dev_get_nest_level(bond_dev) + 1;
+
         /* If the mode uses primary, then the following is handled by
          * bond_change_active_slave().
          */
@@ -1764,7 +1766,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
         if (bond_mode_can_use_xmit_hash(bond))
                 bond_update_slave_arr(bond, NULL);
 
-        bond->nest_level = dev_get_nest_level(bond_dev);
 
         netdev_info(bond_dev, "Enslaving %s as %s interface with %s link\n",
                     slave_dev->name,
@@ -3415,6 +3416,13 @@ static void bond_fold_stats(struct rtnl_link_stats64 *_res,
         }
 }
 
+static int bond_get_nest_level(struct net_device *bond_dev)
+{
+        struct bonding *bond = netdev_priv(bond_dev);
+
+        return bond->nest_level;
+}
+
 static void bond_get_stats(struct net_device *bond_dev,
                            struct rtnl_link_stats64 *stats)
 {
@@ -3423,7 +3431,7 @@ static void bond_get_stats(struct net_device *bond_dev,
         struct list_head *iter;
         struct slave *slave;
 
-        spin_lock(&bond->stats_lock);
+        spin_lock_nested(&bond->stats_lock, bond_get_nest_level(bond_dev));
         memcpy(stats, &bond->bond_stats, sizeof(*stats));
 
         rcu_read_lock();
@@ -4227,6 +4235,7 @@ static const struct net_device_ops bond_netdev_ops = {
         .ndo_neigh_setup        = bond_neigh_setup,
         .ndo_vlan_rx_add_vid    = bond_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid   = bond_vlan_rx_kill_vid,
+        .ndo_get_lock_subclass  = bond_get_nest_level,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_netpoll_setup      = bond_netpoll_setup,
         .ndo_netpoll_cleanup    = bond_netpoll_cleanup,
@@ -4725,6 +4734,7 @@ static int bond_init(struct net_device *bond_dev)
         if (!bond->wq)
                 return -ENOMEM;
 
+        bond->nest_level = SINGLE_DEPTH_NESTING;
         netdev_lockdep_set_classes(bond_dev);
 
         list_add_tail(&bond->bond_list, &bn->dev_list);
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index 98663c50ded0..4d5d01cb8141 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -743,15 +743,20 @@ const struct bond_option *bond_opt_get(unsigned int option)
 static int bond_option_mode_set(struct bonding *bond,
                                 const struct bond_opt_value *newval)
 {
-        if (!bond_mode_uses_arp(newval->value) && bond->params.arp_interval) {
-                netdev_dbg(bond->dev, "%s mode is incompatible with arp monitoring, start mii monitoring\n",
-                           newval->string);
-                /* disable arp monitoring */
-                bond->params.arp_interval = 0;
-                /* set miimon to default value */
-                bond->params.miimon = BOND_DEFAULT_MIIMON;
-                netdev_dbg(bond->dev, "Setting MII monitoring interval to %d\n",
-                           bond->params.miimon);
+        if (!bond_mode_uses_arp(newval->value)) {
+                if (bond->params.arp_interval) {
+                        netdev_dbg(bond->dev, "%s mode is incompatible with arp monitoring, start mii monitoring\n",
+                                   newval->string);
+                        /* disable arp monitoring */
+                        bond->params.arp_interval = 0;
+                }
+
+                if (!bond->params.miimon) {
+                        /* set miimon to default value */
+                        bond->params.miimon = BOND_DEFAULT_MIIMON;
+                        netdev_dbg(bond->dev, "Setting MII monitoring interval to %d\n",
+                                   bond->params.miimon);
+                }
         }
 
         if (newval->value == BOND_MODE_ALB)
diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index b397a33f3d32..9b449400376b 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -634,10 +634,12 @@ static int m_can_clk_start(struct m_can_priv *priv)
         int err;
 
         err = pm_runtime_get_sync(priv->device);
-        if (err)
+        if (err < 0) {
                 pm_runtime_put_noidle(priv->device);
+                return err;
+        }
 
-        return err;
+        return 0;
 }
 
 static void m_can_clk_stop(struct m_can_priv *priv)
@@ -1109,7 +1111,8 @@ static void m_can_chip_config(struct net_device *dev)
 
         } else {
         /* Version 3.1.x or 3.2.x */
-                cccr &= ~(CCCR_TEST | CCCR_MON | CCCR_BRSE | CCCR_FDOE);
+                cccr &= ~(CCCR_TEST | CCCR_MON | CCCR_BRSE | CCCR_FDOE |
+                          CCCR_NISO);
 
                 /* Only 3.2.x has NISO Bit implemented */
                 if (priv->can.ctrlmode & CAN_CTRLMODE_FD_NON_ISO)
@@ -1642,8 +1645,6 @@ static int m_can_plat_probe(struct platform_device *pdev)
         priv->can.clock.freq = clk_get_rate(cclk);
         priv->mram_base = mram_addr;
 
-        m_can_of_parse_mram(priv, mram_config_vals);
-
         platform_set_drvdata(pdev, dev);
         SET_NETDEV_DEV(dev, &pdev->dev);
 
@@ -1666,6 +1667,8 @@ static int m_can_plat_probe(struct platform_device *pdev)
                 goto clk_disable;
         }
 
+        m_can_of_parse_mram(priv, mram_config_vals);
+
         devm_can_led_init(dev);
 
         of_can_transceiver(dev);
@@ -1687,8 +1690,6 @@ failed_ret:
         return ret;
 }
 
-/* TODO: runtime PM with power down or sleep mode  */
-
 static __maybe_unused int m_can_suspend(struct device *dev)
 {
         struct net_device *ndev = dev_get_drvdata(dev);
@@ -1715,8 +1716,6 @@ static __maybe_unused int m_can_resume(struct device *dev)
 
         pinctrl_pm_select_default_state(dev);
 
-        m_can_init_ram(priv);
-
         priv->can.state = CAN_STATE_ERROR_ACTIVE;
 
         if (netif_running(ndev)) {
@@ -1726,6 +1725,7 @@ static __maybe_unused int m_can_resume(struct device *dev)
                 if (ret)
                         return ret;
 
+                m_can_init_ram(priv);
                 m_can_start(ndev);
                 netif_device_attach(ndev);
                 netif_start_queue(ndev);
diff --git a/drivers/net/can/mscan/mpc5xxx_can.c b/drivers/net/can/mscan/mpc5xxx_can.c
index c7427bdd3a4b..2949a381a94d 100644
--- a/drivers/net/can/mscan/mpc5xxx_can.c
+++ b/drivers/net/can/mscan/mpc5xxx_can.c
@@ -86,6 +86,11 @@ static u32 mpc52xx_can_get_clock(struct platform_device *ofdev,
                 return 0;
         }
         cdm = of_iomap(np_cdm, 0);
+        if (!cdm) {
+                of_node_put(np_cdm);
+                dev_err(&ofdev->dev, "can't map clock node!\n");
+                return 0;
+        }
 
         if (in_8(&cdm->ipb_clk_sel) & 0x1)
                 freq *= 2;
diff --git a/drivers/net/can/peak_canfd/peak_pciefd_main.c b/drivers/net/can/peak_canfd/peak_pciefd_main.c
index b9e28578bc7b..455a3797a200 100644
--- a/drivers/net/can/peak_canfd/peak_pciefd_main.c
+++ b/drivers/net/can/peak_canfd/peak_pciefd_main.c
@@ -58,6 +58,10 @@ MODULE_LICENSE("GPL v2");
 #define PCIEFD_REG_SYS_VER1             0x0040  /* version reg #1 */
 #define PCIEFD_REG_SYS_VER2             0x0044  /* version reg #2 */
 
+#define PCIEFD_FW_VERSION(x, y, z)      (((u32)(x) << 24) | \
+                                         ((u32)(y) << 16) | \
+                                         ((u32)(z) << 8))
+
 /* System Control Registers Bits */
 #define PCIEFD_SYS_CTL_TS_RST           0x00000001      /* timestamp clock */
 #define PCIEFD_SYS_CTL_CLK_EN           0x00000002      /* system clock */
@@ -782,6 +786,21 @@ static int peak_pciefd_probe(struct pci_dev *pdev,
                  "%ux CAN-FD PCAN-PCIe FPGA v%u.%u.%u:\n", can_count,
                  hw_ver_major, hw_ver_minor, hw_ver_sub);
 
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+        /* FW < v3.3.0 DMA logic doesn't handle correctly the mix of 32-bit and
+         * 64-bit logical addresses: this workaround forces usage of 32-bit
+         * DMA addresses only when such a fw is detected.
+         */
+        if (PCIEFD_FW_VERSION(hw_ver_major, hw_ver_minor, hw_ver_sub) <
+            PCIEFD_FW_VERSION(3, 3, 0)) {
+                err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
+                if (err)
+                        dev_warn(&pdev->dev,
+                                 "warning: can't set DMA mask %llxh (err %d)\n",
+                                 DMA_BIT_MASK(32), err);
+        }
+#endif
+
         /* stop system clock */
         pciefd_sys_writereg(pciefd, PCIEFD_SYS_CTL_CLK_EN,
                             PCIEFD_REG_SYS_CTL_CLR);
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 12ff0020ecd6..b7dfd4109d24 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -1072,6 +1072,7 @@ static void ems_usb_disconnect(struct usb_interface *intf)
                 usb_free_urb(dev->intr_urb);
 
                 kfree(dev->intr_in_buffer);
+                kfree(dev->tx_msg_buffer);
         }
 }
 
diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c
index 89aec07c225f..5a24039733ef 100644
--- a/drivers/net/can/xilinx_can.c
+++ b/drivers/net/can/xilinx_can.c
@@ -2,6 +2,7 @@
  *
  * Copyright (C) 2012 - 2014 Xilinx, Inc.
  * Copyright (C) 2009 PetaLogix. All rights reserved.
+ * Copyright (C) 2017 Sandvik Mining and Construction Oy
  *
  * Description:
  * This driver is developed for Axi CAN IP and for Zynq CANPS Controller.
@@ -25,8 +26,10 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/of.h>
+#include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/skbuff.h>
+#include <linux/spinlock.h>
 #include <linux/string.h>
 #include <linux/types.h>
 #include <linux/can/dev.h>
@@ -101,7 +104,7 @@ enum xcan_reg {
 #define XCAN_INTR_ALL           (XCAN_IXR_TXOK_MASK | XCAN_IXR_BSOFF_MASK |\
                                  XCAN_IXR_WKUP_MASK | XCAN_IXR_SLP_MASK | \
                                  XCAN_IXR_RXNEMP_MASK | XCAN_IXR_ERROR_MASK | \
-                                 XCAN_IXR_ARBLST_MASK | XCAN_IXR_RXOK_MASK)
+                                 XCAN_IXR_RXOFLW_MASK | XCAN_IXR_ARBLST_MASK)
 
 /* CAN register bit shift - XCAN_<REG>_<BIT>_SHIFT */
 #define XCAN_BTR_SJW_SHIFT              7  /* Synchronous jump width */
@@ -118,6 +121,7 @@ enum xcan_reg {
 /**
  * struct xcan_priv - This definition define CAN driver instance
  * @can:                        CAN private data structure.
+ * @tx_lock:                    Lock for synchronizing TX interrupt handling
  * @tx_head:                    Tx CAN packets ready to send on the queue
  * @tx_tail:                    Tx CAN packets successfully sended on the queue
  * @tx_max:                     Maximum number packets the driver can send
@@ -132,6 +136,7 @@ enum xcan_reg {
  */
 struct xcan_priv {
         struct can_priv can;
+        spinlock_t tx_lock;
         unsigned int tx_head;
         unsigned int tx_tail;
         unsigned int tx_max;
@@ -159,6 +164,11 @@ static const struct can_bittiming_const xcan_bittiming_const = {
         .brp_inc = 1,
 };
 
+#define XCAN_CAP_WATERMARK      0x0001
+struct xcan_devtype_data {
+        unsigned int caps;
+};
+
 /**
  * xcan_write_reg_le - Write a value to the device register little endian
  * @priv:       Driver private data structure
@@ -238,6 +248,10 @@ static int set_reset_mode(struct net_device *ndev)
                 usleep_range(500, 10000);
         }
 
+        /* reset clears FIFOs */
+        priv->tx_head = 0;
+        priv->tx_tail = 0;
+
         return 0;
 }
 
@@ -392,6 +406,7 @@ static int xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         struct net_device_stats *stats = &ndev->stats;
         struct can_frame *cf = (struct can_frame *)skb->data;
         u32 id, dlc, data[2] = {0, 0};
+        unsigned long flags;
 
         if (can_dropped_invalid_skb(ndev, skb))
                 return NETDEV_TX_OK;
@@ -439,6 +454,9 @@ static int xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 data[1] = be32_to_cpup((__be32 *)(cf->data + 4));
 
         can_put_echo_skb(skb, ndev, priv->tx_head % priv->tx_max);
+
+        spin_lock_irqsave(&priv->tx_lock, flags);
+
         priv->tx_head++;
 
         /* Write the Frame to Xilinx CAN TX FIFO */
@@ -454,10 +472,16 @@ static int xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 stats->tx_bytes += cf->can_dlc;
         }
 
+        /* Clear TX-FIFO-empty interrupt for xcan_tx_interrupt() */
+        if (priv->tx_max > 1)
+                priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_TXFEMP_MASK);
+
         /* Check if the TX buffer is full */
         if ((priv->tx_head - priv->tx_tail) == priv->tx_max)
                 netif_stop_queue(ndev);
 
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
+
         return NETDEV_TX_OK;
 }
 
@@ -530,6 +554,123 @@ static int xcan_rx(struct net_device *ndev)
 }
 
 /**
+ * xcan_current_error_state - Get current error state from HW
+ * @ndev:       Pointer to net_device structure
+ *
+ * Checks the current CAN error state from the HW. Note that this
+ * only checks for ERROR_PASSIVE and ERROR_WARNING.
+ *
+ * Return:
+ * ERROR_PASSIVE or ERROR_WARNING if either is active, ERROR_ACTIVE
+ * otherwise.
+ */
+static enum can_state xcan_current_error_state(struct net_device *ndev)
+{
+        struct xcan_priv *priv = netdev_priv(ndev);
+        u32 status = priv->read_reg(priv, XCAN_SR_OFFSET);
+
+        if ((status & XCAN_SR_ESTAT_MASK) == XCAN_SR_ESTAT_MASK)
+                return CAN_STATE_ERROR_PASSIVE;
+        else if (status & XCAN_SR_ERRWRN_MASK)
+                return CAN_STATE_ERROR_WARNING;
+        else
+                return CAN_STATE_ERROR_ACTIVE;
+}
+
+/**
+ * xcan_set_error_state - Set new CAN error state
+ * @ndev:       Pointer to net_device structure
+ * @new_state:  The new CAN state to be set
+ * @cf:         Error frame to be populated or NULL
+ *
+ * Set new CAN error state for the device, updating statistics and
+ * populating the error frame if given.
+ */
+static void xcan_set_error_state(struct net_device *ndev,
+                                 enum can_state new_state,
+                                 struct can_frame *cf)
+{
+        struct xcan_priv *priv = netdev_priv(ndev);
+        u32 ecr = priv->read_reg(priv, XCAN_ECR_OFFSET);
+        u32 txerr = ecr & XCAN_ECR_TEC_MASK;
+        u32 rxerr = (ecr & XCAN_ECR_REC_MASK) >> XCAN_ESR_REC_SHIFT;
+
+        priv->can.state = new_state;
+
+        if (cf) {
+                cf->can_id |= CAN_ERR_CRTL;
+                cf->data[6] = txerr;
+                cf->data[7] = rxerr;
+        }
+
+        switch (new_state) {
+        case CAN_STATE_ERROR_PASSIVE:
+                priv->can.can_stats.error_passive++;
+                if (cf)
+                        cf->data[1] = (rxerr > 127) ?
+                                        CAN_ERR_CRTL_RX_PASSIVE :
+                                        CAN_ERR_CRTL_TX_PASSIVE;
+                break;
+        case CAN_STATE_ERROR_WARNING:
+                priv->can.can_stats.error_warning++;
+                if (cf)
+                        cf->data[1] |= (txerr > rxerr) ?
+                                        CAN_ERR_CRTL_TX_WARNING :
+                                        CAN_ERR_CRTL_RX_WARNING;
+                break;
+        case CAN_STATE_ERROR_ACTIVE:
+                if (cf)
+                        cf->data[1] |= CAN_ERR_CRTL_ACTIVE;
+                break;
+        default:
+                /* non-ERROR states are handled elsewhere */
+                WARN_ON(1);
+                break;
+        }
+}
+
+/**
+ * xcan_update_error_state_after_rxtx - Update CAN error state after RX/TX
+ * @ndev:       Pointer to net_device structure
+ *
+ * If the device is in a ERROR-WARNING or ERROR-PASSIVE state, check if
+ * the performed RX/TX has caused it to drop to a lesser state and set
+ * the interface state accordingly.
+ */
+static void xcan_update_error_state_after_rxtx(struct net_device *ndev)
+{
+        struct xcan_priv *priv = netdev_priv(ndev);
+        enum can_state old_state = priv->can.state;
+        enum can_state new_state;
+
+        /* changing error state due to successful frame RX/TX can only
+         * occur from these states
+         */
+        if (old_state != CAN_STATE_ERROR_WARNING &&
+            old_state != CAN_STATE_ERROR_PASSIVE)
+                return;
+
+        new_state = xcan_current_error_state(ndev);
+
+        if (new_state != old_state) {
+                struct sk_buff *skb;
+                struct can_frame *cf;
+
+                skb = alloc_can_err_skb(ndev, &cf);
+
+                xcan_set_error_state(ndev, new_state, skb ? cf : NULL);
+
+                if (skb) {
+                        struct net_device_stats *stats = &ndev->stats;
+
+                        stats->rx_packets++;
+                        stats->rx_bytes += cf->can_dlc;
+                        netif_rx(skb);
+                }
+        }
+}
+
+/**
  * xcan_err_interrupt - error frame Isr
  * @ndev:       net_device pointer
  * @isr:        interrupt status register value
@@ -544,16 +685,12 @@ static void xcan_err_interrupt(struct net_device *ndev, u32 isr)
         struct net_device_stats *stats = &ndev->stats;
         struct can_frame *cf;
         struct sk_buff *skb;
-        u32 err_status, status, txerr = 0, rxerr = 0;
+        u32 err_status;
 
         skb = alloc_can_err_skb(ndev, &cf);
 
         err_status = priv->read_reg(priv, XCAN_ESR_OFFSET);
         priv->write_reg(priv, XCAN_ESR_OFFSET, err_status);
-        txerr = priv->read_reg(priv, XCAN_ECR_OFFSET) & XCAN_ECR_TEC_MASK;
-        rxerr = ((priv->read_reg(priv, XCAN_ECR_OFFSET) &
-                        XCAN_ECR_REC_MASK) >> XCAN_ESR_REC_SHIFT);
-        status = priv->read_reg(priv, XCAN_SR_OFFSET);
 
         if (isr & XCAN_IXR_BSOFF_MASK) {
                 priv->can.state = CAN_STATE_BUS_OFF;
@@ -563,28 +700,10 @@ static void xcan_err_interrupt(struct net_device *ndev, u32 isr)
                 can_bus_off(ndev);
                 if (skb)
                         cf->can_id |= CAN_ERR_BUSOFF;
-        } else if ((status & XCAN_SR_ESTAT_MASK) == XCAN_SR_ESTAT_MASK) {
-                priv->can.state = CAN_STATE_ERROR_PASSIVE;
-                priv->can.can_stats.error_passive++;
-                if (skb) {
-                        cf->can_id |= CAN_ERR_CRTL;
-                        cf->data[1] = (rxerr > 127) ?
-                                        CAN_ERR_CRTL_RX_PASSIVE :
-                                        CAN_ERR_CRTL_TX_PASSIVE;
-                        cf->data[6] = txerr;
-                        cf->data[7] = rxerr;
-                }
-        } else if (status & XCAN_SR_ERRWRN_MASK) {
-                priv->can.state = CAN_STATE_ERROR_WARNING;
-                priv->can.can_stats.error_warning++;
-                if (skb) {
-                        cf->can_id |= CAN_ERR_CRTL;
-                        cf->data[1] |= (txerr > rxerr) ?
-                                        CAN_ERR_CRTL_TX_WARNING :
-                                        CAN_ERR_CRTL_RX_WARNING;
-                        cf->data[6] = txerr;
-                        cf->data[7] = rxerr;
-                }
+        } else {
+                enum can_state new_state = xcan_current_error_state(ndev);
+
+                xcan_set_error_state(ndev, new_state, skb ? cf : NULL);
         }
 
         /* Check for Arbitration lost interrupt */
@@ -600,7 +719,6 @@ static void xcan_err_interrupt(struct net_device *ndev, u32 isr)
         if (isr & XCAN_IXR_RXOFLW_MASK) {
                 stats->rx_over_errors++;
                 stats->rx_errors++;
-                priv->write_reg(priv, XCAN_SRR_OFFSET, XCAN_SRR_RESET_MASK);
                 if (skb) {
                         cf->can_id |= CAN_ERR_CRTL;
                         cf->data[1] |= CAN_ERR_CRTL_RX_OVERFLOW;
@@ -709,26 +827,20 @@ static int xcan_rx_poll(struct napi_struct *napi, int quota)
 
         isr = priv->read_reg(priv, XCAN_ISR_OFFSET);
         while ((isr & XCAN_IXR_RXNEMP_MASK) && (work_done < quota)) {
-                if (isr & XCAN_IXR_RXOK_MASK) {
-                        priv->write_reg(priv, XCAN_ICR_OFFSET,
-                                XCAN_IXR_RXOK_MASK);
-                        work_done += xcan_rx(ndev);
-                } else {
-                        priv->write_reg(priv, XCAN_ICR_OFFSET,
-                                XCAN_IXR_RXNEMP_MASK);
-                        break;
-                }
+                work_done += xcan_rx(ndev);
                 priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_RXNEMP_MASK);
                 isr = priv->read_reg(priv, XCAN_ISR_OFFSET);
         }
 
-        if (work_done)
+        if (work_done) {
                 can_led_event(ndev, CAN_LED_EVENT_RX);
+                xcan_update_error_state_after_rxtx(ndev);
+        }
 
         if (work_done < quota) {
                 napi_complete_done(napi, work_done);
                 ier = priv->read_reg(priv, XCAN_IER_OFFSET);
-                ier |= (XCAN_IXR_RXOK_MASK | XCAN_IXR_RXNEMP_MASK);
+                ier |= XCAN_IXR_RXNEMP_MASK;
                 priv->write_reg(priv, XCAN_IER_OFFSET, ier);
         }
         return work_done;
@@ -743,18 +855,71 @@ static void xcan_tx_interrupt(struct net_device *ndev, u32 isr)
 {
         struct xcan_priv *priv = netdev_priv(ndev);
         struct net_device_stats *stats = &ndev->stats;
+        unsigned int frames_in_fifo;
+        int frames_sent = 1; /* TXOK => at least 1 frame was sent */
+        unsigned long flags;
+        int retries = 0;
+
+        /* Synchronize with xmit as we need to know the exact number
+         * of frames in the FIFO to stay in sync due to the TXFEMP
+         * handling.
+         * This also prevents a race between netif_wake_queue() and
+         * netif_stop_queue().
+         */
+        spin_lock_irqsave(&priv->tx_lock, flags);
+
+        frames_in_fifo = priv->tx_head - priv->tx_tail;
+
+        if (WARN_ON_ONCE(frames_in_fifo == 0)) {
+                /* clear TXOK anyway to avoid getting back here */
+                priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_TXOK_MASK);
+                spin_unlock_irqrestore(&priv->tx_lock, flags);
+                return;
+        }
+
+        /* Check if 2 frames were sent (TXOK only means that at least 1
+         * frame was sent).
+         */
+        if (frames_in_fifo > 1) {
+                WARN_ON(frames_in_fifo > priv->tx_max);
+
+                /* Synchronize TXOK and isr so that after the loop:
+                 * (1) isr variable is up-to-date at least up to TXOK clear
+                 *     time. This avoids us clearing a TXOK of a second frame
+                 *     but not noticing that the FIFO is now empty and thus
+                 *     marking only a single frame as sent.
+                 * (2) No TXOK is left. Having one could mean leaving a
+                 *     stray TXOK as we might process the associated frame
+                 *     via TXFEMP handling as we read TXFEMP *after* TXOK
+                 *     clear to satisfy (1).
+                 */
+                while ((isr & XCAN_IXR_TXOK_MASK) && !WARN_ON(++retries == 100)) {
+                        priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_TXOK_MASK);
+                        isr = priv->read_reg(priv, XCAN_ISR_OFFSET);
+                }
 
-        while ((priv->tx_head - priv->tx_tail > 0) &&
-                        (isr & XCAN_IXR_TXOK_MASK)) {
+                if (isr & XCAN_IXR_TXFEMP_MASK) {
+                        /* nothing in FIFO anymore */
+                        frames_sent = frames_in_fifo;
+                }
+        } else {
+                /* single frame in fifo, just clear TXOK */
                 priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_TXOK_MASK);
+        }
+
+        while (frames_sent--) {
                 can_get_echo_skb(ndev, priv->tx_tail %
                                         priv->tx_max);
                 priv->tx_tail++;
                 stats->tx_packets++;
-                isr = priv->read_reg(priv, XCAN_ISR_OFFSET);
         }
-        can_led_event(ndev, CAN_LED_EVENT_TX);
+
         netif_wake_queue(ndev);
+
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
+
+        can_led_event(ndev, CAN_LED_EVENT_TX);
+        xcan_update_error_state_after_rxtx(ndev);
 }
 
 /**
@@ -773,6 +938,7 @@ static irqreturn_t xcan_interrupt(int irq, void *dev_id)
         struct net_device *ndev = (struct net_device *)dev_id;
         struct xcan_priv *priv = netdev_priv(ndev);
         u32 isr, ier;
+        u32 isr_errors;
 
         /* Get the interrupt status from Xilinx CAN */
         isr = priv->read_reg(priv, XCAN_ISR_OFFSET);
@@ -791,18 +957,17 @@ static irqreturn_t xcan_interrupt(int irq, void *dev_id)
                 xcan_tx_interrupt(ndev, isr);
 
         /* Check for the type of error interrupt and Processing it */
-        if (isr & (XCAN_IXR_ERROR_MASK | XCAN_IXR_RXOFLW_MASK |
-                        XCAN_IXR_BSOFF_MASK | XCAN_IXR_ARBLST_MASK)) {
-                priv->write_reg(priv, XCAN_ICR_OFFSET, (XCAN_IXR_ERROR_MASK |
-                                XCAN_IXR_RXOFLW_MASK | XCAN_IXR_BSOFF_MASK |
-                                XCAN_IXR_ARBLST_MASK));
+        isr_errors = isr & (XCAN_IXR_ERROR_MASK | XCAN_IXR_RXOFLW_MASK |
+                            XCAN_IXR_BSOFF_MASK | XCAN_IXR_ARBLST_MASK);
+        if (isr_errors) {
+                priv->write_reg(priv, XCAN_ICR_OFFSET, isr_errors);
                 xcan_err_interrupt(ndev, isr);
         }
 
         /* Check for the type of receive interrupt and Processing it */
-        if (isr & (XCAN_IXR_RXNEMP_MASK | XCAN_IXR_RXOK_MASK)) {
+        if (isr & XCAN_IXR_RXNEMP_MASK) {
                 ier = priv->read_reg(priv, XCAN_IER_OFFSET);
-                ier &= ~(XCAN_IXR_RXNEMP_MASK | XCAN_IXR_RXOK_MASK);
+                ier &= ~XCAN_IXR_RXNEMP_MASK;
                 priv->write_reg(priv, XCAN_IER_OFFSET, ier);
                 napi_schedule(&priv->napi);
         }
@@ -819,13 +984,9 @@ static irqreturn_t xcan_interrupt(int irq, void *dev_id)
 static void xcan_chip_stop(struct net_device *ndev)
 {
         struct xcan_priv *priv = netdev_priv(ndev);
-        u32 ier;
 
         /* Disable interrupts and leave the can in configuration mode */
-        ier = priv->read_reg(priv, XCAN_IER_OFFSET);
-        ier &= ~XCAN_INTR_ALL;
-        priv->write_reg(priv, XCAN_IER_OFFSET, ier);
-        priv->write_reg(priv, XCAN_SRR_OFFSET, XCAN_SRR_RESET_MASK);
+        set_reset_mode(ndev);
         priv->can.state = CAN_STATE_STOPPED;
 }
 
@@ -958,10 +1119,15 @@ static const struct net_device_ops xcan_netdev_ops = {
  */
 static int __maybe_unused xcan_suspend(struct device *dev)
 {
-        if (!device_may_wakeup(dev))
-                return pm_runtime_force_suspend(dev);
+        struct net_device *ndev = dev_get_drvdata(dev);
 
-        return 0;
+        if (netif_running(ndev)) {
+                netif_stop_queue(ndev);
+                netif_device_detach(ndev);
+                xcan_chip_stop(ndev);
+        }
+
+        return pm_runtime_force_suspend(dev);
 }
 
 /**
@@ -973,11 +1139,27 @@ static int __maybe_unused xcan_suspend(struct device *dev)
  */
 static int __maybe_unused xcan_resume(struct device *dev)
 {
-        if (!device_may_wakeup(dev))
-                return pm_runtime_force_resume(dev);
+        struct net_device *ndev = dev_get_drvdata(dev);
+        int ret;
 
-        return 0;
+        ret = pm_runtime_force_resume(dev);
+        if (ret) {
+                dev_err(dev, "pm_runtime_force_resume failed on resume\n");
+                return ret;
+        }
+
+        if (netif_running(ndev)) {
+                ret = xcan_chip_start(ndev);
+                if (ret) {
+                        dev_err(dev, "xcan_chip_start failed on resume\n");
+                        return ret;
+                }
+
+                netif_device_attach(ndev);
+                netif_start_queue(ndev);
+        }
 
+        return 0;
 }
 
 /**
@@ -992,14 +1174,6 @@ static int __maybe_unused xcan_runtime_suspend(struct device *dev)
         struct net_device *ndev = dev_get_drvdata(dev);
         struct xcan_priv *priv = netdev_priv(ndev);
 
-        if (netif_running(ndev)) {
-                netif_stop_queue(ndev);
-                netif_device_detach(ndev);
-        }
-
-        priv->write_reg(priv, XCAN_MSR_OFFSET, XCAN_MSR_SLEEP_MASK);
-        priv->can.state = CAN_STATE_SLEEPING;
-
         clk_disable_unprepare(priv->bus_clk);
         clk_disable_unprepare(priv->can_clk);
 
@@ -1018,7 +1192,6 @@ static int __maybe_unused xcan_runtime_resume(struct device *dev)
         struct net_device *ndev = dev_get_drvdata(dev);
         struct xcan_priv *priv = netdev_priv(ndev);
         int ret;
-        u32 isr, status;
 
         ret = clk_prepare_enable(priv->bus_clk);
         if (ret) {
@@ -1032,27 +1205,6 @@ static int __maybe_unused xcan_runtime_resume(struct device *dev)
                 return ret;
         }
 
-        priv->write_reg(priv, XCAN_SRR_OFFSET, XCAN_SRR_RESET_MASK);
-        isr = priv->read_reg(priv, XCAN_ISR_OFFSET);
-        status = priv->read_reg(priv, XCAN_SR_OFFSET);
-
-        if (netif_running(ndev)) {
-                if (isr & XCAN_IXR_BSOFF_MASK) {
-                        priv->can.state = CAN_STATE_BUS_OFF;
-                        priv->write_reg(priv, XCAN_SRR_OFFSET,
-                                        XCAN_SRR_RESET_MASK);
-                } else if ((status & XCAN_SR_ESTAT_MASK) ==
-                                        XCAN_SR_ESTAT_MASK) {
-                        priv->can.state = CAN_STATE_ERROR_PASSIVE;
-                } else if (status & XCAN_SR_ERRWRN_MASK) {
-                        priv->can.state = CAN_STATE_ERROR_WARNING;
-                } else {
-                        priv->can.state = CAN_STATE_ERROR_ACTIVE;
-                }
-                netif_device_attach(ndev);
-                netif_start_queue(ndev);
-        }
-
         return 0;
 }
 
@@ -1061,6 +1213,18 @@ static const struct dev_pm_ops xcan_dev_pm_ops = {
         SET_RUNTIME_PM_OPS(xcan_runtime_suspend, xcan_runtime_resume, NULL)
 };
 
+static const struct xcan_devtype_data xcan_zynq_data = {
+        .caps = XCAN_CAP_WATERMARK,
+};
+
+/* Match table for OF platform binding */
+static const struct of_device_id xcan_of_match[] = {
+        { .compatible = "xlnx,zynq-can-1.0", .data = &xcan_zynq_data },
+        { .compatible = "xlnx,axi-can-1.00.a", },
+        { /* end of list */ },
+};
+MODULE_DEVICE_TABLE(of, xcan_of_match);
+
 /**
  * xcan_probe - Platform registration call
  * @pdev:       Handle to the platform device structure
@@ -1075,8 +1239,10 @@ static int xcan_probe(struct platform_device *pdev)
         struct resource *res; /* IO mem resources */
         struct net_device *ndev;
         struct xcan_priv *priv;
+        const struct of_device_id *of_id;
+        int caps = 0;
         void __iomem *addr;
-        int ret, rx_max, tx_max;
+        int ret, rx_max, tx_max, tx_fifo_depth;
 
         /* Get the virtual base address for the device */
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -1086,7 +1252,8 @@ static int xcan_probe(struct platform_device *pdev)
                 goto err;
         }
 
-        ret = of_property_read_u32(pdev->dev.of_node, "tx-fifo-depth", &tx_max);
+        ret = of_property_read_u32(pdev->dev.of_node, "tx-fifo-depth",
+                                   &tx_fifo_depth);
         if (ret < 0)
                 goto err;
 
@@ -1094,6 +1261,30 @@ static int xcan_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto err;
 
+        of_id = of_match_device(xcan_of_match, &pdev->dev);
+        if (of_id) {
+                const struct xcan_devtype_data *devtype_data = of_id->data;
+
+                if (devtype_data)
+                        caps = devtype_data->caps;
+        }
+
+        /* There is no way to directly figure out how many frames have been
+         * sent when the TXOK interrupt is processed. If watermark programming
+         * is supported, we can have 2 frames in the FIFO and use TXFEMP
+         * to determine if 1 or 2 frames have been sent.
+         * Theoretically we should be able to use TXFWMEMP to determine up
+         * to 3 frames, but it seems that after putting a second frame in the
+         * FIFO, with watermark at 2 frames, it can happen that TXFWMEMP (less
+         * than 2 frames in FIFO) is set anyway with no TXOK (a frame was
+         * sent), which is not a sensible state - possibly TXFWMEMP is not
+         * completely synchronized with the rest of the bits?
+         */
+        if (caps & XCAN_CAP_WATERMARK)
+                tx_max = min(tx_fifo_depth, 2);
+        else
+                tx_max = 1;
+
         /* Create a CAN device instance */
         ndev = alloc_candev(sizeof(struct xcan_priv), tx_max);
         if (!ndev)
@@ -1108,6 +1299,7 @@ static int xcan_probe(struct platform_device *pdev)
                                         CAN_CTRLMODE_BERR_REPORTING;
         priv->reg_base = addr;
         priv->tx_max = tx_max;
+        spin_lock_init(&priv->tx_lock);
 
         /* Get IRQ for the device */
         ndev->irq = platform_get_irq(pdev, 0);
@@ -1172,9 +1364,9 @@ static int xcan_probe(struct platform_device *pdev)
 
         pm_runtime_put(&pdev->dev);
 
-        netdev_dbg(ndev, "reg_base=0x%p irq=%d clock=%d, tx fifo depth:%d\n",
+        netdev_dbg(ndev, "reg_base=0x%p irq=%d clock=%d, tx fifo depth: actual %d, using %d\n",
                         priv->reg_base, ndev->irq, priv->can.clock.freq,
-                        priv->tx_max);
+                        tx_fifo_depth, priv->tx_max);
 
         return 0;
 
@@ -1208,14 +1400,6 @@ static int xcan_remove(struct platform_device *pdev)
         return 0;
 }
 
-/* Match table for OF platform binding */
-static const struct of_device_id xcan_of_match[] = {
-        { .compatible = "xlnx,zynq-can-1.0", },
-        { .compatible = "xlnx,axi-can-1.00.a", },
-        { /* end of list */ },
-};
-MODULE_DEVICE_TABLE(of, xcan_of_match);
-
 static struct platform_driver xcan_driver = {
         .probe = xcan_probe,
         .remove = xcan_remove,
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 437cd6eb4faa..bb28c701381a 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -343,6 +343,7 @@ static const struct irq_domain_ops mv88e6xxx_g1_irq_domain_ops = {
         .xlate  = irq_domain_xlate_twocell,
 };
 
+/* To be called with reg_lock held */
 static void mv88e6xxx_g1_irq_free_common(struct mv88e6xxx_chip *chip)
 {
         int irq, virq;
@@ -362,9 +363,15 @@ static void mv88e6xxx_g1_irq_free_common(struct mv88e6xxx_chip *chip)
 
 static void mv88e6xxx_g1_irq_free(struct mv88e6xxx_chip *chip)
 {
-        mv88e6xxx_g1_irq_free_common(chip);
-
+        /*
+         * free_irq must be called without reg_lock taken because the irq
+         * handler takes this lock, too.
+         */
         free_irq(chip->irq, chip);
+
+        mutex_lock(&chip->reg_lock);
+        mv88e6xxx_g1_irq_free_common(chip);
+        mutex_unlock(&chip->reg_lock);
 }
 
 static int mv88e6xxx_g1_irq_setup_common(struct mv88e6xxx_chip *chip)
@@ -469,10 +476,12 @@ static int mv88e6xxx_irq_poll_setup(struct mv88e6xxx_chip *chip)
 
 static void mv88e6xxx_irq_poll_free(struct mv88e6xxx_chip *chip)
 {
-        mv88e6xxx_g1_irq_free_common(chip);
-
         kthread_cancel_delayed_work_sync(&chip->irq_poll_work);
         kthread_destroy_worker(chip->kworker);
+
+        mutex_lock(&chip->reg_lock);
+        mv88e6xxx_g1_irq_free_common(chip);
+        mutex_unlock(&chip->reg_lock);
 }
 
 int mv88e6xxx_wait(struct mv88e6xxx_chip *chip, int addr, int reg, u16 mask)
@@ -2608,7 +2617,6 @@ static const struct mv88e6xxx_ops mv88e6085_ops = {
         .rmu_disable = mv88e6085_g1_rmu_disable,
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
-        .serdes_power = mv88e6341_serdes_power,
 };
 
 static const struct mv88e6xxx_ops mv88e6095_ops = {
@@ -2774,6 +2782,7 @@ static const struct mv88e6xxx_ops mv88e6141_ops = {
         .reset = mv88e6352_g1_reset,
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
+        .serdes_power = mv88e6341_serdes_power,
         .gpio_ops = &mv88e6352_gpio_ops,
 };
 
@@ -2951,7 +2960,6 @@ static const struct mv88e6xxx_ops mv88e6175_ops = {
         .reset = mv88e6352_g1_reset,
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
-        .serdes_power = mv88e6341_serdes_power,
 };
 
 static const struct mv88e6xxx_ops mv88e6176_ops = {
@@ -3327,6 +3335,7 @@ static const struct mv88e6xxx_ops mv88e6341_ops = {
         .reset = mv88e6352_g1_reset,
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
+        .serdes_power = mv88e6341_serdes_power,
         .gpio_ops = &mv88e6352_gpio_ops,
         .avb_ops = &mv88e6390_avb_ops,
 };
@@ -4506,12 +4515,10 @@ out_g2_irq:
         if (chip->info->g2_irqs > 0)
                 mv88e6xxx_g2_irq_free(chip);
 out_g1_irq:
-        mutex_lock(&chip->reg_lock);
         if (chip->irq > 0)
                 mv88e6xxx_g1_irq_free(chip);
         else
                 mv88e6xxx_irq_poll_free(chip);
-        mutex_unlock(&chip->reg_lock);
 out:
         if (pdata)
                 dev_put(pdata->netdev);
@@ -4539,12 +4546,10 @@ static void mv88e6xxx_remove(struct mdio_device *mdiodev)
         if (chip->info->g2_irqs > 0)
                 mv88e6xxx_g2_irq_free(chip);
 
-        mutex_lock(&chip->reg_lock);
         if (chip->irq > 0)
                 mv88e6xxx_g1_irq_free(chip);
         else
                 mv88e6xxx_irq_poll_free(chip);
-        mutex_unlock(&chip->reg_lock);
 }
 
 static const struct of_device_id mv88e6xxx_of_match[] = {
diff --git a/drivers/net/ethernet/3com/Kconfig b/drivers/net/ethernet/3com/Kconfig
index 5b7658bcf020..5c3ef9fc8207 100644
--- a/drivers/net/ethernet/3com/Kconfig
+++ b/drivers/net/ethernet/3com/Kconfig
@@ -32,7 +32,7 @@ config EL3
 
 config 3C515
         tristate "3c515 ISA \"Fast EtherLink\""
-        depends on ISA && ISA_DMA_API
+        depends on ISA && ISA_DMA_API && !PPC32
         ---help---
           If you have a 3Com ISA EtherLink XL "Corkscrew" 3c515 Fast Ethernet
           network card, say Y here.
diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index 1b9d3130af4d..17f12c18d225 100644
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -333,6 +333,7 @@ static int ena_com_init_io_sq(struct ena_com_dev *ena_dev,
 
         memset(&io_sq->desc_addr, 0x0, sizeof(io_sq->desc_addr));
 
+        io_sq->dma_addr_bits = ena_dev->dma_addr_bits;
         io_sq->desc_entry_size =
                 (io_sq->direction == ENA_COM_IO_QUEUE_DIRECTION_TX) ?
                 sizeof(struct ena_eth_io_tx_desc) :
diff --git a/drivers/net/ethernet/amd/Kconfig b/drivers/net/ethernet/amd/Kconfig
index f273af136fc7..9e5cf5583c87 100644
--- a/drivers/net/ethernet/amd/Kconfig
+++ b/drivers/net/ethernet/amd/Kconfig
@@ -44,7 +44,7 @@ config AMD8111_ETH
 
 config LANCE
         tristate "AMD LANCE and PCnet (AT1500 and NE2100) support"
-        depends on ISA && ISA_DMA_API && !ARM
+        depends on ISA && ISA_DMA_API && !ARM && !PPC32
         ---help---
           If you have a network (Ethernet) card of this type, say Y here.
           Some LinkSys cards are of this type.
@@ -138,7 +138,7 @@ config PCMCIA_NMCLAN
 
 config NI65
         tristate "NI6510 support"
-        depends on ISA && ISA_DMA_API && !ARM
+        depends on ISA && ISA_DMA_API && !ARM && !PPC32
         ---help---
           If you have a network (Ethernet) card of this type, say Y here.
 
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
index 4b5d625de8f0..8a3a60bb2688 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
@@ -1111,14 +1111,14 @@ static void xgbe_phy_adjust_link(struct xgbe_prv_data *pdata)
 
                 if (pdata->tx_pause != pdata->phy.tx_pause) {
                         new_state = 1;
-                        pdata->hw_if.config_tx_flow_control(pdata);
                         pdata->tx_pause = pdata->phy.tx_pause;
+                        pdata->hw_if.config_tx_flow_control(pdata);
                 }
 
                 if (pdata->rx_pause != pdata->phy.rx_pause) {
                         new_state = 1;
-                        pdata->hw_if.config_rx_flow_control(pdata);
                         pdata->rx_pause = pdata->phy.rx_pause;
+                        pdata->hw_if.config_rx_flow_control(pdata);
                 }
 
                 /* Speed support */
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
index fc7383106946..91eb8910b1c9 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
@@ -63,8 +63,6 @@
 
 #define AQ_CFG_NAPI_WEIGHT     64U
 
-#define AQ_CFG_MULTICAST_ADDRESS_MAX     32U
-
 /*#define AQ_CFG_MAC_ADDR_PERMANENT {0x30, 0x0E, 0xE3, 0x12, 0x34, 0x56}*/
 
 #define AQ_NIC_FC_OFF    0U
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
index a2d416b24ffc..2c6ebd91a9f2 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
@@ -98,6 +98,8 @@ struct aq_stats_s {
 #define AQ_HW_MEDIA_TYPE_TP    1U
 #define AQ_HW_MEDIA_TYPE_FIBRE 2U
 
+#define AQ_HW_MULTICAST_ADDRESS_MAX     32U
+
 struct aq_hw_s {
         atomic_t flags;
         u8 rbl_enabled:1;
@@ -177,7 +179,7 @@ struct aq_hw_ops {
                                     unsigned int packet_filter);
 
         int (*hw_multicast_list_set)(struct aq_hw_s *self,
-                                     u8 ar_mac[AQ_CFG_MULTICAST_ADDRESS_MAX]
+                                     u8 ar_mac[AQ_HW_MULTICAST_ADDRESS_MAX]
                                      [ETH_ALEN],
                                      u32 count);
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
index ba5fe8c4125d..e3ae29e523f0 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
@@ -135,17 +135,10 @@ err_exit:
 static void aq_ndev_set_multicast_settings(struct net_device *ndev)
 {
         struct aq_nic_s *aq_nic = netdev_priv(ndev);
-        int err = 0;
 
-        err = aq_nic_set_packet_filter(aq_nic, ndev->flags);
-        if (err < 0)
-                return;
+        aq_nic_set_packet_filter(aq_nic, ndev->flags);
 
-        if (netdev_mc_count(ndev)) {
-                err = aq_nic_set_multicast_list(aq_nic, ndev);
-                if (err < 0)
-                        return;
-        }
+        aq_nic_set_multicast_list(aq_nic, ndev);
 }
 
 static const struct net_device_ops aq_ndev_ops = {
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index 1a1a6380c128..7a22d0257e04 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -563,34 +563,41 @@ err_exit:
 
 int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev)
 {
+        unsigned int packet_filter = self->packet_filter;
         struct netdev_hw_addr *ha = NULL;
         unsigned int i = 0U;
 
-        self->mc_list.count = 0U;
-
-        netdev_for_each_mc_addr(ha, ndev) {
-                ether_addr_copy(self->mc_list.ar[i++], ha->addr);
-                ++self->mc_list.count;
+        self->mc_list.count = 0;
+        if (netdev_uc_count(ndev) > AQ_HW_MULTICAST_ADDRESS_MAX) {
+                packet_filter |= IFF_PROMISC;
+        } else {
+                netdev_for_each_uc_addr(ha, ndev) {
+                        ether_addr_copy(self->mc_list.ar[i++], ha->addr);
 
-                if (i >= AQ_CFG_MULTICAST_ADDRESS_MAX)
-                        break;
+                        if (i >= AQ_HW_MULTICAST_ADDRESS_MAX)
+                                break;
+                }
         }
 
-        if (i >= AQ_CFG_MULTICAST_ADDRESS_MAX) {
-                /* Number of filters is too big: atlantic does not support this.
-                 * Force all multi filter to support this.
-                 * With this we disable all UC filters and setup "all pass"
-                 * multicast mask
-                 */
-                self->packet_filter |= IFF_ALLMULTI;
-                self->aq_nic_cfg.mc_list_count = 0;
-                return self->aq_hw_ops->hw_packet_filter_set(self->aq_hw,
-                                                             self->packet_filter);
+        if (i + netdev_mc_count(ndev) > AQ_HW_MULTICAST_ADDRESS_MAX) {
+                packet_filter |= IFF_ALLMULTI;
         } else {
-                return self->aq_hw_ops->hw_multicast_list_set(self->aq_hw,
-                                                    self->mc_list.ar,
-                                                    self->mc_list.count);
+                netdev_for_each_mc_addr(ha, ndev) {
+                        ether_addr_copy(self->mc_list.ar[i++], ha->addr);
+
+                        if (i >= AQ_HW_MULTICAST_ADDRESS_MAX)
+                                break;
+                }
+        }
+
+        if (i > 0 && i < AQ_HW_MULTICAST_ADDRESS_MAX) {
+                packet_filter |= IFF_MULTICAST;
+                self->mc_list.count = i;
+                self->aq_hw_ops->hw_multicast_list_set(self->aq_hw,
+                                                       self->mc_list.ar,
+                                                       self->mc_list.count);
         }
+        return aq_nic_set_packet_filter(self, packet_filter);
 }
 
 int aq_nic_set_mtu(struct aq_nic_s *self, int new_mtu)
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
index faa533a0ec47..fecfc401f95d 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
@@ -75,7 +75,7 @@ struct aq_nic_s {
         struct aq_hw_link_status_s link_status;
         struct {
                 u32 count;
-                u8 ar[AQ_CFG_MULTICAST_ADDRESS_MAX][ETH_ALEN];
+                u8 ar[AQ_HW_MULTICAST_ADDRESS_MAX][ETH_ALEN];
         } mc_list;
 
         struct pci_dev *pdev;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
index 67e2f9fb9402..8cc6abadc03b 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
@@ -765,7 +765,7 @@ static int hw_atl_a0_hw_packet_filter_set(struct aq_hw_s *self,
 
 static int hw_atl_a0_hw_multicast_list_set(struct aq_hw_s *self,
                                            u8 ar_mac
-                                           [AQ_CFG_MULTICAST_ADDRESS_MAX]
+                                           [AQ_HW_MULTICAST_ADDRESS_MAX]
                                            [ETH_ALEN],
                                            u32 count)
 {
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index 819f6bcf9b4e..956860a69797 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -784,7 +784,7 @@ static int hw_atl_b0_hw_packet_filter_set(struct aq_hw_s *self,
 
 static int hw_atl_b0_hw_multicast_list_set(struct aq_hw_s *self,
                                            u8 ar_mac
-                                           [AQ_CFG_MULTICAST_ADDRESS_MAX]
+                                           [AQ_HW_MULTICAST_ADDRESS_MAX]
                                            [ETH_ALEN],
                                            u32 count)
 {
@@ -812,7 +812,7 @@ static int hw_atl_b0_hw_multicast_list_set(struct aq_hw_s *self,
 
                 hw_atl_rpfl2_uc_flr_en_set(self,
                                            (self->aq_nic_cfg->is_mc_list_enabled),
-                                    HW_ATL_B0_MAC_MIN + i);
+                                           HW_ATL_B0_MAC_MIN + i);
         }
 
         err = aq_hw_err_from_flags(self);
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 94270f654b3b..7087b88550db 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -1686,6 +1686,7 @@ static struct sk_buff *atl1c_alloc_skb(struct atl1c_adapter *adapter)
         skb = build_skb(page_address(page) + adapter->rx_page_offset,
                         adapter->rx_frag_size);
         if (likely(skb)) {
+                skb_reserve(skb, NET_SKB_PAD);
                 adapter->rx_page_offset += adapter->rx_frag_size;
                 if (adapter->rx_page_offset >= PAGE_SIZE)
                         adapter->rx_page = NULL;
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index d5fca2e5a9bc..a1f60f89e059 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1946,8 +1946,8 @@ static int bcm_sysport_open(struct net_device *dev)
         if (!priv->is_lite)
                 priv->crc_fwd = !!(umac_readl(priv, UMAC_CMD) & CMD_CRC_FWD);
         else
-                priv->crc_fwd = !!(gib_readl(priv, GIB_CONTROL) &
-                                   GIB_FCS_STRIP);
+                priv->crc_fwd = !((gib_readl(priv, GIB_CONTROL) &
+                                  GIB_FCS_STRIP) >> GIB_FCS_STRIP_SHIFT);
 
         phydev = of_phy_connect(dev, priv->phy_dn, bcm_sysport_adj_link,
                                 0, priv->phy_interface);
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h
index d6e5d0cbf3a3..cf440b91fd04 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.h
+++ b/drivers/net/ethernet/broadcom/bcmsysport.h
@@ -278,7 +278,8 @@ struct bcm_rsb {
 #define  GIB_GTX_CLK_EXT_CLK            (0 << GIB_GTX_CLK_SEL_SHIFT)
 #define  GIB_GTX_CLK_125MHZ             (1 << GIB_GTX_CLK_SEL_SHIFT)
 #define  GIB_GTX_CLK_250MHZ             (2 << GIB_GTX_CLK_SEL_SHIFT)
-#define  GIB_FCS_STRIP                  (1 << 6)
+#define  GIB_FCS_STRIP_SHIFT            6
+#define  GIB_FCS_STRIP                  (1 << GIB_FCS_STRIP_SHIFT)
 #define  GIB_LCL_LOOP_EN                (1 << 7)
 #define  GIB_LCL_LOOP_TXEN              (1 << 8)
 #define  GIB_RMT_LOOP_EN                (1 << 9)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index da18aa239acb..a4a90b6cdb46 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -3388,14 +3388,18 @@ static int bnx2x_set_rss_flags(struct bnx2x *bp, struct ethtool_rxnfc *info)
                         DP(BNX2X_MSG_ETHTOOL,
                            "rss re-configured, UDP 4-tupple %s\n",
                            udp_rss_requested ? "enabled" : "disabled");
-                        return bnx2x_rss(bp, &bp->rss_conf_obj, false, true);
+                        if (bp->state == BNX2X_STATE_OPEN)
+                                return bnx2x_rss(bp, &bp->rss_conf_obj, false,
+                                                 true);
                 } else if ((info->flow_type == UDP_V6_FLOW) &&
                            (bp->rss_conf_obj.udp_rss_v6 != udp_rss_requested)) {
                         bp->rss_conf_obj.udp_rss_v6 = udp_rss_requested;
                         DP(BNX2X_MSG_ETHTOOL,
                            "rss re-configured, UDP 4-tupple %s\n",
                            udp_rss_requested ? "enabled" : "disabled");
-                        return bnx2x_rss(bp, &bp->rss_conf_obj, false, true);
+                        if (bp->state == BNX2X_STATE_OPEN)
+                                return bnx2x_rss(bp, &bp->rss_conf_obj, false,
+                                                 true);
                 }
                 return 0;
 
@@ -3509,7 +3513,10 @@ static int bnx2x_set_rxfh(struct net_device *dev, const u32 *indir,
                 bp->rss_conf_obj.ind_table[i] = indir[i] + bp->fp->cl_id;
         }
 
-        return bnx2x_config_rss_eth(bp, false);
+        if (bp->state == BNX2X_STATE_OPEN)
+                return bnx2x_config_rss_eth(bp, false);
+
+        return 0;
 }
 
 /**
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 176fc9f4d7de..4394c1162be4 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -5712,7 +5712,9 @@ static int bnxt_init_chip(struct bnxt *bp, bool irq_re_init)
         }
         vnic->uc_filter_count = 1;
 
-        vnic->rx_mask = CFA_L2_SET_RX_MASK_REQ_MASK_BCAST;
+        vnic->rx_mask = 0;
+        if (bp->dev->flags & IFF_BROADCAST)
+                vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_BCAST;
 
         if ((bp->dev->flags & IFF_PROMISC) && bnxt_promisc_ok(bp))
                 vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS;
@@ -5917,7 +5919,7 @@ unsigned int bnxt_get_max_func_irqs(struct bnxt *bp)
         return min_t(unsigned int, hw_resc->max_irqs, hw_resc->max_cp_rings);
 }
 
-void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max_irqs)
+static void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max_irqs)
 {
         bp->hw_resc.max_irqs = max_irqs;
 }
@@ -6888,7 +6890,7 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
                 rc = bnxt_request_irq(bp);
                 if (rc) {
                         netdev_err(bp->dev, "bnxt_request_irq err: %x\n", rc);
-                        goto open_err;
+                        goto open_err_irq;
                 }
         }
 
@@ -6928,6 +6930,8 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
 open_err:
         bnxt_debug_dev_exit(bp);
         bnxt_disable_napi(bp);
+
+open_err_irq:
         bnxt_del_napi(bp);
 
 open_err_free_mem:
@@ -7214,13 +7218,16 @@ static void bnxt_set_rx_mode(struct net_device *dev)
 
         mask &= ~(CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS |
                   CFA_L2_SET_RX_MASK_REQ_MASK_MCAST |
-                  CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST);
+                  CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST |
+                  CFA_L2_SET_RX_MASK_REQ_MASK_BCAST);
 
         if ((dev->flags & IFF_PROMISC) && bnxt_promisc_ok(bp))
                 mask |= CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS;
 
         uc_update = bnxt_uc_list_updated(bp);
 
+        if (dev->flags & IFF_BROADCAST)
+                mask |= CFA_L2_SET_RX_MASK_REQ_MASK_BCAST;
         if (dev->flags & IFF_ALLMULTI) {
                 mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST;
                 vnic->mc_list_count = 0;
@@ -8502,11 +8509,11 @@ int bnxt_get_max_rings(struct bnxt *bp, int *max_rx, int *max_tx, bool shared)
         int rx, tx, cp;
 
         _bnxt_get_max_rings(bp, &rx, &tx, &cp);
+        *max_rx = rx;
+        *max_tx = tx;
         if (!rx || !tx || !cp)
                 return -ENOMEM;
 
-        *max_rx = rx;
-        *max_tx = tx;
         return bnxt_trim_rings(bp, max_rx, max_tx, cp, shared);
 }
 
@@ -8520,8 +8527,11 @@ static int bnxt_get_dflt_rings(struct bnxt *bp, int *max_rx, int *max_tx,
                 /* Not enough rings, try disabling agg rings. */
                 bp->flags &= ~BNXT_FLAG_AGG_RINGS;
                 rc = bnxt_get_max_rings(bp, max_rx, max_tx, shared);
-                if (rc)
+                if (rc) {
+                        /* set BNXT_FLAG_AGG_RINGS back for consistency */
+                        bp->flags |= BNXT_FLAG_AGG_RINGS;
                         return rc;
+                }
                 bp->flags |= BNXT_FLAG_NO_AGG_RINGS;
                 bp->dev->hw_features &= ~(NETIF_F_LRO | NETIF_F_GRO_HW);
                 bp->dev->features &= ~(NETIF_F_LRO | NETIF_F_GRO_HW);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 9b14eb610b9f..91575ef97c8c 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -1470,7 +1470,6 @@ void bnxt_set_max_func_stat_ctxs(struct bnxt *bp, unsigned int max);
 unsigned int bnxt_get_max_func_cp_rings(struct bnxt *bp);
 void bnxt_set_max_func_cp_rings(struct bnxt *bp, unsigned int max);
 unsigned int bnxt_get_max_func_irqs(struct bnxt *bp);
-void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max);
 int bnxt_get_avail_msix(struct bnxt *bp, int num);
 int bnxt_reserve_rings(struct bnxt *bp);
 void bnxt_tx_disable(struct bnxt *bp);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index 795f45024c20..491bd40a254d 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -27,6 +27,15 @@
 #define BNXT_FID_INVALID                        0xffff
 #define VLAN_TCI(vid, prio)     ((vid) | ((prio) << VLAN_PRIO_SHIFT))
 
+#define is_vlan_pcp_wildcarded(vlan_tci_mask)   \
+        ((ntohs(vlan_tci_mask) & VLAN_PRIO_MASK) == 0x0000)
+#define is_vlan_pcp_exactmatch(vlan_tci_mask)   \
+        ((ntohs(vlan_tci_mask) & VLAN_PRIO_MASK) == VLAN_PRIO_MASK)
+#define is_vlan_pcp_zero(vlan_tci)      \
+        ((ntohs(vlan_tci) & VLAN_PRIO_MASK) == 0x0000)
+#define is_vid_exactmatch(vlan_tci_mask)        \
+        ((ntohs(vlan_tci_mask) & VLAN_VID_MASK) == VLAN_VID_MASK)
+
 /* Return the dst fid of the func for flow forwarding
  * For PFs: src_fid is the fid of the PF
  * For VF-reps: src_fid the fid of the VF
@@ -389,6 +398,21 @@ static bool is_exactmatch(void *mask, int len)
         return true;
 }
 
+static bool is_vlan_tci_allowed(__be16  vlan_tci_mask,
+                                __be16  vlan_tci)
+{
+        /* VLAN priority must be either exactly zero or fully wildcarded and
+         * VLAN id must be exact match.
+         */
+        if (is_vid_exactmatch(vlan_tci_mask) &&
+            ((is_vlan_pcp_exactmatch(vlan_tci_mask) &&
+              is_vlan_pcp_zero(vlan_tci)) ||
+             is_vlan_pcp_wildcarded(vlan_tci_mask)))
+                return true;
+
+        return false;
+}
+
 static bool bits_set(void *key, int len)
 {
         const u8 *p = key;
@@ -803,9 +827,9 @@ static bool bnxt_tc_can_offload(struct bnxt *bp, struct bnxt_tc_flow *flow)
         /* Currently VLAN fields cannot be partial wildcard */
         if (bits_set(&flow->l2_key.inner_vlan_tci,
                      sizeof(flow->l2_key.inner_vlan_tci)) &&
-            !is_exactmatch(&flow->l2_mask.inner_vlan_tci,
-                           sizeof(flow->l2_mask.inner_vlan_tci))) {
-                netdev_info(bp->dev, "Wildcard match unsupported for VLAN TCI\n");
+            !is_vlan_tci_allowed(flow->l2_mask.inner_vlan_tci,
+                                 flow->l2_key.inner_vlan_tci)) {
+                netdev_info(bp->dev, "Unsupported VLAN TCI\n");
                 return false;
         }
         if (bits_set(&flow->l2_key.inner_vlan_tpid,
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
index 347e4f946eb2..840f6e505f73 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
@@ -169,7 +169,6 @@ static int bnxt_req_msix_vecs(struct bnxt_en_dev *edev, int ulp_id,
                 edev->ulp_tbl[ulp_id].msix_requested = avail_msix;
         }
         bnxt_fill_msix_vecs(bp, ent);
-        bnxt_set_max_func_irqs(bp, bnxt_get_max_func_irqs(bp) - avail_msix);
         bnxt_set_max_func_cp_rings(bp, max_cp_rings - avail_msix);
         edev->flags |= BNXT_EN_FLAG_MSIX_REQUESTED;
         return avail_msix;
@@ -192,7 +191,6 @@ static int bnxt_free_msix_vecs(struct bnxt_en_dev *edev, int ulp_id)
         msix_requested = edev->ulp_tbl[ulp_id].msix_requested;
         bnxt_set_max_func_cp_rings(bp, max_cp_rings + msix_requested);
         edev->ulp_tbl[ulp_id].msix_requested = 0;
-        bnxt_set_max_func_irqs(bp, bnxt_get_max_func_irqs(bp) + msix_requested);
         edev->flags &= ~BNXT_EN_FLAG_MSIX_REQUESTED;
         if (netif_running(dev)) {
                 bnxt_close_nic(bp, true, false);
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 3be87efdc93d..aa1374d0af93 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -6,11 +6,15 @@
  * Copyright (C) 2004 Sun Microsystems Inc.
  * Copyright (C) 2005-2016 Broadcom Corporation.
  * Copyright (C) 2016-2017 Broadcom Limited.
+ * Copyright (C) 2018 Broadcom. All Rights Reserved. The term "Broadcom"
+ * refers to Broadcom Inc. and/or its subsidiaries.
  *
  * Firmware is:
  *      Derived from proprietary unpublished source code,
  *      Copyright (C) 2000-2016 Broadcom Corporation.
  *      Copyright (C) 2016-2017 Broadcom Ltd.
+ *      Copyright (C) 2018 Broadcom. All Rights Reserved. The term "Broadcom"
+ *      refers to Broadcom Inc. and/or its subsidiaries.
  *
  *      Permission is hereby granted for the distribution of this firmware
  *      data in hexadecimal or equivalent format, provided this copyright
@@ -9290,6 +9294,15 @@ static int tg3_chip_reset(struct tg3 *tp)
 
         tg3_restore_clk(tp);
 
+        /* Increase the core clock speed to fix tx timeout issue for 5762
+         * with 100Mbps link speed.
+         */
+        if (tg3_asic_rev(tp) == ASIC_REV_5762) {
+                val = tr32(TG3_CPMU_CLCK_ORIDE_ENABLE);
+                tw32(TG3_CPMU_CLCK_ORIDE_ENABLE, val |
+                     TG3_CPMU_MAC_ORIDE_ENABLE);
+        }
+
         /* Reprobe ASF enable state.  */
         tg3_flag_clear(tp, ENABLE_ASF);
         tp->phy_flags &= ~(TG3_PHYFLG_1G_ON_VAUX_OK |
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index 1d61aa3efda1..a772a33b685c 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -7,6 +7,8 @@
  * Copyright (C) 2004 Sun Microsystems Inc.
  * Copyright (C) 2007-2016 Broadcom Corporation.
  * Copyright (C) 2016-2017 Broadcom Limited.
+ * Copyright (C) 2018 Broadcom. All Rights Reserved. The term "Broadcom"
+ * refers to Broadcom Inc. and/or its subsidiaries.
  */
 
 #ifndef _T3_H
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index 86659823b259..3d45f4c92cf6 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -166,6 +166,7 @@
 #define GEM_DCFG6               0x0294 /* Design Config 6 */
 #define GEM_DCFG7               0x0298 /* Design Config 7 */
 #define GEM_DCFG8               0x029C /* Design Config 8 */
+#define GEM_DCFG10              0x02A4 /* Design Config 10 */
 
 #define GEM_TXBDCTRL    0x04cc /* TX Buffer Descriptor control register */
 #define GEM_RXBDCTRL    0x04d0 /* RX Buffer Descriptor control register */
@@ -490,6 +491,12 @@
 #define GEM_SCR2CMP_OFFSET                      0
 #define GEM_SCR2CMP_SIZE                        8
 
+/* Bitfields in DCFG10 */
+#define GEM_TXBD_RDBUFF_OFFSET                  12
+#define GEM_TXBD_RDBUFF_SIZE                    4
+#define GEM_RXBD_RDBUFF_OFFSET                  8
+#define GEM_RXBD_RDBUFF_SIZE                    4
+
 /* Bitfields in TISUBN */
 #define GEM_SUBNSINCR_OFFSET                    0
 #define GEM_SUBNSINCR_SIZE                      16
@@ -635,6 +642,7 @@
 #define MACB_CAPS_USRIO_DISABLED                0x00000010
 #define MACB_CAPS_JUMBO                         0x00000020
 #define MACB_CAPS_GEM_HAS_PTP                   0x00000040
+#define MACB_CAPS_BD_RD_PREFETCH                0x00000080
 #define MACB_CAPS_FIFO_MODE                     0x10000000
 #define MACB_CAPS_GIGABIT_MODE_AVAILABLE        0x20000000
 #define MACB_CAPS_SG_DISABLED                   0x40000000
@@ -1203,6 +1211,9 @@ struct macb {
         unsigned int max_tuples;
 
         struct tasklet_struct   hresp_err_tasklet;
+
+        int     rx_bd_rd_prefetch;
+        int     tx_bd_rd_prefetch;
 };
 
 #ifdef CONFIG_MACB_USE_HWSTAMP
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 96cc03a6d942..a6c911bb5ce2 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -1811,23 +1811,25 @@ static void macb_free_consistent(struct macb *bp)
 {
         struct macb_queue *queue;
         unsigned int q;
+        int size;
 
-        queue = &bp->queues[0];
         bp->macbgem_ops.mog_free_rx_buffers(bp);
-        if (queue->rx_ring) {
-                dma_free_coherent(&bp->pdev->dev, RX_RING_BYTES(bp),
-                                queue->rx_ring, queue->rx_ring_dma);
-                queue->rx_ring = NULL;
-        }
 
         for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
                 kfree(queue->tx_skb);
                 queue->tx_skb = NULL;
                 if (queue->tx_ring) {
-                        dma_free_coherent(&bp->pdev->dev, TX_RING_BYTES(bp),
+                        size = TX_RING_BYTES(bp) + bp->tx_bd_rd_prefetch;
+                        dma_free_coherent(&bp->pdev->dev, size,
                                           queue->tx_ring, queue->tx_ring_dma);
                         queue->tx_ring = NULL;
                 }
+                if (queue->rx_ring) {
+                        size = RX_RING_BYTES(bp) + bp->rx_bd_rd_prefetch;
+                        dma_free_coherent(&bp->pdev->dev, size,
+                                          queue->rx_ring, queue->rx_ring_dma);
+                        queue->rx_ring = NULL;
+                }
         }
 }
 
@@ -1874,7 +1876,7 @@ static int macb_alloc_consistent(struct macb *bp)
         int size;
 
         for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
-                size = TX_RING_BYTES(bp);
+                size = TX_RING_BYTES(bp) + bp->tx_bd_rd_prefetch;
                 queue->tx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
                                                     &queue->tx_ring_dma,
                                                     GFP_KERNEL);
@@ -1890,7 +1892,7 @@ static int macb_alloc_consistent(struct macb *bp)
                 if (!queue->tx_skb)
                         goto out_err;
 
-                size = RX_RING_BYTES(bp);
+                size = RX_RING_BYTES(bp) + bp->rx_bd_rd_prefetch;
                 queue->rx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
                                                  &queue->rx_ring_dma, GFP_KERNEL);
                 if (!queue->rx_ring)
@@ -3797,7 +3799,7 @@ static const struct macb_config np4_config = {
 static const struct macb_config zynqmp_config = {
         .caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE |
                         MACB_CAPS_JUMBO |
-                        MACB_CAPS_GEM_HAS_PTP,
+                        MACB_CAPS_GEM_HAS_PTP | MACB_CAPS_BD_RD_PREFETCH,
         .dma_burst_length = 16,
         .clk_init = macb_clk_init,
         .init = macb_init,
@@ -3858,7 +3860,7 @@ static int macb_probe(struct platform_device *pdev)
         void __iomem *mem;
         const char *mac;
         struct macb *bp;
-        int err;
+        int err, val;
 
         regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         mem = devm_ioremap_resource(&pdev->dev, regs);
@@ -3947,6 +3949,18 @@ static int macb_probe(struct platform_device *pdev)
         else
                 dev->max_mtu = ETH_DATA_LEN;
 
+        if (bp->caps & MACB_CAPS_BD_RD_PREFETCH) {
+                val = GEM_BFEXT(RXBD_RDBUFF, gem_readl(bp, DCFG10));
+                if (val)
+                        bp->rx_bd_rd_prefetch = (2 << (val - 1)) *
+                                                macb_dma_desc_get_size(bp);
+
+                val = GEM_BFEXT(TXBD_RDBUFF, gem_readl(bp, DCFG10));
+                if (val)
+                        bp->tx_bd_rd_prefetch = (2 << (val - 1)) *
+                                                macb_dma_desc_get_size(bp);
+        }
+
         mac = of_get_mac_address(np);
         if (mac) {
                 ether_addr_copy(bp->dev->dev_addr, mac);
diff --git a/drivers/net/ethernet/cavium/Kconfig b/drivers/net/ethernet/cavium/Kconfig
index 043e3c11c42b..92d88c5f76fb 100644
--- a/drivers/net/ethernet/cavium/Kconfig
+++ b/drivers/net/ethernet/cavium/Kconfig
@@ -15,7 +15,7 @@ if NET_VENDOR_CAVIUM
 
 config THUNDER_NIC_PF
         tristate "Thunder Physical function driver"
-        depends on 64BIT
+        depends on 64BIT && PCI
         select THUNDER_NIC_BGX
         ---help---
           This driver supports Thunder's NIC physical function.
@@ -28,13 +28,13 @@ config THUNDER_NIC_PF
 config THUNDER_NIC_VF
         tristate "Thunder Virtual function driver"
         imply CAVIUM_PTP
-        depends on 64BIT
+        depends on 64BIT && PCI
         ---help---
           This driver supports Thunder's NIC virtual function
 
 config  THUNDER_NIC_BGX
         tristate "Thunder MAC interface driver (BGX)"
-        depends on 64BIT
+        depends on 64BIT && PCI
         select PHYLIB
         select MDIO_THUNDER
         select THUNDER_NIC_RGX
@@ -44,7 +44,7 @@ config	THUNDER_NIC_BGX
 
 config  THUNDER_NIC_RGX
         tristate "Thunder MAC interface driver (RGX)"
-        depends on 64BIT
+        depends on 64BIT && PCI
         select PHYLIB
         select MDIO_THUNDER
         ---help---
@@ -53,7 +53,7 @@ config	THUNDER_NIC_RGX
 
 config CAVIUM_PTP
         tristate "Cavium PTP coprocessor as PTP clock"
-        depends on 64BIT
+        depends on 64BIT && PCI
         imply PTP_1588_CLOCK
         default y
         ---help---
@@ -65,7 +65,7 @@ config CAVIUM_PTP
 
 config LIQUIDIO
         tristate "Cavium LiquidIO support"
-        depends on 64BIT
+        depends on 64BIT && PCI
         depends on MAY_USE_DEVLINK
         imply PTP_1588_CLOCK
         select FW_LOADER
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
index 8a815bb57177..7e8454d3b1ad 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
@@ -91,6 +91,9 @@ static int octeon_console_debug_enabled(u32 console)
  */
 #define LIO_SYNC_OCTEON_TIME_INTERVAL_MS 60000
 
+/* time to wait for possible in-flight requests in milliseconds */
+#define WAIT_INFLIGHT_REQUEST   msecs_to_jiffies(1000)
+
 struct lio_trusted_vf_ctx {
         struct completion complete;
         int status;
@@ -259,7 +262,7 @@ static inline void pcierror_quiesce_device(struct octeon_device *oct)
         force_io_queues_off(oct);
 
         /* To allow for in-flight requests */
-        schedule_timeout_uninterruptible(100);
+        schedule_timeout_uninterruptible(WAIT_INFLIGHT_REQUEST);
 
         if (wait_for_pending_requests(oct))
                 dev_err(&oct->pci_dev->dev, "There were pending requests\n");
diff --git a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
index 3f6afb54a5eb..bb43ddb7539e 100644
--- a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+++ b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
@@ -643,13 +643,21 @@ static int octeon_mgmt_set_mac_address(struct net_device *netdev, void *addr)
 static int octeon_mgmt_change_mtu(struct net_device *netdev, int new_mtu)
 {
         struct octeon_mgmt *p = netdev_priv(netdev);
-        int size_without_fcs = new_mtu + OCTEON_MGMT_RX_HEADROOM;
+        int max_packet = new_mtu + ETH_HLEN + ETH_FCS_LEN;
 
         netdev->mtu = new_mtu;
 
-        cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, size_without_fcs);
+        /* HW lifts the limit if the frame is VLAN tagged
+         * (+4 bytes per each tag, up to two tags)
+         */
+        cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, max_packet);
+        /* Set the hardware to truncate packets larger than the MTU. The jabber
+         * register must be set to a multiple of 8 bytes, so round up. JABBER is
+         * an unconditional limit, so we need to account for two possible VLAN
+         * tags.
+         */
         cvmx_write_csr(p->agl + AGL_GMX_RX_JABBER,
-                       (size_without_fcs + 7) & 0xfff8);
+                       (max_packet + 7 + VLAN_HLEN * 2) & 0xfff8);
 
         return 0;
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
index 7b795edd9d3a..a19172dbe6be 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
@@ -51,6 +51,7 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/uaccess.h>
+#include <linux/nospec.h>
 
 #include "common.h"
 #include "cxgb3_ioctl.h"
@@ -2268,6 +2269,7 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
 
                 if (t.qset_idx >= nqsets)
                         return -EINVAL;
+                t.qset_idx = array_index_nospec(t.qset_idx, nqsets);
 
                 q = &adapter->params.sge.qset[q1 + t.qset_idx];
                 t.rspq_size = q->rspq_size;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index bc03c175a3cd..a8926e97935e 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -3072,6 +3072,7 @@ static void cxgb_del_udp_tunnel(struct net_device *netdev,
 
                 adapter->geneve_port = 0;
                 t4_write_reg(adapter, MPS_RX_GENEVE_TYPE_A, 0);
+                break;
         default:
                 return;
         }
@@ -3157,6 +3158,7 @@ static void cxgb_add_udp_tunnel(struct net_device *netdev,
 
                 t4_write_reg(adapter, MPS_RX_GENEVE_TYPE_A,
                              GENEVE_V(be16_to_cpu(ti->port)) | GENEVE_EN_F);
+                break;
         default:
                 return;
         }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 974a868a4824..3720c3e11ebb 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -8702,7 +8702,7 @@ static int t4_get_flash_params(struct adapter *adap)
         };
 
         unsigned int part, manufacturer;
-        unsigned int density, size;
+        unsigned int density, size = 0;
         u32 flashid = 0;
         int ret;
 
@@ -8772,11 +8772,6 @@ static int t4_get_flash_params(struct adapter *adap)
                 case 0x22: /* 256MB */
                         size = 1 << 28;
                         break;
-
-                default:
-                        dev_err(adap->pdev_dev, "Micron Flash Part has bad size, ID = %#x, Density code = %#x\n",
-                                flashid, density);
-                        return -EINVAL;
                 }
                 break;
         }
@@ -8792,10 +8787,6 @@ static int t4_get_flash_params(struct adapter *adap)
                 case 0x17: /* 64MB */
                         size = 1 << 26;
                         break;
-                default:
-                        dev_err(adap->pdev_dev, "ISSI Flash Part has bad size, ID = %#x, Density code = %#x\n",
-                                flashid, density);
-                        return -EINVAL;
                 }
                 break;
         }
@@ -8811,10 +8802,6 @@ static int t4_get_flash_params(struct adapter *adap)
                 case 0x18: /* 16MB */
                         size = 1 << 24;
                         break;
-                default:
-                        dev_err(adap->pdev_dev, "Macronix Flash Part has bad size, ID = %#x, Density code = %#x\n",
-                                flashid, density);
-                        return -EINVAL;
                 }
                 break;
         }
@@ -8830,17 +8817,21 @@ static int t4_get_flash_params(struct adapter *adap)
                 case 0x18: /* 16MB */
                         size = 1 << 24;
                         break;
-                default:
-                        dev_err(adap->pdev_dev, "Winbond Flash Part has bad size, ID = %#x, Density code = %#x\n",
-                                flashid, density);
-                        return -EINVAL;
                 }
                 break;
         }
-        default:
-                dev_err(adap->pdev_dev, "Unsupported Flash Part, ID = %#x\n",
-                        flashid);
-                return -EINVAL;
+        }
+
+        /* If we didn't recognize the FLASH part, that's no real issue: the
+         * Hardware/Software contract says that Hardware will _*ALWAYS*_
+         * use a FLASH part which is at least 4MB in size and has 64KB
+         * sectors.  The unrecognized FLASH part is likely to be much larger
+         * than 4MB, but that's all we really need.
+         */
+        if (size == 0) {
+                dev_warn(adap->pdev_dev, "Unknown Flash Part, ID = %#x, assuming 4MB\n",
+                         flashid);
+                size = 1 << 22;
         }
 
         /* Store decoded Flash size and fall through into vetting code. */
diff --git a/drivers/net/ethernet/cirrus/Kconfig b/drivers/net/ethernet/cirrus/Kconfig
index 5ab912937aff..ec0b545197e2 100644
--- a/drivers/net/ethernet/cirrus/Kconfig
+++ b/drivers/net/ethernet/cirrus/Kconfig
@@ -19,6 +19,7 @@ if NET_VENDOR_CIRRUS
 config CS89x0
         tristate "CS89x0 support"
         depends on ISA || EISA || ARM
+        depends on !PPC32
         ---help---
           Support for CS89x0 chipset based Ethernet cards. If you have a
           network (Ethernet) card of this type, say Y and read the file
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 90c645b8538e..60641e202534 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -2047,28 +2047,42 @@ static int enic_stop(struct net_device *netdev)
         return 0;
 }
 
+static int _enic_change_mtu(struct net_device *netdev, int new_mtu)
+{
+        bool running = netif_running(netdev);
+        int err = 0;
+
+        ASSERT_RTNL();
+        if (running) {
+                err = enic_stop(netdev);
+                if (err)
+                        return err;
+        }
+
+        netdev->mtu = new_mtu;
+
+        if (running) {
+                err = enic_open(netdev);
+                if (err)
+                        return err;
+        }
+
+        return 0;
+}
+
 static int enic_change_mtu(struct net_device *netdev, int new_mtu)
 {
         struct enic *enic = netdev_priv(netdev);
-        int running = netif_running(netdev);
 
         if (enic_is_dynamic(enic) || enic_is_sriov_vf(enic))
                 return -EOPNOTSUPP;
 
-        if (running)
-                enic_stop(netdev);
-
-        netdev->mtu = new_mtu;
-
         if (netdev->mtu > enic->port_mtu)
                 netdev_warn(netdev,
-                        "interface MTU (%d) set higher than port MTU (%d)\n",
-                        netdev->mtu, enic->port_mtu);
+                            "interface MTU (%d) set higher than port MTU (%d)\n",
+                            netdev->mtu, enic->port_mtu);
 
-        if (running)
-                enic_open(netdev);
-
-        return 0;
+        return _enic_change_mtu(netdev, new_mtu);
 }
 
 static void enic_change_mtu_work(struct work_struct *work)
@@ -2076,47 +2090,9 @@ static void enic_change_mtu_work(struct work_struct *work)
         struct enic *enic = container_of(work, struct enic, change_mtu_work);
         struct net_device *netdev = enic->netdev;
         int new_mtu = vnic_dev_mtu(enic->vdev);
-        int err;
-        unsigned int i;
-
-        new_mtu = max_t(int, ENIC_MIN_MTU, min_t(int, ENIC_MAX_MTU, new_mtu));
 
         rtnl_lock();
-
-        /* Stop RQ */
-        del_timer_sync(&enic->notify_timer);
-
-        for (i = 0; i < enic->rq_count; i++)
-                napi_disable(&enic->napi[i]);
-
-        vnic_intr_mask(&enic->intr[0]);
-        enic_synchronize_irqs(enic);
-        err = vnic_rq_disable(&enic->rq[0]);
-        if (err) {
-                rtnl_unlock();
-                netdev_err(netdev, "Unable to disable RQ.\n");
-                return;
-        }
-        vnic_rq_clean(&enic->rq[0], enic_free_rq_buf);
-        vnic_cq_clean(&enic->cq[0]);
-        vnic_intr_clean(&enic->intr[0]);
-
-        /* Fill RQ with new_mtu-sized buffers */
-        netdev->mtu = new_mtu;
-        vnic_rq_fill(&enic->rq[0], enic_rq_alloc_buf);
-        /* Need at least one buffer on ring to get going */
-        if (vnic_rq_desc_used(&enic->rq[0]) == 0) {
-                rtnl_unlock();
-                netdev_err(netdev, "Unable to alloc receive buffers.\n");
-                return;
-        }
-
-        /* Start RQ */
-        vnic_rq_enable(&enic->rq[0]);
-        napi_enable(&enic->napi[0]);
-        vnic_intr_unmask(&enic->intr[0]);
-        enic_notify_timer_start(enic);
-
+        (void)_enic_change_mtu(netdev, new_mtu);
         rtnl_unlock();
 
         netdev_info(netdev, "interface MTU set as %d\n", netdev->mtu);
@@ -2916,7 +2892,6 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          */
 
         enic->port_mtu = enic->config.mtu;
-        (void)enic_change_mtu(netdev, enic->port_mtu);
 
         err = enic_set_mac_addr(netdev, enic->mac_addr);
         if (err) {
@@ -3006,6 +2981,7 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         /* MTU range: 68 - 9000 */
         netdev->min_mtu = ENIC_MIN_MTU;
         netdev->max_mtu = ENIC_MAX_MTU;
+        netdev->mtu     = enic->port_mtu;
 
         err = register_netdev(netdev);
         if (err) {
diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c
index 5b122728dcb4..09e9da10b786 100644
--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c
+++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c
@@ -983,6 +983,7 @@ static int nic_dev_init(struct pci_dev *pdev)
         hinic_hwdev_cb_register(nic_dev->hwdev, HINIC_MGMT_MSG_CMD_LINK_STATUS,
                                 nic_dev, link_status_event_handler);
 
+        SET_NETDEV_DEV(netdev, &pdev->dev);
         err = register_netdev(netdev);
         if (err) {
                 dev_err(&pdev->dev, "Failed to register netdev\n");
diff --git a/drivers/net/ethernet/huawei/hinic/hinic_tx.c b/drivers/net/ethernet/huawei/hinic/hinic_tx.c
index 9128858479c4..2353ec829c04 100644
--- a/drivers/net/ethernet/huawei/hinic/hinic_tx.c
+++ b/drivers/net/ethernet/huawei/hinic/hinic_tx.c
@@ -229,6 +229,7 @@ netdev_tx_t hinic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                 txq->txq_stats.tx_busy++;
                 u64_stats_update_end(&txq->txq_stats.syncp);
                 err = NETDEV_TX_BUSY;
+                wqe_size = 0;
                 goto flush_skbs;
         }
 
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index d0e196bff081..ffe7acbeaa22 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -329,7 +329,8 @@ static void replenish_rx_pool(struct ibmvnic_adapter *adapter,
         return;
 
 failure:
-        dev_info(dev, "replenish pools failure\n");
+        if (lpar_rc != H_PARAMETER && lpar_rc != H_CLOSED)
+                dev_err_ratelimited(dev, "rx: replenish packet buffer failed\n");
         pool->free_map[pool->next_free] = index;
         pool->rx_buff[index].skb = NULL;
 
@@ -1617,7 +1618,8 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
                                       &tx_crq);
         }
         if (lpar_rc != H_SUCCESS) {
-                dev_err(dev, "tx failed with code %ld\n", lpar_rc);
+                if (lpar_rc != H_CLOSED && lpar_rc != H_PARAMETER)
+                        dev_err_ratelimited(dev, "tx: send failed\n");
                 dev_kfree_skb_any(skb);
                 tx_buff->skb = NULL;
 
@@ -1825,8 +1827,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
 
                 rc = ibmvnic_login(netdev);
                 if (rc) {
-                        adapter->state = VNIC_PROBED;
-                        return 0;
+                        adapter->state = reset_state;
+                        return rc;
                 }
 
                 if (adapter->reset_reason == VNIC_RESET_CHANGE_PARAM ||
@@ -3204,6 +3206,25 @@ static union ibmvnic_crq *ibmvnic_next_crq(struct ibmvnic_adapter *adapter)
         return crq;
 }
 
+static void print_subcrq_error(struct device *dev, int rc, const char *func)
+{
+        switch (rc) {
+        case H_PARAMETER:
+                dev_warn_ratelimited(dev,
+                                     "%s failed: Send request is malformed or adapter failover pending. (rc=%d)\n",
+                                     func, rc);
+                break;
+        case H_CLOSED:
+                dev_warn_ratelimited(dev,
+                                     "%s failed: Backing queue closed. Adapter is down or failover pending. (rc=%d)\n",
+                                     func, rc);
+                break;
+        default:
+                dev_err_ratelimited(dev, "%s failed: (rc=%d)\n", func, rc);
+                break;
+        }
+}
+
 static int send_subcrq(struct ibmvnic_adapter *adapter, u64 remote_handle,
                        union sub_crq *sub_crq)
 {
@@ -3230,11 +3251,8 @@ static int send_subcrq(struct ibmvnic_adapter *adapter, u64 remote_handle,
                                 cpu_to_be64(u64_crq[2]),
                                 cpu_to_be64(u64_crq[3]));
 
-        if (rc) {
-                if (rc == H_CLOSED)
-                        dev_warn(dev, "CRQ Queue closed\n");
-                dev_err(dev, "Send error (rc=%d)\n", rc);
-        }
+        if (rc)
+                print_subcrq_error(dev, rc, __func__);
 
         return rc;
 }
@@ -3252,11 +3270,8 @@ static int send_subcrq_indirect(struct ibmvnic_adapter *adapter,
                                 cpu_to_be64(remote_handle),
                                 ioba, num_entries);
 
-        if (rc) {
-                if (rc == H_CLOSED)
-                        dev_warn(dev, "CRQ Queue closed\n");
-                dev_err(dev, "Send (indirect) error (rc=%d)\n", rc);
-        }
+        if (rc)
+                print_subcrq_error(dev, rc, __func__);
 
         return rc;
 }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
index 3f5c350716bb..0bd1294ba517 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
@@ -1871,7 +1871,12 @@ s32 ixgbe_set_rar_generic(struct ixgbe_hw *hw, u32 index, u8 *addr, u32 vmdq,
         if (enable_addr != 0)
                 rar_high |= IXGBE_RAH_AV;
 
+        /* Record lower 32 bits of MAC address and then make
+         * sure that write is flushed to hardware before writing
+         * the upper 16 bits and setting the valid bit.
+         */
         IXGBE_WRITE_REG(hw, IXGBE_RAL(index), rar_low);
+        IXGBE_WRITE_FLUSH(hw);
         IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
 
         return 0;
@@ -1903,8 +1908,13 @@ s32 ixgbe_clear_rar_generic(struct ixgbe_hw *hw, u32 index)
         rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(index));
         rar_high &= ~(0x0000FFFF | IXGBE_RAH_AV);
 
-        IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
+        /* Clear the address valid bit and upper 16 bits of the address
+         * before clearing the lower bits. This way we aren't updating
+         * a live filter.
+         */
         IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
+        IXGBE_WRITE_FLUSH(hw);
+        IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
 
         /* clear VMDq pool/queue selection for this RAR */
         hw->mac.ops.clear_vmdq(hw, index, IXGBE_CLEAR_VMDQ_ALL);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
index c116f459945d..da4322e4daed 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
@@ -839,7 +839,7 @@ int ixgbe_ipsec_tx(struct ixgbe_ring *tx_ring,
         }
 
         itd->sa_idx = xs->xso.offload_handle - IXGBE_IPSEC_BASE_TX_INDEX;
-        if (unlikely(itd->sa_idx > IXGBE_IPSEC_MAX_SA_COUNT)) {
+        if (unlikely(itd->sa_idx >= IXGBE_IPSEC_MAX_SA_COUNT)) {
                 netdev_err(tx_ring->netdev, "%s: bad sa_idx=%d handle=%lu\n",
                            __func__, itd->sa_idx, xs->xso.offload_handle);
                 return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index 9f54ccbddea7..3360f7b9ee73 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -474,10 +474,10 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
 {
         const struct mlx4_en_frag_info *frag_info = priv->frag_info;
         unsigned int truesize = 0;
+        bool release = true;
         int nr, frag_size;
         struct page *page;
         dma_addr_t dma;
-        bool release;
 
         /* Collect used fragments while replacing them in the HW descriptors */
         for (nr = 0;; frags++) {
@@ -500,7 +500,11 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
                         release = page_count(page) != 1 ||
                                   page_is_pfmemalloc(page) ||
                                   page_to_nid(page) != numa_mem_id();
-                } else {
+                } else if (!priv->rx_headroom) {
+                        /* rx_headroom for non XDP setup is always 0.
+                         * When XDP is set, the above condition will
+                         * guarantee page is always released.
+                         */
                         u32 sz_align = ALIGN(frag_size, SMP_CACHE_BYTES);
 
                         frags->page_offset += sz_align;
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 7b1b5ac986d0..31bd56727022 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -2958,7 +2958,7 @@ int mlx4_RST2INIT_QP_wrapper(struct mlx4_dev *dev, int slave,
         u32 srqn = qp_get_srqn(qpc) & 0xffffff;
         int use_srq = (qp_get_srqn(qpc) >> 24) & 1;
         struct res_srq *srq;
-        int local_qpn = be32_to_cpu(qpc->local_qpn) & 0xffffff;
+        int local_qpn = vhcr->in_modifier & 0xffffff;
 
         err = adjust_qp_sched_queue(dev, slave, qpc, inbox);
         if (err)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/alloc.c b/drivers/net/ethernet/mellanox/mlx5/core/alloc.c
index 323ffe8bf7e4..456f30007ad6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/alloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/alloc.c
@@ -123,7 +123,7 @@ int mlx5_frag_buf_alloc_node(struct mlx5_core_dev *dev, int size,
         int i;
 
         buf->size = size;
-        buf->npages = 1 << get_order(size);
+        buf->npages = DIV_ROUND_UP(size, PAGE_SIZE);
         buf->page_shift = PAGE_SHIFT;
         buf->frags = kcalloc(buf->npages, sizeof(struct mlx5_buf_list),
                              GFP_KERNEL);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
index 75e4308ba786..d258bb679271 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
@@ -381,14 +381,14 @@ static void arfs_may_expire_flow(struct mlx5e_priv *priv)
         HLIST_HEAD(del_list);
         spin_lock_bh(&priv->fs.arfs.arfs_lock);
         mlx5e_for_each_arfs_rule(arfs_rule, htmp, priv->fs.arfs.arfs_tables, i, j) {
-                if (quota++ > MLX5E_ARFS_EXPIRY_QUOTA)
-                        break;
                 if (!work_pending(&arfs_rule->arfs_work) &&
                     rps_may_expire_flow(priv->netdev,
                                         arfs_rule->rxq, arfs_rule->flow_id,
                                         arfs_rule->filter_id)) {
                         hlist_del_init(&arfs_rule->hlist);
                         hlist_add_head(&arfs_rule->hlist, &del_list);
+                        if (quota++ > MLX5E_ARFS_EXPIRY_QUOTA)
+                                break;
                 }
         }
         spin_unlock_bh(&priv->fs.arfs.arfs_lock);
@@ -711,6 +711,9 @@ int mlx5e_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
             skb->protocol != htons(ETH_P_IPV6))
                 return -EPROTONOSUPPORT;
 
+        if (skb->encapsulation)
+                return -EPROTONOSUPPORT;
+
         arfs_t = arfs_get_table(arfs, arfs_get_ip_proto(skb), skb->protocol);
         if (!arfs_t)
                 return -EPROTONOSUPPORT;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 0a52f31fef37..e33afa8d2417 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -275,7 +275,8 @@ int mlx5e_dcbnl_ieee_setets_core(struct mlx5e_priv *priv, struct ieee_ets *ets)
 }
 
 static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
-                                    struct ieee_ets *ets)
+                                    struct ieee_ets *ets,
+                                    bool zero_sum_allowed)
 {
         bool have_ets_tc = false;
         int bw_sum = 0;
@@ -300,8 +301,9 @@ static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
         }
 
         if (have_ets_tc && bw_sum != 100) {
-                netdev_err(netdev,
-                           "Failed to validate ETS: BW sum is illegal\n");
+                if (bw_sum || (!bw_sum && !zero_sum_allowed))
+                        netdev_err(netdev,
+                                   "Failed to validate ETS: BW sum is illegal\n");
                 return -EINVAL;
         }
         return 0;
@@ -316,7 +318,7 @@ static int mlx5e_dcbnl_ieee_setets(struct net_device *netdev,
         if (!MLX5_CAP_GEN(priv->mdev, ets))
                 return -EOPNOTSUPP;
 
-        err = mlx5e_dbcnl_validate_ets(netdev, ets);
+        err = mlx5e_dbcnl_validate_ets(netdev, ets, false);
         if (err)
                 return err;
 
@@ -642,12 +644,9 @@ static u8 mlx5e_dcbnl_setall(struct net_device *netdev)
                           ets.prio_tc[i]);
         }
 
-        err = mlx5e_dbcnl_validate_ets(netdev, &ets);
-        if (err) {
-                netdev_err(netdev,
-                           "%s, Failed to validate ETS: %d\n", __func__, err);
+        err = mlx5e_dbcnl_validate_ets(netdev, &ets, true);
+        if (err)
                 goto out;
-        }
 
         err = mlx5e_dcbnl_ieee_setets_core(priv, &ets);
         if (err) {
@@ -1173,6 +1172,8 @@ static int mlx5e_trust_initialize(struct mlx5e_priv *priv)
         struct mlx5_core_dev *mdev = priv->mdev;
         int err;
 
+        priv->dcbx_dp.trust_state = MLX5_QPTS_TRUST_PCP;
+
         if (!MLX5_DSCP_SUPPORTED(mdev))
                 return 0;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index dae4156a710d..c592678ab5f1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -3712,7 +3712,8 @@ int mlx5e_change_mtu(struct net_device *netdev, int new_mtu,
 
         if (!reset) {
                 params->sw_mtu = new_mtu;
-                set_mtu_cb(priv);
+                if (set_mtu_cb)
+                        set_mtu_cb(priv);
                 netdev->mtu = params->sw_mtu;
                 goto out;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 0edf4751a8ba..3a2c4e548226 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1957,6 +1957,10 @@ static bool actions_match_supported(struct mlx5e_priv *priv,
         else
                 actions = flow->nic_attr->action;
 
+        if (flow->flags & MLX5E_TC_FLOW_EGRESS &&
+            !(actions & MLX5_FLOW_CONTEXT_ACTION_DECAP))
+                return false;
+
         if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)
                 return modify_header_match_supported(&parse_attr->spec, exts);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index b79d74860a30..40dba9e8af92 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1696,7 +1696,7 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev)
         int vport_num;
         int err;
 
-        if (!MLX5_VPORT_MANAGER(dev))
+        if (!MLX5_ESWITCH_MANAGER(dev))
                 return 0;
 
         esw_info(dev,
@@ -1765,7 +1765,7 @@ abort:
 
 void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw)
 {
-        if (!esw || !MLX5_VPORT_MANAGER(esw->dev))
+        if (!esw || !MLX5_ESWITCH_MANAGER(esw->dev))
                 return;
 
         esw_info(esw->dev, "cleanup\n");
@@ -2216,6 +2216,6 @@ free_out:
 
 u8 mlx5_eswitch_mode(struct mlx5_eswitch *esw)
 {
-        return esw->mode;
+        return ESW_ALLOWED(esw) ? esw->mode : SRIOV_NONE;
 }
 EXPORT_SYMBOL_GPL(mlx5_eswitch_mode);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index f1a86cea86a0..6ddb2565884d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -1887,7 +1887,7 @@ mlx5_add_flow_rules(struct mlx5_flow_table *ft,
         if (flow_act->action == MLX5_FLOW_CONTEXT_ACTION_FWD_NEXT_PRIO) {
                 if (!fwd_next_prio_supported(ft))
                         return ERR_PTR(-EOPNOTSUPP);
-                if (dest)
+                if (dest_num)
                         return ERR_PTR(-EINVAL);
                 mutex_lock(&root->chain_lock);
                 next_ft = find_next_chained_ft(prio);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index af3bb2f7a504..b7c21eb21a21 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -76,6 +76,7 @@ void mlx5i_init(struct mlx5_core_dev *mdev,
                 void *ppriv)
 {
         struct mlx5e_priv *priv  = mlx5i_epriv(netdev);
+        u16 max_mtu;
 
         /* priv init */
         priv->mdev        = mdev;
@@ -84,6 +85,9 @@ void mlx5i_init(struct mlx5_core_dev *mdev,
         priv->ppriv       = ppriv;
         mutex_init(&priv->state_lock);
 
+        mlx5_query_port_max_mtu(mdev, &max_mtu, 1);
+        netdev->mtu = max_mtu;
+
         mlx5e_build_nic_params(mdev, &priv->channels.params,
                                profile->max_nch(mdev), netdev->mtu);
         mlx5i_build_nic_params(mdev, &priv->channels.params);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
index 1e062e6b2587..3f767cde4c1d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
@@ -488,6 +488,7 @@ void mlx5_pps_event(struct mlx5_core_dev *mdev,
 void mlx5_init_clock(struct mlx5_core_dev *mdev)
 {
         struct mlx5_clock *clock = &mdev->clock;
+        u64 overflow_cycles;
         u64 ns;
         u64 frac = 0;
         u32 dev_freq;
@@ -511,10 +512,17 @@ void mlx5_init_clock(struct mlx5_core_dev *mdev)
 
         /* Calculate period in seconds to call the overflow watchdog - to make
          * sure counter is checked at least once every wrap around.
+         * The period is calculated as the minimum between max HW cycles count
+         * (The clock source mask) and max amount of cycles that can be
+         * multiplied by clock multiplier where the result doesn't exceed
+         * 64bits.
          */
-        ns = cyclecounter_cyc2ns(&clock->cycles, clock->cycles.mask,
+        overflow_cycles = div64_u64(~0ULL >> 1, clock->cycles.mult);
+        overflow_cycles = min(overflow_cycles, clock->cycles.mask >> 1);
+
+        ns = cyclecounter_cyc2ns(&clock->cycles, overflow_cycles,
                                  frac, &frac);
-        do_div(ns, NSEC_PER_SEC / 2 / HZ);
+        do_div(ns, NSEC_PER_SEC / HZ);
         clock->overflow_period = ns;
 
         mdev->clock_info_page = alloc_page(GFP_KERNEL);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wq.c b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
index b97bb72b4db4..86478a6b99c5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
@@ -113,35 +113,45 @@ err_db_free:
         return err;
 }
 
-static void mlx5e_qp_set_frag_buf(struct mlx5_frag_buf *buf,
-                                  struct mlx5_wq_qp *qp)
+static void mlx5_qp_set_frag_buf(struct mlx5_frag_buf *buf,
+                                 struct mlx5_wq_qp *qp)
 {
+        struct mlx5_frag_buf_ctrl *sq_fbc;
         struct mlx5_frag_buf *rqb, *sqb;
 
-        rqb = &qp->rq.fbc.frag_buf;
+        rqb  = &qp->rq.fbc.frag_buf;
         *rqb = *buf;
         rqb->size   = mlx5_wq_cyc_get_byte_size(&qp->rq);
-        rqb->npages = 1 << get_order(rqb->size);
+        rqb->npages = DIV_ROUND_UP(rqb->size, PAGE_SIZE);
 
-        sqb = &qp->sq.fbc.frag_buf;
-        *sqb = *buf;
-        sqb->size   = mlx5_wq_cyc_get_byte_size(&qp->rq);
-        sqb->npages = 1 << get_order(sqb->size);
+        sq_fbc = &qp->sq.fbc;
+        sqb    = &sq_fbc->frag_buf;
+        *sqb   = *buf;
+        sqb->size   = mlx5_wq_cyc_get_byte_size(&qp->sq);
+        sqb->npages = DIV_ROUND_UP(sqb->size, PAGE_SIZE);
         sqb->frags += rqb->npages; /* first part is for the rq */
+        if (sq_fbc->strides_offset)
+                sqb->frags--;
 }
 
 int mlx5_wq_qp_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
                       void *qpc, struct mlx5_wq_qp *wq,
                       struct mlx5_wq_ctrl *wq_ctrl)
 {
+        u32 sq_strides_offset;
         int err;
 
         mlx5_fill_fbc(MLX5_GET(qpc, qpc, log_rq_stride) + 4,
                       MLX5_GET(qpc, qpc, log_rq_size),
                       &wq->rq.fbc);
-        mlx5_fill_fbc(ilog2(MLX5_SEND_WQE_BB),
-                      MLX5_GET(qpc, qpc, log_sq_size),
-                      &wq->sq.fbc);
+
+        sq_strides_offset =
+                ((wq->rq.fbc.frag_sz_m1 + 1) % PAGE_SIZE) / MLX5_SEND_WQE_BB;
+
+        mlx5_fill_fbc_offset(ilog2(MLX5_SEND_WQE_BB),
+                             MLX5_GET(qpc, qpc, log_sq_size),
+                             sq_strides_offset,
+                             &wq->sq.fbc);
 
         err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node);
         if (err) {
@@ -156,7 +166,7 @@ int mlx5_wq_qp_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
                 goto err_db_free;
         }
 
-        mlx5e_qp_set_frag_buf(&wq_ctrl->buf, wq);
+        mlx5_qp_set_frag_buf(&wq_ctrl->buf, wq);
 
         wq->rq.db  = &wq_ctrl->db.db[MLX5_RCV_DBR];
         wq->sq.db  = &wq_ctrl->db.db[MLX5_SND_DBR];
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
index 3c0d882ba183..f6f6a568d66a 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
@@ -327,12 +327,16 @@ static void mlxsw_afa_resource_add(struct mlxsw_afa_block *block,
         list_add(&resource->list, &block->resource_list);
 }
 
+static void mlxsw_afa_resource_del(struct mlxsw_afa_resource *resource)
+{
+        list_del(&resource->list);
+}
+
 static void mlxsw_afa_resources_destroy(struct mlxsw_afa_block *block)
 {
         struct mlxsw_afa_resource *resource, *tmp;
 
         list_for_each_entry_safe(resource, tmp, &block->resource_list, list) {
-                list_del(&resource->list);
                 resource->destructor(block, resource);
         }
 }
@@ -530,6 +534,7 @@ static void
 mlxsw_afa_fwd_entry_ref_destroy(struct mlxsw_afa_block *block,
                                 struct mlxsw_afa_fwd_entry_ref *fwd_entry_ref)
 {
+        mlxsw_afa_resource_del(&fwd_entry_ref->resource);
         mlxsw_afa_fwd_entry_put(block->afa, fwd_entry_ref->fwd_entry);
         kfree(fwd_entry_ref);
 }
@@ -579,6 +584,7 @@ static void
 mlxsw_afa_counter_destroy(struct mlxsw_afa_block *block,
                           struct mlxsw_afa_counter *counter)
 {
+        mlxsw_afa_resource_del(&counter->resource);
         block->afa->ops->counter_index_put(block->afa->ops_priv,
                                            counter->counter_index);
         kfree(counter);
@@ -626,8 +632,8 @@ static char *mlxsw_afa_block_append_action(struct mlxsw_afa_block *block,
         char *oneact;
         char *actions;
 
-        if (WARN_ON(block->finished))
-                return NULL;
+        if (block->finished)
+                return ERR_PTR(-EINVAL);
         if (block->cur_act_index + action_size >
             block->afa->max_acts_per_set) {
                 struct mlxsw_afa_set *set;
@@ -637,7 +643,7 @@ static char *mlxsw_afa_block_append_action(struct mlxsw_afa_block *block,
                  */
                 set = mlxsw_afa_set_create(false);
                 if (!set)
-                        return NULL;
+                        return ERR_PTR(-ENOBUFS);
                 set->prev = block->cur_set;
                 block->cur_act_index = 0;
                 block->cur_set->next = set;
@@ -724,8 +730,8 @@ int mlxsw_afa_block_append_vlan_modify(struct mlxsw_afa_block *block,
                                                   MLXSW_AFA_VLAN_CODE,
                                                   MLXSW_AFA_VLAN_SIZE);
 
-        if (!act)
-                return -ENOBUFS;
+        if (IS_ERR(act))
+                return PTR_ERR(act);
         mlxsw_afa_vlan_pack(act, MLXSW_AFA_VLAN_VLAN_TAG_CMD_NOP,
                             MLXSW_AFA_VLAN_CMD_SET_OUTER, vid,
                             MLXSW_AFA_VLAN_CMD_SET_OUTER, pcp,
@@ -806,8 +812,8 @@ int mlxsw_afa_block_append_drop(struct mlxsw_afa_block *block)
                                                   MLXSW_AFA_TRAPDISC_CODE,
                                                   MLXSW_AFA_TRAPDISC_SIZE);
 
-        if (!act)
-                return -ENOBUFS;
+        if (IS_ERR(act))
+                return PTR_ERR(act);
         mlxsw_afa_trapdisc_pack(act, MLXSW_AFA_TRAPDISC_TRAP_ACTION_NOP,
                                 MLXSW_AFA_TRAPDISC_FORWARD_ACTION_DISCARD, 0);
         return 0;
@@ -820,8 +826,8 @@ int mlxsw_afa_block_append_trap(struct mlxsw_afa_block *block, u16 trap_id)
                                                   MLXSW_AFA_TRAPDISC_CODE,
                                                   MLXSW_AFA_TRAPDISC_SIZE);
 
-        if (!act)
-                return -ENOBUFS;
+        if (IS_ERR(act))
+                return PTR_ERR(act);
         mlxsw_afa_trapdisc_pack(act, MLXSW_AFA_TRAPDISC_TRAP_ACTION_TRAP,
                                 MLXSW_AFA_TRAPDISC_FORWARD_ACTION_DISCARD,
                                 trap_id);
@@ -836,8 +842,8 @@ int mlxsw_afa_block_append_trap_and_forward(struct mlxsw_afa_block *block,
                                                   MLXSW_AFA_TRAPDISC_CODE,
                                                   MLXSW_AFA_TRAPDISC_SIZE);
 
-        if (!act)
-                return -ENOBUFS;
+        if (IS_ERR(act))
+                return PTR_ERR(act);
         mlxsw_afa_trapdisc_pack(act, MLXSW_AFA_TRAPDISC_TRAP_ACTION_TRAP,
                                 MLXSW_AFA_TRAPDISC_FORWARD_ACTION_FORWARD,
                                 trap_id);
@@ -856,6 +862,7 @@ static void
 mlxsw_afa_mirror_destroy(struct mlxsw_afa_block *block,
                          struct mlxsw_afa_mirror *mirror)
 {
+        mlxsw_afa_resource_del(&mirror->resource);
         block->afa->ops->mirror_del(block->afa->ops_priv,
                                     mirror->local_in_port,
                                     mirror->span_id,
@@ -908,8 +915,8 @@ mlxsw_afa_block_append_allocated_mirror(struct mlxsw_afa_block *block,
         char *act = mlxsw_afa_block_append_action(block,
                                                   MLXSW_AFA_TRAPDISC_CODE,
                                                   MLXSW_AFA_TRAPDISC_SIZE);
-        if (!act)
-                return -ENOBUFS;
+        if (IS_ERR(act))
+                return PTR_ERR(act);
         mlxsw_afa_trapdisc_pack(act, MLXSW_AFA_TRAPDISC_TRAP_ACTION_NOP,
                                 MLXSW_AFA_TRAPDISC_FORWARD_ACTION_FORWARD, 0);
         mlxsw_afa_trapdisc_mirror_pack(act, true, mirror_agent);
@@ -996,8 +1003,8 @@ int mlxsw_afa_block_append_fwd(struct mlxsw_afa_block *block,
 
         act = mlxsw_afa_block_append_action(block, MLXSW_AFA_FORWARD_CODE,
                                             MLXSW_AFA_FORWARD_SIZE);
-        if (!act) {
-                err = -ENOBUFS;
+        if (IS_ERR(act)) {
+                err = PTR_ERR(act);
                 goto err_append_action;
         }
         mlxsw_afa_forward_pack(act, MLXSW_AFA_FORWARD_TYPE_PBS,
@@ -1052,8 +1059,8 @@ int mlxsw_afa_block_append_allocated_counter(struct mlxsw_afa_block *block,
 {
         char *act = mlxsw_afa_block_append_action(block, MLXSW_AFA_POLCNT_CODE,
                                                   MLXSW_AFA_POLCNT_SIZE);
-        if (!act)
-                return -ENOBUFS;
+        if (IS_ERR(act))
+                return PTR_ERR(act);
         mlxsw_afa_polcnt_pack(act, MLXSW_AFA_POLCNT_COUNTER_SET_TYPE_PACKETS_BYTES,
                               counter_index);
         return 0;
@@ -1123,8 +1130,8 @@ int mlxsw_afa_block_append_fid_set(struct mlxsw_afa_block *block, u16 fid)
         char *act = mlxsw_afa_block_append_action(block,
                                                   MLXSW_AFA_VIRFWD_CODE,
                                                   MLXSW_AFA_VIRFWD_SIZE);
-        if (!act)
-                return -ENOBUFS;
+        if (IS_ERR(act))
+                return PTR_ERR(act);
         mlxsw_afa_virfwd_pack(act, MLXSW_AFA_VIRFWD_FID_CMD_SET, fid);
         return 0;
 }
@@ -1193,8 +1200,8 @@ int mlxsw_afa_block_append_mcrouter(struct mlxsw_afa_block *block,
         char *act = mlxsw_afa_block_append_action(block,
                                                   MLXSW_AFA_MCROUTER_CODE,
                                                   MLXSW_AFA_MCROUTER_SIZE);
-        if (!act)
-                return -ENOBUFS;
+        if (IS_ERR(act))
+                return PTR_ERR(act);
         mlxsw_afa_mcrouter_pack(act, MLXSW_AFA_MCROUTER_RPF_ACTION_TRAP,
                                 expected_irif, min_mtu, rmid_valid, kvdl_index);
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 6aaaf3d9ba31..77b2adb29341 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -4756,6 +4756,12 @@ static void mlxsw_sp_rt6_destroy(struct mlxsw_sp_rt6 *mlxsw_sp_rt6)
         kfree(mlxsw_sp_rt6);
 }
 
+static bool mlxsw_sp_fib6_rt_can_mp(const struct fib6_info *rt)
+{
+        /* RTF_CACHE routes are ignored */
+        return (rt->fib6_flags & (RTF_GATEWAY | RTF_ADDRCONF)) == RTF_GATEWAY;
+}
+
 static struct fib6_info *
 mlxsw_sp_fib6_entry_rt(const struct mlxsw_sp_fib6_entry *fib6_entry)
 {
@@ -4765,11 +4771,11 @@ mlxsw_sp_fib6_entry_rt(const struct mlxsw_sp_fib6_entry *fib6_entry)
 
 static struct mlxsw_sp_fib6_entry *
 mlxsw_sp_fib6_node_mp_entry_find(const struct mlxsw_sp_fib_node *fib_node,
-                                 const struct fib6_info *nrt, bool append)
+                                 const struct fib6_info *nrt, bool replace)
 {
         struct mlxsw_sp_fib6_entry *fib6_entry;
 
-        if (!append)
+        if (!mlxsw_sp_fib6_rt_can_mp(nrt) || replace)
                 return NULL;
 
         list_for_each_entry(fib6_entry, &fib_node->entry_list, common.list) {
@@ -4784,7 +4790,8 @@ mlxsw_sp_fib6_node_mp_entry_find(const struct mlxsw_sp_fib_node *fib_node,
                         break;
                 if (rt->fib6_metric < nrt->fib6_metric)
                         continue;
-                if (rt->fib6_metric == nrt->fib6_metric)
+                if (rt->fib6_metric == nrt->fib6_metric &&
+                    mlxsw_sp_fib6_rt_can_mp(rt))
                         return fib6_entry;
                 if (rt->fib6_metric > nrt->fib6_metric)
                         break;
@@ -5163,7 +5170,7 @@ static struct mlxsw_sp_fib6_entry *
 mlxsw_sp_fib6_node_entry_find(const struct mlxsw_sp_fib_node *fib_node,
                               const struct fib6_info *nrt, bool replace)
 {
-        struct mlxsw_sp_fib6_entry *fib6_entry;
+        struct mlxsw_sp_fib6_entry *fib6_entry, *fallback = NULL;
 
         list_for_each_entry(fib6_entry, &fib_node->entry_list, common.list) {
                 struct fib6_info *rt = mlxsw_sp_fib6_entry_rt(fib6_entry);
@@ -5172,13 +5179,18 @@ mlxsw_sp_fib6_node_entry_find(const struct mlxsw_sp_fib_node *fib_node,
                         continue;
                 if (rt->fib6_table->tb6_id != nrt->fib6_table->tb6_id)
                         break;
-                if (replace && rt->fib6_metric == nrt->fib6_metric)
-                        return fib6_entry;
+                if (replace && rt->fib6_metric == nrt->fib6_metric) {
+                        if (mlxsw_sp_fib6_rt_can_mp(rt) ==
+                            mlxsw_sp_fib6_rt_can_mp(nrt))
+                                return fib6_entry;
+                        if (mlxsw_sp_fib6_rt_can_mp(nrt))
+                                fallback = fallback ?: fib6_entry;
+                }
                 if (rt->fib6_metric > nrt->fib6_metric)
-                        return fib6_entry;
+                        return fallback ?: fib6_entry;
         }
 
-        return NULL;
+        return fallback;
 }
 
 static int
@@ -5304,8 +5316,7 @@ static void mlxsw_sp_fib6_entry_replace(struct mlxsw_sp *mlxsw_sp,
 }
 
 static int mlxsw_sp_router_fib6_add(struct mlxsw_sp *mlxsw_sp,
-                                    struct fib6_info *rt, bool replace,
-                                    bool append)
+                                    struct fib6_info *rt, bool replace)
 {
         struct mlxsw_sp_fib6_entry *fib6_entry;
         struct mlxsw_sp_fib_node *fib_node;
@@ -5331,7 +5342,7 @@ static int mlxsw_sp_router_fib6_add(struct mlxsw_sp *mlxsw_sp,
         /* Before creating a new entry, try to append route to an existing
          * multipath entry.
          */
-        fib6_entry = mlxsw_sp_fib6_node_mp_entry_find(fib_node, rt, append);
+        fib6_entry = mlxsw_sp_fib6_node_mp_entry_find(fib_node, rt, replace);
         if (fib6_entry) {
                 err = mlxsw_sp_fib6_entry_nexthop_add(mlxsw_sp, fib6_entry, rt);
                 if (err)
@@ -5339,14 +5350,6 @@ static int mlxsw_sp_router_fib6_add(struct mlxsw_sp *mlxsw_sp,
                 return 0;
         }
 
-        /* We received an append event, yet did not find any route to
-         * append to.
-         */
-        if (WARN_ON(append)) {
-                err = -EINVAL;
-                goto err_fib6_entry_append;
-        }
-
         fib6_entry = mlxsw_sp_fib6_entry_create(mlxsw_sp, fib_node, rt);
         if (IS_ERR(fib6_entry)) {
                 err = PTR_ERR(fib6_entry);
@@ -5364,7 +5367,6 @@ static int mlxsw_sp_router_fib6_add(struct mlxsw_sp *mlxsw_sp,
 err_fib6_node_entry_link:
         mlxsw_sp_fib6_entry_destroy(mlxsw_sp, fib6_entry);
 err_fib6_entry_create:
-err_fib6_entry_append:
 err_fib6_entry_nexthop_add:
         mlxsw_sp_fib_node_put(mlxsw_sp, fib_node);
         return err;
@@ -5715,7 +5717,7 @@ static void mlxsw_sp_router_fib6_event_work(struct work_struct *work)
         struct mlxsw_sp_fib_event_work *fib_work =
                 container_of(work, struct mlxsw_sp_fib_event_work, work);
         struct mlxsw_sp *mlxsw_sp = fib_work->mlxsw_sp;
-        bool replace, append;
+        bool replace;
         int err;
 
         rtnl_lock();
@@ -5726,10 +5728,8 @@ static void mlxsw_sp_router_fib6_event_work(struct work_struct *work)
         case FIB_EVENT_ENTRY_APPEND: /* fall through */
         case FIB_EVENT_ENTRY_ADD:
                 replace = fib_work->event == FIB_EVENT_ENTRY_REPLACE;
-                append = fib_work->event == FIB_EVENT_ENTRY_APPEND;
                 err = mlxsw_sp_router_fib6_add(mlxsw_sp,
-                                               fib_work->fen6_info.rt, replace,
-                                               append);
+                                               fib_work->fen6_info.rt, replace);
                 if (err)
                         mlxsw_sp_router_fib_abort(mlxsw_sp);
                 mlxsw_sp_rt6_release(fib_work->fen6_info.rt);
diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.c b/drivers/net/ethernet/netronome/nfp/flower/main.c
index 1decf3a1cad3..e57d23746585 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.c
@@ -80,7 +80,7 @@ nfp_flower_repr_get_type_and_port(struct nfp_app *app, u32 port_id, u8 *port)
                         return NFP_REPR_TYPE_VF;
         }
 
-        return NFP_FLOWER_CMSG_PORT_TYPE_UNSPEC;
+        return __NFP_REPR_TYPE_MAX;
 }
 
 static struct net_device *
@@ -91,6 +91,8 @@ nfp_flower_repr_get(struct nfp_app *app, u32 port_id)
         u8 port = 0;
 
         repr_type = nfp_flower_repr_get_type_and_port(app, port_id, &port);
+        if (repr_type > NFP_REPR_TYPE_MAX)
+                return NULL;
 
         reprs = rcu_dereference(app->reprs[repr_type]);
         if (!reprs)
diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
index 78afe75129ab..382bb93cb090 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
@@ -317,7 +317,7 @@ nfp_tun_write_neigh(struct net_device *netdev, struct nfp_app *app,
         payload.dst_ipv4 = flow->daddr;
 
         /* If entry has expired send dst IP with all other fields 0. */
-        if (!(neigh->nud_state & NUD_VALID)) {
+        if (!(neigh->nud_state & NUD_VALID) || neigh->dead) {
                 nfp_tun_del_route_from_cache(app, payload.dst_ipv4);
                 /* Trigger ARP to verify invalid neighbour state. */
                 neigh_event_send(neigh, NULL);
diff --git a/drivers/net/ethernet/qlogic/qed/qed.h b/drivers/net/ethernet/qlogic/qed/qed.h
index 00db3401b898..1dfaccd151f0 100644
--- a/drivers/net/ethernet/qlogic/qed/qed.h
+++ b/drivers/net/ethernet/qlogic/qed/qed.h
@@ -502,6 +502,7 @@ enum BAR_ID {
 struct qed_nvm_image_info {
         u32 num_images;
         struct bist_nvm_image_att *image_att;
+        bool valid;
 };
 
 #define DRV_MODULE_VERSION                    \
diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c
index a14e48489029..4340c4c90bcb 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
@@ -6723,7 +6723,7 @@ static enum dbg_status qed_parse_mcp_trace_buf(u8 *trace_buf,
                 format_idx = header & MFW_TRACE_EVENTID_MASK;
 
                 /* Skip message if its index doesn't exist in the meta data */
-                if (format_idx > s_mcp_trace_meta.formats_num) {
+                if (format_idx >= s_mcp_trace_meta.formats_num) {
                         u8 format_size =
                                 (u8)((header & MFW_TRACE_PRM_SIZE_MASK) >>
                                      MFW_TRACE_PRM_SIZE_SHIFT);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index 99973e10b179..5ede6408649d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -665,7 +665,7 @@ qed_sp_update_mcast_bin(struct qed_hwfn *p_hwfn,
 
         p_ramrod->common.update_approx_mcast_flg = 1;
         for (i = 0; i < ETH_MULTICAST_MAC_BINS_IN_REGS; i++) {
-                u32 *p_bins = (u32 *)p_params->bins;
+                u32 *p_bins = p_params->bins;
 
                 p_ramrod->approx_mcast.bins[i] = cpu_to_le32(p_bins[i]);
         }
@@ -1476,8 +1476,8 @@ qed_sp_eth_filter_mcast(struct qed_hwfn *p_hwfn,
                         enum spq_mode comp_mode,
                         struct qed_spq_comp_cb *p_comp_data)
 {
-        unsigned long bins[ETH_MULTICAST_MAC_BINS_IN_REGS];
         struct vport_update_ramrod_data *p_ramrod = NULL;
+        u32 bins[ETH_MULTICAST_MAC_BINS_IN_REGS];
         struct qed_spq_entry *p_ent = NULL;
         struct qed_sp_init_data init_data;
         u8 abs_vport_id = 0;
@@ -1513,26 +1513,25 @@ qed_sp_eth_filter_mcast(struct qed_hwfn *p_hwfn,
         /* explicitly clear out the entire vector */
         memset(&p_ramrod->approx_mcast.bins, 0,
                sizeof(p_ramrod->approx_mcast.bins));
-        memset(bins, 0, sizeof(unsigned long) *
-               ETH_MULTICAST_MAC_BINS_IN_REGS);
+        memset(bins, 0, sizeof(bins));
         /* filter ADD op is explicit set op and it removes
          *  any existing filters for the vport
          */
         if (p_filter_cmd->opcode == QED_FILTER_ADD) {
                 for (i = 0; i < p_filter_cmd->num_mc_addrs; i++) {
-                        u32 bit;
+                        u32 bit, nbits;
 
                         bit = qed_mcast_bin_from_mac(p_filter_cmd->mac[i]);
-                        __set_bit(bit, bins);
+                        nbits = sizeof(u32) * BITS_PER_BYTE;
+                        bins[bit / nbits] |= 1 << (bit % nbits);
                 }
 
                 /* Convert to correct endianity */
                 for (i = 0; i < ETH_MULTICAST_MAC_BINS_IN_REGS; i++) {
                         struct vport_update_ramrod_mcast *p_ramrod_bins;
-                        u32 *p_bins = (u32 *)bins;
 
                         p_ramrod_bins = &p_ramrod->approx_mcast;
-                        p_ramrod_bins->bins[i] = cpu_to_le32(p_bins[i]);
+                        p_ramrod_bins->bins[i] = cpu_to_le32(bins[i]);
                 }
         }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.h b/drivers/net/ethernet/qlogic/qed/qed_l2.h
index 806a8da257e9..8d80f1095d17 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.h
@@ -215,7 +215,7 @@ struct qed_sp_vport_update_params {
         u8                              anti_spoofing_en;
         u8                              update_accept_any_vlan_flg;
         u8                              accept_any_vlan;
-        unsigned long                   bins[8];
+        u32                             bins[8];
         struct qed_rss_params           *rss_params;
         struct qed_filter_accept_flags  accept_flags;
         struct qed_sge_tpa_params       *sge_tpa_params;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 0cbc74d6ca8b..758a9a5127fa 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -371,7 +371,7 @@ static struct qed_dev *qed_probe(struct pci_dev *pdev,
                 goto err2;
         }
 
-        DP_INFO(cdev, "qed_probe completed successffuly\n");
+        DP_INFO(cdev, "qed_probe completed successfully\n");
 
         return cdev;
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index 4e0b443c9519..cdd645024a32 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -592,6 +592,9 @@ int qed_mcp_nvm_wr_cmd(struct qed_hwfn *p_hwfn,
         *o_mcp_resp = mb_params.mcp_resp;
         *o_mcp_param = mb_params.mcp_param;
 
+        /* nvm_info needs to be updated */
+        p_hwfn->nvm_info.valid = false;
+
         return 0;
 }
 
@@ -1208,6 +1211,7 @@ static void qed_mcp_handle_link_change(struct qed_hwfn *p_hwfn,
                 break;
         default:
                 p_link->speed = 0;
+                p_link->link_up = 0;
         }
 
         if (p_link->link_up && p_link->speed)
@@ -1305,9 +1309,15 @@ int qed_mcp_set_link(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt, bool b_up)
         phy_cfg.pause |= (params->pause.forced_tx) ? ETH_PAUSE_TX : 0;
         phy_cfg.adv_speed = params->speed.advertised_speeds;
         phy_cfg.loopback_mode = params->loopback_mode;
-        if (p_hwfn->mcp_info->capabilities & FW_MB_PARAM_FEATURE_SUPPORT_EEE) {
-                if (params->eee.enable)
-                        phy_cfg.eee_cfg |= EEE_CFG_EEE_ENABLED;
+
+        /* There are MFWs that share this capability regardless of whether
+         * this is feasible or not. And given that at the very least adv_caps
+         * would be set internally by qed, we want to make sure LFA would
+         * still work.
+         */
+        if ((p_hwfn->mcp_info->capabilities &
+             FW_MB_PARAM_FEATURE_SUPPORT_EEE) && params->eee.enable) {
+                phy_cfg.eee_cfg |= EEE_CFG_EEE_ENABLED;
                 if (params->eee.tx_lpi_enable)
                         phy_cfg.eee_cfg |= EEE_CFG_TX_LPI;
                 if (params->eee.adv_caps & QED_EEE_1G_ADV)
@@ -2555,11 +2565,14 @@ int qed_mcp_bist_nvm_get_image_att(struct qed_hwfn *p_hwfn,
 
 int qed_mcp_nvm_info_populate(struct qed_hwfn *p_hwfn)
 {
-        struct qed_nvm_image_info *nvm_info = &p_hwfn->nvm_info;
+        struct qed_nvm_image_info nvm_info;
         struct qed_ptt *p_ptt;
         int rc;
         u32 i;
 
+        if (p_hwfn->nvm_info.valid)
+                return 0;
+
         p_ptt = qed_ptt_acquire(p_hwfn);
         if (!p_ptt) {
                 DP_ERR(p_hwfn, "failed to acquire ptt\n");
@@ -2567,29 +2580,29 @@ int qed_mcp_nvm_info_populate(struct qed_hwfn *p_hwfn)
         }
 
         /* Acquire from MFW the amount of available images */
-        nvm_info->num_images = 0;
+        nvm_info.num_images = 0;
         rc = qed_mcp_bist_nvm_get_num_images(p_hwfn,
-                                             p_ptt, &nvm_info->num_images);
+                                             p_ptt, &nvm_info.num_images);
         if (rc == -EOPNOTSUPP) {
                 DP_INFO(p_hwfn, "DRV_MSG_CODE_BIST_TEST is not supported\n");
                 goto out;
-        } else if (rc || !nvm_info->num_images) {
+        } else if (rc || !nvm_info.num_images) {
                 DP_ERR(p_hwfn, "Failed getting number of images\n");
                 goto err0;
         }
 
-        nvm_info->image_att = kmalloc_array(nvm_info->num_images,
-                                            sizeof(struct bist_nvm_image_att),
-                                            GFP_KERNEL);
-        if (!nvm_info->image_att) {
+        nvm_info.image_att = kmalloc_array(nvm_info.num_images,
+                                           sizeof(struct bist_nvm_image_att),
+                                           GFP_KERNEL);
+        if (!nvm_info.image_att) {
                 rc = -ENOMEM;
                 goto err0;
         }
 
         /* Iterate over images and get their attributes */
-        for (i = 0; i < nvm_info->num_images; i++) {
+        for (i = 0; i < nvm_info.num_images; i++) {
                 rc = qed_mcp_bist_nvm_get_image_att(p_hwfn, p_ptt,
-                                                    &nvm_info->image_att[i], i);
+                                                    &nvm_info.image_att[i], i);
                 if (rc) {
                         DP_ERR(p_hwfn,
                                "Failed getting image index %d attributes\n", i);
@@ -2597,14 +2610,22 @@ int qed_mcp_nvm_info_populate(struct qed_hwfn *p_hwfn)
                 }
 
                 DP_VERBOSE(p_hwfn, QED_MSG_SP, "image index %d, size %x\n", i,
-                           nvm_info->image_att[i].len);
+                           nvm_info.image_att[i].len);
         }
 out:
+        /* Update hwfn's nvm_info */
+        if (nvm_info.num_images) {
+                p_hwfn->nvm_info.num_images = nvm_info.num_images;
+                kfree(p_hwfn->nvm_info.image_att);
+                p_hwfn->nvm_info.image_att = nvm_info.image_att;
+                p_hwfn->nvm_info.valid = true;
+        }
+
         qed_ptt_release(p_hwfn, p_ptt);
         return 0;
 
 err1:
-        kfree(nvm_info->image_att);
+        kfree(nvm_info.image_att);
 err0:
         qed_ptt_release(p_hwfn, p_ptt);
         return rc;
@@ -2641,6 +2662,7 @@ qed_mcp_get_nvm_image_att(struct qed_hwfn *p_hwfn,
                 return -EINVAL;
         }
 
+        qed_mcp_nvm_info_populate(p_hwfn);
         for (i = 0; i < p_hwfn->nvm_info.num_images; i++)
                 if (type == p_hwfn->nvm_info.image_att[i].image_type)
                         break;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
index fd59cf45f4be..26e918d7f2f9 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
@@ -2831,7 +2831,7 @@ qed_iov_vp_update_mcast_bin_param(struct qed_hwfn *p_hwfn,
 
         p_data->update_approx_mcast_flg = 1;
         memcpy(p_data->bins, p_mcast_tlv->bins,
-               sizeof(unsigned long) * ETH_MULTICAST_MAC_BINS_IN_REGS);
+               sizeof(u32) * ETH_MULTICAST_MAC_BINS_IN_REGS);
         *tlvs_mask |= 1 << QED_IOV_VP_UPDATE_MCAST;
 }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c
index 2d7fcd6a0777..be6ddde1a104 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c
@@ -1126,7 +1126,7 @@ int qed_vf_pf_vport_update(struct qed_hwfn *p_hwfn,
                 resp_size += sizeof(struct pfvf_def_resp_tlv);
 
                 memcpy(p_mcast_tlv->bins, p_params->bins,
-                       sizeof(unsigned long) * ETH_MULTICAST_MAC_BINS_IN_REGS);
+                       sizeof(u32) * ETH_MULTICAST_MAC_BINS_IN_REGS);
         }
 
         update_rx = p_params->accept_flags.update_rx_mode_config;
@@ -1272,7 +1272,7 @@ void qed_vf_pf_filter_mcast(struct qed_hwfn *p_hwfn,
                         u32 bit;
 
                         bit = qed_mcast_bin_from_mac(p_filter_cmd->mac[i]);
-                        __set_bit(bit, sp_params.bins);
+                        sp_params.bins[bit / 32] |= 1 << (bit % 32);
                 }
         }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.h b/drivers/net/ethernet/qlogic/qed/qed_vf.h
index 4f05d5eb3cf5..033409db86ae 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_vf.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_vf.h
@@ -392,7 +392,12 @@ struct vfpf_vport_update_mcast_bin_tlv {
         struct channel_tlv tl;
         u8 padding[4];
 
-        u64 bins[8];
+        /* There are only 256 approx bins, and in HSI they're divided into
+         * 32-bit values. As old VFs used to set-bit to the values on its side,
+         * the upper half of the array is never expected to contain any data.
+         */
+        u64 bins[4];
+        u64 obsolete_bins[4];
 };
 
 struct vfpf_vport_update_accept_param_tlv {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
index 891f03a7a33d..8d7b9bb910f2 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
@@ -1128,6 +1128,8 @@ static ssize_t qlcnic_83xx_sysfs_flash_write_handler(struct file *filp,
         struct qlcnic_adapter *adapter = dev_get_drvdata(dev);
 
         ret = kstrtoul(buf, 16, &data);
+        if (ret)
+                return ret;
 
         switch (data) {
         case QLC_83XX_FLASH_SECTOR_ERASE_CMD:
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index 5803cd6db406..206f0266463e 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -658,7 +658,7 @@ qcaspi_netdev_open(struct net_device *dev)
                 return ret;
         }
 
-        netif_start_queue(qca->net_dev);
+        /* SPI thread takes care of TX queue */
 
         return 0;
 }
@@ -760,6 +760,9 @@ qcaspi_netdev_tx_timeout(struct net_device *dev)
         qca->net_dev->stats.tx_errors++;
         /* Trigger tx queue flush and QCA7000 reset */
         qca->sync = QCASPI_SYNC_UNKNOWN;
+
+        if (qca->spi_thread)
+                wake_up_process(qca->spi_thread);
 }
 
 static int
@@ -878,22 +881,22 @@ qca_spi_probe(struct spi_device *spi)
 
         if ((qcaspi_clkspeed < QCASPI_CLK_SPEED_MIN) ||
             (qcaspi_clkspeed > QCASPI_CLK_SPEED_MAX)) {
-                dev_info(&spi->dev, "Invalid clkspeed: %d\n",
-                         qcaspi_clkspeed);
+                dev_err(&spi->dev, "Invalid clkspeed: %d\n",
+                        qcaspi_clkspeed);
                 return -EINVAL;
         }
 
         if ((qcaspi_burst_len < QCASPI_BURST_LEN_MIN) ||
             (qcaspi_burst_len > QCASPI_BURST_LEN_MAX)) {
-                dev_info(&spi->dev, "Invalid burst len: %d\n",
-                         qcaspi_burst_len);
+                dev_err(&spi->dev, "Invalid burst len: %d\n",
+                        qcaspi_burst_len);
                 return -EINVAL;
         }
 
         if ((qcaspi_pluggable < QCASPI_PLUGGABLE_MIN) ||
             (qcaspi_pluggable > QCASPI_PLUGGABLE_MAX)) {
-                dev_info(&spi->dev, "Invalid pluggable: %d\n",
-                         qcaspi_pluggable);
+                dev_err(&spi->dev, "Invalid pluggable: %d\n",
+                        qcaspi_pluggable);
                 return -EINVAL;
         }
 
@@ -955,8 +958,8 @@ qca_spi_probe(struct spi_device *spi)
         }
 
         if (register_netdev(qcaspi_devs)) {
-                dev_info(&spi->dev, "Unable to register net device %s\n",
-                         qcaspi_devs->name);
+                dev_err(&spi->dev, "Unable to register net device %s\n",
+                        qcaspi_devs->name);
                 free_netdev(qcaspi_devs);
                 return -EFAULT;
         }
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index f4cae2be0fda..eaedc11ed686 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -7734,8 +7734,7 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 return rc;
         }
 
-        /* override BIOS settings, use userspace tools to enable WOL */
-        __rtl8169_set_wol(tp, 0);
+        tp->saved_wolopts = __rtl8169_get_wol(tp);
 
         if (rtl_tbi_enabled(tp)) {
                 tp->set_speed = rtl8169_set_speed_tbi;
@@ -7789,6 +7788,7 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 NETIF_F_HW_VLAN_CTAG_RX;
         dev->vlan_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO |
                 NETIF_F_HIGHDMA;
+        dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
 
         tp->cp_cmd |= RxChkSum | RxVlan;
 
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 68f122140966..0d811c02ff34 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -980,6 +980,13 @@ static void ravb_adjust_link(struct net_device *ndev)
         struct ravb_private *priv = netdev_priv(ndev);
         struct phy_device *phydev = ndev->phydev;
         bool new_state = false;
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        /* Disable TX and RX right over here, if E-MAC change is ignored */
+        if (priv->no_avb_link)
+                ravb_rcv_snd_disable(ndev);
 
         if (phydev->link) {
                 if (phydev->duplex != priv->duplex) {
@@ -997,18 +1004,21 @@ static void ravb_adjust_link(struct net_device *ndev)
                         ravb_modify(ndev, ECMR, ECMR_TXF, 0);
                         new_state = true;
                         priv->link = phydev->link;
-                        if (priv->no_avb_link)
-                                ravb_rcv_snd_enable(ndev);
                 }
         } else if (priv->link) {
                 new_state = true;
                 priv->link = 0;
                 priv->speed = 0;
                 priv->duplex = -1;
-                if (priv->no_avb_link)
-                        ravb_rcv_snd_disable(ndev);
         }
 
+        /* Enable TX and RX right over here, if E-MAC change is ignored */
+        if (priv->no_avb_link && phydev->link)
+                ravb_rcv_snd_enable(ndev);
+
+        mmiowb();
+        spin_unlock_irqrestore(&priv->lock, flags);
+
         if (new_state && netif_msg_link(priv))
                 phy_print_status(phydev);
 }
@@ -1096,75 +1106,6 @@ static int ravb_phy_start(struct net_device *ndev)
         return 0;
 }
 
-static int ravb_get_link_ksettings(struct net_device *ndev,
-                                   struct ethtool_link_ksettings *cmd)
-{
-        struct ravb_private *priv = netdev_priv(ndev);
-        unsigned long flags;
-
-        if (!ndev->phydev)
-                return -ENODEV;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        phy_ethtool_ksettings_get(ndev->phydev, cmd);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        return 0;
-}
-
-static int ravb_set_link_ksettings(struct net_device *ndev,
-                                   const struct ethtool_link_ksettings *cmd)
-{
-        struct ravb_private *priv = netdev_priv(ndev);
-        unsigned long flags;
-        int error;
-
-        if (!ndev->phydev)
-                return -ENODEV;
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        /* Disable TX and RX */
-        ravb_rcv_snd_disable(ndev);
-
-        error = phy_ethtool_ksettings_set(ndev->phydev, cmd);
-        if (error)
-                goto error_exit;
-
-        if (cmd->base.duplex == DUPLEX_FULL)
-                priv->duplex = 1;
-        else
-                priv->duplex = 0;
-
-        ravb_set_duplex(ndev);
-
-error_exit:
-        mdelay(1);
-
-        /* Enable TX and RX */
-        ravb_rcv_snd_enable(ndev);
-
-        mmiowb();
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        return error;
-}
-
-static int ravb_nway_reset(struct net_device *ndev)
-{
-        struct ravb_private *priv = netdev_priv(ndev);
-        int error = -ENODEV;
-        unsigned long flags;
-
-        if (ndev->phydev) {
-                spin_lock_irqsave(&priv->lock, flags);
-                error = phy_start_aneg(ndev->phydev);
-                spin_unlock_irqrestore(&priv->lock, flags);
-        }
-
-        return error;
-}
-
 static u32 ravb_get_msglevel(struct net_device *ndev)
 {
         struct ravb_private *priv = netdev_priv(ndev);
@@ -1377,7 +1318,7 @@ static int ravb_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
 }
 
 static const struct ethtool_ops ravb_ethtool_ops = {
-        .nway_reset             = ravb_nway_reset,
+        .nway_reset             = phy_ethtool_nway_reset,
         .get_msglevel           = ravb_get_msglevel,
         .set_msglevel           = ravb_set_msglevel,
         .get_link               = ethtool_op_get_link,
@@ -1387,8 +1328,8 @@ static const struct ethtool_ops ravb_ethtool_ops = {
         .get_ringparam          = ravb_get_ringparam,
         .set_ringparam          = ravb_set_ringparam,
         .get_ts_info            = ravb_get_ts_info,
-        .get_link_ksettings     = ravb_get_link_ksettings,
-        .set_link_ksettings     = ravb_set_link_ksettings,
+        .get_link_ksettings     = phy_ethtool_get_link_ksettings,
+        .set_link_ksettings     = phy_ethtool_set_link_ksettings,
         .get_wol                = ravb_get_wol,
         .set_wol                = ravb_set_wol,
 };
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index e9007b613f17..5614fd231bbe 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1927,8 +1927,15 @@ static void sh_eth_adjust_link(struct net_device *ndev)
 {
         struct sh_eth_private *mdp = netdev_priv(ndev);
         struct phy_device *phydev = ndev->phydev;
+        unsigned long flags;
         int new_state = 0;
 
+        spin_lock_irqsave(&mdp->lock, flags);
+
+        /* Disable TX and RX right over here, if E-MAC change is ignored */
+        if (mdp->cd->no_psr || mdp->no_ether_link)
+                sh_eth_rcv_snd_disable(ndev);
+
         if (phydev->link) {
                 if (phydev->duplex != mdp->duplex) {
                         new_state = 1;
@@ -1947,18 +1954,21 @@ static void sh_eth_adjust_link(struct net_device *ndev)
                         sh_eth_modify(ndev, ECMR, ECMR_TXF, 0);
                         new_state = 1;
                         mdp->link = phydev->link;
-                        if (mdp->cd->no_psr || mdp->no_ether_link)
-                                sh_eth_rcv_snd_enable(ndev);
                 }
         } else if (mdp->link) {
                 new_state = 1;
                 mdp->link = 0;
                 mdp->speed = 0;
                 mdp->duplex = -1;
-                if (mdp->cd->no_psr || mdp->no_ether_link)
-                        sh_eth_rcv_snd_disable(ndev);
         }
 
+        /* Enable TX and RX right over here, if E-MAC change is ignored */
+        if ((mdp->cd->no_psr || mdp->no_ether_link) && phydev->link)
+                sh_eth_rcv_snd_enable(ndev);
+
+        mmiowb();
+        spin_unlock_irqrestore(&mdp->lock, flags);
+
         if (new_state && netif_msg_link(mdp))
                 phy_print_status(phydev);
 }
@@ -2030,60 +2040,6 @@ static int sh_eth_phy_start(struct net_device *ndev)
         return 0;
 }
 
-static int sh_eth_get_link_ksettings(struct net_device *ndev,
-                                     struct ethtool_link_ksettings *cmd)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        unsigned long flags;
-
-        if (!ndev->phydev)
-                return -ENODEV;
-
-        spin_lock_irqsave(&mdp->lock, flags);
-        phy_ethtool_ksettings_get(ndev->phydev, cmd);
-        spin_unlock_irqrestore(&mdp->lock, flags);
-
-        return 0;
-}
-
-static int sh_eth_set_link_ksettings(struct net_device *ndev,
-                                     const struct ethtool_link_ksettings *cmd)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        unsigned long flags;
-        int ret;
-
-        if (!ndev->phydev)
-                return -ENODEV;
-
-        spin_lock_irqsave(&mdp->lock, flags);
-
-        /* disable tx and rx */
-        sh_eth_rcv_snd_disable(ndev);
-
-        ret = phy_ethtool_ksettings_set(ndev->phydev, cmd);
-        if (ret)
-                goto error_exit;
-
-        if (cmd->base.duplex == DUPLEX_FULL)
-                mdp->duplex = 1;
-        else
-                mdp->duplex = 0;
-
-        if (mdp->cd->set_duplex)
-                mdp->cd->set_duplex(ndev);
-
-error_exit:
-        mdelay(1);
-
-        /* enable tx and rx */
-        sh_eth_rcv_snd_enable(ndev);
-
-        spin_unlock_irqrestore(&mdp->lock, flags);
-
-        return ret;
-}
-
 /* If it is ever necessary to increase SH_ETH_REG_DUMP_MAX_REGS, the
  * version must be bumped as well.  Just adding registers up to that
  * limit is fine, as long as the existing register indices don't
@@ -2263,22 +2219,6 @@ static void sh_eth_get_regs(struct net_device *ndev, struct ethtool_regs *regs,
         pm_runtime_put_sync(&mdp->pdev->dev);
 }
 
-static int sh_eth_nway_reset(struct net_device *ndev)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        unsigned long flags;
-        int ret;
-
-        if (!ndev->phydev)
-                return -ENODEV;
-
-        spin_lock_irqsave(&mdp->lock, flags);
-        ret = phy_start_aneg(ndev->phydev);
-        spin_unlock_irqrestore(&mdp->lock, flags);
-
-        return ret;
-}
-
 static u32 sh_eth_get_msglevel(struct net_device *ndev)
 {
         struct sh_eth_private *mdp = netdev_priv(ndev);
@@ -2429,7 +2369,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
 static const struct ethtool_ops sh_eth_ethtool_ops = {
         .get_regs_len   = sh_eth_get_regs_len,
         .get_regs       = sh_eth_get_regs,
-        .nway_reset     = sh_eth_nway_reset,
+        .nway_reset     = phy_ethtool_nway_reset,
         .get_msglevel   = sh_eth_get_msglevel,
         .set_msglevel   = sh_eth_set_msglevel,
         .get_link       = ethtool_op_get_link,
@@ -2438,8 +2378,8 @@ static const struct ethtool_ops sh_eth_ethtool_ops = {
         .get_sset_count     = sh_eth_get_sset_count,
         .get_ringparam  = sh_eth_get_ringparam,
         .set_ringparam  = sh_eth_set_ringparam,
-        .get_link_ksettings = sh_eth_get_link_ksettings,
-        .set_link_ksettings = sh_eth_set_link_ksettings,
+        .get_link_ksettings = phy_ethtool_get_link_ksettings,
+        .set_link_ksettings = phy_ethtool_set_link_ksettings,
         .get_wol        = sh_eth_get_wol,
         .set_wol        = sh_eth_set_wol,
 };
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 23f0785c0573..7eeac3d6cfe8 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -4288,9 +4288,9 @@ static int efx_ef10_filter_pri(struct efx_ef10_filter_table *table,
         return -EPROTONOSUPPORT;
 }
 
-static s32 efx_ef10_filter_insert(struct efx_nic *efx,
-                                  struct efx_filter_spec *spec,
-                                  bool replace_equal)
+static s32 efx_ef10_filter_insert_locked(struct efx_nic *efx,
+                                         struct efx_filter_spec *spec,
+                                         bool replace_equal)
 {
         DECLARE_BITMAP(mc_rem_map, EFX_EF10_FILTER_SEARCH_LIMIT);
         struct efx_ef10_nic_data *nic_data = efx->nic_data;
@@ -4307,7 +4307,7 @@ static s32 efx_ef10_filter_insert(struct efx_nic *efx,
         bool is_mc_recip;
         s32 rc;
 
-        down_read(&efx->filter_sem);
+        WARN_ON(!rwsem_is_locked(&efx->filter_sem));
         table = efx->filter_state;
         down_write(&table->lock);
 
@@ -4498,10 +4498,22 @@ out_unlock:
         if (rss_locked)
                 mutex_unlock(&efx->rss_lock);
         up_write(&table->lock);
-        up_read(&efx->filter_sem);
         return rc;
 }
 
+static s32 efx_ef10_filter_insert(struct efx_nic *efx,
+                                  struct efx_filter_spec *spec,
+                                  bool replace_equal)
+{
+        s32 ret;
+
+        down_read(&efx->filter_sem);
+        ret = efx_ef10_filter_insert_locked(efx, spec, replace_equal);
+        up_read(&efx->filter_sem);
+
+        return ret;
+}
+
 static void efx_ef10_filter_update_rx_scatter(struct efx_nic *efx)
 {
         /* no need to do anything here on EF10 */
@@ -5285,7 +5297,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
                 EFX_WARN_ON_PARANOID(ids[i] != EFX_EF10_FILTER_ID_INVALID);
                 efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
                 efx_filter_set_eth_local(&spec, vlan->vid, addr_list[i].addr);
-                rc = efx_ef10_filter_insert(efx, &spec, true);
+                rc = efx_ef10_filter_insert_locked(efx, &spec, true);
                 if (rc < 0) {
                         if (rollback) {
                                 netif_info(efx, drv, efx->net_dev,
@@ -5314,7 +5326,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
                 efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
                 eth_broadcast_addr(baddr);
                 efx_filter_set_eth_local(&spec, vlan->vid, baddr);
-                rc = efx_ef10_filter_insert(efx, &spec, true);
+                rc = efx_ef10_filter_insert_locked(efx, &spec, true);
                 if (rc < 0) {
                         netif_warn(efx, drv, efx->net_dev,
                                    "Broadcast filter insert failed rc=%d\n", rc);
@@ -5370,7 +5382,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
         if (vlan->vid != EFX_FILTER_VID_UNSPEC)
                 efx_filter_set_eth_local(&spec, vlan->vid, NULL);
 
-        rc = efx_ef10_filter_insert(efx, &spec, true);
+        rc = efx_ef10_filter_insert_locked(efx, &spec, true);
         if (rc < 0) {
                 const char *um = multicast ? "Multicast" : "Unicast";
                 const char *encap_name = "";
@@ -5430,7 +5442,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
                                            filter_flags, 0);
                         eth_broadcast_addr(baddr);
                         efx_filter_set_eth_local(&spec, vlan->vid, baddr);
-                        rc = efx_ef10_filter_insert(efx, &spec, true);
+                        rc = efx_ef10_filter_insert_locked(efx, &spec, true);
                         if (rc < 0) {
                                 netif_warn(efx, drv, efx->net_dev,
                                            "Broadcast filter insert failed rc=%d\n",
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 570ec72266f3..ce3a177081a8 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -1871,12 +1871,6 @@ static void efx_remove_filters(struct efx_nic *efx)
         up_write(&efx->filter_sem);
 }
 
-static void efx_restore_filters(struct efx_nic *efx)
-{
-        down_read(&efx->filter_sem);
-        efx->type->filter_table_restore(efx);
-        up_read(&efx->filter_sem);
-}
 
 /**************************************************************************
  *
@@ -2688,6 +2682,7 @@ void efx_reset_down(struct efx_nic *efx, enum reset_type method)
         efx_disable_interrupts(efx);
 
         mutex_lock(&efx->mac_lock);
+        down_write(&efx->filter_sem);
         mutex_lock(&efx->rss_lock);
         if (efx->port_initialized && method != RESET_TYPE_INVISIBLE &&
             method != RESET_TYPE_DATAPATH)
@@ -2745,9 +2740,8 @@ int efx_reset_up(struct efx_nic *efx, enum reset_type method, bool ok)
         if (efx->type->rx_restore_rss_contexts)
                 efx->type->rx_restore_rss_contexts(efx);
         mutex_unlock(&efx->rss_lock);
-        down_read(&efx->filter_sem);
-        efx_restore_filters(efx);
-        up_read(&efx->filter_sem);
+        efx->type->filter_table_restore(efx);
+        up_write(&efx->filter_sem);
         if (efx->type->sriov_reset)
                 efx->type->sriov_reset(efx);
 
@@ -2764,6 +2758,7 @@ fail:
         efx->port_initialized = false;
 
         mutex_unlock(&efx->rss_lock);
+        up_write(&efx->filter_sem);
         mutex_unlock(&efx->mac_lock);
 
         return rc;
@@ -3473,7 +3468,9 @@ static int efx_pci_probe_main(struct efx_nic *efx)
 
         efx_init_napi(efx);
 
+        down_write(&efx->filter_sem);
         rc = efx->type->init(efx);
+        up_write(&efx->filter_sem);
         if (rc) {
                 netif_err(efx, probe, efx->net_dev,
                           "failed to initialise NIC\n");
@@ -3765,7 +3762,9 @@ static int efx_pm_resume(struct device *dev)
         rc = efx->type->reset(efx, RESET_TYPE_ALL);
         if (rc)
                 return rc;
+        down_write(&efx->filter_sem);
         rc = efx->type->init(efx);
+        up_write(&efx->filter_sem);
         if (rc)
                 return rc;
         rc = efx_pm_thaw(dev);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
index 2e6e2a96b4f2..f9a61f90cfbc 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
@@ -37,7 +37,7 @@
  *              is done in the "stmmac files"
  */
 
-/* struct emac_variant - Descrive dwmac-sun8i hardware variant
+/* struct emac_variant - Describe dwmac-sun8i hardware variant
  * @default_syscon_value:       The default value of the EMAC register in syscon
  *                              This value is used for disabling properly EMAC
  *                              and used as a good starting value in case of the
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 60f59abab009..ef6a8d39db2f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -53,7 +53,7 @@
 #include "dwmac1000.h"
 #include "hwif.h"
 
-#define STMMAC_ALIGN(x) L1_CACHE_ALIGN(x)
+#define STMMAC_ALIGN(x)         __ALIGN_KERNEL(x, SMP_CACHE_BYTES)
 #define TSO_MAX_BUFF_SIZE       (SZ_16K - 1)
 
 /* Module parameters */
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
index 8d375e51a526..6a393b16a1fc 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
@@ -257,7 +257,7 @@ static int stmmac_pci_probe(struct pci_dev *pdev,
                 return -ENOMEM;
 
         /* Enable pci device */
-        ret = pcim_enable_device(pdev);
+        ret = pci_enable_device(pdev);
         if (ret) {
                 dev_err(&pdev->dev, "%s: ERROR: failed to enable device\n",
                         __func__);
@@ -300,9 +300,45 @@ static int stmmac_pci_probe(struct pci_dev *pdev,
 static void stmmac_pci_remove(struct pci_dev *pdev)
 {
         stmmac_dvr_remove(&pdev->dev);
+        pci_disable_device(pdev);
 }
 
-static SIMPLE_DEV_PM_OPS(stmmac_pm_ops, stmmac_suspend, stmmac_resume);
+static int stmmac_pci_suspend(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        int ret;
+
+        ret = stmmac_suspend(dev);
+        if (ret)
+                return ret;
+
+        ret = pci_save_state(pdev);
+        if (ret)
+                return ret;
+
+        pci_disable_device(pdev);
+        pci_wake_from_d3(pdev, true);
+        return 0;
+}
+
+static int stmmac_pci_resume(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        int ret;
+
+        pci_restore_state(pdev);
+        pci_set_power_state(pdev, PCI_D0);
+
+        ret = pci_enable_device(pdev);
+        if (ret)
+                return ret;
+
+        pci_set_master(pdev);
+
+        return stmmac_resume(dev);
+}
+
+static SIMPLE_DEV_PM_OPS(stmmac_pm_ops, stmmac_pci_suspend, stmmac_pci_resume);
 
 /* synthetic ID, no official vendor */
 #define PCI_VENDOR_ID_STMMAC 0x700
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 6d141f3931eb..72da77b94ecd 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -94,7 +94,6 @@ static int dwmac1000_validate_ucast_entries(int ucast_entries)
 /**
  * stmmac_axi_setup - parse DT parameters for programming the AXI register
  * @pdev: platform device
- * @priv: driver private struct.
  * Description:
  * if required, from device-tree the AXI internal register can be tuned
  * by using platform parameters.
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c b/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c
index 16c3bfbe1992..757a3b37ae8a 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c
@@ -218,6 +218,7 @@ issue:
         ret = of_mdiobus_register(bus, np1);
         if (ret) {
                 mdiobus_free(bus);
+                lp->mii_bus = NULL;
                 return ret;
         }
         return 0;
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 8e9d0ee1572b..31c3d77b4733 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -1274,6 +1274,7 @@ int netvsc_poll(struct napi_struct *napi, int budget)
         struct hv_device *device = netvsc_channel_to_device(channel);
         struct net_device *ndev = hv_get_drvdata(device);
         int work_done = 0;
+        int ret;
 
         /* If starting a new interval */
         if (!nvchan->desc)
@@ -1285,16 +1286,18 @@ int netvsc_poll(struct napi_struct *napi, int budget)
                 nvchan->desc = hv_pkt_iter_next(channel, nvchan->desc);
         }
 
-        /* If send of pending receive completions suceeded
-         *   and did not exhaust NAPI budget this time
-         *   and not doing busy poll
+        /* Send any pending receive completions */
+        ret = send_recv_completions(ndev, net_device, nvchan);
+
+        /* If it did not exhaust NAPI budget this time
+         *  and not doing busy poll
          * then re-enable host interrupts
-         *     and reschedule if ring is not empty.
+         *  and reschedule if ring is not empty
+         *   or sending receive completion failed.
          */
-        if (send_recv_completions(ndev, net_device, nvchan) == 0 &&
-            work_done < budget &&
+        if (work_done < budget &&
             napi_complete_done(napi, work_done) &&
-            hv_end_read(&channel->inbound) &&
+            (ret || hv_end_read(&channel->inbound)) &&
             napi_schedule_prep(napi)) {
                 hv_begin_read(&channel->inbound);
                 __napi_schedule(napi);
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 9b4e3c3787e5..408ece27131c 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -1338,6 +1338,7 @@ out:
         /* setting up multiple channels failed */
         net_device->max_chn = 1;
         net_device->num_chn = 1;
+        return 0;
 
 err_dev_remv:
         rndis_filter_device_remove(dev, net_device);
diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
index 64f1b1e77bc0..23a52b9293f3 100644
--- a/drivers/net/ieee802154/adf7242.c
+++ b/drivers/net/ieee802154/adf7242.c
@@ -275,6 +275,8 @@ struct adf7242_local {
         struct spi_message stat_msg;
         struct spi_transfer stat_xfer;
         struct dentry *debugfs_root;
+        struct delayed_work work;
+        struct workqueue_struct *wqueue;
         unsigned long flags;
         int tx_stat;
         bool promiscuous;
@@ -575,10 +577,26 @@ static int adf7242_cmd_rx(struct adf7242_local *lp)
         /* Wait until the ACK is sent */
         adf7242_wait_status(lp, RC_STATUS_PHY_RDY, RC_STATUS_MASK, __LINE__);
         adf7242_clear_irqstat(lp);
+        mod_delayed_work(lp->wqueue, &lp->work, msecs_to_jiffies(400));
 
         return adf7242_cmd(lp, CMD_RC_RX);
 }
 
+static void adf7242_rx_cal_work(struct work_struct *work)
+{
+        struct adf7242_local *lp =
+        container_of(work, struct adf7242_local, work.work);
+
+        /* Reissuing RC_RX every 400ms - to adjust for offset
+         * drift in receiver (datasheet page 61, OCL section)
+         */
+
+        if (!test_bit(FLAG_XMIT, &lp->flags)) {
+                adf7242_cmd(lp, CMD_RC_PHY_RDY);
+                adf7242_cmd_rx(lp);
+        }
+}
+
 static int adf7242_set_txpower(struct ieee802154_hw *hw, int mbm)
 {
         struct adf7242_local *lp = hw->priv;
@@ -686,7 +704,7 @@ static int adf7242_start(struct ieee802154_hw *hw)
         enable_irq(lp->spi->irq);
         set_bit(FLAG_START, &lp->flags);
 
-        return adf7242_cmd(lp, CMD_RC_RX);
+        return adf7242_cmd_rx(lp);
 }
 
 static void adf7242_stop(struct ieee802154_hw *hw)
@@ -694,6 +712,7 @@ static void adf7242_stop(struct ieee802154_hw *hw)
         struct adf7242_local *lp = hw->priv;
 
         disable_irq(lp->spi->irq);
+        cancel_delayed_work_sync(&lp->work);
         adf7242_cmd(lp, CMD_RC_IDLE);
         clear_bit(FLAG_START, &lp->flags);
         adf7242_clear_irqstat(lp);
@@ -719,7 +738,10 @@ static int adf7242_channel(struct ieee802154_hw *hw, u8 page, u8 channel)
         adf7242_write_reg(lp, REG_CH_FREQ1, freq >> 8);
         adf7242_write_reg(lp, REG_CH_FREQ2, freq >> 16);
 
-        return adf7242_cmd(lp, CMD_RC_RX);
+        if (test_bit(FLAG_START, &lp->flags))
+                return adf7242_cmd_rx(lp);
+        else
+                return adf7242_cmd(lp, CMD_RC_PHY_RDY);
 }
 
 static int adf7242_set_hw_addr_filt(struct ieee802154_hw *hw,
@@ -814,6 +836,7 @@ static int adf7242_xmit(struct ieee802154_hw *hw, struct sk_buff *skb)
         /* ensure existing instances of the IRQ handler have completed */
         disable_irq(lp->spi->irq);
         set_bit(FLAG_XMIT, &lp->flags);
+        cancel_delayed_work_sync(&lp->work);
         reinit_completion(&lp->tx_complete);
         adf7242_cmd(lp, CMD_RC_PHY_RDY);
         adf7242_clear_irqstat(lp);
@@ -952,6 +975,7 @@ static irqreturn_t adf7242_isr(int irq, void *data)
         unsigned int xmit;
         u8 irq1;
 
+        mod_delayed_work(lp->wqueue, &lp->work, msecs_to_jiffies(400));
         adf7242_read_reg(lp, REG_IRQ1_SRC1, &irq1);
 
         if (!(irq1 & (IRQ_RX_PKT_RCVD | IRQ_CSMA_CA)))
@@ -1241,6 +1265,9 @@ static int adf7242_probe(struct spi_device *spi)
         spi_message_add_tail(&lp->stat_xfer, &lp->stat_msg);
 
         spi_set_drvdata(spi, lp);
+        INIT_DELAYED_WORK(&lp->work, adf7242_rx_cal_work);
+        lp->wqueue = alloc_ordered_workqueue(dev_name(&spi->dev),
+                                             WQ_MEM_RECLAIM);
 
         ret = adf7242_hw_init(lp);
         if (ret)
@@ -1284,6 +1311,9 @@ static int adf7242_remove(struct spi_device *spi)
         if (!IS_ERR_OR_NULL(lp->debugfs_root))
                 debugfs_remove_recursive(lp->debugfs_root);
 
+        cancel_delayed_work_sync(&lp->work);
+        destroy_workqueue(lp->wqueue);
+
         ieee802154_unregister_hw(lp->hw);
         mutex_destroy(&lp->bmux);
         ieee802154_free_hw(lp->hw);
diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index 77abedf0b524..3d9e91579866 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -940,7 +940,7 @@ at86rf230_xmit(struct ieee802154_hw *hw, struct sk_buff *skb)
 static int
 at86rf230_ed(struct ieee802154_hw *hw, u8 *level)
 {
-        BUG_ON(!level);
+        WARN_ON(!level);
         *level = 0xbe;
         return 0;
 }
@@ -1121,8 +1121,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw,
         if (changed & IEEE802154_AFILT_SADDR_CHANGED) {
                 u16 addr = le16_to_cpu(filt->short_addr);
 
-                dev_vdbg(&lp->spi->dev,
-                         "at86rf230_set_hw_addr_filt called for saddr\n");
+                dev_vdbg(&lp->spi->dev, "%s called for saddr\n", __func__);
                 __at86rf230_write(lp, RG_SHORT_ADDR_0, addr);
                 __at86rf230_write(lp, RG_SHORT_ADDR_1, addr >> 8);
         }
@@ -1130,8 +1129,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw,
         if (changed & IEEE802154_AFILT_PANID_CHANGED) {
                 u16 pan = le16_to_cpu(filt->pan_id);
 
-                dev_vdbg(&lp->spi->dev,
-                         "at86rf230_set_hw_addr_filt called for pan id\n");
+                dev_vdbg(&lp->spi->dev, "%s called for pan id\n", __func__);
                 __at86rf230_write(lp, RG_PAN_ID_0, pan);
                 __at86rf230_write(lp, RG_PAN_ID_1, pan >> 8);
         }
@@ -1140,15 +1138,13 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw,
                 u8 i, addr[8];
 
                 memcpy(addr, &filt->ieee_addr, 8);
-                dev_vdbg(&lp->spi->dev,
-                         "at86rf230_set_hw_addr_filt called for IEEE addr\n");
+                dev_vdbg(&lp->spi->dev, "%s called for IEEE addr\n", __func__);
                 for (i = 0; i < 8; i++)
                         __at86rf230_write(lp, RG_IEEE_ADDR_0 + i, addr[i]);
         }
 
         if (changed & IEEE802154_AFILT_PANC_CHANGED) {
-                dev_vdbg(&lp->spi->dev,
-                         "at86rf230_set_hw_addr_filt called for panc change\n");
+                dev_vdbg(&lp->spi->dev, "%s called for panc change\n", __func__);
                 if (filt->pan_coord)
                         at86rf230_write_subreg(lp, SR_AACK_I_AM_COORD, 1);
                 else
@@ -1252,7 +1248,6 @@ at86rf230_set_cca_mode(struct ieee802154_hw *hw,
         return at86rf230_write_subreg(lp, SR_CCA_MODE, val);
 }
 
-
 static int
 at86rf230_set_cca_ed_level(struct ieee802154_hw *hw, s32 mbm)
 {
diff --git a/drivers/net/ieee802154/fakelb.c b/drivers/net/ieee802154/fakelb.c
index 0d673f7682ee..176395e4b7bb 100644
--- a/drivers/net/ieee802154/fakelb.c
+++ b/drivers/net/ieee802154/fakelb.c
@@ -49,7 +49,7 @@ struct fakelb_phy {
 
 static int fakelb_hw_ed(struct ieee802154_hw *hw, u8 *level)
 {
-        BUG_ON(!level);
+        WARN_ON(!level);
         *level = 0xbe;
 
         return 0;
diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c
index de0d7f28a181..e428277781ac 100644
--- a/drivers/net/ieee802154/mcr20a.c
+++ b/drivers/net/ieee802154/mcr20a.c
@@ -15,10 +15,11 @@
  */
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/gpio.h>
+#include <linux/gpio/consumer.h>
 #include <linux/spi/spi.h>
 #include <linux/workqueue.h>
 #include <linux/interrupt.h>
+#include <linux/irq.h>
 #include <linux/skbuff.h>
 #include <linux/of_gpio.h>
 #include <linux/regmap.h>
diff --git a/drivers/net/netdevsim/devlink.c b/drivers/net/netdevsim/devlink.c
index ba663e5af168..5135fc371f01 100644
--- a/drivers/net/netdevsim/devlink.c
+++ b/drivers/net/netdevsim/devlink.c
@@ -207,6 +207,7 @@ void nsim_devlink_teardown(struct netdevsim *ns)
                 struct net *net = nsim_to_net(ns);
                 bool *reg_devlink = net_generic(net, nsim_devlink_id);
 
+                devlink_resources_unregister(ns->devlink, NULL);
                 devlink_unregister(ns->devlink);
                 devlink_free(ns->devlink);
                 ns->devlink = NULL;
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index b8f57e9b9379..1cd439bdf608 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -130,8 +130,9 @@
 #define MII_88E1318S_PHY_WOL_CTRL_CLEAR_WOL_STATUS              BIT(12)
 #define MII_88E1318S_PHY_WOL_CTRL_MAGIC_PACKET_MATCH_ENABLE     BIT(14)
 
-#define MII_88E1121_PHY_LED_CTRL        16
+#define MII_PHY_LED_CTRL                16
 #define MII_88E1121_PHY_LED_DEF         0x0030
+#define MII_88E1510_PHY_LED_DEF         0x1177
 
 #define MII_M1011_PHY_STATUS            0x11
 #define MII_M1011_PHY_STATUS_1000       0x8000
@@ -632,8 +633,40 @@ error:
         return err;
 }
 
+static void marvell_config_led(struct phy_device *phydev)
+{
+        u16 def_config;
+        int err;
+
+        switch (MARVELL_PHY_FAMILY_ID(phydev->phy_id)) {
+        /* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */
+        case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1121R):
+        case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1318S):
+                def_config = MII_88E1121_PHY_LED_DEF;
+                break;
+        /* Default PHY LED config:
+         * LED[0] .. 1000Mbps Link
+         * LED[1] .. 100Mbps Link
+         * LED[2] .. Blink, Activity
+         */
+        case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1510):
+                def_config = MII_88E1510_PHY_LED_DEF;
+                break;
+        default:
+                return;
+        }
+
+        err = phy_write_paged(phydev, MII_MARVELL_LED_PAGE, MII_PHY_LED_CTRL,
+                              def_config);
+        if (err < 0)
+                pr_warn("Fail to config marvell phy LED.\n");
+}
+
 static int marvell_config_init(struct phy_device *phydev)
 {
+        /* Set defalut LED */
+        marvell_config_led(phydev);
+
         /* Set registers from marvell,reg-init DT property */
         return marvell_of_reg_init(phydev);
 }
@@ -813,21 +846,6 @@ static int m88e1111_config_init(struct phy_device *phydev)
         return genphy_soft_reset(phydev);
 }
 
-static int m88e1121_config_init(struct phy_device *phydev)
-{
-        int err;
-
-        /* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */
-        err = phy_write_paged(phydev, MII_MARVELL_LED_PAGE,
-                              MII_88E1121_PHY_LED_CTRL,
-                              MII_88E1121_PHY_LED_DEF);
-        if (err < 0)
-                return err;
-
-        /* Set marvell,reg-init configuration from device tree */
-        return marvell_config_init(phydev);
-}
-
 static int m88e1318_config_init(struct phy_device *phydev)
 {
         if (phy_interrupt_is_valid(phydev)) {
@@ -841,7 +859,7 @@ static int m88e1318_config_init(struct phy_device *phydev)
                         return err;
         }
 
-        return m88e1121_config_init(phydev);
+        return marvell_config_init(phydev);
 }
 
 static int m88e1510_config_init(struct phy_device *phydev)
@@ -2087,7 +2105,7 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES,
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = &m88e1121_probe,
-                .config_init = &m88e1121_config_init,
+                .config_init = &marvell_config_init,
                 .config_aneg = &m88e1121_config_aneg,
                 .read_status = &marvell_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
diff --git a/drivers/net/phy/mdio-mux-bcm-iproc.c b/drivers/net/phy/mdio-mux-bcm-iproc.c
index 0831b7142df7..0c5b68e7da51 100644
--- a/drivers/net/phy/mdio-mux-bcm-iproc.c
+++ b/drivers/net/phy/mdio-mux-bcm-iproc.c
@@ -218,7 +218,7 @@ out:
 
 static int mdio_mux_iproc_remove(struct platform_device *pdev)
 {
-        struct iproc_mdiomux_desc *md = dev_get_platdata(&pdev->dev);
+        struct iproc_mdiomux_desc *md = platform_get_drvdata(pdev);
 
         mdio_mux_uninit(md->mux_handle);
         mdiobus_unregister(md->mii_bus);
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 537297d2b4b4..6c9b24fe3148 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -514,7 +514,7 @@ static int phy_start_aneg_priv(struct phy_device *phydev, bool sync)
          * negotiation may already be done and aneg interrupt may not be
          * generated.
          */
-        if (phy_interrupt_is_valid(phydev) && (phydev->state == PHY_AN)) {
+        if (phydev->irq != PHY_POLL && phydev->state == PHY_AN) {
                 err = phy_aneg_done(phydev);
                 if (err > 0) {
                         trigger = true;
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index bd0f339f69fd..b9f5f40a7ac1 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1724,11 +1724,8 @@ EXPORT_SYMBOL(genphy_loopback);
 
 static int __set_phy_supported(struct phy_device *phydev, u32 max_speed)
 {
-        /* The default values for phydev->supported are provided by the PHY
-         * driver "features" member, we want to reset to sane defaults first
-         * before supporting higher speeds.
-         */
-        phydev->supported &= PHY_DEFAULT_FEATURES;
+        phydev->supported &= ~(PHY_1000BT_FEATURES | PHY_100BT_FEATURES |
+                               PHY_10BT_FEATURES);
 
         switch (max_speed) {
         default:
diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
index d437f4f5ed52..740655261e5b 100644
--- a/drivers/net/phy/sfp-bus.c
+++ b/drivers/net/phy/sfp-bus.c
@@ -349,7 +349,6 @@ static int sfp_register_bus(struct sfp_bus *bus)
         }
         if (bus->started)
                 bus->socket_ops->start(bus->sfp);
-        bus->netdev->sfp_bus = bus;
         bus->registered = true;
         return 0;
 }
@@ -364,7 +363,6 @@ static void sfp_unregister_bus(struct sfp_bus *bus)
                 if (bus->phydev && ops && ops->disconnect_phy)
                         ops->disconnect_phy(bus->upstream);
         }
-        bus->netdev->sfp_bus = NULL;
         bus->registered = false;
 }
 
@@ -436,6 +434,14 @@ void sfp_upstream_stop(struct sfp_bus *bus)
 }
 EXPORT_SYMBOL_GPL(sfp_upstream_stop);
 
+static void sfp_upstream_clear(struct sfp_bus *bus)
+{
+        bus->upstream_ops = NULL;
+        bus->upstream = NULL;
+        bus->netdev->sfp_bus = NULL;
+        bus->netdev = NULL;
+}
+
 /**
  * sfp_register_upstream() - Register the neighbouring device
  * @fwnode: firmware node for the SFP bus
@@ -461,9 +467,13 @@ struct sfp_bus *sfp_register_upstream(struct fwnode_handle *fwnode,
                 bus->upstream_ops = ops;
                 bus->upstream = upstream;
                 bus->netdev = ndev;
+                ndev->sfp_bus = bus;
 
-                if (bus->sfp)
+                if (bus->sfp) {
                         ret = sfp_register_bus(bus);
+                        if (ret)
+                                sfp_upstream_clear(bus);
+                }
                 rtnl_unlock();
         }
 
@@ -488,8 +498,7 @@ void sfp_unregister_upstream(struct sfp_bus *bus)
         rtnl_lock();
         if (bus->sfp)
                 sfp_unregister_bus(bus);
-        bus->upstream = NULL;
-        bus->netdev = NULL;
+        sfp_upstream_clear(bus);
         rtnl_unlock();
 
         sfp_bus_put(bus);
@@ -561,6 +570,13 @@ void sfp_module_remove(struct sfp_bus *bus)
 }
 EXPORT_SYMBOL_GPL(sfp_module_remove);
 
+static void sfp_socket_clear(struct sfp_bus *bus)
+{
+        bus->sfp_dev = NULL;
+        bus->sfp = NULL;
+        bus->socket_ops = NULL;
+}
+
 struct sfp_bus *sfp_register_socket(struct device *dev, struct sfp *sfp,
                                     const struct sfp_socket_ops *ops)
 {
@@ -573,8 +589,11 @@ struct sfp_bus *sfp_register_socket(struct device *dev, struct sfp *sfp,
                 bus->sfp = sfp;
                 bus->socket_ops = ops;
 
-                if (bus->netdev)
+                if (bus->netdev) {
                         ret = sfp_register_bus(bus);
+                        if (ret)
+                                sfp_socket_clear(bus);
+                }
                 rtnl_unlock();
         }
 
@@ -592,9 +611,7 @@ void sfp_unregister_socket(struct sfp_bus *bus)
         rtnl_lock();
         if (bus->netdev)
                 sfp_unregister_bus(bus);
-        bus->sfp_dev = NULL;
-        bus->sfp = NULL;
-        bus->socket_ops = NULL;
+        sfp_socket_clear(bus);
         rtnl_unlock();
 
         sfp_bus_put(bus);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index a192a017cc68..f5727baac84a 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1688,7 +1688,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
                 case XDP_TX:
                         get_page(alloc_frag->page);
                         alloc_frag->offset += buflen;
-                        if (tun_xdp_tx(tun->dev, &xdp))
+                        if (tun_xdp_tx(tun->dev, &xdp) < 0)
                                 goto err_redirect;
                         rcu_read_unlock();
                         local_bh_enable();
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 3d4f7959dabb..b1b3d8f7e67d 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -642,10 +642,12 @@ static void ax88772_restore_phy(struct usbnet *dev)
                                      priv->presvd_phy_advertise);
 
                 /* Restore BMCR */
+                if (priv->presvd_phy_bmcr & BMCR_ANENABLE)
+                        priv->presvd_phy_bmcr |= BMCR_ANRESTART;
+
                 asix_mdio_write_nopm(dev->net, dev->mii.phy_id, MII_BMCR,
                                      priv->presvd_phy_bmcr);
 
-                mii_nway_restart(&dev->mii);
                 priv->presvd_phy_advertise = 0;
                 priv->presvd_phy_bmcr = 0;
         }
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 2e4130746c40..aeca484a75b8 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -1242,6 +1242,8 @@ static int lan78xx_link_reset(struct lan78xx_net *dev)
                         mod_timer(&dev->stat_monitor,
                                   jiffies + STAT_UPDATE_TIMER);
                 }
+
+                tasklet_schedule(&dev->bh);
         }
 
         return ret;
@@ -3344,6 +3346,7 @@ static void lan78xx_tx_bh(struct lan78xx_net *dev)
         pkt_cnt = 0;
         count = 0;
         length = 0;
+        spin_lock_irqsave(&tqp->lock, flags);
         for (skb = tqp->next; pkt_cnt < tqp->qlen; skb = skb->next) {
                 if (skb_is_gso(skb)) {
                         if (pkt_cnt) {
@@ -3352,7 +3355,8 @@ static void lan78xx_tx_bh(struct lan78xx_net *dev)
                         }
                         count = 1;
                         length = skb->len - TX_OVERHEAD;
-                        skb2 = skb_dequeue(tqp);
+                        __skb_unlink(skb, tqp);
+                        spin_unlock_irqrestore(&tqp->lock, flags);
                         goto gso_skb;
                 }
 
@@ -3361,6 +3365,7 @@ static void lan78xx_tx_bh(struct lan78xx_net *dev)
                 skb_totallen = skb->len + roundup(skb_totallen, sizeof(u32));
                 pkt_cnt++;
         }
+        spin_unlock_irqrestore(&tqp->lock, flags);
 
         /* copy to a single skb */
         skb = alloc_skb(skb_totallen, GFP_ATOMIC);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 8fac8e132c5b..cb0cc30c3d6a 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1246,13 +1246,14 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x413c, 0x81b3, 8)},    /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
         {QMI_FIXED_INTF(0x413c, 0x81b6, 8)},    /* Dell Wireless 5811e */
         {QMI_FIXED_INTF(0x413c, 0x81b6, 10)},   /* Dell Wireless 5811e */
-        {QMI_FIXED_INTF(0x413c, 0x81d7, 1)},    /* Dell Wireless 5821e */
+        {QMI_FIXED_INTF(0x413c, 0x81d7, 0)},    /* Dell Wireless 5821e */
         {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)},    /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */
         {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)},    /* HP lt4120 Snapdragon X5 LTE */
         {QMI_FIXED_INTF(0x22de, 0x9061, 3)},    /* WeTelecom WPD-600N */
         {QMI_QUIRK_SET_DTR(0x1e0e, 0x9001, 5)}, /* SIMCom 7100E, 7230E, 7600E ++ */
         {QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)}, /* Quectel EC25, EC20 R2.0  Mini PCIe */
         {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */
+        {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
         {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)},    /* Quectel BG96 */
         {QMI_QUIRK_SET_DTR(0x2c7c, 0x0306, 4)}, /* Quectel EP06 Mini PCIe */
 
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index 5f565bd574da..48ba80a8ca5c 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -681,7 +681,7 @@ static void rtl8150_set_multicast(struct net_device *netdev)
                    (netdev->flags & IFF_ALLMULTI)) {
                 rx_creg &= 0xfffe;
                 rx_creg |= 0x0002;
-                dev_info(&netdev->dev, "%s: allmulti set\n", netdev->name);
+                dev_dbg(&netdev->dev, "%s: allmulti set\n", netdev->name);
         } else {
                 /* ~RX_MULTICAST, ~RX_PROMISCUOUS */
                 rx_creg &= 0x00fc;
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 7a6a1fe79309..05553d252446 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -82,6 +82,9 @@ static bool turbo_mode = true;
 module_param(turbo_mode, bool, 0644);
 MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction");
 
+static int smsc75xx_link_ok_nopm(struct usbnet *dev);
+static int smsc75xx_phy_gig_workaround(struct usbnet *dev);
+
 static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index,
                                             u32 *data, int in_pm)
 {
@@ -852,6 +855,9 @@ static int smsc75xx_phy_initialize(struct usbnet *dev)
                 return -EIO;
         }
 
+        /* phy workaround for gig link */
+        smsc75xx_phy_gig_workaround(dev);
+
         smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
                 ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP |
                 ADVERTISE_PAUSE_ASYM);
@@ -987,6 +993,62 @@ static int smsc75xx_wait_ready(struct usbnet *dev, int in_pm)
         return -EIO;
 }
 
+static int smsc75xx_phy_gig_workaround(struct usbnet *dev)
+{
+        struct mii_if_info *mii = &dev->mii;
+        int ret = 0, timeout = 0;
+        u32 buf, link_up = 0;
+
+        /* Set the phy in Gig loopback */
+        smsc75xx_mdio_write(dev->net, mii->phy_id, MII_BMCR, 0x4040);
+
+        /* Wait for the link up */
+        do {
+                link_up = smsc75xx_link_ok_nopm(dev);
+                usleep_range(10000, 20000);
+                timeout++;
+        } while ((!link_up) && (timeout < 1000));
+
+        if (timeout >= 1000) {
+                netdev_warn(dev->net, "Timeout waiting for PHY link up\n");
+                return -EIO;
+        }
+
+        /* phy reset */
+        ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
+        if (ret < 0) {
+                netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ret);
+                return ret;
+        }
+
+        buf |= PMT_CTL_PHY_RST;
+
+        ret = smsc75xx_write_reg(dev, PMT_CTL, buf);
+        if (ret < 0) {
+                netdev_warn(dev->net, "Failed to write PMT_CTL: %d\n", ret);
+                return ret;
+        }
+
+        timeout = 0;
+        do {
+                usleep_range(10000, 20000);
+                ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
+                if (ret < 0) {
+                        netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n",
+                                    ret);
+                        return ret;
+                }
+                timeout++;
+        } while ((buf & PMT_CTL_PHY_RST) && (timeout < 100));
+
+        if (timeout >= 100) {
+                netdev_warn(dev->net, "timeout waiting for PHY Reset\n");
+                return -EIO;
+        }
+
+        return 0;
+}
+
 static int smsc75xx_reset(struct usbnet *dev)
 {
         struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]);
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 53085c63277b..2b6ec927809e 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -586,7 +586,8 @@ static struct sk_buff *receive_small(struct net_device *dev,
                                      struct receive_queue *rq,
                                      void *buf, void *ctx,
                                      unsigned int len,
-                                     unsigned int *xdp_xmit)
+                                     unsigned int *xdp_xmit,
+                                     unsigned int *rbytes)
 {
         struct sk_buff *skb;
         struct bpf_prog *xdp_prog;
@@ -601,6 +602,7 @@ static struct sk_buff *receive_small(struct net_device *dev,
         int err;
 
         len -= vi->hdr_len;
+        *rbytes += len;
 
         rcu_read_lock();
         xdp_prog = rcu_dereference(rq->xdp_prog);
@@ -705,11 +707,13 @@ static struct sk_buff *receive_big(struct net_device *dev,
                                    struct virtnet_info *vi,
                                    struct receive_queue *rq,
                                    void *buf,
-                                   unsigned int len)
+                                   unsigned int len,
+                                   unsigned int *rbytes)
 {
         struct page *page = buf;
         struct sk_buff *skb = page_to_skb(vi, rq, page, 0, len, PAGE_SIZE);
 
+        *rbytes += len - vi->hdr_len;
         if (unlikely(!skb))
                 goto err;
 
@@ -727,7 +731,8 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                                          void *buf,
                                          void *ctx,
                                          unsigned int len,
-                                         unsigned int *xdp_xmit)
+                                         unsigned int *xdp_xmit,
+                                         unsigned int *rbytes)
 {
         struct virtio_net_hdr_mrg_rxbuf *hdr = buf;
         u16 num_buf = virtio16_to_cpu(vi->vdev, hdr->num_buffers);
@@ -740,6 +745,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
         int err;
 
         head_skb = NULL;
+        *rbytes += len - vi->hdr_len;
 
         rcu_read_lock();
         xdp_prog = rcu_dereference(rq->xdp_prog);
@@ -877,6 +883,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                         goto err_buf;
                 }
 
+                *rbytes += len;
                 page = virt_to_head_page(buf);
 
                 truesize = mergeable_ctx_to_truesize(ctx);
@@ -932,6 +939,7 @@ err_skb:
                         dev->stats.rx_length_errors++;
                         break;
                 }
+                *rbytes += len;
                 page = virt_to_head_page(buf);
                 put_page(page);
         }
@@ -942,14 +950,13 @@ xdp_xmit:
         return NULL;
 }
 
-static int receive_buf(struct virtnet_info *vi, struct receive_queue *rq,
-                       void *buf, unsigned int len, void **ctx,
-                       unsigned int *xdp_xmit)
+static void receive_buf(struct virtnet_info *vi, struct receive_queue *rq,
+                        void *buf, unsigned int len, void **ctx,
+                        unsigned int *xdp_xmit, unsigned int *rbytes)
 {
         struct net_device *dev = vi->dev;
         struct sk_buff *skb;
         struct virtio_net_hdr_mrg_rxbuf *hdr;
-        int ret;
 
         if (unlikely(len < vi->hdr_len + ETH_HLEN)) {
                 pr_debug("%s: short packet %i\n", dev->name, len);
@@ -961,23 +968,22 @@ static int receive_buf(struct virtnet_info *vi, struct receive_queue *rq,
                 } else {
                         put_page(virt_to_head_page(buf));
                 }
-                return 0;
+                return;
         }
 
         if (vi->mergeable_rx_bufs)
-                skb = receive_mergeable(dev, vi, rq, buf, ctx, len, xdp_xmit);
+                skb = receive_mergeable(dev, vi, rq, buf, ctx, len, xdp_xmit,
+                                        rbytes);
         else if (vi->big_packets)
-                skb = receive_big(dev, vi, rq, buf, len);
+                skb = receive_big(dev, vi, rq, buf, len, rbytes);
         else
-                skb = receive_small(dev, vi, rq, buf, ctx, len, xdp_xmit);
+                skb = receive_small(dev, vi, rq, buf, ctx, len, xdp_xmit, rbytes);
 
         if (unlikely(!skb))
-                return 0;
+                return;
 
         hdr = skb_vnet_hdr(skb);
 
-        ret = skb->len;
-
         if (hdr->hdr.flags & VIRTIO_NET_HDR_F_DATA_VALID)
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
 
@@ -994,12 +1000,11 @@ static int receive_buf(struct virtnet_info *vi, struct receive_queue *rq,
                  ntohs(skb->protocol), skb->len, skb->pkt_type);
 
         napi_gro_receive(&rq->napi, skb);
-        return ret;
+        return;
 
 frame_err:
         dev->stats.rx_frame_errors++;
         dev_kfree_skb(skb);
-        return 0;
 }
 
 /* Unlike mergeable buffers, all buffers are allocated to the
@@ -1249,13 +1254,13 @@ static int virtnet_receive(struct receive_queue *rq, int budget,
 
                 while (received < budget &&
                        (buf = virtqueue_get_buf_ctx(rq->vq, &len, &ctx))) {
-                        bytes += receive_buf(vi, rq, buf, len, ctx, xdp_xmit);
+                        receive_buf(vi, rq, buf, len, ctx, xdp_xmit, &bytes);
                         received++;
                 }
         } else {
                 while (received < budget &&
                        (buf = virtqueue_get_buf(rq->vq, &len)) != NULL) {
-                        bytes += receive_buf(vi, rq, buf, len, NULL, xdp_xmit);
+                        receive_buf(vi, rq, buf, len, NULL, xdp_xmit, &bytes);
                         received++;
                 }
         }
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index f6bb1d54d4bd..e857cb3335f6 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -636,9 +636,62 @@ static int vxlan_gro_complete(struct sock *sk, struct sk_buff *skb, int nhoff)
         return eth_gro_complete(skb, nhoff + sizeof(struct vxlanhdr));
 }
 
-/* Add new entry to forwarding table -- assumes lock held */
+static struct vxlan_fdb *vxlan_fdb_alloc(struct vxlan_dev *vxlan,
+                                         const u8 *mac, __u16 state,
+                                         __be32 src_vni, __u8 ndm_flags)
+{
+        struct vxlan_fdb *f;
+
+        f = kmalloc(sizeof(*f), GFP_ATOMIC);
+        if (!f)
+                return NULL;
+        f->state = state;
+        f->flags = ndm_flags;
+        f->updated = f->used = jiffies;
+        f->vni = src_vni;
+        INIT_LIST_HEAD(&f->remotes);
+        memcpy(f->eth_addr, mac, ETH_ALEN);
+
+        return f;
+}
+
 static int vxlan_fdb_create(struct vxlan_dev *vxlan,
                             const u8 *mac, union vxlan_addr *ip,
+                            __u16 state, __be16 port, __be32 src_vni,
+                            __be32 vni, __u32 ifindex, __u8 ndm_flags,
+                            struct vxlan_fdb **fdb)
+{
+        struct vxlan_rdst *rd = NULL;
+        struct vxlan_fdb *f;
+        int rc;
+
+        if (vxlan->cfg.addrmax &&
+            vxlan->addrcnt >= vxlan->cfg.addrmax)
+                return -ENOSPC;
+
+        netdev_dbg(vxlan->dev, "add %pM -> %pIS\n", mac, ip);
+        f = vxlan_fdb_alloc(vxlan, mac, state, src_vni, ndm_flags);
+        if (!f)
+                return -ENOMEM;
+
+        rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
+        if (rc < 0) {
+                kfree(f);
+                return rc;
+        }
+
+        ++vxlan->addrcnt;
+        hlist_add_head_rcu(&f->hlist,
+                           vxlan_fdb_head(vxlan, mac, src_vni));
+
+        *fdb = f;
+
+        return 0;
+}
+
+/* Add new entry to forwarding table -- assumes lock held */
+static int vxlan_fdb_update(struct vxlan_dev *vxlan,
+                            const u8 *mac, union vxlan_addr *ip,
                             __u16 state, __u16 flags,
                             __be16 port, __be32 src_vni, __be32 vni,
                             __u32 ifindex, __u8 ndm_flags)
@@ -687,37 +740,17 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
                 if (!(flags & NLM_F_CREATE))
                         return -ENOENT;
 
-                if (vxlan->cfg.addrmax &&
-                    vxlan->addrcnt >= vxlan->cfg.addrmax)
-                        return -ENOSPC;
-
                 /* Disallow replace to add a multicast entry */
                 if ((flags & NLM_F_REPLACE) &&
                     (is_multicast_ether_addr(mac) || is_zero_ether_addr(mac)))
                         return -EOPNOTSUPP;
 
                 netdev_dbg(vxlan->dev, "add %pM -> %pIS\n", mac, ip);
-                f = kmalloc(sizeof(*f), GFP_ATOMIC);
-                if (!f)
-                        return -ENOMEM;
-
-                notify = 1;
-                f->state = state;
-                f->flags = ndm_flags;
-                f->updated = f->used = jiffies;
-                f->vni = src_vni;
-                INIT_LIST_HEAD(&f->remotes);
-                memcpy(f->eth_addr, mac, ETH_ALEN);
-
-                rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
-                if (rc < 0) {
-                        kfree(f);
+                rc = vxlan_fdb_create(vxlan, mac, ip, state, port, src_vni,
+                                      vni, ifindex, ndm_flags, &f);
+                if (rc < 0)
                         return rc;
-                }
-
-                ++vxlan->addrcnt;
-                hlist_add_head_rcu(&f->hlist,
-                                   vxlan_fdb_head(vxlan, mac, src_vni));
+                notify = 1;
         }
 
         if (notify) {
@@ -741,13 +774,15 @@ static void vxlan_fdb_free(struct rcu_head *head)
         kfree(f);
 }
 
-static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f)
+static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f,
+                              bool do_notify)
 {
         netdev_dbg(vxlan->dev,
                     "delete %pM\n", f->eth_addr);
 
         --vxlan->addrcnt;
-        vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_DELNEIGH);
+        if (do_notify)
+                vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_DELNEIGH);
 
         hlist_del_rcu(&f->hlist);
         call_rcu(&f->rcu, vxlan_fdb_free);
@@ -863,7 +898,7 @@ static int vxlan_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                 return -EAFNOSUPPORT;
 
         spin_lock_bh(&vxlan->hash_lock);
-        err = vxlan_fdb_create(vxlan, addr, &ip, ndm->ndm_state, flags,
+        err = vxlan_fdb_update(vxlan, addr, &ip, ndm->ndm_state, flags,
                                port, src_vni, vni, ifindex, ndm->ndm_flags);
         spin_unlock_bh(&vxlan->hash_lock);
 
@@ -897,7 +932,7 @@ static int __vxlan_fdb_delete(struct vxlan_dev *vxlan,
                 goto out;
         }
 
-        vxlan_fdb_destroy(vxlan, f);
+        vxlan_fdb_destroy(vxlan, f, true);
 
 out:
         return 0;
@@ -1006,7 +1041,7 @@ static bool vxlan_snoop(struct net_device *dev,
 
                 /* close off race between vxlan_flush and incoming packets */
                 if (netif_running(dev))
-                        vxlan_fdb_create(vxlan, src_mac, src_ip,
+                        vxlan_fdb_update(vxlan, src_mac, src_ip,
                                          NUD_REACHABLE,
                                          NLM_F_EXCL|NLM_F_CREATE,
                                          vxlan->cfg.dst_port,
@@ -2364,7 +2399,7 @@ static void vxlan_cleanup(struct timer_list *t)
                                            "garbage collect %pM\n",
                                            f->eth_addr);
                                 f->state = NUD_STALE;
-                                vxlan_fdb_destroy(vxlan, f);
+                                vxlan_fdb_destroy(vxlan, f, true);
                         } else if (time_before(timeout, next_timer))
                                 next_timer = timeout;
                 }
@@ -2415,7 +2450,7 @@ static void vxlan_fdb_delete_default(struct vxlan_dev *vxlan, __be32 vni)
         spin_lock_bh(&vxlan->hash_lock);
         f = __vxlan_find_mac(vxlan, all_zeros_mac, vni);
         if (f)
-                vxlan_fdb_destroy(vxlan, f);
+                vxlan_fdb_destroy(vxlan, f, true);
         spin_unlock_bh(&vxlan->hash_lock);
 }
 
@@ -2469,7 +2504,7 @@ static void vxlan_flush(struct vxlan_dev *vxlan, bool do_all)
                                 continue;
                         /* the all_zeros_mac entry is deleted at vxlan_uninit */
                         if (!is_zero_ether_addr(f->eth_addr))
-                                vxlan_fdb_destroy(vxlan, f);
+                                vxlan_fdb_destroy(vxlan, f, true);
                 }
         }
         spin_unlock_bh(&vxlan->hash_lock);
@@ -3160,6 +3195,7 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
 {
         struct vxlan_net *vn = net_generic(net, vxlan_net_id);
         struct vxlan_dev *vxlan = netdev_priv(dev);
+        struct vxlan_fdb *f = NULL;
         int err;
 
         err = vxlan_dev_configure(net, dev, conf, false, extack);
@@ -3173,24 +3209,35 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
                 err = vxlan_fdb_create(vxlan, all_zeros_mac,
                                        &vxlan->default_dst.remote_ip,
                                        NUD_REACHABLE | NUD_PERMANENT,
-                                       NLM_F_EXCL | NLM_F_CREATE,
                                        vxlan->cfg.dst_port,
                                        vxlan->default_dst.remote_vni,
                                        vxlan->default_dst.remote_vni,
                                        vxlan->default_dst.remote_ifindex,
-                                       NTF_SELF);
+                                       NTF_SELF, &f);
                 if (err)
                         return err;
         }
 
         err = register_netdevice(dev);
+        if (err)
+                goto errout;
+
+        err = rtnl_configure_link(dev, NULL);
         if (err) {
-                vxlan_fdb_delete_default(vxlan, vxlan->default_dst.remote_vni);
-                return err;
+                unregister_netdevice(dev);
+                goto errout;
         }
 
+        /* notify default fdb entry */
+        if (f)
+                vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH);
+
         list_add(&vxlan->next, &vn->vxlan_list);
         return 0;
+errout:
+        if (f)
+                vxlan_fdb_destroy(vxlan, f, false);
+        return err;
 }
 
 static int vxlan_nl2conf(struct nlattr *tb[], struct nlattr *data[],
@@ -3425,6 +3472,7 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
         struct vxlan_rdst *dst = &vxlan->default_dst;
         struct vxlan_rdst old_dst;
         struct vxlan_config conf;
+        struct vxlan_fdb *f = NULL;
         int err;
 
         err = vxlan_nl2conf(tb, data,
@@ -3453,16 +3501,16 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
                         err = vxlan_fdb_create(vxlan, all_zeros_mac,
                                                &dst->remote_ip,
                                                NUD_REACHABLE | NUD_PERMANENT,
-                                               NLM_F_CREATE | NLM_F_APPEND,
                                                vxlan->cfg.dst_port,
                                                dst->remote_vni,
                                                dst->remote_vni,
                                                dst->remote_ifindex,
-                                               NTF_SELF);
+                                               NTF_SELF, &f);
                         if (err) {
                                 spin_unlock_bh(&vxlan->hash_lock);
                                 return err;
                         }
+                        vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH);
                 }
                 spin_unlock_bh(&vxlan->hash_lock);
         }
diff --git a/drivers/net/wan/lmc/lmc_main.c b/drivers/net/wan/lmc/lmc_main.c
index 90a4ad9a2d08..b3a1b6f5c406 100644
--- a/drivers/net/wan/lmc/lmc_main.c
+++ b/drivers/net/wan/lmc/lmc_main.c
@@ -1362,7 +1362,7 @@ static irqreturn_t lmc_interrupt (int irq, void *dev_instance) /*fold00*/
             case 0x001:
                 printk(KERN_WARNING "%s: Master Abort (naughty)\n", dev->name);
                 break;
-            case 0x010:
+            case 0x002:
                 printk(KERN_WARNING "%s: Target Abort (not so naughty)\n", dev->name);
                 break;
             default:
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index e9c2fb318c03..836e0a47b94a 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -6058,8 +6058,19 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
                            ath10k_mac_max_vht_nss(vht_mcs_mask)));
 
         if (changed & IEEE80211_RC_BW_CHANGED) {
-                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM peer bw %d\n",
-                           sta->addr, bw);
+                enum wmi_phy_mode mode;
+
+                mode = chan_to_phymode(&def);
+                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM peer bw %d phymode %d\n",
+                                sta->addr, bw, mode);
+
+                err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
+                                WMI_PEER_PHYMODE, mode);
+                if (err) {
+                        ath10k_warn(ar, "failed to update STA %pM peer phymode %d: %d\n",
+                                        sta->addr, mode, err);
+                        goto exit;
+                }
 
                 err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
                                                 WMI_PEER_CHAN_WIDTH, bw);
@@ -6100,6 +6111,7 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
                                     sta->addr);
         }
 
+exit:
         mutex_unlock(&ar->conf_mutex);
 }
 
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index b48db54e9865..d68afb65402a 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -6144,6 +6144,7 @@ enum wmi_peer_param {
         WMI_PEER_NSS        = 0x5,
         WMI_PEER_USE_4ADDR  = 0x6,
         WMI_PEER_DEBUG      = 0xa,
+        WMI_PEER_PHYMODE    = 0xd,
         WMI_PEER_DUMMY_VAR  = 0xff, /* dummy parameter for STA PS workaround */
 };
 
diff --git a/drivers/net/wireless/ath/wcn36xx/testmode.c b/drivers/net/wireless/ath/wcn36xx/testmode.c
index 1279064a3b71..51a038022c8b 100644
--- a/drivers/net/wireless/ath/wcn36xx/testmode.c
+++ b/drivers/net/wireless/ath/wcn36xx/testmode.c
@@ -1,4 +1,4 @@
-/*
+/*
  * Copyright (c) 2018, The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
index 45928b5b8d97..4fffa6988087 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
@@ -1785,7 +1785,8 @@ brcmf_pcie_prepare_fw_request(struct brcmf_pciedev_info *devinfo)
         fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
         fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
         fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL;
-        fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus);
+        /* NVRAM reserves PCI domain 0 for Broadcom's SDK faked bus */
+        fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus) + 1;
         fwreq->bus_nr = devinfo->pdev->bus->number;
 
         return fwreq;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index c99a191e8d69..a907d7b065fa 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -4296,6 +4296,13 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
         brcmf_dbg(TRACE, "Enter\n");
 
         if (bus) {
+                /* Stop watchdog task */
+                if (bus->watchdog_tsk) {
+                        send_sig(SIGTERM, bus->watchdog_tsk, 1);
+                        kthread_stop(bus->watchdog_tsk);
+                        bus->watchdog_tsk = NULL;
+                }
+
                 /* De-register interrupt handler */
                 brcmf_sdiod_intr_unregister(bus->sdiodev);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
index e20c30b29c03..c8ea63d02619 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
@@ -178,6 +178,17 @@ const struct iwl_cfg iwl9260_2ac_cfg = {
         .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
 };
 
+const struct iwl_cfg iwl9260_killer_2ac_cfg = {
+        .name = "Killer (R) Wireless-AC 1550 Wireless Network Adapter (9260NGW)",
+        .fw_name_pre = IWL9260A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
+        IWL_DEVICE_9000,
+        .ht_params = &iwl9000_ht_params,
+        .nvm_ver = IWL9000_NVM_VERSION,
+        .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+};
+
 const struct iwl_cfg iwl9270_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9270",
         .fw_name_pre = IWL9260A_FW_PRE,
@@ -267,6 +278,34 @@ const struct iwl_cfg iwl9560_2ac_cfg_soc = {
         .soc_latency = 5000,
 };
 
+const struct iwl_cfg iwl9560_killer_2ac_cfg_soc = {
+        .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
+        .fw_name_pre = IWL9000A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        IWL_DEVICE_9000,
+        .ht_params = &iwl9000_ht_params,
+        .nvm_ver = IWL9000_NVM_VERSION,
+        .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+        .integrated = true,
+        .soc_latency = 5000,
+};
+
+const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc = {
+        .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)",
+        .fw_name_pre = IWL9000A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        IWL_DEVICE_9000,
+        .ht_params = &iwl9000_ht_params,
+        .nvm_ver = IWL9000_NVM_VERSION,
+        .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+        .integrated = true,
+        .soc_latency = 5000,
+};
+
 const struct iwl_cfg iwl9460_2ac_cfg_shared_clk = {
         .name = "Intel(R) Dual Band Wireless AC 9460",
         .fw_name_pre = IWL9000A_FW_PRE,
@@ -327,6 +366,36 @@ const struct iwl_cfg iwl9560_2ac_cfg_shared_clk = {
         .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
 };
 
+const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk = {
+        .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
+        .fw_name_pre = IWL9000A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        IWL_DEVICE_9000,
+        .ht_params = &iwl9000_ht_params,
+        .nvm_ver = IWL9000_NVM_VERSION,
+        .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+        .integrated = true,
+        .soc_latency = 5000,
+        .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
+};
+
+const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk = {
+        .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)",
+        .fw_name_pre = IWL9000A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        IWL_DEVICE_9000,
+        .ht_params = &iwl9000_ht_params,
+        .nvm_ver = IWL9000_NVM_VERSION,
+        .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+        .integrated = true,
+        .soc_latency = 5000,
+        .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
+};
+
 MODULE_FIRMWARE(IWL9000A_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL9000B_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL9000RFB_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index c503b26793f6..84a816809723 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -551,6 +551,7 @@ extern const struct iwl_cfg iwl8275_2ac_cfg;
 extern const struct iwl_cfg iwl4165_2ac_cfg;
 extern const struct iwl_cfg iwl9160_2ac_cfg;
 extern const struct iwl_cfg iwl9260_2ac_cfg;
+extern const struct iwl_cfg iwl9260_killer_2ac_cfg;
 extern const struct iwl_cfg iwl9270_2ac_cfg;
 extern const struct iwl_cfg iwl9460_2ac_cfg;
 extern const struct iwl_cfg iwl9560_2ac_cfg;
@@ -558,10 +559,14 @@ extern const struct iwl_cfg iwl9460_2ac_cfg_soc;
 extern const struct iwl_cfg iwl9461_2ac_cfg_soc;
 extern const struct iwl_cfg iwl9462_2ac_cfg_soc;
 extern const struct iwl_cfg iwl9560_2ac_cfg_soc;
+extern const struct iwl_cfg iwl9560_killer_2ac_cfg_soc;
+extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc;
 extern const struct iwl_cfg iwl9460_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl9461_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl9462_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl9560_2ac_cfg_shared_clk;
+extern const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk;
+extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl22000_2ac_cfg_hr;
 extern const struct iwl_cfg iwl22000_2ac_cfg_hr_cdb;
 extern const struct iwl_cfg iwl22000_2ac_cfg_jf;
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 38234bda9017..8520523b91b4 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -545,6 +545,9 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x2526, 0x1210, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x1420, iwl9460_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2526, 0x1550, iwl9260_killer_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2526, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x2034, iwl9560_2ac_cfg_soc)},
@@ -554,6 +557,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x4234, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x42A4, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2526, 0x8014, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
@@ -578,6 +582,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x2720, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2720, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2720, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2720, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2720, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2720, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2720, 0x4030, iwl9560_2ac_cfg)},
@@ -604,6 +610,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x30DC, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x30DC, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x30DC, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -630,6 +638,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x31DC, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x31DC, 0x1030, iwl9560_2ac_cfg_shared_clk)},
         {IWL_PCI_DEVICE(0x31DC, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x31DC, 0x1551, iwl9560_killer_s_2ac_cfg_shared_clk)},
+        {IWL_PCI_DEVICE(0x31DC, 0x1552, iwl9560_killer_2ac_cfg_shared_clk)},
         {IWL_PCI_DEVICE(0x31DC, 0x2030, iwl9560_2ac_cfg_shared_clk)},
         {IWL_PCI_DEVICE(0x31DC, 0x2034, iwl9560_2ac_cfg_shared_clk)},
         {IWL_PCI_DEVICE(0x31DC, 0x4030, iwl9560_2ac_cfg_shared_clk)},
@@ -656,6 +666,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x34F0, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x34F0, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x34F0, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x34F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x34F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -682,6 +694,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x3DF0, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x3DF0, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x3DF0, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x3DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x3DF0, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x3DF0, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x3DF0, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -708,6 +722,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x43F0, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x43F0, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x43F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x43F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -743,6 +759,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x9DF0, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x9DF0, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x9DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x9DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x9DF0, 0x2010, iwl9460_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x9DF0, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x9DF0, 0x2034, iwl9560_2ac_cfg_soc)},
@@ -771,6 +789,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0xA0F0, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0xA0F0, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -797,6 +817,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0xA370, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0xA370, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA370, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0xA370, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0xA370, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA370, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA370, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA370, 0x4030, iwl9560_2ac_cfg_soc)},
diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
index 6e3cf9817730..88f4c89f89ba 100644
--- a/drivers/net/wireless/marvell/mwifiex/usb.c
+++ b/drivers/net/wireless/marvell/mwifiex/usb.c
@@ -644,11 +644,6 @@ static void mwifiex_usb_disconnect(struct usb_interface *intf)
                                          MWIFIEX_FUNC_SHUTDOWN);
         }
 
-        if (adapter->workqueue)
-                flush_workqueue(adapter->workqueue);
-
-        mwifiex_usb_free(card);
-
         mwifiex_dbg(adapter, FATAL,
                     "%s: removing card\n", __func__);
         mwifiex_remove_card(adapter);
@@ -1356,6 +1351,8 @@ static void mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
 {
         struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
 
+        mwifiex_usb_free(card);
+
         mwifiex_usb_cleanup_tx_aggr(adapter);
 
         card->adapter = NULL;
diff --git a/drivers/net/wireless/mediatek/mt7601u/phy.c b/drivers/net/wireless/mediatek/mt7601u/phy.c
index 9d2f9a776ef1..b804abd464ae 100644
--- a/drivers/net/wireless/mediatek/mt7601u/phy.c
+++ b/drivers/net/wireless/mediatek/mt7601u/phy.c
@@ -986,13 +986,15 @@ static void mt7601u_agc_tune(struct mt7601u_dev *dev)
          */
         spin_lock_bh(&dev->con_mon_lock);
         avg_rssi = ewma_rssi_read(&dev->avg_rssi);
-        WARN_ON_ONCE(avg_rssi == 0);
+        spin_unlock_bh(&dev->con_mon_lock);
+        if (avg_rssi == 0)
+                return;
+
         avg_rssi = -avg_rssi;
         if (avg_rssi <= -70)
                 val -= 0x20;
         else if (avg_rssi <= -60)
                 val -= 0x10;
-        spin_unlock_bh(&dev->con_mon_lock);
 
         if (val != mt7601u_bbp_rr(dev, 66))
                 mt7601u_bbp_wr(dev, 66, val);
diff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
index 220e2b710208..ae0ca8006849 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
@@ -654,8 +654,7 @@ qtnf_disconnect(struct wiphy *wiphy, struct net_device *dev,
         vif = qtnf_mac_get_base_vif(mac);
         if (!vif) {
                 pr_err("MAC%u: primary VIF is not configured\n", mac->macid);
-                ret = -EFAULT;
-                goto out;
+                return -EFAULT;
         }
 
         if (vif->wdev.iftype != NL80211_IFTYPE_STATION) {
diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
index 39c817eddd78..54c9f6ab0c8c 100644
--- a/drivers/net/wireless/realtek/rtlwifi/base.c
+++ b/drivers/net/wireless/realtek/rtlwifi/base.c
@@ -484,18 +484,21 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
 
 }
 
-void rtl_deinit_deferred_work(struct ieee80211_hw *hw)
+void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
         del_timer_sync(&rtlpriv->works.watchdog_timer);
 
-        cancel_delayed_work(&rtlpriv->works.watchdog_wq);
-        cancel_delayed_work(&rtlpriv->works.ips_nic_off_wq);
-        cancel_delayed_work(&rtlpriv->works.ps_work);
-        cancel_delayed_work(&rtlpriv->works.ps_rfon_wq);
-        cancel_delayed_work(&rtlpriv->works.fwevt_wq);
-        cancel_delayed_work(&rtlpriv->works.c2hcmd_wq);
+        cancel_delayed_work_sync(&rtlpriv->works.watchdog_wq);
+        if (ips_wq)
+                cancel_delayed_work(&rtlpriv->works.ips_nic_off_wq);
+        else
+                cancel_delayed_work_sync(&rtlpriv->works.ips_nic_off_wq);
+        cancel_delayed_work_sync(&rtlpriv->works.ps_work);
+        cancel_delayed_work_sync(&rtlpriv->works.ps_rfon_wq);
+        cancel_delayed_work_sync(&rtlpriv->works.fwevt_wq);
+        cancel_delayed_work_sync(&rtlpriv->works.c2hcmd_wq);
 }
 EXPORT_SYMBOL_GPL(rtl_deinit_deferred_work);
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/base.h b/drivers/net/wireless/realtek/rtlwifi/base.h
index 912f205779c3..a7ae40eaa3cd 100644
--- a/drivers/net/wireless/realtek/rtlwifi/base.h
+++ b/drivers/net/wireless/realtek/rtlwifi/base.h
@@ -121,7 +121,7 @@ void rtl_init_rfkill(struct ieee80211_hw *hw);
 void rtl_deinit_rfkill(struct ieee80211_hw *hw);
 
 void rtl_watch_dog_timer_callback(struct timer_list *t);
-void rtl_deinit_deferred_work(struct ieee80211_hw *hw);
+void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq);
 
 bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx);
 int rtlwifi_rate_mapping(struct ieee80211_hw *hw, bool isht,
diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c
index cfea57efa7f4..4bf7967590ca 100644
--- a/drivers/net/wireless/realtek/rtlwifi/core.c
+++ b/drivers/net/wireless/realtek/rtlwifi/core.c
@@ -130,7 +130,6 @@ found_alt:
                        firmware->size);
                 rtlpriv->rtlhal.wowlan_fwsize = firmware->size;
         }
-        rtlpriv->rtlhal.fwsize = firmware->size;
         release_firmware(firmware);
 }
 
@@ -196,7 +195,7 @@ static void rtl_op_stop(struct ieee80211_hw *hw)
                 /* reset sec info */
                 rtl_cam_reset_sec_info(hw);
 
-                rtl_deinit_deferred_work(hw);
+                rtl_deinit_deferred_work(hw, false);
         }
         rtlpriv->intf_ops->adapter_stop(hw);
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
index ae13bcfb3bf0..5d1fda16fc8c 100644
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -2377,7 +2377,7 @@ void rtl_pci_disconnect(struct pci_dev *pdev)
                 ieee80211_unregister_hw(hw);
                 rtlmac->mac80211_registered = 0;
         } else {
-                rtl_deinit_deferred_work(hw);
+                rtl_deinit_deferred_work(hw, false);
                 rtlpriv->intf_ops->adapter_stop(hw);
         }
         rtlpriv->cfg->ops->disable_interrupt(hw);
diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c
index 71af24e2e051..479a4cfc245d 100644
--- a/drivers/net/wireless/realtek/rtlwifi/ps.c
+++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
@@ -71,7 +71,7 @@ bool rtl_ps_disable_nic(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
         /*<1> Stop all timer */
-        rtl_deinit_deferred_work(hw);
+        rtl_deinit_deferred_work(hw, true);
 
         /*<2> Disable Interrupt */
         rtlpriv->cfg->ops->disable_interrupt(hw);
@@ -292,7 +292,7 @@ void rtl_ips_nic_on(struct ieee80211_hw *hw)
         struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
         enum rf_pwrstate rtstate;
 
-        cancel_delayed_work(&rtlpriv->works.ips_nic_off_wq);
+        cancel_delayed_work_sync(&rtlpriv->works.ips_nic_off_wq);
 
         mutex_lock(&rtlpriv->locks.ips_mutex);
         if (ppsc->inactiveps) {
diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
index f9faffc498bc..2ac5004d7a40 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -1132,7 +1132,7 @@ void rtl_usb_disconnect(struct usb_interface *intf)
                 ieee80211_unregister_hw(hw);
                 rtlmac->mac80211_registered = 0;
         } else {
-                rtl_deinit_deferred_work(hw);
+                rtl_deinit_deferred_work(hw, false);
                 rtlpriv->intf_ops->adapter_stop(hw);
         }
         /*deinit rfkill */
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index a57daecf1d57..2d8812dd1534 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -87,6 +87,7 @@ struct netfront_cb {
 /* IRQ name is queue name with "-tx" or "-rx" appended */
 #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3)
 
+static DECLARE_WAIT_QUEUE_HEAD(module_load_q);
 static DECLARE_WAIT_QUEUE_HEAD(module_unload_q);
 
 struct netfront_stats {
@@ -1330,6 +1331,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
         netif_carrier_off(netdev);
 
         xenbus_switch_state(dev, XenbusStateInitialising);
+        wait_event(module_load_q,
+                           xenbus_read_driver_state(dev->otherend) !=
+                           XenbusStateClosed &&
+                           xenbus_read_driver_state(dev->otherend) !=
+                           XenbusStateUnknown);
         return netdev;
 
  exit:
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 46df030b2c3f..bf65501e6ed6 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -100,6 +100,22 @@ static struct class *nvme_subsys_class;
 static void nvme_ns_remove(struct nvme_ns *ns);
 static int nvme_revalidate_disk(struct gendisk *disk);
 static void nvme_put_subsystem(struct nvme_subsystem *subsys);
+static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl,
+                                           unsigned nsid);
+
+static void nvme_set_queue_dying(struct nvme_ns *ns)
+{
+        /*
+         * Revalidating a dead namespace sets capacity to 0. This will end
+         * buffered writers dirtying pages that can't be synced.
+         */
+        if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags))
+                return;
+        revalidate_disk(ns->disk);
+        blk_set_queue_dying(ns->queue);
+        /* Forcibly unquiesce queues to avoid blocking dispatch */
+        blk_mq_unquiesce_queue(ns->queue);
+}
 
 static void nvme_queue_scan(struct nvme_ctrl *ctrl)
 {
@@ -1044,14 +1060,17 @@ EXPORT_SYMBOL_GPL(nvme_set_queue_count);
 
 static void nvme_enable_aen(struct nvme_ctrl *ctrl)
 {
-        u32 result;
+        u32 result, supported_aens = ctrl->oaes & NVME_AEN_SUPPORTED;
         int status;
 
-        status = nvme_set_features(ctrl, NVME_FEAT_ASYNC_EVENT,
-                        ctrl->oaes & NVME_AEN_SUPPORTED, NULL, 0, &result);
+        if (!supported_aens)
+                return;
+
+        status = nvme_set_features(ctrl, NVME_FEAT_ASYNC_EVENT, supported_aens,
+                        NULL, 0, &result);
         if (status)
                 dev_warn(ctrl->device, "Failed to configure AEN (cfg %x)\n",
-                         ctrl->oaes & NVME_AEN_SUPPORTED);
+                         supported_aens);
 }
 
 static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio)
@@ -1151,19 +1170,15 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
 
 static void nvme_update_formats(struct nvme_ctrl *ctrl)
 {
-        struct nvme_ns *ns, *next;
-        LIST_HEAD(rm_list);
+        struct nvme_ns *ns;
 
-        down_write(&ctrl->namespaces_rwsem);
-        list_for_each_entry(ns, &ctrl->namespaces, list) {
-                if (ns->disk && nvme_revalidate_disk(ns->disk)) {
-                        list_move_tail(&ns->list, &rm_list);
-                }
-        }
-        up_write(&ctrl->namespaces_rwsem);
+        down_read(&ctrl->namespaces_rwsem);
+        list_for_each_entry(ns, &ctrl->namespaces, list)
+                if (ns->disk && nvme_revalidate_disk(ns->disk))
+                        nvme_set_queue_dying(ns);
+        up_read(&ctrl->namespaces_rwsem);
 
-        list_for_each_entry_safe(ns, next, &rm_list, list)
-                nvme_ns_remove(ns);
+        nvme_remove_invalid_namespaces(ctrl, NVME_NSID_ALL);
 }
 
 static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
@@ -1218,7 +1233,7 @@ static int nvme_user_cmd(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
         effects = nvme_passthru_start(ctrl, ns, cmd.opcode);
         status = nvme_submit_user_cmd(ns ? ns->queue : ctrl->admin_q, &c,
                         (void __user *)(uintptr_t)cmd.addr, cmd.data_len,
-                        (void __user *)(uintptr_t)cmd.metadata, cmd.metadata,
+                        (void __user *)(uintptr_t)cmd.metadata, cmd.metadata_len,
                         0, &cmd.result, timeout);
         nvme_passthru_end(ctrl, effects);
 
@@ -3138,7 +3153,7 @@ static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl,
 
         down_write(&ctrl->namespaces_rwsem);
         list_for_each_entry_safe(ns, next, &ctrl->namespaces, list) {
-                if (ns->head->ns_id > nsid)
+                if (ns->head->ns_id > nsid || test_bit(NVME_NS_DEAD, &ns->flags))
                         list_move_tail(&ns->list, &rm_list);
         }
         up_write(&ctrl->namespaces_rwsem);
@@ -3542,19 +3557,9 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
         if (ctrl->admin_q)
                 blk_mq_unquiesce_queue(ctrl->admin_q);
 
-        list_for_each_entry(ns, &ctrl->namespaces, list) {
-                /*
-                 * Revalidating a dead namespace sets capacity to 0. This will
-                 * end buffered writers dirtying pages that can't be synced.
-                 */
-                if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags))
-                        continue;
-                revalidate_disk(ns->disk);
-                blk_set_queue_dying(ns->queue);
+        list_for_each_entry(ns, &ctrl->namespaces, list)
+                nvme_set_queue_dying(ns);
 
-                /* Forcibly unquiesce queues to avoid blocking dispatch */
-                blk_mq_unquiesce_queue(ns->queue);
-        }
         up_read(&ctrl->namespaces_rwsem);
 }
 EXPORT_SYMBOL_GPL(nvme_kill_queues);
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 903eb4545e26..f7efe5a58cc7 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -539,14 +539,18 @@ static struct nvmf_transport_ops *nvmf_lookup_transport(
 /*
  * For something we're not in a state to send to the device the default action
  * is to busy it and retry it after the controller state is recovered.  However,
- * anything marked for failfast or nvme multipath is immediately failed.
+ * if the controller is deleting or if anything is marked for failfast or
+ * nvme multipath it is immediately failed.
  *
  * Note: commands used to initialize the controller will be marked for failfast.
  * Note: nvme cli/ioctl commands are marked for failfast.
  */
-blk_status_t nvmf_fail_nonready_command(struct request *rq)
+blk_status_t nvmf_fail_nonready_command(struct nvme_ctrl *ctrl,
+                struct request *rq)
 {
-        if (!blk_noretry_request(rq) && !(rq->cmd_flags & REQ_NVME_MPATH))
+        if (ctrl->state != NVME_CTRL_DELETING &&
+            ctrl->state != NVME_CTRL_DEAD &&
+            !blk_noretry_request(rq) && !(rq->cmd_flags & REQ_NVME_MPATH))
                 return BLK_STS_RESOURCE;
         nvme_req(rq)->status = NVME_SC_ABORT_REQ;
         return BLK_STS_IOERR;
diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h
index e1818a27aa2d..aa2fdb2a2e8f 100644
--- a/drivers/nvme/host/fabrics.h
+++ b/drivers/nvme/host/fabrics.h
@@ -162,7 +162,8 @@ void nvmf_unregister_transport(struct nvmf_transport_ops *ops);
 void nvmf_free_options(struct nvmf_ctrl_options *opts);
 int nvmf_get_address(struct nvme_ctrl *ctrl, char *buf, int size);
 bool nvmf_should_reconnect(struct nvme_ctrl *ctrl);
-blk_status_t nvmf_fail_nonready_command(struct request *rq);
+blk_status_t nvmf_fail_nonready_command(struct nvme_ctrl *ctrl,
+                struct request *rq);
 bool __nvmf_check_ready(struct nvme_ctrl *ctrl, struct request *rq,
                 bool queue_live);
 
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 41d45a1b5c62..9bac912173ba 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -2272,7 +2272,7 @@ nvme_fc_queue_rq(struct blk_mq_hw_ctx *hctx,
 
         if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE ||
             !nvmf_check_ready(&queue->ctrl->ctrl, rq, queue_ready))
-                return nvmf_fail_nonready_command(rq);
+                return nvmf_fail_nonready_command(&queue->ctrl->ctrl, rq);
 
         ret = nvme_setup_cmd(ns, rq, sqe);
         if (ret)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index ba943f211687..ddd441b1516a 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2556,11 +2556,6 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         quirks |= check_vendor_combination_bug(pdev);
 
-        result = nvme_init_ctrl(&dev->ctrl, &pdev->dev, &nvme_pci_ctrl_ops,
-                        quirks);
-        if (result)
-                goto release_pools;
-
         /*
          * Double check that our mempool alloc size will cover the biggest
          * command we support.
@@ -2578,6 +2573,11 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 goto release_pools;
         }
 
+        result = nvme_init_ctrl(&dev->ctrl, &pdev->dev, &nvme_pci_ctrl_ops,
+                        quirks);
+        if (result)
+                goto release_mempool;
+
         dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev));
 
         nvme_get_ctrl(&dev->ctrl);
@@ -2585,6 +2585,8 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         return 0;
 
+ release_mempool:
+        mempool_destroy(dev->iod_mempool);
  release_pools:
         nvme_release_prp_pools(dev);
  unmap:
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 518c5b09038c..66ec5985c9f3 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1639,7 +1639,7 @@ static blk_status_t nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
         WARN_ON_ONCE(rq->tag < 0);
 
         if (!nvmf_check_ready(&queue->ctrl->ctrl, rq, queue_ready))
-                return nvmf_fail_nonready_command(rq);
+                return nvmf_fail_nonready_command(&queue->ctrl->ctrl, rq);
 
         dev = queue->device->dev;
         ib_dma_sync_single_for_cpu(dev, sqe->dma,
diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index d3f3b3ec4d1a..ebea1373d1b7 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -282,6 +282,7 @@ static ssize_t nvmet_ns_device_path_store(struct config_item *item,
 {
         struct nvmet_ns *ns = to_nvmet_ns(item);
         struct nvmet_subsys *subsys = ns->subsys;
+        size_t len;
         int ret;
 
         mutex_lock(&subsys->lock);
@@ -289,10 +290,14 @@ static ssize_t nvmet_ns_device_path_store(struct config_item *item,
         if (ns->enabled)
                 goto out_unlock;
 
-        kfree(ns->device_path);
+        ret = -EINVAL;
+        len = strcspn(page, "\n");
+        if (!len)
+                goto out_unlock;
 
+        kfree(ns->device_path);
         ret = -ENOMEM;
-        ns->device_path = kstrndup(page, strcspn(page, "\n"), GFP_KERNEL);
+        ns->device_path = kstrndup(page, len, GFP_KERNEL);
         if (!ns->device_path)
                 goto out_unlock;
 
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 74d4b785d2da..9838103f2d62 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -339,7 +339,7 @@ int nvmet_ns_enable(struct nvmet_ns *ns)
                 goto out_unlock;
 
         ret = nvmet_bdev_ns_enable(ns);
-        if (ret)
+        if (ret == -ENOTBLK)
                 ret = nvmet_file_ns_enable(ns);
         if (ret)
                 goto out_unlock;
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 408279cb6f2c..29b4b236afd8 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -58,8 +58,8 @@ struct nvmet_fc_ls_iod {
         struct work_struct              work;
 } __aligned(sizeof(unsigned long long));
 
+/* desired maximum for a single sequence - if sg list allows it */
 #define NVMET_FC_MAX_SEQ_LENGTH         (256 * 1024)
-#define NVMET_FC_MAX_XFR_SGENTS         (NVMET_FC_MAX_SEQ_LENGTH / PAGE_SIZE)
 
 enum nvmet_fcp_datadir {
         NVMET_FCP_NODATA,
@@ -74,6 +74,7 @@ struct nvmet_fc_fcp_iod {
         struct nvme_fc_cmd_iu           cmdiubuf;
         struct nvme_fc_ersp_iu          rspiubuf;
         dma_addr_t                      rspdma;
+        struct scatterlist              *next_sg;
         struct scatterlist              *data_sg;
         int                             data_sg_cnt;
         u32                             offset;
@@ -1025,8 +1026,7 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo,
         INIT_LIST_HEAD(&newrec->assoc_list);
         kref_init(&newrec->ref);
         ida_init(&newrec->assoc_cnt);
-        newrec->max_sg_cnt = min_t(u32, NVMET_FC_MAX_XFR_SGENTS,
-                                        template->max_sgl_segments);
+        newrec->max_sg_cnt = template->max_sgl_segments;
 
         ret = nvmet_fc_alloc_ls_iodlist(newrec);
         if (ret) {
@@ -1722,6 +1722,7 @@ nvmet_fc_alloc_tgt_pgs(struct nvmet_fc_fcp_iod *fod)
                                 ((fod->io_dir == NVMET_FCP_WRITE) ?
                                         DMA_FROM_DEVICE : DMA_TO_DEVICE));
                                 /* note: write from initiator perspective */
+        fod->next_sg = fod->data_sg;
 
         return 0;
 
@@ -1866,24 +1867,49 @@ nvmet_fc_transfer_fcp_data(struct nvmet_fc_tgtport *tgtport,
                                 struct nvmet_fc_fcp_iod *fod, u8 op)
 {
         struct nvmefc_tgt_fcp_req *fcpreq = fod->fcpreq;
+        struct scatterlist *sg = fod->next_sg;
         unsigned long flags;
-        u32 tlen;
+        u32 remaininglen = fod->req.transfer_len - fod->offset;
+        u32 tlen = 0;
         int ret;
 
         fcpreq->op = op;
         fcpreq->offset = fod->offset;
         fcpreq->timeout = NVME_FC_TGTOP_TIMEOUT_SEC;
 
-        tlen = min_t(u32, tgtport->max_sg_cnt * PAGE_SIZE,
-                        (fod->req.transfer_len - fod->offset));
+        /*
+         * for next sequence:
+         *  break at a sg element boundary
+         *  attempt to keep sequence length capped at
+         *    NVMET_FC_MAX_SEQ_LENGTH but allow sequence to
+         *    be longer if a single sg element is larger
+         *    than that amount. This is done to avoid creating
+         *    a new sg list to use for the tgtport api.
+         */
+        fcpreq->sg = sg;
+        fcpreq->sg_cnt = 0;
+        while (tlen < remaininglen &&
+               fcpreq->sg_cnt < tgtport->max_sg_cnt &&
+               tlen + sg_dma_len(sg) < NVMET_FC_MAX_SEQ_LENGTH) {
+                fcpreq->sg_cnt++;
+                tlen += sg_dma_len(sg);
+                sg = sg_next(sg);
+        }
+        if (tlen < remaininglen && fcpreq->sg_cnt == 0) {
+                fcpreq->sg_cnt++;
+                tlen += min_t(u32, sg_dma_len(sg), remaininglen);
+                sg = sg_next(sg);
+        }
+        if (tlen < remaininglen)
+                fod->next_sg = sg;
+        else
+                fod->next_sg = NULL;
+
         fcpreq->transfer_length = tlen;
         fcpreq->transferred_length = 0;
         fcpreq->fcp_error = 0;
         fcpreq->rsplen = 0;
 
-        fcpreq->sg = &fod->data_sg[fod->offset / PAGE_SIZE];
-        fcpreq->sg_cnt = DIV_ROUND_UP(tlen, PAGE_SIZE);
-
         /*
          * If the last READDATA request: check if LLDD supports
          * combined xfr with response.
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index d8d91f04bd7e..ae7586b8be07 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -162,7 +162,7 @@ static blk_status_t nvme_loop_queue_rq(struct blk_mq_hw_ctx *hctx,
         blk_status_t ret;
 
         if (!nvmf_check_ready(&queue->ctrl->ctrl, req, queue_ready))
-                return nvmf_fail_nonready_command(req);
+                return nvmf_fail_nonready_command(&queue->ctrl->ctrl, req);
 
         ret = nvme_setup_cmd(ns, req, &iod->cmd);
         if (ret)
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 848f549164cd..466e3c8582f0 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -102,7 +102,7 @@ static u32 phandle_cache_mask;
  *   - the phandle lookup overhead reduction provided by the cache
  *     will likely be less
  */
-static void of_populate_phandle_cache(void)
+void of_populate_phandle_cache(void)
 {
         unsigned long flags;
         u32 cache_entries;
@@ -134,8 +134,7 @@ out:
         raw_spin_unlock_irqrestore(&devtree_lock, flags);
 }
 
-#ifndef CONFIG_MODULES
-static int __init of_free_phandle_cache(void)
+int of_free_phandle_cache(void)
 {
         unsigned long flags;
 
@@ -148,6 +147,7 @@ static int __init of_free_phandle_cache(void)
 
         return 0;
 }
+#if !defined(CONFIG_MODULES)
 late_initcall_sync(of_free_phandle_cache);
 #endif
 
diff --git a/drivers/of/of_private.h b/drivers/of/of_private.h
index 891d780c076a..216175d11d3d 100644
--- a/drivers/of/of_private.h
+++ b/drivers/of/of_private.h
@@ -79,6 +79,8 @@ int of_resolve_phandles(struct device_node *tree);
 #if defined(CONFIG_OF_OVERLAY)
 void of_overlay_mutex_lock(void);
 void of_overlay_mutex_unlock(void);
+int of_free_phandle_cache(void);
+void of_populate_phandle_cache(void);
 #else
 static inline void of_overlay_mutex_lock(void) {};
 static inline void of_overlay_mutex_unlock(void) {};
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index 7baa53e5b1d7..eda57ef12fd0 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -804,6 +804,8 @@ static int of_overlay_apply(const void *fdt, struct device_node *tree,
                 goto err_free_overlay_changeset;
         }
 
+        of_populate_phandle_cache();
+
         ret = __of_changeset_apply_notify(&ovcs->cset);
         if (ret)
                 pr_err("overlay changeset entry notify error %d\n", ret);
@@ -1046,8 +1048,17 @@ int of_overlay_remove(int *ovcs_id)
 
         list_del(&ovcs->ovcs_list);
 
+        /*
+         * Disable phandle cache.  Avoids race condition that would arise
+         * from removing cache entry when the associated node is deleted.
+         */
+        of_free_phandle_cache();
+
         ret_apply = 0;
         ret = __of_changeset_revert_entries(&ovcs->cset, &ret_apply);
+
+        of_populate_phandle_cache();
+
         if (ret) {
                 if (ret_apply)
                         devicetree_state_flags |= DTSF_REVERT_FAIL;
diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
index 35b7fc87eac5..5cb40b2518f9 100644
--- a/drivers/pci/bus.c
+++ b/drivers/pci/bus.c
@@ -330,7 +330,7 @@ void pci_bus_add_device(struct pci_dev *dev)
                 return;
         }
 
-        dev->is_added = 1;
+        pci_dev_assign_added(dev, true);
 }
 EXPORT_SYMBOL_GPL(pci_bus_add_device);
 
@@ -347,14 +347,14 @@ void pci_bus_add_devices(const struct pci_bus *bus)
 
         list_for_each_entry(dev, &bus->devices, bus_list) {
                 /* Skip already-added devices */
-                if (dev->is_added)
+                if (pci_dev_is_added(dev))
                         continue;
                 pci_bus_add_device(dev);
         }
 
         list_for_each_entry(dev, &bus->devices, bus_list) {
                 /* Skip if device attach failed */
-                if (!dev->is_added)
+                if (!pci_dev_is_added(dev))
                         continue;
                 child = dev->subordinate;
                 if (child)
diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
index 781aa03aeede..29a05759a294 100644
--- a/drivers/pci/controller/dwc/pcie-designware-host.c
+++ b/drivers/pci/controller/dwc/pcie-designware-host.c
@@ -363,7 +363,8 @@ int dw_pcie_host_init(struct pcie_port *pp)
         resource_list_for_each_entry_safe(win, tmp, &bridge->windows) {
                 switch (resource_type(win->res)) {
                 case IORESOURCE_IO:
-                        ret = pci_remap_iospace(win->res, pp->io_base);
+                        ret = devm_pci_remap_iospace(dev, win->res,
+                                                     pp->io_base);
                         if (ret) {
                                 dev_warn(dev, "Error %d: failed to map resource %pR\n",
                                          ret, win->res);
diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index d3172d5d3d35..0fae816fba39 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -849,7 +849,7 @@ static int advk_pcie_parse_request_of_pci_ranges(struct advk_pcie *pcie)
                                              0, 0xF8000000, 0,
                                              lower_32_bits(res->start),
                                              OB_PCIE_IO);
-                        err = pci_remap_iospace(res, iobase);
+                        err = devm_pci_remap_iospace(dev, res, iobase);
                         if (err) {
                                 dev_warn(dev, "error %d: failed to map resource %pR\n",
                                          err, res);
diff --git a/drivers/pci/controller/pci-ftpci100.c b/drivers/pci/controller/pci-ftpci100.c
index 20bb2564a6b3..bf5ece5d9291 100644
--- a/drivers/pci/controller/pci-ftpci100.c
+++ b/drivers/pci/controller/pci-ftpci100.c
@@ -503,7 +503,7 @@ static int faraday_pci_probe(struct platform_device *pdev)
                                 dev_err(dev, "illegal IO mem size\n");
                                 return -EINVAL;
                         }
-                        ret = pci_remap_iospace(io, io_base);
+                        ret = devm_pci_remap_iospace(dev, io, io_base);
                         if (ret) {
                                 dev_warn(dev, "error %d: failed to map resource %pR\n",
                                          ret, io);
diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
index 6cc5036ac83c..f6325f1a89e8 100644
--- a/drivers/pci/controller/pci-hyperv.c
+++ b/drivers/pci/controller/pci-hyperv.c
@@ -1073,6 +1073,7 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
         struct pci_bus *pbus;
         struct pci_dev *pdev;
         struct cpumask *dest;
+        unsigned long flags;
         struct compose_comp_ctxt comp;
         struct tran_int_desc *int_desc;
         struct {
@@ -1164,14 +1165,15 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
                  * the channel callback directly when channel->target_cpu is
                  * the current CPU. When the higher level interrupt code
                  * calls us with interrupt enabled, let's add the
-                 * local_bh_disable()/enable() to avoid race.
+                 * local_irq_save()/restore() to avoid race:
+                 * hv_pci_onchannelcallback() can also run in tasklet.
                  */
-                local_bh_disable();
+                local_irq_save(flags);
 
                 if (hbus->hdev->channel->target_cpu == smp_processor_id())
                         hv_pci_onchannelcallback(hbus);
 
-                local_bh_enable();
+                local_irq_restore(flags);
 
                 if (hpdev->state == hv_pcichild_ejecting) {
                         dev_err_once(&hbus->hdev->device,
diff --git a/drivers/pci/controller/pci-v3-semi.c b/drivers/pci/controller/pci-v3-semi.c
index 68b8bfbdb867..d219404bad92 100644
--- a/drivers/pci/controller/pci-v3-semi.c
+++ b/drivers/pci/controller/pci-v3-semi.c
@@ -537,7 +537,7 @@ static int v3_pci_setup_resource(struct v3_pci *v3,
                 v3->io_bus_addr = io->start - win->offset;
                 dev_dbg(dev, "I/O window %pR, bus addr %pap\n",
                         io, &v3->io_bus_addr);
-                ret = pci_remap_iospace(io, io_base);
+                ret = devm_pci_remap_iospace(dev, io, io_base);
                 if (ret) {
                         dev_warn(dev,
                                  "error %d: failed to map resource %pR\n",
diff --git a/drivers/pci/controller/pci-versatile.c b/drivers/pci/controller/pci-versatile.c
index 994f32061b32..f59ad2728c0b 100644
--- a/drivers/pci/controller/pci-versatile.c
+++ b/drivers/pci/controller/pci-versatile.c
@@ -82,7 +82,7 @@ static int versatile_pci_parse_request_of_pci_ranges(struct device *dev,
 
                 switch (resource_type(res)) {
                 case IORESOURCE_IO:
-                        err = pci_remap_iospace(res, iobase);
+                        err = devm_pci_remap_iospace(dev, res, iobase);
                         if (err) {
                                 dev_warn(dev, "error %d: failed to map resource %pR\n",
                                          err, res);
diff --git a/drivers/pci/controller/pci-xgene.c b/drivers/pci/controller/pci-xgene.c
index d854d67e873c..ffda3e8b4742 100644
--- a/drivers/pci/controller/pci-xgene.c
+++ b/drivers/pci/controller/pci-xgene.c
@@ -423,7 +423,7 @@ static int xgene_pcie_map_ranges(struct xgene_pcie_port *port,
                 case IORESOURCE_IO:
                         xgene_pcie_setup_ob_reg(port, res, OMR3BARL, io_base,
                                                 res->start - window->offset);
-                        ret = pci_remap_iospace(res, io_base);
+                        ret = devm_pci_remap_iospace(dev, res, io_base);
                         if (ret < 0)
                                 return ret;
                         break;
diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
index 0baabe30858f..861dda69f366 100644
--- a/drivers/pci/controller/pcie-mediatek.c
+++ b/drivers/pci/controller/pcie-mediatek.c
@@ -1109,7 +1109,7 @@ static int mtk_pcie_request_resources(struct mtk_pcie *pcie)
         if (err < 0)
                 return err;
 
-        pci_remap_iospace(&pcie->pio, pcie->io.start);
+        devm_pci_remap_iospace(dev, &pcie->pio, pcie->io.start);
 
         return 0;
 }
diff --git a/drivers/pci/controller/pcie-mobiveil.c b/drivers/pci/controller/pcie-mobiveil.c
index 4d6c20e47bed..cf0aa7cee5b0 100644
--- a/drivers/pci/controller/pcie-mobiveil.c
+++ b/drivers/pci/controller/pcie-mobiveil.c
@@ -107,7 +107,7 @@
 #define CFG_WINDOW_TYPE 0
 #define IO_WINDOW_TYPE          1
 #define MEM_WINDOW_TYPE 2
-#define IB_WIN_SIZE             (256 * 1024 * 1024 * 1024)
+#define IB_WIN_SIZE             ((u64)256 * 1024 * 1024 * 1024)
 #define MAX_PIO_WINDOWS 8
 
 /* Parameters for the waiting for link up routine */
diff --git a/drivers/pci/endpoint/pci-epf-core.c b/drivers/pci/endpoint/pci-epf-core.c
index bf53fad636a5..825fa24427a3 100644
--- a/drivers/pci/endpoint/pci-epf-core.c
+++ b/drivers/pci/endpoint/pci-epf-core.c
@@ -137,25 +137,60 @@ void *pci_epf_alloc_space(struct pci_epf *epf, size_t size, enum pci_barno bar)
 }
 EXPORT_SYMBOL_GPL(pci_epf_alloc_space);
 
-/**
- * pci_epf_unregister_driver() - unregister the PCI EPF driver
- * @driver: the PCI EPF driver that has to be unregistered
- *
- * Invoke to unregister the PCI EPF driver.
- */
-void pci_epf_unregister_driver(struct pci_epf_driver *driver)
+static void pci_epf_remove_cfs(struct pci_epf_driver *driver)
 {
         struct config_group *group, *tmp;
 
+        if (!IS_ENABLED(CONFIG_PCI_ENDPOINT_CONFIGFS))
+                return;
+
         mutex_lock(&pci_epf_mutex);
         list_for_each_entry_safe(group, tmp, &driver->epf_group, group_entry)
                 pci_ep_cfs_remove_epf_group(group);
         list_del(&driver->epf_group);
         mutex_unlock(&pci_epf_mutex);
+}
+
+/**
+ * pci_epf_unregister_driver() - unregister the PCI EPF driver
+ * @driver: the PCI EPF driver that has to be unregistered
+ *
+ * Invoke to unregister the PCI EPF driver.
+ */
+void pci_epf_unregister_driver(struct pci_epf_driver *driver)
+{
+        pci_epf_remove_cfs(driver);
         driver_unregister(&driver->driver);
 }
 EXPORT_SYMBOL_GPL(pci_epf_unregister_driver);
 
+static int pci_epf_add_cfs(struct pci_epf_driver *driver)
+{
+        struct config_group *group;
+        const struct pci_epf_device_id *id;
+
+        if (!IS_ENABLED(CONFIG_PCI_ENDPOINT_CONFIGFS))
+                return 0;
+
+        INIT_LIST_HEAD(&driver->epf_group);
+
+        id = driver->id_table;
+        while (id->name[0]) {
+                group = pci_ep_cfs_add_epf_group(id->name);
+                if (IS_ERR(group)) {
+                        pci_epf_remove_cfs(driver);
+                        return PTR_ERR(group);
+                }
+
+                mutex_lock(&pci_epf_mutex);
+                list_add_tail(&group->group_entry, &driver->epf_group);
+                mutex_unlock(&pci_epf_mutex);
+                id++;
+        }
+
+        return 0;
+}
+
 /**
  * __pci_epf_register_driver() - register a new PCI EPF driver
  * @driver: structure representing PCI EPF driver
@@ -167,8 +202,6 @@ int __pci_epf_register_driver(struct pci_epf_driver *driver,
                               struct module *owner)
 {
         int ret;
-        struct config_group *group;
-        const struct pci_epf_device_id *id;
 
         if (!driver->ops)
                 return -EINVAL;
@@ -183,16 +216,7 @@ int __pci_epf_register_driver(struct pci_epf_driver *driver,
         if (ret)
                 return ret;
 
-        INIT_LIST_HEAD(&driver->epf_group);
-
-        id = driver->id_table;
-        while (id->name[0]) {
-                group = pci_ep_cfs_add_epf_group(id->name);
-                mutex_lock(&pci_epf_mutex);
-                list_add_tail(&group->group_entry, &driver->epf_group);
-                mutex_unlock(&pci_epf_mutex);
-                id++;
-        }
+        pci_epf_add_cfs(driver);
 
         return 0;
 }
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 3a17b290df5d..ef0b1b6ba86f 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -509,7 +509,7 @@ static void enable_slot(struct acpiphp_slot *slot)
 
         list_for_each_entry(dev, &bus->devices, bus_list) {
                 /* Assume that newly added devices are powered on already. */
-                if (!dev->is_added)
+                if (!pci_dev_is_added(dev))
                         dev->current_state = PCI_D0;
         }
 
diff --git a/drivers/pci/of.c b/drivers/pci/of.c
index d088c9147f10..69a60d6ebd73 100644
--- a/drivers/pci/of.c
+++ b/drivers/pci/of.c
@@ -612,7 +612,7 @@ int pci_parse_request_of_pci_ranges(struct device *dev,
 
                 switch (resource_type(res)) {
                 case IORESOURCE_IO:
-                        err = pci_remap_iospace(res, iobase);
+                        err = devm_pci_remap_iospace(dev, res, iobase);
                         if (err) {
                                 dev_warn(dev, "error %d: failed to map resource %pR\n",
                                          err, res);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 97acba712e4e..316496e99da9 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -3579,6 +3579,44 @@ void pci_unmap_iospace(struct resource *res)
 }
 EXPORT_SYMBOL(pci_unmap_iospace);
 
+static void devm_pci_unmap_iospace(struct device *dev, void *ptr)
+{
+        struct resource **res = ptr;
+
+        pci_unmap_iospace(*res);
+}
+
+/**
+ * devm_pci_remap_iospace - Managed pci_remap_iospace()
+ * @dev: Generic device to remap IO address for
+ * @res: Resource describing the I/O space
+ * @phys_addr: physical address of range to be mapped
+ *
+ * Managed pci_remap_iospace().  Map is automatically unmapped on driver
+ * detach.
+ */
+int devm_pci_remap_iospace(struct device *dev, const struct resource *res,
+                           phys_addr_t phys_addr)
+{
+        const struct resource **ptr;
+        int error;
+
+        ptr = devres_alloc(devm_pci_unmap_iospace, sizeof(*ptr), GFP_KERNEL);
+        if (!ptr)
+                return -ENOMEM;
+
+        error = pci_remap_iospace(res, phys_addr);
+        if (error) {
+                devres_free(ptr);
+        } else  {
+                *ptr = res;
+                devres_add(dev, ptr);
+        }
+
+        return error;
+}
+EXPORT_SYMBOL(devm_pci_remap_iospace);
+
 /**
  * devm_pci_remap_cfgspace - Managed pci_remap_cfgspace()
  * @dev: Generic device to remap IO address for
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 882f1f9596df..08817253c8a2 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -288,6 +288,7 @@ struct pci_sriov {
 
 /* pci_dev priv_flags */
 #define PCI_DEV_DISCONNECTED 0
+#define PCI_DEV_ADDED 1
 
 static inline int pci_dev_set_disconnected(struct pci_dev *dev, void *unused)
 {
@@ -300,6 +301,16 @@ static inline bool pci_dev_is_disconnected(const struct pci_dev *dev)
         return test_bit(PCI_DEV_DISCONNECTED, &dev->priv_flags);
 }
 
+static inline void pci_dev_assign_added(struct pci_dev *dev, bool added)
+{
+        assign_bit(PCI_DEV_ADDED, &dev->priv_flags, added);
+}
+
+static inline bool pci_dev_is_added(const struct pci_dev *dev)
+{
+        return test_bit(PCI_DEV_ADDED, &dev->priv_flags);
+}
+
 #ifdef CONFIG_PCI_ATS
 void pci_restore_ats_state(struct pci_dev *dev);
 #else
diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c
index f7ce0cb0b0b7..f02e334beb45 100644
--- a/drivers/pci/pcie/err.c
+++ b/drivers/pci/pcie/err.c
@@ -295,6 +295,7 @@ void pcie_do_fatal_recovery(struct pci_dev *dev, u32 service)
 
         parent = udev->subordinate;
         pci_lock_rescan_remove();
+        pci_dev_get(dev);
         list_for_each_entry_safe_reverse(pdev, temp, &parent->devices,
                                          bus_list) {
                 pci_dev_get(pdev);
@@ -328,6 +329,7 @@ void pcie_do_fatal_recovery(struct pci_dev *dev, u32 service)
                 pci_info(dev, "Device recovery from fatal error failed\n");
         }
 
+        pci_dev_put(dev);
         pci_unlock_rescan_remove();
 }
 
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index ac876e32de4b..611adcd9c169 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -2433,13 +2433,13 @@ int pci_scan_slot(struct pci_bus *bus, int devfn)
         dev = pci_scan_single_device(bus, devfn);
         if (!dev)
                 return 0;
-        if (!dev->is_added)
+        if (!pci_dev_is_added(dev))
                 nr++;
 
         for (fn = next_fn(bus, dev, 0); fn > 0; fn = next_fn(bus, dev, fn)) {
                 dev = pci_scan_single_device(bus, devfn + fn);
                 if (dev) {
-                        if (!dev->is_added)
+                        if (!pci_dev_is_added(dev))
                                 nr++;
                         dev->multifunction = 1;
                 }
diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
index 6f072eae4f7a..5e3d0dced2b8 100644
--- a/drivers/pci/remove.c
+++ b/drivers/pci/remove.c
@@ -19,11 +19,12 @@ static void pci_stop_dev(struct pci_dev *dev)
 {
         pci_pme_active(dev, false);
 
-        if (dev->is_added) {
+        if (pci_dev_is_added(dev)) {
                 device_release_driver(&dev->dev);
                 pci_proc_detach_device(dev);
                 pci_remove_sysfs_dev_files(dev);
-                dev->is_added = 0;
+
+                pci_dev_assign_added(dev, false);
         }
 
         if (dev->bus->self)
diff --git a/drivers/phy/broadcom/phy-brcm-usb-init.c b/drivers/phy/broadcom/phy-brcm-usb-init.c
index 1b7febc43da9..29d2c3b1913a 100644
--- a/drivers/phy/broadcom/phy-brcm-usb-init.c
+++ b/drivers/phy/broadcom/phy-brcm-usb-init.c
@@ -962,6 +962,10 @@ void brcm_usb_init_xhci(struct brcm_usb_init_params *params)
 {
         void __iomem *ctrl = params->ctrl_regs;
 
+        USB_CTRL_UNSET(ctrl, USB30_PCTL, PHY3_IDDQ_OVERRIDE);
+        /* 1 millisecond - for USB clocks to settle down */
+        usleep_range(1000, 2000);
+
         if (BRCM_ID(params->family_id) == 0x7366) {
                 /*
                  * The PHY3_SOFT_RESETB bits default to the wrong state.
diff --git a/drivers/phy/motorola/phy-mapphone-mdm6600.c b/drivers/phy/motorola/phy-mapphone-mdm6600.c
index 23705e1a0023..0075fb0bef8c 100644
--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c
+++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c
@@ -182,13 +182,13 @@ static void phy_mdm6600_status(struct work_struct *work)
         ddata = container_of(work, struct phy_mdm6600, status_work.work);
         dev = ddata->dev;
 
-        error = gpiod_get_array_value_cansleep(PHY_MDM6600_NR_CMD_LINES,
+        error = gpiod_get_array_value_cansleep(PHY_MDM6600_NR_STATUS_LINES,
                                                ddata->status_gpios->desc,
                                                values);
         if (error)
                 return;
 
-        for (i = 0; i < PHY_MDM6600_NR_CMD_LINES; i++) {
+        for (i = 0; i < PHY_MDM6600_NR_STATUS_LINES; i++) {
                 val |= values[i] << i;
                 dev_dbg(ddata->dev, "XXX %s: i: %i values[i]: %i val: %i\n",
                         __func__, i, values[i], val);
diff --git a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
index 35c17653c694..87618a4e90e4 100644
--- a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
+++ b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
@@ -460,8 +460,8 @@ static int nsp_pinmux_enable(struct pinctrl_dev *pctrl_dev,
         const struct nsp_pin_function *func;
         const struct nsp_pin_group *grp;
 
-        if (grp_select > pinctrl->num_groups ||
-                func_select > pinctrl->num_functions)
+        if (grp_select >= pinctrl->num_groups ||
+            func_select >= pinctrl->num_functions)
                 return -EINVAL;
 
         func = &pinctrl->functions[func_select];
@@ -577,6 +577,8 @@ static int nsp_pinmux_probe(struct platform_device *pdev)
                 return PTR_ERR(pinctrl->base0);
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+        if (!res)
+                return -EINVAL;
         pinctrl->base1 = devm_ioremap_nocache(&pdev->dev, res->start,
                                               resource_size(res));
         if (!pinctrl->base1) {
diff --git a/drivers/pinctrl/mediatek/pinctrl-mt7622.c b/drivers/pinctrl/mediatek/pinctrl-mt7622.c
index e3f1ab2290fc..4c4740ffeb9c 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mt7622.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mt7622.c
@@ -1424,7 +1424,7 @@ static struct pinctrl_desc mtk_desc = {
 
 static int mtk_gpio_get(struct gpio_chip *chip, unsigned int gpio)
 {
-        struct mtk_pinctrl *hw = dev_get_drvdata(chip->parent);
+        struct mtk_pinctrl *hw = gpiochip_get_data(chip);
         int value, err;
 
         err = mtk_hw_get_value(hw, gpio, PINCTRL_PIN_REG_DI, &value);
@@ -1436,7 +1436,7 @@ static int mtk_gpio_get(struct gpio_chip *chip, unsigned int gpio)
 
 static void mtk_gpio_set(struct gpio_chip *chip, unsigned int gpio, int value)
 {
-        struct mtk_pinctrl *hw = dev_get_drvdata(chip->parent);
+        struct mtk_pinctrl *hw = gpiochip_get_data(chip);
 
         mtk_hw_set_value(hw, gpio, PINCTRL_PIN_REG_DO, !!value);
 }
@@ -1508,11 +1508,20 @@ static int mtk_build_gpiochip(struct mtk_pinctrl *hw, struct device_node *np)
         if (ret < 0)
                 return ret;
 
-        ret = gpiochip_add_pin_range(chip, dev_name(hw->dev), 0, 0,
-                                     chip->ngpio);
-        if (ret < 0) {
-                gpiochip_remove(chip);
-                return ret;
+        /* Just for backward compatible for these old pinctrl nodes without
+         * "gpio-ranges" property. Otherwise, called directly from a
+         * DeviceTree-supported pinctrl driver is DEPRECATED.
+         * Please see Section 2.1 of
+         * Documentation/devicetree/bindings/gpio/gpio.txt on how to
+         * bind pinctrl and gpio drivers via the "gpio-ranges" property.
+         */
+        if (!of_find_property(np, "gpio-ranges", NULL)) {
+                ret = gpiochip_add_pin_range(chip, dev_name(hw->dev), 0, 0,
+                                             chip->ngpio);
+                if (ret < 0) {
+                        gpiochip_remove(chip);
+                        return ret;
+                }
         }
 
         return 0;
@@ -1695,15 +1704,16 @@ static int mtk_pinctrl_probe(struct platform_device *pdev)
         mtk_desc.custom_conf_items = mtk_conf_items;
 #endif
 
-        hw->pctrl = devm_pinctrl_register(&pdev->dev, &mtk_desc, hw);
-        if (IS_ERR(hw->pctrl))
-                return PTR_ERR(hw->pctrl);
+        err = devm_pinctrl_register_and_init(&pdev->dev, &mtk_desc, hw,
+                                             &hw->pctrl);
+        if (err)
+                return err;
 
         /* Setup groups descriptions per SoC types */
         err = mtk_build_groups(hw);
         if (err) {
                 dev_err(&pdev->dev, "Failed to build groups\n");
-                return 0;
+                return err;
         }
 
         /* Setup functions descriptions per SoC types */
@@ -1713,17 +1723,25 @@ static int mtk_pinctrl_probe(struct platform_device *pdev)
                 return err;
         }
 
-        err = mtk_build_gpiochip(hw, pdev->dev.of_node);
-        if (err) {
-                dev_err(&pdev->dev, "Failed to add gpio_chip\n");
+        /* For able to make pinctrl_claim_hogs, we must not enable pinctrl
+         * until all groups and functions are being added one.
+         */
+        err = pinctrl_enable(hw->pctrl);
+        if (err)
                 return err;
-        }
 
         err = mtk_build_eint(hw, pdev);
         if (err)
                 dev_warn(&pdev->dev,
                          "Failed to add EINT, but pinctrl still can work\n");
 
+        /* Build gpiochip should be after pinctrl_enable is done */
+        err = mtk_build_gpiochip(hw, pdev->dev.of_node);
+        if (err) {
+                dev_err(&pdev->dev, "Failed to add gpio_chip\n");
+                return err;
+        }
+
         platform_set_drvdata(pdev, hw);
 
         return 0;
diff --git a/drivers/pinctrl/pinctrl-ingenic.c b/drivers/pinctrl/pinctrl-ingenic.c
index a1d7156d0a43..6a1b6058b991 100644
--- a/drivers/pinctrl/pinctrl-ingenic.c
+++ b/drivers/pinctrl/pinctrl-ingenic.c
@@ -536,7 +536,7 @@ static int ingenic_pinmux_gpio_set_direction(struct pinctrl_dev *pctldev,
                 ingenic_config_pin(jzpc, pin, JZ4770_GPIO_PAT1, input);
         } else {
                 ingenic_config_pin(jzpc, pin, JZ4740_GPIO_SELECT, false);
-                ingenic_config_pin(jzpc, pin, JZ4740_GPIO_DIR, input);
+                ingenic_config_pin(jzpc, pin, JZ4740_GPIO_DIR, !input);
                 ingenic_config_pin(jzpc, pin, JZ4740_GPIO_FUNC, false);
         }
 
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77970.c b/drivers/pinctrl/sh-pfc/pfc-r8a77970.c
index b02caf316711..eeb58b3bbc9a 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a77970.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a77970.c
@@ -21,15 +21,13 @@
 #include "core.h"
 #include "sh_pfc.h"
 
-#define CFG_FLAGS SH_PFC_PIN_CFG_DRIVE_STRENGTH
-
 #define CPU_ALL_PORT(fn, sfx)                                           \
-        PORT_GP_CFG_22(0, fn, sfx, CFG_FLAGS | SH_PFC_PIN_CFG_IO_VOLTAGE), \
-        PORT_GP_CFG_28(1, fn, sfx, CFG_FLAGS),                          \
-        PORT_GP_CFG_17(2, fn, sfx, CFG_FLAGS | SH_PFC_PIN_CFG_IO_VOLTAGE), \
-        PORT_GP_CFG_17(3, fn, sfx, CFG_FLAGS | SH_PFC_PIN_CFG_IO_VOLTAGE), \
-        PORT_GP_CFG_6(4,  fn, sfx, CFG_FLAGS),                          \
-        PORT_GP_CFG_15(5, fn, sfx, CFG_FLAGS)
+        PORT_GP_CFG_22(0, fn, sfx, SH_PFC_PIN_CFG_IO_VOLTAGE),          \
+        PORT_GP_28(1, fn, sfx),                                         \
+        PORT_GP_CFG_17(2, fn, sfx, SH_PFC_PIN_CFG_IO_VOLTAGE),          \
+        PORT_GP_CFG_17(3, fn, sfx, SH_PFC_PIN_CFG_IO_VOLTAGE),          \
+        PORT_GP_6(4,  fn, sfx),                                         \
+        PORT_GP_15(5, fn, sfx)
 /*
  * F_() : just information
  * FM() : macro for FN_xxx / xxx_MARK
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index f1fa8612db40..06978c14c83b 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -2185,7 +2185,7 @@ static int __init dell_init(void)
                 dell_fill_request(&buffer, token->location, 0, 0, 0);
                 ret = dell_send_request(&buffer,
                                         CLASS_TOKEN_READ, SELECT_TOKEN_AC);
-                if (ret)
+                if (ret == 0)
                         max_intensity = buffer.output[3];
         }
 
diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
index 547dbdac9d54..01b0e2bb3319 100644
--- a/drivers/ptp/ptp_chardev.c
+++ b/drivers/ptp/ptp_chardev.c
@@ -89,6 +89,7 @@ int ptp_set_pinfunc(struct ptp_clock *ptp, unsigned int pin,
         case PTP_PF_PHYSYNC:
                 if (chan != 0)
                         return -EINVAL;
+                break;
         default:
                 return -EINVAL;
         }
diff --git a/drivers/scsi/cxlflash/main.h b/drivers/scsi/cxlflash/main.h
index 2a3977823812..a39be94d110c 100644
--- a/drivers/scsi/cxlflash/main.h
+++ b/drivers/scsi/cxlflash/main.h
@@ -107,12 +107,12 @@ cxlflash_assign_ops(struct dev_dependent_vals *ddv)
 {
         const struct cxlflash_backend_ops *ops = NULL;
 
-#ifdef CONFIG_OCXL
+#ifdef CONFIG_OCXL_BASE
         if (ddv->flags & CXLFLASH_OCXL_DEV)
                 ops = &cxlflash_ocxl_ops;
 #endif
 
-#ifdef CONFIG_CXL
+#ifdef CONFIG_CXL_BASE
         if (!(ddv->flags & CXLFLASH_OCXL_DEV))
                 ops = &cxlflash_cxl_ops;
 #endif
diff --git a/drivers/scsi/cxlflash/ocxl_hw.c b/drivers/scsi/cxlflash/ocxl_hw.c
index 0a95b5f25380..497a68389461 100644
--- a/drivers/scsi/cxlflash/ocxl_hw.c
+++ b/drivers/scsi/cxlflash/ocxl_hw.c
@@ -134,15 +134,14 @@ static struct file *ocxlflash_getfile(struct device *dev, const char *name,
                 rc = PTR_ERR(file);
                 dev_err(dev, "%s: alloc_file failed rc=%d\n",
                         __func__, rc);
-                goto err5;
+                path_put(&path);
+                goto err3;
         }
 
         file->f_flags = flags & (O_ACCMODE | O_NONBLOCK);
         file->private_data = priv;
 out:
         return file;
-err5:
-        path_put(&path);
 err4:
         iput(inode);
 err3:
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 15c7f3b6f35e..58bb70b886d7 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -3440,11 +3440,11 @@ static void hpsa_get_enclosure_info(struct ctlr_info *h,
         struct ext_report_lun_entry *rle = &rlep->LUN[rle_index];
         u16 bmic_device_index = 0;
 
-        bmic_device_index = GET_BMIC_DRIVE_NUMBER(&rle->lunid[0]);
-
-        encl_dev->sas_address =
+        encl_dev->eli =
                 hpsa_get_enclosure_logical_identifier(h, scsi3addr);
 
+        bmic_device_index = GET_BMIC_DRIVE_NUMBER(&rle->lunid[0]);
+
         if (encl_dev->target == -1 || encl_dev->lun == -1) {
                 rc = IO_OK;
                 goto out;
@@ -9697,7 +9697,24 @@ hpsa_sas_get_linkerrors(struct sas_phy *phy)
 static int
 hpsa_sas_get_enclosure_identifier(struct sas_rphy *rphy, u64 *identifier)
 {
-        *identifier = rphy->identify.sas_address;
+        struct Scsi_Host *shost = phy_to_shost(rphy);
+        struct ctlr_info *h;
+        struct hpsa_scsi_dev_t *sd;
+
+        if (!shost)
+                return -ENXIO;
+
+        h = shost_to_hba(shost);
+
+        if (!h)
+                return -ENXIO;
+
+        sd = hpsa_find_device_by_sas_rphy(h, rphy);
+        if (!sd)
+                return -ENXIO;
+
+        *identifier = sd->eli;
+
         return 0;
 }
 
diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
index fb9f5e7f8209..59e023696fff 100644
--- a/drivers/scsi/hpsa.h
+++ b/drivers/scsi/hpsa.h
@@ -68,6 +68,7 @@ struct hpsa_scsi_dev_t {
 #define RAID_CTLR_LUNID "\0\0\0\0\0\0\0\0"
         unsigned char device_id[16];    /* from inquiry pg. 0x83 */
         u64 sas_address;
+        u64 eli;                        /* from report diags. */
         unsigned char vendor[8];        /* bytes 8-15 of inquiry data */
         unsigned char model[16];        /* bytes 16-31 of inquiry data */
         unsigned char rev;              /* byte 2 of inquiry data */
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index d6093838f5f2..c972cc2b3d5b 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -284,11 +284,11 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
                  */
                 if (opcode != ISCSI_OP_SCSI_DATA_OUT) {
                         iscsi_conn_printk(KERN_INFO, conn,
-                                          "task [op %x/%x itt "
+                                          "task [op %x itt "
                                           "0x%x/0x%x] "
                                           "rejected.\n",
-                                          task->hdr->opcode, opcode,
-                                          task->itt, task->hdr_itt);
+                                          opcode, task->itt,
+                                          task->hdr_itt);
                         return -EACCES;
                 }
                 /*
@@ -297,10 +297,10 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
                  */
                 if (conn->session->fast_abort) {
                         iscsi_conn_printk(KERN_INFO, conn,
-                                          "task [op %x/%x itt "
+                                          "task [op %x itt "
                                           "0x%x/0x%x] fast abort.\n",
-                                          task->hdr->opcode, opcode,
-                                          task->itt, task->hdr_itt);
+                                          opcode, task->itt,
+                                          task->hdr_itt);
                         return -EACCES;
                 }
                 break;
diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
index 90394cef0f41..0a5dd5595dd3 100644
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -3295,6 +3295,11 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
 
         init_completion(&qedf->flogi_compl);
 
+        status = qed_ops->common->update_drv_state(qedf->cdev, true);
+        if (status)
+                QEDF_ERR(&(qedf->dbg_ctx),
+                        "Failed to send drv state to MFW.\n");
+
         memset(&link_params, 0, sizeof(struct qed_link_params));
         link_params.link_up = true;
         status = qed_ops->common->set_link(qedf->cdev, &link_params);
@@ -3343,6 +3348,7 @@ static int qedf_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 static void __qedf_remove(struct pci_dev *pdev, int mode)
 {
         struct qedf_ctx *qedf;
+        int rc;
 
         if (!pdev) {
                 QEDF_ERR(NULL, "pdev is NULL.\n");
@@ -3437,6 +3443,12 @@ static void __qedf_remove(struct pci_dev *pdev, int mode)
                 qed_ops->common->set_power_state(qedf->cdev, PCI_D0);
                 pci_set_drvdata(pdev, NULL);
         }
+
+        rc = qed_ops->common->update_drv_state(qedf->cdev, false);
+        if (rc)
+                QEDF_ERR(&(qedf->dbg_ctx),
+                        "Failed to send drv state to MFW.\n");
+
         qed_ops->common->slowpath_stop(qedf->cdev);
         qed_ops->common->remove(qedf->cdev);
 
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index cf274a79e77a..091ec1207bea 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -2273,6 +2273,7 @@ kset_free:
 static void __qedi_remove(struct pci_dev *pdev, int mode)
 {
         struct qedi_ctx *qedi = pci_get_drvdata(pdev);
+        int rval;
 
         if (qedi->tmf_thread) {
                 flush_workqueue(qedi->tmf_thread);
@@ -2302,6 +2303,10 @@ static void __qedi_remove(struct pci_dev *pdev, int mode)
         if (mode == QEDI_MODE_NORMAL)
                 qedi_free_iscsi_pf_param(qedi);
 
+        rval = qedi_ops->common->update_drv_state(qedi->cdev, false);
+        if (rval)
+                QEDI_ERR(&qedi->dbg_ctx, "Failed to send drv state to MFW\n");
+
         if (!test_bit(QEDI_IN_OFFLINE, &qedi->flags)) {
                 qedi_ops->common->slowpath_stop(qedi->cdev);
                 qedi_ops->common->remove(qedi->cdev);
@@ -2576,6 +2581,12 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
                 if (qedi_setup_boot_info(qedi))
                         QEDI_ERR(&qedi->dbg_ctx,
                                  "No iSCSI boot target configured\n");
+
+                rc = qedi_ops->common->update_drv_state(qedi->cdev, true);
+                if (rc)
+                        QEDI_ERR(&qedi->dbg_ctx,
+                                 "Failed to send drv state to MFW\n");
+
         }
 
         return 0;
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 89a4999fa631..c8731568f9c4 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -2141,6 +2141,7 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
                 msleep(1000);
 
         qla24xx_disable_vp(vha);
+        qla2x00_wait_for_sess_deletion(vha);
 
         vha->flags.delete_progress = 1;
 
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 9442e18aef6f..0f94b1d62d3f 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -361,6 +361,8 @@ struct ct_arg {
         dma_addr_t      rsp_dma;
         u32             req_size;
         u32             rsp_size;
+        u32             req_allocated_size;
+        u32             rsp_allocated_size;
         void            *req;
         void            *rsp;
         port_id_t       id;
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index f68eb6096559..2660a48d918a 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -214,6 +214,7 @@ void qla2x00_handle_login_done_event(struct scsi_qla_host *, fc_port_t *,
 int qla24xx_post_gnl_work(struct scsi_qla_host *, fc_port_t *);
 int qla24xx_async_abort_cmd(srb_t *);
 int qla24xx_post_relogin_work(struct scsi_qla_host *vha);
+void qla2x00_wait_for_sess_deletion(scsi_qla_host_t *);
 
 /*
  * Global Functions in qla_mid.c source file.
diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
index 4bc2b66b299f..7a3744006419 100644
--- a/drivers/scsi/qla2xxx/qla_gs.c
+++ b/drivers/scsi/qla2xxx/qla_gs.c
@@ -556,7 +556,7 @@ err2:
                 /* please ignore kernel warning. otherwise, we have mem leak. */
                 if (sp->u.iocb_cmd.u.ctarg.req) {
                         dma_free_coherent(&vha->hw->pdev->dev,
-                            sizeof(struct ct_sns_pkt),
+                            sp->u.iocb_cmd.u.ctarg.req_allocated_size,
                             sp->u.iocb_cmd.u.ctarg.req,
                             sp->u.iocb_cmd.u.ctarg.req_dma);
                         sp->u.iocb_cmd.u.ctarg.req = NULL;
@@ -564,7 +564,7 @@ err2:
 
                 if (sp->u.iocb_cmd.u.ctarg.rsp) {
                         dma_free_coherent(&vha->hw->pdev->dev,
-                            sizeof(struct ct_sns_pkt),
+                            sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
                             sp->u.iocb_cmd.u.ctarg.rsp,
                             sp->u.iocb_cmd.u.ctarg.rsp_dma);
                         sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -617,6 +617,7 @@ static int qla_async_rftid(scsi_qla_host_t *vha, port_id_t *d_id)
         sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,
             sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,
             GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.req) {
                 ql_log(ql_log_warn, vha, 0xd041,
                     "%s: Failed to allocate ct_sns request.\n",
@@ -627,6 +628,7 @@ static int qla_async_rftid(scsi_qla_host_t *vha, port_id_t *d_id)
         sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,
             sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,
             GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.rsp) {
                 ql_log(ql_log_warn, vha, 0xd042,
                     "%s: Failed to allocate ct_sns request.\n",
@@ -712,6 +714,7 @@ static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id,
         sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,
             sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,
             GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.req) {
                 ql_log(ql_log_warn, vha, 0xd041,
                     "%s: Failed to allocate ct_sns request.\n",
@@ -722,6 +725,7 @@ static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id,
         sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,
             sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,
             GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.rsp) {
                 ql_log(ql_log_warn, vha, 0xd042,
                     "%s: Failed to allocate ct_sns request.\n",
@@ -802,6 +806,7 @@ static int qla_async_rnnid(scsi_qla_host_t *vha, port_id_t *d_id,
         sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,
             sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,
             GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.req) {
                 ql_log(ql_log_warn, vha, 0xd041,
                     "%s: Failed to allocate ct_sns request.\n",
@@ -812,6 +817,7 @@ static int qla_async_rnnid(scsi_qla_host_t *vha, port_id_t *d_id,
         sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,
             sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,
             GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.rsp) {
                 ql_log(ql_log_warn, vha, 0xd042,
                     "%s: Failed to allocate ct_sns request.\n",
@@ -909,6 +915,7 @@ static int qla_async_rsnn_nn(scsi_qla_host_t *vha)
         sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,
             sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,
             GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.req) {
                 ql_log(ql_log_warn, vha, 0xd041,
                     "%s: Failed to allocate ct_sns request.\n",
@@ -919,6 +926,7 @@ static int qla_async_rsnn_nn(scsi_qla_host_t *vha)
         sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,
             sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,
             GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.rsp) {
                 ql_log(ql_log_warn, vha, 0xd042,
                     "%s: Failed to allocate ct_sns request.\n",
@@ -3388,14 +3396,14 @@ void qla24xx_sp_unmap(scsi_qla_host_t *vha, srb_t *sp)
 {
         if (sp->u.iocb_cmd.u.ctarg.req) {
                 dma_free_coherent(&vha->hw->pdev->dev,
-                        sizeof(struct ct_sns_pkt),
+                        sp->u.iocb_cmd.u.ctarg.req_allocated_size,
                         sp->u.iocb_cmd.u.ctarg.req,
                         sp->u.iocb_cmd.u.ctarg.req_dma);
                 sp->u.iocb_cmd.u.ctarg.req = NULL;
         }
         if (sp->u.iocb_cmd.u.ctarg.rsp) {
                 dma_free_coherent(&vha->hw->pdev->dev,
-                        sizeof(struct ct_sns_pkt),
+                        sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
                         sp->u.iocb_cmd.u.ctarg.rsp,
                         sp->u.iocb_cmd.u.ctarg.rsp_dma);
                 sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -3596,14 +3604,14 @@ static void qla2x00_async_gpnid_sp_done(void *s, int res)
                 /* please ignore kernel warning. otherwise, we have mem leak. */
                 if (sp->u.iocb_cmd.u.ctarg.req) {
                         dma_free_coherent(&vha->hw->pdev->dev,
-                                sizeof(struct ct_sns_pkt),
+                                sp->u.iocb_cmd.u.ctarg.req_allocated_size,
                                 sp->u.iocb_cmd.u.ctarg.req,
                                 sp->u.iocb_cmd.u.ctarg.req_dma);
                         sp->u.iocb_cmd.u.ctarg.req = NULL;
                 }
                 if (sp->u.iocb_cmd.u.ctarg.rsp) {
                         dma_free_coherent(&vha->hw->pdev->dev,
-                                sizeof(struct ct_sns_pkt),
+                                sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
                                 sp->u.iocb_cmd.u.ctarg.rsp,
                                 sp->u.iocb_cmd.u.ctarg.rsp_dma);
                         sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -3654,6 +3662,7 @@ int qla24xx_async_gpnid(scsi_qla_host_t *vha, port_id_t *id)
         sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,
                 sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,
                 GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.req) {
                 ql_log(ql_log_warn, vha, 0xd041,
                     "Failed to allocate ct_sns request.\n");
@@ -3663,6 +3672,7 @@ int qla24xx_async_gpnid(scsi_qla_host_t *vha, port_id_t *id)
         sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,
                 sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,
                 GFP_KERNEL);
+        sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
         if (!sp->u.iocb_cmd.u.ctarg.rsp) {
                 ql_log(ql_log_warn, vha, 0xd042,
                     "Failed to allocate ct_sns request.\n");
@@ -3698,6 +3708,10 @@ int qla24xx_async_gpnid(scsi_qla_host_t *vha, port_id_t *id)
         return rval;
 
 done_free_sp:
+        spin_lock_irqsave(&vha->hw->vport_slock, flags);
+        list_del(&sp->elem);
+        spin_unlock_irqrestore(&vha->hw->vport_slock, flags);
+
         if (sp->u.iocb_cmd.u.ctarg.req) {
                 dma_free_coherent(&vha->hw->pdev->dev,
                         sizeof(struct ct_sns_pkt),
@@ -4142,14 +4156,14 @@ static void qla2x00_async_gpnft_gnnft_sp_done(void *s, int res)
                          */
                         if (sp->u.iocb_cmd.u.ctarg.req) {
                                 dma_free_coherent(&vha->hw->pdev->dev,
-                                    sizeof(struct ct_sns_pkt),
+                                    sp->u.iocb_cmd.u.ctarg.req_allocated_size,
                                     sp->u.iocb_cmd.u.ctarg.req,
                                     sp->u.iocb_cmd.u.ctarg.req_dma);
                                 sp->u.iocb_cmd.u.ctarg.req = NULL;
                         }
                         if (sp->u.iocb_cmd.u.ctarg.rsp) {
                                 dma_free_coherent(&vha->hw->pdev->dev,
-                                    sizeof(struct ct_sns_pkt),
+                                    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
                                     sp->u.iocb_cmd.u.ctarg.rsp,
                                     sp->u.iocb_cmd.u.ctarg.rsp_dma);
                                 sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -4179,14 +4193,14 @@ static void qla2x00_async_gpnft_gnnft_sp_done(void *s, int res)
                 /* please ignore kernel warning. Otherwise, we have mem leak. */
                 if (sp->u.iocb_cmd.u.ctarg.req) {
                         dma_free_coherent(&vha->hw->pdev->dev,
-                            sizeof(struct ct_sns_pkt),
+                            sp->u.iocb_cmd.u.ctarg.req_allocated_size,
                             sp->u.iocb_cmd.u.ctarg.req,
                             sp->u.iocb_cmd.u.ctarg.req_dma);
                         sp->u.iocb_cmd.u.ctarg.req = NULL;
                 }
                 if (sp->u.iocb_cmd.u.ctarg.rsp) {
                         dma_free_coherent(&vha->hw->pdev->dev,
-                            sizeof(struct ct_sns_pkt),
+                            sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
                             sp->u.iocb_cmd.u.ctarg.rsp,
                             sp->u.iocb_cmd.u.ctarg.rsp_dma);
                         sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -4281,14 +4295,14 @@ static int qla24xx_async_gnnft(scsi_qla_host_t *vha, struct srb *sp,
 done_free_sp:
         if (sp->u.iocb_cmd.u.ctarg.req) {
                 dma_free_coherent(&vha->hw->pdev->dev,
-                    sizeof(struct ct_sns_pkt),
+                    sp->u.iocb_cmd.u.ctarg.req_allocated_size,
                     sp->u.iocb_cmd.u.ctarg.req,
                     sp->u.iocb_cmd.u.ctarg.req_dma);
                 sp->u.iocb_cmd.u.ctarg.req = NULL;
         }
         if (sp->u.iocb_cmd.u.ctarg.rsp) {
                 dma_free_coherent(&vha->hw->pdev->dev,
-                    sizeof(struct ct_sns_pkt),
+                    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
                     sp->u.iocb_cmd.u.ctarg.rsp,
                     sp->u.iocb_cmd.u.ctarg.rsp_dma);
                 sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -4349,6 +4363,7 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp)
                 sp->u.iocb_cmd.u.ctarg.req = dma_zalloc_coherent(
                         &vha->hw->pdev->dev, sizeof(struct ct_sns_pkt),
                         &sp->u.iocb_cmd.u.ctarg.req_dma, GFP_KERNEL);
+                sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);
                 if (!sp->u.iocb_cmd.u.ctarg.req) {
                         ql_log(ql_log_warn, vha, 0xffff,
                             "Failed to allocate ct_sns request.\n");
@@ -4366,6 +4381,7 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp)
                 sp->u.iocb_cmd.u.ctarg.rsp = dma_zalloc_coherent(
                         &vha->hw->pdev->dev, rspsz,
                         &sp->u.iocb_cmd.u.ctarg.rsp_dma, GFP_KERNEL);
+                sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);
                 if (!sp->u.iocb_cmd.u.ctarg.rsp) {
                         ql_log(ql_log_warn, vha, 0xffff,
                             "Failed to allocate ct_sns request.\n");
@@ -4425,14 +4441,14 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp)
 done_free_sp:
         if (sp->u.iocb_cmd.u.ctarg.req) {
                 dma_free_coherent(&vha->hw->pdev->dev,
-                    sizeof(struct ct_sns_pkt),
+                    sp->u.iocb_cmd.u.ctarg.req_allocated_size,
                     sp->u.iocb_cmd.u.ctarg.req,
                     sp->u.iocb_cmd.u.ctarg.req_dma);
                 sp->u.iocb_cmd.u.ctarg.req = NULL;
         }
         if (sp->u.iocb_cmd.u.ctarg.rsp) {
                 dma_free_coherent(&vha->hw->pdev->dev,
-                    sizeof(struct ct_sns_pkt),
+                    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
                     sp->u.iocb_cmd.u.ctarg.rsp,
                     sp->u.iocb_cmd.u.ctarg.rsp_dma);
                 sp->u.iocb_cmd.u.ctarg.rsp = NULL;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 7b675243bd16..1b19b954bbae 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -591,12 +591,14 @@ static void qla24xx_handle_gnl_done_event(scsi_qla_host_t *vha,
                                 conflict_fcport =
                                         qla2x00_find_fcport_by_wwpn(vha,
                                             e->port_name, 0);
-                                ql_dbg(ql_dbg_disc, vha, 0x20e6,
-                                    "%s %d %8phC post del sess\n",
-                                    __func__, __LINE__,
-                                    conflict_fcport->port_name);
-                                qlt_schedule_sess_for_deletion
-                                        (conflict_fcport);
+                                if (conflict_fcport) {
+                                        qlt_schedule_sess_for_deletion
+                                                (conflict_fcport);
+                                        ql_dbg(ql_dbg_disc, vha, 0x20e6,
+                                            "%s %d %8phC post del sess\n",
+                                            __func__, __LINE__,
+                                            conflict_fcport->port_name);
+                                }
                         }
 
                         /* FW already picked this loop id for another fcport */
@@ -1487,11 +1489,10 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
 
         wait_for_completion(&tm_iocb->u.tmf.comp);
 
-        rval = tm_iocb->u.tmf.comp_status == CS_COMPLETE ?
-            QLA_SUCCESS : QLA_FUNCTION_FAILED;
+        rval = tm_iocb->u.tmf.data;
 
-        if ((rval != QLA_SUCCESS) || tm_iocb->u.tmf.data) {
-                ql_dbg(ql_dbg_taskm, vha, 0x8030,
+        if (rval != QLA_SUCCESS) {
+                ql_log(ql_log_warn, vha, 0x8030,
                     "TM IOCB failed (%x).\n", rval);
         }
 
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index 37ae0f6d8ae5..59fd5a9dfeb8 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -222,6 +222,8 @@ qla2xxx_get_qpair_sp(struct qla_qpair *qpair, fc_port_t *fcport, gfp_t flag)
         sp->fcport = fcport;
         sp->iocbs = 1;
         sp->vha = qpair->vha;
+        INIT_LIST_HEAD(&sp->elem);
+
 done:
         if (!sp)
                 QLA_QPAIR_MARK_NOT_BUSY(qpair);
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 9fa5a2557f2c..7756106d4555 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -631,6 +631,9 @@ qla2x00_async_event(scsi_qla_host_t *vha, struct rsp_que *rsp, uint16_t *mb)
         unsigned long   flags;
         fc_port_t       *fcport = NULL;
 
+        if (!vha->hw->flags.fw_started)
+                return;
+
         /* Setup to process RIO completion. */
         handle_cnt = 0;
         if (IS_CNA_CAPABLE(ha))
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 7e875f575229..f0ec13d48bf3 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -4220,6 +4220,9 @@ qla25xx_init_req_que(struct scsi_qla_host *vha, struct req_que *req)
         mbx_cmd_t *mcp = &mc;
         struct qla_hw_data *ha = vha->hw;
 
+        if (!ha->flags.fw_started)
+                return QLA_SUCCESS;
+
         ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10d3,
             "Entered %s.\n", __func__);
 
@@ -4289,6 +4292,9 @@ qla25xx_init_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp)
         mbx_cmd_t *mcp = &mc;
         struct qla_hw_data *ha = vha->hw;
 
+        if (!ha->flags.fw_started)
+                return QLA_SUCCESS;
+
         ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10d6,
             "Entered %s.\n", __func__);
 
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index f6f0a759a7c2..aa727d07b702 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -152,11 +152,18 @@ int
 qla24xx_disable_vp(scsi_qla_host_t *vha)
 {
         unsigned long flags;
-        int ret;
+        int ret = QLA_SUCCESS;
+        fc_port_t *fcport;
+
+        if (vha->hw->flags.fw_started)
+                ret = qla24xx_control_vp(vha, VCE_COMMAND_DISABLE_VPS_LOGO_ALL);
 
-        ret = qla24xx_control_vp(vha, VCE_COMMAND_DISABLE_VPS_LOGO_ALL);
         atomic_set(&vha->loop_state, LOOP_DOWN);
         atomic_set(&vha->loop_down_timer, LOOP_DOWN_TIME);
+        list_for_each_entry(fcport, &vha->vp_fcports, list)
+                fcport->logout_on_delete = 0;
+
+        qla2x00_mark_all_devices_lost(vha, 0);
 
         /* Remove port id from vp target map */
         spin_lock_irqsave(&vha->hw->hardware_lock, flags);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index e881fce7477a..1fbd16c8c9a7 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -303,6 +303,7 @@ static void qla2x00_free_device(scsi_qla_host_t *);
 static int qla2xxx_map_queues(struct Scsi_Host *shost);
 static void qla2x00_destroy_deferred_work(struct qla_hw_data *);
 
+
 struct scsi_host_template qla2xxx_driver_template = {
         .module                 = THIS_MODULE,
         .name                   = QLA2XXX_DRIVER_NAME,
@@ -1147,7 +1148,7 @@ static inline int test_fcport_count(scsi_qla_host_t *vha)
  * qla2x00_wait_for_sess_deletion can only be called from remove_one.
  * it has dependency on UNLOADING flag to stop device discovery
  */
-static void
+void
 qla2x00_wait_for_sess_deletion(scsi_qla_host_t *vha)
 {
         qla2x00_mark_all_devices_lost(vha, 0);
@@ -3180,6 +3181,8 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
             "req->req_q_in=%p req->req_q_out=%p rsp->rsp_q_in=%p rsp->rsp_q_out=%p.\n",
             req->req_q_in, req->req_q_out, rsp->rsp_q_in, rsp->rsp_q_out);
 
+        ha->wq = alloc_workqueue("qla2xxx_wq", 0, 0);
+
         if (ha->isp_ops->initialize_adapter(base_vha)) {
                 ql_log(ql_log_fatal, base_vha, 0x00d6,
                     "Failed to initialize adapter - Adapter flags %x.\n",
@@ -3216,8 +3219,6 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
             host->can_queue, base_vha->req,
             base_vha->mgmt_svr_loop_id, host->sg_tablesize);
 
-        ha->wq = alloc_workqueue("qla2xxx_wq", 0, 0);
-
         if (ha->mqenable) {
                 bool mq = false;
                 bool startit = false;
@@ -3603,6 +3604,8 @@ qla2x00_remove_one(struct pci_dev *pdev)
 
         base_vha = pci_get_drvdata(pdev);
         ha = base_vha->hw;
+        ql_log(ql_log_info, base_vha, 0xb079,
+            "Removing driver\n");
 
         /* Indicate device removal to prevent future board_disable and wait
          * until any pending board_disable has completed. */
@@ -3625,6 +3628,21 @@ qla2x00_remove_one(struct pci_dev *pdev)
         }
         qla2x00_wait_for_hba_ready(base_vha);
 
+        if (IS_QLA25XX(ha) || IS_QLA2031(ha) || IS_QLA27XX(ha)) {
+                if (ha->flags.fw_started)
+                        qla2x00_abort_isp_cleanup(base_vha);
+        } else if (!IS_QLAFX00(ha)) {
+                if (IS_QLA8031(ha)) {
+                        ql_dbg(ql_dbg_p3p, base_vha, 0xb07e,
+                            "Clearing fcoe driver presence.\n");
+                        if (qla83xx_clear_drv_presence(base_vha) != QLA_SUCCESS)
+                                ql_dbg(ql_dbg_p3p, base_vha, 0xb079,
+                                    "Error while clearing DRV-Presence.\n");
+                }
+
+                qla2x00_try_to_stop_firmware(base_vha);
+        }
+
         qla2x00_wait_for_sess_deletion(base_vha);
 
         /*
@@ -3648,14 +3666,6 @@ qla2x00_remove_one(struct pci_dev *pdev)
 
         qla2x00_delete_all_vps(ha, base_vha);
 
-        if (IS_QLA8031(ha)) {
-                ql_dbg(ql_dbg_p3p, base_vha, 0xb07e,
-                    "Clearing fcoe driver presence.\n");
-                if (qla83xx_clear_drv_presence(base_vha) != QLA_SUCCESS)
-                        ql_dbg(ql_dbg_p3p, base_vha, 0xb079,
-                            "Error while clearing DRV-Presence.\n");
-        }
-
         qla2x00_abort_all_cmds(base_vha, DID_NO_CONNECT << 16);
 
         qla2x00_dfs_remove(base_vha);
@@ -3715,24 +3725,6 @@ qla2x00_free_device(scsi_qla_host_t *vha)
                 qla2x00_stop_timer(vha);
 
         qla25xx_delete_queues(vha);
-
-        if (ha->flags.fce_enabled)
-                qla2x00_disable_fce_trace(vha, NULL, NULL);
-
-        if (ha->eft)
-                qla2x00_disable_eft_trace(vha);
-
-        if (IS_QLA25XX(ha) ||  IS_QLA2031(ha) || IS_QLA27XX(ha)) {
-                if (ha->flags.fw_started)
-                        qla2x00_abort_isp_cleanup(vha);
-        } else {
-                if (ha->flags.fw_started) {
-                        /* Stop currently executing firmware. */
-                        qla2x00_try_to_stop_firmware(vha);
-                        ha->flags.fw_started = 0;
-                }
-        }
-
         vha->flags.online = 0;
 
         /* turn-off interrupts on the card */
@@ -6028,8 +6020,9 @@ qla2x00_do_dpc(void *data)
                                 set_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags);
                 }
 
-                if (test_and_clear_bit(ISP_ABORT_NEEDED,
-                                                &base_vha->dpc_flags)) {
+                if (test_and_clear_bit
+                    (ISP_ABORT_NEEDED, &base_vha->dpc_flags) &&
+                    !test_bit(UNLOADING, &base_vha->dpc_flags)) {
 
                         ql_dbg(ql_dbg_dpc, base_vha, 0x4007,
                             "ISP abort scheduled.\n");
diff --git a/drivers/scsi/qla2xxx/qla_sup.c b/drivers/scsi/qla2xxx/qla_sup.c
index 04458eb19d38..4499c787165f 100644
--- a/drivers/scsi/qla2xxx/qla_sup.c
+++ b/drivers/scsi/qla2xxx/qla_sup.c
@@ -1880,6 +1880,9 @@ qla24xx_beacon_off(struct scsi_qla_host *vha)
         if (IS_P3P_TYPE(ha))
                 return QLA_SUCCESS;
 
+        if (!ha->flags.fw_started)
+                return QLA_SUCCESS;
+
         ha->beacon_blink_led = 0;
 
         if (IS_QLA2031(ha) || IS_QLA27XX(ha))
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 8932ae81a15a..2715cdaa669c 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -296,6 +296,20 @@ enum blk_eh_timer_return scsi_times_out(struct request *req)
                 rtn = host->hostt->eh_timed_out(scmd);
 
         if (rtn == BLK_EH_DONE) {
+                /*
+                 * For blk-mq, we must set the request state to complete now
+                 * before sending the request to the scsi error handler. This
+                 * will prevent a use-after-free in the event the LLD manages
+                 * to complete the request before the error handler finishes
+                 * processing this timed out request.
+                 *
+                 * If the request was already completed, then the LLD beat the
+                 * time out handler from transferring the request to the scsi
+                 * error handler. In that case we can return immediately as no
+                 * further action is required.
+                 */
+                if (req->q->mq_ops && !blk_mq_mark_complete(req))
+                        return rtn;
                 if (scsi_abort_command(scmd) != SUCCESS) {
                         set_host_byte(scmd, DID_TIME_OUT);
                         scsi_eh_scmd_add(scmd);
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index a14fef11776e..2bf3bf73886e 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -391,7 +391,8 @@ static int sd_zbc_check_capacity(struct scsi_disk *sdkp, unsigned char *buf)
  * Check that all zones of the device are equal. The last zone can however
  * be smaller. The zone size must also be a power of two number of LBAs.
  *
- * Returns the zone size in bytes upon success or an error code upon failure.
+ * Returns the zone size in number of blocks upon success or an error code
+ * upon failure.
  */
 static s64 sd_zbc_check_zone_size(struct scsi_disk *sdkp)
 {
@@ -401,7 +402,7 @@ static s64 sd_zbc_check_zone_size(struct scsi_disk *sdkp)
         unsigned char *rec;
         unsigned int buf_len;
         unsigned int list_length;
-        int ret;
+        s64 ret;
         u8 same;
 
         /* Get a buffer */
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index cd2fdac000c9..ba9ba0e04f42 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1741,15 +1741,11 @@ sg_start_req(Sg_request *srp, unsigned char *cmd)
          *
          * With scsi-mq enabled, there are a fixed number of preallocated
          * requests equal in number to shost->can_queue.  If all of the
-         * preallocated requests are already in use, then using GFP_ATOMIC with
-         * blk_get_request() will return -EWOULDBLOCK, whereas using GFP_KERNEL
-         * will cause blk_get_request() to sleep until an active command
-         * completes, freeing up a request.  Neither option is ideal, but
-         * GFP_KERNEL is the better choice to prevent userspace from getting an
-         * unexpected EWOULDBLOCK.
-         *
-         * With scsi-mq disabled, blk_get_request() with GFP_KERNEL usually
-         * does not sleep except under memory pressure.
+         * preallocated requests are already in use, then blk_get_request()
+         * will sleep until an active command completes, freeing up a request.
+         * Although waiting in an asynchronous interface is less than ideal, we
+         * do not want to use BLK_MQ_REQ_NOWAIT here because userspace might
+         * not expect an EWOULDBLOCK from this condition.
          */
         rq = blk_get_request(q, hp->dxfer_direction == SG_DXFER_TO_DEV ?
                         REQ_OP_SCSI_OUT : REQ_OP_SCSI_IN, 0);
@@ -2185,6 +2181,7 @@ sg_add_sfp(Sg_device * sdp)
         write_lock_irqsave(&sdp->sfd_lock, iflags);
         if (atomic_read(&sdp->detaching)) {
                 write_unlock_irqrestore(&sdp->sfd_lock, iflags);
+                kfree(sfp);
                 return ERR_PTR(-ENODEV);
         }
         list_add_tail(&sfp->sfd_siblings, &sdp->sfds);
diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c
index 32f0748fd067..0097a939487f 100644
--- a/drivers/soc/imx/gpc.c
+++ b/drivers/soc/imx/gpc.c
@@ -27,9 +27,16 @@
 #define GPC_PGC_SW2ISO_SHIFT    0x8
 #define GPC_PGC_SW_SHIFT        0x0
 
+#define GPC_PGC_PCI_PDN         0x200
+#define GPC_PGC_PCI_SR          0x20c
+
 #define GPC_PGC_GPU_PDN         0x260
 #define GPC_PGC_GPU_PUPSCR      0x264
 #define GPC_PGC_GPU_PDNSCR      0x268
+#define GPC_PGC_GPU_SR          0x26c
+
+#define GPC_PGC_DISP_PDN        0x240
+#define GPC_PGC_DISP_SR         0x24c
 
 #define GPU_VPU_PUP_REQ         BIT(1)
 #define GPU_VPU_PDN_REQ         BIT(0)
@@ -318,10 +325,24 @@ static const struct of_device_id imx_gpc_dt_ids[] = {
         { }
 };
 
+static const struct regmap_range yes_ranges[] = {
+        regmap_reg_range(GPC_CNTR, GPC_CNTR),
+        regmap_reg_range(GPC_PGC_PCI_PDN, GPC_PGC_PCI_SR),
+        regmap_reg_range(GPC_PGC_GPU_PDN, GPC_PGC_GPU_SR),
+        regmap_reg_range(GPC_PGC_DISP_PDN, GPC_PGC_DISP_SR),
+};
+
+static const struct regmap_access_table access_table = {
+        .yes_ranges     = yes_ranges,
+        .n_yes_ranges   = ARRAY_SIZE(yes_ranges),
+};
+
 static const struct regmap_config imx_gpc_regmap_config = {
         .reg_bits = 32,
         .val_bits = 32,
         .reg_stride = 4,
+        .rd_table = &access_table,
+        .wr_table = &access_table,
         .max_register = 0x2ac,
 };
 
diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index a1a0025b59e0..d5d33e12e952 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -402,6 +402,8 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
                         fput(asma->file);
                         goto out;
                 }
+        } else {
+                vma_set_anonymous(vma);
         }
 
         if (vma->vm_file)
diff --git a/drivers/staging/ks7010/ks_hostif.c b/drivers/staging/ks7010/ks_hostif.c
index 0ecffab52ec2..abdaf7cf8162 100644
--- a/drivers/staging/ks7010/ks_hostif.c
+++ b/drivers/staging/ks7010/ks_hostif.c
@@ -1842,15 +1842,15 @@ void hostif_sme_multicast_set(struct ks_wlan_private *priv)
         memset(set_address, 0, NIC_MAX_MCAST_LIST * ETH_ALEN);
 
         if (dev->flags & IFF_PROMISC) {
-                hostif_mib_set_request_bool(priv, LOCAL_MULTICAST_FILTER,
-                                            MCAST_FILTER_PROMISC);
+                hostif_mib_set_request_int(priv, LOCAL_MULTICAST_FILTER,
+                                           MCAST_FILTER_PROMISC);
                 goto spin_unlock;
         }
 
         if ((netdev_mc_count(dev) > NIC_MAX_MCAST_LIST) ||
             (dev->flags & IFF_ALLMULTI)) {
-                hostif_mib_set_request_bool(priv, LOCAL_MULTICAST_FILTER,
-                                            MCAST_FILTER_MCASTALL);
+                hostif_mib_set_request_int(priv, LOCAL_MULTICAST_FILTER,
+                                           MCAST_FILTER_MCASTALL);
                 goto spin_unlock;
         }
 
@@ -1866,8 +1866,8 @@ void hostif_sme_multicast_set(struct ks_wlan_private *priv)
                                                ETH_ALEN * mc_count);
         } else {
                 priv->sme_i.sme_flag |= SME_MULTICAST;
-                hostif_mib_set_request_bool(priv, LOCAL_MULTICAST_FILTER,
-                                            MCAST_FILTER_MCAST);
+                hostif_mib_set_request_int(priv, LOCAL_MULTICAST_FILTER,
+                                           MCAST_FILTER_MCAST);
         }
 
 spin_unlock:
diff --git a/drivers/staging/media/omap4iss/iss_video.c b/drivers/staging/media/omap4iss/iss_video.c
index a3a83424a926..16478fe9e3f8 100644
--- a/drivers/staging/media/omap4iss/iss_video.c
+++ b/drivers/staging/media/omap4iss/iss_video.c
@@ -11,7 +11,6 @@
  * (at your option) any later version.
  */
 
-#include <asm/cacheflush.h>
 #include <linux/clk.h>
 #include <linux/mm.h>
 #include <linux/pagemap.h>
@@ -24,6 +23,8 @@
 #include <media/v4l2-ioctl.h>
 #include <media/v4l2-mc.h>
 
+#include <asm/cacheflush.h>
+
 #include "iss_video.h"
 #include "iss.h"
 
diff --git a/drivers/staging/rtl8188eu/Kconfig b/drivers/staging/rtl8188eu/Kconfig
index 673fdce25530..ff7832798a77 100644
--- a/drivers/staging/rtl8188eu/Kconfig
+++ b/drivers/staging/rtl8188eu/Kconfig
@@ -7,7 +7,6 @@ config R8188EU
         select LIB80211
         select LIB80211_CRYPT_WEP
         select LIB80211_CRYPT_CCMP
-        select LIB80211_CRYPT_TKIP
         ---help---
         This option adds the Realtek RTL8188EU USB device such as TP-Link TL-WN725N.
         If built as a module, it will be called r8188eu.
diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c
index 05936a45eb93..c6857a5be12a 100644
--- a/drivers/staging/rtl8188eu/core/rtw_recv.c
+++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
@@ -23,7 +23,6 @@
 #include <mon.h>
 #include <wifi.h>
 #include <linux/vmalloc.h>
-#include <net/lib80211.h>
 
 #define ETHERNET_HEADER_SIZE    14      /*  Ethernet Header Length */
 #define LLC_HEADER_SIZE                 6       /*  LLC Header Length */
@@ -221,20 +220,31 @@ u32 rtw_free_uc_swdec_pending_queue(struct adapter *adapter)
 static int recvframe_chkmic(struct adapter *adapter,
                             struct recv_frame *precvframe)
 {
-        int res = _SUCCESS;
-        struct rx_pkt_attrib *prxattrib = &precvframe->attrib;
-        struct sta_info *stainfo = rtw_get_stainfo(&adapter->stapriv, prxattrib->ta);
+        int     i, res = _SUCCESS;
+        u32     datalen;
+        u8      miccode[8];
+        u8      bmic_err = false, brpt_micerror = true;
+        u8      *pframe, *payload, *pframemic;
+        u8      *mickey;
+        struct  sta_info                *stainfo;
+        struct  rx_pkt_attrib   *prxattrib = &precvframe->attrib;
+        struct  security_priv   *psecuritypriv = &adapter->securitypriv;
+
+        struct mlme_ext_priv    *pmlmeext = &adapter->mlmeextpriv;
+        struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
+
+        stainfo = rtw_get_stainfo(&adapter->stapriv, &prxattrib->ta[0]);
 
         if (prxattrib->encrypt == _TKIP_) {
+                RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
+                         ("\n %s: prxattrib->encrypt==_TKIP_\n", __func__));
+                RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
+                         ("\n %s: da=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+                          __func__, prxattrib->ra[0], prxattrib->ra[1], prxattrib->ra[2],
+                          prxattrib->ra[3], prxattrib->ra[4], prxattrib->ra[5]));
+
+                /* calculate mic code */
                 if (stainfo) {
-                        int key_idx;
-                        const int iv_len = 8, icv_len = 4, key_length = 32;
-                        struct sk_buff *skb = precvframe->pkt;
-                        u8 key[32], iv[8], icv[4], *pframe = skb->data;
-                        void *crypto_private = NULL;
-                        struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("TKIP"), "lib80211_crypt_tkip");
-                        struct security_priv *psecuritypriv = &adapter->securitypriv;
-
                         if (IS_MCAST(prxattrib->ra)) {
                                 if (!psecuritypriv) {
                                         res = _FAIL;
@@ -243,58 +253,115 @@ static int recvframe_chkmic(struct adapter *adapter,
                                         DBG_88E("\n %s: didn't install group key!!!!!!!!!!\n", __func__);
                                         goto exit;
                                 }
-                                key_idx = prxattrib->key_index;
-                                memcpy(key, psecuritypriv->dot118021XGrpKey[key_idx].skey, 16);
-                                memcpy(key + 16, psecuritypriv->dot118021XGrprxmickey[key_idx].skey, 16);
+                                mickey = &psecuritypriv->dot118021XGrprxmickey[prxattrib->key_index].skey[0];
+
+                                RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
+                                         ("\n %s: bcmc key\n", __func__));
                         } else {
-                                key_idx = 0;
-                                memcpy(key, stainfo->dot118021x_UncstKey.skey, 16);
-                                memcpy(key + 16, stainfo->dot11tkiprxmickey.skey, 16);
+                                mickey = &stainfo->dot11tkiprxmickey.skey[0];
+                                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                         ("\n %s: unicast key\n", __func__));
                         }
 
-                        if (!crypto_ops) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
+                        /* icv_len included the mic code */
+                        datalen = precvframe->pkt->len-prxattrib->hdrlen -
+                                  prxattrib->iv_len-prxattrib->icv_len-8;
+                        pframe = precvframe->pkt->data;
+                        payload = pframe+prxattrib->hdrlen+prxattrib->iv_len;
 
-                        memcpy(iv, pframe + prxattrib->hdrlen, iv_len);
-                        memcpy(icv, pframe + skb->len - icv_len, icv_len);
-                        memmove(pframe + iv_len, pframe, prxattrib->hdrlen);
+                        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n prxattrib->iv_len=%d prxattrib->icv_len=%d\n", prxattrib->iv_len, prxattrib->icv_len));
+                        rtw_seccalctkipmic(mickey, pframe, payload, datalen, &miccode[0],
+                                           (unsigned char)prxattrib->priority); /* care the length of the data */
 
-                        skb_pull(skb, iv_len);
-                        skb_trim(skb, skb->len - icv_len);
+                        pframemic = payload+datalen;
 
-                        crypto_private = crypto_ops->init(key_idx);
-                        if (!crypto_private) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
-                        if (crypto_ops->set_key(key, key_length, NULL, crypto_private) < 0) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
-                        if (crypto_ops->decrypt_msdu(skb, key_idx, prxattrib->hdrlen, crypto_private)) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
+                        bmic_err = false;
+
+                        for (i = 0; i < 8; i++) {
+                                if (miccode[i] != *(pframemic+i)) {
+                                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                                 ("%s: miccode[%d](%02x)!=*(pframemic+%d)(%02x) ",
+                                                  __func__, i, miccode[i], i, *(pframemic + i)));
+                                        bmic_err = true;
+                                }
                         }
 
-                        memmove(pframe, pframe + iv_len, prxattrib->hdrlen);
-                        skb_push(skb, iv_len);
-                        skb_put(skb, icv_len);
+                        if (bmic_err) {
+                                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                         ("\n *(pframemic-8)-*(pframemic-1)=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+                                         *(pframemic-8), *(pframemic-7), *(pframemic-6),
+                                         *(pframemic-5), *(pframemic-4), *(pframemic-3),
+                                         *(pframemic-2), *(pframemic-1)));
+                                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                         ("\n *(pframemic-16)-*(pframemic-9)=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+                                         *(pframemic-16), *(pframemic-15), *(pframemic-14),
+                                         *(pframemic-13), *(pframemic-12), *(pframemic-11),
+                                         *(pframemic-10), *(pframemic-9)));
+                                {
+                                        uint i;
 
-                        memcpy(pframe + prxattrib->hdrlen, iv, iv_len);
-                        memcpy(pframe + skb->len - icv_len, icv, icv_len);
+                                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                                 ("\n ======demp packet (len=%d)======\n",
+                                                 precvframe->pkt->len));
+                                        for (i = 0; i < precvframe->pkt->len; i += 8) {
+                                                RT_TRACE(_module_rtl871x_recv_c_,
+                                                         _drv_err_,
+                                                         ("0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x",
+                                                         *(precvframe->pkt->data+i),
+                                                         *(precvframe->pkt->data+i+1),
+                                                         *(precvframe->pkt->data+i+2),
+                                                         *(precvframe->pkt->data+i+3),
+                                                         *(precvframe->pkt->data+i+4),
+                                                         *(precvframe->pkt->data+i+5),
+                                                         *(precvframe->pkt->data+i+6),
+                                                         *(precvframe->pkt->data+i+7)));
+                                        }
+                                        RT_TRACE(_module_rtl871x_recv_c_,
+                                                 _drv_err_,
+                                                 ("\n ====== demp packet end [len=%d]======\n",
+                                                 precvframe->pkt->len));
+                                        RT_TRACE(_module_rtl871x_recv_c_,
+                                                 _drv_err_,
+                                                 ("\n hrdlen=%d,\n",
+                                                 prxattrib->hdrlen));
+                                }
 
-exit_lib80211_tkip:
-                        if (crypto_ops && crypto_private)
-                                crypto_ops->deinit(crypto_private);
+                                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                         ("ra=0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x psecuritypriv->binstallGrpkey=%d ",
+                                         prxattrib->ra[0], prxattrib->ra[1], prxattrib->ra[2],
+                                         prxattrib->ra[3], prxattrib->ra[4], prxattrib->ra[5], psecuritypriv->binstallGrpkey));
+
+                                /*  double check key_index for some timing issue , */
+                                /*  cannot compare with psecuritypriv->dot118021XGrpKeyid also cause timing issue */
+                                if ((IS_MCAST(prxattrib->ra) == true)  && (prxattrib->key_index != pmlmeinfo->key_index))
+                                        brpt_micerror = false;
+
+                                if ((prxattrib->bdecrypted) && (brpt_micerror)) {
+                                        rtw_handle_tkip_mic_err(adapter, (u8)IS_MCAST(prxattrib->ra));
+                                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" mic error :prxattrib->bdecrypted=%d ", prxattrib->bdecrypted));
+                                        DBG_88E(" mic error :prxattrib->bdecrypted=%d\n", prxattrib->bdecrypted);
+                                } else {
+                                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" mic error :prxattrib->bdecrypted=%d ", prxattrib->bdecrypted));
+                                        DBG_88E(" mic error :prxattrib->bdecrypted=%d\n", prxattrib->bdecrypted);
+                                }
+                                res = _FAIL;
+                        } else {
+                                /* mic checked ok */
+                                if ((!psecuritypriv->bcheck_grpkey) && (IS_MCAST(prxattrib->ra))) {
+                                        psecuritypriv->bcheck_grpkey = true;
+                                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("psecuritypriv->bcheck_grpkey = true"));
+                                }
+                        }
                 } else {
                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
                                  ("%s: rtw_get_stainfo==NULL!!!\n", __func__));
                 }
+
+                skb_trim(precvframe->pkt, precvframe->pkt->len - 8);
         }
 
 exit:
+
         return res;
 }
 
diff --git a/drivers/staging/rtl8188eu/core/rtw_security.c b/drivers/staging/rtl8188eu/core/rtw_security.c
index bfe0b217e679..67a2490f055e 100644
--- a/drivers/staging/rtl8188eu/core/rtw_security.c
+++ b/drivers/staging/rtl8188eu/core/rtw_security.c
@@ -650,71 +650,71 @@ u32	rtw_tkip_encrypt(struct adapter *padapter, u8 *pxmitframe)
         return res;
 }
 
+/* The hlen isn't include the IV */
 u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe)
-{
-        struct rx_pkt_attrib *prxattrib = &((struct recv_frame *)precvframe)->attrib;
-        u32 res = _SUCCESS;
+{                                                                                                                                       /*  exclude ICV */
+        u16 pnl;
+        u32 pnh;
+        u8   rc4key[16];
+        u8   ttkey[16];
+        u8      crc[4];
+        struct arc4context mycontext;
+        int                     length;
+
+        u8      *pframe, *payload, *iv, *prwskey;
+        union pn48 dot11txpn;
+        struct  sta_info                *stainfo;
+        struct  rx_pkt_attrib    *prxattrib = &((struct recv_frame *)precvframe)->attrib;
+        struct  security_priv   *psecuritypriv = &padapter->securitypriv;
+        u32             res = _SUCCESS;
+
+
+        pframe = (unsigned char *)((struct recv_frame *)precvframe)->pkt->data;
 
         /* 4 start to decrypt recvframe */
         if (prxattrib->encrypt == _TKIP_) {
-                struct sta_info *stainfo = rtw_get_stainfo(&padapter->stapriv, prxattrib->ta);
-
+                stainfo = rtw_get_stainfo(&padapter->stapriv, &prxattrib->ta[0]);
                 if (stainfo) {
-                        int key_idx;
-                        const int iv_len = 8, icv_len = 4, key_length = 32;
-                        void *crypto_private = NULL;
-                        struct sk_buff *skb = ((struct recv_frame *)precvframe)->pkt;
-                        u8 key[32], iv[8], icv[4], *pframe = skb->data;
-                        struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("TKIP"), "lib80211_crypt_tkip");
-                        struct security_priv *psecuritypriv = &padapter->securitypriv;
-
                         if (IS_MCAST(prxattrib->ra)) {
                                 if (!psecuritypriv->binstallGrpkey) {
                                         res = _FAIL;
                                         DBG_88E("%s:rx bc/mc packets, but didn't install group key!!!!!!!!!!\n", __func__);
                                         goto exit;
                                 }
-                                key_idx = prxattrib->key_index;
-                                memcpy(key, psecuritypriv->dot118021XGrpKey[key_idx].skey, 16);
-                                memcpy(key + 16, psecuritypriv->dot118021XGrprxmickey[key_idx].skey, 16);
+                                prwskey = psecuritypriv->dot118021XGrpKey[prxattrib->key_index].skey;
                         } else {
-                                key_idx = 0;
-                                memcpy(key, stainfo->dot118021x_UncstKey.skey, 16);
-                                memcpy(key + 16, stainfo->dot11tkiprxmickey.skey, 16);
+                                RT_TRACE(_module_rtl871x_security_c_, _drv_err_, ("%s: stainfo!= NULL!!!\n", __func__));
+                                prwskey = &stainfo->dot118021x_UncstKey.skey[0];
                         }
 
-                        if (!crypto_ops) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
+                        iv = pframe+prxattrib->hdrlen;
+                        payload = pframe+prxattrib->iv_len+prxattrib->hdrlen;
+                        length = ((struct recv_frame *)precvframe)->pkt->len-prxattrib->hdrlen-prxattrib->iv_len;
 
-                        memcpy(iv, pframe + prxattrib->hdrlen, iv_len);
-                        memcpy(icv, pframe + skb->len - icv_len, icv_len);
+                        GET_TKIP_PN(iv, dot11txpn);
 
-                        crypto_private = crypto_ops->init(key_idx);
-                        if (!crypto_private) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
-                        if (crypto_ops->set_key(key, key_length, NULL, crypto_private) < 0) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
-                        if (crypto_ops->decrypt_mpdu(skb, prxattrib->hdrlen, crypto_private)) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
+                        pnl = (u16)(dot11txpn.val);
+                        pnh = (u32)(dot11txpn.val>>16);
 
-                        memmove(pframe, pframe + iv_len, prxattrib->hdrlen);
-                        skb_push(skb, iv_len);
-                        skb_put(skb, icv_len);
+                        phase1((u16 *)&ttkey[0], prwskey, &prxattrib->ta[0], pnh);
+                        phase2(&rc4key[0], prwskey, (unsigned short *)&ttkey[0], pnl);
 
-                        memcpy(pframe + prxattrib->hdrlen, iv, iv_len);
-                        memcpy(pframe + skb->len - icv_len, icv, icv_len);
+                        /* 4 decrypt payload include icv */
 
-exit_lib80211_tkip:
-                        if (crypto_ops && crypto_private)
-                                crypto_ops->deinit(crypto_private);
+                        arcfour_init(&mycontext, rc4key, 16);
+                        arcfour_encrypt(&mycontext, payload, payload, length);
+
+                        *((__le32 *)crc) = getcrc32(payload, length-4);
+
+                        if (crc[3] != payload[length-1] ||
+                            crc[2] != payload[length-2] ||
+                            crc[1] != payload[length-3] ||
+                            crc[0] != payload[length-4]) {
+                                RT_TRACE(_module_rtl871x_security_c_, _drv_err_,
+                                         ("rtw_wep_decrypt:icv error crc (%4ph)!=payload (%4ph)\n",
+                                         &crc, &payload[length-4]));
+                                res = _FAIL;
+                        }
                 } else {
                         RT_TRACE(_module_rtl871x_security_c_, _drv_err_, ("rtw_tkip_decrypt: stainfo==NULL!!!\n"));
                         res = _FAIL;
diff --git a/drivers/staging/speakup/speakup_soft.c b/drivers/staging/speakup/speakup_soft.c
index a61bc41b82d7..947c79532e10 100644
--- a/drivers/staging/speakup/speakup_soft.c
+++ b/drivers/staging/speakup/speakup_soft.c
@@ -198,11 +198,15 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count,
         int chars_sent = 0;
         char __user *cp;
         char *init;
+        size_t bytes_per_ch = unicode ? 3 : 1;
         u16 ch;
         int empty;
         unsigned long flags;
         DEFINE_WAIT(wait);
 
+        if (count < bytes_per_ch)
+                return -EINVAL;
+
         spin_lock_irqsave(&speakup_info.spinlock, flags);
         while (1) {
                 prepare_to_wait(&speakup_event, &wait, TASK_INTERRUPTIBLE);
@@ -228,7 +232,7 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count,
         init = get_initstring();
 
         /* Keep 3 bytes available for a 16bit UTF-8-encoded character */
-        while (chars_sent <= count - 3) {
+        while (chars_sent <= count - bytes_per_ch) {
                 if (speakup_info.flushing) {
                         speakup_info.flushing = 0;
                         ch = '\x18';
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_target.c b/drivers/target/iscsi/cxgbit/cxgbit_target.c
index 514986b57c2d..25eb3891e34b 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_target.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_target.c
@@ -652,6 +652,7 @@ static int cxgbit_set_iso_npdu(struct cxgbit_sock *csk)
         struct iscsi_param *param;
         u32 mrdsl, mbl;
         u32 max_npdu, max_iso_npdu;
+        u32 max_iso_payload;
 
         if (conn->login->leading_connection) {
                 param = iscsi_find_param_from_key(MAXBURSTLENGTH,
@@ -670,8 +671,10 @@ static int cxgbit_set_iso_npdu(struct cxgbit_sock *csk)
         mrdsl = conn_ops->MaxRecvDataSegmentLength;
         max_npdu = mbl / mrdsl;
 
-        max_iso_npdu = CXGBIT_MAX_ISO_PAYLOAD /
-                        (ISCSI_HDR_LEN + mrdsl +
+        max_iso_payload = rounddown(CXGBIT_MAX_ISO_PAYLOAD, csk->emss);
+
+        max_iso_npdu = max_iso_payload /
+                       (ISCSI_HDR_LEN + mrdsl +
                         cxgbit_digest_len[csk->submode]);
 
         csk->max_iso_npdu = min(max_npdu, max_iso_npdu);
@@ -741,6 +744,9 @@ static int cxgbit_set_params(struct iscsi_conn *conn)
         if (conn_ops->MaxRecvDataSegmentLength > cdev->mdsl)
                 conn_ops->MaxRecvDataSegmentLength = cdev->mdsl;
 
+        if (cxgbit_set_digest(csk))
+                return -1;
+
         if (conn->login->leading_connection) {
                 param = iscsi_find_param_from_key(ERRORRECOVERYLEVEL,
                                                   conn->param_list);
@@ -764,7 +770,7 @@ static int cxgbit_set_params(struct iscsi_conn *conn)
                         if (is_t5(cdev->lldi.adapter_type))
                                 goto enable_ddp;
                         else
-                                goto enable_digest;
+                                return 0;
                 }
 
                 if (test_bit(CDEV_ISO_ENABLE, &cdev->flags)) {
@@ -781,10 +787,6 @@ enable_ddp:
                 }
         }
 
-enable_digest:
-        if (cxgbit_set_digest(csk))
-                return -1;
-
         return 0;
 }
 
diff --git a/drivers/usb/chipidea/Kconfig b/drivers/usb/chipidea/Kconfig
index 785f0ed037f7..ee34e9046f7e 100644
--- a/drivers/usb/chipidea/Kconfig
+++ b/drivers/usb/chipidea/Kconfig
@@ -3,6 +3,7 @@ config USB_CHIPIDEA
         depends on ((USB_EHCI_HCD && USB_GADGET) || (USB_EHCI_HCD && !USB_GADGET) || (!USB_EHCI_HCD && USB_GADGET)) && HAS_DMA
         select EXTCON
         select RESET_CONTROLLER
+        select USB_ULPI_BUS
         help
           Say Y here if your system has a dual role high speed USB
           controller based on ChipIdea silicon IP. It supports:
@@ -38,12 +39,4 @@ config USB_CHIPIDEA_HOST
         help
           Say Y here to enable host controller functionality of the
           ChipIdea driver.
-
-config USB_CHIPIDEA_ULPI
-        bool "ChipIdea ULPI PHY support"
-        depends on USB_ULPI_BUS=y || USB_ULPI_BUS=USB_CHIPIDEA
-        help
-          Say Y here if you have a ULPI PHY attached to your ChipIdea
-          controller.
-
 endif
diff --git a/drivers/usb/chipidea/Makefile b/drivers/usb/chipidea/Makefile
index e3d5e728fa53..12df94f78f72 100644
--- a/drivers/usb/chipidea/Makefile
+++ b/drivers/usb/chipidea/Makefile
@@ -1,11 +1,10 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-$(CONFIG_USB_CHIPIDEA)              += ci_hdrc.o
 
-ci_hdrc-y                               := core.o otg.o debug.o
+ci_hdrc-y                               := core.o otg.o debug.o ulpi.o
 ci_hdrc-$(CONFIG_USB_CHIPIDEA_UDC)      += udc.o
 ci_hdrc-$(CONFIG_USB_CHIPIDEA_HOST)     += host.o
 ci_hdrc-$(CONFIG_USB_OTG_FSM)           += otg_fsm.o
-ci_hdrc-$(CONFIG_USB_CHIPIDEA_ULPI)     += ulpi.o
 
 # Glue/Bridge layers go here
 
diff --git a/drivers/usb/chipidea/ci.h b/drivers/usb/chipidea/ci.h
index 0bf244d50544..6a2cc5cd0281 100644
--- a/drivers/usb/chipidea/ci.h
+++ b/drivers/usb/chipidea/ci.h
@@ -240,10 +240,8 @@ struct ci_hdrc {
 
         struct ci_hdrc_platform_data    *platdata;
         int                             vbus_active;
-#ifdef CONFIG_USB_CHIPIDEA_ULPI
         struct ulpi                     *ulpi;
         struct ulpi_ops                 ulpi_ops;
-#endif
         struct phy                      *phy;
         /* old usb_phy interface */
         struct usb_phy                  *usb_phy;
@@ -426,15 +424,9 @@ static inline bool ci_otg_is_fsm_mode(struct ci_hdrc *ci)
 #endif
 }
 
-#if IS_ENABLED(CONFIG_USB_CHIPIDEA_ULPI)
 int ci_ulpi_init(struct ci_hdrc *ci);
 void ci_ulpi_exit(struct ci_hdrc *ci);
 int ci_ulpi_resume(struct ci_hdrc *ci);
-#else
-static inline int ci_ulpi_init(struct ci_hdrc *ci) { return 0; }
-static inline void ci_ulpi_exit(struct ci_hdrc *ci) { }
-static inline int ci_ulpi_resume(struct ci_hdrc *ci) { return 0; }
-#endif
 
 u32 hw_read_intr_enable(struct ci_hdrc *ci);
 
diff --git a/drivers/usb/chipidea/ulpi.c b/drivers/usb/chipidea/ulpi.c
index 6da42dcd2888..dfec07e8ae1d 100644
--- a/drivers/usb/chipidea/ulpi.c
+++ b/drivers/usb/chipidea/ulpi.c
@@ -95,6 +95,9 @@ int ci_ulpi_resume(struct ci_hdrc *ci)
 {
         int cnt = 100000;
 
+        if (ci->platdata->phy_mode != USBPHY_INTERFACE_MODE_ULPI)
+                return 0;
+
         while (cnt-- > 0) {
                 if (hw_read(ci, OP_ULPI_VIEWPORT, ULPI_SYNC_STATE))
                         return 0;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 998b32d0167e..75c4623ad779 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1831,6 +1831,9 @@ static const struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */
         .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */
         },
+        { USB_DEVICE(0x0ca6, 0xa050), /* Castles VEGA3000 */
+        .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+        },
 
         { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */
         .driver_info = CLEAR_HALT_CONDITIONS,
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index fcae521df29b..1fb266809966 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1142,10 +1142,14 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 
                 if (!udev || udev->state == USB_STATE_NOTATTACHED) {
                         /* Tell hub_wq to disconnect the device or
-                         * check for a new connection
+                         * check for a new connection or over current condition.
+                         * Based on USB2.0 Spec Section 11.12.5,
+                         * C_PORT_OVER_CURRENT could be set while
+                         * PORT_OVER_CURRENT is not. So check for any of them.
                          */
                         if (udev || (portstatus & USB_PORT_STAT_CONNECTION) ||
-                            (portstatus & USB_PORT_STAT_OVERCURRENT))
+                            (portstatus & USB_PORT_STAT_OVERCURRENT) ||
+                            (portchange & USB_PORT_STAT_C_OVERCURRENT))
                                 set_bit(port1, hub->change_bits);
 
                 } else if (portstatus & USB_PORT_STAT_ENABLE) {
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index a0f82cca2d9a..cefc99ae69b2 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3430,7 +3430,7 @@ static void dwc2_gadget_handle_incomplete_isoc_in(struct dwc2_hsotg *hsotg)
         for (idx = 1; idx < hsotg->num_of_eps; idx++) {
                 hs_ep = hsotg->eps_in[idx];
                 /* Proceed only unmasked ISOC EPs */
-                if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
+                if ((BIT(idx) & ~daintmsk) || !hs_ep->isochronous)
                         continue;
 
                 epctrl = dwc2_readl(hsotg->regs + DIEPCTL(idx));
@@ -3476,7 +3476,7 @@ static void dwc2_gadget_handle_incomplete_isoc_out(struct dwc2_hsotg *hsotg)
         for (idx = 1; idx < hsotg->num_of_eps; idx++) {
                 hs_ep = hsotg->eps_out[idx];
                 /* Proceed only unmasked ISOC EPs */
-                if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
+                if ((BIT(idx) & ~daintmsk) || !hs_ep->isochronous)
                         continue;
 
                 epctrl = dwc2_readl(hsotg->regs + DOEPCTL(idx));
@@ -3650,7 +3650,7 @@ irq_retry:
                 for (idx = 1; idx < hsotg->num_of_eps; idx++) {
                         hs_ep = hsotg->eps_out[idx];
                         /* Proceed only unmasked ISOC EPs */
-                        if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
+                        if ((BIT(idx) & ~daintmsk) || !hs_ep->isochronous)
                                 continue;
 
                         epctrl = dwc2_readl(hsotg->regs + DOEPCTL(idx));
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index b1104be3429c..6e2cdd7b93d4 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -2665,34 +2665,35 @@ static int dwc2_alloc_split_dma_aligned_buf(struct dwc2_hsotg *hsotg,
 
 #define DWC2_USB_DMA_ALIGN 4
 
-struct dma_aligned_buffer {
-        void *kmalloc_ptr;
-        void *old_xfer_buffer;
-        u8 data[0];
-};
-
 static void dwc2_free_dma_aligned_buffer(struct urb *urb)
 {
-        struct dma_aligned_buffer *temp;
+        void *stored_xfer_buffer;
+        size_t length;
 
         if (!(urb->transfer_flags & URB_ALIGNED_TEMP_BUFFER))
                 return;
 
-        temp = container_of(urb->transfer_buffer,
-                            struct dma_aligned_buffer, data);
+        /* Restore urb->transfer_buffer from the end of the allocated area */
+        memcpy(&stored_xfer_buffer, urb->transfer_buffer +
+               urb->transfer_buffer_length, sizeof(urb->transfer_buffer));
 
-        if (usb_urb_dir_in(urb))
-                memcpy(temp->old_xfer_buffer, temp->data,
-                       urb->transfer_buffer_length);
-        urb->transfer_buffer = temp->old_xfer_buffer;
-        kfree(temp->kmalloc_ptr);
+        if (usb_urb_dir_in(urb)) {
+                if (usb_pipeisoc(urb->pipe))
+                        length = urb->transfer_buffer_length;
+                else
+                        length = urb->actual_length;
+
+                memcpy(stored_xfer_buffer, urb->transfer_buffer, length);
+        }
+        kfree(urb->transfer_buffer);
+        urb->transfer_buffer = stored_xfer_buffer;
 
         urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER;
 }
 
 static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
 {
-        struct dma_aligned_buffer *temp, *kmalloc_ptr;
+        void *kmalloc_ptr;
         size_t kmalloc_size;
 
         if (urb->num_sgs || urb->sg ||
@@ -2700,22 +2701,29 @@ static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
             !((uintptr_t)urb->transfer_buffer & (DWC2_USB_DMA_ALIGN - 1)))
                 return 0;
 
-        /* Allocate a buffer with enough padding for alignment */
+        /*
+         * Allocate a buffer with enough padding for original transfer_buffer
+         * pointer. This allocation is guaranteed to be aligned properly for
+         * DMA
+         */
         kmalloc_size = urb->transfer_buffer_length +
-                sizeof(struct dma_aligned_buffer) + DWC2_USB_DMA_ALIGN - 1;
+                sizeof(urb->transfer_buffer);
 
         kmalloc_ptr = kmalloc(kmalloc_size, mem_flags);
         if (!kmalloc_ptr)
                 return -ENOMEM;
 
-        /* Position our struct dma_aligned_buffer such that data is aligned */
-        temp = PTR_ALIGN(kmalloc_ptr + 1, DWC2_USB_DMA_ALIGN) - 1;
-        temp->kmalloc_ptr = kmalloc_ptr;
-        temp->old_xfer_buffer = urb->transfer_buffer;
+        /*
+         * Position value of original urb->transfer_buffer pointer to the end
+         * of allocation for later referencing
+         */
+        memcpy(kmalloc_ptr + urb->transfer_buffer_length,
+               &urb->transfer_buffer, sizeof(urb->transfer_buffer));
+
         if (usb_urb_dir_out(urb))
-                memcpy(temp->data, urb->transfer_buffer,
+                memcpy(kmalloc_ptr, urb->transfer_buffer,
                        urb->transfer_buffer_length);
-        urb->transfer_buffer = temp->data;
+        urb->transfer_buffer = kmalloc_ptr;
 
         urb->transfer_flags |= URB_ALIGNED_TEMP_BUFFER;
 
diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
index ed7f05cf4906..8ce10caf3e19 100644
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -1231,7 +1231,10 @@ static void dwc2_hc_nak_intr(struct dwc2_hsotg *hsotg,
          * avoid interrupt storms we'll wait before retrying if we've got
          * several NAKs. If we didn't do this we'd retry directly from the
          * interrupt handler and could end up quickly getting another
-         * interrupt (another NAK), which we'd retry.
+         * interrupt (another NAK), which we'd retry. Note that we do not
+         * delay retries for IN parts of control requests, as those are expected
+         * to complete fairly quickly, and if we delay them we risk confusing
+         * the device and cause it issue STALL.
          *
          * Note that in DMA mode software only gets involved to re-send NAKed
          * transfers for split transactions, so we only need to apply this
@@ -1244,7 +1247,9 @@ static void dwc2_hc_nak_intr(struct dwc2_hsotg *hsotg,
                         qtd->error_count = 0;
                 qtd->complete_split = 0;
                 qtd->num_naks++;
-                qtd->qh->want_wait = qtd->num_naks >= DWC2_NAKS_BEFORE_DELAY;
+                qtd->qh->want_wait = qtd->num_naks >= DWC2_NAKS_BEFORE_DELAY &&
+                                !(chan->ep_type == USB_ENDPOINT_XFER_CONTROL &&
+                                  chan->ep_is_in);
                 dwc2_halt_channel(hsotg, chan, qtd, DWC2_HC_XFER_NAK);
                 goto handle_nak_done;
         }
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index c77ff50a88a2..8efde178eef4 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -973,15 +973,12 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                 ret = dwc3_ep0_start_trans(dep);
         } else if (IS_ALIGNED(req->request.length, dep->endpoint.maxpacket) &&
                    req->request.length && req->request.zero) {
-                u32     maxpacket;
 
                 ret = usb_gadget_map_request_by_dev(dwc->sysdev,
                                 &req->request, dep->number);
                 if (ret)
                         return;
 
-                maxpacket = dep->endpoint.maxpacket;
-
                 /* prepare normal TRB */
                 dwc3_ep0_prepare_one_trb(dep, req->request.dma,
                                          req->request.length,
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index d2fa071c21b1..b8a15840b4ff 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1819,7 +1819,6 @@ unknown:
                 if (cdev->use_os_string && cdev->os_desc_config &&
                     (ctrl->bRequestType & USB_TYPE_VENDOR) &&
                     ctrl->bRequest == cdev->b_vendor_code) {
-                        struct usb_request              *req;
                         struct usb_configuration        *os_desc_cfg;
                         u8                              *buf;
                         int                             interface;
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 33e2030503fa..3ada83d81bda 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -3263,7 +3263,7 @@ static int ffs_func_setup(struct usb_function *f,
         __ffs_event_add(ffs, FUNCTIONFS_SETUP);
         spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
 
-        return USB_GADGET_DELAYED_STATUS;
+        return creq->wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0;
 }
 
 static bool ffs_func_req_match(struct usb_function *f,
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index d2dc1f00180b..d582921f7257 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -438,14 +438,14 @@ static struct usb_descriptor_header *hs_audio_desc[] = {
 };
 
 struct cntrl_cur_lay3 {
-        __u32   dCUR;
+        __le32  dCUR;
 };
 
 struct cntrl_range_lay3 {
-        __u16   wNumSubRanges;
-        __u32   dMIN;
-        __u32   dMAX;
-        __u32   dRES;
+        __le16  wNumSubRanges;
+        __le32  dMIN;
+        __le32  dMAX;
+        __le32  dRES;
 } __packed;
 
 static void set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts,
@@ -559,13 +559,13 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
         agdev->out_ep = usb_ep_autoconfig(gadget, &fs_epout_desc);
         if (!agdev->out_ep) {
                 dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
-                return ret;
+                return -ENODEV;
         }
 
         agdev->in_ep = usb_ep_autoconfig(gadget, &fs_epin_desc);
         if (!agdev->in_ep) {
                 dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
-                return ret;
+                return -ENODEV;
         }
 
         agdev->in_ep_maxpsize = max_t(u16,
@@ -703,9 +703,9 @@ in_rq_cur(struct usb_function *fn, const struct usb_ctrlrequest *cr)
                 memset(&c, 0, sizeof(struct cntrl_cur_lay3));
 
                 if (entity_id == USB_IN_CLK_ID)
-                        c.dCUR = p_srate;
+                        c.dCUR = cpu_to_le32(p_srate);
                 else if (entity_id == USB_OUT_CLK_ID)
-                        c.dCUR = c_srate;
+                        c.dCUR = cpu_to_le32(c_srate);
 
                 value = min_t(unsigned, w_length, sizeof c);
                 memcpy(req->buf, &c, value);
@@ -742,15 +742,15 @@ in_rq_range(struct usb_function *fn, const struct usb_ctrlrequest *cr)
 
         if (control_selector == UAC2_CS_CONTROL_SAM_FREQ) {
                 if (entity_id == USB_IN_CLK_ID)
-                        r.dMIN = p_srate;
+                        r.dMIN = cpu_to_le32(p_srate);
                 else if (entity_id == USB_OUT_CLK_ID)
-                        r.dMIN = c_srate;
+                        r.dMIN = cpu_to_le32(c_srate);
                 else
                         return -EOPNOTSUPP;
 
                 r.dMAX = r.dMIN;
                 r.dRES = 0;
-                r.wNumSubRanges = 1;
+                r.wNumSubRanges = cpu_to_le16(1);
 
                 value = min_t(unsigned, w_length, sizeof r);
                 memcpy(req->buf, &r, value);
diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
index a72295c953bb..fb5ed97572e5 100644
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -32,9 +32,6 @@ struct uac_req {
 struct uac_rtd_params {
         struct snd_uac_chip *uac; /* parent chip */
         bool ep_enabled; /* if the ep is enabled */
-        /* Size of the ring buffer */
-        size_t dma_bytes;
-        unsigned char *dma_area;
 
         struct snd_pcm_substream *ss;
 
@@ -43,8 +40,6 @@ struct uac_rtd_params {
 
         void *rbuf;
 
-        size_t period_size;
-
         unsigned max_psize;     /* MaxPacketSize of endpoint */
         struct uac_req *ureq;
 
@@ -84,12 +79,12 @@ static const struct snd_pcm_hardware uac_pcm_hardware = {
 static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
 {
         unsigned pending;
-        unsigned long flags;
+        unsigned long flags, flags2;
         unsigned int hw_ptr;
-        bool update_alsa = false;
         int status = req->status;
         struct uac_req *ur = req->context;
         struct snd_pcm_substream *substream;
+        struct snd_pcm_runtime *runtime;
         struct uac_rtd_params *prm = ur->pp;
         struct snd_uac_chip *uac = prm->uac;
 
@@ -111,6 +106,14 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
         if (!substream)
                 goto exit;
 
+        snd_pcm_stream_lock_irqsave(substream, flags2);
+
+        runtime = substream->runtime;
+        if (!runtime || !snd_pcm_running(substream)) {
+                snd_pcm_stream_unlock_irqrestore(substream, flags2);
+                goto exit;
+        }
+
         spin_lock_irqsave(&prm->lock, flags);
 
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
@@ -137,43 +140,46 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
                 req->actual = req->length;
         }
 
-        pending = prm->hw_ptr % prm->period_size;
-        pending += req->actual;
-        if (pending >= prm->period_size)
-                update_alsa = true;
-
         hw_ptr = prm->hw_ptr;
-        prm->hw_ptr = (prm->hw_ptr + req->actual) % prm->dma_bytes;
 
         spin_unlock_irqrestore(&prm->lock, flags);
 
         /* Pack USB load in ALSA ring buffer */
-        pending = prm->dma_bytes - hw_ptr;
+        pending = runtime->dma_bytes - hw_ptr;
 
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
                 if (unlikely(pending < req->actual)) {
-                        memcpy(req->buf, prm->dma_area + hw_ptr, pending);
-                        memcpy(req->buf + pending, prm->dma_area,
+                        memcpy(req->buf, runtime->dma_area + hw_ptr, pending);
+                        memcpy(req->buf + pending, runtime->dma_area,
                                req->actual - pending);
                 } else {
-                        memcpy(req->buf, prm->dma_area + hw_ptr, req->actual);
+                        memcpy(req->buf, runtime->dma_area + hw_ptr,
+                               req->actual);
                 }
         } else {
                 if (unlikely(pending < req->actual)) {
-                        memcpy(prm->dma_area + hw_ptr, req->buf, pending);
-                        memcpy(prm->dma_area, req->buf + pending,
+                        memcpy(runtime->dma_area + hw_ptr, req->buf, pending);
+                        memcpy(runtime->dma_area, req->buf + pending,
                                req->actual - pending);
                 } else {
-                        memcpy(prm->dma_area + hw_ptr, req->buf, req->actual);
+                        memcpy(runtime->dma_area + hw_ptr, req->buf,
+                               req->actual);
                 }
         }
 
+        spin_lock_irqsave(&prm->lock, flags);
+        /* update hw_ptr after data is copied to memory */
+        prm->hw_ptr = (hw_ptr + req->actual) % runtime->dma_bytes;
+        hw_ptr = prm->hw_ptr;
+        spin_unlock_irqrestore(&prm->lock, flags);
+        snd_pcm_stream_unlock_irqrestore(substream, flags2);
+
+        if ((hw_ptr % snd_pcm_lib_period_bytes(substream)) < req->actual)
+                snd_pcm_period_elapsed(substream);
+
 exit:
         if (usb_ep_queue(ep, req, GFP_ATOMIC))
                 dev_err(uac->card->dev, "%d Error!\n", __LINE__);
-
-        if (update_alsa)
-                snd_pcm_period_elapsed(substream);
 }
 
 static int uac_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
@@ -236,40 +242,12 @@ static snd_pcm_uframes_t uac_pcm_pointer(struct snd_pcm_substream *substream)
 static int uac_pcm_hw_params(struct snd_pcm_substream *substream,
                                struct snd_pcm_hw_params *hw_params)
 {
-        struct snd_uac_chip *uac = snd_pcm_substream_chip(substream);
-        struct uac_rtd_params *prm;
-        int err;
-
-        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
-                prm = &uac->p_prm;
-        else
-                prm = &uac->c_prm;
-
-        err = snd_pcm_lib_malloc_pages(substream,
+        return snd_pcm_lib_malloc_pages(substream,
                                         params_buffer_bytes(hw_params));
-        if (err >= 0) {
-                prm->dma_bytes = substream->runtime->dma_bytes;
-                prm->dma_area = substream->runtime->dma_area;
-                prm->period_size = params_period_bytes(hw_params);
-        }
-
-        return err;
 }
 
 static int uac_pcm_hw_free(struct snd_pcm_substream *substream)
 {
-        struct snd_uac_chip *uac = snd_pcm_substream_chip(substream);
-        struct uac_rtd_params *prm;
-
-        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
-                prm = &uac->p_prm;
-        else
-                prm = &uac->c_prm;
-
-        prm->dma_area = NULL;
-        prm->dma_bytes = 0;
-        prm->period_size = 0;
-
         return snd_pcm_lib_free_pages(substream);
 }
 
@@ -595,15 +573,15 @@ int g_audio_setup(struct g_audio *g_audio, const char *pcm_name,
         if (err < 0)
                 goto snd_fail;
 
-        strcpy(pcm->name, pcm_name);
+        strlcpy(pcm->name, pcm_name, sizeof(pcm->name));
         pcm->private_data = uac;
         uac->pcm = pcm;
 
         snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK, &uac_pcm_ops);
         snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_CAPTURE, &uac_pcm_ops);
 
-        strcpy(card->driver, card_name);
-        strcpy(card->shortname, card_name);
+        strlcpy(card->driver, card_name, sizeof(card->driver));
+        strlcpy(card->shortname, card_name, sizeof(card->shortname));
         sprintf(card->longname, "%s %i", card_name, card->dev->id);
 
         snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_CONTINUOUS,
diff --git a/drivers/usb/gadget/udc/aspeed-vhub/ep0.c b/drivers/usb/gadget/udc/aspeed-vhub/ep0.c
index 20ffb03ff6ac..e2927fb083cf 100644
--- a/drivers/usb/gadget/udc/aspeed-vhub/ep0.c
+++ b/drivers/usb/gadget/udc/aspeed-vhub/ep0.c
@@ -108,6 +108,13 @@ void ast_vhub_ep0_handle_setup(struct ast_vhub_ep *ep)
         /* Check our state, cancel pending requests if needed */
         if (ep->ep0.state != ep0_state_token) {
                 EPDBG(ep, "wrong state\n");
+                ast_vhub_nuke(ep, -EIO);
+
+                /*
+                 * Accept the packet regardless, this seems to happen
+                 * when stalling a SETUP packet that has an OUT data
+                 * phase.
+                 */
                 ast_vhub_nuke(ep, 0);
                 goto stall;
         }
@@ -212,6 +219,8 @@ static void ast_vhub_ep0_do_send(struct ast_vhub_ep *ep,
         if (chunk && req->req.buf)
                 memcpy(ep->buf, req->req.buf + req->req.actual, chunk);
 
+        vhub_dma_workaround(ep->buf);
+
         /* Remember chunk size and trigger send */
         reg = VHUB_EP0_SET_TX_LEN(chunk);
         writel(reg, ep->ep0.ctlstat);
@@ -224,7 +233,7 @@ static void ast_vhub_ep0_rx_prime(struct ast_vhub_ep *ep)
         EPVDBG(ep, "rx prime\n");
 
         /* Prime endpoint for receiving data */
-        writel(VHUB_EP0_RX_BUFF_RDY, ep->ep0.ctlstat + AST_VHUB_EP0_CTRL);
+        writel(VHUB_EP0_RX_BUFF_RDY, ep->ep0.ctlstat);
 }
 
 static void ast_vhub_ep0_do_receive(struct ast_vhub_ep *ep, struct ast_vhub_req *req,
diff --git a/drivers/usb/gadget/udc/aspeed-vhub/epn.c b/drivers/usb/gadget/udc/aspeed-vhub/epn.c
index 80c9feac5147..5939eb1e97f2 100644
--- a/drivers/usb/gadget/udc/aspeed-vhub/epn.c
+++ b/drivers/usb/gadget/udc/aspeed-vhub/epn.c
@@ -66,11 +66,16 @@ static void ast_vhub_epn_kick(struct ast_vhub_ep *ep, struct ast_vhub_req *req)
         if (!req->req.dma) {
 
                 /* For IN transfers, copy data over first */
-                if (ep->epn.is_in)
+                if (ep->epn.is_in) {
                         memcpy(ep->buf, req->req.buf + act, chunk);
+                        vhub_dma_workaround(ep->buf);
+                }
                 writel(ep->buf_dma, ep->epn.regs + AST_VHUB_EP_DESC_BASE);
-        } else
+        } else {
+                if (ep->epn.is_in)
+                        vhub_dma_workaround(req->req.buf);
                 writel(req->req.dma + act, ep->epn.regs + AST_VHUB_EP_DESC_BASE);
+        }
 
         /* Start DMA */
         req->active = true;
@@ -161,6 +166,7 @@ static inline unsigned int ast_vhub_count_free_descs(struct ast_vhub_ep *ep)
 static void ast_vhub_epn_kick_desc(struct ast_vhub_ep *ep,
                                    struct ast_vhub_req *req)
 {
+        struct ast_vhub_desc *desc = NULL;
         unsigned int act = req->act_count;
         unsigned int len = req->req.length;
         unsigned int chunk;
@@ -177,7 +183,6 @@ static void ast_vhub_epn_kick_desc(struct ast_vhub_ep *ep,
 
         /* While we can create descriptors */
         while (ast_vhub_count_free_descs(ep) && req->last_desc < 0) {
-                struct ast_vhub_desc *desc;
                 unsigned int d_num;
 
                 /* Grab next free descriptor */
@@ -227,6 +232,9 @@ static void ast_vhub_epn_kick_desc(struct ast_vhub_ep *ep,
                 req->act_count = act = act + chunk;
         }
 
+        if (likely(desc))
+                vhub_dma_workaround(desc);
+
         /* Tell HW about new descriptors */
         writel(VHUB_EP_DMA_SET_CPU_WPTR(ep->epn.d_next),
                ep->epn.regs + AST_VHUB_EP_DESC_STATUS);
diff --git a/drivers/usb/gadget/udc/aspeed-vhub/vhub.h b/drivers/usb/gadget/udc/aspeed-vhub/vhub.h
index 2b040257bc1f..4ed03d33a5a9 100644
--- a/drivers/usb/gadget/udc/aspeed-vhub/vhub.h
+++ b/drivers/usb/gadget/udc/aspeed-vhub/vhub.h
@@ -462,6 +462,39 @@ enum std_req_rc {
 #define DDBG(d, fmt, ...)       do { } while(0)
 #endif
 
+static inline void vhub_dma_workaround(void *addr)
+{
+        /*
+         * This works around a confirmed HW issue with the Aspeed chip.
+         *
+         * The core uses a different bus to memory than the AHB going to
+         * the USB device controller. Due to the latter having a higher
+         * priority than the core for arbitration on that bus, it's
+         * possible for an MMIO to the device, followed by a DMA by the
+         * device from memory to all be performed and services before
+         * a previous store to memory gets completed.
+         *
+         * This the following scenario can happen:
+         *
+         *    - Driver writes to a DMA descriptor (Mbus)
+         *    - Driver writes to the MMIO register to start the DMA (AHB)
+         *    - The gadget sees the second write and sends a read of the
+         *      descriptor to the memory controller (Mbus)
+         *    - The gadget hits memory before the descriptor write
+         *      causing it to read an obsolete value.
+         *
+         * Thankfully the problem is limited to the USB gadget device, other
+         * masters in the SoC all have a lower priority than the core, thus
+         * ensuring that the store by the core arrives first.
+         *
+         * The workaround consists of using a dummy read of the memory before
+         * doing the MMIO writes. This will ensure that the previous writes
+         * have been "pushed out".
+         */
+        mb();
+        (void)__raw_readl((void __iomem *)addr);
+}
+
 /* core.c */
 void ast_vhub_done(struct ast_vhub_ep *ep, struct ast_vhub_req *req,
                    int status);
diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c
index a3ecce62662b..11e25a3f4f1f 100644
--- a/drivers/usb/gadget/udc/r8a66597-udc.c
+++ b/drivers/usb/gadget/udc/r8a66597-udc.c
@@ -832,11 +832,11 @@ static void init_controller(struct r8a66597 *r8a66597)
 
                 r8a66597_bset(r8a66597, XCKE, SYSCFG0);
 
-                msleep(3);
+                mdelay(3);
 
                 r8a66597_bset(r8a66597, PLLC, SYSCFG0);
 
-                msleep(1);
+                mdelay(1);
 
                 r8a66597_bset(r8a66597, SCKE, SYSCFG0);
 
@@ -1190,7 +1190,7 @@ __acquires(r8a66597->lock)
         r8a66597->ep0_req->length = 2;
         /* AV: what happens if we get called again before that gets through? */
         spin_unlock(&r8a66597->lock);
-        r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_KERNEL);
+        r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_ATOMIC);
         spin_lock(&r8a66597->lock);
 }
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 2f4850f25e82..68e6132aa8b2 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3051,6 +3051,7 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
         if (!list_empty(&ep->ring->td_list)) {
                 dev_err(&udev->dev, "EP not empty, refuse reset\n");
                 spin_unlock_irqrestore(&xhci->lock, flags);
+                xhci_free_command(xhci, cfg_cmd);
                 goto cleanup;
         }
         xhci_queue_stop_endpoint(xhci, stop_cmd, udev->slot_id, ep_index, 0);
diff --git a/drivers/usb/phy/phy-fsl-usb.c b/drivers/usb/phy/phy-fsl-usb.c
index 900875f326d7..f7c96d209eda 100644
--- a/drivers/usb/phy/phy-fsl-usb.c
+++ b/drivers/usb/phy/phy-fsl-usb.c
@@ -861,6 +861,7 @@ int usb_otg_start(struct platform_device *pdev)
         if (pdata->init && pdata->init(pdev) != 0)
                 return -EINVAL;
 
+#ifdef CONFIG_PPC32
         if (pdata->big_endian_mmio) {
                 _fsl_readl = _fsl_readl_be;
                 _fsl_writel = _fsl_writel_be;
@@ -868,6 +869,7 @@ int usb_otg_start(struct platform_device *pdev)
                 _fsl_readl = _fsl_readl_le;
                 _fsl_writel = _fsl_writel_le;
         }
+#endif
 
         /* request irq */
         p_otg->irq = platform_get_irq(pdev, 0);
@@ -958,7 +960,7 @@ int usb_otg_start(struct platform_device *pdev)
 /*
  * state file in sysfs
  */
-static int show_fsl_usb2_otg_state(struct device *dev,
+static ssize_t show_fsl_usb2_otg_state(struct device *dev,
                                    struct device_attribute *attr, char *buf)
 {
         struct otg_fsm *fsm = &fsl_otg_dev->fsm;
diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
index 150f43668bec..d1d20252bad8 100644
--- a/drivers/usb/typec/tcpm.c
+++ b/drivers/usb/typec/tcpm.c
@@ -2140,7 +2140,7 @@ static unsigned int tcpm_pd_select_pps_apdo(struct tcpm_port *port)
                          * PPS APDO. Again skip the first sink PDO as this will
                          * always be 5V 3A.
                          */
-                        for (j = i; j < port->nr_snk_pdo; j++) {
+                        for (j = 1; j < port->nr_snk_pdo; j++) {
                                 pdo = port->snk_pdo[j];
 
                                 switch (pdo_type(pdo)) {
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index b423a309a6e0..125b58eff936 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -28,6 +28,7 @@
 #include <linux/uaccess.h>
 #include <linux/vfio.h>
 #include <linux/vgaarb.h>
+#include <linux/nospec.h>
 
 #include "vfio_pci_private.h"
 
@@ -727,6 +728,9 @@ static long vfio_pci_ioctl(void *device_data,
                         if (info.index >=
                             VFIO_PCI_NUM_REGIONS + vdev->num_regions)
                                 return -EINVAL;
+                        info.index = array_index_nospec(info.index,
+                                                        VFIO_PCI_NUM_REGIONS +
+                                                        vdev->num_regions);
 
                         i = info.index - VFIO_PCI_NUM_REGIONS;
 
diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c
index 759a5bdd40e1..7cd63b0c1a46 100644
--- a/drivers/vfio/vfio_iommu_spapr_tce.c
+++ b/drivers/vfio/vfio_iommu_spapr_tce.c
@@ -457,17 +457,17 @@ static void tce_iommu_unuse_page(struct tce_container *container,
 }
 
 static int tce_iommu_prereg_ua_to_hpa(struct tce_container *container,
-                unsigned long tce, unsigned long size,
+                unsigned long tce, unsigned long shift,
                 unsigned long *phpa, struct mm_iommu_table_group_mem_t **pmem)
 {
         long ret = 0;
         struct mm_iommu_table_group_mem_t *mem;
 
-        mem = mm_iommu_lookup(container->mm, tce, size);
+        mem = mm_iommu_lookup(container->mm, tce, 1ULL << shift);
         if (!mem)
                 return -EINVAL;
 
-        ret = mm_iommu_ua_to_hpa(mem, tce, phpa);
+        ret = mm_iommu_ua_to_hpa(mem, tce, shift, phpa);
         if (ret)
                 return -EINVAL;
 
@@ -487,7 +487,7 @@ static void tce_iommu_unuse_page_v2(struct tce_container *container,
         if (!pua)
                 return;
 
-        ret = tce_iommu_prereg_ua_to_hpa(container, *pua, IOMMU_PAGE_SIZE(tbl),
+        ret = tce_iommu_prereg_ua_to_hpa(container, *pua, tbl->it_page_shift,
                         &hpa, &mem);
         if (ret)
                 pr_debug("%s: tce %lx at #%lx was not cached, ret=%d\n",
@@ -611,7 +611,7 @@ static long tce_iommu_build_v2(struct tce_container *container,
                                 entry + i);
 
                 ret = tce_iommu_prereg_ua_to_hpa(container,
-                                tce, IOMMU_PAGE_SIZE(tbl), &hpa, &mem);
+                                tce, tbl->it_page_shift, &hpa, &mem);
                 if (ret)
                         break;
 
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 6b237e3f4983..3988c0914322 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -513,7 +513,9 @@ static int virtballoon_migratepage(struct balloon_dev_info *vb_dev_info,
         tell_host(vb, vb->inflate_vq);
 
         /* balloon's page migration 2nd step -- deflate "page" */
+        spin_lock_irqsave(&vb_dev_info->pages_lock, flags);
         balloon_page_delete(page);
+        spin_unlock_irqrestore(&vb_dev_info->pages_lock, flags);
         vb->num_pfns = VIRTIO_BALLOON_PAGES_PER_PAGE;
         set_page_pfns(vb, vb->pfns, page);
         tell_host(vb, vb->deflate_vq);
diff --git a/fs/aio.c b/fs/aio.c
index 210df9da1283..27454594e37a 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1896,6 +1896,11 @@ SYSCALL_DEFINE5(io_getevents, aio_context_t, ctx_id,
         return ret;
 }
 
+struct __aio_sigset {
+        const sigset_t __user   *sigmask;
+        size_t          sigsetsize;
+};
+
 SYSCALL_DEFINE6(io_pgetevents,
                 aio_context_t, ctx_id,
                 long, min_nr,
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 0dd87aaeb39a..aba25414231a 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -221,7 +221,7 @@ __blkdev_direct_IO_simple(struct kiocb *iocb, struct iov_iter *iter,
 
         ret = bio_iov_iter_get_pages(&bio, iter);
         if (unlikely(ret))
-                return ret;
+                goto out;
         ret = bio.bi_iter.bi_size;
 
         if (iov_iter_rw(iter) == READ) {
@@ -250,12 +250,13 @@ __blkdev_direct_IO_simple(struct kiocb *iocb, struct iov_iter *iter,
                 put_page(bvec->bv_page);
         }
 
-        if (vecs != inline_vecs)
-                kfree(vecs);
-
         if (unlikely(bio.bi_status))
                 ret = blk_status_to_errno(bio.bi_status);
 
+out:
+        if (vecs != inline_vecs)
+                kfree(vecs);
+
         bio_uninit(&bio);
 
         return ret;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index e55843f536bc..b3e45714d28f 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4238,8 +4238,9 @@ int try_release_extent_mapping(struct page *page, gfp_t mask)
         struct extent_map *em;
         u64 start = page_offset(page);
         u64 end = start + PAGE_SIZE - 1;
-        struct extent_io_tree *tree = &BTRFS_I(page->mapping->host)->io_tree;
-        struct extent_map_tree *map = &BTRFS_I(page->mapping->host)->extent_tree;
+        struct btrfs_inode *btrfs_inode = BTRFS_I(page->mapping->host);
+        struct extent_io_tree *tree = &btrfs_inode->io_tree;
+        struct extent_map_tree *map = &btrfs_inode->extent_tree;
 
         if (gfpflags_allow_blocking(mask) &&
             page->mapping->host->i_size > SZ_16M) {
@@ -4262,6 +4263,8 @@ int try_release_extent_mapping(struct page *page, gfp_t mask)
                                             extent_map_end(em) - 1,
                                             EXTENT_LOCKED | EXTENT_WRITEBACK,
                                             0, NULL)) {
+                                set_bit(BTRFS_INODE_NEEDS_FULL_SYNC,
+                                        &btrfs_inode->runtime_flags);
                                 remove_extent_mapping(map, em);
                                 /* once for the rb tree */
                                 free_extent_map(em);
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 43ecbe620dea..b077544b5232 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3327,11 +3327,13 @@ static void btrfs_cmp_data_free(struct cmp_pages *cmp)
                 if (pg) {
                         unlock_page(pg);
                         put_page(pg);
+                        cmp->src_pages[i] = NULL;
                 }
                 pg = cmp->dst_pages[i];
                 if (pg) {
                         unlock_page(pg);
                         put_page(pg);
+                        cmp->dst_pages[i] = NULL;
                 }
         }
 }
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 572306036477..6702896cdb8f 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -1151,11 +1151,6 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check)
                 return ret;
         }
 
-        if (sctx->is_dev_replace && !is_metadata && !have_csum) {
-                sblocks_for_recheck = NULL;
-                goto nodatasum_case;
-        }
-
         /*
          * read all mirrors one after the other. This includes to
          * re-read the extent or metadata block that failed (that was
@@ -1268,13 +1263,19 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check)
                 goto out;
         }
 
-        if (!is_metadata && !have_csum) {
+        /*
+         * NOTE: Even for nodatasum case, it's still possible that it's a
+         * compressed data extent, thus scrub_fixup_nodatasum(), which write
+         * inode page cache onto disk, could cause serious data corruption.
+         *
+         * So here we could only read from disk, and hope our recovery could
+         * reach disk before the newer write.
+         */
+        if (0 && !is_metadata && !have_csum) {
                 struct scrub_fixup_nodatasum *fixup_nodatasum;
 
                 WARN_ON(sctx->is_dev_replace);
 
-nodatasum_case:
-
                 /*
                  * !is_metadata and !have_csum, this means that the data
                  * might not be COWed, that it might be modified
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index e034ad9e23b4..1da162928d1a 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1146,6 +1146,7 @@ int btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
 {
         int ret;
 
+        mutex_lock(&uuid_mutex);
         mutex_lock(&fs_devices->device_list_mutex);
         if (fs_devices->opened) {
                 fs_devices->opened++;
@@ -1155,6 +1156,7 @@ int btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
                 ret = open_fs_devices(fs_devices, flags, holder);
         }
         mutex_unlock(&fs_devices->device_list_mutex);
+        mutex_unlock(&uuid_mutex);
 
         return ret;
 }
diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
index d9f001078e08..4a717d400807 100644
--- a/fs/cachefiles/bind.c
+++ b/fs/cachefiles/bind.c
@@ -218,7 +218,8 @@ static int cachefiles_daemon_add_cache(struct cachefiles_cache *cache)
                            "%s",
                            fsdef->dentry->d_sb->s_id);
 
-        fscache_object_init(&fsdef->fscache, NULL, &cache->cache);
+        fscache_object_init(&fsdef->fscache, &fscache_fsdef_index,
+                            &cache->cache);
 
         ret = fscache_add_cache(&cache->cache, &fsdef->fscache, cache->tag);
         if (ret < 0)
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
index ab0bbe93b398..af2b17b21b94 100644
--- a/fs/cachefiles/namei.c
+++ b/fs/cachefiles/namei.c
@@ -186,12 +186,12 @@ try_again:
          * need to wait for it to be destroyed */
 wait_for_old_object:
         trace_cachefiles_wait_active(object, dentry, xobject);
+        clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
 
         if (fscache_object_is_live(&xobject->fscache)) {
                 pr_err("\n");
                 pr_err("Error: Unexpected object collision\n");
                 cachefiles_printk_object(object, xobject);
-                BUG();
         }
         atomic_inc(&xobject->usage);
         write_unlock(&cache->active_lock);
@@ -248,7 +248,6 @@ wait_for_old_object:
         goto try_again;
 
 requeue:
-        clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
         cache->cache.ops->put_object(&xobject->fscache, cachefiles_obj_put_wait_timeo);
         _leave(" = -ETIMEDOUT");
         return -ETIMEDOUT;
diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
index 5082c8a49686..40f7595aad10 100644
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -27,6 +27,7 @@ static int cachefiles_read_waiter(wait_queue_entry_t *wait, unsigned mode,
         struct cachefiles_one_read *monitor =
                 container_of(wait, struct cachefiles_one_read, monitor);
         struct cachefiles_object *object;
+        struct fscache_retrieval *op = monitor->op;
         struct wait_bit_key *key = _key;
         struct page *page = wait->private;
 
@@ -51,16 +52,22 @@ static int cachefiles_read_waiter(wait_queue_entry_t *wait, unsigned mode,
         list_del(&wait->entry);
 
         /* move onto the action list and queue for FS-Cache thread pool */
-        ASSERT(monitor->op);
+        ASSERT(op);
 
-        object = container_of(monitor->op->op.object,
-                              struct cachefiles_object, fscache);
+        /* We need to temporarily bump the usage count as we don't own a ref
+         * here otherwise cachefiles_read_copier() may free the op between the
+         * monitor being enqueued on the op->to_do list and the op getting
+         * enqueued on the work queue.
+         */
+        fscache_get_retrieval(op);
 
+        object = container_of(op->op.object, struct cachefiles_object, fscache);
         spin_lock(&object->work_lock);
-        list_add_tail(&monitor->op_link, &monitor->op->to_do);
+        list_add_tail(&monitor->op_link, &op->to_do);
         spin_unlock(&object->work_lock);
 
-        fscache_enqueue_retrieval(monitor->op);
+        fscache_enqueue_retrieval(op);
+        fscache_put_retrieval(op);
         return 0;
 }
 
diff --git a/fs/exec.c b/fs/exec.c
index 2d4e0075bd24..bdd0eacefdf5 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -290,15 +290,15 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
         struct vm_area_struct *vma = NULL;
         struct mm_struct *mm = bprm->mm;
 
-        bprm->vma = vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+        bprm->vma = vma = vm_area_alloc(mm);
         if (!vma)
                 return -ENOMEM;
+        vma_set_anonymous(vma);
 
         if (down_write_killable(&mm->mmap_sem)) {
                 err = -EINTR;
                 goto err_free;
         }
-        vma->vm_mm = mm;
 
         /*
          * Place the stack at the largest stack address the architecture
@@ -311,7 +311,6 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
         vma->vm_start = vma->vm_end - PAGE_SIZE;
         vma->vm_flags = VM_SOFTDIRTY | VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
         vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-        INIT_LIST_HEAD(&vma->anon_vma_chain);
 
         err = insert_vm_struct(mm, vma);
         if (err)
@@ -326,7 +325,7 @@ err:
         up_write(&mm->mmap_sem);
 err_free:
         bprm->vma = NULL;
-        kmem_cache_free(vm_area_cachep, vma);
+        vm_area_free(vma);
         return err;
 }
 
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index e68cefe08261..aa52d87985aa 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -368,6 +368,8 @@ static int ext4_validate_block_bitmap(struct super_block *sb,
                 return -EFSCORRUPTED;
 
         ext4_lock_group(sb, block_group);
+        if (buffer_verified(bh))
+                goto verified;
         if (unlikely(!ext4_block_bitmap_csum_verify(sb, block_group,
                         desc, bh))) {
                 ext4_unlock_group(sb, block_group);
@@ -386,6 +388,7 @@ static int ext4_validate_block_bitmap(struct super_block *sb,
                 return -EFSCORRUPTED;
         }
         set_buffer_verified(bh);
+verified:
         ext4_unlock_group(sb, block_group);
         return 0;
 }
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index fb83750c1a14..f336cbc6e932 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -90,6 +90,8 @@ static int ext4_validate_inode_bitmap(struct super_block *sb,
                 return -EFSCORRUPTED;
 
         ext4_lock_group(sb, block_group);
+        if (buffer_verified(bh))
+                goto verified;
         blk = ext4_inode_bitmap(sb, desc);
         if (!ext4_inode_bitmap_csum_verify(sb, block_group, desc, bh,
                                            EXT4_INODES_PER_GROUP(sb) / 8)) {
@@ -101,6 +103,7 @@ static int ext4_validate_inode_bitmap(struct super_block *sb,
                 return -EFSBADCRC;
         }
         set_buffer_verified(bh);
+verified:
         ext4_unlock_group(sb, block_group);
         return 0;
 }
@@ -1385,7 +1388,10 @@ int ext4_init_inode_table(struct super_block *sb, ext4_group_t group,
                             ext4_itable_unused_count(sb, gdp)),
                             sbi->s_inodes_per_block);
 
-        if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group)) {
+        if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group) ||
+            ((group == 0) && ((EXT4_INODES_PER_GROUP(sb) -
+                               ext4_itable_unused_count(sb, gdp)) <
+                              EXT4_FIRST_INO(sb)))) {
                 ext4_error(sb, "Something is wrong with group %u: "
                            "used itable blocks: %d; "
                            "itable unused count: %u",
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index e55a8bc870bd..3543fe80a3c4 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -682,6 +682,10 @@ int ext4_try_to_write_inline_data(struct address_space *mapping,
                 goto convert;
         }
 
+        ret = ext4_journal_get_write_access(handle, iloc.bh);
+        if (ret)
+                goto out;
+
         flags |= AOP_FLAG_NOFS;
 
         page = grab_cache_page_write_begin(mapping, 0, flags);
@@ -710,7 +714,7 @@ int ext4_try_to_write_inline_data(struct address_space *mapping,
 out_up_read:
         up_read(&EXT4_I(inode)->xattr_sem);
 out:
-        if (handle)
+        if (handle && (ret != 1))
                 ext4_journal_stop(handle);
         brelse(iloc.bh);
         return ret;
@@ -752,6 +756,7 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
 
         ext4_write_unlock_xattr(inode, &no_expand);
         brelse(iloc.bh);
+        mark_inode_dirty(inode);
 out:
         return copied;
 }
@@ -898,7 +903,6 @@ retry_journal:
                 goto out;
         }
 
-
         page = grab_cache_page_write_begin(mapping, 0, flags);
         if (!page) {
                 ret = -ENOMEM;
@@ -916,6 +920,9 @@ retry_journal:
                 if (ret < 0)
                         goto out_release_page;
         }
+        ret = ext4_journal_get_write_access(handle, iloc.bh);
+        if (ret)
+                goto out_release_page;
 
         up_read(&EXT4_I(inode)->xattr_sem);
         *pagep = page;
@@ -936,7 +943,6 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos,
                                   unsigned len, unsigned copied,
                                   struct page *page)
 {
-        int i_size_changed = 0;
         int ret;
 
         ret = ext4_write_inline_data_end(inode, pos, len, copied, page);
@@ -954,10 +960,8 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos,
          * But it's important to update i_size while still holding page lock:
          * page writeout could otherwise come in and zero beyond i_size.
          */
-        if (pos+copied > inode->i_size) {
+        if (pos+copied > inode->i_size)
                 i_size_write(inode, pos+copied);
-                i_size_changed = 1;
-        }
         unlock_page(page);
         put_page(page);
 
@@ -967,8 +971,7 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos,
          * ordering of page lock and transaction start for journaling
          * filesystems.
          */
-        if (i_size_changed)
-                mark_inode_dirty(inode);
+        mark_inode_dirty(inode);
 
         return copied;
 }
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 7d6c10017bdf..4efe77286ecd 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1389,9 +1389,10 @@ static int ext4_write_end(struct file *file,
         loff_t old_size = inode->i_size;
         int ret = 0, ret2;
         int i_size_changed = 0;
+        int inline_data = ext4_has_inline_data(inode);
 
         trace_ext4_write_end(inode, pos, len, copied);
-        if (ext4_has_inline_data(inode)) {
+        if (inline_data) {
                 ret = ext4_write_inline_data_end(inode, pos, len,
                                                  copied, page);
                 if (ret < 0) {
@@ -1419,7 +1420,7 @@ static int ext4_write_end(struct file *file,
          * ordering of page lock and transaction start for journaling
          * filesystems.
          */
-        if (i_size_changed)
+        if (i_size_changed || inline_data)
                 ext4_mark_inode_dirty(handle, inode);
 
         if (pos + len > inode->i_size && ext4_can_truncate(inode))
@@ -1493,6 +1494,7 @@ static int ext4_journalled_write_end(struct file *file,
         int partial = 0;
         unsigned from, to;
         int size_changed = 0;
+        int inline_data = ext4_has_inline_data(inode);
 
         trace_ext4_journalled_write_end(inode, pos, len, copied);
         from = pos & (PAGE_SIZE - 1);
@@ -1500,7 +1502,7 @@ static int ext4_journalled_write_end(struct file *file,
 
         BUG_ON(!ext4_handle_valid(handle));
 
-        if (ext4_has_inline_data(inode)) {
+        if (inline_data) {
                 ret = ext4_write_inline_data_end(inode, pos, len,
                                                  copied, page);
                 if (ret < 0) {
@@ -1531,7 +1533,7 @@ static int ext4_journalled_write_end(struct file *file,
         if (old_size < pos)
                 pagecache_isize_extended(inode, old_size, pos);
 
-        if (size_changed) {
+        if (size_changed || inline_data) {
                 ret2 = ext4_mark_inode_dirty(handle, inode);
                 if (!ret)
                         ret = ret2;
@@ -2028,11 +2030,7 @@ static int __ext4_journalled_writepage(struct page *page,
         }
 
         if (inline_data) {
-                BUFFER_TRACE(inode_bh, "get write access");
-                ret = ext4_journal_get_write_access(handle, inode_bh);
-
-                err = ext4_handle_dirty_metadata(handle, inode, inode_bh);
-
+                ret = ext4_mark_inode_dirty(handle, inode);
         } else {
                 ret = ext4_walk_page_buffers(handle, page_bufs, 0, len, NULL,
                                              do_journal_get_write_access);
diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c
index 27b9a76a0dfa..638ad4743477 100644
--- a/fs/ext4/mmp.c
+++ b/fs/ext4/mmp.c
@@ -186,11 +186,8 @@ static int kmmpd(void *data)
                         goto exit_thread;
                 }
 
-                if (sb_rdonly(sb)) {
-                        ext4_warning(sb, "kmmpd being stopped since filesystem "
-                                     "has been remounted as readonly.");
-                        goto exit_thread;
-                }
+                if (sb_rdonly(sb))
+                        break;
 
                 diff = jiffies - last_update_time;
                 if (diff < mmp_update_interval * HZ)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index ba2396a7bd04..b7f7922061be 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2342,7 +2342,7 @@ static int ext4_check_descriptors(struct super_block *sb,
         struct ext4_sb_info *sbi = EXT4_SB(sb);
         ext4_fsblk_t first_block = le32_to_cpu(sbi->s_es->s_first_data_block);
         ext4_fsblk_t last_block;
-        ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0) + 1;
+        ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0);
         ext4_fsblk_t block_bitmap;
         ext4_fsblk_t inode_bitmap;
         ext4_fsblk_t inode_table;
@@ -3141,14 +3141,8 @@ static ext4_group_t ext4_has_uninit_itable(struct super_block *sb)
                 if (!gdp)
                         continue;
 
-                if (gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED))
-                        continue;
-                if (group != 0)
+                if (!(gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED)))
                         break;
-                ext4_error(sb, "Inode table for bg 0 marked as "
-                           "needing zeroing");
-                if (sb_rdonly(sb))
-                        return ngroups;
         }
 
         return group;
@@ -4085,14 +4079,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                         goto failed_mount2;
                 }
         }
+        sbi->s_gdb_count = db_count;
         if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) {
                 ext4_msg(sb, KERN_ERR, "group descriptors corrupted!");
                 ret = -EFSCORRUPTED;
                 goto failed_mount2;
         }
 
-        sbi->s_gdb_count = db_count;
-
         timer_setup(&sbi->s_err_report, print_daily_error_info, 0);
 
         /* Register extent status tree shrinker */
@@ -5213,6 +5206,8 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
 
                         if (sbi->s_journal)
                                 ext4_mark_recovery_complete(sb, es);
+                        if (sbi->s_mmp_tsk)
+                                kthread_stop(sbi->s_mmp_tsk);
                 } else {
                         /* Make sure we can mount this feature set readwrite */
                         if (ext4_has_feature_readonly(sb) ||
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 065dc919a0ce..bfd589ea74c0 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -707,13 +707,21 @@ static void fat_set_state(struct super_block *sb,
         brelse(bh);
 }
 
+static void fat_reset_iocharset(struct fat_mount_options *opts)
+{
+        if (opts->iocharset != fat_default_iocharset) {
+                /* Note: opts->iocharset can be NULL here */
+                kfree(opts->iocharset);
+                opts->iocharset = fat_default_iocharset;
+        }
+}
+
 static void delayed_free(struct rcu_head *p)
 {
         struct msdos_sb_info *sbi = container_of(p, struct msdos_sb_info, rcu);
         unload_nls(sbi->nls_disk);
         unload_nls(sbi->nls_io);
-        if (sbi->options.iocharset != fat_default_iocharset)
-                kfree(sbi->options.iocharset);
+        fat_reset_iocharset(&sbi->options);
         kfree(sbi);
 }
 
@@ -1132,7 +1140,7 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat,
         opts->fs_fmask = opts->fs_dmask = current_umask();
         opts->allow_utime = -1;
         opts->codepage = fat_default_codepage;
-        opts->iocharset = fat_default_iocharset;
+        fat_reset_iocharset(opts);
         if (is_vfat) {
                 opts->shortname = VFAT_SFN_DISPLAY_WINNT|VFAT_SFN_CREATE_WIN95;
                 opts->rodir = 0;
@@ -1289,8 +1297,7 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat,
 
                 /* vfat specific */
                 case Opt_charset:
-                        if (opts->iocharset != fat_default_iocharset)
-                                kfree(opts->iocharset);
+                        fat_reset_iocharset(opts);
                         iocharset = match_strdup(&args[0]);
                         if (!iocharset)
                                 return -ENOMEM;
@@ -1881,8 +1888,7 @@ out_fail:
                 iput(fat_inode);
         unload_nls(sbi->nls_io);
         unload_nls(sbi->nls_disk);
-        if (sbi->options.iocharset != fat_default_iocharset)
-                kfree(sbi->options.iocharset);
+        fat_reset_iocharset(&sbi->options);
         sb->s_fs_info = NULL;
         kfree(sbi);
         return error;
diff --git a/fs/fscache/cache.c b/fs/fscache/cache.c
index c184c5a356ff..cdcb376ef8df 100644
--- a/fs/fscache/cache.c
+++ b/fs/fscache/cache.c
@@ -220,6 +220,7 @@ int fscache_add_cache(struct fscache_cache *cache,
 {
         struct fscache_cache_tag *tag;
 
+        ASSERTCMP(ifsdef->cookie, ==, &fscache_fsdef_index);
         BUG_ON(!cache->ops);
         BUG_ON(!ifsdef);
 
@@ -248,7 +249,6 @@ int fscache_add_cache(struct fscache_cache *cache,
         if (!cache->kobj)
                 goto error;
 
-        ifsdef->cookie = &fscache_fsdef_index;
         ifsdef->cache = cache;
         cache->fsdef = ifsdef;
 
diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index 97137d7ec5ee..83bfe04456b6 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -516,6 +516,7 @@ static int fscache_alloc_object(struct fscache_cache *cache,
                 goto error;
         }
 
+        ASSERTCMP(object->cookie, ==, cookie);
         fscache_stat(&fscache_n_object_alloc);
 
         object->debug_id = atomic_inc_return(&fscache_object_debug_id);
@@ -571,6 +572,8 @@ static int fscache_attach_object(struct fscache_cookie *cookie,
 
         _enter("{%s},{OBJ%x}", cookie->def->name, object->debug_id);
 
+        ASSERTCMP(object->cookie, ==, cookie);
+
         spin_lock(&cookie->lock);
 
         /* there may be multiple initial creations of this object, but we only
@@ -610,9 +613,7 @@ static int fscache_attach_object(struct fscache_cookie *cookie,
                 spin_unlock(&cache->object_list_lock);
         }
 
-        /* attach to the cookie */
-        object->cookie = cookie;
-        fscache_cookie_get(cookie, fscache_cookie_get_attach_object);
+        /* Attach to the cookie.  The object already has a ref on it. */
         hlist_add_head(&object->cookie_link, &cookie->backing_objects);
 
         fscache_objlist_add(object);
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
index 20e0d0a4dc8c..9edc920f651f 100644
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -327,6 +327,7 @@ void fscache_object_init(struct fscache_object *object,
         object->store_limit_l = 0;
         object->cache = cache;
         object->cookie = cookie;
+        fscache_cookie_get(cookie, fscache_cookie_get_attach_object);
         object->parent = NULL;
 #ifdef CONFIG_FSCACHE_OBJECT_LIST
         RB_CLEAR_NODE(&object->objlist_link);
diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
index e30c5975ea58..8d265790374c 100644
--- a/fs/fscache/operation.c
+++ b/fs/fscache/operation.c
@@ -70,7 +70,8 @@ void fscache_enqueue_operation(struct fscache_operation *op)
         ASSERT(op->processor != NULL);
         ASSERT(fscache_object_is_available(op->object));
         ASSERTCMP(atomic_read(&op->usage), >, 0);
-        ASSERTCMP(op->state, ==, FSCACHE_OP_ST_IN_PROGRESS);
+        ASSERTIFCMP(op->state != FSCACHE_OP_ST_IN_PROGRESS,
+                    op->state, ==,  FSCACHE_OP_ST_CANCELLED);
 
         fscache_stat(&fscache_n_op_enqueue);
         switch (op->flags & FSCACHE_OP_TYPE) {
@@ -499,7 +500,8 @@ void fscache_put_operation(struct fscache_operation *op)
         struct fscache_cache *cache;
 
         _enter("{OBJ%x OP%x,%d}",
-               op->object->debug_id, op->debug_id, atomic_read(&op->usage));
+               op->object ? op->object->debug_id : 0,
+               op->debug_id, atomic_read(&op->usage));
 
         ASSERTCMP(atomic_read(&op->usage), >, 0);
 
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index d508c7844681..40d4c66c7751 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -411,6 +411,7 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
         bool truncate_op = (lend == LLONG_MAX);
 
         memset(&pseudo_vma, 0, sizeof(struct vm_area_struct));
+        vma_init(&pseudo_vma, current->mm);
         pseudo_vma.vm_flags = (VM_HUGETLB | VM_MAYSHARE | VM_SHARED);
         pagevec_init(&pvec);
         next = start;
@@ -595,6 +596,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
          * as input to create an allocation policy.
          */
         memset(&pseudo_vma, 0, sizeof(struct vm_area_struct));
+        vma_init(&pseudo_vma, mm);
         pseudo_vma.vm_flags = (VM_HUGETLB | VM_MAYSHARE | VM_SHARED);
         pseudo_vma.vm_file = file;
 
diff --git a/fs/internal.h b/fs/internal.h
index 980d005b21b4..5645b4ebf494 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -127,7 +127,6 @@ int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group,
 
 extern int open_check_o_direct(struct file *f);
 extern int vfs_open(const struct path *, struct file *, const struct cred *);
-extern struct file *filp_clone_open(struct file *);
 
 /*
  * inode.c
diff --git a/fs/iomap.c b/fs/iomap.c
index 77397b5a96ef..0d0bd8845586 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -1443,7 +1443,7 @@ iomap_bmap(struct address_space *mapping, sector_t bno,
                 const struct iomap_ops *ops)
 {
         struct inode *inode = mapping->host;
-        loff_t pos = bno >> inode->i_blkbits;
+        loff_t pos = bno << inode->i_blkbits;
         unsigned blocksize = i_blocksize(inode);
 
         if (filemap_write_and_wait(mapping))
diff --git a/fs/jfs/jfs_dinode.h b/fs/jfs/jfs_dinode.h
index 395c4c0d0f06..1682a87c00b2 100644
--- a/fs/jfs/jfs_dinode.h
+++ b/fs/jfs/jfs_dinode.h
@@ -115,6 +115,13 @@ struct dinode {
                                         dxd_t _dxd;     /* 16: */
                                         union {
                                                 __le32 _rdev;   /* 4: */
+                                                /*
+                                                 * The fast symlink area
+                                                 * is expected to overflow
+                                                 * into _inlineea when
+                                                 * needed (which will clear
+                                                 * INLINEEA).
+                                                 */
                                                 u8 _fastsymlink[128];
                                         } _u;
                                         u8 _inlineea[128];
diff --git a/fs/jfs/jfs_incore.h b/fs/jfs/jfs_incore.h
index 1f26d1910409..9940a1e04cbf 100644
--- a/fs/jfs/jfs_incore.h
+++ b/fs/jfs/jfs_incore.h
@@ -87,6 +87,7 @@ struct jfs_inode_info {
                 struct {
                         unchar _unused[16];     /* 16: */
                         dxd_t _dxd;             /* 16: */
+                        /* _inline may overflow into _inline_ea when needed */
                         unchar _inline[128];    /* 128: inline symlink */
                         /* _inline_ea may overlay the last part of
                          * file._xtroot if maxentry = XTROOTINITSLOT
diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index 1b9264fd54b6..f08571433aba 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -967,8 +967,7 @@ static int __init init_jfs_fs(void)
         jfs_inode_cachep =
             kmem_cache_create_usercopy("jfs_ip", sizeof(struct jfs_inode_info),
                         0, SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_ACCOUNT,
-                        offsetof(struct jfs_inode_info, i_inline),
-                        sizeof_field(struct jfs_inode_info, i_inline),
+                        offsetof(struct jfs_inode_info, i_inline), IDATASIZE,
                         init_once);
         if (jfs_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 6dd146885da9..f6c4ccd693f4 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -6466,34 +6466,34 @@ static void nfs4_lock_done(struct rpc_task *task, void *calldata)
                 if (data->arg.new_lock && !data->cancelled) {
                         data->fl.fl_flags &= ~(FL_SLEEP | FL_ACCESS);
                         if (locks_lock_inode_wait(lsp->ls_state->inode, &data->fl) < 0)
-                                break;
+                                goto out_restart;
                 }
-
                 if (data->arg.new_lock_owner != 0) {
                         nfs_confirm_seqid(&lsp->ls_seqid, 0);
                         nfs4_stateid_copy(&lsp->ls_stateid, &data->res.stateid);
                         set_bit(NFS_LOCK_INITIALIZED, &lsp->ls_flags);
-                        goto out_done;
-                } else if (nfs4_update_lock_stateid(lsp, &data->res.stateid))
-                        goto out_done;
-
+                } else if (!nfs4_update_lock_stateid(lsp, &data->res.stateid))
+                        goto out_restart;
                 break;
         case -NFS4ERR_BAD_STATEID:
         case -NFS4ERR_OLD_STATEID:
         case -NFS4ERR_STALE_STATEID:
         case -NFS4ERR_EXPIRED:
                 if (data->arg.new_lock_owner != 0) {
-                        if (nfs4_stateid_match(&data->arg.open_stateid,
+                        if (!nfs4_stateid_match(&data->arg.open_stateid,
                                                 &lsp->ls_state->open_stateid))
-                                goto out_done;
-                } else if (nfs4_stateid_match(&data->arg.lock_stateid,
+                                goto out_restart;
+                } else if (!nfs4_stateid_match(&data->arg.lock_stateid,
                                                 &lsp->ls_stateid))
-                                goto out_done;
+                                goto out_restart;
         }
-        if (!data->cancelled)
-                rpc_restart_call_prepare(task);
 out_done:
         dprintk("%s: done, ret = %d!\n", __func__, data->rpc_status);
+        return;
+out_restart:
+        if (!data->cancelled)
+                rpc_restart_call_prepare(task);
+        goto out_done;
 }
 
 static void nfs4_lock_release(void *calldata)
@@ -6502,7 +6502,7 @@ static void nfs4_lock_release(void *calldata)
 
         dprintk("%s: begin!\n", __func__);
         nfs_free_seqid(data->arg.open_seqid);
-        if (data->cancelled) {
+        if (data->cancelled && data->rpc_status == 0) {
                 struct rpc_task *task;
                 task = nfs4_do_unlck(&data->fl, data->ctx, data->lsp,
                                 data->arg.lock_seqid);
diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index 2751476e6b6e..f098b9f1c396 100644
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -167,6 +167,8 @@ int squashfs_read_data(struct super_block *sb, u64 index, int length,
         }
 
         if (compressed) {
+                if (!msblk->stream)
+                        goto read_failure;
                 length = squashfs_decompress(msblk, bh, b, offset, length,
                         output);
                 if (length < 0)
diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c
index 23813c078cc9..0839efa720b3 100644
--- a/fs/squashfs/cache.c
+++ b/fs/squashfs/cache.c
@@ -350,6 +350,9 @@ int squashfs_read_metadata(struct super_block *sb, void *buffer,
 
         TRACE("Entered squashfs_read_metadata [%llx:%x]\n", *block, *offset);
 
+        if (unlikely(length < 0))
+                return -EIO;
+
         while (length) {
                 entry = squashfs_cache_get(sb, msblk->block_cache, *block, 0);
                 if (entry->error) {
diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c
index 13d80947bf9e..f1c1430ae721 100644
--- a/fs/squashfs/file.c
+++ b/fs/squashfs/file.c
@@ -194,7 +194,11 @@ static long long read_indexes(struct super_block *sb, int n,
                 }
 
                 for (i = 0; i < blocks; i++) {
-                        int size = le32_to_cpu(blist[i]);
+                        int size = squashfs_block_size(blist[i]);
+                        if (size < 0) {
+                                err = size;
+                                goto failure;
+                        }
                         block += SQUASHFS_COMPRESSED_SIZE_BLOCK(size);
                 }
                 n -= blocks;
@@ -367,7 +371,24 @@ static int read_blocklist(struct inode *inode, int index, u64 *block)
                         sizeof(size));
         if (res < 0)
                 return res;
-        return le32_to_cpu(size);
+        return squashfs_block_size(size);
+}
+
+void squashfs_fill_page(struct page *page, struct squashfs_cache_entry *buffer, int offset, int avail)
+{
+        int copied;
+        void *pageaddr;
+
+        pageaddr = kmap_atomic(page);
+        copied = squashfs_copy_data(pageaddr, buffer, offset, avail);
+        memset(pageaddr + copied, 0, PAGE_SIZE - copied);
+        kunmap_atomic(pageaddr);
+
+        flush_dcache_page(page);
+        if (copied == avail)
+                SetPageUptodate(page);
+        else
+                SetPageError(page);
 }
 
 /* Copy data into page cache  */
@@ -376,7 +397,6 @@ void squashfs_copy_cache(struct page *page, struct squashfs_cache_entry *buffer,
 {
         struct inode *inode = page->mapping->host;
         struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
-        void *pageaddr;
         int i, mask = (1 << (msblk->block_log - PAGE_SHIFT)) - 1;
         int start_index = page->index & ~mask, end_index = start_index | mask;
 
@@ -402,12 +422,7 @@ void squashfs_copy_cache(struct page *page, struct squashfs_cache_entry *buffer,
                 if (PageUptodate(push_page))
                         goto skip_page;
 
-                pageaddr = kmap_atomic(push_page);
-                squashfs_copy_data(pageaddr, buffer, offset, avail);
-                memset(pageaddr + avail, 0, PAGE_SIZE - avail);
-                kunmap_atomic(pageaddr);
-                flush_dcache_page(push_page);
-                SetPageUptodate(push_page);
+                squashfs_fill_page(push_page, buffer, offset, avail);
 skip_page:
                 unlock_page(push_page);
                 if (i != page->index)
@@ -416,10 +431,9 @@ skip_page:
 }
 
 /* Read datablock stored packed inside a fragment (tail-end packed block) */
-static int squashfs_readpage_fragment(struct page *page)
+static int squashfs_readpage_fragment(struct page *page, int expected)
 {
         struct inode *inode = page->mapping->host;
-        struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
         struct squashfs_cache_entry *buffer = squashfs_get_fragment(inode->i_sb,
                 squashfs_i(inode)->fragment_block,
                 squashfs_i(inode)->fragment_size);
@@ -430,23 +444,16 @@ static int squashfs_readpage_fragment(struct page *page)
                         squashfs_i(inode)->fragment_block,
                         squashfs_i(inode)->fragment_size);
         else
-                squashfs_copy_cache(page, buffer, i_size_read(inode) &
-                        (msblk->block_size - 1),
+                squashfs_copy_cache(page, buffer, expected,
                         squashfs_i(inode)->fragment_offset);
 
         squashfs_cache_put(buffer);
         return res;
 }
 
-static int squashfs_readpage_sparse(struct page *page, int index, int file_end)
+static int squashfs_readpage_sparse(struct page *page, int expected)
 {
-        struct inode *inode = page->mapping->host;
-        struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
-        int bytes = index == file_end ?
-                        (i_size_read(inode) & (msblk->block_size - 1)) :
-                         msblk->block_size;
-
-        squashfs_copy_cache(page, NULL, bytes, 0);
+        squashfs_copy_cache(page, NULL, expected, 0);
         return 0;
 }
 
@@ -456,6 +463,9 @@ static int squashfs_readpage(struct file *file, struct page *page)
         struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
         int index = page->index >> (msblk->block_log - PAGE_SHIFT);
         int file_end = i_size_read(inode) >> msblk->block_log;
+        int expected = index == file_end ?
+                        (i_size_read(inode) & (msblk->block_size - 1)) :
+                         msblk->block_size;
         int res;
         void *pageaddr;
 
@@ -474,11 +484,11 @@ static int squashfs_readpage(struct file *file, struct page *page)
                         goto error_out;
 
                 if (bsize == 0)
-                        res = squashfs_readpage_sparse(page, index, file_end);
+                        res = squashfs_readpage_sparse(page, expected);
                 else
-                        res = squashfs_readpage_block(page, block, bsize);
+                        res = squashfs_readpage_block(page, block, bsize, expected);
         } else
-                res = squashfs_readpage_fragment(page);
+                res = squashfs_readpage_fragment(page, expected);
 
         if (!res)
                 return 0;
diff --git a/fs/squashfs/file_cache.c b/fs/squashfs/file_cache.c
index f2310d2a2019..a9ba8d96776a 100644
--- a/fs/squashfs/file_cache.c
+++ b/fs/squashfs/file_cache.c
@@ -20,7 +20,7 @@
 #include "squashfs.h"
 
 /* Read separately compressed datablock and memcopy into page cache */
-int squashfs_readpage_block(struct page *page, u64 block, int bsize)
+int squashfs_readpage_block(struct page *page, u64 block, int bsize, int expected)
 {
         struct inode *i = page->mapping->host;
         struct squashfs_cache_entry *buffer = squashfs_get_datablock(i->i_sb,
@@ -31,7 +31,7 @@ int squashfs_readpage_block(struct page *page, u64 block, int bsize)
                 ERROR("Unable to read page, block %llx, size %x\n", block,
                         bsize);
         else
-                squashfs_copy_cache(page, buffer, buffer->length, 0);
+                squashfs_copy_cache(page, buffer, expected, 0);
 
         squashfs_cache_put(buffer);
         return res;
diff --git a/fs/squashfs/file_direct.c b/fs/squashfs/file_direct.c
index cb485d8e0e91..80db1b86a27c 100644
--- a/fs/squashfs/file_direct.c
+++ b/fs/squashfs/file_direct.c
@@ -21,10 +21,11 @@
 #include "page_actor.h"
 
 static int squashfs_read_cache(struct page *target_page, u64 block, int bsize,
-        int pages, struct page **page);
+        int pages, struct page **page, int bytes);
 
 /* Read separately compressed datablock directly into page cache */
-int squashfs_readpage_block(struct page *target_page, u64 block, int bsize)
+int squashfs_readpage_block(struct page *target_page, u64 block, int bsize,
+        int expected)
 
 {
         struct inode *inode = target_page->mapping->host;
@@ -83,7 +84,7 @@ int squashfs_readpage_block(struct page *target_page, u64 block, int bsize)
                  * using an intermediate buffer.
                  */
                 res = squashfs_read_cache(target_page, block, bsize, pages,
-                                                                page);
+                                                        page, expected);
                 if (res < 0)
                         goto mark_errored;
 
@@ -95,6 +96,11 @@ int squashfs_readpage_block(struct page *target_page, u64 block, int bsize)
         if (res < 0)
                 goto mark_errored;
 
+        if (res != expected) {
+                res = -EIO;
+                goto mark_errored;
+        }
+
         /* Last page may have trailing bytes not filled */
         bytes = res % PAGE_SIZE;
         if (bytes) {
@@ -138,13 +144,12 @@ out:
 
 
 static int squashfs_read_cache(struct page *target_page, u64 block, int bsize,
-        int pages, struct page **page)
+        int pages, struct page **page, int bytes)
 {
         struct inode *i = target_page->mapping->host;
         struct squashfs_cache_entry *buffer = squashfs_get_datablock(i->i_sb,
                                                  block, bsize);
-        int bytes = buffer->length, res = buffer->error, n, offset = 0;
-        void *pageaddr;
+        int res = buffer->error, n, offset = 0;
 
         if (res) {
                 ERROR("Unable to read page, block %llx, size %x\n", block,
@@ -159,12 +164,7 @@ static int squashfs_read_cache(struct page *target_page, u64 block, int bsize,
                 if (page[n] == NULL)
                         continue;
 
-                pageaddr = kmap_atomic(page[n]);
-                squashfs_copy_data(pageaddr, buffer, offset, avail);
-                memset(pageaddr + avail, 0, PAGE_SIZE - avail);
-                kunmap_atomic(pageaddr);
-                flush_dcache_page(page[n]);
-                SetPageUptodate(page[n]);
+                squashfs_fill_page(page[n], buffer, offset, avail);
                 unlock_page(page[n]);
                 if (page[n] != target_page)
                         put_page(page[n]);
diff --git a/fs/squashfs/fragment.c b/fs/squashfs/fragment.c
index 0ed6edbc5c71..0681feab4a84 100644
--- a/fs/squashfs/fragment.c
+++ b/fs/squashfs/fragment.c
@@ -49,11 +49,16 @@ int squashfs_frag_lookup(struct super_block *sb, unsigned int fragment,
                                 u64 *fragment_block)
 {
         struct squashfs_sb_info *msblk = sb->s_fs_info;
-        int block = SQUASHFS_FRAGMENT_INDEX(fragment);
-        int offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment);
-        u64 start_block = le64_to_cpu(msblk->fragment_index[block]);
+        int block, offset, size;
         struct squashfs_fragment_entry fragment_entry;
-        int size;
+        u64 start_block;
+
+        if (fragment >= msblk->fragments)
+                return -EIO;
+        block = SQUASHFS_FRAGMENT_INDEX(fragment);
+        offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment);
+
+        start_block = le64_to_cpu(msblk->fragment_index[block]);
 
         size = squashfs_read_metadata(sb, &fragment_entry, &start_block,
                                         &offset, sizeof(fragment_entry));
@@ -61,9 +66,7 @@ int squashfs_frag_lookup(struct super_block *sb, unsigned int fragment,
                 return size;
 
         *fragment_block = le64_to_cpu(fragment_entry.start_block);
-        size = le32_to_cpu(fragment_entry.size);
-
-        return size;
+        return squashfs_block_size(fragment_entry.size);
 }
 
 
diff --git a/fs/squashfs/squashfs.h b/fs/squashfs/squashfs.h
index 887d6d270080..f89f8a74c6ce 100644
--- a/fs/squashfs/squashfs.h
+++ b/fs/squashfs/squashfs.h
@@ -67,11 +67,12 @@ extern __le64 *squashfs_read_fragment_index_table(struct super_block *,
                                 u64, u64, unsigned int);
 
 /* file.c */
+void squashfs_fill_page(struct page *, struct squashfs_cache_entry *, int, int);
 void squashfs_copy_cache(struct page *, struct squashfs_cache_entry *, int,
                                 int);
 
 /* file_xxx.c */
-extern int squashfs_readpage_block(struct page *, u64, int);
+extern int squashfs_readpage_block(struct page *, u64, int, int);
 
 /* id.c */
 extern int squashfs_get_id(struct super_block *, unsigned int, unsigned int *);
diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h
index 24d12fd14177..4e6853f084d0 100644
--- a/fs/squashfs/squashfs_fs.h
+++ b/fs/squashfs/squashfs_fs.h
@@ -129,6 +129,12 @@
 
 #define SQUASHFS_COMPRESSED_BLOCK(B)    (!((B) & SQUASHFS_COMPRESSED_BIT_BLOCK))
 
+static inline int squashfs_block_size(__le32 raw)
+{
+        u32 size = le32_to_cpu(raw);
+        return (size >> 25) ? -EIO : size;
+}
+
 /*
  * Inode number ops.  Inodes consist of a compressed block number, and an
  * uncompressed offset within that block
diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h
index 1da565cb50c3..ef69c31947bf 100644
--- a/fs/squashfs/squashfs_fs_sb.h
+++ b/fs/squashfs/squashfs_fs_sb.h
@@ -75,6 +75,7 @@ struct squashfs_sb_info {
         unsigned short                          block_log;
         long long                               bytes_used;
         unsigned int                            inodes;
+        unsigned int                            fragments;
         int                                     xattr_ids;
 };
 #endif
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 8a73b97217c8..40e657386fa5 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -175,6 +175,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
         msblk->inode_table = le64_to_cpu(sblk->inode_table_start);
         msblk->directory_table = le64_to_cpu(sblk->directory_table_start);
         msblk->inodes = le32_to_cpu(sblk->inodes);
+        msblk->fragments = le32_to_cpu(sblk->fragments);
         flags = le16_to_cpu(sblk->flags);
 
         TRACE("Found valid superblock on %pg\n", sb->s_bdev);
@@ -185,7 +186,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
         TRACE("Filesystem size %lld bytes\n", msblk->bytes_used);
         TRACE("Block size %d\n", msblk->block_size);
         TRACE("Number of inodes %d\n", msblk->inodes);
-        TRACE("Number of fragments %d\n", le32_to_cpu(sblk->fragments));
+        TRACE("Number of fragments %d\n", msblk->fragments);
         TRACE("Number of ids %d\n", le16_to_cpu(sblk->no_ids));
         TRACE("sblk->inode_table_start %llx\n", msblk->inode_table);
         TRACE("sblk->directory_table_start %llx\n", msblk->directory_table);
@@ -272,7 +273,7 @@ allocate_id_index_table:
         sb->s_export_op = &squashfs_export_ops;
 
 handle_fragments:
-        fragments = le32_to_cpu(sblk->fragments);
+        fragments = msblk->fragments;
         if (fragments == 0)
                 goto check_directory_table;
 
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 594d192b2331..bad9cea37f12 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -633,8 +633,10 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
                 /* the various vma->vm_userfaultfd_ctx still points to it */
                 down_write(&mm->mmap_sem);
                 for (vma = mm->mmap; vma; vma = vma->vm_next)
-                        if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx)
+                        if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx) {
                                 vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
+                                vma->vm_flags &= ~(VM_UFFD_WP | VM_UFFD_MISSING);
+                        }
                 up_write(&mm->mmap_sem);
 
                 userfaultfd_ctx_put(release_new_ctx);
diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
index eef466260d43..75dbdc14c45f 100644
--- a/fs/xfs/libxfs/xfs_alloc.c
+++ b/fs/xfs/libxfs/xfs_alloc.c
@@ -223,12 +223,13 @@ xfs_alloc_get_rec(
         error = xfs_btree_get_rec(cur, &rec, stat);
         if (error || !(*stat))
                 return error;
-        if (rec->alloc.ar_blockcount == 0)
-                goto out_bad_rec;
 
         *bno = be32_to_cpu(rec->alloc.ar_startblock);
         *len = be32_to_cpu(rec->alloc.ar_blockcount);
 
+        if (*len == 0)
+                goto out_bad_rec;
+
         /* check for valid extent range, including overflow */
         if (!xfs_verify_agbno(mp, agno, *bno))
                 goto out_bad_rec;
diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c
index 33dc34655ac3..30d1d60f1d46 100644
--- a/fs/xfs/libxfs/xfs_inode_buf.c
+++ b/fs/xfs/libxfs/xfs_inode_buf.c
@@ -731,7 +731,8 @@ xfs_inode_validate_extsize(
         if ((hint_flag || inherit_flag) && extsize == 0)
                 return __this_address;
 
-        if (!(hint_flag || inherit_flag) && extsize != 0)
+        /* free inodes get flags set to zero but extsize remains */
+        if (mode && !(hint_flag || inherit_flag) && extsize != 0)
                 return __this_address;
 
         if (extsize_bytes % blocksize_bytes)
@@ -777,7 +778,8 @@ xfs_inode_validate_cowextsize(
         if (hint_flag && cowextsize == 0)
                 return __this_address;
 
-        if (!hint_flag && cowextsize != 0)
+        /* free inodes get flags set to zero but cowextsize remains */
+        if (mode && !hint_flag && cowextsize != 0)
                 return __this_address;
 
         if (hint_flag && rt_flag)
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index e3147eb74222..ca3f2c2edd85 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -287,6 +287,20 @@ void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues);
 
 void blk_mq_quiesce_queue_nowait(struct request_queue *q);
 
+/**
+ * blk_mq_mark_complete() - Set request state to complete
+ * @rq: request to set to complete state
+ *
+ * Returns true if request state was successfully set to complete. If
+ * successful, the caller is responsibile for seeing this request is ended, as
+ * blk_mq_complete_request will not work again.
+ */
+static inline bool blk_mq_mark_complete(struct request *rq)
+{
+        return cmpxchg(&rq->state, MQ_RQ_IN_FLIGHT, MQ_RQ_COMPLETE) ==
+                        MQ_RQ_IN_FLIGHT;
+}
+
 /*
  * Driver command data is immediately after the request. So subtract request
  * size to get back to the original request, add request size to get the PDU.
diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h
index 79795c5fa7c3..d50c2f0a655a 100644
--- a/include/linux/bpf-cgroup.h
+++ b/include/linux/bpf-cgroup.h
@@ -2,6 +2,7 @@
 #ifndef _BPF_CGROUP_H
 #define _BPF_CGROUP_H
 
+#include <linux/errno.h>
 #include <linux/jump_label.h>
 #include <uapi/linux/bpf.h>
 
diff --git a/include/linux/bpfilter.h b/include/linux/bpfilter.h
index 687b1760bb9f..f02cee0225d4 100644
--- a/include/linux/bpfilter.h
+++ b/include/linux/bpfilter.h
@@ -5,10 +5,10 @@
 #include <uapi/linux/bpfilter.h>
 
 struct sock;
-int bpfilter_ip_set_sockopt(struct sock *sk, int optname, char *optval,
+int bpfilter_ip_set_sockopt(struct sock *sk, int optname, char __user *optval,
                             unsigned int optlen);
-int bpfilter_ip_get_sockopt(struct sock *sk, int optname, char *optval,
-                            int *optlen);
+int bpfilter_ip_get_sockopt(struct sock *sk, int optname, char __user *optval,
+                            int __user *optlen);
 extern int (*bpfilter_process_sockopt)(struct sock *sk, int optname,
                                        char __user *optval,
                                        unsigned int optlen, bool is_set);
diff --git a/include/linux/delayacct.h b/include/linux/delayacct.h
index e6c0448ebcc7..31c865d1842e 100644
--- a/include/linux/delayacct.h
+++ b/include/linux/delayacct.h
@@ -124,7 +124,7 @@ static inline void delayacct_blkio_start(void)
 
 static inline void delayacct_blkio_end(struct task_struct *p)
 {
-        if (current->delays)
+        if (p->delays)
                 __delayacct_blkio_end(p);
         delayacct_clear_flag(DELAYACCT_PF_BLKIO);
 }
diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h
index 7094718b653b..ffcc7724ca21 100644
--- a/include/linux/eventfd.h
+++ b/include/linux/eventfd.h
@@ -11,6 +11,7 @@
 
 #include <linux/fcntl.h>
 #include <linux/wait.h>
+#include <linux/err.h>
 
 /*
  * CAREFUL: Check include/uapi/asm-generic/fcntl.h when defining
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 300baad62c88..c73dd7396886 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -765,8 +765,8 @@ static inline bool bpf_dump_raw_ok(void)
 struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
                                        const struct bpf_insn *patch, u32 len);
 
-static inline int __xdp_generic_ok_fwd_dev(struct sk_buff *skb,
-                                           struct net_device *fwd)
+static inline int xdp_ok_fwd_dev(const struct net_device *fwd,
+                                 unsigned int pktlen)
 {
         unsigned int len;
 
@@ -774,7 +774,7 @@ static inline int __xdp_generic_ok_fwd_dev(struct sk_buff *skb,
                 return -ENETDOWN;
 
         len = fwd->mtu + fwd->hard_header_len + VLAN_HLEN;
-        if (skb->len > len)
+        if (pktlen > len)
                 return -EMSGSIZE;
 
         return 0;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index d78d146a98da..805bf22898cf 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2420,6 +2420,7 @@ extern struct file *filp_open(const char *, int, umode_t);
 extern struct file *file_open_root(struct dentry *, struct vfsmount *,
                                    const char *, int, umode_t);
 extern struct file * dentry_open(const struct path *, int, const struct cred *);
+extern struct file *filp_clone_open(struct file *);
 extern int filp_close(struct file *, fl_owner_t id);
 
 extern struct filename *getname_flags(const char __user *, int, int *);
diff --git a/include/linux/fsl/guts.h b/include/linux/fsl/guts.h
index 3efa3b861d44..941b11811f85 100644
--- a/include/linux/fsl/guts.h
+++ b/include/linux/fsl/guts.h
@@ -16,6 +16,7 @@
 #define __FSL_GUTS_H__
 
 #include <linux/types.h>
+#include <linux/io.h>
 
 /**
  * Global Utility Registers.
diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h
index 7843b98e1c6e..c20c7e197d07 100644
--- a/include/linux/if_bridge.h
+++ b/include/linux/if_bridge.h
@@ -105,13 +105,13 @@ static inline bool br_vlan_enabled(const struct net_device *dev)
 
 static inline int br_vlan_get_pvid(const struct net_device *dev, u16 *p_pvid)
 {
-        return -1;
+        return -EINVAL;
 }
 
 static inline int br_vlan_get_info(const struct net_device *dev, u16 vid,
                                    struct bridge_vlan_info *p_vinfo)
 {
-        return -1;
+        return -EINVAL;
 }
 #endif
 
diff --git a/include/linux/igmp.h b/include/linux/igmp.h
index f8231854b5d6..119f53941c12 100644
--- a/include/linux/igmp.h
+++ b/include/linux/igmp.h
@@ -109,6 +109,8 @@ struct ip_mc_list {
 extern int ip_check_mc_rcu(struct in_device *dev, __be32 mc_addr, __be32 src_addr, u8 proto);
 extern int igmp_rcv(struct sk_buff *);
 extern int ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr);
+extern int ip_mc_join_group_ssm(struct sock *sk, struct ip_mreqn *imr,
+                                unsigned int mode);
 extern int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr);
 extern void ip_mc_drop_socket(struct sock *sk);
 extern int ip_mc_source(int add, int omode, struct sock *sk,
diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
index 1df940196ab2..ef169d67df92 100644
--- a/include/linux/intel-iommu.h
+++ b/include/linux/intel-iommu.h
@@ -121,6 +121,7 @@
 #define ecap_srs(e)             ((e >> 31) & 0x1)
 #define ecap_ers(e)             ((e >> 30) & 0x1)
 #define ecap_prs(e)             ((e >> 29) & 0x1)
+#define ecap_broken_pasid(e)    ((e >> 28) & 0x1)
 #define ecap_dis(e)             ((e >> 27) & 0x1)
 #define ecap_nest(e)            ((e >> 26) & 0x1)
 #define ecap_mts(e)             ((e >> 25) & 0x1)
diff --git a/include/linux/marvell_phy.h b/include/linux/marvell_phy.h
index 4f5f8c21e283..1eb6f244588d 100644
--- a/include/linux/marvell_phy.h
+++ b/include/linux/marvell_phy.h
@@ -27,6 +27,8 @@
  */
 #define MARVELL_PHY_ID_88E6390          0x01410f90
 
+#define MARVELL_PHY_FAMILY_ID(id)       ((id) >> 4)
+
 /* struct phy_device dev_flags definitions */
 #define MARVELL_PHY_M1145_FLAGS_RESISTANCE      0x00000001
 #define MARVELL_PHY_M1118_DNS323_LEDS           0x00000002
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 80cbb7fdce4a..83957920653a 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -358,6 +358,7 @@ struct mlx5_frag_buf_ctrl {
         struct mlx5_frag_buf    frag_buf;
         u32                     sz_m1;
         u32                     frag_sz_m1;
+        u32                     strides_offset;
         u8                      log_sz;
         u8                      log_stride;
         u8                      log_frag_strides;
@@ -983,14 +984,22 @@ static inline u32 mlx5_base_mkey(const u32 key)
         return key & 0xffffff00u;
 }
 
-static inline void mlx5_fill_fbc(u8 log_stride, u8 log_sz,
-                                 struct mlx5_frag_buf_ctrl *fbc)
+static inline void mlx5_fill_fbc_offset(u8 log_stride, u8 log_sz,
+                                        u32 strides_offset,
+                                        struct mlx5_frag_buf_ctrl *fbc)
 {
         fbc->log_stride = log_stride;
         fbc->log_sz     = log_sz;
         fbc->sz_m1      = (1 << fbc->log_sz) - 1;
         fbc->log_frag_strides = PAGE_SHIFT - fbc->log_stride;
         fbc->frag_sz_m1 = (1 << fbc->log_frag_strides) - 1;
+        fbc->strides_offset = strides_offset;
+}
+
+static inline void mlx5_fill_fbc(u8 log_stride, u8 log_sz,
+                                 struct mlx5_frag_buf_ctrl *fbc)
+{
+        mlx5_fill_fbc_offset(log_stride, log_sz, 0, fbc);
 }
 
 static inline void mlx5_core_init_cq_frag_buf(struct mlx5_frag_buf_ctrl *fbc,
@@ -1004,7 +1013,10 @@ static inline void mlx5_core_init_cq_frag_buf(struct mlx5_frag_buf_ctrl *fbc,
 static inline void *mlx5_frag_buf_get_wqe(struct mlx5_frag_buf_ctrl *fbc,
                                           u32 ix)
 {
-        unsigned int frag = (ix >> fbc->log_frag_strides);
+        unsigned int frag;
+
+        ix  += fbc->strides_offset;
+        frag = ix >> fbc->log_frag_strides;
 
         return fbc->frag_buf.frags[frag].buf +
                 ((fbc->frag_sz_m1 & ix) << fbc->log_stride);
diff --git a/include/linux/mm.h b/include/linux/mm.h
index a0fbb9ffe380..68a5121694ef 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -155,7 +155,9 @@ extern int overcommit_kbytes_handler(struct ctl_table *, int, void __user *,
  * mmap() functions).
  */
 
-extern struct kmem_cache *vm_area_cachep;
+struct vm_area_struct *vm_area_alloc(struct mm_struct *);
+struct vm_area_struct *vm_area_dup(struct vm_area_struct *);
+void vm_area_free(struct vm_area_struct *);
 
 #ifndef CONFIG_MMU
 extern struct rb_root nommu_region_tree;
@@ -450,6 +452,23 @@ struct vm_operations_struct {
                                           unsigned long addr);
 };
 
+static inline void vma_init(struct vm_area_struct *vma, struct mm_struct *mm)
+{
+        static const struct vm_operations_struct dummy_vm_ops = {};
+
+        vma->vm_mm = mm;
+        vma->vm_ops = &dummy_vm_ops;
+        INIT_LIST_HEAD(&vma->anon_vma_chain);
+}
+
+static inline void vma_set_anonymous(struct vm_area_struct *vma)
+{
+        vma->vm_ops = NULL;
+}
+
+/* flush_tlb_range() takes a vma, not a mm, and can care about flags */
+#define TLB_FLUSH_VMA(mm,flags) { .vm_mm = (mm), .vm_flags = (flags) }
+
 struct mmu_gather;
 struct inode;
 
@@ -2132,7 +2151,7 @@ extern int __meminit __early_pfn_to_nid(unsigned long pfn,
                                         struct mminit_pfnnid_cache *state);
 #endif
 
-#ifdef CONFIG_HAVE_MEMBLOCK
+#if defined(CONFIG_HAVE_MEMBLOCK) && !defined(CONFIG_FLAT_NODE_MEM_MAP)
 void zero_resv_unavail(void);
 #else
 static inline void zero_resv_unavail(void) {}
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 340029b2fb38..c133ccfa002e 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -368,7 +368,6 @@ struct pci_dev {
         unsigned int    transparent:1;          /* Subtractive decode bridge */
         unsigned int    multifunction:1;        /* Multi-function device */
 
-        unsigned int    is_added:1;
         unsigned int    is_busmaster:1;         /* Is busmaster */
         unsigned int    no_msi:1;               /* May not use MSI */
         unsigned int    no_64bit_msi:1;         /* May only use 32-bit MSIs */
@@ -1240,6 +1239,8 @@ int pci_register_io_range(struct fwnode_handle *fwnode, phys_addr_t addr,
 unsigned long pci_address_to_pio(phys_addr_t addr);
 phys_addr_t pci_pio_to_address(unsigned long pio);
 int pci_remap_iospace(const struct resource *res, phys_addr_t phys_addr);
+int devm_pci_remap_iospace(struct device *dev, const struct resource *res,
+                           phys_addr_t phys_addr);
 void pci_unmap_iospace(struct resource *res);
 void __iomem *devm_pci_remap_cfgspace(struct device *dev,
                                       resource_size_t offset,
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 1fa12887ec02..87f6db437e4a 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -1130,6 +1130,7 @@ extern void perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct
 extern struct perf_callchain_entry *
 get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user,
                    u32 max_stack, bool crosstask, bool add_mark);
+extern struct perf_callchain_entry *perf_callchain(struct perf_event *event, struct pt_regs *regs);
 extern int get_callchain_buffers(int max_stack);
 extern void put_callchain_buffers(void);
 
diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
index b72ebdff0b77..003d09ab308d 100644
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -165,6 +165,7 @@ void ring_buffer_record_enable(struct ring_buffer *buffer);
 void ring_buffer_record_off(struct ring_buffer *buffer);
 void ring_buffer_record_on(struct ring_buffer *buffer);
 int ring_buffer_record_is_on(struct ring_buffer *buffer);
+int ring_buffer_record_is_set_on(struct ring_buffer *buffer);
 void ring_buffer_record_disable_cpu(struct ring_buffer *buffer, int cpu);
 void ring_buffer_record_enable_cpu(struct ring_buffer *buffer, int cpu);
 
diff --git a/include/linux/rtmutex.h b/include/linux/rtmutex.h
index 1b92a28dd672..6fd615a0eea9 100644
--- a/include/linux/rtmutex.h
+++ b/include/linux/rtmutex.h
@@ -106,7 +106,14 @@ static inline int rt_mutex_is_locked(struct rt_mutex *lock)
 extern void __rt_mutex_init(struct rt_mutex *lock, const char *name, struct lock_class_key *key);
 extern void rt_mutex_destroy(struct rt_mutex *lock);
 
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+extern void rt_mutex_lock_nested(struct rt_mutex *lock, unsigned int subclass);
+#define rt_mutex_lock(lock) rt_mutex_lock_nested(lock, 0)
+#else
 extern void rt_mutex_lock(struct rt_mutex *lock);
+#define rt_mutex_lock_nested(lock, subclass) rt_mutex_lock(lock)
+#endif
+
 extern int rt_mutex_lock_interruptible(struct rt_mutex *lock);
 extern int rt_mutex_timed_lock(struct rt_mutex *lock,
                                struct hrtimer_sleeper *timeout);
diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
index 5be31eb7b266..108ede99e533 100644
--- a/include/linux/sched/task.h
+++ b/include/linux/sched/task.h
@@ -75,7 +75,7 @@ extern long _do_fork(unsigned long, unsigned long, unsigned long, int __user *,
 extern long do_fork(unsigned long, unsigned long, unsigned long, int __user *, int __user *);
 struct task_struct *fork_idle(int);
 extern pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags);
-extern long kernel_wait4(pid_t, int *, int, struct rusage *);
+extern long kernel_wait4(pid_t, int __user *, int, struct rusage *);
 
 extern void free_task(struct task_struct *tsk);
 
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 164cdedf6012..610a201126ee 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -630,6 +630,7 @@ typedef unsigned char *sk_buff_data_t;
  *      @hash: the packet hash
  *      @queue_mapping: Queue mapping for multiqueue devices
  *      @xmit_more: More SKBs are pending for this queue
+ *      @pfmemalloc: skbuff was allocated from PFMEMALLOC reserves
  *      @ndisc_nodetype: router type (from link layer)
  *      @ooo_okay: allow the mapping of a socket to a queue to be changed
  *      @l4_hash: indicate hash is a canonical 4-tuple hash over transport
@@ -735,7 +736,7 @@ struct sk_buff {
                                 peeked:1,
                                 head_frag:1,
                                 xmit_more:1,
-                                __unused:1; /* one bit hole */
+                                pfmemalloc:1;
 
         /* fields enclosed in headers_start/headers_end are copied
          * using a single memcpy() in __copy_skb_header()
@@ -754,31 +755,30 @@ struct sk_buff {
 
         __u8                    __pkt_type_offset[0];
         __u8                    pkt_type:3;
-        __u8                    pfmemalloc:1;
         __u8                    ignore_df:1;
-
         __u8                    nf_trace:1;
         __u8                    ip_summed:2;
         __u8                    ooo_okay:1;
+
         __u8                    l4_hash:1;
         __u8                    sw_hash:1;
         __u8                    wifi_acked_valid:1;
         __u8                    wifi_acked:1;
-
         __u8                    no_fcs:1;
         /* Indicates the inner headers are valid in the skbuff. */
         __u8                    encapsulation:1;
         __u8                    encap_hdr_csum:1;
         __u8                    csum_valid:1;
+
         __u8                    csum_complete_sw:1;
         __u8                    csum_level:2;
         __u8                    csum_not_inet:1;
-
         __u8                    dst_pending_confirm:1;
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
         __u8                    ndisc_nodetype:2;
 #endif
         __u8                    ipvs_property:1;
+
         __u8                    inner_protocol_type:1;
         __u8                    remcsum_offload:1;
 #ifdef CONFIG_NET_SWITCHDEV
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index a368a68cb667..5c1a0933768e 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -11,6 +11,7 @@
 #ifndef _LINUX_SYSCALLS_H
 #define _LINUX_SYSCALLS_H
 
+struct __aio_sigset;
 struct epoll_event;
 struct iattr;
 struct inode;
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 5fbfe61f41c6..1beb3ead0385 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -5835,10 +5835,11 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
 /**
  * cfg80211_rx_control_port - notification about a received control port frame
  * @dev: The device the frame matched to
- * @buf: control port frame
- * @len: length of the frame data
- * @addr: The peer from which the frame was received
- * @proto: frame protocol, typically PAE or Pre-authentication
+ * @skb: The skbuf with the control port frame.  It is assumed that the skbuf
+ *      is 802.3 formatted (with 802.3 header).  The skb can be non-linear.
+ *      This function does not take ownership of the skb, so the caller is
+ *      responsible for any cleanup.  The caller must also ensure that
+ *      skb->protocol is set appropriately.
  * @unencrypted: Whether the frame was received unencrypted
  *
  * This function is used to inform userspace about a received control port
@@ -5851,8 +5852,7 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
  * Return: %true if the frame was passed to userspace
  */
 bool cfg80211_rx_control_port(struct net_device *dev,
-                              const u8 *buf, size_t len,
-                              const u8 *addr, u16 proto, bool unencrypted);
+                              struct sk_buff *skb, bool unencrypted);
 
 /**
  * cfg80211_cqm_rssi_notify - connection quality monitoring rssi event
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 71b9043aa0e7..3d4930528db0 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -281,6 +281,11 @@ static inline void fib6_info_hold(struct fib6_info *f6i)
         atomic_inc(&f6i->fib6_ref);
 }
 
+static inline bool fib6_info_hold_safe(struct fib6_info *f6i)
+{
+        return atomic_inc_not_zero(&f6i->fib6_ref);
+}
+
 static inline void fib6_info_release(struct fib6_info *f6i)
 {
         if (f6i && atomic_dec_and_test(&f6i->fib6_ref))
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 59656fc580df..7b9c82de11cc 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -66,6 +66,12 @@ static inline bool rt6_need_strict(const struct in6_addr *daddr)
                 (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
 }
 
+static inline bool rt6_qualify_for_ecmp(const struct fib6_info *f6i)
+{
+        return (f6i->fib6_flags & (RTF_GATEWAY|RTF_ADDRCONF|RTF_DYNAMIC)) ==
+               RTF_GATEWAY;
+}
+
 void ip6_route_input(struct sk_buff *skb);
 struct dst_entry *ip6_route_input_lookup(struct net *net,
                                          struct net_device *dev,
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 16475c269749..8f73be494503 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -355,14 +355,7 @@ struct ipv6_txoptions *ipv6_dup_options(struct sock *sk,
 struct ipv6_txoptions *ipv6_renew_options(struct sock *sk,
                                           struct ipv6_txoptions *opt,
                                           int newtype,
-                                          struct ipv6_opt_hdr __user *newopt,
-                                          int newoptlen);
-struct ipv6_txoptions *
-ipv6_renew_options_kern(struct sock *sk,
-                        struct ipv6_txoptions *opt,
-                        int newtype,
-                        struct ipv6_opt_hdr *newopt,
-                        int newoptlen);
+                                          struct ipv6_opt_hdr *newopt);
 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
                                           struct ipv6_txoptions *opt);
 
@@ -830,7 +823,7 @@ static inline __be32 ip6_make_flowlabel(struct net *net, struct sk_buff *skb,
          * to minimize possbility that any useful information to an
          * attacker is leaked. Only lower 20 bits are relevant.
          */
-        rol32(hash, 16);
+        hash = rol32(hash, 16);
 
         flowlabel = (__force __be32)hash & IPV6_FLOWLABEL_MASK;
 
@@ -1107,6 +1100,8 @@ void ipv6_sysctl_unregister(void);
 
 int ipv6_sock_mc_join(struct sock *sk, int ifindex,
                       const struct in6_addr *addr);
+int ipv6_sock_mc_join_ssm(struct sock *sk, int ifindex,
+                          const struct in6_addr *addr, unsigned int mode);
 int ipv6_sock_mc_drop(struct sock *sk, int ifindex,
                       const struct in6_addr *addr);
 #endif /* _NET_IPV6_H */
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 08c005ce56e9..dc417ef0a0c5 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -150,6 +150,7 @@ static inline void nft_data_debug(const struct nft_data *data)
  *      @portid: netlink portID of the original message
  *      @seq: netlink sequence number
  *      @family: protocol family
+ *      @level: depth of the chains
  *      @report: notify via unicast netlink message
  */
 struct nft_ctx {
@@ -160,6 +161,7 @@ struct nft_ctx {
         u32                             portid;
         u32                             seq;
         u8                              family;
+        u8                              level;
         bool                            report;
 };
 
@@ -865,7 +867,6 @@ enum nft_chain_flags {
  *      @table: table that this chain belongs to
  *      @handle: chain handle
  *      @use: number of jump references to this chain
- *      @level: length of longest path to this chain
  *      @flags: bitmask of enum nft_chain_flags
  *      @name: name of the chain
  */
@@ -878,7 +879,6 @@ struct nft_chain {
         struct nft_table                *table;
         u64                             handle;
         u32                             use;
-        u16                             level;
         u8                              flags:6,
                                         genmask:2;
         char                            *name;
@@ -1124,7 +1124,6 @@ struct nft_flowtable {
         u32                             genmask:2,
                                         use:30;
         u64                             handle;
-        char                            *dev_name[NFT_FLOWTABLE_DEVICE_MAX];
         /* runtime data below here */
         struct nf_hook_ops              *ops ____cacheline_aligned;
         struct nf_flowtable             data;
diff --git a/include/net/netfilter/nf_tables_core.h b/include/net/netfilter/nf_tables_core.h
index e0c0c2558ec4..a05134507e7b 100644
--- a/include/net/netfilter/nf_tables_core.h
+++ b/include/net/netfilter/nf_tables_core.h
@@ -65,4 +65,10 @@ extern const struct nft_expr_ops nft_payload_fast_ops;
 extern struct static_key_false nft_counters_enabled;
 extern struct static_key_false nft_trace_enabled;
 
+extern struct nft_set_type nft_set_rhash_type;
+extern struct nft_set_type nft_set_hash_type;
+extern struct nft_set_type nft_set_hash_fast_type;
+extern struct nft_set_type nft_set_rbtree_type;
+extern struct nft_set_type nft_set_bitmap_type;
+
 #endif /* _NET_NF_TABLES_CORE_H */
diff --git a/include/net/netfilter/nf_tproxy.h b/include/net/netfilter/nf_tproxy.h
index 9754a50ecde9..4cc64c8446eb 100644
--- a/include/net/netfilter/nf_tproxy.h
+++ b/include/net/netfilter/nf_tproxy.h
@@ -64,7 +64,7 @@ nf_tproxy_handle_time_wait4(struct net *net, struct sk_buff *skb,
  * belonging to established connections going through that one.
  */
 struct sock *
-nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb, void *hp,
+nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb,
                       const u8 protocol,
                       const __be32 saddr, const __be32 daddr,
                       const __be16 sport, const __be16 dport,
@@ -103,7 +103,7 @@ nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
                             struct sock *sk);
 
 struct sock *
-nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff, void *hp,
+nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
                       const u8 protocol,
                       const struct in6_addr *saddr, const struct in6_addr *daddr,
                       const __be16 sport, const __be16 dport,
diff --git a/include/net/tc_act/tc_csum.h b/include/net/tc_act/tc_csum.h
index 9470fd7e4350..32d2454c0479 100644
--- a/include/net/tc_act/tc_csum.h
+++ b/include/net/tc_act/tc_csum.h
@@ -7,7 +7,6 @@
 #include <linux/tc_act/tc_csum.h>
 
 struct tcf_csum_params {
-        int action;
         u32 update_flags;
         struct rcu_head rcu;
 };
diff --git a/include/net/tc_act/tc_tunnel_key.h b/include/net/tc_act/tc_tunnel_key.h
index efef0b4b1b2b..46b8c7f1c8d5 100644
--- a/include/net/tc_act/tc_tunnel_key.h
+++ b/include/net/tc_act/tc_tunnel_key.h
@@ -18,7 +18,6 @@
 struct tcf_tunnel_key_params {
         struct rcu_head         rcu;
         int                     tcft_action;
-        int                     action;
         struct metadata_dst     *tcft_enc_metadata;
 };
 
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 800582b5dd54..cd3ecda9386a 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -342,6 +342,7 @@ ssize_t tcp_splice_read(struct socket *sk, loff_t *ppos,
                         struct pipe_inode_info *pipe, size_t len,
                         unsigned int flags);
 
+void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks);
 static inline void tcp_dec_quickack_mode(struct sock *sk,
                                          const unsigned int pkts)
 {
@@ -539,6 +540,7 @@ void tcp_send_fin(struct sock *sk);
 void tcp_send_active_reset(struct sock *sk, gfp_t priority);
 int tcp_send_synack(struct sock *);
 void tcp_push_one(struct sock *, unsigned int mss_now);
+void __tcp_send_ack(struct sock *sk, u32 rcv_nxt);
 void tcp_send_ack(struct sock *sk);
 void tcp_send_delayed_ack(struct sock *sk);
 void tcp_send_loss_probe(struct sock *sk);
@@ -828,6 +830,10 @@ struct tcp_skb_cb {
 
 #define TCP_SKB_CB(__skb)       ((struct tcp_skb_cb *)&((__skb)->cb[0]))
 
+static inline void bpf_compute_data_end_sk_skb(struct sk_buff *skb)
+{
+        TCP_SKB_CB(skb)->bpf.data_end = skb->data + skb_headlen(skb);
+}
 
 #if IS_ENABLED(CONFIG_IPV6)
 /* This is the variant of inet6_iif() that must be used by TCP,
@@ -835,6 +841,11 @@ struct tcp_skb_cb {
  */
 static inline int tcp_v6_iif(const struct sk_buff *skb)
 {
+        return TCP_SKB_CB(skb)->header.h6.iif;
+}
+
+static inline int tcp_v6_iif_l3_slave(const struct sk_buff *skb)
+{
         bool l3_slave = ipv6_l3mdev_skb(TCP_SKB_CB(skb)->header.h6.flags);
 
         return l3_slave ? skb->skb_iif : TCP_SKB_CB(skb)->header.h6.iif;
@@ -908,8 +919,6 @@ enum tcp_ca_event {
         CA_EVENT_LOSS,          /* loss timeout */
         CA_EVENT_ECN_NO_CE,     /* ECT set, but not CE marked */
         CA_EVENT_ECN_IS_CE,     /* received CE marked IP packet */
-        CA_EVENT_DELAYED_ACK,   /* Delayed ack is sent */
-        CA_EVENT_NON_DELAYED_ACK,
 };
 
 /* Information about inbound ACK, passed to cong_ops->in_ack_event() */
diff --git a/include/net/xdp_sock.h b/include/net/xdp_sock.h
index 9fe472f2ac95..7161856bcf9c 100644
--- a/include/net/xdp_sock.h
+++ b/include/net/xdp_sock.h
@@ -60,6 +60,10 @@ struct xdp_sock {
         bool zc;
         /* Protects multiple processes in the control path */
         struct mutex mutex;
+        /* Mutual exclusion of NAPI TX thread and sendmsg error paths
+         * in the SKB destructor callback.
+         */
+        spinlock_t tx_completion_lock;
         u64 rx_dropped;
 };
 
diff --git a/include/uapi/linux/aio_abi.h b/include/uapi/linux/aio_abi.h
index 3c5038b587ba..d4593a6062ef 100644
--- a/include/uapi/linux/aio_abi.h
+++ b/include/uapi/linux/aio_abi.h
@@ -29,7 +29,6 @@
 
 #include <linux/types.h>
 #include <linux/fs.h>
-#include <linux/signal.h>
 #include <asm/byteorder.h>
 
 typedef __kernel_ulong_t aio_context_t;
@@ -110,10 +109,5 @@ struct iocb {
 #undef IFBIG
 #undef IFLITTLE
 
-struct __aio_sigset {
-        const sigset_t __user   *sigmask;
-        size_t          sigsetsize;
-};
-
 #endif /* __LINUX__AIO_ABI_H */
 
diff --git a/include/uapi/linux/btf.h b/include/uapi/linux/btf.h
index 0b5ddbe135a4..972265f32871 100644
--- a/include/uapi/linux/btf.h
+++ b/include/uapi/linux/btf.h
@@ -76,7 +76,7 @@ struct btf_type {
  */
 #define BTF_INT_ENCODING(VAL)   (((VAL) & 0x0f000000) >> 24)
 #define BTF_INT_OFFSET(VAL)     (((VAL  & 0x00ff0000)) >> 16)
-#define BTF_INT_BITS(VAL)       ((VAL)  & 0x0000ffff)
+#define BTF_INT_BITS(VAL)       ((VAL)  & 0x000000ff)
 
 /* Attributes stored in the BTF_INT_ENCODING */
 #define BTF_INT_SIGNED  (1 << 0)
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index 4ca65b56084f..7363f18e65a5 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -226,7 +226,7 @@ enum tunable_id {
         ETHTOOL_TX_COPYBREAK,
         ETHTOOL_PFC_PREVENTION_TOUT, /* timeout in msecs */
         /*
-         * Add your fresh new tubale attribute above and remember to update
+         * Add your fresh new tunable attribute above and remember to update
          * tunable_strings[] in net/core/ethtool.c
          */
         __ETHTOOL_TUNABLE_COUNT,
diff --git a/include/uapi/linux/perf_event.h b/include/uapi/linux/perf_event.h
index b8e288a1f740..eeb787b1c53c 100644
--- a/include/uapi/linux/perf_event.h
+++ b/include/uapi/linux/perf_event.h
@@ -143,6 +143,8 @@ enum perf_event_sample_format {
         PERF_SAMPLE_PHYS_ADDR                   = 1U << 19,
 
         PERF_SAMPLE_MAX = 1U << 20,             /* non-ABI */
+
+        __PERF_SAMPLE_CALLCHAIN_EARLY           = 1ULL << 63,
 };
 
 /*
diff --git a/include/uapi/linux/tcp.h b/include/uapi/linux/tcp.h
index 29eb659aa77a..e3f6ed8a7064 100644
--- a/include/uapi/linux/tcp.h
+++ b/include/uapi/linux/tcp.h
@@ -127,6 +127,10 @@ enum {
 
 #define TCP_CM_INQ              TCP_INQ
 
+#define TCP_REPAIR_ON           1
+#define TCP_REPAIR_OFF          0
+#define TCP_REPAIR_OFF_NO_WP    -1      /* Turn off without window probes */
+
 struct tcp_repair_opt {
         __u32   opt_code;
         __u32   opt_val;
diff --git a/ipc/sem.c b/ipc/sem.c
index 5af1943ad782..76e95e4f3aa2 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -2118,7 +2118,7 @@ static long do_semtimedop(int semid, struct sembuf __user *tsops,
         }
 
         do {
-                queue.status = -EINTR;
+                WRITE_ONCE(queue.status, -EINTR);
                 queue.sleeper = current;
 
                 __set_current_state(TASK_INTERRUPTIBLE);
diff --git a/ipc/shm.c b/ipc/shm.c
index 051a3e1fb8df..fefa00d310fb 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -427,6 +427,17 @@ static int shm_split(struct vm_area_struct *vma, unsigned long addr)
         return 0;
 }
 
+static unsigned long shm_pagesize(struct vm_area_struct *vma)
+{
+        struct file *file = vma->vm_file;
+        struct shm_file_data *sfd = shm_file_data(file);
+
+        if (sfd->vm_ops->pagesize)
+                return sfd->vm_ops->pagesize(vma);
+
+        return PAGE_SIZE;
+}
+
 #ifdef CONFIG_NUMA
 static int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new)
 {
@@ -554,6 +565,7 @@ static const struct vm_operations_struct shm_vm_ops = {
         .close  = shm_close,    /* callback for when the vm-area is released */
         .fault  = shm_fault,
         .split  = shm_split,
+        .pagesize = shm_pagesize,
 #if defined(CONFIG_NUMA)
         .set_policy = shm_set_policy,
         .get_policy = shm_get_policy,
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index ceb1c4596c51..80d672a11088 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1279,8 +1279,12 @@ static void show_special(struct audit_context *context, int *call_panic)
                 break;
         case AUDIT_KERN_MODULE:
                 audit_log_format(ab, "name=");
-                audit_log_untrustedstring(ab, context->module.name);
-                kfree(context->module.name);
+                if (context->module.name) {
+                        audit_log_untrustedstring(ab, context->module.name);
+                        kfree(context->module.name);
+                } else
+                        audit_log_format(ab, "(null)");
+
                 break;
         }
         audit_log_end(ab);
@@ -2411,8 +2415,9 @@ void __audit_log_kern_module(char *name)
 {
         struct audit_context *context = audit_context();
 
-        context->module.name = kmalloc(strlen(name) + 1, GFP_KERNEL);
-        strcpy(context->module.name, name);
+        context->module.name = kstrdup(name, GFP_KERNEL);
+        if (!context->module.name)
+                audit_log_lost("out of memory in __audit_log_kern_module");
         context->type = AUDIT_KERN_MODULE;
 }
 
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 544e58f5f642..2aa55d030c77 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -378,7 +378,7 @@ static int array_map_check_btf(const struct bpf_map *map, const struct btf *btf,
                 return -EINVAL;
 
         value_type = btf_type_id_size(btf, &btf_value_id, &value_size);
-        if (!value_type || value_size > map->value_size)
+        if (!value_type || value_size != map->value_size)
                 return -EINVAL;
 
         return 0;
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 2d49d18b793a..2590700237c1 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -450,7 +450,7 @@ static const struct btf_type *btf_type_by_id(const struct btf *btf, u32 type_id)
  */
 static bool btf_type_int_is_regular(const struct btf_type *t)
 {
-        u16 nr_bits, nr_bytes;
+        u8 nr_bits, nr_bytes;
         u32 int_data;
 
         int_data = btf_type_int(t);
@@ -991,38 +991,38 @@ static void btf_int_bits_seq_show(const struct btf *btf,
                                   void *data, u8 bits_offset,
                                   struct seq_file *m)
 {
+        u16 left_shift_bits, right_shift_bits;
         u32 int_data = btf_type_int(t);
-        u16 nr_bits = BTF_INT_BITS(int_data);
-        u16 total_bits_offset;
-        u16 nr_copy_bytes;
-        u16 nr_copy_bits;
-        u8 nr_upper_bits;
-        union {
-                u64 u64_num;
-                u8  u8_nums[8];
-        } print_num;
+        u8 nr_bits = BTF_INT_BITS(int_data);
+        u8 total_bits_offset;
+        u8 nr_copy_bytes;
+        u8 nr_copy_bits;
+        u64 print_num;
 
+        /*
+         * bits_offset is at most 7.
+         * BTF_INT_OFFSET() cannot exceed 64 bits.
+         */
         total_bits_offset = bits_offset + BTF_INT_OFFSET(int_data);
         data += BITS_ROUNDDOWN_BYTES(total_bits_offset);
         bits_offset = BITS_PER_BYTE_MASKED(total_bits_offset);
         nr_copy_bits = nr_bits + bits_offset;
         nr_copy_bytes = BITS_ROUNDUP_BYTES(nr_copy_bits);
 
-        print_num.u64_num = 0;
-        memcpy(&print_num.u64_num, data, nr_copy_bytes);
-
-        /* Ditch the higher order bits */
-        nr_upper_bits = BITS_PER_BYTE_MASKED(nr_copy_bits);
-        if (nr_upper_bits) {
-                /* We need to mask out some bits of the upper byte. */
-                u8 mask = (1 << nr_upper_bits) - 1;
+        print_num = 0;
+        memcpy(&print_num, data, nr_copy_bytes);
 
-                print_num.u8_nums[nr_copy_bytes - 1] &= mask;
-        }
+#ifdef __BIG_ENDIAN_BITFIELD
+        left_shift_bits = bits_offset;
+#else
+        left_shift_bits = BITS_PER_U64 - nr_copy_bits;
+#endif
+        right_shift_bits = BITS_PER_U64 - nr_bits;
 
-        print_num.u64_num >>= bits_offset;
+        print_num <<= left_shift_bits;
+        print_num >>= right_shift_bits;
 
-        seq_printf(m, "0x%llx", print_num.u64_num);
+        seq_printf(m, "0x%llx", print_num);
 }
 
 static void btf_int_seq_show(const struct btf *btf, const struct btf_type *t,
@@ -1032,7 +1032,7 @@ static void btf_int_seq_show(const struct btf *btf, const struct btf_type *t,
         u32 int_data = btf_type_int(t);
         u8 encoding = BTF_INT_ENCODING(int_data);
         bool sign = encoding & BTF_INT_SIGNED;
-        u32 nr_bits = BTF_INT_BITS(int_data);
+        u8 nr_bits = BTF_INT_BITS(int_data);
 
         if (bits_offset || BTF_INT_OFFSET(int_data) ||
             BITS_PER_BYTE_MASKED(nr_bits)) {
@@ -1519,9 +1519,9 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
 {
         bool is_union = BTF_INFO_KIND(t->info) == BTF_KIND_UNION;
         const struct btf_member *member;
+        u32 meta_needed, last_offset;
         struct btf *btf = env->btf;
         u32 struct_size = t->size;
-        u32 meta_needed;
         u16 i;
 
         meta_needed = btf_type_vlen(t) * sizeof(*member);
@@ -1534,6 +1534,7 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
 
         btf_verifier_log_type(env, t, NULL);
 
+        last_offset = 0;
         for_each_member(i, t, member) {
                 if (!btf_name_offset_valid(btf, member->name_off)) {
                         btf_verifier_log_member(env, t, member,
@@ -1555,6 +1556,16 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
                         return -EINVAL;
                 }
 
+                /*
+                 * ">" instead of ">=" because the last member could be
+                 * "char a[0];"
+                 */
+                if (last_offset > member->offset) {
+                        btf_verifier_log_member(env, t, member,
+                                                "Invalid member bits_offset");
+                        return -EINVAL;
+                }
+
                 if (BITS_ROUNDUP_BYTES(member->offset) > struct_size) {
                         btf_verifier_log_member(env, t, member,
                                                 "Memmber bits_offset exceeds its struct size");
@@ -1562,6 +1573,7 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
                 }
 
                 btf_verifier_log_member(env, t, member, NULL);
+                last_offset = member->offset;
         }
 
         return meta_needed;
diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index 642c97f6d1b8..d361fc1e3bf3 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -334,10 +334,15 @@ int dev_map_enqueue(struct bpf_dtab_netdev *dst, struct xdp_buff *xdp,
 {
         struct net_device *dev = dst->dev;
         struct xdp_frame *xdpf;
+        int err;
 
         if (!dev->netdev_ops->ndo_xdp_xmit)
                 return -EOPNOTSUPP;
 
+        err = xdp_ok_fwd_dev(dev, xdp->data_end - xdp->data);
+        if (unlikely(err))
+                return err;
+
         xdpf = convert_to_xdp_frame(xdp);
         if (unlikely(!xdpf))
                 return -EOVERFLOW;
@@ -350,7 +355,7 @@ int dev_map_generic_redirect(struct bpf_dtab_netdev *dst, struct sk_buff *skb,
 {
         int err;
 
-        err = __xdp_generic_ok_fwd_dev(skb, dst->dev);
+        err = xdp_ok_fwd_dev(dst->dev, skb->len);
         if (unlikely(err))
                 return err;
         skb->dev = dst->dev;
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 3ca2198a6d22..513d9dfcf4ee 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -747,13 +747,15 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
                                  * old element will be freed immediately.
                                  * Otherwise return an error
                                  */
-                                atomic_dec(&htab->count);
-                                return ERR_PTR(-E2BIG);
+                                l_new = ERR_PTR(-E2BIG);
+                                goto dec_count;
                         }
                 l_new = kmalloc_node(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN,
                                      htab->map.numa_node);
-                if (!l_new)
-                        return ERR_PTR(-ENOMEM);
+                if (!l_new) {
+                        l_new = ERR_PTR(-ENOMEM);
+                        goto dec_count;
+                }
         }
 
         memcpy(l_new->key, key, key_size);
@@ -766,7 +768,8 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
                                                   GFP_ATOMIC | __GFP_NOWARN);
                         if (!pptr) {
                                 kfree(l_new);
-                                return ERR_PTR(-ENOMEM);
+                                l_new = ERR_PTR(-ENOMEM);
+                                goto dec_count;
                         }
                 }
 
@@ -780,6 +783,9 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
 
         l_new->hash = hash;
         return l_new;
+dec_count:
+        atomic_dec(&htab->count);
+        return l_new;
 }
 
 static int check_flags(struct bpf_htab *htab, struct htab_elem *l_old,
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index cf7b6a6dbd1f..98fb7938beea 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -312,10 +312,12 @@ static void bpf_tcp_close(struct sock *sk, long timeout)
         struct smap_psock *psock;
         struct sock *osk;
 
+        lock_sock(sk);
         rcu_read_lock();
         psock = smap_psock_sk(sk);
         if (unlikely(!psock)) {
                 rcu_read_unlock();
+                release_sock(sk);
                 return sk->sk_prot->close(sk, timeout);
         }
 
@@ -371,6 +373,7 @@ static void bpf_tcp_close(struct sock *sk, long timeout)
                 e = psock_map_pop(sk, psock);
         }
         rcu_read_unlock();
+        release_sock(sk);
         close_fun(sk, timeout);
 }
 
@@ -568,7 +571,8 @@ static int free_sg(struct sock *sk, int start, struct sk_msg_buff *md)
         while (sg[i].length) {
                 free += sg[i].length;
                 sk_mem_uncharge(sk, sg[i].length);
-                put_page(sg_page(&sg[i]));
+                if (!md->skb)
+                        put_page(sg_page(&sg[i]));
                 sg[i].length = 0;
                 sg[i].page_link = 0;
                 sg[i].offset = 0;
@@ -577,6 +581,8 @@ static int free_sg(struct sock *sk, int start, struct sk_msg_buff *md)
                 if (i == MAX_SKB_FRAGS)
                         i = 0;
         }
+        if (md->skb)
+                consume_skb(md->skb);
 
         return free;
 }
@@ -1230,7 +1236,7 @@ static int smap_verdict_func(struct smap_psock *psock, struct sk_buff *skb)
          */
         TCP_SKB_CB(skb)->bpf.sk_redir = NULL;
         skb->sk = psock->sock;
-        bpf_compute_data_pointers(skb);
+        bpf_compute_data_end_sk_skb(skb);
         preempt_disable();
         rc = (*prog->bpf_func)(skb, prog->insnsi);
         preempt_enable();
@@ -1485,7 +1491,7 @@ static int smap_parse_func_strparser(struct strparser *strp,
          * any socket yet.
          */
         skb->sk = psock->sock;
-        bpf_compute_data_pointers(skb);
+        bpf_compute_data_end_sk_skb(skb);
         rc = (*prog->bpf_func)(skb, prog->insnsi);
         skb->sk = NULL;
         rcu_read_unlock();
@@ -1896,7 +1902,7 @@ static int __sock_map_ctx_update_elem(struct bpf_map *map,
                 e = kzalloc(sizeof(*e), GFP_ATOMIC | __GFP_NOWARN);
                 if (!e) {
                         err = -ENOMEM;
-                        goto out_progs;
+                        goto out_free;
                 }
         }
 
@@ -2069,7 +2075,13 @@ static int sock_map_update_elem(struct bpf_map *map,
                 return -EOPNOTSUPP;
         }
 
+        lock_sock(skops.sk);
+        preempt_disable();
+        rcu_read_lock();
         err = sock_map_ctx_update_elem(&skops, map, key, flags);
+        rcu_read_unlock();
+        preempt_enable();
+        release_sock(skops.sk);
         fput(socket->file);
         return err;
 }
@@ -2342,7 +2354,10 @@ static int sock_hash_ctx_update_elem(struct bpf_sock_ops_kern *skops,
         if (err)
                 goto err;
 
-        /* bpf_map_update_elem() can be called in_irq() */
+        /* psock is valid here because otherwise above *ctx_update_elem would
+         * have thrown an error. It is safe to skip error check.
+         */
+        psock = smap_psock_sk(sock);
         raw_spin_lock_bh(&b->lock);
         l_old = lookup_elem_raw(head, hash, key, key_size);
         if (l_old && map_flags == BPF_NOEXIST) {
@@ -2360,12 +2375,6 @@ static int sock_hash_ctx_update_elem(struct bpf_sock_ops_kern *skops,
                 goto bucket_err;
         }
 
-        psock = smap_psock_sk(sock);
-        if (unlikely(!psock)) {
-                err = -EINVAL;
-                goto bucket_err;
-        }
-
         rcu_assign_pointer(e->hash_link, l_new);
         rcu_assign_pointer(e->htab,
                            container_of(map, struct bpf_htab, map));
@@ -2388,12 +2397,10 @@ static int sock_hash_ctx_update_elem(struct bpf_sock_ops_kern *skops,
         raw_spin_unlock_bh(&b->lock);
         return 0;
 bucket_err:
+        smap_release_sock(psock, sock);
         raw_spin_unlock_bh(&b->lock);
 err:
         kfree(e);
-        psock = smap_psock_sk(sock);
-        if (psock)
-                smap_release_sock(psock, sock);
         return err;
 }
 
@@ -2415,7 +2422,13 @@ static int sock_hash_update_elem(struct bpf_map *map,
                 return -EINVAL;
         }
 
+        lock_sock(skops.sk);
+        preempt_disable();
+        rcu_read_lock();
         err = sock_hash_ctx_update_elem(&skops, map, key, flags);
+        rcu_read_unlock();
+        preempt_enable();
+        release_sock(skops.sk);
         fput(socket->file);
         return err;
 }
@@ -2472,10 +2485,8 @@ struct sock  *__sock_hash_lookup_elem(struct bpf_map *map, void *key)
         b = __select_bucket(htab, hash);
         head = &b->head;
 
-        raw_spin_lock_bh(&b->lock);
         l = lookup_elem_raw(head, hash, key, key_size);
         sk = l ? l->sk : NULL;
-        raw_spin_unlock_bh(&b->lock);
         return sk;
 }
 
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index d10ecd78105f..a31a1ba0f8ea 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -735,7 +735,9 @@ static int map_update_elem(union bpf_attr *attr)
         if (bpf_map_is_dev_bound(map)) {
                 err = bpf_map_offload_update_elem(map, key, value, attr->flags);
                 goto out;
-        } else if (map->map_type == BPF_MAP_TYPE_CPUMAP) {
+        } else if (map->map_type == BPF_MAP_TYPE_CPUMAP ||
+                   map->map_type == BPF_MAP_TYPE_SOCKHASH ||
+                   map->map_type == BPF_MAP_TYPE_SOCKMAP) {
                 err = map->ops->map_update_elem(map, key, value, attr->flags);
                 goto out;
         }
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 9e2bf834f13a..63aaac52a265 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5430,6 +5430,10 @@ static int jit_subprogs(struct bpf_verifier_env *env)
                 if (insn->code != (BPF_JMP | BPF_CALL) ||
                     insn->src_reg != BPF_PSEUDO_CALL)
                         continue;
+                /* Upon error here we cannot fall back to interpreter but
+                 * need a hard reject of the program. Thus -EFAULT is
+                 * propagated in any case.
+                 */
                 subprog = find_subprog(env, i + insn->imm + 1);
                 if (subprog < 0) {
                         WARN_ONCE(1, "verifier bug. No program starts at insn %d\n",
@@ -5450,7 +5454,7 @@ static int jit_subprogs(struct bpf_verifier_env *env)
 
         func = kcalloc(env->subprog_cnt, sizeof(prog), GFP_KERNEL);
         if (!func)
-                return -ENOMEM;
+                goto out_undo_insn;
 
         for (i = 0; i < env->subprog_cnt; i++) {
                 subprog_start = subprog_end;
@@ -5515,7 +5519,7 @@ static int jit_subprogs(struct bpf_verifier_env *env)
                 tmp = bpf_int_jit_compile(func[i]);
                 if (tmp != func[i] || func[i]->bpf_func != old_bpf_func) {
                         verbose(env, "JIT doesn't support bpf-to-bpf calls\n");
-                        err = -EFAULT;
+                        err = -ENOTSUPP;
                         goto out_free;
                 }
                 cond_resched();
@@ -5552,6 +5556,7 @@ out_free:
                 if (func[i])
                         bpf_jit_free(func[i]);
         kfree(func);
+out_undo_insn:
         /* cleanup main prog to be interpreted */
         prog->jit_requested = 0;
         for (i = 0, insn = prog->insnsi; i < prog->len; i++, insn++) {
@@ -5578,6 +5583,8 @@ static int fixup_call_args(struct bpf_verifier_env *env)
                 err = jit_subprogs(env);
                 if (err == 0)
                         return 0;
+                if (err == -EFAULT)
+                        return err;
         }
 #ifndef CONFIG_BPF_JIT_ALWAYS_ON
         for (i = 0; i < prog->len; i++, insn++) {
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 8f0434a9951a..eec2d5fb676b 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6343,7 +6343,7 @@ static u64 perf_virt_to_phys(u64 virt)
 
 static struct perf_callchain_entry __empty_callchain = { .nr = 0, };
 
-static struct perf_callchain_entry *
+struct perf_callchain_entry *
 perf_callchain(struct perf_event *event, struct pt_regs *regs)
 {
         bool kernel = !event->attr.exclude_callchain_kernel;
@@ -6382,7 +6382,9 @@ void perf_prepare_sample(struct perf_event_header *header,
         if (sample_type & PERF_SAMPLE_CALLCHAIN) {
                 int size = 1;
 
-                data->callchain = perf_callchain(event, regs);
+                if (!(sample_type & __PERF_SAMPLE_CALLCHAIN_EARLY))
+                        data->callchain = perf_callchain(event, regs);
+
                 size += data->callchain->nr;
 
                 header->size += size * sizeof(u64);
@@ -7335,6 +7337,10 @@ static bool perf_addr_filter_match(struct perf_addr_filter *filter,
                                      struct file *file, unsigned long offset,
                                      unsigned long size)
 {
+        /* d_inode(NULL) won't be equal to any mapped user-space file */
+        if (!filter->path.dentry)
+                return false;
+
         if (d_inode(filter->path.dentry) != file_inode(file))
                 return false;
 
diff --git a/kernel/fork.c b/kernel/fork.c
index 9440d61b925c..1b27babc4c78 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -303,11 +303,36 @@ struct kmem_cache *files_cachep;
 struct kmem_cache *fs_cachep;
 
 /* SLAB cache for vm_area_struct structures */
-struct kmem_cache *vm_area_cachep;
+static struct kmem_cache *vm_area_cachep;
 
 /* SLAB cache for mm_struct structures (tsk->mm) */
 static struct kmem_cache *mm_cachep;
 
+struct vm_area_struct *vm_area_alloc(struct mm_struct *mm)
+{
+        struct vm_area_struct *vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+
+        if (vma)
+                vma_init(vma, mm);
+        return vma;
+}
+
+struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig)
+{
+        struct vm_area_struct *new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
+
+        if (new) {
+                *new = *orig;
+                INIT_LIST_HEAD(&new->anon_vma_chain);
+        }
+        return new;
+}
+
+void vm_area_free(struct vm_area_struct *vma)
+{
+        kmem_cache_free(vm_area_cachep, vma);
+}
+
 static void account_kernel_stack(struct task_struct *tsk, int account)
 {
         void *stack = task_stack_page(tsk);
@@ -455,11 +480,9 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm,
                                 goto fail_nomem;
                         charge = len;
                 }
-                tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
+                tmp = vm_area_dup(mpnt);
                 if (!tmp)
                         goto fail_nomem;
-                *tmp = *mpnt;
-                INIT_LIST_HEAD(&tmp->anon_vma_chain);
                 retval = vma_dup_policy(mpnt, tmp);
                 if (retval)
                         goto fail_nomem_policy;
@@ -539,7 +562,7 @@ fail_uprobe_end:
 fail_nomem_anon_vma_fork:
         mpol_put(vma_policy(tmp));
 fail_nomem_policy:
-        kmem_cache_free(vm_area_cachep, tmp);
+        vm_area_free(tmp);
 fail_nomem:
         retval = -ENOMEM;
         vm_unacct_memory(charge);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index daeabd791d58..9a8b7ba9aa88 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1068,6 +1068,13 @@ static int irq_setup_forced_threading(struct irqaction *new)
         if (new->flags & (IRQF_NO_THREAD | IRQF_PERCPU | IRQF_ONESHOT))
                 return 0;
 
+        /*
+         * No further action required for interrupts which are requested as
+         * threaded interrupts already
+         */
+        if (new->handler == irq_default_primary_handler)
+                return 0;
+
         new->flags |= IRQF_ONESHOT;
 
         /*
@@ -1075,7 +1082,7 @@ static int irq_setup_forced_threading(struct irqaction *new)
          * thread handler. We force thread them as well by creating a
          * secondary action.
          */
-        if (new->handler != irq_default_primary_handler && new->thread_fn) {
+        if (new->handler && new->thread_fn) {
                 /* Allocate the secondary action */
                 new->secondary = kzalloc(sizeof(struct irqaction), GFP_KERNEL);
                 if (!new->secondary)
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 750cb8082694..486dedbd9af5 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -325,8 +325,14 @@ struct task_struct *__kthread_create_on_node(int (*threadfn)(void *data),
         task = create->result;
         if (!IS_ERR(task)) {
                 static const struct sched_param param = { .sched_priority = 0 };
+                char name[TASK_COMM_LEN];
 
-                vsnprintf(task->comm, sizeof(task->comm), namefmt, args);
+                /*
+                 * task is already visible to other tasks, so updating
+                 * COMM must be protected.
+                 */
+                vsnprintf(name, sizeof(name), namefmt, args);
+                set_task_comm(task, name);
                 /*
                  * root may have changed our (kthreadd's) priority or CPU mask.
                  * The kernel thread should not inherit these properties.
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 4f014be7a4b8..2823d4163a37 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1465,6 +1465,29 @@ rt_mutex_fastunlock(struct rt_mutex *lock,
                 rt_mutex_postunlock(&wake_q);
 }
 
+static inline void __rt_mutex_lock(struct rt_mutex *lock, unsigned int subclass)
+{
+        might_sleep();
+
+        mutex_acquire(&lock->dep_map, subclass, 0, _RET_IP_);
+        rt_mutex_fastlock(lock, TASK_UNINTERRUPTIBLE, rt_mutex_slowlock);
+}
+
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+/**
+ * rt_mutex_lock_nested - lock a rt_mutex
+ *
+ * @lock: the rt_mutex to be locked
+ * @subclass: the lockdep subclass
+ */
+void __sched rt_mutex_lock_nested(struct rt_mutex *lock, unsigned int subclass)
+{
+        __rt_mutex_lock(lock, subclass);
+}
+EXPORT_SYMBOL_GPL(rt_mutex_lock_nested);
+#endif
+
+#ifndef CONFIG_DEBUG_LOCK_ALLOC
 /**
  * rt_mutex_lock - lock a rt_mutex
  *
@@ -1472,12 +1495,10 @@ rt_mutex_fastunlock(struct rt_mutex *lock,
  */
 void __sched rt_mutex_lock(struct rt_mutex *lock)
 {
-        might_sleep();
-
-        mutex_acquire(&lock->dep_map, 0, 0, _RET_IP_);
-        rt_mutex_fastlock(lock, TASK_UNINTERRUPTIBLE, rt_mutex_slowlock);
+        __rt_mutex_lock(lock, 0);
 }
 EXPORT_SYMBOL_GPL(rt_mutex_lock);
+#endif
 
 /**
  * rt_mutex_lock_interruptible - lock a rt_mutex interruptible
diff --git a/kernel/memremap.c b/kernel/memremap.c
index 5857267a4af5..38283363da06 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -176,10 +176,27 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap)
         unsigned long pfn, pgoff, order;
         pgprot_t pgprot = PAGE_KERNEL;
         int error, nid, is_ram;
+        struct dev_pagemap *conflict_pgmap;
 
         align_start = res->start & ~(SECTION_SIZE - 1);
         align_size = ALIGN(res->start + resource_size(res), SECTION_SIZE)
                 - align_start;
+        align_end = align_start + align_size - 1;
+
+        conflict_pgmap = get_dev_pagemap(PHYS_PFN(align_start), NULL);
+        if (conflict_pgmap) {
+                dev_WARN(dev, "Conflicting mapping in same section\n");
+                put_dev_pagemap(conflict_pgmap);
+                return ERR_PTR(-ENOMEM);
+        }
+
+        conflict_pgmap = get_dev_pagemap(PHYS_PFN(align_end), NULL);
+        if (conflict_pgmap) {
+                dev_WARN(dev, "Conflicting mapping in same section\n");
+                put_dev_pagemap(conflict_pgmap);
+                return ERR_PTR(-ENOMEM);
+        }
+
         is_ram = region_intersects(align_start, align_size,
                 IORESOURCE_SYSTEM_RAM, IORES_DESC_NONE);
 
@@ -199,7 +216,6 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap)
 
         mutex_lock(&pgmap_lock);
         error = 0;
-        align_end = align_start + align_size - 1;
 
         foreach_order_pgoff(res, order, pgoff) {
                 error = __radix_tree_insert(&pgmap_radix,
@@ -305,7 +321,7 @@ EXPORT_SYMBOL_GPL(get_dev_pagemap);
 
 #ifdef CONFIG_DEV_PAGEMAP_OPS
 DEFINE_STATIC_KEY_FALSE(devmap_managed_key);
-EXPORT_SYMBOL_GPL(devmap_managed_key);
+EXPORT_SYMBOL(devmap_managed_key);
 static atomic_t devmap_enable;
 
 /*
@@ -346,5 +362,5 @@ void __put_devmap_managed_page(struct page *page)
         } else if (!count)
                 __put_page(page);
 }
-EXPORT_SYMBOL_GPL(__put_devmap_managed_page);
+EXPORT_SYMBOL(__put_devmap_managed_page);
 #endif /* CONFIG_DEV_PAGEMAP_OPS */
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index fbfc3f1d368a..b5fbdde6afa9 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -2090,8 +2090,14 @@ retry:
         sub_rq_bw(&next_task->dl, &rq->dl);
         set_task_cpu(next_task, later_rq->cpu);
         add_rq_bw(&next_task->dl, &later_rq->dl);
+
+        /*
+         * Update the later_rq clock here, because the clock is used
+         * by the cpufreq_update_util() inside __add_running_bw().
+         */
+        update_rq_clock(later_rq);
         add_running_bw(&next_task->dl, &later_rq->dl);
-        activate_task(later_rq, next_task, 0);
+        activate_task(later_rq, next_task, ENQUEUE_NOCLOCK);
         ret = 1;
 
         resched_curr(later_rq);
@@ -2290,8 +2296,17 @@ static void switched_from_dl(struct rq *rq, struct task_struct *p)
         if (task_on_rq_queued(p) && p->dl.dl_runtime)
                 task_non_contending(p);
 
-        if (!task_on_rq_queued(p))
+        if (!task_on_rq_queued(p)) {
+                /*
+                 * Inactive timer is armed. However, p is leaving DEADLINE and
+                 * might migrate away from this rq while continuing to run on
+                 * some other class. We need to remove its contribution from
+                 * this rq running_bw now, or sub_rq_bw (below) will complain.
+                 */
+                if (p->dl.dl_non_contending)
+                        sub_running_bw(&p->dl, &rq->dl);
                 sub_rq_bw(&p->dl, &rq->dl);
+        }
 
         /*
          * We cannot use inactive_task_timer() to invoke sub_running_bw()
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index 572567078b60..eaaec8364f96 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -836,6 +836,8 @@ static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun)
                  * can be time-consuming. Try to avoid it when possible.
                  */
                 raw_spin_lock(&rt_rq->rt_runtime_lock);
+                if (!sched_feat(RT_RUNTIME_SHARE) && rt_rq->rt_runtime != RUNTIME_INF)
+                        rt_rq->rt_runtime = rt_b->rt_runtime;
                 skip = !rt_rq->rt_time && !rt_rq->rt_nr_running;
                 raw_spin_unlock(&rt_rq->rt_runtime_lock);
                 if (skip)
diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
index 05a831427bc7..56a0fed30c0a 100644
--- a/kernel/sched/topology.c
+++ b/kernel/sched/topology.c
@@ -47,7 +47,7 @@ static int sched_domain_debug_one(struct sched_domain *sd, int cpu, int level,
         if (!cpumask_test_cpu(cpu, sched_domain_span(sd))) {
                 printk(KERN_ERR "ERROR: domain->span does not contain CPU%d\n", cpu);
         }
-        if (!cpumask_test_cpu(cpu, sched_group_span(group))) {
+        if (group && !cpumask_test_cpu(cpu, sched_group_span(group))) {
                 printk(KERN_ERR "ERROR: domain->groups does not contain CPU%d\n", cpu);
         }
 
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 900dcfee542c..6f584861d329 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -79,12 +79,16 @@ static void wakeup_softirqd(void)
 
 /*
  * If ksoftirqd is scheduled, we do not want to process pending softirqs
- * right now. Let ksoftirqd handle this at its own rate, to get fairness.
+ * right now. Let ksoftirqd handle this at its own rate, to get fairness,
+ * unless we're doing some of the synchronous softirqs.
  */
-static bool ksoftirqd_running(void)
+#define SOFTIRQ_NOW_MASK ((1 << HI_SOFTIRQ) | (1 << TASKLET_SOFTIRQ))
+static bool ksoftirqd_running(unsigned long pending)
 {
         struct task_struct *tsk = __this_cpu_read(ksoftirqd);
 
+        if (pending & SOFTIRQ_NOW_MASK)
+                return false;
         return tsk && (tsk->state == TASK_RUNNING);
 }
 
@@ -328,7 +332,7 @@ asmlinkage __visible void do_softirq(void)
 
         pending = local_softirq_pending();
 
-        if (pending && !ksoftirqd_running())
+        if (pending && !ksoftirqd_running(pending))
                 do_softirq_own_stack();
 
         local_irq_restore(flags);
@@ -355,7 +359,7 @@ void irq_enter(void)
 
 static inline void invoke_softirq(void)
 {
-        if (ksoftirqd_running())
+        if (ksoftirqd_running(local_softirq_pending()))
                 return;
 
         if (!force_irqthreads) {
@@ -386,7 +390,7 @@ static inline void tick_irq_exit(void)
 
         /* Make sure that timer wheel updates are propagated */
         if ((idle_cpu(cpu) && !need_resched()) || tick_nohz_full_cpu(cpu)) {
-                if (!in_interrupt())
+                if (!in_irq())
                         tick_nohz_irq_exit();
         }
 #endif
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index f89014a2c238..e190d1ef3a23 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -260,6 +260,15 @@ retry:
         err = 0;
         __cpu_stop_queue_work(stopper1, work1, &wakeq);
         __cpu_stop_queue_work(stopper2, work2, &wakeq);
+        /*
+         * The waking up of stopper threads has to happen
+         * in the same scheduling context as the queueing.
+         * Otherwise, there is a possibility of one of the
+         * above stoppers being woken up by another CPU,
+         * and preempting us. This will cause us to n ot
+         * wake up the other stopper forever.
+         */
+        preempt_disable();
 unlock:
         raw_spin_unlock(&stopper2->lock);
         raw_spin_unlock_irq(&stopper1->lock);
@@ -270,7 +279,10 @@ unlock:
                 goto retry;
         }
 
-        wake_up_q(&wakeq);
+        if (!err) {
+                wake_up_q(&wakeq);
+                preempt_enable();
+        }
 
         return err;
 }
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index da9455a6b42b..5b33e2f5c0ed 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -642,7 +642,7 @@ static void tick_nohz_restart(struct tick_sched *ts, ktime_t now)
 
 static inline bool local_timer_softirq_pending(void)
 {
-        return local_softirq_pending() & TIMER_SOFTIRQ;
+        return local_softirq_pending() & BIT(TIMER_SOFTIRQ);
 }
 
 static ktime_t tick_nohz_next_event(struct tick_sched *ts, int cpu)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 6a46af21765c..0b0b688ea166 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -3227,6 +3227,22 @@ int ring_buffer_record_is_on(struct ring_buffer *buffer)
 }
 
 /**
+ * ring_buffer_record_is_set_on - return true if the ring buffer is set writable
+ * @buffer: The ring buffer to see if write is set enabled
+ *
+ * Returns true if the ring buffer is set writable by ring_buffer_record_on().
+ * Note that this does NOT mean it is in a writable state.
+ *
+ * It may return true when the ring buffer has been disabled by
+ * ring_buffer_record_disable(), as that is a temporary disabling of
+ * the ring buffer.
+ */
+int ring_buffer_record_is_set_on(struct ring_buffer *buffer)
+{
+        return !(atomic_read(&buffer->record_disabled) & RB_BUFFER_OFF);
+}
+
+/**
  * ring_buffer_record_disable_cpu - stop all writes into the cpu_buffer
  * @buffer: The ring buffer to stop writes to.
  * @cpu: The CPU buffer to stop
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 87cf25171fb8..823687997b01 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1373,6 +1373,12 @@ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
 
         arch_spin_lock(&tr->max_lock);
 
+        /* Inherit the recordable setting from trace_buffer */
+        if (ring_buffer_record_is_set_on(tr->trace_buffer.buffer))
+                ring_buffer_record_on(tr->max_buffer.buffer);
+        else
+                ring_buffer_record_off(tr->max_buffer.buffer);
+
         swap(tr->trace_buffer.buffer, tr->max_buffer.buffer);
 
         __update_max_tr(tr, tsk, cpu);
diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index d18249683682..5dea177cef53 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -679,6 +679,8 @@ event_trigger_callback(struct event_command *cmd_ops,
                 goto out_free;
 
  out_reg:
+        /* Up the trigger_data count to make sure reg doesn't free it on failure */
+        event_trigger_init(trigger_ops, trigger_data);
         ret = cmd_ops->reg(glob, trigger_ops, trigger_data, file);
         /*
          * The above returns on success the # of functions enabled,
@@ -686,11 +688,13 @@ event_trigger_callback(struct event_command *cmd_ops,
          * Consider no functions a failure too.
          */
         if (!ret) {
+                cmd_ops->unreg(glob, trigger_ops, trigger_data, file);
                 ret = -ENOENT;
-                goto out_free;
-        } else if (ret < 0)
-                goto out_free;
-        ret = 0;
+        } else if (ret > 0)
+                ret = 0;
+
+        /* Down the counter of trigger_data or free it if not used anymore */
+        event_trigger_free(trigger_ops, trigger_data);
  out:
         return ret;
 
@@ -1416,6 +1420,9 @@ int event_enable_trigger_func(struct event_command *cmd_ops,
                 goto out;
         }
 
+        /* Up the trigger_data count to make sure nothing frees it on failure */
+        event_trigger_init(trigger_ops, trigger_data);
+
         if (trigger) {
                 number = strsep(&trigger, ":");
 
@@ -1466,6 +1473,7 @@ int event_enable_trigger_func(struct event_command *cmd_ops,
                 goto out_disable;
         /* Just return zero, not the number of enabled functions */
         ret = 0;
+        event_trigger_free(trigger_ops, trigger_data);
  out:
         return ret;
 
@@ -1476,7 +1484,7 @@ int event_enable_trigger_func(struct event_command *cmd_ops,
  out_free:
         if (cmd_ops->set_filter)
                 cmd_ops->set_filter(NULL, trigger_data, NULL);
-        kfree(trigger_data);
+        event_trigger_free(trigger_ops, trigger_data);
         kfree(enable_data);
         goto out;
 }
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 21f718472942..6b71860f3998 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -400,11 +400,10 @@ static struct trace_kprobe *find_trace_kprobe(const char *event,
 static int
 enable_trace_kprobe(struct trace_kprobe *tk, struct trace_event_file *file)
 {
+        struct event_file_link *link = NULL;
         int ret = 0;
 
         if (file) {
-                struct event_file_link *link;
-
                 link = kmalloc(sizeof(*link), GFP_KERNEL);
                 if (!link) {
                         ret = -ENOMEM;
@@ -424,6 +423,18 @@ enable_trace_kprobe(struct trace_kprobe *tk, struct trace_event_file *file)
                 else
                         ret = enable_kprobe(&tk->rp.kp);
         }
+
+        if (ret) {
+                if (file) {
+                        /* Notice the if is true on not WARN() */
+                        if (!WARN_ON_ONCE(!link))
+                                list_del_rcu(&link->list);
+                        kfree(link);
+                        tk->tp.flags &= ~TP_FLAG_TRACE;
+                } else {
+                        tk->tp.flags &= ~TP_FLAG_PROFILE;
+                }
+        }
  out:
         return ret;
 }
diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
index c253c1b46c6b..befb127507c0 100644
--- a/lib/Kconfig.kasan
+++ b/lib/Kconfig.kasan
@@ -5,7 +5,7 @@ if HAVE_ARCH_KASAN
 
 config KASAN
         bool "KASan: runtime memory debugger"
-        depends on SLUB || (SLAB && !DEBUG_SLAB)
+        depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB)
         select SLUB_DEBUG if SLUB
         select CONSTRUCTORS
         select STACKDEPOT
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 7e43cd54c84c..8be175df3075 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -596,15 +596,70 @@ static unsigned long memcpy_mcsafe_to_page(struct page *page, size_t offset,
         return ret;
 }
 
+static size_t copy_pipe_to_iter_mcsafe(const void *addr, size_t bytes,
+                                struct iov_iter *i)
+{
+        struct pipe_inode_info *pipe = i->pipe;
+        size_t n, off, xfer = 0;
+        int idx;
+
+        if (!sanity(i))
+                return 0;
+
+        bytes = n = push_pipe(i, bytes, &idx, &off);
+        if (unlikely(!n))
+                return 0;
+        for ( ; n; idx = next_idx(idx, pipe), off = 0) {
+                size_t chunk = min_t(size_t, n, PAGE_SIZE - off);
+                unsigned long rem;
+
+                rem = memcpy_mcsafe_to_page(pipe->bufs[idx].page, off, addr,
+                                chunk);
+                i->idx = idx;
+                i->iov_offset = off + chunk - rem;
+                xfer += chunk - rem;
+                if (rem)
+                        break;
+                n -= chunk;
+                addr += chunk;
+        }
+        i->count -= xfer;
+        return xfer;
+}
+
+/**
+ * _copy_to_iter_mcsafe - copy to user with source-read error exception handling
+ * @addr: source kernel address
+ * @bytes: total transfer length
+ * @iter: destination iterator
+ *
+ * The pmem driver arranges for filesystem-dax to use this facility via
+ * dax_copy_to_iter() for protecting read/write to persistent memory.
+ * Unless / until an architecture can guarantee identical performance
+ * between _copy_to_iter_mcsafe() and _copy_to_iter() it would be a
+ * performance regression to switch more users to the mcsafe version.
+ *
+ * Otherwise, the main differences between this and typical _copy_to_iter().
+ *
+ * * Typical tail/residue handling after a fault retries the copy
+ *   byte-by-byte until the fault happens again. Re-triggering machine
+ *   checks is potentially fatal so the implementation uses source
+ *   alignment and poison alignment assumptions to avoid re-triggering
+ *   hardware exceptions.
+ *
+ * * ITER_KVEC, ITER_PIPE, and ITER_BVEC can return short copies.
+ *   Compare to copy_to_iter() where only ITER_IOVEC attempts might return
+ *   a short copy.
+ *
+ * See MCSAFE_TEST for self-test.
+ */
 size_t _copy_to_iter_mcsafe(const void *addr, size_t bytes, struct iov_iter *i)
 {
         const char *from = addr;
         unsigned long rem, curr_addr, s_addr = (unsigned long) addr;
 
-        if (unlikely(i->type & ITER_PIPE)) {
-                WARN_ON(1);
-                return 0;
-        }
+        if (unlikely(i->type & ITER_PIPE))
+                return copy_pipe_to_iter_mcsafe(addr, bytes, i);
         if (iter_is_iovec(i))
                 might_fault();
         iterate_and_advance(i, bytes, v,
@@ -701,6 +756,20 @@ size_t _copy_from_iter_nocache(void *addr, size_t bytes, struct iov_iter *i)
 EXPORT_SYMBOL(_copy_from_iter_nocache);
 
 #ifdef CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE
+/**
+ * _copy_from_iter_flushcache - write destination through cpu cache
+ * @addr: destination kernel address
+ * @bytes: total transfer length
+ * @iter: source iterator
+ *
+ * The pmem driver arranges for filesystem-dax to use this facility via
+ * dax_copy_from_iter() for ensuring that writes to persistent memory
+ * are flushed through the CPU cache. It is differentiated from
+ * _copy_from_iter_nocache() in that guarantees all data is flushed for
+ * all iterator types. The _copy_from_iter_nocache() only attempts to
+ * bypass the cache for the ITER_IOVEC case, and on some archs may use
+ * instructions that strand dirty-data in the cache.
+ */
 size_t _copy_from_iter_flushcache(void *addr, size_t bytes, struct iov_iter *i)
 {
         char *to = addr;
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 9427b5766134..e5c8586cf717 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -774,7 +774,7 @@ int rhashtable_walk_start_check(struct rhashtable_iter *iter)
                                 skip++;
                                 if (list == iter->list) {
                                         iter->p = p;
-                                        skip = skip;
+                                        iter->skip = skip;
                                         goto found;
                                 }
                         }
@@ -964,8 +964,16 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_stop);
 
 static size_t rounded_hashtable_size(const struct rhashtable_params *params)
 {
-        return max(roundup_pow_of_two(params->nelem_hint * 4 / 3),
-                   (unsigned long)params->min_size);
+        size_t retsize;
+
+        if (params->nelem_hint)
+                retsize = max(roundup_pow_of_two(params->nelem_hint * 4 / 3),
+                              (unsigned long)params->min_size);
+        else
+                retsize = max(HASH_DEFAULT_SIZE,
+                              (unsigned long)params->min_size);
+
+        return retsize;
 }
 
 static u32 rhashtable_jhash2(const void *key, u32 length, u32 seed)
@@ -1022,8 +1030,6 @@ int rhashtable_init(struct rhashtable *ht,
         struct bucket_table *tbl;
         size_t size;
 
-        size = HASH_DEFAULT_SIZE;
-
         if ((!params->key_len && !params->obj_hashfn) ||
             (params->obj_hashfn && !params->obj_cmpfn))
                 return -EINVAL;
@@ -1050,8 +1056,7 @@ int rhashtable_init(struct rhashtable *ht,
 
         ht->p.min_size = max_t(u16, ht->p.min_size, HASH_MIN_SIZE);
 
-        if (params->nelem_hint)
-                size = rounded_hashtable_size(&ht->p);
+        size = rounded_hashtable_size(&ht->p);
 
         if (params->locks_mul)
                 ht->p.locks_mul = roundup_pow_of_two(params->locks_mul);
@@ -1143,13 +1148,14 @@ void rhashtable_free_and_destroy(struct rhashtable *ht,
                                  void (*free_fn)(void *ptr, void *arg),
                                  void *arg)
 {
-        struct bucket_table *tbl;
+        struct bucket_table *tbl, *next_tbl;
         unsigned int i;
 
         cancel_work_sync(&ht->run_work);
 
         mutex_lock(&ht->mutex);
         tbl = rht_dereference(ht->tbl, ht);
+restart:
         if (free_fn) {
                 for (i = 0; i < tbl->size; i++) {
                         struct rhash_head *pos, *next;
@@ -1166,7 +1172,12 @@ void rhashtable_free_and_destroy(struct rhashtable *ht,
                 }
         }
 
+        next_tbl = rht_dereference(tbl->future_tbl, ht);
         bucket_table_free(tbl);
+        if (next_tbl) {
+                tbl = next_tbl;
+                goto restart;
+        }
         mutex_unlock(&ht->mutex);
 }
 EXPORT_SYMBOL_GPL(rhashtable_free_and_destroy);
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 1cd7c1a57a14..25346bd99364 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2084,6 +2084,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
                 if (vma_is_dax(vma))
                         return;
                 page = pmd_page(_pmd);
+                if (!PageDirty(page) && pmd_dirty(_pmd))
+                        set_page_dirty(page);
                 if (!PageReferenced(page) && pmd_young(_pmd))
                         SetPageReferenced(page);
                 page_remove_rmap(page, true);
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 039ddbc574e9..3103099f64fd 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3167,6 +3167,13 @@ static vm_fault_t hugetlb_vm_op_fault(struct vm_fault *vmf)
         return 0;
 }
 
+/*
+ * When a new function is introduced to vm_operations_struct and added
+ * to hugetlb_vm_ops, please consider adding the function to shm_vm_ops.
+ * This is because under System V memory model, mappings created via
+ * shmget/shmat with "huge page" specified are backed by hugetlbfs files,
+ * their original vm_ops are overwritten with shm_vm_ops.
+ */
 const struct vm_operations_struct hugetlb_vm_ops = {
         .fault = hugetlb_vm_op_fault,
         .open = hugetlb_vm_op_open,
diff --git a/mm/memblock.c b/mm/memblock.c
index 11e46f83e1ad..4b5d245fafc1 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -20,6 +20,7 @@
 #include <linux/kmemleak.h>
 #include <linux/seq_file.h>
 #include <linux/memblock.h>
+#include <linux/bootmem.h>
 
 #include <asm/sections.h>
 #include <linux/io.h>
@@ -1225,6 +1226,7 @@ phys_addr_t __init memblock_alloc_try_nid(phys_addr_t size, phys_addr_t align, i
         return memblock_alloc_base(size, align, MEMBLOCK_ALLOC_ACCESSIBLE);
 }
 
+#if defined(CONFIG_NO_BOOTMEM)
 /**
  * memblock_virt_alloc_internal - allocate boot memory block
  * @size: size of memory block to be allocated in bytes
@@ -1432,6 +1434,7 @@ void * __init memblock_virt_alloc_try_nid(
               (u64)max_addr);
         return NULL;
 }
+#endif
 
 /**
  * __memblock_free_early - free boot memory block
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index e6f0d5ef320a..b2173f7e5164 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -850,7 +850,7 @@ static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
         int nid;
         int i;
 
-        while ((memcg = parent_mem_cgroup(memcg))) {
+        for (; memcg; memcg = parent_mem_cgroup(memcg)) {
                 for_each_node(nid) {
                         mz = mem_cgroup_nodeinfo(memcg, nid);
                         for (i = 0; i <= DEF_PRIORITY; i++) {
@@ -4037,6 +4037,14 @@ static struct cftype mem_cgroup_legacy_files[] = {
 
 static DEFINE_IDR(mem_cgroup_idr);
 
+static void mem_cgroup_id_remove(struct mem_cgroup *memcg)
+{
+        if (memcg->id.id > 0) {
+                idr_remove(&mem_cgroup_idr, memcg->id.id);
+                memcg->id.id = 0;
+        }
+}
+
 static void mem_cgroup_id_get_many(struct mem_cgroup *memcg, unsigned int n)
 {
         VM_BUG_ON(atomic_read(&memcg->id.ref) <= 0);
@@ -4047,8 +4055,7 @@ static void mem_cgroup_id_put_many(struct mem_cgroup *memcg, unsigned int n)
 {
         VM_BUG_ON(atomic_read(&memcg->id.ref) < n);
         if (atomic_sub_and_test(n, &memcg->id.ref)) {
-                idr_remove(&mem_cgroup_idr, memcg->id.id);
-                memcg->id.id = 0;
+                mem_cgroup_id_remove(memcg);
 
                 /* Memcg ID pins CSS */
                 css_put(&memcg->css);
@@ -4185,8 +4192,7 @@ static struct mem_cgroup *mem_cgroup_alloc(void)
         idr_replace(&mem_cgroup_idr, memcg, memcg->id.id);
         return memcg;
 fail:
-        if (memcg->id.id > 0)
-                idr_remove(&mem_cgroup_idr, memcg->id.id);
+        mem_cgroup_id_remove(memcg);
         __mem_cgroup_free(memcg);
         return NULL;
 }
@@ -4245,6 +4251,7 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)
 
         return &memcg->css;
 fail:
+        mem_cgroup_id_remove(memcg);
         mem_cgroup_free(memcg);
         return ERR_PTR(-ENOMEM);
 }
diff --git a/mm/memory.c b/mm/memory.c
index 7206a634270b..dab1511294ad 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1417,11 +1417,9 @@ static inline unsigned long zap_pmd_range(struct mmu_gather *tlb,
         do {
                 next = pmd_addr_end(addr, end);
                 if (is_swap_pmd(*pmd) || pmd_trans_huge(*pmd) || pmd_devmap(*pmd)) {
-                        if (next - addr != HPAGE_PMD_SIZE) {
-                                VM_BUG_ON_VMA(vma_is_anonymous(vma) &&
-                                    !rwsem_is_locked(&tlb->mm->mmap_sem), vma);
+                        if (next - addr != HPAGE_PMD_SIZE)
                                 __split_huge_pmd(vma, pmd, addr, false, NULL);
-                        } else if (zap_huge_pmd(tlb, vma, pmd, addr))
+                        else if (zap_huge_pmd(tlb, vma, pmd, addr))
                                 goto next;
                         /* fall through */
                 }
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 9ac49ef17b4e..01f1a14facc4 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2505,6 +2505,7 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
 
                 /* Create pseudo-vma that contains just the policy */
                 memset(&pvma, 0, sizeof(struct vm_area_struct));
+                vma_init(&pvma, NULL);
                 pvma.vm_end = TASK_SIZE;        /* policy covers entire file */
                 mpol_set_shared_policy(sp, &pvma, new); /* adds ref */
 
diff --git a/mm/mmap.c b/mm/mmap.c
index 5801b5f0a634..17bbf4d3e24f 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -182,7 +182,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
         if (vma->vm_file)
                 fput(vma->vm_file);
         mpol_put(vma_policy(vma));
-        kmem_cache_free(vm_area_cachep, vma);
+        vm_area_free(vma);
         return next;
 }
 
@@ -911,7 +911,7 @@ again:
                         anon_vma_merge(vma, next);
                 mm->map_count--;
                 mpol_put(vma_policy(next));
-                kmem_cache_free(vm_area_cachep, next);
+                vm_area_free(next);
                 /*
                  * In mprotect's case 6 (see comments on vma_merge),
                  * we must remove another next too. It would clutter
@@ -1729,19 +1729,17 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
          * specific mapper. the address has already been validated, but
          * not unmapped, but the maps are removed from the list.
          */
-        vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+        vma = vm_area_alloc(mm);
         if (!vma) {
                 error = -ENOMEM;
                 goto unacct_error;
         }
 
-        vma->vm_mm = mm;
         vma->vm_start = addr;
         vma->vm_end = addr + len;
         vma->vm_flags = vm_flags;
         vma->vm_page_prot = vm_get_page_prot(vm_flags);
         vma->vm_pgoff = pgoff;
-        INIT_LIST_HEAD(&vma->anon_vma_chain);
 
         if (file) {
                 if (vm_flags & VM_DENYWRITE) {
@@ -1780,6 +1778,8 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
                 error = shmem_zero_setup(vma);
                 if (error)
                         goto free_vma;
+        } else {
+                vma_set_anonymous(vma);
         }
 
         vma_link(mm, vma, prev, rb_link, rb_parent);
@@ -1832,7 +1832,7 @@ allow_write_and_free_vma:
         if (vm_flags & VM_DENYWRITE)
                 allow_write_access(file);
 free_vma:
-        kmem_cache_free(vm_area_cachep, vma);
+        vm_area_free(vma);
 unacct_error:
         if (charged)
                 vm_unacct_memory(charged);
@@ -2620,15 +2620,10 @@ int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
                         return err;
         }
 
-        new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
+        new = vm_area_dup(vma);
         if (!new)
                 return -ENOMEM;
 
-        /* most fields are the same, copy all, and then fixup */
-        *new = *vma;
-
-        INIT_LIST_HEAD(&new->anon_vma_chain);
-
         if (new_below)
                 new->vm_end = addr;
         else {
@@ -2669,7 +2664,7 @@ int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  out_free_mpol:
         mpol_put(vma_policy(new));
  out_free_vma:
-        kmem_cache_free(vm_area_cachep, new);
+        vm_area_free(new);
         return err;
 }
 
@@ -2984,14 +2979,13 @@ static int do_brk_flags(unsigned long addr, unsigned long len, unsigned long fla
         /*
          * create a vma struct for an anonymous mapping
          */
-        vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+        vma = vm_area_alloc(mm);
         if (!vma) {
                 vm_unacct_memory(len >> PAGE_SHIFT);
                 return -ENOMEM;
         }
 
-        INIT_LIST_HEAD(&vma->anon_vma_chain);
-        vma->vm_mm = mm;
+        vma_set_anonymous(vma);
         vma->vm_start = addr;
         vma->vm_end = addr + len;
         vma->vm_pgoff = pgoff;
@@ -3202,16 +3196,14 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
                 }
                 *need_rmap_locks = (new_vma->vm_pgoff <= vma->vm_pgoff);
         } else {
-                new_vma = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
+                new_vma = vm_area_dup(vma);
                 if (!new_vma)
                         goto out;
-                *new_vma = *vma;
                 new_vma->vm_start = addr;
                 new_vma->vm_end = addr + len;
                 new_vma->vm_pgoff = pgoff;
                 if (vma_dup_policy(vma, new_vma))
                         goto out_free_vma;
-                INIT_LIST_HEAD(&new_vma->anon_vma_chain);
                 if (anon_vma_clone(new_vma, vma))
                         goto out_free_mempol;
                 if (new_vma->vm_file)
@@ -3226,7 +3218,7 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
 out_free_mempol:
         mpol_put(vma_policy(new_vma));
 out_free_vma:
-        kmem_cache_free(vm_area_cachep, new_vma);
+        vm_area_free(new_vma);
 out:
         return NULL;
 }
@@ -3350,12 +3342,10 @@ static struct vm_area_struct *__install_special_mapping(
         int ret;
         struct vm_area_struct *vma;
 
-        vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+        vma = vm_area_alloc(mm);
         if (unlikely(vma == NULL))
                 return ERR_PTR(-ENOMEM);
 
-        INIT_LIST_HEAD(&vma->anon_vma_chain);
-        vma->vm_mm = mm;
         vma->vm_start = addr;
         vma->vm_end = addr + len;
 
@@ -3376,7 +3366,7 @@ static struct vm_area_struct *__install_special_mapping(
         return vma;
 
 out:
-        kmem_cache_free(vm_area_cachep, vma);
+        vm_area_free(vma);
         return ERR_PTR(ret);
 }
 
diff --git a/mm/nommu.c b/mm/nommu.c
index 4452d8bd9ae4..9fc9e43335b6 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -769,7 +769,7 @@ static void delete_vma(struct mm_struct *mm, struct vm_area_struct *vma)
         if (vma->vm_file)
                 fput(vma->vm_file);
         put_nommu_region(vma->vm_region);
-        kmem_cache_free(vm_area_cachep, vma);
+        vm_area_free(vma);
 }
 
 /*
@@ -1145,6 +1145,8 @@ static int do_mmap_private(struct vm_area_struct *vma,
                 if (ret < len)
                         memset(base + ret, 0, len - ret);
 
+        } else {
+                vma_set_anonymous(vma);
         }
 
         return 0;
@@ -1204,7 +1206,7 @@ unsigned long do_mmap(struct file *file,
         if (!region)
                 goto error_getting_region;
 
-        vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+        vma = vm_area_alloc(current->mm);
         if (!vma)
                 goto error_getting_vma;
 
@@ -1212,7 +1214,6 @@ unsigned long do_mmap(struct file *file,
         region->vm_flags = vm_flags;
         region->vm_pgoff = pgoff;
 
-        INIT_LIST_HEAD(&vma->anon_vma_chain);
         vma->vm_flags = vm_flags;
         vma->vm_pgoff = pgoff;
 
@@ -1368,7 +1369,7 @@ error:
         kmem_cache_free(vm_region_jar, region);
         if (vma->vm_file)
                 fput(vma->vm_file);
-        kmem_cache_free(vm_area_cachep, vma);
+        vm_area_free(vma);
         return ret;
 
 sharing_violation:
@@ -1469,14 +1470,13 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
         if (!region)
                 return -ENOMEM;
 
-        new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
+        new = vm_area_dup(vma);
         if (!new) {
                 kmem_cache_free(vm_region_jar, region);
                 return -ENOMEM;
         }
 
         /* most fields are the same, copy all, and then fixup */
-        *new = *vma;
         *region = *vma->vm_region;
         new->vm_region = region;
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 5d800d61ddb7..3222193c46c6 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -6383,7 +6383,7 @@ void __paginginit free_area_init_node(int nid, unsigned long *zones_size,
         free_area_init_core(pgdat);
 }
 
-#ifdef CONFIG_HAVE_MEMBLOCK
+#if defined(CONFIG_HAVE_MEMBLOCK) && !defined(CONFIG_FLAT_NODE_MEM_MAP)
 /*
  * Only struct pages that are backed by physical memory are zeroed and
  * initialized by going through __init_single_page(). But, there are some
@@ -6421,7 +6421,7 @@ void __paginginit zero_resv_unavail(void)
         if (pgcnt)
                 pr_info("Reserved but unavailable: %lld pages", pgcnt);
 }
-#endif /* CONFIG_HAVE_MEMBLOCK */
+#endif /* CONFIG_HAVE_MEMBLOCK && !CONFIG_FLAT_NODE_MEM_MAP */
 
 #ifdef CONFIG_HAVE_MEMBLOCK_NODE_MAP
 
@@ -6939,9 +6939,21 @@ unsigned long free_reserved_area(void *start, void *end, int poison, char *s)
         start = (void *)PAGE_ALIGN((unsigned long)start);
         end = (void *)((unsigned long)end & PAGE_MASK);
         for (pos = start; pos < end; pos += PAGE_SIZE, pages++) {
+                struct page *page = virt_to_page(pos);
+                void *direct_map_addr;
+
+                /*
+                 * 'direct_map_addr' might be different from 'pos'
+                 * because some architectures' virt_to_page()
+                 * work with aliases.  Getting the direct map
+                 * address ensures that we get a _writeable_
+                 * alias for the memset().
+                 */
+                direct_map_addr = page_address(page);
                 if ((unsigned int)poison <= 0xFF)
-                        memset(pos, poison, PAGE_SIZE);
-                free_reserved_page(virt_to_page(pos));
+                        memset(direct_map_addr, poison, PAGE_SIZE);
+
+                free_reserved_page(page);
         }
 
         if (pages && s)
diff --git a/mm/shmem.c b/mm/shmem.c
index 2cab84403055..41b9bbf24e16 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1421,6 +1421,7 @@ static void shmem_pseudo_vma_init(struct vm_area_struct *vma,
 {
         /* Create a pseudo vma that just contains the policy */
         memset(vma, 0, sizeof(*vma));
+        vma_init(vma, NULL);
         /* Bias interleave by inode number to distribute better across nodes */
         vma->vm_pgoff = index + info->vfs_inode.i_ino;
         vma->vm_policy = mpol_shared_policy_lookup(&info->policy, index);
diff --git a/mm/zswap.c b/mm/zswap.c
index 7d34e69507e3..cd91fd9d96b8 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -1026,6 +1026,15 @@ static int zswap_frontswap_store(unsigned type, pgoff_t offset,
                         ret = -ENOMEM;
                         goto reject;
                 }
+
+                /* A second zswap_is_full() check after
+                 * zswap_shrink() to make sure it's now
+                 * under the max_pool_percent
+                 */
+                if (zswap_is_full()) {
+                        ret = -ENOMEM;
+                        goto reject;
+                }
         }
 
         /* allocate entry */
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index be09a9883825..73bf6a93a3cf 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -2732,7 +2732,7 @@ static int batadv_iv_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
 {
         struct batadv_neigh_ifinfo *router_ifinfo = NULL;
         struct batadv_neigh_node *router;
-        struct batadv_gw_node *curr_gw;
+        struct batadv_gw_node *curr_gw = NULL;
         int ret = 0;
         void *hdr;
 
@@ -2780,6 +2780,8 @@ static int batadv_iv_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
         ret = 0;
 
 out:
+        if (curr_gw)
+                batadv_gw_node_put(curr_gw);
         if (router_ifinfo)
                 batadv_neigh_ifinfo_put(router_ifinfo);
         if (router)
diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c
index ec93337ee259..6baec4e68898 100644
--- a/net/batman-adv/bat_v.c
+++ b/net/batman-adv/bat_v.c
@@ -927,7 +927,7 @@ static int batadv_v_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
 {
         struct batadv_neigh_ifinfo *router_ifinfo = NULL;
         struct batadv_neigh_node *router;
-        struct batadv_gw_node *curr_gw;
+        struct batadv_gw_node *curr_gw = NULL;
         int ret = 0;
         void *hdr;
 
@@ -995,6 +995,8 @@ static int batadv_v_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
         ret = 0;
 
 out:
+        if (curr_gw)
+                batadv_gw_node_put(curr_gw);
         if (router_ifinfo)
                 batadv_neigh_ifinfo_put(router_ifinfo);
         if (router)
diff --git a/net/batman-adv/debugfs.c b/net/batman-adv/debugfs.c
index 4229b01ac7b5..87479c60670e 100644
--- a/net/batman-adv/debugfs.c
+++ b/net/batman-adv/debugfs.c
@@ -19,6 +19,7 @@
 #include "debugfs.h"
 #include "main.h"
 
+#include <linux/dcache.h>
 #include <linux/debugfs.h>
 #include <linux/err.h>
 #include <linux/errno.h>
@@ -344,6 +345,25 @@ out:
 }
 
 /**
+ * batadv_debugfs_rename_hardif() - Fix debugfs path for renamed hardif
+ * @hard_iface: hard interface which was renamed
+ */
+void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface)
+{
+        const char *name = hard_iface->net_dev->name;
+        struct dentry *dir;
+        struct dentry *d;
+
+        dir = hard_iface->debug_dir;
+        if (!dir)
+                return;
+
+        d = debugfs_rename(dir->d_parent, dir, dir->d_parent, name);
+        if (!d)
+                pr_err("Can't rename debugfs dir to %s\n", name);
+}
+
+/**
  * batadv_debugfs_del_hardif() - delete the base directory for a hard interface
  *  in debugfs.
  * @hard_iface: hard interface which is deleted.
@@ -414,6 +434,26 @@ out:
 }
 
 /**
+ * batadv_debugfs_rename_meshif() - Fix debugfs path for renamed softif
+ * @dev: net_device which was renamed
+ */
+void batadv_debugfs_rename_meshif(struct net_device *dev)
+{
+        struct batadv_priv *bat_priv = netdev_priv(dev);
+        const char *name = dev->name;
+        struct dentry *dir;
+        struct dentry *d;
+
+        dir = bat_priv->debug_dir;
+        if (!dir)
+                return;
+
+        d = debugfs_rename(dir->d_parent, dir, dir->d_parent, name);
+        if (!d)
+                pr_err("Can't rename debugfs dir to %s\n", name);
+}
+
+/**
  * batadv_debugfs_del_meshif() - Remove interface dependent debugfs entries
  * @dev: netdev struct of the soft interface
  */
diff --git a/net/batman-adv/debugfs.h b/net/batman-adv/debugfs.h
index 37b069698b04..08a592ffbee5 100644
--- a/net/batman-adv/debugfs.h
+++ b/net/batman-adv/debugfs.h
@@ -30,8 +30,10 @@ struct net_device;
 void batadv_debugfs_init(void);
 void batadv_debugfs_destroy(void);
 int batadv_debugfs_add_meshif(struct net_device *dev);
+void batadv_debugfs_rename_meshif(struct net_device *dev);
 void batadv_debugfs_del_meshif(struct net_device *dev);
 int batadv_debugfs_add_hardif(struct batadv_hard_iface *hard_iface);
+void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface);
 void batadv_debugfs_del_hardif(struct batadv_hard_iface *hard_iface);
 
 #else
@@ -49,6 +51,10 @@ static inline int batadv_debugfs_add_meshif(struct net_device *dev)
         return 0;
 }
 
+static inline void batadv_debugfs_rename_meshif(struct net_device *dev)
+{
+}
+
 static inline void batadv_debugfs_del_meshif(struct net_device *dev)
 {
 }
@@ -60,6 +66,11 @@ int batadv_debugfs_add_hardif(struct batadv_hard_iface *hard_iface)
 }
 
 static inline
+void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface)
+{
+}
+
+static inline
 void batadv_debugfs_del_hardif(struct batadv_hard_iface *hard_iface)
 {
 }
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index c405d15befd6..2f0d42f2f913 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -989,6 +989,32 @@ void batadv_hardif_remove_interfaces(void)
         rtnl_unlock();
 }
 
+/**
+ * batadv_hard_if_event_softif() - Handle events for soft interfaces
+ * @event: NETDEV_* event to handle
+ * @net_dev: net_device which generated an event
+ *
+ * Return: NOTIFY_* result
+ */
+static int batadv_hard_if_event_softif(unsigned long event,
+                                       struct net_device *net_dev)
+{
+        struct batadv_priv *bat_priv;
+
+        switch (event) {
+        case NETDEV_REGISTER:
+                batadv_sysfs_add_meshif(net_dev);
+                bat_priv = netdev_priv(net_dev);
+                batadv_softif_create_vlan(bat_priv, BATADV_NO_FLAGS);
+                break;
+        case NETDEV_CHANGENAME:
+                batadv_debugfs_rename_meshif(net_dev);
+                break;
+        }
+
+        return NOTIFY_DONE;
+}
+
 static int batadv_hard_if_event(struct notifier_block *this,
                                 unsigned long event, void *ptr)
 {
@@ -997,12 +1023,8 @@ static int batadv_hard_if_event(struct notifier_block *this,
         struct batadv_hard_iface *primary_if = NULL;
         struct batadv_priv *bat_priv;
 
-        if (batadv_softif_is_valid(net_dev) && event == NETDEV_REGISTER) {
-                batadv_sysfs_add_meshif(net_dev);
-                bat_priv = netdev_priv(net_dev);
-                batadv_softif_create_vlan(bat_priv, BATADV_NO_FLAGS);
-                return NOTIFY_DONE;
-        }
+        if (batadv_softif_is_valid(net_dev))
+                return batadv_hard_if_event_softif(event, net_dev);
 
         hard_iface = batadv_hardif_get_by_netdev(net_dev);
         if (!hard_iface && (event == NETDEV_REGISTER ||
@@ -1051,6 +1073,9 @@ static int batadv_hard_if_event(struct notifier_block *this,
                 if (batadv_is_wifi_hardif(hard_iface))
                         hard_iface->num_bcasts = BATADV_NUM_BCASTS_WIRELESS;
                 break;
+        case NETDEV_CHANGENAME:
+                batadv_debugfs_rename_hardif(hard_iface);
+                break;
         default:
                 break;
         }
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 3986551397ca..12a2b7d21376 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -1705,7 +1705,9 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv,
                 ether_addr_copy(common->addr, tt_addr);
                 common->vid = vid;
 
-                common->flags = flags;
+                if (!is_multicast_ether_addr(common->addr))
+                        common->flags = flags & (~BATADV_TT_SYNC_MASK);
+
                 tt_global_entry->roam_at = 0;
                 /* node must store current time in case of roaming. This is
                  * needed to purge this entry out on timeout (if nobody claims
@@ -1768,7 +1770,8 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv,
                  * TT_CLIENT_TEMP, therefore they have to be copied in the
                  * client entry
                  */
-                common->flags |= flags & (~BATADV_TT_SYNC_MASK);
+                if (!is_multicast_ether_addr(common->addr))
+                        common->flags |= flags & (~BATADV_TT_SYNC_MASK);
 
                 /* If there is the BATADV_TT_CLIENT_ROAM flag set, there is only
                  * one originator left in the list and we previously received a
diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index 68c3578343b4..22a78eedf4b1 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -96,6 +96,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
         u32 size = kattr->test.data_size_in;
         u32 repeat = kattr->test.repeat;
         u32 retval, duration;
+        int hh_len = ETH_HLEN;
         struct sk_buff *skb;
         void *data;
         int ret;
@@ -131,12 +132,22 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
         skb_reset_network_header(skb);
 
         if (is_l2)
-                __skb_push(skb, ETH_HLEN);
+                __skb_push(skb, hh_len);
         if (is_direct_pkt_access)
                 bpf_compute_data_pointers(skb);
         retval = bpf_test_run(prog, skb, repeat, &duration);
-        if (!is_l2)
-                __skb_push(skb, ETH_HLEN);
+        if (!is_l2) {
+                if (skb_headroom(skb) < hh_len) {
+                        int nhead = HH_DATA_ALIGN(hh_len - skb_headroom(skb));
+
+                        if (pskb_expand_head(skb, nhead, 0, GFP_USER)) {
+                                kfree_skb(skb);
+                                return -ENOMEM;
+                        }
+                }
+                memset(__skb_push(skb, hh_len), 0, hh_len);
+        }
+
         size = skb->len;
         /* bpf program can never convert linear skb to non-linear */
         if (WARN_ON_ONCE(skb_is_nonlinear(skb)))
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index e0adcd123f48..711d7156efd8 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -131,8 +131,10 @@ static void caif_flow_cb(struct sk_buff *skb)
         caifd = caif_get(skb->dev);
 
         WARN_ON(caifd == NULL);
-        if (caifd == NULL)
+        if (!caifd) {
+                rcu_read_unlock();
                 return;
+        }
 
         caifd_hold(caifd);
         rcu_read_unlock();
diff --git a/net/core/dev.c b/net/core/dev.c
index a5aa1c7444e6..559a91271f82 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -7149,16 +7149,19 @@ int dev_change_tx_queue_len(struct net_device *dev, unsigned long new_len)
                 dev->tx_queue_len = new_len;
                 res = call_netdevice_notifiers(NETDEV_CHANGE_TX_QUEUE_LEN, dev);
                 res = notifier_to_errno(res);
-                if (res) {
-                        netdev_err(dev,
-                                   "refused to change device tx_queue_len\n");
-                        dev->tx_queue_len = orig_len;
-                        return res;
-                }
-                return dev_qdisc_change_tx_queue_len(dev);
+                if (res)
+                        goto err_rollback;
+                res = dev_qdisc_change_tx_queue_len(dev);
+                if (res)
+                        goto err_rollback;
         }
 
         return 0;
+
+err_rollback:
+        netdev_err(dev, "refused to change device tx_queue_len\n");
+        dev->tx_queue_len = orig_len;
+        return res;
 }
 
 /**
diff --git a/net/core/filter.c b/net/core/filter.c
index 0ca6907d7efe..9dfd145eedcc 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -459,11 +459,21 @@ static bool convert_bpf_ld_abs(struct sock_filter *fp, struct bpf_insn **insnp)
              (!unaligned_ok && offset >= 0 &&
               offset + ip_align >= 0 &&
               offset + ip_align % size == 0))) {
+                bool ldx_off_ok = offset <= S16_MAX;
+
                 *insn++ = BPF_MOV64_REG(BPF_REG_TMP, BPF_REG_H);
                 *insn++ = BPF_ALU64_IMM(BPF_SUB, BPF_REG_TMP, offset);
-                *insn++ = BPF_JMP_IMM(BPF_JSLT, BPF_REG_TMP, size, 2 + endian);
-                *insn++ = BPF_LDX_MEM(BPF_SIZE(fp->code), BPF_REG_A, BPF_REG_D,
-                                      offset);
+                *insn++ = BPF_JMP_IMM(BPF_JSLT, BPF_REG_TMP,
+                                      size, 2 + endian + (!ldx_off_ok * 2));
+                if (ldx_off_ok) {
+                        *insn++ = BPF_LDX_MEM(BPF_SIZE(fp->code), BPF_REG_A,
+                                              BPF_REG_D, offset);
+                } else {
+                        *insn++ = BPF_MOV64_REG(BPF_REG_TMP, BPF_REG_D);
+                        *insn++ = BPF_ALU64_IMM(BPF_ADD, BPF_REG_TMP, offset);
+                        *insn++ = BPF_LDX_MEM(BPF_SIZE(fp->code), BPF_REG_A,
+                                              BPF_REG_TMP, 0);
+                }
                 if (endian)
                         *insn++ = BPF_ENDIAN(BPF_FROM_BE, BPF_REG_A, size * 8);
                 *insn++ = BPF_JMP_A(8);
@@ -1702,24 +1712,26 @@ static const struct bpf_func_proto bpf_skb_load_bytes_proto = {
 BPF_CALL_5(bpf_skb_load_bytes_relative, const struct sk_buff *, skb,
            u32, offset, void *, to, u32, len, u32, start_header)
 {
+        u8 *end = skb_tail_pointer(skb);
+        u8 *net = skb_network_header(skb);
+        u8 *mac = skb_mac_header(skb);
         u8 *ptr;
 
-        if (unlikely(offset > 0xffff || len > skb_headlen(skb)))
+        if (unlikely(offset > 0xffff || len > (end - mac)))
                 goto err_clear;
 
         switch (start_header) {
         case BPF_HDR_START_MAC:
-                ptr = skb_mac_header(skb) + offset;
+                ptr = mac + offset;
                 break;
         case BPF_HDR_START_NET:
-                ptr = skb_network_header(skb) + offset;
+                ptr = net + offset;
                 break;
         default:
                 goto err_clear;
         }
 
-        if (likely(ptr >= skb_mac_header(skb) &&
-                   ptr + len <= skb_tail_pointer(skb))) {
+        if (likely(ptr >= mac && ptr + len <= end)) {
                 memcpy(to, ptr, len);
                 return 0;
         }
@@ -1762,6 +1774,37 @@ static const struct bpf_func_proto bpf_skb_pull_data_proto = {
         .arg2_type      = ARG_ANYTHING,
 };
 
+static inline int sk_skb_try_make_writable(struct sk_buff *skb,
+                                           unsigned int write_len)
+{
+        int err = __bpf_try_make_writable(skb, write_len);
+
+        bpf_compute_data_end_sk_skb(skb);
+        return err;
+}
+
+BPF_CALL_2(sk_skb_pull_data, struct sk_buff *, skb, u32, len)
+{
+        /* Idea is the following: should the needed direct read/write
+         * test fail during runtime, we can pull in more data and redo
+         * again, since implicitly, we invalidate previous checks here.
+         *
+         * Or, since we know how much we need to make read/writeable,
+         * this can be done once at the program beginning for direct
+         * access case. By this we overcome limitations of only current
+         * headroom being accessible.
+         */
+        return sk_skb_try_make_writable(skb, len ? : skb_headlen(skb));
+}
+
+static const struct bpf_func_proto sk_skb_pull_data_proto = {
+        .func           = sk_skb_pull_data,
+        .gpl_only       = false,
+        .ret_type       = RET_INTEGER,
+        .arg1_type      = ARG_PTR_TO_CTX,
+        .arg2_type      = ARG_ANYTHING,
+};
+
 BPF_CALL_5(bpf_l3_csum_replace, struct sk_buff *, skb, u32, offset,
            u64, from, u64, to, u64, flags)
 {
@@ -2779,7 +2822,8 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff)
 
 static u32 __bpf_skb_max_len(const struct sk_buff *skb)
 {
-        return skb->dev->mtu + skb->dev->hard_header_len;
+        return skb->dev ? skb->dev->mtu + skb->dev->hard_header_len :
+                          SKB_MAX_ALLOC;
 }
 
 static int bpf_skb_adjust_net(struct sk_buff *skb, s32 len_diff)
@@ -2863,8 +2907,8 @@ static int bpf_skb_trim_rcsum(struct sk_buff *skb, unsigned int new_len)
         return __skb_trim_rcsum(skb, new_len);
 }
 
-BPF_CALL_3(bpf_skb_change_tail, struct sk_buff *, skb, u32, new_len,
-           u64, flags)
+static inline int __bpf_skb_change_tail(struct sk_buff *skb, u32 new_len,
+                                        u64 flags)
 {
         u32 max_len = __bpf_skb_max_len(skb);
         u32 min_len = __bpf_skb_min_len(skb);
@@ -2900,6 +2944,13 @@ BPF_CALL_3(bpf_skb_change_tail, struct sk_buff *, skb, u32, new_len,
                 if (!ret && skb_is_gso(skb))
                         skb_gso_reset(skb);
         }
+        return ret;
+}
+
+BPF_CALL_3(bpf_skb_change_tail, struct sk_buff *, skb, u32, new_len,
+           u64, flags)
+{
+        int ret = __bpf_skb_change_tail(skb, new_len, flags);
 
         bpf_compute_data_pointers(skb);
         return ret;
@@ -2914,9 +2965,27 @@ static const struct bpf_func_proto bpf_skb_change_tail_proto = {
         .arg3_type      = ARG_ANYTHING,
 };
 
-BPF_CALL_3(bpf_skb_change_head, struct sk_buff *, skb, u32, head_room,
+BPF_CALL_3(sk_skb_change_tail, struct sk_buff *, skb, u32, new_len,
            u64, flags)
 {
+        int ret = __bpf_skb_change_tail(skb, new_len, flags);
+
+        bpf_compute_data_end_sk_skb(skb);
+        return ret;
+}
+
+static const struct bpf_func_proto sk_skb_change_tail_proto = {
+        .func           = sk_skb_change_tail,
+        .gpl_only       = false,
+        .ret_type       = RET_INTEGER,
+        .arg1_type      = ARG_PTR_TO_CTX,
+        .arg2_type      = ARG_ANYTHING,
+        .arg3_type      = ARG_ANYTHING,
+};
+
+static inline int __bpf_skb_change_head(struct sk_buff *skb, u32 head_room,
+                                        u64 flags)
+{
         u32 max_len = __bpf_skb_max_len(skb);
         u32 new_len = skb->len + head_room;
         int ret;
@@ -2941,8 +3010,16 @@ BPF_CALL_3(bpf_skb_change_head, struct sk_buff *, skb, u32, head_room,
                 skb_reset_mac_header(skb);
         }
 
+        return ret;
+}
+
+BPF_CALL_3(bpf_skb_change_head, struct sk_buff *, skb, u32, head_room,
+           u64, flags)
+{
+        int ret = __bpf_skb_change_head(skb, head_room, flags);
+
         bpf_compute_data_pointers(skb);
-        return 0;
+        return ret;
 }
 
 static const struct bpf_func_proto bpf_skb_change_head_proto = {
@@ -2954,6 +3031,23 @@ static const struct bpf_func_proto bpf_skb_change_head_proto = {
         .arg3_type      = ARG_ANYTHING,
 };
 
+BPF_CALL_3(sk_skb_change_head, struct sk_buff *, skb, u32, head_room,
+           u64, flags)
+{
+        int ret = __bpf_skb_change_head(skb, head_room, flags);
+
+        bpf_compute_data_end_sk_skb(skb);
+        return ret;
+}
+
+static const struct bpf_func_proto sk_skb_change_head_proto = {
+        .func           = sk_skb_change_head,
+        .gpl_only       = false,
+        .ret_type       = RET_INTEGER,
+        .arg1_type      = ARG_PTR_TO_CTX,
+        .arg2_type      = ARG_ANYTHING,
+        .arg3_type      = ARG_ANYTHING,
+};
 static unsigned long xdp_get_metalen(const struct xdp_buff *xdp)
 {
         return xdp_data_meta_unsupported(xdp) ? 0 :
@@ -3046,12 +3140,16 @@ static int __bpf_tx_xdp(struct net_device *dev,
                         u32 index)
 {
         struct xdp_frame *xdpf;
-        int sent;
+        int err, sent;
 
         if (!dev->netdev_ops->ndo_xdp_xmit) {
                 return -EOPNOTSUPP;
         }
 
+        err = xdp_ok_fwd_dev(dev, xdp->data_end - xdp->data);
+        if (unlikely(err))
+                return err;
+
         xdpf = convert_to_xdp_frame(xdp);
         if (unlikely(!xdpf))
                 return -EOVERFLOW;
@@ -3285,7 +3383,8 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,
                 goto err;
         }
 
-        if (unlikely((err = __xdp_generic_ok_fwd_dev(skb, fwd))))
+        err = xdp_ok_fwd_dev(fwd, skb->len);
+        if (unlikely(err))
                 goto err;
 
         skb->dev = fwd;
@@ -4439,10 +4538,10 @@ static const struct bpf_func_proto bpf_lwt_push_encap_proto = {
         .arg4_type      = ARG_CONST_SIZE
 };
 
+#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
 BPF_CALL_4(bpf_lwt_seg6_store_bytes, struct sk_buff *, skb, u32, offset,
            const void *, from, u32, len)
 {
-#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
         struct seg6_bpf_srh_state *srh_state =
                 this_cpu_ptr(&seg6_bpf_srh_states);
         void *srh_tlvs, *srh_end, *ptr;
@@ -4468,9 +4567,6 @@ BPF_CALL_4(bpf_lwt_seg6_store_bytes, struct sk_buff *, skb, u32, offset,
 
         memcpy(skb->data + offset, from, len);
         return 0;
-#else /* CONFIG_IPV6_SEG6_BPF */
-        return -EOPNOTSUPP;
-#endif
 }
 
 static const struct bpf_func_proto bpf_lwt_seg6_store_bytes_proto = {
@@ -4486,7 +4582,6 @@ static const struct bpf_func_proto bpf_lwt_seg6_store_bytes_proto = {
 BPF_CALL_4(bpf_lwt_seg6_action, struct sk_buff *, skb,
            u32, action, void *, param, u32, param_len)
 {
-#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
         struct seg6_bpf_srh_state *srh_state =
                 this_cpu_ptr(&seg6_bpf_srh_states);
         struct ipv6_sr_hdr *srh;
@@ -4534,9 +4629,6 @@ BPF_CALL_4(bpf_lwt_seg6_action, struct sk_buff *, skb,
         default:
                 return -EINVAL;
         }
-#else /* CONFIG_IPV6_SEG6_BPF */
-        return -EOPNOTSUPP;
-#endif
 }
 
 static const struct bpf_func_proto bpf_lwt_seg6_action_proto = {
@@ -4552,7 +4644,6 @@ static const struct bpf_func_proto bpf_lwt_seg6_action_proto = {
 BPF_CALL_3(bpf_lwt_seg6_adjust_srh, struct sk_buff *, skb, u32, offset,
            s32, len)
 {
-#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
         struct seg6_bpf_srh_state *srh_state =
                 this_cpu_ptr(&seg6_bpf_srh_states);
         void *srh_end, *srh_tlvs, *ptr;
@@ -4596,9 +4687,6 @@ BPF_CALL_3(bpf_lwt_seg6_adjust_srh, struct sk_buff *, skb, u32, offset,
         srh_state->hdrlen += len;
         srh_state->valid = 0;
         return 0;
-#else /* CONFIG_IPV6_SEG6_BPF */
-        return -EOPNOTSUPP;
-#endif
 }
 
 static const struct bpf_func_proto bpf_lwt_seg6_adjust_srh_proto = {
@@ -4609,6 +4697,7 @@ static const struct bpf_func_proto bpf_lwt_seg6_adjust_srh_proto = {
         .arg2_type      = ARG_ANYTHING,
         .arg3_type      = ARG_ANYTHING,
 };
+#endif /* CONFIG_IPV6_SEG6_BPF */
 
 bool bpf_helper_changes_pkt_data(void *func)
 {
@@ -4617,9 +4706,12 @@ bool bpf_helper_changes_pkt_data(void *func)
             func == bpf_skb_store_bytes ||
             func == bpf_skb_change_proto ||
             func == bpf_skb_change_head ||
+            func == sk_skb_change_head ||
             func == bpf_skb_change_tail ||
+            func == sk_skb_change_tail ||
             func == bpf_skb_adjust_room ||
             func == bpf_skb_pull_data ||
+            func == sk_skb_pull_data ||
             func == bpf_clone_redirect ||
             func == bpf_l3_csum_replace ||
             func == bpf_l4_csum_replace ||
@@ -4627,11 +4719,12 @@ bool bpf_helper_changes_pkt_data(void *func)
             func == bpf_xdp_adjust_meta ||
             func == bpf_msg_pull_data ||
             func == bpf_xdp_adjust_tail ||
-            func == bpf_lwt_push_encap ||
+#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
             func == bpf_lwt_seg6_store_bytes ||
             func == bpf_lwt_seg6_adjust_srh ||
-            func == bpf_lwt_seg6_action
-            )
+            func == bpf_lwt_seg6_action ||
+#endif
+            func == bpf_lwt_push_encap)
                 return true;
 
         return false;
@@ -4871,11 +4964,11 @@ sk_skb_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
         case BPF_FUNC_skb_load_bytes:
                 return &bpf_skb_load_bytes_proto;
         case BPF_FUNC_skb_pull_data:
-                return &bpf_skb_pull_data_proto;
+                return &sk_skb_pull_data_proto;
         case BPF_FUNC_skb_change_tail:
-                return &bpf_skb_change_tail_proto;
+                return &sk_skb_change_tail_proto;
         case BPF_FUNC_skb_change_head:
-                return &bpf_skb_change_head_proto;
+                return &sk_skb_change_head_proto;
         case BPF_FUNC_get_socket_cookie:
                 return &bpf_get_socket_cookie_proto;
         case BPF_FUNC_get_socket_uid:
@@ -4966,12 +5059,14 @@ static const struct bpf_func_proto *
 lwt_seg6local_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
         switch (func_id) {
+#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
         case BPF_FUNC_lwt_seg6_store_bytes:
                 return &bpf_lwt_seg6_store_bytes_proto;
         case BPF_FUNC_lwt_seg6_action:
                 return &bpf_lwt_seg6_action_proto;
         case BPF_FUNC_lwt_seg6_adjust_srh:
                 return &bpf_lwt_seg6_adjust_srh_proto;
+#endif
         default:
                 return lwt_out_func_proto(func_id, prog);
         }
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index b2b2323bdc84..188d693cb251 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -77,8 +77,20 @@ gnet_stats_start_copy_compat(struct sk_buff *skb, int type, int tc_stats_type,
                 d->lock = lock;
                 spin_lock_bh(lock);
         }
-        if (d->tail)
-                return gnet_stats_copy(d, type, NULL, 0, padattr);
+        if (d->tail) {
+                int ret = gnet_stats_copy(d, type, NULL, 0, padattr);
+
+                /* The initial attribute added in gnet_stats_copy() may be
+                 * preceded by a padding attribute, in which case d->tail will
+                 * end up pointing at the padding instead of the real attribute.
+                 * Fix this so gnet_stats_finish_copy() adjusts the length of
+                 * the right attribute.
+                 */
+                if (ret == 0 && d->tail->nla_type == padattr)
+                        d->tail = (struct nlattr *)((char *)d->tail +
+                                                    NLA_ALIGN(d->tail->nla_len));
+                return ret;
+        }
 
         return 0;
 }
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index e7e626fb87bb..e45098593dc0 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -217,7 +217,7 @@ static int bpf_parse_prog(struct nlattr *attr, struct bpf_lwt_prog *prog,
         if (!tb[LWT_BPF_PROG_FD] || !tb[LWT_BPF_PROG_NAME])
                 return -EINVAL;
 
-        prog->name = nla_memdup(tb[LWT_BPF_PROG_NAME], GFP_KERNEL);
+        prog->name = nla_memdup(tb[LWT_BPF_PROG_NAME], GFP_ATOMIC);
         if (!prog->name)
                 return -ENOMEM;
 
diff --git a/net/core/page_pool.c b/net/core/page_pool.c
index 68bf07206744..43a932cb609b 100644
--- a/net/core/page_pool.c
+++ b/net/core/page_pool.c
@@ -269,7 +269,7 @@ static void __page_pool_empty_ring(struct page_pool *pool)
         struct page *page;
 
         /* Empty recycle ring */
-        while ((page = ptr_ring_consume(&pool->ring))) {
+        while ((page = ptr_ring_consume_bh(&pool->ring))) {
                 /* Verify the refcnt invariant of cached pages */
                 if (!(page_ref_count(page) == 1))
                         pr_crit("%s() page_pool refcnt %d violation\n",
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 5ef61222fdef..e3f743c141b3 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2759,9 +2759,12 @@ int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm)
                         return err;
         }
 
-        dev->rtnl_link_state = RTNL_LINK_INITIALIZED;
-
-        __dev_notify_flags(dev, old_flags, ~0U);
+        if (dev->rtnl_link_state == RTNL_LINK_INITIALIZED) {
+                __dev_notify_flags(dev, old_flags, 0U);
+        } else {
+                dev->rtnl_link_state = RTNL_LINK_INITIALIZED;
+                __dev_notify_flags(dev, old_flags, ~0U);
+        }
         return 0;
 }
 EXPORT_SYMBOL(rtnl_configure_link);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index eba8dae22c25..fb35b62af272 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -858,6 +858,7 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
         n->cloned = 1;
         n->nohdr = 0;
         n->peeked = 0;
+        C(pfmemalloc);
         n->destructor = NULL;
         C(tail);
         C(end);
@@ -3719,6 +3720,7 @@ normal:
                                 net_warn_ratelimited(
                                         "skb_segment: too many frags: %u %u\n",
                                         pos, mss);
+                                err = -EINVAL;
                                 goto err;
                         }
 
@@ -3752,11 +3754,10 @@ skip_fraglist:
 
 perform_csum_check:
                 if (!csum) {
-                        if (skb_has_shared_frag(nskb)) {
-                                err = __skb_linearize(nskb);
-                                if (err)
-                                        goto err;
-                        }
+                        if (skb_has_shared_frag(nskb) &&
+                            __skb_linearize(nskb))
+                                goto err;
+
                         if (!nskb->remcsum_offload)
                                 nskb->ip_summed = CHECKSUM_NONE;
                         SKB_GSO_CB(nskb)->csum =
diff --git a/net/core/sock.c b/net/core/sock.c
index 9e8f65585b81..bc2d7a37297f 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2277,9 +2277,9 @@ int sk_alloc_sg(struct sock *sk, int len, struct scatterlist *sg,
                 pfrag->offset += use;
 
                 sge = sg + sg_curr - 1;
-                if (sg_curr > first_coalesce && sg_page(sg) == pfrag->page &&
-                    sg->offset + sg->length == orig_offset) {
-                        sg->length += use;
+                if (sg_curr > first_coalesce && sg_page(sge) == pfrag->page &&
+                    sge->offset + sge->length == orig_offset) {
+                        sge->length += use;
                 } else {
                         sge = sg + sg_curr;
                         sg_unmark_end(sge);
diff --git a/net/core/xdp.c b/net/core/xdp.c
index 9d1f22072d5d..6771f1855b96 100644
--- a/net/core/xdp.c
+++ b/net/core/xdp.c
@@ -345,7 +345,8 @@ static void __xdp_return(void *data, struct xdp_mem_info *mem, bool napi_direct,
                 rcu_read_lock();
                 /* mem->id is valid, checked in xdp_rxq_info_reg_mem_model() */
                 xa = rhashtable_lookup(mem_id_ht, &mem->id, mem_id_rht_params);
-                xa->zc_alloc->free(xa->zc_alloc, handle);
+                if (!WARN_ON_ONCE(!xa))
+                        xa->zc_alloc->free(xa->zc_alloc, handle);
                 rcu_read_unlock();
         default:
                 /* Not possible, checked in xdp_rxq_info_reg_mem_model() */
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index 40c851693f77..0c9478b91fa5 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -86,35 +86,39 @@ dns_resolver_preparse(struct key_preparsed_payload *prep)
                 opt++;
                 kdebug("options: '%s'", opt);
                 do {
+                        int opt_len, opt_nlen;
                         const char *eq;
-                        int opt_len, opt_nlen, opt_vlen, tmp;
+                        char optval[128];
 
                         next_opt = memchr(opt, '#', end - opt) ?: end;
                         opt_len = next_opt - opt;
-                        if (opt_len <= 0 || opt_len > 128) {
+                        if (opt_len <= 0 || opt_len > sizeof(optval)) {
                                 pr_warn_ratelimited("Invalid option length (%d) for dns_resolver key\n",
                                                     opt_len);
                                 return -EINVAL;
                         }
 
-                        eq = memchr(opt, '=', opt_len) ?: end;
-                        opt_nlen = eq - opt;
-                        eq++;
-                        opt_vlen = next_opt - eq; /* will be -1 if no value */
+                        eq = memchr(opt, '=', opt_len);
+                        if (eq) {
+                                opt_nlen = eq - opt;
+                                eq++;
+                                memcpy(optval, eq, next_opt - eq);
+                                optval[next_opt - eq] = '\0';
+                        } else {
+                                opt_nlen = opt_len;
+                                optval[0] = '\0';
+                        }
 
-                        tmp = opt_vlen >= 0 ? opt_vlen : 0;
-                        kdebug("option '%*.*s' val '%*.*s'",
-                               opt_nlen, opt_nlen, opt, tmp, tmp, eq);
+                        kdebug("option '%*.*s' val '%s'",
+                               opt_nlen, opt_nlen, opt, optval);
 
                         /* see if it's an error number representing a DNS error
                          * that's to be recorded as the result in this key */
                         if (opt_nlen == sizeof(DNS_ERRORNO_OPTION) - 1 &&
                             memcmp(opt, DNS_ERRORNO_OPTION, opt_nlen) == 0) {
                                 kdebug("dns error number option");
-                                if (opt_vlen <= 0)
-                                        goto bad_option_value;
 
-                                ret = kstrtoul(eq, 10, &derrno);
+                                ret = kstrtoul(optval, 10, &derrno);
                                 if (ret < 0)
                                         goto bad_option_value;
 
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 1e3b6a6d8a40..732369c80644 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1248,6 +1248,9 @@ int dsa_slave_suspend(struct net_device *slave_dev)
 {
         struct dsa_port *dp = dsa_slave_to_port(slave_dev);
 
+        if (!netif_running(slave_dev))
+                return 0;
+
         netif_device_detach(slave_dev);
 
         rtnl_lock();
@@ -1261,6 +1264,9 @@ int dsa_slave_resume(struct net_device *slave_dev)
 {
         struct dsa_port *dp = dsa_slave_to_port(slave_dev);
 
+        if (!netif_running(slave_dev))
+                return 0;
+
         netif_device_attach(slave_dev);
 
         rtnl_lock();
diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
index 275449b0d633..3297e7fa9945 100644
--- a/net/ieee802154/6lowpan/core.c
+++ b/net/ieee802154/6lowpan/core.c
@@ -90,12 +90,18 @@ static int lowpan_neigh_construct(struct net_device *dev, struct neighbour *n)
         return 0;
 }
 
+static int lowpan_get_iflink(const struct net_device *dev)
+{
+        return lowpan_802154_dev(dev)->wdev->ifindex;
+}
+
 static const struct net_device_ops lowpan_netdev_ops = {
         .ndo_init               = lowpan_dev_init,
         .ndo_start_xmit         = lowpan_xmit,
         .ndo_open               = lowpan_open,
         .ndo_stop               = lowpan_stop,
         .ndo_neigh_construct    = lowpan_neigh_construct,
+        .ndo_get_iflink         = lowpan_get_iflink,
 };
 
 static void lowpan_setup(struct net_device *ldev)
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index b21833651394..2998b0e47d4b 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -292,18 +292,19 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
                 return ip_hdr(skb)->daddr;
 
         in_dev = __in_dev_get_rcu(dev);
-        BUG_ON(!in_dev);
 
         net = dev_net(dev);
 
         scope = RT_SCOPE_UNIVERSE;
         if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) {
+                bool vmark = in_dev && IN_DEV_SRC_VMARK(in_dev);
                 struct flowi4 fl4 = {
                         .flowi4_iif = LOOPBACK_IFINDEX,
+                        .flowi4_oif = l3mdev_master_ifindex_rcu(dev),
                         .daddr = ip_hdr(skb)->saddr,
                         .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
                         .flowi4_scope = scope,
-                        .flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0,
+                        .flowi4_mark = vmark ? skb->mark : 0,
                 };
                 if (!fib_lookup(net, &fl4, &res, 0))
                         return FIB_RES_PREFSRC(net, res);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 85b617b655bc..75151be21413 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1200,13 +1200,13 @@ static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im)
         spin_lock_bh(&im->lock);
         if (pmc) {
                 im->interface = pmc->interface;
-                im->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
-                im->sfmode = pmc->sfmode;
-                if (pmc->sfmode == MCAST_INCLUDE) {
+                if (im->sfmode == MCAST_INCLUDE) {
                         im->tomb = pmc->tomb;
                         im->sources = pmc->sources;
                         for (psf = im->sources; psf; psf = psf->sf_next)
-                                psf->sf_crcount = im->crcount;
+                                psf->sf_crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
+                } else {
+                        im->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
                 }
                 in_dev_put(pmc->interface);
                 kfree(pmc);
@@ -1288,7 +1288,7 @@ static void igmp_group_dropped(struct ip_mc_list *im)
 #endif
 }
 
-static void igmp_group_added(struct ip_mc_list *im)
+static void igmp_group_added(struct ip_mc_list *im, unsigned int mode)
 {
         struct in_device *in_dev = im->interface;
 #ifdef CONFIG_IP_MULTICAST
@@ -1316,7 +1316,13 @@ static void igmp_group_added(struct ip_mc_list *im)
         }
         /* else, v3 */
 
-        im->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
+        /* Based on RFC3376 5.1, for newly added INCLUDE SSM, we should
+         * not send filter-mode change record as the mode should be from
+         * IN() to IN(A).
+         */
+        if (mode == MCAST_EXCLUDE)
+                im->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
+
         igmp_ifc_event(in_dev);
 #endif
 }
@@ -1381,8 +1387,8 @@ static void ip_mc_hash_remove(struct in_device *in_dev,
 /*
  *      A socket has joined a multicast group on device dev.
  */
-
-void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
+static void __ip_mc_inc_group(struct in_device *in_dev, __be32 addr,
+                              unsigned int mode)
 {
         struct ip_mc_list *im;
 #ifdef CONFIG_IP_MULTICAST
@@ -1394,7 +1400,7 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
         for_each_pmc_rtnl(in_dev, im) {
                 if (im->multiaddr == addr) {
                         im->users++;
-                        ip_mc_add_src(in_dev, &addr, MCAST_EXCLUDE, 0, NULL, 0);
+                        ip_mc_add_src(in_dev, &addr, mode, 0, NULL, 0);
                         goto out;
                 }
         }
@@ -1408,8 +1414,8 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
         in_dev_hold(in_dev);
         im->multiaddr = addr;
         /* initial mode is (EX, empty) */
-        im->sfmode = MCAST_EXCLUDE;
-        im->sfcount[MCAST_EXCLUDE] = 1;
+        im->sfmode = mode;
+        im->sfcount[mode] = 1;
         refcount_set(&im->refcnt, 1);
         spin_lock_init(&im->lock);
 #ifdef CONFIG_IP_MULTICAST
@@ -1426,12 +1432,17 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
 #ifdef CONFIG_IP_MULTICAST
         igmpv3_del_delrec(in_dev, im);
 #endif
-        igmp_group_added(im);
+        igmp_group_added(im, mode);
         if (!in_dev->dead)
                 ip_rt_multicast_event(in_dev);
 out:
         return;
 }
+
+void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
+{
+        __ip_mc_inc_group(in_dev, addr, MCAST_EXCLUDE);
+}
 EXPORT_SYMBOL(ip_mc_inc_group);
 
 static int ip_mc_check_iphdr(struct sk_buff *skb)
@@ -1688,7 +1699,7 @@ void ip_mc_remap(struct in_device *in_dev)
 #ifdef CONFIG_IP_MULTICAST
                 igmpv3_del_delrec(in_dev, pmc);
 #endif
-                igmp_group_added(pmc);
+                igmp_group_added(pmc, pmc->sfmode);
         }
 }
 
@@ -1751,7 +1762,7 @@ void ip_mc_up(struct in_device *in_dev)
 #ifdef CONFIG_IP_MULTICAST
                 igmpv3_del_delrec(in_dev, pmc);
 #endif
-                igmp_group_added(pmc);
+                igmp_group_added(pmc, pmc->sfmode);
         }
 }
 
@@ -2130,8 +2141,8 @@ static void ip_mc_clear_src(struct ip_mc_list *pmc)
 
 /* Join a multicast group
  */
-
-int ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr)
+static int __ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr,
+                              unsigned int mode)
 {
         __be32 addr = imr->imr_multiaddr.s_addr;
         struct ip_mc_socklist *iml, *i;
@@ -2172,15 +2183,30 @@ int ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr)
         memcpy(&iml->multi, imr, sizeof(*imr));
         iml->next_rcu = inet->mc_list;
         iml->sflist = NULL;
-        iml->sfmode = MCAST_EXCLUDE;
+        iml->sfmode = mode;
         rcu_assign_pointer(inet->mc_list, iml);
-        ip_mc_inc_group(in_dev, addr);
+        __ip_mc_inc_group(in_dev, addr, mode);
         err = 0;
 done:
         return err;
 }
+
+/* Join ASM (Any-Source Multicast) group
+ */
+int ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr)
+{
+        return __ip_mc_join_group(sk, imr, MCAST_EXCLUDE);
+}
 EXPORT_SYMBOL(ip_mc_join_group);
 
+/* Join SSM (Source-Specific Multicast) group
+ */
+int ip_mc_join_group_ssm(struct sock *sk, struct ip_mreqn *imr,
+                         unsigned int mode)
+{
+        return __ip_mc_join_group(sk, imr, mode);
+}
+
 static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
                            struct in_device *in_dev)
 {
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index c9e35b81d093..0d70608cc2e1 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -90,7 +90,7 @@ static void inet_frags_free_cb(void *ptr, void *arg)
 
 void inet_frags_exit_net(struct netns_frags *nf)
 {
-        nf->low_thresh = 0; /* prevent creation of new frags */
+        nf->high_thresh = 0; /* prevent creation of new frags */
 
         rhashtable_free_and_destroy(&nf->rhashtable, inet_frags_free_cb, NULL);
 }
@@ -157,9 +157,6 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf,
 {
         struct inet_frag_queue *q;
 
-        if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh)
-                return NULL;
-
         q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC);
         if (!q)
                 return NULL;
@@ -204,6 +201,9 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key)
 {
         struct inet_frag_queue *fq;
 
+        if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh)
+                return NULL;
+
         rcu_read_lock();
 
         fq = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 8e9528ebaa8e..d14d741fb05e 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -383,11 +383,16 @@ found:
                 int i = end - next->ip_defrag_offset; /* overlap is 'i' bytes */
 
                 if (i < next->len) {
+                        int delta = -next->truesize;
+
                         /* Eat head of the next overlapped fragment
                          * and leave the loop. The next ones cannot overlap.
                          */
                         if (!pskb_pull(next, i))
                                 goto err;
+                        delta += next->truesize;
+                        if (delta)
+                                add_frag_mem_limit(qp->q.net, delta);
                         next->ip_defrag_offset += i;
                         qp->q.meat -= i;
                         if (next->ip_summed != CHECKSUM_UNNECESSARY)
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index b3308e9d9762..0e3edd25f881 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -523,6 +523,8 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->dev = from->dev;
         to->mark = from->mark;
 
+        skb_copy_hash(to, from);
+
         /* Copy the flags to each fragment. */
         IPCB(to)->flags = IPCB(from)->flags;
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index fc32fdbeefa6..c0fe5ad996f2 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -150,15 +150,18 @@ static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)
 {
         struct sockaddr_in sin;
         const struct iphdr *iph = ip_hdr(skb);
-        __be16 *ports = (__be16 *)skb_transport_header(skb);
+        __be16 *ports;
+        int end;
 
-        if (skb_transport_offset(skb) + 4 > (int)skb->len)
+        end = skb_transport_offset(skb) + 4;
+        if (end > 0 && !pskb_may_pull(skb, end))
                 return;
 
         /* All current transport protocols have the port numbers in the
          * first four bytes of the transport header and this function is
          * written with this assumption in mind.
          */
+        ports = (__be16 *)skb_transport_header(skb);
 
         sin.sin_family = AF_INET;
         sin.sin_addr.s_addr = iph->daddr;
@@ -984,7 +987,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                         mreq.imr_multiaddr.s_addr = mreqs.imr_multiaddr;
                         mreq.imr_address.s_addr = mreqs.imr_interface;
                         mreq.imr_ifindex = 0;
-                        err = ip_mc_join_group(sk, &mreq);
+                        err = ip_mc_join_group_ssm(sk, &mreq, MCAST_INCLUDE);
                         if (err && err != -EADDRINUSE)
                                 break;
                         omode = MCAST_INCLUDE;
@@ -1061,7 +1064,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                         mreq.imr_multiaddr = psin->sin_addr;
                         mreq.imr_address.s_addr = 0;
                         mreq.imr_ifindex = greqs.gsr_interface;
-                        err = ip_mc_join_group(sk, &mreq);
+                        err = ip_mc_join_group_ssm(sk, &mreq, MCAST_INCLUDE);
                         if (err && err != -EADDRINUSE)
                                 break;
                         greqs.gsr_interface = mreq.imr_ifindex;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index ca0dad90803a..e77872c93c20 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1898,6 +1898,7 @@ static struct xt_match ipt_builtin_mt[] __read_mostly = {
                 .checkentry = icmp_checkentry,
                 .proto      = IPPROTO_ICMP,
                 .family     = NFPROTO_IPV4,
+                .me         = THIS_MODULE,
         },
 };
 
diff --git a/net/ipv4/netfilter/nf_tproxy_ipv4.c b/net/ipv4/netfilter/nf_tproxy_ipv4.c
index 805e83ec3ad9..164714104965 100644
--- a/net/ipv4/netfilter/nf_tproxy_ipv4.c
+++ b/net/ipv4/netfilter/nf_tproxy_ipv4.c
@@ -37,7 +37,7 @@ nf_tproxy_handle_time_wait4(struct net *net, struct sk_buff *skb,
                  * to a listener socket if there's one */
                 struct sock *sk2;
 
-                sk2 = nf_tproxy_get_sock_v4(net, skb, hp, iph->protocol,
+                sk2 = nf_tproxy_get_sock_v4(net, skb, iph->protocol,
                                             iph->saddr, laddr ? laddr : iph->daddr,
                                             hp->source, lport ? lport : hp->dest,
                                             skb->dev, NF_TPROXY_LOOKUP_LISTENER);
@@ -71,7 +71,7 @@ __be32 nf_tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr)
 EXPORT_SYMBOL_GPL(nf_tproxy_laddr4);
 
 struct sock *
-nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb, void *hp,
+nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb,
                       const u8 protocol,
                       const __be32 saddr, const __be32 daddr,
                       const __be16 sport, const __be16 dport,
@@ -79,16 +79,21 @@ nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb, void *hp,
                       const enum nf_tproxy_lookup_t lookup_type)
 {
         struct sock *sk;
-        struct tcphdr *tcph;
 
         switch (protocol) {
-        case IPPROTO_TCP:
+        case IPPROTO_TCP: {
+                struct tcphdr _hdr, *hp;
+
+                hp = skb_header_pointer(skb, ip_hdrlen(skb),
+                                        sizeof(struct tcphdr), &_hdr);
+                if (hp == NULL)
+                        return NULL;
+
                 switch (lookup_type) {
                 case NF_TPROXY_LOOKUP_LISTENER:
-                        tcph = hp;
                         sk = inet_lookup_listener(net, &tcp_hashinfo, skb,
                                                     ip_hdrlen(skb) +
-                                                      __tcp_hdrlen(tcph),
+                                                      __tcp_hdrlen(hp),
                                                     saddr, sport,
                                                     daddr, dport,
                                                     in->ifindex, 0);
@@ -110,6 +115,7 @@ nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb, void *hp,
                         BUG();
                 }
                 break;
+                }
         case IPPROTO_UDP:
                 sk = udp4_lib_lookup(net, saddr, sport, daddr, dport,
                                      in->ifindex);
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index af0a857d8352..5fa335fd3852 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -189,8 +189,9 @@ static int ipv4_ping_group_range(struct ctl_table *table, int write,
         if (write && ret == 0) {
                 low = make_kgid(user_ns, urange[0]);
                 high = make_kgid(user_ns, urange[1]);
-                if (!gid_valid(low) || !gid_valid(high) ||
-                    (urange[1] < urange[0]) || gid_lt(high, low)) {
+                if (!gid_valid(low) || !gid_valid(high))
+                        return -EINVAL;
+                if (urange[1] < urange[0] || gid_lt(high, low)) {
                         low = make_kgid(&init_user_ns, 1);
                         high = make_kgid(&init_user_ns, 0);
                 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index e7b53d2a971f..4491faf83f4f 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1998,7 +1998,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
                          * shouldn't happen.
                          */
                         if (WARN(before(*seq, TCP_SKB_CB(skb)->seq),
-                                 "recvmsg bug: copied %X seq %X rcvnxt %X fl %X\n",
+                                 "TCP recvmsg seq # bug: copied %X, seq %X, rcvnxt %X, fl %X\n",
                                  *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt,
                                  flags))
                                 break;
@@ -2013,7 +2013,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
                         if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
                                 goto found_fin_ok;
                         WARN(!(flags & MSG_PEEK),
-                             "recvmsg bug 2: copied %X seq %X rcvnxt %X fl %X\n",
+                             "TCP recvmsg seq # bug 2: copied %X, seq %X, rcvnxt %X, fl %X\n",
                              *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, flags);
                 }
 
@@ -2562,6 +2562,8 @@ int tcp_disconnect(struct sock *sk, int flags)
 
         tcp_clear_xmit_timers(sk);
         __skb_queue_purge(&sk->sk_receive_queue);
+        tp->copied_seq = tp->rcv_nxt;
+        tp->urg_data = 0;
         tcp_write_queue_purge(sk);
         tcp_fastopen_active_disable_ofo_check(sk);
         skb_rbtree_purge(&tp->out_of_order_queue);
@@ -2821,14 +2823,17 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
         case TCP_REPAIR:
                 if (!tcp_can_repair_sock(sk))
                         err = -EPERM;
-                else if (val == 1) {
+                else if (val == TCP_REPAIR_ON) {
                         tp->repair = 1;
                         sk->sk_reuse = SK_FORCE_REUSE;
                         tp->repair_queue = TCP_NO_QUEUE;
-                } else if (val == 0) {
+                } else if (val == TCP_REPAIR_OFF) {
                         tp->repair = 0;
                         sk->sk_reuse = SK_NO_REUSE;
                         tcp_send_window_probe(sk);
+                } else if (val == TCP_REPAIR_OFF_NO_WP) {
+                        tp->repair = 0;
+                        sk->sk_reuse = SK_NO_REUSE;
                 } else
                         err = -EINVAL;
 
@@ -3720,8 +3725,7 @@ int tcp_abort(struct sock *sk, int err)
                         struct request_sock *req = inet_reqsk(sk);
 
                         local_bh_disable();
-                        inet_csk_reqsk_queue_drop_and_put(req->rsk_listener,
-                                                          req);
+                        inet_csk_reqsk_queue_drop(req->rsk_listener, req);
                         local_bh_enable();
                         return 0;
                 }
diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
index 58e2f479ffb4..4bfff3c87e8e 100644
--- a/net/ipv4/tcp_bbr.c
+++ b/net/ipv4/tcp_bbr.c
@@ -354,6 +354,10 @@ static u32 bbr_target_cwnd(struct sock *sk, u32 bw, int gain)
         /* Reduce delayed ACKs by rounding up cwnd to the next even number. */
         cwnd = (cwnd + 1) & ~1U;
 
+        /* Ensure gain cycling gets inflight above BDP even for small BDPs. */
+        if (bbr->mode == BBR_PROBE_BW && gain > BBR_UNIT)
+                cwnd += 2;
+
         return cwnd;
 }
 
diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
index 5f5e5936760e..8b637f9f23a2 100644
--- a/net/ipv4/tcp_dctcp.c
+++ b/net/ipv4/tcp_dctcp.c
@@ -55,7 +55,6 @@ struct dctcp {
         u32 dctcp_alpha;
         u32 next_seq;
         u32 ce_state;
-        u32 delayed_ack_reserved;
         u32 loss_cwnd;
 };
 
@@ -96,7 +95,6 @@ static void dctcp_init(struct sock *sk)
 
                 ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA);
 
-                ca->delayed_ack_reserved = 0;
                 ca->loss_cwnd = 0;
                 ca->ce_state = 0;
 
@@ -131,23 +129,14 @@ static void dctcp_ce_state_0_to_1(struct sock *sk)
         struct dctcp *ca = inet_csk_ca(sk);
         struct tcp_sock *tp = tcp_sk(sk);
 
-        /* State has changed from CE=0 to CE=1 and delayed
-         * ACK has not sent yet.
-         */
-        if (!ca->ce_state && ca->delayed_ack_reserved) {
-                u32 tmp_rcv_nxt;
-
-                /* Save current rcv_nxt. */
-                tmp_rcv_nxt = tp->rcv_nxt;
-
-                /* Generate previous ack with CE=0. */
-                tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR;
-                tp->rcv_nxt = ca->prior_rcv_nxt;
-
-                tcp_send_ack(sk);
-
-                /* Recover current rcv_nxt. */
-                tp->rcv_nxt = tmp_rcv_nxt;
+        if (!ca->ce_state) {
+                /* State has changed from CE=0 to CE=1, force an immediate
+                 * ACK to reflect the new CE state. If an ACK was delayed,
+                 * send that first to reflect the prior CE state.
+                 */
+                if (inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER)
+                        __tcp_send_ack(sk, ca->prior_rcv_nxt);
+                tcp_enter_quickack_mode(sk, 1);
         }
 
         ca->prior_rcv_nxt = tp->rcv_nxt;
@@ -161,23 +150,14 @@ static void dctcp_ce_state_1_to_0(struct sock *sk)
         struct dctcp *ca = inet_csk_ca(sk);
         struct tcp_sock *tp = tcp_sk(sk);
 
-        /* State has changed from CE=1 to CE=0 and delayed
-         * ACK has not sent yet.
-         */
-        if (ca->ce_state && ca->delayed_ack_reserved) {
-                u32 tmp_rcv_nxt;
-
-                /* Save current rcv_nxt. */
-                tmp_rcv_nxt = tp->rcv_nxt;
-
-                /* Generate previous ack with CE=1. */
-                tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
-                tp->rcv_nxt = ca->prior_rcv_nxt;
-
-                tcp_send_ack(sk);
-
-                /* Recover current rcv_nxt. */
-                tp->rcv_nxt = tmp_rcv_nxt;
+        if (ca->ce_state) {
+                /* State has changed from CE=1 to CE=0, force an immediate
+                 * ACK to reflect the new CE state. If an ACK was delayed,
+                 * send that first to reflect the prior CE state.
+                 */
+                if (inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER)
+                        __tcp_send_ack(sk, ca->prior_rcv_nxt);
+                tcp_enter_quickack_mode(sk, 1);
         }
 
         ca->prior_rcv_nxt = tp->rcv_nxt;
@@ -248,25 +228,6 @@ static void dctcp_state(struct sock *sk, u8 new_state)
         }
 }
 
-static void dctcp_update_ack_reserved(struct sock *sk, enum tcp_ca_event ev)
-{
-        struct dctcp *ca = inet_csk_ca(sk);
-
-        switch (ev) {
-        case CA_EVENT_DELAYED_ACK:
-                if (!ca->delayed_ack_reserved)
-                        ca->delayed_ack_reserved = 1;
-                break;
-        case CA_EVENT_NON_DELAYED_ACK:
-                if (ca->delayed_ack_reserved)
-                        ca->delayed_ack_reserved = 0;
-                break;
-        default:
-                /* Don't care for the rest. */
-                break;
-        }
-}
-
 static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
 {
         switch (ev) {
@@ -276,10 +237,6 @@ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
         case CA_EVENT_ECN_NO_CE:
                 dctcp_ce_state_1_to_0(sk);
                 break;
-        case CA_EVENT_DELAYED_ACK:
-        case CA_EVENT_NON_DELAYED_ACK:
-                dctcp_update_ack_reserved(sk, ev);
-                break;
         default:
                 /* Don't care for the rest. */
                 break;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 8e5522c6833a..f9dcb29be12d 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -215,7 +215,7 @@ static void tcp_incr_quickack(struct sock *sk, unsigned int max_quickacks)
                 icsk->icsk_ack.quick = quickacks;
 }
 
-static void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks)
+void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
 
@@ -223,6 +223,7 @@ static void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks)
         icsk->icsk_ack.pingpong = 0;
         icsk->icsk_ack.ato = TCP_ATO_MIN;
 }
+EXPORT_SYMBOL(tcp_enter_quickack_mode);
 
 /* Send ACKs quickly, if "quick" count is not exhausted
  * and the session is not interactive.
@@ -245,8 +246,15 @@ static void tcp_ecn_queue_cwr(struct tcp_sock *tp)
 
 static void tcp_ecn_accept_cwr(struct tcp_sock *tp, const struct sk_buff *skb)
 {
-        if (tcp_hdr(skb)->cwr)
+        if (tcp_hdr(skb)->cwr) {
                 tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR;
+
+                /* If the sender is telling us it has entered CWR, then its
+                 * cwnd may be very low (even just 1 packet), so we should ACK
+                 * immediately.
+                 */
+                tcp_enter_quickack_mode((struct sock *)tp, 2);
+        }
 }
 
 static void tcp_ecn_withdraw_cwr(struct tcp_sock *tp)
@@ -4357,6 +4365,23 @@ static bool tcp_try_coalesce(struct sock *sk,
         return true;
 }
 
+static bool tcp_ooo_try_coalesce(struct sock *sk,
+                             struct sk_buff *to,
+                             struct sk_buff *from,
+                             bool *fragstolen)
+{
+        bool res = tcp_try_coalesce(sk, to, from, fragstolen);
+
+        /* In case tcp_drop() is called later, update to->gso_segs */
+        if (res) {
+                u32 gso_segs = max_t(u16, 1, skb_shinfo(to)->gso_segs) +
+                               max_t(u16, 1, skb_shinfo(from)->gso_segs);
+
+                skb_shinfo(to)->gso_segs = min_t(u32, gso_segs, 0xFFFF);
+        }
+        return res;
+}
+
 static void tcp_drop(struct sock *sk, struct sk_buff *skb)
 {
         sk_drops_add(sk, skb);
@@ -4480,8 +4505,8 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
         /* In the typical case, we are adding an skb to the end of the list.
          * Use of ooo_last_skb avoids the O(Log(N)) rbtree lookup.
          */
-        if (tcp_try_coalesce(sk, tp->ooo_last_skb,
-                             skb, &fragstolen)) {
+        if (tcp_ooo_try_coalesce(sk, tp->ooo_last_skb,
+                                 skb, &fragstolen)) {
 coalesce_done:
                 tcp_grow_window(sk, skb);
                 kfree_skb_partial(skb, fragstolen);
@@ -4509,7 +4534,7 @@ coalesce_done:
                                 /* All the bits are present. Drop. */
                                 NET_INC_STATS(sock_net(sk),
                                               LINUX_MIB_TCPOFOMERGE);
-                                __kfree_skb(skb);
+                                tcp_drop(sk, skb);
                                 skb = NULL;
                                 tcp_dsack_set(sk, seq, end_seq);
                                 goto add_sack;
@@ -4528,11 +4553,11 @@ coalesce_done:
                                                  TCP_SKB_CB(skb1)->end_seq);
                                 NET_INC_STATS(sock_net(sk),
                                               LINUX_MIB_TCPOFOMERGE);
-                                __kfree_skb(skb1);
+                                tcp_drop(sk, skb1);
                                 goto merge_right;
                         }
-                } else if (tcp_try_coalesce(sk, skb1,
-                                            skb, &fragstolen)) {
+                } else if (tcp_ooo_try_coalesce(sk, skb1,
+                                                skb, &fragstolen)) {
                         goto coalesce_done;
                 }
                 p = &parent->rb_right;
@@ -4901,6 +4926,7 @@ end:
 static void tcp_collapse_ofo_queue(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
+        u32 range_truesize, sum_tiny = 0;
         struct sk_buff *skb, *head;
         u32 start, end;
 
@@ -4912,6 +4938,7 @@ new_range:
         }
         start = TCP_SKB_CB(skb)->seq;
         end = TCP_SKB_CB(skb)->end_seq;
+        range_truesize = skb->truesize;
 
         for (head = skb;;) {
                 skb = skb_rb_next(skb);
@@ -4922,11 +4949,20 @@ new_range:
                 if (!skb ||
                     after(TCP_SKB_CB(skb)->seq, end) ||
                     before(TCP_SKB_CB(skb)->end_seq, start)) {
-                        tcp_collapse(sk, NULL, &tp->out_of_order_queue,
-                                     head, skb, start, end);
+                        /* Do not attempt collapsing tiny skbs */
+                        if (range_truesize != head->truesize ||
+                            end - start >= SKB_WITH_OVERHEAD(SK_MEM_QUANTUM)) {
+                                tcp_collapse(sk, NULL, &tp->out_of_order_queue,
+                                             head, skb, start, end);
+                        } else {
+                                sum_tiny += range_truesize;
+                                if (sum_tiny > sk->sk_rcvbuf >> 3)
+                                        return;
+                        }
                         goto new_range;
                 }
 
+                range_truesize += skb->truesize;
                 if (unlikely(before(TCP_SKB_CB(skb)->seq, start)))
                         start = TCP_SKB_CB(skb)->seq;
                 if (after(TCP_SKB_CB(skb)->end_seq, end))
@@ -4941,6 +4977,7 @@ new_range:
  * 2) not add too big latencies if thousands of packets sit there.
  *    (But if application shrinks SO_RCVBUF, we could still end up
  *     freeing whole queue here)
+ * 3) Drop at least 12.5 % of sk_rcvbuf to avoid malicious attacks.
  *
  * Return true if queue has shrunk.
  */
@@ -4948,20 +4985,26 @@ static bool tcp_prune_ofo_queue(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct rb_node *node, *prev;
+        int goal;
 
         if (RB_EMPTY_ROOT(&tp->out_of_order_queue))
                 return false;
 
         NET_INC_STATS(sock_net(sk), LINUX_MIB_OFOPRUNED);
+        goal = sk->sk_rcvbuf >> 3;
         node = &tp->ooo_last_skb->rbnode;
         do {
                 prev = rb_prev(node);
                 rb_erase(node, &tp->out_of_order_queue);
+                goal -= rb_to_skb(node)->truesize;
                 tcp_drop(sk, rb_to_skb(node));
-                sk_mem_reclaim(sk);
-                if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
-                    !tcp_under_memory_pressure(sk))
-                        break;
+                if (!prev || goal <= 0) {
+                        sk_mem_reclaim(sk);
+                        if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
+                            !tcp_under_memory_pressure(sk))
+                                break;
+                        goal = sk->sk_rcvbuf >> 3;
+                }
                 node = prev;
         } while (node);
         tp->ooo_last_skb = rb_to_skb(prev);
@@ -4996,6 +5039,9 @@ static int tcp_prune_queue(struct sock *sk)
         else if (tcp_under_memory_pressure(sk))
                 tp->rcv_ssthresh = min(tp->rcv_ssthresh, 4U * tp->advmss);
 
+        if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf)
+                return 0;
+
         tcp_collapse_ofo_queue(sk);
         if (!skb_queue_empty(&sk->sk_receive_queue))
                 tcp_collapse(sk, &sk->sk_receive_queue, NULL,
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index bea17f1e8302..3b2711e33e4c 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -156,11 +156,24 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
          */
         if (tcptw->tw_ts_recent_stamp &&
             (!twp || (reuse && get_seconds() - tcptw->tw_ts_recent_stamp > 1))) {
-                tp->write_seq = tcptw->tw_snd_nxt + 65535 + 2;
-                if (tp->write_seq == 0)
-                        tp->write_seq = 1;
-                tp->rx_opt.ts_recent       = tcptw->tw_ts_recent;
-                tp->rx_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
+                /* In case of repair and re-using TIME-WAIT sockets we still
+                 * want to be sure that it is safe as above but honor the
+                 * sequence numbers and time stamps set as part of the repair
+                 * process.
+                 *
+                 * Without this check re-using a TIME-WAIT socket with TCP
+                 * repair would accumulate a -1 on the repair assigned
+                 * sequence number. The first time it is reused the sequence
+                 * is -1, the second time -2, etc. This fixes that issue
+                 * without appearing to create any others.
+                 */
+                if (likely(!tp->repair)) {
+                        tp->write_seq = tcptw->tw_snd_nxt + 65535 + 2;
+                        if (tp->write_seq == 0)
+                                tp->write_seq = 1;
+                        tp->rx_opt.ts_recent       = tcptw->tw_ts_recent;
+                        tp->rx_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
+                }
                 sock_hold(sktw);
                 return 1;
         }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 8e08b409c71e..c4172c1fb198 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -160,7 +160,8 @@ static void tcp_event_data_sent(struct tcp_sock *tp,
 }
 
 /* Account for an ACK we sent. */
-static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
+static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts,
+                                      u32 rcv_nxt)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
@@ -171,6 +172,9 @@ static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
                 if (hrtimer_try_to_cancel(&tp->compressed_ack_timer) == 1)
                         __sock_put(sk);
         }
+
+        if (unlikely(rcv_nxt != tp->rcv_nxt))
+                return;  /* Special ACK sent by DCTCP to reflect ECN */
         tcp_dec_quickack_mode(sk, pkts);
         inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
 }
@@ -1023,8 +1027,8 @@ static void tcp_update_skb_after_send(struct tcp_sock *tp, struct sk_buff *skb)
  * We are working here with either a clone of the original
  * SKB, or a fresh unique copy made by the retransmit engine.
  */
-static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
-                            gfp_t gfp_mask)
+static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb,
+                              int clone_it, gfp_t gfp_mask, u32 rcv_nxt)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct inet_sock *inet;
@@ -1100,7 +1104,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         th->source              = inet->inet_sport;
         th->dest                = inet->inet_dport;
         th->seq                 = htonl(tcb->seq);
-        th->ack_seq             = htonl(tp->rcv_nxt);
+        th->ack_seq             = htonl(rcv_nxt);
         *(((__be16 *)th) + 6)   = htons(((tcp_header_size >> 2) << 12) |
                                         tcb->tcp_flags);
 
@@ -1141,7 +1145,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         icsk->icsk_af_ops->send_check(sk, skb);
 
         if (likely(tcb->tcp_flags & TCPHDR_ACK))
-                tcp_event_ack_sent(sk, tcp_skb_pcount(skb));
+                tcp_event_ack_sent(sk, tcp_skb_pcount(skb), rcv_nxt);
 
         if (skb->len != tcp_header_size) {
                 tcp_event_data_sent(tp, sk);
@@ -1178,6 +1182,13 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         return err;
 }
 
+static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
+                            gfp_t gfp_mask)
+{
+        return __tcp_transmit_skb(sk, skb, clone_it, gfp_mask,
+                                  tcp_sk(sk)->rcv_nxt);
+}
+
 /* This routine just queues the buffer for sending.
  *
  * NOTE: probe0 timer is not checked, do not forget tcp_push_pending_frames,
@@ -3523,8 +3534,6 @@ void tcp_send_delayed_ack(struct sock *sk)
         int ato = icsk->icsk_ack.ato;
         unsigned long timeout;
 
-        tcp_ca_event(sk, CA_EVENT_DELAYED_ACK);
-
         if (ato > TCP_DELACK_MIN) {
                 const struct tcp_sock *tp = tcp_sk(sk);
                 int max_ato = HZ / 2;
@@ -3573,7 +3582,7 @@ void tcp_send_delayed_ack(struct sock *sk)
 }
 
 /* This routine sends an ack and also updates the window. */
-void tcp_send_ack(struct sock *sk)
+void __tcp_send_ack(struct sock *sk, u32 rcv_nxt)
 {
         struct sk_buff *buff;
 
@@ -3581,8 +3590,6 @@ void tcp_send_ack(struct sock *sk)
         if (sk->sk_state == TCP_CLOSE)
                 return;
 
-        tcp_ca_event(sk, CA_EVENT_NON_DELAYED_ACK);
-
         /* We are not putting this on the write queue, so
          * tcp_transmit_skb() will set the ownership to this
          * sock.
@@ -3608,9 +3615,14 @@ void tcp_send_ack(struct sock *sk)
         skb_set_tcp_pure_ack(buff);
 
         /* Send it off, this clears delayed acks for us. */
-        tcp_transmit_skb(sk, buff, 0, (__force gfp_t)0);
+        __tcp_transmit_skb(sk, buff, 0, (__force gfp_t)0, rcv_nxt);
+}
+EXPORT_SYMBOL_GPL(__tcp_send_ack);
+
+void tcp_send_ack(struct sock *sk)
+{
+        __tcp_send_ack(sk, tcp_sk(sk)->rcv_nxt);
 }
-EXPORT_SYMBOL_GPL(tcp_send_ack);
 
 /* This routine sends a packet with an out of date sequence
  * number. It assumes the other end will try to ack it.
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index 0eff75525da1..b3885ca22d6f 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -108,6 +108,7 @@ config IPV6_MIP6
 config IPV6_ILA
         tristate "IPv6: Identifier Locator Addressing (ILA)"
         depends on NETFILTER
+        select DST_CACHE
         select LWTUNNEL
         ---help---
           Support for IPv6 Identifier Locator Addressing (ILA).
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 91580c62bb86..f66a1cae3366 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2374,7 +2374,8 @@ static struct fib6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
                         continue;
                 if ((rt->fib6_flags & noflags) != 0)
                         continue;
-                fib6_info_hold(rt);
+                if (!fib6_info_hold_safe(rt))
+                        continue;
                 break;
         }
 out:
diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
index 1323b9679cf7..1c0bb9fb76e6 100644
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -799,8 +799,7 @@ static int calipso_opt_update(struct sock *sk, struct ipv6_opt_hdr *hop)
 {
         struct ipv6_txoptions *old = txopt_get(inet6_sk(sk)), *txopts;
 
-        txopts = ipv6_renew_options_kern(sk, old, IPV6_HOPOPTS,
-                                         hop, hop ? ipv6_optlen(hop) : 0);
+        txopts = ipv6_renew_options(sk, old, IPV6_HOPOPTS, hop);
         txopt_put(old);
         if (IS_ERR(txopts))
                 return PTR_ERR(txopts);
@@ -1222,8 +1221,7 @@ static int calipso_req_setattr(struct request_sock *req,
         if (IS_ERR(new))
                 return PTR_ERR(new);
 
-        txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS,
-                                         new, new ? ipv6_optlen(new) : 0);
+        txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new);
 
         kfree(new);
 
@@ -1260,8 +1258,7 @@ static void calipso_req_delattr(struct request_sock *req)
         if (calipso_opt_del(req_inet->ipv6_opt->hopopt, &new))
                 return; /* Nothing to do */
 
-        txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS,
-                                         new, new ? ipv6_optlen(new) : 0);
+        txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new);
 
         if (!IS_ERR(txopts)) {
                 txopts = xchg(&req_inet->ipv6_opt, txopts);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 2ee08b6a86a4..1a1f876f8e28 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -700,13 +700,16 @@ void ip6_datagram_recv_specific_ctl(struct sock *sk, struct msghdr *msg,
         }
         if (np->rxopt.bits.rxorigdstaddr) {
                 struct sockaddr_in6 sin6;
-                __be16 *ports = (__be16 *) skb_transport_header(skb);
+                __be16 *ports;
+                int end;
 
-                if (skb_transport_offset(skb) + 4 <= (int)skb->len) {
+                end = skb_transport_offset(skb) + 4;
+                if (end <= 0 || pskb_may_pull(skb, end)) {
                         /* All current transport protocols have the port numbers in the
                          * first four bytes of the transport header and this function is
                          * written with this assumption in mind.
                          */
+                        ports = (__be16 *)skb_transport_header(skb);
 
                         sin6.sin6_family = AF_INET6;
                         sin6.sin6_addr = ipv6_hdr(skb)->daddr;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 97513f35bcc5..88a7579c23bd 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -669,8 +669,10 @@ skip_cow:
 
         sg_init_table(sg, nfrags);
         ret = skb_to_sgvec(skb, sg, 0, skb->len);
-        if (unlikely(ret < 0))
+        if (unlikely(ret < 0)) {
+                kfree(tmp);
                 goto out;
+        }
 
         skb->ip_summed = CHECKSUM_NONE;
 
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 5bc2bf3733ab..20291c2036fc 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -1015,29 +1015,21 @@ ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
 }
 EXPORT_SYMBOL_GPL(ipv6_dup_options);
 
-static int ipv6_renew_option(void *ohdr,
-                             struct ipv6_opt_hdr __user *newopt, int newoptlen,
-                             int inherit,
-                             struct ipv6_opt_hdr **hdr,
-                             char **p)
+static void ipv6_renew_option(int renewtype,
+                              struct ipv6_opt_hdr **dest,
+                              struct ipv6_opt_hdr *old,
+                              struct ipv6_opt_hdr *new,
+                              int newtype, char **p)
 {
-        if (inherit) {
-                if (ohdr) {
-                        memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
-                        *hdr = (struct ipv6_opt_hdr *)*p;
-                        *p += CMSG_ALIGN(ipv6_optlen(*hdr));
-                }
-        } else {
-                if (newopt) {
-                        if (copy_from_user(*p, newopt, newoptlen))
-                                return -EFAULT;
-                        *hdr = (struct ipv6_opt_hdr *)*p;
-                        if (ipv6_optlen(*hdr) > newoptlen)
-                                return -EINVAL;
-                        *p += CMSG_ALIGN(newoptlen);
-                }
-        }
-        return 0;
+        struct ipv6_opt_hdr *src;
+
+        src = (renewtype == newtype ? new : old);
+        if (!src)
+                return;
+
+        memcpy(*p, src, ipv6_optlen(src));
+        *dest = (struct ipv6_opt_hdr *)*p;
+        *p += CMSG_ALIGN(ipv6_optlen(*dest));
 }
 
 /**
@@ -1063,13 +1055,11 @@ static int ipv6_renew_option(void *ohdr,
  */
 struct ipv6_txoptions *
 ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
-                   int newtype,
-                   struct ipv6_opt_hdr __user *newopt, int newoptlen)
+                   int newtype, struct ipv6_opt_hdr *newopt)
 {
         int tot_len = 0;
         char *p;
         struct ipv6_txoptions *opt2;
-        int err;
 
         if (opt) {
                 if (newtype != IPV6_HOPOPTS && opt->hopopt)
@@ -1082,8 +1072,8 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
         }
 
-        if (newopt && newoptlen)
-                tot_len += CMSG_ALIGN(newoptlen);
+        if (newopt)
+                tot_len += CMSG_ALIGN(ipv6_optlen(newopt));
 
         if (!tot_len)
                 return NULL;
@@ -1098,29 +1088,19 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
         opt2->tot_len = tot_len;
         p = (char *)(opt2 + 1);
 
-        err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
-                                newtype != IPV6_HOPOPTS,
-                                &opt2->hopopt, &p);
-        if (err)
-                goto out;
-
-        err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
-                                newtype != IPV6_RTHDRDSTOPTS,
-                                &opt2->dst0opt, &p);
-        if (err)
-                goto out;
-
-        err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
-                                newtype != IPV6_RTHDR,
-                                (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
-        if (err)
-                goto out;
-
-        err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
-                                newtype != IPV6_DSTOPTS,
-                                &opt2->dst1opt, &p);
-        if (err)
-                goto out;
+        ipv6_renew_option(IPV6_HOPOPTS, &opt2->hopopt,
+                          (opt ? opt->hopopt : NULL),
+                          newopt, newtype, &p);
+        ipv6_renew_option(IPV6_RTHDRDSTOPTS, &opt2->dst0opt,
+                          (opt ? opt->dst0opt : NULL),
+                          newopt, newtype, &p);
+        ipv6_renew_option(IPV6_RTHDR,
+                          (struct ipv6_opt_hdr **)&opt2->srcrt,
+                          (opt ? (struct ipv6_opt_hdr *)opt->srcrt : NULL),
+                          newopt, newtype, &p);
+        ipv6_renew_option(IPV6_DSTOPTS, &opt2->dst1opt,
+                          (opt ? opt->dst1opt : NULL),
+                          newopt, newtype, &p);
 
         opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
                           (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
@@ -1128,37 +1108,6 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
         opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
 
         return opt2;
-out:
-        sock_kfree_s(sk, opt2, opt2->tot_len);
-        return ERR_PTR(err);
-}
-
-/**
- * ipv6_renew_options_kern - replace a specific ext hdr with a new one.
- *
- * @sk: sock from which to allocate memory
- * @opt: original options
- * @newtype: option type to replace in @opt
- * @newopt: new option of type @newtype to replace (kernel-mem)
- * @newoptlen: length of @newopt
- *
- * See ipv6_renew_options().  The difference is that @newopt is
- * kernel memory, rather than user memory.
- */
-struct ipv6_txoptions *
-ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt,
-                        int newtype, struct ipv6_opt_hdr *newopt,
-                        int newoptlen)
-{
-        struct ipv6_txoptions *ret_val;
-        const mm_segment_t old_fs = get_fs();
-
-        set_fs(KERNEL_DS);
-        ret_val = ipv6_renew_options(sk, opt, newtype,
-                                     (struct ipv6_opt_hdr __user *)newopt,
-                                     newoptlen);
-        set_fs(old_fs);
-        return ret_val;
 }
 
 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index be491bf6ab6e..ef2505aefc15 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -402,9 +402,10 @@ static int icmp6_iif(const struct sk_buff *skb)
 
         /* for local traffic to local address, skb dev is the loopback
          * device. Check if there is a dst attached to the skb and if so
-         * get the real device index.
+         * get the real device index. Same is needed for replies to a link
+         * local address on a device enslaved to an L3 master device
          */
-        if (unlikely(iif == LOOPBACK_IFINDEX)) {
+        if (unlikely(iif == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) {
                 const struct rt6_info *rt6 = skb_rt6_info(skb);
 
                 if (rt6)
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 1fb2f3118d60..d212738e9d10 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -935,20 +935,19 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
 {
         struct fib6_info *leaf = rcu_dereference_protected(fn->leaf,
                                     lockdep_is_held(&rt->fib6_table->tb6_lock));
-        enum fib_event_type event = FIB_EVENT_ENTRY_ADD;
-        struct fib6_info *iter = NULL, *match = NULL;
+        struct fib6_info *iter = NULL;
         struct fib6_info __rcu **ins;
+        struct fib6_info __rcu **fallback_ins = NULL;
         int replace = (info->nlh &&
                        (info->nlh->nlmsg_flags & NLM_F_REPLACE));
-        int append = (info->nlh &&
-                       (info->nlh->nlmsg_flags & NLM_F_APPEND));
         int add = (!info->nlh ||
                    (info->nlh->nlmsg_flags & NLM_F_CREATE));
         int found = 0;
+        bool rt_can_ecmp = rt6_qualify_for_ecmp(rt);
         u16 nlflags = NLM_F_EXCL;
         int err;
 
-        if (append)
+        if (info->nlh && (info->nlh->nlmsg_flags & NLM_F_APPEND))
                 nlflags |= NLM_F_APPEND;
 
         ins = &fn->leaf;
@@ -970,8 +969,13 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
 
                         nlflags &= ~NLM_F_EXCL;
                         if (replace) {
-                                found++;
-                                break;
+                                if (rt_can_ecmp == rt6_qualify_for_ecmp(iter)) {
+                                        found++;
+                                        break;
+                                }
+                                if (rt_can_ecmp)
+                                        fallback_ins = fallback_ins ?: ins;
+                                goto next_iter;
                         }
 
                         if (rt6_duplicate_nexthop(iter, rt)) {
@@ -986,51 +990,71 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
                                 fib6_metric_set(iter, RTAX_MTU, rt->fib6_pmtu);
                                 return -EEXIST;
                         }
-
-                        /* first route that matches */
-                        if (!match)
-                                match = iter;
+                        /* If we have the same destination and the same metric,
+                         * but not the same gateway, then the route we try to
+                         * add is sibling to this route, increment our counter
+                         * of siblings, and later we will add our route to the
+                         * list.
+                         * Only static routes (which don't have flag
+                         * RTF_EXPIRES) are used for ECMPv6.
+                         *
+                         * To avoid long list, we only had siblings if the
+                         * route have a gateway.
+                         */
+                        if (rt_can_ecmp &&
+                            rt6_qualify_for_ecmp(iter))
+                                rt->fib6_nsiblings++;
                 }
 
                 if (iter->fib6_metric > rt->fib6_metric)
                         break;
 
+next_iter:
                 ins = &iter->fib6_next;
         }
 
+        if (fallback_ins && !found) {
+                /* No ECMP-able route found, replace first non-ECMP one */
+                ins = fallback_ins;
+                iter = rcu_dereference_protected(*ins,
+                                    lockdep_is_held(&rt->fib6_table->tb6_lock));
+                found++;
+        }
+
         /* Reset round-robin state, if necessary */
         if (ins == &fn->leaf)
                 fn->rr_ptr = NULL;
 
         /* Link this route to others same route. */
-        if (append && match) {
+        if (rt->fib6_nsiblings) {
+                unsigned int fib6_nsiblings;
                 struct fib6_info *sibling, *temp_sibling;
 
-                if (rt->fib6_flags & RTF_REJECT) {
-                        NL_SET_ERR_MSG(extack,
-                                       "Can not append a REJECT route");
-                        return -EINVAL;
-                } else if (match->fib6_flags & RTF_REJECT) {
-                        NL_SET_ERR_MSG(extack,
-                                       "Can not append to a REJECT route");
-                        return -EINVAL;
+                /* Find the first route that have the same metric */
+                sibling = leaf;
+                while (sibling) {
+                        if (sibling->fib6_metric == rt->fib6_metric &&
+                            rt6_qualify_for_ecmp(sibling)) {
+                                list_add_tail(&rt->fib6_siblings,
+                                              &sibling->fib6_siblings);
+                                break;
+                        }
+                        sibling = rcu_dereference_protected(sibling->fib6_next,
+                                    lockdep_is_held(&rt->fib6_table->tb6_lock));
                 }
-                event = FIB_EVENT_ENTRY_APPEND;
-                rt->fib6_nsiblings = match->fib6_nsiblings;
-                list_add_tail(&rt->fib6_siblings, &match->fib6_siblings);
-                match->fib6_nsiblings++;
-
                 /* For each sibling in the list, increment the counter of
                  * siblings. BUG() if counters does not match, list of siblings
                  * is broken!
                  */
+                fib6_nsiblings = 0;
                 list_for_each_entry_safe(sibling, temp_sibling,
-                                         &match->fib6_siblings, fib6_siblings) {
+                                         &rt->fib6_siblings, fib6_siblings) {
                         sibling->fib6_nsiblings++;
-                        BUG_ON(sibling->fib6_nsiblings != match->fib6_nsiblings);
+                        BUG_ON(sibling->fib6_nsiblings != rt->fib6_nsiblings);
+                        fib6_nsiblings++;
                 }
-
-                rt6_multipath_rebalance(match);
+                BUG_ON(fib6_nsiblings != rt->fib6_nsiblings);
+                rt6_multipath_rebalance(temp_sibling);
         }
 
         /*
@@ -1043,8 +1067,9 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
 add:
                 nlflags |= NLM_F_CREATE;
 
-                err = call_fib6_entry_notifiers(info->nl_net, event, rt,
-                                                extack);
+                err = call_fib6_entry_notifiers(info->nl_net,
+                                                FIB_EVENT_ENTRY_ADD,
+                                                rt, extack);
                 if (err)
                         return err;
 
@@ -1062,7 +1087,7 @@ add:
                 }
 
         } else {
-                struct fib6_info *tmp;
+                int nsiblings;
 
                 if (!found) {
                         if (add)
@@ -1077,57 +1102,48 @@ add:
                 if (err)
                         return err;
 
-                /* if route being replaced has siblings, set tmp to
-                 * last one, otherwise tmp is current route. this is
-                 * used to set fib6_next for new route
-                 */
-                if (iter->fib6_nsiblings)
-                        tmp = list_last_entry(&iter->fib6_siblings,
-                                              struct fib6_info,
-                                              fib6_siblings);
-                else
-                        tmp = iter;
-
-                /* insert new route */
                 atomic_inc(&rt->fib6_ref);
                 rcu_assign_pointer(rt->fib6_node, fn);
-                rt->fib6_next = tmp->fib6_next;
+                rt->fib6_next = iter->fib6_next;
                 rcu_assign_pointer(*ins, rt);
-
                 if (!info->skip_notify)
                         inet6_rt_notify(RTM_NEWROUTE, rt, info, NLM_F_REPLACE);
                 if (!(fn->fn_flags & RTN_RTINFO)) {
                         info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
                         fn->fn_flags |= RTN_RTINFO;
                 }
+                nsiblings = iter->fib6_nsiblings;
+                iter->fib6_node = NULL;
+                fib6_purge_rt(iter, fn, info->nl_net);
+                if (rcu_access_pointer(fn->rr_ptr) == iter)
+                        fn->rr_ptr = NULL;
+                fib6_info_release(iter);
 
-                /* delete old route */
-                rt = iter;
-
-                if (rt->fib6_nsiblings) {
-                        struct fib6_info *tmp;
-
+                if (nsiblings) {
                         /* Replacing an ECMP route, remove all siblings */
-                        list_for_each_entry_safe(iter, tmp, &rt->fib6_siblings,
-                                                 fib6_siblings) {
-                                iter->fib6_node = NULL;
-                                fib6_purge_rt(iter, fn, info->nl_net);
-                                if (rcu_access_pointer(fn->rr_ptr) == iter)
-                                        fn->rr_ptr = NULL;
-                                fib6_info_release(iter);
-
-                                rt->fib6_nsiblings--;
-                                info->nl_net->ipv6.rt6_stats->fib_rt_entries--;
+                        ins = &rt->fib6_next;
+                        iter = rcu_dereference_protected(*ins,
+                                    lockdep_is_held(&rt->fib6_table->tb6_lock));
+                        while (iter) {
+                                if (iter->fib6_metric > rt->fib6_metric)
+                                        break;
+                                if (rt6_qualify_for_ecmp(iter)) {
+                                        *ins = iter->fib6_next;
+                                        iter->fib6_node = NULL;
+                                        fib6_purge_rt(iter, fn, info->nl_net);
+                                        if (rcu_access_pointer(fn->rr_ptr) == iter)
+                                                fn->rr_ptr = NULL;
+                                        fib6_info_release(iter);
+                                        nsiblings--;
+                                        info->nl_net->ipv6.rt6_stats->fib_rt_entries--;
+                                } else {
+                                        ins = &iter->fib6_next;
+                                }
+                                iter = rcu_dereference_protected(*ins,
+                                        lockdep_is_held(&rt->fib6_table->tb6_lock));
                         }
+                        WARN_ON(nsiblings != 0);
                 }
-
-                WARN_ON(rt->fib6_nsiblings != 0);
-
-                rt->fib6_node = NULL;
-                fib6_purge_rt(rt, fn, info->nl_net);
-                if (rcu_access_pointer(fn->rr_ptr) == rt)
-                        fn->rr_ptr = NULL;
-                fib6_info_release(rt);
         }
 
         return 0;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index c8cf2fdbb13b..cd2cfb04e5d8 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -927,7 +927,6 @@ tx_err:
 static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
                                          struct net_device *dev)
 {
-        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
         struct ip6_tnl *t = netdev_priv(dev);
         struct dst_entry *dst = skb_dst(skb);
         struct net_device_stats *stats;
@@ -1010,6 +1009,8 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
                         goto tx_err;
                 }
         } else {
+                struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+
                 switch (skb->protocol) {
                 case htons(ETH_P_IP):
                         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index a14fb4fcdf18..3168847c30d1 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -570,6 +570,8 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->dev = from->dev;
         to->mark = from->mark;
 
+        skb_copy_hash(to, from);
+
 #ifdef CONFIG_NET_SCHED
         to->tc_index = from->tc_index;
 #endif
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index b7f28deddaea..c72ae3a4fe09 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -480,10 +480,6 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
                 goto tx_err_dst_release;
         }
 
-        skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
-        skb_dst_set(skb, dst);
-        skb->dev = skb_dst(skb)->dev;
-
         mtu = dst_mtu(dst);
         if (!skb->ignore_df && skb->len > mtu) {
                 skb_dst_update_pmtu(skb, mtu);
@@ -498,9 +494,14 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
                                   htonl(mtu));
                 }
 
-                return -EMSGSIZE;
+                err = -EMSGSIZE;
+                goto tx_err_dst_release;
         }
 
+        skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
+        skb_dst_set(skb, dst);
+        skb->dev = skb_dst(skb)->dev;
+
         err = dst_output(t->net, skb->sk, skb);
         if (net_xmit_eval(err) == 0) {
                 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 4d780c7f0130..568ca4187cd1 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -398,6 +398,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
         case IPV6_DSTOPTS:
         {
                 struct ipv6_txoptions *opt;
+                struct ipv6_opt_hdr *new = NULL;
+
+                /* hop-by-hop / destination options are privileged option */
+                retv = -EPERM;
+                if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
+                        break;
 
                 /* remove any sticky options header with a zero option
                  * length, per RFC3542.
@@ -409,17 +415,22 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 else if (optlen < sizeof(struct ipv6_opt_hdr) ||
                          optlen & 0x7 || optlen > 8 * 255)
                         goto e_inval;
-
-                /* hop-by-hop / destination options are privileged option */
-                retv = -EPERM;
-                if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
-                        break;
+                else {
+                        new = memdup_user(optval, optlen);
+                        if (IS_ERR(new)) {
+                                retv = PTR_ERR(new);
+                                break;
+                        }
+                        if (unlikely(ipv6_optlen(new) > optlen)) {
+                                kfree(new);
+                                goto e_inval;
+                        }
+                }
 
                 opt = rcu_dereference_protected(np->opt,
                                                 lockdep_sock_is_held(sk));
-                opt = ipv6_renew_options(sk, opt, optname,
-                                         (struct ipv6_opt_hdr __user *)optval,
-                                         optlen);
+                opt = ipv6_renew_options(sk, opt, optname, new);
+                kfree(new);
                 if (IS_ERR(opt)) {
                         retv = PTR_ERR(opt);
                         break;
@@ -718,8 +729,9 @@ done:
                         struct sockaddr_in6 *psin6;
 
                         psin6 = (struct sockaddr_in6 *)&greqs.gsr_group;
-                        retv = ipv6_sock_mc_join(sk, greqs.gsr_interface,
-                                                 &psin6->sin6_addr);
+                        retv = ipv6_sock_mc_join_ssm(sk, greqs.gsr_interface,
+                                                     &psin6->sin6_addr,
+                                                     MCAST_INCLUDE);
                         /* prior join w/ different source is ok */
                         if (retv && retv != -EADDRINUSE)
                                 break;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index c0c74088f2af..f60f310785fd 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -95,6 +95,8 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
                           int delta);
 static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
                             struct inet6_dev *idev);
+static int __ipv6_dev_mc_inc(struct net_device *dev,
+                             const struct in6_addr *addr, unsigned int mode);
 
 #define MLD_QRV_DEFAULT         2
 /* RFC3810, 9.2. Query Interval */
@@ -132,7 +134,8 @@ static int unsolicited_report_interval(struct inet6_dev *idev)
         return iv > 0 ? iv : 1;
 }
 
-int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
+static int __ipv6_sock_mc_join(struct sock *sk, int ifindex,
+                               const struct in6_addr *addr, unsigned int mode)
 {
         struct net_device *dev = NULL;
         struct ipv6_mc_socklist *mc_lst;
@@ -179,7 +182,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
         }
 
         mc_lst->ifindex = dev->ifindex;
-        mc_lst->sfmode = MCAST_EXCLUDE;
+        mc_lst->sfmode = mode;
         rwlock_init(&mc_lst->sflock);
         mc_lst->sflist = NULL;
 
@@ -187,7 +190,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
          *      now add/increase the group membership on the device
          */
 
-        err = ipv6_dev_mc_inc(dev, addr);
+        err = __ipv6_dev_mc_inc(dev, addr, mode);
 
         if (err) {
                 sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
@@ -199,8 +202,19 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
 
         return 0;
 }
+
+int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
+{
+        return __ipv6_sock_mc_join(sk, ifindex, addr, MCAST_EXCLUDE);
+}
 EXPORT_SYMBOL(ipv6_sock_mc_join);
 
+int ipv6_sock_mc_join_ssm(struct sock *sk, int ifindex,
+                          const struct in6_addr *addr, unsigned int mode)
+{
+        return __ipv6_sock_mc_join(sk, ifindex, addr, mode);
+}
+
 /*
  *      socket leave on multicast group
  */
@@ -646,7 +660,7 @@ bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
         return rv;
 }
 
-static void igmp6_group_added(struct ifmcaddr6 *mc)
+static void igmp6_group_added(struct ifmcaddr6 *mc, unsigned int mode)
 {
         struct net_device *dev = mc->idev->dev;
         char buf[MAX_ADDR_LEN];
@@ -672,7 +686,13 @@ static void igmp6_group_added(struct ifmcaddr6 *mc)
         }
         /* else v2 */
 
-        mc->mca_crcount = mc->idev->mc_qrv;
+        /* Based on RFC3810 6.1, for newly added INCLUDE SSM, we
+         * should not send filter-mode change record as the mode
+         * should be from IN() to IN(A).
+         */
+        if (mode == MCAST_EXCLUDE)
+                mc->mca_crcount = mc->idev->mc_qrv;
+
         mld_ifc_event(mc->idev);
 }
 
@@ -770,13 +790,13 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
         spin_lock_bh(&im->mca_lock);
         if (pmc) {
                 im->idev = pmc->idev;
-                im->mca_crcount = idev->mc_qrv;
-                im->mca_sfmode = pmc->mca_sfmode;
-                if (pmc->mca_sfmode == MCAST_INCLUDE) {
+                if (im->mca_sfmode == MCAST_INCLUDE) {
                         im->mca_tomb = pmc->mca_tomb;
                         im->mca_sources = pmc->mca_sources;
                         for (psf = im->mca_sources; psf; psf = psf->sf_next)
-                                psf->sf_crcount = im->mca_crcount;
+                                psf->sf_crcount = idev->mc_qrv;
+                } else {
+                        im->mca_crcount = idev->mc_qrv;
                 }
                 in6_dev_put(pmc->idev);
                 kfree(pmc);
@@ -831,7 +851,8 @@ static void ma_put(struct ifmcaddr6 *mc)
 }
 
 static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev,
-                                   const struct in6_addr *addr)
+                                   const struct in6_addr *addr,
+                                   unsigned int mode)
 {
         struct ifmcaddr6 *mc;
 
@@ -849,9 +870,8 @@ static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev,
         refcount_set(&mc->mca_refcnt, 1);
         spin_lock_init(&mc->mca_lock);
 
-        /* initial mode is (EX, empty) */
-        mc->mca_sfmode = MCAST_EXCLUDE;
-        mc->mca_sfcount[MCAST_EXCLUDE] = 1;
+        mc->mca_sfmode = mode;
+        mc->mca_sfcount[mode] = 1;
 
         if (ipv6_addr_is_ll_all_nodes(&mc->mca_addr) ||
             IPV6_ADDR_MC_SCOPE(&mc->mca_addr) < IPV6_ADDR_SCOPE_LINKLOCAL)
@@ -863,7 +883,8 @@ static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev,
 /*
  *      device multicast group inc (add if not found)
  */
-int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
+static int __ipv6_dev_mc_inc(struct net_device *dev,
+                             const struct in6_addr *addr, unsigned int mode)
 {
         struct ifmcaddr6 *mc;
         struct inet6_dev *idev;
@@ -887,14 +908,13 @@ int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
                 if (ipv6_addr_equal(&mc->mca_addr, addr)) {
                         mc->mca_users++;
                         write_unlock_bh(&idev->lock);
-                        ip6_mc_add_src(idev, &mc->mca_addr, MCAST_EXCLUDE, 0,
-                                NULL, 0);
+                        ip6_mc_add_src(idev, &mc->mca_addr, mode, 0, NULL, 0);
                         in6_dev_put(idev);
                         return 0;
                 }
         }
 
-        mc = mca_alloc(idev, addr);
+        mc = mca_alloc(idev, addr, mode);
         if (!mc) {
                 write_unlock_bh(&idev->lock);
                 in6_dev_put(idev);
@@ -911,11 +931,16 @@ int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
         write_unlock_bh(&idev->lock);
 
         mld_del_delrec(idev, mc);
-        igmp6_group_added(mc);
+        igmp6_group_added(mc, mode);
         ma_put(mc);
         return 0;
 }
 
+int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
+{
+        return __ipv6_dev_mc_inc(dev, addr, MCAST_EXCLUDE);
+}
+
 /*
  *      device multicast group del
  */
@@ -1751,7 +1776,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
 
                 psf_next = psf->sf_next;
 
-                if (!is_in(pmc, psf, type, gdeleted, sdeleted)) {
+                if (!is_in(pmc, psf, type, gdeleted, sdeleted) && !crsend) {
                         psf_prev = psf;
                         continue;
                 }
@@ -2066,7 +2091,7 @@ static void mld_send_initial_cr(struct inet6_dev *idev)
                 if (pmc->mca_sfcount[MCAST_EXCLUDE])
                         type = MLD2_CHANGE_TO_EXCLUDE;
                 else
-                        type = MLD2_CHANGE_TO_INCLUDE;
+                        type = MLD2_ALLOW_NEW_SOURCES;
                 skb = add_grec(skb, pmc, type, 0, 0, 1);
                 spin_unlock_bh(&pmc->mca_lock);
         }
@@ -2546,7 +2571,7 @@ void ipv6_mc_up(struct inet6_dev *idev)
         ipv6_mc_reset(idev);
         for (i = idev->mc_list; i; i = i->next) {
                 mld_del_delrec(idev, i);
-                igmp6_group_added(i);
+                igmp6_group_added(i, i->mca_sfmode);
         }
         read_unlock_bh(&idev->lock);
 }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index e640d2f3c55c..0ec273997d1d 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -811,7 +811,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                         return;
                 }
         }
-        if (ndopts.nd_opts_nonce)
+        if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1)
                 memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
 
         inc = ipv6_addr_is_multicast(daddr);
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 7eab959734bc..daf2e9e9193d 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1909,6 +1909,7 @@ static struct xt_match ip6t_builtin_mt[] __read_mostly = {
                 .checkentry = icmp6_checkentry,
                 .proto      = IPPROTO_ICMPV6,
                 .family     = NFPROTO_IPV6,
+                .me         = THIS_MODULE,
         },
 };
 
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index a452d99c9f52..e4d9e6976d3c 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -585,6 +585,8 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
             fq->q.meat == fq->q.len &&
             nf_ct_frag6_reasm(fq, skb, dev))
                 ret = 0;
+        else
+                skb_dst_drop(skb);
 
 out_unlock:
         spin_unlock_bh(&fq->q.lock);
diff --git a/net/ipv6/netfilter/nf_tproxy_ipv6.c b/net/ipv6/netfilter/nf_tproxy_ipv6.c
index bf1d6c421e3b..5dfd33af6451 100644
--- a/net/ipv6/netfilter/nf_tproxy_ipv6.c
+++ b/net/ipv6/netfilter/nf_tproxy_ipv6.c
@@ -55,7 +55,7 @@ nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
                  * to a listener socket if there's one */
                 struct sock *sk2;
 
-                sk2 = nf_tproxy_get_sock_v6(net, skb, thoff, hp, tproto,
+                sk2 = nf_tproxy_get_sock_v6(net, skb, thoff, tproto,
                                             &iph->saddr,
                                             nf_tproxy_laddr6(skb, laddr, &iph->daddr),
                                             hp->source,
@@ -72,7 +72,7 @@ nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
 EXPORT_SYMBOL_GPL(nf_tproxy_handle_time_wait6);
 
 struct sock *
-nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff, void *hp,
+nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
                       const u8 protocol,
                       const struct in6_addr *saddr, const struct in6_addr *daddr,
                       const __be16 sport, const __be16 dport,
@@ -80,15 +80,20 @@ nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff, void *hp,
                       const enum nf_tproxy_lookup_t lookup_type)
 {
         struct sock *sk;
-        struct tcphdr *tcph;
 
         switch (protocol) {
-        case IPPROTO_TCP:
+        case IPPROTO_TCP: {
+                struct tcphdr _hdr, *hp;
+
+                hp = skb_header_pointer(skb, thoff,
+                                        sizeof(struct tcphdr), &_hdr);
+                if (hp == NULL)
+                        return NULL;
+
                 switch (lookup_type) {
                 case NF_TPROXY_LOOKUP_LISTENER:
-                        tcph = hp;
                         sk = inet6_lookup_listener(net, &tcp_hashinfo, skb,
-                                                   thoff + __tcp_hdrlen(tcph),
+                                                   thoff + __tcp_hdrlen(hp),
                                                    saddr, sport,
                                                    daddr, ntohs(dport),
                                                    in->ifindex, 0);
@@ -110,6 +115,7 @@ nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff, void *hp,
                         BUG();
                 }
                 break;
+                }
         case IPPROTO_UDP:
                 sk = udp6_lib_lookup(net, saddr, sport, daddr, dport,
                                      in->ifindex);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 86a0e4333d42..ec18b3ce8b6d 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -972,10 +972,10 @@ static void ip6_rt_init_dst(struct rt6_info *rt, struct fib6_info *ort)
         rt->dst.lastuse = jiffies;
 }
 
+/* Caller must already hold reference to @from */
 static void rt6_set_from(struct rt6_info *rt, struct fib6_info *from)
 {
         rt->rt6i_flags &= ~RTF_EXPIRES;
-        fib6_info_hold(from);
         rcu_assign_pointer(rt->from, from);
         dst_init_metrics(&rt->dst, from->fib6_metrics->metrics, true);
         if (from->fib6_metrics != &dst_default_metrics) {
@@ -984,6 +984,7 @@ static void rt6_set_from(struct rt6_info *rt, struct fib6_info *from)
         }
 }
 
+/* Caller must already hold reference to @ort */
 static void ip6_rt_copy_init(struct rt6_info *rt, struct fib6_info *ort)
 {
         struct net_device *dev = fib6_info_nh_dev(ort);
@@ -1044,9 +1045,14 @@ static struct rt6_info *ip6_create_rt_rcu(struct fib6_info *rt)
         struct net_device *dev = rt->fib6_nh.nh_dev;
         struct rt6_info *nrt;
 
+        if (!fib6_info_hold_safe(rt))
+                return NULL;
+
         nrt = ip6_dst_alloc(dev_net(dev), dev, flags);
         if (nrt)
                 ip6_rt_copy_init(nrt, rt);
+        else
+                fib6_info_release(rt);
 
         return nrt;
 }
@@ -1178,10 +1184,15 @@ static struct rt6_info *ip6_rt_cache_alloc(struct fib6_info *ort,
          *      Clone the route.
          */
 
+        if (!fib6_info_hold_safe(ort))
+                return NULL;
+
         dev = ip6_rt_get_dev_rcu(ort);
         rt = ip6_dst_alloc(dev_net(dev), dev, 0);
-        if (!rt)
+        if (!rt) {
+                fib6_info_release(ort);
                 return NULL;
+        }
 
         ip6_rt_copy_init(rt, ort);
         rt->rt6i_flags |= RTF_CACHE;
@@ -1210,12 +1221,17 @@ static struct rt6_info *ip6_rt_pcpu_alloc(struct fib6_info *rt)
         struct net_device *dev;
         struct rt6_info *pcpu_rt;
 
+        if (!fib6_info_hold_safe(rt))
+                return NULL;
+
         rcu_read_lock();
         dev = ip6_rt_get_dev_rcu(rt);
         pcpu_rt = ip6_dst_alloc(dev_net(dev), dev, flags);
         rcu_read_unlock();
-        if (!pcpu_rt)
+        if (!pcpu_rt) {
+                fib6_info_release(rt);
                 return NULL;
+        }
         ip6_rt_copy_init(pcpu_rt, rt);
         pcpu_rt->rt6i_flags |= RTF_PCPU;
         return pcpu_rt;
@@ -2486,7 +2502,7 @@ restart:
 
 out:
         if (ret)
-                dst_hold(&ret->dst);
+                ip6_hold_safe(net, &ret, true);
         else
                 ret = ip6_create_rt_rcu(rt);
 
@@ -3303,7 +3319,8 @@ static int ip6_route_del(struct fib6_config *cfg,
                                 continue;
                         if (cfg->fc_protocol && cfg->fc_protocol != rt->fib6_protocol)
                                 continue;
-                        fib6_info_hold(rt);
+                        if (!fib6_info_hold_safe(rt))
+                                continue;
                         rcu_read_unlock();
 
                         /* if gateway was specified only delete the one hop */
@@ -3409,6 +3426,9 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
 
         rcu_read_lock();
         from = rcu_dereference(rt->from);
+        /* This fib6_info_hold() is safe here because we hold reference to rt
+         * and rt already holds reference to fib6_info.
+         */
         fib6_info_hold(from);
         rcu_read_unlock();
 
@@ -3470,7 +3490,8 @@ static struct fib6_info *rt6_get_route_info(struct net *net,
                         continue;
                 if (!ipv6_addr_equal(&rt->fib6_nh.nh_gw, gwaddr))
                         continue;
-                fib6_info_hold(rt);
+                if (!fib6_info_hold_safe(rt))
+                        continue;
                 break;
         }
 out:
@@ -3530,8 +3551,8 @@ struct fib6_info *rt6_get_dflt_router(struct net *net,
                     ipv6_addr_equal(&rt->fib6_nh.nh_gw, addr))
                         break;
         }
-        if (rt)
-                fib6_info_hold(rt);
+        if (rt && !fib6_info_hold_safe(rt))
+                rt = NULL;
         rcu_read_unlock();
         return rt;
 }
@@ -3579,8 +3600,8 @@ restart:
                 struct inet6_dev *idev = dev ? __in6_dev_get(dev) : NULL;
 
                 if (rt->fib6_flags & (RTF_DEFAULT | RTF_ADDRCONF) &&
-                    (!idev || idev->cnf.accept_ra != 2)) {
-                        fib6_info_hold(rt);
+                    (!idev || idev->cnf.accept_ra != 2) &&
+                    fib6_info_hold_safe(rt)) {
                         rcu_read_unlock();
                         ip6_del_rt(net, rt);
                         goto restart;
@@ -3842,7 +3863,7 @@ static struct fib6_info *rt6_multipath_first_sibling(const struct fib6_info *rt)
                         lockdep_is_held(&rt->fib6_table->tb6_lock));
         while (iter) {
                 if (iter->fib6_metric == rt->fib6_metric &&
-                    iter->fib6_nsiblings)
+                    rt6_qualify_for_ecmp(iter))
                         return iter;
                 iter = rcu_dereference_protected(iter->fib6_next,
                                 lockdep_is_held(&rt->fib6_table->tb6_lock));
@@ -4388,6 +4409,13 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
                         rt = NULL;
                         goto cleanup;
                 }
+                if (!rt6_qualify_for_ecmp(rt)) {
+                        err = -EINVAL;
+                        NL_SET_ERR_MSG(extack,
+                                       "Device only routes can not be added for IPv6 using the multipath API.");
+                        fib6_info_release(rt);
+                        goto cleanup;
+                }
 
                 rt->fib6_nh.nh_weight = rtnh->rtnh_hops + 1;
 
@@ -4439,7 +4467,6 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
                  */
                 cfg->fc_nlinfo.nlh->nlmsg_flags &= ~(NLM_F_EXCL |
                                                      NLM_F_REPLACE);
-                cfg->fc_nlinfo.nlh->nlmsg_flags |= NLM_F_APPEND;
                 nhn++;
         }
 
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index 19ccf0dc996c..a8854dd3e9c5 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -101,7 +101,7 @@ static __be32 seg6_make_flowlabel(struct net *net, struct sk_buff *skb,
 
         if (do_flowlabel > 0) {
                 hash = skb_get_hash(skb);
-                rol32(hash, 16);
+                hash = rol32(hash, 16);
                 flowlabel = (__force __be32)hash & IPV6_FLOWLABEL_MASK;
         } else if (!do_flowlabel && skb->protocol == htons(ETH_P_IPV6)) {
                 flowlabel = ip6_flowlabel(inner_hdr);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 7efa9fd7e109..03e6b7a2bc53 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -938,7 +938,8 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
                                            &tcp_hashinfo, NULL, 0,
                                            &ipv6h->saddr,
                                            th->source, &ipv6h->daddr,
-                                           ntohs(th->source), tcp_v6_iif(skb),
+                                           ntohs(th->source),
+                                           tcp_v6_iif_l3_slave(skb),
                                            tcp_v6_sdif(skb));
                 if (!sk1)
                         goto out;
@@ -1609,7 +1610,8 @@ do_time_wait:
                                             skb, __tcp_hdrlen(th),
                                             &ipv6_hdr(skb)->saddr, th->source,
                                             &ipv6_hdr(skb)->daddr,
-                                            ntohs(th->dest), tcp_v6_iif(skb),
+                                            ntohs(th->dest),
+                                            tcp_v6_iif_l3_slave(skb),
                                             sdif);
                 if (sk2) {
                         struct inet_timewait_sock *tw = inet_twsk(sk);
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index e398797878a9..cf6cca260e7b 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -1201,13 +1201,18 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
                                 l2tp_session_get(sock_net(sk), tunnel,
                                                  stats.session_id);
 
-                        if (session && session->pwtype == L2TP_PWTYPE_PPP) {
-                                err = pppol2tp_session_ioctl(session, cmd,
-                                                             arg);
+                        if (!session) {
+                                err = -EBADR;
+                                break;
+                        }
+                        if (session->pwtype != L2TP_PWTYPE_PPP) {
                                 l2tp_session_dec_refcount(session);
-                        } else {
                                 err = -EBADR;
+                                break;
                         }
+
+                        err = pppol2tp_session_ioctl(session, cmd, arg);
+                        l2tp_session_dec_refcount(session);
                         break;
                 }
 #ifdef CONFIG_XFRM
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 0a38cc1cbebc..932985ca4e66 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2254,11 +2254,8 @@ static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
                      sdata->control_port_over_nl80211)) {
                 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
                 bool noencrypt = status->flag & RX_FLAG_DECRYPTED;
-                struct ethhdr *ehdr = eth_hdr(skb);
 
-                cfg80211_rx_control_port(dev, skb->data, skb->len,
-                                         ehdr->h_source,
-                                         be16_to_cpu(skb->protocol), noencrypt);
+                cfg80211_rx_control_port(dev, skb, noencrypt);
                 dev_kfree_skb(skb);
         } else {
                 /* deliver to local stack */
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 5e2e511c4a6f..d02fbfec3783 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2111,7 +2111,8 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 if (!sta->uploaded)
                         continue;
 
-                if (sta->sdata->vif.type != NL80211_IFTYPE_AP)
+                if (sta->sdata->vif.type != NL80211_IFTYPE_AP &&
+                    sta->sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
                         continue;
 
                 for (state = IEEE80211_STA_NOTEXIST;
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index dbd7d1fad277..f0a1c536ef15 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -460,6 +460,13 @@ config NF_TABLES
 
 if NF_TABLES
 
+config NF_TABLES_SET
+        tristate "Netfilter nf_tables set infrastructure"
+        help
+          This option enables the nf_tables set infrastructure that allows to
+          look up for elements in a set and to build one-way mappings between
+          matchings and actions.
+
 config NF_TABLES_INET
         depends on IPV6
         select NF_TABLES_IPV4
@@ -493,24 +500,6 @@ config NFT_FLOW_OFFLOAD
           This option adds the "flow_offload" expression that you can use to
           choose what flows are placed into the hardware.
 
-config NFT_SET_RBTREE
-        tristate "Netfilter nf_tables rbtree set module"
-        help
-          This option adds the "rbtree" set type (Red Black tree) that is used
-          to build interval-based sets.
-
-config NFT_SET_HASH
-        tristate "Netfilter nf_tables hash set module"
-        help
-          This option adds the "hash" set type that is used to build one-way
-          mappings between matchings and actions.
-
-config NFT_SET_BITMAP
-        tristate "Netfilter nf_tables bitmap set module"
-        help
-          This option adds the "bitmap" set type that is used to build sets
-          whose keys are smaller or equal to 16 bits.
-
 config NFT_COUNTER
         tristate "Netfilter nf_tables counter module"
         help
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 44449389e527..8a76dced974d 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -78,7 +78,11 @@ nf_tables-objs := nf_tables_core.o nf_tables_api.o nft_chain_filter.o \
                   nft_bitwise.o nft_byteorder.o nft_payload.o nft_lookup.o \
                   nft_dynset.o nft_meta.o nft_rt.o nft_exthdr.o
 
+nf_tables_set-objs := nf_tables_set_core.o \
+                      nft_set_hash.o nft_set_bitmap.o nft_set_rbtree.o
+
 obj-$(CONFIG_NF_TABLES)         += nf_tables.o
+obj-$(CONFIG_NF_TABLES_SET)     += nf_tables_set.o
 obj-$(CONFIG_NFT_COMPAT)        += nft_compat.o
 obj-$(CONFIG_NFT_CONNLIMIT)     += nft_connlimit.o
 obj-$(CONFIG_NFT_NUMGEN)        += nft_numgen.o
@@ -91,9 +95,6 @@ obj-$(CONFIG_NFT_QUEUE)		+= nft_queue.o
 obj-$(CONFIG_NFT_QUOTA)         += nft_quota.o
 obj-$(CONFIG_NFT_REJECT)        += nft_reject.o
 obj-$(CONFIG_NFT_REJECT_INET)   += nft_reject_inet.o
-obj-$(CONFIG_NFT_SET_RBTREE)    += nft_set_rbtree.o
-obj-$(CONFIG_NFT_SET_HASH)      += nft_set_hash.o
-obj-$(CONFIG_NFT_SET_BITMAP)    += nft_set_bitmap.o
 obj-$(CONFIG_NFT_COUNTER)       += nft_counter.o
 obj-$(CONFIG_NFT_LOG)           += nft_log.o
 obj-$(CONFIG_NFT_MASQ)          += nft_masq.o
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 3465da2a98bd..3d5280425027 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -2043,7 +2043,7 @@ int nf_conntrack_set_hashsize(const char *val, const struct kernel_param *kp)
                 return -EOPNOTSUPP;
 
         /* On boot, we can set this without any fancy locking. */
-        if (!nf_conntrack_htable_size)
+        if (!nf_conntrack_hash)
                 return param_set_uint(val, kp);
 
         rc = kstrtouint(val, 0, &hashsize);
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index abe647d5b8c6..9ce6336d1e55 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -243,14 +243,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] =
                  * We currently ignore Sync packets
                  *
                  *      sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
-                        sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+                        sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
                 },
                 [DCCP_PKT_SYNCACK] = {
                 /*
                  * We currently ignore SyncAck packets
                  *
                  *      sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
-                        sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+                        sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
                 },
         },
         [CT_DCCP_ROLE_SERVER] = {
@@ -371,14 +371,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] =
                  * We currently ignore Sync packets
                  *
                  *      sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
-                        sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+                        sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
                 },
                 [DCCP_PKT_SYNCACK] = {
                 /*
                  * We currently ignore SyncAck packets
                  *
                  *      sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
-                        sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+                        sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
                 },
         },
 };
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 896d4a36081d..f5745e4c6513 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -75,6 +75,7 @@ static void nft_ctx_init(struct nft_ctx *ctx,
 {
         ctx->net        = net;
         ctx->family     = family;
+        ctx->level      = 0;
         ctx->table      = table;
         ctx->chain      = chain;
         ctx->nla        = nla;
@@ -1597,7 +1598,6 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
         struct nft_base_chain *basechain;
         struct nft_stats *stats = NULL;
         struct nft_chain_hook hook;
-        const struct nlattr *name;
         struct nf_hook_ops *ops;
         struct nft_trans *trans;
         int err;
@@ -1645,12 +1645,11 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
                         return PTR_ERR(stats);
         }
 
+        err = -ENOMEM;
         trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
                                 sizeof(struct nft_trans_chain));
-        if (trans == NULL) {
-                free_percpu(stats);
-                return -ENOMEM;
-        }
+        if (trans == NULL)
+                goto err;
 
         nft_trans_chain_stats(trans) = stats;
         nft_trans_chain_update(trans) = true;
@@ -1660,19 +1659,37 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
         else
                 nft_trans_chain_policy(trans) = -1;
 
-        name = nla[NFTA_CHAIN_NAME];
-        if (nla[NFTA_CHAIN_HANDLE] && name) {
-                nft_trans_chain_name(trans) =
-                        nla_strdup(name, GFP_KERNEL);
-                if (!nft_trans_chain_name(trans)) {
-                        kfree(trans);
-                        free_percpu(stats);
-                        return -ENOMEM;
+        if (nla[NFTA_CHAIN_HANDLE] &&
+            nla[NFTA_CHAIN_NAME]) {
+                struct nft_trans *tmp;
+                char *name;
+
+                err = -ENOMEM;
+                name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
+                if (!name)
+                        goto err;
+
+                err = -EEXIST;
+                list_for_each_entry(tmp, &ctx->net->nft.commit_list, list) {
+                        if (tmp->msg_type == NFT_MSG_NEWCHAIN &&
+                            tmp->ctx.table == table &&
+                            nft_trans_chain_update(tmp) &&
+                            nft_trans_chain_name(tmp) &&
+                            strcmp(name, nft_trans_chain_name(tmp)) == 0) {
+                                kfree(name);
+                                goto err;
+                        }
                 }
+
+                nft_trans_chain_name(trans) = name;
         }
         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 
         return 0;
+err:
+        free_percpu(stats);
+        kfree(trans);
+        return err;
 }
 
 static int nf_tables_newchain(struct net *net, struct sock *nlsk,
@@ -2254,6 +2271,39 @@ done:
         return skb->len;
 }
 
+static int nf_tables_dump_rules_start(struct netlink_callback *cb)
+{
+        const struct nlattr * const *nla = cb->data;
+        struct nft_rule_dump_ctx *ctx = NULL;
+
+        if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
+                ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
+                if (!ctx)
+                        return -ENOMEM;
+
+                if (nla[NFTA_RULE_TABLE]) {
+                        ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
+                                                        GFP_ATOMIC);
+                        if (!ctx->table) {
+                                kfree(ctx);
+                                return -ENOMEM;
+                        }
+                }
+                if (nla[NFTA_RULE_CHAIN]) {
+                        ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
+                                                GFP_ATOMIC);
+                        if (!ctx->chain) {
+                                kfree(ctx->table);
+                                kfree(ctx);
+                                return -ENOMEM;
+                        }
+                }
+        }
+
+        cb->data = ctx;
+        return 0;
+}
+
 static int nf_tables_dump_rules_done(struct netlink_callback *cb)
 {
         struct nft_rule_dump_ctx *ctx = cb->data;
@@ -2283,38 +2333,13 @@ static int nf_tables_getrule(struct net *net, struct sock *nlsk,
 
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 struct netlink_dump_control c = {
+                        .start= nf_tables_dump_rules_start,
                         .dump = nf_tables_dump_rules,
                         .done = nf_tables_dump_rules_done,
                         .module = THIS_MODULE,
+                        .data = (void *)nla,
                 };
 
-                if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
-                        struct nft_rule_dump_ctx *ctx;
-
-                        ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
-                        if (!ctx)
-                                return -ENOMEM;
-
-                        if (nla[NFTA_RULE_TABLE]) {
-                                ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
-                                                        GFP_ATOMIC);
-                                if (!ctx->table) {
-                                        kfree(ctx);
-                                        return -ENOMEM;
-                                }
-                        }
-                        if (nla[NFTA_RULE_CHAIN]) {
-                                ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
-                                                        GFP_ATOMIC);
-                                if (!ctx->chain) {
-                                        kfree(ctx->table);
-                                        kfree(ctx);
-                                        return -ENOMEM;
-                                }
-                        }
-                        c.data = ctx;
-                }
-
                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
         }
 
@@ -2384,6 +2409,9 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
         struct nft_rule *rule;
         int err;
 
+        if (ctx->level == NFT_JUMP_STACK_SIZE)
+                return -EMLINK;
+
         list_for_each_entry(rule, &chain->rules, list) {
                 if (!nft_is_active_next(ctx->net, rule))
                         continue;
@@ -3161,6 +3189,18 @@ done:
         return skb->len;
 }
 
+static int nf_tables_dump_sets_start(struct netlink_callback *cb)
+{
+        struct nft_ctx *ctx_dump = NULL;
+
+        ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC);
+        if (ctx_dump == NULL)
+                return -ENOMEM;
+
+        cb->data = ctx_dump;
+        return 0;
+}
+
 static int nf_tables_dump_sets_done(struct netlink_callback *cb)
 {
         kfree(cb->data);
@@ -3188,18 +3228,12 @@ static int nf_tables_getset(struct net *net, struct sock *nlsk,
 
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 struct netlink_dump_control c = {
+                        .start = nf_tables_dump_sets_start,
                         .dump = nf_tables_dump_sets,
                         .done = nf_tables_dump_sets_done,
+                        .data = &ctx,
                         .module = THIS_MODULE,
                 };
-                struct nft_ctx *ctx_dump;
-
-                ctx_dump = kmalloc(sizeof(*ctx_dump), GFP_ATOMIC);
-                if (ctx_dump == NULL)
-                        return -ENOMEM;
-
-                *ctx_dump = ctx;
-                c.data = ctx_dump;
 
                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
         }
@@ -3849,6 +3883,15 @@ nla_put_failure:
         return -ENOSPC;
 }
 
+static int nf_tables_dump_set_start(struct netlink_callback *cb)
+{
+        struct nft_set_dump_ctx *dump_ctx = cb->data;
+
+        cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC);
+
+        return cb->data ? 0 : -ENOMEM;
+}
+
 static int nf_tables_dump_set_done(struct netlink_callback *cb)
 {
         kfree(cb->data);
@@ -4002,20 +4045,17 @@ static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
 
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 struct netlink_dump_control c = {
+                        .start = nf_tables_dump_set_start,
                         .dump = nf_tables_dump_set,
                         .done = nf_tables_dump_set_done,
                         .module = THIS_MODULE,
                 };
-                struct nft_set_dump_ctx *dump_ctx;
-
-                dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_ATOMIC);
-                if (!dump_ctx)
-                        return -ENOMEM;
-
-                dump_ctx->set = set;
-                dump_ctx->ctx = ctx;
+                struct nft_set_dump_ctx dump_ctx = {
+                        .set = set,
+                        .ctx = ctx,
+                };
 
-                c.data = dump_ctx;
+                c.data = &dump_ctx;
                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
         }
 
@@ -4975,38 +5015,42 @@ done:
         return skb->len;
 }
 
-static int nf_tables_dump_obj_done(struct netlink_callback *cb)
+static int nf_tables_dump_obj_start(struct netlink_callback *cb)
 {
-        struct nft_obj_filter *filter = cb->data;
+        const struct nlattr * const *nla = cb->data;
+        struct nft_obj_filter *filter = NULL;
 
-        if (filter) {
-                kfree(filter->table);
-                kfree(filter);
+        if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) {
+                filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
+                if (!filter)
+                        return -ENOMEM;
+
+                if (nla[NFTA_OBJ_TABLE]) {
+                        filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC);
+                        if (!filter->table) {
+                                kfree(filter);
+                                return -ENOMEM;
+                        }
+                }
+
+                if (nla[NFTA_OBJ_TYPE])
+                        filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
         }
 
+        cb->data = filter;
         return 0;
 }
 
-static struct nft_obj_filter *
-nft_obj_filter_alloc(const struct nlattr * const nla[])
+static int nf_tables_dump_obj_done(struct netlink_callback *cb)
 {
-        struct nft_obj_filter *filter;
-
-        filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
-        if (!filter)
-                return ERR_PTR(-ENOMEM);
+        struct nft_obj_filter *filter = cb->data;
 
-        if (nla[NFTA_OBJ_TABLE]) {
-                filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC);
-                if (!filter->table) {
-                        kfree(filter);
-                        return ERR_PTR(-ENOMEM);
-                }
+        if (filter) {
+                kfree(filter->table);
+                kfree(filter);
         }
-        if (nla[NFTA_OBJ_TYPE])
-                filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
 
-        return filter;
+        return 0;
 }
 
 /* called with rcu_read_lock held */
@@ -5027,21 +5071,13 @@ static int nf_tables_getobj(struct net *net, struct sock *nlsk,
 
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 struct netlink_dump_control c = {
+                        .start = nf_tables_dump_obj_start,
                         .dump = nf_tables_dump_obj,
                         .done = nf_tables_dump_obj_done,
                         .module = THIS_MODULE,
+                        .data = (void *)nla,
                 };
 
-                if (nla[NFTA_OBJ_TABLE] ||
-                    nla[NFTA_OBJ_TYPE]) {
-                        struct nft_obj_filter *filter;
-
-                        filter = nft_obj_filter_alloc(nla);
-                        if (IS_ERR(filter))
-                                return -ENOMEM;
-
-                        c.data = filter;
-                }
                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
         }
 
@@ -5320,8 +5356,6 @@ static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
                 flowtable->ops[i].priv          = &flowtable->data;
                 flowtable->ops[i].hook          = flowtable->data.type->hook;
                 flowtable->ops[i].dev           = dev_array[i];
-                flowtable->dev_name[i]          = kstrdup(dev_array[i]->name,
-                                                          GFP_KERNEL);
         }
 
         return err;
@@ -5479,10 +5513,8 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
 err6:
         i = flowtable->ops_len;
 err5:
-        for (k = i - 1; k >= 0; k--) {
-                kfree(flowtable->dev_name[k]);
+        for (k = i - 1; k >= 0; k--)
                 nf_unregister_net_hook(net, &flowtable->ops[k]);
-        }
 
         kfree(flowtable->ops);
 err4:
@@ -5581,9 +5613,10 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
                 goto nla_put_failure;
 
         for (i = 0; i < flowtable->ops_len; i++) {
-                if (flowtable->dev_name[i][0] &&
-                    nla_put_string(skb, NFTA_DEVICE_NAME,
-                                   flowtable->dev_name[i]))
+                const struct net_device *dev = READ_ONCE(flowtable->ops[i].dev);
+
+                if (dev &&
+                    nla_put_string(skb, NFTA_DEVICE_NAME, dev->name))
                         goto nla_put_failure;
         }
         nla_nest_end(skb, nest_devs);
@@ -5650,37 +5683,39 @@ done:
         return skb->len;
 }
 
-static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
+static int nf_tables_dump_flowtable_start(struct netlink_callback *cb)
 {
-        struct nft_flowtable_filter *filter = cb->data;
+        const struct nlattr * const *nla = cb->data;
+        struct nft_flowtable_filter *filter = NULL;
 
-        if (!filter)
-                return 0;
+        if (nla[NFTA_FLOWTABLE_TABLE]) {
+                filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
+                if (!filter)
+                        return -ENOMEM;
 
-        kfree(filter->table);
-        kfree(filter);
+                filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
+                                           GFP_ATOMIC);
+                if (!filter->table) {
+                        kfree(filter);
+                        return -ENOMEM;
+                }
+        }
 
+        cb->data = filter;
         return 0;
 }
 
-static struct nft_flowtable_filter *
-nft_flowtable_filter_alloc(const struct nlattr * const nla[])
+static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
 {
-        struct nft_flowtable_filter *filter;
+        struct nft_flowtable_filter *filter = cb->data;
 
-        filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
         if (!filter)
-                return ERR_PTR(-ENOMEM);
+                return 0;
 
-        if (nla[NFTA_FLOWTABLE_TABLE]) {
-                filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
-                                           GFP_ATOMIC);
-                if (!filter->table) {
-                        kfree(filter);
-                        return ERR_PTR(-ENOMEM);
-                }
-        }
-        return filter;
+        kfree(filter->table);
+        kfree(filter);
+
+        return 0;
 }
 
 /* called with rcu_read_lock held */
@@ -5700,20 +5735,13 @@ static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
 
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 struct netlink_dump_control c = {
+                        .start = nf_tables_dump_flowtable_start,
                         .dump = nf_tables_dump_flowtable,
                         .done = nf_tables_dump_flowtable_done,
                         .module = THIS_MODULE,
+                        .data = (void *)nla,
                 };
 
-                if (nla[NFTA_FLOWTABLE_TABLE]) {
-                        struct nft_flowtable_filter *filter;
-
-                        filter = nft_flowtable_filter_alloc(nla);
-                        if (IS_ERR(filter))
-                                return -ENOMEM;
-
-                        c.data = filter;
-                }
                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
         }
 
@@ -5783,6 +5811,7 @@ static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
         kfree(flowtable->name);
         flowtable->data.type->free(&flowtable->data);
         module_put(flowtable->data.type->owner);
+        kfree(flowtable);
 }
 
 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
@@ -5825,7 +5854,6 @@ static void nft_flowtable_event(unsigned long event, struct net_device *dev,
                         continue;
 
                 nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]);
-                flowtable->dev_name[i][0] = '\0';
                 flowtable->ops[i].dev = NULL;
                 break;
         }
@@ -6086,6 +6114,9 @@ static void nft_commit_release(struct nft_trans *trans)
         case NFT_MSG_DELTABLE:
                 nf_tables_table_destroy(&trans->ctx);
                 break;
+        case NFT_MSG_NEWCHAIN:
+                kfree(nft_trans_chain_name(trans));
+                break;
         case NFT_MSG_DELCHAIN:
                 nf_tables_chain_destroy(&trans->ctx);
                 break;
@@ -6315,13 +6346,15 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
                         nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
                         break;
                 case NFT_MSG_NEWCHAIN:
-                        if (nft_trans_chain_update(trans))
+                        if (nft_trans_chain_update(trans)) {
                                 nft_chain_commit_update(trans);
-                        else
+                                nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
+                                /* trans destroyed after rcu grace period */
+                        } else {
                                 nft_clear(net, trans->ctx.chain);
-
-                        nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
-                        nft_trans_destroy(trans);
+                                nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
+                                nft_trans_destroy(trans);
+                        }
                         break;
                 case NFT_MSG_DELCHAIN:
                         nft_chain_del(trans->ctx.chain);
@@ -6471,7 +6504,7 @@ static int __nf_tables_abort(struct net *net)
                 case NFT_MSG_NEWCHAIN:
                         if (nft_trans_chain_update(trans)) {
                                 free_percpu(nft_trans_chain_stats(trans));
-
+                                kfree(nft_trans_chain_name(trans));
                                 nft_trans_destroy(trans);
                         } else {
                                 trans->ctx.table->use--;
@@ -6837,13 +6870,6 @@ int nft_validate_register_store(const struct nft_ctx *ctx,
                         err = nf_tables_check_loops(ctx, data->verdict.chain);
                         if (err < 0)
                                 return err;
-
-                        if (ctx->chain->level + 1 >
-                            data->verdict.chain->level) {
-                                if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
-                                        return -EMLINK;
-                                data->verdict.chain->level = ctx->chain->level + 1;
-                        }
                 }
 
                 return 0;
diff --git a/net/netfilter/nf_tables_set_core.c b/net/netfilter/nf_tables_set_core.c
new file mode 100644
index 000000000000..814789644bd3
--- /dev/null
+++ b/net/netfilter/nf_tables_set_core.c
@@ -0,0 +1,28 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#include <net/netfilter/nf_tables_core.h>
+
+static int __init nf_tables_set_module_init(void)
+{
+        nft_register_set(&nft_set_hash_fast_type);
+        nft_register_set(&nft_set_hash_type);
+        nft_register_set(&nft_set_rhash_type);
+        nft_register_set(&nft_set_bitmap_type);
+        nft_register_set(&nft_set_rbtree_type);
+
+        return 0;
+}
+
+static void __exit nf_tables_set_module_exit(void)
+{
+        nft_unregister_set(&nft_set_rbtree_type);
+        nft_unregister_set(&nft_set_bitmap_type);
+        nft_unregister_set(&nft_set_rhash_type);
+        nft_unregister_set(&nft_set_hash_type);
+        nft_unregister_set(&nft_set_hash_fast_type);
+}
+
+module_init(nf_tables_set_module_init);
+module_exit(nf_tables_set_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_NFT_SET();
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 8d1ff654e5af..32535eea51b2 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -832,10 +832,18 @@ nft_target_select_ops(const struct nft_ctx *ctx,
         rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
         family = ctx->family;
 
+        if (strcmp(tg_name, XT_ERROR_TARGET) == 0 ||
+            strcmp(tg_name, XT_STANDARD_TARGET) == 0 ||
+            strcmp(tg_name, "standard") == 0)
+                return ERR_PTR(-EINVAL);
+
         /* Re-use the existing target if it's already loaded. */
         list_for_each_entry(nft_target, &nft_target_list, head) {
                 struct xt_target *target = nft_target->ops.data;
 
+                if (!target->target)
+                        continue;
+
                 if (nft_target_cmp(target, tg_name, rev, family))
                         return &nft_target->ops;
         }
@@ -844,6 +852,11 @@ nft_target_select_ops(const struct nft_ctx *ctx,
         if (IS_ERR(target))
                 return ERR_PTR(-ENOENT);
 
+        if (!target->target) {
+                err = -EINVAL;
+                goto err;
+        }
+
         if (target->targetsize > nla_len(tb[NFTA_TARGET_INFO])) {
                 err = -EINVAL;
                 goto err;
diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index 15adf8ca82c3..0777a93211e2 100644
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -98,6 +98,7 @@ static int nft_immediate_validate(const struct nft_ctx *ctx,
                                   const struct nft_data **d)
 {
         const struct nft_immediate_expr *priv = nft_expr_priv(expr);
+        struct nft_ctx *pctx = (struct nft_ctx *)ctx;
         const struct nft_data *data;
         int err;
 
@@ -109,9 +110,11 @@ static int nft_immediate_validate(const struct nft_ctx *ctx,
         switch (data->verdict.code) {
         case NFT_JUMP:
         case NFT_GOTO:
+                pctx->level++;
                 err = nft_chain_validate(ctx, data->verdict.chain);
                 if (err < 0)
                         return err;
+                pctx->level--;
                 break;
         default:
                 break;
diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
index 42e6fadf1417..c2a1d84cdfc4 100644
--- a/net/netfilter/nft_lookup.c
+++ b/net/netfilter/nft_lookup.c
@@ -155,7 +155,9 @@ static int nft_lookup_validate_setelem(const struct nft_ctx *ctx,
                                        struct nft_set_elem *elem)
 {
         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
+        struct nft_ctx *pctx = (struct nft_ctx *)ctx;
         const struct nft_data *data;
+        int err;
 
         if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
             *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
@@ -165,10 +167,17 @@ static int nft_lookup_validate_setelem(const struct nft_ctx *ctx,
         switch (data->verdict.code) {
         case NFT_JUMP:
         case NFT_GOTO:
-                return nft_chain_validate(ctx, data->verdict.chain);
+                pctx->level++;
+                err = nft_chain_validate(ctx, data->verdict.chain);
+                if (err < 0)
+                        return err;
+                pctx->level--;
+                break;
         default:
-                return 0;
+                break;
         }
+
+        return 0;
 }
 
 static int nft_lookup_validate(const struct nft_ctx *ctx,
diff --git a/net/netfilter/nft_set_bitmap.c b/net/netfilter/nft_set_bitmap.c
index d6626e01c7ee..128bc16f52dd 100644
--- a/net/netfilter/nft_set_bitmap.c
+++ b/net/netfilter/nft_set_bitmap.c
@@ -296,7 +296,7 @@ static bool nft_bitmap_estimate(const struct nft_set_desc *desc, u32 features,
         return true;
 }
 
-static struct nft_set_type nft_bitmap_type __read_mostly = {
+struct nft_set_type nft_set_bitmap_type __read_mostly = {
         .owner          = THIS_MODULE,
         .ops            = {
                 .privsize       = nft_bitmap_privsize,
@@ -314,20 +314,3 @@ static struct nft_set_type nft_bitmap_type __read_mostly = {
                 .get            = nft_bitmap_get,
         },
 };
-
-static int __init nft_bitmap_module_init(void)
-{
-        return nft_register_set(&nft_bitmap_type);
-}
-
-static void __exit nft_bitmap_module_exit(void)
-{
-        nft_unregister_set(&nft_bitmap_type);
-}
-
-module_init(nft_bitmap_module_init);
-module_exit(nft_bitmap_module_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
-MODULE_ALIAS_NFT_SET();
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 6f9a1365a09f..90c3e7e6cacb 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -387,6 +387,7 @@ static void nft_rhash_destroy(const struct nft_set *set)
         struct nft_rhash *priv = nft_set_priv(set);
 
         cancel_delayed_work_sync(&priv->gc_work);
+        rcu_barrier();
         rhashtable_free_and_destroy(&priv->ht, nft_rhash_elem_destroy,
                                     (void *)set);
 }
@@ -654,7 +655,7 @@ static bool nft_hash_fast_estimate(const struct nft_set_desc *desc, u32 features
         return true;
 }
 
-static struct nft_set_type nft_rhash_type __read_mostly = {
+struct nft_set_type nft_set_rhash_type __read_mostly = {
         .owner          = THIS_MODULE,
         .features       = NFT_SET_MAP | NFT_SET_OBJECT |
                           NFT_SET_TIMEOUT | NFT_SET_EVAL,
@@ -677,7 +678,7 @@ static struct nft_set_type nft_rhash_type __read_mostly = {
         },
 };
 
-static struct nft_set_type nft_hash_type __read_mostly = {
+struct nft_set_type nft_set_hash_type __read_mostly = {
         .owner          = THIS_MODULE,
         .features       = NFT_SET_MAP | NFT_SET_OBJECT,
         .ops            = {
@@ -697,7 +698,7 @@ static struct nft_set_type nft_hash_type __read_mostly = {
         },
 };
 
-static struct nft_set_type nft_hash_fast_type __read_mostly = {
+struct nft_set_type nft_set_hash_fast_type __read_mostly = {
         .owner          = THIS_MODULE,
         .features       = NFT_SET_MAP | NFT_SET_OBJECT,
         .ops            = {
@@ -716,26 +717,3 @@ static struct nft_set_type nft_hash_fast_type __read_mostly = {
                 .get            = nft_hash_get,
         },
 };
-
-static int __init nft_hash_module_init(void)
-{
-        if (nft_register_set(&nft_hash_fast_type) ||
-            nft_register_set(&nft_hash_type) ||
-            nft_register_set(&nft_rhash_type))
-                return 1;
-        return 0;
-}
-
-static void __exit nft_hash_module_exit(void)
-{
-        nft_unregister_set(&nft_rhash_type);
-        nft_unregister_set(&nft_hash_type);
-        nft_unregister_set(&nft_hash_fast_type);
-}
-
-module_init(nft_hash_module_init);
-module_exit(nft_hash_module_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-MODULE_ALIAS_NFT_SET();
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index 7f3a9a211034..9873d734b494 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -381,7 +381,7 @@ static void nft_rbtree_gc(struct work_struct *work)
 
                 gcb = nft_set_gc_batch_check(set, gcb, GFP_ATOMIC);
                 if (!gcb)
-                        goto out;
+                        break;
 
                 atomic_dec(&set->nelems);
                 nft_set_gc_batch_add(gcb, rbe);
@@ -390,10 +390,12 @@ static void nft_rbtree_gc(struct work_struct *work)
                         rbe = rb_entry(prev, struct nft_rbtree_elem, node);
                         atomic_dec(&set->nelems);
                         nft_set_gc_batch_add(gcb, rbe);
+                        prev = NULL;
                 }
                 node = rb_next(node);
+                if (!node)
+                        break;
         }
-out:
         if (gcb) {
                 for (i = 0; i < gcb->head.cnt; i++) {
                         rbe = gcb->elems[i];
@@ -440,6 +442,7 @@ static void nft_rbtree_destroy(const struct nft_set *set)
         struct rb_node *node;
 
         cancel_delayed_work_sync(&priv->gc_work);
+        rcu_barrier();
         while ((node = priv->root.rb_node) != NULL) {
                 rb_erase(node, &priv->root);
                 rbe = rb_entry(node, struct nft_rbtree_elem, node);
@@ -462,7 +465,7 @@ static bool nft_rbtree_estimate(const struct nft_set_desc *desc, u32 features,
         return true;
 }
 
-static struct nft_set_type nft_rbtree_type __read_mostly = {
+struct nft_set_type nft_set_rbtree_type __read_mostly = {
         .owner          = THIS_MODULE,
         .features       = NFT_SET_INTERVAL | NFT_SET_MAP | NFT_SET_OBJECT | NFT_SET_TIMEOUT,
         .ops            = {
@@ -481,20 +484,3 @@ static struct nft_set_type nft_rbtree_type __read_mostly = {
                 .get            = nft_rbtree_get,
         },
 };
-
-static int __init nft_rbtree_module_init(void)
-{
-        return nft_register_set(&nft_rbtree_type);
-}
-
-static void __exit nft_rbtree_module_exit(void)
-{
-        nft_unregister_set(&nft_rbtree_type);
-}
-
-module_init(nft_rbtree_module_init);
-module_exit(nft_rbtree_module_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-MODULE_ALIAS_NFT_SET();
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index 58fce4e749a9..d76550a8b642 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -61,7 +61,7 @@ tproxy_tg4(struct net *net, struct sk_buff *skb, __be32 laddr, __be16 lport,
          * addresses, this happens if the redirect already happened
          * and the current packet belongs to an already established
          * connection */
-        sk = nf_tproxy_get_sock_v4(net, skb, hp, iph->protocol,
+        sk = nf_tproxy_get_sock_v4(net, skb, iph->protocol,
                                    iph->saddr, iph->daddr,
                                    hp->source, hp->dest,
                                    skb->dev, NF_TPROXY_LOOKUP_ESTABLISHED);
@@ -77,7 +77,7 @@ tproxy_tg4(struct net *net, struct sk_buff *skb, __be32 laddr, __be16 lport,
         else if (!sk)
                 /* no, there's no established connection, check if
                  * there's a listener on the redirected addr/port */
-                sk = nf_tproxy_get_sock_v4(net, skb, hp, iph->protocol,
+                sk = nf_tproxy_get_sock_v4(net, skb, iph->protocol,
                                            iph->saddr, laddr,
                                            hp->source, lport,
                                            skb->dev, NF_TPROXY_LOOKUP_LISTENER);
@@ -150,7 +150,7 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)
          * addresses, this happens if the redirect already happened
          * and the current packet belongs to an already established
          * connection */
-        sk = nf_tproxy_get_sock_v6(xt_net(par), skb, thoff, hp, tproto,
+        sk = nf_tproxy_get_sock_v6(xt_net(par), skb, thoff, tproto,
                                    &iph->saddr, &iph->daddr,
                                    hp->source, hp->dest,
                                    xt_in(par), NF_TPROXY_LOOKUP_ESTABLISHED);
@@ -171,7 +171,7 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)
         else if (!sk)
                 /* no there's no established connection, check if
                  * there's a listener on the redirected addr/port */
-                sk = nf_tproxy_get_sock_v6(xt_net(par), skb, thoff, hp,
+                sk = nf_tproxy_get_sock_v6(xt_net(par), skb, thoff,
                                            tproto, &iph->saddr, laddr,
                                            hp->source, lport,
                                            xt_in(par), NF_TPROXY_LOOKUP_LISTENER);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 393573a99a5a..56704d95f82d 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -63,6 +63,7 @@
 #include <linux/hash.h>
 #include <linux/genetlink.h>
 #include <linux/net_namespace.h>
+#include <linux/nospec.h>
 
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
@@ -679,6 +680,7 @@ static int netlink_create(struct net *net, struct socket *sock, int protocol,
 
         if (protocol < 0 || protocol >= MAX_LINKS)
                 return -EPROTONOSUPPORT;
+        protocol = array_index_nospec(protocol, MAX_LINKS);
 
         netlink_lock_table();
 #ifdef CONFIG_MODULES
@@ -1009,6 +1011,11 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
                         return err;
         }
 
+        if (nlk->ngroups == 0)
+                groups = 0;
+        else if (nlk->ngroups < 8*sizeof(groups))
+                groups &= (1UL << nlk->ngroups) - 1;
+
         bound = nlk->bound;
         if (bound) {
                 /* Ensure nlk->portid is up-to-date. */
diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
index 2ceefa183cee..6a196e438b6c 100644
--- a/net/nfc/llcp_commands.c
+++ b/net/nfc/llcp_commands.c
@@ -752,11 +752,14 @@ int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap,
                 pr_debug("Fragment %zd bytes remaining %zd",
                          frag_len, remaining_len);
 
-                pdu = nfc_alloc_send_skb(sock->dev, &sock->sk, MSG_DONTWAIT,
+                pdu = nfc_alloc_send_skb(sock->dev, &sock->sk, 0,
                                          frag_len + LLCP_HEADER_SIZE, &err);
                 if (pdu == NULL) {
-                        pr_err("Could not allocate PDU\n");
-                        continue;
+                        pr_err("Could not allocate PDU (error=%d)\n", err);
+                        len -= remaining_len;
+                        if (len == 0)
+                                len = err;
+                        break;
                 }
 
                 pdu = llcp_add_header(pdu, dsap, ssap, LLCP_PDU_UI);
diff --git a/net/nsh/nsh.c b/net/nsh/nsh.c
index 9696ef96b719..1a30e165eeb4 100644
--- a/net/nsh/nsh.c
+++ b/net/nsh/nsh.c
@@ -104,7 +104,7 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb,
         __skb_pull(skb, nsh_len);
 
         skb_reset_mac_header(skb);
-        skb_reset_mac_len(skb);
+        skb->mac_len = proto == htons(ETH_P_TEB) ? ETH_HLEN : 0;
         skb->protocol = proto;
 
         features &= NETIF_F_SG;
diff --git a/net/openvswitch/meter.c b/net/openvswitch/meter.c
index b891a91577f8..c038e021a591 100644
--- a/net/openvswitch/meter.c
+++ b/net/openvswitch/meter.c
@@ -211,6 +211,7 @@ static struct dp_meter *dp_meter_create(struct nlattr **a)
         if (!meter)
                 return ERR_PTR(-ENOMEM);
 
+        meter->id = nla_get_u32(a[OVS_METER_ATTR_ID]);
         meter->used = div_u64(ktime_get_ns(), 1000 * 1000);
         meter->kbps = a[OVS_METER_ATTR_KBPS] ? 1 : 0;
         meter->keep_stats = !a[OVS_METER_ATTR_CLEAR];
@@ -280,6 +281,10 @@ static int ovs_meter_cmd_set(struct sk_buff *skb, struct genl_info *info)
         u32 meter_id;
         bool failed;
 
+        if (!a[OVS_METER_ATTR_ID]) {
+                return -ENODEV;
+        }
+
         meter = dp_meter_create(a);
         if (IS_ERR_OR_NULL(meter))
                 return PTR_ERR(meter);
@@ -298,11 +303,6 @@ static int ovs_meter_cmd_set(struct sk_buff *skb, struct genl_info *info)
                 goto exit_unlock;
         }
 
-        if (!a[OVS_METER_ATTR_ID]) {
-                err = -ENODEV;
-                goto exit_unlock;
-        }
-
         meter_id = nla_get_u32(a[OVS_METER_ATTR_ID]);
 
         /* Cannot fail after this. */
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 57634bc3da74..9b27d0cd766d 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2878,6 +2878,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
                         goto out_free;
         } else if (reserve) {
                 skb_reserve(skb, -reserve);
+                if (len < reserve)
+                        skb_reset_network_header(skb);
         }
 
         /* Returns -EFAULT on error */
diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
index 2aa07b547b16..86e1e37eb4e8 100644
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -191,8 +191,13 @@ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb,
         hdr->type = cpu_to_le32(type);
         hdr->src_node_id = cpu_to_le32(from->sq_node);
         hdr->src_port_id = cpu_to_le32(from->sq_port);
-        hdr->dst_node_id = cpu_to_le32(to->sq_node);
-        hdr->dst_port_id = cpu_to_le32(to->sq_port);
+        if (to->sq_port == QRTR_PORT_CTRL) {
+                hdr->dst_node_id = cpu_to_le32(node->nid);
+                hdr->dst_port_id = cpu_to_le32(QRTR_NODE_BCAST);
+        } else {
+                hdr->dst_node_id = cpu_to_le32(to->sq_node);
+                hdr->dst_port_id = cpu_to_le32(to->sq_port);
+        }
 
         hdr->size = cpu_to_le32(len);
         hdr->confirm_rx = 0;
@@ -764,6 +769,10 @@ static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
         node = NULL;
         if (addr->sq_node == QRTR_NODE_BCAST) {
                 enqueue_fn = qrtr_bcast_enqueue;
+                if (addr->sq_port != QRTR_PORT_CTRL) {
+                        release_sock(sk);
+                        return -ENOTCONN;
+                }
         } else if (addr->sq_node == ipc->us.sq_node) {
                 enqueue_fn = qrtr_local_enqueue;
         } else {
diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c
index 48332a6ed738..d152e48ea371 100644
--- a/net/rds/ib_frmr.c
+++ b/net/rds/ib_frmr.c
@@ -344,6 +344,11 @@ struct rds_ib_mr *rds_ib_reg_frmr(struct rds_ib_device *rds_ibdev,
         struct rds_ib_frmr *frmr;
         int ret;
 
+        if (!ic) {
+                /* TODO: Add FRWR support for RDS_GET_MR using proxy qp*/
+                return ERR_PTR(-EOPNOTSUPP);
+        }
+
         do {
                 if (ibmr)
                         rds_ib_free_frmr(ibmr, true);
diff --git a/net/rds/ib_mr.h b/net/rds/ib_mr.h
index 0ea4ab017a8c..655f01d427fe 100644
--- a/net/rds/ib_mr.h
+++ b/net/rds/ib_mr.h
@@ -115,7 +115,8 @@ void rds_ib_get_mr_info(struct rds_ib_device *rds_ibdev,
                         struct rds_info_rdma_connection *iinfo);
 void rds_ib_destroy_mr_pool(struct rds_ib_mr_pool *);
 void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
-                    struct rds_sock *rs, u32 *key_ret);
+                    struct rds_sock *rs, u32 *key_ret,
+                    struct rds_connection *conn);
 void rds_ib_sync_mr(void *trans_private, int dir);
 void rds_ib_free_mr(void *trans_private, int invalidate);
 void rds_ib_flush_mrs(void);
diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index e678699268a2..2e49a40a5e11 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -537,11 +537,12 @@ void rds_ib_flush_mrs(void)
 }
 
 void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
-                    struct rds_sock *rs, u32 *key_ret)
+                    struct rds_sock *rs, u32 *key_ret,
+                    struct rds_connection *conn)
 {
         struct rds_ib_device *rds_ibdev;
         struct rds_ib_mr *ibmr = NULL;
-        struct rds_ib_connection *ic = rs->rs_conn->c_transport_data;
+        struct rds_ib_connection *ic = NULL;
         int ret;
 
         rds_ibdev = rds_ib_get_device(rs->rs_bound_addr);
@@ -550,6 +551,9 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
                 goto out;
         }
 
+        if (conn)
+                ic = conn->c_transport_data;
+
         if (!rds_ibdev->mr_8k_pool || !rds_ibdev->mr_1m_pool) {
                 ret = -ENODEV;
                 goto out;
@@ -559,17 +563,18 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
                 ibmr = rds_ib_reg_frmr(rds_ibdev, ic, sg, nents, key_ret);
         else
                 ibmr = rds_ib_reg_fmr(rds_ibdev, sg, nents, key_ret);
-        if (ibmr)
-                rds_ibdev = NULL;
-
- out:
-        if (!ibmr)
+        if (IS_ERR(ibmr)) {
+                ret = PTR_ERR(ibmr);
                 pr_warn("RDS/IB: rds_ib_get_mr failed (errno=%d)\n", ret);
+        } else {
+                return ibmr;
+        }
 
+ out:
         if (rds_ibdev)
                 rds_ib_dev_put(rds_ibdev);
 
-        return ibmr;
+        return ERR_PTR(ret);
 }
 
 void rds_ib_destroy_mr_pool(struct rds_ib_mr_pool *pool)
diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 634cfcb7bba6..80920e47f2c7 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -170,7 +170,8 @@ static int rds_pin_pages(unsigned long user_addr, unsigned int nr_pages,
 }
 
 static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
-                                u64 *cookie_ret, struct rds_mr **mr_ret)
+                          u64 *cookie_ret, struct rds_mr **mr_ret,
+                          struct rds_conn_path *cp)
 {
         struct rds_mr *mr = NULL, *found;
         unsigned int nr_pages;
@@ -269,7 +270,8 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
          * Note that dma_map() implies that pending writes are
          * flushed to RAM, so no dma_sync is needed here. */
         trans_private = rs->rs_transport->get_mr(sg, nents, rs,
-                                                 &mr->r_key);
+                                                 &mr->r_key,
+                                                 cp ? cp->cp_conn : NULL);
 
         if (IS_ERR(trans_private)) {
                 for (i = 0 ; i < nents; i++)
@@ -330,7 +332,7 @@ int rds_get_mr(struct rds_sock *rs, char __user *optval, int optlen)
                            sizeof(struct rds_get_mr_args)))
                 return -EFAULT;
 
-        return __rds_rdma_map(rs, &args, NULL, NULL);
+        return __rds_rdma_map(rs, &args, NULL, NULL, NULL);
 }
 
 int rds_get_mr_for_dest(struct rds_sock *rs, char __user *optval, int optlen)
@@ -354,7 +356,7 @@ int rds_get_mr_for_dest(struct rds_sock *rs, char __user *optval, int optlen)
         new_args.cookie_addr = args.cookie_addr;
         new_args.flags = args.flags;
 
-        return __rds_rdma_map(rs, &new_args, NULL, NULL);
+        return __rds_rdma_map(rs, &new_args, NULL, NULL, NULL);
 }
 
 /*
@@ -782,7 +784,8 @@ int rds_cmsg_rdma_map(struct rds_sock *rs, struct rds_message *rm,
             rm->m_rdma_cookie != 0)
                 return -EINVAL;
 
-        return __rds_rdma_map(rs, CMSG_DATA(cmsg), &rm->m_rdma_cookie, &rm->rdma.op_rdma_mr);
+        return __rds_rdma_map(rs, CMSG_DATA(cmsg), &rm->m_rdma_cookie,
+                              &rm->rdma.op_rdma_mr, rm->m_conn_path);
 }
 
 /*
diff --git a/net/rds/rds.h b/net/rds/rds.h
index f2272fb8cd45..60b3b787fbdb 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -464,6 +464,8 @@ struct rds_message {
                         struct scatterlist      *op_sg;
                 } data;
         };
+
+        struct rds_conn_path *m_conn_path;
 };
 
 /*
@@ -544,7 +546,8 @@ struct rds_transport {
                                         unsigned int avail);
         void (*exit)(void);
         void *(*get_mr)(struct scatterlist *sg, unsigned long nr_sg,
-                        struct rds_sock *rs, u32 *key_ret);
+                        struct rds_sock *rs, u32 *key_ret,
+                        struct rds_connection *conn);
         void (*sync_mr)(void *trans_private, int direction);
         void (*free_mr)(void *trans_private, int invalidate);
         void (*flush_mrs)(void);
diff --git a/net/rds/send.c b/net/rds/send.c
index 94c7f74909be..59f17a2335f4 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -1169,6 +1169,13 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
                 rs->rs_conn = conn;
         }
 
+        if (conn->c_trans->t_mp_capable)
+                cpath = &conn->c_path[rds_send_mprds_hash(rs, conn)];
+        else
+                cpath = &conn->c_path[0];
+
+        rm->m_conn_path = cpath;
+
         /* Parse any control messages the user may have included. */
         ret = rds_cmsg_send(rs, rm, msg, &allocated_mr);
         if (ret) {
@@ -1192,11 +1199,6 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
                 goto out;
         }
 
-        if (conn->c_trans->t_mp_capable)
-                cpath = &conn->c_path[rds_send_mprds_hash(rs, conn)];
-        else
-                cpath = &conn->c_path[0];
-
         if (rds_destroy_pending(conn)) {
                 ret = -EAGAIN;
                 goto out;
diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
index a9a9be5519b9..9d1e298b784c 100644
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -116,9 +116,9 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx,
                 while (*pp) {
                         parent = *pp;
                         xcall = rb_entry(parent, struct rxrpc_call, sock_node);
-                        if (user_call_ID < call->user_call_ID)
+                        if (user_call_ID < xcall->user_call_ID)
                                 pp = &(*pp)->rb_left;
-                        else if (user_call_ID > call->user_call_ID)
+                        else if (user_call_ID > xcall->user_call_ID)
                                 pp = &(*pp)->rb_right;
                         else
                                 goto id_in_use;
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 526a8e491626..6e7124e57918 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -91,7 +91,7 @@ static int tcf_csum_init(struct net *net, struct nlattr *nla,
         }
         params_old = rtnl_dereference(p->params);
 
-        params_new->action = parm->action;
+        p->tcf_action = parm->action;
         params_new->update_flags = parm->update_flags;
         rcu_assign_pointer(p->params, params_new);
         if (params_old)
@@ -561,7 +561,7 @@ static int tcf_csum(struct sk_buff *skb, const struct tc_action *a,
         tcf_lastuse_update(&p->tcf_tm);
         bstats_cpu_update(this_cpu_ptr(p->common.cpu_bstats), skb);
 
-        action = params->action;
+        action = READ_ONCE(p->tcf_action);
         if (unlikely(action == TC_ACT_SHOT))
                 goto drop_stats;
 
@@ -599,11 +599,11 @@ static int tcf_csum_dump(struct sk_buff *skb, struct tc_action *a, int bind,
                 .index   = p->tcf_index,
                 .refcnt  = p->tcf_refcnt - ref,
                 .bindcnt = p->tcf_bindcnt - bind,
+                .action  = p->tcf_action,
         };
         struct tcf_t t;
 
         params = rtnl_dereference(p->params);
-        opt.action = params->action;
         opt.update_flags = params->update_flags;
 
         if (nla_put(skb, TCA_CSUM_PARMS, sizeof(opt), &opt))
diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index 626dac81a48a..9bc6c2ae98a5 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -36,7 +36,7 @@ static int tunnel_key_act(struct sk_buff *skb, const struct tc_action *a,
 
         tcf_lastuse_update(&t->tcf_tm);
         bstats_cpu_update(this_cpu_ptr(t->common.cpu_bstats), skb);
-        action = params->action;
+        action = READ_ONCE(t->tcf_action);
 
         switch (params->tcft_action) {
         case TCA_TUNNEL_KEY_ACT_RELEASE:
@@ -182,7 +182,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
 
         params_old = rtnl_dereference(t->params);
 
-        params_new->action = parm->action;
+        t->tcf_action = parm->action;
         params_new->tcft_action = parm->t_action;
         params_new->tcft_enc_metadata = metadata;
 
@@ -254,13 +254,13 @@ static int tunnel_key_dump(struct sk_buff *skb, struct tc_action *a,
                 .index    = t->tcf_index,
                 .refcnt   = t->tcf_refcnt - ref,
                 .bindcnt  = t->tcf_bindcnt - bind,
+                .action   = t->tcf_action,
         };
         struct tcf_t tm;
 
         params = rtnl_dereference(t->params);
 
         opt.t_action = params->tcft_action;
-        opt.action = params->action;
 
         if (nla_put(skb, TCA_TUNNEL_KEY_PARMS, sizeof(opt), &opt))
                 goto nla_put_failure;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index cdc3c87c53e6..f74513a7c7a8 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -1053,7 +1053,7 @@ static void tfilter_notify_chain(struct net *net, struct sk_buff *oskb,
         for (tp = rtnl_dereference(chain->filter_chain);
              tp; tp = rtnl_dereference(tp->next))
                 tfilter_notify(net, oskb, n, tp, block,
-                               q, parent, 0, event, false);
+                               q, parent, NULL, event, false);
 }
 
 static int tc_new_tfilter(struct sk_buff *skb, struct nlmsghdr *n,
@@ -1444,7 +1444,7 @@ static bool tcf_chain_dump(struct tcf_chain *chain, struct Qdisc *q, u32 parent,
                         memset(&cb->args[1], 0,
                                sizeof(cb->args) - sizeof(cb->args[0]));
                 if (cb->args[1] == 0) {
-                        if (tcf_fill_node(net, skb, tp, block, q, parent, 0,
+                        if (tcf_fill_node(net, skb, tp, block, q, parent, NULL,
                                           NETLINK_CB(cb->skb).portid,
                                           cb->nlh->nlmsg_seq, NLM_F_MULTI,
                                           RTM_NEWTFILTER) <= 0)
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index cd2e0e342fb6..6c0a9d5dbf94 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -479,24 +479,28 @@ static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt,
         q->cparams.mtu = psched_mtu(qdisc_dev(sch));
 
         if (opt) {
-                int err = fq_codel_change(sch, opt, extack);
+                err = fq_codel_change(sch, opt, extack);
                 if (err)
-                        return err;
+                        goto init_failure;
         }
 
         err = tcf_block_get(&q->block, &q->filter_list, sch, extack);
         if (err)
-                return err;
+                goto init_failure;
 
         if (!q->flows) {
                 q->flows = kvcalloc(q->flows_cnt,
                                     sizeof(struct fq_codel_flow),
                                     GFP_KERNEL);
-                if (!q->flows)
-                        return -ENOMEM;
+                if (!q->flows) {
+                        err = -ENOMEM;
+                        goto init_failure;
+                }
                 q->backlogs = kvcalloc(q->flows_cnt, sizeof(u32), GFP_KERNEL);
-                if (!q->backlogs)
-                        return -ENOMEM;
+                if (!q->backlogs) {
+                        err = -ENOMEM;
+                        goto alloc_failure;
+                }
                 for (i = 0; i < q->flows_cnt; i++) {
                         struct fq_codel_flow *flow = q->flows + i;
 
@@ -509,6 +513,13 @@ static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt,
         else
                 sch->flags &= ~TCQ_F_CAN_BYPASS;
         return 0;
+
+alloc_failure:
+        kvfree(q->flows);
+        q->flows = NULL;
+init_failure:
+        q->flows_cnt = 0;
+        return err;
 }
 
 static int fq_codel_dump(struct Qdisc *sch, struct sk_buff *skb)
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 445b7ef61677..12cac85da994 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -282,7 +282,7 @@ bool sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu)
 
         if (dst) {
                 /* Re-fetch, as under layers may have a higher minimum size */
-                pmtu = SCTP_TRUNC4(dst_mtu(dst));
+                pmtu = sctp_dst_mtu(dst);
                 change = t->pathmtu != pmtu;
         }
         t->pathmtu = pmtu;
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 3c1405df936c..05e4ffe5aabd 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -147,7 +147,8 @@ static int smc_release(struct socket *sock)
                 smc->clcsock = NULL;
         }
         if (smc->use_fallback) {
-                sock_put(sk); /* passive closing */
+                if (sk->sk_state != SMC_LISTEN && sk->sk_state != SMC_INIT)
+                        sock_put(sk); /* passive closing */
                 sk->sk_state = SMC_CLOSED;
                 sk->sk_state_change(sk);
         }
@@ -417,12 +418,18 @@ static int smc_connect_decline_fallback(struct smc_sock *smc, int reason_code)
 {
         int rc;
 
-        if (reason_code < 0) /* error, fallback is not possible */
+        if (reason_code < 0) { /* error, fallback is not possible */
+                if (smc->sk.sk_state == SMC_INIT)
+                        sock_put(&smc->sk); /* passive closing */
                 return reason_code;
+        }
         if (reason_code != SMC_CLC_DECL_REPLY) {
                 rc = smc_clc_send_decline(smc, reason_code);
-                if (rc < 0)
+                if (rc < 0) {
+                        if (smc->sk.sk_state == SMC_INIT)
+                                sock_put(&smc->sk); /* passive closing */
                         return rc;
+                }
         }
         return smc_connect_fallback(smc);
 }
@@ -435,8 +442,6 @@ static int smc_connect_abort(struct smc_sock *smc, int reason_code,
                 smc_lgr_forget(smc->conn.lgr);
         mutex_unlock(&smc_create_lgr_pending);
         smc_conn_free(&smc->conn);
-        if (reason_code < 0 && smc->sk.sk_state == SMC_INIT)
-                sock_put(&smc->sk); /* passive closing */
         return reason_code;
 }
 
@@ -1452,7 +1457,8 @@ static int smc_setsockopt(struct socket *sock, int level, int optname,
 
         if (optlen < sizeof(int))
                 return -EINVAL;
-        get_user(val, (int __user *)optval);
+        if (get_user(val, (int __user *)optval))
+                return -EFAULT;
 
         lock_sock(sk);
         switch (optname) {
@@ -1520,10 +1526,13 @@ static int smc_ioctl(struct socket *sock, unsigned int cmd,
                         return -EBADF;
                 return smc->clcsock->ops->ioctl(smc->clcsock, cmd, arg);
         }
+        lock_sock(&smc->sk);
         switch (cmd) {
         case SIOCINQ: /* same as FIONREAD */
-                if (smc->sk.sk_state == SMC_LISTEN)
+                if (smc->sk.sk_state == SMC_LISTEN) {
+                        release_sock(&smc->sk);
                         return -EINVAL;
+                }
                 if (smc->sk.sk_state == SMC_INIT ||
                     smc->sk.sk_state == SMC_CLOSED)
                         answ = 0;
@@ -1532,8 +1541,10 @@ static int smc_ioctl(struct socket *sock, unsigned int cmd,
                 break;
         case SIOCOUTQ:
                 /* output queue size (not send + not acked) */
-                if (smc->sk.sk_state == SMC_LISTEN)
+                if (smc->sk.sk_state == SMC_LISTEN) {
+                        release_sock(&smc->sk);
                         return -EINVAL;
+                }
                 if (smc->sk.sk_state == SMC_INIT ||
                     smc->sk.sk_state == SMC_CLOSED)
                         answ = 0;
@@ -1543,8 +1554,10 @@ static int smc_ioctl(struct socket *sock, unsigned int cmd,
                 break;
         case SIOCOUTQNSD:
                 /* output queue size (not send only) */
-                if (smc->sk.sk_state == SMC_LISTEN)
+                if (smc->sk.sk_state == SMC_LISTEN) {
+                        release_sock(&smc->sk);
                         return -EINVAL;
+                }
                 if (smc->sk.sk_state == SMC_INIT ||
                     smc->sk.sk_state == SMC_CLOSED)
                         answ = 0;
@@ -1552,8 +1565,10 @@ static int smc_ioctl(struct socket *sock, unsigned int cmd,
                         answ = smc_tx_prepared_sends(&smc->conn);
                 break;
         case SIOCATMARK:
-                if (smc->sk.sk_state == SMC_LISTEN)
+                if (smc->sk.sk_state == SMC_LISTEN) {
+                        release_sock(&smc->sk);
                         return -EINVAL;
+                }
                 if (smc->sk.sk_state == SMC_INIT ||
                     smc->sk.sk_state == SMC_CLOSED) {
                         answ = 0;
@@ -1569,8 +1584,10 @@ static int smc_ioctl(struct socket *sock, unsigned int cmd,
                 }
                 break;
         default:
+                release_sock(&smc->sk);
                 return -ENOIOCTLCMD;
         }
+        release_sock(&smc->sk);
 
         return put_user(answ, (int __user *)arg);
 }
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index a7e8d63fc8ae..9bde1e4ca288 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -233,7 +233,8 @@ static void smc_cdc_msg_recv_action(struct smc_sock *smc,
                         /* force immediate tx of current consumer cursor, but
                          * under send_lock to guarantee arrival in seqno-order
                          */
-                        smc_tx_sndbuf_nonempty(conn);
+                        if (smc->sk.sk_state != SMC_INIT)
+                                smc_tx_sndbuf_nonempty(conn);
                 }
         }
 
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index 717449b1da0b..ae5d168653ce 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -250,6 +250,7 @@ out:
 int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
                      u8 expected_type)
 {
+        long rcvtimeo = smc->clcsock->sk->sk_rcvtimeo;
         struct sock *clc_sk = smc->clcsock->sk;
         struct smc_clc_msg_hdr *clcm = buf;
         struct msghdr msg = {NULL, 0};
@@ -306,7 +307,6 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
         memset(&msg, 0, sizeof(struct msghdr));
         iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &vec, 1, datlen);
         krflags = MSG_WAITALL;
-        smc->clcsock->sk->sk_rcvtimeo = CLC_WAIT_TIME;
         len = sock_recvmsg(smc->clcsock, &msg, krflags);
         if (len < datlen || !smc_clc_msg_hdr_valid(clcm)) {
                 smc->sk.sk_err = EPROTO;
@@ -322,6 +322,7 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
         }
 
 out:
+        smc->clcsock->sk->sk_rcvtimeo = rcvtimeo;
         return reason_code;
 }
 
diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
index fa41d9881741..ac961dfb1ea1 100644
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -107,6 +107,8 @@ static void smc_close_active_abort(struct smc_sock *smc)
         }
         switch (sk->sk_state) {
         case SMC_INIT:
+                sk->sk_state = SMC_PEERABORTWAIT;
+                break;
         case SMC_ACTIVE:
                 sk->sk_state = SMC_PEERABORTWAIT;
                 release_sock(sk);
diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
index cee666400752..f82886b7d1d8 100644
--- a/net/smc/smc_tx.c
+++ b/net/smc/smc_tx.c
@@ -495,7 +495,8 @@ out:
 
 void smc_tx_consumer_update(struct smc_connection *conn, bool force)
 {
-        union smc_host_cursor cfed, cons;
+        union smc_host_cursor cfed, cons, prod;
+        int sender_free = conn->rmb_desc->len;
         int to_confirm;
 
         smc_curs_write(&cons,
@@ -505,11 +506,18 @@ void smc_tx_consumer_update(struct smc_connection *conn, bool force)
                        smc_curs_read(&conn->rx_curs_confirmed, conn),
                        conn);
         to_confirm = smc_curs_diff(conn->rmb_desc->len, &cfed, &cons);
+        if (to_confirm > conn->rmbe_update_limit) {
+                smc_curs_write(&prod,
+                               smc_curs_read(&conn->local_rx_ctrl.prod, conn),
+                               conn);
+                sender_free = conn->rmb_desc->len -
+                              smc_curs_diff(conn->rmb_desc->len, &prod, &cfed);
+        }
 
         if (conn->local_rx_ctrl.prod_flags.cons_curs_upd_req ||
             force ||
             ((to_confirm > conn->rmbe_update_limit) &&
-             ((to_confirm > (conn->rmb_desc->len / 2)) ||
+             ((sender_free <= (conn->rmb_desc->len / 2)) ||
               conn->local_rx_ctrl.prod_flags.write_blocked))) {
                 if ((smc_cdc_get_slot_and_msg_send(conn) < 0) &&
                     conn->alert_token_local) { /* connection healthy */
diff --git a/net/socket.c b/net/socket.c
index 85633622c94d..8c24d5dc4bc8 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -89,6 +89,7 @@
 #include <linux/magic.h>
 #include <linux/slab.h>
 #include <linux/xattr.h>
+#include <linux/nospec.h>
 
 #include <linux/uaccess.h>
 #include <asm/unistd.h>
@@ -2522,6 +2523,7 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
 
         if (call < 1 || call > SYS_SENDMMSG)
                 return -EINVAL;
+        call = array_index_nospec(call, SYS_SENDMMSG + 1);
 
         len = nargs[call];
         if (len > sizeof(a))
@@ -2688,7 +2690,8 @@ EXPORT_SYMBOL(sock_unregister);
 
 bool sock_is_registered(int family)
 {
-        return family < NPROTO && rcu_access_pointer(net_families[family]);
+        return family < NPROTO &&
+                rcu_access_pointer(net_families[array_index_nospec(family, NPROTO)]);
 }
 
 static int __init sock_init(void)
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index 9f666e0650e2..2830709957bd 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -133,6 +133,8 @@ static void disc_dupl_alert(struct tipc_bearer *b, u32 node_addr,
 }
 
 /* tipc_disc_addr_trial(): - handle an address uniqueness trial from peer
+ * Returns true if message should be dropped by caller, i.e., if it is a
+ * trial message or we are inside trial period. Otherwise false.
  */
 static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d,
                                      struct tipc_media_addr *maddr,
@@ -168,8 +170,9 @@ static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d,
                 msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
         }
 
+        /* Accept regular link requests/responses only after trial period */
         if (mtyp != DSC_TRIAL_MSG)
-                return false;
+                return trial;
 
         sugg_addr = tipc_node_try_addr(net, peer_id, src);
         if (sugg_addr)
@@ -284,7 +287,6 @@ static void tipc_disc_timeout(struct timer_list *t)
 {
         struct tipc_discoverer *d = from_timer(d, t, timer);
         struct tipc_net *tn = tipc_net(d->net);
-        u32 self = tipc_own_addr(d->net);
         struct tipc_media_addr maddr;
         struct sk_buff *skb = NULL;
         struct net *net = d->net;
@@ -298,12 +300,14 @@ static void tipc_disc_timeout(struct timer_list *t)
                 goto exit;
         }
 
-        /* Did we just leave the address trial period ? */
-        if (!self && !time_before(jiffies, tn->addr_trial_end)) {
-                self = tn->trial_addr;
-                tipc_net_finalize(net, self);
-                msg_set_prevnode(buf_msg(d->skb), self);
+        /* Trial period over ? */
+        if (!time_before(jiffies, tn->addr_trial_end)) {
+                /* Did we just leave it ? */
+                if (!tipc_own_addr(net))
+                        tipc_net_finalize(net, tn->trial_addr);
+
                 msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
+                msg_set_prevnode(buf_msg(d->skb), tipc_own_addr(net));
         }
 
         /* Adjust timeout interval according to discovery phase */
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 4fbaa0464405..a7f6964c3a4b 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -121,12 +121,17 @@ int tipc_net_init(struct net *net, u8 *node_id, u32 addr)
 
 void tipc_net_finalize(struct net *net, u32 addr)
 {
-        tipc_set_node_addr(net, addr);
-        smp_mb();
-        tipc_named_reinit(net);
-        tipc_sk_reinit(net);
-        tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
-                             TIPC_CLUSTER_SCOPE, 0, addr);
+        struct tipc_net *tn = tipc_net(net);
+
+        spin_lock_bh(&tn->node_list_lock);
+        if (!tipc_own_addr(net)) {
+                tipc_set_node_addr(net, addr);
+                tipc_named_reinit(net);
+                tipc_sk_reinit(net);
+                tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
+                                     TIPC_CLUSTER_SCOPE, 0, addr);
+        }
+        spin_unlock_bh(&tn->node_list_lock);
 }
 
 void tipc_net_stop(struct net *net)
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 6a44eb812baf..0453bd451ce8 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -797,6 +797,7 @@ static u32 tipc_node_suggest_addr(struct net *net, u32 addr)
 }
 
 /* tipc_node_try_addr(): Check if addr can be used by peer, suggest other if not
+ * Returns suggested address if any, otherwise 0
  */
 u32 tipc_node_try_addr(struct net *net, u8 *id, u32 addr)
 {
@@ -819,12 +820,14 @@ u32 tipc_node_try_addr(struct net *net, u8 *id, u32 addr)
         if (n) {
                 addr = n->addr;
                 tipc_node_put(n);
+                return addr;
         }
-        /* Even this node may be in trial phase */
+
+        /* Even this node may be in conflict */
         if (tn->trial_addr == addr)
                 return tipc_node_suggest_addr(net, addr);
 
-        return addr;
+        return 0;
 }
 
 void tipc_node_check_dest(struct net *net, u32 addr,
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index d2380548f8f6..1f3d9789af30 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -440,7 +440,7 @@ alloc_encrypted:
                         ret = tls_push_record(sk, msg->msg_flags, record_type);
                         if (!ret)
                                 continue;
-                        if (ret == -EAGAIN)
+                        if (ret < 0)
                                 goto send_end;
 
                         copied -= try_to_copy;
@@ -646,6 +646,9 @@ static struct sk_buff *tls_wait_data(struct sock *sk, int flags,
                         return NULL;
                 }
 
+                if (sk->sk_shutdown & RCV_SHUTDOWN)
+                        return NULL;
+
                 if (sock_flag(sk, SOCK_DONE))
                         return NULL;
 
@@ -701,6 +704,10 @@ static int decrypt_skb(struct sock *sk, struct sk_buff *skb,
         nsg = skb_to_sgvec(skb, &sgin[1],
                            rxm->offset + tls_ctx->rx.prepend_size,
                            rxm->full_len - tls_ctx->rx.prepend_size);
+        if (nsg < 0) {
+                ret = nsg;
+                goto out;
+        }
 
         tls_make_aad(ctx->rx_aad_ciphertext,
                      rxm->full_len - tls_ctx->rx.overhead_size,
@@ -712,6 +719,7 @@ static int decrypt_skb(struct sock *sk, struct sk_buff *skb,
                                 rxm->full_len - tls_ctx->rx.overhead_size,
                                 skb, sk->sk_allocation);
 
+out:
         if (sgin != &sgin_arr[0])
                 kfree(sgin);
 
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 4eece06be1e7..80bc986c79e5 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4409,6 +4409,7 @@ static int parse_station_flags(struct genl_info *info,
                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
                                          BIT(NL80211_STA_FLAG_MFP) |
                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
+                break;
         default:
                 return -EINVAL;
         }
@@ -14923,20 +14924,24 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
 
 static int __nl80211_rx_control_port(struct net_device *dev,
-                                     const u8 *buf, size_t len,
-                                     const u8 *addr, u16 proto,
+                                     struct sk_buff *skb,
                                      bool unencrypted, gfp_t gfp)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
+        struct ethhdr *ehdr = eth_hdr(skb);
+        const u8 *addr = ehdr->h_source;
+        u16 proto = be16_to_cpu(skb->protocol);
         struct sk_buff *msg;
         void *hdr;
+        struct nlattr *frame;
+
         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
 
         if (!nlportid)
                 return -ENOENT;
 
-        msg = nlmsg_new(100 + len, gfp);
+        msg = nlmsg_new(100 + skb->len, gfp);
         if (!msg)
                 return -ENOMEM;
 
@@ -14950,13 +14955,17 @@ static int __nl80211_rx_control_port(struct net_device *dev,
             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
                               NL80211_ATTR_PAD) ||
-            nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
             (unencrypted && nla_put_flag(msg,
                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
                 goto nla_put_failure;
 
+        frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
+        if (!frame)
+                goto nla_put_failure;
+
+        skb_copy_bits(skb, 0, nla_data(frame), skb->len);
         genlmsg_end(msg, hdr);
 
         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
@@ -14967,14 +14976,12 @@ static int __nl80211_rx_control_port(struct net_device *dev,
 }
 
 bool cfg80211_rx_control_port(struct net_device *dev,
-                              const u8 *buf, size_t len,
-                              const u8 *addr, u16 proto, bool unencrypted)
+                              struct sk_buff *skb, bool unencrypted)
 {
         int ret;
 
-        trace_cfg80211_rx_control_port(dev, buf, len, addr, proto, unencrypted);
-        ret = __nl80211_rx_control_port(dev, buf, len, addr, proto,
-                                        unencrypted, GFP_ATOMIC);
+        trace_cfg80211_rx_control_port(dev, skb, unencrypted);
+        ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
         trace_cfg80211_return_bool(ret == 0);
         return ret == 0;
 }
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index bbe6298e4bb9..4fc66a117b7d 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2240,7 +2240,9 @@ static void wiphy_update_regulatory(struct wiphy *wiphy,
                  * as some drivers used this to restore its orig_* reg domain.
                  */
                 if (initiator == NL80211_REGDOM_SET_BY_CORE &&
-                    wiphy->regulatory_flags & REGULATORY_CUSTOM_REG)
+                    wiphy->regulatory_flags & REGULATORY_CUSTOM_REG &&
+                    !(wiphy->regulatory_flags &
+                      REGULATORY_WIPHY_SELF_MANAGED))
                         reg_call_notifier(wiphy, lr);
                 return;
         }
@@ -2787,26 +2789,6 @@ static void notify_self_managed_wiphys(struct regulatory_request *request)
         }
 }
 
-static bool reg_only_self_managed_wiphys(void)
-{
-        struct cfg80211_registered_device *rdev;
-        struct wiphy *wiphy;
-        bool self_managed_found = false;
-
-        ASSERT_RTNL();
-
-        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
-                wiphy = &rdev->wiphy;
-                if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED)
-                        self_managed_found = true;
-                else
-                        return false;
-        }
-
-        /* make sure at least one self-managed wiphy exists */
-        return self_managed_found;
-}
-
 /*
  * Processes regulatory hints, this is all the NL80211_REGDOM_SET_BY_*
  * Regulatory hints come on a first come first serve basis and we
@@ -2839,10 +2821,6 @@ static void reg_process_pending_hints(void)
         spin_unlock(&reg_requests_lock);
 
         notify_self_managed_wiphys(reg_request);
-        if (reg_only_self_managed_wiphys()) {
-                reg_free_request(reg_request);
-                return;
-        }
 
         reg_process_hint(reg_request);
 
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index 2b417a2fe63f..7c73510b161f 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -2627,23 +2627,25 @@ TRACE_EVENT(cfg80211_mgmt_tx_status,
 );
 
 TRACE_EVENT(cfg80211_rx_control_port,
-        TP_PROTO(struct net_device *netdev, const u8 *buf, size_t len,
-                 const u8 *addr, u16 proto, bool unencrypted),
-        TP_ARGS(netdev, buf, len, addr, proto, unencrypted),
+        TP_PROTO(struct net_device *netdev, struct sk_buff *skb,
+                 bool unencrypted),
+        TP_ARGS(netdev, skb, unencrypted),
         TP_STRUCT__entry(
                 NETDEV_ENTRY
-                MAC_ENTRY(addr)
+                __field(int, len)
+                MAC_ENTRY(from)
                 __field(u16, proto)
                 __field(bool, unencrypted)
         ),
         TP_fast_assign(
                 NETDEV_ASSIGN;
-                MAC_ASSIGN(addr, addr);
-                __entry->proto = proto;
+                __entry->len = skb->len;
+                MAC_ASSIGN(from, eth_hdr(skb)->h_source);
+                __entry->proto = be16_to_cpu(skb->protocol);
                 __entry->unencrypted = unencrypted;
         ),
-        TP_printk(NETDEV_PR_FMT ", " MAC_PR_FMT " proto: 0x%x, unencrypted: %s",
-                  NETDEV_PR_ARG, MAC_PR_ARG(addr),
+        TP_printk(NETDEV_PR_FMT ", len=%d, " MAC_PR_FMT ", proto: 0x%x, unencrypted: %s",
+                  NETDEV_PR_ARG, __entry->len, MAC_PR_ARG(from),
                   __entry->proto, BOOL_TO_STR(__entry->unencrypted))
 );
 
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 59fb7d3c36a3..4e937cd7c17d 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -84,10 +84,8 @@ static int __xsk_rcv_zc(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len)
 {
         int err = xskq_produce_batch_desc(xs->rx, (u64)xdp->handle, len);
 
-        if (err) {
-                xdp_return_buff(xdp);
+        if (err)
                 xs->rx_dropped++;
-        }
 
         return err;
 }
@@ -199,8 +197,11 @@ static void xsk_destruct_skb(struct sk_buff *skb)
 {
         u64 addr = (u64)(long)skb_shinfo(skb)->destructor_arg;
         struct xdp_sock *xs = xdp_sk(skb->sk);
+        unsigned long flags;
 
+        spin_lock_irqsave(&xs->tx_completion_lock, flags);
         WARN_ON_ONCE(xskq_produce_addr(xs->umem->cq, addr));
+        spin_unlock_irqrestore(&xs->tx_completion_lock, flags);
 
         sock_wfree(skb);
 }
@@ -215,9 +216,6 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
         struct sk_buff *skb;
         int err = 0;
 
-        if (unlikely(!xs->tx))
-                return -ENOBUFS;
-
         mutex_lock(&xs->mutex);
 
         while (xskq_peek_desc(xs->tx, &desc)) {
@@ -230,22 +228,13 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
                         goto out;
                 }
 
-                if (xskq_reserve_addr(xs->umem->cq)) {
-                        err = -EAGAIN;
+                if (xskq_reserve_addr(xs->umem->cq))
                         goto out;
-                }
 
-                len = desc.len;
-                if (unlikely(len > xs->dev->mtu)) {
-                        err = -EMSGSIZE;
+                if (xs->queue_id >= xs->dev->real_num_tx_queues)
                         goto out;
-                }
-
-                if (xs->queue_id >= xs->dev->real_num_tx_queues) {
-                        err = -ENXIO;
-                        goto out;
-                }
 
+                len = desc.len;
                 skb = sock_alloc_send_skb(sk, len, 1, &err);
                 if (unlikely(!skb)) {
                         err = -EAGAIN;
@@ -268,15 +257,15 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
                 skb->destructor = xsk_destruct_skb;
 
                 err = dev_direct_xmit(skb, xs->queue_id);
+                xskq_discard_desc(xs->tx);
                 /* Ignore NET_XMIT_CN as packet might have been sent */
                 if (err == NET_XMIT_DROP || err == NETDEV_TX_BUSY) {
-                        err = -EAGAIN;
-                        /* SKB consumed by dev_direct_xmit() */
+                        /* SKB completed but not sent */
+                        err = -EBUSY;
                         goto out;
                 }
 
                 sent_frame = true;
-                xskq_discard_desc(xs->tx);
         }
 
 out:
@@ -297,6 +286,8 @@ static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
                 return -ENXIO;
         if (unlikely(!(xs->dev->flags & IFF_UP)))
                 return -ENETDOWN;
+        if (unlikely(!xs->tx))
+                return -ENOBUFS;
         if (need_wait)
                 return -EOPNOTSUPP;
 
@@ -755,6 +746,7 @@ static int xsk_create(struct net *net, struct socket *sock, int protocol,
 
         xs = xdp_sk(sk);
         mutex_init(&xs->mutex);
+        spin_lock_init(&xs->tx_completion_lock);
 
         local_bh_disable();
         sock_prot_inuse_add(net, &xsk_proto, 1);
diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
index ef6a6f0ec949..8a64b150be54 100644
--- a/net/xdp/xsk_queue.h
+++ b/net/xdp/xsk_queue.h
@@ -62,14 +62,9 @@ static inline u32 xskq_nb_avail(struct xsk_queue *q, u32 dcnt)
         return (entries > dcnt) ? dcnt : entries;
 }
 
-static inline u32 xskq_nb_free_lazy(struct xsk_queue *q, u32 producer)
-{
-        return q->nentries - (producer - q->cons_tail);
-}
-
 static inline u32 xskq_nb_free(struct xsk_queue *q, u32 producer, u32 dcnt)
 {
-        u32 free_entries = xskq_nb_free_lazy(q, producer);
+        u32 free_entries = q->nentries - (producer - q->cons_tail);
 
         if (free_entries >= dcnt)
                 return free_entries;
@@ -129,7 +124,7 @@ static inline int xskq_produce_addr(struct xsk_queue *q, u64 addr)
 {
         struct xdp_umem_ring *ring = (struct xdp_umem_ring *)q->ring;
 
-        if (xskq_nb_free(q, q->prod_tail, LAZY_UPDATE_THRESHOLD) == 0)
+        if (xskq_nb_free(q, q->prod_tail, 1) == 0)
                 return -ENOSPC;
 
         ring->desc[q->prod_tail++ & q->ring_mask] = addr;
@@ -255,7 +250,7 @@ static inline bool xskq_full_desc(struct xsk_queue *q)
 
 static inline bool xskq_empty_desc(struct xsk_queue *q)
 {
-        return xskq_nb_free(q, q->prod_tail, 1) == q->nentries;
+        return xskq_nb_free(q, q->prod_tail, q->nentries) == q->nentries;
 }
 
 void xskq_set_umem(struct xsk_queue *q, struct xdp_umem_props *umem_props);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 5f48251c1319..7c5e8978aeaa 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2286,6 +2286,9 @@ struct dst_entry *xfrm_lookup_route(struct net *net, struct dst_entry *dst_orig,
         if (IS_ERR(dst) && PTR_ERR(dst) == -EREMOTE)
                 return make_blackhole(net, dst_orig->ops->family, dst_orig);
 
+        if (IS_ERR(dst))
+                dst_release(dst_orig);
+
         return dst;
 }
 EXPORT_SYMBOL(xfrm_lookup_route);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 080035f056d9..33878e6e0d0a 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1025,10 +1025,12 @@ static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb,
 {
         struct sock *nlsk = rcu_dereference(net->xfrm.nlsk);
 
-        if (nlsk)
-                return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC);
-        else
-                return -1;
+        if (!nlsk) {
+                kfree_skb(skb);
+                return -EPIPE;
+        }
+
+        return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC);
 }
 
 static inline unsigned int xfrm_spdinfo_msgsize(void)
@@ -1671,9 +1673,11 @@ static inline unsigned int userpolicy_type_attrsize(void)
 #ifdef CONFIG_XFRM_SUB_POLICY
 static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
 {
-        struct xfrm_userpolicy_type upt = {
-                .type = type,
-        };
+        struct xfrm_userpolicy_type upt;
+
+        /* Sadly there are two holes in struct xfrm_userpolicy_type */
+        memset(&upt, 0, sizeof(upt));
+        upt.type = type;
 
         return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
 }
diff --git a/samples/bpf/.gitignore b/samples/bpf/.gitignore
new file mode 100644
index 000000000000..8ae4940025f8
--- /dev/null
+++ b/samples/bpf/.gitignore
@@ -0,0 +1,49 @@
+cpustat
+fds_example
+lathist
+load_sock_ops
+lwt_len_hist
+map_perf_test
+offwaketime
+per_socket_stats_example
+sampleip
+sock_example
+sockex1
+sockex2
+sockex3
+spintest
+syscall_nrs.h
+syscall_tp
+task_fd_query
+tc_l2_redirect
+test_cgrp2_array_pin
+test_cgrp2_attach
+test_cgrp2_attach2
+test_cgrp2_sock
+test_cgrp2_sock2
+test_current_task_under_cgroup
+test_lru_dist
+test_map_in_map
+test_overhead
+test_probe_write_user
+trace_event
+trace_output
+tracex1
+tracex2
+tracex3
+tracex4
+tracex5
+tracex6
+tracex7
+xdp1
+xdp2
+xdp_adjust_tail
+xdp_fwd
+xdp_monitor
+xdp_redirect
+xdp_redirect_cpu
+xdp_redirect_map
+xdp_router_ipv4
+xdp_rxq_info
+xdp_tx_iptunnel
+xdpsock
diff --git a/samples/bpf/parse_varlen.c b/samples/bpf/parse_varlen.c
index 95c16324760c..0b6f22feb2c9 100644
--- a/samples/bpf/parse_varlen.c
+++ b/samples/bpf/parse_varlen.c
@@ -6,6 +6,7 @@
  */
 #define KBUILD_MODNAME "foo"
 #include <linux/if_ether.h>
+#include <linux/if_vlan.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/in.h>
@@ -108,11 +109,6 @@ static int parse_ipv6(void *data, uint64_t nh_off, void *data_end)
         return 0;
 }
 
-struct vlan_hdr {
-        uint16_t h_vlan_TCI;
-        uint16_t h_vlan_encapsulated_proto;
-};
-
 SEC("varlen")
 int handle_ingress(struct __sk_buff *skb)
 {
diff --git a/samples/bpf/test_overhead_user.c b/samples/bpf/test_overhead_user.c
index 6caf47afa635..9d6dcaa9db92 100644
--- a/samples/bpf/test_overhead_user.c
+++ b/samples/bpf/test_overhead_user.c
@@ -6,6 +6,7 @@
  */
 #define _GNU_SOURCE
 #include <sched.h>
+#include <errno.h>
 #include <stdio.h>
 #include <sys/types.h>
 #include <asm/unistd.h>
@@ -44,8 +45,13 @@ static void test_task_rename(int cpu)
                 exit(1);
         }
         start_time = time_get_ns();
-        for (i = 0; i < MAX_CNT; i++)
-                write(fd, buf, sizeof(buf));
+        for (i = 0; i < MAX_CNT; i++) {
+                if (write(fd, buf, sizeof(buf)) < 0) {
+                        printf("task rename failed: %s\n", strerror(errno));
+                        close(fd);
+                        return;
+                }
+        }
         printf("task_rename:%d: %lld events per sec\n",
                cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time));
         close(fd);
@@ -63,8 +69,13 @@ static void test_urandom_read(int cpu)
                 exit(1);
         }
         start_time = time_get_ns();
-        for (i = 0; i < MAX_CNT; i++)
-                read(fd, buf, sizeof(buf));
+        for (i = 0; i < MAX_CNT; i++) {
+                if (read(fd, buf, sizeof(buf)) < 0) {
+                        printf("failed to read from /dev/urandom: %s\n", strerror(errno));
+                        close(fd);
+                        return;
+                }
+        }
         printf("urandom_read:%d: %lld events per sec\n",
                cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time));
         close(fd);
diff --git a/samples/bpf/trace_event_user.c b/samples/bpf/trace_event_user.c
index 1fa1becfa641..d08046ab81f0 100644
--- a/samples/bpf/trace_event_user.c
+++ b/samples/bpf/trace_event_user.c
@@ -122,6 +122,16 @@ static void print_stacks(void)
         }
 }
 
+static inline int generate_load(void)
+{
+        if (system("dd if=/dev/zero of=/dev/null count=5000k status=none") < 0) {
+                printf("failed to generate some load with dd: %s\n", strerror(errno));
+                return -1;
+        }
+
+        return 0;
+}
+
 static void test_perf_event_all_cpu(struct perf_event_attr *attr)
 {
         int nr_cpus = sysconf(_SC_NPROCESSORS_CONF);
@@ -142,7 +152,11 @@ static void test_perf_event_all_cpu(struct perf_event_attr *attr)
                 assert(ioctl(pmu_fd[i], PERF_EVENT_IOC_SET_BPF, prog_fd[0]) == 0);
                 assert(ioctl(pmu_fd[i], PERF_EVENT_IOC_ENABLE) == 0);
         }
-        system("dd if=/dev/zero of=/dev/null count=5000k status=none");
+
+        if (generate_load() < 0) {
+                error = 1;
+                goto all_cpu_err;
+        }
         print_stacks();
 all_cpu_err:
         for (i--; i >= 0; i--) {
@@ -156,7 +170,7 @@ all_cpu_err:
 
 static void test_perf_event_task(struct perf_event_attr *attr)
 {
-        int pmu_fd;
+        int pmu_fd, error = 0;
 
         /* per task perf event, enable inherit so the "dd ..." command can be traced properly.
          * Enabling inherit will cause bpf_perf_prog_read_time helper failure.
@@ -171,10 +185,17 @@ static void test_perf_event_task(struct perf_event_attr *attr)
         }
         assert(ioctl(pmu_fd, PERF_EVENT_IOC_SET_BPF, prog_fd[0]) == 0);
         assert(ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE) == 0);
-        system("dd if=/dev/zero of=/dev/null count=5000k status=none");
+
+        if (generate_load() < 0) {
+                error = 1;
+                goto err;
+        }
         print_stacks();
+err:
         ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
         close(pmu_fd);
+        if (error)
+                int_exit(0);
 }
 
 static void test_bpf_perf_event(void)
diff --git a/samples/bpf/xdp2skb_meta.sh b/samples/bpf/xdp2skb_meta.sh
index b9c9549c4c27..4bde9d066c46 100755
--- a/samples/bpf/xdp2skb_meta.sh
+++ b/samples/bpf/xdp2skb_meta.sh
@@ -16,8 +16,8 @@
 BPF_FILE=xdp2skb_meta_kern.o
 DIR=$(dirname $0)
 
-export TC=/usr/sbin/tc
-export IP=/usr/sbin/ip
+[ -z "$TC" ] && TC=tc
+[ -z "$IP" ] && IP=ip
 
 function usage() {
     echo ""
@@ -53,7 +53,7 @@ function _call_cmd() {
     local allow_fail="$2"
     shift 2
     if [[ -n "$VERBOSE" ]]; then
-        echo "$(basename $cmd) $@"
+        echo "$cmd $@"
     fi
     if [[ -n "$DRYRUN" ]]; then
         return
diff --git a/samples/bpf/xdpsock_user.c b/samples/bpf/xdpsock_user.c
index d69c8d78d3fd..5904b1543831 100644
--- a/samples/bpf/xdpsock_user.c
+++ b/samples/bpf/xdpsock_user.c
@@ -729,7 +729,7 @@ static void kick_tx(int fd)
         int ret;
 
         ret = sendto(fd, NULL, 0, MSG_DONTWAIT, NULL, 0);
-        if (ret >= 0 || errno == ENOBUFS || errno == EAGAIN)
+        if (ret >= 0 || errno == ENOBUFS || errno == EAGAIN || errno == EBUSY)
                 return;
         lassert(0);
 }
diff --git a/scripts/tags.sh b/scripts/tags.sh
index 412a70cce558..26de7d5aa5c8 100755
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -152,6 +152,7 @@ regex_asm=(
 )
 regex_c=(
         '/^SYSCALL_DEFINE[0-9](\([[:alnum:]_]*\).*/sys_\1/'
+        '/^BPF_CALL_[0-9](\([[:alnum:]_]*\).*/\1/'
         '/^COMPAT_SYSCALL_DEFINE[0-9](\([[:alnum:]_]*\).*/compat_sys_\1/'
         '/^TRACE_EVENT(\([[:alnum:]_]*\).*/trace_\1/'
         '/^TRACE_EVENT(\([[:alnum:]_]*\).*/trace_\1_rcuidle/'
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index 69616d00481c..b53026a72e73 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -635,7 +635,7 @@ static int snd_rawmidi_info_select_user(struct snd_card *card,
 int snd_rawmidi_output_params(struct snd_rawmidi_substream *substream,
                               struct snd_rawmidi_params * params)
 {
-        char *newbuf;
+        char *newbuf, *oldbuf;
         struct snd_rawmidi_runtime *runtime = substream->runtime;
         
         if (substream->append && substream->use_count > 1)
@@ -648,13 +648,17 @@ int snd_rawmidi_output_params(struct snd_rawmidi_substream *substream,
                 return -EINVAL;
         }
         if (params->buffer_size != runtime->buffer_size) {
-                newbuf = krealloc(runtime->buffer, params->buffer_size,
-                                  GFP_KERNEL);
+                newbuf = kmalloc(params->buffer_size, GFP_KERNEL);
                 if (!newbuf)
                         return -ENOMEM;
+                spin_lock_irq(&runtime->lock);
+                oldbuf = runtime->buffer;
                 runtime->buffer = newbuf;
                 runtime->buffer_size = params->buffer_size;
                 runtime->avail = runtime->buffer_size;
+                runtime->appl_ptr = runtime->hw_ptr = 0;
+                spin_unlock_irq(&runtime->lock);
+                kfree(oldbuf);
         }
         runtime->avail_min = params->avail_min;
         substream->active_sensing = !params->no_active_sensing;
@@ -665,7 +669,7 @@ EXPORT_SYMBOL(snd_rawmidi_output_params);
 int snd_rawmidi_input_params(struct snd_rawmidi_substream *substream,
                              struct snd_rawmidi_params * params)
 {
-        char *newbuf;
+        char *newbuf, *oldbuf;
         struct snd_rawmidi_runtime *runtime = substream->runtime;
 
         snd_rawmidi_drain_input(substream);
@@ -676,12 +680,16 @@ int snd_rawmidi_input_params(struct snd_rawmidi_substream *substream,
                 return -EINVAL;
         }
         if (params->buffer_size != runtime->buffer_size) {
-                newbuf = krealloc(runtime->buffer, params->buffer_size,
-                                  GFP_KERNEL);
+                newbuf = kmalloc(params->buffer_size, GFP_KERNEL);
                 if (!newbuf)
                         return -ENOMEM;
+                spin_lock_irq(&runtime->lock);
+                oldbuf = runtime->buffer;
                 runtime->buffer = newbuf;
                 runtime->buffer_size = params->buffer_size;
+                runtime->appl_ptr = runtime->hw_ptr = 0;
+                spin_unlock_irq(&runtime->lock);
+                kfree(oldbuf);
         }
         runtime->avail_min = params->avail_min;
         return 0;
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index e7fcfc3b8885..f641c20095f7 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -964,6 +964,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
         SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC),
         SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
         SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO),
+        SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO),
         SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE),
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 7496be4491b1..f6af3e1c2b93 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2366,6 +2366,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
         SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
         SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
+        SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950),
         SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950),
         SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
         SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
@@ -6569,6 +6570,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC),
         SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
         SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE),
+        SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE),
         SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
         SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
         SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
diff --git a/tools/arch/powerpc/include/uapi/asm/unistd.h b/tools/arch/powerpc/include/uapi/asm/unistd.h
index ac5ba55066dd..985534d0b448 100644
--- a/tools/arch/powerpc/include/uapi/asm/unistd.h
+++ b/tools/arch/powerpc/include/uapi/asm/unistd.h
@@ -399,5 +399,6 @@
 #define __NR_pkey_free          385
 #define __NR_pkey_mprotect      386
 #define __NR_rseq               387
+#define __NR_io_pgetevents      388
 
 #endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/tools/arch/x86/include/asm/mcsafe_test.h b/tools/arch/x86/include/asm/mcsafe_test.h
new file mode 100644
index 000000000000..2ccd588fbad4
--- /dev/null
+++ b/tools/arch/x86/include/asm/mcsafe_test.h
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _MCSAFE_TEST_H_
+#define _MCSAFE_TEST_H_
+
+.macro MCSAFE_TEST_CTL
+.endm
+
+.macro MCSAFE_TEST_SRC reg count target
+.endm
+
+.macro MCSAFE_TEST_DST reg count target
+.endm
+#endif /* _MCSAFE_TEST_H_ */
diff --git a/tools/arch/x86/lib/memcpy_64.S b/tools/arch/x86/lib/memcpy_64.S
index 9a53a06e5a3e..298ef1479240 100644
--- a/tools/arch/x86/lib/memcpy_64.S
+++ b/tools/arch/x86/lib/memcpy_64.S
@@ -3,6 +3,7 @@
 #include <linux/linkage.h>
 #include <asm/errno.h>
 #include <asm/cpufeatures.h>
+#include <asm/mcsafe_test.h>
 #include <asm/alternative-asm.h>
 #include <asm/export.h>
 
@@ -183,12 +184,15 @@ ENTRY(memcpy_orig)
 ENDPROC(memcpy_orig)
 
 #ifndef CONFIG_UML
+
+MCSAFE_TEST_CTL
+
 /*
- * memcpy_mcsafe_unrolled - memory copy with machine check exception handling
+ * __memcpy_mcsafe - memory copy with machine check exception handling
  * Note that we only catch machine checks when reading the source addresses.
  * Writes to target are posted and don't generate machine checks.
  */
-ENTRY(memcpy_mcsafe_unrolled)
+ENTRY(__memcpy_mcsafe)
         cmpl $8, %edx
         /* Less than 8 bytes? Go to byte copy loop */
         jb .L_no_whole_words
@@ -204,58 +208,33 @@ ENTRY(memcpy_mcsafe_unrolled)
         subl $8, %ecx
         negl %ecx
         subl %ecx, %edx
-.L_copy_leading_bytes:
+.L_read_leading_bytes:
         movb (%rsi), %al
+        MCSAFE_TEST_SRC %rsi 1 .E_leading_bytes
+        MCSAFE_TEST_DST %rdi 1 .E_leading_bytes
+.L_write_leading_bytes:
         movb %al, (%rdi)
         incq %rsi
         incq %rdi
         decl %ecx
-        jnz .L_copy_leading_bytes
+        jnz .L_read_leading_bytes
 
 .L_8byte_aligned:
-        /* Figure out how many whole cache lines (64-bytes) to copy */
-        movl %edx, %ecx
-        andl $63, %edx
-        shrl $6, %ecx
-        jz .L_no_whole_cache_lines
-
-        /* Loop copying whole cache lines */
-.L_cache_w0: movq (%rsi), %r8
-.L_cache_w1: movq 1*8(%rsi), %r9
-.L_cache_w2: movq 2*8(%rsi), %r10
-.L_cache_w3: movq 3*8(%rsi), %r11
-        movq %r8, (%rdi)
-        movq %r9, 1*8(%rdi)
-        movq %r10, 2*8(%rdi)
-        movq %r11, 3*8(%rdi)
-.L_cache_w4: movq 4*8(%rsi), %r8
-.L_cache_w5: movq 5*8(%rsi), %r9
-.L_cache_w6: movq 6*8(%rsi), %r10
-.L_cache_w7: movq 7*8(%rsi), %r11
-        movq %r8, 4*8(%rdi)
-        movq %r9, 5*8(%rdi)
-        movq %r10, 6*8(%rdi)
-        movq %r11, 7*8(%rdi)
-        leaq 64(%rsi), %rsi
-        leaq 64(%rdi), %rdi
-        decl %ecx
-        jnz .L_cache_w0
-
-        /* Are there any trailing 8-byte words? */
-.L_no_whole_cache_lines:
         movl %edx, %ecx
         andl $7, %edx
         shrl $3, %ecx
         jz .L_no_whole_words
 
-        /* Copy trailing words */
-.L_copy_trailing_words:
+.L_read_words:
         movq (%rsi), %r8
-        mov %r8, (%rdi)
-        leaq 8(%rsi), %rsi
-        leaq 8(%rdi), %rdi
+        MCSAFE_TEST_SRC %rsi 8 .E_read_words
+        MCSAFE_TEST_DST %rdi 8 .E_write_words
+.L_write_words:
+        movq %r8, (%rdi)
+        addq $8, %rsi
+        addq $8, %rdi
         decl %ecx
-        jnz .L_copy_trailing_words
+        jnz .L_read_words
 
         /* Any trailing bytes? */
 .L_no_whole_words:
@@ -264,38 +243,55 @@ ENTRY(memcpy_mcsafe_unrolled)
 
         /* Copy trailing bytes */
         movl %edx, %ecx
-.L_copy_trailing_bytes:
+.L_read_trailing_bytes:
         movb (%rsi), %al
+        MCSAFE_TEST_SRC %rsi 1 .E_trailing_bytes
+        MCSAFE_TEST_DST %rdi 1 .E_trailing_bytes
+.L_write_trailing_bytes:
         movb %al, (%rdi)
         incq %rsi
         incq %rdi
         decl %ecx
-        jnz .L_copy_trailing_bytes
+        jnz .L_read_trailing_bytes
 
         /* Copy successful. Return zero */
 .L_done_memcpy_trap:
         xorq %rax, %rax
         ret
-ENDPROC(memcpy_mcsafe_unrolled)
-EXPORT_SYMBOL_GPL(memcpy_mcsafe_unrolled)
+ENDPROC(__memcpy_mcsafe)
+EXPORT_SYMBOL_GPL(__memcpy_mcsafe)
 
         .section .fixup, "ax"
-        /* Return -EFAULT for any failure */
-.L_memcpy_mcsafe_fail:
-        mov     $-EFAULT, %rax
+        /*
+         * Return number of bytes not copied for any failure. Note that
+         * there is no "tail" handling since the source buffer is 8-byte
+         * aligned and poison is cacheline aligned.
+         */
+.E_read_words:
+        shll    $3, %ecx
+.E_leading_bytes:
+        addl    %edx, %ecx
+.E_trailing_bytes:
+        mov     %ecx, %eax
         ret
 
+        /*
+         * For write fault handling, given the destination is unaligned,
+         * we handle faults on multi-byte writes with a byte-by-byte
+         * copy up to the write-protected page.
+         */
+.E_write_words:
+        shll    $3, %ecx
+        addl    %edx, %ecx
+        movl    %ecx, %edx
+        jmp mcsafe_handle_tail
+
         .previous
 
-        _ASM_EXTABLE_FAULT(.L_copy_leading_bytes, .L_memcpy_mcsafe_fail)
-        _ASM_EXTABLE_FAULT(.L_cache_w0, .L_memcpy_mcsafe_fail)
-        _ASM_EXTABLE_FAULT(.L_cache_w1, .L_memcpy_mcsafe_fail)
-        _ASM_EXTABLE_FAULT(.L_cache_w2, .L_memcpy_mcsafe_fail)
-        _ASM_EXTABLE_FAULT(.L_cache_w3, .L_memcpy_mcsafe_fail)
-        _ASM_EXTABLE_FAULT(.L_cache_w4, .L_memcpy_mcsafe_fail)
-        _ASM_EXTABLE_FAULT(.L_cache_w5, .L_memcpy_mcsafe_fail)
-        _ASM_EXTABLE_FAULT(.L_cache_w6, .L_memcpy_mcsafe_fail)
-        _ASM_EXTABLE_FAULT(.L_cache_w7, .L_memcpy_mcsafe_fail)
-        _ASM_EXTABLE_FAULT(.L_copy_trailing_words, .L_memcpy_mcsafe_fail)
-        _ASM_EXTABLE_FAULT(.L_copy_trailing_bytes, .L_memcpy_mcsafe_fail)
+        _ASM_EXTABLE_FAULT(.L_read_leading_bytes, .E_leading_bytes)
+        _ASM_EXTABLE_FAULT(.L_read_words, .E_read_words)
+        _ASM_EXTABLE_FAULT(.L_read_trailing_bytes, .E_trailing_bytes)
+        _ASM_EXTABLE(.L_write_leading_bytes, .E_leading_bytes)
+        _ASM_EXTABLE(.L_write_words, .E_write_words)
+        _ASM_EXTABLE(.L_write_trailing_bytes, .E_trailing_bytes)
 #endif
diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
index 32f9e397a6c0..3f140eff039f 100644
--- a/tools/bpf/bpftool/common.c
+++ b/tools/bpf/bpftool/common.c
@@ -217,6 +217,14 @@ int do_pin_any(int argc, char **argv, int (*get_fd_by_id)(__u32))
         int err;
         int fd;
 
+        if (argc < 3) {
+                p_err("too few arguments, id ID and FILE path is required");
+                return -1;
+        } else if (argc > 3) {
+                p_err("too many arguments");
+                return -1;
+        }
+
         if (!is_prefix(*argv, "id")) {
                 p_err("expected 'id' got %s", *argv);
                 return -1;
@@ -230,9 +238,6 @@ int do_pin_any(int argc, char **argv, int (*get_fd_by_id)(__u32))
         }
         NEXT_ARG();
 
-        if (argc != 1)
-                usage();
-
         fd = get_fd_by_id(id);
         if (fd < 0) {
                 p_err("can't get prog by id (%u): %s", id, strerror(errno));
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index 097b1a5e046b..f74a8bcbda87 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -36,6 +36,7 @@
 #include <assert.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <linux/kernel.h>
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -90,7 +91,8 @@ static bool map_is_map_of_progs(__u32 type)
 static void *alloc_value(struct bpf_map_info *info)
 {
         if (map_is_per_cpu(info->type))
-                return malloc(info->value_size * get_possible_cpus());
+                return malloc(round_up(info->value_size, 8) *
+                              get_possible_cpus());
         else
                 return malloc(info->value_size);
 }
@@ -161,9 +163,10 @@ static void print_entry_json(struct bpf_map_info *info, unsigned char *key,
                 jsonw_name(json_wtr, "value");
                 print_hex_data_json(value, info->value_size);
         } else {
-                unsigned int i, n;
+                unsigned int i, n, step;
 
                 n = get_possible_cpus();
+                step = round_up(info->value_size, 8);
 
                 jsonw_name(json_wtr, "key");
                 print_hex_data_json(key, info->key_size);
@@ -176,7 +179,7 @@ static void print_entry_json(struct bpf_map_info *info, unsigned char *key,
                         jsonw_int_field(json_wtr, "cpu", i);
 
                         jsonw_name(json_wtr, "value");
-                        print_hex_data_json(value + i * info->value_size,
+                        print_hex_data_json(value + i * step,
                                             info->value_size);
 
                         jsonw_end_object(json_wtr);
@@ -207,9 +210,10 @@ static void print_entry_plain(struct bpf_map_info *info, unsigned char *key,
 
                 printf("\n");
         } else {
-                unsigned int i, n;
+                unsigned int i, n, step;
 
                 n = get_possible_cpus();
+                step = round_up(info->value_size, 8);
 
                 printf("key:\n");
                 fprint_hex(stdout, key, info->key_size, " ");
@@ -217,7 +221,7 @@ static void print_entry_plain(struct bpf_map_info *info, unsigned char *key,
                 for (i = 0; i < n; i++) {
                         printf("value (CPU %02d):%c",
                                i, info->value_size > 16 ? '\n' : ' ');
-                        fprint_hex(stdout, value + i * info->value_size,
+                        fprint_hex(stdout, value + i * step,
                                    info->value_size, " ");
                         printf("\n");
                 }
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 59b19b6a40d7..b7db3261c62d 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -1857,7 +1857,8 @@ union bpf_attr {
  *              is resolved), the nexthop address is returned in ipv4_dst
  *              or ipv6_dst based on family, smac is set to mac address of
  *              egress device, dmac is set to nexthop mac address, rt_metric
- *              is set to metric from route (IPv4/IPv6 only).
+ *              is set to metric from route (IPv4/IPv6 only), and ifindex
+ *              is set to the device index of the nexthop from the FIB lookup.
  *
  *             *plen* argument is the size of the passed in struct.
  *             *flags* argument can be a combination of one or more of the
@@ -1873,9 +1874,10 @@ union bpf_attr {
  *             *ctx* is either **struct xdp_md** for XDP programs or
  *             **struct sk_buff** tc cls_act programs.
  *     Return
- *             Egress device index on success, 0 if packet needs to continue
- *             up the stack for further processing or a negative error in case
- *             of failure.
+ *              * < 0 if any input argument is invalid
+ *              *   0 on success (packet is forwarded, nexthop neighbor exists)
+ *              * > 0 one of **BPF_FIB_LKUP_RET_** codes explaining why the
+ *              *     packet is not forwarded or needs assist from full stack
  *
  * int bpf_sock_hash_update(struct bpf_sock_ops_kern *skops, struct bpf_map *map, void *key, u64 flags)
  *      Description
@@ -2612,6 +2614,18 @@ struct bpf_raw_tracepoint_args {
 #define BPF_FIB_LOOKUP_DIRECT  BIT(0)
 #define BPF_FIB_LOOKUP_OUTPUT  BIT(1)
 
+enum {
+        BPF_FIB_LKUP_RET_SUCCESS,      /* lookup successful */
+        BPF_FIB_LKUP_RET_BLACKHOLE,    /* dest is blackholed; can be dropped */
+        BPF_FIB_LKUP_RET_UNREACHABLE,  /* dest is unreachable; can be dropped */
+        BPF_FIB_LKUP_RET_PROHIBIT,     /* dest not allowed; can be dropped */
+        BPF_FIB_LKUP_RET_NOT_FWDED,    /* packet is not forwarded */
+        BPF_FIB_LKUP_RET_FWD_DISABLED, /* fwding is not enabled on ingress */
+        BPF_FIB_LKUP_RET_UNSUPP_LWT,   /* fwd requires encapsulation */
+        BPF_FIB_LKUP_RET_NO_NEIGH,     /* no neighbor entry for nh */
+        BPF_FIB_LKUP_RET_FRAG_NEEDED,  /* fragmentation required to fwd */
+};
+
 struct bpf_fib_lookup {
         /* input:  network family for lookup (AF_INET, AF_INET6)
          * output: network family of egress nexthop
@@ -2625,7 +2639,11 @@ struct bpf_fib_lookup {
 
         /* total length of packet from network header - used for MTU check */
         __u16   tot_len;
-        __u32   ifindex;  /* L3 device index for lookup */
+
+        /* input: L3 device index for lookup
+         * output: device index from FIB lookup
+         */
+        __u32   ifindex;
 
         union {
                 /* inputs to lookup */
diff --git a/tools/include/uapi/linux/btf.h b/tools/include/uapi/linux/btf.h
index 0b5ddbe135a4..972265f32871 100644
--- a/tools/include/uapi/linux/btf.h
+++ b/tools/include/uapi/linux/btf.h
@@ -76,7 +76,7 @@ struct btf_type {
  */
 #define BTF_INT_ENCODING(VAL)   (((VAL) & 0x0f000000) >> 24)
 #define BTF_INT_OFFSET(VAL)     (((VAL  & 0x00ff0000)) >> 16)
-#define BTF_INT_BITS(VAL)       ((VAL)  & 0x0000ffff)
+#define BTF_INT_BITS(VAL)       ((VAL)  & 0x000000ff)
 
 /* Attributes stored in the BTF_INT_ENCODING */
 #define BTF_INT_SIGNED  (1 << 0)
diff --git a/tools/include/uapi/linux/perf_event.h b/tools/include/uapi/linux/perf_event.h
index b8e288a1f740..eeb787b1c53c 100644
--- a/tools/include/uapi/linux/perf_event.h
+++ b/tools/include/uapi/linux/perf_event.h
@@ -143,6 +143,8 @@ enum perf_event_sample_format {
         PERF_SAMPLE_PHYS_ADDR                   = 1U << 19,
 
         PERF_SAMPLE_MAX = 1U << 20,             /* non-ABI */
+
+        __PERF_SAMPLE_CALLCHAIN_EARLY           = 1ULL << 63,
 };
 
 /*
diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 8c54a4b6f187..2d270c560df3 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -2,7 +2,6 @@
 /* Copyright (c) 2018 Facebook */
 
 #include <stdlib.h>
-#include <stdint.h>
 #include <string.h>
 #include <unistd.h>
 #include <errno.h>
@@ -27,13 +26,13 @@ struct btf {
         struct btf_type **types;
         const char *strings;
         void *nohdr_data;
-        uint32_t nr_types;
-        uint32_t types_size;
-        uint32_t data_size;
+        __u32 nr_types;
+        __u32 types_size;
+        __u32 data_size;
         int fd;
 };
 
-static const char *btf_name_by_offset(const struct btf *btf, uint32_t offset)
+static const char *btf_name_by_offset(const struct btf *btf, __u32 offset)
 {
         if (offset < btf->hdr->str_len)
                 return &btf->strings[offset];
@@ -45,7 +44,7 @@ static int btf_add_type(struct btf *btf, struct btf_type *t)
 {
         if (btf->types_size - btf->nr_types < 2) {
                 struct btf_type **new_types;
-                u32 expand_by, new_size;
+                __u32 expand_by, new_size;
 
                 if (btf->types_size == BTF_MAX_NR_TYPES)
                         return -E2BIG;
@@ -72,7 +71,7 @@ static int btf_add_type(struct btf *btf, struct btf_type *t)
 static int btf_parse_hdr(struct btf *btf, btf_print_fn_t err_log)
 {
         const struct btf_header *hdr = btf->hdr;
-        u32 meta_left;
+        __u32 meta_left;
 
         if (btf->data_size < sizeof(struct btf_header)) {
                 elog("BTF header not found\n");
@@ -151,7 +150,7 @@ static int btf_parse_type_sec(struct btf *btf, btf_print_fn_t err_log)
 
         while (next_type < end_type) {
                 struct btf_type *t = next_type;
-                uint16_t vlen = BTF_INFO_VLEN(t->info);
+                __u16 vlen = BTF_INFO_VLEN(t->info);
                 int err;
 
                 next_type += sizeof(*t);
@@ -190,8 +189,7 @@ static int btf_parse_type_sec(struct btf *btf, btf_print_fn_t err_log)
         return 0;
 }
 
-static const struct btf_type *btf_type_by_id(const struct btf *btf,
-                                             uint32_t type_id)
+const struct btf_type *btf__type_by_id(const struct btf *btf, __u32 type_id)
 {
         if (type_id > btf->nr_types)
                 return NULL;
@@ -209,7 +207,7 @@ static bool btf_type_is_void_or_null(const struct btf_type *t)
         return !t || btf_type_is_void(t);
 }
 
-static int64_t btf_type_size(const struct btf_type *t)
+static __s64 btf_type_size(const struct btf_type *t)
 {
         switch (BTF_INFO_KIND(t->info)) {
         case BTF_KIND_INT:
@@ -226,15 +224,15 @@ static int64_t btf_type_size(const struct btf_type *t)
 
 #define MAX_RESOLVE_DEPTH 32
 
-int64_t btf__resolve_size(const struct btf *btf, uint32_t type_id)
+__s64 btf__resolve_size(const struct btf *btf, __u32 type_id)
 {
         const struct btf_array *array;
         const struct btf_type *t;
-        uint32_t nelems = 1;
-        int64_t size = -1;
+        __u32 nelems = 1;
+        __s64 size = -1;
         int i;
 
-        t = btf_type_by_id(btf, type_id);
+        t = btf__type_by_id(btf, type_id);
         for (i = 0; i < MAX_RESOLVE_DEPTH && !btf_type_is_void_or_null(t);
              i++) {
                 size = btf_type_size(t);
@@ -259,7 +257,7 @@ int64_t btf__resolve_size(const struct btf *btf, uint32_t type_id)
                         return -EINVAL;
                 }
 
-                t = btf_type_by_id(btf, type_id);
+                t = btf__type_by_id(btf, type_id);
         }
 
         if (size < 0)
@@ -271,9 +269,9 @@ int64_t btf__resolve_size(const struct btf *btf, uint32_t type_id)
         return nelems * size;
 }
 
-int32_t btf__find_by_name(const struct btf *btf, const char *type_name)
+__s32 btf__find_by_name(const struct btf *btf, const char *type_name)
 {
-        uint32_t i;
+        __u32 i;
 
         if (!strcmp(type_name, "void"))
                 return 0;
@@ -302,10 +300,9 @@ void btf__free(struct btf *btf)
         free(btf);
 }
 
-struct btf *btf__new(uint8_t *data, uint32_t size,
-                     btf_print_fn_t err_log)
+struct btf *btf__new(__u8 *data, __u32 size, btf_print_fn_t err_log)
 {
-        uint32_t log_buf_size = 0;
+        __u32 log_buf_size = 0;
         char *log_buf = NULL;
         struct btf *btf;
         int err;
diff --git a/tools/lib/bpf/btf.h b/tools/lib/bpf/btf.h
index 74bb344035bb..e2a09a155f84 100644
--- a/tools/lib/bpf/btf.h
+++ b/tools/lib/bpf/btf.h
@@ -4,19 +4,21 @@
 #ifndef __BPF_BTF_H
 #define __BPF_BTF_H
 
-#include <stdint.h>
+#include <linux/types.h>
 
 #define BTF_ELF_SEC ".BTF"
 
 struct btf;
+struct btf_type;
 
 typedef int (*btf_print_fn_t)(const char *, ...)
         __attribute__((format(printf, 1, 2)));
 
 void btf__free(struct btf *btf);
-struct btf *btf__new(uint8_t *data, uint32_t size, btf_print_fn_t err_log);
-int32_t btf__find_by_name(const struct btf *btf, const char *type_name);
-int64_t btf__resolve_size(const struct btf *btf, uint32_t type_id);
+struct btf *btf__new(__u8 *data, __u32 size, btf_print_fn_t err_log);
+__s32 btf__find_by_name(const struct btf *btf, const char *type_name);
+const struct btf_type *btf__type_by_id(const struct btf *btf, __u32 id);
+__s64 btf__resolve_size(const struct btf *btf, __u32 type_id);
 int btf__fd(const struct btf *btf);
 
 #endif
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index a1e96b5de5ff..1aafdbe827fe 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -36,6 +36,7 @@
 #include <linux/err.h>
 #include <linux/kernel.h>
 #include <linux/bpf.h>
+#include <linux/btf.h>
 #include <linux/list.h>
 #include <linux/limits.h>
 #include <sys/stat.h>
@@ -216,8 +217,8 @@ struct bpf_map {
         size_t offset;
         int map_ifindex;
         struct bpf_map_def def;
-        uint32_t btf_key_type_id;
-        uint32_t btf_value_type_id;
+        __u32 btf_key_type_id;
+        __u32 btf_value_type_id;
         void *priv;
         bpf_map_clear_priv_t clear_priv;
 };
@@ -1014,68 +1015,72 @@ bpf_program__collect_reloc(struct bpf_program *prog, GElf_Shdr *shdr,
 
 static int bpf_map_find_btf_info(struct bpf_map *map, const struct btf *btf)
 {
+        const struct btf_type *container_type;
+        const struct btf_member *key, *value;
         struct bpf_map_def *def = &map->def;
         const size_t max_name = 256;
-        int64_t key_size, value_size;
-        int32_t key_id, value_id;
-        char name[max_name];
+        char container_name[max_name];
+        __s64 key_size, value_size;
+        __s32 container_id;
 
-        /* Find key type by name from BTF */
-        if (snprintf(name, max_name, "%s_key", map->name) == max_name) {
-                pr_warning("map:%s length of BTF key_type:%s_key is too long\n",
+        if (snprintf(container_name, max_name, "____btf_map_%s", map->name) ==
+            max_name) {
+                pr_warning("map:%s length of '____btf_map_%s' is too long\n",
                            map->name, map->name);
                 return -EINVAL;
         }
 
-        key_id = btf__find_by_name(btf, name);
-        if (key_id < 0) {
-                pr_debug("map:%s key_type:%s cannot be found in BTF\n",
-                         map->name, name);
-                return key_id;
+        container_id = btf__find_by_name(btf, container_name);
+        if (container_id < 0) {
+                pr_debug("map:%s container_name:%s cannot be found in BTF. Missing BPF_ANNOTATE_KV_PAIR?\n",
+                         map->name, container_name);
+                return container_id;
         }
 
-        key_size = btf__resolve_size(btf, key_id);
-        if (key_size < 0) {
-                pr_warning("map:%s key_type:%s cannot get the BTF type_size\n",
-                           map->name, name);
-                return key_size;
+        container_type = btf__type_by_id(btf, container_id);
+        if (!container_type) {
+                pr_warning("map:%s cannot find BTF type for container_id:%u\n",
+                           map->name, container_id);
+                return -EINVAL;
         }
 
-        if (def->key_size != key_size) {
-                pr_warning("map:%s key_type:%s has BTF type_size:%u != key_size:%u\n",
-                           map->name, name, (unsigned int)key_size, def->key_size);
+        if (BTF_INFO_KIND(container_type->info) != BTF_KIND_STRUCT ||
+            BTF_INFO_VLEN(container_type->info) < 2) {
+                pr_warning("map:%s container_name:%s is an invalid container struct\n",
+                           map->name, container_name);
                 return -EINVAL;
         }
 
-        /* Find value type from BTF */
-        if (snprintf(name, max_name, "%s_value", map->name) == max_name) {
-                pr_warning("map:%s length of BTF value_type:%s_value is too long\n",
-                          map->name, map->name);
-                return -EINVAL;
+        key = (struct btf_member *)(container_type + 1);
+        value = key + 1;
+
+        key_size = btf__resolve_size(btf, key->type);
+        if (key_size < 0) {
+                pr_warning("map:%s invalid BTF key_type_size\n",
+                           map->name);
+                return key_size;
         }
 
-        value_id = btf__find_by_name(btf, name);
-        if (value_id < 0) {
-                pr_debug("map:%s value_type:%s cannot be found in BTF\n",
-                         map->name, name);
-                return value_id;
+        if (def->key_size != key_size) {
+                pr_warning("map:%s btf_key_type_size:%u != map_def_key_size:%u\n",
+                           map->name, (__u32)key_size, def->key_size);
+                return -EINVAL;
         }
 
-        value_size = btf__resolve_size(btf, value_id);
+        value_size = btf__resolve_size(btf, value->type);
         if (value_size < 0) {
-                pr_warning("map:%s value_type:%s cannot get the BTF type_size\n",
-                           map->name, name);
+                pr_warning("map:%s invalid BTF value_type_size\n", map->name);
                 return value_size;
         }
 
         if (def->value_size != value_size) {
-                pr_warning("map:%s value_type:%s has BTF type_size:%u != value_size:%u\n",
-                           map->name, name, (unsigned int)value_size, def->value_size);
+                pr_warning("map:%s btf_value_type_size:%u != map_def_value_size:%u\n",
+                           map->name, (__u32)value_size, def->value_size);
                 return -EINVAL;
         }
 
-        map->btf_key_type_id = key_id;
-        map->btf_value_type_id = value_id;
+        map->btf_key_type_id = key->type;
+        map->btf_value_type_id = value->type;
 
         return 0;
 }
@@ -2089,12 +2094,12 @@ const char *bpf_map__name(struct bpf_map *map)
         return map ? map->name : NULL;
 }
 
-uint32_t bpf_map__btf_key_type_id(const struct bpf_map *map)
+__u32 bpf_map__btf_key_type_id(const struct bpf_map *map)
 {
         return map ? map->btf_key_type_id : 0;
 }
 
-uint32_t bpf_map__btf_value_type_id(const struct bpf_map *map)
+__u32 bpf_map__btf_value_type_id(const struct bpf_map *map)
 {
         return map ? map->btf_value_type_id : 0;
 }
@@ -2268,8 +2273,8 @@ bpf_perf_event_read_simple(void *mem, unsigned long size,
         volatile struct perf_event_mmap_page *header = mem;
         __u64 data_tail = header->data_tail;
         __u64 data_head = header->data_head;
+        int ret = LIBBPF_PERF_EVENT_ERROR;
         void *base, *begin, *end;
-        int ret;
 
         asm volatile("" ::: "memory"); /* in real code it should be smp_rmb() */
         if (data_head == data_tail)
diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
index 09976531aa74..b33ae02f7d0e 100644
--- a/tools/lib/bpf/libbpf.h
+++ b/tools/lib/bpf/libbpf.h
@@ -244,8 +244,8 @@ bpf_map__next(struct bpf_map *map, struct bpf_object *obj);
 int bpf_map__fd(struct bpf_map *map);
 const struct bpf_map_def *bpf_map__def(struct bpf_map *map);
 const char *bpf_map__name(struct bpf_map *map);
-uint32_t bpf_map__btf_key_type_id(const struct bpf_map *map);
-uint32_t bpf_map__btf_value_type_id(const struct bpf_map *map);
+__u32 bpf_map__btf_key_type_id(const struct bpf_map *map);
+__u32 bpf_map__btf_value_type_id(const struct bpf_map *map);
 
 typedef void (*bpf_map_clear_priv_t)(struct bpf_map *, void *);
 int bpf_map__set_priv(struct bpf_map *map, void *priv,
diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
index 0d1acb704f64..7ec85d567598 100644
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -519,10 +519,12 @@ struct section *elf_create_section(struct elf *elf, const char *name,
         sec->sh.sh_flags = SHF_ALLOC;
 
 
-        /* Add section name to .shstrtab */
+        /* Add section name to .shstrtab (or .strtab for Clang) */
         shstrtab = find_section_by_name(elf, ".shstrtab");
+        if (!shstrtab)
+                shstrtab = find_section_by_name(elf, ".strtab");
         if (!shstrtab) {
-                WARN("can't find .shstrtab section");
+                WARN("can't find .shstrtab or .strtab section");
                 return NULL;
         }
 
diff --git a/tools/perf/arch/x86/util/pmu.c b/tools/perf/arch/x86/util/pmu.c
index 63a74c32ddc5..e33ef5bc31c5 100644
--- a/tools/perf/arch/x86/util/pmu.c
+++ b/tools/perf/arch/x86/util/pmu.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <string.h>
 
+#include <linux/stddef.h>
 #include <linux/perf_event.h>
 
 #include "../../util/intel-pt.h"
diff --git a/tools/perf/arch/x86/util/tsc.c b/tools/perf/arch/x86/util/tsc.c
index 06bae7023a51..950539f9a4f7 100644
--- a/tools/perf/arch/x86/util/tsc.c
+++ b/tools/perf/arch/x86/util/tsc.c
@@ -2,6 +2,7 @@
 #include <stdbool.h>
 #include <errno.h>
 
+#include <linux/stddef.h>
 #include <linux/perf_event.h>
 
 #include "../../perf.h"
diff --git a/tools/perf/bench/Build b/tools/perf/bench/Build
index 60bf11943047..eafce1a130a1 100644
--- a/tools/perf/bench/Build
+++ b/tools/perf/bench/Build
@@ -7,6 +7,7 @@ perf-y += futex-wake-parallel.o
 perf-y += futex-requeue.o
 perf-y += futex-lock-pi.o
 
+perf-$(CONFIG_X86_64) += mem-memcpy-x86-64-lib.o
 perf-$(CONFIG_X86_64) += mem-memcpy-x86-64-asm.o
 perf-$(CONFIG_X86_64) += mem-memset-x86-64-asm.o
 
diff --git a/tools/perf/bench/mem-memcpy-x86-64-asm.S b/tools/perf/bench/mem-memcpy-x86-64-asm.S
index b43f8d2a34ec..9ad015a1e202 100644
--- a/tools/perf/bench/mem-memcpy-x86-64-asm.S
+++ b/tools/perf/bench/mem-memcpy-x86-64-asm.S
@@ -6,6 +6,7 @@
 #define altinstr_replacement text
 #define globl p2align 4; .globl
 #define _ASM_EXTABLE_FAULT(x, y)
+#define _ASM_EXTABLE(x, y)
 
 #include "../../arch/x86/lib/memcpy_64.S"
 /*
diff --git a/tools/perf/bench/mem-memcpy-x86-64-lib.c b/tools/perf/bench/mem-memcpy-x86-64-lib.c
new file mode 100644
index 000000000000..4130734dde84
--- /dev/null
+++ b/tools/perf/bench/mem-memcpy-x86-64-lib.c
@@ -0,0 +1,24 @@
+/*
+ * From code in arch/x86/lib/usercopy_64.c, copied to keep tools/ copy
+ * of the kernel's arch/x86/lib/memcpy_64.s used in 'perf bench mem memcpy'
+ * happy.
+ */
+#include <linux/types.h>
+
+unsigned long __memcpy_mcsafe(void *dst, const void *src, size_t cnt);
+unsigned long mcsafe_handle_tail(char *to, char *from, unsigned len);
+
+unsigned long mcsafe_handle_tail(char *to, char *from, unsigned len)
+{
+        for (; len; --len, to++, from++) {
+                /*
+                 * Call the assembly routine back directly since
+                 * memcpy_mcsafe() may silently fallback to memcpy.
+                 */
+                unsigned long rem = __memcpy_mcsafe(to, from, 1);
+
+                if (rem)
+                        break;
+        }
+        return len;
+}
diff --git a/tools/perf/perf.h b/tools/perf/perf.h
index a1a97956136f..d215714f48df 100644
--- a/tools/perf/perf.h
+++ b/tools/perf/perf.h
@@ -5,6 +5,7 @@
 #include <time.h>
 #include <stdbool.h>
 #include <linux/types.h>
+#include <linux/stddef.h>
 #include <linux/perf_event.h>
 
 extern bool test_attr__enabled;
diff --git a/tools/perf/util/header.h b/tools/perf/util/header.h
index 90d4577a92dc..6d7fe44aadc0 100644
--- a/tools/perf/util/header.h
+++ b/tools/perf/util/header.h
@@ -2,6 +2,7 @@
 #ifndef __PERF_HEADER_H
 #define __PERF_HEADER_H
 
+#include <linux/stddef.h>
 #include <linux/perf_event.h>
 #include <sys/types.h>
 #include <stdbool.h>
diff --git a/tools/perf/util/namespaces.h b/tools/perf/util/namespaces.h
index 760558dcfd18..cae1a9a39722 100644
--- a/tools/perf/util/namespaces.h
+++ b/tools/perf/util/namespaces.h
@@ -10,6 +10,7 @@
 #define __PERF_NAMESPACES_H
 
 #include <sys/types.h>
+#include <linux/stddef.h>
 #include <linux/perf_event.h>
 #include <linux/refcount.h>
 #include <linux/types.h>
diff --git a/tools/power/x86/turbostat/turbostat.8 b/tools/power/x86/turbostat/turbostat.8
index d39e4ff7d0bf..a6db83a88e85 100644
--- a/tools/power/x86/turbostat/turbostat.8
+++ b/tools/power/x86/turbostat/turbostat.8
@@ -106,7 +106,7 @@ The system configuration dump (if --quiet is not used) is followed by statistics
 \fBC1%, C2%, C3%\fP The residency percentage that Linux requested C1, C2, C3....  The system summary is the average of all CPUs in the system.  Note that these are software, reflecting what was requested.  The hardware counters reflect what was actually achieved.
 \fBCPU%c1, CPU%c3, CPU%c6, CPU%c7\fP show the percentage residency in hardware core idle states.  These numbers are from hardware residency counters.
 \fBCoreTmp\fP Degrees Celsius reported by the per-core Digital Thermal Sensor.
-\fBPkgTtmp\fP Degrees Celsius reported by the per-package Package Thermal Monitor.
+\fBPkgTmp\fP Degrees Celsius reported by the per-package Package Thermal Monitor.
 \fBGFX%rc6\fP The percentage of time the GPU is in the "render C6" state, rc6, during the measurement interval. From /sys/class/drm/card0/power/rc6_residency_ms.
 \fBGFXMHz\fP Instantaneous snapshot of what sysfs presents at the end of the measurement interval. From /sys/class/graphics/fb0/device/drm/card0/gt_cur_freq_mhz.
 \fBPkg%pc2, Pkg%pc3, Pkg%pc6, Pkg%pc7\fP percentage residency in hardware package idle states.  These numbers are from hardware residency counters.
@@ -114,7 +114,7 @@ The system configuration dump (if --quiet is not used) is followed by statistics
 \fBCorWatt\fP Watts consumed by the core part of the package.
 \fBGFXWatt\fP Watts consumed by the Graphics part of the package -- available only on client processors.
 \fBRAMWatt\fP Watts consumed by the DRAM DIMMS -- available only on server processors.
-\fBPKG_%\fP percent of the interval that RAPL throttling was active on the Package.
+\fBPKG_%\fP percent of the interval that RAPL throttling was active on the Package.  Note that the system summary is the sum of the package throttling time, and thus may be higher than 100% on a multi-package system.  Note that the meaning of this field is model specific.  For example, some hardware increments this counter when RAPL responds to thermal limits, but does not increment this counter when RAPL responds to power limits.  Comparing PkgWatt and PkgTmp to system limits is necessary.
 \fBRAM_%\fP percent of the interval that RAPL throttling was active on DRAM.
 .fi
 .SH TOO MUCH INFORMATION EXAMPLE
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index 4d14bbbf9b63..980bd9d20646 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -1163,9 +1163,7 @@ void format_all_counters(struct thread_data *t, struct core_data *c, struct pkg_
         if (!printed || !summary_only)
                 print_header("\t");
 
-        if (topo.num_cpus > 1)
-                format_counters(&average.threads, &average.cores,
-                        &average.packages);
+        format_counters(&average.threads, &average.cores, &average.packages);
 
         printed = 1;
 
@@ -1692,7 +1690,7 @@ void get_apic_id(struct thread_data *t)
         t->x2apic_id = edx;
 
         if (debug && (t->apic_id != t->x2apic_id))
-                fprintf(stderr, "cpu%d: apic 0x%x x2apic 0x%x\n", t->cpu_id, t->apic_id, t->x2apic_id);
+                fprintf(outf, "cpu%d: apic 0x%x x2apic 0x%x\n", t->cpu_id, t->apic_id, t->x2apic_id);
 }
 
 /*
@@ -2473,55 +2471,43 @@ int get_core_id(int cpu)
 
 void set_node_data(void)
 {
-        char path[80];
-        FILE *filep;
-        int pkg, node, cpu;
-
-        struct pkg_node_info {
-                int count;
-                int min;
-        } *pni;
-
-        pni = calloc(topo.num_packages, sizeof(struct pkg_node_info));
-        if (!pni)
-                err(1, "calloc pkg_node_count");
-
-        for (pkg = 0; pkg < topo.num_packages; pkg++)
-                pni[pkg].min = topo.num_cpus;
-
-        for (node = 0; node <= topo.max_node_num; node++) {
-                /* find the "first" cpu in the node */
-                sprintf(path, "/sys/bus/node/devices/node%d/cpulist", node);
-                filep = fopen(path, "r");
-                if (!filep)
-                        continue;
-                fscanf(filep, "%d", &cpu);
-                fclose(filep);
-
-                pkg = cpus[cpu].physical_package_id;
-                pni[pkg].count++;
-
-                if (node < pni[pkg].min)
-                        pni[pkg].min = node;
-        }
-
-        for (pkg = 0; pkg < topo.num_packages; pkg++)
-                if (pni[pkg].count > topo.nodes_per_pkg)
-                        topo.nodes_per_pkg = pni[0].count;
-
-        /* Fake 1 node per pkg for machines that don't
-         * expose nodes and thus avoid -nan results
-         */
-        if (topo.nodes_per_pkg == 0)
-                topo.nodes_per_pkg = 1;
-
-        for (cpu = 0; cpu < topo.num_cpus; cpu++) {
-                pkg = cpus[cpu].physical_package_id;
-                node = cpus[cpu].physical_node_id;
-                cpus[cpu].logical_node_id = node - pni[pkg].min;
+        int pkg, node, lnode, cpu, cpux;
+        int cpu_count;
+
+        /* initialize logical_node_id */
+        for (cpu = 0; cpu <= topo.max_cpu_num; ++cpu)
+                cpus[cpu].logical_node_id = -1;
+
+        cpu_count = 0;
+        for (pkg = 0; pkg < topo.num_packages; pkg++) {
+                lnode = 0;
+                for (cpu = 0; cpu <= topo.max_cpu_num; ++cpu) {
+                        if (cpus[cpu].physical_package_id != pkg)
+                                continue;
+                        /* find a cpu with an unset logical_node_id */
+                        if (cpus[cpu].logical_node_id != -1)
+                                continue;
+                        cpus[cpu].logical_node_id = lnode;
+                        node = cpus[cpu].physical_node_id;
+                        cpu_count++;
+                        /*
+                         * find all matching cpus on this pkg and set
+                         * the logical_node_id
+                         */
+                        for (cpux = cpu; cpux <= topo.max_cpu_num; cpux++) {
+                                if ((cpus[cpux].physical_package_id == pkg) &&
+                                   (cpus[cpux].physical_node_id == node)) {
+                                        cpus[cpux].logical_node_id = lnode;
+                                        cpu_count++;
+                                }
+                        }
+                        lnode++;
+                        if (lnode > topo.nodes_per_pkg)
+                                topo.nodes_per_pkg = lnode;
+                }
+                if (cpu_count >= topo.max_cpu_num)
+                        break;
         }
-        free(pni);
-
 }
 
 int get_physical_node_id(struct cpu_topology *thiscpu)
@@ -4471,7 +4457,9 @@ void process_cpuid()
         family = (fms >> 8) & 0xf;
         model = (fms >> 4) & 0xf;
         stepping = fms & 0xf;
-        if (family == 6 || family == 0xf)
+        if (family == 0xf)
+                family += (fms >> 20) & 0xff;
+        if (family >= 6)
                 model += ((fms >> 16) & 0xf) << 4;
 
         if (!quiet) {
@@ -4840,16 +4828,8 @@ void topology_probe()
                 siblings = get_thread_siblings(&cpus[i]);
                 if (siblings > max_siblings)
                         max_siblings = siblings;
-                if (cpus[i].thread_id != -1)
+                if (cpus[i].thread_id == 0)
                         topo.num_cores++;
-
-                if (debug > 1)
-                        fprintf(outf,
-                                "cpu %d pkg %d node %d core %d thread %d\n",
-                                i, cpus[i].physical_package_id,
-                                cpus[i].physical_node_id,
-                                cpus[i].physical_core_id,
-                                cpus[i].thread_id);
         }
 
         topo.cores_per_node = max_core_id + 1;
@@ -4875,6 +4855,20 @@ void topology_probe()
         topo.threads_per_core = max_siblings;
         if (debug > 1)
                 fprintf(outf, "max_siblings %d\n", max_siblings);
+
+        if (debug < 1)
+                return;
+
+        for (i = 0; i <= topo.max_cpu_num; ++i) {
+                fprintf(outf,
+                        "cpu %d pkg %d node %d lnode %d core %d thread %d\n",
+                        i, cpus[i].physical_package_id,
+                        cpus[i].physical_node_id,
+                        cpus[i].logical_node_id,
+                        cpus[i].physical_core_id,
+                        cpus[i].thread_id);
+        }
+
 }
 
 void
@@ -5102,7 +5096,7 @@ int get_and_dump_counters(void)
 }
 
 void print_version() {
-        fprintf(outf, "turbostat version 18.06.20"
+        fprintf(outf, "turbostat version 18.07.27"
                 " - Len Brown <lenb@kernel.org>\n");
 }
 
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 7a6214e9ae58..a362e3d7abc6 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -105,7 +105,7 @@ $(OUTPUT)/test_xdp_noinline.o: CLANG_FLAGS += -fno-inline
 
 BTF_LLC_PROBE := $(shell $(LLC) -march=bpf -mattr=help 2>&1 | grep dwarfris)
 BTF_PAHOLE_PROBE := $(shell $(BTF_PAHOLE) --help 2>&1 | grep BTF)
-BTF_OBJCOPY_PROBE := $(shell $(LLVM_OBJCOPY) --version 2>&1 | grep LLVM)
+BTF_OBJCOPY_PROBE := $(shell $(LLVM_OBJCOPY) --help 2>&1 | grep -i 'usage.*llvm')
 
 ifneq ($(BTF_LLC_PROBE),)
 ifneq ($(BTF_PAHOLE_PROBE),)
diff --git a/tools/testing/selftests/bpf/bpf_helpers.h b/tools/testing/selftests/bpf/bpf_helpers.h
index f2f28b6c8915..810de20e8e26 100644
--- a/tools/testing/selftests/bpf/bpf_helpers.h
+++ b/tools/testing/selftests/bpf/bpf_helpers.h
@@ -158,6 +158,15 @@ struct bpf_map_def {
         unsigned int numa_node;
 };
 
+#define BPF_ANNOTATE_KV_PAIR(name, type_key, type_val)          \
+        struct ____btf_map_##name {                             \
+                type_key key;                                   \
+                type_val value;                                 \
+        };                                                      \
+        struct ____btf_map_##name                               \
+        __attribute__ ((section(".maps." #name), used))         \
+                ____btf_map_##name = { }
+
 static int (*bpf_skb_load_bytes)(void *ctx, int off, void *to, int len) =
         (void *) BPF_FUNC_skb_load_bytes;
 static int (*bpf_skb_store_bytes)(void *ctx, int off, void *from, int len, int flags) =
diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c
index 3619f3023088..ffdd27737c9e 100644
--- a/tools/testing/selftests/bpf/test_btf.c
+++ b/tools/testing/selftests/bpf/test_btf.c
@@ -247,6 +247,34 @@ static struct btf_raw_test raw_tests[] = {
         .max_entries = 4,
 },
 
+{
+        .descr = "struct test #3 Invalid member offset",
+        .raw_types = {
+                /* int */                                       /* [1] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),
+                /* int64 */                                     /* [2] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 64, 8),
+
+                /* struct A { */                                /* [3] */
+                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 2), 16),
+                BTF_MEMBER_ENC(NAME_TBD, 1, 64),        /* int m;               */
+                BTF_MEMBER_ENC(NAME_TBD, 2, 0),         /* int64 n; */
+                /* } */
+                BTF_END_RAW,
+        },
+        .str_sec = "\0A\0m\0n\0",
+        .str_sec_size = sizeof("\0A\0m\0n\0"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "struct_test3_map",
+        .key_size = sizeof(int),
+        .value_size = 16,
+        .key_type_id = 1,
+        .value_type_id = 3,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid member bits_offset",
+},
+
 /* Test member exceeds the size of struct.
  *
  * struct A {
@@ -479,7 +507,7 @@ static struct btf_raw_test raw_tests[] = {
         .key_size = sizeof(int),
         .value_size = sizeof(void *) * 4,
         .key_type_id = 1,
-        .value_type_id = 4,
+        .value_type_id = 5,
         .max_entries = 4,
 },
 
@@ -1264,6 +1292,88 @@ static struct btf_raw_test raw_tests[] = {
         .err_str = "type != 0",
 },
 
+{
+        .descr = "arraymap invalid btf key (a bit field)",
+        .raw_types = {
+                /* int */                               /* [1] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),
+                /* 32 bit int with 32 bit offset */     /* [2] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 32, 32, 8),
+                BTF_END_RAW,
+        },
+        .str_sec = "",
+        .str_sec_size = sizeof(""),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "array_map_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 2,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .map_create_err = true,
+},
+
+{
+        .descr = "arraymap invalid btf key (!= 32 bits)",
+        .raw_types = {
+                /* int */                               /* [1] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),
+                /* 16 bit int with 0 bit offset */      /* [2] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 16, 2),
+                BTF_END_RAW,
+        },
+        .str_sec = "",
+        .str_sec_size = sizeof(""),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "array_map_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 2,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .map_create_err = true,
+},
+
+{
+        .descr = "arraymap invalid btf value (too small)",
+        .raw_types = {
+                /* int */                               /* [1] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),
+                BTF_END_RAW,
+        },
+        .str_sec = "",
+        .str_sec_size = sizeof(""),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "array_map_check_btf",
+        .key_size = sizeof(int),
+        /* btf_value_size < map->value_size */
+        .value_size = sizeof(__u64),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .map_create_err = true,
+},
+
+{
+        .descr = "arraymap invalid btf value (too big)",
+        .raw_types = {
+                /* int */                               /* [1] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),
+                BTF_END_RAW,
+        },
+        .str_sec = "",
+        .str_sec_size = sizeof(""),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "array_map_check_btf",
+        .key_size = sizeof(int),
+        /* btf_value_size > map->value_size */
+        .value_size = sizeof(__u16),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .map_create_err = true,
+},
+
 }; /* struct btf_raw_test raw_tests[] */
 
 static const char *get_next_str(const char *start, const char *end)
@@ -2023,7 +2133,7 @@ static struct btf_raw_test pprint_test = {
                 BTF_ENUM_ENC(NAME_TBD, 2),
                 BTF_ENUM_ENC(NAME_TBD, 3),
                 /* struct pprint_mapv */                /* [16] */
-                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 8), 28),
+                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 8), 32),
                 BTF_MEMBER_ENC(NAME_TBD, 11, 0),        /* uint32_t ui32 */
                 BTF_MEMBER_ENC(NAME_TBD, 10, 32),       /* uint16_t ui16 */
                 BTF_MEMBER_ENC(NAME_TBD, 12, 64),       /* int32_t si32 */
diff --git a/tools/testing/selftests/bpf/test_btf_haskv.c b/tools/testing/selftests/bpf/test_btf_haskv.c
index 8c7ca096ecf2..b21b876f475d 100644
--- a/tools/testing/selftests/bpf/test_btf_haskv.c
+++ b/tools/testing/selftests/bpf/test_btf_haskv.c
@@ -10,11 +10,6 @@ struct ipv_counts {
         unsigned int v6;
 };
 
-typedef int btf_map_key;
-typedef struct ipv_counts btf_map_value;
-btf_map_key dumm_key;
-btf_map_value dummy_value;
-
 struct bpf_map_def SEC("maps") btf_map = {
         .type = BPF_MAP_TYPE_ARRAY,
         .key_size = sizeof(int),
@@ -22,6 +17,8 @@ struct bpf_map_def SEC("maps") btf_map = {
         .max_entries = 4,
 };
 
+BPF_ANNOTATE_KV_PAIR(btf_map, int, struct ipv_counts);
+
 struct dummy_tracepoint_args {
         unsigned long long pad;
         struct sock *sock;
diff --git a/tools/testing/selftests/bpf/test_lwt_seg6local.sh b/tools/testing/selftests/bpf/test_lwt_seg6local.sh
index 270fa8f49573..785eabf2a593 100755
--- a/tools/testing/selftests/bpf/test_lwt_seg6local.sh
+++ b/tools/testing/selftests/bpf/test_lwt_seg6local.sh
@@ -115,14 +115,14 @@ ip netns exec ns2 ip -6 route add fb00::6 encap bpf in obj test_lwt_seg6local.o
 ip netns exec ns2 ip -6 route add fd00::1 dev veth3 via fb00::43 scope link
 
 ip netns exec ns3 ip -6 route add fc42::1 dev veth5 via fb00::65
-ip netns exec ns3 ip -6 route add fd00::1 encap seg6local action End.BPF obj test_lwt_seg6local.o sec add_egr_x dev veth4
+ip netns exec ns3 ip -6 route add fd00::1 encap seg6local action End.BPF endpoint obj test_lwt_seg6local.o sec add_egr_x dev veth4
 
-ip netns exec ns4 ip -6 route add fd00::2 encap seg6local action End.BPF obj test_lwt_seg6local.o sec pop_egr dev veth6
+ip netns exec ns4 ip -6 route add fd00::2 encap seg6local action End.BPF endpoint obj test_lwt_seg6local.o sec pop_egr dev veth6
 ip netns exec ns4 ip -6 addr add fc42::1 dev lo
 ip netns exec ns4 ip -6 route add fd00::3 dev veth7 via fb00::87
 
 ip netns exec ns5 ip -6 route add fd00::4 table 117 dev veth9 via fb00::109
-ip netns exec ns5 ip -6 route add fd00::3 encap seg6local action End.BPF obj test_lwt_seg6local.o sec inspect_t dev veth8
+ip netns exec ns5 ip -6 route add fd00::3 encap seg6local action End.BPF endpoint obj test_lwt_seg6local.o sec inspect_t dev veth8
 
 ip netns exec ns6 ip -6 addr add fb00::6/16 dev lo
 ip netns exec ns6 ip -6 addr add fd00::4/16 dev lo
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 2ecd27b670d7..41106d9d5cc7 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -4975,6 +4975,24 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
         },
         {
+                "make headroom for LWT_XMIT",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_2, 34),
+                        BPF_MOV64_IMM(BPF_REG_3, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
+                        /* split for s390 to succeed */
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+                        BPF_MOV64_IMM(BPF_REG_2, 42),
+                        BPF_MOV64_IMM(BPF_REG_3, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_LWT_XMIT,
+        },
+        {
                 "invalid access of tc_classid for LWT_IN",
                 .insns = {
                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
@@ -11987,6 +12005,46 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_XDP,
         },
         {
+                "xadd/w check whether src/dst got mangled, 1",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
+                        BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
+                        BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
+                        BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
+                        BPF_JMP_REG(BPF_JNE, BPF_REG_6, BPF_REG_0, 3),
+                        BPF_JMP_REG(BPF_JNE, BPF_REG_7, BPF_REG_10, 2),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
+                        BPF_EXIT_INSN(),
+                        BPF_MOV64_IMM(BPF_REG_0, 42),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .retval = 3,
+        },
+        {
+                "xadd/w check whether src/dst got mangled, 2",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
+                        BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
+                        BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -8),
+                        BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -8),
+                        BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -8),
+                        BPF_JMP_REG(BPF_JNE, BPF_REG_6, BPF_REG_0, 3),
+                        BPF_JMP_REG(BPF_JNE, BPF_REG_7, BPF_REG_10, 2),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
+                        BPF_EXIT_INSN(),
+                        BPF_MOV64_IMM(BPF_REG_0, 42),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .retval = 3,
+        },
+        {
                 "bpf_get_stack return R0 within range",
                 .insns = {
                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
@@ -12554,8 +12612,11 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
         }
 
         if (fd_prog >= 0) {
+                __u8 tmp[TEST_DATA_LEN << 2];
+                __u32 size_tmp = sizeof(tmp);
+
                 err = bpf_prog_test_run(fd_prog, 1, test->data,
-                                        sizeof(test->data), NULL, NULL,
+                                        sizeof(test->data), tmp, &size_tmp,
                                         &retval, NULL);
                 if (err && errno != 524/*ENOTSUPP*/ && errno != EPERM) {
                         printf("Unexpected bpf_prog_test_run error\n");
diff --git a/tools/testing/selftests/ftrace/test.d/00basic/snapshot.tc b/tools/testing/selftests/ftrace/test.d/00basic/snapshot.tc
new file mode 100644
index 000000000000..3b1f45e13a2e
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/00basic/snapshot.tc
@@ -0,0 +1,28 @@
+#!/bin/sh
+# description: Snapshot and tracing setting
+# flags: instance
+
+[ ! -f snapshot ] && exit_unsupported
+
+echo "Set tracing off"
+echo 0 > tracing_on
+
+echo "Allocate and take a snapshot"
+echo 1 > snapshot
+
+# Since trace buffer is empty, snapshot is also empty, but allocated
+grep -q "Snapshot is allocated" snapshot
+
+echo "Ensure keep tracing off"
+test `cat tracing_on` -eq 0
+
+echo "Set tracing on"
+echo 1 > tracing_on
+
+echo "Take a snapshot again"
+echo 1 > snapshot
+
+echo "Ensure keep tracing on"
+test `cat tracing_on` -eq 1
+
+exit 0
diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
index 78245d60d8bc..0f45633bd634 100755
--- a/tools/testing/selftests/net/fib_tests.sh
+++ b/tools/testing/selftests/net/fib_tests.sh
@@ -740,13 +740,6 @@ ipv6_rt_add()
         run_cmd "$IP -6 ro add unreachable 2001:db8:104::/64"
         log_test $? 2 "Attempt to add duplicate route - reject route"
 
-        # iproute2 prepend only sets NLM_F_CREATE
-        # - adds a new route; does NOT convert existing route to ECMP
-        add_route6 "2001:db8:104::/64" "via 2001:db8:101::2"
-        run_cmd "$IP -6 ro prepend 2001:db8:104::/64 via 2001:db8:103::2"
-        check_route6 "2001:db8:104::/64 via 2001:db8:101::2 dev veth1 metric 1024 2001:db8:104::/64 via 2001:db8:103::2 dev veth3 metric 1024"
-        log_test $? 0 "Add new route for existing prefix (w/o NLM_F_EXCL)"
-
         # route append with same prefix adds a new route
         # - iproute2 sets NLM_F_CREATE | NLM_F_APPEND
         add_route6 "2001:db8:104::/64" "via 2001:db8:101::2"
@@ -754,27 +747,6 @@ ipv6_rt_add()
         check_route6 "2001:db8:104::/64 metric 1024 nexthop via 2001:db8:101::2 dev veth1 weight 1 nexthop via 2001:db8:103::2 dev veth3 weight 1"
         log_test $? 0 "Append nexthop to existing route - gw"
 
-        add_route6 "2001:db8:104::/64" "via 2001:db8:101::2"
-        run_cmd "$IP -6 ro append 2001:db8:104::/64 dev veth3"
-        check_route6 "2001:db8:104::/64 metric 1024 nexthop via 2001:db8:101::2 dev veth1 weight 1 nexthop dev veth3 weight 1"
-        log_test $? 0 "Append nexthop to existing route - dev only"
-
-        # multipath route can not have a nexthop that is a reject route
-        add_route6 "2001:db8:104::/64" "via 2001:db8:101::2"
-        run_cmd "$IP -6 ro append unreachable 2001:db8:104::/64"
-        log_test $? 2 "Append nexthop to existing route - reject route"
-
-        # reject route can not be converted to multipath route
-        run_cmd "$IP -6 ro flush 2001:db8:104::/64"
-        run_cmd "$IP -6 ro add unreachable 2001:db8:104::/64"
-        run_cmd "$IP -6 ro append 2001:db8:104::/64 via 2001:db8:103::2"
-        log_test $? 2 "Append nexthop to existing reject route - gw"
-
-        run_cmd "$IP -6 ro flush 2001:db8:104::/64"
-        run_cmd "$IP -6 ro add unreachable 2001:db8:104::/64"
-        run_cmd "$IP -6 ro append 2001:db8:104::/64 dev veth3"
-        log_test $? 2 "Append nexthop to existing reject route - dev only"
-
         # insert mpath directly
         add_route6 "2001:db8:104::/64" "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2"
         check_route6  "2001:db8:104::/64 metric 1024 nexthop via 2001:db8:101::2 dev veth1 weight 1 nexthop via 2001:db8:103::2 dev veth3 weight 1"
@@ -819,13 +791,6 @@ ipv6_rt_replace_single()
         check_route6 "2001:db8:104::/64 metric 1024 nexthop via 2001:db8:101::3 dev veth1 weight 1 nexthop via 2001:db8:103::2 dev veth3 weight 1"
         log_test $? 0 "Single path with multipath"
 
-        # single path with reject
-        #
-        add_initial_route6 "nexthop via 2001:db8:101::2"
-        run_cmd "$IP -6 ro replace unreachable 2001:db8:104::/64"
-        check_route6 "unreachable 2001:db8:104::/64 dev lo metric 1024"
-        log_test $? 0 "Single path with reject route"
-
         # single path with single path using MULTIPATH attribute
         #
         add_initial_route6 "via 2001:db8:101::2"
@@ -873,12 +838,6 @@ ipv6_rt_replace_mpath()
         check_route6 "2001:db8:104::/64 via 2001:db8:101::3 dev veth1 metric 1024"
         log_test $? 0 "Multipath with single path via multipath attribute"
 
-        # multipath with reject
-        add_initial_route6 "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2"
-        run_cmd "$IP -6 ro replace unreachable 2001:db8:104::/64"
-        check_route6 "unreachable 2001:db8:104::/64 dev lo metric 1024"
-        log_test $? 0 "Multipath with reject route"
-
         # route replace fails - invalid nexthop 1
         add_initial_route6 "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2"
         run_cmd "$IP -6 ro replace 2001:db8:104::/64 nexthop via 2001:db8:111::3 nexthop via 2001:db8:103::3"
diff --git a/tools/testing/selftests/net/tcp_mmap.c b/tools/testing/selftests/net/tcp_mmap.c
index 77f762780199..e8c5dff448eb 100644
--- a/tools/testing/selftests/net/tcp_mmap.c
+++ b/tools/testing/selftests/net/tcp_mmap.c
@@ -402,7 +402,7 @@ int main(int argc, char *argv[])
                 exit(1);
         }
 
-        fd = socket(AF_INET6, SOCK_STREAM, 0);
+        fd = socket(cfg_family, SOCK_STREAM, 0);
         if (fd == -1) {
                 perror("socket");
                 exit(1);
diff --git a/tools/testing/selftests/net/udpgso_bench.sh b/tools/testing/selftests/net/udpgso_bench.sh
index 792fa4d0285e..850767befa47 100755
--- a/tools/testing/selftests/net/udpgso_bench.sh
+++ b/tools/testing/selftests/net/udpgso_bench.sh
@@ -35,9 +35,6 @@ run_udp() {
 
         echo "udp gso"
         run_in_netns ${args} -S
-
-        echo "udp gso zerocopy"
-        run_in_netns ${args} -S -z
 }
 
 run_tcp() {
diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c
index 95dd14648ba5..0f395dfb7774 100644
--- a/tools/usb/ffs-test.c
+++ b/tools/usb/ffs-test.c
@@ -44,12 +44,25 @@
 
 /******************** Little Endian Handling ********************************/
 
-#define cpu_to_le16(x)  htole16(x)
-#define cpu_to_le32(x)  htole32(x)
+/*
+ * cpu_to_le16/32 are used when initializing structures, a context where a
+ * function call is not allowed. To solve this, we code cpu_to_le16/32 in a way
+ * that allows them to be used when initializing structures.
+ */
+
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+#define cpu_to_le16(x)  (x)
+#define cpu_to_le32(x)  (x)
+#else
+#define cpu_to_le16(x)  ((((x) >> 8) & 0xffu) | (((x) & 0xffu) << 8))
+#define cpu_to_le32(x)  \
+        ((((x) & 0xff000000u) >> 24) | (((x) & 0x00ff0000u) >>  8) | \
+        (((x) & 0x0000ff00u) <<  8) | (((x) & 0x000000ffu) << 24))
+#endif
+
 #define le32_to_cpu(x)  le32toh(x)
 #define le16_to_cpu(x)  le16toh(x)
 
-
 /******************** Messages and Errors ***********************************/
 
 static const char argv0[] = "ffs-test";
diff --git a/tools/virtio/asm/barrier.h b/tools/virtio/asm/barrier.h
index 0ac3caf90877..d0351f83aebe 100644
--- a/tools/virtio/asm/barrier.h
+++ b/tools/virtio/asm/barrier.h
@@ -13,8 +13,8 @@
 } while (0);
 /* Weak barriers should be used. If not - it's a bug */
 # define mb() abort()
-# define rmb() abort()
-# define wmb() abort()
+# define dma_rmb() abort()
+# define dma_wmb() abort()
 #else
 #error Please fill in barrier macros
 #endif
diff --git a/tools/virtio/linux/kernel.h b/tools/virtio/linux/kernel.h
index fca8381bbe04..fb22bccfbc8a 100644
--- a/tools/virtio/linux/kernel.h
+++ b/tools/virtio/linux/kernel.h
@@ -52,6 +52,11 @@ static inline void *kmalloc(size_t s, gfp_t gfp)
                 return __kmalloc_fake;
         return malloc(s);
 }
+static inline void *kmalloc_array(unsigned n, size_t s, gfp_t gfp)
+{
+        return kmalloc(n * s, gfp);
+}
+
 static inline void *kzalloc(size_t s, gfp_t gfp)
 {
         void *p = kmalloc(s, gfp);
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index 90d30fbe95ae..b20b751286fc 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -119,8 +119,12 @@ irqfd_shutdown(struct work_struct *work)
 {
         struct kvm_kernel_irqfd *irqfd =
                 container_of(work, struct kvm_kernel_irqfd, shutdown);
+        struct kvm *kvm = irqfd->kvm;
         u64 cnt;
 
+        /* Make sure irqfd has been initalized in assign path. */
+        synchronize_srcu(&kvm->irq_srcu);
+
         /*
          * Synchronize with the wait-queue and unhook ourselves to prevent
          * further events.
@@ -387,7 +391,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
 
         idx = srcu_read_lock(&kvm->irq_srcu);
         irqfd_update(kvm, irqfd);
-        srcu_read_unlock(&kvm->irq_srcu, idx);
 
         list_add_tail(&irqfd->list, &kvm->irqfds.items);
 
@@ -402,11 +405,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
         if (events & EPOLLIN)
                 schedule_work(&irqfd->inject);
 
-        /*
-         * do not drop the file until the irqfd is fully initialized, otherwise
-         * we might race against the EPOLLHUP
-         */
-        fdput(f);
 #ifdef CONFIG_HAVE_KVM_IRQ_BYPASS
         if (kvm_arch_has_irq_bypass()) {
                 irqfd->consumer.token = (void *)irqfd->eventfd;
@@ -421,6 +419,13 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
         }
 #endif
 
+        srcu_read_unlock(&kvm->irq_srcu, idx);
+
+        /*
+         * do not drop the file until the irqfd is fully initialized, otherwise
+         * we might race against the EPOLLHUP
+         */
+        fdput(f);
         return 0;
 
 fail: