Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

An ipvlan bug fix in 'net' conflicted with the abstraction away
of the IPV6 specific support in 'net-next'.

Similarly, a bug fix for mlx5 in 'net' conflicted with the flow
action conversion in 'net-next'.

Signed-off-by: David S. Miller <davem@davemloft.net>

399 files changed, 4109 insertions, 1563 deletions

diff --git a/Documentation/ABI/stable/sysfs-driver-mlxreg-io b/Documentation/ABI/stable/sysfs-driver-mlxreg-io
index 9b642669cb16..169fe08a649b 100644
--- a/Documentation/ABI/stable/sysfs-driver-mlxreg-io
+++ b/Documentation/ABI/stable/sysfs-driver-mlxreg-io
@@ -24,7 +24,7 @@ What:		/sys/devices/platform/mlxplat/mlxreg-io/hwmon/hwmon*/
                                                         cpld3_version
 
 Date:           November 2018
-KernelVersion:  4.21
+KernelVersion:  5.0
 Contact:        Vadim Pasternak <vadimpmellanox.com>
 Description:    These files show with which CPLD versions have been burned
                 on LED board.
@@ -35,7 +35,7 @@ What:		/sys/devices/platform/mlxplat/mlxreg-io/hwmon/hwmon*/
                                                         jtag_enable
 
 Date:           November 2018
-KernelVersion:  4.21
+KernelVersion:  5.0
 Contact:        Vadim Pasternak <vadimpmellanox.com>
 Description:    These files enable and disable the access to the JTAG domain.
                 By default access to the JTAG domain is disabled.
@@ -105,7 +105,7 @@ What:		/sys/devices/platform/mlxplat/mlxreg-io/hwmon/hwmon*/
                                                 reset_voltmon_upgrade_fail
 
 Date:           November 2018
-KernelVersion:  4.21
+KernelVersion:  5.0
 Contact:        Vadim Pasternak <vadimpmellanox.com>
 Description:    These files show the system reset cause, as following: ComEx
                 power fail, reset from ComEx, system platform reset, reset
diff --git a/Documentation/devicetree/bindings/Makefile b/Documentation/devicetree/bindings/Makefile
index 6e5cef0ed6fb..50daa0b3b032 100644
--- a/Documentation/devicetree/bindings/Makefile
+++ b/Documentation/devicetree/bindings/Makefile
@@ -17,7 +17,11 @@ extra-y += $(DT_TMP_SCHEMA)
 quiet_cmd_mk_schema = SCHEMA  $@
       cmd_mk_schema = $(DT_MK_SCHEMA) $(DT_MK_SCHEMA_FLAGS) -o $@ $(filter-out FORCE, $^)
 
-DT_DOCS = $(shell cd $(srctree)/$(src) && find * -name '*.yaml')
+DT_DOCS = $(shell \
+        cd $(srctree)/$(src) && \
+        find * \( -name '*.yaml' ! -name $(DT_TMP_SCHEMA) \) \
+        )
+
 DT_SCHEMA_FILES ?= $(addprefix $(src)/,$(DT_DOCS))
 
 extra-y += $(patsubst $(src)/%.yaml,%.example.dts, $(DT_SCHEMA_FILES))
diff --git a/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt b/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt
index 36603419d6f8..0e72183f52bc 100644
--- a/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt
+++ b/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt
@@ -4,14 +4,10 @@ Required properties:
 - compatible : "olpc,ap-sp"
 - reg : base address and length of SoC's WTM registers
 - interrupts : SP-AP interrupt
-- clocks : phandle + clock-specifier for the clock that drives the WTM
-- clock-names:  should be "sp"
 
 Example:
         ap-sp@d4290000 {
                 compatible = "olpc,ap-sp";
                 reg = <0xd4290000 0x1000>;
                 interrupts = <40>;
-                clocks = <&soc_clocks MMP2_CLK_SP>;
-                clock-names = "sp";
         }
diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
index 819caf8ca05f..58649bd4fcfc 100644
--- a/Documentation/sysctl/fs.txt
+++ b/Documentation/sysctl/fs.txt
@@ -56,26 +56,32 @@ of any kernel data structures.
 
 dentry-state:
 
-From linux/fs/dentry.c:
+From linux/include/linux/dcache.h:
 --------------------------------------------------------------
-struct {
+struct dentry_stat_t dentry_stat {
         int nr_dentry;
         int nr_unused;
         int age_limit;         /* age in seconds */
         int want_pages;        /* pages requested by system */
-        int dummy[2];
-} dentry_stat = {0, 0, 45, 0,};
--------------------------------------------------------------- 
-
-Dentries are dynamically allocated and deallocated, and
-nr_dentry seems to be 0 all the time. Hence it's safe to
-assume that only nr_unused, age_limit and want_pages are
-used. Nr_unused seems to be exactly what its name says.
+        int nr_negative;       /* # of unused negative dentries */
+        int dummy;             /* Reserved for future use */
+};
+--------------------------------------------------------------
+
+Dentries are dynamically allocated and deallocated.
+
+nr_dentry shows the total number of dentries allocated (active
++ unused). nr_unused shows the number of dentries that are not
+actively used, but are saved in the LRU list for future reuse.
+
 Age_limit is the age in seconds after which dcache entries
 can be reclaimed when memory is short and want_pages is
 nonzero when shrink_dcache_pages() has been called and the
 dcache isn't pruned yet.
 
+nr_negative shows the number of unused dentries that are also
+negative dentries which do not mapped to actual files.
+
 ==============================================================
 
 dquot-max & dquot-nr:
diff --git a/Documentation/x86/resctrl_ui.txt b/Documentation/x86/resctrl_ui.txt
index e8e8d14d3c4e..c1f95b59e14d 100644
--- a/Documentation/x86/resctrl_ui.txt
+++ b/Documentation/x86/resctrl_ui.txt
@@ -9,7 +9,7 @@ Fenghua Yu <fenghua.yu@intel.com>
 Tony Luck <tony.luck@intel.com>
 Vikas Shivappa <vikas.shivappa@intel.com>
 
-This feature is enabled by the CONFIG_X86_RESCTRL and the x86 /proc/cpuinfo
+This feature is enabled by the CONFIG_X86_CPU_RESCTRL and the x86 /proc/cpuinfo
 flag bits:
 RDT (Resource Director Technology) Allocation - "rdt_a"
 CAT (Cache Allocation Technology) - "cat_l3", "cat_l2"
diff --git a/MAINTAINERS b/MAINTAINERS
index b4491132b9ce..604bca2fc05d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2848,6 +2848,9 @@ F:	include/uapi/linux/if_bonding.h
 BPF (Safe dynamic programs and tools)
 M:      Alexei Starovoitov <ast@kernel.org>
 M:      Daniel Borkmann <daniel@iogearbox.net>
+R:      Martin KaFai Lau <kafai@fb.com>
+R:      Song Liu <songliubraving@fb.com>
+R:      Yonghong Song <yhs@fb.com>
 L:      netdev@vger.kernel.org
 L:      linux-kernel@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
@@ -2873,6 +2876,8 @@ F:	samples/bpf/
 F:      tools/bpf/
 F:      tools/lib/bpf/
 F:      tools/testing/selftests/bpf/
+K:      bpf
+N:      bpf
 
 BPF JIT for ARM
 M:      Shubham Bansal <illusionist.neo@gmail.com>
@@ -12890,6 +12895,13 @@ F:	Documentation/devicetree/bindings/net/dsa/realtek-smi.txt
 F:      drivers/net/dsa/realtek-smi*
 F:      drivers/net/dsa/rtl83*
 
+REDPINE WIRELESS DRIVER
+M:      Amitkumar Karwar <amitkarwar@gmail.com>
+M:      Siva Rebbagondla <siva8118@gmail.com>
+L:      linux-wireless@vger.kernel.org
+S:      Maintained
+F:      drivers/net/wireless/rsi/
+
 REGISTER MAP ABSTRACTION
 M:      Mark Brown <broonie@kernel.org>
 L:      linux-kernel@vger.kernel.org
@@ -13718,6 +13730,15 @@ L:	netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/sfc/
 
+SFF/SFP/SFP+ MODULE SUPPORT
+M:      Russell King <linux@armlinux.org.uk>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      drivers/net/phy/phylink.c
+F:      drivers/net/phy/sfp*
+F:      include/linux/phylink.h
+F:      include/linux/sfp.h
+
 SGI GRU DRIVER
 M:      Dimitri Sivanich <sivanich@sgi.com>
 S:      Maintained
@@ -16663,6 +16684,15 @@ S:	Maintained
 F:      drivers/platform/x86/
 F:      drivers/platform/olpc/
 
+X86 PLATFORM DRIVERS - ARCH
+R:      Darren Hart <dvhart@infradead.org>
+R:      Andy Shevchenko <andy@infradead.org>
+L:      platform-driver-x86@vger.kernel.org
+L:      x86@kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git x86/core
+S:      Maintained
+F:      arch/x86/platform
+
 X86 VDSO
 M:      Andy Lutomirski <luto@kernel.org>
 L:      linux-kernel@vger.kernel.org
diff --git a/Makefile b/Makefile
index 141653226f3c..3142e67d03f1 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 0
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 NAME = Shy Crocodile
 
 # *DOCUMENTATION*
diff --git a/arch/arm/mach-cns3xxx/pcie.c b/arch/arm/mach-cns3xxx/pcie.c
index 318394ed5c7a..95a11d5b3587 100644
--- a/arch/arm/mach-cns3xxx/pcie.c
+++ b/arch/arm/mach-cns3xxx/pcie.c
@@ -83,7 +83,7 @@ static void __iomem *cns3xxx_pci_map_bus(struct pci_bus *bus,
         } else /* remote PCI bus */
                 base = cnspci->cfg1_regs + ((busno & 0xf) << 20);
 
-        return base + (where & 0xffc) + (devfn << 12);
+        return base + where + (devfn << 12);
 }
 
 static int cns3xxx_pci_read_config(struct pci_bus *bus, unsigned int devfn,
@@ -93,7 +93,7 @@ static int cns3xxx_pci_read_config(struct pci_bus *bus, unsigned int devfn,
         u32 mask = (0x1ull << (size * 8)) - 1;
         int shift = (where % 4) * 8;
 
-        ret = pci_generic_config_read32(bus, devfn, where, size, val);
+        ret = pci_generic_config_read(bus, devfn, where, size, val);
 
         if (ret == PCIBIOS_SUCCESSFUL && !bus->number && !devfn &&
             (where & 0xffc) == PCI_CLASS_REVISION)
diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
index 29cdc99688f3..9859e1178e6b 100644
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -299,8 +299,10 @@ int swsusp_arch_suspend(void)
                 dcache_clean_range(__idmap_text_start, __idmap_text_end);
 
                 /* Clean kvm setup code to PoC? */
-                if (el2_reset_needed())
+                if (el2_reset_needed()) {
                         dcache_clean_range(__hyp_idmap_text_start, __hyp_idmap_text_end);
+                        dcache_clean_range(__hyp_text_start, __hyp_text_end);
+                }
 
                 /* make the crash dump kernel image protected again */
                 crash_post_resume();
diff --git a/arch/arm64/kernel/hyp-stub.S b/arch/arm64/kernel/hyp-stub.S
index e1261fbaa374..17f325ba831e 100644
--- a/arch/arm64/kernel/hyp-stub.S
+++ b/arch/arm64/kernel/hyp-stub.S
@@ -28,6 +28,8 @@
 #include <asm/virt.h>
 
         .text
+        .pushsection    .hyp.text, "ax"
+
         .align 11
 
 ENTRY(__hyp_stub_vectors)
diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c
index ba6b41790fcd..b09b6f75f759 100644
--- a/arch/arm64/kernel/kaslr.c
+++ b/arch/arm64/kernel/kaslr.c
@@ -88,6 +88,7 @@ u64 __init kaslr_early_init(u64 dt_phys)
          * we end up running with module randomization disabled.
          */
         module_alloc_base = (u64)_etext - MODULES_VSIZE;
+        __flush_dcache_area(&module_alloc_base, sizeof(module_alloc_base));
 
         /*
          * Try to map the FDT early. If this fails, we simply bail,
diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
index 2a5b338b2542..f17afb99890c 100644
--- a/arch/arm64/kernel/probes/kprobes.c
+++ b/arch/arm64/kernel/probes/kprobes.c
@@ -478,13 +478,13 @@ bool arch_within_kprobe_blacklist(unsigned long addr)
             addr < (unsigned long)__entry_text_end) ||
             (addr >= (unsigned long)__idmap_text_start &&
             addr < (unsigned long)__idmap_text_end) ||
+            (addr >= (unsigned long)__hyp_text_start &&
+            addr < (unsigned long)__hyp_text_end) ||
             !!search_exception_tables(addr))
                 return true;
 
         if (!is_kernel_in_hyp_mode()) {
-                if ((addr >= (unsigned long)__hyp_text_start &&
-                    addr < (unsigned long)__hyp_text_end) ||
-                    (addr >= (unsigned long)__hyp_idmap_text_start &&
+                if ((addr >= (unsigned long)__hyp_idmap_text_start &&
                     addr < (unsigned long)__hyp_idmap_text_end))
                         return true;
         }
diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c
index 30695a868107..5c9073bace83 100644
--- a/arch/arm64/mm/flush.c
+++ b/arch/arm64/mm/flush.c
@@ -33,7 +33,11 @@ void sync_icache_aliases(void *kaddr, unsigned long len)
                 __clean_dcache_area_pou(kaddr, len);
                 __flush_icache_all();
         } else {
-                flush_icache_range(addr, addr + len);
+                /*
+                 * Don't issue kick_all_cpus_sync() after I-cache invalidation
+                 * for user mappings.
+                 */
+                __flush_icache_range(addr, addr + len);
         }
 }
 
diff --git a/arch/c6x/include/asm/Kbuild b/arch/c6x/include/asm/Kbuild
index 33a2c94fed0d..63b4a1705182 100644
--- a/arch/c6x/include/asm/Kbuild
+++ b/arch/c6x/include/asm/Kbuild
@@ -30,6 +30,7 @@ generic-y += pgalloc.h
 generic-y += preempt.h
 generic-y += segment.h
 generic-y += serial.h
+generic-y += shmparam.h
 generic-y += tlbflush.h
 generic-y += topology.h
 generic-y += trace_clock.h
diff --git a/arch/c6x/include/uapi/asm/Kbuild b/arch/c6x/include/uapi/asm/Kbuild
index 6c6f6301012e..0febf1a07c30 100644
--- a/arch/c6x/include/uapi/asm/Kbuild
+++ b/arch/c6x/include/uapi/asm/Kbuild
@@ -1,5 +1,4 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += kvm_para.h
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/h8300/include/asm/Kbuild b/arch/h8300/include/asm/Kbuild
index cd400d353d18..961c1dc064e1 100644
--- a/arch/h8300/include/asm/Kbuild
+++ b/arch/h8300/include/asm/Kbuild
@@ -40,6 +40,7 @@ generic-y += preempt.h
 generic-y += scatterlist.h
 generic-y += sections.h
 generic-y += serial.h
+generic-y += shmparam.h
 generic-y += sizes.h
 generic-y += spinlock.h
 generic-y += timex.h
diff --git a/arch/h8300/include/uapi/asm/Kbuild b/arch/h8300/include/uapi/asm/Kbuild
index 6c6f6301012e..0febf1a07c30 100644
--- a/arch/h8300/include/uapi/asm/Kbuild
+++ b/arch/h8300/include/uapi/asm/Kbuild
@@ -1,5 +1,4 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += kvm_para.h
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/hexagon/include/asm/Kbuild b/arch/hexagon/include/asm/Kbuild
index 47c4da3d64a4..b25fd42aa0f4 100644
--- a/arch/hexagon/include/asm/Kbuild
+++ b/arch/hexagon/include/asm/Kbuild
@@ -30,6 +30,7 @@ generic-y += rwsem.h
 generic-y += sections.h
 generic-y += segment.h
 generic-y += serial.h
+generic-y += shmparam.h
 generic-y += sizes.h
 generic-y += topology.h
 generic-y += trace_clock.h
diff --git a/arch/hexagon/include/uapi/asm/Kbuild b/arch/hexagon/include/uapi/asm/Kbuild
index 61d955c1747a..c1b06dcf6cf8 100644
--- a/arch/hexagon/include/uapi/asm/Kbuild
+++ b/arch/hexagon/include/uapi/asm/Kbuild
@@ -1,4 +1,3 @@
 include include/uapi/asm-generic/Kbuild.asm
 
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/m68k/include/asm/Kbuild b/arch/m68k/include/asm/Kbuild
index 9f1dd26903e3..95f8f631c4df 100644
--- a/arch/m68k/include/asm/Kbuild
+++ b/arch/m68k/include/asm/Kbuild
@@ -20,6 +20,7 @@ generic-y += mm-arch-hooks.h
 generic-y += percpu.h
 generic-y += preempt.h
 generic-y += sections.h
+generic-y += shmparam.h
 generic-y += spinlock.h
 generic-y += topology.h
 generic-y += trace_clock.h
diff --git a/arch/m68k/include/uapi/asm/Kbuild b/arch/m68k/include/uapi/asm/Kbuild
index b8b3525271fa..960bf1e4be53 100644
--- a/arch/m68k/include/uapi/asm/Kbuild
+++ b/arch/m68k/include/uapi/asm/Kbuild
@@ -2,4 +2,3 @@ include include/uapi/asm-generic/Kbuild.asm
 
 generated-y += unistd_32.h
 generic-y += kvm_para.h
-generic-y += shmparam.h
diff --git a/arch/microblaze/include/asm/Kbuild b/arch/microblaze/include/asm/Kbuild
index 9c7d1d25bf3d..791cc8d54d0a 100644
--- a/arch/microblaze/include/asm/Kbuild
+++ b/arch/microblaze/include/asm/Kbuild
@@ -26,6 +26,7 @@ generic-y += parport.h
 generic-y += percpu.h
 generic-y += preempt.h
 generic-y += serial.h
+generic-y += shmparam.h
 generic-y += syscalls.h
 generic-y += topology.h
 generic-y += trace_clock.h
diff --git a/arch/microblaze/include/uapi/asm/Kbuild b/arch/microblaze/include/uapi/asm/Kbuild
index 28823e3db825..97823ec46e97 100644
--- a/arch/microblaze/include/uapi/asm/Kbuild
+++ b/arch/microblaze/include/uapi/asm/Kbuild
@@ -2,5 +2,4 @@ include include/uapi/asm-generic/Kbuild.asm
 
 generated-y += unistd_32.h
 generic-y += kvm_para.h
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/openrisc/include/asm/Kbuild b/arch/openrisc/include/asm/Kbuild
index eb87cd8327c8..1f04844b6b82 100644
--- a/arch/openrisc/include/asm/Kbuild
+++ b/arch/openrisc/include/asm/Kbuild
@@ -34,6 +34,7 @@ generic-y += qrwlock_types.h
 generic-y += qrwlock.h
 generic-y += sections.h
 generic-y += segment.h
+generic-y += shmparam.h
 generic-y += string.h
 generic-y += switch_to.h
 generic-y += topology.h
diff --git a/arch/openrisc/include/uapi/asm/Kbuild b/arch/openrisc/include/uapi/asm/Kbuild
index 6c6f6301012e..0febf1a07c30 100644
--- a/arch/openrisc/include/uapi/asm/Kbuild
+++ b/arch/openrisc/include/uapi/asm/Kbuild
@@ -1,5 +1,4 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += kvm_para.h
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index e64c657060bb..bd149905a5b5 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -104,7 +104,7 @@ choice
         prompt "Base ISA"
         default ARCH_RV64I
         help
-          This selects the base ISA that this kernel will traget and must match
+          This selects the base ISA that this kernel will target and must match
           the target platform.
 
 config ARCH_RV32I
diff --git a/arch/riscv/configs/defconfig b/arch/riscv/configs/defconfig
index f399659d3b8d..2fd3461e50ab 100644
--- a/arch/riscv/configs/defconfig
+++ b/arch/riscv/configs/defconfig
@@ -13,8 +13,6 @@ CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_SMP=y
-CONFIG_PCI=y
-CONFIG_PCIE_XILINX=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_NET=y
@@ -28,6 +26,10 @@ CONFIG_IP_PNP_DHCP=y
 CONFIG_IP_PNP_BOOTP=y
 CONFIG_IP_PNP_RARP=y
 CONFIG_NETLINK_DIAG=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_XILINX=y
 CONFIG_DEVTMPFS=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_VIRTIO_BLK=y
@@ -63,7 +65,6 @@ CONFIG_USB_STORAGE=y
 CONFIG_USB_UAS=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_SIFIVE_PLIC=y
-CONFIG_RAS=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_AUTOFS4_FS=y
@@ -77,5 +78,6 @@ CONFIG_NFS_V4_1=y
 CONFIG_NFS_V4_2=y
 CONFIG_ROOT_NFS=y
 CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_CRYPTO_DEV_VIRTIO=y
 CONFIG_PRINTK_TIME=y
 # CONFIG_RCU_TRACE is not set
diff --git a/arch/riscv/include/asm/page.h b/arch/riscv/include/asm/page.h
index 06cfbb3aacbb..2a546a52f02a 100644
--- a/arch/riscv/include/asm/page.h
+++ b/arch/riscv/include/asm/page.h
@@ -80,7 +80,7 @@ typedef struct page *pgtable_t;
 #define __pgd(x)        ((pgd_t) { (x) })
 #define __pgprot(x)     ((pgprot_t) { (x) })
 
-#ifdef CONFIG_64BITS
+#ifdef CONFIG_64BIT
 #define PTE_FMT "%016lx"
 #else
 #define PTE_FMT "%08lx"
diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/processor.h
index 0531f49af5c3..ce70bceb8872 100644
--- a/arch/riscv/include/asm/processor.h
+++ b/arch/riscv/include/asm/processor.h
@@ -22,7 +22,7 @@
  * This decides where the kernel will search for a free chunk of vm
  * space during mmap's.
  */
-#define TASK_UNMAPPED_BASE      PAGE_ALIGN(TASK_SIZE >> 1)
+#define TASK_UNMAPPED_BASE      PAGE_ALIGN(TASK_SIZE / 3)
 
 #define STACK_TOP               TASK_SIZE
 #define STACK_TOP_MAX           STACK_TOP
diff --git a/arch/riscv/kernel/asm-offsets.c b/arch/riscv/kernel/asm-offsets.c
index 6a92a2fe198e..dac98348c6a3 100644
--- a/arch/riscv/kernel/asm-offsets.c
+++ b/arch/riscv/kernel/asm-offsets.c
@@ -39,6 +39,7 @@ void asm_offsets(void)
         OFFSET(TASK_STACK, task_struct, stack);
         OFFSET(TASK_TI, task_struct, thread_info);
         OFFSET(TASK_TI_FLAGS, task_struct, thread_info.flags);
+        OFFSET(TASK_TI_PREEMPT_COUNT, task_struct, thread_info.preempt_count);
         OFFSET(TASK_TI_KERNEL_SP, task_struct, thread_info.kernel_sp);
         OFFSET(TASK_TI_USER_SP, task_struct, thread_info.user_sp);
         OFFSET(TASK_TI_CPU, task_struct, thread_info.cpu);
diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
index 355166f57205..fd9b57c8b4ce 100644
--- a/arch/riscv/kernel/entry.S
+++ b/arch/riscv/kernel/entry.S
@@ -144,6 +144,10 @@ _save_context:
         REG_L x2,  PT_SP(sp)
         .endm
 
+#if !IS_ENABLED(CONFIG_PREEMPT)
+.set resume_kernel, restore_all
+#endif
+
 ENTRY(handle_exception)
         SAVE_ALL
 
@@ -228,7 +232,7 @@ ret_from_exception:
         REG_L s0, PT_SSTATUS(sp)
         csrc sstatus, SR_SIE
         andi s0, s0, SR_SPP
-        bnez s0, restore_all
+        bnez s0, resume_kernel
 
 resume_userspace:
         /* Interrupts must be disabled here so flags are checked atomically */
@@ -250,6 +254,18 @@ restore_all:
         RESTORE_ALL
         sret
 
+#if IS_ENABLED(CONFIG_PREEMPT)
+resume_kernel:
+        REG_L s0, TASK_TI_PREEMPT_COUNT(tp)
+        bnez s0, restore_all
+need_resched:
+        REG_L s0, TASK_TI_FLAGS(tp)
+        andi s0, s0, _TIF_NEED_RESCHED
+        beqz s0, restore_all
+        call preempt_schedule_irq
+        j need_resched
+#endif
+
 work_pending:
         /* Enter slow path for supplementary processing */
         la ra, ret_from_exception
diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
index 6e079e94b638..77564310235f 100644
--- a/arch/riscv/kernel/setup.c
+++ b/arch/riscv/kernel/setup.c
@@ -181,7 +181,7 @@ static void __init setup_bootmem(void)
         BUG_ON(mem_size == 0);
 
         set_max_mapnr(PFN_DOWN(mem_size));
-        max_low_pfn = memblock_end_of_DRAM();
+        max_low_pfn = PFN_DOWN(memblock_end_of_DRAM());
 
 #ifdef CONFIG_BLK_DEV_INITRD
         setup_initrd();
diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c
index fc185ecabb0a..18cda0e8cf94 100644
--- a/arch/riscv/kernel/smpboot.c
+++ b/arch/riscv/kernel/smpboot.c
@@ -57,15 +57,12 @@ void __init setup_smp(void)
 
         while ((dn = of_find_node_by_type(dn, "cpu"))) {
                 hart = riscv_of_processor_hartid(dn);
-                if (hart < 0) {
-                        of_node_put(dn);
+                if (hart < 0)
                         continue;
-                }
 
                 if (hart == cpuid_to_hartid_map(0)) {
                         BUG_ON(found_boot_cpu);
                         found_boot_cpu = 1;
-                        of_node_put(dn);
                         continue;
                 }
 
@@ -73,7 +70,6 @@ void __init setup_smp(void)
                 set_cpu_possible(cpuid, true);
                 set_cpu_present(cpuid, true);
                 cpuid++;
-                of_node_put(dn);
         }
 
         BUG_ON(!found_boot_cpu);
diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index 1d9bfaff60bc..658ebf645f42 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -28,7 +28,8 @@ static void __init zone_sizes_init(void)
         unsigned long max_zone_pfns[MAX_NR_ZONES] = { 0, };
 
 #ifdef CONFIG_ZONE_DMA32
-        max_zone_pfns[ZONE_DMA32] = PFN_DOWN(min(4UL * SZ_1G, max_low_pfn));
+        max_zone_pfns[ZONE_DMA32] = PFN_DOWN(min(4UL * SZ_1G,
+                        (unsigned long) PFN_PHYS(max_low_pfn)));
 #endif
         max_zone_pfns[ZONE_NORMAL] = max_low_pfn;
 
diff --git a/arch/unicore32/include/asm/Kbuild b/arch/unicore32/include/asm/Kbuild
index 1372553dc0a9..1d1544b6ca74 100644
--- a/arch/unicore32/include/asm/Kbuild
+++ b/arch/unicore32/include/asm/Kbuild
@@ -28,6 +28,7 @@ generic-y += preempt.h
 generic-y += sections.h
 generic-y += segment.h
 generic-y += serial.h
+generic-y += shmparam.h
 generic-y += sizes.h
 generic-y += syscalls.h
 generic-y += topology.h
diff --git a/arch/unicore32/include/uapi/asm/Kbuild b/arch/unicore32/include/uapi/asm/Kbuild
index 6c6f6301012e..0febf1a07c30 100644
--- a/arch/unicore32/include/uapi/asm/Kbuild
+++ b/arch/unicore32/include/uapi/asm/Kbuild
@@ -1,5 +1,4 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += kvm_para.h
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 26387c7bf305..68261430fe6e 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -446,12 +446,12 @@ config RETPOLINE
           branches. Requires a compiler with -mindirect-branch=thunk-extern
           support for full protection. The kernel may run slower.
 
-config X86_RESCTRL
-        bool "Resource Control support"
+config X86_CPU_RESCTRL
+        bool "x86 CPU resource control support"
         depends on X86 && (CPU_SUP_INTEL || CPU_SUP_AMD)
         select KERNFS
         help
-          Enable Resource Control support.
+          Enable x86 CPU resource control support.
 
           Provide support for the allocation and monitoring of system resources
           usage by the CPU.
diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
index 64037895b085..f105ae8651c9 100644
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -600,6 +600,14 @@ ENTRY(trampoline_32bit_src)
         leal    TRAMPOLINE_32BIT_PGTABLE_OFFSET(%ecx), %eax
         movl    %eax, %cr3
 3:
+        /* Set EFER.LME=1 as a precaution in case hypervsior pulls the rug */
+        pushl   %ecx
+        movl    $MSR_EFER, %ecx
+        rdmsr
+        btsl    $_EFER_LME, %eax
+        wrmsr
+        popl    %ecx
+
         /* Enable PAE and LA57 (if required) paging modes */
         movl    $X86_CR4_PAE, %eax
         cmpl    $0, %edx
diff --git a/arch/x86/boot/compressed/pgtable.h b/arch/x86/boot/compressed/pgtable.h
index 91f75638f6e6..6ff7e81b5628 100644
--- a/arch/x86/boot/compressed/pgtable.h
+++ b/arch/x86/boot/compressed/pgtable.h
@@ -6,7 +6,7 @@
 #define TRAMPOLINE_32BIT_PGTABLE_OFFSET 0
 
 #define TRAMPOLINE_32BIT_CODE_OFFSET    PAGE_SIZE
-#define TRAMPOLINE_32BIT_CODE_SIZE      0x60
+#define TRAMPOLINE_32BIT_CODE_SIZE      0x70
 
 #define TRAMPOLINE_32BIT_STACK_END      TRAMPOLINE_32BIT_SIZE
 
diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
index 0dd6b0f4000e..d9a9993af882 100644
--- a/arch/x86/include/asm/intel-family.h
+++ b/arch/x86/include/asm/intel-family.h
@@ -6,7 +6,7 @@
  * "Big Core" Processors (Branded as Core, Xeon, etc...)
  *
  * The "_X" parts are generally the EP and EX Xeons, or the
- * "Extreme" ones, like Broadwell-E.
+ * "Extreme" ones, like Broadwell-E, or Atom microserver.
  *
  * While adding a new CPUID for a new microarchitecture, add a new
  * group to keep logically sorted out in chronological order. Within
@@ -71,6 +71,7 @@
 #define INTEL_FAM6_ATOM_GOLDMONT        0x5C /* Apollo Lake */
 #define INTEL_FAM6_ATOM_GOLDMONT_X      0x5F /* Denverton */
 #define INTEL_FAM6_ATOM_GOLDMONT_PLUS   0x7A /* Gemini Lake */
+#define INTEL_FAM6_ATOM_TREMONT_X       0x86 /* Jacobsville */
 
 /* Xeon Phi */
 
diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
index 8f657286d599..0ce558a8150d 100644
--- a/arch/x86/include/asm/page_64_types.h
+++ b/arch/x86/include/asm/page_64_types.h
@@ -7,7 +7,11 @@
 #endif
 
 #ifdef CONFIG_KASAN
+#ifdef CONFIG_KASAN_EXTRA
+#define KASAN_STACK_ORDER 2
+#else
 #define KASAN_STACK_ORDER 1
+#endif
 #else
 #define KASAN_STACK_ORDER 0
 #endif
diff --git a/arch/x86/include/asm/resctrl_sched.h b/arch/x86/include/asm/resctrl_sched.h
index 40ebddde6ac2..f6b7fe2833cc 100644
--- a/arch/x86/include/asm/resctrl_sched.h
+++ b/arch/x86/include/asm/resctrl_sched.h
@@ -2,7 +2,7 @@
 #ifndef _ASM_X86_RESCTRL_SCHED_H
 #define _ASM_X86_RESCTRL_SCHED_H
 
-#ifdef CONFIG_X86_RESCTRL
+#ifdef CONFIG_X86_CPU_RESCTRL
 
 #include <linux/sched.h>
 #include <linux/jump_label.h>
@@ -88,6 +88,6 @@ static inline void resctrl_sched_in(void)
 
 static inline void resctrl_sched_in(void) {}
 
-#endif /* CONFIG_X86_RESCTRL */
+#endif /* CONFIG_X86_CPU_RESCTRL */
 
 #endif /* _ASM_X86_RESCTRL_SCHED_H */
diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
index b6fa0869f7aa..cfd24f9f7614 100644
--- a/arch/x86/kernel/cpu/Makefile
+++ b/arch/x86/kernel/cpu/Makefile
@@ -39,7 +39,7 @@ obj-$(CONFIG_CPU_SUP_UMC_32)		+= umc.o
 obj-$(CONFIG_X86_MCE)                   += mce/
 obj-$(CONFIG_MTRR)                      += mtrr/
 obj-$(CONFIG_MICROCODE)                 += microcode/
-obj-$(CONFIG_X86_RESCTRL)               += resctrl/
+obj-$(CONFIG_X86_CPU_RESCTRL)           += resctrl/
 
 obj-$(CONFIG_X86_LOCAL_APIC)            += perfctr-watchdog.o
 
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 1de0f4170178..01874d54f4fd 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -71,7 +71,7 @@ void __init check_bugs(void)
          * identify_boot_cpu() initialized SMT support information, let the
          * core code know.
          */
-        cpu_smt_check_topology_early();
+        cpu_smt_check_topology();
 
         if (!IS_ENABLED(CONFIG_SMP)) {
                 pr_info("CPU: ");
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 51adde0a0f1a..e1f3ba19ba54 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -855,7 +855,7 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
         if (!p) {
                 return ret;
         } else {
-                if (boot_cpu_data.microcode == p->patch_id)
+                if (boot_cpu_data.microcode >= p->patch_id)
                         return ret;
 
                 ret = UCODE_NEW;
diff --git a/arch/x86/kernel/cpu/resctrl/Makefile b/arch/x86/kernel/cpu/resctrl/Makefile
index 1cabe6fd8e11..4a06c37b9cf1 100644
--- a/arch/x86/kernel/cpu/resctrl/Makefile
+++ b/arch/x86/kernel/cpu/resctrl/Makefile
@@ -1,4 +1,4 @@
 # SPDX-License-Identifier: GPL-2.0
-obj-$(CONFIG_X86_RESCTRL)       += core.o rdtgroup.o monitor.o
-obj-$(CONFIG_X86_RESCTRL)       += ctrlmondata.o pseudo_lock.o
+obj-$(CONFIG_X86_CPU_RESCTRL)   += core.o rdtgroup.o monitor.o
+obj-$(CONFIG_X86_CPU_RESCTRL)   += ctrlmondata.o pseudo_lock.o
 CFLAGS_pseudo_lock.o = -I$(src)
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 0d5efa34f359..53917a3ebf94 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -167,6 +167,9 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr,
         struct efi_info *current_ei = &boot_params.efi_info;
         struct efi_info *ei = &params->efi_info;
 
+        if (!efi_enabled(EFI_RUNTIME_SERVICES))
+                return 0;
+
         if (!current_ei->efi_memmap_size)
                 return 0;
 
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 8ff20523661b..d8ea4ebd79e7 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -211,6 +211,7 @@ static void free_nested(struct kvm_vcpu *vcpu)
         if (!vmx->nested.vmxon && !vmx->nested.smm.vmxon)
                 return;
 
+        hrtimer_cancel(&vmx->nested.preemption_timer);
         vmx->nested.vmxon = false;
         vmx->nested.smm.vmxon = false;
         free_vpid(vmx->nested.vpid02);
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 4341175339f3..95d618045001 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -26,6 +26,7 @@
 #include <linux/mod_devicetable.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
+#include <linux/sched/smt.h>
 #include <linux/slab.h>
 #include <linux/tboot.h>
 #include <linux/trace_events.h>
@@ -6823,7 +6824,7 @@ static int vmx_vm_init(struct kvm *kvm)
                          * Warn upon starting the first VM in a potentially
                          * insecure environment.
                          */
-                        if (cpu_smt_control == CPU_SMT_ENABLED)
+                        if (sched_smt_active())
                                 pr_warn_once(L1TF_MSG_SMT);
                         if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER)
                                 pr_warn_once(L1TF_MSG_L1D);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 3d27206f6c01..e67ecf25e690 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5116,6 +5116,13 @@ int kvm_read_guest_virt(struct kvm_vcpu *vcpu,
 {
         u32 access = (kvm_x86_ops->get_cpl(vcpu) == 3) ? PFERR_USER_MASK : 0;
 
+        /*
+         * FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED
+         * is returned, but our callers are not ready for that and they blindly
+         * call kvm_inject_page_fault.  Ensure that they at least do not leak
+         * uninitialized kernel stack memory into cr2 and error code.
+         */
+        memset(exception, 0, sizeof(*exception));
         return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access,
                                           exception);
 }
diff --git a/arch/x86/lib/iomem.c b/arch/x86/lib/iomem.c
index 66894675f3c8..df50451d94ef 100644
--- a/arch/x86/lib/iomem.c
+++ b/arch/x86/lib/iomem.c
@@ -2,8 +2,11 @@
 #include <linux/module.h>
 #include <linux/io.h>
 
+#define movs(type,to,from) \
+        asm volatile("movs" type:"=&D" (to), "=&S" (from):"0" (to), "1" (from):"memory")
+
 /* Originally from i386/string.h */
-static __always_inline void __iomem_memcpy(void *to, const void *from, size_t n)
+static __always_inline void rep_movs(void *to, const void *from, size_t n)
 {
         unsigned long d0, d1, d2;
         asm volatile("rep ; movsl\n\t"
@@ -21,13 +24,37 @@ static __always_inline void __iomem_memcpy(void *to, const void *from, size_t n)
 
 void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
 {
-        __iomem_memcpy(to, (const void *)from, n);
+        if (unlikely(!n))
+                return;
+
+        /* Align any unaligned source IO */
+        if (unlikely(1 & (unsigned long)from)) {
+                movs("b", to, from);
+                n--;
+        }
+        if (n > 1 && unlikely(2 & (unsigned long)from)) {
+                movs("w", to, from);
+                n-=2;
+        }
+        rep_movs(to, (const void *)from, n);
 }
 EXPORT_SYMBOL(memcpy_fromio);
 
 void memcpy_toio(volatile void __iomem *to, const void *from, size_t n)
 {
-        __iomem_memcpy((void *)to, (const void *) from, n);
+        if (unlikely(!n))
+                return;
+
+        /* Align any unaligned destination IO */
+        if (unlikely(1 & (unsigned long)to)) {
+                movs("b", to, from);
+                n--;
+        }
+        if (n > 1 && unlikely(2 & (unsigned long)to)) {
+                movs("w", to, from);
+                n-=2;
+        }
+        rep_movs((void *)to, (const void *) from, n);
 }
 EXPORT_SYMBOL(memcpy_toio);
 
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 2ff25ad33233..9d5c75f02295 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -595,7 +595,7 @@ static void show_ldttss(const struct desc_ptr *gdt, const char *name, u16 index)
                 return;
         }
 
-        addr = desc.base0 | (desc.base1 << 16) | (desc.base2 << 24);
+        addr = desc.base0 | (desc.base1 << 16) | ((unsigned long)desc.base2 << 24);
 #ifdef CONFIG_X86_64
         addr |= ((u64)desc.base3 << 32);
 #endif
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index 20a0756f27ef..ce91682770cb 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -164,7 +164,7 @@ config XTENSA_FAKE_NMI
           If unsure, say N.
 
 config XTENSA_UNALIGNED_USER
-        bool "Unaligned memory access in use space"
+        bool "Unaligned memory access in user space"
         help
           The Xtensa architecture currently does not handle unaligned
           memory accesses in hardware but through an exception handler.
@@ -451,7 +451,7 @@ config USE_OF
         help
           Include support for flattened device tree machine descriptions.
 
-config BUILTIN_DTB
+config BUILTIN_DTB_SOURCE
         string "DTB to build into the kernel image"
         depends on OF
 
diff --git a/arch/xtensa/boot/dts/Makefile b/arch/xtensa/boot/dts/Makefile
index f8052ba5aea8..0b8d00cdae7c 100644
--- a/arch/xtensa/boot/dts/Makefile
+++ b/arch/xtensa/boot/dts/Makefile
@@ -7,9 +7,9 @@
 #
 #
 
-BUILTIN_DTB := $(patsubst "%",%,$(CONFIG_BUILTIN_DTB)).dtb.o
-ifneq ($(CONFIG_BUILTIN_DTB),"")
-obj-$(CONFIG_OF) += $(BUILTIN_DTB)
+BUILTIN_DTB_SOURCE := $(patsubst "%",%,$(CONFIG_BUILTIN_DTB_SOURCE)).dtb.o
+ifneq ($(CONFIG_BUILTIN_DTB_SOURCE),"")
+obj-$(CONFIG_OF) += $(BUILTIN_DTB_SOURCE)
 endif
 
 # for CONFIG_OF_ALL_DTBS test
diff --git a/arch/xtensa/configs/audio_kc705_defconfig b/arch/xtensa/configs/audio_kc705_defconfig
index 2bf964df37ba..f378e56f9ce6 100644
--- a/arch/xtensa/configs/audio_kc705_defconfig
+++ b/arch/xtensa/configs/audio_kc705_defconfig
@@ -34,7 +34,7 @@ CONFIG_XTENSA_PLATFORM_XTFPGA=y
 CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="earlycon=uart8250,mmio32native,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=0x38000000@0"
 CONFIG_USE_OF=y
-CONFIG_BUILTIN_DTB="kc705"
+CONFIG_BUILTIN_DTB_SOURCE="kc705"
 # CONFIG_COMPACTION is not set
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_PM=y
diff --git a/arch/xtensa/configs/cadence_csp_defconfig b/arch/xtensa/configs/cadence_csp_defconfig
index 3221b7053fa3..62f32a902568 100644
--- a/arch/xtensa/configs/cadence_csp_defconfig
+++ b/arch/xtensa/configs/cadence_csp_defconfig
@@ -38,7 +38,7 @@ CONFIG_HIGHMEM=y
 # CONFIG_PCI is not set
 CONFIG_XTENSA_PLATFORM_XTFPGA=y
 CONFIG_USE_OF=y
-CONFIG_BUILTIN_DTB="csp"
+CONFIG_BUILTIN_DTB_SOURCE="csp"
 # CONFIG_COMPACTION is not set
 CONFIG_XTFPGA_LCD=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
diff --git a/arch/xtensa/configs/generic_kc705_defconfig b/arch/xtensa/configs/generic_kc705_defconfig
index 985fa8546e4e..8bebe07f1060 100644
--- a/arch/xtensa/configs/generic_kc705_defconfig
+++ b/arch/xtensa/configs/generic_kc705_defconfig
@@ -33,7 +33,7 @@ CONFIG_XTENSA_PLATFORM_XTFPGA=y
 CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="earlycon=uart8250,mmio32native,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=0x38000000@0"
 CONFIG_USE_OF=y
-CONFIG_BUILTIN_DTB="kc705"
+CONFIG_BUILTIN_DTB_SOURCE="kc705"
 # CONFIG_COMPACTION is not set
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_NET=y
diff --git a/arch/xtensa/configs/nommu_kc705_defconfig b/arch/xtensa/configs/nommu_kc705_defconfig
index f3fc4f970ca8..933ab2adf434 100644
--- a/arch/xtensa/configs/nommu_kc705_defconfig
+++ b/arch/xtensa/configs/nommu_kc705_defconfig
@@ -39,7 +39,7 @@ CONFIG_XTENSA_PLATFORM_XTFPGA=y
 CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="earlycon=uart8250,mmio32native,0x9d050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=256M@0x60000000"
 CONFIG_USE_OF=y
-CONFIG_BUILTIN_DTB="kc705_nommu"
+CONFIG_BUILTIN_DTB_SOURCE="kc705_nommu"
 CONFIG_BINFMT_FLAT=y
 CONFIG_NET=y
 CONFIG_PACKET=y
diff --git a/arch/xtensa/configs/smp_lx200_defconfig b/arch/xtensa/configs/smp_lx200_defconfig
index 11fed6c06a7c..e29c5b179a5b 100644
--- a/arch/xtensa/configs/smp_lx200_defconfig
+++ b/arch/xtensa/configs/smp_lx200_defconfig
@@ -33,11 +33,12 @@ CONFIG_SMP=y
 CONFIG_HOTPLUG_CPU=y
 # CONFIG_INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX is not set
 # CONFIG_PCI is not set
+CONFIG_VECTORS_OFFSET=0x00002000
 CONFIG_XTENSA_PLATFORM_XTFPGA=y
 CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="earlycon=uart8250,mmio32native,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=96M@0"
 CONFIG_USE_OF=y
-CONFIG_BUILTIN_DTB="lx200mx"
+CONFIG_BUILTIN_DTB_SOURCE="lx200mx"
 # CONFIG_COMPACTION is not set
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_NET=y
diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S
index da08e75100ab..7f009719304e 100644
--- a/arch/xtensa/kernel/head.S
+++ b/arch/xtensa/kernel/head.S
@@ -276,12 +276,13 @@ should_never_return:
 
         movi    a2, cpu_start_ccount
 1:
+        memw
         l32i    a3, a2, 0
         beqi    a3, 0, 1b
         movi    a3, 0
         s32i    a3, a2, 0
-        memw
 1:
+        memw
         l32i    a3, a2, 0
         beqi    a3, 0, 1b
         wsr     a3, ccount
@@ -317,11 +318,13 @@ ENTRY(cpu_restart)
         rsr     a0, prid
         neg     a2, a0
         movi    a3, cpu_start_id
+        memw
         s32i    a2, a3, 0
 #if XCHAL_DCACHE_IS_WRITEBACK
         dhwbi   a3, 0
 #endif
 1:
+        memw
         l32i    a2, a3, 0
         dhi     a3, 0
         bne     a2, a0, 1b
diff --git a/arch/xtensa/kernel/smp.c b/arch/xtensa/kernel/smp.c
index 932d64689bac..be1f280c322c 100644
--- a/arch/xtensa/kernel/smp.c
+++ b/arch/xtensa/kernel/smp.c
@@ -83,7 +83,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
 {
         unsigned i;
 
-        for (i = 0; i < max_cpus; ++i)
+        for_each_possible_cpu(i)
                 set_cpu_present(i, true);
 }
 
@@ -96,6 +96,11 @@ void __init smp_init_cpus(void)
         pr_info("%s: Core Count = %d\n", __func__, ncpus);
         pr_info("%s: Core Id = %d\n", __func__, core_id);
 
+        if (ncpus > NR_CPUS) {
+                ncpus = NR_CPUS;
+                pr_info("%s: limiting core count by %d\n", __func__, ncpus);
+        }
+
         for (i = 0; i < ncpus; ++i)
                 set_cpu_possible(i, true);
 }
@@ -195,9 +200,11 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts)
         int i;
 
 #ifdef CONFIG_HOTPLUG_CPU
-        cpu_start_id = cpu;
-        system_flush_invalidate_dcache_range(
-                        (unsigned long)&cpu_start_id, sizeof(cpu_start_id));
+        WRITE_ONCE(cpu_start_id, cpu);
+        /* Pairs with the third memw in the cpu_restart */
+        mb();
+        system_flush_invalidate_dcache_range((unsigned long)&cpu_start_id,
+                                             sizeof(cpu_start_id));
 #endif
         smp_call_function_single(0, mx_cpu_start, (void *)cpu, 1);
 
@@ -206,18 +213,21 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts)
                         ccount = get_ccount();
                 while (!ccount);
 
-                cpu_start_ccount = ccount;
+                WRITE_ONCE(cpu_start_ccount, ccount);
 
-                while (time_before(jiffies, timeout)) {
+                do {
+                        /*
+                         * Pairs with the first two memws in the
+                         * .Lboot_secondary.
+                         */
                         mb();
-                        if (!cpu_start_ccount)
-                                break;
-                }
+                        ccount = READ_ONCE(cpu_start_ccount);
+                } while (ccount && time_before(jiffies, timeout));
 
-                if (cpu_start_ccount) {
+                if (ccount) {
                         smp_call_function_single(0, mx_cpu_stop,
-                                        (void *)cpu, 1);
-                        cpu_start_ccount = 0;
+                                                 (void *)cpu, 1);
+                        WRITE_ONCE(cpu_start_ccount, 0);
                         return -EIO;
                 }
         }
@@ -237,6 +247,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
         pr_debug("%s: Calling wakeup_secondary(cpu:%d, idle:%p, sp: %08lx)\n",
                         __func__, cpu, idle, start_info.stack);
 
+        init_completion(&cpu_running);
         ret = boot_secondary(cpu, idle);
         if (ret == 0) {
                 wait_for_completion_timeout(&cpu_running,
@@ -298,8 +309,10 @@ void __cpu_die(unsigned int cpu)
         unsigned long timeout = jiffies + msecs_to_jiffies(1000);
         while (time_before(jiffies, timeout)) {
                 system_invalidate_dcache_range((unsigned long)&cpu_start_id,
-                                sizeof(cpu_start_id));
-                if (cpu_start_id == -cpu) {
+                                               sizeof(cpu_start_id));
+                /* Pairs with the second memw in the cpu_restart */
+                mb();
+                if (READ_ONCE(cpu_start_id) == -cpu) {
                         platform_cpu_kill(cpu);
                         return;
                 }
diff --git a/arch/xtensa/kernel/time.c b/arch/xtensa/kernel/time.c
index fd524a54d2ab..378186b5eb40 100644
--- a/arch/xtensa/kernel/time.c
+++ b/arch/xtensa/kernel/time.c
@@ -89,7 +89,7 @@ static int ccount_timer_shutdown(struct clock_event_device *evt)
                 container_of(evt, struct ccount_timer, evt);
 
         if (timer->irq_enabled) {
-                disable_irq(evt->irq);
+                disable_irq_nosync(evt->irq);
                 timer->irq_enabled = 0;
         }
         return 0;
diff --git a/block/blk-core.c b/block/blk-core.c
index 3c5f61ceeb67..6b78ec56a4f2 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -462,6 +462,10 @@ static void blk_rq_timed_out_timer(struct timer_list *t)
         kblockd_schedule_work(&q->timeout_work);
 }
 
+static void blk_timeout_work(struct work_struct *work)
+{
+}
+
 /**
  * blk_alloc_queue_node - allocate a request queue
  * @gfp_mask: memory allocation flags
@@ -505,7 +509,7 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id)
         timer_setup(&q->backing_dev_info->laptop_mode_wb_timer,
                     laptop_mode_timer_fn, 0);
         timer_setup(&q->timeout, blk_rq_timed_out_timer, 0);
-        INIT_WORK(&q->timeout_work, NULL);
+        INIT_WORK(&q->timeout_work, blk_timeout_work);
         INIT_LIST_HEAD(&q->icq_list);
 #ifdef CONFIG_BLK_CGROUP
         INIT_LIST_HEAD(&q->blkg_list);
diff --git a/block/blk-flush.c b/block/blk-flush.c
index a3fc7191c694..6e0f2d97fc6d 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -335,7 +335,7 @@ static void mq_flush_data_end_io(struct request *rq, blk_status_t error)
         blk_flush_complete_seq(rq, fq, REQ_FSEQ_DATA, error);
         spin_unlock_irqrestore(&fq->mq_flush_lock, flags);
 
-        blk_mq_run_hw_queue(hctx, true);
+        blk_mq_sched_restart(hctx);
 }
 
 /**
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
index f8120832ca7b..7921573aebbc 100644
--- a/block/blk-mq-debugfs.c
+++ b/block/blk-mq-debugfs.c
@@ -839,6 +839,9 @@ static const struct blk_mq_debugfs_attr blk_mq_debugfs_ctx_attrs[] = {
 static bool debugfs_create_files(struct dentry *parent, void *data,
                                  const struct blk_mq_debugfs_attr *attr)
 {
+        if (IS_ERR_OR_NULL(parent))
+                return false;
+
         d_inode(parent)->i_private = data;
 
         for (; attr->name; attr++) {
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index cdfc87629efb..4d2b2ad1ee0e 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -5854,9 +5854,10 @@ static int __init init_binder_device(const char *name)
 static int __init binder_init(void)
 {
         int ret;
-        char *device_name, *device_names, *device_tmp;
+        char *device_name, *device_tmp;
         struct binder_device *device;
         struct hlist_node *tmp;
+        char *device_names = NULL;
 
         ret = binder_alloc_shrinker_init();
         if (ret)
@@ -5898,23 +5899,29 @@ static int __init binder_init(void)
                                     &transaction_log_fops);
         }
 
-        /*
-         * Copy the module_parameter string, because we don't want to
-         * tokenize it in-place.
-         */
-        device_names = kstrdup(binder_devices_param, GFP_KERNEL);
-        if (!device_names) {
-                ret = -ENOMEM;
-                goto err_alloc_device_names_failed;
-        }
+        if (strcmp(binder_devices_param, "") != 0) {
+                /*
+                * Copy the module_parameter string, because we don't want to
+                * tokenize it in-place.
+                 */
+                device_names = kstrdup(binder_devices_param, GFP_KERNEL);
+                if (!device_names) {
+                        ret = -ENOMEM;
+                        goto err_alloc_device_names_failed;
+                }
 
-        device_tmp = device_names;
-        while ((device_name = strsep(&device_tmp, ","))) {
-                ret = init_binder_device(device_name);
-                if (ret)
-                        goto err_init_binder_device_failed;
+                device_tmp = device_names;
+                while ((device_name = strsep(&device_tmp, ","))) {
+                        ret = init_binder_device(device_name);
+                        if (ret)
+                                goto err_init_binder_device_failed;
+                }
         }
 
+        ret = init_binderfs();
+        if (ret)
+                goto err_init_binder_device_failed;
+
         return ret;
 
 err_init_binder_device_failed:
diff --git a/drivers/android/binder_internal.h b/drivers/android/binder_internal.h
index 7fb97f503ef2..045b3e42d98b 100644
--- a/drivers/android/binder_internal.h
+++ b/drivers/android/binder_internal.h
@@ -46,4 +46,13 @@ static inline bool is_binderfs_device(const struct inode *inode)
 }
 #endif
 
+#ifdef CONFIG_ANDROID_BINDERFS
+extern int __init init_binderfs(void);
+#else
+static inline int __init init_binderfs(void)
+{
+        return 0;
+}
+#endif
+
 #endif /* _LINUX_BINDER_INTERNAL_H */
diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index 6a2185eb66c5..e773f45d19d9 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -395,6 +395,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
         struct inode *inode = NULL;
         struct dentry *root = sb->s_root;
         struct binderfs_info *info = sb->s_fs_info;
+#if defined(CONFIG_IPC_NS)
+        bool use_reserve = (info->ipc_ns == &init_ipc_ns);
+#else
+        bool use_reserve = true;
+#endif
 
         device = kzalloc(sizeof(*device), GFP_KERNEL);
         if (!device)
@@ -413,7 +418,10 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
 
         /* Reserve a new minor number for the new device. */
         mutex_lock(&binderfs_minors_mutex);
-        minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
+        minor = ida_alloc_max(&binderfs_minors,
+                              use_reserve ? BINDERFS_MAX_MINOR :
+                                            BINDERFS_MAX_MINOR_CAPPED,
+                              GFP_KERNEL);
         mutex_unlock(&binderfs_minors_mutex);
         if (minor < 0) {
                 ret = minor;
@@ -542,7 +550,7 @@ static struct file_system_type binder_fs_type = {
         .fs_flags       = FS_USERNS_MOUNT,
 };
 
-static int __init init_binderfs(void)
+int __init init_binderfs(void)
 {
         int ret;
 
@@ -560,5 +568,3 @@ static int __init init_binderfs(void)
 
         return ret;
 }
-
-device_initcall(init_binderfs);
diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
index cf78fa6d470d..a7359535caf5 100644
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -79,8 +79,7 @@ static void cache_size(struct cacheinfo *this_leaf, struct device_node *np)
         ct_idx = get_cacheinfo_idx(this_leaf->type);
         propname = cache_type_info[ct_idx].size_prop;
 
-        if (of_property_read_u32(np, propname, &this_leaf->size))
-                this_leaf->size = 0;
+        of_property_read_u32(np, propname, &this_leaf->size);
 }
 
 /* not cache_line_size() because that's a macro in include/linux/cache.h */
@@ -114,8 +113,7 @@ static void cache_nr_sets(struct cacheinfo *this_leaf, struct device_node *np)
         ct_idx = get_cacheinfo_idx(this_leaf->type);
         propname = cache_type_info[ct_idx].nr_sets_prop;
 
-        if (of_property_read_u32(np, propname, &this_leaf->number_of_sets))
-                this_leaf->number_of_sets = 0;
+        of_property_read_u32(np, propname, &this_leaf->number_of_sets);
 }
 
 static void cache_associativity(struct cacheinfo *this_leaf)
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 457be03b744d..0ea2139c50d8 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -130,7 +130,7 @@ u64 pm_runtime_autosuspend_expiration(struct device *dev)
 {
         int autosuspend_delay;
         u64 last_busy, expires = 0;
-        u64 now = ktime_to_ns(ktime_get());
+        u64 now = ktime_get_mono_fast_ns();
 
         if (!dev->power.use_autosuspend)
                 goto out;
@@ -909,7 +909,7 @@ static enum hrtimer_restart  pm_suspend_timer_fn(struct hrtimer *timer)
          * If 'expires' is after the current time, we've been called
          * too early.
          */
-        if (expires > 0 && expires < ktime_to_ns(ktime_get())) {
+        if (expires > 0 && expires < ktime_get_mono_fast_ns()) {
                 dev->power.timer_expires = 0;
                 rpm_suspend(dev, dev->power.timer_autosuspends ?
                     (RPM_ASYNC | RPM_AUTO) : RPM_ASYNC);
@@ -928,7 +928,7 @@ static enum hrtimer_restart  pm_suspend_timer_fn(struct hrtimer *timer)
 int pm_schedule_suspend(struct device *dev, unsigned int delay)
 {
         unsigned long flags;
-        ktime_t expires;
+        u64 expires;
         int retval;
 
         spin_lock_irqsave(&dev->power.lock, flags);
@@ -945,8 +945,8 @@ int pm_schedule_suspend(struct device *dev, unsigned int delay)
         /* Other scheduled or pending requests need to be canceled. */
         pm_runtime_cancel_pending(dev);
 
-        expires = ktime_add(ktime_get(), ms_to_ktime(delay));
-        dev->power.timer_expires = ktime_to_ns(expires);
+        expires = ktime_get_mono_fast_ns() + (u64)delay * NSEC_PER_MSEC;
+        dev->power.timer_expires = expires;
         dev->power.timer_autosuspends = 0;
         hrtimer_start(&dev->power.suspend_timer, expires, HRTIMER_MODE_ABS);
 
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 6ccdbedb02f3..d2477a5058ac 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1513,9 +1513,19 @@ static int clk_fetch_parent_index(struct clk_core *core,
         if (!parent)
                 return -EINVAL;
 
-        for (i = 0; i < core->num_parents; i++)
-                if (clk_core_get_parent_by_index(core, i) == parent)
+        for (i = 0; i < core->num_parents; i++) {
+                if (core->parents[i] == parent)
+                        return i;
+
+                if (core->parents[i])
+                        continue;
+
+                /* Fallback to comparing globally unique names */
+                if (!strcmp(parent->name, core->parent_names[i])) {
+                        core->parents[i] = parent;
                         return i;
+                }
+        }
 
         return -EINVAL;
 }
diff --git a/drivers/clk/imx/clk-frac-pll.c b/drivers/clk/imx/clk-frac-pll.c
index 0026c3969b1e..76b9eb15604e 100644
--- a/drivers/clk/imx/clk-frac-pll.c
+++ b/drivers/clk/imx/clk-frac-pll.c
@@ -155,13 +155,14 @@ static int clk_pll_set_rate(struct clk_hw *hw, unsigned long rate,
 {
         struct clk_frac_pll *pll = to_clk_frac_pll(hw);
         u32 val, divfi, divff;
-        u64 temp64 = parent_rate;
+        u64 temp64;
         int ret;
 
         parent_rate *= 8;
         rate *= 2;
         divfi = rate / parent_rate;
-        temp64 *= rate - divfi;
+        temp64 = parent_rate * divfi;
+        temp64 = rate - temp64;
         temp64 *= PLL_FRAC_DENOM;
         do_div(temp64, parent_rate);
         divff = temp64;
diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c
index 61fefc046ec5..d083b860f083 100644
--- a/drivers/clk/mmp/clk-of-mmp2.c
+++ b/drivers/clk/mmp/clk-of-mmp2.c
@@ -53,7 +53,6 @@
 #define APMU_DISP1      0x110
 #define APMU_CCIC0      0x50
 #define APMU_CCIC1      0xf4
-#define APMU_SP         0x68
 #define MPMU_UART_PLL   0x14
 
 struct mmp2_clk_unit {
@@ -210,8 +209,6 @@ static struct mmp_clk_mix_config ccic1_mix_config = {
         .reg_info = DEFINE_MIX_REG_INFO(4, 16, 2, 6, 32),
 };
 
-static DEFINE_SPINLOCK(sp_lock);
-
 static struct mmp_param_mux_clk apmu_mux_clks[] = {
         {MMP2_CLK_DISP0_MUX, "disp0_mux", disp_parent_names, ARRAY_SIZE(disp_parent_names), CLK_SET_RATE_PARENT, APMU_DISP0, 6, 2, 0, &disp0_lock},
         {MMP2_CLK_DISP1_MUX, "disp1_mux", disp_parent_names, ARRAY_SIZE(disp_parent_names), CLK_SET_RATE_PARENT, APMU_DISP1, 6, 2, 0, &disp1_lock},
@@ -242,7 +239,6 @@ static struct mmp_param_gate_clk apmu_gate_clks[] = {
         {MMP2_CLK_CCIC1, "ccic1_clk", "ccic1_mix_clk", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x1b, 0x1b, 0x0, 0, &ccic1_lock},
         {MMP2_CLK_CCIC1_PHY, "ccic1_phy_clk", "ccic1_mix_clk", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x24, 0x24, 0x0, 0, &ccic1_lock},
         {MMP2_CLK_CCIC1_SPHY, "ccic1_sphy_clk", "ccic1_sphy_div", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x300, 0x300, 0x0, 0, &ccic1_lock},
-        {MMP2_CLK_SP, "sp_clk", NULL, CLK_SET_RATE_PARENT, APMU_SP, 0x1b, 0x1b, 0x0, 0, &sp_lock},
 };
 
 static void mmp2_axi_periph_clk_init(struct mmp2_clk_unit *pxa_unit)
diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c
index c782e62dd98b..58fa5c247af1 100644
--- a/drivers/clk/qcom/gcc-sdm845.c
+++ b/drivers/clk/qcom/gcc-sdm845.c
@@ -115,8 +115,8 @@ static const char * const gcc_parent_names_6[] = {
         "core_bi_pll_test_se",
 };
 
-static const char * const gcc_parent_names_7[] = {
-        "bi_tcxo",
+static const char * const gcc_parent_names_7_ao[] = {
+        "bi_tcxo_ao",
         "gpll0",
         "gpll0_out_even",
         "core_bi_pll_test_se",
@@ -128,6 +128,12 @@ static const char * const gcc_parent_names_8[] = {
         "core_bi_pll_test_se",
 };
 
+static const char * const gcc_parent_names_8_ao[] = {
+        "bi_tcxo_ao",
+        "gpll0",
+        "core_bi_pll_test_se",
+};
+
 static const struct parent_map gcc_parent_map_10[] = {
         { P_BI_TCXO, 0 },
         { P_GPLL0_OUT_MAIN, 1 },
@@ -210,7 +216,7 @@ static struct clk_rcg2 gcc_cpuss_ahb_clk_src = {
         .freq_tbl = ftbl_gcc_cpuss_ahb_clk_src,
         .clkr.hw.init = &(struct clk_init_data){
                 .name = "gcc_cpuss_ahb_clk_src",
-                .parent_names = gcc_parent_names_7,
+                .parent_names = gcc_parent_names_7_ao,
                 .num_parents = 4,
                 .ops = &clk_rcg2_ops,
         },
@@ -229,7 +235,7 @@ static struct clk_rcg2 gcc_cpuss_rbcpr_clk_src = {
         .freq_tbl = ftbl_gcc_cpuss_rbcpr_clk_src,
         .clkr.hw.init = &(struct clk_init_data){
                 .name = "gcc_cpuss_rbcpr_clk_src",
-                .parent_names = gcc_parent_names_8,
+                .parent_names = gcc_parent_names_8_ao,
                 .num_parents = 3,
                 .ops = &clk_rcg2_ops,
         },
diff --git a/drivers/clk/ti/divider.c b/drivers/clk/ti/divider.c
index 8d77090ad94a..0241450f3eb3 100644
--- a/drivers/clk/ti/divider.c
+++ b/drivers/clk/ti/divider.c
@@ -403,8 +403,10 @@ int ti_clk_parse_divider_data(int *div_table, int num_dividers, int max_div,
         num_dividers = i;
 
         tmp = kcalloc(valid_div + 1, sizeof(*tmp), GFP_KERNEL);
-        if (!tmp)
+        if (!tmp) {
+                *table = ERR_PTR(-ENOMEM);
                 return -ENOMEM;
+        }
 
         valid_div = 0;
         *width = 0;
@@ -439,6 +441,7 @@ struct clk_hw *ti_clk_build_component_div(struct ti_clk_divider *setup)
 {
         struct clk_omap_divider *div;
         struct clk_omap_reg *reg;
+        int ret;
 
         if (!setup)
                 return NULL;
@@ -458,6 +461,12 @@ struct clk_hw *ti_clk_build_component_div(struct ti_clk_divider *setup)
                 div->flags |= CLK_DIVIDER_POWER_OF_TWO;
 
         div->table = _get_div_table_from_setup(setup, &div->width);
+        if (IS_ERR(div->table)) {
+                ret = PTR_ERR(div->table);
+                kfree(div);
+                return ERR_PTR(ret);
+        }
+
 
         div->shift = setup->bit_shift;
         div->latch = -EINVAL;
diff --git a/drivers/cpuidle/poll_state.c b/drivers/cpuidle/poll_state.c
index b17d153e724f..23a1b27579a5 100644
--- a/drivers/cpuidle/poll_state.c
+++ b/drivers/cpuidle/poll_state.c
@@ -21,7 +21,7 @@ static int __cpuidle poll_idle(struct cpuidle_device *dev,
         local_irq_enable();
         if (!current_set_polling_and_test()) {
                 unsigned int loop_count = 0;
-                u64 limit = TICK_USEC;
+                u64 limit = TICK_NSEC;
                 int i;
 
                 for (i = 1; i < drv->state_count; i++) {
diff --git a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
index fe070d75c842..4c97478d44bd 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
+++ b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
@@ -537,6 +537,8 @@ static void process_response_list(struct nitrox_cmdq *cmdq)
         struct nitrox_device *ndev = cmdq->ndev;
         struct nitrox_softreq *sr;
         int req_completed = 0, err = 0, budget;
+        completion_t callback;
+        void *cb_arg;
 
         /* check all pending requests */
         budget = atomic_read(&cmdq->pending_count);
@@ -564,13 +566,13 @@ static void process_response_list(struct nitrox_cmdq *cmdq)
                 smp_mb__after_atomic();
                 /* remove from response list */
                 response_list_del(sr, cmdq);
-
                 /* ORH error code */
                 err = READ_ONCE(*sr->resp.orh) & 0xff;
-
-                if (sr->callback)
-                        sr->callback(sr->cb_arg, err);
+                callback = sr->callback;
+                cb_arg = sr->cb_arg;
                 softreq_destroy(sr);
+                if (callback)
+                        callback(cb_arg, err);
 
                 req_completed++;
         }
diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c
index 23ea1ed409d1..352bd2473162 100644
--- a/drivers/firmware/efi/arm-runtime.c
+++ b/drivers/firmware/efi/arm-runtime.c
@@ -37,8 +37,9 @@ extern u64 efi_system_table;
 static struct ptdump_info efi_ptdump_info = {
         .mm             = &efi_mm,
         .markers        = (struct addr_marker[]){
-                { 0,            "UEFI runtime start" },
-                { DEFAULT_MAP_WINDOW_64, "UEFI runtime end" }
+                { 0,                            "UEFI runtime start" },
+                { DEFAULT_MAP_WINDOW_64,        "UEFI runtime end" },
+                { -1,                           NULL }
         },
         .base_addr      = 0,
 };
diff --git a/drivers/fpga/stratix10-soc.c b/drivers/fpga/stratix10-soc.c
index a1a09e04fab8..13851b3d1c56 100644
--- a/drivers/fpga/stratix10-soc.c
+++ b/drivers/fpga/stratix10-soc.c
@@ -508,14 +508,11 @@ static int __init s10_init(void)
                 return -ENODEV;
 
         np = of_find_matching_node(fw_np, s10_of_match);
-        if (!np) {
-                of_node_put(fw_np);
+        if (!np)
                 return -ENODEV;
-        }
 
         of_node_put(np);
         ret = of_platform_populate(fw_np, s10_of_match, NULL, NULL);
-        of_node_put(fw_np);
         if (ret)
                 return ret;
 
diff --git a/drivers/gpio/gpio-altera-a10sr.c b/drivers/gpio/gpio-altera-a10sr.c
index 6b11f1314248..7f9e0304b510 100644
--- a/drivers/gpio/gpio-altera-a10sr.c
+++ b/drivers/gpio/gpio-altera-a10sr.c
@@ -66,8 +66,10 @@ static int altr_a10sr_gpio_direction_input(struct gpio_chip *gc,
 static int altr_a10sr_gpio_direction_output(struct gpio_chip *gc,
                                             unsigned int nr, int value)
 {
-        if (nr <= (ALTR_A10SR_OUT_VALID_RANGE_HI - ALTR_A10SR_LED_VALID_SHIFT))
+        if (nr <= (ALTR_A10SR_OUT_VALID_RANGE_HI - ALTR_A10SR_LED_VALID_SHIFT)) {
+                altr_a10sr_gpio_set(gc, nr, value);
                 return 0;
+        }
         return -EINVAL;
 }
 
diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
index e0d6a0a7bc69..e41223c05f6e 100644
--- a/drivers/gpio/gpio-eic-sprd.c
+++ b/drivers/gpio/gpio-eic-sprd.c
@@ -180,7 +180,18 @@ static void sprd_eic_free(struct gpio_chip *chip, unsigned int offset)
 
 static int sprd_eic_get(struct gpio_chip *chip, unsigned int offset)
 {
-        return sprd_eic_read(chip, offset, SPRD_EIC_DBNC_DATA);
+        struct sprd_eic *sprd_eic = gpiochip_get_data(chip);
+
+        switch (sprd_eic->type) {
+        case SPRD_EIC_DEBOUNCE:
+                return sprd_eic_read(chip, offset, SPRD_EIC_DBNC_DATA);
+        case SPRD_EIC_ASYNC:
+                return sprd_eic_read(chip, offset, SPRD_EIC_ASYNC_DATA);
+        case SPRD_EIC_SYNC:
+                return sprd_eic_read(chip, offset, SPRD_EIC_SYNC_DATA);
+        default:
+                return -ENOTSUPP;
+        }
 }
 
 static int sprd_eic_direction_input(struct gpio_chip *chip, unsigned int offset)
@@ -368,6 +379,7 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type)
                         irq_set_handler_locked(data, handle_edge_irq);
                         break;
                 case IRQ_TYPE_EDGE_BOTH:
+                        sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 0);
                         sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 1);
                         irq_set_handler_locked(data, handle_edge_irq);
                         break;
diff --git a/drivers/gpio/gpio-pcf857x.c b/drivers/gpio/gpio-pcf857x.c
index adf72dda25a2..68a35b65925a 100644
--- a/drivers/gpio/gpio-pcf857x.c
+++ b/drivers/gpio/gpio-pcf857x.c
@@ -84,6 +84,7 @@ MODULE_DEVICE_TABLE(of, pcf857x_of_table);
  */
 struct pcf857x {
         struct gpio_chip        chip;
+        struct irq_chip         irqchip;
         struct i2c_client       *client;
         struct mutex            lock;           /* protect 'out' */
         unsigned                out;            /* software latch */
@@ -252,18 +253,6 @@ static void pcf857x_irq_bus_sync_unlock(struct irq_data *data)
         mutex_unlock(&gpio->lock);
 }
 
-static struct irq_chip pcf857x_irq_chip = {
-        .name           = "pcf857x",
-        .irq_enable     = pcf857x_irq_enable,
-        .irq_disable    = pcf857x_irq_disable,
-        .irq_ack        = noop,
-        .irq_mask       = noop,
-        .irq_unmask     = noop,
-        .irq_set_wake   = pcf857x_irq_set_wake,
-        .irq_bus_lock           = pcf857x_irq_bus_lock,
-        .irq_bus_sync_unlock    = pcf857x_irq_bus_sync_unlock,
-};
-
 /*-------------------------------------------------------------------------*/
 
 static int pcf857x_probe(struct i2c_client *client,
@@ -376,8 +365,17 @@ static int pcf857x_probe(struct i2c_client *client,
 
         /* Enable irqchip if we have an interrupt */
         if (client->irq) {
+                gpio->irqchip.name = "pcf857x",
+                gpio->irqchip.irq_enable = pcf857x_irq_enable,
+                gpio->irqchip.irq_disable = pcf857x_irq_disable,
+                gpio->irqchip.irq_ack = noop,
+                gpio->irqchip.irq_mask = noop,
+                gpio->irqchip.irq_unmask = noop,
+                gpio->irqchip.irq_set_wake = pcf857x_irq_set_wake,
+                gpio->irqchip.irq_bus_lock = pcf857x_irq_bus_lock,
+                gpio->irqchip.irq_bus_sync_unlock = pcf857x_irq_bus_sync_unlock,
                 status = gpiochip_irqchip_add_nested(&gpio->chip,
-                                                     &pcf857x_irq_chip,
+                                                     &gpio->irqchip,
                                                      0, handle_level_irq,
                                                      IRQ_TYPE_NONE);
                 if (status) {
@@ -392,7 +390,7 @@ static int pcf857x_probe(struct i2c_client *client,
                 if (status)
                         goto fail;
 
-                gpiochip_set_nested_irqchip(&gpio->chip, &pcf857x_irq_chip,
+                gpiochip_set_nested_irqchip(&gpio->chip, &gpio->irqchip,
                                             client->irq);
                 gpio->irq_parent = client->irq;
         }
diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
index 1b79ebcfce3e..541fa6ac399d 100644
--- a/drivers/gpio/gpio-vf610.c
+++ b/drivers/gpio/gpio-vf610.c
@@ -253,6 +253,7 @@ static int vf610_gpio_probe(struct platform_device *pdev)
         struct vf610_gpio_port *port;
         struct resource *iores;
         struct gpio_chip *gc;
+        int i;
         int ret;
 
         port = devm_kzalloc(&pdev->dev, sizeof(*port), GFP_KERNEL);
@@ -319,6 +320,10 @@ static int vf610_gpio_probe(struct platform_device *pdev)
         if (ret < 0)
                 return ret;
 
+        /* Mask all GPIO interrupts */
+        for (i = 0; i < gc->ngpio; i++)
+                vf610_gpio_writel(0, port->base + PORT_PCR(i));
+
         /* Clear the interrupt status register for all GPIO's */
         vf610_gpio_writel(~0, port->base + PORT_ISFR);
 
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 1651d7f0a303..d1adfdf50fb3 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -828,7 +828,14 @@ static irqreturn_t lineevent_irq_thread(int irq, void *p)
         /* Do not leak kernel stack to userspace */
         memset(&ge, 0, sizeof(ge));
 
-        ge.timestamp = le->timestamp;
+        /*
+         * We may be running from a nested threaded interrupt in which case
+         * we didn't get the timestamp from lineevent_irq_handler().
+         */
+        if (!le->timestamp)
+                ge.timestamp = ktime_get_real_ns();
+        else
+                ge.timestamp = le->timestamp;
 
         if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE
             && le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
index 6896dec97fc7..0ed41a9d2d77 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
@@ -1686,7 +1686,8 @@ static umode_t hwmon_attributes_visible(struct kobject *kobj,
                 effective_mode &= ~S_IWUSR;
 
         if ((adev->flags & AMD_IS_APU) &&
-            (attr == &sensor_dev_attr_power1_cap_max.dev_attr.attr ||
+            (attr == &sensor_dev_attr_power1_average.dev_attr.attr ||
+             attr == &sensor_dev_attr_power1_cap_max.dev_attr.attr ||
              attr == &sensor_dev_attr_power1_cap_min.dev_attr.attr||
              attr == &sensor_dev_attr_power1_cap.dev_attr.attr))
                 return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
index 71913a18d142..a38e0fb4a6fe 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
@@ -38,6 +38,7 @@
 #include "amdgpu_gem.h"
 #include <drm/amdgpu_drm.h>
 #include <linux/dma-buf.h>
+#include <linux/dma-fence-array.h>
 
 /**
  * amdgpu_gem_prime_get_sg_table - &drm_driver.gem_prime_get_sg_table
@@ -187,6 +188,48 @@ error:
         return ERR_PTR(ret);
 }
 
+static int
+__reservation_object_make_exclusive(struct reservation_object *obj)
+{
+        struct dma_fence **fences;
+        unsigned int count;
+        int r;
+
+        if (!reservation_object_get_list(obj)) /* no shared fences to convert */
+                return 0;
+
+        r = reservation_object_get_fences_rcu(obj, NULL, &count, &fences);
+        if (r)
+                return r;
+
+        if (count == 0) {
+                /* Now that was unexpected. */
+        } else if (count == 1) {
+                reservation_object_add_excl_fence(obj, fences[0]);
+                dma_fence_put(fences[0]);
+                kfree(fences);
+        } else {
+                struct dma_fence_array *array;
+
+                array = dma_fence_array_create(count, fences,
+                                               dma_fence_context_alloc(1), 0,
+                                               false);
+                if (!array)
+                        goto err_fences_put;
+
+                reservation_object_add_excl_fence(obj, &array->base);
+                dma_fence_put(&array->base);
+        }
+
+        return 0;
+
+err_fences_put:
+        while (count--)
+                dma_fence_put(fences[count]);
+        kfree(fences);
+        return -ENOMEM;
+}
+
 /**
  * amdgpu_gem_map_attach - &dma_buf_ops.attach implementation
  * @dma_buf: Shared DMA buffer
@@ -218,16 +261,16 @@ static int amdgpu_gem_map_attach(struct dma_buf *dma_buf,
 
         if (attach->dev->driver != adev->dev->driver) {
                 /*
-                 * Wait for all shared fences to complete before we switch to future
-                 * use of exclusive fence on this prime shared bo.
+                 * We only create shared fences for internal use, but importers
+                 * of the dmabuf rely on exclusive fences for implicitly
+                 * tracking write hazards. As any of the current fences may
+                 * correspond to a write, we need to convert all existing
+                 * fences on the reservation object into a single exclusive
+                 * fence.
                  */
-                r = reservation_object_wait_timeout_rcu(bo->tbo.resv,
-                                                        true, false,
-                                                        MAX_SCHEDULE_TIMEOUT);
-                if (unlikely(r < 0)) {
-                        DRM_DEBUG_PRIME("Fence wait failed: %li\n", r);
+                r = __reservation_object_make_exclusive(bo->tbo.resv);
+                if (r)
                         goto error_unreserve;
-                }
         }
 
         /* pin buffer into GTT */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index d2ea5ce2cefb..7c108e687683 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -3363,14 +3363,15 @@ void amdgpu_vm_get_task_info(struct amdgpu_device *adev, unsigned int pasid,
                          struct amdgpu_task_info *task_info)
 {
         struct amdgpu_vm *vm;
+        unsigned long flags;
 
-        spin_lock(&adev->vm_manager.pasid_lock);
+        spin_lock_irqsave(&adev->vm_manager.pasid_lock, flags);
 
         vm = idr_find(&adev->vm_manager.pasid_idr, pasid);
         if (vm)
                 *task_info = vm->task_info;
 
-        spin_unlock(&adev->vm_manager.pasid_lock);
+        spin_unlock_irqrestore(&adev->vm_manager.pasid_lock, flags);
 }
 
 /**
diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
index 4cd31a276dcd..186db182f924 100644
--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
+++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
@@ -93,7 +93,20 @@ static void nbio_v7_4_enable_doorbell_aperture(struct amdgpu_device *adev,
 static void nbio_v7_4_enable_doorbell_selfring_aperture(struct amdgpu_device *adev,
                                                         bool enable)
 {
+        u32 tmp = 0;
 
+        if (enable) {
+                tmp = REG_SET_FIELD(tmp, DOORBELL_SELFRING_GPA_APER_CNTL, DOORBELL_SELFRING_GPA_APER_EN, 1) |
+                      REG_SET_FIELD(tmp, DOORBELL_SELFRING_GPA_APER_CNTL, DOORBELL_SELFRING_GPA_APER_MODE, 1) |
+                      REG_SET_FIELD(tmp, DOORBELL_SELFRING_GPA_APER_CNTL, DOORBELL_SELFRING_GPA_APER_SIZE, 0);
+
+                WREG32_SOC15(NBIO, 0, mmDOORBELL_SELFRING_GPA_APER_BASE_LOW,
+                             lower_32_bits(adev->doorbell.base));
+                WREG32_SOC15(NBIO, 0, mmDOORBELL_SELFRING_GPA_APER_BASE_HIGH,
+                             upper_32_bits(adev->doorbell.base));
+        }
+
+        WREG32_SOC15(NBIO, 0, mmDOORBELL_SELFRING_GPA_APER_CNTL, tmp);
 }
 
 static void nbio_v7_4_ih_doorbell_range(struct amdgpu_device *adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
index 8849b74078d6..9b639974c70c 100644
--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
+++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
@@ -729,11 +729,13 @@ static int soc15_common_early_init(void *handle)
         case CHIP_RAVEN:
                 adev->asic_funcs = &soc15_asic_funcs;
                 if (adev->rev_id >= 0x8)
-                        adev->external_rev_id = adev->rev_id + 0x81;
+                        adev->external_rev_id = adev->rev_id + 0x79;
                 else if (adev->pdev->device == 0x15d8)
                         adev->external_rev_id = adev->rev_id + 0x41;
+                else if (adev->rev_id == 1)
+                        adev->external_rev_id = adev->rev_id + 0x20;
                 else
-                        adev->external_rev_id = 0x1;
+                        adev->external_rev_id = adev->rev_id + 0x01;
 
                 if (adev->rev_id >= 0x8) {
                         adev->cg_flags = AMD_CG_SUPPORT_GFX_MGCG |
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
index 5d85ff341385..2e7c44955f43 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
@@ -863,7 +863,7 @@ static int kfd_fill_mem_info_for_cpu(int numa_node_id, int *avail_size,
         return 0;
 }
 
-#if CONFIG_X86_64
+#ifdef CONFIG_X86_64
 static int kfd_fill_iolink_info_for_cpu(int numa_node_id, int *avail_size,
                                 uint32_t *num_entries,
                                 struct crat_subtype_iolink *sub_type_hdr)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index f4fa40c387d3..0b392bfca284 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -4082,7 +4082,8 @@ void amdgpu_dm_connector_init_helper(struct amdgpu_display_manager *dm,
         }
 
         if (connector_type == DRM_MODE_CONNECTOR_HDMIA ||
-            connector_type == DRM_MODE_CONNECTOR_DisplayPort) {
+            connector_type == DRM_MODE_CONNECTOR_DisplayPort ||
+            connector_type == DRM_MODE_CONNECTOR_eDP) {
                 drm_connector_attach_vrr_capable_property(
                         &aconnector->base);
         }
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c
index afd287f08bc9..19801bdba0d2 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c
@@ -591,7 +591,15 @@ static void dce11_pplib_apply_display_requirements(
                         dc,
                         context->bw.dce.sclk_khz);
 
-        pp_display_cfg->min_dcfclock_khz = pp_display_cfg->min_engine_clock_khz;
+        /*
+         * As workaround for >4x4K lightup set dcfclock to min_engine_clock value.
+         * This is not required for less than 5 displays,
+         * thus don't request decfclk in dc to avoid impact
+         * on power saving.
+         *
+         */
+        pp_display_cfg->min_dcfclock_khz = (context->stream_count > 4)?
+                        pp_display_cfg->min_engine_clock_khz : 0;
 
         pp_display_cfg->min_engine_clock_deep_sleep_khz
                         = context->bw.dce.sclk_deep_sleep_khz;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
index f95c5f50eb0f..5273de3c5b98 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
@@ -1033,6 +1033,7 @@ static int smu10_get_clock_by_type_with_latency(struct pp_hwmgr *hwmgr,
                 break;
         case amd_pp_dpp_clock:
                 pclk_vol_table = pinfo->vdd_dep_on_dppclk;
+                break;
         default:
                 return -EINVAL;
         }
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index 24a750436559..f91e02c87fd8 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -758,7 +758,7 @@ int drm_mode_hsync(const struct drm_display_mode *mode)
         if (mode->hsync)
                 return mode->hsync;
 
-        if (mode->htotal < 0)
+        if (mode->htotal <= 0)
                 return 0;
 
         calc_val = (mode->clock * 1000) / mode->htotal; /* hsync in Hz */
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index f3e1d6a0b7dd..4079050f9d6c 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1086,7 +1086,7 @@ static uint32_t icl_pll_to_ddi_pll_sel(struct intel_encoder *encoder,
                         return DDI_CLK_SEL_TBT_810;
                 default:
                         MISSING_CASE(clock);
-                        break;
+                        return DDI_CLK_SEL_NONE;
                 }
         case DPLL_ID_ICL_MGPLL1:
         case DPLL_ID_ICL_MGPLL2:
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3da9c0f9e948..248128126422 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -15415,16 +15415,45 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc,
         }
 }
 
+static bool has_bogus_dpll_config(const struct intel_crtc_state *crtc_state)
+{
+        struct drm_i915_private *dev_priv = to_i915(crtc_state->base.crtc->dev);
+
+        /*
+         * Some SNB BIOSen (eg. ASUS K53SV) are known to misprogram
+         * the hardware when a high res displays plugged in. DPLL P
+         * divider is zero, and the pipe timings are bonkers. We'll
+         * try to disable everything in that case.
+         *
+         * FIXME would be nice to be able to sanitize this state
+         * without several WARNs, but for now let's take the easy
+         * road.
+         */
+        return IS_GEN6(dev_priv) &&
+                crtc_state->base.active &&
+                crtc_state->shared_dpll &&
+                crtc_state->port_clock == 0;
+}
+
 static void intel_sanitize_encoder(struct intel_encoder *encoder)
 {
         struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
         struct intel_connector *connector;
+        struct intel_crtc *crtc = to_intel_crtc(encoder->base.crtc);
+        struct intel_crtc_state *crtc_state = crtc ?
+                to_intel_crtc_state(crtc->base.state) : NULL;
 
         /* We need to check both for a crtc link (meaning that the
          * encoder is active and trying to read from a pipe) and the
          * pipe itself being active. */
-        bool has_active_crtc = encoder->base.crtc &&
-                to_intel_crtc(encoder->base.crtc)->active;
+        bool has_active_crtc = crtc_state &&
+                crtc_state->base.active;
+
+        if (crtc_state && has_bogus_dpll_config(crtc_state)) {
+                DRM_DEBUG_KMS("BIOS has misprogrammed the hardware. Disabling pipe %c\n",
+                              pipe_name(crtc->pipe));
+                has_active_crtc = false;
+        }
 
         connector = intel_encoder_find_connector(encoder);
         if (connector && !has_active_crtc) {
@@ -15435,16 +15464,25 @@ static void intel_sanitize_encoder(struct intel_encoder *encoder)
                 /* Connector is active, but has no active pipe. This is
                  * fallout from our resume register restoring. Disable
                  * the encoder manually again. */
-                if (encoder->base.crtc) {
-                        struct drm_crtc_state *crtc_state = encoder->base.crtc->state;
+                if (crtc_state) {
+                        struct drm_encoder *best_encoder;
 
                         DRM_DEBUG_KMS("[ENCODER:%d:%s] manually disabled\n",
                                       encoder->base.base.id,
                                       encoder->base.name);
+
+                        /* avoid oopsing in case the hooks consult best_encoder */
+                        best_encoder = connector->base.state->best_encoder;
+                        connector->base.state->best_encoder = &encoder->base;
+
                         if (encoder->disable)
-                                encoder->disable(encoder, to_intel_crtc_state(crtc_state), connector->base.state);
+                                encoder->disable(encoder, crtc_state,
+                                                 connector->base.state);
                         if (encoder->post_disable)
-                                encoder->post_disable(encoder, to_intel_crtc_state(crtc_state), connector->base.state);
+                                encoder->post_disable(encoder, crtc_state,
+                                                      connector->base.state);
+
+                        connector->base.state->best_encoder = best_encoder;
                 }
                 encoder->base.crtc = NULL;
 
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index d2e003d8f3db..5170a0f5fe7b 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -494,7 +494,7 @@ skl_program_plane(struct intel_plane *plane,
 
         keymax = (key->max_value & 0xffffff) | PLANE_KEYMAX_ALPHA(alpha);
 
-        keymsk = key->channel_mask & 0x3ffffff;
+        keymsk = key->channel_mask & 0x7ffffff;
         if (alpha < 0xff)
                 keymsk |= PLANE_KEYMSK_ALPHA_ENABLE;
 
diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
index 00a9c2ab9e6c..64fb788b6647 100644
--- a/drivers/gpu/drm/omapdrm/dss/dsi.c
+++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
@@ -1406,7 +1406,7 @@ static void dsi_pll_disable(struct dss_pll *pll)
 
 static int dsi_dump_dsi_clocks(struct seq_file *s, void *p)
 {
-        struct dsi_data *dsi = p;
+        struct dsi_data *dsi = s->private;
         struct dss_pll_clock_info *cinfo = &dsi->pll.cinfo;
         enum dss_clk_source dispc_clk_src, dsi_clk_src;
         int dsi_module = dsi->module_id;
@@ -1467,7 +1467,7 @@ static int dsi_dump_dsi_clocks(struct seq_file *s, void *p)
 #ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
 static int dsi_dump_dsi_irqs(struct seq_file *s, void *p)
 {
-        struct dsi_data *dsi = p;
+        struct dsi_data *dsi = s->private;
         unsigned long flags;
         struct dsi_irq_stats stats;
 
@@ -1558,7 +1558,7 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p)
 
 static int dsi_dump_dsi_regs(struct seq_file *s, void *p)
 {
-        struct dsi_data *dsi = p;
+        struct dsi_data *dsi = s->private;
 
         if (dsi_runtime_get(dsi))
                 return 0;
@@ -4751,6 +4751,17 @@ static int dsi_set_config(struct omap_dss_device *dssdev,
         dsi->vm.flags |= DISPLAY_FLAGS_HSYNC_HIGH;
         dsi->vm.flags &= ~DISPLAY_FLAGS_VSYNC_LOW;
         dsi->vm.flags |= DISPLAY_FLAGS_VSYNC_HIGH;
+        /*
+         * HACK: These flags should be handled through the omap_dss_device bus
+         * flags, but this will only be possible when the DSI encoder will be
+         * converted to the omapdrm-managed encoder model.
+         */
+        dsi->vm.flags &= ~DISPLAY_FLAGS_PIXDATA_NEGEDGE;
+        dsi->vm.flags |= DISPLAY_FLAGS_PIXDATA_POSEDGE;
+        dsi->vm.flags &= ~DISPLAY_FLAGS_DE_LOW;
+        dsi->vm.flags |= DISPLAY_FLAGS_DE_HIGH;
+        dsi->vm.flags &= ~DISPLAY_FLAGS_SYNC_POSEDGE;
+        dsi->vm.flags |= DISPLAY_FLAGS_SYNC_NEGEDGE;
 
         dss_mgr_set_timings(&dsi->output, &dsi->vm);
 
@@ -5083,15 +5094,15 @@ static int dsi_bind(struct device *dev, struct device *master, void *data)
 
         snprintf(name, sizeof(name), "dsi%u_regs", dsi->module_id + 1);
         dsi->debugfs.regs = dss_debugfs_create_file(dss, name,
-                                                    dsi_dump_dsi_regs, &dsi);
+                                                    dsi_dump_dsi_regs, dsi);
 #ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
         snprintf(name, sizeof(name), "dsi%u_irqs", dsi->module_id + 1);
         dsi->debugfs.irqs = dss_debugfs_create_file(dss, name,
-                                                    dsi_dump_dsi_irqs, &dsi);
+                                                    dsi_dump_dsi_irqs, dsi);
 #endif
         snprintf(name, sizeof(name), "dsi%u_clks", dsi->module_id + 1);
         dsi->debugfs.clks = dss_debugfs_create_file(dss, name,
-                                                    dsi_dump_dsi_clocks, &dsi);
+                                                    dsi_dump_dsi_clocks, dsi);
 
         return 0;
 }
@@ -5104,8 +5115,6 @@ static void dsi_unbind(struct device *dev, struct device *master, void *data)
         dss_debugfs_remove_file(dsi->debugfs.irqs);
         dss_debugfs_remove_file(dsi->debugfs.regs);
 
-        of_platform_depopulate(dev);
-
         WARN_ON(dsi->scp_clk_refcount > 0);
 
         dss_pll_unregister(&dsi->pll);
@@ -5457,6 +5466,8 @@ static int dsi_remove(struct platform_device *pdev)
 
         dsi_uninit_output(dsi);
 
+        of_platform_depopulate(&pdev->dev);
+
         pm_runtime_disable(&pdev->dev);
 
         if (dsi->vdds_dsi_reg != NULL && dsi->vdds_dsi_enabled) {
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index d587779a80b4..a97294ac96d5 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -5676,7 +5676,7 @@ int ci_dpm_init(struct radeon_device *rdev)
         u16 data_offset, size;
         u8 frev, crev;
         struct ci_power_info *pi;
-        enum pci_bus_speed speed_cap;
+        enum pci_bus_speed speed_cap = PCI_SPEED_UNKNOWN;
         struct pci_dev *root = rdev->pdev->bus->self;
         int ret;
 
@@ -5685,7 +5685,8 @@ int ci_dpm_init(struct radeon_device *rdev)
                 return -ENOMEM;
         rdev->pm.dpm.priv = pi;
 
-        speed_cap = pcie_get_speed_cap(root);
+        if (!pci_is_root_bus(rdev->pdev->bus))
+                speed_cap = pcie_get_speed_cap(root);
         if (speed_cap == PCI_SPEED_UNKNOWN) {
                 pi->sys_pcie_mask = 0;
         } else {
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 8fb60b3af015..0a785ef0ab66 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -6899,7 +6899,7 @@ int si_dpm_init(struct radeon_device *rdev)
         struct ni_power_info *ni_pi;
         struct si_power_info *si_pi;
         struct atom_clock_dividers dividers;
-        enum pci_bus_speed speed_cap;
+        enum pci_bus_speed speed_cap = PCI_SPEED_UNKNOWN;
         struct pci_dev *root = rdev->pdev->bus->self;
         int ret;
 
@@ -6911,7 +6911,8 @@ int si_dpm_init(struct radeon_device *rdev)
         eg_pi = &ni_pi->eg;
         pi = &eg_pi->rv7xx;
 
-        speed_cap = pcie_get_speed_cap(root);
+        if (!pci_is_root_bus(rdev->pdev->bus))
+                speed_cap = pcie_get_speed_cap(root);
         if (speed_cap == PCI_SPEED_UNKNOWN) {
                 si_pi->sys_pcie_mask = 0;
         } else {
diff --git a/drivers/gpu/drm/rockchip/rockchip_rgb.c b/drivers/gpu/drm/rockchip/rockchip_rgb.c
index 37f93022a106..c0351abf83a3 100644
--- a/drivers/gpu/drm/rockchip/rockchip_rgb.c
+++ b/drivers/gpu/drm/rockchip/rockchip_rgb.c
@@ -1,17 +1,8 @@
-//SPDX-License-Identifier: GPL-2.0+
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) Fuzhou Rockchip Electronics Co.Ltd
  * Author:
  *      Sandy Huang <hjc@rock-chips.com>
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
  */
 
 #include <drm/drmP.h>
diff --git a/drivers/gpu/drm/rockchip/rockchip_rgb.h b/drivers/gpu/drm/rockchip/rockchip_rgb.h
index 38b52e63b2b0..27b9635124bc 100644
--- a/drivers/gpu/drm/rockchip/rockchip_rgb.h
+++ b/drivers/gpu/drm/rockchip/rockchip_rgb.h
@@ -1,17 +1,8 @@
-//SPDX-License-Identifier: GPL-2.0+
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (C) Fuzhou Rockchip Electronics Co.Ltd
  * Author:
  *      Sandy Huang <hjc@rock-chips.com>
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
  */
 
 #ifdef CONFIG_ROCKCHIP_RGB
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index 0420f5c978b9..cf45d0f940f9 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -761,6 +761,7 @@ static int sun4i_tcon_init_clocks(struct device *dev,
                         return PTR_ERR(tcon->sclk0);
                 }
         }
+        clk_prepare_enable(tcon->sclk0);
 
         if (tcon->quirks->has_channel_1) {
                 tcon->sclk1 = devm_clk_get(dev, "tcon-ch1");
@@ -775,6 +776,7 @@ static int sun4i_tcon_init_clocks(struct device *dev,
 
 static void sun4i_tcon_free_clocks(struct sun4i_tcon *tcon)
 {
+        clk_disable_unprepare(tcon->sclk0);
         clk_disable_unprepare(tcon->clk);
 }
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 25afb1d594e3..7ef5dcb06104 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -26,6 +26,7 @@
  **************************************************************************/
 #include <linux/module.h>
 #include <linux/console.h>
+#include <linux/dma-mapping.h>
 
 #include <drm/drmP.h>
 #include "vmwgfx_drv.h"
@@ -34,7 +35,6 @@
 #include <drm/ttm/ttm_placement.h>
 #include <drm/ttm/ttm_bo_driver.h>
 #include <drm/ttm/ttm_module.h>
-#include <linux/intel-iommu.h>
 
 #define VMWGFX_DRIVER_DESC "Linux drm driver for VMware graphics devices"
 #define VMWGFX_CHIP_SVGAII 0
@@ -546,6 +546,21 @@ static void vmw_get_initial_size(struct vmw_private *dev_priv)
 }
 
 /**
+ * vmw_assume_iommu - Figure out whether coherent dma-remapping might be
+ * taking place.
+ * @dev: Pointer to the struct drm_device.
+ *
+ * Return: true if iommu present, false otherwise.
+ */
+static bool vmw_assume_iommu(struct drm_device *dev)
+{
+        const struct dma_map_ops *ops = get_dma_ops(dev->dev);
+
+        return !dma_is_direct(ops) && ops &&
+                ops->map_page != dma_direct_map_page;
+}
+
+/**
  * vmw_dma_select_mode - Determine how DMA mappings should be set up for this
  * system.
  *
@@ -565,55 +580,27 @@ static int vmw_dma_select_mode(struct vmw_private *dev_priv)
                 [vmw_dma_alloc_coherent] = "Using coherent TTM pages.",
                 [vmw_dma_map_populate] = "Keeping DMA mappings.",
                 [vmw_dma_map_bind] = "Giving up DMA mappings early."};
-#ifdef CONFIG_X86
-        const struct dma_map_ops *dma_ops = get_dma_ops(dev_priv->dev->dev);
 
-#ifdef CONFIG_INTEL_IOMMU
-        if (intel_iommu_enabled) {
+        if (vmw_force_coherent)
+                dev_priv->map_mode = vmw_dma_alloc_coherent;
+        else if (vmw_assume_iommu(dev_priv->dev))
                 dev_priv->map_mode = vmw_dma_map_populate;
-                goto out_fixup;
-        }
-#endif
-
-        if (!(vmw_force_iommu || vmw_force_coherent)) {
+        else if (!vmw_force_iommu)
                 dev_priv->map_mode = vmw_dma_phys;
-                DRM_INFO("DMA map mode: %s\n", names[dev_priv->map_mode]);
-                return 0;
-        }
-
-        dev_priv->map_mode = vmw_dma_map_populate;
-
-        if (dma_ops && dma_ops->sync_single_for_cpu)
+        else if (IS_ENABLED(CONFIG_SWIOTLB) && swiotlb_nr_tbl())
                 dev_priv->map_mode = vmw_dma_alloc_coherent;
-#ifdef CONFIG_SWIOTLB
-        if (swiotlb_nr_tbl() == 0)
+        else
                 dev_priv->map_mode = vmw_dma_map_populate;
-#endif
 
-#ifdef CONFIG_INTEL_IOMMU
-out_fixup:
-#endif
-        if (dev_priv->map_mode == vmw_dma_map_populate &&
-            vmw_restrict_iommu)
+        if (dev_priv->map_mode == vmw_dma_map_populate && vmw_restrict_iommu)
                 dev_priv->map_mode = vmw_dma_map_bind;
 
-        if (vmw_force_coherent)
-                dev_priv->map_mode = vmw_dma_alloc_coherent;
-
-#if !defined(CONFIG_SWIOTLB) && !defined(CONFIG_INTEL_IOMMU)
-        /*
-         * No coherent page pool
-         */
-        if (dev_priv->map_mode == vmw_dma_alloc_coherent)
+        /* No TTM coherent page pool? FIXME: Ask TTM instead! */
+        if (!(IS_ENABLED(CONFIG_SWIOTLB) || IS_ENABLED(CONFIG_INTEL_IOMMU)) &&
+            (dev_priv->map_mode == vmw_dma_alloc_coherent))
                 return -EINVAL;
-#endif
-
-#else /* CONFIG_X86 */
-        dev_priv->map_mode = vmw_dma_map_populate;
-#endif /* CONFIG_X86 */
 
         DRM_INFO("DMA map mode: %s\n", names[dev_priv->map_mode]);
-
         return 0;
 }
 
@@ -625,24 +612,20 @@ out_fixup:
  * With 32-bit we can only handle 32 bit PFNs. Optionally set that
  * restriction also for 64-bit systems.
  */
-#ifdef CONFIG_INTEL_IOMMU
 static int vmw_dma_masks(struct vmw_private *dev_priv)
 {
         struct drm_device *dev = dev_priv->dev;
+        int ret = 0;
 
-        if (intel_iommu_enabled &&
+        ret = dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(64));
+        if (dev_priv->map_mode != vmw_dma_phys &&
             (sizeof(unsigned long) == 4 || vmw_restrict_dma_mask)) {
                 DRM_INFO("Restricting DMA addresses to 44 bits.\n");
-                return dma_set_mask(dev->dev, DMA_BIT_MASK(44));
+                return dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(44));
         }
-        return 0;
-}
-#else
-static int vmw_dma_masks(struct vmw_private *dev_priv)
-{
-        return 0;
+
+        return ret;
 }
-#endif
 
 static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
 {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index f2d13a72c05d..88b8178d4687 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -3570,7 +3570,7 @@ int vmw_execbuf_fence_commands(struct drm_file *file_priv,
                 *p_fence = NULL;
         }
 
-        return 0;
+        return ret;
 }
 
 /**
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index b351fb5214d3..ed2f67822f45 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1646,7 +1646,7 @@ static int vmw_kms_check_topology(struct drm_device *dev,
                 struct drm_connector_state *conn_state;
                 struct vmw_connector_state *vmw_conn_state;
 
-                if (!du->pref_active) {
+                if (!du->pref_active && new_crtc_state->enable) {
                         ret = -EINVAL;
                         goto clean;
                 }
@@ -2554,8 +2554,8 @@ void vmw_kms_helper_validation_finish(struct vmw_private *dev_priv,
                                       user_fence_rep)
 {
         struct vmw_fence_obj *fence = NULL;
-        uint32_t handle;
-        int ret;
+        uint32_t handle = 0;
+        int ret = 0;
 
         if (file_priv || user_fence_rep || vmw_validation_has_bos(ctx) ||
             out_fence)
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index c530476edba6..ac9fda1b5a72 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -30,6 +30,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
+#include <linux/kfifo.h>
 #include <linux/sched/signal.h>
 #include <linux/export.h>
 #include <linux/slab.h>
@@ -661,17 +662,12 @@ EXPORT_SYMBOL_GPL(hid_dump_device);
 /* enqueue string to 'events' ring buffer */
 void hid_debug_event(struct hid_device *hdev, char *buf)
 {
-        unsigned i;
         struct hid_debug_list *list;
         unsigned long flags;
 
         spin_lock_irqsave(&hdev->debug_list_lock, flags);
-        list_for_each_entry(list, &hdev->debug_list, node) {
-                for (i = 0; buf[i]; i++)
-                        list->hid_debug_buf[(list->tail + i) % HID_DEBUG_BUFSIZE] =
-                                buf[i];
-                list->tail = (list->tail + i) % HID_DEBUG_BUFSIZE;
-        }
+        list_for_each_entry(list, &hdev->debug_list, node)
+                kfifo_in(&list->hid_debug_fifo, buf, strlen(buf));
         spin_unlock_irqrestore(&hdev->debug_list_lock, flags);
 
         wake_up_interruptible(&hdev->debug_wait);
@@ -722,8 +718,7 @@ void hid_dump_input(struct hid_device *hdev, struct hid_usage *usage, __s32 valu
         hid_debug_event(hdev, buf);
 
         kfree(buf);
-        wake_up_interruptible(&hdev->debug_wait);
-
+        wake_up_interruptible(&hdev->debug_wait);
 }
 EXPORT_SYMBOL_GPL(hid_dump_input);
 
@@ -1083,8 +1078,8 @@ static int hid_debug_events_open(struct inode *inode, struct file *file)
                 goto out;
         }
 
-        if (!(list->hid_debug_buf = kzalloc(HID_DEBUG_BUFSIZE, GFP_KERNEL))) {
-                err = -ENOMEM;
+        err = kfifo_alloc(&list->hid_debug_fifo, HID_DEBUG_FIFOSIZE, GFP_KERNEL);
+        if (err) {
                 kfree(list);
                 goto out;
         }
@@ -1104,77 +1099,57 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer,
                 size_t count, loff_t *ppos)
 {
         struct hid_debug_list *list = file->private_data;
-        int ret = 0, len;
+        int ret = 0, copied;
         DECLARE_WAITQUEUE(wait, current);
 
         mutex_lock(&list->read_mutex);
-        while (ret == 0) {
-                if (list->head == list->tail) {
-                        add_wait_queue(&list->hdev->debug_wait, &wait);
-                        set_current_state(TASK_INTERRUPTIBLE);
-
-                        while (list->head == list->tail) {
-                                if (file->f_flags & O_NONBLOCK) {
-                                        ret = -EAGAIN;
-                                        break;
-                                }
-                                if (signal_pending(current)) {
-                                        ret = -ERESTARTSYS;
-                                        break;
-                                }
+        if (kfifo_is_empty(&list->hid_debug_fifo)) {
+                add_wait_queue(&list->hdev->debug_wait, &wait);
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                while (kfifo_is_empty(&list->hid_debug_fifo)) {
+                        if (file->f_flags & O_NONBLOCK) {
+                                ret = -EAGAIN;
+                                break;
+                        }
 
-                                if (!list->hdev || !list->hdev->debug) {
-                                        ret = -EIO;
-                                        set_current_state(TASK_RUNNING);
-                                        goto out;
-                                }
+                        if (signal_pending(current)) {
+                                ret = -ERESTARTSYS;
+                                break;
+                        }
 
-                                /* allow O_NONBLOCK from other threads */
-                                mutex_unlock(&list->read_mutex);
-                                schedule();
-                                mutex_lock(&list->read_mutex);
-                                set_current_state(TASK_INTERRUPTIBLE);
+                        /* if list->hdev is NULL we cannot remove_wait_queue().
+                         * if list->hdev->debug is 0 then hid_debug_unregister()
+                         * was already called and list->hdev is being destroyed.
+                         * if we add remove_wait_queue() here we can hit a race.
+                         */
+                        if (!list->hdev || !list->hdev->debug) {
+                                ret = -EIO;
+                                set_current_state(TASK_RUNNING);
+                                goto out;
                         }
 
-                        set_current_state(TASK_RUNNING);
-                        remove_wait_queue(&list->hdev->debug_wait, &wait);
+                        /* allow O_NONBLOCK from other threads */
+                        mutex_unlock(&list->read_mutex);
+                        schedule();
+                        mutex_lock(&list->read_mutex);
+                        set_current_state(TASK_INTERRUPTIBLE);
                 }
 
-                if (ret)
-                        goto out;
+                __set_current_state(TASK_RUNNING);
+                remove_wait_queue(&list->hdev->debug_wait, &wait);
 
-                /* pass the ringbuffer contents to userspace */
-copy_rest:
-                if (list->tail == list->head)
+                if (ret)
                         goto out;
-                if (list->tail > list->head) {
-                        len = list->tail - list->head;
-                        if (len > count)
-                                len = count;
-
-                        if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) {
-                                ret = -EFAULT;
-                                goto out;
-                        }
-                        ret += len;
-                        list->head += len;
-                } else {
-                        len = HID_DEBUG_BUFSIZE - list->head;
-                        if (len > count)
-                                len = count;
-
-                        if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) {
-                                ret = -EFAULT;
-                                goto out;
-                        }
-                        list->head = 0;
-                        ret += len;
-                        count -= len;
-                        if (count > 0)
-                                goto copy_rest;
-                }
-
         }
+
+        /* pass the fifo content to userspace, locking is not needed with only
+         * one concurrent reader and one concurrent writer
+         */
+        ret = kfifo_to_user(&list->hid_debug_fifo, buffer, count, &copied);
+        if (ret)
+                goto out;
+        ret = copied;
 out:
         mutex_unlock(&list->read_mutex);
         return ret;
@@ -1185,7 +1160,7 @@ static __poll_t hid_debug_events_poll(struct file *file, poll_table *wait)
         struct hid_debug_list *list = file->private_data;
 
         poll_wait(file, &list->hdev->debug_wait, wait);
-        if (list->head != list->tail)
+        if (!kfifo_is_empty(&list->hid_debug_fifo))
                 return EPOLLIN | EPOLLRDNORM;
         if (!list->hdev->debug)
                 return EPOLLERR | EPOLLHUP;
@@ -1200,7 +1175,7 @@ static int hid_debug_events_release(struct inode *inode, struct file *file)
         spin_lock_irqsave(&list->hdev->debug_list_lock, flags);
         list_del(&list->node);
         spin_unlock_irqrestore(&list->hdev->debug_list_lock, flags);
-        kfree(list->hid_debug_buf);
+        kfifo_free(&list->hid_debug_fifo);
         kfree(list);
 
         return 0;
@@ -1246,4 +1221,3 @@ void hid_debug_exit(void)
 {
         debugfs_remove_recursive(hid_debug_root);
 }
-
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index c39f89d2deba..2dc628d4f1ae 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -1828,7 +1828,7 @@ int i3c_master_add_i3c_dev_locked(struct i3c_master_controller *master,
 
         ret = i3c_master_retrieve_dev_info(newdev);
         if (ret)
-                goto err_free_dev;
+                goto err_detach_dev;
 
         olddev = i3c_master_search_i3c_dev_duplicate(newdev);
         if (olddev) {
diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
index f8c00b94817f..bb03079fbade 100644
--- a/drivers/i3c/master/dw-i3c-master.c
+++ b/drivers/i3c/master/dw-i3c-master.c
@@ -419,12 +419,9 @@ static void dw_i3c_master_enqueue_xfer(struct dw_i3c_master *master,
         spin_unlock_irqrestore(&master->xferqueue.lock, flags);
 }
 
-static void dw_i3c_master_dequeue_xfer(struct dw_i3c_master *master,
-                                       struct dw_i3c_xfer *xfer)
+static void dw_i3c_master_dequeue_xfer_locked(struct dw_i3c_master *master,
+                                              struct dw_i3c_xfer *xfer)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&master->xferqueue.lock, flags);
         if (master->xferqueue.cur == xfer) {
                 u32 status;
 
@@ -439,6 +436,15 @@ static void dw_i3c_master_dequeue_xfer(struct dw_i3c_master *master,
         } else {
                 list_del_init(&xfer->node);
         }
+}
+
+static void dw_i3c_master_dequeue_xfer(struct dw_i3c_master *master,
+                                       struct dw_i3c_xfer *xfer)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&master->xferqueue.lock, flags);
+        dw_i3c_master_dequeue_xfer_locked(master, xfer);
         spin_unlock_irqrestore(&master->xferqueue.lock, flags);
 }
 
@@ -494,7 +500,7 @@ static void dw_i3c_master_end_xfer_locked(struct dw_i3c_master *master, u32 isr)
         complete(&xfer->comp);
 
         if (ret < 0) {
-                dw_i3c_master_dequeue_xfer(master, xfer);
+                dw_i3c_master_dequeue_xfer_locked(master, xfer);
                 writel(readl(master->regs + DEVICE_CTRL) | DEV_CTRL_RESUME,
                        master->regs + DEVICE_CTRL);
         }
diff --git a/drivers/ide/ide-atapi.c b/drivers/ide/ide-atapi.c
index da58020a144e..33a28cde126c 100644
--- a/drivers/ide/ide-atapi.c
+++ b/drivers/ide/ide-atapi.c
@@ -235,21 +235,28 @@ EXPORT_SYMBOL_GPL(ide_prep_sense);
 
 int ide_queue_sense_rq(ide_drive_t *drive, void *special)
 {
-        struct request *sense_rq = drive->sense_rq;
+        ide_hwif_t *hwif = drive->hwif;
+        struct request *sense_rq;
+        unsigned long flags;
+
+        spin_lock_irqsave(&hwif->lock, flags);
 
         /* deferred failure from ide_prep_sense() */
         if (!drive->sense_rq_armed) {
                 printk(KERN_WARNING PFX "%s: error queuing a sense request\n",
                        drive->name);
+                spin_unlock_irqrestore(&hwif->lock, flags);
                 return -ENOMEM;
         }
 
+        sense_rq = drive->sense_rq;
         ide_req(sense_rq)->special = special;
         drive->sense_rq_armed = false;
 
         drive->hwif->rq = NULL;
 
         ide_insert_request_head(drive, sense_rq);
+        spin_unlock_irqrestore(&hwif->lock, flags);
         return 0;
 }
 EXPORT_SYMBOL_GPL(ide_queue_sense_rq);
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 8445b484ae69..b137f27a34d5 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -68,8 +68,10 @@ int ide_end_rq(ide_drive_t *drive, struct request *rq, blk_status_t error,
         }
 
         if (!blk_update_request(rq, error, nr_bytes)) {
-                if (rq == drive->sense_rq)
+                if (rq == drive->sense_rq) {
                         drive->sense_rq = NULL;
+                        drive->sense_rq_active = false;
+                }
 
                 __blk_mq_end_request(rq, error);
                 return 0;
@@ -451,16 +453,11 @@ void ide_requeue_and_plug(ide_drive_t *drive, struct request *rq)
                 blk_mq_delay_run_hw_queue(q->queue_hw_ctx[0], 3);
 }
 
-/*
- * Issue a new request to a device.
- */
-blk_status_t ide_queue_rq(struct blk_mq_hw_ctx *hctx,
-                          const struct blk_mq_queue_data *bd)
+blk_status_t ide_issue_rq(ide_drive_t *drive, struct request *rq,
+                          bool local_requeue)
 {
-        ide_drive_t     *drive = hctx->queue->queuedata;
-        ide_hwif_t      *hwif = drive->hwif;
+        ide_hwif_t *hwif = drive->hwif;
         struct ide_host *host = hwif->host;
-        struct request  *rq = bd->rq;
         ide_startstop_t startstop;
 
         if (!blk_rq_is_passthrough(rq) && !(rq->rq_flags & RQF_DONTPREP)) {
@@ -474,8 +471,6 @@ blk_status_t ide_queue_rq(struct blk_mq_hw_ctx *hctx,
         if (ide_lock_host(host, hwif))
                 return BLK_STS_DEV_RESOURCE;
 
-        blk_mq_start_request(rq);
-
         spin_lock_irq(&hwif->lock);
 
         if (!ide_lock_port(hwif)) {
@@ -511,18 +506,6 @@ repeat:
                 drive->dev_flags &= ~(IDE_DFLAG_SLEEPING | IDE_DFLAG_PARKED);
 
                 /*
-                 * we know that the queue isn't empty, but this can happen
-                 * if ->prep_rq() decides to kill a request
-                 */
-                if (!rq) {
-                        rq = bd->rq;
-                        if (!rq) {
-                                ide_unlock_port(hwif);
-                                goto out;
-                        }
-                }
-
-                /*
                  * Sanity: don't accept a request that isn't a PM request
                  * if we are currently power managed. This is very important as
                  * blk_stop_queue() doesn't prevent the blk_fetch_request()
@@ -560,9 +543,12 @@ repeat:
                 }
         } else {
 plug_device:
+                if (local_requeue)
+                        list_add(&rq->queuelist, &drive->rq_list);
                 spin_unlock_irq(&hwif->lock);
                 ide_unlock_host(host);
-                ide_requeue_and_plug(drive, rq);
+                if (!local_requeue)
+                        ide_requeue_and_plug(drive, rq);
                 return BLK_STS_OK;
         }
 
@@ -573,6 +559,26 @@ out:
         return BLK_STS_OK;
 }
 
+/*
+ * Issue a new request to a device.
+ */
+blk_status_t ide_queue_rq(struct blk_mq_hw_ctx *hctx,
+                          const struct blk_mq_queue_data *bd)
+{
+        ide_drive_t *drive = hctx->queue->queuedata;
+        ide_hwif_t *hwif = drive->hwif;
+
+        spin_lock_irq(&hwif->lock);
+        if (drive->sense_rq_active) {
+                spin_unlock_irq(&hwif->lock);
+                return BLK_STS_DEV_RESOURCE;
+        }
+        spin_unlock_irq(&hwif->lock);
+
+        blk_mq_start_request(bd->rq);
+        return ide_issue_rq(drive, bd->rq, false);
+}
+
 static int drive_is_ready(ide_drive_t *drive)
 {
         ide_hwif_t *hwif = drive->hwif;
@@ -893,13 +899,8 @@ EXPORT_SYMBOL_GPL(ide_pad_transfer);
 
 void ide_insert_request_head(ide_drive_t *drive, struct request *rq)
 {
-        ide_hwif_t *hwif = drive->hwif;
-        unsigned long flags;
-
-        spin_lock_irqsave(&hwif->lock, flags);
+        drive->sense_rq_active = true;
         list_add_tail(&rq->queuelist, &drive->rq_list);
-        spin_unlock_irqrestore(&hwif->lock, flags);
-
         kblockd_schedule_work(&drive->rq_work);
 }
 EXPORT_SYMBOL_GPL(ide_insert_request_head);
diff --git a/drivers/ide/ide-park.c b/drivers/ide/ide-park.c
index 102aa3bc3e7f..8af7af6001eb 100644
--- a/drivers/ide/ide-park.c
+++ b/drivers/ide/ide-park.c
@@ -54,7 +54,9 @@ static void issue_park_cmd(ide_drive_t *drive, unsigned long timeout)
         scsi_req(rq)->cmd[0] = REQ_UNPARK_HEADS;
         scsi_req(rq)->cmd_len = 1;
         ide_req(rq)->type = ATA_PRIV_MISC;
+        spin_lock_irq(&hwif->lock);
         ide_insert_request_head(drive, rq);
+        spin_unlock_irq(&hwif->lock);
 
 out:
         return;
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 63627be0811a..5aeaca24a28f 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1159,18 +1159,27 @@ static void drive_rq_insert_work(struct work_struct *work)
         ide_drive_t *drive = container_of(work, ide_drive_t, rq_work);
         ide_hwif_t *hwif = drive->hwif;
         struct request *rq;
+        blk_status_t ret;
         LIST_HEAD(list);
 
-        spin_lock_irq(&hwif->lock);
-        if (!list_empty(&drive->rq_list))
-                list_splice_init(&drive->rq_list, &list);
-        spin_unlock_irq(&hwif->lock);
+        blk_mq_quiesce_queue(drive->queue);
 
-        while (!list_empty(&list)) {
-                rq = list_first_entry(&list, struct request, queuelist);
+        ret = BLK_STS_OK;
+        spin_lock_irq(&hwif->lock);
+        while (!list_empty(&drive->rq_list)) {
+                rq = list_first_entry(&drive->rq_list, struct request, queuelist);
                 list_del_init(&rq->queuelist);
-                blk_execute_rq_nowait(drive->queue, rq->rq_disk, rq, true, NULL);
+
+                spin_unlock_irq(&hwif->lock);
+                ret = ide_issue_rq(drive, rq, true);
+                spin_lock_irq(&hwif->lock);
         }
+        spin_unlock_irq(&hwif->lock);
+
+        blk_mq_unquiesce_queue(drive->queue);
+
+        if (ret != BLK_STS_OK)
+                kblockd_schedule_work(&drive->rq_work);
 }
 
 static const u8 ide_hwif_to_major[] =
diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c
index 031d568b4972..4e339cfd0c54 100644
--- a/drivers/iio/adc/axp288_adc.c
+++ b/drivers/iio/adc/axp288_adc.c
@@ -27,9 +27,18 @@
 #include <linux/iio/machine.h>
 #include <linux/iio/driver.h>
 
-#define AXP288_ADC_EN_MASK              0xF1
-#define AXP288_ADC_TS_PIN_GPADC         0xF2
-#define AXP288_ADC_TS_PIN_ON            0xF3
+/*
+ * This mask enables all ADCs except for the battery temp-sensor (TS), that is
+ * left as-is to avoid breaking charging on devices without a temp-sensor.
+ */
+#define AXP288_ADC_EN_MASK                              0xF0
+#define AXP288_ADC_TS_ENABLE                            0x01
+
+#define AXP288_ADC_TS_CURRENT_ON_OFF_MASK               GENMASK(1, 0)
+#define AXP288_ADC_TS_CURRENT_OFF                       (0 << 0)
+#define AXP288_ADC_TS_CURRENT_ON_WHEN_CHARGING          (1 << 0)
+#define AXP288_ADC_TS_CURRENT_ON_ONDEMAND               (2 << 0)
+#define AXP288_ADC_TS_CURRENT_ON                        (3 << 0)
 
 enum axp288_adc_id {
         AXP288_ADC_TS,
@@ -44,6 +53,7 @@ enum axp288_adc_id {
 struct axp288_adc_info {
         int irq;
         struct regmap *regmap;
+        bool ts_enabled;
 };
 
 static const struct iio_chan_spec axp288_adc_channels[] = {
@@ -115,21 +125,33 @@ static int axp288_adc_read_channel(int *val, unsigned long address,
         return IIO_VAL_INT;
 }
 
-static int axp288_adc_set_ts(struct regmap *regmap, unsigned int mode,
-                                unsigned long address)
+/*
+ * The current-source used for the battery temp-sensor (TS) is shared
+ * with the GPADC. For proper fuel-gauge and charger operation the TS
+ * current-source needs to be permanently on. But to read the GPADC we
+ * need to temporary switch the TS current-source to ondemand, so that
+ * the GPADC can use it, otherwise we will always read an all 0 value.
+ */
+static int axp288_adc_set_ts(struct axp288_adc_info *info,
+                             unsigned int mode, unsigned long address)
 {
         int ret;
 
-        /* channels other than GPADC do not need to switch TS pin */
+        /* No need to switch the current-source if the TS pin is disabled */
+        if (!info->ts_enabled)
+                return 0;
+
+        /* Channels other than GPADC do not need the current source */
         if (address != AXP288_GP_ADC_H)
                 return 0;
 
-        ret = regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, mode);
+        ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
+                                 AXP288_ADC_TS_CURRENT_ON_OFF_MASK, mode);
         if (ret)
                 return ret;
 
         /* When switching to the GPADC pin give things some time to settle */
-        if (mode == AXP288_ADC_TS_PIN_GPADC)
+        if (mode == AXP288_ADC_TS_CURRENT_ON_ONDEMAND)
                 usleep_range(6000, 10000);
 
         return 0;
@@ -145,14 +167,14 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
         mutex_lock(&indio_dev->mlock);
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
-                if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_GPADC,
+                if (axp288_adc_set_ts(info, AXP288_ADC_TS_CURRENT_ON_ONDEMAND,
                                         chan->address)) {
                         dev_err(&indio_dev->dev, "GPADC mode\n");
                         ret = -EINVAL;
                         break;
                 }
                 ret = axp288_adc_read_channel(val, chan->address, info->regmap);
-                if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_ON,
+                if (axp288_adc_set_ts(info, AXP288_ADC_TS_CURRENT_ON,
                                                 chan->address))
                         dev_err(&indio_dev->dev, "TS pin restore\n");
                 break;
@@ -164,13 +186,35 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
         return ret;
 }
 
-static int axp288_adc_set_state(struct regmap *regmap)
+static int axp288_adc_initialize(struct axp288_adc_info *info)
 {
-        /* ADC should be always enabled for internal FG to function */
-        if (regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON))
-                return -EIO;
+        int ret, adc_enable_val;
+
+        /*
+         * Determine if the TS pin is enabled and set the TS current-source
+         * accordingly.
+         */
+        ret = regmap_read(info->regmap, AXP20X_ADC_EN1, &adc_enable_val);
+        if (ret)
+                return ret;
+
+        if (adc_enable_val & AXP288_ADC_TS_ENABLE) {
+                info->ts_enabled = true;
+                ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
+                                         AXP288_ADC_TS_CURRENT_ON_OFF_MASK,
+                                         AXP288_ADC_TS_CURRENT_ON);
+        } else {
+                info->ts_enabled = false;
+                ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
+                                         AXP288_ADC_TS_CURRENT_ON_OFF_MASK,
+                                         AXP288_ADC_TS_CURRENT_OFF);
+        }
+        if (ret)
+                return ret;
 
-        return regmap_write(regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
+        /* Turn on the ADC for all channels except TS, leave TS as is */
+        return regmap_update_bits(info->regmap, AXP20X_ADC_EN1,
+                                  AXP288_ADC_EN_MASK, AXP288_ADC_EN_MASK);
 }
 
 static const struct iio_info axp288_adc_iio_info = {
@@ -200,7 +244,7 @@ static int axp288_adc_probe(struct platform_device *pdev)
          * Set ADC to enabled state at all time, including system suspend.
          * otherwise internal fuel gauge functionality may be affected.
          */
-        ret = axp288_adc_set_state(axp20x->regmap);
+        ret = axp288_adc_initialize(info);
         if (ret) {
                 dev_err(&pdev->dev, "unable to enable ADC device\n");
                 return ret;
diff --git a/drivers/iio/adc/ti-ads8688.c b/drivers/iio/adc/ti-ads8688.c
index 184d686ebd99..8b4568edd5cb 100644
--- a/drivers/iio/adc/ti-ads8688.c
+++ b/drivers/iio/adc/ti-ads8688.c
@@ -41,6 +41,7 @@
 
 #define ADS8688_VREF_MV                 4096
 #define ADS8688_REALBITS                16
+#define ADS8688_MAX_CHANNELS            8
 
 /*
  * enum ads8688_range - ADS8688 reference voltage range
@@ -385,7 +386,7 @@ static irqreturn_t ads8688_trigger_handler(int irq, void *p)
 {
         struct iio_poll_func *pf = p;
         struct iio_dev *indio_dev = pf->indio_dev;
-        u16 buffer[8];
+        u16 buffer[ADS8688_MAX_CHANNELS + sizeof(s64)/sizeof(u16)];
         int i, j = 0;
 
         for (i = 0; i < indio_dev->masklength; i++) {
diff --git a/drivers/iio/chemical/atlas-ph-sensor.c b/drivers/iio/chemical/atlas-ph-sensor.c
index a406ad31b096..3a20cb5d9bff 100644
--- a/drivers/iio/chemical/atlas-ph-sensor.c
+++ b/drivers/iio/chemical/atlas-ph-sensor.c
@@ -444,9 +444,8 @@ static int atlas_read_raw(struct iio_dev *indio_dev,
         case IIO_CHAN_INFO_SCALE:
                 switch (chan->type) {
                 case IIO_TEMP:
-                        *val = 1; /* 0.01 */
-                        *val2 = 100;
-                        break;
+                        *val = 10;
+                        return IIO_VAL_INT;
                 case IIO_PH:
                         *val = 1; /* 0.001 */
                         *val2 = 1000;
@@ -477,7 +476,7 @@ static int atlas_write_raw(struct iio_dev *indio_dev,
                            int val, int val2, long mask)
 {
         struct atlas_data *data = iio_priv(indio_dev);
-        __be32 reg = cpu_to_be32(val);
+        __be32 reg = cpu_to_be32(val / 10);
 
         if (val2 != 0 || val < 0 || val > 20000)
                 return -EINVAL;
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index 3cd830d52967..616734313f0c 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -267,7 +267,6 @@ static inline int ib_mad_enforce_security(struct ib_mad_agent_private *map,
 #endif
 
 struct ib_device *ib_device_get_by_index(u32 ifindex);
-void ib_device_put(struct ib_device *device);
 /* RDMA device netlink */
 void nldev_init(void);
 void nldev_exit(void);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 8872453e26c0..238ec42778ef 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -156,19 +156,26 @@ struct ib_device *ib_device_get_by_index(u32 index)
         down_read(&lists_rwsem);
         device = __ib_device_get_by_index(index);
         if (device) {
-                /* Do not return a device if unregistration has started. */
-                if (!refcount_inc_not_zero(&device->refcount))
+                if (!ib_device_try_get(device))
                         device = NULL;
         }
         up_read(&lists_rwsem);
         return device;
 }
 
+/**
+ * ib_device_put - Release IB device reference
+ * @device: device whose reference to be released
+ *
+ * ib_device_put() releases reference to the IB device to allow it to be
+ * unregistered and eventually free.
+ */
 void ib_device_put(struct ib_device *device)
 {
         if (refcount_dec_and_test(&device->refcount))
                 complete(&device->unreg_completion);
 }
+EXPORT_SYMBOL(ib_device_put);
 
 static struct ib_device *__ib_device_get_by_name(const char *name)
 {
@@ -303,7 +310,6 @@ struct ib_device *ib_alloc_device(size_t size)
         rwlock_init(&device->client_data_lock);
         INIT_LIST_HEAD(&device->client_data_list);
         INIT_LIST_HEAD(&device->port_list);
-        refcount_set(&device->refcount, 1);
         init_completion(&device->unreg_completion);
 
         return device;
@@ -620,6 +626,7 @@ int ib_register_device(struct ib_device *device, const char *name,
                 goto cg_cleanup;
         }
 
+        refcount_set(&device->refcount, 1);
         device->reg_state = IB_DEV_REGISTERED;
 
         list_for_each_entry(client, &client_list, list)
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index a4ec43093cb3..acb882f279cb 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -352,6 +352,8 @@ struct ib_umem_odp *ib_alloc_odp_umem(struct ib_ucontext_per_mm *per_mm,
         umem->writable   = 1;
         umem->is_odp = 1;
         odp_data->per_mm = per_mm;
+        umem->owning_mm  = per_mm->mm;
+        mmgrab(umem->owning_mm);
 
         mutex_init(&odp_data->umem_mutex);
         init_completion(&odp_data->notifier_completion);
@@ -384,6 +386,7 @@ struct ib_umem_odp *ib_alloc_odp_umem(struct ib_ucontext_per_mm *per_mm,
 out_page_list:
         vfree(odp_data->page_list);
 out_odp_data:
+        mmdrop(umem->owning_mm);
         kfree(odp_data);
         return ERR_PTR(ret);
 }
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 2890a77339e1..5f366838b7ff 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -204,6 +204,9 @@ void ib_uverbs_release_file(struct kref *ref)
         if (atomic_dec_and_test(&file->device->refcount))
                 ib_uverbs_comp_dev(file->device);
 
+        if (file->async_file)
+                kref_put(&file->async_file->ref,
+                         ib_uverbs_release_async_event_file);
         put_device(&file->device->dev);
         kfree(file);
 }
@@ -964,11 +967,19 @@ void uverbs_user_mmap_disassociate(struct ib_uverbs_file *ufile)
 
                 /* Get an arbitrary mm pointer that hasn't been cleaned yet */
                 mutex_lock(&ufile->umap_lock);
-                if (!list_empty(&ufile->umaps)) {
-                        mm = list_first_entry(&ufile->umaps,
-                                              struct rdma_umap_priv, list)
-                                     ->vma->vm_mm;
-                        mmget(mm);
+                while (!list_empty(&ufile->umaps)) {
+                        int ret;
+
+                        priv = list_first_entry(&ufile->umaps,
+                                                struct rdma_umap_priv, list);
+                        mm = priv->vma->vm_mm;
+                        ret = mmget_not_zero(mm);
+                        if (!ret) {
+                                list_del_init(&priv->list);
+                                mm = NULL;
+                                continue;
+                        }
+                        break;
                 }
                 mutex_unlock(&ufile->umap_lock);
                 if (!mm)
@@ -1096,10 +1107,6 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
         list_del_init(&file->list);
         mutex_unlock(&file->device->lists_mutex);
 
-        if (file->async_file)
-                kref_put(&file->async_file->ref,
-                         ib_uverbs_release_async_event_file);
-
         kref_put(&file->ref, ib_uverbs_release_file);
 
         return 0;
diff --git a/drivers/infiniband/core/uverbs_std_types_device.c b/drivers/infiniband/core/uverbs_std_types_device.c
index 5030ec480370..2a3f2f01028d 100644
--- a/drivers/infiniband/core/uverbs_std_types_device.c
+++ b/drivers/infiniband/core/uverbs_std_types_device.c
@@ -168,12 +168,18 @@ void copy_port_attr_to_resp(struct ib_port_attr *attr,
 static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_PORT)(
         struct uverbs_attr_bundle *attrs)
 {
-        struct ib_device *ib_dev = attrs->ufile->device->ib_dev;
+        struct ib_device *ib_dev;
         struct ib_port_attr attr = {};
         struct ib_uverbs_query_port_resp_ex resp = {};
+        struct ib_ucontext *ucontext;
         int ret;
         u8 port_num;
 
+        ucontext = ib_uverbs_get_ucontext(attrs);
+        if (IS_ERR(ucontext))
+                return PTR_ERR(ucontext);
+        ib_dev = ucontext->device;
+
         /* FIXME: Extend the UAPI_DEF_OBJ_NEEDS_FN stuff.. */
         if (!ib_dev->ops.query_port)
                 return -EOPNOTSUPP;
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index c22ebc774a6a..f9a7e9d29c8b 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -488,7 +488,7 @@ static int hfi1_file_mmap(struct file *fp, struct vm_area_struct *vma)
                 vmf = 1;
                 break;
         case STATUS:
-                if (flags & (unsigned long)(VM_WRITE | VM_EXEC)) {
+                if (flags & VM_WRITE) {
                         ret = -EPERM;
                         goto done;
                 }
diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
index 88242fe95eaa..bf96067876c9 100644
--- a/drivers/infiniband/hw/hfi1/ud.c
+++ b/drivers/infiniband/hw/hfi1/ud.c
@@ -987,7 +987,6 @@ void hfi1_ud_rcv(struct hfi1_packet *packet)
             opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
                 wc.ex.imm_data = packet->ohdr->u.ud.imm_data;
                 wc.wc_flags = IB_WC_WITH_IMM;
-                tlen -= sizeof(u32);
         } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
                 wc.ex.imm_data = 0;
                 wc.wc_flags = 0;
diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c
index 960b1946c365..12deacf442cf 100644
--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
+++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
@@ -210,6 +210,7 @@ struct ib_srq *hns_roce_create_srq(struct ib_pd *pd,
                                    struct ib_udata *udata)
 {
         struct hns_roce_dev *hr_dev = to_hr_dev(pd->device);
+        struct hns_roce_ib_create_srq_resp resp = {};
         struct hns_roce_srq *srq;
         int srq_desc_size;
         int srq_buf_size;
@@ -378,16 +379,21 @@ struct ib_srq *hns_roce_create_srq(struct ib_pd *pd,
 
         srq->event = hns_roce_ib_srq_event;
         srq->ibsrq.ext.xrc.srq_num = srq->srqn;
+        resp.srqn = srq->srqn;
 
         if (udata) {
-                if (ib_copy_to_udata(udata, &srq->srqn, sizeof(__u32))) {
+                if (ib_copy_to_udata(udata, &resp,
+                                     min(udata->outlen, sizeof(resp)))) {
                         ret = -EFAULT;
-                        goto err_wrid;
+                        goto err_srqc_alloc;
                 }
         }
 
         return &srq->ibsrq;
 
+err_srqc_alloc:
+        hns_roce_srq_free(hr_dev, srq);
+
 err_wrid:
         kvfree(srq->wrid);
 
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 25439da8976c..936ee1314bcd 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1411,7 +1411,7 @@ int mlx4_ib_send_to_wire(struct mlx4_ib_dev *dev, int slave, u8 port,
 
         sqp_mad = (struct mlx4_mad_snd_buf *) (sqp->tx_ring[wire_tx_ix].buf.addr);
         if (sqp->tx_ring[wire_tx_ix].ah)
-                rdma_destroy_ah(sqp->tx_ring[wire_tx_ix].ah, 0);
+                mlx4_ib_destroy_ah(sqp->tx_ring[wire_tx_ix].ah, 0);
         sqp->tx_ring[wire_tx_ix].ah = ah;
         ib_dma_sync_single_for_cpu(&dev->ib_dev,
                                    sqp->tx_ring[wire_tx_ix].buf.map,
@@ -1902,7 +1902,7 @@ static void mlx4_ib_sqp_comp_worker(struct work_struct *work)
                 if (wc.status == IB_WC_SUCCESS) {
                         switch (wc.opcode) {
                         case IB_WC_SEND:
-                                rdma_destroy_ah(sqp->tx_ring[wc.wr_id &
+                                mlx4_ib_destroy_ah(sqp->tx_ring[wc.wr_id &
                                               (MLX4_NUM_TUNNEL_BUFS - 1)].ah, 0);
                                 sqp->tx_ring[wc.wr_id & (MLX4_NUM_TUNNEL_BUFS - 1)].ah
                                         = NULL;
@@ -1931,7 +1931,7 @@ static void mlx4_ib_sqp_comp_worker(struct work_struct *work)
                                  " status = %d, wrid = 0x%llx\n",
                                  ctx->slave, wc.status, wc.wr_id);
                         if (!MLX4_TUN_IS_RECV(wc.wr_id)) {
-                                rdma_destroy_ah(sqp->tx_ring[wc.wr_id &
+                                mlx4_ib_destroy_ah(sqp->tx_ring[wc.wr_id &
                                               (MLX4_NUM_TUNNEL_BUFS - 1)].ah, 0);
                                 sqp->tx_ring[wc.wr_id & (MLX4_NUM_TUNNEL_BUFS - 1)].ah
                                         = NULL;
diff --git a/drivers/infiniband/hw/mlx5/flow.c b/drivers/infiniband/hw/mlx5/flow.c
index e8a1e4498e3f..798591a18484 100644
--- a/drivers/infiniband/hw/mlx5/flow.c
+++ b/drivers/infiniband/hw/mlx5/flow.c
@@ -630,8 +630,7 @@ const struct uapi_definition mlx5_ib_flow_defs[] = {
                 UAPI_DEF_IS_OBJ_SUPPORTED(flow_is_supported)),
         UAPI_DEF_CHAIN_OBJ_TREE(
                 UVERBS_OBJECT_FLOW,
-                &mlx5_ib_fs,
-                UAPI_DEF_IS_OBJ_SUPPORTED(flow_is_supported)),
+                &mlx5_ib_fs),
         UAPI_DEF_CHAIN_OBJ_TREE(UVERBS_OBJECT_FLOW_ACTION,
                                 &mlx5_ib_flow_actions),
         {},
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index 01e0f6200631..4ee32964e1dd 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -1595,10 +1595,12 @@ static void mlx5_ib_prefetch_mr_work(struct work_struct *work)
         struct prefetch_mr_work *w =
                 container_of(work, struct prefetch_mr_work, work);
 
-        if (w->dev->ib_dev.reg_state == IB_DEV_REGISTERED)
+        if (ib_device_try_get(&w->dev->ib_dev)) {
                 mlx5_ib_prefetch_sg_list(w->dev, w->pf_flags, w->sg_list,
                                          w->num_sge);
-
+                ib_device_put(&w->dev->ib_dev);
+        }
+        put_device(&w->dev->ib_dev.dev);
         kfree(w);
 }
 
@@ -1617,15 +1619,13 @@ int mlx5_ib_advise_mr_prefetch(struct ib_pd *pd,
                 return mlx5_ib_prefetch_sg_list(dev, pf_flags, sg_list,
                                                 num_sge);
 
-        if (dev->ib_dev.reg_state != IB_DEV_REGISTERED)
-                return -ENODEV;
-
         work = kvzalloc(struct_size(work, sg_list, num_sge), GFP_KERNEL);
         if (!work)
                 return -ENOMEM;
 
         memcpy(work->sg_list, sg_list, num_sge * sizeof(struct ib_sge));
 
+        get_device(&dev->ib_dev.dev);
         work->dev = dev;
         work->pf_flags = pf_flags;
         work->num_sge = num_sge;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index dd2ae640bc84..7db778d96ef5 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1912,14 +1912,16 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
                 }
 
                 if (!check_flags_mask(ucmd.flags,
+                                      MLX5_QP_FLAG_ALLOW_SCATTER_CQE |
+                                      MLX5_QP_FLAG_BFREG_INDEX |
+                                      MLX5_QP_FLAG_PACKET_BASED_CREDIT_MODE |
+                                      MLX5_QP_FLAG_SCATTER_CQE |
                                       MLX5_QP_FLAG_SIGNATURE |
-                                              MLX5_QP_FLAG_SCATTER_CQE |
-                                              MLX5_QP_FLAG_TUNNEL_OFFLOADS |
-                                              MLX5_QP_FLAG_BFREG_INDEX |
-                                              MLX5_QP_FLAG_TYPE_DCT |
-                                              MLX5_QP_FLAG_TYPE_DCI |
-                                              MLX5_QP_FLAG_ALLOW_SCATTER_CQE |
-                                              MLX5_QP_FLAG_PACKET_BASED_CREDIT_MODE))
+                                      MLX5_QP_FLAG_TIR_ALLOW_SELF_LB_MC |
+                                      MLX5_QP_FLAG_TIR_ALLOW_SELF_LB_UC |
+                                      MLX5_QP_FLAG_TUNNEL_OFFLOADS |
+                                      MLX5_QP_FLAG_TYPE_DCI |
+                                      MLX5_QP_FLAG_TYPE_DCT))
                         return -EINVAL;
 
                 err = get_qp_user_index(to_mucontext(pd->uobject->context),
diff --git a/drivers/infiniband/hw/qib/qib_ud.c b/drivers/infiniband/hw/qib/qib_ud.c
index 868da0ece7ba..445ea19a2ec8 100644
--- a/drivers/infiniband/hw/qib/qib_ud.c
+++ b/drivers/infiniband/hw/qib/qib_ud.c
@@ -512,7 +512,6 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct ib_header *hdr,
             opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
                 wc.ex.imm_data = ohdr->u.ud.imm_data;
                 wc.wc_flags = IB_WC_WITH_IMM;
-                tlen -= sizeof(u32);
         } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
                 wc.ex.imm_data = 0;
                 wc.wc_flags = 0;
diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
index a1bd8cfc2c25..c6cc3e4ab71d 100644
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -2910,6 +2910,8 @@ send:
                         goto op_err;
                 if (!ret)
                         goto rnr_nak;
+                if (wqe->length > qp->r_len)
+                        goto inv_err;
                 break;
 
         case IB_WR_RDMA_WRITE_WITH_IMM:
@@ -3078,7 +3080,10 @@ op_err:
         goto err;
 
 inv_err:
-        send_status = IB_WC_REM_INV_REQ_ERR;
+        send_status =
+                sqp->ibqp.qp_type == IB_QPT_RC ?
+                        IB_WC_REM_INV_REQ_ERR :
+                        IB_WC_SUCCESS;
         wc.status = IB_WC_LOC_QP_OP_ERR;
         goto err;
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 1da119d901a9..73e808c1e6ad 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -248,7 +248,6 @@ struct ipoib_cm_tx {
         struct list_head     list;
         struct net_device   *dev;
         struct ipoib_neigh  *neigh;
-        struct ipoib_path   *path;
         struct ipoib_tx_buf *tx_ring;
         unsigned int         tx_head;
         unsigned int         tx_tail;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 0428e01e8f69..aa9dcfc36cd3 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1312,7 +1312,6 @@ struct ipoib_cm_tx *ipoib_cm_create_tx(struct net_device *dev, struct ipoib_path
 
         neigh->cm = tx;
         tx->neigh = neigh;
-        tx->path = path;
         tx->dev = dev;
         list_add(&tx->list, &priv->cm.start_list);
         set_bit(IPOIB_FLAG_INITIALIZED, &tx->flags);
@@ -1371,7 +1370,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
                                 neigh->daddr + QPN_AND_OPTIONS_OFFSET);
                         goto free_neigh;
                 }
-                memcpy(&pathrec, &p->path->pathrec, sizeof(pathrec));
+                memcpy(&pathrec, &path->pathrec, sizeof(pathrec));
 
                 spin_unlock_irqrestore(&priv->lock, flags);
                 netif_tx_unlock_bh(dev);
diff --git a/drivers/input/serio/olpc_apsp.c b/drivers/input/serio/olpc_apsp.c
index bae08226e3d9..a7cfab3db9ee 100644
--- a/drivers/input/serio/olpc_apsp.c
+++ b/drivers/input/serio/olpc_apsp.c
@@ -23,7 +23,6 @@
 #include <linux/of.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
-#include <linux/clk.h>
 
 /*
  * The OLPC XO-1.75 and XO-4 laptops do not have a hardware PS/2 controller.
@@ -75,7 +74,6 @@ struct olpc_apsp {
         struct serio *kbio;
         struct serio *padio;
         void __iomem *base;
-        struct clk *clk;
         int open_count;
         int irq;
 };
@@ -148,17 +146,11 @@ static int olpc_apsp_open(struct serio *port)
         struct olpc_apsp *priv = port->port_data;
         unsigned int tmp;
         unsigned long l;
-        int error;
 
         if (priv->open_count++ == 0) {
-                error = clk_prepare_enable(priv->clk);
-                if (error)
-                        return error;
-
                 l = readl(priv->base + COMMAND_FIFO_STATUS);
                 if (!(l & CMD_STS_MASK)) {
                         dev_err(priv->dev, "SP cannot accept commands.\n");
-                        clk_disable_unprepare(priv->clk);
                         return -EIO;
                 }
 
@@ -179,8 +171,6 @@ static void olpc_apsp_close(struct serio *port)
                 /* Disable interrupt 0 */
                 tmp = readl(priv->base + PJ_INTERRUPT_MASK);
                 writel(tmp | INT_0, priv->base + PJ_INTERRUPT_MASK);
-
-                clk_disable_unprepare(priv->clk);
         }
 }
 
@@ -208,10 +198,6 @@ static int olpc_apsp_probe(struct platform_device *pdev)
         if (priv->irq < 0)
                 return priv->irq;
 
-        priv->clk = devm_clk_get(&pdev->dev, "sp");
-        if (IS_ERR(priv->clk))
-                return PTR_ERR(priv->clk);
-
         /* KEYBOARD */
         kb_serio = kzalloc(sizeof(struct serio), GFP_KERNEL);
         if (!kb_serio)
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 87ba23a75b38..2a7b78bb98b4 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -1991,16 +1991,13 @@ static void do_attach(struct iommu_dev_data *dev_data,
 
 static void do_detach(struct iommu_dev_data *dev_data)
 {
+        struct protection_domain *domain = dev_data->domain;
         struct amd_iommu *iommu;
         u16 alias;
 
         iommu = amd_iommu_rlookup_table[dev_data->devid];
         alias = dev_data->alias;
 
-        /* decrease reference counters */
-        dev_data->domain->dev_iommu[iommu->index] -= 1;
-        dev_data->domain->dev_cnt                 -= 1;
-
         /* Update data structures */
         dev_data->domain = NULL;
         list_del(&dev_data->list);
@@ -2010,6 +2007,16 @@ static void do_detach(struct iommu_dev_data *dev_data)
 
         /* Flush the DTE entry */
         device_flush_dte(dev_data);
+
+        /* Flush IOTLB */
+        domain_flush_tlb_pde(domain);
+
+        /* Wait for the flushes to finish */
+        domain_flush_complete(domain);
+
+        /* decrease reference counters - needs to happen after the flushes */
+        domain->dev_iommu[iommu->index] -= 1;
+        domain->dev_cnt                 -= 1;
 }
 
 /*
@@ -2617,13 +2624,13 @@ out_unmap:
                         bus_addr  = address + s->dma_address + (j << PAGE_SHIFT);
                         iommu_unmap_page(domain, bus_addr, PAGE_SIZE);
 
-                        if (--mapped_pages)
+                        if (--mapped_pages == 0)
                                 goto out_free_iova;
                 }
         }
 
 out_free_iova:
-        free_iova_fast(&dma_dom->iovad, address, npages);
+        free_iova_fast(&dma_dom->iovad, address >> PAGE_SHIFT, npages);
 
 out_err:
         return 0;
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 2bd9ac285c0d..1457f931218e 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -5294,7 +5294,7 @@ static void intel_iommu_put_resv_regions(struct device *dev,
         struct iommu_resv_region *entry, *next;
 
         list_for_each_entry_safe(entry, next, head, list) {
-                if (entry->type == IOMMU_RESV_RESERVED)
+                if (entry->type == IOMMU_RESV_MSI)
                         kfree(entry);
         }
 }
diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
index 730f7dabcf37..7e0df67bd3e9 100644
--- a/drivers/iommu/mtk_iommu_v1.c
+++ b/drivers/iommu/mtk_iommu_v1.c
@@ -441,6 +441,10 @@ static int mtk_iommu_add_device(struct device *dev)
                 iommu_spec.args_count = count;
 
                 mtk_iommu_create_mapping(dev, &iommu_spec);
+
+                /* dev->iommu_fwspec might have changed */
+                fwspec = dev_iommu_fwspec_get(dev);
+
                 of_node_put(iommu_spec.np);
         }
 
diff --git a/drivers/irqchip/irq-xtensa-mx.c b/drivers/irqchip/irq-xtensa-mx.c
index 5385f5768345..27933338f7b3 100644
--- a/drivers/irqchip/irq-xtensa-mx.c
+++ b/drivers/irqchip/irq-xtensa-mx.c
@@ -71,14 +71,17 @@ static void xtensa_mx_irq_mask(struct irq_data *d)
         unsigned int mask = 1u << d->hwirq;
 
         if (mask & (XCHAL_INTTYPE_MASK_EXTERN_EDGE |
-                                XCHAL_INTTYPE_MASK_EXTERN_LEVEL)) {
-                set_er(1u << (xtensa_get_ext_irq_no(d->hwirq) -
-                                        HW_IRQ_MX_BASE), MIENG);
-        } else {
-                mask = __this_cpu_read(cached_irq_mask) & ~mask;
-                __this_cpu_write(cached_irq_mask, mask);
-                xtensa_set_sr(mask, intenable);
+                    XCHAL_INTTYPE_MASK_EXTERN_LEVEL)) {
+                unsigned int ext_irq = xtensa_get_ext_irq_no(d->hwirq);
+
+                if (ext_irq >= HW_IRQ_MX_BASE) {
+                        set_er(1u << (ext_irq - HW_IRQ_MX_BASE), MIENG);
+                        return;
+                }
         }
+        mask = __this_cpu_read(cached_irq_mask) & ~mask;
+        __this_cpu_write(cached_irq_mask, mask);
+        xtensa_set_sr(mask, intenable);
 }
 
 static void xtensa_mx_irq_unmask(struct irq_data *d)
@@ -86,14 +89,17 @@ static void xtensa_mx_irq_unmask(struct irq_data *d)
         unsigned int mask = 1u << d->hwirq;
 
         if (mask & (XCHAL_INTTYPE_MASK_EXTERN_EDGE |
-                                XCHAL_INTTYPE_MASK_EXTERN_LEVEL)) {
-                set_er(1u << (xtensa_get_ext_irq_no(d->hwirq) -
-                                        HW_IRQ_MX_BASE), MIENGSET);
-        } else {
-                mask |= __this_cpu_read(cached_irq_mask);
-                __this_cpu_write(cached_irq_mask, mask);
-                xtensa_set_sr(mask, intenable);
+                    XCHAL_INTTYPE_MASK_EXTERN_LEVEL)) {
+                unsigned int ext_irq = xtensa_get_ext_irq_no(d->hwirq);
+
+                if (ext_irq >= HW_IRQ_MX_BASE) {
+                        set_er(1u << (ext_irq - HW_IRQ_MX_BASE), MIENGSET);
+                        return;
+                }
         }
+        mask |= __this_cpu_read(cached_irq_mask);
+        __this_cpu_write(cached_irq_mask, mask);
+        xtensa_set_sr(mask, intenable);
 }
 
 static void xtensa_mx_irq_enable(struct irq_data *d)
@@ -113,7 +119,11 @@ static void xtensa_mx_irq_ack(struct irq_data *d)
 
 static int xtensa_mx_irq_retrigger(struct irq_data *d)
 {
-        xtensa_set_sr(1 << d->hwirq, intset);
+        unsigned int mask = 1u << d->hwirq;
+
+        if (WARN_ON(mask & ~XCHAL_INTTYPE_MASK_SOFTWARE))
+                return 0;
+        xtensa_set_sr(mask, intset);
         return 1;
 }
 
diff --git a/drivers/irqchip/irq-xtensa-pic.c b/drivers/irqchip/irq-xtensa-pic.c
index c200234dd2c9..ab12328be5ee 100644
--- a/drivers/irqchip/irq-xtensa-pic.c
+++ b/drivers/irqchip/irq-xtensa-pic.c
@@ -70,7 +70,11 @@ static void xtensa_irq_ack(struct irq_data *d)
 
 static int xtensa_irq_retrigger(struct irq_data *d)
 {
-        xtensa_set_sr(1 << d->hwirq, intset);
+        unsigned int mask = 1u << d->hwirq;
+
+        if (WARN_ON(mask & ~XCHAL_INTTYPE_MASK_SOFTWARE))
+                return 0;
+        xtensa_set_sr(mask, intset);
         return 1;
 }
 
diff --git a/drivers/isdn/mISDN/timerdev.c b/drivers/isdn/mISDN/timerdev.c
index 211ed6cffd10..578978711887 100644
--- a/drivers/isdn/mISDN/timerdev.c
+++ b/drivers/isdn/mISDN/timerdev.c
@@ -170,8 +170,8 @@ dev_expire_timer(struct timer_list *t)
         spin_lock_irqsave(&timer->dev->lock, flags);
         if (timer->id >= 0)
                 list_move_tail(&timer->list, &timer->dev->expired);
-        spin_unlock_irqrestore(&timer->dev->lock, flags);
         wake_up_interruptible(&timer->dev->wait);
+        spin_unlock_irqrestore(&timer->dev->lock, flags);
 }
 
 static int
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 4eb5f8c56535..a20531e5f3b4 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -131,7 +131,7 @@ static void rq_end_stats(struct mapped_device *md, struct request *orig)
 static void rq_completed(struct mapped_device *md)
 {
         /* nudge anyone waiting on suspend queue */
-        if (unlikely(waitqueue_active(&md->wait)))
+        if (unlikely(wq_has_sleeper(&md->wait)))
                 wake_up(&md->wait);
 
         /*
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 2b53c3841b53..515e6af9bed2 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -699,7 +699,7 @@ static void end_io_acct(struct dm_io *io)
                                     true, duration, &io->stats_aux);
 
         /* nudge anyone waiting on suspend queue */
-        if (unlikely(waitqueue_active(&md->wait)))
+        if (unlikely(wq_has_sleeper(&md->wait)))
                 wake_up(&md->wait);
 }
 
@@ -1336,7 +1336,11 @@ static int clone_bio(struct dm_target_io *tio, struct bio *bio,
                         return r;
         }
 
-        bio_trim(clone, sector - clone->bi_iter.bi_sector, len);
+        bio_advance(clone, to_bytes(sector - clone->bi_iter.bi_sector));
+        clone->bi_iter.bi_size = to_bytes(len);
+
+        if (bio_integrity(bio))
+                bio_integrity_trim(clone);
 
         return 0;
 }
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index ec3a5ef7fee0..cbbe6b6535be 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -1935,12 +1935,14 @@ out:
 }
 
 static struct stripe_head *
-r5c_recovery_alloc_stripe(struct r5conf *conf,
-                          sector_t stripe_sect)
+r5c_recovery_alloc_stripe(
+                struct r5conf *conf,
+                sector_t stripe_sect,
+                int noblock)
 {
         struct stripe_head *sh;
 
-        sh = raid5_get_active_stripe(conf, stripe_sect, 0, 1, 0);
+        sh = raid5_get_active_stripe(conf, stripe_sect, 0, noblock, 0);
         if (!sh)
                 return NULL;  /* no more stripe available */
 
@@ -2150,7 +2152,7 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
                                                 stripe_sect);
 
                 if (!sh) {
-                        sh = r5c_recovery_alloc_stripe(conf, stripe_sect);
+                        sh = r5c_recovery_alloc_stripe(conf, stripe_sect, 1);
                         /*
                          * cannot get stripe from raid5_get_active_stripe
                          * try replay some stripes
@@ -2159,20 +2161,29 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
                                 r5c_recovery_replay_stripes(
                                         cached_stripe_list, ctx);
                                 sh = r5c_recovery_alloc_stripe(
-                                        conf, stripe_sect);
+                                        conf, stripe_sect, 1);
                         }
                         if (!sh) {
+                                int new_size = conf->min_nr_stripes * 2;
                                 pr_debug("md/raid:%s: Increasing stripe cache size to %d to recovery data on journal.\n",
                                         mdname(mddev),
-                                        conf->min_nr_stripes * 2);
-                                raid5_set_cache_size(mddev,
-                                                     conf->min_nr_stripes * 2);
-                                sh = r5c_recovery_alloc_stripe(conf,
-                                                               stripe_sect);
+                                        new_size);
+                                ret = raid5_set_cache_size(mddev, new_size);
+                                if (conf->min_nr_stripes <= new_size / 2) {
+                                        pr_err("md/raid:%s: Cannot increase cache size, ret=%d, new_size=%d, min_nr_stripes=%d, max_nr_stripes=%d\n",
+                                                mdname(mddev),
+                                                ret,
+                                                new_size,
+                                                conf->min_nr_stripes,
+                                                conf->max_nr_stripes);
+                                        return -ENOMEM;
+                                }
+                                sh = r5c_recovery_alloc_stripe(
+                                        conf, stripe_sect, 0);
                         }
                         if (!sh) {
                                 pr_err("md/raid:%s: Cannot get enough stripes due to memory pressure. Recovery failed.\n",
-                                       mdname(mddev));
+                                        mdname(mddev));
                                 return -ENOMEM;
                         }
                         list_add_tail(&sh->lru, cached_stripe_list);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 4990f0319f6c..cecea901ab8c 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -6369,6 +6369,7 @@ raid5_show_stripe_cache_size(struct mddev *mddev, char *page)
 int
 raid5_set_cache_size(struct mddev *mddev, int size)
 {
+        int result = 0;
         struct r5conf *conf = mddev->private;
 
         if (size <= 16 || size > 32768)
@@ -6385,11 +6386,14 @@ raid5_set_cache_size(struct mddev *mddev, int size)
 
         mutex_lock(&conf->cache_size_mutex);
         while (size > conf->max_nr_stripes)
-                if (!grow_one_stripe(conf, GFP_KERNEL))
+                if (!grow_one_stripe(conf, GFP_KERNEL)) {
+                        conf->min_nr_stripes = conf->max_nr_stripes;
+                        result = -ENOMEM;
                         break;
+                }
         mutex_unlock(&conf->cache_size_mutex);
 
-        return 0;
+        return result;
 }
 EXPORT_SYMBOL(raid5_set_cache_size);
 
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index f461460a2aeb..76f9909cf396 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -1419,7 +1419,7 @@ config MFD_TPS65217
 
 config MFD_TPS68470
         bool "TI TPS68470 Power Management / LED chips"
-        depends on ACPI && I2C=y
+        depends on ACPI && PCI && I2C=y
         select MFD_CORE
         select REGMAP_I2C
         select I2C_DESIGNWARE_PLATFORM
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 1fc8ea0f519b..ca4c9cc218a2 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -401,8 +401,11 @@ static void mei_io_list_flush_cl(struct list_head *head,
         struct mei_cl_cb *cb, *next;
 
         list_for_each_entry_safe(cb, next, head, list) {
-                if (cl == cb->cl)
+                if (cl == cb->cl) {
                         list_del_init(&cb->list);
+                        if (cb->fop_type == MEI_FOP_READ)
+                                mei_io_cb_free(cb);
+                }
         }
 }
 
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index 23739a60517f..bb1ee9834a02 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -139,6 +139,8 @@
 #define MEI_DEV_ID_CNP_H      0xA360  /* Cannon Point H */
 #define MEI_DEV_ID_CNP_H_4    0xA364  /* Cannon Point H 4 (iTouch) */
 
+#define MEI_DEV_ID_ICP_LP     0x34E0  /* Ice Lake Point LP */
+
 /*
  * MEI HW Section
  */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index e89497f858ae..3ab946ad3257 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -105,6 +105,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
         {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH12_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)},
 
+        {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
+
         /* required last entry */
         {0, }
 };
diff --git a/drivers/misc/mic/vop/vop_main.c b/drivers/misc/mic/vop/vop_main.c
index 2bfa3a903bf9..744757f541be 100644
--- a/drivers/misc/mic/vop/vop_main.c
+++ b/drivers/misc/mic/vop/vop_main.c
@@ -47,7 +47,8 @@
  * @dc: Virtio device control
  * @vpdev: VOP device which is the parent for this virtio device
  * @vr: Buffer for accessing the VRING
- * @used: Buffer for used
+ * @used_virt: Virtual address of used ring
+ * @used: DMA address of used ring
  * @used_size: Size of the used buffer
  * @reset_done: Track whether VOP reset is complete
  * @virtio_cookie: Cookie returned upon requesting a interrupt
@@ -61,6 +62,7 @@ struct _vop_vdev {
         struct mic_device_ctrl __iomem *dc;
         struct vop_device *vpdev;
         void __iomem *vr[VOP_MAX_VRINGS];
+        void *used_virt[VOP_MAX_VRINGS];
         dma_addr_t used[VOP_MAX_VRINGS];
         int used_size[VOP_MAX_VRINGS];
         struct completion reset_done;
@@ -260,12 +262,12 @@ static bool vop_notify(struct virtqueue *vq)
 static void vop_del_vq(struct virtqueue *vq, int n)
 {
         struct _vop_vdev *vdev = to_vopvdev(vq->vdev);
-        struct vring *vr = (struct vring *)(vq + 1);
         struct vop_device *vpdev = vdev->vpdev;
 
         dma_unmap_single(&vpdev->dev, vdev->used[n],
                          vdev->used_size[n], DMA_BIDIRECTIONAL);
-        free_pages((unsigned long)vr->used, get_order(vdev->used_size[n]));
+        free_pages((unsigned long)vdev->used_virt[n],
+                   get_order(vdev->used_size[n]));
         vring_del_virtqueue(vq);
         vpdev->hw_ops->iounmap(vpdev, vdev->vr[n]);
         vdev->vr[n] = NULL;
@@ -283,6 +285,26 @@ static void vop_del_vqs(struct virtio_device *dev)
                 vop_del_vq(vq, idx++);
 }
 
+static struct virtqueue *vop_new_virtqueue(unsigned int index,
+                                      unsigned int num,
+                                      struct virtio_device *vdev,
+                                      bool context,
+                                      void *pages,
+                                      bool (*notify)(struct virtqueue *vq),
+                                      void (*callback)(struct virtqueue *vq),
+                                      const char *name,
+                                      void *used)
+{
+        bool weak_barriers = false;
+        struct vring vring;
+
+        vring_init(&vring, num, pages, MIC_VIRTIO_RING_ALIGN);
+        vring.used = used;
+
+        return __vring_new_virtqueue(index, vring, vdev, weak_barriers, context,
+                                     notify, callback, name);
+}
+
 /*
  * This routine will assign vring's allocated in host/io memory. Code in
  * virtio_ring.c however continues to access this io memory as if it were local
@@ -302,7 +324,6 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
         struct _mic_vring_info __iomem *info;
         void *used;
         int vr_size, _vr_size, err, magic;
-        struct vring *vr;
         u8 type = ioread8(&vdev->desc->type);
 
         if (index >= ioread8(&vdev->desc->num_vq))
@@ -322,17 +343,7 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
                 return ERR_PTR(-ENOMEM);
         vdev->vr[index] = va;
         memset_io(va, 0x0, _vr_size);
-        vq = vring_new_virtqueue(
-                                index,
-                                le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN,
-                                dev,
-                                false,
-                                ctx,
-                                (void __force *)va, vop_notify, callback, name);
-        if (!vq) {
-                err = -ENOMEM;
-                goto unmap;
-        }
+
         info = va + _vr_size;
         magic = ioread32(&info->magic);
 
@@ -341,18 +352,27 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
                 goto unmap;
         }
 
-        /* Allocate and reassign used ring now */
         vdev->used_size[index] = PAGE_ALIGN(sizeof(__u16) * 3 +
                                              sizeof(struct vring_used_elem) *
                                              le16_to_cpu(config.num));
         used = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
                                         get_order(vdev->used_size[index]));
+        vdev->used_virt[index] = used;
         if (!used) {
                 err = -ENOMEM;
                 dev_err(_vop_dev(vdev), "%s %d err %d\n",
                         __func__, __LINE__, err);
-                goto del_vq;
+                goto unmap;
+        }
+
+        vq = vop_new_virtqueue(index, le16_to_cpu(config.num), dev, ctx,
+                               (void __force *)va, vop_notify, callback,
+                               name, used);
+        if (!vq) {
+                err = -ENOMEM;
+                goto free_used;
         }
+
         vdev->used[index] = dma_map_single(&vpdev->dev, used,
                                             vdev->used_size[index],
                                             DMA_BIDIRECTIONAL);
@@ -360,26 +380,17 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
                 err = -ENOMEM;
                 dev_err(_vop_dev(vdev), "%s %d err %d\n",
                         __func__, __LINE__, err);
-                goto free_used;
+                goto del_vq;
         }
         writeq(vdev->used[index], &vqconfig->used_address);
-        /*
-         * To reassign the used ring here we are directly accessing
-         * struct vring_virtqueue which is a private data structure
-         * in virtio_ring.c. At the minimum, a BUILD_BUG_ON() in
-         * vring_new_virtqueue() would ensure that
-         *  (&vq->vring == (struct vring *) (&vq->vq + 1));
-         */
-        vr = (struct vring *)(vq + 1);
-        vr->used = used;
 
         vq->priv = vdev;
         return vq;
+del_vq:
+        vring_del_virtqueue(vq);
 free_used:
         free_pages((unsigned long)used,
                    get_order(vdev->used_size[index]));
-del_vq:
-        vring_del_virtqueue(vq);
 unmap:
         vpdev->hw_ops->iounmap(vpdev, vdev->vr[index]);
         return ERR_PTR(err);
@@ -581,6 +592,8 @@ static int _vop_remove_device(struct mic_device_desc __iomem *d,
         int ret = -1;
 
         if (ioread8(&dc->config_change) == MIC_VIRTIO_PARAM_DEV_REMOVE) {
+                struct device *dev = get_device(&vdev->vdev.dev);
+
                 dev_dbg(&vpdev->dev,
                         "%s %d config_change %d type %d vdev %p\n",
                         __func__, __LINE__,
@@ -592,7 +605,7 @@ static int _vop_remove_device(struct mic_device_desc __iomem *d,
                 iowrite8(-1, &dc->h2c_vdev_db);
                 if (status & VIRTIO_CONFIG_S_DRIVER_OK)
                         wait_for_completion(&vdev->reset_done);
-                put_device(&vdev->vdev.dev);
+                put_device(dev);
                 iowrite8(1, &dc->guest_ack);
                 dev_dbg(&vpdev->dev, "%s %d guest_ack %d\n",
                         __func__, __LINE__, ioread8(&dc->guest_ack));
diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c
index 50293529d6de..c9e7aa50bb0a 100644
--- a/drivers/mmc/host/bcm2835.c
+++ b/drivers/mmc/host/bcm2835.c
@@ -1431,6 +1431,8 @@ static int bcm2835_probe(struct platform_device *pdev)
 
 err:
         dev_dbg(dev, "%s -> err %d\n", __func__, ret);
+        if (host->dma_chan_rxtx)
+                dma_release_channel(host->dma_chan_rxtx);
         mmc_free_host(mmc);
 
         return ret;
diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
index 8afeaf81ae66..833ef0590af8 100644
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -846,7 +846,7 @@ static void msdc_set_mclk(struct msdc_host *host, unsigned char timing, u32 hz)
 
         if (timing == MMC_TIMING_MMC_HS400 &&
             host->dev_comp->hs400_tune)
-                sdr_set_field(host->base + PAD_CMD_TUNE,
+                sdr_set_field(host->base + tune_reg,
                               MSDC_PAD_TUNE_CMDRRDLY,
                               host->hs400_cmd_int_delay);
         dev_dbg(host->dev, "sclk: %d, timing: %d\n", host->mmc->actual_clock,
diff --git a/drivers/net/dsa/b53/b53_srab.c b/drivers/net/dsa/b53/b53_srab.c
index 90f514252987..d9c56a779c08 100644
--- a/drivers/net/dsa/b53/b53_srab.c
+++ b/drivers/net/dsa/b53/b53_srab.c
@@ -511,9 +511,6 @@ static void b53_srab_prepare_irq(struct platform_device *pdev)
         /* Clear all pending interrupts */
         writel(0xffffffff, priv->regs + B53_SRAB_INTR);
 
-        if (dev->pdata && dev->pdata->chip_id != BCM58XX_DEVICE_ID)
-                return;
-
         for (i = 0; i < B53_N_PORTS; i++) {
                 port = &priv->port_intrs[i];
 
diff --git a/drivers/net/dsa/mv88e6xxx/global1_atu.c b/drivers/net/dsa/mv88e6xxx/global1_atu.c
index 5200e4bdce93..ea243840ee0f 100644
--- a/drivers/net/dsa/mv88e6xxx/global1_atu.c
+++ b/drivers/net/dsa/mv88e6xxx/global1_atu.c
@@ -314,6 +314,7 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id)
 {
         struct mv88e6xxx_chip *chip = dev_id;
         struct mv88e6xxx_atu_entry entry;
+        int spid;
         int err;
         u16 val;
 
@@ -336,6 +337,8 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id)
         if (err)
                 goto out;
 
+        spid = entry.state;
+
         if (val & MV88E6XXX_G1_ATU_OP_AGE_OUT_VIOLATION) {
                 dev_err_ratelimited(chip->dev,
                                     "ATU age out violation for %pM\n",
@@ -344,23 +347,23 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id)
 
         if (val & MV88E6XXX_G1_ATU_OP_MEMBER_VIOLATION) {
                 dev_err_ratelimited(chip->dev,
-                                    "ATU member violation for %pM portvec %x\n",
-                                    entry.mac, entry.portvec);
-                chip->ports[entry.portvec].atu_member_violation++;
+                                    "ATU member violation for %pM portvec %x spid %d\n",
+                                    entry.mac, entry.portvec, spid);
+                chip->ports[spid].atu_member_violation++;
         }
 
         if (val & MV88E6XXX_G1_ATU_OP_MISS_VIOLATION) {
                 dev_err_ratelimited(chip->dev,
-                                    "ATU miss violation for %pM portvec %x\n",
-                                    entry.mac, entry.portvec);
-                chip->ports[entry.portvec].atu_miss_violation++;
+                                    "ATU miss violation for %pM portvec %x spid %d\n",
+                                    entry.mac, entry.portvec, spid);
+                chip->ports[spid].atu_miss_violation++;
         }
 
         if (val & MV88E6XXX_G1_ATU_OP_FULL_VIOLATION) {
                 dev_err_ratelimited(chip->dev,
-                                    "ATU full violation for %pM portvec %x\n",
-                                    entry.mac, entry.portvec);
-                chip->ports[entry.portvec].atu_full_violation++;
+                                    "ATU full violation for %pM portvec %x spid %d\n",
+                                    entry.mac, entry.portvec, spid);
+                chip->ports[spid].atu_full_violation++;
         }
         mutex_unlock(&chip->reg_lock);
 
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index f9521d0274b7..28c9b0bdf2f6 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -520,7 +520,6 @@ static void bcm_sysport_get_wol(struct net_device *dev,
                                 struct ethtool_wolinfo *wol)
 {
         struct bcm_sysport_priv *priv = netdev_priv(dev);
-        u32 reg;
 
         wol->supported = WAKE_MAGIC | WAKE_MAGICSECURE | WAKE_FILTER;
         wol->wolopts = priv->wolopts;
@@ -528,11 +527,7 @@ static void bcm_sysport_get_wol(struct net_device *dev,
         if (!(priv->wolopts & WAKE_MAGICSECURE))
                 return;
 
-        /* Return the programmed SecureOn password */
-        reg = umac_readl(priv, UMAC_PSW_MS);
-        put_unaligned_be16(reg, &wol->sopass[0]);
-        reg = umac_readl(priv, UMAC_PSW_LS);
-        put_unaligned_be32(reg, &wol->sopass[2]);
+        memcpy(wol->sopass, priv->sopass, sizeof(priv->sopass));
 }
 
 static int bcm_sysport_set_wol(struct net_device *dev,
@@ -548,13 +543,8 @@ static int bcm_sysport_set_wol(struct net_device *dev,
         if (wol->wolopts & ~supported)
                 return -EINVAL;
 
-        /* Program the SecureOn password */
-        if (wol->wolopts & WAKE_MAGICSECURE) {
-                umac_writel(priv, get_unaligned_be16(&wol->sopass[0]),
-                            UMAC_PSW_MS);
-                umac_writel(priv, get_unaligned_be32(&wol->sopass[2]),
-                            UMAC_PSW_LS);
-        }
+        if (wol->wolopts & WAKE_MAGICSECURE)
+                memcpy(priv->sopass, wol->sopass, sizeof(priv->sopass));
 
         /* Flag the device and relevant IRQ as wakeup capable */
         if (wol->wolopts) {
@@ -2649,13 +2639,18 @@ static int bcm_sysport_suspend_to_wol(struct bcm_sysport_priv *priv)
         unsigned int index, i = 0;
         u32 reg;
 
-        /* Password has already been programmed */
         reg = umac_readl(priv, UMAC_MPD_CTRL);
         if (priv->wolopts & (WAKE_MAGIC | WAKE_MAGICSECURE))
                 reg |= MPD_EN;
         reg &= ~PSW_EN;
-        if (priv->wolopts & WAKE_MAGICSECURE)
+        if (priv->wolopts & WAKE_MAGICSECURE) {
+                /* Program the SecureOn password */
+                umac_writel(priv, get_unaligned_be16(&priv->sopass[0]),
+                            UMAC_PSW_MS);
+                umac_writel(priv, get_unaligned_be32(&priv->sopass[2]),
+                            UMAC_PSW_LS);
                 reg |= PSW_EN;
+        }
         umac_writel(priv, reg, UMAC_MPD_CTRL);
 
         if (priv->wolopts & WAKE_FILTER) {
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h
index 0887e6356649..0b192fea9c5d 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.h
+++ b/drivers/net/ethernet/broadcom/bcmsysport.h
@@ -12,6 +12,7 @@
 #define __BCM_SYSPORT_H
 
 #include <linux/bitmap.h>
+#include <linux/ethtool.h>
 #include <linux/if_vlan.h>
 #include <linux/net_dim.h>
 
@@ -778,6 +779,7 @@ struct bcm_sysport_priv {
         unsigned int            crc_fwd:1;
         u16                     rev;
         u32                     wolopts;
+        u8                      sopass[SOPASS_MAX];
         unsigned int            wol_irq_disabled:1;
 
         /* MIB related fields */
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 1c2987c3d708..92d73453a318 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -4973,12 +4973,18 @@ static int bnxt_hwrm_ring_alloc(struct bnxt *bp)
                 struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring;
                 struct bnxt_ring_struct *ring = &cpr->cp_ring_struct;
                 u32 map_idx = ring->map_idx;
+                unsigned int vector;
 
+                vector = bp->irq_tbl[map_idx].vector;
+                disable_irq_nosync(vector);
                 rc = hwrm_ring_alloc_send_msg(bp, ring, type, map_idx);
-                if (rc)
+                if (rc) {
+                        enable_irq(vector);
                         goto err_out;
+                }
                 bnxt_set_db(bp, &cpr->cp_db, type, map_idx, ring->fw_ring_id);
                 bnxt_db_nq(bp, &cpr->cp_db, cpr->cp_raw_cons);
+                enable_irq(vector);
                 bp->grp_info[i].cp_fw_ring_id = ring->fw_ring_id;
 
                 if (!i) {
diff --git a/drivers/net/ethernet/broadcom/sb1250-mac.c b/drivers/net/ethernet/broadcom/sb1250-mac.c
index 5db9f4158e62..134ae2862efa 100644
--- a/drivers/net/ethernet/broadcom/sb1250-mac.c
+++ b/drivers/net/ethernet/broadcom/sb1250-mac.c
@@ -1288,7 +1288,7 @@ static void sbdma_tx_process(struct sbmac_softc *sc, struct sbmacdma *d,
                  * for transmits, we just free buffers.
                  */
 
-                dev_kfree_skb_irq(sb);
+                dev_consume_skb_irq(sb);
 
                 /*
                  * .. and advance to the next buffer.
diff --git a/drivers/net/ethernet/cavium/Kconfig b/drivers/net/ethernet/cavium/Kconfig
index 5f03199a3acf..05f4a3b21e29 100644
--- a/drivers/net/ethernet/cavium/Kconfig
+++ b/drivers/net/ethernet/cavium/Kconfig
@@ -54,7 +54,6 @@ config CAVIUM_PTP
         tristate "Cavium PTP coprocessor as PTP clock"
         depends on 64BIT && PCI
         imply PTP_1588_CLOCK
-        default y
         ---help---
           This driver adds support for the Precision Time Protocol Clocks and
           Timestamping coprocessor (PTP) found on Cavium processors.
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 60641e202534..9a7f70db20c7 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1434,7 +1434,8 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
                  * csum is correct or is zero.
                  */
                 if ((netdev->features & NETIF_F_RXCSUM) && !csum_not_calc &&
-                    tcp_udp_csum_ok && ipv4_csum_ok && outer_csum_ok) {
+                    tcp_udp_csum_ok && outer_csum_ok &&
+                    (ipv4_csum_ok || ipv6)) {
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                         skb->csum_level = encap;
                 }
diff --git a/drivers/net/ethernet/dec/tulip/de2104x.c b/drivers/net/ethernet/dec/tulip/de2104x.c
index 13430f75496c..f1a2da15dd0a 100644
--- a/drivers/net/ethernet/dec/tulip/de2104x.c
+++ b/drivers/net/ethernet/dec/tulip/de2104x.c
@@ -585,7 +585,7 @@ static void de_tx (struct de_private *de)
                                 netif_dbg(de, tx_done, de->dev,
                                           "tx done, slot %d\n", tx_tail);
                         }
-                        dev_kfree_skb_irq(skb);
+                        dev_consume_skb_irq(skb);
                 }
 
 next:
diff --git a/drivers/net/ethernet/freescale/fec_mpc52xx.c b/drivers/net/ethernet/freescale/fec_mpc52xx.c
index b90bab72efdb..c1968b3ecec8 100644
--- a/drivers/net/ethernet/freescale/fec_mpc52xx.c
+++ b/drivers/net/ethernet/freescale/fec_mpc52xx.c
@@ -369,7 +369,7 @@ static irqreturn_t mpc52xx_fec_tx_interrupt(int irq, void *dev_id)
                 dma_unmap_single(dev->dev.parent, bd->skb_pa, skb->len,
                                  DMA_TO_DEVICE);
 
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
         }
         spin_unlock(&priv->lock);
 
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index c3d539e209ed..eb3e65e8868f 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -1879,6 +1879,8 @@ static void ucc_geth_free_tx(struct ucc_geth_private *ugeth)
         u16 i, j;
         u8 __iomem *bd;
 
+        netdev_reset_queue(ugeth->ndev);
+
         ug_info = ugeth->ug_info;
         uf_info = &ug_info->uf_info;
 
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index 04fd1f135011..654ac534b10e 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -152,8 +152,10 @@ static void skge_get_regs(struct net_device *dev, struct ethtool_regs *regs,
         memset(p, 0, regs->len);
         memcpy_fromio(p, io, B3_RAM_ADDR);
 
-        memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1,
-                      regs->len - B3_RI_WTO_R1);
+        if (regs->len > B3_RI_WTO_R1) {
+                memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1,
+                              regs->len - B3_RI_WTO_R1);
+        }
 }
 
 /* Wake on Lan only supported on Yukon chips with rev 1 or above */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
index 9e71f4d41b82..bdcc5e79328d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
@@ -256,6 +256,7 @@ int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv,
         e->m_neigh.family = n->ops->family;
         memcpy(&e->m_neigh.dst_ip, n->primary_key, n->tbl->key_len);
         e->out_dev = out_dev;
+        e->route_dev = route_dev;
 
         /* It's important to add the neigh to the hash table before checking
          * the neigh validity state. So if we'll get a notification, in case the
@@ -369,6 +370,7 @@ int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv,
         e->m_neigh.family = n->ops->family;
         memcpy(&e->m_neigh.dst_ip, n->primary_key, n->tbl->key_len);
         e->out_dev = out_dev;
+        e->route_dev = route_dev;
 
         /* It's importent to add the neigh to the hash table before checking
          * the neigh validity state. So if we'll get a notification, in case the
@@ -602,16 +604,18 @@ int mlx5e_tc_tun_parse(struct net_device *filter_dev,
                        struct mlx5_flow_spec *spec,
                        struct tc_cls_flower_offload *f,
                        void *headers_c,
-                       void *headers_v)
+                       void *headers_v, u8 *match_level)
 {
         int tunnel_type;
         int err = 0;
 
         tunnel_type = mlx5e_tc_tun_get_type(filter_dev);
         if (tunnel_type == MLX5E_TC_TUNNEL_TYPE_VXLAN) {
+                *match_level = MLX5_MATCH_L4;
                 err = mlx5e_tc_tun_parse_vxlan(priv, spec, f,
                                                headers_c, headers_v);
         } else if (tunnel_type == MLX5E_TC_TUNNEL_TYPE_GRETAP) {
+                *match_level = MLX5_MATCH_L3;
                 err = mlx5e_tc_tun_parse_gretap(priv, spec, f,
                                                 headers_c, headers_v);
         } else {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.h b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.h
index 706ce7bf15e7..b63f15de899d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.h
@@ -39,6 +39,6 @@ int mlx5e_tc_tun_parse(struct net_device *filter_dev,
                        struct mlx5_flow_spec *spec,
                        struct tc_cls_flower_offload *f,
                        void *headers_c,
-                       void *headers_v);
+                       void *headers_v, u8 *match_level);
 
 #endif //__MLX5_EN_TC_TUNNEL_H__
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 0b1988b330f3..7b5829406d95 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -579,6 +579,10 @@ static void mlx5e_rep_update_flows(struct mlx5e_priv *priv,
         if (neigh_connected && !(e->flags & MLX5_ENCAP_ENTRY_VALID)) {
                 ether_addr_copy(e->h_dest, ha);
                 ether_addr_copy(eth->h_dest, ha);
+                /* Update the encap source mac, in case that we delete
+                 * the flows when encap source mac changed.
+                 */
+                ether_addr_copy(eth->h_source, e->route_dev->dev_addr);
 
                 mlx5e_tc_encap_flows_add(priv, e);
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h
index edd722824697..36eafc877e6b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h
@@ -148,6 +148,7 @@ struct mlx5e_encap_entry {
         unsigned char h_dest[ETH_ALEN]; /* destination eth addr */
 
         struct net_device *out_dev;
+        struct net_device *route_dev;
         int tunnel_type;
         int tunnel_hlen;
         int reformat_type;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 85c5dd7fc2c7..e9437757cad7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -127,6 +127,7 @@ struct mlx5e_tc_flow_parse_attr {
         struct net_device *filter_dev;
         struct mlx5_flow_spec spec;
         int num_mod_hdr_actions;
+        int max_mod_hdr_actions;
         void *mod_hdr_actions;
         int mirred_ifindex[MLX5_MAX_FLOW_FWD_VPORTS];
 };
@@ -1301,7 +1302,7 @@ static void mlx5e_tc_del_flow(struct mlx5e_priv *priv,
 static int parse_tunnel_attr(struct mlx5e_priv *priv,
                              struct mlx5_flow_spec *spec,
                              struct tc_cls_flower_offload *f,
-                             struct net_device *filter_dev)
+                             struct net_device *filter_dev, u8 *match_level)
 {
         struct netlink_ext_ack *extack = f->common.extack;
         void *headers_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
@@ -1313,7 +1314,7 @@ static int parse_tunnel_attr(struct mlx5e_priv *priv,
         int err;
 
         err = mlx5e_tc_tun_parse(filter_dev, priv, spec, f,
-                                 headers_c, headers_v);
+                                 headers_c, headers_v, match_level);
         if (err) {
                 NL_SET_ERR_MSG_MOD(extack,
                                    "failed to parse tunnel attributes");
@@ -1413,7 +1414,7 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
                               struct mlx5_flow_spec *spec,
                               struct tc_cls_flower_offload *f,
                               struct net_device *filter_dev,
-                              u8 *match_level)
+                              u8 *match_level, u8 *tunnel_match_level)
 {
         struct netlink_ext_ack *extack = f->common.extack;
         void *headers_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
@@ -1464,7 +1465,7 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
                 switch (match.key->addr_type) {
                 case FLOW_DISSECTOR_KEY_IPV4_ADDRS:
                 case FLOW_DISSECTOR_KEY_IPV6_ADDRS:
-                        if (parse_tunnel_attr(priv, spec, f, filter_dev))
+                        if (parse_tunnel_attr(priv, spec, f, filter_dev, tunnel_match_level))
                                 return -EOPNOTSUPP;
                         break;
                 default:
@@ -1767,11 +1768,11 @@ static int parse_cls_flower(struct mlx5e_priv *priv,
         struct mlx5_core_dev *dev = priv->mdev;
         struct mlx5_eswitch *esw = dev->priv.eswitch;
         struct mlx5e_rep_priv *rpriv = priv->ppriv;
+        u8 match_level, tunnel_match_level = MLX5_MATCH_NONE;
         struct mlx5_eswitch_rep *rep;
-        u8 match_level;
         int err;
 
-        err = __parse_cls_flower(priv, spec, f, filter_dev, &match_level);
+        err = __parse_cls_flower(priv, spec, f, filter_dev, &match_level, &tunnel_match_level);
 
         if (!err && (flow->flags & MLX5E_TC_FLOW_ESWITCH)) {
                 rep = rpriv->rep;
@@ -1787,10 +1788,12 @@ static int parse_cls_flower(struct mlx5e_priv *priv,
                 }
         }
 
-        if (flow->flags & MLX5E_TC_FLOW_ESWITCH)
+        if (flow->flags & MLX5E_TC_FLOW_ESWITCH) {
                 flow->esw_attr->match_level = match_level;
-        else
+                flow->esw_attr->tunnel_match_level = tunnel_match_level;
+        } else {
                 flow->nic_attr->match_level = match_level;
+        }
 
         return err;
 }
@@ -1880,9 +1883,9 @@ static struct mlx5_fields fields[] = {
         OFFLOAD(UDP_DPORT, 2, udp.dest,   0),
 };
 
-/* On input attr->num_mod_hdr_actions tells how many HW actions can be parsed at
- * max from the SW pedit action. On success, it says how many HW actions were
- * actually parsed.
+/* On input attr->max_mod_hdr_actions tells how many HW actions can be parsed at
+ * max from the SW pedit action. On success, attr->num_mod_hdr_actions
+ * says how many HW actions were actually parsed.
  */
 static int offload_pedit_fields(struct pedit_headers_action *hdrs,
                                 struct mlx5e_tc_flow_parse_attr *parse_attr,
@@ -1905,9 +1908,11 @@ static int offload_pedit_fields(struct pedit_headers_action *hdrs,
         add_vals = &hdrs[1].vals;
 
         action_size = MLX5_UN_SZ_BYTES(set_action_in_add_action_in_auto);
-        action = parse_attr->mod_hdr_actions;
-        max_actions = parse_attr->num_mod_hdr_actions;
-        nactions = 0;
+        action = parse_attr->mod_hdr_actions +
+                 parse_attr->num_mod_hdr_actions * action_size;
+
+        max_actions = parse_attr->max_mod_hdr_actions;
+        nactions = parse_attr->num_mod_hdr_actions;
 
         for (i = 0; i < ARRAY_SIZE(fields); i++) {
                 f = &fields[i];
@@ -2020,7 +2025,7 @@ static int alloc_mod_hdr_actions(struct mlx5e_priv *priv,
         if (!parse_attr->mod_hdr_actions)
                 return -ENOMEM;
 
-        parse_attr->num_mod_hdr_actions = max_actions;
+        parse_attr->max_mod_hdr_actions = max_actions;
         return 0;
 }
 
@@ -2069,9 +2074,11 @@ static int alloc_tc_pedit_action(struct mlx5e_priv *priv, int namespace,
         int err;
         u8 cmd;
 
-        err = alloc_mod_hdr_actions(priv, hdrs, namespace, parse_attr);
-        if (err)
-                goto out_err;
+        if (!parse_attr->mod_hdr_actions) {
+                err = alloc_mod_hdr_actions(priv, hdrs, namespace, parse_attr);
+                if (err)
+                        goto out_err;
+        }
 
         err = offload_pedit_fields(hdrs, parse_attr, extack);
         if (err < 0)
@@ -2129,6 +2136,7 @@ static bool csum_offload_supported(struct mlx5e_priv *priv,
 
 static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
                                           struct flow_action *flow_action,
+                                          u32 actions,
                                           struct netlink_ext_ack *extack)
 {
         const struct flow_action_entry *act;
@@ -2138,7 +2146,11 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
         u16 ethertype;
         int i;
 
-        headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, outer_headers);
+        if (actions & MLX5_FLOW_CONTEXT_ACTION_DECAP)
+                headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, inner_headers);
+        else
+                headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, outer_headers);
+
         ethertype = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ethertype);
 
         /* for non-IP we only re-write MACs, so we're okay */
@@ -2191,7 +2203,7 @@ static bool actions_match_supported(struct mlx5e_priv *priv,
 
         if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)
                 return modify_header_match_supported(&parse_attr->spec,
-                                                     flow_action,
+                                                     flow_action, actions,
                                                      extack);
 
         return true;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index 189211295e48..c1334a8ac8f3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -387,8 +387,14 @@ netdev_tx_t mlx5e_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb,
         num_wqebbs = DIV_ROUND_UP(ds_cnt, MLX5_SEND_WQEBB_NUM_DS);
         contig_wqebbs_room = mlx5_wq_cyc_get_contig_wqebbs(wq, pi);
         if (unlikely(contig_wqebbs_room < num_wqebbs)) {
+#ifdef CONFIG_MLX5_EN_IPSEC
+                struct mlx5_wqe_eth_seg cur_eth = wqe->eth;
+#endif
                 mlx5e_fill_sq_frag_edge(sq, wq, pi, contig_wqebbs_room);
                 mlx5e_sq_fetch_wqe(sq, &wqe, &pi);
+#ifdef CONFIG_MLX5_EN_IPSEC
+                wqe->eth = cur_eth;
+#endif
         }
 
         /* fill wqe */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index 9c89eea9b2c3..748ff178a1d6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -312,6 +312,7 @@ struct mlx5_esw_flow_attr {
         } dests[MLX5_MAX_FLOW_FWD_VPORTS];
         u32     mod_hdr_id;
         u8      match_level;
+        u8      tunnel_match_level;
         struct mlx5_fc *counter;
         u32     chain;
         u16     prio;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 53065b6ae593..d4e6fe5b9300 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -160,14 +160,15 @@ mlx5_eswitch_add_offloaded_rule(struct mlx5_eswitch *esw,
                 MLX5_SET_TO_ONES(fte_match_set_misc, misc,
                                  source_eswitch_owner_vhca_id);
 
-        if (attr->match_level == MLX5_MATCH_NONE)
-                spec->match_criteria_enable = MLX5_MATCH_MISC_PARAMETERS;
-        else
-                spec->match_criteria_enable = MLX5_MATCH_OUTER_HEADERS |
-                                              MLX5_MATCH_MISC_PARAMETERS;
-
-        if (flow_act.action & MLX5_FLOW_CONTEXT_ACTION_DECAP)
-                spec->match_criteria_enable |= MLX5_MATCH_INNER_HEADERS;
+        spec->match_criteria_enable = MLX5_MATCH_MISC_PARAMETERS;
+        if (flow_act.action & MLX5_FLOW_CONTEXT_ACTION_DECAP) {
+                if (attr->tunnel_match_level != MLX5_MATCH_NONE)
+                        spec->match_criteria_enable |= MLX5_MATCH_OUTER_HEADERS;
+                if (attr->match_level != MLX5_MATCH_NONE)
+                        spec->match_criteria_enable |= MLX5_MATCH_INNER_HEADERS;
+        } else if (attr->match_level != MLX5_MATCH_NONE) {
+                spec->match_criteria_enable |= MLX5_MATCH_OUTER_HEADERS;
+        }
 
         if (flow_act.action & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)
                 flow_act.modify_id = attr->mod_hdr_id;
diff --git a/drivers/net/ethernet/qlogic/qed/qed.h b/drivers/net/ethernet/qlogic/qed/qed.h
index 3b0955d34716..2d21c94f19c2 100644
--- a/drivers/net/ethernet/qlogic/qed/qed.h
+++ b/drivers/net/ethernet/qlogic/qed/qed.h
@@ -53,7 +53,7 @@
 extern const struct qed_common_ops qed_common_ops_pass;
 
 #define QED_MAJOR_VERSION               8
-#define QED_MINOR_VERSION               33
+#define QED_MINOR_VERSION               37
 #define QED_REVISION_VERSION            0
 #define QED_ENGINEERING_VERSION         20
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index e68ca83ae915..58be1c4c6668 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -2216,7 +2216,7 @@ static int qed_fill_eth_dev_info(struct qed_dev *cdev,
                         u16 num_queues = 0;
 
                         /* Since the feature controls only queue-zones,
-                         * make sure we have the contexts [rx, tx, xdp] to
+                         * make sure we have the contexts [rx, xdp, tcs] to
                          * match.
                          */
                         for_each_hwfn(cdev, i) {
@@ -2226,7 +2226,8 @@ static int qed_fill_eth_dev_info(struct qed_dev *cdev,
                                 u16 cids;
 
                                 cids = hwfn->pf_params.eth_pf_params.num_cons;
-                                num_queues += min_t(u16, l2_queues, cids / 3);
+                                cids /= (2 + info->num_tc);
+                                num_queues += min_t(u16, l2_queues, cids);
                         }
 
                         /* queues might theoretically be >256, but interrupts'
@@ -2870,7 +2871,8 @@ static int qed_get_coalesce(struct qed_dev *cdev, u16 *coal, void *handle)
         p_hwfn = p_cid->p_owner;
         rc = qed_get_queue_coalesce(p_hwfn, coal, handle);
         if (rc)
-                DP_NOTICE(p_hwfn, "Unable to read queue coalescing\n");
+                DP_VERBOSE(cdev, QED_MSG_DEBUG,
+                           "Unable to read queue coalescing\n");
 
         return rc;
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h
index 4179c9013fc6..96ab77ae6af5 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h
@@ -382,6 +382,7 @@ void qed_consq_setup(struct qed_hwfn *p_hwfn);
  * @param p_hwfn
  */
 void qed_consq_free(struct qed_hwfn *p_hwfn);
+int qed_spq_pend_post(struct qed_hwfn *p_hwfn);
 
 /**
  * @file
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
index 888274fa208b..5a495fda9e9d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
@@ -604,6 +604,9 @@ int qed_sp_pf_update_stag(struct qed_hwfn *p_hwfn)
 
         p_ent->ramrod.pf_update.update_mf_vlan_flag = true;
         p_ent->ramrod.pf_update.mf_vlan = cpu_to_le16(p_hwfn->hw_info.ovlan);
+        if (test_bit(QED_MF_UFP_SPECIFIC, &p_hwfn->cdev->mf_bits))
+                p_ent->ramrod.pf_update.mf_vlan |=
+                        cpu_to_le16(((u16)p_hwfn->ufp_info.tc << 13));
 
         return qed_spq_post(p_hwfn, p_ent, NULL);
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
index 3e0f7c46bb1b..79b311b86f66 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
@@ -397,6 +397,11 @@ int qed_eq_completion(struct qed_hwfn *p_hwfn, void *cookie)
 
         qed_eq_prod_update(p_hwfn, qed_chain_get_prod_idx(p_chain));
 
+        /* Attempt to post pending requests */
+        spin_lock_bh(&p_hwfn->p_spq->lock);
+        rc = qed_spq_pend_post(p_hwfn);
+        spin_unlock_bh(&p_hwfn->p_spq->lock);
+
         return rc;
 }
 
@@ -767,7 +772,7 @@ static int qed_spq_post_list(struct qed_hwfn *p_hwfn,
         return 0;
 }
 
-static int qed_spq_pend_post(struct qed_hwfn *p_hwfn)
+int qed_spq_pend_post(struct qed_hwfn *p_hwfn)
 {
         struct qed_spq *p_spq = p_hwfn->p_spq;
         struct qed_spq_entry *p_ent = NULL;
@@ -927,7 +932,6 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
         struct qed_spq_entry    *p_ent = NULL;
         struct qed_spq_entry    *tmp;
         struct qed_spq_entry    *found = NULL;
-        int                     rc;
 
         if (!p_hwfn)
                 return -EINVAL;
@@ -985,12 +989,7 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
                  */
                 qed_spq_return_entry(p_hwfn, found);
 
-        /* Attempt to post pending requests */
-        spin_lock_bh(&p_spq->lock);
-        rc = qed_spq_pend_post(p_hwfn);
-        spin_unlock_bh(&p_spq->lock);
-
-        return rc;
+        return 0;
 }
 
 int qed_consq_alloc(struct qed_hwfn *p_hwfn)
diff --git a/drivers/net/ethernet/qlogic/qede/qede.h b/drivers/net/ethernet/qlogic/qede/qede.h
index 843416404aeb..63a78162cfaf 100644
--- a/drivers/net/ethernet/qlogic/qede/qede.h
+++ b/drivers/net/ethernet/qlogic/qede/qede.h
@@ -56,7 +56,7 @@
 #include <net/tc_act/tc_gact.h>
 
 #define QEDE_MAJOR_VERSION              8
-#define QEDE_MINOR_VERSION              33
+#define QEDE_MINOR_VERSION              37
 #define QEDE_REVISION_VERSION           0
 #define QEDE_ENGINEERING_VERSION        20
 #define DRV_MODULE_VERSION __stringify(QEDE_MAJOR_VERSION) "."  \
@@ -497,6 +497,9 @@ struct qede_reload_args {
 
 /* Datapath functions definition */
 netdev_tx_t qede_start_xmit(struct sk_buff *skb, struct net_device *ndev);
+u16 qede_select_queue(struct net_device *dev, struct sk_buff *skb,
+                      struct net_device *sb_dev,
+                      select_queue_fallback_t fallback);
 netdev_features_t qede_features_check(struct sk_buff *skb,
                                       struct net_device *dev,
                                       netdev_features_t features);
diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c
index bdf816fe5a16..31b046e24565 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
@@ -1695,6 +1695,19 @@ netdev_tx_t qede_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         return NETDEV_TX_OK;
 }
 
+u16 qede_select_queue(struct net_device *dev, struct sk_buff *skb,
+                      struct net_device *sb_dev,
+                      select_queue_fallback_t fallback)
+{
+        struct qede_dev *edev = netdev_priv(dev);
+        int total_txq;
+
+        total_txq = QEDE_TSS_COUNT(edev) * edev->dev_info.num_tc;
+
+        return QEDE_TSS_COUNT(edev) ?
+                fallback(dev, skb, NULL) % total_txq :  0;
+}
+
 /* 8B udp header + 8B base tunnel header + 32B option length */
 #define QEDE_MAX_TUN_HDR_LEN 48
 
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index 6b4d96635238..02a97c659e29 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -621,6 +621,7 @@ static const struct net_device_ops qede_netdev_ops = {
         .ndo_open = qede_open,
         .ndo_stop = qede_close,
         .ndo_start_xmit = qede_start_xmit,
+        .ndo_select_queue = qede_select_queue,
         .ndo_set_rx_mode = qede_set_rx_mode,
         .ndo_set_mac_address = qede_set_mac_addr,
         .ndo_validate_addr = eth_validate_addr,
@@ -656,6 +657,7 @@ static const struct net_device_ops qede_netdev_vf_ops = {
         .ndo_open = qede_open,
         .ndo_stop = qede_close,
         .ndo_start_xmit = qede_start_xmit,
+        .ndo_select_queue = qede_select_queue,
         .ndo_set_rx_mode = qede_set_rx_mode,
         .ndo_set_mac_address = qede_set_mac_addr,
         .ndo_validate_addr = eth_validate_addr,
@@ -674,6 +676,7 @@ static const struct net_device_ops qede_netdev_vf_xdp_ops = {
         .ndo_open = qede_open,
         .ndo_stop = qede_close,
         .ndo_start_xmit = qede_start_xmit,
+        .ndo_select_queue = qede_select_queue,
         .ndo_set_rx_mode = qede_set_rx_mode,
         .ndo_set_mac_address = qede_set_mac_addr,
         .ndo_validate_addr = eth_validate_addr,
diff --git a/drivers/net/ethernet/smsc/epic100.c b/drivers/net/ethernet/smsc/epic100.c
index 15c62c160953..be47d864f8b9 100644
--- a/drivers/net/ethernet/smsc/epic100.c
+++ b/drivers/net/ethernet/smsc/epic100.c
@@ -1037,7 +1037,7 @@ static void epic_tx(struct net_device *dev, struct epic_private *ep)
                 skb = ep->tx_skbuff[entry];
                 pci_unmap_single(ep->pci_dev, ep->tx_ring[entry].bufaddr,
                                  skb->len, PCI_DMA_TODEVICE);
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
                 ep->tx_skbuff[entry] = NULL;
         }
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
index d1f61c25d82b..5d85742a2be0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
@@ -721,8 +721,11 @@ static u32 stmmac_usec2riwt(u32 usec, struct stmmac_priv *priv)
 {
         unsigned long clk = clk_get_rate(priv->plat->stmmac_clk);
 
-        if (!clk)
-                return 0;
+        if (!clk) {
+                clk = priv->plat->clk_ref_rate;
+                if (!clk)
+                        return 0;
+        }
 
         return (usec * (clk / 1000000)) / 256;
 }
@@ -731,8 +734,11 @@ static u32 stmmac_riwt2usec(u32 riwt, struct stmmac_priv *priv)
 {
         unsigned long clk = clk_get_rate(priv->plat->stmmac_clk);
 
-        if (!clk)
-                return 0;
+        if (!clk) {
+                clk = priv->plat->clk_ref_rate;
+                if (!clk)
+                        return 0;
+        }
 
         return (riwt * 256) / (clk / 1000000);
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index effff171d250..f12dd59c85cf 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3039,10 +3039,22 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
 
         tx_q = &priv->tx_queue[queue];
 
+        if (priv->tx_path_in_lpi_mode)
+                stmmac_disable_eee_mode(priv);
+
         /* Manage oversized TCP frames for GMAC4 device */
         if (skb_is_gso(skb) && priv->tso) {
-                if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))
+                if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) {
+                        /*
+                         * There is no way to determine the number of TSO
+                         * capable Queues. Let's use always the Queue 0
+                         * because if TSO is supported then at least this
+                         * one will be capable.
+                         */
+                        skb_set_queue_mapping(skb, 0);
+
                         return stmmac_tso_xmit(skb, dev);
+                }
         }
 
         if (unlikely(stmmac_tx_avail(priv, queue) < nfrags + 1)) {
@@ -3057,9 +3069,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_BUSY;
         }
 
-        if (priv->tx_path_in_lpi_mode)
-                stmmac_disable_eee_mode(priv);
-
         entry = tx_q->cur_tx;
         first_entry = entry;
         WARN_ON(tx_q->tx_skbuff[first_entry]);
diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c
index 7ec4eb74fe21..6fc05c106afc 100644
--- a/drivers/net/ethernet/sun/cassini.c
+++ b/drivers/net/ethernet/sun/cassini.c
@@ -1898,7 +1898,7 @@ static inline void cas_tx_ringN(struct cas *cp, int ring, int limit)
                 cp->net_stats[ring].tx_packets++;
                 cp->net_stats[ring].tx_bytes += skb->len;
                 spin_unlock(&cp->stat_lock[ring]);
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
         }
         cp->tx_old[ring] = entry;
 
diff --git a/drivers/net/ethernet/sun/sunbmac.c b/drivers/net/ethernet/sun/sunbmac.c
index 720b7ac77f3b..e9b757b03b56 100644
--- a/drivers/net/ethernet/sun/sunbmac.c
+++ b/drivers/net/ethernet/sun/sunbmac.c
@@ -781,7 +781,7 @@ static void bigmac_tx(struct bigmac *bp)
 
                 DTX(("skb(%p) ", skb));
                 bp->tx_skbs[elem] = NULL;
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
 
                 elem = NEXT_TX(elem);
         }
diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
index ff641cf30a4e..d007dfeba5c3 100644
--- a/drivers/net/ethernet/sun/sunhme.c
+++ b/drivers/net/ethernet/sun/sunhme.c
@@ -1962,7 +1962,7 @@ static void happy_meal_tx(struct happy_meal *hp)
                         this = &txbase[elem];
                 }
 
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
                 dev->stats.tx_packets++;
         }
         hp->tx_old = elem;
diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
index dc966ddb6d81..b24c11187017 100644
--- a/drivers/net/ethernet/tehuti/tehuti.c
+++ b/drivers/net/ethernet/tehuti/tehuti.c
@@ -1739,7 +1739,7 @@ static void bdx_tx_cleanup(struct bdx_priv *priv)
                 tx_level -= db->rptr->len;      /* '-' koz len is negative */
 
                 /* now should come skb pointer - free it */
-                dev_kfree_skb_irq(db->rptr->addr.skb);
+                dev_consume_skb_irq(db->rptr->addr.skb);
                 bdx_tx_db_inc_rptr(db);
         }
 
diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
index 82412691ee66..27f6cf140845 100644
--- a/drivers/net/ethernet/via/via-velocity.c
+++ b/drivers/net/ethernet/via/via-velocity.c
@@ -1740,7 +1740,7 @@ static void velocity_free_tx_buf(struct velocity_info *vptr,
                 dma_unmap_single(vptr->dev, tdinfo->skb_dma[i],
                                  le16_to_cpu(pktlen), DMA_TO_DEVICE);
         }
-        dev_kfree_skb_irq(skb);
+        dev_consume_skb_irq(skb);
         tdinfo->skb = NULL;
 }
 
diff --git a/drivers/net/fddi/defxx.c b/drivers/net/fddi/defxx.c
index 38ac8ef41f5f..56b7791911bf 100644
--- a/drivers/net/fddi/defxx.c
+++ b/drivers/net/fddi/defxx.c
@@ -3512,7 +3512,7 @@ static int dfx_xmt_done(DFX_board_t *bp)
                                  bp->descr_block_virt->xmt_data[comp].long_1,
                                  p_xmt_drv_descr->p_skb->len,
                                  DMA_TO_DEVICE);
-                dev_kfree_skb_irq(p_xmt_drv_descr->p_skb);
+                dev_consume_skb_irq(p_xmt_drv_descr->p_skb);
 
                 /*
                  * Move to start of next packet by updating completion index
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 58bbba8582b0..3377ac66a347 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1512,9 +1512,13 @@ static void geneve_link_config(struct net_device *dev,
         }
 #if IS_ENABLED(CONFIG_IPV6)
         case AF_INET6: {
-                struct rt6_info *rt = rt6_lookup(geneve->net,
-                                                 &info->key.u.ipv6.dst, NULL, 0,
-                                                 NULL, 0);
+                struct rt6_info *rt;
+
+                if (!__in6_dev_get(dev))
+                        break;
+
+                rt = rt6_lookup(geneve->net, &info->key.u.ipv6.dst, NULL, 0,
+                                NULL, 0);
 
                 if (rt && rt->dst.dev)
                         ldev_mtu = rt->dst.dev->mtu - GENEVE_IPV6_HLEN;
diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c
index 44de81e5f140..c589f5ae75bb 100644
--- a/drivers/net/ieee802154/mcr20a.c
+++ b/drivers/net/ieee802154/mcr20a.c
@@ -905,9 +905,9 @@ mcr20a_irq_clean_complete(void *context)
                 }
                 break;
         case (DAR_IRQSTS1_RXIRQ | DAR_IRQSTS1_SEQIRQ):
-                        /* rx is starting */
-                        dev_dbg(printdev(lp), "RX is starting\n");
-                        mcr20a_handle_rx(lp);
+                /* rx is starting */
+                dev_dbg(printdev(lp), "RX is starting\n");
+                mcr20a_handle_rx(lp);
                 break;
         case (DAR_IRQSTS1_RXIRQ | DAR_IRQSTS1_TXIRQ | DAR_IRQSTS1_SEQIRQ):
                 if (lp->is_tx) {
diff --git a/drivers/net/ipvlan/ipvlan_l3s.c b/drivers/net/ipvlan/ipvlan_l3s.c
index 9a2f24078a54..d17480a911a3 100644
--- a/drivers/net/ipvlan/ipvlan_l3s.c
+++ b/drivers/net/ipvlan/ipvlan_l3s.c
@@ -209,7 +209,7 @@ int ipvlan_l3s_register(struct ipvl_port *port)
         ret = ipvlan_register_nf_hook(read_pnet(&port->pnet));
         if (!ret) {
                 dev->l3mdev_ops = &ipvl_l3mdev_ops;
-                dev->priv_flags |= IFF_L3MDEV_MASTER;
+                dev->priv_flags |= IFF_L3MDEV_RX_HANDLER;
         }
 
         return ret;
@@ -221,7 +221,7 @@ void ipvlan_l3s_unregister(struct ipvl_port *port)
 
         ASSERT_RTNL();
 
-        dev->priv_flags &= ~IFF_L3MDEV_MASTER;
+        dev->priv_flags &= ~IFF_L3MDEV_RX_HANDLER;
         ipvlan_unregister_nf_hook(read_pnet(&port->pnet));
         dev->l3mdev_ops = NULL;
 }
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 25ef483bcc24..2fe2ebaf62d1 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -885,14 +885,14 @@ static void decode_txts(struct dp83640_private *dp83640,
                         struct phy_txts *phy_txts)
 {
         struct skb_shared_hwtstamps shhwtstamps;
+        struct dp83640_skb_info *skb_info;
         struct sk_buff *skb;
-        u64 ns;
         u8 overflow;
+        u64 ns;
 
         /* We must already have the skb that triggered this. */
-
+again:
         skb = skb_dequeue(&dp83640->tx_queue);
-
         if (!skb) {
                 pr_debug("have timestamp but tx_queue empty\n");
                 return;
@@ -907,6 +907,11 @@ static void decode_txts(struct dp83640_private *dp83640,
                 }
                 return;
         }
+        skb_info = (struct dp83640_skb_info *)skb->cb;
+        if (time_after(jiffies, skb_info->tmo)) {
+                kfree_skb(skb);
+                goto again;
+        }
 
         ns = phy2txts(phy_txts);
         memset(&shhwtstamps, 0, sizeof(shhwtstamps));
@@ -1459,6 +1464,7 @@ static bool dp83640_rxtstamp(struct phy_device *phydev,
 static void dp83640_txtstamp(struct phy_device *phydev,
                              struct sk_buff *skb, int type)
 {
+        struct dp83640_skb_info *skb_info = (struct dp83640_skb_info *)skb->cb;
         struct dp83640_private *dp83640 = phydev->priv;
 
         switch (dp83640->hwts_tx_en) {
@@ -1471,6 +1477,7 @@ static void dp83640_txtstamp(struct phy_device *phydev,
                 /* fall through */
         case HWTSTAMP_TX_ON:
                 skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+                skb_info->tmo = jiffies + SKB_TIMESTAMP_TIMEOUT;
                 skb_queue_tail(&dp83640->tx_queue, skb);
                 break;
 
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 90f44ba8aca7..3ccba37bd6dd 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -842,7 +842,6 @@ static int m88e1510_config_init(struct phy_device *phydev)
 
         /* SGMII-to-Copper mode initialization */
         if (phydev->interface == PHY_INTERFACE_MODE_SGMII) {
-
                 /* Select page 18 */
                 err = marvell_set_page(phydev, 18);
                 if (err < 0)
@@ -865,21 +864,6 @@ static int m88e1510_config_init(struct phy_device *phydev)
                 err = marvell_set_page(phydev, MII_MARVELL_COPPER_PAGE);
                 if (err < 0)
                         return err;
-
-                /* There appears to be a bug in the 88e1512 when used in
-                 * SGMII to copper mode, where the AN advertisement register
-                 * clears the pause bits each time a negotiation occurs.
-                 * This means we can never be truely sure what was advertised,
-                 * so disable Pause support.
-                 */
-                linkmode_clear_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
-                                   phydev->supported);
-                linkmode_clear_bit(ETHTOOL_LINK_MODE_Pause_BIT,
-                                   phydev->supported);
-                linkmode_clear_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
-                                   phydev->advertising);
-                linkmode_clear_bit(ETHTOOL_LINK_MODE_Pause_BIT,
-                                   phydev->advertising);
         }
 
         return m88e1318_config_init(phydev);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 18656c4094b3..fed298c0cb39 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -866,8 +866,6 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
         if (rtnl_dereference(tun->xdp_prog))
                 sock_set_flag(&tfile->sk, SOCK_XDP);
 
-        tun_set_real_num_queues(tun);
-
         /* device is allowed to go away first, so no need to hold extra
          * refcnt.
          */
@@ -879,6 +877,7 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
         rcu_assign_pointer(tfile->tun, tun);
         rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
         tun->numqueues++;
+        tun_set_real_num_queues(tun);
 out:
         return err;
 }
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 2a0edd4653e3..7eb38ea9ba56 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -57,6 +57,8 @@ module_param(napi_tx, bool, 0644);
 #define VIRTIO_XDP_TX           BIT(0)
 #define VIRTIO_XDP_REDIR        BIT(1)
 
+#define VIRTIO_XDP_FLAG BIT(0)
+
 /* RX packet size EWMA. The average packet size is used to determine the packet
  * buffer size when refilling RX rings. As the entire RX ring may be refilled
  * at once, the weight is chosen so that the EWMA will be insensitive to short-
@@ -252,6 +254,21 @@ struct padded_vnet_hdr {
         char padding[4];
 };
 
+static bool is_xdp_frame(void *ptr)
+{
+        return (unsigned long)ptr & VIRTIO_XDP_FLAG;
+}
+
+static void *xdp_to_ptr(struct xdp_frame *ptr)
+{
+        return (void *)((unsigned long)ptr | VIRTIO_XDP_FLAG);
+}
+
+static struct xdp_frame *ptr_to_xdp(void *ptr)
+{
+        return (struct xdp_frame *)((unsigned long)ptr & ~VIRTIO_XDP_FLAG);
+}
+
 /* Converting between virtqueue no. and kernel tx/rx queue no.
  * 0:rx0 1:tx0 2:rx1 3:tx1 ... 2N:rxN 2N+1:txN 2N+2:cvq
  */
@@ -462,7 +479,8 @@ static int __virtnet_xdp_xmit_one(struct virtnet_info *vi,
 
         sg_init_one(sq->sg, xdpf->data, xdpf->len);
 
-        err = virtqueue_add_outbuf(sq->vq, sq->sg, 1, xdpf, GFP_ATOMIC);
+        err = virtqueue_add_outbuf(sq->vq, sq->sg, 1, xdp_to_ptr(xdpf),
+                                   GFP_ATOMIC);
         if (unlikely(err))
                 return -ENOSPC; /* Caller handle free/refcnt */
 
@@ -482,36 +500,47 @@ static int virtnet_xdp_xmit(struct net_device *dev,
 {
         struct virtnet_info *vi = netdev_priv(dev);
         struct receive_queue *rq = vi->rq;
-        struct xdp_frame *xdpf_sent;
         struct bpf_prog *xdp_prog;
         struct send_queue *sq;
         unsigned int len;
+        int packets = 0;
+        int bytes = 0;
         int drops = 0;
         int kicks = 0;
         int ret, err;
+        void *ptr;
         int i;
 
-        sq = virtnet_xdp_sq(vi);
-
-        if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {
-                ret = -EINVAL;
-                drops = n;
-                goto out;
-        }
-
         /* Only allow ndo_xdp_xmit if XDP is loaded on dev, as this
          * indicate XDP resources have been successfully allocated.
          */
         xdp_prog = rcu_dereference(rq->xdp_prog);
-        if (!xdp_prog) {
-                ret = -ENXIO;
+        if (!xdp_prog)
+                return -ENXIO;
+
+        sq = virtnet_xdp_sq(vi);
+
+        if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {
+                ret = -EINVAL;
                 drops = n;
                 goto out;
         }
 
         /* Free up any pending old buffers before queueing new ones. */
-        while ((xdpf_sent = virtqueue_get_buf(sq->vq, &len)) != NULL)
-                xdp_return_frame(xdpf_sent);
+        while ((ptr = virtqueue_get_buf(sq->vq, &len)) != NULL) {
+                if (likely(is_xdp_frame(ptr))) {
+                        struct xdp_frame *frame = ptr_to_xdp(ptr);
+
+                        bytes += frame->len;
+                        xdp_return_frame(frame);
+                } else {
+                        struct sk_buff *skb = ptr;
+
+                        bytes += skb->len;
+                        napi_consume_skb(skb, false);
+                }
+                packets++;
+        }
 
         for (i = 0; i < n; i++) {
                 struct xdp_frame *xdpf = frames[i];
@@ -530,6 +559,8 @@ static int virtnet_xdp_xmit(struct net_device *dev,
         }
 out:
         u64_stats_update_begin(&sq->stats.syncp);
+        sq->stats.bytes += bytes;
+        sq->stats.packets += packets;
         sq->stats.xdp_tx += n;
         sq->stats.xdp_tx_drops += drops;
         sq->stats.kicks += kicks;
@@ -1333,18 +1364,26 @@ static int virtnet_receive(struct receive_queue *rq, int budget,
 
 static void free_old_xmit_skbs(struct send_queue *sq, bool in_napi)
 {
-        struct sk_buff *skb;
         unsigned int len;
         unsigned int packets = 0;
         unsigned int bytes = 0;
+        void *ptr;
 
-        while ((skb = virtqueue_get_buf(sq->vq, &len)) != NULL) {
-                pr_debug("Sent skb %p\n", skb);
+        while ((ptr = virtqueue_get_buf(sq->vq, &len)) != NULL) {
+                if (likely(!is_xdp_frame(ptr))) {
+                        struct sk_buff *skb = ptr;
 
-                bytes += skb->len;
-                packets++;
+                        pr_debug("Sent skb %p\n", skb);
+
+                        bytes += skb->len;
+                        napi_consume_skb(skb, in_napi);
+                } else {
+                        struct xdp_frame *frame = ptr_to_xdp(ptr);
 
-                napi_consume_skb(skb, in_napi);
+                        bytes += frame->len;
+                        xdp_return_frame(frame);
+                }
+                packets++;
         }
 
         /* Avoid overhead when no packets have been processed
@@ -1359,6 +1398,16 @@ static void free_old_xmit_skbs(struct send_queue *sq, bool in_napi)
         u64_stats_update_end(&sq->stats.syncp);
 }
 
+static bool is_xdp_raw_buffer_queue(struct virtnet_info *vi, int q)
+{
+        if (q < (vi->curr_queue_pairs - vi->xdp_queue_pairs))
+                return false;
+        else if (q < vi->curr_queue_pairs)
+                return true;
+        else
+                return false;
+}
+
 static void virtnet_poll_cleantx(struct receive_queue *rq)
 {
         struct virtnet_info *vi = rq->vq->vdev->priv;
@@ -1366,7 +1415,7 @@ static void virtnet_poll_cleantx(struct receive_queue *rq)
         struct send_queue *sq = &vi->sq[index];
         struct netdev_queue *txq = netdev_get_tx_queue(vi->dev, index);
 
-        if (!sq->napi.weight)
+        if (!sq->napi.weight || is_xdp_raw_buffer_queue(vi, index))
                 return;
 
         if (__netif_tx_trylock(txq)) {
@@ -1443,8 +1492,16 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget)
 {
         struct send_queue *sq = container_of(napi, struct send_queue, napi);
         struct virtnet_info *vi = sq->vq->vdev->priv;
-        struct netdev_queue *txq = netdev_get_tx_queue(vi->dev, vq2txq(sq->vq));
+        unsigned int index = vq2txq(sq->vq);
+        struct netdev_queue *txq;
 
+        if (unlikely(is_xdp_raw_buffer_queue(vi, index))) {
+                /* We don't need to enable cb for XDP */
+                napi_complete_done(napi, 0);
+                return 0;
+        }
+
+        txq = netdev_get_tx_queue(vi->dev, index);
         __netif_tx_lock(txq, raw_smp_processor_id());
         free_old_xmit_skbs(sq, true);
         __netif_tx_unlock(txq);
@@ -2396,6 +2453,10 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
                 return -ENOMEM;
         }
 
+        old_prog = rtnl_dereference(vi->rq[0].xdp_prog);
+        if (!prog && !old_prog)
+                return 0;
+
         if (prog) {
                 prog = bpf_prog_add(prog, vi->max_queue_pairs - 1);
                 if (IS_ERR(prog))
@@ -2403,36 +2464,62 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
         }
 
         /* Make sure NAPI is not using any XDP TX queues for RX. */
-        if (netif_running(dev))
-                for (i = 0; i < vi->max_queue_pairs; i++)
+        if (netif_running(dev)) {
+                for (i = 0; i < vi->max_queue_pairs; i++) {
                         napi_disable(&vi->rq[i].napi);
+                        virtnet_napi_tx_disable(&vi->sq[i].napi);
+                }
+        }
+
+        if (!prog) {
+                for (i = 0; i < vi->max_queue_pairs; i++) {
+                        rcu_assign_pointer(vi->rq[i].xdp_prog, prog);
+                        if (i == 0)
+                                virtnet_restore_guest_offloads(vi);
+                }
+                synchronize_net();
+        }
 
-        netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp);
         err = _virtnet_set_queues(vi, curr_qp + xdp_qp);
         if (err)
                 goto err;
+        netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp);
         vi->xdp_queue_pairs = xdp_qp;
 
-        for (i = 0; i < vi->max_queue_pairs; i++) {
-                old_prog = rtnl_dereference(vi->rq[i].xdp_prog);
-                rcu_assign_pointer(vi->rq[i].xdp_prog, prog);
-                if (i == 0) {
-                        if (!old_prog)
+        if (prog) {
+                for (i = 0; i < vi->max_queue_pairs; i++) {
+                        rcu_assign_pointer(vi->rq[i].xdp_prog, prog);
+                        if (i == 0 && !old_prog)
                                 virtnet_clear_guest_offloads(vi);
-                        if (!prog)
-                                virtnet_restore_guest_offloads(vi);
                 }
+        }
+
+        for (i = 0; i < vi->max_queue_pairs; i++) {
                 if (old_prog)
                         bpf_prog_put(old_prog);
-                if (netif_running(dev))
+                if (netif_running(dev)) {
                         virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
+                        virtnet_napi_tx_enable(vi, vi->sq[i].vq,
+                                               &vi->sq[i].napi);
+                }
         }
 
         return 0;
 
 err:
-        for (i = 0; i < vi->max_queue_pairs; i++)
-                virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
+        if (!prog) {
+                virtnet_clear_guest_offloads(vi);
+                for (i = 0; i < vi->max_queue_pairs; i++)
+                        rcu_assign_pointer(vi->rq[i].xdp_prog, old_prog);
+        }
+
+        if (netif_running(dev)) {
+                for (i = 0; i < vi->max_queue_pairs; i++) {
+                        virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
+                        virtnet_napi_tx_enable(vi, vi->sq[i].vq,
+                                               &vi->sq[i].napi);
+                }
+        }
         if (prog)
                 bpf_prog_sub(prog, vi->max_queue_pairs - 1);
         return err;
@@ -2614,16 +2701,6 @@ static void free_receive_page_frags(struct virtnet_info *vi)
                         put_page(vi->rq[i].alloc_frag.page);
 }
 
-static bool is_xdp_raw_buffer_queue(struct virtnet_info *vi, int q)
-{
-        if (q < (vi->curr_queue_pairs - vi->xdp_queue_pairs))
-                return false;
-        else if (q < vi->curr_queue_pairs)
-                return true;
-        else
-                return false;
-}
-
 static void free_unused_bufs(struct virtnet_info *vi)
 {
         void *buf;
@@ -2632,10 +2709,10 @@ static void free_unused_bufs(struct virtnet_info *vi)
         for (i = 0; i < vi->max_queue_pairs; i++) {
                 struct virtqueue *vq = vi->sq[i].vq;
                 while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) {
-                        if (!is_xdp_raw_buffer_queue(vi, i))
+                        if (!is_xdp_frame(buf))
                                 dev_kfree_skb(buf);
                         else
-                                put_page(virt_to_head_page(buf));
+                                xdp_return_frame(ptr_to_xdp(buf));
                 }
         }
 
diff --git a/drivers/net/wan/dscc4.c b/drivers/net/wan/dscc4.c
index d5dc823f781e..fa78d2b14136 100644
--- a/drivers/net/wan/dscc4.c
+++ b/drivers/net/wan/dscc4.c
@@ -1575,7 +1575,7 @@ try:
                                         dev->stats.tx_packets++;
                                         dev->stats.tx_bytes += skb->len;
                                 }
-                                dev_kfree_skb_irq(skb);
+                                dev_consume_skb_irq(skb);
                                 dpriv->tx_skbuff[cur] = NULL;
                                 ++dpriv->tx_dirty;
                         } else {
diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index 66d889d54e58..a08f04c3f644 100644
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -482,7 +482,7 @@ static int hdlc_tx_done(struct ucc_hdlc_private *priv)
                 memset(priv->tx_buffer +
                        (be32_to_cpu(bd->buf) - priv->dma_tx_addr),
                        0, skb->len);
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
 
                 priv->tx_skbuff[priv->skb_dirtytx] = NULL;
                 priv->skb_dirtytx =
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 399b501f3c3c..e8891f5fc83a 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -548,7 +548,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
         {
                 .id = WCN3990_HW_1_0_DEV_VERSION,
                 .dev_id = 0,
-                .bus = ATH10K_BUS_PCI,
+                .bus = ATH10K_BUS_SNOC,
                 .name = "wcn3990 hw1.0",
                 .continuous_frag_desc = true,
                 .tx_chain_mask = 0x7,
diff --git a/drivers/net/wireless/intel/iwlwifi/Kconfig b/drivers/net/wireless/intel/iwlwifi/Kconfig
index 491ca3c8b43c..83d5bceea08f 100644
--- a/drivers/net/wireless/intel/iwlwifi/Kconfig
+++ b/drivers/net/wireless/intel/iwlwifi/Kconfig
@@ -1,6 +1,6 @@
 config IWLWIFI
         tristate "Intel Wireless WiFi Next Gen AGN - Wireless-N/Advanced-N/Ultimate-N (iwlwifi) "
-        depends on PCI && HAS_IOMEM
+        depends on PCI && HAS_IOMEM && CFG80211
         select FW_LOADER
         ---help---
           Select to build the driver supporting the:
@@ -47,6 +47,7 @@ if IWLWIFI
 config IWLWIFI_LEDS
         bool
         depends on LEDS_CLASS=y || LEDS_CLASS=IWLWIFI
+        depends on IWLMVM || IWLDVM
         select LEDS_TRIGGERS
         select MAC80211_LEDS
         default y
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c
index 497e762978cc..b2cabce1d74d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c
@@ -212,24 +212,24 @@ void mt76x0_get_tx_power_per_rate(struct mt76x02_dev *dev)
         mt76x02_add_rate_power_offset(t, delta);
 }
 
-void mt76x0_get_power_info(struct mt76x02_dev *dev, u8 *info)
+void mt76x0_get_power_info(struct mt76x02_dev *dev, s8 *tp)
 {
         struct mt76x0_chan_map {
                 u8 chan;
                 u8 offset;
         } chan_map[] = {
-                {   2,  0 }, {   4,  1 }, {   6,  2 }, {   8,  3 },
-                {  10,  4 }, {  12,  5 }, {  14,  6 }, {  38,  0 },
-                {  44,  1 }, {  48,  2 }, {  54,  3 }, {  60,  4 },
-                {  64,  5 }, { 102,  6 }, { 108,  7 }, { 112,  8 },
-                { 118,  9 }, { 124, 10 }, { 128, 11 }, { 134, 12 },
-                { 140, 13 }, { 151, 14 }, { 157, 15 }, { 161, 16 },
-                { 167, 17 }, { 171, 18 }, { 173, 19 },
+                {   2,  0 }, {   4,  2 }, {   6,  4 }, {   8,  6 },
+                {  10,  8 }, {  12, 10 }, {  14, 12 }, {  38,  0 },
+                {  44,  2 }, {  48,  4 }, {  54,  6 }, {  60,  8 },
+                {  64, 10 }, { 102, 12 }, { 108, 14 }, { 112, 16 },
+                { 118, 18 }, { 124, 20 }, { 128, 22 }, { 134, 24 },
+                { 140, 26 }, { 151, 28 }, { 157, 30 }, { 161, 32 },
+                { 167, 34 }, { 171, 36 }, { 175, 38 },
         };
         struct ieee80211_channel *chan = dev->mt76.chandef.chan;
         u8 offset, addr;
+        int i, idx = 0;
         u16 data;
-        int i;
 
         if (mt76x0_tssi_enabled(dev)) {
                 s8 target_power;
@@ -239,14 +239,14 @@ void mt76x0_get_power_info(struct mt76x02_dev *dev, u8 *info)
                 else
                         data = mt76x02_eeprom_get(dev, MT_EE_2G_TARGET_POWER);
                 target_power = (data & 0xff) - dev->mt76.rate_power.ofdm[7];
-                info[0] = target_power + mt76x0_get_delta(dev);
-                info[1] = 0;
+                *tp = target_power + mt76x0_get_delta(dev);
 
                 return;
         }
 
         for (i = 0; i < ARRAY_SIZE(chan_map); i++) {
-                if (chan_map[i].chan <= chan->hw_value) {
+                if (chan->hw_value <= chan_map[i].chan) {
+                        idx = (chan->hw_value == chan_map[i].chan);
                         offset = chan_map[i].offset;
                         break;
                 }
@@ -258,13 +258,16 @@ void mt76x0_get_power_info(struct mt76x02_dev *dev, u8 *info)
                 addr = MT_EE_TX_POWER_DELTA_BW80 + offset;
         } else {
                 switch (chan->hw_value) {
+                case 42:
+                        offset = 2;
+                        break;
                 case 58:
                         offset = 8;
                         break;
                 case 106:
                         offset = 14;
                         break;
-                case 112:
+                case 122:
                         offset = 20;
                         break;
                 case 155:
@@ -277,14 +280,9 @@ void mt76x0_get_power_info(struct mt76x02_dev *dev, u8 *info)
         }
 
         data = mt76x02_eeprom_get(dev, addr);
-
-        info[0] = data;
-        if (!info[0] || info[0] > 0x3f)
-                info[0] = 5;
-
-        info[1] = data >> 8;
-        if (!info[1] || info[1] > 0x3f)
-                info[1] = 5;
+        *tp = data >> (8 * idx);
+        if (*tp < 0 || *tp > 0x3f)
+                *tp = 5;
 }
 
 static int mt76x0_check_eeprom(struct mt76x02_dev *dev)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.h
index ee9ade9f3c8b..42b259f90b6d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.h
@@ -26,7 +26,7 @@ struct mt76x02_dev;
 int mt76x0_eeprom_init(struct mt76x02_dev *dev);
 void mt76x0_read_rx_gain(struct mt76x02_dev *dev);
 void mt76x0_get_tx_power_per_rate(struct mt76x02_dev *dev);
-void mt76x0_get_power_info(struct mt76x02_dev *dev, u8 *info);
+void mt76x0_get_power_info(struct mt76x02_dev *dev, s8 *tp);
 
 static inline s8 s6_to_s8(u32 val)
 {
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
index 5a4c6f34267e..1117cdc15b04 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
@@ -845,17 +845,17 @@ static void mt76x0_phy_tssi_calibrate(struct mt76x02_dev *dev)
 void mt76x0_phy_set_txpower(struct mt76x02_dev *dev)
 {
         struct mt76_rate_power *t = &dev->mt76.rate_power;
-        u8 info[2];
+        s8 info;
 
         mt76x0_get_tx_power_per_rate(dev);
-        mt76x0_get_power_info(dev, info);
+        mt76x0_get_power_info(dev, &info);
 
-        mt76x02_add_rate_power_offset(t, info[0]);
+        mt76x02_add_rate_power_offset(t, info);
         mt76x02_limit_rate_power(t, dev->mt76.txpower_conf);
         dev->mt76.txpower_cur = mt76x02_get_max_rate_power(t);
-        mt76x02_add_rate_power_offset(t, -info[0]);
+        mt76x02_add_rate_power_offset(t, -info);
 
-        mt76x02_phy_set_txpower(dev, info[0], info[1]);
+        mt76x02_phy_set_txpower(dev, info, info);
 }
 
 void mt76x0_phy_calibrate(struct mt76x02_dev *dev, bool power_on)
diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
index bd10165d7eec..4d4b07701149 100644
--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -164,6 +164,12 @@ static int wl12xx_sdio_power_on(struct wl12xx_sdio_glue *glue)
         }
 
         sdio_claim_host(func);
+        /*
+         * To guarantee that the SDIO card is power cycled, as required to make
+         * the FW programming to succeed, let's do a brute force HW reset.
+         */
+        mmc_hw_reset(card->host);
+
         sdio_enable_func(func);
         sdio_release_host(func);
 
@@ -174,20 +180,13 @@ static int wl12xx_sdio_power_off(struct wl12xx_sdio_glue *glue)
 {
         struct sdio_func *func = dev_to_sdio_func(glue->dev);
         struct mmc_card *card = func->card;
-        int error;
 
         sdio_claim_host(func);
         sdio_disable_func(func);
         sdio_release_host(func);
 
         /* Let runtime PM know the card is powered off */
-        error = pm_runtime_put(&card->dev);
-        if (error < 0 && error != -EBUSY) {
-                dev_err(&card->dev, "%s failed: %i\n", __func__, error);
-
-                return error;
-        }
-
+        pm_runtime_put(&card->dev);
         return 0;
 }
 
diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
index 52e47dac028f..80f843030e36 100644
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -310,6 +310,9 @@ static int imx6_pcie_attach_pd(struct device *dev)
         imx6_pcie->pd_pcie = dev_pm_domain_attach_by_name(dev, "pcie");
         if (IS_ERR(imx6_pcie->pd_pcie))
                 return PTR_ERR(imx6_pcie->pd_pcie);
+        /* Do nothing when power domain missing */
+        if (!imx6_pcie->pd_pcie)
+                return 0;
         link = device_link_add(dev, imx6_pcie->pd_pcie,
                         DL_FLAG_STATELESS |
                         DL_FLAG_PM_RUNTIME |
@@ -323,13 +326,13 @@ static int imx6_pcie_attach_pd(struct device *dev)
         if (IS_ERR(imx6_pcie->pd_pcie_phy))
                 return PTR_ERR(imx6_pcie->pd_pcie_phy);
 
-        device_link_add(dev, imx6_pcie->pd_pcie_phy,
+        link = device_link_add(dev, imx6_pcie->pd_pcie_phy,
                         DL_FLAG_STATELESS |
                         DL_FLAG_PM_RUNTIME |
                         DL_FLAG_RPM_ACTIVE);
-        if (IS_ERR(link)) {
-                dev_err(dev, "Failed to add device_link to pcie_phy pd: %ld\n", PTR_ERR(link));
-                return PTR_ERR(link);
+        if (!link) {
+                dev_err(dev, "Failed to add device_link to pcie_phy pd.\n");
+                return -EINVAL;
         }
 
         return 0;
diff --git a/drivers/pci/controller/dwc/pcie-armada8k.c b/drivers/pci/controller/dwc/pcie-armada8k.c
index b171b6bc15c8..0c389a30ef5d 100644
--- a/drivers/pci/controller/dwc/pcie-armada8k.c
+++ b/drivers/pci/controller/dwc/pcie-armada8k.c
@@ -22,7 +22,6 @@
 #include <linux/resource.h>
 #include <linux/of_pci.h>
 #include <linux/of_irq.h>
-#include <linux/gpio/consumer.h>
 
 #include "pcie-designware.h"
 
@@ -30,7 +29,6 @@ struct armada8k_pcie {
         struct dw_pcie *pci;
         struct clk *clk;
         struct clk *clk_reg;
-        struct gpio_desc *reset_gpio;
 };
 
 #define PCIE_VENDOR_REGS_OFFSET         0x8000
@@ -139,12 +137,6 @@ static int armada8k_pcie_host_init(struct pcie_port *pp)
         struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
         struct armada8k_pcie *pcie = to_armada8k_pcie(pci);
 
-        if (pcie->reset_gpio) {
-                /* assert and then deassert the reset signal */
-                gpiod_set_value_cansleep(pcie->reset_gpio, 1);
-                msleep(100);
-                gpiod_set_value_cansleep(pcie->reset_gpio, 0);
-        }
         dw_pcie_setup_rc(pp);
         armada8k_pcie_establish_link(pcie);
 
@@ -257,14 +249,6 @@ static int armada8k_pcie_probe(struct platform_device *pdev)
                 goto fail_clkreg;
         }
 
-        /* Get reset gpio signal and hold asserted (logically high) */
-        pcie->reset_gpio = devm_gpiod_get_optional(dev, "reset",
-                                                   GPIOD_OUT_HIGH);
-        if (IS_ERR(pcie->reset_gpio)) {
-                ret = PTR_ERR(pcie->reset_gpio);
-                goto fail_clkreg;
-        }
-
         platform_set_drvdata(pdev, pcie);
 
         ret = armada8k_add_pcie_port(pcie, pdev);
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 05044e323ea5..03ec7a5d9d0b 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1513,7 +1513,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
                         DMI_MATCH(DMI_PRODUCT_FAMILY, "Intel_Strago"),
-                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
                 },
         },
         {
@@ -1521,7 +1521,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "HP"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "Setzer"),
-                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
                 },
         },
         {
@@ -1529,7 +1529,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "Cyan"),
-                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
                 },
         },
         {
@@ -1537,7 +1537,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "Celes"),
-                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
                 },
         },
         {}
diff --git a/drivers/pinctrl/mediatek/Kconfig b/drivers/pinctrl/mediatek/Kconfig
index 1817786ab6aa..a005cbccb4f7 100644
--- a/drivers/pinctrl/mediatek/Kconfig
+++ b/drivers/pinctrl/mediatek/Kconfig
@@ -45,12 +45,14 @@ config PINCTRL_MT2701
 config PINCTRL_MT7623
         bool "Mediatek MT7623 pin control with generic binding"
         depends on MACH_MT7623 || COMPILE_TEST
+        depends on OF
         default MACH_MT7623
         select PINCTRL_MTK_MOORE
 
 config PINCTRL_MT7629
         bool "Mediatek MT7629 pin control"
         depends on MACH_MT7629 || COMPILE_TEST
+        depends on OF
         default MACH_MT7629
         select PINCTRL_MTK_MOORE
 
@@ -92,6 +94,7 @@ config PINCTRL_MT6797
 
 config PINCTRL_MT7622
         bool "MediaTek MT7622 pin control"
+        depends on OF
         depends on ARM64 || COMPILE_TEST
         default ARM64 && ARCH_MEDIATEK
         select PINCTRL_MTK_MOORE
diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c
index b03481ef99a1..98905d4a79ca 100644
--- a/drivers/pinctrl/pinctrl-mcp23s08.c
+++ b/drivers/pinctrl/pinctrl-mcp23s08.c
@@ -832,8 +832,13 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
                 break;
 
         case MCP_TYPE_S18:
+                one_regmap_config =
+                        devm_kmemdup(dev, &mcp23x17_regmap,
+                                sizeof(struct regmap_config), GFP_KERNEL);
+                if (!one_regmap_config)
+                        return -ENOMEM;
                 mcp->regmap = devm_regmap_init(dev, &mcp23sxx_spi_regmap, mcp,
-                                               &mcp23x17_regmap);
+                                               one_regmap_config);
                 mcp->reg_shift = 1;
                 mcp->chip.ngpio = 16;
                 mcp->chip.label = "mcp23s18";
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c b/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c
index aa8b58125568..ef4268cc6227 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c
@@ -588,7 +588,7 @@ static const unsigned int h6_irq_bank_map[] = { 1, 5, 6, 7 };
 static const struct sunxi_pinctrl_desc h6_pinctrl_data = {
         .pins = h6_pins,
         .npins = ARRAY_SIZE(h6_pins),
-        .irq_banks = 3,
+        .irq_banks = 4,
         .irq_bank_map = h6_irq_bank_map,
         .irq_read_needs_mux = true,
 };
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index 5d9184d18c16..0e7fa69e93df 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -698,26 +698,24 @@ static int sunxi_pmx_request(struct pinctrl_dev *pctldev, unsigned offset)
 {
         struct sunxi_pinctrl *pctl = pinctrl_dev_get_drvdata(pctldev);
         unsigned short bank = offset / PINS_PER_BANK;
-        struct sunxi_pinctrl_regulator *s_reg = &pctl->regulators[bank];
-        struct regulator *reg;
+        unsigned short bank_offset = bank - pctl->desc->pin_base /
+                                            PINS_PER_BANK;
+        struct sunxi_pinctrl_regulator *s_reg = &pctl->regulators[bank_offset];
+        struct regulator *reg = s_reg->regulator;
+        char supply[16];
         int ret;
 
-        reg = s_reg->regulator;
-        if (!reg) {
-                char supply[16];
-
-                snprintf(supply, sizeof(supply), "vcc-p%c", 'a' + bank);
-                reg = regulator_get(pctl->dev, supply);
-                if (IS_ERR(reg)) {
-                        dev_err(pctl->dev, "Couldn't get bank P%c regulator\n",
-                                'A' + bank);
-                        return PTR_ERR(reg);
-                }
-
-                s_reg->regulator = reg;
-                refcount_set(&s_reg->refcount, 1);
-        } else {
+        if (reg) {
                 refcount_inc(&s_reg->refcount);
+                return 0;
+        }
+
+        snprintf(supply, sizeof(supply), "vcc-p%c", 'a' + bank);
+        reg = regulator_get(pctl->dev, supply);
+        if (IS_ERR(reg)) {
+                dev_err(pctl->dev, "Couldn't get bank P%c regulator\n",
+                        'A' + bank);
+                return PTR_ERR(reg);
         }
 
         ret = regulator_enable(reg);
@@ -727,13 +725,13 @@ static int sunxi_pmx_request(struct pinctrl_dev *pctldev, unsigned offset)
                 goto out;
         }
 
+        s_reg->regulator = reg;
+        refcount_set(&s_reg->refcount, 1);
+
         return 0;
 
 out:
-        if (refcount_dec_and_test(&s_reg->refcount)) {
-                regulator_put(s_reg->regulator);
-                s_reg->regulator = NULL;
-        }
+        regulator_put(s_reg->regulator);
 
         return ret;
 }
@@ -742,7 +740,9 @@ static int sunxi_pmx_free(struct pinctrl_dev *pctldev, unsigned offset)
 {
         struct sunxi_pinctrl *pctl = pinctrl_dev_get_drvdata(pctldev);
         unsigned short bank = offset / PINS_PER_BANK;
-        struct sunxi_pinctrl_regulator *s_reg = &pctl->regulators[bank];
+        unsigned short bank_offset = bank - pctl->desc->pin_base /
+                                            PINS_PER_BANK;
+        struct sunxi_pinctrl_regulator *s_reg = &pctl->regulators[bank_offset];
 
         if (!refcount_dec_and_test(&s_reg->refcount))
                 return 0;
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.h b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
index e340d2a24b44..034c0317c8d6 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.h
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
@@ -136,7 +136,7 @@ struct sunxi_pinctrl {
         struct gpio_chip                *chip;
         const struct sunxi_pinctrl_desc *desc;
         struct device                   *dev;
-        struct sunxi_pinctrl_regulator  regulators[12];
+        struct sunxi_pinctrl_regulator  regulators[9];
         struct irq_domain               *domain;
         struct sunxi_pinctrl_function   *functions;
         unsigned                        nfunctions;
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 5e2109c54c7c..b5e9db85e881 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -905,6 +905,7 @@ config TOSHIBA_WMI
 config ACPI_CMPC
         tristate "CMPC Laptop Extras"
         depends on ACPI && INPUT
+        depends on BACKLIGHT_LCD_SUPPORT
         depends on RFKILL || RFKILL=n
         select BACKLIGHT_CLASS_DEVICE
         help
@@ -1128,6 +1129,7 @@ config INTEL_OAKTRAIL
 config SAMSUNG_Q10
         tristate "Samsung Q10 Extras"
         depends on ACPI
+        depends on BACKLIGHT_LCD_SUPPORT
         select BACKLIGHT_CLASS_DEVICE
         ---help---
           This driver provides support for backlight control on Samsung Q10
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index d65650ef6b41..71d27a804920 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -22,6 +22,7 @@
 #include <linux/hashtable.h>
 #include <linux/ip.h>
 #include <linux/refcount.h>
+#include <linux/workqueue.h>
 
 #include <net/ipv6.h>
 #include <net/if_inet6.h>
@@ -784,6 +785,7 @@ struct qeth_card {
         struct qeth_seqno seqno;
         struct qeth_card_options options;
 
+        struct workqueue_struct *event_wq;
         wait_queue_head_t wait_q;
         spinlock_t mclock;
         unsigned long active_vlans[BITS_TO_LONGS(VLAN_N_VID)];
@@ -954,7 +956,6 @@ extern const struct attribute_group *qeth_osn_attr_groups[];
 extern const struct attribute_group qeth_device_attr_group;
 extern const struct attribute_group qeth_device_blkt_group;
 extern const struct device_type qeth_generic_devtype;
-extern struct workqueue_struct *qeth_wq;
 
 int qeth_card_hw_is_reachable(struct qeth_card *);
 const char *qeth_get_cardname_short(struct qeth_card *);
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index dcc06e48b70b..6ef0c89370b5 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -74,8 +74,7 @@ static void qeth_notify_skbs(struct qeth_qdio_out_q *queue,
 static void qeth_release_skbs(struct qeth_qdio_out_buffer *buf);
 static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *, int);
 
-struct workqueue_struct *qeth_wq;
-EXPORT_SYMBOL_GPL(qeth_wq);
+static struct workqueue_struct *qeth_wq;
 
 int qeth_card_hw_is_reachable(struct qeth_card *card)
 {
@@ -540,6 +539,7 @@ static int __qeth_issue_next_read(struct qeth_card *card)
                 QETH_DBF_MESSAGE(2, "error %i on device %x when starting next read ccw!\n",
                                  rc, CARD_DEVID(card));
                 atomic_set(&channel->irq_pending, 0);
+                qeth_release_buffer(channel, iob);
                 card->read_or_write_problem = 1;
                 qeth_schedule_recovery(card);
                 wake_up(&card->wait_q);
@@ -1101,6 +1101,8 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
                 rc = qeth_get_problem(card, cdev, irb);
                 if (rc) {
                         card->read_or_write_problem = 1;
+                        if (iob)
+                                qeth_release_buffer(iob->channel, iob);
                         qeth_clear_ipacmd_list(card);
                         qeth_schedule_recovery(card);
                         goto out;
@@ -1439,6 +1441,10 @@ static struct qeth_card *qeth_alloc_card(struct ccwgroup_device *gdev)
         CARD_RDEV(card) = gdev->cdev[0];
         CARD_WDEV(card) = gdev->cdev[1];
         CARD_DDEV(card) = gdev->cdev[2];
+
+        card->event_wq = alloc_ordered_workqueue("%s", 0, dev_name(&gdev->dev));
+        if (!card->event_wq)
+                goto out_wq;
         if (qeth_setup_channel(&card->read, true))
                 goto out_ip;
         if (qeth_setup_channel(&card->write, true))
@@ -1454,6 +1460,8 @@ out_data:
 out_channel:
         qeth_clean_channel(&card->read);
 out_ip:
+        destroy_workqueue(card->event_wq);
+out_wq:
         dev_set_drvdata(&gdev->dev, NULL);
         kfree(card);
 out:
@@ -1782,6 +1790,7 @@ static int qeth_idx_activate_get_answer(struct qeth_card *card,
                 QETH_DBF_MESSAGE(2, "Error2 in activating channel rc=%d\n", rc);
                 QETH_DBF_TEXT_(SETUP, 2, "2err%d", rc);
                 atomic_set(&channel->irq_pending, 0);
+                qeth_release_buffer(channel, iob);
                 wake_up(&card->wait_q);
                 return rc;
         }
@@ -1851,6 +1860,7 @@ static int qeth_idx_activate_channel(struct qeth_card *card,
                         rc);
                 QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
                 atomic_set(&channel->irq_pending, 0);
+                qeth_release_buffer(channel, iob);
                 wake_up(&card->wait_q);
                 return rc;
         }
@@ -2031,6 +2041,7 @@ int qeth_send_control_data(struct qeth_card *card, int len,
         }
         reply = qeth_alloc_reply(card);
         if (!reply) {
+                qeth_release_buffer(channel, iob);
                 return -ENOMEM;
         }
         reply->callback = reply_cb;
@@ -2362,11 +2373,12 @@ static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *q, int bidx)
         return 0;
 }
 
-static void qeth_free_qdio_out_buf(struct qeth_qdio_out_q *q)
+static void qeth_free_output_queue(struct qeth_qdio_out_q *q)
 {
         if (!q)
                 return;
 
+        qeth_clear_outq_buffers(q, 1);
         qdio_free_buffers(q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q);
         kfree(q);
 }
@@ -2440,10 +2452,8 @@ out_freeoutqbufs:
                 card->qdio.out_qs[i]->bufs[j] = NULL;
         }
 out_freeoutq:
-        while (i > 0) {
-                qeth_free_qdio_out_buf(card->qdio.out_qs[--i]);
-                qeth_clear_outq_buffers(card->qdio.out_qs[i], 1);
-        }
+        while (i > 0)
+                qeth_free_output_queue(card->qdio.out_qs[--i]);
         kfree(card->qdio.out_qs);
         card->qdio.out_qs = NULL;
 out_freepool:
@@ -2476,10 +2486,8 @@ static void qeth_free_qdio_buffers(struct qeth_card *card)
         qeth_free_buffer_pool(card);
         /* free outbound qdio_qs */
         if (card->qdio.out_qs) {
-                for (i = 0; i < card->qdio.no_out_queues; ++i) {
-                        qeth_clear_outq_buffers(card->qdio.out_qs[i], 1);
-                        qeth_free_qdio_out_buf(card->qdio.out_qs[i]);
-                }
+                for (i = 0; i < card->qdio.no_out_queues; i++)
+                        qeth_free_output_queue(card->qdio.out_qs[i]);
                 kfree(card->qdio.out_qs);
                 card->qdio.out_qs = NULL;
         }
@@ -4994,6 +5002,7 @@ static void qeth_core_free_card(struct qeth_card *card)
         qeth_clean_channel(&card->read);
         qeth_clean_channel(&card->write);
         qeth_clean_channel(&card->data);
+        destroy_workqueue(card->event_wq);
         qeth_free_qdio_buffers(card);
         unregister_service_level(&card->qeth_service_level);
         dev_set_drvdata(&card->gdev->dev, NULL);
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 82f50cc30b0a..ef0b5eaf2532 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -319,6 +319,8 @@ static void qeth_l2_stop_card(struct qeth_card *card, int recovery_mode)
                 qeth_clear_cmd_buffers(&card->read);
                 qeth_clear_cmd_buffers(&card->write);
         }
+
+        flush_workqueue(card->event_wq);
 }
 
 static int qeth_l2_process_inbound_buffer(struct qeth_card *card,
@@ -695,6 +697,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)
 
         if (cgdev->state == CCWGROUP_ONLINE)
                 qeth_l2_set_offline(cgdev);
+
+        cancel_work_sync(&card->close_dev_work);
         if (qeth_netdev_is_registered(card->dev))
                 unregister_netdev(card->dev);
 }
@@ -1330,7 +1334,7 @@ static void qeth_bridge_state_change(struct qeth_card *card,
         data->card = card;
         memcpy(&data->qports, qports,
                         sizeof(struct qeth_sbp_state_change) + extrasize);
-        queue_work(qeth_wq, &data->worker);
+        queue_work(card->event_wq, &data->worker);
 }
 
 struct qeth_bridge_host_data {
@@ -1402,7 +1406,7 @@ static void qeth_bridge_host_event(struct qeth_card *card,
         data->card = card;
         memcpy(&data->hostevs, hostevs,
                         sizeof(struct qeth_ipacmd_addr_change) + extrasize);
-        queue_work(qeth_wq, &data->worker);
+        queue_work(card->event_wq, &data->worker);
 }
 
 /* SETBRIDGEPORT support; sending commands */
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 59535ecb1487..f7d0623999ba 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -1428,6 +1428,8 @@ static void qeth_l3_stop_card(struct qeth_card *card, int recovery_mode)
                 qeth_clear_cmd_buffers(&card->read);
                 qeth_clear_cmd_buffers(&card->write);
         }
+
+        flush_workqueue(card->event_wq);
 }
 
 /*
@@ -2278,6 +2280,7 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev)
         if (cgdev->state == CCWGROUP_ONLINE)
                 qeth_l3_set_offline(cgdev);
 
+        cancel_work_sync(&card->close_dev_work);
         if (qeth_netdev_is_registered(card->dev))
                 unregister_netdev(card->dev);
         qeth_l3_clear_ip_htable(card, 0);
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index 9cf30d124b9e..e390f8c6d5f3 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -403,7 +403,6 @@ struct zfcp_adapter *zfcp_adapter_enqueue(struct ccw_device *ccw_device)
                 goto failed;
 
         /* report size limit per scatter-gather segment */
-        adapter->dma_parms.max_segment_size = ZFCP_QDIO_SBALE_LEN;
         adapter->ccw_device->dev.dma_parms = &adapter->dma_parms;
 
         adapter->stat_read_buf_num = FSF_STATUS_READS_RECOM;
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 00acc7144bbc..f4f6a07c5222 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -428,6 +428,8 @@ static struct scsi_host_template zfcp_scsi_host_template = {
         .max_sectors             = (((QDIO_MAX_ELEMENTS_PER_BUFFER - 1)
                                      * ZFCP_QDIO_MAX_SBALS_PER_REQ) - 2) * 8,
                                    /* GCD, adjusted later */
+        /* report size limit per scatter-gather segment */
+        .max_segment_size        = ZFCP_QDIO_SBALE_LEN,
         .dma_boundary            = ZFCP_QDIO_SBALE_LEN - 1,
         .shost_attrs             = zfcp_sysfs_shost_attrs,
         .sdev_attrs              = zfcp_sysfs_sdev_attrs,
diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c
index 128d658d472a..16957d7ac414 100644
--- a/drivers/scsi/53c700.c
+++ b/drivers/scsi/53c700.c
@@ -295,7 +295,7 @@ NCR_700_detect(struct scsi_host_template *tpnt,
         if(tpnt->sdev_attrs == NULL)
                 tpnt->sdev_attrs = NCR_700_dev_attrs;
 
-        memory = dma_alloc_attrs(hostdata->dev, TOTAL_MEM_SIZE, &pScript,
+        memory = dma_alloc_attrs(dev, TOTAL_MEM_SIZE, &pScript,
                                  GFP_KERNEL, DMA_ATTR_NON_CONSISTENT);
         if(memory == NULL) {
                 printk(KERN_ERR "53c700: Failed to allocate memory for driver, detaching\n");
diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
index 350257c13a5b..bc9f2a2365f4 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -240,6 +240,7 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
                 return NULL;
         }
 
+        cmgr->hba = hba;
         cmgr->free_list = kcalloc(arr_sz, sizeof(*cmgr->free_list),
                                   GFP_KERNEL);
         if (!cmgr->free_list) {
@@ -256,7 +257,6 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
                 goto mem_err;
         }
 
-        cmgr->hba = hba;
         cmgr->cmds = (struct bnx2fc_cmd **)(cmgr + 1);
 
         for (i = 0; i < arr_sz; i++)  {
@@ -295,7 +295,7 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
 
         /* Allocate pool of io_bdts - one for each bnx2fc_cmd */
         mem_size = num_ios * sizeof(struct io_bdt *);
-        cmgr->io_bdt_pool = kmalloc(mem_size, GFP_KERNEL);
+        cmgr->io_bdt_pool = kzalloc(mem_size, GFP_KERNEL);
         if (!cmgr->io_bdt_pool) {
                 printk(KERN_ERR PFX "failed to alloc io_bdt_pool\n");
                 goto mem_err;
diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index be83590ed955..ff943f477d6f 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -1726,14 +1726,14 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
             fc_frame_payload_op(fp) != ELS_LS_ACC) {
                 FC_LPORT_DBG(lport, "FLOGI not accepted or bad response\n");
                 fc_lport_error(lport, fp);
-                goto err;
+                goto out;
         }
 
         flp = fc_frame_payload_get(fp, sizeof(*flp));
         if (!flp) {
                 FC_LPORT_DBG(lport, "FLOGI bad response\n");
                 fc_lport_error(lport, fp);
-                goto err;
+                goto out;
         }
 
         mfs = ntohs(flp->fl_csp.sp_bb_data) &
@@ -1743,7 +1743,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
                 FC_LPORT_DBG(lport, "FLOGI bad mfs:%hu response, "
                              "lport->mfs:%hu\n", mfs, lport->mfs);
                 fc_lport_error(lport, fp);
-                goto err;
+                goto out;
         }
 
         if (mfs <= lport->mfs) {
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 661512bec3ac..e27f4df24021 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -62,7 +62,7 @@
 
 /* make sure inq_product_rev string corresponds to this version */
 #define SDEBUG_VERSION "0188"   /* format to fit INQUIRY revision field */
-static const char *sdebug_version_date = "20180128";
+static const char *sdebug_version_date = "20190125";
 
 #define MY_NAME "scsi_debug"
 
@@ -735,7 +735,7 @@ static inline bool scsi_debug_lbp(void)
                 (sdebug_lbpu || sdebug_lbpws || sdebug_lbpws10);
 }
 
-static void *fake_store(unsigned long long lba)
+static void *lba2fake_store(unsigned long long lba)
 {
         lba = do_div(lba, sdebug_store_sectors);
 
@@ -2514,8 +2514,8 @@ static int do_device_access(struct scsi_cmnd *scmd, u32 sg_skip, u64 lba,
         return ret;
 }
 
-/* If fake_store(lba,num) compares equal to arr(num), then copy top half of
- * arr into fake_store(lba,num) and return true. If comparison fails then
+/* If lba2fake_store(lba,num) compares equal to arr(num), then copy top half of
+ * arr into lba2fake_store(lba,num) and return true. If comparison fails then
  * return false. */
 static bool comp_write_worker(u64 lba, u32 num, const u8 *arr)
 {
@@ -2643,7 +2643,7 @@ static int prot_verify_read(struct scsi_cmnd *SCpnt, sector_t start_sec,
                 if (sdt->app_tag == cpu_to_be16(0xffff))
                         continue;
 
-                ret = dif_verify(sdt, fake_store(sector), sector, ei_lba);
+                ret = dif_verify(sdt, lba2fake_store(sector), sector, ei_lba);
                 if (ret) {
                         dif_errors++;
                         return ret;
@@ -3261,10 +3261,12 @@ err_out:
 static int resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num,
                            u32 ei_lba, bool unmap, bool ndob)
 {
+        int ret;
         unsigned long iflags;
         unsigned long long i;
-        int ret;
-        u64 lba_off;
+        u32 lb_size = sdebug_sector_size;
+        u64 block, lbaa;
+        u8 *fs1p;
 
         ret = check_device_access_params(scp, lba, num);
         if (ret)
@@ -3276,31 +3278,30 @@ static int resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num,
                 unmap_region(lba, num);
                 goto out;
         }
-
-        lba_off = lba * sdebug_sector_size;
+        lbaa = lba;
+        block = do_div(lbaa, sdebug_store_sectors);
         /* if ndob then zero 1 logical block, else fetch 1 logical block */
+        fs1p = fake_storep + (block * lb_size);
         if (ndob) {
-                memset(fake_storep + lba_off, 0, sdebug_sector_size);
+                memset(fs1p, 0, lb_size);
                 ret = 0;
         } else
-                ret = fetch_to_dev_buffer(scp, fake_storep + lba_off,
-                                          sdebug_sector_size);
+                ret = fetch_to_dev_buffer(scp, fs1p, lb_size);
 
         if (-1 == ret) {
                 write_unlock_irqrestore(&atomic_rw, iflags);
                 return DID_ERROR << 16;
-        } else if (sdebug_verbose && !ndob && (ret < sdebug_sector_size))
+        } else if (sdebug_verbose && !ndob && (ret < lb_size))
                 sdev_printk(KERN_INFO, scp->device,
                             "%s: %s: lb size=%u, IO sent=%d bytes\n",
-                            my_name, "write same",
-                            sdebug_sector_size, ret);
+                            my_name, "write same", lb_size, ret);
 
         /* Copy first sector to remaining blocks */
-        for (i = 1 ; i < num ; i++)
-                memcpy(fake_storep + ((lba + i) * sdebug_sector_size),
-                       fake_storep + lba_off,
-                       sdebug_sector_size);
-
+        for (i = 1 ; i < num ; i++) {
+                lbaa = lba + i;
+                block = do_div(lbaa, sdebug_store_sectors);
+                memmove(fake_storep + (block * lb_size), fs1p, lb_size);
+        }
         if (scsi_debug_lbp())
                 map_region(lba, num);
 out:
diff --git a/drivers/staging/octeon/ethernet-mdio.c b/drivers/staging/octeon/ethernet-mdio.c
index 2848fa71a33d..d6248eecf123 100644
--- a/drivers/staging/octeon/ethernet-mdio.c
+++ b/drivers/staging/octeon/ethernet-mdio.c
@@ -170,7 +170,7 @@ int cvm_oct_phy_setup_device(struct net_device *dev)
                 return -ENODEV;
 
         priv->last_link = 0;
-        phy_start_aneg(phydev);
+        phy_start(phydev);
 
         return 0;
 no_phy:
diff --git a/drivers/staging/speakup/spk_ttyio.c b/drivers/staging/speakup/spk_ttyio.c
index c92bbd05516e..005de0024dd4 100644
--- a/drivers/staging/speakup/spk_ttyio.c
+++ b/drivers/staging/speakup/spk_ttyio.c
@@ -265,7 +265,8 @@ static void spk_ttyio_send_xchar(char ch)
                 return;
         }
 
-        speakup_tty->ops->send_xchar(speakup_tty, ch);
+        if (speakup_tty->ops->send_xchar)
+                speakup_tty->ops->send_xchar(speakup_tty, ch);
         mutex_unlock(&speakup_tty_mutex);
 }
 
@@ -277,7 +278,8 @@ static void spk_ttyio_tiocmset(unsigned int set, unsigned int clear)
                 return;
         }
 
-        speakup_tty->ops->tiocmset(speakup_tty, set, clear);
+        if (speakup_tty->ops->tiocmset)
+                speakup_tty->ops->tiocmset(speakup_tty, set, clear);
         mutex_unlock(&speakup_tty_mutex);
 }
 
diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
index e2c407656fa6..c1fdbc0b6840 100644
--- a/drivers/tty/serial/8250/8250_mtk.c
+++ b/drivers/tty/serial/8250/8250_mtk.c
@@ -357,6 +357,9 @@ static int mtk8250_probe_of(struct platform_device *pdev, struct uart_port *p,
         if (dmacnt == 2) {
                 data->dma = devm_kzalloc(&pdev->dev, sizeof(*data->dma),
                                          GFP_KERNEL);
+                if (!data->dma)
+                        return -ENOMEM;
+
                 data->dma->fn = mtk8250_dma_filter;
                 data->dma->rx_size = MTK_UART_RX_SIZE;
                 data->dma->rxconf.src_maxburst = MTK_UART_RX_TRIGGER;
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index f80a300b5d68..48bd694a5fa1 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -3420,6 +3420,11 @@ static int
 serial_pci_guess_board(struct pci_dev *dev, struct pciserial_board *board)
 {
         int num_iomem, num_port, first_port = -1, i;
+        int rc;
+
+        rc = serial_pci_is_class_communication(dev);
+        if (rc)
+                return rc;
 
         /*
          * Should we try to make guesses for multiport serial devices later?
@@ -3647,10 +3652,6 @@ pciserial_init_one(struct pci_dev *dev, const struct pci_device_id *ent)
 
         board = &pci_boards[ent->driver_data];
 
-        rc = serial_pci_is_class_communication(dev);
-        if (rc)
-                return rc;
-
         rc = serial_pci_is_blacklisted(dev);
         if (rc)
                 return rc;
diff --git a/drivers/tty/serial/earlycon-riscv-sbi.c b/drivers/tty/serial/earlycon-riscv-sbi.c
index e1a551aae336..ce81523c3113 100644
--- a/drivers/tty/serial/earlycon-riscv-sbi.c
+++ b/drivers/tty/serial/earlycon-riscv-sbi.c
@@ -10,13 +10,16 @@
 #include <linux/serial_core.h>
 #include <asm/sbi.h>
 
-static void sbi_console_write(struct console *con,
-                              const char *s, unsigned int n)
+static void sbi_putc(struct uart_port *port, int c)
 {
-        int i;
+        sbi_console_putchar(c);
+}
 
-        for (i = 0; i < n; ++i)
-                sbi_console_putchar(s[i]);
+static void sbi_console_write(struct console *con,
+                              const char *s, unsigned n)
+{
+        struct earlycon_device *dev = con->data;
+        uart_console_write(&dev->port, s, n, sbi_putc);
 }
 
 static int __init early_sbi_setup(struct earlycon_device *device,
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 5c01bb6d1c24..556f50aa1b58 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -130,6 +130,9 @@ static void uart_start(struct tty_struct *tty)
         struct uart_port *port;
         unsigned long flags;
 
+        if (!state)
+                return;
+
         port = uart_port_lock(state, flags);
         __uart_start(tty);
         uart_port_unlock(port, flags);
@@ -727,6 +730,9 @@ static void uart_unthrottle(struct tty_struct *tty)
         upstat_t mask = UPSTAT_SYNC_FIFO;
         struct uart_port *port;
 
+        if (!state)
+                return;
+
         port = uart_port_ref(state);
         if (!port)
                 return;
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 8df0fd824520..64bbeb7d7e0c 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1921,7 +1921,7 @@ out_nomem:
 
 static void sci_free_irq(struct sci_port *port)
 {
-        int i;
+        int i, j;
 
         /*
          * Intentionally in reverse order so we iterate over the muxed
@@ -1937,6 +1937,13 @@ static void sci_free_irq(struct sci_port *port)
                 if (unlikely(irq < 0))
                         continue;
 
+                /* Check if already freed (irq was muxed) */
+                for (j = 0; j < i; j++)
+                        if (port->irqs[j] == irq)
+                                j = i + 1;
+                if (j > i)
+                        continue;
+
                 free_irq(port->irqs[i], port);
                 kfree(port->irqstr[i]);
 
diff --git a/drivers/usb/dwc3/dwc3-exynos.c b/drivers/usb/dwc3/dwc3-exynos.c
index cb7fcd7c0ad8..c1e9ea621f41 100644
--- a/drivers/usb/dwc3/dwc3-exynos.c
+++ b/drivers/usb/dwc3/dwc3-exynos.c
@@ -78,7 +78,7 @@ static int dwc3_exynos_probe(struct platform_device *pdev)
         for (i = 0; i < exynos->num_clks; i++) {
                 ret = clk_prepare_enable(exynos->clks[i]);
                 if (ret) {
-                        while (--i > 0)
+                        while (i-- > 0)
                                 clk_disable_unprepare(exynos->clks[i]);
                         return ret;
                 }
@@ -223,7 +223,7 @@ static int dwc3_exynos_resume(struct device *dev)
         for (i = 0; i < exynos->num_clks; i++) {
                 ret = clk_prepare_enable(exynos->clks[i]);
                 if (ret) {
-                        while (--i > 0)
+                        while (i-- > 0)
                                 clk_disable_unprepare(exynos->clks[i]);
                         return ret;
                 }
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index bed2ff42780b..6c9b76bcc2e1 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1119,7 +1119,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
         unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);
         unsigned int rem = length % maxp;
 
-        if (rem && usb_endpoint_dir_out(dep->endpoint.desc)) {
+        if ((!length || rem) && usb_endpoint_dir_out(dep->endpoint.desc)) {
                 struct dwc3     *dwc = dep->dwc;
                 struct dwc3_trb *trb;
 
diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c
index 660878a19505..b77f3126580e 100644
--- a/drivers/usb/gadget/udc/net2272.c
+++ b/drivers/usb/gadget/udc/net2272.c
@@ -2083,7 +2083,7 @@ static irqreturn_t net2272_irq(int irq, void *_dev)
 #if defined(PLX_PCI_RDK2)
         /* see if PCI int for us by checking irqstat */
         intcsr = readl(dev->rdk2.fpga_base_addr + RDK2_IRQSTAT);
-        if (!intcsr & (1 << NET2272_PCI_IRQ)) {
+        if (!(intcsr & (1 << NET2272_PCI_IRQ))) {
                 spin_unlock(&dev->lock);
                 return IRQ_NONE;
         }
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index eae8b1b1b45b..ffe462a657b1 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -452,13 +452,10 @@ void musb_g_tx(struct musb *musb, u8 epnum)
         }
 
         if (request) {
-                u8      is_dma = 0;
-                bool    short_packet = false;
 
                 trace_musb_req_tx(req);
 
                 if (dma && (csr & MUSB_TXCSR_DMAENAB)) {
-                        is_dma = 1;
                         csr |= MUSB_TXCSR_P_WZC_BITS;
                         csr &= ~(MUSB_TXCSR_DMAENAB | MUSB_TXCSR_P_UNDERRUN |
                                  MUSB_TXCSR_TXPKTRDY | MUSB_TXCSR_AUTOSET);
@@ -476,16 +473,8 @@ void musb_g_tx(struct musb *musb, u8 epnum)
                  */
                 if ((request->zero && request->length)
                         && (request->length % musb_ep->packet_sz == 0)
-                        && (request->actual == request->length))
-                                short_packet = true;
+                        && (request->actual == request->length)) {
 
-                if ((musb_dma_inventra(musb) || musb_dma_ux500(musb)) &&
-                        (is_dma && (!dma->desired_mode ||
-                                (request->actual &
-                                        (musb_ep->packet_sz - 1)))))
-                                short_packet = true;
-
-                if (short_packet) {
                         /*
                          * On DMA completion, FIFO may not be
                          * available yet...
diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
index a688f7f87829..5fc6825745f2 100644
--- a/drivers/usb/musb/musbhsdma.c
+++ b/drivers/usb/musb/musbhsdma.c
@@ -346,12 +346,10 @@ static irqreturn_t dma_controller_irq(int irq, void *private_data)
                                 channel->status = MUSB_DMA_STATUS_FREE;
 
                                 /* completed */
-                                if ((devctl & MUSB_DEVCTL_HM)
-                                        && (musb_channel->transmit)
-                                        && ((channel->desired_mode == 0)
-                                            || (channel->actual_len &
-                                            (musb_channel->max_packet_sz - 1)))
-                                    ) {
+                                if (musb_channel->transmit &&
+                                        (!channel->desired_mode ||
+                                        (channel->actual_len %
+                                            musb_channel->max_packet_sz))) {
                                         u8  epnum  = musb_channel->epnum;
                                         int offset = musb->io.ep_offset(epnum,
                                                                     MUSB_TXCSR);
@@ -363,11 +361,14 @@ static irqreturn_t dma_controller_irq(int irq, void *private_data)
                                          */
                                         musb_ep_select(mbase, epnum);
                                         txcsr = musb_readw(mbase, offset);
-                                        txcsr &= ~(MUSB_TXCSR_DMAENAB
+                                        if (channel->desired_mode == 1) {
+                                                txcsr &= ~(MUSB_TXCSR_DMAENAB
                                                         | MUSB_TXCSR_AUTOSET);
-                                        musb_writew(mbase, offset, txcsr);
-                                        /* Send out the packet */
-                                        txcsr &= ~MUSB_TXCSR_DMAMODE;
+                                                musb_writew(mbase, offset, txcsr);
+                                                /* Send out the packet */
+                                                txcsr &= ~MUSB_TXCSR_DMAMODE;
+                                                txcsr |= MUSB_TXCSR_DMAENAB;
+                                        }
                                         txcsr |=  MUSB_TXCSR_TXPKTRDY;
                                         musb_writew(mbase, offset, txcsr);
                                 }
diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index d7312eed6088..91ea3083e7ad 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -21,7 +21,7 @@ config AB8500_USB
 
 config FSL_USB2_OTG
         bool "Freescale USB OTG Transceiver Driver"
-        depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM && PM
+        depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM
         depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y'
         select USB_PHY
         help
diff --git a/drivers/usb/phy/phy-am335x.c b/drivers/usb/phy/phy-am335x.c
index 27bdb7222527..f5f0568d8533 100644
--- a/drivers/usb/phy/phy-am335x.c
+++ b/drivers/usb/phy/phy-am335x.c
@@ -61,9 +61,6 @@ static int am335x_phy_probe(struct platform_device *pdev)
         if (ret)
                 return ret;
 
-        ret = usb_add_phy_dev(&am_phy->usb_phy_gen.phy);
-        if (ret)
-                return ret;
         am_phy->usb_phy_gen.phy.init = am335x_init;
         am_phy->usb_phy_gen.phy.shutdown = am335x_shutdown;
 
@@ -82,7 +79,7 @@ static int am335x_phy_probe(struct platform_device *pdev)
         device_set_wakeup_enable(dev, false);
         phy_ctrl_power(am_phy->phy_ctrl, am_phy->id, am_phy->dr_mode, false);
 
-        return 0;
+        return usb_add_phy_dev(&am_phy->usb_phy_gen.phy);
 }
 
 static int am335x_phy_remove(struct platform_device *pdev)
diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index 4bc29b586698..f1c39a3c7534 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -2297,7 +2297,8 @@ static unsigned int tcpm_pd_select_pps_apdo(struct tcpm_port *port)
                                               pdo_pps_apdo_max_voltage(snk));
                 port->pps_data.max_curr = min_pps_apdo_current(src, snk);
                 port->pps_data.out_volt = min(port->pps_data.max_volt,
-                                              port->pps_data.out_volt);
+                                              max(port->pps_data.min_volt,
+                                                  port->pps_data.out_volt));
                 port->pps_data.op_curr = min(port->pps_data.max_curr,
                                              port->pps_data.op_curr);
         }
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index cd7e755484e3..a0b07c331255 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -152,7 +152,12 @@ struct vring_virtqueue {
                 /* Available for packed ring */
                 struct {
                         /* Actual memory layout for this queue. */
-                        struct vring_packed vring;
+                        struct {
+                                unsigned int num;
+                                struct vring_packed_desc *desc;
+                                struct vring_packed_desc_event *driver;
+                                struct vring_packed_desc_event *device;
+                        } vring;
 
                         /* Driver ring wrap counter. */
                         bool avail_wrap_counter;
@@ -1609,6 +1614,9 @@ static struct virtqueue *vring_create_virtqueue_packed(
                 !context;
         vq->event = virtio_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX);
 
+        if (virtio_has_feature(vdev, VIRTIO_F_ORDER_PLATFORM))
+                vq->weak_barriers = false;
+
         vq->packed.ring_dma_addr = ring_dma_addr;
         vq->packed.driver_event_dma_addr = driver_event_dma_addr;
         vq->packed.device_event_dma_addr = device_event_dma_addr;
@@ -2079,6 +2087,9 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index,
                 !context;
         vq->event = virtio_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX);
 
+        if (virtio_has_feature(vdev, VIRTIO_F_ORDER_PLATFORM))
+                vq->weak_barriers = false;
+
         vq->split.queue_dma_addr = 0;
         vq->split.queue_size_in_bytes = 0;
 
@@ -2213,6 +2224,8 @@ void vring_transport_features(struct virtio_device *vdev)
                         break;
                 case VIRTIO_F_RING_PACKED:
                         break;
+                case VIRTIO_F_ORDER_PLATFORM:
+                        break;
                 default:
                         /* We don't understand this bit. */
                         __virtio_clear_bit(vdev, i);
diff --git a/fs/autofs/expire.c b/fs/autofs/expire.c
index d441244b79df..28d9c2b1b3bb 100644
--- a/fs/autofs/expire.c
+++ b/fs/autofs/expire.c
@@ -596,7 +596,6 @@ int autofs_expire_run(struct super_block *sb,
         pkt.len = dentry->d_name.len;
         memcpy(pkt.name, dentry->d_name.name, pkt.len);
         pkt.name[pkt.len] = '\0';
-        dput(dentry);
 
         if (copy_to_user(pkt_p, &pkt, sizeof(struct autofs_packet_expire)))
                 ret = -EFAULT;
@@ -609,6 +608,8 @@ int autofs_expire_run(struct super_block *sb,
         complete_all(&ino->expire_complete);
         spin_unlock(&sbi->fs_lock);
 
+        dput(dentry);
+
         return ret;
 }
 
diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c
index 0e8ea2d9a2bb..078992eee299 100644
--- a/fs/autofs/inode.c
+++ b/fs/autofs/inode.c
@@ -266,8 +266,10 @@ int autofs_fill_super(struct super_block *s, void *data, int silent)
         }
         root_inode = autofs_get_inode(s, S_IFDIR | 0755);
         root = d_make_root(root_inode);
-        if (!root)
+        if (!root) {
+                ret = -ENOMEM;
                 goto fail_ino;
+        }
         pipe = NULL;
 
         root->d_fsdata = ino;
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index f64aad613727..5a6c39b44c84 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -968,6 +968,48 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
         return 0;
 }
 
+static struct extent_buffer *alloc_tree_block_no_bg_flush(
+                                          struct btrfs_trans_handle *trans,
+                                          struct btrfs_root *root,
+                                          u64 parent_start,
+                                          const struct btrfs_disk_key *disk_key,
+                                          int level,
+                                          u64 hint,
+                                          u64 empty_size)
+{
+        struct btrfs_fs_info *fs_info = root->fs_info;
+        struct extent_buffer *ret;
+
+        /*
+         * If we are COWing a node/leaf from the extent, chunk, device or free
+         * space trees, make sure that we do not finish block group creation of
+         * pending block groups. We do this to avoid a deadlock.
+         * COWing can result in allocation of a new chunk, and flushing pending
+         * block groups (btrfs_create_pending_block_groups()) can be triggered
+         * when finishing allocation of a new chunk. Creation of a pending block
+         * group modifies the extent, chunk, device and free space trees,
+         * therefore we could deadlock with ourselves since we are holding a
+         * lock on an extent buffer that btrfs_create_pending_block_groups() may
+         * try to COW later.
+         * For similar reasons, we also need to delay flushing pending block
+         * groups when splitting a leaf or node, from one of those trees, since
+         * we are holding a write lock on it and its parent or when inserting a
+         * new root node for one of those trees.
+         */
+        if (root == fs_info->extent_root ||
+            root == fs_info->chunk_root ||
+            root == fs_info->dev_root ||
+            root == fs_info->free_space_root)
+                trans->can_flush_pending_bgs = false;
+
+        ret = btrfs_alloc_tree_block(trans, root, parent_start,
+                                     root->root_key.objectid, disk_key, level,
+                                     hint, empty_size);
+        trans->can_flush_pending_bgs = true;
+
+        return ret;
+}
+
 /*
  * does the dirty work in cow of a single block.  The parent block (if
  * supplied) is updated to point to the new cow copy.  The new buffer is marked
@@ -1015,28 +1057,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
         if ((root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) && parent)
                 parent_start = parent->start;
 
-        /*
-         * If we are COWing a node/leaf from the extent, chunk, device or free
-         * space trees, make sure that we do not finish block group creation of
-         * pending block groups. We do this to avoid a deadlock.
-         * COWing can result in allocation of a new chunk, and flushing pending
-         * block groups (btrfs_create_pending_block_groups()) can be triggered
-         * when finishing allocation of a new chunk. Creation of a pending block
-         * group modifies the extent, chunk, device and free space trees,
-         * therefore we could deadlock with ourselves since we are holding a
-         * lock on an extent buffer that btrfs_create_pending_block_groups() may
-         * try to COW later.
-         */
-        if (root == fs_info->extent_root ||
-            root == fs_info->chunk_root ||
-            root == fs_info->dev_root ||
-            root == fs_info->free_space_root)
-                trans->can_flush_pending_bgs = false;
-
-        cow = btrfs_alloc_tree_block(trans, root, parent_start,
-                        root->root_key.objectid, &disk_key, level,
-                        search_start, empty_size);
-        trans->can_flush_pending_bgs = true;
+        cow = alloc_tree_block_no_bg_flush(trans, root, parent_start, &disk_key,
+                                           level, search_start, empty_size);
         if (IS_ERR(cow))
                 return PTR_ERR(cow);
 
@@ -3345,8 +3367,8 @@ static noinline int insert_new_root(struct btrfs_trans_handle *trans,
         else
                 btrfs_node_key(lower, &lower_key, 0);
 
-        c = btrfs_alloc_tree_block(trans, root, 0, root->root_key.objectid,
-                                   &lower_key, level, root->node->start, 0);
+        c = alloc_tree_block_no_bg_flush(trans, root, 0, &lower_key, level,
+                                         root->node->start, 0);
         if (IS_ERR(c))
                 return PTR_ERR(c);
 
@@ -3475,8 +3497,8 @@ static noinline int split_node(struct btrfs_trans_handle *trans,
         mid = (c_nritems + 1) / 2;
         btrfs_node_key(c, &disk_key, mid);
 
-        split = btrfs_alloc_tree_block(trans, root, 0, root->root_key.objectid,
-                        &disk_key, level, c->start, 0);
+        split = alloc_tree_block_no_bg_flush(trans, root, 0, &disk_key, level,
+                                             c->start, 0);
         if (IS_ERR(split))
                 return PTR_ERR(split);
 
@@ -4260,8 +4282,8 @@ again:
         else
                 btrfs_item_key(l, &disk_key, mid);
 
-        right = btrfs_alloc_tree_block(trans, root, 0, root->root_key.objectid,
-                        &disk_key, 0, l->start, 0);
+        right = alloc_tree_block_no_bg_flush(trans, root, 0, &disk_key, 0,
+                                             l->start, 0);
         if (IS_ERR(right))
                 return PTR_ERR(right);
 
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index c5586ffd1426..0a3f122dd61f 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1621,6 +1621,7 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
                                 flags | SB_RDONLY, device_name, data);
                         if (IS_ERR(mnt_root)) {
                                 root = ERR_CAST(mnt_root);
+                                kfree(subvol_name);
                                 goto out;
                         }
 
@@ -1630,12 +1631,14 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
                         if (error < 0) {
                                 root = ERR_PTR(error);
                                 mntput(mnt_root);
+                                kfree(subvol_name);
                                 goto out;
                         }
                 }
         }
         if (IS_ERR(mnt_root)) {
                 root = ERR_CAST(mnt_root);
+                kfree(subvol_name);
                 goto out;
         }
 
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 127fa1535f58..4ec2b660d014 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -850,14 +850,6 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
 
         btrfs_trans_release_chunk_metadata(trans);
 
-        if (lock && should_end_transaction(trans) &&
-            READ_ONCE(cur_trans->state) == TRANS_STATE_RUNNING) {
-                spin_lock(&info->trans_lock);
-                if (cur_trans->state == TRANS_STATE_RUNNING)
-                        cur_trans->state = TRANS_STATE_BLOCKED;
-                spin_unlock(&info->trans_lock);
-        }
-
         if (lock && READ_ONCE(cur_trans->state) == TRANS_STATE_BLOCKED) {
                 if (throttle)
                         return btrfs_commit_transaction(trans);
@@ -1879,6 +1871,21 @@ static void cleanup_transaction(struct btrfs_trans_handle *trans, int err)
         kmem_cache_free(btrfs_trans_handle_cachep, trans);
 }
 
+/*
+ * Release reserved delayed ref space of all pending block groups of the
+ * transaction and remove them from the list
+ */
+static void btrfs_cleanup_pending_block_groups(struct btrfs_trans_handle *trans)
+{
+       struct btrfs_fs_info *fs_info = trans->fs_info;
+       struct btrfs_block_group_cache *block_group, *tmp;
+
+       list_for_each_entry_safe(block_group, tmp, &trans->new_bgs, bg_list) {
+               btrfs_delayed_refs_rsv_release(fs_info, 1);
+               list_del_init(&block_group->bg_list);
+       }
+}
+
 static inline int btrfs_start_delalloc_flush(struct btrfs_fs_info *fs_info)
 {
         /*
@@ -2270,6 +2277,7 @@ scrub_continue:
         btrfs_scrub_continue(fs_info);
 cleanup_transaction:
         btrfs_trans_release_metadata(trans);
+        btrfs_cleanup_pending_block_groups(trans);
         btrfs_trans_release_chunk_metadata(trans);
         trans->block_rsv = NULL;
         btrfs_warn(fs_info, "Skipping commit of aborted transaction.");
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 3e4f8f88353e..15561926ab32 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -957,11 +957,11 @@ static noinline struct btrfs_device *device_list_add(const char *path,
                 else
                         fs_devices = alloc_fs_devices(disk_super->fsid, NULL);
 
-                fs_devices->fsid_change = fsid_change_in_progress;
-
                 if (IS_ERR(fs_devices))
                         return ERR_CAST(fs_devices);
 
+                fs_devices->fsid_change = fsid_change_in_progress;
+
                 mutex_lock(&fs_devices->device_list_mutex);
                 list_add(&fs_devices->fs_list, &fs_uuids);
 
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index d1f9c2f3f575..7652551a1fc4 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -150,5 +150,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CONFIG_CIFS_NFSD_EXPORT */
 
-#define CIFS_VERSION   "2.16"
+#define CIFS_VERSION   "2.17"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 2c7689f3998d..659ce1b92c44 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2696,6 +2696,7 @@ cifs_write_from_iter(loff_t offset, size_t len, struct iov_iter *from,
 
                         rc = cifs_write_allocate_pages(wdata->pages, nr_pages);
                         if (rc) {
+                                kvfree(wdata->pages);
                                 kfree(wdata);
                                 add_credits_and_wake_if(server, credits, 0);
                                 break;
@@ -2707,6 +2708,7 @@ cifs_write_from_iter(loff_t offset, size_t len, struct iov_iter *from,
                         if (rc) {
                                 for (i = 0; i < nr_pages; i++)
                                         put_page(wdata->pages[i]);
+                                kvfree(wdata->pages);
                                 kfree(wdata);
                                 add_credits_and_wake_if(server, credits, 0);
                                 break;
@@ -3386,8 +3388,12 @@ cifs_send_async_read(loff_t offset, size_t len, struct cifsFileInfo *open_file,
                         }
 
                         rc = cifs_read_allocate_pages(rdata, npages);
-                        if (rc)
-                                goto error;
+                        if (rc) {
+                                kvfree(rdata->pages);
+                                kfree(rdata);
+                                add_credits_and_wake_if(server, credits, 0);
+                                break;
+                        }
 
                         rdata->tailsz = PAGE_SIZE;
                 }
@@ -3407,7 +3413,6 @@ cifs_send_async_read(loff_t offset, size_t len, struct cifsFileInfo *open_file,
                 if (!rdata->cfile->invalidHandle ||
                     !(rc = cifs_reopen_file(rdata->cfile, true)))
                         rc = server->ops->async_readv(rdata);
-error:
                 if (rc) {
                         add_credits_and_wake_if(server, rdata->credits, 0);
                         kref_put(&rdata->refcount,
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 153238fc4fa9..6f96e2292856 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -866,7 +866,9 @@ smb2_query_eas(const unsigned int xid, struct cifs_tcon *tcon,
                                       FILE_READ_EA,
                                       FILE_FULL_EA_INFORMATION,
                                       SMB2_O_INFO_FILE,
-                                      SMB2_MAX_EA_BUF,
+                                      CIFSMaxBufSize -
+                                      MAX_SMB2_CREATE_RESPONSE_SIZE -
+                                      MAX_SMB2_CLOSE_RESPONSE_SIZE,
                                       &rsp_iov, &buftype, cifs_sb);
         if (rc) {
                 /*
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 2ff209ec4fab..77b3aaa39b35 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -3241,8 +3241,17 @@ smb2_readv_callback(struct mid_q_entry *mid)
                 rdata->mr = NULL;
         }
 #endif
-        if (rdata->result)
+        if (rdata->result && rdata->result != -ENODATA) {
                 cifs_stats_fail_inc(tcon, SMB2_READ_HE);
+                trace_smb3_read_err(0 /* xid */,
+                                    rdata->cfile->fid.persistent_fid,
+                                    tcon->tid, tcon->ses->Suid, rdata->offset,
+                                    rdata->bytes, rdata->result);
+        } else
+                trace_smb3_read_done(0 /* xid */,
+                                     rdata->cfile->fid.persistent_fid,
+                                     tcon->tid, tcon->ses->Suid,
+                                     rdata->offset, rdata->got_bytes);
 
         queue_work(cifsiod_wq, &rdata->work);
         DeleteMidQEntry(mid);
@@ -3317,13 +3326,11 @@ smb2_async_readv(struct cifs_readdata *rdata)
         if (rc) {
                 kref_put(&rdata->refcount, cifs_readdata_release);
                 cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE);
-                trace_smb3_read_err(rc, 0 /* xid */, io_parms.persistent_fid,
-                                   io_parms.tcon->tid, io_parms.tcon->ses->Suid,
-                                   io_parms.offset, io_parms.length);
-        } else
-                trace_smb3_read_done(0 /* xid */, io_parms.persistent_fid,
-                                   io_parms.tcon->tid, io_parms.tcon->ses->Suid,
-                                   io_parms.offset, io_parms.length);
+                trace_smb3_read_err(0 /* xid */, io_parms.persistent_fid,
+                                    io_parms.tcon->tid,
+                                    io_parms.tcon->ses->Suid,
+                                    io_parms.offset, io_parms.length, rc);
+        }
 
         cifs_small_buf_release(buf);
         return rc;
@@ -3367,10 +3374,11 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
                 if (rc != -ENODATA) {
                         cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
                         cifs_dbg(VFS, "Send error in read = %d\n", rc);
+                        trace_smb3_read_err(xid, req->PersistentFileId,
+                                            io_parms->tcon->tid, ses->Suid,
+                                            io_parms->offset, io_parms->length,
+                                            rc);
                 }
-                trace_smb3_read_err(rc, xid, req->PersistentFileId,
-                                    io_parms->tcon->tid, ses->Suid,
-                                    io_parms->offset, io_parms->length);
                 free_rsp_buf(resp_buftype, rsp_iov.iov_base);
                 return rc == -ENODATA ? 0 : rc;
         } else
@@ -3459,8 +3467,17 @@ smb2_writev_callback(struct mid_q_entry *mid)
                 wdata->mr = NULL;
         }
 #endif
-        if (wdata->result)
+        if (wdata->result) {
                 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
+                trace_smb3_write_err(0 /* no xid */,
+                                     wdata->cfile->fid.persistent_fid,
+                                     tcon->tid, tcon->ses->Suid, wdata->offset,
+                                     wdata->bytes, wdata->result);
+        } else
+                trace_smb3_write_done(0 /* no xid */,
+                                      wdata->cfile->fid.persistent_fid,
+                                      tcon->tid, tcon->ses->Suid,
+                                      wdata->offset, wdata->bytes);
 
         queue_work(cifsiod_wq, &wdata->work);
         DeleteMidQEntry(mid);
@@ -3602,10 +3619,7 @@ smb2_async_writev(struct cifs_writedata *wdata,
                                      wdata->bytes, rc);
                 kref_put(&wdata->refcount, release);
                 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
-        } else
-                trace_smb3_write_done(0 /* no xid */, req->PersistentFileId,
-                                     tcon->tid, tcon->ses->Suid, wdata->offset,
-                                     wdata->bytes);
+        }
 
 async_writev_out:
         cifs_small_buf_release(req);
@@ -3831,8 +3845,8 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
                     rsp->sync_hdr.Status == STATUS_NO_MORE_FILES) {
                         srch_inf->endOfSearch = true;
                         rc = 0;
-                }
-                cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
+                } else
+                        cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
                 goto qdir_exit;
         }
 
@@ -4427,8 +4441,8 @@ SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon,
         rc = cifs_send_recv(xid, ses, &rqst, &resp_buf_type, flags, &rsp_iov);
         cifs_small_buf_release(req);
 
-        please_key_low = (__u64 *)req->LeaseKey;
-        please_key_high = (__u64 *)(req->LeaseKey+8);
+        please_key_low = (__u64 *)lease_key;
+        please_key_high = (__u64 *)(lease_key+8);
         if (rc) {
                 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
                 trace_smb3_lease_err(le32_to_cpu(lease_state), tcon->tid,
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index 7a2d0a2255e6..538e2299805f 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -84,8 +84,9 @@
 
 #define NUMBER_OF_SMB2_COMMANDS 0x0013
 
-/* 4 len + 52 transform hdr + 64 hdr + 56 create rsp */
-#define MAX_SMB2_HDR_SIZE 0x00b0
+/* 52 transform hdr + 64 hdr + 88 create rsp */
+#define SMB2_TRANSFORM_HEADER_SIZE 52
+#define MAX_SMB2_HDR_SIZE 204
 
 #define SMB2_PROTO_NUMBER cpu_to_le32(0x424d53fe)
 #define SMB2_TRANSFORM_PROTO_NUM cpu_to_le32(0x424d53fd)
@@ -648,6 +649,13 @@ struct smb2_create_req {
         __u8   Buffer[0];
 } __packed;
 
+/*
+ * Maximum size of a SMB2_CREATE response is 64 (smb2 header) +
+ * 88 (fixed part of create response) + 520 (path) + 150 (contexts) +
+ * 2 bytes of padding.
+ */
+#define MAX_SMB2_CREATE_RESPONSE_SIZE 824
+
 struct smb2_create_rsp {
         struct smb2_sync_hdr sync_hdr;
         __le16 StructureSize;   /* Must be 89 */
@@ -996,6 +1004,11 @@ struct smb2_close_req {
         __u64  VolatileFileId; /* opaque endianness */
 } __packed;
 
+/*
+ * Maximum size of a SMB2_CLOSE response is 64 (smb2 header) + 60 (data)
+ */
+#define MAX_SMB2_CLOSE_RESPONSE_SIZE 124
+
 struct smb2_close_rsp {
         struct smb2_sync_hdr sync_hdr;
         __le16 StructureSize; /* 60 */
@@ -1398,8 +1411,6 @@ struct smb2_file_link_info { /* encoding of request for level 11 */
         char   FileName[0];     /* Name to be assigned to new link */
 } __packed; /* level 11 Set */
 
-#define SMB2_MAX_EA_BUF 65536
-
 struct smb2_file_full_ea_info { /* encoding of response for level 15 */
         __le32 next_entry_offset;
         __u8   flags;
diff --git a/fs/dcache.c b/fs/dcache.c
index 2593153471cf..aac41adf4743 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -119,6 +119,7 @@ struct dentry_stat_t dentry_stat = {
 
 static DEFINE_PER_CPU(long, nr_dentry);
 static DEFINE_PER_CPU(long, nr_dentry_unused);
+static DEFINE_PER_CPU(long, nr_dentry_negative);
 
 #if defined(CONFIG_SYSCTL) && defined(CONFIG_PROC_FS)
 
@@ -152,11 +153,22 @@ static long get_nr_dentry_unused(void)
         return sum < 0 ? 0 : sum;
 }
 
+static long get_nr_dentry_negative(void)
+{
+        int i;
+        long sum = 0;
+
+        for_each_possible_cpu(i)
+                sum += per_cpu(nr_dentry_negative, i);
+        return sum < 0 ? 0 : sum;
+}
+
 int proc_nr_dentry(struct ctl_table *table, int write, void __user *buffer,
                    size_t *lenp, loff_t *ppos)
 {
         dentry_stat.nr_dentry = get_nr_dentry();
         dentry_stat.nr_unused = get_nr_dentry_unused();
+        dentry_stat.nr_negative = get_nr_dentry_negative();
         return proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
 }
 #endif
@@ -317,6 +329,8 @@ static inline void __d_clear_type_and_inode(struct dentry *dentry)
         flags &= ~(DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU);
         WRITE_ONCE(dentry->d_flags, flags);
         dentry->d_inode = NULL;
+        if (dentry->d_flags & DCACHE_LRU_LIST)
+                this_cpu_inc(nr_dentry_negative);
 }
 
 static void dentry_free(struct dentry *dentry)
@@ -371,6 +385,11 @@ static void dentry_unlink_inode(struct dentry * dentry)
  * The per-cpu "nr_dentry_unused" counters are updated with
  * the DCACHE_LRU_LIST bit.
  *
+ * The per-cpu "nr_dentry_negative" counters are only updated
+ * when deleted from or added to the per-superblock LRU list, not
+ * from/to the shrink list. That is to avoid an unneeded dec/inc
+ * pair when moving from LRU to shrink list in select_collect().
+ *
  * These helper functions make sure we always follow the
  * rules. d_lock must be held by the caller.
  */
@@ -380,6 +399,8 @@ static void d_lru_add(struct dentry *dentry)
         D_FLAG_VERIFY(dentry, 0);
         dentry->d_flags |= DCACHE_LRU_LIST;
         this_cpu_inc(nr_dentry_unused);
+        if (d_is_negative(dentry))
+                this_cpu_inc(nr_dentry_negative);
         WARN_ON_ONCE(!list_lru_add(&dentry->d_sb->s_dentry_lru, &dentry->d_lru));
 }
 
@@ -388,6 +409,8 @@ static void d_lru_del(struct dentry *dentry)
         D_FLAG_VERIFY(dentry, DCACHE_LRU_LIST);
         dentry->d_flags &= ~DCACHE_LRU_LIST;
         this_cpu_dec(nr_dentry_unused);
+        if (d_is_negative(dentry))
+                this_cpu_dec(nr_dentry_negative);
         WARN_ON_ONCE(!list_lru_del(&dentry->d_sb->s_dentry_lru, &dentry->d_lru));
 }
 
@@ -418,6 +441,8 @@ static void d_lru_isolate(struct list_lru_one *lru, struct dentry *dentry)
         D_FLAG_VERIFY(dentry, DCACHE_LRU_LIST);
         dentry->d_flags &= ~DCACHE_LRU_LIST;
         this_cpu_dec(nr_dentry_unused);
+        if (d_is_negative(dentry))
+                this_cpu_dec(nr_dentry_negative);
         list_lru_isolate(lru, &dentry->d_lru);
 }
 
@@ -426,6 +451,8 @@ static void d_lru_shrink_move(struct list_lru_one *lru, struct dentry *dentry,
 {
         D_FLAG_VERIFY(dentry, DCACHE_LRU_LIST);
         dentry->d_flags |= DCACHE_SHRINK_LIST;
+        if (d_is_negative(dentry))
+                this_cpu_dec(nr_dentry_negative);
         list_lru_isolate_move(lru, &dentry->d_lru, list);
 }
 
@@ -1188,15 +1215,11 @@ static enum lru_status dentry_lru_isolate_shrink(struct list_head *item,
  */
 void shrink_dcache_sb(struct super_block *sb)
 {
-        long freed;
-
         do {
                 LIST_HEAD(dispose);
 
-                freed = list_lru_walk(&sb->s_dentry_lru,
+                list_lru_walk(&sb->s_dentry_lru,
                         dentry_lru_isolate_shrink, &dispose, 1024);
-
-                this_cpu_sub(nr_dentry_unused, freed);
                 shrink_dentry_list(&dispose);
         } while (list_lru_count(&sb->s_dentry_lru) > 0);
 }
@@ -1820,6 +1843,11 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode)
         WARN_ON(d_in_lookup(dentry));
 
         spin_lock(&dentry->d_lock);
+        /*
+         * Decrement negative dentry count if it was in the LRU list.
+         */
+        if (dentry->d_flags & DCACHE_LRU_LIST)
+                this_cpu_dec(nr_dentry_negative);
         hlist_add_head(&dentry->d_u.d_alias, &inode->i_dentry);
         raw_write_seqcount_begin(&dentry->d_seq);
         __d_set_inode_and_type(dentry, inode, add_flags);
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index 13b01351dd1c..29c68c5d44d5 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -324,7 +324,7 @@ static struct dentry *failed_creating(struct dentry *dentry)
         inode_unlock(d_inode(dentry->d_parent));
         dput(dentry);
         simple_release_fs(&debugfs_mount, &debugfs_mount_count);
-        return NULL;
+        return ERR_PTR(-ENOMEM);
 }
 
 static struct dentry *end_creating(struct dentry *dentry)
@@ -347,7 +347,7 @@ static struct dentry *__debugfs_create_file(const char *name, umode_t mode,
         dentry = start_creating(name, parent);
 
         if (IS_ERR(dentry))
-                return NULL;
+                return dentry;
 
         inode = debugfs_get_inode(dentry->d_sb);
         if (unlikely(!inode))
@@ -386,7 +386,8 @@ static struct dentry *__debugfs_create_file(const char *name, umode_t mode,
  * This function will return a pointer to a dentry if it succeeds.  This
  * pointer must be passed to the debugfs_remove() function when the file is
  * to be removed (no automatic cleanup happens if your module is unloaded,
- * you are responsible here.)  If an error occurs, %NULL will be returned.
+ * you are responsible here.)  If an error occurs, %ERR_PTR(-ERROR) will be
+ * returned.
  *
  * If debugfs is not enabled in the kernel, the value -%ENODEV will be
  * returned.
@@ -464,7 +465,8 @@ EXPORT_SYMBOL_GPL(debugfs_create_file_unsafe);
  * This function will return a pointer to a dentry if it succeeds.  This
  * pointer must be passed to the debugfs_remove() function when the file is
  * to be removed (no automatic cleanup happens if your module is unloaded,
- * you are responsible here.)  If an error occurs, %NULL will be returned.
+ * you are responsible here.)  If an error occurs, %ERR_PTR(-ERROR) will be
+ * returned.
  *
  * If debugfs is not enabled in the kernel, the value -%ENODEV will be
  * returned.
@@ -495,7 +497,8 @@ EXPORT_SYMBOL_GPL(debugfs_create_file_size);
  * This function will return a pointer to a dentry if it succeeds.  This
  * pointer must be passed to the debugfs_remove() function when the file is
  * to be removed (no automatic cleanup happens if your module is unloaded,
- * you are responsible here.)  If an error occurs, %NULL will be returned.
+ * you are responsible here.)  If an error occurs, %ERR_PTR(-ERROR) will be
+ * returned.
  *
  * If debugfs is not enabled in the kernel, the value -%ENODEV will be
  * returned.
@@ -506,7 +509,7 @@ struct dentry *debugfs_create_dir(const char *name, struct dentry *parent)
         struct inode *inode;
 
         if (IS_ERR(dentry))
-                return NULL;
+                return dentry;
 
         inode = debugfs_get_inode(dentry->d_sb);
         if (unlikely(!inode))
@@ -545,7 +548,7 @@ struct dentry *debugfs_create_automount(const char *name,
         struct inode *inode;
 
         if (IS_ERR(dentry))
-                return NULL;
+                return dentry;
 
         inode = debugfs_get_inode(dentry->d_sb);
         if (unlikely(!inode))
@@ -581,8 +584,8 @@ EXPORT_SYMBOL(debugfs_create_automount);
  * This function will return a pointer to a dentry if it succeeds.  This
  * pointer must be passed to the debugfs_remove() function when the symbolic
  * link is to be removed (no automatic cleanup happens if your module is
- * unloaded, you are responsible here.)  If an error occurs, %NULL will be
- * returned.
+ * unloaded, you are responsible here.)  If an error occurs, %ERR_PTR(-ERROR)
+ * will be returned.
  *
  * If debugfs is not enabled in the kernel, the value -%ENODEV will be
  * returned.
@@ -594,12 +597,12 @@ struct dentry *debugfs_create_symlink(const char *name, struct dentry *parent,
         struct inode *inode;
         char *link = kstrdup(target, GFP_KERNEL);
         if (!link)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         dentry = start_creating(name, parent);
         if (IS_ERR(dentry)) {
                 kfree(link);
-                return NULL;
+                return dentry;
         }
 
         inode = debugfs_get_inode(dentry->d_sb);
@@ -787,6 +790,13 @@ struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry,
         struct dentry *dentry = NULL, *trap;
         struct name_snapshot old_name;
 
+        if (IS_ERR(old_dir))
+                return old_dir;
+        if (IS_ERR(new_dir))
+                return new_dir;
+        if (IS_ERR_OR_NULL(old_dentry))
+                return old_dentry;
+
         trap = lock_rename(new_dir, old_dir);
         /* Source or destination directories don't exist? */
         if (d_really_is_negative(old_dir) || d_really_is_negative(new_dir))
@@ -820,7 +830,9 @@ exit:
         if (dentry && !IS_ERR(dentry))
                 dput(dentry);
         unlock_rename(new_dir, old_dir);
-        return NULL;
+        if (IS_ERR(dentry))
+                return dentry;
+        return ERR_PTR(-EINVAL);
 }
 EXPORT_SYMBOL_GPL(debugfs_rename);
 
diff --git a/fs/drop_caches.c b/fs/drop_caches.c
index 82377017130f..d31b6c72b476 100644
--- a/fs/drop_caches.c
+++ b/fs/drop_caches.c
@@ -21,8 +21,13 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)
         spin_lock(&sb->s_inode_list_lock);
         list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
                 spin_lock(&inode->i_lock);
+                /*
+                 * We must skip inodes in unusual state. We may also skip
+                 * inodes without pages but we deliberately won't in case
+                 * we need to reschedule to avoid softlockups.
+                 */
                 if ((inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW)) ||
-                    (inode->i_mapping->nrpages == 0)) {
+                    (inode->i_mapping->nrpages == 0 && !need_resched())) {
                         spin_unlock(&inode->i_lock);
                         continue;
                 }
@@ -30,6 +35,7 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)
                 spin_unlock(&inode->i_lock);
                 spin_unlock(&sb->s_inode_list_lock);
 
+                cond_resched();
                 invalidate_mapping_pages(inode->i_mapping, 0, -1);
                 iput(toput_inode);
                 toput_inode = inode;
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index a5e516a40e7a..809c0f2f9942 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1742,7 +1742,6 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
         req->in.h.nodeid = outarg->nodeid;
         req->in.numargs = 2;
         req->in.argpages = 1;
-        req->page_descs[0].offset = offset;
         req->end = fuse_retrieve_end;
 
         index = outarg->offset >> PAGE_SHIFT;
@@ -1757,6 +1756,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
 
                 this_num = min_t(unsigned, num, PAGE_SIZE - offset);
                 req->pages[req->num_pages] = page;
+                req->page_descs[req->num_pages].offset = offset;
                 req->page_descs[req->num_pages].length = this_num;
                 req->num_pages++;
 
@@ -2077,8 +2077,10 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
 
         ret = fuse_dev_do_write(fud, &cs, len);
 
+        pipe_lock(pipe);
         for (idx = 0; idx < nbuf; idx++)
                 pipe_buf_release(pipe, &bufs[idx]);
+        pipe_unlock(pipe);
 
 out:
         kvfree(bufs);
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index ffaffe18352a..a59c16bd90ac 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1782,7 +1782,7 @@ static bool fuse_writepage_in_flight(struct fuse_req *new_req,
                 spin_unlock(&fc->lock);
 
                 dec_wb_stat(&bdi->wb, WB_WRITEBACK);
-                dec_node_page_state(page, NR_WRITEBACK_TEMP);
+                dec_node_page_state(new_req->pages[0], NR_WRITEBACK_TEMP);
                 wb_writeout_inc(&bdi->wb);
                 fuse_writepage_free(fc, new_req);
                 fuse_request_free(new_req);
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 76baaa6be393..c2d4099429be 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -628,6 +628,7 @@ void fuse_conn_init(struct fuse_conn *fc, struct user_namespace *user_ns)
         get_random_bytes(&fc->scramble_key, sizeof(fc->scramble_key));
         fc->pid_ns = get_pid_ns(task_active_pid_ns(current));
         fc->user_ns = get_user_ns(user_ns);
+        fc->max_pages = FUSE_DEFAULT_MAX_PAGES_PER_REQ;
 }
 EXPORT_SYMBOL_GPL(fuse_conn_init);
 
@@ -1162,7 +1163,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         fc->user_id = d.user_id;
         fc->group_id = d.group_id;
         fc->max_read = max_t(unsigned, 4096, d.max_read);
-        fc->max_pages = FUSE_DEFAULT_MAX_PAGES_PER_REQ;
 
         /* Used by get_root_inode() */
         sb->s_fs_info = fc;
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 831d7cb5a49c..17a8d3b43990 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -1780,9 +1780,9 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext,
                         goto next_iter;
                 }
                 if (ret == -E2BIG) {
-                        n += rbm->bii - initial_bii;
                         rbm->bii = 0;
                         rbm->offset = 0;
+                        n += (rbm->bii - initial_bii);
                         goto res_covered_end_of_rgrp;
                 }
                 return ret;
diff --git a/fs/iomap.c b/fs/iomap.c
index a3088fae567b..897c60215dd1 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -116,6 +116,12 @@ iomap_page_create(struct inode *inode, struct page *page)
         atomic_set(&iop->read_count, 0);
         atomic_set(&iop->write_count, 0);
         bitmap_zero(iop->uptodate, PAGE_SIZE / SECTOR_SIZE);
+
+        /*
+         * migrate_page_move_mapping() assumes that pages with private data have
+         * their count elevated by 1.
+         */
+        get_page(page);
         set_page_private(page, (unsigned long)iop);
         SetPagePrivate(page);
         return iop;
@@ -132,6 +138,7 @@ iomap_page_release(struct page *page)
         WARN_ON_ONCE(atomic_read(&iop->write_count));
         ClearPagePrivate(page);
         set_page_private(page, 0);
+        put_page(page);
         kfree(iop);
 }
 
@@ -569,8 +576,10 @@ iomap_migrate_page(struct address_space *mapping, struct page *newpage,
 
         if (page_has_private(page)) {
                 ClearPagePrivate(page);
+                get_page(newpage);
                 set_page_private(newpage, page_private(page));
                 set_page_private(page, 0);
+                put_page(page);
                 SetPagePrivate(newpage);
         }
 
@@ -1804,6 +1813,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         loff_t pos = iocb->ki_pos, start = pos;
         loff_t end = iocb->ki_pos + count - 1, ret = 0;
         unsigned int flags = IOMAP_DIRECT;
+        bool wait_for_completion = is_sync_kiocb(iocb);
         struct blk_plug plug;
         struct iomap_dio *dio;
 
@@ -1823,7 +1833,6 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         dio->end_io = end_io;
         dio->error = 0;
         dio->flags = 0;
-        dio->wait_for_completion = is_sync_kiocb(iocb);
 
         dio->submit.iter = iter;
         dio->submit.waiter = current;
@@ -1878,7 +1887,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                 dio_warn_stale_pagecache(iocb->ki_filp);
         ret = 0;
 
-        if (iov_iter_rw(iter) == WRITE && !dio->wait_for_completion &&
+        if (iov_iter_rw(iter) == WRITE && !wait_for_completion &&
             !inode->i_sb->s_dio_done_wq) {
                 ret = sb_init_dio_done_wq(inode->i_sb);
                 if (ret < 0)
@@ -1894,7 +1903,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                 if (ret <= 0) {
                         /* magic error code to fall back to buffered I/O */
                         if (ret == -ENOTBLK) {
-                                dio->wait_for_completion = true;
+                                wait_for_completion = true;
                                 ret = 0;
                         }
                         break;
@@ -1916,8 +1925,24 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         if (dio->flags & IOMAP_DIO_WRITE_FUA)
                 dio->flags &= ~IOMAP_DIO_NEED_SYNC;
 
+        /*
+         * We are about to drop our additional submission reference, which
+         * might be the last reference to the dio.  There are three three
+         * different ways we can progress here:
+         *
+         *  (a) If this is the last reference we will always complete and free
+         *      the dio ourselves.
+         *  (b) If this is not the last reference, and we serve an asynchronous
+         *      iocb, we must never touch the dio after the decrement, the
+         *      I/O completion handler will complete and free it.
+         *  (c) If this is not the last reference, but we serve a synchronous
+         *      iocb, the I/O completion handler will wake us up on the drop
+         *      of the final reference, and we will complete and free it here
+         *      after we got woken by the I/O completion handler.
+         */
+        dio->wait_for_completion = wait_for_completion;
         if (!atomic_dec_and_test(&dio->ref)) {
-                if (!dio->wait_for_completion)
+                if (!wait_for_completion)
                         return -EIOCBQUEUED;
 
                 for (;;) {
@@ -1934,9 +1959,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                 __set_current_state(TASK_RUNNING);
         }
 
-        ret = iomap_dio_complete(dio);
-
-        return ret;
+        return iomap_dio_complete(dio);
 
 out_free_dio:
         kfree(dio);
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 22ce3c8a2f46..0570391eaa16 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1895,6 +1895,11 @@ static int nfs_parse_devname(const char *dev_name,
         size_t len;
         char *end;
 
+        if (unlikely(!dev_name || !*dev_name)) {
+                dfprintk(MOUNT, "NFS: device name not specified\n");
+                return -EINVAL;
+        }
+
         /* Is the host name protected with square brakcets? */
         if (*dev_name == '[') {
                 end = strchr(++dev_name, ']');
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 5a0bbf917a32..f12cb31a41e5 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -621,11 +621,12 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
         nfs_set_page_writeback(page);
         WARN_ON_ONCE(test_bit(PG_CLEAN, &req->wb_flags));
 
-        ret = 0;
+        ret = req->wb_context->error;
         /* If there is a fatal error that covers this write, just exit */
-        if (nfs_error_is_fatal_on_server(req->wb_context->error))
+        if (nfs_error_is_fatal_on_server(ret))
                 goto out_launder;
 
+        ret = 0;
         if (!nfs_pageio_add_request(pgio, req)) {
                 ret = pgio->pg_error;
                 /*
@@ -635,9 +636,9 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
                         nfs_context_set_write_error(req->wb_context, ret);
                         if (nfs_error_is_fatal_on_server(ret))
                                 goto out_launder;
-                }
+                } else
+                        ret = -EAGAIN;
                 nfs_redirty_request(req);
-                ret = -EAGAIN;
         } else
                 nfs_add_stats(page_file_mapping(page)->host,
                                 NFSIOS_WRITEPAGES, 1);
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 9824e32b2f23..7dc98e14655d 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -557,9 +557,11 @@ __be32 nfsd4_clone_file_range(struct file *src, u64 src_pos, struct file *dst,
         loff_t cloned;
 
         cloned = vfs_clone_file_range(src, src_pos, dst, dst_pos, count, 0);
+        if (cloned < 0)
+                return nfserrno(cloned);
         if (count && cloned != count)
-                cloned = -EINVAL;
-        return nfserrno(cloned < 0 ? cloned : 0);
+                return nfserrno(-EINVAL);
+        return 0;
 }
 
 ssize_t nfsd_copy_file_range(struct file *src, u64 src_pos, struct file *dst,
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 8ae109429a88..e39bac94dead 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -256,7 +256,7 @@ struct dentry *proc_lookup_de(struct inode *dir, struct dentry *dentry,
                 inode = proc_get_inode(dir->i_sb, de);
                 if (!inode)
                         return ERR_PTR(-ENOMEM);
-                d_set_d_op(dentry, &proc_misc_dentry_ops);
+                d_set_d_op(dentry, de->proc_dops);
                 return d_splice_alias(inode, dentry);
         }
         read_unlock(&proc_subdir_lock);
@@ -429,6 +429,8 @@ static struct proc_dir_entry *__proc_create(struct proc_dir_entry **parent,
         INIT_LIST_HEAD(&ent->pde_openers);
         proc_set_user(ent, (*parent)->uid, (*parent)->gid);
 
+        ent->proc_dops = &proc_misc_dentry_ops;
+
 out:
         return ent;
 }
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index 5185d7f6a51e..95b14196f284 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -44,6 +44,7 @@ struct proc_dir_entry {
         struct completion *pde_unload_completion;
         const struct inode_operations *proc_iops;
         const struct file_operations *proc_fops;
+        const struct dentry_operations *proc_dops;
         union {
                 const struct seq_operations *seq_ops;
                 int (*single_show)(struct seq_file *, void *);
diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
index d5e0fcb3439e..a7b12435519e 100644
--- a/fs/proc/proc_net.c
+++ b/fs/proc/proc_net.c
@@ -38,6 +38,22 @@ static struct net *get_proc_net(const struct inode *inode)
         return maybe_get_net(PDE_NET(PDE(inode)));
 }
 
+static int proc_net_d_revalidate(struct dentry *dentry, unsigned int flags)
+{
+        return 0;
+}
+
+static const struct dentry_operations proc_net_dentry_ops = {
+        .d_revalidate   = proc_net_d_revalidate,
+        .d_delete       = always_delete_dentry,
+};
+
+static void pde_force_lookup(struct proc_dir_entry *pde)
+{
+        /* /proc/net/ entries can be changed under us by setns(CLONE_NEWNET) */
+        pde->proc_dops = &proc_net_dentry_ops;
+}
+
 static int seq_open_net(struct inode *inode, struct file *file)
 {
         unsigned int state_size = PDE(inode)->state_size;
@@ -90,6 +106,7 @@ struct proc_dir_entry *proc_create_net_data(const char *name, umode_t mode,
         p = proc_create_reg(name, mode, &parent, data);
         if (!p)
                 return NULL;
+        pde_force_lookup(p);
         p->proc_fops = &proc_net_seq_fops;
         p->seq_ops = ops;
         p->state_size = state_size;
@@ -133,6 +150,7 @@ struct proc_dir_entry *proc_create_net_data_write(const char *name, umode_t mode
         p = proc_create_reg(name, mode, &parent, data);
         if (!p)
                 return NULL;
+        pde_force_lookup(p);
         p->proc_fops = &proc_net_seq_fops;
         p->seq_ops = ops;
         p->state_size = state_size;
@@ -181,6 +199,7 @@ struct proc_dir_entry *proc_create_net_single(const char *name, umode_t mode,
         p = proc_create_reg(name, mode, &parent, data);
         if (!p)
                 return NULL;
+        pde_force_lookup(p);
         p->proc_fops = &proc_net_single_fops;
         p->single_show = show;
         return proc_register(parent, p);
@@ -223,6 +242,7 @@ struct proc_dir_entry *proc_create_net_single_write(const char *name, umode_t mo
         p = proc_create_reg(name, mode, &parent, data);
         if (!p)
                 return NULL;
+        pde_force_lookup(p);
         p->proc_fops = &proc_net_single_fops;
         p->single_show = show;
         p->write = write;
diff --git a/fs/xfs/scrub/repair.c b/fs/xfs/scrub/repair.c
index 1c8eecfe52b8..6acf1bfa0bfe 100644
--- a/fs/xfs/scrub/repair.c
+++ b/fs/xfs/scrub/repair.c
@@ -768,18 +768,23 @@ xrep_findroot_block(
                 if (!uuid_equal(&btblock->bb_u.s.bb_uuid,
                                 &mp->m_sb.sb_meta_uuid))
                         goto out;
+                /*
+                 * Read verifiers can reference b_ops, so we set the pointer
+                 * here.  If the verifier fails we'll reset the buffer state
+                 * to what it was before we touched the buffer.
+                 */
+                bp->b_ops = fab->buf_ops;
                 fab->buf_ops->verify_read(bp);
                 if (bp->b_error) {
+                        bp->b_ops = NULL;
                         bp->b_error = 0;
                         goto out;
                 }
 
                 /*
                  * Some read verifiers will (re)set b_ops, so we must be
-                 * careful not to blow away any such assignment.
+                 * careful not to change b_ops after running the verifier.
                  */
-                if (!bp->b_ops)
-                        bp->b_ops = fab->buf_ops;
         }
 
         /*
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 338b9d9984e0..d9048bcea49c 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -449,6 +449,7 @@ xfs_map_blocks(
         }
 
         wpc->imap = imap;
+        xfs_trim_extent_eof(&wpc->imap, ip);
         trace_xfs_map_blocks_found(ip, offset, count, wpc->io_type, &imap);
         return 0;
 allocate_blocks:
@@ -459,6 +460,7 @@ allocate_blocks:
         ASSERT(whichfork == XFS_COW_FORK || cow_fsb == NULLFILEOFF ||
                imap.br_startoff + imap.br_blockcount <= cow_fsb);
         wpc->imap = imap;
+        xfs_trim_extent_eof(&wpc->imap, ip);
         trace_xfs_map_blocks_alloc(ip, offset, count, wpc->io_type, &imap);
         return 0;
 }
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index eedc5e0156ff..4f5f2ff3f70f 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -776,10 +776,26 @@ _xfs_buf_read(
 }
 
 /*
+ * Set buffer ops on an unchecked buffer and validate it, if possible.
+ *
  * If the caller passed in an ops structure and the buffer doesn't have ops
  * assigned, set the ops and use them to verify the contents.  If the contents
  * cannot be verified, we'll clear XBF_DONE.  We assume the buffer has no
  * recorded errors and is already in XBF_DONE state.
+ *
+ * Under normal operations, every in-core buffer must have buffer ops assigned
+ * to them when the buffer is read in from disk so that we can validate the
+ * metadata.
+ *
+ * However, there are two scenarios where one can encounter in-core buffers
+ * that don't have buffer ops.  The first is during log recovery of buffers on
+ * a V4 filesystem, though these buffers are purged at the end of recovery.
+ *
+ * The other is online repair, which tries to match arbitrary metadata blocks
+ * with btree types in order to find the root.  If online repair doesn't match
+ * the buffer with /any/ btree type, the buffer remains in memory in DONE state
+ * with no ops, and a subsequent read_buf call from elsewhere will not set the
+ * ops.  This function helps us fix this situation.
  */
 int
 xfs_buf_ensure_ops(
@@ -1536,8 +1552,7 @@ __xfs_buf_submit(
                 xfs_buf_ioerror(bp, -EIO);
                 bp->b_flags &= ~XBF_DONE;
                 xfs_buf_stale(bp);
-                if (bp->b_flags & XBF_ASYNC)
-                        xfs_buf_ioend(bp);
+                xfs_buf_ioend(bp);
                 return -EIO;
         }
 
diff --git a/include/dt-bindings/clock/marvell,mmp2.h b/include/dt-bindings/clock/marvell,mmp2.h
index 7b24fc791146..228a5e234af0 100644
--- a/include/dt-bindings/clock/marvell,mmp2.h
+++ b/include/dt-bindings/clock/marvell,mmp2.h
@@ -71,7 +71,6 @@
 #define MMP2_CLK_CCIC1_MIX              117
 #define MMP2_CLK_CCIC1_PHY              118
 #define MMP2_CLK_CCIC1_SPHY             119
-#define MMP2_CLK_SP                     120
 
 #define MMP2_NR_CLKS                    200
 #endif
diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index 218df7f4d3e1..5041357d0297 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -180,12 +180,10 @@ enum cpuhp_smt_control {
 #if defined(CONFIG_SMP) && defined(CONFIG_HOTPLUG_SMT)
 extern enum cpuhp_smt_control cpu_smt_control;
 extern void cpu_smt_disable(bool force);
-extern void cpu_smt_check_topology_early(void);
 extern void cpu_smt_check_topology(void);
 #else
 # define cpu_smt_control                (CPU_SMT_ENABLED)
 static inline void cpu_smt_disable(bool force) { }
-static inline void cpu_smt_check_topology_early(void) { }
 static inline void cpu_smt_check_topology(void) { }
 #endif
 
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index ef4b70f64f33..60996e64c579 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -62,9 +62,10 @@ extern const struct qstr slash_name;
 struct dentry_stat_t {
         long nr_dentry;
         long nr_unused;
-        long age_limit;          /* age in seconds */
-        long want_pages;         /* pages requested by system */
-        long dummy[2];
+        long age_limit;         /* age in seconds */
+        long want_pages;        /* pages requested by system */
+        long nr_negative;       /* # of unused negative dentries */
+        long dummy;             /* Reserved for future use */
 };
 extern struct dentry_stat_t dentry_stat;
 
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 7317376734f7..95e2d7ebdf21 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -611,8 +611,8 @@ static inline u8 *bpf_skb_cb(struct sk_buff *skb)
         return qdisc_skb_cb(skb)->data;
 }
 
-static inline u32 bpf_prog_run_save_cb(const struct bpf_prog *prog,
-                                       struct sk_buff *skb)
+static inline u32 __bpf_prog_run_save_cb(const struct bpf_prog *prog,
+                                         struct sk_buff *skb)
 {
         u8 *cb_data = bpf_skb_cb(skb);
         u8 cb_saved[BPF_SKB_CB_LEN];
@@ -631,15 +631,30 @@ static inline u32 bpf_prog_run_save_cb(const struct bpf_prog *prog,
         return res;
 }
 
+static inline u32 bpf_prog_run_save_cb(const struct bpf_prog *prog,
+                                       struct sk_buff *skb)
+{
+        u32 res;
+
+        preempt_disable();
+        res = __bpf_prog_run_save_cb(prog, skb);
+        preempt_enable();
+        return res;
+}
+
 static inline u32 bpf_prog_run_clear_cb(const struct bpf_prog *prog,
                                         struct sk_buff *skb)
 {
         u8 *cb_data = bpf_skb_cb(skb);
+        u32 res;
 
         if (unlikely(prog->cb_access))
                 memset(cb_data, 0, BPF_SKB_CB_LEN);
 
-        return BPF_PROG_RUN(prog, skb);
+        preempt_disable();
+        res = BPF_PROG_RUN(prog, skb);
+        preempt_enable();
+        return res;
 }
 
 static __always_inline u32 bpf_prog_run_xdp(const struct bpf_prog *prog,
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 811c77743dad..29d8e2cfed0e 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1479,11 +1479,12 @@ struct super_block {
         struct user_namespace *s_user_ns;
 
         /*
-         * Keep the lru lists last in the structure so they always sit on their
-         * own individual cachelines.
+         * The list_lru structure is essentially just a pointer to a table
+         * of per-node lru lists, each of which has its own spinlock.
+         * There is no need to put them into separate cachelines.
          */
-        struct list_lru         s_dentry_lru ____cacheline_aligned_in_smp;
-        struct list_lru         s_inode_lru ____cacheline_aligned_in_smp;
+        struct list_lru         s_dentry_lru;
+        struct list_lru         s_inode_lru;
         struct rcu_head         rcu;
         struct work_struct      destroy_work;
 
diff --git a/include/linux/hid-debug.h b/include/linux/hid-debug.h
index 8663f216c563..2d6100edf204 100644
--- a/include/linux/hid-debug.h
+++ b/include/linux/hid-debug.h
@@ -24,7 +24,10 @@
 
 #ifdef CONFIG_DEBUG_FS
 
+#include <linux/kfifo.h>
+
 #define HID_DEBUG_BUFSIZE 512
+#define HID_DEBUG_FIFOSIZE 512
 
 void hid_dump_input(struct hid_device *, struct hid_usage *, __s32);
 void hid_dump_report(struct hid_device *, int , u8 *, int);
@@ -37,11 +40,8 @@ void hid_debug_init(void);
 void hid_debug_exit(void);
 void hid_debug_event(struct hid_device *, char *);
 
-
 struct hid_debug_list {
-        char *hid_debug_buf;
-        int head;
-        int tail;
+        DECLARE_KFIFO_PTR(hid_debug_fifo, char);
         struct fasync_struct *fasync;
         struct hid_device *hdev;
         struct list_head node;
@@ -64,4 +64,3 @@ struct hid_debug_list {
 #endif
 
 #endif
-
diff --git a/include/linux/ide.h b/include/linux/ide.h
index e7d29ae633cd..971cf76a78a0 100644
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -615,6 +615,7 @@ struct ide_drive_s {
 
         /* current sense rq and buffer */
         bool sense_rq_armed;
+        bool sense_rq_active;
         struct request *sense_rq;
         struct request_sense sense_data;
 
@@ -1219,6 +1220,7 @@ extern void ide_stall_queue(ide_drive_t *drive, unsigned long timeout);
 extern void ide_timer_expiry(struct timer_list *t);
 extern irqreturn_t ide_intr(int irq, void *dev_id);
 extern blk_status_t ide_queue_rq(struct blk_mq_hw_ctx *, const struct blk_mq_queue_data *);
+extern blk_status_t ide_issue_rq(ide_drive_t *, struct request *, bool);
 extern void ide_requeue_and_plug(ide_drive_t *drive, struct request *rq);
 
 void ide_init_disk(struct gendisk *, ide_drive_t *);
diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index 07da5c6c5ba0..368267c1b71b 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -21,14 +21,16 @@ struct vmem_altmap;
  * walkers which rely on the fully initialized page->flags and others
  * should use this rather than pfn_valid && pfn_to_page
  */
-#define pfn_to_online_page(pfn)                         \
-({                                                      \
-        struct page *___page = NULL;                    \
-        unsigned long ___nr = pfn_to_section_nr(pfn);   \
-                                                        \
-        if (___nr < NR_MEM_SECTIONS && online_section_nr(___nr))\
-                ___page = pfn_to_page(pfn);             \
-        ___page;                                        \
+#define pfn_to_online_page(pfn)                                    \
+({                                                                 \
+        struct page *___page = NULL;                               \
+        unsigned long ___pfn = pfn;                                \
+        unsigned long ___nr = pfn_to_section_nr(___pfn);           \
+                                                                   \
+        if (___nr < NR_MEM_SECTIONS && online_section_nr(___nr) && \
+            pfn_valid_within(___pfn))                              \
+                ___page = pfn_to_page(___pfn);                     \
+        ___page;                                                   \
 })
 
 /*
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 1d95e634f3fe..1fb733f38a47 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1492,6 +1492,7 @@ struct net_device_ops {
  * @IFF_NO_RX_HANDLER: device doesn't support the rx_handler hook
  * @IFF_FAILOVER: device is a failover master device
  * @IFF_FAILOVER_SLAVE: device is lower dev of a failover master device
+ * @IFF_L3MDEV_RX_HANDLER: only invoke the rx handler of L3 master device
  */
 enum netdev_priv_flags {
         IFF_802_1Q_VLAN                 = 1<<0,
@@ -1523,6 +1524,7 @@ enum netdev_priv_flags {
         IFF_NO_RX_HANDLER               = 1<<26,
         IFF_FAILOVER                    = 1<<27,
         IFF_FAILOVER_SLAVE              = 1<<28,
+        IFF_L3MDEV_RX_HANDLER           = 1<<29,
 };
 
 #define IFF_802_1Q_VLAN                 IFF_802_1Q_VLAN
@@ -1553,6 +1555,7 @@ enum netdev_priv_flags {
 #define IFF_NO_RX_HANDLER               IFF_NO_RX_HANDLER
 #define IFF_FAILOVER                    IFF_FAILOVER
 #define IFF_FAILOVER_SLAVE              IFF_FAILOVER_SLAVE
+#define IFF_L3MDEV_RX_HANDLER           IFF_L3MDEV_RX_HANDLER
 
 /**
  *      struct net_device - The DEVICE structure.
@@ -4561,6 +4564,11 @@ static inline bool netif_supports_nofcs(struct net_device *dev)
         return dev->priv_flags & IFF_SUPP_NOFCS;
 }
 
+static inline bool netif_has_l3_rx_handler(const struct net_device *dev)
+{
+        return dev->priv_flags & IFF_L3MDEV_RX_HANDLER;
+}
+
 static inline bool netif_is_l3_master(const struct net_device *dev)
 {
         return dev->priv_flags & IFF_L3MDEV_MASTER;
diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
index 54af4eef169f..fed5be706bc9 100644
--- a/include/linux/pm_runtime.h
+++ b/include/linux/pm_runtime.h
@@ -105,7 +105,7 @@ static inline bool pm_runtime_callbacks_present(struct device *dev)
 
 static inline void pm_runtime_mark_last_busy(struct device *dev)
 {
-        WRITE_ONCE(dev->power.last_busy, ktime_to_ns(ktime_get()));
+        WRITE_ONCE(dev->power.last_busy, ktime_get_mono_fast_ns());
 }
 
 static inline bool pm_runtime_is_irq_safe(struct device *dev)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index d2f90fa92468..bba3afb4e9bf 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -995,7 +995,7 @@ struct task_struct {
         /* cg_list protected by css_set_lock and tsk->alloc_lock: */
         struct list_head                cg_list;
 #endif
-#ifdef CONFIG_X86_RESCTRL
+#ifdef CONFIG_X86_CPU_RESCTRL
         u32                             closid;
         u32                             rmid;
 #endif
diff --git a/include/linux/sched/coredump.h b/include/linux/sched/coredump.h
index ec912d01126f..ecdc6542070f 100644
--- a/include/linux/sched/coredump.h
+++ b/include/linux/sched/coredump.h
@@ -71,6 +71,7 @@ static inline int get_dumpable(struct mm_struct *mm)
 #define MMF_HUGE_ZERO_PAGE      23      /* mm has ever used the global huge zero page */
 #define MMF_DISABLE_THP         24      /* disable THP for all VMAs */
 #define MMF_OOM_VICTIM          25      /* mm is the oom victim */
+#define MMF_OOM_REAP_QUEUED     26      /* mm was queued for oom_reaper */
 #define MMF_DISABLE_THP_MASK    (1 << MMF_DISABLE_THP)
 
 #define MMF_INIT_MASK           (MMF_DUMPABLE_MASK | MMF_DUMP_FILTER_MASK |\
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
index 7ddfc65586b0..4335bd771ce5 100644
--- a/include/linux/stmmac.h
+++ b/include/linux/stmmac.h
@@ -184,6 +184,7 @@ struct plat_stmmacenet_data {
         struct clk *pclk;
         struct clk *clk_ptp_ref;
         unsigned int clk_ptp_rate;
+        unsigned int clk_ref_rate;
         struct reset_control *stmmac_rst;
         struct stmmac_axi *axi;
         int has_gmac4;
diff --git a/include/net/l3mdev.h b/include/net/l3mdev.h
index 78fa0ac4613c..5175fd63cd82 100644
--- a/include/net/l3mdev.h
+++ b/include/net/l3mdev.h
@@ -153,7 +153,8 @@ struct sk_buff *l3mdev_l3_rcv(struct sk_buff *skb, u16 proto)
 
         if (netif_is_l3_slave(skb->dev))
                 master = netdev_master_upper_dev_get_rcu(skb->dev);
-        else if (netif_is_l3_master(skb->dev))
+        else if (netif_is_l3_master(skb->dev) ||
+                 netif_has_l3_rx_handler(skb->dev))
                 master = skb->dev;
 
         if (master && master->l3mdev_ops->l3mdev_l3_rcv)
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 45eba7d7ab38..a66fcd316734 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -469,9 +469,7 @@ struct nft_set_binding {
 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
                        struct nft_set_binding *binding);
 void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
-                          struct nft_set_binding *binding);
-void nf_tables_rebind_set(const struct nft_ctx *ctx, struct nft_set *set,
-                          struct nft_set_binding *binding);
+                          struct nft_set_binding *binding, bool commit);
 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set);
 
 /**
@@ -721,6 +719,13 @@ struct nft_expr_type {
 #define NFT_EXPR_STATEFUL               0x1
 #define NFT_EXPR_GC                     0x2
 
+enum nft_trans_phase {
+        NFT_TRANS_PREPARE,
+        NFT_TRANS_ABORT,
+        NFT_TRANS_COMMIT,
+        NFT_TRANS_RELEASE
+};
+
 /**
  *      struct nft_expr_ops - nf_tables expression operations
  *
@@ -750,7 +755,8 @@ struct nft_expr_ops {
         void                            (*activate)(const struct nft_ctx *ctx,
                                                     const struct nft_expr *expr);
         void                            (*deactivate)(const struct nft_ctx *ctx,
-                                                      const struct nft_expr *expr);
+                                                      const struct nft_expr *expr,
+                                                      enum nft_trans_phase phase);
         void                            (*destroy)(const struct nft_ctx *ctx,
                                                    const struct nft_expr *expr);
         void                            (*destroy_clone)(const struct nft_ctx *ctx,
@@ -1335,12 +1341,15 @@ struct nft_trans_rule {
 struct nft_trans_set {
         struct nft_set                  *set;
         u32                             set_id;
+        bool                            bound;
 };
 
 #define nft_trans_set(trans)    \
         (((struct nft_trans_set *)trans->data)->set)
 #define nft_trans_set_id(trans) \
         (((struct nft_trans_set *)trans->data)->set_id)
+#define nft_trans_set_bound(trans)      \
+        (((struct nft_trans_set *)trans->data)->bound)
 
 struct nft_trans_chain {
         bool                            update;
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index a3ceed3a040a..80debf5982ac 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -2579,9 +2579,10 @@ struct ib_device {
 
         const struct uapi_definition   *driver_def;
         enum rdma_driver_id             driver_id;
+
         /*
-         * Provides synchronization between device unregistration and netlink
-         * commands on a device. To be used only by core.
+         * Positive refcount indicates that the device is currently
+         * registered and cannot be unregistered.
          */
         refcount_t refcount;
         struct completion unreg_completion;
@@ -3926,6 +3927,25 @@ static inline bool ib_access_writable(int access_flags)
 int ib_check_mr_status(struct ib_mr *mr, u32 check_mask,
                        struct ib_mr_status *mr_status);
 
+/**
+ * ib_device_try_get: Hold a registration lock
+ * device: The device to lock
+ *
+ * A device under an active registration lock cannot become unregistered. It
+ * is only possible to obtain a registration lock on a device that is fully
+ * registered, otherwise this function returns false.
+ *
+ * The registration lock is only necessary for actions which require the
+ * device to still be registered. Uses that only require the device pointer to
+ * be valid should use get_device(&ibdev->dev) to hold the memory.
+ *
+ */
+static inline bool ib_device_try_get(struct ib_device *dev)
+{
+        return refcount_inc_not_zero(&dev->refcount);
+}
+
+void ib_device_put(struct ib_device *device);
 struct net_device *ib_get_net_dev_by_params(struct ib_device *dev, u8 port,
                                             u16 pkey, const union ib_gid *gid,
                                             const struct sockaddr *addr);
diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h
index 0cdc3999ecfa..c5188ff724d1 100644
--- a/include/sound/compress_driver.h
+++ b/include/sound/compress_driver.h
@@ -173,7 +173,11 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream)
         if (snd_BUG_ON(!stream))
                 return;
 
-        stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+        if (stream->direction == SND_COMPRESS_PLAYBACK)
+                stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+        else
+                stream->runtime->state = SNDRV_PCM_STATE_PREPARED;
+
         wake_up(&stream->runtime->sleep);
 }
 
diff --git a/include/sound/hda_codec.h b/include/sound/hda_codec.h
index 7fa48b100936..cc7c8d42d4fd 100644
--- a/include/sound/hda_codec.h
+++ b/include/sound/hda_codec.h
@@ -68,6 +68,7 @@ struct hda_bus {
         unsigned int response_reset:1;  /* controller was reset */
         unsigned int in_reset:1;        /* during reset operation */
         unsigned int no_response_fallback:1; /* don't fallback at RIRB error */
+        unsigned int bus_probing :1;    /* during probing process */
 
         int primary_dig_out_type;       /* primary digital out PCM type */
         unsigned int mixer_assigned;    /* codec addr for mixer name */
diff --git a/include/uapi/linux/virtio_config.h b/include/uapi/linux/virtio_config.h
index 1196e1c1d4f6..ff8e7dc9d4dd 100644
--- a/include/uapi/linux/virtio_config.h
+++ b/include/uapi/linux/virtio_config.h
@@ -79,6 +79,12 @@
 #define VIRTIO_F_RING_PACKED            34
 
 /*
+ * This feature indicates that memory accesses by the driver and the
+ * device are ordered in a way described by the platform.
+ */
+#define VIRTIO_F_ORDER_PLATFORM         36
+
+/*
  * Does the device support Single Root I/O Virtualization?
  */
 #define VIRTIO_F_SR_IOV                 37
diff --git a/include/uapi/linux/virtio_ring.h b/include/uapi/linux/virtio_ring.h
index 2414f8af26b3..4c4e24c291a5 100644
--- a/include/uapi/linux/virtio_ring.h
+++ b/include/uapi/linux/virtio_ring.h
@@ -213,14 +213,4 @@ struct vring_packed_desc {
         __le16 flags;
 };
 
-struct vring_packed {
-        unsigned int num;
-
-        struct vring_packed_desc *desc;
-
-        struct vring_packed_desc_event *driver;
-
-        struct vring_packed_desc_event *device;
-};
-
 #endif /* _UAPI_LINUX_VIRTIO_RING_H */
diff --git a/include/uapi/rdma/hns-abi.h b/include/uapi/rdma/hns-abi.h
index ef3c7ec793a7..eb76b38a00d4 100644
--- a/include/uapi/rdma/hns-abi.h
+++ b/include/uapi/rdma/hns-abi.h
@@ -52,6 +52,11 @@ struct hns_roce_ib_create_srq {
         __aligned_u64 que_addr;
 };
 
+struct hns_roce_ib_create_srq_resp {
+        __u32   srqn;
+        __u32   reserved;
+};
+
 struct hns_roce_ib_create_qp {
         __aligned_u64 buf_addr;
         __aligned_u64 db_addr;
diff --git a/init/Kconfig b/init/Kconfig
index 513fa544a134..c9386a365eea 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -512,6 +512,17 @@ config PSI_DEFAULT_DISABLED
           per default but can be enabled through passing psi=1 on the
           kernel commandline during boot.
 
+          This feature adds some code to the task wakeup and sleep
+          paths of the scheduler. The overhead is too low to affect
+          common scheduling-intense workloads in practice (such as
+          webservers, memcache), but it does show up in artificial
+          scheduler stress tests, such as hackbench.
+
+          If you are paranoid and not sure what the kernel will be
+          used for, say Y.
+
+          Say N if unsure.
+
 endmenu # "CPU/Task time and stats accounting"
 
 config CPU_ISOLATION
@@ -825,7 +836,7 @@ config CGROUP_PIDS
           PIDs controller is designed to stop this from happening.
 
           It should be noted that organisational operations (such as attaching
-          to a cgroup hierarchy will *not* be blocked by the PIDs controller),
+          to a cgroup hierarchy) will *not* be blocked by the PIDs controller,
           since the PIDs limit only affects a process's ability to fork, not to
           attach to a cgroup.
 
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 7019c1f05cab..bd3921b1514b 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -1530,7 +1530,8 @@ static int btf_modifier_resolve(struct btf_verifier_env *env,
 
                 /* "typedef void new_void", "const void"...etc */
                 if (!btf_type_is_void(next_type) &&
-                    !btf_type_is_fwd(next_type)) {
+                    !btf_type_is_fwd(next_type) &&
+                    !btf_type_is_func_proto(next_type)) {
                         btf_verifier_log_type(env, v->t, "Invalid type_id");
                         return -EINVAL;
                 }
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index d78cfec5807d..4e807973aa80 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -573,7 +573,7 @@ int __cgroup_bpf_run_filter_skb(struct sock *sk,
         bpf_compute_and_save_data_end(skb, &saved_data_end);
 
         ret = BPF_PROG_RUN_ARRAY(cgrp->bpf.effective[type], skb,
-                                 bpf_prog_run_save_cb);
+                                 __bpf_prog_run_save_cb);
         bpf_restore_data_end(skb, saved_data_end);
         __skb_pull(skb, offset);
         skb->sk = save_sk;
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 937776531998..fed15cf94dca 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -686,7 +686,7 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
         }
 
         if (htab_is_prealloc(htab)) {
-                pcpu_freelist_push(&htab->freelist, &l->fnode);
+                __pcpu_freelist_push(&htab->freelist, &l->fnode);
         } else {
                 atomic_dec(&htab->count);
                 l->htab = htab;
@@ -739,7 +739,7 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
                 } else {
                         struct pcpu_freelist_node *l;
 
-                        l = pcpu_freelist_pop(&htab->freelist);
+                        l = __pcpu_freelist_pop(&htab->freelist);
                         if (!l)
                                 return ERR_PTR(-E2BIG);
                         l_new = container_of(l, struct htab_elem, fnode);
diff --git a/kernel/bpf/percpu_freelist.c b/kernel/bpf/percpu_freelist.c
index 673fa6fe2d73..0c1b4ba9e90e 100644
--- a/kernel/bpf/percpu_freelist.c
+++ b/kernel/bpf/percpu_freelist.c
@@ -28,8 +28,8 @@ void pcpu_freelist_destroy(struct pcpu_freelist *s)
         free_percpu(s->freelist);
 }
 
-static inline void __pcpu_freelist_push(struct pcpu_freelist_head *head,
-                                        struct pcpu_freelist_node *node)
+static inline void ___pcpu_freelist_push(struct pcpu_freelist_head *head,
+                                         struct pcpu_freelist_node *node)
 {
         raw_spin_lock(&head->lock);
         node->next = head->first;
@@ -37,12 +37,22 @@ static inline void __pcpu_freelist_push(struct pcpu_freelist_head *head,
         raw_spin_unlock(&head->lock);
 }
 
-void pcpu_freelist_push(struct pcpu_freelist *s,
+void __pcpu_freelist_push(struct pcpu_freelist *s,
                         struct pcpu_freelist_node *node)
 {
         struct pcpu_freelist_head *head = this_cpu_ptr(s->freelist);
 
-        __pcpu_freelist_push(head, node);
+        ___pcpu_freelist_push(head, node);
+}
+
+void pcpu_freelist_push(struct pcpu_freelist *s,
+                        struct pcpu_freelist_node *node)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+        __pcpu_freelist_push(s, node);
+        local_irq_restore(flags);
 }
 
 void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size,
@@ -63,7 +73,7 @@ void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size,
         for_each_possible_cpu(cpu) {
 again:
                 head = per_cpu_ptr(s->freelist, cpu);
-                __pcpu_freelist_push(head, buf);
+                ___pcpu_freelist_push(head, buf);
                 i++;
                 buf += elem_size;
                 if (i == nr_elems)
@@ -74,14 +84,12 @@ again:
         local_irq_restore(flags);
 }
 
-struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s)
+struct pcpu_freelist_node *__pcpu_freelist_pop(struct pcpu_freelist *s)
 {
         struct pcpu_freelist_head *head;
         struct pcpu_freelist_node *node;
-        unsigned long flags;
         int orig_cpu, cpu;
 
-        local_irq_save(flags);
         orig_cpu = cpu = raw_smp_processor_id();
         while (1) {
                 head = per_cpu_ptr(s->freelist, cpu);
@@ -89,16 +97,25 @@ struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s)
                 node = head->first;
                 if (node) {
                         head->first = node->next;
-                        raw_spin_unlock_irqrestore(&head->lock, flags);
+                        raw_spin_unlock(&head->lock);
                         return node;
                 }
                 raw_spin_unlock(&head->lock);
                 cpu = cpumask_next(cpu, cpu_possible_mask);
                 if (cpu >= nr_cpu_ids)
                         cpu = 0;
-                if (cpu == orig_cpu) {
-                        local_irq_restore(flags);
+                if (cpu == orig_cpu)
                         return NULL;
-                }
         }
 }
+
+struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s)
+{
+        struct pcpu_freelist_node *ret;
+        unsigned long flags;
+
+        local_irq_save(flags);
+        ret = __pcpu_freelist_pop(s);
+        local_irq_restore(flags);
+        return ret;
+}
diff --git a/kernel/bpf/percpu_freelist.h b/kernel/bpf/percpu_freelist.h
index 3049aae8ea1e..c3960118e617 100644
--- a/kernel/bpf/percpu_freelist.h
+++ b/kernel/bpf/percpu_freelist.h
@@ -22,8 +22,12 @@ struct pcpu_freelist_node {
         struct pcpu_freelist_node *next;
 };
 
+/* pcpu_freelist_* do spin_lock_irqsave. */
 void pcpu_freelist_push(struct pcpu_freelist *, struct pcpu_freelist_node *);
 struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *);
+/* __pcpu_freelist_* do spin_lock only. caller must disable irqs. */
+void __pcpu_freelist_push(struct pcpu_freelist *, struct pcpu_freelist_node *);
+struct pcpu_freelist_node *__pcpu_freelist_pop(struct pcpu_freelist *);
 void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size,
                             u32 nr_elems);
 int pcpu_freelist_init(struct pcpu_freelist *);
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 0834958f1dc4..ec7c552af76b 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -740,8 +740,13 @@ static int map_lookup_elem(union bpf_attr *attr)
 
         if (bpf_map_is_dev_bound(map)) {
                 err = bpf_map_offload_lookup_elem(map, key, value);
-        } else if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
-                   map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH) {
+                goto done;
+        }
+
+        preempt_disable();
+        this_cpu_inc(bpf_prog_active);
+        if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
+            map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH) {
                 err = bpf_percpu_hash_copy(map, key, value);
         } else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
                 err = bpf_percpu_array_copy(map, key, value);
@@ -777,7 +782,10 @@ static int map_lookup_elem(union bpf_attr *attr)
                 }
                 rcu_read_unlock();
         }
+        this_cpu_dec(bpf_prog_active);
+        preempt_enable();
 
+done:
         if (err)
                 goto free_value;
 
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 91d5c38eb7e5..d1c6d152da89 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -376,9 +376,6 @@ void __weak arch_smt_update(void) { }
 
 #ifdef CONFIG_HOTPLUG_SMT
 enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED;
-EXPORT_SYMBOL_GPL(cpu_smt_control);
-
-static bool cpu_smt_available __read_mostly;
 
 void __init cpu_smt_disable(bool force)
 {
@@ -397,25 +394,11 @@ void __init cpu_smt_disable(bool force)
 
 /*
  * The decision whether SMT is supported can only be done after the full
- * CPU identification. Called from architecture code before non boot CPUs
- * are brought up.
- */
-void __init cpu_smt_check_topology_early(void)
-{
-        if (!topology_smt_supported())
-                cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
-}
-
-/*
- * If SMT was disabled by BIOS, detect it here, after the CPUs have been
- * brought online. This ensures the smt/l1tf sysfs entries are consistent
- * with reality. cpu_smt_available is set to true during the bringup of non
- * boot CPUs when a SMT sibling is detected. Note, this may overwrite
- * cpu_smt_control's previous setting.
+ * CPU identification. Called from architecture code.
  */
 void __init cpu_smt_check_topology(void)
 {
-        if (!cpu_smt_available)
+        if (!topology_smt_supported())
                 cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
 }
 
@@ -428,18 +411,10 @@ early_param("nosmt", smt_cmdline_disable);
 
 static inline bool cpu_smt_allowed(unsigned int cpu)
 {
-        if (topology_is_primary_thread(cpu))
+        if (cpu_smt_control == CPU_SMT_ENABLED)
                 return true;
 
-        /*
-         * If the CPU is not a 'primary' thread and the booted_once bit is
-         * set then the processor has SMT support. Store this information
-         * for the late check of SMT support in cpu_smt_check_topology().
-         */
-        if (per_cpu(cpuhp_state, cpu).booted_once)
-                cpu_smt_available = true;
-
-        if (cpu_smt_control == CPU_SMT_ENABLED)
+        if (topology_is_primary_thread(cpu))
                 return true;
 
         /*
@@ -2090,10 +2065,8 @@ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
                  */
                 cpuhp_offline_cpu_device(cpu);
         }
-        if (!ret) {
+        if (!ret)
                 cpu_smt_control = ctrlval;
-                arch_smt_update();
-        }
         cpu_maps_update_done();
         return ret;
 }
@@ -2104,7 +2077,6 @@ static int cpuhp_smt_enable(void)
 
         cpu_maps_update_begin();
         cpu_smt_control = CPU_SMT_ENABLED;
-        arch_smt_update();
         for_each_present_cpu(cpu) {
                 /* Skip online CPUs and CPUs on offline nodes */
                 if (cpu_online(cpu) || !node_online(cpu_to_node(cpu)))
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 3cd13a30f732..e5ede6918050 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -436,18 +436,18 @@ int perf_proc_update_handler(struct ctl_table *table, int write,
                 void __user *buffer, size_t *lenp,
                 loff_t *ppos)
 {
-        int ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
-
-        if (ret || !write)
-                return ret;
-
+        int ret;
+        int perf_cpu = sysctl_perf_cpu_time_max_percent;
         /*
          * If throttling is disabled don't allow the write:
          */
-        if (sysctl_perf_cpu_time_max_percent == 100 ||
-            sysctl_perf_cpu_time_max_percent == 0)
+        if (write && (perf_cpu == 100 || perf_cpu == 0))
                 return -EINVAL;
 
+        ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+        if (ret || !write)
+                return ret;
+
         max_samples_per_tick = DIV_ROUND_UP(sysctl_perf_event_sample_rate, HZ);
         perf_sample_period_ns = NSEC_PER_SEC / sysctl_perf_event_sample_rate;
         update_perf_cpu_limits();
diff --git a/kernel/exit.c b/kernel/exit.c
index 3fb7be001964..2639a30a8aa5 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -558,12 +558,14 @@ static struct task_struct *find_alive_thread(struct task_struct *p)
         return NULL;
 }
 
-static struct task_struct *find_child_reaper(struct task_struct *father)
+static struct task_struct *find_child_reaper(struct task_struct *father,
+                                                struct list_head *dead)
         __releases(&tasklist_lock)
         __acquires(&tasklist_lock)
 {
         struct pid_namespace *pid_ns = task_active_pid_ns(father);
         struct task_struct *reaper = pid_ns->child_reaper;
+        struct task_struct *p, *n;
 
         if (likely(reaper != father))
                 return reaper;
@@ -579,6 +581,12 @@ static struct task_struct *find_child_reaper(struct task_struct *father)
                 panic("Attempted to kill init! exitcode=0x%08x\n",
                         father->signal->group_exit_code ?: father->exit_code);
         }
+
+        list_for_each_entry_safe(p, n, dead, ptrace_entry) {
+                list_del_init(&p->ptrace_entry);
+                release_task(p);
+        }
+
         zap_pid_ns_processes(pid_ns);
         write_lock_irq(&tasklist_lock);
 
@@ -668,7 +676,7 @@ static void forget_original_parent(struct task_struct *father,
                 exit_ptrace(father, dead);
 
         /* Can drop and reacquire tasklist_lock */
-        reaper = find_child_reaper(father);
+        reaper = find_child_reaper(father, dead);
         if (list_empty(&father->children))
                 return;
 
diff --git a/kernel/relay.c b/kernel/relay.c
index 04f248644e06..9e0f52375487 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -428,6 +428,8 @@ static struct dentry *relay_create_buf_file(struct rchan *chan,
         dentry = chan->cb->create_buf_file(tmpname, chan->parent,
                                            S_IRUSR, buf,
                                            &chan->is_global);
+        if (IS_ERR(dentry))
+                dentry = NULL;
 
         kfree(tmpname);
 
@@ -461,7 +463,7 @@ static struct rchan_buf *relay_open_buf(struct rchan *chan, unsigned int cpu)
                 dentry = chan->cb->create_buf_file(NULL, NULL,
                                                    S_IRUSR, buf,
                                                    &chan->is_global);
-                if (WARN_ON(dentry))
+                if (IS_ERR_OR_NULL(dentry))
                         goto free_buf;
         }
 
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 50aa2aba69bd..310d0637fe4b 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5980,6 +5980,7 @@ static inline int find_idlest_cpu(struct sched_domain *sd, struct task_struct *p
 
 #ifdef CONFIG_SCHED_SMT
 DEFINE_STATIC_KEY_FALSE(sched_smt_present);
+EXPORT_SYMBOL_GPL(sched_smt_present);
 
 static inline void set_idle_cores(int cpu, int val)
 {
diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
index fe24de3fbc93..c3484785b179 100644
--- a/kernel/sched/psi.c
+++ b/kernel/sched/psi.c
@@ -124,6 +124,7 @@
  * sampling of the aggregate task states would be.
  */
 
+#include "../workqueue_internal.h"
 #include <linux/sched/loadavg.h>
 #include <linux/seq_file.h>
 #include <linux/proc_fs.h>
@@ -480,9 +481,6 @@ static void psi_group_change(struct psi_group *group, int cpu,
                         groupc->tasks[t]++;
 
         write_seqcount_end(&groupc->seq);
-
-        if (!delayed_work_pending(&group->clock_work))
-                schedule_delayed_work(&group->clock_work, PSI_FREQ);
 }
 
 static struct psi_group *iterate_groups(struct task_struct *task, void **iter)
@@ -513,6 +511,7 @@ void psi_task_change(struct task_struct *task, int clear, int set)
 {
         int cpu = task_cpu(task);
         struct psi_group *group;
+        bool wake_clock = true;
         void *iter = NULL;
 
         if (!task->pid)
@@ -530,8 +529,22 @@ void psi_task_change(struct task_struct *task, int clear, int set)
         task->psi_flags &= ~clear;
         task->psi_flags |= set;
 
-        while ((group = iterate_groups(task, &iter)))
+        /*
+         * Periodic aggregation shuts off if there is a period of no
+         * task changes, so we wake it back up if necessary. However,
+         * don't do this if the task change is the aggregation worker
+         * itself going to sleep, or we'll ping-pong forever.
+         */
+        if (unlikely((clear & TSK_RUNNING) &&
+                     (task->flags & PF_WQ_WORKER) &&
+                     wq_worker_last_func(task) == psi_update_work))
+                wake_clock = false;
+
+        while ((group = iterate_groups(task, &iter))) {
                 psi_group_change(group, cpu, clear, set);
+                if (wake_clock && !delayed_work_pending(&group->clock_work))
+                        schedule_delayed_work(&group->clock_work, PSI_FREQ);
+        }
 }
 
 void psi_memstall_tick(struct task_struct *task, int cpu)
diff --git a/kernel/smp.c b/kernel/smp.c
index 163c451af42e..f4cf1b0bb3b8 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -584,8 +584,6 @@ void __init smp_init(void)
                 num_nodes, (num_nodes > 1 ? "s" : ""),
                 num_cpus,  (num_cpus  > 1 ? "s" : ""));
 
-        /* Final decision about SMT support */
-        cpu_smt_check_topology();
         /* Any cleanup work */
         smp_cpus_done(setup_max_cpus);
 }
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 8b068adb9da1..f1a86a0d881d 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -1204,22 +1204,12 @@ static int __bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog *
 
 int bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog *prog)
 {
-        int err;
-
-        mutex_lock(&bpf_event_mutex);
-        err = __bpf_probe_register(btp, prog);
-        mutex_unlock(&bpf_event_mutex);
-        return err;
+        return __bpf_probe_register(btp, prog);
 }
 
 int bpf_probe_unregister(struct bpf_raw_event_map *btp, struct bpf_prog *prog)
 {
-        int err;
-
-        mutex_lock(&bpf_event_mutex);
-        err = tracepoint_probe_unregister(btp->tp, (void *)btp->bpf_func, prog);
-        mutex_unlock(&bpf_event_mutex);
-        return err;
+        return tracepoint_probe_unregister(btp->tp, (void *)btp->bpf_func, prog);
 }
 
 int bpf_get_perf_event_info(const struct perf_event *event, u32 *prog_id,
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index e335576b9411..9bde07c06362 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -5,7 +5,7 @@
  * Copyright (C) IBM Corporation, 2010-2012
  * Author:      Srikar Dronamraju <srikar@linux.vnet.ibm.com>
  */
-#define pr_fmt(fmt)     "trace_kprobe: " fmt
+#define pr_fmt(fmt)     "trace_uprobe: " fmt
 
 #include <linux/ctype.h>
 #include <linux/module.h>
@@ -160,6 +160,13 @@ fetch_store_string(unsigned long addr, void *dest, void *base)
         if (ret >= 0) {
                 if (ret == maxlen)
                         dst[ret - 1] = '\0';
+                else
+                        /*
+                         * Include the terminating null byte. In this case it
+                         * was copied by strncpy_from_user but not accounted
+                         * for in ret.
+                         */
+                        ret++;
                 *(u32 *)dest = make_data_loc(ret, (void *)dst - base);
         }
 
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 392be4b252f6..fc5d23d752a5 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -910,6 +910,26 @@ struct task_struct *wq_worker_sleeping(struct task_struct *task)
 }
 
 /**
+ * wq_worker_last_func - retrieve worker's last work function
+ *
+ * Determine the last function a worker executed. This is called from
+ * the scheduler to get a worker's last known identity.
+ *
+ * CONTEXT:
+ * spin_lock_irq(rq->lock)
+ *
+ * Return:
+ * The last work function %current executed as a worker, NULL if it
+ * hasn't executed any work yet.
+ */
+work_func_t wq_worker_last_func(struct task_struct *task)
+{
+        struct worker *worker = kthread_data(task);
+
+        return worker->last_func;
+}
+
+/**
  * worker_set_flags - set worker flags and adjust nr_running accordingly
  * @worker: self
  * @flags: flags to set
@@ -2184,6 +2204,9 @@ __acquires(&pool->lock)
         if (unlikely(cpu_intensive))
                 worker_clr_flags(worker, WORKER_CPU_INTENSIVE);
 
+        /* tag the worker for identification in schedule() */
+        worker->last_func = worker->current_func;
+
         /* we're done with it, release */
         hash_del(&worker->hentry);
         worker->current_work = NULL;
diff --git a/kernel/workqueue_internal.h b/kernel/workqueue_internal.h
index 66fbb5a9e633..cb68b03ca89a 100644
--- a/kernel/workqueue_internal.h
+++ b/kernel/workqueue_internal.h
@@ -53,6 +53,9 @@ struct worker {
 
         /* used only by rescuers to point to the target workqueue */
         struct workqueue_struct *rescue_wq;     /* I: the workqueue to rescue */
+
+        /* used by the scheduler to determine a worker's last known identity */
+        work_func_t             last_func;
 };
 
 /**
@@ -67,9 +70,10 @@ static inline struct worker *current_wq_worker(void)
 
 /*
  * Scheduler hooks for concurrency managed workqueue.  Only to be used from
- * sched/core.c and workqueue.c.
+ * sched/ and workqueue.c.
  */
 void wq_worker_waking_up(struct task_struct *task, int cpu);
 struct task_struct *wq_worker_sleeping(struct task_struct *task);
+work_func_t wq_worker_last_func(struct task_struct *task);
 
 #endif /* _KERNEL_WORKQUEUE_INTERNAL_H */
diff --git a/lib/test_kmod.c b/lib/test_kmod.c
index d82d022111e0..9cf77628fc91 100644
--- a/lib/test_kmod.c
+++ b/lib/test_kmod.c
@@ -632,7 +632,7 @@ static void __kmod_config_free(struct test_config *config)
         config->test_driver = NULL;
 
         kfree_const(config->test_fs);
-        config->test_driver = NULL;
+        config->test_fs = NULL;
 }
 
 static void kmod_config_free(struct kmod_test_device *test_dev)
diff --git a/lib/test_rhashtable.c b/lib/test_rhashtable.c
index 6a8ac7626797..e52f8cafe227 100644
--- a/lib/test_rhashtable.c
+++ b/lib/test_rhashtable.c
@@ -541,38 +541,45 @@ static unsigned int __init print_ht(struct rhltable *rhlt)
 static int __init test_insert_dup(struct test_obj_rhl *rhl_test_objects,
                                   int cnt, bool slow)
 {
-        struct rhltable rhlt;
+        struct rhltable *rhlt;
         unsigned int i, ret;
         const char *key;
         int err = 0;
 
-        err = rhltable_init(&rhlt, &test_rht_params_dup);
-        if (WARN_ON(err))
+        rhlt = kmalloc(sizeof(*rhlt), GFP_KERNEL);
+        if (WARN_ON(!rhlt))
+                return -EINVAL;
+
+        err = rhltable_init(rhlt, &test_rht_params_dup);
+        if (WARN_ON(err)) {
+                kfree(rhlt);
                 return err;
+        }
 
         for (i = 0; i < cnt; i++) {
                 rhl_test_objects[i].value.tid = i;
-                key = rht_obj(&rhlt.ht, &rhl_test_objects[i].list_node.rhead);
+                key = rht_obj(&rhlt->ht, &rhl_test_objects[i].list_node.rhead);
                 key += test_rht_params_dup.key_offset;
 
                 if (slow) {
-                        err = PTR_ERR(rhashtable_insert_slow(&rhlt.ht, key,
+                        err = PTR_ERR(rhashtable_insert_slow(&rhlt->ht, key,
                                                              &rhl_test_objects[i].list_node.rhead));
                         if (err == -EAGAIN)
                                 err = 0;
                 } else
-                        err = rhltable_insert(&rhlt,
+                        err = rhltable_insert(rhlt,
                                               &rhl_test_objects[i].list_node,
                                               test_rht_params_dup);
                 if (WARN(err, "error %d on element %d/%d (%s)\n", err, i, cnt, slow? "slow" : "fast"))
                         goto skip_print;
         }
 
-        ret = print_ht(&rhlt);
+        ret = print_ht(rhlt);
         WARN(ret != cnt, "missing rhltable elements (%d != %d, %s)\n", ret, cnt, slow? "slow" : "fast");
 
 skip_print:
-        rhltable_destroy(&rhlt);
+        rhltable_destroy(rhlt);
+        kfree(rhlt);
 
         return 0;
 }
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index df2e7dd5ff17..afef61656c1e 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4268,7 +4268,8 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
                                 break;
                         }
                         if (ret & VM_FAULT_RETRY) {
-                                if (nonblocking)
+                                if (nonblocking &&
+                                    !(fault_flags & FAULT_FLAG_RETRY_NOWAIT))
                                         *nonblocking = 0;
                                 *nr_pages = 0;
                                 /*
diff --git a/mm/kasan/Makefile b/mm/kasan/Makefile
index 0a14fcff70ed..e2bb06c1b45e 100644
--- a/mm/kasan/Makefile
+++ b/mm/kasan/Makefile
@@ -5,6 +5,7 @@ UBSAN_SANITIZE_generic.o := n
 UBSAN_SANITIZE_tags.o := n
 KCOV_INSTRUMENT := n
 
+CFLAGS_REMOVE_common.o = -pg
 CFLAGS_REMOVE_generic.o = -pg
 # Function splitter causes unnecessary splits in __asan_load1/__asan_store1
 # see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63533
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 7c72f2a95785..831be5ff5f4d 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -372,7 +372,8 @@ static void kill_procs(struct list_head *to_kill, int forcekill, bool fail,
                         if (fail || tk->addr_valid == 0) {
                                 pr_err("Memory failure: %#lx: forcibly killing %s:%d because of failure to unmap corrupted page\n",
                                        pfn, tk->tsk->comm, tk->tsk->pid);
-                                force_sig(SIGKILL, tk->tsk);
+                                do_send_sig_info(SIGKILL, SEND_SIG_PRIV,
+                                                 tk->tsk, PIDTYPE_PID);
                         }
 
                         /*
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index b9a667d36c55..124e794867c5 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1233,7 +1233,8 @@ static bool is_pageblock_removable_nolock(struct page *page)
 bool is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages)
 {
         struct page *page = pfn_to_page(start_pfn);
-        struct page *end_page = page + nr_pages;
+        unsigned long end_pfn = min(start_pfn + nr_pages, zone_end_pfn(page_zone(page)));
+        struct page *end_page = pfn_to_page(end_pfn);
 
         /* Check the starting page of each pageblock within the range */
         for (; page < end_page; page = next_active_pageblock(page)) {
@@ -1273,6 +1274,9 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn,
                                 i++;
                         if (i == MAX_ORDER_NR_PAGES || pfn + i >= end_pfn)
                                 continue;
+                        /* Check if we got outside of the zone */
+                        if (zone && !zone_spans_pfn(zone, pfn + i))
+                                return 0;
                         page = pfn_to_page(pfn + i);
                         if (zone && page_zone(page) != zone)
                                 return 0;
@@ -1301,23 +1305,27 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn,
 static unsigned long scan_movable_pages(unsigned long start, unsigned long end)
 {
         unsigned long pfn;
-        struct page *page;
+
         for (pfn = start; pfn < end; pfn++) {
-                if (pfn_valid(pfn)) {
-                        page = pfn_to_page(pfn);
-                        if (PageLRU(page))
-                                return pfn;
-                        if (__PageMovable(page))
-                                return pfn;
-                        if (PageHuge(page)) {
-                                if (hugepage_migration_supported(page_hstate(page)) &&
-                                    page_huge_active(page))
-                                        return pfn;
-                                else
-                                        pfn = round_up(pfn + 1,
-                                                1 << compound_order(page)) - 1;
-                        }
-                }
+                struct page *page, *head;
+                unsigned long skip;
+
+                if (!pfn_valid(pfn))
+                        continue;
+                page = pfn_to_page(pfn);
+                if (PageLRU(page))
+                        return pfn;
+                if (__PageMovable(page))
+                        return pfn;
+
+                if (!PageHuge(page))
+                        continue;
+                head = compound_head(page);
+                if (hugepage_migration_supported(page_hstate(head)) &&
+                    page_huge_active(head))
+                        return pfn;
+                skip = (1 << compound_order(head)) - (page - head);
+                pfn += skip - 1;
         }
         return 0;
 }
@@ -1344,7 +1352,6 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
 {
         unsigned long pfn;
         struct page *page;
-        int not_managed = 0;
         int ret = 0;
         LIST_HEAD(source);
 
@@ -1392,7 +1399,6 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
                 else
                         ret = isolate_movable_page(page, ISOLATE_UNEVICTABLE);
                 if (!ret) { /* Success */
-                        put_page(page);
                         list_add_tail(&page->lru, &source);
                         if (!__PageMovable(page))
                                 inc_node_page_state(page, NR_ISOLATED_ANON +
@@ -1401,22 +1407,10 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
                 } else {
                         pr_warn("failed to isolate pfn %lx\n", pfn);
                         dump_page(page, "isolation failed");
-                        put_page(page);
-                        /* Because we don't have big zone->lock. we should
-                           check this again here. */
-                        if (page_count(page)) {
-                                not_managed++;
-                                ret = -EBUSY;
-                                break;
-                        }
                 }
+                put_page(page);
         }
         if (!list_empty(&source)) {
-                if (not_managed) {
-                        putback_movable_pages(&source);
-                        goto out;
-                }
-
                 /* Allocate a new page from the nearest neighbor node */
                 ret = migrate_pages(&source, new_node_page, NULL, 0,
                                         MIGRATE_SYNC, MR_MEMORY_HOTPLUG);
@@ -1429,7 +1423,7 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
                         putback_movable_pages(&source);
                 }
         }
-out:
+
         return ret;
 }
 
@@ -1576,7 +1570,6 @@ static int __ref __offline_pages(unsigned long start_pfn,
            we assume this for now. .*/
         if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start,
                                   &valid_end)) {
-                mem_hotplug_done();
                 ret = -EINVAL;
                 reason = "multizone range";
                 goto failed_removal;
@@ -1591,7 +1584,6 @@ static int __ref __offline_pages(unsigned long start_pfn,
                                        MIGRATE_MOVABLE,
                                        SKIP_HWPOISON | REPORT_FAILURE);
         if (ret) {
-                mem_hotplug_done();
                 reason = "failure to isolate range";
                 goto failed_removal;
         }
diff --git a/mm/migrate.c b/mm/migrate.c
index a16b15090df3..d4fd680be3b0 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -709,7 +709,6 @@ static bool buffer_migrate_lock_buffers(struct buffer_head *head,
         /* Simple case, sync compaction */
         if (mode != MIGRATE_ASYNC) {
                 do {
-                        get_bh(bh);
                         lock_buffer(bh);
                         bh = bh->b_this_page;
 
@@ -720,18 +719,15 @@ static bool buffer_migrate_lock_buffers(struct buffer_head *head,
 
         /* async case, we cannot block on lock_buffer so use trylock_buffer */
         do {
-                get_bh(bh);
                 if (!trylock_buffer(bh)) {
                         /*
                          * We failed to lock the buffer and cannot stall in
                          * async migration. Release the taken locks
                          */
                         struct buffer_head *failed_bh = bh;
-                        put_bh(failed_bh);
                         bh = head;
                         while (bh != failed_bh) {
                                 unlock_buffer(bh);
-                                put_bh(bh);
                                 bh = bh->b_this_page;
                         }
                         return false;
@@ -818,7 +814,6 @@ unlock_buffers:
         bh = head;
         do {
                 unlock_buffer(bh);
-                put_bh(bh);
                 bh = bh->b_this_page;
 
         } while (bh != head);
@@ -1135,10 +1130,13 @@ out:
          * If migration is successful, decrease refcount of the newpage
          * which will not free the page because new page owner increased
          * refcounter. As well, if it is LRU page, add the page to LRU
-         * list in here.
+         * list in here. Use the old state of the isolated source page to
+         * determine if we migrated a LRU page. newpage was already unlocked
+         * and possibly modified by its owner - don't rely on the page
+         * state.
          */
         if (rc == MIGRATEPAGE_SUCCESS) {
-                if (unlikely(__PageMovable(newpage)))
+                if (unlikely(!is_lru))
                         put_page(newpage);
                 else
                         putback_lru_page(newpage);
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index f0e8cd9edb1a..26ea8636758f 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -647,8 +647,8 @@ static int oom_reaper(void *unused)
 
 static void wake_oom_reaper(struct task_struct *tsk)
 {
-        /* tsk is already queued? */
-        if (tsk == oom_reaper_list || tsk->oom_reaper_list)
+        /* mm is already queued? */
+        if (test_and_set_bit(MMF_OOM_REAP_QUEUED, &tsk->signal->oom_mm->flags))
                 return;
 
         get_task_struct(tsk);
@@ -975,6 +975,13 @@ static void oom_kill_process(struct oom_control *oc, const char *message)
          * still freeing memory.
          */
         read_lock(&tasklist_lock);
+
+        /*
+         * The task 'p' might have already exited before reaching here. The
+         * put_task_struct() will free task_struct 'p' while the loop still try
+         * to access the field of 'p', so, get an extra reference.
+         */
+        get_task_struct(p);
         for_each_thread(p, t) {
                 list_for_each_entry(child, &t->children, sibling) {
                         unsigned int child_points;
@@ -994,6 +1001,7 @@ static void oom_kill_process(struct oom_control *oc, const char *message)
                         }
                 }
         }
+        put_task_struct(p);
         read_unlock(&tasklist_lock);
 
         /*
diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
index 7b80f6f8d4dc..a9b7919c9de5 100644
--- a/net/batman-adv/bat_v_elp.c
+++ b/net/batman-adv/bat_v_elp.c
@@ -104,6 +104,9 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh)
 
                 ret = cfg80211_get_station(real_netdev, neigh->addr, &sinfo);
 
+                /* free the TID stats immediately */
+                cfg80211_sinfo_release_content(&sinfo);
+
                 dev_put(real_netdev);
                 if (ret == -ENOENT) {
                         /* Node is not associated anymore! It would be
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index 28c1fb8d1af0..96ef7c70b4d9 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -20,7 +20,6 @@
 #include "main.h"
 
 #include <linux/atomic.h>
-#include <linux/bug.h>
 #include <linux/byteorder/generic.h>
 #include <linux/errno.h>
 #include <linux/gfp.h>
@@ -179,8 +178,10 @@ static bool batadv_is_on_batman_iface(const struct net_device *net_dev)
         parent_dev = __dev_get_by_index((struct net *)parent_net,
                                         dev_get_iflink(net_dev));
         /* if we got a NULL parent_dev there is something broken.. */
-        if (WARN(!parent_dev, "Cannot find parent device"))
+        if (!parent_dev) {
+                pr_err("Cannot find parent device\n");
                 return false;
+        }
 
         if (batadv_mutual_parents(net_dev, net, parent_dev, parent_net))
                 return false;
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index b14fb3462af7..93a5975c21a4 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -222,6 +222,8 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
 
         netif_trans_update(soft_iface);
         vid = batadv_get_vid(skb, 0);
+
+        skb_reset_mac_header(skb);
         ethhdr = eth_hdr(skb);
 
         proto = ethhdr->h_proto;
diff --git a/net/core/filter.c b/net/core/filter.c
index 3a49f68eda10..b5a002d7b263 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4112,10 +4112,12 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
                 /* Only some socketops are supported */
                 switch (optname) {
                 case SO_RCVBUF:
+                        val = min_t(u32, val, sysctl_rmem_max);
                         sk->sk_userlocks |= SOCK_RCVBUF_LOCK;
                         sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF);
                         break;
                 case SO_SNDBUF:
+                        val = min_t(u32, val, sysctl_wmem_max);
                         sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
                         sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF);
                         break;
diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index e76ed8df9f13..ae6f06e45737 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -554,8 +554,7 @@ static void sk_psock_destroy_deferred(struct work_struct *gc)
         struct sk_psock *psock = container_of(gc, struct sk_psock, gc);
 
         /* No sk_callback_lock since already detached. */
-        if (psock->parser.enabled)
-                strp_done(&psock->parser.strp);
+        strp_done(&psock->parser.strp);
 
         cancel_work_sync(&psock->work);
 
diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
index 6eb837a47b5c..baaaeb2b2c42 100644
--- a/net/dccp/ccid.h
+++ b/net/dccp/ccid.h
@@ -202,7 +202,7 @@ static inline void ccid_hc_tx_packet_recv(struct ccid *ccid, struct sock *sk,
 static inline int ccid_hc_tx_parse_options(struct ccid *ccid, struct sock *sk,
                                            u8 pkt, u8 opt, u8 *val, u8 len)
 {
-        if (ccid->ccid_ops->ccid_hc_tx_parse_options == NULL)
+        if (!ccid || !ccid->ccid_ops->ccid_hc_tx_parse_options)
                 return 0;
         return ccid->ccid_ops->ccid_hc_tx_parse_options(sk, pkt, opt, val, len);
 }
@@ -214,7 +214,7 @@ static inline int ccid_hc_tx_parse_options(struct ccid *ccid, struct sock *sk,
 static inline int ccid_hc_rx_parse_options(struct ccid *ccid, struct sock *sk,
                                            u8 pkt, u8 opt, u8 *val, u8 len)
 {
-        if (ccid->ccid_ops->ccid_hc_rx_parse_options == NULL)
+        if (!ccid || !ccid->ccid_ops->ccid_hc_rx_parse_options)
                 return 0;
         return ccid->ccid_ops->ccid_hc_rx_parse_options(sk, pkt, opt, val, len);
 }
diff --git a/net/dsa/master.c b/net/dsa/master.c
index 79e97d2f2d9b..c58f33931be1 100644
--- a/net/dsa/master.c
+++ b/net/dsa/master.c
@@ -248,6 +248,8 @@ static void dsa_master_reset_mtu(struct net_device *dev)
         rtnl_unlock();
 }
 
+static struct lock_class_key dsa_master_addr_list_lock_key;
+
 int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
 {
         int ret;
@@ -261,6 +263,8 @@ int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
         wmb();
 
         dev->dsa_ptr = cpu_dp;
+        lockdep_set_class(&dev->addr_list_lock,
+                          &dsa_master_addr_list_lock_key);
 
         ret = dsa_master_ethtool_setup(dev);
         if (ret)
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 70395a0ae52e..2e5e7c04821b 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -140,11 +140,14 @@ static int dsa_slave_close(struct net_device *dev)
 static void dsa_slave_change_rx_flags(struct net_device *dev, int change)
 {
         struct net_device *master = dsa_slave_to_master(dev);
-
-        if (change & IFF_ALLMULTI)
-                dev_set_allmulti(master, dev->flags & IFF_ALLMULTI ? 1 : -1);
-        if (change & IFF_PROMISC)
-                dev_set_promiscuity(master, dev->flags & IFF_PROMISC ? 1 : -1);
+        if (dev->flags & IFF_UP) {
+                if (change & IFF_ALLMULTI)
+                        dev_set_allmulti(master,
+                                         dev->flags & IFF_ALLMULTI ? 1 : -1);
+                if (change & IFF_PROMISC)
+                        dev_set_promiscuity(master,
+                                            dev->flags & IFF_PROMISC ? 1 : -1);
+        }
 }
 
 static void dsa_slave_set_rx_mode(struct net_device *dev)
@@ -644,7 +647,7 @@ static int dsa_slave_set_eee(struct net_device *dev, struct ethtool_eee *e)
         int ret;
 
         /* Port's PHY and MAC both need to be EEE capable */
-        if (!dev->phydev && !dp->pl)
+        if (!dev->phydev || !dp->pl)
                 return -ENODEV;
 
         if (!ds->ops->set_mac_eee)
@@ -664,7 +667,7 @@ static int dsa_slave_get_eee(struct net_device *dev, struct ethtool_eee *e)
         int ret;
 
         /* Port's PHY and MAC both need to be EEE capable */
-        if (!dev->phydev && !dp->pl)
+        if (!dev->phydev || !dp->pl)
                 return -ENODEV;
 
         if (!ds->ops->get_mac_eee)
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index d1cef66820d3..ccee9411dae1 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1381,12 +1381,17 @@ static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
 {
         struct ip_tunnel *t = netdev_priv(dev);
         struct ip_tunnel_parm *p = &t->parms;
+        __be16 o_flags = p->o_flags;
+
+        if ((t->erspan_ver == 1 || t->erspan_ver == 2) &&
+            !t->collect_md)
+                o_flags |= TUNNEL_KEY;
 
         if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
             nla_put_be16(skb, IFLA_GRE_IFLAGS,
                          gre_tnl_flags_to_gre_flags(p->i_flags)) ||
             nla_put_be16(skb, IFLA_GRE_OFLAGS,
-                         gre_tnl_flags_to_gre_flags(p->o_flags)) ||
+                         gre_tnl_flags_to_gre_flags(o_flags)) ||
             nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) ||
             nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) ||
             nla_put_in_addr(skb, IFLA_GRE_LOCAL, p->iph.saddr) ||
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index e081e69d534e..65a4f96dc462 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -2098,12 +2098,17 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
         struct __ip6_tnl_parm *p = &t->parms;
+        __be16 o_flags = p->o_flags;
+
+        if ((p->erspan_ver == 1 || p->erspan_ver == 2) &&
+            !p->collect_md)
+                o_flags |= TUNNEL_KEY;
 
         if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
             nla_put_be16(skb, IFLA_GRE_IFLAGS,
                          gre_tnl_flags_to_gre_flags(p->i_flags)) ||
             nla_put_be16(skb, IFLA_GRE_OFLAGS,
-                         gre_tnl_flags_to_gre_flags(p->o_flags)) ||
+                         gre_tnl_flags_to_gre_flags(o_flags)) ||
             nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) ||
             nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) ||
             nla_put_in6_addr(skb, IFLA_GRE_LOCAL, &p->laddr) ||
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 8b075f0bc351..6d0b1f3e927b 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -23,9 +23,11 @@ int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
         struct sock *sk = sk_to_full_sk(skb->sk);
         unsigned int hh_len;
         struct dst_entry *dst;
+        int strict = (ipv6_addr_type(&iph->daddr) &
+                      (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL));
         struct flowi6 fl6 = {
                 .flowi6_oif = sk && sk->sk_bound_dev_if ? sk->sk_bound_dev_if :
-                        rt6_need_strict(&iph->daddr) ? skb_dst(skb)->dev->ifindex : 0,
+                        strict ? skb_dst(skb)->dev->ifindex : 0,
                 .flowi6_mark = skb->mark,
                 .flowi6_uid = sock_net_uid(net, sk),
                 .daddr = iph->daddr,
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index 8181ee7e1e27..ee5403cbe655 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -146,6 +146,8 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
         } else {
                 ip6_flow_hdr(hdr, 0, flowlabel);
                 hdr->hop_limit = ip6_dst_hoplimit(skb_dst(skb));
+
+                memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
         }
 
         hdr->nexthdr = NEXTHDR_ROUTING;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 1e03305c0549..e8a1dabef803 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -546,7 +546,8 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
         }
 
         err = 0;
-        if (!ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4, type, data_len))
+        if (__in6_dev_get(skb->dev) &&
+            !ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4, type, data_len))
                 goto out;
 
         if (t->parms.iph.daddr == 0)
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 26f1d435696a..fed6becc5daf 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -83,8 +83,7 @@
 #define L2TP_SLFLAG_S      0x40000000
 #define L2TP_SL_SEQ_MASK   0x00ffffff
 
-#define L2TP_HDR_SIZE_SEQ               10
-#define L2TP_HDR_SIZE_NOSEQ             6
+#define L2TP_HDR_SIZE_MAX               14
 
 /* Default trace flags */
 #define L2TP_DEFAULT_DEBUG_FLAGS        0
@@ -808,7 +807,7 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb)
         __skb_pull(skb, sizeof(struct udphdr));
 
         /* Short packet? */
-        if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) {
+        if (!pskb_may_pull(skb, L2TP_HDR_SIZE_MAX)) {
                 l2tp_info(tunnel, L2TP_MSG_DATA,
                           "%s: recv short packet (len=%d)\n",
                           tunnel->name, skb->len);
@@ -884,6 +883,10 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb)
                 goto error;
         }
 
+        if (tunnel->version == L2TP_HDR_VER_3 &&
+            l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr))
+                goto error;
+
         l2tp_recv_common(session, skb, ptr, optr, hdrflags, length);
         l2tp_session_dec_refcount(session);
 
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 9c9afe94d389..b2ce90260c35 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -301,6 +301,26 @@ static inline bool l2tp_tunnel_uses_xfrm(const struct l2tp_tunnel *tunnel)
 }
 #endif
 
+static inline int l2tp_v3_ensure_opt_in_linear(struct l2tp_session *session, struct sk_buff *skb,
+                                               unsigned char **ptr, unsigned char **optr)
+{
+        int opt_len = session->peer_cookie_len + l2tp_get_l2specific_len(session);
+
+        if (opt_len > 0) {
+                int off = *ptr - *optr;
+
+                if (!pskb_may_pull(skb, off + opt_len))
+                        return -1;
+
+                if (skb->data != *optr) {
+                        *optr = skb->data;
+                        *ptr = skb->data + off;
+                }
+        }
+
+        return 0;
+}
+
 #define l2tp_printk(ptr, type, func, fmt, ...)                          \
 do {                                                                    \
         if (((ptr)->debug) & (type))                                    \
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 35f6f86d4dcc..d4c60523c549 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -165,6 +165,9 @@ static int l2tp_ip_recv(struct sk_buff *skb)
                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
         }
 
+        if (l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr))
+                goto discard_sess;
+
         l2tp_recv_common(session, skb, ptr, optr, 0, skb->len);
         l2tp_session_dec_refcount(session);
 
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 237f1a4a0b0c..0ae6899edac0 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -178,6 +178,9 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
         }
 
+        if (l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr))
+                goto discard_sess;
+
         l2tp_recv_common(session, skb, ptr, optr, 0, skb->len);
         l2tp_session_dec_refcount(session);
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 61c7ea9de2cc..8a49a74c0a37 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1945,9 +1945,16 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
                                 int head_need, bool may_encrypt)
 {
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_hdr *hdr;
+        bool enc_tailroom;
         int tail_need = 0;
 
-        if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) {
+        hdr = (struct ieee80211_hdr *) skb->data;
+        enc_tailroom = may_encrypt &&
+                       (sdata->crypto_tx_tailroom_needed_cnt ||
+                        ieee80211_is_mgmt(hdr->frame_control));
+
+        if (enc_tailroom) {
                 tail_need = IEEE80211_ENCRYPT_TAILROOM;
                 tail_need -= skb_tailroom(skb);
                 tail_need = max_t(int, tail_need, 0);
@@ -1955,8 +1962,7 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
 
         if (skb_cloned(skb) &&
             (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) ||
-             !skb_clone_writable(skb, ETH_HLEN) ||
-             (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt)))
+             !skb_clone_writable(skb, ETH_HLEN) || enc_tailroom))
                 I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
         else if (head_need || tail_need)
                 I802_DEBUG_INC(local->tx_expand_skb_head);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 815956ac5a76..08ee03407ace 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1042,6 +1042,22 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
                 }
 
                 if (nf_ct_key_equal(h, tuple, zone, net)) {
+                        /* Tuple is taken already, so caller will need to find
+                         * a new source port to use.
+                         *
+                         * Only exception:
+                         * If the *original tuples* are identical, then both
+                         * conntracks refer to the same flow.
+                         * This is a rare situation, it can occur e.g. when
+                         * more than one UDP packet is sent from same socket
+                         * in different threads.
+                         *
+                         * Let nf_ct_resolve_clash() deal with this later.
+                         */
+                        if (nf_ct_tuple_equal(&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+                                              &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple))
+                                continue;
+
                         NF_CT_STAT_INC_ATOMIC(net, found);
                         rcu_read_unlock();
                         return 1;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index e92bedd09cde..5ca5ec8f3cf0 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -131,6 +131,23 @@ static void nft_trans_destroy(struct nft_trans *trans)
         kfree(trans);
 }
 
+static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
+{
+        struct net *net = ctx->net;
+        struct nft_trans *trans;
+
+        if (!nft_set_is_anonymous(set))
+                return;
+
+        list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
+                if (trans->msg_type == NFT_MSG_NEWSET &&
+                    nft_trans_set(trans) == set) {
+                        nft_trans_set_bound(trans) = true;
+                        break;
+                }
+        }
+}
+
 static int nf_tables_register_hook(struct net *net,
                                    const struct nft_table *table,
                                    struct nft_chain *chain)
@@ -226,18 +243,6 @@ static int nft_delchain(struct nft_ctx *ctx)
         return err;
 }
 
-/* either expr ops provide both activate/deactivate, or neither */
-static bool nft_expr_check_ops(const struct nft_expr_ops *ops)
-{
-        if (!ops)
-                return true;
-
-        if (WARN_ON_ONCE((!ops->activate ^ !ops->deactivate)))
-                return false;
-
-        return true;
-}
-
 static void nft_rule_expr_activate(const struct nft_ctx *ctx,
                                    struct nft_rule *rule)
 {
@@ -253,14 +258,15 @@ static void nft_rule_expr_activate(const struct nft_ctx *ctx,
 }
 
 static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
-                                     struct nft_rule *rule)
+                                     struct nft_rule *rule,
+                                     enum nft_trans_phase phase)
 {
         struct nft_expr *expr;
 
         expr = nft_expr_first(rule);
         while (expr != nft_expr_last(rule) && expr->ops) {
                 if (expr->ops->deactivate)
-                        expr->ops->deactivate(ctx, expr);
+                        expr->ops->deactivate(ctx, expr, phase);
 
                 expr = nft_expr_next(expr);
         }
@@ -311,7 +317,7 @@ static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
                 nft_trans_destroy(trans);
                 return err;
         }
-        nft_rule_expr_deactivate(ctx, rule);
+        nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE);
 
         return 0;
 }
@@ -1972,9 +1978,6 @@ static int nf_tables_delchain(struct net *net, struct sock *nlsk,
  */
 int nft_register_expr(struct nft_expr_type *type)
 {
-        if (!nft_expr_check_ops(type->ops))
-                return -EINVAL;
-
         nfnl_lock(NFNL_SUBSYS_NFTABLES);
         if (type->family == NFPROTO_UNSPEC)
                 list_add_tail_rcu(&type->list, &nf_tables_expressions);
@@ -2122,10 +2125,6 @@ static int nf_tables_expr_parse(const struct nft_ctx *ctx,
                         err = PTR_ERR(ops);
                         goto err1;
                 }
-                if (!nft_expr_check_ops(ops)) {
-                        err = -EINVAL;
-                        goto err1;
-                }
         } else
                 ops = type->ops;
 
@@ -2554,7 +2553,7 @@ static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
 static void nf_tables_rule_release(const struct nft_ctx *ctx,
                                    struct nft_rule *rule)
 {
-        nft_rule_expr_deactivate(ctx, rule);
+        nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE);
         nf_tables_rule_destroy(ctx, rule);
 }
 
@@ -3760,39 +3759,30 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
 bind:
         binding->chain = ctx->chain;
         list_add_tail_rcu(&binding->list, &set->bindings);
+        nft_set_trans_bind(ctx, set);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(nf_tables_bind_set);
 
-void nf_tables_rebind_set(const struct nft_ctx *ctx, struct nft_set *set,
-                          struct nft_set_binding *binding)
-{
-        if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
-            nft_is_active(ctx->net, set))
-                list_add_tail_rcu(&set->list, &ctx->table->sets);
-
-        list_add_tail_rcu(&binding->list, &set->bindings);
-}
-EXPORT_SYMBOL_GPL(nf_tables_rebind_set);
-
 void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
-                          struct nft_set_binding *binding)
+                          struct nft_set_binding *binding, bool event)
 {
         list_del_rcu(&binding->list);
 
-        if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
-            nft_is_active(ctx->net, set))
+        if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) {
                 list_del_rcu(&set->list);
+                if (event)
+                        nf_tables_set_notify(ctx, set, NFT_MSG_DELSET,
+                                             GFP_KERNEL);
+        }
 }
 EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
 
 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set)
 {
-        if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
-            nft_is_active(ctx->net, set)) {
-                nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
+        if (list_empty(&set->bindings) && nft_set_is_anonymous(set))
                 nft_set_destroy(set);
-        }
 }
 EXPORT_SYMBOL_GPL(nf_tables_destroy_set);
 
@@ -6621,6 +6611,9 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
                         nf_tables_rule_notify(&trans->ctx,
                                               nft_trans_rule(trans),
                                               NFT_MSG_DELRULE);
+                        nft_rule_expr_deactivate(&trans->ctx,
+                                                 nft_trans_rule(trans),
+                                                 NFT_TRANS_COMMIT);
                         break;
                 case NFT_MSG_NEWSET:
                         nft_clear(net, nft_trans_set(trans));
@@ -6707,7 +6700,8 @@ static void nf_tables_abort_release(struct nft_trans *trans)
                 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
                 break;
         case NFT_MSG_NEWSET:
-                nft_set_destroy(nft_trans_set(trans));
+                if (!nft_trans_set_bound(trans))
+                        nft_set_destroy(nft_trans_set(trans));
                 break;
         case NFT_MSG_NEWSETELEM:
                 nft_set_elem_destroy(nft_trans_elem_set(trans),
@@ -6768,7 +6762,9 @@ static int __nf_tables_abort(struct net *net)
                 case NFT_MSG_NEWRULE:
                         trans->ctx.chain->use--;
                         list_del_rcu(&nft_trans_rule(trans)->list);
-                        nft_rule_expr_deactivate(&trans->ctx, nft_trans_rule(trans));
+                        nft_rule_expr_deactivate(&trans->ctx,
+                                                 nft_trans_rule(trans),
+                                                 NFT_TRANS_ABORT);
                         break;
                 case NFT_MSG_DELRULE:
                         trans->ctx.chain->use++;
@@ -6778,7 +6774,8 @@ static int __nf_tables_abort(struct net *net)
                         break;
                 case NFT_MSG_NEWSET:
                         trans->ctx.table->use--;
-                        list_del_rcu(&nft_trans_set(trans)->list);
+                        if (!nft_trans_set_bound(trans))
+                                list_del_rcu(&nft_trans_set(trans)->list);
                         break;
                 case NFT_MSG_DELSET:
                         trans->ctx.table->use++;
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 5eb269428832..fe64df848365 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -61,6 +61,21 @@ static struct nft_compat_net *nft_compat_pernet(struct net *net)
         return net_generic(net, nft_compat_net_id);
 }
 
+static void nft_xt_get(struct nft_xt *xt)
+{
+        /* refcount_inc() warns on 0 -> 1 transition, but we can't
+         * init the reference count to 1 in .select_ops -- we can't
+         * undo such an increase when another expression inside the same
+         * rule fails afterwards.
+         */
+        if (xt->listcnt == 0)
+                refcount_set(&xt->refcnt, 1);
+        else
+                refcount_inc(&xt->refcnt);
+
+        xt->listcnt++;
+}
+
 static bool nft_xt_put(struct nft_xt *xt)
 {
         if (refcount_dec_and_test(&xt->refcnt)) {
@@ -291,7 +306,7 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
                 return -EINVAL;
 
         nft_xt = container_of(expr->ops, struct nft_xt, ops);
-        refcount_inc(&nft_xt->refcnt);
+        nft_xt_get(nft_xt);
         return 0;
 }
 
@@ -504,7 +519,7 @@ __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
                 return ret;
 
         nft_xt = container_of(expr->ops, struct nft_xt, ops);
-        refcount_inc(&nft_xt->refcnt);
+        nft_xt_get(nft_xt);
         return 0;
 }
 
@@ -558,41 +573,16 @@ nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
         __nft_match_destroy(ctx, expr, nft_expr_priv(expr));
 }
 
-static void nft_compat_activate(const struct nft_ctx *ctx,
-                                const struct nft_expr *expr,
-                                struct list_head *h)
-{
-        struct nft_xt *xt = container_of(expr->ops, struct nft_xt, ops);
-
-        if (xt->listcnt == 0)
-                list_add(&xt->head, h);
-
-        xt->listcnt++;
-}
-
-static void nft_compat_activate_mt(const struct nft_ctx *ctx,
-                                   const struct nft_expr *expr)
-{
-        struct nft_compat_net *cn = nft_compat_pernet(ctx->net);
-
-        nft_compat_activate(ctx, expr, &cn->nft_match_list);
-}
-
-static void nft_compat_activate_tg(const struct nft_ctx *ctx,
-                                   const struct nft_expr *expr)
-{
-        struct nft_compat_net *cn = nft_compat_pernet(ctx->net);
-
-        nft_compat_activate(ctx, expr, &cn->nft_target_list);
-}
-
 static void nft_compat_deactivate(const struct nft_ctx *ctx,
-                                  const struct nft_expr *expr)
+                                  const struct nft_expr *expr,
+                                  enum nft_trans_phase phase)
 {
         struct nft_xt *xt = container_of(expr->ops, struct nft_xt, ops);
 
-        if (--xt->listcnt == 0)
-                list_del_init(&xt->head);
+        if (phase == NFT_TRANS_ABORT || phase == NFT_TRANS_COMMIT) {
+                if (--xt->listcnt == 0)
+                        list_del_init(&xt->head);
+        }
 }
 
 static void
@@ -848,7 +838,6 @@ nft_match_select_ops(const struct nft_ctx *ctx,
         nft_match->ops.eval = nft_match_eval;
         nft_match->ops.init = nft_match_init;
         nft_match->ops.destroy = nft_match_destroy;
-        nft_match->ops.activate = nft_compat_activate_mt;
         nft_match->ops.deactivate = nft_compat_deactivate;
         nft_match->ops.dump = nft_match_dump;
         nft_match->ops.validate = nft_match_validate;
@@ -866,7 +855,7 @@ nft_match_select_ops(const struct nft_ctx *ctx,
 
         nft_match->ops.size = matchsize;
 
-        nft_match->listcnt = 1;
+        nft_match->listcnt = 0;
         list_add(&nft_match->head, &cn->nft_match_list);
 
         return &nft_match->ops;
@@ -953,7 +942,6 @@ nft_target_select_ops(const struct nft_ctx *ctx,
         nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));
         nft_target->ops.init = nft_target_init;
         nft_target->ops.destroy = nft_target_destroy;
-        nft_target->ops.activate = nft_compat_activate_tg;
         nft_target->ops.deactivate = nft_compat_deactivate;
         nft_target->ops.dump = nft_target_dump;
         nft_target->ops.validate = nft_target_validate;
@@ -964,7 +952,7 @@ nft_target_select_ops(const struct nft_ctx *ctx,
         else
                 nft_target->ops.eval = nft_target_eval_xt;
 
-        nft_target->listcnt = 1;
+        nft_target->listcnt = 0;
         list_add(&nft_target->head, &cn->nft_target_list);
 
         return &nft_target->ops;
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 9658493d37d4..a8a74a16f9c4 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -234,20 +234,17 @@ err1:
         return err;
 }
 
-static void nft_dynset_activate(const struct nft_ctx *ctx,
-                                const struct nft_expr *expr)
-{
-        struct nft_dynset *priv = nft_expr_priv(expr);
-
-        nf_tables_rebind_set(ctx, priv->set, &priv->binding);
-}
-
 static void nft_dynset_deactivate(const struct nft_ctx *ctx,
-                                  const struct nft_expr *expr)
+                                  const struct nft_expr *expr,
+                                  enum nft_trans_phase phase)
 {
         struct nft_dynset *priv = nft_expr_priv(expr);
 
-        nf_tables_unbind_set(ctx, priv->set, &priv->binding);
+        if (phase == NFT_TRANS_PREPARE)
+                return;
+
+        nf_tables_unbind_set(ctx, priv->set, &priv->binding,
+                             phase == NFT_TRANS_COMMIT);
 }
 
 static void nft_dynset_destroy(const struct nft_ctx *ctx,
@@ -295,7 +292,6 @@ static const struct nft_expr_ops nft_dynset_ops = {
         .eval           = nft_dynset_eval,
         .init           = nft_dynset_init,
         .destroy        = nft_dynset_destroy,
-        .activate       = nft_dynset_activate,
         .deactivate     = nft_dynset_deactivate,
         .dump           = nft_dynset_dump,
 };
diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index 3e5ed787b1d4..5ec43124cbca 100644
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -72,10 +72,14 @@ static void nft_immediate_activate(const struct nft_ctx *ctx,
 }
 
 static void nft_immediate_deactivate(const struct nft_ctx *ctx,
-                                     const struct nft_expr *expr)
+                                     const struct nft_expr *expr,
+                                     enum nft_trans_phase phase)
 {
         const struct nft_immediate_expr *priv = nft_expr_priv(expr);
 
+        if (phase == NFT_TRANS_COMMIT)
+                return;
+
         return nft_data_release(&priv->data, nft_dreg_to_type(priv->dreg));
 }
 
diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
index 227b2b15a19c..14496da5141d 100644
--- a/net/netfilter/nft_lookup.c
+++ b/net/netfilter/nft_lookup.c
@@ -121,20 +121,17 @@ static int nft_lookup_init(const struct nft_ctx *ctx,
         return 0;
 }
 
-static void nft_lookup_activate(const struct nft_ctx *ctx,
-                                const struct nft_expr *expr)
-{
-        struct nft_lookup *priv = nft_expr_priv(expr);
-
-        nf_tables_rebind_set(ctx, priv->set, &priv->binding);
-}
-
 static void nft_lookup_deactivate(const struct nft_ctx *ctx,
-                                  const struct nft_expr *expr)
+                                  const struct nft_expr *expr,
+                                  enum nft_trans_phase phase)
 {
         struct nft_lookup *priv = nft_expr_priv(expr);
 
-        nf_tables_unbind_set(ctx, priv->set, &priv->binding);
+        if (phase == NFT_TRANS_PREPARE)
+                return;
+
+        nf_tables_unbind_set(ctx, priv->set, &priv->binding,
+                             phase == NFT_TRANS_COMMIT);
 }
 
 static void nft_lookup_destroy(const struct nft_ctx *ctx,
@@ -225,7 +222,6 @@ static const struct nft_expr_ops nft_lookup_ops = {
         .size           = NFT_EXPR_SIZE(sizeof(struct nft_lookup)),
         .eval           = nft_lookup_eval,
         .init           = nft_lookup_init,
-        .activate       = nft_lookup_activate,
         .deactivate     = nft_lookup_deactivate,
         .destroy        = nft_lookup_destroy,
         .dump           = nft_lookup_dump,
diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
index c1f2adf198a0..79ef074c18ca 100644
--- a/net/netfilter/nft_objref.c
+++ b/net/netfilter/nft_objref.c
@@ -156,20 +156,17 @@ nla_put_failure:
         return -1;
 }
 
-static void nft_objref_map_activate(const struct nft_ctx *ctx,
-                                    const struct nft_expr *expr)
-{
-        struct nft_objref_map *priv = nft_expr_priv(expr);
-
-        nf_tables_rebind_set(ctx, priv->set, &priv->binding);
-}
-
 static void nft_objref_map_deactivate(const struct nft_ctx *ctx,
-                                      const struct nft_expr *expr)
+                                      const struct nft_expr *expr,
+                                      enum nft_trans_phase phase)
 {
         struct nft_objref_map *priv = nft_expr_priv(expr);
 
-        nf_tables_unbind_set(ctx, priv->set, &priv->binding);
+        if (phase == NFT_TRANS_PREPARE)
+                return;
+
+        nf_tables_unbind_set(ctx, priv->set, &priv->binding,
+                             phase == NFT_TRANS_COMMIT);
 }
 
 static void nft_objref_map_destroy(const struct nft_ctx *ctx,
@@ -186,7 +183,6 @@ static const struct nft_expr_ops nft_objref_map_ops = {
         .size           = NFT_EXPR_SIZE(sizeof(struct nft_objref_map)),
         .eval           = nft_objref_map_eval,
         .init           = nft_objref_map_init,
-        .activate       = nft_objref_map_activate,
         .deactivate     = nft_objref_map_deactivate,
         .destroy        = nft_objref_map_destroy,
         .dump           = nft_objref_map_dump,
diff --git a/net/rds/bind.c b/net/rds/bind.c
index 762d2c6788a3..17c9d9f0c848 100644
--- a/net/rds/bind.c
+++ b/net/rds/bind.c
@@ -78,10 +78,10 @@ struct rds_sock *rds_find_bound(const struct in6_addr *addr, __be16 port,
         __rds_create_bind_key(key, addr, port, scope_id);
         rcu_read_lock();
         rs = rhashtable_lookup(&bind_hash_table, key, ht_parms);
-        if (rs && !sock_flag(rds_rs_to_sk(rs), SOCK_DEAD))
-                rds_sock_addref(rs);
-        else
+        if (rs && (sock_flag(rds_rs_to_sk(rs), SOCK_DEAD) ||
+                   !refcount_inc_not_zero(&rds_rs_to_sk(rs)->sk_refcnt)))
                 rs = NULL;
+
         rcu_read_unlock();
 
         rdsdebug("returning rs %p for %pI6c:%u\n", rs, addr,
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index eaf19ebaa964..3f7bb11f3290 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -596,6 +596,7 @@ error_requeue_call:
         }
 error_no_call:
         release_sock(&rx->sk);
+error_trace:
         trace_rxrpc_recvmsg(call, rxrpc_recvmsg_return, 0, 0, 0, ret);
         return ret;
 
@@ -604,7 +605,7 @@ wait_interrupted:
 wait_error:
         finish_wait(sk_sleep(&rx->sk), &wait);
         call = NULL;
-        goto error_no_call;
+        goto error_trace;
 }
 
 /**
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index c5d1db3a3db7..6a341287a527 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -1385,7 +1385,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
         if (!tc_skip_hw(fnew->flags)) {
                 err = fl_hw_replace_filter(tp, fnew, extack);
                 if (err)
-                        goto errout_mask;
+                        goto errout_mask_ht;
         }
 
         if (!tc_in_hw(fnew->flags))
@@ -1415,6 +1415,10 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
         kfree(mask);
         return 0;
 
+errout_mask_ht:
+        rhashtable_remove_fast(&fnew->mask->ht, &fnew->ht_node,
+                               fnew->mask->filter_ht_params);
+
 errout_mask:
         fl_mask_put(head, fnew->mask, false);
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9644bdc8e85c..a78e55a1bb9c 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2027,7 +2027,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
         struct sctp_endpoint *ep = sctp_sk(sk)->ep;
         struct sctp_transport *transport = NULL;
         struct sctp_sndrcvinfo _sinfo, *sinfo;
-        struct sctp_association *asoc;
+        struct sctp_association *asoc, *tmp;
         struct sctp_cmsgs cmsgs;
         union sctp_addr *daddr;
         bool new = false;
@@ -2053,7 +2053,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
 
         /* SCTP_SENDALL process */
         if ((sflags & SCTP_SENDALL) && sctp_style(sk, UDP)) {
-                list_for_each_entry(asoc, &ep->asocs, asocs) {
+                list_for_each_entry_safe(asoc, tmp, &ep->asocs, asocs) {
                         err = sctp_sendmsg_check_sflags(asoc, sflags, msg,
                                                         msg_len);
                         if (err == 0)
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 80e0ae5534ec..f24633114dfd 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -84,6 +84,19 @@ static void fa_zero(struct flex_array *fa, size_t index, size_t count)
         }
 }
 
+static size_t fa_index(struct flex_array *fa, void *elem, size_t count)
+{
+        size_t index = 0;
+
+        while (count--) {
+                if (elem == flex_array_get(fa, index))
+                        break;
+                index++;
+        }
+
+        return index;
+}
+
 /* Migrates chunks from stream queues to new stream queues if needed,
  * but not across associations. Also, removes those chunks to streams
  * higher than the new max.
@@ -147,6 +160,13 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
 
         if (stream->out) {
                 fa_copy(out, stream->out, 0, min(outcnt, stream->outcnt));
+                if (stream->out_curr) {
+                        size_t index = fa_index(stream->out, stream->out_curr,
+                                                stream->outcnt);
+
+                        BUG_ON(index == stream->outcnt);
+                        stream->out_curr = flex_array_get(out, index);
+                }
                 fa_free(stream->out);
         }
 
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 48ea7669161f..46fa9f3016cc 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1523,6 +1523,11 @@ static int smc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
 
         smc = smc_sk(sk);
         lock_sock(sk);
+        if (sk->sk_state == SMC_CLOSED && (sk->sk_shutdown & RCV_SHUTDOWN)) {
+                /* socket was connected before, no more data to read */
+                rc = 0;
+                goto out;
+        }
         if ((sk->sk_state == SMC_INIT) ||
             (sk->sk_state == SMC_LISTEN) ||
             (sk->sk_state == SMC_CLOSED))
@@ -1858,7 +1863,11 @@ static ssize_t smc_splice_read(struct socket *sock, loff_t *ppos,
 
         smc = smc_sk(sk);
         lock_sock(sk);
-
+        if (sk->sk_state == SMC_CLOSED && (sk->sk_shutdown & RCV_SHUTDOWN)) {
+                /* socket was connected before, no more data to read */
+                rc = 0;
+                goto out;
+        }
         if (sk->sk_state == SMC_INIT ||
             sk->sk_state == SMC_LISTEN ||
             sk->sk_state == SMC_CLOSED)
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index db83332ac1c8..a712c9f8699b 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -21,13 +21,6 @@
 
 /********************************** send *************************************/
 
-struct smc_cdc_tx_pend {
-        struct smc_connection   *conn;          /* socket connection */
-        union smc_host_cursor   cursor; /* tx sndbuf cursor sent */
-        union smc_host_cursor   p_cursor;       /* rx RMBE cursor produced */
-        u16                     ctrl_seq;       /* conn. tx sequence # */
-};
-
 /* handler for send/transmission completion of a CDC msg */
 static void smc_cdc_tx_handler(struct smc_wr_tx_pend_priv *pnd_snd,
                                struct smc_link *link,
@@ -61,12 +54,14 @@ static void smc_cdc_tx_handler(struct smc_wr_tx_pend_priv *pnd_snd,
 
 int smc_cdc_get_free_slot(struct smc_connection *conn,
                           struct smc_wr_buf **wr_buf,
+                          struct smc_rdma_wr **wr_rdma_buf,
                           struct smc_cdc_tx_pend **pend)
 {
         struct smc_link *link = &conn->lgr->lnk[SMC_SINGLE_LINK];
         int rc;
 
         rc = smc_wr_tx_get_free_slot(link, smc_cdc_tx_handler, wr_buf,
+                                     wr_rdma_buf,
                                      (struct smc_wr_tx_pend_priv **)pend);
         if (!conn->alert_token_local)
                 /* abnormal termination */
@@ -96,6 +91,7 @@ int smc_cdc_msg_send(struct smc_connection *conn,
                      struct smc_wr_buf *wr_buf,
                      struct smc_cdc_tx_pend *pend)
 {
+        union smc_host_cursor cfed;
         struct smc_link *link;
         int rc;
 
@@ -107,10 +103,10 @@ int smc_cdc_msg_send(struct smc_connection *conn,
         conn->local_tx_ctrl.seqno = conn->tx_cdc_seq;
         smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf,
                             &conn->local_tx_ctrl, conn);
+        smc_curs_copy(&cfed, &((struct smc_host_cdc_msg *)wr_buf)->cons, conn);
         rc = smc_wr_tx_send(link, (struct smc_wr_tx_pend_priv *)pend);
         if (!rc)
-                smc_curs_copy(&conn->rx_curs_confirmed,
-                              &conn->local_tx_ctrl.cons, conn);
+                smc_curs_copy(&conn->rx_curs_confirmed, &cfed, conn);
 
         return rc;
 }
@@ -121,11 +117,14 @@ static int smcr_cdc_get_slot_and_msg_send(struct smc_connection *conn)
         struct smc_wr_buf *wr_buf;
         int rc;
 
-        rc = smc_cdc_get_free_slot(conn, &wr_buf, &pend);
+        rc = smc_cdc_get_free_slot(conn, &wr_buf, NULL, &pend);
         if (rc)
                 return rc;
 
-        return smc_cdc_msg_send(conn, wr_buf, pend);
+        spin_lock_bh(&conn->send_lock);
+        rc = smc_cdc_msg_send(conn, wr_buf, pend);
+        spin_unlock_bh(&conn->send_lock);
+        return rc;
 }
 
 int smc_cdc_get_slot_and_msg_send(struct smc_connection *conn)
diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
index e8c214b992b6..e3b6b367f3b6 100644
--- a/net/smc/smc_cdc.h
+++ b/net/smc/smc_cdc.h
@@ -160,7 +160,9 @@ static inline void smcd_curs_copy(union smcd_cdc_cursor *tgt,
 #endif
 }
 
-/* calculate cursor difference between old and new, where old <= new */
+/* calculate cursor difference between old and new, where old <= new and
+ * difference cannot exceed size
+ */
 static inline int smc_curs_diff(unsigned int size,
                                 union smc_host_cursor *old,
                                 union smc_host_cursor *new)
@@ -185,6 +187,28 @@ static inline int smc_curs_comp(unsigned int size,
         return smc_curs_diff(size, old, new);
 }
 
+/* calculate cursor difference between old and new, where old <= new and
+ * difference may exceed size
+ */
+static inline int smc_curs_diff_large(unsigned int size,
+                                      union smc_host_cursor *old,
+                                      union smc_host_cursor *new)
+{
+        if (old->wrap < new->wrap)
+                return min_t(int,
+                             (size - old->count) + new->count +
+                             (new->wrap - old->wrap - 1) * size,
+                             size);
+
+        if (old->wrap > new->wrap) /* wrap has switched from 0xffff to 0x0000 */
+                return min_t(int,
+                             (size - old->count) + new->count +
+                             (new->wrap + 0xffff - old->wrap) * size,
+                             size);
+
+        return max_t(int, 0, (new->count - old->count));
+}
+
 static inline void smc_host_cursor_to_cdc(union smc_cdc_cursor *peer,
                                           union smc_host_cursor *local,
                                           struct smc_connection *conn)
@@ -271,10 +295,16 @@ static inline void smc_cdc_msg_to_host(struct smc_host_cdc_msg *local,
                 smcr_cdc_msg_to_host(local, peer, conn);
 }
 
-struct smc_cdc_tx_pend;
+struct smc_cdc_tx_pend {
+        struct smc_connection   *conn;          /* socket connection */
+        union smc_host_cursor   cursor;         /* tx sndbuf cursor sent */
+        union smc_host_cursor   p_cursor;       /* rx RMBE cursor produced */
+        u16                     ctrl_seq;       /* conn. tx sequence # */
+};
 
 int smc_cdc_get_free_slot(struct smc_connection *conn,
                           struct smc_wr_buf **wr_buf,
+                          struct smc_rdma_wr **wr_rdma_buf,
                           struct smc_cdc_tx_pend **pend);
 void smc_cdc_tx_dismiss_slots(struct smc_connection *conn);
 int smc_cdc_msg_send(struct smc_connection *conn, struct smc_wr_buf *wr_buf,
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index 776e9dfc915d..d53fd588d1f5 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -378,7 +378,7 @@ int smc_clc_send_decline(struct smc_sock *smc, u32 peer_diag_info)
         vec.iov_len = sizeof(struct smc_clc_msg_decline);
         len = kernel_sendmsg(smc->clcsock, &msg, &vec, 1,
                              sizeof(struct smc_clc_msg_decline));
-        if (len < sizeof(struct smc_clc_msg_decline))
+        if (len < 0 || len < sizeof(struct smc_clc_msg_decline))
                 len = -EPROTO;
         return len > 0 ? 0 : len;
 }
diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
index 0e60dd741698..2ad37e998509 100644
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -345,14 +345,7 @@ static void smc_close_passive_work(struct work_struct *work)
 
         switch (sk->sk_state) {
         case SMC_INIT:
-                if (atomic_read(&conn->bytes_to_rcv) ||
-                    (rxflags->peer_done_writing &&
-                     !smc_cdc_rxed_any_close(conn))) {
-                        sk->sk_state = SMC_APPCLOSEWAIT1;
-                } else {
-                        sk->sk_state = SMC_CLOSED;
-                        sock_put(sk); /* passive closing */
-                }
+                sk->sk_state = SMC_APPCLOSEWAIT1;
                 break;
         case SMC_ACTIVE:
                 sk->sk_state = SMC_APPCLOSEWAIT1;
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index a1a6d351ae1b..349d789a9728 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -127,6 +127,8 @@ static void smc_lgr_unregister_conn(struct smc_connection *conn)
 {
         struct smc_link_group *lgr = conn->lgr;
 
+        if (!lgr)
+                return;
         write_lock_bh(&lgr->conns_lock);
         if (conn->alert_token_local) {
                 __smc_lgr_unregister_conn(conn);
@@ -299,13 +301,13 @@ static void smc_buf_unuse(struct smc_connection *conn,
                 conn->sndbuf_desc->used = 0;
         if (conn->rmb_desc) {
                 if (!conn->rmb_desc->regerr) {
-                        conn->rmb_desc->used = 0;
                         if (!lgr->is_smcd) {
                                 /* unregister rmb with peer */
                                 smc_llc_do_delete_rkey(
                                                 &lgr->lnk[SMC_SINGLE_LINK],
                                                 conn->rmb_desc);
                         }
+                        conn->rmb_desc->used = 0;
                 } else {
                         /* buf registration failed, reuse not possible */
                         write_lock_bh(&lgr->rmbs_lock);
@@ -629,6 +631,8 @@ int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
                         local_contact = SMC_REUSE_CONTACT;
                         conn->lgr = lgr;
                         smc_lgr_register_conn(conn); /* add smc conn to lgr */
+                        if (delayed_work_pending(&lgr->free_work))
+                                cancel_delayed_work(&lgr->free_work);
                         write_unlock_bh(&lgr->conns_lock);
                         break;
                 }
diff --git a/net/smc/smc_core.h b/net/smc/smc_core.h
index b00287989a3d..8806d2afa6ed 100644
--- a/net/smc/smc_core.h
+++ b/net/smc/smc_core.h
@@ -52,6 +52,24 @@ enum smc_wr_reg_state {
         FAILED          /* ib_wr_reg_mr response: failure */
 };
 
+struct smc_rdma_sge {                           /* sges for RDMA writes */
+        struct ib_sge           wr_tx_rdma_sge[SMC_IB_MAX_SEND_SGE];
+};
+
+#define SMC_MAX_RDMA_WRITES     2               /* max. # of RDMA writes per
+                                                 * message send
+                                                 */
+
+struct smc_rdma_sges {                          /* sges per message send */
+        struct smc_rdma_sge     tx_rdma_sge[SMC_MAX_RDMA_WRITES];
+};
+
+struct smc_rdma_wr {                            /* work requests per message
+                                                 * send
+                                                 */
+        struct ib_rdma_wr       wr_tx_rdma[SMC_MAX_RDMA_WRITES];
+};
+
 struct smc_link {
         struct smc_ib_device    *smcibdev;      /* ib-device */
         u8                      ibport;         /* port - values 1 | 2 */
@@ -64,6 +82,8 @@ struct smc_link {
         struct smc_wr_buf       *wr_tx_bufs;    /* WR send payload buffers */
         struct ib_send_wr       *wr_tx_ibs;     /* WR send meta data */
         struct ib_sge           *wr_tx_sges;    /* WR send gather meta data */
+        struct smc_rdma_sges    *wr_tx_rdma_sges;/*RDMA WRITE gather meta data*/
+        struct smc_rdma_wr      *wr_tx_rdmas;   /* WR RDMA WRITE */
         struct smc_wr_tx_pend   *wr_tx_pends;   /* WR send waiting for CQE */
         /* above four vectors have wr_tx_cnt elements and use the same index */
         dma_addr_t              wr_tx_dma_addr; /* DMA address of wr_tx_bufs */
diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
index e519ef29c0ff..76487a16934e 100644
--- a/net/smc/smc_ib.c
+++ b/net/smc/smc_ib.c
@@ -289,8 +289,8 @@ int smc_ib_create_protection_domain(struct smc_link *lnk)
 
 static void smc_ib_qp_event_handler(struct ib_event *ibevent, void *priv)
 {
-        struct smc_ib_device *smcibdev =
-                (struct smc_ib_device *)ibevent->device;
+        struct smc_link *lnk = (struct smc_link *)priv;
+        struct smc_ib_device *smcibdev = lnk->smcibdev;
         u8 port_idx;
 
         switch (ibevent->event) {
@@ -298,7 +298,7 @@ static void smc_ib_qp_event_handler(struct ib_event *ibevent, void *priv)
         case IB_EVENT_GID_CHANGE:
         case IB_EVENT_PORT_ERR:
         case IB_EVENT_QP_ACCESS_ERR:
-                port_idx = ibevent->element.port_num - 1;
+                port_idx = ibevent->element.qp->port - 1;
                 set_bit(port_idx, &smcibdev->port_event_mask);
                 schedule_work(&smcibdev->port_event_work);
                 break;
diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c
index a6d3623d06f4..4fd60c522802 100644
--- a/net/smc/smc_llc.c
+++ b/net/smc/smc_llc.c
@@ -166,7 +166,8 @@ static int smc_llc_add_pending_send(struct smc_link *link,
 {
         int rc;
 
-        rc = smc_wr_tx_get_free_slot(link, smc_llc_tx_handler, wr_buf, pend);
+        rc = smc_wr_tx_get_free_slot(link, smc_llc_tx_handler, wr_buf, NULL,
+                                     pend);
         if (rc < 0)
                 return rc;
         BUILD_BUG_ON_MSG(
diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c
index 7cb3e4f07c10..632c3109dee5 100644
--- a/net/smc/smc_pnet.c
+++ b/net/smc/smc_pnet.c
@@ -27,7 +27,7 @@
 static struct nla_policy smc_pnet_policy[SMC_PNETID_MAX + 1] = {
         [SMC_PNETID_NAME] = {
                 .type = NLA_NUL_STRING,
-                .len = SMC_MAX_PNETID_LEN - 1
+                .len = SMC_MAX_PNETID_LEN
         },
         [SMC_PNETID_ETHNAME] = {
                 .type = NLA_NUL_STRING,
diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
index d8366ed51757..f93f3580c100 100644
--- a/net/smc/smc_tx.c
+++ b/net/smc/smc_tx.c
@@ -165,12 +165,11 @@ int smc_tx_sendmsg(struct smc_sock *smc, struct msghdr *msg, size_t len)
                         conn->local_tx_ctrl.prod_flags.urg_data_pending = 1;
 
                 if (!atomic_read(&conn->sndbuf_space) || conn->urg_tx_pend) {
+                        if (send_done)
+                                return send_done;
                         rc = smc_tx_wait(smc, msg->msg_flags);
-                        if (rc) {
-                                if (send_done)
-                                        return send_done;
+                        if (rc)
                                 goto out_err;
-                        }
                         continue;
                 }
 
@@ -267,27 +266,23 @@ int smcd_tx_ism_write(struct smc_connection *conn, void *data, size_t len,
 
 /* sndbuf consumer: actual data transfer of one target chunk with RDMA write */
 static int smc_tx_rdma_write(struct smc_connection *conn, int peer_rmbe_offset,
-                             int num_sges, struct ib_sge sges[])
+                             int num_sges, struct ib_rdma_wr *rdma_wr)
 {
         struct smc_link_group *lgr = conn->lgr;
-        struct ib_rdma_wr rdma_wr;
         struct smc_link *link;
         int rc;
 
-        memset(&rdma_wr, 0, sizeof(rdma_wr));
         link = &lgr->lnk[SMC_SINGLE_LINK];
-        rdma_wr.wr.wr_id = smc_wr_tx_get_next_wr_id(link);
-        rdma_wr.wr.sg_list = sges;
-        rdma_wr.wr.num_sge = num_sges;
-        rdma_wr.wr.opcode = IB_WR_RDMA_WRITE;
-        rdma_wr.remote_addr =
+        rdma_wr->wr.wr_id = smc_wr_tx_get_next_wr_id(link);
+        rdma_wr->wr.num_sge = num_sges;
+        rdma_wr->remote_addr =
                 lgr->rtokens[conn->rtoken_idx][SMC_SINGLE_LINK].dma_addr +
                 /* RMBE within RMB */
                 conn->tx_off +
                 /* offset within RMBE */
                 peer_rmbe_offset;
-        rdma_wr.rkey = lgr->rtokens[conn->rtoken_idx][SMC_SINGLE_LINK].rkey;
-        rc = ib_post_send(link->roce_qp, &rdma_wr.wr, NULL);
+        rdma_wr->rkey = lgr->rtokens[conn->rtoken_idx][SMC_SINGLE_LINK].rkey;
+        rc = ib_post_send(link->roce_qp, &rdma_wr->wr, NULL);
         if (rc) {
                 conn->local_tx_ctrl.conn_state_flags.peer_conn_abort = 1;
                 smc_lgr_terminate(lgr);
@@ -314,24 +309,25 @@ static inline void smc_tx_advance_cursors(struct smc_connection *conn,
 /* SMC-R helper for smc_tx_rdma_writes() */
 static int smcr_tx_rdma_writes(struct smc_connection *conn, size_t len,
                                size_t src_off, size_t src_len,
-                               size_t dst_off, size_t dst_len)
+                               size_t dst_off, size_t dst_len,
+                               struct smc_rdma_wr *wr_rdma_buf)
 {
         dma_addr_t dma_addr =
                 sg_dma_address(conn->sndbuf_desc->sgt[SMC_SINGLE_LINK].sgl);
-        struct smc_link *link = &conn->lgr->lnk[SMC_SINGLE_LINK];
         int src_len_sum = src_len, dst_len_sum = dst_len;
-        struct ib_sge sges[SMC_IB_MAX_SEND_SGE];
         int sent_count = src_off;
         int srcchunk, dstchunk;
         int num_sges;
         int rc;
 
         for (dstchunk = 0; dstchunk < 2; dstchunk++) {
+                struct ib_sge *sge =
+                        wr_rdma_buf->wr_tx_rdma[dstchunk].wr.sg_list;
+
                 num_sges = 0;
                 for (srcchunk = 0; srcchunk < 2; srcchunk++) {
-                        sges[srcchunk].addr = dma_addr + src_off;
-                        sges[srcchunk].length = src_len;
-                        sges[srcchunk].lkey = link->roce_pd->local_dma_lkey;
+                        sge[srcchunk].addr = dma_addr + src_off;
+                        sge[srcchunk].length = src_len;
                         num_sges++;
 
                         src_off += src_len;
@@ -344,7 +340,8 @@ static int smcr_tx_rdma_writes(struct smc_connection *conn, size_t len,
                         src_len = dst_len - src_len; /* remainder */
                         src_len_sum += src_len;
                 }
-                rc = smc_tx_rdma_write(conn, dst_off, num_sges, sges);
+                rc = smc_tx_rdma_write(conn, dst_off, num_sges,
+                                       &wr_rdma_buf->wr_tx_rdma[dstchunk]);
                 if (rc)
                         return rc;
                 if (dst_len_sum == len)
@@ -403,7 +400,8 @@ static int smcd_tx_rdma_writes(struct smc_connection *conn, size_t len,
 /* sndbuf consumer: prepare all necessary (src&dst) chunks of data transmit;
  * usable snd_wnd as max transmit
  */
-static int smc_tx_rdma_writes(struct smc_connection *conn)
+static int smc_tx_rdma_writes(struct smc_connection *conn,
+                              struct smc_rdma_wr *wr_rdma_buf)
 {
         size_t len, src_len, dst_off, dst_len; /* current chunk values */
         union smc_host_cursor sent, prep, prod, cons;
@@ -464,7 +462,7 @@ static int smc_tx_rdma_writes(struct smc_connection *conn)
                                          dst_off, dst_len);
         else
                 rc = smcr_tx_rdma_writes(conn, len, sent.count, src_len,
-                                         dst_off, dst_len);
+                                         dst_off, dst_len, wr_rdma_buf);
         if (rc)
                 return rc;
 
@@ -485,31 +483,30 @@ static int smc_tx_rdma_writes(struct smc_connection *conn)
 static int smcr_tx_sndbuf_nonempty(struct smc_connection *conn)
 {
         struct smc_cdc_producer_flags *pflags;
+        struct smc_rdma_wr *wr_rdma_buf;
         struct smc_cdc_tx_pend *pend;
         struct smc_wr_buf *wr_buf;
         int rc;
 
-        spin_lock_bh(&conn->send_lock);
-        rc = smc_cdc_get_free_slot(conn, &wr_buf, &pend);
+        rc = smc_cdc_get_free_slot(conn, &wr_buf, &wr_rdma_buf, &pend);
         if (rc < 0) {
                 if (rc == -EBUSY) {
                         struct smc_sock *smc =
                                 container_of(conn, struct smc_sock, conn);
 
-                        if (smc->sk.sk_err == ECONNABORTED) {
-                                rc = sock_error(&smc->sk);
-                                goto out_unlock;
-                        }
+                        if (smc->sk.sk_err == ECONNABORTED)
+                                return sock_error(&smc->sk);
                         rc = 0;
                         if (conn->alert_token_local) /* connection healthy */
                                 mod_delayed_work(system_wq, &conn->tx_work,
                                                  SMC_TX_WORK_DELAY);
                 }
-                goto out_unlock;
+                return rc;
         }
 
+        spin_lock_bh(&conn->send_lock);
         if (!conn->local_tx_ctrl.prod_flags.urg_data_present) {
-                rc = smc_tx_rdma_writes(conn);
+                rc = smc_tx_rdma_writes(conn, wr_rdma_buf);
                 if (rc) {
                         smc_wr_tx_put_slot(&conn->lgr->lnk[SMC_SINGLE_LINK],
                                            (struct smc_wr_tx_pend_priv *)pend);
@@ -536,7 +533,7 @@ static int smcd_tx_sndbuf_nonempty(struct smc_connection *conn)
 
         spin_lock_bh(&conn->send_lock);
         if (!pflags->urg_data_present)
-                rc = smc_tx_rdma_writes(conn);
+                rc = smc_tx_rdma_writes(conn, NULL);
         if (!rc)
                 rc = smcd_cdc_msg_send(conn);
 
@@ -598,7 +595,8 @@ void smc_tx_consumer_update(struct smc_connection *conn, bool force)
         if (to_confirm > conn->rmbe_update_limit) {
                 smc_curs_copy(&prod, &conn->local_rx_ctrl.prod, conn);
                 sender_free = conn->rmb_desc->len -
-                              smc_curs_diff(conn->rmb_desc->len, &prod, &cfed);
+                              smc_curs_diff_large(conn->rmb_desc->len,
+                                                  &cfed, &prod);
         }
 
         if (conn->local_rx_ctrl.prod_flags.cons_curs_upd_req ||
diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c
index c2694750a6a8..253aa75dc2b6 100644
--- a/net/smc/smc_wr.c
+++ b/net/smc/smc_wr.c
@@ -160,6 +160,7 @@ static inline int smc_wr_tx_get_free_slot_index(struct smc_link *link, u32 *idx)
  * @link:               Pointer to smc_link used to later send the message.
  * @handler:            Send completion handler function pointer.
  * @wr_buf:             Out value returns pointer to message buffer.
+ * @wr_rdma_buf:        Out value returns pointer to rdma work request.
  * @wr_pend_priv:       Out value returns pointer serving as handler context.
  *
  * Return: 0 on success, or -errno on error.
@@ -167,6 +168,7 @@ static inline int smc_wr_tx_get_free_slot_index(struct smc_link *link, u32 *idx)
 int smc_wr_tx_get_free_slot(struct smc_link *link,
                             smc_wr_tx_handler handler,
                             struct smc_wr_buf **wr_buf,
+                            struct smc_rdma_wr **wr_rdma_buf,
                             struct smc_wr_tx_pend_priv **wr_pend_priv)
 {
         struct smc_wr_tx_pend *wr_pend;
@@ -204,6 +206,8 @@ int smc_wr_tx_get_free_slot(struct smc_link *link,
         wr_ib = &link->wr_tx_ibs[idx];
         wr_ib->wr_id = wr_id;
         *wr_buf = &link->wr_tx_bufs[idx];
+        if (wr_rdma_buf)
+                *wr_rdma_buf = &link->wr_tx_rdmas[idx];
         *wr_pend_priv = &wr_pend->priv;
         return 0;
 }
@@ -218,10 +222,10 @@ int smc_wr_tx_put_slot(struct smc_link *link,
                 u32 idx = pend->idx;
 
                 /* clear the full struct smc_wr_tx_pend including .priv */
-                memset(&link->wr_tx_pends[pend->idx], 0,
-                       sizeof(link->wr_tx_pends[pend->idx]));
-                memset(&link->wr_tx_bufs[pend->idx], 0,
-                       sizeof(link->wr_tx_bufs[pend->idx]));
+                memset(&link->wr_tx_pends[idx], 0,
+                       sizeof(link->wr_tx_pends[idx]));
+                memset(&link->wr_tx_bufs[idx], 0,
+                       sizeof(link->wr_tx_bufs[idx]));
                 test_and_clear_bit(idx, link->wr_tx_mask);
                 return 1;
         }
@@ -465,12 +469,26 @@ static void smc_wr_init_sge(struct smc_link *lnk)
                         lnk->wr_tx_dma_addr + i * SMC_WR_BUF_SIZE;
                 lnk->wr_tx_sges[i].length = SMC_WR_TX_SIZE;
                 lnk->wr_tx_sges[i].lkey = lnk->roce_pd->local_dma_lkey;
+                lnk->wr_tx_rdma_sges[i].tx_rdma_sge[0].wr_tx_rdma_sge[0].lkey =
+                        lnk->roce_pd->local_dma_lkey;
+                lnk->wr_tx_rdma_sges[i].tx_rdma_sge[0].wr_tx_rdma_sge[1].lkey =
+                        lnk->roce_pd->local_dma_lkey;
+                lnk->wr_tx_rdma_sges[i].tx_rdma_sge[1].wr_tx_rdma_sge[0].lkey =
+                        lnk->roce_pd->local_dma_lkey;
+                lnk->wr_tx_rdma_sges[i].tx_rdma_sge[1].wr_tx_rdma_sge[1].lkey =
+                        lnk->roce_pd->local_dma_lkey;
                 lnk->wr_tx_ibs[i].next = NULL;
                 lnk->wr_tx_ibs[i].sg_list = &lnk->wr_tx_sges[i];
                 lnk->wr_tx_ibs[i].num_sge = 1;
                 lnk->wr_tx_ibs[i].opcode = IB_WR_SEND;
                 lnk->wr_tx_ibs[i].send_flags =
                         IB_SEND_SIGNALED | IB_SEND_SOLICITED;
+                lnk->wr_tx_rdmas[i].wr_tx_rdma[0].wr.opcode = IB_WR_RDMA_WRITE;
+                lnk->wr_tx_rdmas[i].wr_tx_rdma[1].wr.opcode = IB_WR_RDMA_WRITE;
+                lnk->wr_tx_rdmas[i].wr_tx_rdma[0].wr.sg_list =
+                        lnk->wr_tx_rdma_sges[i].tx_rdma_sge[0].wr_tx_rdma_sge;
+                lnk->wr_tx_rdmas[i].wr_tx_rdma[1].wr.sg_list =
+                        lnk->wr_tx_rdma_sges[i].tx_rdma_sge[1].wr_tx_rdma_sge;
         }
         for (i = 0; i < lnk->wr_rx_cnt; i++) {
                 lnk->wr_rx_sges[i].addr =
@@ -521,8 +539,12 @@ void smc_wr_free_link_mem(struct smc_link *lnk)
         lnk->wr_tx_mask = NULL;
         kfree(lnk->wr_tx_sges);
         lnk->wr_tx_sges = NULL;
+        kfree(lnk->wr_tx_rdma_sges);
+        lnk->wr_tx_rdma_sges = NULL;
         kfree(lnk->wr_rx_sges);
         lnk->wr_rx_sges = NULL;
+        kfree(lnk->wr_tx_rdmas);
+        lnk->wr_tx_rdmas = NULL;
         kfree(lnk->wr_rx_ibs);
         lnk->wr_rx_ibs = NULL;
         kfree(lnk->wr_tx_ibs);
@@ -552,10 +574,20 @@ int smc_wr_alloc_link_mem(struct smc_link *link)
                                   GFP_KERNEL);
         if (!link->wr_rx_ibs)
                 goto no_mem_wr_tx_ibs;
+        link->wr_tx_rdmas = kcalloc(SMC_WR_BUF_CNT,
+                                    sizeof(link->wr_tx_rdmas[0]),
+                                    GFP_KERNEL);
+        if (!link->wr_tx_rdmas)
+                goto no_mem_wr_rx_ibs;
+        link->wr_tx_rdma_sges = kcalloc(SMC_WR_BUF_CNT,
+                                        sizeof(link->wr_tx_rdma_sges[0]),
+                                        GFP_KERNEL);
+        if (!link->wr_tx_rdma_sges)
+                goto no_mem_wr_tx_rdmas;
         link->wr_tx_sges = kcalloc(SMC_WR_BUF_CNT, sizeof(link->wr_tx_sges[0]),
                                    GFP_KERNEL);
         if (!link->wr_tx_sges)
-                goto no_mem_wr_rx_ibs;
+                goto no_mem_wr_tx_rdma_sges;
         link->wr_rx_sges = kcalloc(SMC_WR_BUF_CNT * 3,
                                    sizeof(link->wr_rx_sges[0]),
                                    GFP_KERNEL);
@@ -579,6 +611,10 @@ no_mem_wr_rx_sges:
         kfree(link->wr_rx_sges);
 no_mem_wr_tx_sges:
         kfree(link->wr_tx_sges);
+no_mem_wr_tx_rdma_sges:
+        kfree(link->wr_tx_rdma_sges);
+no_mem_wr_tx_rdmas:
+        kfree(link->wr_tx_rdmas);
 no_mem_wr_rx_ibs:
         kfree(link->wr_rx_ibs);
 no_mem_wr_tx_ibs:
diff --git a/net/smc/smc_wr.h b/net/smc/smc_wr.h
index 1d85bb14fd6f..09bf32fd3959 100644
--- a/net/smc/smc_wr.h
+++ b/net/smc/smc_wr.h
@@ -85,6 +85,7 @@ void smc_wr_add_dev(struct smc_ib_device *smcibdev);
 
 int smc_wr_tx_get_free_slot(struct smc_link *link, smc_wr_tx_handler handler,
                             struct smc_wr_buf **wr_buf,
+                            struct smc_rdma_wr **wrs,
                             struct smc_wr_tx_pend_priv **wr_pend_priv);
 int smc_wr_tx_put_slot(struct smc_link *link,
                        struct smc_wr_tx_pend_priv *wr_pend_priv);
diff --git a/net/socket.c b/net/socket.c
index d51930689b98..643a1648fcc2 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -963,8 +963,7 @@ void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
 EXPORT_SYMBOL(dlci_ioctl_set);
 
 static long sock_do_ioctl(struct net *net, struct socket *sock,
-                          unsigned int cmd, unsigned long arg,
-                          unsigned int ifreq_size)
+                          unsigned int cmd, unsigned long arg)
 {
         int err;
         void __user *argp = (void __user *)arg;
@@ -990,11 +989,11 @@ static long sock_do_ioctl(struct net *net, struct socket *sock,
         } else {
                 struct ifreq ifr;
                 bool need_copyout;
-                if (copy_from_user(&ifr, argp, ifreq_size))
+                if (copy_from_user(&ifr, argp, sizeof(struct ifreq)))
                         return -EFAULT;
                 err = dev_ioctl(net, cmd, &ifr, &need_copyout);
                 if (!err && need_copyout)
-                        if (copy_to_user(argp, &ifr, ifreq_size))
+                        if (copy_to_user(argp, &ifr, sizeof(struct ifreq)))
                                 return -EFAULT;
         }
         return err;
@@ -1093,8 +1092,7 @@ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
                         err = open_related_ns(&net->ns, get_net_ns);
                         break;
                 default:
-                        err = sock_do_ioctl(net, sock, cmd, arg,
-                                            sizeof(struct ifreq));
+                        err = sock_do_ioctl(net, sock, cmd, arg);
                         break;
                 }
         return err;
@@ -2802,8 +2800,7 @@ static int do_siocgstamp(struct net *net, struct socket *sock,
         int err;
 
         set_fs(KERNEL_DS);
-        err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv,
-                            sizeof(struct compat_ifreq));
+        err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
         set_fs(old_fs);
         if (!err)
                 err = compat_put_timeval(&ktv, up);
@@ -2819,8 +2816,7 @@ static int do_siocgstampns(struct net *net, struct socket *sock,
         int err;
 
         set_fs(KERNEL_DS);
-        err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts,
-                            sizeof(struct compat_ifreq));
+        err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
         set_fs(old_fs);
         if (!err)
                 err = compat_put_timespec(&kts, up);
@@ -3016,6 +3012,54 @@ static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
         return dev_ioctl(net, cmd, &ifreq, NULL);
 }
 
+static int compat_ifreq_ioctl(struct net *net, struct socket *sock,
+                              unsigned int cmd,
+                              struct compat_ifreq __user *uifr32)
+{
+        struct ifreq __user *uifr;
+        int err;
+
+        /* Handle the fact that while struct ifreq has the same *layout* on
+         * 32/64 for everything but ifreq::ifru_ifmap and ifreq::ifru_data,
+         * which are handled elsewhere, it still has different *size* due to
+         * ifreq::ifru_ifmap (which is 16 bytes on 32 bit, 24 bytes on 64-bit,
+         * resulting in struct ifreq being 32 and 40 bytes respectively).
+         * As a result, if the struct happens to be at the end of a page and
+         * the next page isn't readable/writable, we get a fault. To prevent
+         * that, copy back and forth to the full size.
+         */
+
+        uifr = compat_alloc_user_space(sizeof(*uifr));
+        if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
+                return -EFAULT;
+
+        err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
+
+        if (!err) {
+                switch (cmd) {
+                case SIOCGIFFLAGS:
+                case SIOCGIFMETRIC:
+                case SIOCGIFMTU:
+                case SIOCGIFMEM:
+                case SIOCGIFHWADDR:
+                case SIOCGIFINDEX:
+                case SIOCGIFADDR:
+                case SIOCGIFBRDADDR:
+                case SIOCGIFDSTADDR:
+                case SIOCGIFNETMASK:
+                case SIOCGIFPFLAGS:
+                case SIOCGIFTXQLEN:
+                case SIOCGMIIPHY:
+                case SIOCGMIIREG:
+                case SIOCGIFNAME:
+                        if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
+                                err = -EFAULT;
+                        break;
+                }
+        }
+        return err;
+}
+
 static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
                         struct compat_ifreq __user *uifr32)
 {
@@ -3131,8 +3175,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
         }
 
         set_fs(KERNEL_DS);
-        ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r,
-                            sizeof(struct compat_ifreq));
+        ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
         set_fs(old_fs);
 
 out:
@@ -3232,21 +3275,22 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
         case SIOCSIFTXQLEN:
         case SIOCBRADDIF:
         case SIOCBRDELIF:
+        case SIOCGIFNAME:
         case SIOCSIFNAME:
         case SIOCGMIIPHY:
         case SIOCGMIIREG:
         case SIOCSMIIREG:
-        case SIOCSARP:
-        case SIOCGARP:
-        case SIOCDARP:
-        case SIOCATMARK:
         case SIOCBONDENSLAVE:
         case SIOCBONDRELEASE:
         case SIOCBONDSETHWADDR:
         case SIOCBONDCHANGEACTIVE:
-        case SIOCGIFNAME:
-                return sock_do_ioctl(net, sock, cmd, arg,
-                                     sizeof(struct compat_ifreq));
+                return compat_ifreq_ioctl(net, sock, cmd, argp);
+
+        case SIOCSARP:
+        case SIOCGARP:
+        case SIOCDARP:
+        case SIOCATMARK:
+                return sock_do_ioctl(net, sock, cmd, arg);
         }
 
         return -ENOIOCTLCMD;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index cf51b8f9b15f..1f200119268c 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -537,6 +537,99 @@ void svc_rdma_sync_reply_hdr(struct svcxprt_rdma *rdma,
                                       DMA_TO_DEVICE);
 }
 
+/* If the xdr_buf has more elements than the device can
+ * transmit in a single RDMA Send, then the reply will
+ * have to be copied into a bounce buffer.
+ */
+static bool svc_rdma_pull_up_needed(struct svcxprt_rdma *rdma,
+                                    struct xdr_buf *xdr,
+                                    __be32 *wr_lst)
+{
+        int elements;
+
+        /* xdr->head */
+        elements = 1;
+
+        /* xdr->pages */
+        if (!wr_lst) {
+                unsigned int remaining;
+                unsigned long pageoff;
+
+                pageoff = xdr->page_base & ~PAGE_MASK;
+                remaining = xdr->page_len;
+                while (remaining) {
+                        ++elements;
+                        remaining -= min_t(u32, PAGE_SIZE - pageoff,
+                                           remaining);
+                        pageoff = 0;
+                }
+        }
+
+        /* xdr->tail */
+        if (xdr->tail[0].iov_len)
+                ++elements;
+
+        /* assume 1 SGE is needed for the transport header */
+        return elements >= rdma->sc_max_send_sges;
+}
+
+/* The device is not capable of sending the reply directly.
+ * Assemble the elements of @xdr into the transport header
+ * buffer.
+ */
+static int svc_rdma_pull_up_reply_msg(struct svcxprt_rdma *rdma,
+                                      struct svc_rdma_send_ctxt *ctxt,
+                                      struct xdr_buf *xdr, __be32 *wr_lst)
+{
+        unsigned char *dst, *tailbase;
+        unsigned int taillen;
+
+        dst = ctxt->sc_xprt_buf;
+        dst += ctxt->sc_sges[0].length;
+
+        memcpy(dst, xdr->head[0].iov_base, xdr->head[0].iov_len);
+        dst += xdr->head[0].iov_len;
+
+        tailbase = xdr->tail[0].iov_base;
+        taillen = xdr->tail[0].iov_len;
+        if (wr_lst) {
+                u32 xdrpad;
+
+                xdrpad = xdr_padsize(xdr->page_len);
+                if (taillen && xdrpad) {
+                        tailbase += xdrpad;
+                        taillen -= xdrpad;
+                }
+        } else {
+                unsigned int len, remaining;
+                unsigned long pageoff;
+                struct page **ppages;
+
+                ppages = xdr->pages + (xdr->page_base >> PAGE_SHIFT);
+                pageoff = xdr->page_base & ~PAGE_MASK;
+                remaining = xdr->page_len;
+                while (remaining) {
+                        len = min_t(u32, PAGE_SIZE - pageoff, remaining);
+
+                        memcpy(dst, page_address(*ppages), len);
+                        remaining -= len;
+                        dst += len;
+                        pageoff = 0;
+                }
+        }
+
+        if (taillen)
+                memcpy(dst, tailbase, taillen);
+
+        ctxt->sc_sges[0].length += xdr->len;
+        ib_dma_sync_single_for_device(rdma->sc_pd->device,
+                                      ctxt->sc_sges[0].addr,
+                                      ctxt->sc_sges[0].length,
+                                      DMA_TO_DEVICE);
+
+        return 0;
+}
+
 /* svc_rdma_map_reply_msg - Map the buffer holding RPC message
  * @rdma: controlling transport
  * @ctxt: send_ctxt for the Send WR
@@ -559,8 +652,10 @@ int svc_rdma_map_reply_msg(struct svcxprt_rdma *rdma,
         u32 xdr_pad;
         int ret;
 
-        if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
-                return -EIO;
+        if (svc_rdma_pull_up_needed(rdma, xdr, wr_lst))
+                return svc_rdma_pull_up_reply_msg(rdma, ctxt, xdr, wr_lst);
+
+        ++ctxt->sc_cur_sge_no;
         ret = svc_rdma_dma_map_buf(rdma, ctxt,
                                    xdr->head[0].iov_base,
                                    xdr->head[0].iov_len);
@@ -591,8 +686,7 @@ int svc_rdma_map_reply_msg(struct svcxprt_rdma *rdma,
         while (remaining) {
                 len = min_t(u32, PAGE_SIZE - page_off, remaining);
 
-                if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
-                        return -EIO;
+                ++ctxt->sc_cur_sge_no;
                 ret = svc_rdma_dma_map_page(rdma, ctxt, *ppages++,
                                             page_off, len);
                 if (ret < 0)
@@ -606,8 +700,7 @@ int svc_rdma_map_reply_msg(struct svcxprt_rdma *rdma,
         len = xdr->tail[0].iov_len;
 tail:
         if (len) {
-                if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
-                        return -EIO;
+                ++ctxt->sc_cur_sge_no;
                 ret = svc_rdma_dma_map_buf(rdma, ctxt, base, len);
                 if (ret < 0)
                         return ret;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 924c17d46903..57f86c63a463 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -419,12 +419,9 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
         /* Transport header, head iovec, tail iovec */
         newxprt->sc_max_send_sges = 3;
         /* Add one SGE per page list entry */
-        newxprt->sc_max_send_sges += svcrdma_max_req_size / PAGE_SIZE;
-        if (newxprt->sc_max_send_sges > dev->attrs.max_send_sge) {
-                pr_err("svcrdma: too few Send SGEs available (%d needed)\n",
-                       newxprt->sc_max_send_sges);
-                goto errout;
-        }
+        newxprt->sc_max_send_sges += (svcrdma_max_req_size / PAGE_SIZE) + 1;
+        if (newxprt->sc_max_send_sges > dev->attrs.max_send_sge)
+                newxprt->sc_max_send_sges = dev->attrs.max_send_sge;
         newxprt->sc_max_req_size = svcrdma_max_req_size;
         newxprt->sc_max_requests = svcrdma_max_requests;
         newxprt->sc_max_bc_requests = svcrdma_max_bc_requests;
diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
index 5d3cce9e8744..15eb5d3d4750 100644
--- a/net/vmw_vsock/virtio_transport.c
+++ b/net/vmw_vsock/virtio_transport.c
@@ -75,6 +75,9 @@ static u32 virtio_transport_get_local_cid(void)
 {
         struct virtio_vsock *vsock = virtio_vsock_get();
 
+        if (!vsock)
+                return VMADDR_CID_ANY;
+
         return vsock->guest_cid;
 }
 
@@ -584,10 +587,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
 
         virtio_vsock_update_guest_cid(vsock);
 
-        ret = vsock_core_init(&virtio_transport.transport);
-        if (ret < 0)
-                goto out_vqs;
-
         vsock->rx_buf_nr = 0;
         vsock->rx_buf_max_nr = 0;
         atomic_set(&vsock->queued_replies, 0);
@@ -618,8 +617,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
         mutex_unlock(&the_virtio_vsock_mutex);
         return 0;
 
-out_vqs:
-        vsock->vdev->config->del_vqs(vsock->vdev);
 out:
         kfree(vsock);
         mutex_unlock(&the_virtio_vsock_mutex);
@@ -637,6 +634,9 @@ static void virtio_vsock_remove(struct virtio_device *vdev)
         flush_work(&vsock->event_work);
         flush_work(&vsock->send_pkt_work);
 
+        /* Reset all connected sockets when the device disappear */
+        vsock_for_each_connected_socket(virtio_vsock_reset_sock);
+
         vdev->config->reset(vdev);
 
         mutex_lock(&vsock->rx_lock);
@@ -669,7 +669,6 @@ static void virtio_vsock_remove(struct virtio_device *vdev)
 
         mutex_lock(&the_virtio_vsock_mutex);
         the_virtio_vsock = NULL;
-        vsock_core_exit();
         mutex_unlock(&the_virtio_vsock_mutex);
 
         vdev->config->del_vqs(vdev);
@@ -702,14 +701,28 @@ static int __init virtio_vsock_init(void)
         virtio_vsock_workqueue = alloc_workqueue("virtio_vsock", 0, 0);
         if (!virtio_vsock_workqueue)
                 return -ENOMEM;
+
         ret = register_virtio_driver(&virtio_vsock_driver);
         if (ret)
-                destroy_workqueue(virtio_vsock_workqueue);
+                goto out_wq;
+
+        ret = vsock_core_init(&virtio_transport.transport);
+        if (ret)
+                goto out_vdr;
+
+        return 0;
+
+out_vdr:
+        unregister_virtio_driver(&virtio_vsock_driver);
+out_wq:
+        destroy_workqueue(virtio_vsock_workqueue);
         return ret;
+
 }
 
 static void __exit virtio_vsock_exit(void)
 {
+        vsock_core_exit();
         unregister_virtio_driver(&virtio_vsock_driver);
         destroy_workqueue(virtio_vsock_workqueue);
 }
diff --git a/net/wireless/ap.c b/net/wireless/ap.c
index 882d97bdc6bf..550ac9d827fe 100644
--- a/net/wireless/ap.c
+++ b/net/wireless/ap.c
@@ -41,6 +41,8 @@ int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
                 cfg80211_sched_dfs_chan_update(rdev);
         }
 
+        schedule_work(&cfg80211_disconnect_work);
+
         return err;
 }
 
diff --git a/net/wireless/core.h b/net/wireless/core.h
index c5d6f3418601..f6b40563dc63 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -445,6 +445,8 @@ void cfg80211_process_wdev_events(struct wireless_dev *wdev);
 bool cfg80211_does_bw_fit_range(const struct ieee80211_freq_range *freq_range,
                                 u32 center_freq_khz, u32 bw_khz);
 
+extern struct work_struct cfg80211_disconnect_work;
+
 /**
  * cfg80211_chandef_dfs_usable - checks if chandef is DFS usable
  * @wiphy: the wiphy to validate against
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index f741d8376a46..7d34cb884840 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -667,7 +667,7 @@ static void disconnect_work(struct work_struct *work)
         rtnl_unlock();
 }
 
-static DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
+DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
 
 
 /*
diff --git a/samples/mei/mei-amt-version.c b/samples/mei/mei-amt-version.c
index 33e67bd1dc34..32234481ad7d 100644
--- a/samples/mei/mei-amt-version.c
+++ b/samples/mei/mei-amt-version.c
@@ -117,7 +117,7 @@ static bool mei_init(struct mei *me, const uuid_le *guid,
 
         me->verbose = verbose;
 
-        me->fd = open("/dev/mei", O_RDWR);
+        me->fd = open("/dev/mei0", O_RDWR);
         if (me->fd == -1) {
                 mei_err(me, "Cannot establish a handle to the Intel MEI driver\n");
                 goto err;
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 08c88de0ffda..11975ec8d566 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -1444,7 +1444,10 @@ check:
                         new = aa_label_merge(label, target, GFP_KERNEL);
                 if (IS_ERR_OR_NULL(new)) {
                         info = "failed to build target label";
-                        error = PTR_ERR(new);
+                        if (!new)
+                                error = -ENOMEM;
+                        else
+                                error = PTR_ERR(new);
                         new = NULL;
                         perms.allow = 0;
                         goto audit;
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 2c010874329f..8db1731d046a 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -1599,12 +1599,14 @@ static unsigned int apparmor_ipv4_postroute(void *priv,
         return apparmor_ip_postroute(priv, skb, state);
 }
 
+#if IS_ENABLED(CONFIG_IPV6)
 static unsigned int apparmor_ipv6_postroute(void *priv,
                                             struct sk_buff *skb,
                                             const struct nf_hook_state *state)
 {
         return apparmor_ip_postroute(priv, skb, state);
 }
+#endif
 
 static const struct nf_hook_ops apparmor_nf_ops[] = {
         {
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 40013b26f671..6c99fa8ac5fa 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -2112,6 +2112,13 @@ int pcm_lib_apply_appl_ptr(struct snd_pcm_substream *substream,
         return 0;
 }
 
+/* allow waiting for a capture stream that hasn't been started */
+#if IS_ENABLED(CONFIG_SND_PCM_OSS)
+#define wait_capture_start(substream)   ((substream)->oss.oss)
+#else
+#define wait_capture_start(substream)   false
+#endif
+
 /* the common loop for read/write data */
 snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
                                      void *data, bool interleaved,
@@ -2182,7 +2189,7 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
                         err = snd_pcm_start(substream);
                         if (err < 0)
                                 goto _end_unlock;
-                } else {
+                } else if (!wait_capture_start(substream)) {
                         /* nothing to do */
                         err = 0;
                         goto _end_unlock;
diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c
index 9174f1b3a987..1ec706ced75c 100644
--- a/sound/pci/hda/hda_bind.c
+++ b/sound/pci/hda/hda_bind.c
@@ -115,7 +115,8 @@ static int hda_codec_driver_probe(struct device *dev)
         err = snd_hda_codec_build_controls(codec);
         if (err < 0)
                 goto error_module;
-        if (codec->card->registered) {
+        /* only register after the bus probe finished; otherwise it's racy */
+        if (!codec->bus->bus_probing && codec->card->registered) {
                 err = snd_card_register(codec->card);
                 if (err < 0)
                         goto error_module;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index e784130ea4e0..e5c49003e75f 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2185,6 +2185,7 @@ static int azx_probe_continue(struct azx *chip)
         int dev = chip->dev_index;
         int err;
 
+        to_hda_bus(bus)->bus_probing = 1;
         hda->probe_continued = 1;
 
         /* bind with i915 if needed */
@@ -2269,6 +2270,7 @@ out_free:
         if (err < 0)
                 hda->init_failed = 1;
         complete_all(&hda->probe_wait);
+        to_hda_bus(bus)->bus_probing = 0;
         return err;
 }
 
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index e5bdbc245682..29882bda7632 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -8451,8 +8451,10 @@ static void ca0132_free(struct hda_codec *codec)
         ca0132_exit_chip(codec);
 
         snd_hda_power_down(codec);
-        if (IS_ENABLED(CONFIG_PCI) && spec->mem_base)
+#ifdef CONFIG_PCI
+        if (spec->mem_base)
                 pci_iounmap(codec->bus->pci, spec->mem_base);
+#endif
         kfree(spec->spec_init_verbs);
         kfree(codec->spec);
 }
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index b4f472157ebd..6df758adff84 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -117,6 +117,7 @@ struct alc_spec {
         int codec_variant;      /* flag for other variants */
         unsigned int has_alc5505_dsp:1;
         unsigned int no_depop_delay:1;
+        unsigned int done_hp_init:1;
 
         /* for PLL fix */
         hda_nid_t pll_nid;
@@ -514,6 +515,15 @@ static void alc_auto_init_amp(struct hda_codec *codec, int type)
         }
 }
 
+/* get a primary headphone pin if available */
+static hda_nid_t alc_get_hp_pin(struct alc_spec *spec)
+{
+        if (spec->gen.autocfg.hp_pins[0])
+                return spec->gen.autocfg.hp_pins[0];
+        if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
+                return spec->gen.autocfg.line_out_pins[0];
+        return 0;
+}
 
 /*
  * Realtek SSID verification
@@ -724,9 +734,7 @@ do_sku:
          * 15   : 1 --> enable the function "Mute internal speaker
          *              when the external headphone out jack is plugged"
          */
-        if (!spec->gen.autocfg.hp_pins[0] &&
-            !(spec->gen.autocfg.line_out_pins[0] &&
-              spec->gen.autocfg.line_out_type == AUTO_PIN_HP_OUT)) {
+        if (!alc_get_hp_pin(spec)) {
                 hda_nid_t nid;
                 tmp = (ass >> 11) & 0x3;        /* HP to chassis */
                 nid = ports[tmp];
@@ -2958,7 +2966,7 @@ static void alc282_restore_default_value(struct hda_codec *codec)
 static void alc282_init(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp_pin_sense;
         int coef78;
 
@@ -2995,7 +3003,7 @@ static void alc282_init(struct hda_codec *codec)
 static void alc282_shutup(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp_pin_sense;
         int coef78;
 
@@ -3073,14 +3081,9 @@ static void alc283_restore_default_value(struct hda_codec *codec)
 static void alc283_init(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp_pin_sense;
 
-        if (!spec->gen.autocfg.hp_outs) {
-                if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-                        hp_pin = spec->gen.autocfg.line_out_pins[0];
-        }
-
         alc283_restore_default_value(codec);
 
         if (!hp_pin)
@@ -3114,14 +3117,9 @@ static void alc283_init(struct hda_codec *codec)
 static void alc283_shutup(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp_pin_sense;
 
-        if (!spec->gen.autocfg.hp_outs) {
-                if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-                        hp_pin = spec->gen.autocfg.line_out_pins[0];
-        }
-
         if (!hp_pin) {
                 alc269_shutup(codec);
                 return;
@@ -3155,7 +3153,7 @@ static void alc283_shutup(struct hda_codec *codec)
 static void alc256_init(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp_pin_sense;
 
         if (!hp_pin)
@@ -3191,7 +3189,7 @@ static void alc256_init(struct hda_codec *codec)
 static void alc256_shutup(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp_pin_sense;
 
         if (!hp_pin) {
@@ -3227,7 +3225,7 @@ static void alc256_shutup(struct hda_codec *codec)
 static void alc225_init(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp1_pin_sense, hp2_pin_sense;
 
         if (!hp_pin)
@@ -3270,7 +3268,7 @@ static void alc225_init(struct hda_codec *codec)
 static void alc225_shutup(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp1_pin_sense, hp2_pin_sense;
 
         if (!hp_pin) {
@@ -3314,7 +3312,7 @@ static void alc225_shutup(struct hda_codec *codec)
 static void alc_default_init(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp_pin_sense;
 
         if (!hp_pin)
@@ -3343,7 +3341,7 @@ static void alc_default_init(struct hda_codec *codec)
 static void alc_default_shutup(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp_pin_sense;
 
         if (!hp_pin) {
@@ -3372,6 +3370,48 @@ static void alc_default_shutup(struct hda_codec *codec)
         snd_hda_shutup_pins(codec);
 }
 
+static void alc294_hp_init(struct hda_codec *codec)
+{
+        struct alc_spec *spec = codec->spec;
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
+        int i, val;
+
+        if (!hp_pin)
+                return;
+
+        snd_hda_codec_write(codec, hp_pin, 0,
+                            AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+
+        msleep(100);
+
+        snd_hda_codec_write(codec, hp_pin, 0,
+                            AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+        alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */
+        alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */
+
+        /* Wait for depop procedure finish  */
+        val = alc_read_coefex_idx(codec, 0x58, 0x01);
+        for (i = 0; i < 20 && val & 0x0080; i++) {
+                msleep(50);
+                val = alc_read_coefex_idx(codec, 0x58, 0x01);
+        }
+        /* Set HP depop to auto mode */
+        alc_update_coef_idx(codec, 0x6f, 0x000f, 0x000b);
+        msleep(50);
+}
+
+static void alc294_init(struct hda_codec *codec)
+{
+        struct alc_spec *spec = codec->spec;
+
+        if (!spec->done_hp_init) {
+                alc294_hp_init(codec);
+                spec->done_hp_init = true;
+        }
+        alc_default_init(codec);
+}
+
 static void alc5505_coef_set(struct hda_codec *codec, unsigned int index_reg,
                              unsigned int val)
 {
@@ -4737,7 +4777,7 @@ static void alc_update_headset_mode(struct hda_codec *codec)
         struct alc_spec *spec = codec->spec;
 
         hda_nid_t mux_pin = spec->gen.imux_pins[spec->gen.cur_mux[0]];
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
 
         int new_headset_mode;
 
@@ -5016,7 +5056,7 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec,
 static void alc_shutup_dell_xps13(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        int hp_pin = spec->gen.autocfg.hp_pins[0];
+        int hp_pin = alc_get_hp_pin(spec);
 
         /* Prevent pop noises when headphones are plugged in */
         snd_hda_codec_write(codec, hp_pin, 0,
@@ -5109,7 +5149,7 @@ static void alc271_hp_gate_mic_jack(struct hda_codec *codec,
 
         if (action == HDA_FIXUP_ACT_PROBE) {
                 int mic_pin = find_ext_mic_pin(codec);
-                int hp_pin = spec->gen.autocfg.hp_pins[0];
+                int hp_pin = alc_get_hp_pin(spec);
 
                 if (snd_BUG_ON(!mic_pin || !hp_pin))
                         return;
@@ -5591,6 +5631,7 @@ enum {
         ALC294_FIXUP_ASUS_HEADSET_MIC,
         ALC294_FIXUP_ASUS_SPK,
         ALC225_FIXUP_HEADSET_JACK,
+        ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -6537,6 +6578,15 @@ static const struct hda_fixup alc269_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc_fixup_headset_jack,
         },
+        [ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x1a, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6715,6 +6765,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
         SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
         SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
+        SND_PCI_QUIRK(0x1558, 0x1325, "System76 Darter Pro (darp5)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
@@ -7373,37 +7424,6 @@ static void alc269_fill_coef(struct hda_codec *codec)
         alc_update_coef_idx(codec, 0x4, 0, 1<<11);
 }
 
-static void alc294_hp_init(struct hda_codec *codec)
-{
-        struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
-        int i, val;
-
-        if (!hp_pin)
-                return;
-
-        snd_hda_codec_write(codec, hp_pin, 0,
-                            AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
-
-        msleep(100);
-
-        snd_hda_codec_write(codec, hp_pin, 0,
-                            AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
-
-        alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */
-        alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */
-
-        /* Wait for depop procedure finish  */
-        val = alc_read_coefex_idx(codec, 0x58, 0x01);
-        for (i = 0; i < 20 && val & 0x0080; i++) {
-                msleep(50);
-                val = alc_read_coefex_idx(codec, 0x58, 0x01);
-        }
-        /* Set HP depop to auto mode */
-        alc_update_coef_idx(codec, 0x6f, 0x000f, 0x000b);
-        msleep(50);
-}
-
 /*
  */
 static int patch_alc269(struct hda_codec *codec)
@@ -7529,7 +7549,7 @@ static int patch_alc269(struct hda_codec *codec)
                 spec->codec_variant = ALC269_TYPE_ALC294;
                 spec->gen.mixer_nid = 0; /* ALC2x4 does not have any loopback mixer path */
                 alc_update_coef_idx(codec, 0x6b, 0x0018, (1<<4) | (1<<3)); /* UAJ MIC Vref control by verb */
-                alc294_hp_init(codec);
+                spec->init_hook = alc294_init;
                 break;
         case 0x10ec0300:
                 spec->codec_variant = ALC269_TYPE_ALC300;
@@ -7541,7 +7561,7 @@ static int patch_alc269(struct hda_codec *codec)
                 spec->codec_variant = ALC269_TYPE_ALC700;
                 spec->gen.mixer_nid = 0; /* ALC700 does not have any loopback mixer path */
                 alc_update_coef_idx(codec, 0x4a, 1 << 15, 0); /* Combo jack auto trigger control */
-                alc294_hp_init(codec);
+                spec->init_hook = alc294_init;
                 break;
 
         }
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index ebbadb3a7094..7e65fe853ee3 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1492,6 +1492,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
                         return SNDRV_PCM_FMTBIT_DSD_U32_BE;
                 break;
 
+        case USB_ID(0x10cb, 0x0103): /* The Bit Opus #3; with fp->dsd_raw */
         case USB_ID(0x152a, 0x85de): /* SMSL D1 DAC */
         case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
         case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */
@@ -1566,6 +1567,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
         case 0x20b1:  /* XMOS based devices */
         case 0x152a:  /* Thesycon devices */
         case 0x25ce:  /* Mytek devices */
+        case 0x2ab6:  /* T+A devices */
                 if (fp->dsd_raw)
                         return SNDRV_PCM_FMTBIT_DSD_U32_BE;
                 break;
diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
index 897483457bf0..f7261fad45c1 100644
--- a/tools/bpf/bpftool/common.c
+++ b/tools/bpf/bpftool/common.c
@@ -297,10 +297,8 @@ char *get_fdinfo(int fd, const char *key)
         snprintf(path, sizeof(path), "/proc/self/fdinfo/%d", fd);
 
         fdi = fopen(path, "r");
-        if (!fdi) {
-                p_err("can't open fdinfo: %s", strerror(errno));
+        if (!fdi)
                 return NULL;
-        }
 
         while ((n = getline(&line, &line_n, fdi)) > 0) {
                 char *value;
@@ -313,7 +311,6 @@ char *get_fdinfo(int fd, const char *key)
 
                 value = strchr(line, '\t');
                 if (!value || !value[1]) {
-                        p_err("malformed fdinfo!?");
                         free(line);
                         return NULL;
                 }
@@ -326,7 +323,6 @@ char *get_fdinfo(int fd, const char *key)
                 return line;
         }
 
-        p_err("key '%s' not found in fdinfo", key);
         free(line);
         fclose(fdi);
         return NULL;
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index 2160a8ef17e5..e0c650d91784 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -358,6 +358,20 @@ static char **parse_bytes(char **argv, const char *name, unsigned char *val,
         return argv + i;
 }
 
+/* on per cpu maps we must copy the provided value on all value instances */
+static void fill_per_cpu_value(struct bpf_map_info *info, void *value)
+{
+        unsigned int i, n, step;
+
+        if (!map_is_per_cpu(info->type))
+                return;
+
+        n = get_possible_cpus();
+        step = round_up(info->value_size, 8);
+        for (i = 1; i < n; i++)
+                memcpy(value + i * step, value, info->value_size);
+}
+
 static int parse_elem(char **argv, struct bpf_map_info *info,
                       void *key, void *value, __u32 key_size, __u32 value_size,
                       __u32 *flags, __u32 **value_fd)
@@ -440,6 +454,8 @@ static int parse_elem(char **argv, struct bpf_map_info *info,
                         argv = parse_bytes(argv, "value", value, value_size);
                         if (!argv)
                                 return -1;
+
+                        fill_per_cpu_value(info, value);
                 }
 
                 return parse_elem(argv, info, key, NULL, key_size, value_size,
@@ -511,10 +527,9 @@ static int show_map_close_json(int fd, struct bpf_map_info *info)
                                 jsonw_uint_field(json_wtr, "owner_prog_type",
                                                  prog_type);
                 }
-                if (atoi(owner_jited))
-                        jsonw_bool_field(json_wtr, "owner_jited", true);
-                else
-                        jsonw_bool_field(json_wtr, "owner_jited", false);
+                if (owner_jited)
+                        jsonw_bool_field(json_wtr, "owner_jited",
+                                         !!atoi(owner_jited));
 
                 free(owner_prog_type);
                 free(owner_jited);
@@ -567,7 +582,8 @@ static int show_map_close_plain(int fd, struct bpf_map_info *info)
                 char *owner_prog_type = get_fdinfo(fd, "owner_prog_type");
                 char *owner_jited = get_fdinfo(fd, "owner_jited");
 
-                printf("\n\t");
+                if (owner_prog_type || owner_jited)
+                        printf("\n\t");
                 if (owner_prog_type) {
                         unsigned int prog_type = atoi(owner_prog_type);
 
@@ -577,10 +593,9 @@ static int show_map_close_plain(int fd, struct bpf_map_info *info)
                         else
                                 printf("owner_prog_type %d  ", prog_type);
                 }
-                if (atoi(owner_jited))
-                        printf("owner jited");
-                else
-                        printf("owner not jited");
+                if (owner_jited)
+                        printf("owner%s jited",
+                               atoi(owner_jited) ? "" : " not");
 
                 free(owner_prog_type);
                 free(owner_jited);
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 0640e9bc0ada..33ed0806ccc0 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -78,13 +78,14 @@ static void print_boot_time(__u64 nsecs, char *buf, unsigned int size)
 
 static int prog_fd_by_tag(unsigned char *tag)
 {
-        struct bpf_prog_info info = {};
-        __u32 len = sizeof(info);
         unsigned int id = 0;
         int err;
         int fd;
 
         while (true) {
+                struct bpf_prog_info info = {};
+                __u32 len = sizeof(info);
+
                 err = bpf_prog_get_next_id(id, &id);
                 if (err) {
                         p_err("%s", strerror(errno));
diff --git a/tools/iio/iio_generic_buffer.c b/tools/iio/iio_generic_buffer.c
index 3040830d7797..84545666a09c 100644
--- a/tools/iio/iio_generic_buffer.c
+++ b/tools/iio/iio_generic_buffer.c
@@ -330,7 +330,7 @@ static const struct option longopts[] = {
 
 int main(int argc, char **argv)
 {
-        unsigned long long num_loops = 2;
+        long long num_loops = 2;
         unsigned long timedelay = 1000000;
         unsigned long buf_len = 128;
 
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index d079f36d342d..ac221f137ed2 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -1681,13 +1681,8 @@ static void perf_sample__fprint_metric(struct perf_script *script,
                 .force_header = false,
         };
         struct perf_evsel *ev2;
-        static bool init;
         u64 val;
 
-        if (!init) {
-                perf_stat__init_shadow_stats();
-                init = true;
-        }
         if (!evsel->stats)
                 perf_evlist__alloc_stats(script->session->evlist, false);
         if (evsel_script(evsel->leader)->gnum++ == 0)
@@ -1794,7 +1789,7 @@ static void process_event(struct perf_script *script,
                 return;
         }
 
-        if (PRINT_FIELD(TRACE)) {
+        if (PRINT_FIELD(TRACE) && sample->raw_data) {
                 event_format__fprintf(evsel->tp_format, sample->cpu,
                                       sample->raw_data, sample->raw_size, fp);
         }
@@ -2359,6 +2354,8 @@ static int __cmd_script(struct perf_script *script)
 
         signal(SIGINT, sig_handler);
 
+        perf_stat__init_shadow_stats();
+
         /* override event processing functions */
         if (script->show_task_events) {
                 script->tool.comm = process_comm_event;
diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c
index 1d00e5ec7906..82e16bf84466 100644
--- a/tools/perf/ui/browsers/annotate.c
+++ b/tools/perf/ui/browsers/annotate.c
@@ -224,20 +224,24 @@ static unsigned int annotate_browser__refresh(struct ui_browser *browser)
         return ret;
 }
 
-static int disasm__cmp(struct annotation_line *a, struct annotation_line *b)
+static double disasm__cmp(struct annotation_line *a, struct annotation_line *b,
+                                                  int percent_type)
 {
         int i;
 
         for (i = 0; i < a->data_nr; i++) {
-                if (a->data[i].percent == b->data[i].percent)
+                if (a->data[i].percent[percent_type] == b->data[i].percent[percent_type])
                         continue;
-                return a->data[i].percent < b->data[i].percent;
+                return a->data[i].percent[percent_type] -
+                           b->data[i].percent[percent_type];
         }
         return 0;
 }
 
-static void disasm_rb_tree__insert(struct rb_root *root, struct annotation_line *al)
+static void disasm_rb_tree__insert(struct annotate_browser *browser,
+                                struct annotation_line *al)
 {
+        struct rb_root *root = &browser->entries;
         struct rb_node **p = &root->rb_node;
         struct rb_node *parent = NULL;
         struct annotation_line *l;
@@ -246,7 +250,7 @@ static void disasm_rb_tree__insert(struct rb_root *root, struct annotation_line
                 parent = *p;
                 l = rb_entry(parent, struct annotation_line, rb_node);
 
-                if (disasm__cmp(al, l))
+                if (disasm__cmp(al, l, browser->opts->percent_type) < 0)
                         p = &(*p)->rb_left;
                 else
                         p = &(*p)->rb_right;
@@ -329,7 +333,7 @@ static void annotate_browser__calc_percent(struct annotate_browser *browser,
                         RB_CLEAR_NODE(&pos->al.rb_node);
                         continue;
                 }
-                disasm_rb_tree__insert(&browser->entries, &pos->al);
+                disasm_rb_tree__insert(browser, &pos->al);
         }
         pthread_mutex_unlock(&notes->lock);
 
diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
index 1ccbd3342069..383674f448fc 100644
--- a/tools/perf/util/cpumap.c
+++ b/tools/perf/util/cpumap.c
@@ -134,7 +134,12 @@ struct cpu_map *cpu_map__new(const char *cpu_list)
         if (!cpu_list)
                 return cpu_map__read_all_cpu_map();
 
-        if (!isdigit(*cpu_list))
+        /*
+         * must handle the case of empty cpumap to cover
+         * TOPOLOGY header for NUMA nodes with no CPU
+         * ( e.g., because of CPU hotplug)
+         */
+        if (!isdigit(*cpu_list) && *cpu_list != '\0')
                 goto out;
 
         while (isdigit(*cpu_list)) {
@@ -181,8 +186,10 @@ struct cpu_map *cpu_map__new(const char *cpu_list)
 
         if (nr_cpus > 0)
                 cpus = cpu_map__trim_new(nr_cpus, tmp_cpus);
-        else
+        else if (*cpu_list != '\0')
                 cpus = cpu_map__default_new();
+        else
+                cpus = cpu_map__dummy_new();
 invalid:
         free(tmp_cpus);
 out:
diff --git a/tools/perf/util/ordered-events.c b/tools/perf/util/ordered-events.c
index 897589507d97..ea523d3b248f 100644
--- a/tools/perf/util/ordered-events.c
+++ b/tools/perf/util/ordered-events.c
@@ -391,8 +391,10 @@ void ordered_events__free(struct ordered_events *oe)
          * Current buffer might not have all the events allocated
          * yet, we need to free only allocated ones ...
          */
-        list_del(&oe->buffer->list);
-        ordered_events_buffer__free(oe->buffer, oe->buffer_idx, oe);
+        if (oe->buffer) {
+                list_del(&oe->buffer->list);
+                ordered_events_buffer__free(oe->buffer, oe->buffer_idx, oe);
+        }
 
         /* ... and continue with the rest */
         list_for_each_entry_safe(buffer, tmp, &oe->to_free, list) {
diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py
index 63f758c655d5..64d1f36dee99 100644
--- a/tools/perf/util/setup.py
+++ b/tools/perf/util/setup.py
@@ -17,6 +17,8 @@ if cc == "clang":
             vars[var] = sub("-mcet", "", vars[var])
         if not clang_has_option("-fcf-protection"):
             vars[var] = sub("-fcf-protection", "", vars[var])
+        if not clang_has_option("-fstack-clash-protection"):
+            vars[var] = sub("-fstack-clash-protection", "", vars[var])
 
 from distutils.core import setup, Extension
 
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 1a2bd15c5b6e..400ee81a3043 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -10,6 +10,7 @@ TARGETS += drivers/dma-buf
 TARGETS += efivarfs
 TARGETS += exec
 TARGETS += filesystems
+TARGETS += filesystems/binderfs
 TARGETS += firmware
 TARGETS += ftrace
 TARGETS += futex
diff --git a/tools/testing/selftests/bpf/bpf_util.h b/tools/testing/selftests/bpf/bpf_util.h
index 315a44fa32af..84fd6f1bf33e 100644
--- a/tools/testing/selftests/bpf/bpf_util.h
+++ b/tools/testing/selftests/bpf/bpf_util.h
@@ -13,7 +13,7 @@ static inline unsigned int bpf_num_possible_cpus(void)
         unsigned int start, end, possible_cpus = 0;
         char buff[128];
         FILE *fp;
-        int n;
+        int len, n, i, j = 0;
 
         fp = fopen(fcpu, "r");
         if (!fp) {
@@ -21,17 +21,27 @@ static inline unsigned int bpf_num_possible_cpus(void)
                 exit(1);
         }
 
-        while (fgets(buff, sizeof(buff), fp)) {
-                n = sscanf(buff, "%u-%u", &start, &end);
-                if (n == 0) {
-                        printf("Failed to retrieve # possible CPUs!\n");
-                        exit(1);
-                } else if (n == 1) {
-                        end = start;
+        if (!fgets(buff, sizeof(buff), fp)) {
+                printf("Failed to read %s!\n", fcpu);
+                exit(1);
+        }
+
+        len = strlen(buff);
+        for (i = 0; i <= len; i++) {
+                if (buff[i] == ',' || buff[i] == '\0') {
+                        buff[i] = '\0';
+                        n = sscanf(&buff[j], "%u-%u", &start, &end);
+                        if (n <= 0) {
+                                printf("Failed to retrieve # possible CPUs!\n");
+                                exit(1);
+                        } else if (n == 1) {
+                                end = start;
+                        }
+                        possible_cpus += end - start + 1;
+                        j = i + 1;
                 }
-                possible_cpus = start == 0 ? end + 1 : 0;
-                break;
         }
+
         fclose(fp);
 
         return possible_cpus;
diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c
index 447acc34db94..ee723774015a 100644
--- a/tools/testing/selftests/bpf/test_btf.c
+++ b/tools/testing/selftests/bpf/test_btf.c
@@ -1902,13 +1902,12 @@ static struct btf_raw_test raw_tests[] = {
 },
 
 {
-        .descr = "func proto (CONST=>TYPEDEF=>FUNC_PROTO)",
+        .descr = "func proto (TYPEDEF=>FUNC_PROTO)",
         .raw_types = {
                 BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),  /* [1] */
                 BTF_TYPE_INT_ENC(0, 0, 0, 32, 4),               /* [2] */
-                BTF_CONST_ENC(4),                               /* [3] */
-                BTF_TYPEDEF_ENC(NAME_TBD, 5),                   /* [4] */
-                BTF_FUNC_PROTO_ENC(0, 2),                       /* [5] */
+                BTF_TYPEDEF_ENC(NAME_TBD, 4),                   /* [3] */
+                BTF_FUNC_PROTO_ENC(0, 2),                       /* [4] */
                         BTF_FUNC_PROTO_ARG_ENC(0, 1),
                         BTF_FUNC_PROTO_ARG_ENC(0, 2),
                 BTF_END_RAW,
@@ -1922,8 +1921,6 @@ static struct btf_raw_test raw_tests[] = {
         .key_type_id = 1,
         .value_type_id = 1,
         .max_entries = 4,
-        .btf_load_err = true,
-        .err_str = "Invalid type_id",
 },
 
 {
diff --git a/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh b/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
index bab13dd025a6..0d26b5e3f966 100755
--- a/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
+++ b/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
@@ -37,6 +37,10 @@ prerequisite()
                 exit $ksft_skip
         fi
 
+        present_cpus=`cat $SYSFS/devices/system/cpu/present`
+        present_max=${present_cpus##*-}
+        echo "present_cpus = $present_cpus present_max = $present_max"
+
         echo -e "\t Cpus in online state: $online_cpus"
 
         offline_cpus=`cat $SYSFS/devices/system/cpu/offline`
@@ -151,6 +155,8 @@ online_cpus=0
 online_max=0
 offline_cpus=0
 offline_max=0
+present_cpus=0
+present_max=0
 
 while getopts e:ahp: opt; do
         case $opt in
@@ -190,9 +196,10 @@ if [ $allcpus -eq 0 ]; then
         online_cpu_expect_success $online_max
 
         if [[ $offline_cpus -gt 0 ]]; then
-                echo -e "\t offline to online to offline: cpu $offline_max"
-                online_cpu_expect_success $offline_max
-                offline_cpu_expect_success $offline_max
+                echo -e "\t offline to online to offline: cpu $present_max"
+                online_cpu_expect_success $present_max
+                offline_cpu_expect_success $present_max
+                online_cpu $present_max
         fi
         exit 0
 else
diff --git a/tools/testing/selftests/filesystems/binderfs/.gitignore b/tools/testing/selftests/filesystems/binderfs/.gitignore
new file mode 100644
index 000000000000..8a5d9bf63dd4
--- /dev/null
+++ b/tools/testing/selftests/filesystems/binderfs/.gitignore
@@ -0,0 +1 @@
+binderfs_test
diff --git a/tools/testing/selftests/filesystems/binderfs/Makefile b/tools/testing/selftests/filesystems/binderfs/Makefile
new file mode 100644
index 000000000000..58cb659b56b4
--- /dev/null
+++ b/tools/testing/selftests/filesystems/binderfs/Makefile
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0
+
+CFLAGS += -I../../../../../usr/include/
+TEST_GEN_PROGS := binderfs_test
+
+include ../../lib.mk
diff --git a/tools/testing/selftests/filesystems/binderfs/binderfs_test.c b/tools/testing/selftests/filesystems/binderfs/binderfs_test.c
new file mode 100644
index 000000000000..8c2ed962e1c7
--- /dev/null
+++ b/tools/testing/selftests/filesystems/binderfs/binderfs_test.c
@@ -0,0 +1,275 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <sched.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/mount.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <linux/android/binder.h>
+#include <linux/android/binderfs.h>
+#include "../../kselftest.h"
+
+static ssize_t write_nointr(int fd, const void *buf, size_t count)
+{
+        ssize_t ret;
+again:
+        ret = write(fd, buf, count);
+        if (ret < 0 && errno == EINTR)
+                goto again;
+
+        return ret;
+}
+
+static void write_to_file(const char *filename, const void *buf, size_t count,
+                          int allowed_errno)
+{
+        int fd, saved_errno;
+        ssize_t ret;
+
+        fd = open(filename, O_WRONLY | O_CLOEXEC);
+        if (fd < 0)
+                ksft_exit_fail_msg("%s - Failed to open file %s\n",
+                                   strerror(errno), filename);
+
+        ret = write_nointr(fd, buf, count);
+        if (ret < 0) {
+                if (allowed_errno && (errno == allowed_errno)) {
+                        close(fd);
+                        return;
+                }
+
+                goto on_error;
+        }
+
+        if ((size_t)ret != count)
+                goto on_error;
+
+        close(fd);
+        return;
+
+on_error:
+        saved_errno = errno;
+        close(fd);
+        errno = saved_errno;
+
+        if (ret < 0)
+                ksft_exit_fail_msg("%s - Failed to write to file %s\n",
+                                   strerror(errno), filename);
+
+        ksft_exit_fail_msg("Failed to write to file %s\n", filename);
+}
+
+static void change_to_userns(void)
+{
+        int ret;
+        uid_t uid;
+        gid_t gid;
+        /* {g,u}id_map files only allow a max of 4096 bytes written to them */
+        char idmap[4096];
+
+        uid = getuid();
+        gid = getgid();
+
+        ret = unshare(CLONE_NEWUSER);
+        if (ret < 0)
+                ksft_exit_fail_msg("%s - Failed to unshare user namespace\n",
+                                   strerror(errno));
+
+        write_to_file("/proc/self/setgroups", "deny", strlen("deny"), ENOENT);
+
+        ret = snprintf(idmap, sizeof(idmap), "0 %d 1", uid);
+        if (ret < 0 || (size_t)ret >= sizeof(idmap))
+                ksft_exit_fail_msg("%s - Failed to prepare uid mapping\n",
+                                   strerror(errno));
+
+        write_to_file("/proc/self/uid_map", idmap, strlen(idmap), 0);
+
+        ret = snprintf(idmap, sizeof(idmap), "0 %d 1", gid);
+        if (ret < 0 || (size_t)ret >= sizeof(idmap))
+                ksft_exit_fail_msg("%s - Failed to prepare uid mapping\n",
+                                   strerror(errno));
+
+        write_to_file("/proc/self/gid_map", idmap, strlen(idmap), 0);
+
+        ret = setgid(0);
+        if (ret)
+                ksft_exit_fail_msg("%s - Failed to setgid(0)\n",
+                                   strerror(errno));
+
+        ret = setuid(0);
+        if (ret)
+                ksft_exit_fail_msg("%s - Failed to setgid(0)\n",
+                                   strerror(errno));
+}
+
+static void change_to_mountns(void)
+{
+        int ret;
+
+        ret = unshare(CLONE_NEWNS);
+        if (ret < 0)
+                ksft_exit_fail_msg("%s - Failed to unshare mount namespace\n",
+                                   strerror(errno));
+
+        ret = mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, 0);
+        if (ret < 0)
+                ksft_exit_fail_msg("%s - Failed to mount / as private\n",
+                                   strerror(errno));
+}
+
+static void rmdir_protect_errno(const char *dir)
+{
+        int saved_errno = errno;
+        (void)rmdir(dir);
+        errno = saved_errno;
+}
+
+static void __do_binderfs_test(void)
+{
+        int fd, ret, saved_errno;
+        size_t len;
+        ssize_t wret;
+        bool keep = false;
+        struct binderfs_device device = { 0 };
+        struct binder_version version = { 0 };
+
+        change_to_mountns();
+
+        ret = mkdir("/dev/binderfs", 0755);
+        if (ret < 0) {
+                if (errno != EEXIST)
+                        ksft_exit_fail_msg(
+                                "%s - Failed to create binderfs mountpoint\n",
+                                strerror(errno));
+
+                keep = true;
+        }
+
+        ret = mount(NULL, "/dev/binderfs", "binder", 0, 0);
+        if (ret < 0) {
+                if (errno != ENODEV)
+                        ksft_exit_fail_msg("%s - Failed to mount binderfs\n",
+                                           strerror(errno));
+
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_skip(
+                        "The Android binderfs filesystem is not available\n");
+        }
+
+        /* binderfs mount test passed */
+        ksft_inc_pass_cnt();
+
+        memcpy(device.name, "my-binder", strlen("my-binder"));
+
+        fd = open("/dev/binderfs/binder-control", O_RDONLY | O_CLOEXEC);
+        if (fd < 0)
+                ksft_exit_fail_msg(
+                        "%s - Failed to open binder-control device\n",
+                        strerror(errno));
+
+        ret = ioctl(fd, BINDER_CTL_ADD, &device);
+        saved_errno = errno;
+        close(fd);
+        errno = saved_errno;
+        if (ret < 0) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg(
+                        "%s - Failed to allocate new binder device\n",
+                        strerror(errno));
+        }
+
+        ksft_print_msg(
+                "Allocated new binder device with major %d, minor %d, and name %s\n",
+                device.major, device.minor, device.name);
+
+        /* binder device allocation test passed */
+        ksft_inc_pass_cnt();
+
+        fd = open("/dev/binderfs/my-binder", O_CLOEXEC | O_RDONLY);
+        if (fd < 0) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg("%s - Failed to open my-binder device\n",
+                                   strerror(errno));
+        }
+
+        ret = ioctl(fd, BINDER_VERSION, &version);
+        saved_errno = errno;
+        close(fd);
+        errno = saved_errno;
+        if (ret < 0) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg(
+                        "%s - Failed to open perform BINDER_VERSION request\n",
+                        strerror(errno));
+        }
+
+        ksft_print_msg("Detected binder version: %d\n",
+                       version.protocol_version);
+
+        /* binder transaction with binderfs binder device passed */
+        ksft_inc_pass_cnt();
+
+        ret = unlink("/dev/binderfs/my-binder");
+        if (ret < 0) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg("%s - Failed to delete binder device\n",
+                                   strerror(errno));
+        }
+
+        /* binder device removal passed */
+        ksft_inc_pass_cnt();
+
+        ret = unlink("/dev/binderfs/binder-control");
+        if (!ret) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg("Managed to delete binder-control device\n");
+        } else if (errno != EPERM) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg(
+                        "%s - Failed to delete binder-control device but exited with unexpected error code\n",
+                        strerror(errno));
+        }
+
+        /* binder-control device removal failed as expected */
+        ksft_inc_xfail_cnt();
+
+on_error:
+        ret = umount2("/dev/binderfs", MNT_DETACH);
+        keep ?: rmdir_protect_errno("/dev/binderfs");
+        if (ret < 0)
+                ksft_exit_fail_msg("%s - Failed to unmount binderfs\n",
+                                   strerror(errno));
+
+        /* binderfs unmount test passed */
+        ksft_inc_pass_cnt();
+}
+
+static void binderfs_test_privileged()
+{
+        if (geteuid() != 0)
+                ksft_print_msg(
+                        "Tests are not run as root. Skipping privileged tests\n");
+        else
+                __do_binderfs_test();
+}
+
+static void binderfs_test_unprivileged()
+{
+        change_to_userns();
+        __do_binderfs_test();
+}
+
+int main(int argc, char *argv[])
+{
+        binderfs_test_privileged();
+        binderfs_test_unprivileged();
+        ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/filesystems/binderfs/config b/tools/testing/selftests/filesystems/binderfs/config
new file mode 100644
index 000000000000..02dd6cc9cf99
--- /dev/null
+++ b/tools/testing/selftests/filesystems/binderfs/config
@@ -0,0 +1,3 @@
+CONFIG_ANDROID=y
+CONFIG_ANDROID_BINDERFS=y
+CONFIG_ANDROID_BINDER_IPC=y
diff --git a/tools/testing/selftests/ir/Makefile b/tools/testing/selftests/ir/Makefile
index f4ba8eb84b95..ad06489c22a5 100644
--- a/tools/testing/selftests/ir/Makefile
+++ b/tools/testing/selftests/ir/Makefile
@@ -1,5 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 TEST_PROGS := ir_loopback.sh
 TEST_GEN_PROGS_EXTENDED := ir_loopback
+APIDIR := ../../../include/uapi
+CFLAGS += -Wall -O2 -I$(APIDIR)
 
 include ../lib.mk
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index f8f3e90700c0..1e6d14d2825c 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -21,6 +21,6 @@ TEST_GEN_PROGS += reuseport_dualstack reuseaddr_conflict tls
 KSFT_KHDR_INSTALL := 1
 include ../lib.mk
 
-$(OUTPUT)/reuseport_bpf_numa: LDFLAGS += -lnuma
+$(OUTPUT)/reuseport_bpf_numa: LDLIBS += -lnuma
 $(OUTPUT)/tcp_mmap: LDFLAGS += -lpthread
 $(OUTPUT)/tcp_inq: LDFLAGS += -lpthread
diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile
index 47ed6cef93fb..c9ff2b47bd1c 100644
--- a/tools/testing/selftests/netfilter/Makefile
+++ b/tools/testing/selftests/netfilter/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 # Makefile for netfilter selftests
 
-TEST_PROGS := nft_trans_stress.sh
+TEST_PROGS := nft_trans_stress.sh nft_nat.sh
 
 include ../lib.mk
diff --git a/tools/testing/selftests/netfilter/config b/tools/testing/selftests/netfilter/config
index 1017313e41a8..59caa8f71cd8 100644
--- a/tools/testing/selftests/netfilter/config
+++ b/tools/testing/selftests/netfilter/config
@@ -1,2 +1,2 @@
 CONFIG_NET_NS=y
-NF_TABLES_INET=y
+CONFIG_NF_TABLES_INET=y
diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh
new file mode 100755
index 000000000000..8ec76681605c
--- /dev/null
+++ b/tools/testing/selftests/netfilter/nft_nat.sh
@@ -0,0 +1,762 @@
+#!/bin/bash
+#
+# This test is for basic NAT functionality: snat, dnat, redirect, masquerade.
+#
+
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+ret=0
+
+nft --version > /dev/null 2>&1
+if [ $? -ne 0 ];then
+        echo "SKIP: Could not run test without nft tool"
+        exit $ksft_skip
+fi
+
+ip -Version > /dev/null 2>&1
+if [ $? -ne 0 ];then
+        echo "SKIP: Could not run test without ip tool"
+        exit $ksft_skip
+fi
+
+ip netns add ns0
+ip netns add ns1
+ip netns add ns2
+
+ip link add veth0 netns ns0 type veth peer name eth0 netns ns1
+ip link add veth1 netns ns0 type veth peer name eth0 netns ns2
+
+ip -net ns0 link set lo up
+ip -net ns0 link set veth0 up
+ip -net ns0 addr add 10.0.1.1/24 dev veth0
+ip -net ns0 addr add dead:1::1/64 dev veth0
+
+ip -net ns0 link set veth1 up
+ip -net ns0 addr add 10.0.2.1/24 dev veth1
+ip -net ns0 addr add dead:2::1/64 dev veth1
+
+for i in 1 2; do
+  ip -net ns$i link set lo up
+  ip -net ns$i link set eth0 up
+  ip -net ns$i addr add 10.0.$i.99/24 dev eth0
+  ip -net ns$i route add default via 10.0.$i.1
+  ip -net ns$i addr add dead:$i::99/64 dev eth0
+  ip -net ns$i route add default via dead:$i::1
+done
+
+bad_counter()
+{
+        local ns=$1
+        local counter=$2
+        local expect=$3
+
+        echo "ERROR: $counter counter in $ns has unexpected value (expected $expect)" 1>&2
+        ip netns exec $ns nft list counter inet filter $counter 1>&2
+}
+
+check_counters()
+{
+        ns=$1
+        local lret=0
+
+        cnt=$(ip netns exec $ns nft list counter inet filter ns0in | grep -q "packets 1 bytes 84")
+        if [ $? -ne 0 ]; then
+                bad_counter $ns ns0in "packets 1 bytes 84"
+                lret=1
+        fi
+        cnt=$(ip netns exec $ns nft list counter inet filter ns0out | grep -q "packets 1 bytes 84")
+        if [ $? -ne 0 ]; then
+                bad_counter $ns ns0out "packets 1 bytes 84"
+                lret=1
+        fi
+
+        expect="packets 1 bytes 104"
+        cnt=$(ip netns exec $ns nft list counter inet filter ns0in6 | grep -q "$expect")
+        if [ $? -ne 0 ]; then
+                bad_counter $ns ns0in6 "$expect"
+                lret=1
+        fi
+        cnt=$(ip netns exec $ns nft list counter inet filter ns0out6 | grep -q "$expect")
+        if [ $? -ne 0 ]; then
+                bad_counter $ns ns0out6 "$expect"
+                lret=1
+        fi
+
+        return $lret
+}
+
+check_ns0_counters()
+{
+        local ns=$1
+        local lret=0
+
+        cnt=$(ip netns exec ns0 nft list counter inet filter ns0in | grep -q "packets 0 bytes 0")
+        if [ $? -ne 0 ]; then
+                bad_counter ns0 ns0in "packets 0 bytes 0"
+                lret=1
+        fi
+
+        cnt=$(ip netns exec ns0 nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0")
+        if [ $? -ne 0 ]; then
+                bad_counter ns0 ns0in6 "packets 0 bytes 0"
+                lret=1
+        fi
+
+        cnt=$(ip netns exec ns0 nft list counter inet filter ns0out | grep -q "packets 0 bytes 0")
+        if [ $? -ne 0 ]; then
+                bad_counter ns0 ns0out "packets 0 bytes 0"
+                lret=1
+        fi
+        cnt=$(ip netns exec ns0 nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0")
+        if [ $? -ne 0 ]; then
+                bad_counter ns0 ns0out6 "packets 0 bytes 0"
+                lret=1
+        fi
+
+        for dir in "in" "out" ; do
+                expect="packets 1 bytes 84"
+                cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 $ns$dir "$expect"
+                        lret=1
+                fi
+
+                expect="packets 1 bytes 104"
+                cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir}6 | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 $ns$dir6 "$expect"
+                        lret=1
+                fi
+        done
+
+        return $lret
+}
+
+reset_counters()
+{
+        for i in 0 1 2;do
+                ip netns exec ns$i nft reset counters inet > /dev/null
+        done
+}
+
+test_local_dnat6()
+{
+        local lret=0
+ip netns exec ns0 nft -f - <<EOF
+table ip6 nat {
+        chain output {
+                type nat hook output priority 0; policy accept;
+                ip6 daddr dead:1::99 dnat to dead:2::99
+        }
+}
+EOF
+        if [ $? -ne 0 ]; then
+                echo "SKIP: Could not add add ip6 dnat hook"
+                return $ksft_skip
+        fi
+
+        # ping netns1, expect rewrite to netns2
+        ip netns exec ns0 ping -q -c 1 dead:1::99 > /dev/null
+        if [ $? -ne 0 ]; then
+                lret=1
+                echo "ERROR: ping6 failed"
+                return $lret
+        fi
+
+        expect="packets 0 bytes 0"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns2$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 0 count in ns1
+        expect="packets 0 bytes 0"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 1 packet in ns2
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        test $lret -eq 0 && echo "PASS: ipv6 ping to ns1 was NATted to ns2"
+        ip netns exec ns0 nft flush chain ip6 nat output
+
+        return $lret
+}
+
+test_local_dnat()
+{
+        local lret=0
+ip netns exec ns0 nft -f - <<EOF
+table ip nat {
+        chain output {
+                type nat hook output priority 0; policy accept;
+                ip daddr 10.0.1.99 dnat to 10.0.2.99
+        }
+}
+EOF
+        # ping netns1, expect rewrite to netns2
+        ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null
+        if [ $? -ne 0 ]; then
+                lret=1
+                echo "ERROR: ping failed"
+                return $lret
+        fi
+
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns2$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 0 count in ns1
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 1 packet in ns2
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        test $lret -eq 0 && echo "PASS: ping to ns1 was NATted to ns2"
+
+        ip netns exec ns0 nft flush chain ip nat output
+
+        reset_counters
+        ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null
+        if [ $? -ne 0 ]; then
+                lret=1
+                echo "ERROR: ping failed"
+                return $lret
+        fi
+
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns2$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 1 count in ns1
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 0 packet in ns2
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns2$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        test $lret -eq 0 && echo "PASS: ping to ns1 OK after nat output chain flush"
+
+        return $lret
+}
+
+
+test_masquerade6()
+{
+        local lret=0
+
+        ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
+
+        ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 via ipv6"
+                return 1
+                lret=1
+        fi
+
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns2$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        reset_counters
+
+# add masquerading rule
+ip netns exec ns0 nft -f - <<EOF
+table ip6 nat {
+        chain postrouting {
+                type nat hook postrouting priority 0; policy accept;
+                meta oif veth0 masquerade
+        }
+}
+EOF
+        ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerading"
+                lret=1
+        fi
+
+        # ns1 should have seen packets from ns0, due to masquerade
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # ns1 should not have seen packets from ns2, due to masquerade
+        expect="packets 0 bytes 0"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        ip netns exec ns0 nft flush chain ip6 nat postrouting
+        if [ $? -ne 0 ]; then
+                echo "ERROR: Could not flush ip6 nat postrouting" 1>&2
+                lret=1
+        fi
+
+        test $lret -eq 0 && echo "PASS: IPv6 masquerade for ns2"
+
+        return $lret
+}
+
+test_masquerade()
+{
+        local lret=0
+
+        ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
+        ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
+
+        ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: canot ping ns1 from ns2"
+                lret=1
+        fi
+
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns2$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        reset_counters
+
+# add masquerading rule
+ip netns exec ns0 nft -f - <<EOF
+table ip nat {
+        chain postrouting {
+                type nat hook postrouting priority 0; policy accept;
+                meta oif veth0 masquerade
+        }
+}
+EOF
+        ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 with active ip masquerading"
+                lret=1
+        fi
+
+        # ns1 should have seen packets from ns0, due to masquerade
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # ns1 should not have seen packets from ns2, due to masquerade
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        ip netns exec ns0 nft flush chain ip nat postrouting
+        if [ $? -ne 0 ]; then
+                echo "ERROR: Could not flush nat postrouting" 1>&2
+                lret=1
+        fi
+
+        test $lret -eq 0 && echo "PASS: IP masquerade for ns2"
+
+        return $lret
+}
+
+test_redirect6()
+{
+        local lret=0
+
+        ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
+
+        ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannnot ping ns1 from ns2 via ipv6"
+                lret=1
+        fi
+
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns2$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        reset_counters
+
+# add redirect rule
+ip netns exec ns0 nft -f - <<EOF
+table ip6 nat {
+        chain prerouting {
+                type nat hook prerouting priority 0; policy accept;
+                meta iif veth1 meta l4proto icmpv6 ip6 saddr dead:2::99 ip6 daddr dead:1::99 redirect
+        }
+}
+EOF
+        ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 with active ip6 redirect"
+                lret=1
+        fi
+
+        # ns1 should have seen no packets from ns2, due to redirection
+        expect="packets 0 bytes 0"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # ns0 should have seen packets from ns2, due to masquerade
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        ip netns exec ns0 nft delete table ip6 nat
+        if [ $? -ne 0 ]; then
+                echo "ERROR: Could not delete ip6 nat table" 1>&2
+                lret=1
+        fi
+
+        test $lret -eq 0 && echo "PASS: IPv6 redirection for ns2"
+
+        return $lret
+}
+
+test_redirect()
+{
+        local lret=0
+
+        ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
+        ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
+
+        ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2"
+                lret=1
+        fi
+
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns2$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        reset_counters
+
+# add redirect rule
+ip netns exec ns0 nft -f - <<EOF
+table ip nat {
+        chain prerouting {
+                type nat hook prerouting priority 0; policy accept;
+                meta iif veth1 ip protocol icmp ip saddr 10.0.2.99 ip daddr 10.0.1.99 redirect
+        }
+}
+EOF
+        ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 with active ip redirect"
+                lret=1
+        fi
+
+        # ns1 should have seen no packets from ns2, due to redirection
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # ns0 should have seen packets from ns2, due to masquerade
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        ip netns exec ns0 nft delete table ip nat
+        if [ $? -ne 0 ]; then
+                echo "ERROR: Could not delete nat table" 1>&2
+                lret=1
+        fi
+
+        test $lret -eq 0 && echo "PASS: IP redirection for ns2"
+
+        return $lret
+}
+
+
+# ip netns exec ns0 ping -c 1 -q 10.0.$i.99
+for i in 0 1 2; do
+ip netns exec ns$i nft -f - <<EOF
+table inet filter {
+        counter ns0in {}
+        counter ns1in {}
+        counter ns2in {}
+
+        counter ns0out {}
+        counter ns1out {}
+        counter ns2out {}
+
+        counter ns0in6 {}
+        counter ns1in6 {}
+        counter ns2in6 {}
+
+        counter ns0out6 {}
+        counter ns1out6 {}
+        counter ns2out6 {}
+
+        map nsincounter {
+                type ipv4_addr : counter
+                elements = { 10.0.1.1 : "ns0in",
+                             10.0.2.1 : "ns0in",
+                             10.0.1.99 : "ns1in",
+                             10.0.2.99 : "ns2in" }
+        }
+
+        map nsincounter6 {
+                type ipv6_addr : counter
+                elements = { dead:1::1 : "ns0in6",
+                             dead:2::1 : "ns0in6",
+                             dead:1::99 : "ns1in6",
+                             dead:2::99 : "ns2in6" }
+        }
+
+        map nsoutcounter {
+                type ipv4_addr : counter
+                elements = { 10.0.1.1 : "ns0out",
+                             10.0.2.1 : "ns0out",
+                             10.0.1.99: "ns1out",
+                             10.0.2.99: "ns2out" }
+        }
+
+        map nsoutcounter6 {
+                type ipv6_addr : counter
+                elements = { dead:1::1 : "ns0out6",
+                             dead:2::1 : "ns0out6",
+                             dead:1::99 : "ns1out6",
+                             dead:2::99 : "ns2out6" }
+        }
+
+        chain input {
+                type filter hook input priority 0; policy accept;
+                counter name ip saddr map @nsincounter
+                icmpv6 type { "echo-request", "echo-reply" } counter name ip6 saddr map @nsincounter6
+        }
+        chain output {
+                type filter hook output priority 0; policy accept;
+                counter name ip daddr map @nsoutcounter
+                icmpv6 type { "echo-request", "echo-reply" } counter name ip6 daddr map @nsoutcounter6
+        }
+}
+EOF
+done
+
+sleep 3
+# test basic connectivity
+for i in 1 2; do
+  ip netns exec ns0 ping -c 1 -q 10.0.$i.99 > /dev/null
+  if [ $? -ne 0 ];then
+        echo "ERROR: Could not reach other namespace(s)" 1>&2
+        ret=1
+  fi
+
+  ip netns exec ns0 ping -c 1 -q dead:$i::99 > /dev/null
+  if [ $? -ne 0 ];then
+        echo "ERROR: Could not reach other namespace(s) via ipv6" 1>&2
+        ret=1
+  fi
+  check_counters ns$i
+  if [ $? -ne 0 ]; then
+        ret=1
+  fi
+
+  check_ns0_counters ns$i
+  if [ $? -ne 0 ]; then
+        ret=1
+  fi
+  reset_counters
+done
+
+if [ $ret -eq 0 ];then
+        echo "PASS: netns routing/connectivity: ns0 can reach ns1 and ns2"
+fi
+
+reset_counters
+test_local_dnat
+test_local_dnat6
+
+reset_counters
+test_masquerade
+test_masquerade6
+
+reset_counters
+test_redirect
+test_redirect6
+
+for i in 0 1 2; do ip netns del ns$i;done
+
+exit $ret
diff --git a/tools/testing/selftests/proc/.gitignore b/tools/testing/selftests/proc/.gitignore
index 82121a81681f..29bac5ef9a93 100644
--- a/tools/testing/selftests/proc/.gitignore
+++ b/tools/testing/selftests/proc/.gitignore
@@ -10,4 +10,5 @@
 /proc-uptime-002
 /read
 /self
+/setns-dcache
 /thread-self
diff --git a/tools/testing/selftests/proc/Makefile b/tools/testing/selftests/proc/Makefile
index 1c12c34cf85d..434d033ee067 100644
--- a/tools/testing/selftests/proc/Makefile
+++ b/tools/testing/selftests/proc/Makefile
@@ -14,6 +14,7 @@ TEST_GEN_PROGS += proc-uptime-001
 TEST_GEN_PROGS += proc-uptime-002
 TEST_GEN_PROGS += read
 TEST_GEN_PROGS += self
+TEST_GEN_PROGS += setns-dcache
 TEST_GEN_PROGS += thread-self
 
 include ../lib.mk
diff --git a/tools/testing/selftests/proc/setns-dcache.c b/tools/testing/selftests/proc/setns-dcache.c
new file mode 100644
index 000000000000..60ab197a73fc
--- /dev/null
+++ b/tools/testing/selftests/proc/setns-dcache.c
@@ -0,0 +1,129 @@
+/*
+ * Copyright © 2019 Alexey Dobriyan <adobriyan@gmail.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+/*
+ * Test that setns(CLONE_NEWNET) points to new /proc/net content even
+ * if old one is in dcache.
+ *
+ * FIXME /proc/net/unix is under CONFIG_UNIX which can be disabled.
+ */
+#undef NDEBUG
+#include <assert.h>
+#include <errno.h>
+#include <sched.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <sys/socket.h>
+
+static pid_t pid = -1;
+
+static void f(void)
+{
+        if (pid > 0) {
+                kill(pid, SIGTERM);
+        }
+}
+
+int main(void)
+{
+        int fd[2];
+        char _ = 0;
+        int nsfd;
+
+        atexit(f);
+
+        /* Check for priviledges and syscall availability straight away. */
+        if (unshare(CLONE_NEWNET) == -1) {
+                if (errno == ENOSYS || errno == EPERM) {
+                        return 4;
+                }
+                return 1;
+        }
+        /* Distinguisher between two otherwise empty net namespaces. */
+        if (socket(AF_UNIX, SOCK_STREAM, 0) == -1) {
+                return 1;
+        }
+
+        if (pipe(fd) == -1) {
+                return 1;
+        }
+
+        pid = fork();
+        if (pid == -1) {
+                return 1;
+        }
+
+        if (pid == 0) {
+                if (unshare(CLONE_NEWNET) == -1) {
+                        return 1;
+                }
+
+                if (write(fd[1], &_, 1) != 1) {
+                        return 1;
+                }
+
+                pause();
+
+                return 0;
+        }
+
+        if (read(fd[0], &_, 1) != 1) {
+                return 1;
+        }
+
+        {
+                char buf[64];
+                snprintf(buf, sizeof(buf), "/proc/%u/ns/net", pid);
+                nsfd = open(buf, O_RDONLY);
+                if (nsfd == -1) {
+                        return 1;
+                }
+        }
+
+        /* Reliably pin dentry into dcache. */
+        (void)open("/proc/net/unix", O_RDONLY);
+
+        if (setns(nsfd, CLONE_NEWNET) == -1) {
+                return 1;
+        }
+
+        kill(pid, SIGTERM);
+        pid = 0;
+
+        {
+                char buf[4096];
+                ssize_t rv;
+                int fd;
+
+                fd = open("/proc/net/unix", O_RDONLY);
+                if (fd == -1) {
+                        return 1;
+                }
+
+#define S "Num       RefCount Protocol Flags    Type St Inode Path\n"
+                rv = read(fd, buf, sizeof(buf));
+
+                assert(rv == strlen(S));
+                assert(memcmp(buf, S, strlen(S)) == 0);
+        }
+
+        return 0;
+}
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 496a9a8c773a..7e632b465ab4 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -1608,7 +1608,16 @@ TEST_F(TRACE_poke, getpid_runs_normally)
 #ifdef SYSCALL_NUM_RET_SHARE_REG
 # define EXPECT_SYSCALL_RETURN(val, action)     EXPECT_EQ(-1, action)
 #else
-# define EXPECT_SYSCALL_RETURN(val, action)     EXPECT_EQ(val, action)
+# define EXPECT_SYSCALL_RETURN(val, action)             \
+        do {                                            \
+                errno = 0;                              \
+                if (val < 0) {                          \
+                        EXPECT_EQ(-1, action);          \
+                        EXPECT_EQ(-(val), errno);       \
+                } else {                                \
+                        EXPECT_EQ(val, action);         \
+                }                                       \
+        } while (0)
 #endif
 
 /* Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for
@@ -1647,7 +1656,7 @@ int get_syscall(struct __test_metadata *_metadata, pid_t tracee)
 
 /* Architecture-specific syscall changing routine. */
 void change_syscall(struct __test_metadata *_metadata,
-                    pid_t tracee, int syscall)
+                    pid_t tracee, int syscall, int result)
 {
         int ret;
         ARCH_REGS regs;
@@ -1706,7 +1715,7 @@ void change_syscall(struct __test_metadata *_metadata,
 #ifdef SYSCALL_NUM_RET_SHARE_REG
                 TH_LOG("Can't modify syscall return on this architecture");
 #else
-                regs.SYSCALL_RET = EPERM;
+                regs.SYSCALL_RET = result;
 #endif
 
 #ifdef HAVE_GETREGS
@@ -1734,14 +1743,19 @@ void tracer_syscall(struct __test_metadata *_metadata, pid_t tracee,
         case 0x1002:
                 /* change getpid to getppid. */
                 EXPECT_EQ(__NR_getpid, get_syscall(_metadata, tracee));
-                change_syscall(_metadata, tracee, __NR_getppid);
+                change_syscall(_metadata, tracee, __NR_getppid, 0);
                 break;
         case 0x1003:
-                /* skip gettid. */
+                /* skip gettid with valid return code. */
                 EXPECT_EQ(__NR_gettid, get_syscall(_metadata, tracee));
-                change_syscall(_metadata, tracee, -1);
+                change_syscall(_metadata, tracee, -1, 45000);
                 break;
         case 0x1004:
+                /* skip openat with error. */
+                EXPECT_EQ(__NR_openat, get_syscall(_metadata, tracee));
+                change_syscall(_metadata, tracee, -1, -ESRCH);
+                break;
+        case 0x1005:
                 /* do nothing (allow getppid) */
                 EXPECT_EQ(__NR_getppid, get_syscall(_metadata, tracee));
                 break;
@@ -1774,9 +1788,11 @@ void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee,
         nr = get_syscall(_metadata, tracee);
 
         if (nr == __NR_getpid)
-                change_syscall(_metadata, tracee, __NR_getppid);
+                change_syscall(_metadata, tracee, __NR_getppid, 0);
+        if (nr == __NR_gettid)
+                change_syscall(_metadata, tracee, -1, 45000);
         if (nr == __NR_openat)
-                change_syscall(_metadata, tracee, -1);
+                change_syscall(_metadata, tracee, -1, -ESRCH);
 }
 
 FIXTURE_DATA(TRACE_syscall) {
@@ -1793,8 +1809,10 @@ FIXTURE_SETUP(TRACE_syscall)
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1002),
                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_gettid, 0, 1),
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1003),
-                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_openat, 0, 1),
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1004),
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1005),
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
         };
 
@@ -1842,15 +1860,26 @@ TEST_F(TRACE_syscall, ptrace_syscall_redirected)
         EXPECT_NE(self->mypid, syscall(__NR_getpid));
 }
 
-TEST_F(TRACE_syscall, ptrace_syscall_dropped)
+TEST_F(TRACE_syscall, ptrace_syscall_errno)
+{
+        /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
+        teardown_trace_fixture(_metadata, self->tracer);
+        self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
+                                           true);
+
+        /* Tracer should skip the open syscall, resulting in ESRCH. */
+        EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat));
+}
+
+TEST_F(TRACE_syscall, ptrace_syscall_faked)
 {
         /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
         teardown_trace_fixture(_metadata, self->tracer);
         self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
                                            true);
 
-        /* Tracer should skip the open syscall, resulting in EPERM. */
-        EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_openat));
+        /* Tracer should skip the gettid syscall, resulting fake pid. */
+        EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid));
 }
 
 TEST_F(TRACE_syscall, syscall_allowed)
@@ -1883,7 +1912,21 @@ TEST_F(TRACE_syscall, syscall_redirected)
         EXPECT_NE(self->mypid, syscall(__NR_getpid));
 }
 
-TEST_F(TRACE_syscall, syscall_dropped)
+TEST_F(TRACE_syscall, syscall_errno)
+{
+        long ret;
+
+        ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+        ASSERT_EQ(0, ret);
+
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
+        ASSERT_EQ(0, ret);
+
+        /* openat has been skipped and an errno return. */
+        EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat));
+}
+
+TEST_F(TRACE_syscall, syscall_faked)
 {
         long ret;
 
@@ -1894,8 +1937,7 @@ TEST_F(TRACE_syscall, syscall_dropped)
         ASSERT_EQ(0, ret);
 
         /* gettid has been skipped and an altered return value stored. */
-        EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_gettid));
-        EXPECT_NE(self->mytid, syscall(__NR_gettid));
+        EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid));
 }
 
 TEST_F(TRACE_syscall, skip_after_RET_TRACE)
diff --git a/tools/testing/selftests/timers/Makefile b/tools/testing/selftests/timers/Makefile
index c02683cfb6c9..7656c7ce79d9 100644
--- a/tools/testing/selftests/timers/Makefile
+++ b/tools/testing/selftests/timers/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 CFLAGS += -O3 -Wl,-no-as-needed -Wall
-LDFLAGS += -lrt -lpthread -lm
+LDLIBS += -lrt -lpthread -lm
 
 # these are all "safe" tests that don't modify
 # system time or require escalated privileges
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 5ecea812cb6a..585845203db8 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -3000,8 +3000,10 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
         if (ops->init)
                 ops->init(dev);
 
+        kvm_get_kvm(kvm);
         ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
         if (ret < 0) {
+                kvm_put_kvm(kvm);
                 mutex_lock(&kvm->lock);
                 list_del(&dev->vm_node);
                 mutex_unlock(&kvm->lock);
@@ -3009,7 +3011,6 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
                 return ret;
         }
 
-        kvm_get_kvm(kvm);
         cd->fd = ret;
         return 0;
 }