274 files changed, 2840 insertions, 1642 deletions

diff --git a/CREDITS b/CREDITS
index 84cbec4c6211..c9273393fe14 100644
--- a/CREDITS
+++ b/CREDITS
@@ -2204,6 +2204,10 @@ S: Post Office Box 371
 S: North Little Rock, Arkansas 72115
 S: USA
 
+N: Christopher Li
+E: sparse@chrisli.org
+D: Sparse maintainer 2009 - 2018
+
 N: Stephan Linz
 E: linz@mazet.de
 E: Stephan.Linz@gmx.de
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 81d1d5a74728..19f4423e70d9 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4713,6 +4713,8 @@
                                         prevent spurious wakeup);
                                 n = USB_QUIRK_DELAY_CTRL_MSG (Device needs a
                                         pause after every control message);
+                                o = USB_QUIRK_HUB_SLOW_RESET (Hub needs extra
+                                        delay after resetting its port);
                         Example: quirks=0781:5580:bk,0a5c:5834:gij
 
         usbhid.mousepoll=
diff --git a/Documentation/admin-guide/security-bugs.rst b/Documentation/admin-guide/security-bugs.rst
index 164bf71149fd..30187d49dc2c 100644
--- a/Documentation/admin-guide/security-bugs.rst
+++ b/Documentation/admin-guide/security-bugs.rst
@@ -32,16 +32,17 @@ Disclosure and embargoed information
 The security list is not a disclosure channel.  For that, see Coordination
 below.
 
-Once a robust fix has been developed, our preference is to release the
-fix in a timely fashion, treating it no differently than any of the other
-thousands of changes and fixes the Linux kernel project releases every
-month.
-
-However, at the request of the reporter, we will postpone releasing the
-fix for up to 5 business days after the date of the report or after the
-embargo has lifted; whichever comes first.  The only exception to that
-rule is if the bug is publicly known, in which case the preference is to
-release the fix as soon as it's available.
+Once a robust fix has been developed, the release process starts.  Fixes
+for publicly known bugs are released immediately.
+
+Although our preference is to release fixes for publicly undisclosed bugs
+as soon as they become available, this may be postponed at the request of
+the reporter or an affected party for up to 7 calendar days from the start
+of the release process, with an exceptional extension to 14 calendar days
+if it is agreed that the criticality of the bug requires more time.  The
+only valid reason for deferring the publication of a fix is to accommodate
+the logistics of QA and large scale rollouts which require release
+coordination.
 
 Whilst embargoed information may be shared with trusted individuals in
 order to develop a fix, such information will not be published alongside
diff --git a/Documentation/core-api/xarray.rst b/Documentation/core-api/xarray.rst
index a4e705108f42..dbe96cb5558e 100644
--- a/Documentation/core-api/xarray.rst
+++ b/Documentation/core-api/xarray.rst
@@ -74,7 +74,8 @@ using :c:func:`xa_load`.  xa_store will overwrite any entry with the
 new entry and return the previous entry stored at that index.  You can
 use :c:func:`xa_erase` instead of calling :c:func:`xa_store` with a
 ``NULL`` entry.  There is no difference between an entry that has never
-been stored to and one that has most recently had ``NULL`` stored to it.
+been stored to, one that has been erased and one that has most recently
+had ``NULL`` stored to it.
 
 You can conditionally replace an entry at an index by using
 :c:func:`xa_cmpxchg`.  Like :c:func:`cmpxchg`, it will only succeed if
@@ -105,23 +106,44 @@ may result in the entry being marked at some, but not all of the other
 indices.  Storing into one index may result in the entry retrieved by
 some, but not all of the other indices changing.
 
+Sometimes you need to ensure that a subsequent call to :c:func:`xa_store`
+will not need to allocate memory.  The :c:func:`xa_reserve` function
+will store a reserved entry at the indicated index.  Users of the normal
+API will see this entry as containing ``NULL``.  If you do not need to
+use the reserved entry, you can call :c:func:`xa_release` to remove the
+unused entry.  If another user has stored to the entry in the meantime,
+:c:func:`xa_release` will do nothing; if instead you want the entry to
+become ``NULL``, you should use :c:func:`xa_erase`.
+
+If all entries in the array are ``NULL``, the :c:func:`xa_empty` function
+will return ``true``.
+
 Finally, you can remove all entries from an XArray by calling
 :c:func:`xa_destroy`.  If the XArray entries are pointers, you may wish
 to free the entries first.  You can do this by iterating over all present
 entries in the XArray using the :c:func:`xa_for_each` iterator.
 
-ID assignment
--------------
+Allocating XArrays
+------------------
+
+If you use :c:func:`DEFINE_XARRAY_ALLOC` to define the XArray, or
+initialise it by passing ``XA_FLAGS_ALLOC`` to :c:func:`xa_init_flags`,
+the XArray changes to track whether entries are in use or not.
 
 You can call :c:func:`xa_alloc` to store the entry at any unused index
 in the XArray.  If you need to modify the array from interrupt context,
 you can use :c:func:`xa_alloc_bh` or :c:func:`xa_alloc_irq` to disable
-interrupts while allocating the ID.  Unlike :c:func:`xa_store`, allocating
-a ``NULL`` pointer does not delete an entry.  Instead it reserves an
-entry like :c:func:`xa_reserve` and you can release it using either
-:c:func:`xa_erase` or :c:func:`xa_release`.  To use ID assignment, the
-XArray must be defined with :c:func:`DEFINE_XARRAY_ALLOC`, or initialised
-by passing ``XA_FLAGS_ALLOC`` to :c:func:`xa_init_flags`,
+interrupts while allocating the ID.
+
+Using :c:func:`xa_store`, :c:func:`xa_cmpxchg` or :c:func:`xa_insert`
+will mark the entry as being allocated.  Unlike a normal XArray, storing
+``NULL`` will mark the entry as being in use, like :c:func:`xa_reserve`.
+To free an entry, use :c:func:`xa_erase` (or :c:func:`xa_release` if
+you only want to free the entry if it's ``NULL``).
+
+You cannot use ``XA_MARK_0`` with an allocating XArray as this mark
+is used to track whether an entry is free or not.  The other marks are
+available for your use.
 
 Memory allocation
 -----------------
@@ -158,6 +180,8 @@ Takes RCU read lock:
 
 Takes xa_lock internally:
  * :c:func:`xa_store`
+ * :c:func:`xa_store_bh`
+ * :c:func:`xa_store_irq`
  * :c:func:`xa_insert`
  * :c:func:`xa_erase`
  * :c:func:`xa_erase_bh`
@@ -167,6 +191,9 @@ Takes xa_lock internally:
  * :c:func:`xa_alloc`
  * :c:func:`xa_alloc_bh`
  * :c:func:`xa_alloc_irq`
+ * :c:func:`xa_reserve`
+ * :c:func:`xa_reserve_bh`
+ * :c:func:`xa_reserve_irq`
  * :c:func:`xa_destroy`
  * :c:func:`xa_set_mark`
  * :c:func:`xa_clear_mark`
@@ -177,6 +204,7 @@ Assumes xa_lock held on entry:
  * :c:func:`__xa_erase`
  * :c:func:`__xa_cmpxchg`
  * :c:func:`__xa_alloc`
+ * :c:func:`__xa_reserve`
  * :c:func:`__xa_set_mark`
  * :c:func:`__xa_clear_mark`
 
@@ -234,7 +262,8 @@ Sharing the XArray with interrupt context is also possible, either
 using :c:func:`xa_lock_irqsave` in both the interrupt handler and process
 context, or :c:func:`xa_lock_irq` in process context and :c:func:`xa_lock`
 in the interrupt handler.  Some of the more common patterns have helper
-functions such as :c:func:`xa_erase_bh` and :c:func:`xa_erase_irq`.
+functions such as :c:func:`xa_store_bh`, :c:func:`xa_store_irq`,
+:c:func:`xa_erase_bh` and :c:func:`xa_erase_irq`.
 
 Sometimes you need to protect access to the XArray with a mutex because
 that lock sits above another mutex in the locking hierarchy.  That does
@@ -322,7 +351,8 @@ to :c:func:`xas_retry`, and retry the operation if it returns ``true``.
      - :c:func:`xa_is_zero`
      - Zero entries appear as ``NULL`` through the Normal API, but occupy
        an entry in the XArray which can be used to reserve the index for
-       future use.
+       future use.  This is used by allocating XArrays for allocated entries
+       which are ``NULL``.
 
 Other internal entries may be added in the future.  As far as possible, they
 will be handled by :c:func:`xas_retry`.
diff --git a/Documentation/devicetree/bindings/net/can/holt_hi311x.txt b/Documentation/devicetree/bindings/net/can/holt_hi311x.txt
index 903a78da65be..3a9926f99937 100644
--- a/Documentation/devicetree/bindings/net/can/holt_hi311x.txt
+++ b/Documentation/devicetree/bindings/net/can/holt_hi311x.txt
@@ -17,7 +17,7 @@ Example:
                 reg = <1>;
                 clocks = <&clk32m>;
                 interrupt-parent = <&gpio4>;
-                interrupts = <13 IRQ_TYPE_EDGE_RISING>;
+                interrupts = <13 IRQ_TYPE_LEVEL_HIGH>;
                 vdd-supply = <&reg5v0>;
                 xceiver-supply = <&reg5v0>;
         };
diff --git a/Documentation/devicetree/bindings/net/can/rcar_can.txt b/Documentation/devicetree/bindings/net/can/rcar_can.txt
index cc4372842bf3..9936b9ee67c3 100644
--- a/Documentation/devicetree/bindings/net/can/rcar_can.txt
+++ b/Documentation/devicetree/bindings/net/can/rcar_can.txt
@@ -5,6 +5,7 @@ Required properties:
 - compatible: "renesas,can-r8a7743" if CAN controller is a part of R8A7743 SoC.
               "renesas,can-r8a7744" if CAN controller is a part of R8A7744 SoC.
               "renesas,can-r8a7745" if CAN controller is a part of R8A7745 SoC.
+              "renesas,can-r8a774a1" if CAN controller is a part of R8A774A1 SoC.
               "renesas,can-r8a7778" if CAN controller is a part of R8A7778 SoC.
               "renesas,can-r8a7779" if CAN controller is a part of R8A7779 SoC.
               "renesas,can-r8a7790" if CAN controller is a part of R8A7790 SoC.
@@ -14,26 +15,32 @@ Required properties:
               "renesas,can-r8a7794" if CAN controller is a part of R8A7794 SoC.
               "renesas,can-r8a7795" if CAN controller is a part of R8A7795 SoC.
               "renesas,can-r8a7796" if CAN controller is a part of R8A7796 SoC.
+              "renesas,can-r8a77965" if CAN controller is a part of R8A77965 SoC.
               "renesas,rcar-gen1-can" for a generic R-Car Gen1 compatible device.
               "renesas,rcar-gen2-can" for a generic R-Car Gen2 or RZ/G1
               compatible device.
-              "renesas,rcar-gen3-can" for a generic R-Car Gen3 compatible device.
+              "renesas,rcar-gen3-can" for a generic R-Car Gen3 or RZ/G2
+              compatible device.
               When compatible with the generic version, nodes must list the
               SoC-specific version corresponding to the platform first
               followed by the generic version.
 
 - reg: physical base address and size of the R-Car CAN register map.
 - interrupts: interrupt specifier for the sole interrupt.
-- clocks: phandles and clock specifiers for 3 CAN clock inputs.
-- clock-names: 3 clock input name strings: "clkp1", "clkp2", "can_clk".
+- clocks: phandles and clock specifiers for 2 CAN clock inputs for RZ/G2
+          devices.
+          phandles and clock specifiers for 3 CAN clock inputs for every other
+          SoC.
+- clock-names: 2 clock input name strings for RZ/G2: "clkp1", "can_clk".
+               3 clock input name strings for every other SoC: "clkp1", "clkp2",
+               "can_clk".
 - pinctrl-0: pin control group to be used for this controller.
 - pinctrl-names: must be "default".
 
-Required properties for "renesas,can-r8a7795" and "renesas,can-r8a7796"
-compatible:
-In R8A7795 and R8A7796 SoCs, "clkp2" can be CANFD clock. This is a div6 clock
-and can be used by both CAN and CAN FD controller at the same time. It needs to
-be scaled to maximum frequency if any of these controllers use it. This is done
+Required properties for R8A7795, R8A7796 and R8A77965:
+For the denoted SoCs, "clkp2" can be CANFD clock. This is a div6 clock and can
+be used by both CAN and CAN FD controller at the same time. It needs to be
+scaled to maximum frequency if any of these controllers use it. This is done
 using the below properties:
 
 - assigned-clocks: phandle of clkp2(CANFD) clock.
@@ -42,8 +49,9 @@ using the below properties:
 Optional properties:
 - renesas,can-clock-select: R-Car CAN Clock Source Select. Valid values are:
                             <0x0> (default) : Peripheral clock (clkp1)
-                            <0x1> : Peripheral clock (clkp2)
-                            <0x3> : Externally input clock
+                            <0x1> : Peripheral clock (clkp2) (not supported by
+                                    RZ/G2 devices)
+                            <0x3> : External input clock
 
 Example
 -------
diff --git a/Documentation/devicetree/bindings/net/dsa/dsa.txt b/Documentation/devicetree/bindings/net/dsa/dsa.txt
index 3ceeb8de1196..35694c0c376b 100644
--- a/Documentation/devicetree/bindings/net/dsa/dsa.txt
+++ b/Documentation/devicetree/bindings/net/dsa/dsa.txt
@@ -7,7 +7,7 @@ limitations.
 Current Binding
 ---------------
 
-Switches are true Linux devices and can be probes by any means. Once
+Switches are true Linux devices and can be probed by any means. Once
 probed, they register to the DSA framework, passing a node
 pointer. This node is expected to fulfil the following binding, and
 may contain additional properties as required by the device it is
diff --git a/Documentation/input/event-codes.rst b/Documentation/input/event-codes.rst
index cef220c176a4..a8c0873beb95 100644
--- a/Documentation/input/event-codes.rst
+++ b/Documentation/input/event-codes.rst
@@ -190,16 +190,7 @@ A few EV_REL codes have special meanings:
 * REL_WHEEL, REL_HWHEEL:
 
   - These codes are used for vertical and horizontal scroll wheels,
-    respectively. The value is the number of "notches" moved on the wheel, the
-    physical size of which varies by device. For high-resolution wheels (which
-    report multiple events for each notch of movement, or do not have notches)
-    this may be an approximation based on the high-resolution scroll events.
-
-* REL_WHEEL_HI_RES:
-
-  - If a vertical scroll wheel supports high-resolution scrolling, this code
-    will be emitted in addition to REL_WHEEL. The value is the (approximate)
-    distance travelled by the user's finger, in microns.
+    respectively.
 
 EV_ABS
 ------
diff --git a/Documentation/media/uapi/v4l/dev-meta.rst b/Documentation/media/uapi/v4l/dev-meta.rst
index f7ac8d0d3af1..b65dc078abeb 100644
--- a/Documentation/media/uapi/v4l/dev-meta.rst
+++ b/Documentation/media/uapi/v4l/dev-meta.rst
@@ -40,7 +40,7 @@ To use the :ref:`format` ioctls applications set the ``type`` field of the
 the desired operation. Both drivers and applications must set the remainder of
 the :c:type:`v4l2_format` structure to 0.
 
-.. _v4l2-meta-format:
+.. c:type:: v4l2_meta_format
 
 .. tabularcolumns:: |p{1.4cm}|p{2.2cm}|p{13.9cm}|
 
diff --git a/Documentation/media/uapi/v4l/vidioc-g-fmt.rst b/Documentation/media/uapi/v4l/vidioc-g-fmt.rst
index 3ead350e099f..9ea494a8faca 100644
--- a/Documentation/media/uapi/v4l/vidioc-g-fmt.rst
+++ b/Documentation/media/uapi/v4l/vidioc-g-fmt.rst
@@ -133,6 +133,11 @@ The format as returned by :ref:`VIDIOC_TRY_FMT <VIDIOC_G_FMT>` must be identical
       - Definition of a data format, see :ref:`pixfmt`, used by SDR
         capture and output devices.
     * -
+      - struct :c:type:`v4l2_meta_format`
+      - ``meta``
+      - Definition of a metadata format, see :ref:`meta-formats`, used by
+        metadata capture devices.
+    * -
       - __u8
       - ``raw_data``\ [200]
       - Place holder for future extensions.
diff --git a/Documentation/networking/rxrpc.txt b/Documentation/networking/rxrpc.txt
index 605e00cdd6be..89f1302d593a 100644
--- a/Documentation/networking/rxrpc.txt
+++ b/Documentation/networking/rxrpc.txt
@@ -1056,18 +1056,23 @@ The kernel interface functions are as follows:
 
         u32 rxrpc_kernel_check_life(struct socket *sock,
                                     struct rxrpc_call *call);
+        void rxrpc_kernel_probe_life(struct socket *sock,
+                                     struct rxrpc_call *call);
 
-     This returns a number that is updated when ACKs are received from the peer
-     (notably including PING RESPONSE ACKs which we can elicit by sending PING
-     ACKs to see if the call still exists on the server).  The caller should
-     compare the numbers of two calls to see if the call is still alive after
-     waiting for a suitable interval.
+     The first function returns a number that is updated when ACKs are received
+     from the peer (notably including PING RESPONSE ACKs which we can elicit by
+     sending PING ACKs to see if the call still exists on the server).  The
+     caller should compare the numbers of two calls to see if the call is still
+     alive after waiting for a suitable interval.
 
      This allows the caller to work out if the server is still contactable and
      if the call is still alive on the server whilst waiting for the server to
      process a client operation.
 
-     This function may transmit a PING ACK.
+     The second function causes a ping ACK to be transmitted to try to provoke
+     the peer into responding, which would then cause the value returned by the
+     first function to change.  Note that this must be called in TASK_RUNNING
+     state.
 
  (*) Get reply timestamp.
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 1026150ae90f..254b7b267731 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -180,6 +180,7 @@ F:	drivers/net/hamradio/6pack.c
 
 8169 10/100/1000 GIGABIT ETHERNET DRIVER
 M:      Realtek linux nic maintainers <nic_swsd@realtek.com>
+M:      Heiner Kallweit <hkallweit1@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ethernet/realtek/r8169.c
@@ -717,7 +718,7 @@ F:	include/linux/mfd/altera-a10sr.h
 F:      include/dt-bindings/reset/altr,rst-mgr-a10sr.h
 
 ALTERA TRIPLE SPEED ETHERNET DRIVER
-M:      Vince Bridgers <vbridger@opensource.altera.com>
+M:      Thor Thayer <thor.thayer@linux.intel.com>
 L:      netdev@vger.kernel.org
 L:      nios2-dev@lists.rocketboards.org (moderated for non-subscribers)
 S:      Maintained
@@ -3276,6 +3277,12 @@ F:	include/uapi/linux/caif/
 F:      include/net/caif/
 F:      net/caif/
 
+CAKE QDISC
+M:      Toke Høiland-Jørgensen <toke@toke.dk>
+L:      cake@lists.bufferbloat.net (moderated for non-subscribers)
+S:      Maintained
+F:      net/sched/sch_cake.c
+
 CALGARY x86-64 IOMMU
 M:      Muli Ben-Yehuda <mulix@mulix.org>
 M:      Jon Mason <jdmason@kudzu.us>
@@ -5541,6 +5548,7 @@ F:	net/bridge/
 ETHERNET PHY LIBRARY
 M:      Andrew Lunn <andrew@lunn.ch>
 M:      Florian Fainelli <f.fainelli@gmail.com>
+M:      Heiner Kallweit <hkallweit1@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      Documentation/ABI/testing/sysfs-bus-mdio
@@ -6312,6 +6320,7 @@ F:	tools/testing/selftests/gpio/
 
 GPIO SUBSYSTEM
 M:      Linus Walleij <linus.walleij@linaro.org>
+M:      Bartosz Golaszewski <bgolaszewski@baylibre.com>
 L:      linux-gpio@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio.git
 S:      Maintained
@@ -7449,6 +7458,20 @@ S:	Maintained
 F:      Documentation/fb/intelfb.txt
 F:      drivers/video/fbdev/intelfb/
 
+INTEL GPIO DRIVERS
+M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+L:      linux-gpio@vger.kernel.org
+S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel.git
+F:      drivers/gpio/gpio-ich.c
+F:      drivers/gpio/gpio-intel-mid.c
+F:      drivers/gpio/gpio-lynxpoint.c
+F:      drivers/gpio/gpio-merrifield.c
+F:      drivers/gpio/gpio-ml-ioh.c
+F:      drivers/gpio/gpio-pch.c
+F:      drivers/gpio/gpio-sch.c
+F:      drivers/gpio/gpio-sodaville.c
+
 INTEL GVT-g DRIVERS (Intel GPU Virtualization)
 M:      Zhenyu Wang <zhenyuw@linux.intel.com>
 M:      Zhi Wang <zhi.a.wang@intel.com>
@@ -7459,12 +7482,6 @@ T:	git https://github.com/intel/gvt-linux.git
 S:      Supported
 F:      drivers/gpu/drm/i915/gvt/
 
-INTEL PMIC GPIO DRIVER
-R:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-S:      Maintained
-F:      drivers/gpio/gpio-*cove.c
-F:      drivers/gpio/gpio-msic.c
-
 INTEL HID EVENT DRIVER
 M:      Alex Hung <alex.hung@canonical.com>
 L:      platform-driver-x86@vger.kernel.org
@@ -7552,12 +7569,6 @@ W:	https://01.org/linux-acpi
 S:      Supported
 F:      drivers/platform/x86/intel_menlow.c
 
-INTEL MERRIFIELD GPIO DRIVER
-M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-L:      linux-gpio@vger.kernel.org
-S:      Maintained
-F:      drivers/gpio/gpio-merrifield.c
-
 INTEL MIC DRIVERS (mic)
 M:      Sudeep Dutt <sudeep.dutt@intel.com>
 M:      Ashutosh Dixit <ashutosh.dixit@intel.com>
@@ -7590,6 +7601,13 @@ F:	drivers/platform/x86/intel_punit_ipc.c
 F:      arch/x86/include/asm/intel_pmc_ipc.h
 F:      arch/x86/include/asm/intel_punit_ipc.h
 
+INTEL PMIC GPIO DRIVERS
+M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel.git
+F:      drivers/gpio/gpio-*cove.c
+F:      drivers/gpio/gpio-msic.c
+
 INTEL MULTIFUNCTION PMIC DEVICE DRIVERS
 R:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
 S:      Maintained
@@ -13991,11 +14009,10 @@ F:	drivers/tty/serial/sunzilog.h
 F:      drivers/tty/vcc.c
 
 SPARSE CHECKER
-M:      "Christopher Li" <sparse@chrisli.org>
+M:      "Luc Van Oostenryck" <luc.vanoostenryck@gmail.com>
 L:      linux-sparse@vger.kernel.org
 W:      https://sparse.wiki.kernel.org/
 T:      git git://git.kernel.org/pub/scm/devel/sparse/sparse.git
-T:      git git://git.kernel.org/pub/scm/devel/sparse/chrisl/sparse.git
 S:      Maintained
 F:      include/linux/compiler.h
 
@@ -14092,6 +14109,7 @@ F:	Documentation/devicetree/bindings/iio/proximity/vl53l0x.txt
 
 STABLE BRANCH
 M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+M:      Sasha Levin <sashal@kernel.org>
 L:      stable@vger.kernel.org
 S:      Supported
 F:      Documentation/process/stable-kernel-rules.rst
diff --git a/Makefile b/Makefile
index ddbf627cad8f..0ce4e29ee342 100644
--- a/Makefile
+++ b/Makefile
@@ -2,8 +2,8 @@
 VERSION = 4
 PATCHLEVEL = 20
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
-NAME = "People's Front"
+EXTRAVERSION = -rc4
+NAME = Shy Crocodile
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
index 0c909c4a932f..842fb9572661 100644
--- a/arch/arm64/include/asm/sysreg.h
+++ b/arch/arm64/include/asm/sysreg.h
@@ -468,7 +468,7 @@
                          SCTLR_ELx_SA     | SCTLR_ELx_I    | SCTLR_ELx_WXN | \
                          SCTLR_ELx_DSSBS | ENDIAN_CLEAR_EL2 | SCTLR_EL2_RES0)
 
-#if (SCTLR_EL2_SET ^ SCTLR_EL2_CLEAR) != 0xffffffffffffffff
+#if (SCTLR_EL2_SET ^ SCTLR_EL2_CLEAR) != 0xffffffffffffffffUL
 #error "Inconsistent SCTLR_EL2 set/clear bits"
 #endif
 
@@ -509,7 +509,7 @@
                          SCTLR_EL1_UMA | SCTLR_ELx_WXN     | ENDIAN_CLEAR_EL1 |\
                          SCTLR_ELx_DSSBS | SCTLR_EL1_NTWI  | SCTLR_EL1_RES0)
 
-#if (SCTLR_EL1_SET ^ SCTLR_EL1_CLEAR) != 0xffffffffffffffff
+#if (SCTLR_EL1_SET ^ SCTLR_EL1_CLEAR) != 0xffffffffffffffffUL
 #error "Inconsistent SCTLR_EL1 set/clear bits"
 #endif
 
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index af50064dea51..aec5ecb85737 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -1333,7 +1333,6 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
                 .cpu_enable = cpu_enable_hw_dbm,
         },
 #endif
-#ifdef CONFIG_ARM64_SSBD
         {
                 .desc = "CRC32 instructions",
                 .capability = ARM64_HAS_CRC32,
@@ -1343,6 +1342,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
                 .field_pos = ID_AA64ISAR0_CRC32_SHIFT,
                 .min_field_value = 1,
         },
+#ifdef CONFIG_ARM64_SSBD
         {
                 .desc = "Speculative Store Bypassing Safe (SSBS)",
                 .capability = ARM64_SSBS,
diff --git a/arch/mips/configs/cavium_octeon_defconfig b/arch/mips/configs/cavium_octeon_defconfig
index 490b12af103c..c52d0efacd14 100644
--- a/arch/mips/configs/cavium_octeon_defconfig
+++ b/arch/mips/configs/cavium_octeon_defconfig
@@ -140,6 +140,7 @@ CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_DS1307=y
 CONFIG_STAGING=y
 CONFIG_OCTEON_ETHERNET=y
+CONFIG_OCTEON_USB=y
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_RAS=y
 CONFIG_EXT4_FS=y
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index ea09ed6a80a9..8c6c48ed786a 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -794,6 +794,7 @@ static void __init arch_mem_init(char **cmdline_p)
 
         /* call board setup routine */
         plat_mem_setup();
+        memblock_set_bottom_up(true);
 
         /*
          * Make sure all kernel memory is in the maps.  The "UP" and
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 0f852e1b5891..15e103c6d799 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -2260,10 +2260,8 @@ void __init trap_init(void)
                 unsigned long size = 0x200 + VECTORSPACING*64;
                 phys_addr_t ebase_pa;
 
-                memblock_set_bottom_up(true);
                 ebase = (unsigned long)
                         memblock_alloc_from(size, 1 << fls(size), 0);
-                memblock_set_bottom_up(false);
 
                 /*
                  * Try to ensure ebase resides in KSeg0 if possible.
@@ -2307,6 +2305,7 @@ void __init trap_init(void)
         if (board_ebase_setup)
                 board_ebase_setup();
         per_cpu_trap_init(true);
+        memblock_set_bottom_up(false);
 
         /*
          * Copy the generic exception handlers to their final destination.
diff --git a/arch/mips/loongson64/loongson-3/numa.c b/arch/mips/loongson64/loongson-3/numa.c
index 622761878cd1..60bf0a1cb757 100644
--- a/arch/mips/loongson64/loongson-3/numa.c
+++ b/arch/mips/loongson64/loongson-3/numa.c
@@ -231,6 +231,8 @@ static __init void prom_meminit(void)
                         cpumask_clear(&__node_data[(node)]->cpumask);
                 }
         }
+        max_low_pfn = PHYS_PFN(memblock_end_of_DRAM());
+
         for (cpu = 0; cpu < loongson_sysconf.nr_cpus; cpu++) {
                 node = cpu / loongson_sysconf.cores_per_node;
                 if (node >= num_online_nodes())
@@ -248,19 +250,9 @@ static __init void prom_meminit(void)
 
 void __init paging_init(void)
 {
-        unsigned node;
         unsigned long zones_size[MAX_NR_ZONES] = {0, };
 
         pagetable_init();
-
-        for_each_online_node(node) {
-                unsigned long  start_pfn, end_pfn;
-
-                get_pfn_range_for_nid(node, &start_pfn, &end_pfn);
-
-                if (end_pfn > max_low_pfn)
-                        max_low_pfn = end_pfn;
-        }
 #ifdef CONFIG_ZONE_DMA32
         zones_size[ZONE_DMA32] = MAX_DMA32_PFN;
 #endif
diff --git a/arch/mips/sgi-ip27/ip27-memory.c b/arch/mips/sgi-ip27/ip27-memory.c
index d8b8444d6795..813d13f92957 100644
--- a/arch/mips/sgi-ip27/ip27-memory.c
+++ b/arch/mips/sgi-ip27/ip27-memory.c
@@ -435,6 +435,7 @@ void __init prom_meminit(void)
 
         mlreset();
         szmem();
+        max_low_pfn = PHYS_PFN(memblock_end_of_DRAM());
 
         for (node = 0; node < MAX_COMPACT_NODES; node++) {
                 if (node_online(node)) {
@@ -455,18 +456,8 @@ extern void setup_zero_pages(void);
 void __init paging_init(void)
 {
         unsigned long zones_size[MAX_NR_ZONES] = {0, };
-        unsigned node;
 
         pagetable_init();
-
-        for_each_online_node(node) {
-                unsigned long start_pfn, end_pfn;
-
-                get_pfn_range_for_nid(node, &start_pfn, &end_pfn);
-
-                if (end_pfn > max_low_pfn)
-                        max_low_pfn = end_pfn;
-        }
         zones_size[ZONE_NORMAL] = max_low_pfn;
         free_area_init_nodes(zones_size);
 }
diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
index 4af153a182b0..4b594f2e4f7e 100644
--- a/arch/riscv/Makefile
+++ b/arch/riscv/Makefile
@@ -71,6 +71,10 @@ KBUILD_CFLAGS += $(call cc-option,-mstrict-align)
 # arch specific predefines for sparse
 CHECKFLAGS += -D__riscv -D__riscv_xlen=$(BITS)
 
+# Default target when executing plain make
+boot            := arch/riscv/boot
+KBUILD_IMAGE    := $(boot)/Image.gz
+
 head-y := arch/riscv/kernel/head.o
 
 core-y += arch/riscv/kernel/ arch/riscv/mm/
@@ -81,4 +85,13 @@ PHONY += vdso_install
 vdso_install:
         $(Q)$(MAKE) $(build)=arch/riscv/kernel/vdso $@
 
-all: vmlinux
+all: Image.gz
+
+Image: vmlinux
+        $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
+
+Image.%: Image
+        $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
+
+zinstall install:
+        $(Q)$(MAKE) $(build)=$(boot) $@
diff --git a/arch/riscv/boot/.gitignore b/arch/riscv/boot/.gitignore
new file mode 100644
index 000000000000..8dab0bb6ae66
--- /dev/null
+++ b/arch/riscv/boot/.gitignore
@@ -0,0 +1,2 @@
+Image
+Image.gz
diff --git a/arch/riscv/boot/Makefile b/arch/riscv/boot/Makefile
new file mode 100644
index 000000000000..0990a9fdbe5d
--- /dev/null
+++ b/arch/riscv/boot/Makefile
@@ -0,0 +1,33 @@
+#
+# arch/riscv/boot/Makefile
+#
+# This file is included by the global makefile so that you can add your own
+# architecture-specific flags and dependencies.
+#
+# This file is subject to the terms and conditions of the GNU General Public
+# License.  See the file "COPYING" in the main directory of this archive
+# for more details.
+#
+# Copyright (C) 2018, Anup Patel.
+# Author: Anup Patel <anup@brainfault.org>
+#
+# Based on the ia64 and arm64 boot/Makefile.
+#
+
+OBJCOPYFLAGS_Image :=-O binary -R .note -R .note.gnu.build-id -R .comment -S
+
+targets := Image
+
+$(obj)/Image: vmlinux FORCE
+        $(call if_changed,objcopy)
+
+$(obj)/Image.gz: $(obj)/Image FORCE
+        $(call if_changed,gzip)
+
+install:
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+        $(obj)/Image System.map "$(INSTALL_PATH)"
+
+zinstall:
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+        $(obj)/Image.gz System.map "$(INSTALL_PATH)"
diff --git a/arch/riscv/boot/install.sh b/arch/riscv/boot/install.sh
new file mode 100644
index 000000000000..18c39159c0ff
--- /dev/null
+++ b/arch/riscv/boot/install.sh
@@ -0,0 +1,60 @@
+#!/bin/sh
+#
+# arch/riscv/boot/install.sh
+#
+# This file is subject to the terms and conditions of the GNU General Public
+# License.  See the file "COPYING" in the main directory of this archive
+# for more details.
+#
+# Copyright (C) 1995 by Linus Torvalds
+#
+# Adapted from code in arch/i386/boot/Makefile by H. Peter Anvin
+# Adapted from code in arch/i386/boot/install.sh by Russell King
+#
+# "make install" script for the RISC-V Linux port
+#
+# Arguments:
+#   $1 - kernel version
+#   $2 - kernel image file
+#   $3 - kernel map file
+#   $4 - default install path (blank if root directory)
+#
+
+verify () {
+        if [ ! -f "$1" ]; then
+                echo ""                                                   1>&2
+                echo " *** Missing file: $1"                              1>&2
+                echo ' *** You need to run "make" before "make install".' 1>&2
+                echo ""                                                   1>&2
+                exit 1
+        fi
+}
+
+# Make sure the files actually exist
+verify "$2"
+verify "$3"
+
+# User may have a custom install script
+if [ -x ~/bin/${INSTALLKERNEL} ]; then exec ~/bin/${INSTALLKERNEL} "$@"; fi
+if [ -x /sbin/${INSTALLKERNEL} ]; then exec /sbin/${INSTALLKERNEL} "$@"; fi
+
+if [ "$(basename $2)" = "Image.gz" ]; then
+# Compressed install
+  echo "Installing compressed kernel"
+  base=vmlinuz
+else
+# Normal install
+  echo "Installing normal kernel"
+  base=vmlinux
+fi
+
+if [ -f $4/$base-$1 ]; then
+  mv $4/$base-$1 $4/$base-$1.old
+fi
+cat $2 > $4/$base-$1
+
+# Install system map file
+if [ -f $4/System.map-$1 ]; then
+  mv $4/System.map-$1 $4/System.map-$1.old
+fi
+cp $3 $4/System.map-$1
diff --git a/arch/riscv/include/asm/module.h b/arch/riscv/include/asm/module.h
index 349df33808c4..cd2af4b013e3 100644
--- a/arch/riscv/include/asm/module.h
+++ b/arch/riscv/include/asm/module.h
@@ -8,6 +8,7 @@
 
 #define MODULE_ARCH_VERMAGIC    "riscv"
 
+struct module;
 u64 module_emit_got_entry(struct module *mod, u64 val);
 u64 module_emit_plt_entry(struct module *mod, u64 val);
 
diff --git a/arch/riscv/include/asm/uaccess.h b/arch/riscv/include/asm/uaccess.h
index 473cfc84e412..8c3e3e3c8be1 100644
--- a/arch/riscv/include/asm/uaccess.h
+++ b/arch/riscv/include/asm/uaccess.h
@@ -400,13 +400,13 @@ extern unsigned long __must_check __asm_copy_from_user(void *to,
 static inline unsigned long
 raw_copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-        return __asm_copy_to_user(to, from, n);
+        return __asm_copy_from_user(to, from, n);
 }
 
 static inline unsigned long
 raw_copy_to_user(void __user *to, const void *from, unsigned long n)
 {
-        return __asm_copy_from_user(to, from, n);
+        return __asm_copy_to_user(to, from, n);
 }
 
 extern long strncpy_from_user(char *dest, const char __user *src, long count);
diff --git a/arch/riscv/include/asm/unistd.h b/arch/riscv/include/asm/unistd.h
index eff7aa9aa163..fef96f117b4d 100644
--- a/arch/riscv/include/asm/unistd.h
+++ b/arch/riscv/include/asm/unistd.h
@@ -13,10 +13,9 @@
 
 /*
  * There is explicitly no include guard here because this file is expected to
- * be included multiple times.  See uapi/asm/syscalls.h for more info.
+ * be included multiple times.
  */
 
-#define __ARCH_WANT_NEW_STAT
 #define __ARCH_WANT_SYS_CLONE
+
 #include <uapi/asm/unistd.h>
-#include <uapi/asm/syscalls.h>
diff --git a/arch/riscv/include/uapi/asm/syscalls.h b/arch/riscv/include/uapi/asm/unistd.h
index 206dc4b0f6ea..1f3bd3ebbb0d 100644
--- a/arch/riscv/include/uapi/asm/syscalls.h
+++ b/arch/riscv/include/uapi/asm/unistd.h
@@ -1,13 +1,25 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 /*
- * Copyright (C) 2017-2018 SiFive
+ * Copyright (C) 2018 David Abdurachmanov <david.abdurachmanov@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-/*
- * There is explicitly no include guard here because this file is expected to
- * be included multiple times in order to define the syscall macros via
- * __SYSCALL.
- */
+#ifdef __LP64__
+#define __ARCH_WANT_NEW_STAT
+#endif /* __LP64__ */
+
+#include <asm-generic/unistd.h>
 
 /*
  * Allows the instruction cache to be flushed from userspace.  Despite RISC-V
diff --git a/arch/riscv/kernel/cpu.c b/arch/riscv/kernel/cpu.c
index 3a5a2ee31547..b4a7d4427fbb 100644
--- a/arch/riscv/kernel/cpu.c
+++ b/arch/riscv/kernel/cpu.c
@@ -64,7 +64,7 @@ int riscv_of_processor_hartid(struct device_node *node)
 
 static void print_isa(struct seq_file *f, const char *orig_isa)
 {
-        static const char *ext = "mafdc";
+        static const char *ext = "mafdcsu";
         const char *isa = orig_isa;
         const char *e;
 
@@ -88,11 +88,14 @@ static void print_isa(struct seq_file *f, const char *orig_isa)
         /*
          * Check the rest of the ISA string for valid extensions, printing those
          * we find.  RISC-V ISA strings define an order, so we only print the
-         * extension bits when they're in order.
+         * extension bits when they're in order. Hide the supervisor (S)
+         * extension from userspace as it's not accessible from there.
          */
         for (e = ext; *e != '\0'; ++e) {
                 if (isa[0] == e[0]) {
-                        seq_write(f, isa, 1);
+                        if (isa[0] != 's')
+                                seq_write(f, isa, 1);
+
                         isa++;
                 }
         }
diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S
index 711190d473d4..fe884cd69abd 100644
--- a/arch/riscv/kernel/head.S
+++ b/arch/riscv/kernel/head.S
@@ -44,6 +44,16 @@ ENTRY(_start)
         amoadd.w a3, a2, (a3)
         bnez a3, .Lsecondary_start
 
+        /* Clear BSS for flat non-ELF images */
+        la a3, __bss_start
+        la a4, __bss_stop
+        ble a4, a3, clear_bss_done
+clear_bss:
+        REG_S zero, (a3)
+        add a3, a3, RISCV_SZPTR
+        blt a3, a4, clear_bss
+clear_bss_done:
+
         /* Save hart ID and DTB physical address */
         mv s0, a0
         mv s1, a1
diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S
index ece84991609c..65df1dfdc303 100644
--- a/arch/riscv/kernel/vmlinux.lds.S
+++ b/arch/riscv/kernel/vmlinux.lds.S
@@ -74,7 +74,7 @@ SECTIONS
                 *(.sbss*)
         }
 
-        BSS_SECTION(0, 0, 0)
+        BSS_SECTION(PAGE_SIZE, PAGE_SIZE, 0)
 
         EXCEPTION_TABLE(0x10)
         NOTES
diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
index eaa60c94205a..1f32caa87686 100644
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -30,6 +30,7 @@ static const struct acpi_device_id forbidden_id_list[] = {
         {"PNP0200",  0},        /* AT DMA Controller */
         {"ACPI0009", 0},        /* IOxAPIC */
         {"ACPI000A", 0},        /* IOAPIC */
+        {"SMB0001",  0},        /* ACPI SMBUS virtual device */
         {"", 0},
 };
 
diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c
index 3f0e2a14895a..22b53bf26817 100644
--- a/drivers/cpufreq/ti-cpufreq.c
+++ b/drivers/cpufreq/ti-cpufreq.c
@@ -201,19 +201,28 @@ static const struct of_device_id ti_cpufreq_of_match[] = {
         {},
 };
 
+static const struct of_device_id *ti_cpufreq_match_node(void)
+{
+        struct device_node *np;
+        const struct of_device_id *match;
+
+        np = of_find_node_by_path("/");
+        match = of_match_node(ti_cpufreq_of_match, np);
+        of_node_put(np);
+
+        return match;
+}
+
 static int ti_cpufreq_probe(struct platform_device *pdev)
 {
         u32 version[VERSION_COUNT];
-        struct device_node *np;
         const struct of_device_id *match;
         struct opp_table *ti_opp_table;
         struct ti_cpufreq_data *opp_data;
         const char * const reg_names[] = {"vdd", "vbb"};
         int ret;
 
-        np = of_find_node_by_path("/");
-        match = of_match_node(ti_cpufreq_of_match, np);
-        of_node_put(np);
+        match = dev_get_platdata(&pdev->dev);
         if (!match)
                 return -ENODEV;
 
@@ -290,7 +299,14 @@ fail_put_node:
 
 static int ti_cpufreq_init(void)
 {
-        platform_device_register_simple("ti-cpufreq", -1, NULL, 0);
+        const struct of_device_id *match;
+
+        /* Check to ensure we are on a compatible platform */
+        match = ti_cpufreq_match_node();
+        if (match)
+                platform_device_register_data(NULL, "ti-cpufreq", -1, match,
+                                              sizeof(*match));
+
         return 0;
 }
 module_init(ti_cpufreq_init);
diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
index 5b44ef226904..fc359ca4503d 100644
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -184,6 +184,7 @@ static long udmabuf_create(const struct udmabuf_create_list *head,
         exp_info.ops  = &udmabuf_ops;
         exp_info.size = ubuf->pagecount << PAGE_SHIFT;
         exp_info.priv = ubuf;
+        exp_info.flags = O_RDWR;
 
         buf = dma_buf_export(&exp_info);
         if (IS_ERR(buf)) {
diff --git a/drivers/gnss/serial.c b/drivers/gnss/serial.c
index b01ba4438501..31e891f00175 100644
--- a/drivers/gnss/serial.c
+++ b/drivers/gnss/serial.c
@@ -13,6 +13,7 @@
 #include <linux/of.h>
 #include <linux/pm.h>
 #include <linux/pm_runtime.h>
+#include <linux/sched.h>
 #include <linux/serdev.h>
 #include <linux/slab.h>
 
@@ -63,7 +64,7 @@ static int gnss_serial_write_raw(struct gnss_device *gdev,
         int ret;
 
         /* write is only buffered synchronously */
-        ret = serdev_device_write(serdev, buf, count, 0);
+        ret = serdev_device_write(serdev, buf, count, MAX_SCHEDULE_TIMEOUT);
         if (ret < 0)
                 return ret;
 
diff --git a/drivers/gnss/sirf.c b/drivers/gnss/sirf.c
index 79cb98950013..71d014edd167 100644
--- a/drivers/gnss/sirf.c
+++ b/drivers/gnss/sirf.c
@@ -16,6 +16,7 @@
 #include <linux/pm.h>
 #include <linux/pm_runtime.h>
 #include <linux/regulator/consumer.h>
+#include <linux/sched.h>
 #include <linux/serdev.h>
 #include <linux/slab.h>
 #include <linux/wait.h>
@@ -83,7 +84,7 @@ static int sirf_write_raw(struct gnss_device *gdev, const unsigned char *buf,
         int ret;
 
         /* write is only buffered synchronously */
-        ret = serdev_device_write(serdev, buf, count, 0);
+        ret = serdev_device_write(serdev, buf, count, MAX_SCHEDULE_TIMEOUT);
         if (ret < 0)
                 return ret;
 
diff --git a/drivers/gpio/gpio-mockup.c b/drivers/gpio/gpio-mockup.c
index 8269cffc2967..6a50f9f59c90 100644
--- a/drivers/gpio/gpio-mockup.c
+++ b/drivers/gpio/gpio-mockup.c
@@ -35,8 +35,8 @@
 #define gpio_mockup_err(...)    pr_err(GPIO_MOCKUP_NAME ": " __VA_ARGS__)
 
 enum {
-        GPIO_MOCKUP_DIR_OUT = 0,
-        GPIO_MOCKUP_DIR_IN = 1,
+        GPIO_MOCKUP_DIR_IN = 0,
+        GPIO_MOCKUP_DIR_OUT = 1,
 };
 
 /*
@@ -131,7 +131,7 @@ static int gpio_mockup_get_direction(struct gpio_chip *gc, unsigned int offset)
 {
         struct gpio_mockup_chip *chip = gpiochip_get_data(gc);
 
-        return chip->lines[offset].dir;
+        return !chip->lines[offset].dir;
 }
 
 static int gpio_mockup_to_irq(struct gpio_chip *gc, unsigned int offset)
diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
index bfe4c5c9f41c..e9600b556f39 100644
--- a/drivers/gpio/gpio-pxa.c
+++ b/drivers/gpio/gpio-pxa.c
@@ -268,8 +268,8 @@ static int pxa_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 
         if (pxa_gpio_has_pinctrl()) {
                 ret = pinctrl_gpio_direction_input(chip->base + offset);
-                if (!ret)
-                        return 0;
+                if (ret)
+                        return ret;
         }
 
         spin_lock_irqsave(&gpio_lock, flags);
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 230e41562462..a2cbb474901c 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1295,7 +1295,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
         gdev->descs = kcalloc(chip->ngpio, sizeof(gdev->descs[0]), GFP_KERNEL);
         if (!gdev->descs) {
                 status = -ENOMEM;
-                goto err_free_gdev;
+                goto err_free_ida;
         }
 
         if (chip->ngpio == 0) {
@@ -1427,8 +1427,9 @@ err_free_label:
         kfree_const(gdev->label);
 err_free_descs:
         kfree(gdev->descs);
-err_free_gdev:
+err_free_ida:
         ida_simple_remove(&gpio_ida, gdev->id);
+err_free_gdev:
         /* failures here can mean systems won't boot... */
         pr_err("%s: GPIOs %d..%d (%s) failed to register, %d\n", __func__,
                gdev->base, gdev->base + gdev->ngpio - 1,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
index 60f9a87e9c74..bcf1666fb31d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
@@ -501,8 +501,11 @@ void amdgpu_amdkfd_set_compute_idle(struct kgd_dev *kgd, bool idle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)kgd;
 
-        amdgpu_dpm_switch_power_profile(adev,
-                                        PP_SMC_POWER_PROFILE_COMPUTE, !idle);
+        if (adev->powerplay.pp_funcs &&
+            adev->powerplay.pp_funcs->switch_power_profile)
+                amdgpu_dpm_switch_power_profile(adev,
+                                                PP_SMC_POWER_PROFILE_COMPUTE,
+                                                !idle);
 }
 
 bool amdgpu_amdkfd_is_kfd_vmid(struct amdgpu_device *adev, u32 vmid)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index 6748cd7fc129..686a26de50f9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -626,6 +626,13 @@ int amdgpu_display_modeset_create_props(struct amdgpu_device *adev)
                                          "dither",
                                          amdgpu_dither_enum_list, sz);
 
+        if (amdgpu_device_has_dc_support(adev)) {
+                adev->mode_info.max_bpc_property =
+                        drm_property_create_range(adev->ddev, 0, "max bpc", 8, 16);
+                if (!adev->mode_info.max_bpc_property)
+                        return -ENOMEM;
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
index 11723d8fffbd..0dc2c5c57015 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
@@ -338,6 +338,8 @@ struct amdgpu_mode_info {
         struct drm_property *audio_property;
         /* FMT dithering */
         struct drm_property *dither_property;
+        /* maximum number of bits per channel for monitor color */
+        struct drm_property *max_bpc_property;
         /* hardcoded DFP edid from BIOS */
         struct edid *bios_hardcoded_edid;
         int bios_hardcoded_edid_size;
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index 2821d1d846e4..9fc3296592fe 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -46,6 +46,7 @@ MODULE_FIRMWARE("amdgpu/tahiti_mc.bin");
 MODULE_FIRMWARE("amdgpu/pitcairn_mc.bin");
 MODULE_FIRMWARE("amdgpu/verde_mc.bin");
 MODULE_FIRMWARE("amdgpu/oland_mc.bin");
+MODULE_FIRMWARE("amdgpu/hainan_mc.bin");
 MODULE_FIRMWARE("amdgpu/si58_mc.bin");
 
 #define MC_SEQ_MISC0__MT__MASK   0xf0000000
diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
index bf5e6a413dee..4cc0dcb1a187 100644
--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
+++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
@@ -65,6 +65,13 @@
 #define mmMP0_MISC_LIGHT_SLEEP_CTRL                                                             0x01ba
 #define mmMP0_MISC_LIGHT_SLEEP_CTRL_BASE_IDX                                                    0
 
+/* for Vega20 register name change */
+#define mmHDP_MEM_POWER_CTRL    0x00d4
+#define HDP_MEM_POWER_CTRL__IPH_MEM_POWER_CTRL_EN_MASK  0x00000001L
+#define HDP_MEM_POWER_CTRL__IPH_MEM_POWER_LS_EN_MASK    0x00000002L
+#define HDP_MEM_POWER_CTRL__RC_MEM_POWER_CTRL_EN_MASK   0x00010000L
+#define HDP_MEM_POWER_CTRL__RC_MEM_POWER_LS_EN_MASK             0x00020000L
+#define mmHDP_MEM_POWER_CTRL_BASE_IDX   0
 /*
  * Indirect registers accessor
  */
@@ -870,15 +877,33 @@ static void soc15_update_hdp_light_sleep(struct amdgpu_device *adev, bool enable
 {
         uint32_t def, data;
 
-        def = data = RREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_LS));
+        if (adev->asic_type == CHIP_VEGA20) {
+                def = data = RREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_CTRL));
 
-        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_LS))
-                data |= HDP_MEM_POWER_LS__LS_ENABLE_MASK;
-        else
-                data &= ~HDP_MEM_POWER_LS__LS_ENABLE_MASK;
+                if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_LS))
+                        data |= HDP_MEM_POWER_CTRL__IPH_MEM_POWER_CTRL_EN_MASK |
+                                HDP_MEM_POWER_CTRL__IPH_MEM_POWER_LS_EN_MASK |
+                                HDP_MEM_POWER_CTRL__RC_MEM_POWER_CTRL_EN_MASK |
+                                HDP_MEM_POWER_CTRL__RC_MEM_POWER_LS_EN_MASK;
+                else
+                        data &= ~(HDP_MEM_POWER_CTRL__IPH_MEM_POWER_CTRL_EN_MASK |
+                                HDP_MEM_POWER_CTRL__IPH_MEM_POWER_LS_EN_MASK |
+                                HDP_MEM_POWER_CTRL__RC_MEM_POWER_CTRL_EN_MASK |
+                                HDP_MEM_POWER_CTRL__RC_MEM_POWER_LS_EN_MASK);
 
-        if (def != data)
-                WREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_LS), data);
+                if (def != data)
+                        WREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_CTRL), data);
+        } else {
+                def = data = RREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_LS));
+
+                if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_LS))
+                        data |= HDP_MEM_POWER_LS__LS_ENABLE_MASK;
+                else
+                        data &= ~HDP_MEM_POWER_LS__LS_ENABLE_MASK;
+
+                if (def != data)
+                        WREG32(SOC15_REG_OFFSET(HDP, 0, mmHDP_MEM_POWER_LS), data);
+        }
 }
 
 static void soc15_update_drm_clock_gating(struct amdgpu_device *adev, bool enable)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index aa43bb253ea2..d8d0b206a79c 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -2422,8 +2422,15 @@ static void update_stream_scaling_settings(const struct drm_display_mode *mode,
 static enum dc_color_depth
 convert_color_depth_from_display_info(const struct drm_connector *connector)
 {
+        struct dm_connector_state *dm_conn_state =
+                to_dm_connector_state(connector->state);
         uint32_t bpc = connector->display_info.bpc;
 
+        /* TODO: Remove this when there's support for max_bpc in drm */
+        if (dm_conn_state && bpc > dm_conn_state->max_bpc)
+                /* Round down to nearest even number. */
+                bpc = dm_conn_state->max_bpc - (dm_conn_state->max_bpc & 1);
+
         switch (bpc) {
         case 0:
                 /*
@@ -3007,6 +3014,9 @@ int amdgpu_dm_connector_atomic_set_property(struct drm_connector *connector,
         } else if (property == adev->mode_info.underscan_property) {
                 dm_new_state->underscan_enable = val;
                 ret = 0;
+        } else if (property == adev->mode_info.max_bpc_property) {
+                dm_new_state->max_bpc = val;
+                ret = 0;
         }
 
         return ret;
@@ -3049,6 +3059,9 @@ int amdgpu_dm_connector_atomic_get_property(struct drm_connector *connector,
         } else if (property == adev->mode_info.underscan_property) {
                 *val = dm_state->underscan_enable;
                 ret = 0;
+        } else if (property == adev->mode_info.max_bpc_property) {
+                *val = dm_state->max_bpc;
+                ret = 0;
         }
         return ret;
 }
@@ -3859,6 +3872,9 @@ void amdgpu_dm_connector_init_helper(struct amdgpu_display_manager *dm,
         drm_object_attach_property(&aconnector->base.base,
                                 adev->mode_info.underscan_vborder_property,
                                 0);
+        drm_object_attach_property(&aconnector->base.base,
+                                adev->mode_info.max_bpc_property,
+                                0);
 
 }
 
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
index d6960644d714..607c3cdd7d0c 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
@@ -252,6 +252,7 @@ struct dm_connector_state {
         enum amdgpu_rmx_type scaling;
         uint8_t underscan_vborder;
         uint8_t underscan_hborder;
+        uint8_t max_bpc;
         bool underscan_enable;
         bool freesync_enable;
         bool freesync_capable;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index ed35ec0341e6..88f6b35ea6fe 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -4525,12 +4525,12 @@ static int smu7_get_sclk_od(struct pp_hwmgr *hwmgr)
         struct smu7_single_dpm_table *sclk_table = &(data->dpm_table.sclk_table);
         struct smu7_single_dpm_table *golden_sclk_table =
                         &(data->golden_dpm_table.sclk_table);
-        int value;
+        int value = sclk_table->dpm_levels[sclk_table->count - 1].value;
+        int golden_value = golden_sclk_table->dpm_levels
+                        [golden_sclk_table->count - 1].value;
 
-        value = (sclk_table->dpm_levels[sclk_table->count - 1].value -
-                        golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value) *
-                        100 /
-                        golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value;
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
@@ -4567,12 +4567,12 @@ static int smu7_get_mclk_od(struct pp_hwmgr *hwmgr)
         struct smu7_single_dpm_table *mclk_table = &(data->dpm_table.mclk_table);
         struct smu7_single_dpm_table *golden_mclk_table =
                         &(data->golden_dpm_table.mclk_table);
-        int value;
+        int value = mclk_table->dpm_levels[mclk_table->count - 1].value;
+        int golden_value = golden_mclk_table->dpm_levels
+                        [golden_mclk_table->count - 1].value;
 
-        value = (mclk_table->dpm_levels[mclk_table->count - 1].value -
-                        golden_mclk_table->dpm_levels[golden_mclk_table->count - 1].value) *
-                        100 /
-                        golden_mclk_table->dpm_levels[golden_mclk_table->count - 1].value;
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
index 8c4db86bb4b7..e2bc6e0c229f 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
@@ -4522,15 +4522,13 @@ static int vega10_get_sclk_od(struct pp_hwmgr *hwmgr)
         struct vega10_single_dpm_table *sclk_table = &(data->dpm_table.gfx_table);
         struct vega10_single_dpm_table *golden_sclk_table =
                         &(data->golden_dpm_table.gfx_table);
-        int value;
-
-        value = (sclk_table->dpm_levels[sclk_table->count - 1].value -
-                        golden_sclk_table->dpm_levels
-                        [golden_sclk_table->count - 1].value) *
-                        100 /
-                        golden_sclk_table->dpm_levels
+        int value = sclk_table->dpm_levels[sclk_table->count - 1].value;
+        int golden_value = golden_sclk_table->dpm_levels
                         [golden_sclk_table->count - 1].value;
 
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
+
         return value;
 }
 
@@ -4575,16 +4573,13 @@ static int vega10_get_mclk_od(struct pp_hwmgr *hwmgr)
         struct vega10_single_dpm_table *mclk_table = &(data->dpm_table.mem_table);
         struct vega10_single_dpm_table *golden_mclk_table =
                         &(data->golden_dpm_table.mem_table);
-        int value;
-
-        value = (mclk_table->dpm_levels
-                        [mclk_table->count - 1].value -
-                        golden_mclk_table->dpm_levels
-                        [golden_mclk_table->count - 1].value) *
-                        100 /
-                        golden_mclk_table->dpm_levels
+        int value = mclk_table->dpm_levels[mclk_table->count - 1].value;
+        int golden_value = golden_mclk_table->dpm_levels
                         [golden_mclk_table->count - 1].value;
 
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
+
         return value;
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
index 74bc37308dc0..54364444ecd1 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
@@ -2243,12 +2243,12 @@ static int vega12_get_sclk_od(struct pp_hwmgr *hwmgr)
         struct vega12_single_dpm_table *sclk_table = &(data->dpm_table.gfx_table);
         struct vega12_single_dpm_table *golden_sclk_table =
                         &(data->golden_dpm_table.gfx_table);
-        int value;
+        int value = sclk_table->dpm_levels[sclk_table->count - 1].value;
+        int golden_value = golden_sclk_table->dpm_levels
+                        [golden_sclk_table->count - 1].value;
 
-        value = (sclk_table->dpm_levels[sclk_table->count - 1].value -
-                        golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value) *
-                        100 /
-                        golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value;
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
@@ -2264,16 +2264,13 @@ static int vega12_get_mclk_od(struct pp_hwmgr *hwmgr)
         struct vega12_single_dpm_table *mclk_table = &(data->dpm_table.mem_table);
         struct vega12_single_dpm_table *golden_mclk_table =
                         &(data->golden_dpm_table.mem_table);
-        int value;
-
-        value = (mclk_table->dpm_levels
-                        [mclk_table->count - 1].value -
-                        golden_mclk_table->dpm_levels
-                        [golden_mclk_table->count - 1].value) *
-                        100 /
-                        golden_mclk_table->dpm_levels
+        int value = mclk_table->dpm_levels[mclk_table->count - 1].value;
+        int golden_value = golden_mclk_table->dpm_levels
                         [golden_mclk_table->count - 1].value;
 
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
+
         return value;
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
index f2daf00cc911..2679d1240fa1 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
@@ -75,7 +75,17 @@ static void vega20_set_default_registry_data(struct pp_hwmgr *hwmgr)
         data->phy_clk_quad_eqn_b = PPREGKEY_VEGA20QUADRATICEQUATION_DFLT;
         data->phy_clk_quad_eqn_c = PPREGKEY_VEGA20QUADRATICEQUATION_DFLT;
 
-        data->registry_data.disallowed_features = 0x0;
+        /*
+         * Disable the following features for now:
+         *   GFXCLK DS
+         *   SOCLK DS
+         *   LCLK DS
+         *   DCEFCLK DS
+         *   FCLK DS
+         *   MP1CLK DS
+         *   MP0CLK DS
+         */
+        data->registry_data.disallowed_features = 0xE0041C00;
         data->registry_data.od_state_in_dc_support = 0;
         data->registry_data.thermal_support = 1;
         data->registry_data.skip_baco_hardware = 0;
@@ -1313,12 +1323,13 @@ static int vega20_get_sclk_od(
                         &(data->dpm_table.gfx_table);
         struct vega20_single_dpm_table *golden_sclk_table =
                         &(data->golden_dpm_table.gfx_table);
-        int value;
+        int value = sclk_table->dpm_levels[sclk_table->count - 1].value;
+        int golden_value = golden_sclk_table->dpm_levels
+                        [golden_sclk_table->count - 1].value;
 
         /* od percentage */
-        value = DIV_ROUND_UP((sclk_table->dpm_levels[sclk_table->count - 1].value -
-                golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value) * 100,
-                golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value);
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
@@ -1358,12 +1369,13 @@ static int vega20_get_mclk_od(
                         &(data->dpm_table.mem_table);
         struct vega20_single_dpm_table *golden_mclk_table =
                         &(data->golden_dpm_table.mem_table);
-        int value;
+        int value = mclk_table->dpm_levels[mclk_table->count - 1].value;
+        int golden_value = golden_mclk_table->dpm_levels
+                        [golden_mclk_table->count - 1].value;
 
         /* od percentage */
-        value = DIV_ROUND_UP((mclk_table->dpm_levels[mclk_table->count - 1].value -
-                golden_mclk_table->dpm_levels[golden_mclk_table->count - 1].value) * 100,
-                golden_mclk_table->dpm_levels[golden_mclk_table->count - 1].value);
+        value -= golden_value;
+        value = DIV_ROUND_UP(value * 100, golden_value);
 
         return value;
 }
diff --git a/drivers/gpu/drm/ast/ast_drv.c b/drivers/gpu/drm/ast/ast_drv.c
index 69dab82a3771..bf589c53b908 100644
--- a/drivers/gpu/drm/ast/ast_drv.c
+++ b/drivers/gpu/drm/ast/ast_drv.c
@@ -60,8 +60,29 @@ static const struct pci_device_id pciidlist[] = {
 
 MODULE_DEVICE_TABLE(pci, pciidlist);
 
+static void ast_kick_out_firmware_fb(struct pci_dev *pdev)
+{
+        struct apertures_struct *ap;
+        bool primary = false;
+
+        ap = alloc_apertures(1);
+        if (!ap)
+                return;
+
+        ap->ranges[0].base = pci_resource_start(pdev, 0);
+        ap->ranges[0].size = pci_resource_len(pdev, 0);
+
+#ifdef CONFIG_X86
+        primary = pdev->resource[PCI_ROM_RESOURCE].flags & IORESOURCE_ROM_SHADOW;
+#endif
+        drm_fb_helper_remove_conflicting_framebuffers(ap, "astdrmfb", primary);
+        kfree(ap);
+}
+
 static int ast_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
+        ast_kick_out_firmware_fb(pdev);
+
         return drm_get_pci_dev(pdev, ent, &driver);
 }
 
diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
index 5e77d456d9bb..7c6ac3cadb6b 100644
--- a/drivers/gpu/drm/ast/ast_mode.c
+++ b/drivers/gpu/drm/ast/ast_mode.c
@@ -568,6 +568,7 @@ static int ast_crtc_do_set_base(struct drm_crtc *crtc,
         }
         ast_bo_unreserve(bo);
 
+        ast_set_offset_reg(crtc);
         ast_set_start_address_crt1(crtc, (u32)gpu_addr);
 
         return 0;
@@ -1254,7 +1255,7 @@ static int ast_cursor_move(struct drm_crtc *crtc,
         ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xc7, ((y >> 8) & 0x07));
 
         /* dummy write to fire HWC */
-        ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xCB, 0xFF, 0x00);
+        ast_show_cursor(crtc);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 9a69ad7e9f3b..5e9ca6f96379 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -219,6 +219,9 @@ int drm_fb_helper_single_add_all_connectors(struct drm_fb_helper *fb_helper)
         mutex_lock(&fb_helper->lock);
         drm_connector_list_iter_begin(dev, &conn_iter);
         drm_for_each_connector_iter(connector, &conn_iter) {
+                if (connector->connector_type == DRM_MODE_CONNECTOR_WRITEBACK)
+                        continue;
+
                 ret = __drm_fb_helper_add_one_connector(fb_helper, connector);
                 if (ret)
                         goto fail;
diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
index 127468785f74..1f94b9affe4b 100644
--- a/drivers/gpu/drm/vc4/vc4_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_kms.c
@@ -214,6 +214,12 @@ static int vc4_atomic_commit(struct drm_device *dev,
                 return 0;
         }
 
+        /* We know for sure we don't want an async update here. Set
+         * state->legacy_cursor_update to false to prevent
+         * drm_atomic_helper_setup_commit() from auto-completing
+         * commit->flip_done.
+         */
+        state->legacy_cursor_update = false;
         ret = drm_atomic_helper_setup_commit(state, nonblock);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 1728fb7d00ba..c3ded0ba0441 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -854,7 +854,7 @@ void vc4_plane_async_set_fb(struct drm_plane *plane, struct drm_framebuffer *fb)
 static void vc4_plane_atomic_async_update(struct drm_plane *plane,
                                           struct drm_plane_state *state)
 {
-        struct vc4_plane_state *vc4_state = to_vc4_plane_state(plane->state);
+        struct vc4_plane_state *vc4_state, *new_vc4_state;
 
         if (plane->state->fb != state->fb) {
                 vc4_plane_async_set_fb(plane, state->fb);
@@ -875,7 +875,18 @@ static void vc4_plane_atomic_async_update(struct drm_plane *plane,
         plane->state->src_y = state->src_y;
 
         /* Update the display list based on the new crtc_x/y. */
-        vc4_plane_atomic_check(plane, plane->state);
+        vc4_plane_atomic_check(plane, state);
+
+        new_vc4_state = to_vc4_plane_state(state);
+        vc4_state = to_vc4_plane_state(plane->state);
+
+        /* Update the current vc4_state pos0, pos2 and ptr0 dlist entries. */
+        vc4_state->dlist[vc4_state->pos0_offset] =
+                new_vc4_state->dlist[vc4_state->pos0_offset];
+        vc4_state->dlist[vc4_state->pos2_offset] =
+                new_vc4_state->dlist[vc4_state->pos2_offset];
+        vc4_state->dlist[vc4_state->ptr0_offset] =
+                new_vc4_state->dlist[vc4_state->ptr0_offset];
 
         /* Note that we can't just call vc4_plane_write_dlist()
          * because that would smash the context data that the HVS is
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index c0d668944dbe..ed35c9a9a110 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -275,6 +275,9 @@
 
 #define USB_VENDOR_ID_CIDC              0x1677
 
+#define I2C_VENDOR_ID_CIRQUE            0x0488
+#define I2C_PRODUCT_ID_CIRQUE_121F      0x121F
+
 #define USB_VENDOR_ID_CJTOUCH           0x24b8
 #define USB_DEVICE_ID_CJTOUCH_MULTI_TOUCH_0020  0x0020
 #define USB_DEVICE_ID_CJTOUCH_MULTI_TOUCH_0040  0x0040
@@ -707,6 +710,7 @@
 #define USB_VENDOR_ID_LG                0x1fd2
 #define USB_DEVICE_ID_LG_MULTITOUCH     0x0064
 #define USB_DEVICE_ID_LG_MELFAS_MT      0x6007
+#define I2C_DEVICE_ID_LG_8001           0x8001
 
 #define USB_VENDOR_ID_LOGITECH          0x046d
 #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
@@ -805,6 +809,7 @@
 #define USB_DEVICE_ID_MS_TYPE_COVER_2    0x07a9
 #define USB_DEVICE_ID_MS_POWER_COVER     0x07da
 #define USB_DEVICE_ID_MS_XBOX_ONE_S_CONTROLLER  0x02fd
+#define USB_DEVICE_ID_MS_PIXART_MOUSE    0x00cb
 
 #define USB_VENDOR_ID_MOJO              0x8282
 #define USB_DEVICE_ID_RETRO_ADAPTER     0x3201
@@ -1043,6 +1048,7 @@
 #define USB_VENDOR_ID_SYMBOL            0x05e0
 #define USB_DEVICE_ID_SYMBOL_SCANNER_1  0x0800
 #define USB_DEVICE_ID_SYMBOL_SCANNER_2  0x1300
+#define USB_DEVICE_ID_SYMBOL_SCANNER_3  0x1200
 
 #define USB_VENDOR_ID_SYNAPTICS         0x06cb
 #define USB_DEVICE_ID_SYNAPTICS_TP      0x0001
@@ -1204,6 +1210,8 @@
 #define USB_DEVICE_ID_PRIMAX_MOUSE_4D22 0x4d22
 #define USB_DEVICE_ID_PRIMAX_KEYBOARD   0x4e05
 #define USB_DEVICE_ID_PRIMAX_REZEL      0x4e72
+#define USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4D0F  0x4d0f
+#define USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4E22  0x4e22
 
 
 #define USB_VENDOR_ID_RISO_KAGAKU       0x1294  /* Riso Kagaku Corp. */
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index a2f74e6adc70..d6fab5798487 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -325,6 +325,9 @@ static const struct hid_device_id hid_battery_quirks[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM,
                 USB_DEVICE_ID_ELECOM_BM084),
           HID_BATTERY_QUIRK_IGNORE },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SYMBOL,
+                USB_DEVICE_ID_SYMBOL_SCANNER_3),
+          HID_BATTERY_QUIRK_IGNORE },
         {}
 };
 
@@ -1838,47 +1841,3 @@ void hidinput_disconnect(struct hid_device *hid)
 }
 EXPORT_SYMBOL_GPL(hidinput_disconnect);
 
-/**
- * hid_scroll_counter_handle_scroll() - Send high- and low-resolution scroll
- *                                      events given a high-resolution wheel
- *                                      movement.
- * @counter: a hid_scroll_counter struct describing the wheel.
- * @hi_res_value: the movement of the wheel, in the mouse's high-resolution
- *                units.
- *
- * Given a high-resolution movement, this function converts the movement into
- * microns and emits high-resolution scroll events for the input device. It also
- * uses the multiplier from &struct hid_scroll_counter to emit low-resolution
- * scroll events when appropriate for backwards-compatibility with userspace
- * input libraries.
- */
-void hid_scroll_counter_handle_scroll(struct hid_scroll_counter *counter,
-                                      int hi_res_value)
-{
-        int low_res_value, remainder, multiplier;
-
-        input_report_rel(counter->dev, REL_WHEEL_HI_RES,
-                         hi_res_value * counter->microns_per_hi_res_unit);
-
-        /*
-         * Update the low-res remainder with the high-res value,
-         * but reset if the direction has changed.
-         */
-        remainder = counter->remainder;
-        if ((remainder ^ hi_res_value) < 0)
-                remainder = 0;
-        remainder += hi_res_value;
-
-        /*
-         * Then just use the resolution multiplier to see if
-         * we should send a low-res (aka regular wheel) event.
-         */
-        multiplier = counter->resolution_multiplier;
-        low_res_value = remainder / multiplier;
-        remainder -= low_res_value * multiplier;
-        counter->remainder = remainder;
-
-        if (low_res_value)
-                input_report_rel(counter->dev, REL_WHEEL, low_res_value);
-}
-EXPORT_SYMBOL_GPL(hid_scroll_counter_handle_scroll);
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index f01280898b24..19cc980eebce 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -64,14 +64,6 @@ MODULE_PARM_DESC(disable_tap_to_click,
 #define HIDPP_QUIRK_NO_HIDINPUT                 BIT(23)
 #define HIDPP_QUIRK_FORCE_OUTPUT_REPORTS        BIT(24)
 #define HIDPP_QUIRK_UNIFYING                    BIT(25)
-#define HIDPP_QUIRK_HI_RES_SCROLL_1P0           BIT(26)
-#define HIDPP_QUIRK_HI_RES_SCROLL_X2120         BIT(27)
-#define HIDPP_QUIRK_HI_RES_SCROLL_X2121         BIT(28)
-
-/* Convenience constant to check for any high-res support. */
-#define HIDPP_QUIRK_HI_RES_SCROLL       (HIDPP_QUIRK_HI_RES_SCROLL_1P0 | \
-                                         HIDPP_QUIRK_HI_RES_SCROLL_X2120 | \
-                                         HIDPP_QUIRK_HI_RES_SCROLL_X2121)
 
 #define HIDPP_QUIRK_DELAYED_INIT                HIDPP_QUIRK_NO_HIDINPUT
 
@@ -157,7 +149,6 @@ struct hidpp_device {
         unsigned long capabilities;
 
         struct hidpp_battery battery;
-        struct hid_scroll_counter vertical_wheel_counter;
 };
 
 /* HID++ 1.0 error codes */
@@ -409,53 +400,32 @@ static void hidpp_prefix_name(char **name, int name_length)
 #define HIDPP_SET_LONG_REGISTER                         0x82
 #define HIDPP_GET_LONG_REGISTER                         0x83
 
-/**
- * hidpp10_set_register_bit() - Sets a single bit in a HID++ 1.0 register.
- * @hidpp_dev: the device to set the register on.
- * @register_address: the address of the register to modify.
- * @byte: the byte of the register to modify. Should be less than 3.
- * Return: 0 if successful, otherwise a negative error code.
- */
-static int hidpp10_set_register_bit(struct hidpp_device *hidpp_dev,
-        u8 register_address, u8 byte, u8 bit)
+#define HIDPP_REG_GENERAL                               0x00
+
+static int hidpp10_enable_battery_reporting(struct hidpp_device *hidpp_dev)
 {
         struct hidpp_report response;
         int ret;
         u8 params[3] = { 0 };
 
         ret = hidpp_send_rap_command_sync(hidpp_dev,
-                                          REPORT_ID_HIDPP_SHORT,
-                                          HIDPP_GET_REGISTER,
-                                          register_address,
-                                          NULL, 0, &response);
+                                        REPORT_ID_HIDPP_SHORT,
+                                        HIDPP_GET_REGISTER,
+                                        HIDPP_REG_GENERAL,
+                                        NULL, 0, &response);
         if (ret)
                 return ret;
 
         memcpy(params, response.rap.params, 3);
 
-        params[byte] |= BIT(bit);
+        /* Set the battery bit */
+        params[0] |= BIT(4);
 
         return hidpp_send_rap_command_sync(hidpp_dev,
-                                           REPORT_ID_HIDPP_SHORT,
-                                           HIDPP_SET_REGISTER,
-                                           register_address,
-                                           params, 3, &response);
-}
-
-
-#define HIDPP_REG_GENERAL                               0x00
-
-static int hidpp10_enable_battery_reporting(struct hidpp_device *hidpp_dev)
-{
-        return hidpp10_set_register_bit(hidpp_dev, HIDPP_REG_GENERAL, 0, 4);
-}
-
-#define HIDPP_REG_FEATURES                              0x01
-
-/* On HID++ 1.0 devices, high-res scroll was called "scrolling acceleration". */
-static int hidpp10_enable_scrolling_acceleration(struct hidpp_device *hidpp_dev)
-{
-        return hidpp10_set_register_bit(hidpp_dev, HIDPP_REG_FEATURES, 0, 6);
+                                        REPORT_ID_HIDPP_SHORT,
+                                        HIDPP_SET_REGISTER,
+                                        HIDPP_REG_GENERAL,
+                                        params, 3, &response);
 }
 
 #define HIDPP_REG_BATTERY_STATUS                        0x07
@@ -1167,100 +1137,6 @@ static int hidpp_battery_get_property(struct power_supply *psy,
 }
 
 /* -------------------------------------------------------------------------- */
-/* 0x2120: Hi-resolution scrolling                                            */
-/* -------------------------------------------------------------------------- */
-
-#define HIDPP_PAGE_HI_RESOLUTION_SCROLLING                      0x2120
-
-#define CMD_HI_RESOLUTION_SCROLLING_SET_HIGHRES_SCROLLING_MODE  0x10
-
-static int hidpp_hrs_set_highres_scrolling_mode(struct hidpp_device *hidpp,
-        bool enabled, u8 *multiplier)
-{
-        u8 feature_index;
-        u8 feature_type;
-        int ret;
-        u8 params[1];
-        struct hidpp_report response;
-
-        ret = hidpp_root_get_feature(hidpp,
-                                     HIDPP_PAGE_HI_RESOLUTION_SCROLLING,
-                                     &feature_index,
-                                     &feature_type);
-        if (ret)
-                return ret;
-
-        params[0] = enabled ? BIT(0) : 0;
-        ret = hidpp_send_fap_command_sync(hidpp, feature_index,
-                                          CMD_HI_RESOLUTION_SCROLLING_SET_HIGHRES_SCROLLING_MODE,
-                                          params, sizeof(params), &response);
-        if (ret)
-                return ret;
-        *multiplier = response.fap.params[1];
-        return 0;
-}
-
-/* -------------------------------------------------------------------------- */
-/* 0x2121: HiRes Wheel                                                        */
-/* -------------------------------------------------------------------------- */
-
-#define HIDPP_PAGE_HIRES_WHEEL          0x2121
-
-#define CMD_HIRES_WHEEL_GET_WHEEL_CAPABILITY    0x00
-#define CMD_HIRES_WHEEL_SET_WHEEL_MODE          0x20
-
-static int hidpp_hrw_get_wheel_capability(struct hidpp_device *hidpp,
-        u8 *multiplier)
-{
-        u8 feature_index;
-        u8 feature_type;
-        int ret;
-        struct hidpp_report response;
-
-        ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_HIRES_WHEEL,
-                                     &feature_index, &feature_type);
-        if (ret)
-                goto return_default;
-
-        ret = hidpp_send_fap_command_sync(hidpp, feature_index,
-                                          CMD_HIRES_WHEEL_GET_WHEEL_CAPABILITY,
-                                          NULL, 0, &response);
-        if (ret)
-                goto return_default;
-
-        *multiplier = response.fap.params[0];
-        return 0;
-return_default:
-        hid_warn(hidpp->hid_dev,
-                 "Couldn't get wheel multiplier (error %d), assuming %d.\n",
-                 ret, *multiplier);
-        return ret;
-}
-
-static int hidpp_hrw_set_wheel_mode(struct hidpp_device *hidpp, bool invert,
-        bool high_resolution, bool use_hidpp)
-{
-        u8 feature_index;
-        u8 feature_type;
-        int ret;
-        u8 params[1];
-        struct hidpp_report response;
-
-        ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_HIRES_WHEEL,
-                                     &feature_index, &feature_type);
-        if (ret)
-                return ret;
-
-        params[0] = (invert          ? BIT(2) : 0) |
-                    (high_resolution ? BIT(1) : 0) |
-                    (use_hidpp       ? BIT(0) : 0);
-
-        return hidpp_send_fap_command_sync(hidpp, feature_index,
-                                           CMD_HIRES_WHEEL_SET_WHEEL_MODE,
-                                           params, sizeof(params), &response);
-}
-
-/* -------------------------------------------------------------------------- */
 /* 0x4301: Solar Keyboard                                                     */
 /* -------------------------------------------------------------------------- */
 
@@ -2523,8 +2399,7 @@ static int m560_raw_event(struct hid_device *hdev, u8 *data, int size)
                 input_report_rel(mydata->input, REL_Y, v);
 
                 v = hid_snto32(data[6], 8);
-                hid_scroll_counter_handle_scroll(
-                                &hidpp->vertical_wheel_counter, v);
+                input_report_rel(mydata->input, REL_WHEEL, v);
 
                 input_sync(mydata->input);
         }
@@ -2653,72 +2528,6 @@ static int g920_get_config(struct hidpp_device *hidpp)
 }
 
 /* -------------------------------------------------------------------------- */
-/* High-resolution scroll wheels                                              */
-/* -------------------------------------------------------------------------- */
-
-/**
- * struct hi_res_scroll_info - Stores info on a device's high-res scroll wheel.
- * @product_id: the HID product ID of the device being described.
- * @microns_per_hi_res_unit: the distance moved by the user's finger for each
- *                         high-resolution unit reported by the device, in
- *                         256ths of a millimetre.
- */
-struct hi_res_scroll_info {
-        __u32 product_id;
-        int microns_per_hi_res_unit;
-};
-
-static struct hi_res_scroll_info hi_res_scroll_devices[] = {
-        { /* Anywhere MX */
-          .product_id = 0x1017, .microns_per_hi_res_unit = 445 },
-        { /* Performance MX */
-          .product_id = 0x101a, .microns_per_hi_res_unit = 406 },
-        { /* M560 */
-          .product_id = 0x402d, .microns_per_hi_res_unit = 435 },
-        { /* MX Master 2S */
-          .product_id = 0x4069, .microns_per_hi_res_unit = 406 },
-};
-
-static int hi_res_scroll_look_up_microns(__u32 product_id)
-{
-        int i;
-        int num_devices = sizeof(hi_res_scroll_devices)
-                          / sizeof(hi_res_scroll_devices[0]);
-        for (i = 0; i < num_devices; i++) {
-                if (hi_res_scroll_devices[i].product_id == product_id)
-                        return hi_res_scroll_devices[i].microns_per_hi_res_unit;
-        }
-        /* We don't have a value for this device, so use a sensible default. */
-        return 406;
-}
-
-static int hi_res_scroll_enable(struct hidpp_device *hidpp)
-{
-        int ret;
-        u8 multiplier = 8;
-
-        if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL_X2121) {
-                ret = hidpp_hrw_set_wheel_mode(hidpp, false, true, false);
-                hidpp_hrw_get_wheel_capability(hidpp, &multiplier);
-        } else if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL_X2120) {
-                ret = hidpp_hrs_set_highres_scrolling_mode(hidpp, true,
-                                                           &multiplier);
-        } else /* if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL_1P0) */
-                ret = hidpp10_enable_scrolling_acceleration(hidpp);
-
-        if (ret)
-                return ret;
-
-        hidpp->vertical_wheel_counter.resolution_multiplier = multiplier;
-        hidpp->vertical_wheel_counter.microns_per_hi_res_unit =
-                hi_res_scroll_look_up_microns(hidpp->hid_dev->product);
-        hid_info(hidpp->hid_dev, "multiplier = %d, microns = %d\n",
-                 multiplier,
-                 hidpp->vertical_wheel_counter.microns_per_hi_res_unit);
-        return 0;
-}
-
-/* -------------------------------------------------------------------------- */
 /* Generic HID++ devices                                                      */
 /* -------------------------------------------------------------------------- */
 
@@ -2763,11 +2572,6 @@ static void hidpp_populate_input(struct hidpp_device *hidpp,
                 wtp_populate_input(hidpp, input, origin_is_hid_core);
         else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560)
                 m560_populate_input(hidpp, input, origin_is_hid_core);
-
-        if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL) {
-                input_set_capability(input, EV_REL, REL_WHEEL_HI_RES);
-                hidpp->vertical_wheel_counter.dev = input;
-        }
 }
 
 static int hidpp_input_configured(struct hid_device *hdev,
@@ -2886,27 +2690,6 @@ static int hidpp_raw_event(struct hid_device *hdev, struct hid_report *report,
         return 0;
 }
 
-static int hidpp_event(struct hid_device *hdev, struct hid_field *field,
-        struct hid_usage *usage, __s32 value)
-{
-        /* This function will only be called for scroll events, due to the
-         * restriction imposed in hidpp_usages.
-         */
-        struct hidpp_device *hidpp = hid_get_drvdata(hdev);
-        struct hid_scroll_counter *counter = &hidpp->vertical_wheel_counter;
-        /* A scroll event may occur before the multiplier has been retrieved or
-         * the input device set, or high-res scroll enabling may fail. In such
-         * cases we must return early (falling back to default behaviour) to
-         * avoid a crash in hid_scroll_counter_handle_scroll.
-         */
-        if (!(hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL) || value == 0
-            || counter->dev == NULL || counter->resolution_multiplier == 0)
-                return 0;
-
-        hid_scroll_counter_handle_scroll(counter, value);
-        return 1;
-}
-
 static int hidpp_initialize_battery(struct hidpp_device *hidpp)
 {
         static atomic_t battery_no = ATOMIC_INIT(0);
@@ -3118,9 +2901,6 @@ static void hidpp_connect_event(struct hidpp_device *hidpp)
         if (hidpp->battery.ps)
                 power_supply_changed(hidpp->battery.ps);
 
-        if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL)
-                hi_res_scroll_enable(hidpp);
-
         if (!(hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT) || hidpp->delayed_input)
                 /* if the input nodes are already created, we can stop now */
                 return;
@@ -3306,63 +3086,35 @@ static void hidpp_remove(struct hid_device *hdev)
         mutex_destroy(&hidpp->send_mutex);
 }
 
-#define LDJ_DEVICE(product) \
-        HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE, \
-                   USB_VENDOR_ID_LOGITECH, (product))
-
 static const struct hid_device_id hidpp_devices[] = {
         { /* wireless touchpad */
-          LDJ_DEVICE(0x4011),
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x4011),
           .driver_data = HIDPP_QUIRK_CLASS_WTP | HIDPP_QUIRK_DELAYED_INIT |
                          HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS },
         { /* wireless touchpad T650 */
-          LDJ_DEVICE(0x4101),
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x4101),
           .driver_data = HIDPP_QUIRK_CLASS_WTP | HIDPP_QUIRK_DELAYED_INIT },
         { /* wireless touchpad T651 */
           HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
                 USB_DEVICE_ID_LOGITECH_T651),
           .driver_data = HIDPP_QUIRK_CLASS_WTP },
-        { /* Mouse Logitech Anywhere MX */
-          LDJ_DEVICE(0x1017), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 },
-        { /* Mouse Logitech Cube */
-          LDJ_DEVICE(0x4010), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2120 },
-        { /* Mouse Logitech M335 */
-          LDJ_DEVICE(0x4050), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech M515 */
-          LDJ_DEVICE(0x4007), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2120 },
         { /* Mouse logitech M560 */
-          LDJ_DEVICE(0x402d),
-          .driver_data = HIDPP_QUIRK_DELAYED_INIT | HIDPP_QUIRK_CLASS_M560
-                | HIDPP_QUIRK_HI_RES_SCROLL_X2120 },
-        { /* Mouse Logitech M705 (firmware RQM17) */
-          LDJ_DEVICE(0x101b), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 },
-        { /* Mouse Logitech M705 (firmware RQM67) */
-          LDJ_DEVICE(0x406d), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech M720 */
-          LDJ_DEVICE(0x405e), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech MX Anywhere 2 */
-          LDJ_DEVICE(0x404a), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { LDJ_DEVICE(0xb013), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { LDJ_DEVICE(0xb018), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { LDJ_DEVICE(0xb01f), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech MX Anywhere 2S */
-          LDJ_DEVICE(0x406a), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech MX Master */
-          LDJ_DEVICE(0x4041), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { LDJ_DEVICE(0x4060), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { LDJ_DEVICE(0x4071), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech MX Master 2S */
-          LDJ_DEVICE(0x4069), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-        { /* Mouse Logitech Performance MX */
-          LDJ_DEVICE(0x101a), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 },
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x402d),
+          .driver_data = HIDPP_QUIRK_DELAYED_INIT | HIDPP_QUIRK_CLASS_M560 },
         { /* Keyboard logitech K400 */
-          LDJ_DEVICE(0x4024),
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x4024),
           .driver_data = HIDPP_QUIRK_CLASS_K400 },
         { /* Solar Keyboard Logitech K750 */
-          LDJ_DEVICE(0x4002),
+          HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, 0x4002),
           .driver_data = HIDPP_QUIRK_CLASS_K750 },
 
-        { LDJ_DEVICE(HID_ANY_ID) },
+        { HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
+                USB_VENDOR_ID_LOGITECH, HID_ANY_ID)},
 
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL),
                 .driver_data = HIDPP_QUIRK_CLASS_G920 | HIDPP_QUIRK_FORCE_OUTPUT_REPORTS},
@@ -3371,19 +3123,12 @@ static const struct hid_device_id hidpp_devices[] = {
 
 MODULE_DEVICE_TABLE(hid, hidpp_devices);
 
-static const struct hid_usage_id hidpp_usages[] = {
-        { HID_GD_WHEEL, EV_REL, REL_WHEEL },
-        { HID_ANY_ID - 1, HID_ANY_ID - 1, HID_ANY_ID - 1}
-};
-
 static struct hid_driver hidpp_driver = {
         .name = "logitech-hidpp-device",
         .id_table = hidpp_devices,
         .probe = hidpp_probe,
         .remove = hidpp_remove,
         .raw_event = hidpp_raw_event,
-        .usage_table = hidpp_usages,
-        .event = hidpp_event,
         .input_configured = hidpp_input_configured,
         .input_mapping = hidpp_input_mapping,
         .input_mapped = hidpp_input_mapped,
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index f7c6de2b6730..dca0a3a90fb8 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1814,6 +1814,12 @@ static const struct hid_device_id mt_devices[] = {
                 MT_USB_DEVICE(USB_VENDOR_ID_CHUNGHWAT,
                         USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH) },
 
+        /* Cirque devices */
+        { .driver_data = MT_CLS_WIN_8_DUAL,
+                HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+                        I2C_VENDOR_ID_CIRQUE,
+                        I2C_PRODUCT_ID_CIRQUE_121F) },
+
         /* CJTouch panels */
         { .driver_data = MT_CLS_NSMU,
                 MT_USB_DEVICE(USB_VENDOR_ID_CJTOUCH,
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 8237dd86fb17..c85a79986b6a 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -107,6 +107,7 @@ static const struct hid_device_id hid_quirks[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C05A), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C06A), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_MCS, USB_DEVICE_ID_MCS_GAMEPADBLOCK), HID_QUIRK_MULTI_INPUT },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PIXART_MOUSE), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER), HID_QUIRK_NO_INIT_REPORTS },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_SURFACE_PRO_2), HID_QUIRK_NO_INIT_REPORTS },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2), HID_QUIRK_NO_INIT_REPORTS },
@@ -129,6 +130,8 @@ static const struct hid_device_id hid_quirks[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN), HID_QUIRK_NO_INIT_REPORTS },
         { HID_USB_DEVICE(USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_MOUSE_4D22), HID_QUIRK_ALWAYS_POLL },
+        { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4D0F), HID_QUIRK_ALWAYS_POLL },
+        { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4E22), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS), HID_QUIRK_NOGET },
         { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001), HID_QUIRK_NOGET },
         { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003), HID_QUIRK_NOGET },
diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
index 0422ec2b13d2..dc4128bfe2ca 100644
--- a/drivers/hid/hid-steam.c
+++ b/drivers/hid/hid-steam.c
@@ -23,8 +23,9 @@
  * In order to avoid breaking them this driver creates a layered hidraw device,
  * so it can detect when the client is running and then:
  *  - it will not send any command to the controller.
- *  - this input device will be disabled, to avoid double input of the same
+ *  - this input device will be removed, to avoid double input of the same
  *    user action.
+ * When the client is closed, this input device will be created again.
  *
  * For additional functions, such as changing the right-pad margin or switching
  * the led, you can use the user-space tool at:
@@ -113,7 +114,7 @@ struct steam_device {
         spinlock_t lock;
         struct hid_device *hdev, *client_hdev;
         struct mutex mutex;
-        bool client_opened, input_opened;
+        bool client_opened;
         struct input_dev __rcu *input;
         unsigned long quirks;
         struct work_struct work_connect;
@@ -279,18 +280,6 @@ static void steam_set_lizard_mode(struct steam_device *steam, bool enable)
         }
 }
 
-static void steam_update_lizard_mode(struct steam_device *steam)
-{
-        mutex_lock(&steam->mutex);
-        if (!steam->client_opened) {
-                if (steam->input_opened)
-                        steam_set_lizard_mode(steam, false);
-                else
-                        steam_set_lizard_mode(steam, lizard_mode);
-        }
-        mutex_unlock(&steam->mutex);
-}
-
 static int steam_input_open(struct input_dev *dev)
 {
         struct steam_device *steam = input_get_drvdata(dev);
@@ -301,7 +290,6 @@ static int steam_input_open(struct input_dev *dev)
                 return ret;
 
         mutex_lock(&steam->mutex);
-        steam->input_opened = true;
         if (!steam->client_opened && lizard_mode)
                 steam_set_lizard_mode(steam, false);
         mutex_unlock(&steam->mutex);
@@ -313,7 +301,6 @@ static void steam_input_close(struct input_dev *dev)
         struct steam_device *steam = input_get_drvdata(dev);
 
         mutex_lock(&steam->mutex);
-        steam->input_opened = false;
         if (!steam->client_opened && lizard_mode)
                 steam_set_lizard_mode(steam, true);
         mutex_unlock(&steam->mutex);
@@ -400,7 +387,7 @@ static int steam_battery_register(struct steam_device *steam)
         return 0;
 }
 
-static int steam_register(struct steam_device *steam)
+static int steam_input_register(struct steam_device *steam)
 {
         struct hid_device *hdev = steam->hdev;
         struct input_dev *input;
@@ -414,17 +401,6 @@ static int steam_register(struct steam_device *steam)
                 return 0;
         }
 
-        /*
-         * Unlikely, but getting the serial could fail, and it is not so
-         * important, so make up a serial number and go on.
-         */
-        if (steam_get_serial(steam) < 0)
-                strlcpy(steam->serial_no, "XXXXXXXXXX",
-                                sizeof(steam->serial_no));
-
-        hid_info(hdev, "Steam Controller '%s' connected",
-                        steam->serial_no);
-
         input = input_allocate_device();
         if (!input)
                 return -ENOMEM;
@@ -492,11 +468,6 @@ static int steam_register(struct steam_device *steam)
                 goto input_register_fail;
 
         rcu_assign_pointer(steam->input, input);
-
-        /* ignore battery errors, we can live without it */
-        if (steam->quirks & STEAM_QUIRK_WIRELESS)
-                steam_battery_register(steam);
-
         return 0;
 
 input_register_fail:
@@ -504,27 +475,88 @@ input_register_fail:
         return ret;
 }
 
-static void steam_unregister(struct steam_device *steam)
+static void steam_input_unregister(struct steam_device *steam)
 {
         struct input_dev *input;
+        rcu_read_lock();
+        input = rcu_dereference(steam->input);
+        rcu_read_unlock();
+        if (!input)
+                return;
+        RCU_INIT_POINTER(steam->input, NULL);
+        synchronize_rcu();
+        input_unregister_device(input);
+}
+
+static void steam_battery_unregister(struct steam_device *steam)
+{
         struct power_supply *battery;
 
         rcu_read_lock();
-        input = rcu_dereference(steam->input);
         battery = rcu_dereference(steam->battery);
         rcu_read_unlock();
 
-        if (battery) {
-                RCU_INIT_POINTER(steam->battery, NULL);
-                synchronize_rcu();
-                power_supply_unregister(battery);
+        if (!battery)
+                return;
+        RCU_INIT_POINTER(steam->battery, NULL);
+        synchronize_rcu();
+        power_supply_unregister(battery);
+}
+
+static int steam_register(struct steam_device *steam)
+{
+        int ret;
+
+        /*
+         * This function can be called several times in a row with the
+         * wireless adaptor, without steam_unregister() between them, because
+         * another client send a get_connection_status command, for example.
+         * The battery and serial number are set just once per device.
+         */
+        if (!steam->serial_no[0]) {
+                /*
+                 * Unlikely, but getting the serial could fail, and it is not so
+                 * important, so make up a serial number and go on.
+                 */
+                if (steam_get_serial(steam) < 0)
+                        strlcpy(steam->serial_no, "XXXXXXXXXX",
+                                        sizeof(steam->serial_no));
+
+                hid_info(steam->hdev, "Steam Controller '%s' connected",
+                                steam->serial_no);
+
+                /* ignore battery errors, we can live without it */
+                if (steam->quirks & STEAM_QUIRK_WIRELESS)
+                        steam_battery_register(steam);
+
+                mutex_lock(&steam_devices_lock);
+                list_add(&steam->list, &steam_devices);
+                mutex_unlock(&steam_devices_lock);
         }
-        if (input) {
-                RCU_INIT_POINTER(steam->input, NULL);
-                synchronize_rcu();
+
+        mutex_lock(&steam->mutex);
+        if (!steam->client_opened) {
+                steam_set_lizard_mode(steam, lizard_mode);
+                ret = steam_input_register(steam);
+        } else {
+                ret = 0;
+        }
+        mutex_unlock(&steam->mutex);
+
+        return ret;
+}
+
+static void steam_unregister(struct steam_device *steam)
+{
+        steam_battery_unregister(steam);
+        steam_input_unregister(steam);
+        if (steam->serial_no[0]) {
                 hid_info(steam->hdev, "Steam Controller '%s' disconnected",
                                 steam->serial_no);
-                input_unregister_device(input);
+                mutex_lock(&steam_devices_lock);
+                list_del(&steam->list);
+                mutex_unlock(&steam_devices_lock);
+                steam->serial_no[0] = 0;
         }
 }
 
@@ -600,6 +632,9 @@ static int steam_client_ll_open(struct hid_device *hdev)
         mutex_lock(&steam->mutex);
         steam->client_opened = true;
         mutex_unlock(&steam->mutex);
+
+        steam_input_unregister(steam);
+
         return ret;
 }
 
@@ -609,13 +644,13 @@ static void steam_client_ll_close(struct hid_device *hdev)
 
         mutex_lock(&steam->mutex);
         steam->client_opened = false;
-        if (steam->input_opened)
-                steam_set_lizard_mode(steam, false);
-        else
-                steam_set_lizard_mode(steam, lizard_mode);
         mutex_unlock(&steam->mutex);
 
         hid_hw_close(steam->hdev);
+        if (steam->connected) {
+                steam_set_lizard_mode(steam, lizard_mode);
+                steam_input_register(steam);
+        }
 }
 
 static int steam_client_ll_raw_request(struct hid_device *hdev,
@@ -744,11 +779,6 @@ static int steam_probe(struct hid_device *hdev,
                 }
         }
 
-        mutex_lock(&steam_devices_lock);
-        steam_update_lizard_mode(steam);
-        list_add(&steam->list, &steam_devices);
-        mutex_unlock(&steam_devices_lock);
-
         return 0;
 
 hid_hw_open_fail:
@@ -774,10 +804,6 @@ static void steam_remove(struct hid_device *hdev)
                 return;
         }
 
-        mutex_lock(&steam_devices_lock);
-        list_del(&steam->list);
-        mutex_unlock(&steam_devices_lock);
-
         hid_destroy_device(steam->client_hdev);
         steam->client_opened = false;
         cancel_work_sync(&steam->work_connect);
@@ -792,12 +818,14 @@ static void steam_remove(struct hid_device *hdev)
 static void steam_do_connect_event(struct steam_device *steam, bool connected)
 {
         unsigned long flags;
+        bool changed;
 
         spin_lock_irqsave(&steam->lock, flags);
+        changed = steam->connected != connected;
         steam->connected = connected;
         spin_unlock_irqrestore(&steam->lock, flags);
 
-        if (schedule_work(&steam->work_connect) == 0)
+        if (changed && schedule_work(&steam->work_connect) == 0)
                 dbg_hid("%s: connected=%d event already queued\n",
                                 __func__, connected);
 }
@@ -1019,13 +1047,8 @@ static int steam_raw_event(struct hid_device *hdev,
                         return 0;
                 rcu_read_lock();
                 input = rcu_dereference(steam->input);
-                if (likely(input)) {
+                if (likely(input))
                         steam_do_input_event(steam, input, data);
-                } else {
-                        dbg_hid("%s: input data without connect event\n",
-                                        __func__);
-                        steam_do_connect_event(steam, true);
-                }
                 rcu_read_unlock();
                 break;
         case STEAM_EV_CONNECT:
@@ -1074,7 +1097,10 @@ static int steam_param_set_lizard_mode(const char *val,
 
         mutex_lock(&steam_devices_lock);
         list_for_each_entry(steam, &steam_devices, list) {
-                steam_update_lizard_mode(steam);
+                mutex_lock(&steam->mutex);
+                if (!steam->client_opened)
+                        steam_set_lizard_mode(steam, lizard_mode);
+                mutex_unlock(&steam->mutex);
         }
         mutex_unlock(&steam_devices_lock);
         return 0;
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 3cde7c1b9c33..8555ce7e737b 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -177,6 +177,8 @@ static const struct i2c_hid_quirks {
                 I2C_HID_QUIRK_NO_RUNTIME_PM },
         { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_4B33,
                 I2C_HID_QUIRK_DELAY_AFTER_SLEEP },
+        { USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_8001,
+                I2C_HID_QUIRK_NO_RUNTIME_PM },
         { 0, 0 }
 };
 
diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index 3c5507313606..840634e0f1e3 100644
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -12,6 +12,7 @@
 
 #include <linux/atomic.h>
 #include <linux/compat.h>
+#include <linux/cred.h>
 #include <linux/device.h>
 #include <linux/fs.h>
 #include <linux/hid.h>
@@ -496,12 +497,13 @@ static int uhid_dev_create2(struct uhid_device *uhid,
                 goto err_free;
         }
 
-        len = min(sizeof(hid->name), sizeof(ev->u.create2.name));
-        strlcpy(hid->name, ev->u.create2.name, len);
-        len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys));
-        strlcpy(hid->phys, ev->u.create2.phys, len);
-        len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq));
-        strlcpy(hid->uniq, ev->u.create2.uniq, len);
+        /* @hid is zero-initialized, strncpy() is correct, strlcpy() not */
+        len = min(sizeof(hid->name), sizeof(ev->u.create2.name)) - 1;
+        strncpy(hid->name, ev->u.create2.name, len);
+        len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys)) - 1;
+        strncpy(hid->phys, ev->u.create2.phys, len);
+        len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq)) - 1;
+        strncpy(hid->uniq, ev->u.create2.uniq, len);
 
         hid->ll_driver = &uhid_hid_driver;
         hid->bus = ev->u.create2.bus;
@@ -722,6 +724,17 @@ static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
 
         switch (uhid->input_buf.type) {
         case UHID_CREATE:
+                /*
+                 * 'struct uhid_create_req' contains a __user pointer which is
+                 * copied from, so it's unsafe to allow this with elevated
+                 * privileges (e.g. from a setuid binary) or via kernel_write().
+                 */
+                if (file->f_cred != current_cred() || uaccess_kernel()) {
+                        pr_err_once("UHID_CREATE from different security context by process %d (%s), this is not allowed.\n",
+                                    task_tgid_vnr(current), current->comm);
+                        ret = -EACCES;
+                        goto unlock;
+                }
                 ret = uhid_dev_create(uhid, &uhid->input_buf);
                 break;
         case UHID_CREATE2:
diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
index a7513a8a8e37..d6106e1a0d4a 100644
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@@ -353,6 +353,9 @@ static void process_ib_ipinfo(void *in_msg, void *out_msg, int op)
 
                 out->body.kvp_ip_val.dhcp_enabled = in->kvp_ip_val.dhcp_enabled;
 
+                /* fallthrough */
+
+        case KVP_OP_GET_IP_INFO:
                 utf16s_to_utf8s((wchar_t *)in->kvp_ip_val.adapter_id,
                                 MAX_ADAPTER_ID_SIZE,
                                 UTF16_LITTLE_ENDIAN,
@@ -405,7 +408,11 @@ kvp_send_key(struct work_struct *dummy)
                 process_ib_ipinfo(in_msg, message, KVP_OP_SET_IP_INFO);
                 break;
         case KVP_OP_GET_IP_INFO:
-                /* We only need to pass on message->kvp_hdr.operation.  */
+                /*
+                 * We only need to pass on the info of operation, adapter_id
+                 * and addr_family to the userland kvp daemon.
+                 */
+                process_ib_ipinfo(in_msg, message, KVP_OP_GET_IP_INFO);
                 break;
         case KVP_OP_SET:
                 switch (in_msg->body.kvp_set.data.value_type) {
@@ -446,9 +453,9 @@ kvp_send_key(struct work_struct *dummy)
 
                 }
 
-                break;
-
-        case KVP_OP_GET:
+                /*
+                 * The key is always a string - utf16 encoding.
+                 */
                 message->body.kvp_set.data.key_size =
                         utf16s_to_utf8s(
                         (wchar_t *)in_msg->body.kvp_set.data.key,
@@ -456,6 +463,17 @@ kvp_send_key(struct work_struct *dummy)
                         UTF16_LITTLE_ENDIAN,
                         message->body.kvp_set.data.key,
                         HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
+
+                break;
+
+        case KVP_OP_GET:
+                message->body.kvp_get.data.key_size =
+                        utf16s_to_utf8s(
+                        (wchar_t *)in_msg->body.kvp_get.data.key,
+                        in_msg->body.kvp_get.data.key_size,
+                        UTF16_LITTLE_ENDIAN,
+                        message->body.kvp_get.data.key,
+                        HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
                 break;
 
         case KVP_OP_DELETE:
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index bb2cd29e1658..d8f7000a466a 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -797,7 +797,8 @@ static int iommu_init_ga_log(struct amd_iommu *iommu)
         entry = iommu_virt_to_phys(iommu->ga_log) | GA_LOG_SIZE_512;
         memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_BASE_OFFSET,
                     &entry, sizeof(entry));
-        entry = (iommu_virt_to_phys(iommu->ga_log) & 0xFFFFFFFFFFFFFULL) & ~7ULL;
+        entry = (iommu_virt_to_phys(iommu->ga_log_tail) &
+                 (BIT_ULL(52)-1)) & ~7ULL;
         memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_TAIL_OFFSET,
                     &entry, sizeof(entry));
         writel(0x00, iommu->mmio_base + MMIO_GA_HEAD_OFFSET);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index f3ccf025108b..41a4b8808802 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3075,7 +3075,7 @@ static int copy_context_table(struct intel_iommu *iommu,
                         }
 
                         if (old_ce)
-                                iounmap(old_ce);
+                                memunmap(old_ce);
 
                         ret = 0;
                         if (devfn < 0x80)
diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index db301efe126d..887150907526 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -595,7 +595,7 @@ static irqreturn_t prq_event_thread(int irq, void *d)
                         pr_err("%s: Page request without PASID: %08llx %08llx\n",
                                iommu->name, ((unsigned long long *)req)[0],
                                ((unsigned long long *)req)[1]);
-                        goto bad_req;
+                        goto no_pasid;
                 }
 
                 if (!svm || svm->pasid != req->pasid) {
diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
index b98a03189580..ddf3a492e1d5 100644
--- a/drivers/iommu/ipmmu-vmsa.c
+++ b/drivers/iommu/ipmmu-vmsa.c
@@ -498,6 +498,9 @@ static int ipmmu_domain_init_context(struct ipmmu_vmsa_domain *domain)
 
 static void ipmmu_domain_destroy_context(struct ipmmu_vmsa_domain *domain)
 {
+        if (!domain->mmu)
+                return;
+
         /*
          * Disable the context. Flush the TLB as required when modifying the
          * context registers.
diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
index 31d1f4ab915e..65a933a21e68 100644
--- a/drivers/media/cec/cec-adap.c
+++ b/drivers/media/cec/cec-adap.c
@@ -807,7 +807,7 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
         }
 
         if (adap->transmit_queue_sz >= CEC_MAX_MSG_TX_QUEUE_SZ) {
-                dprintk(1, "%s: transmit queue full\n", __func__);
+                dprintk(2, "%s: transmit queue full\n", __func__);
                 return -EBUSY;
         }
 
@@ -1180,6 +1180,8 @@ static int cec_config_log_addr(struct cec_adapter *adap,
 {
         struct cec_log_addrs *las = &adap->log_addrs;
         struct cec_msg msg = { };
+        const unsigned int max_retries = 2;
+        unsigned int i;
         int err;
 
         if (cec_has_log_addr(adap, log_addr))
@@ -1188,19 +1190,44 @@ static int cec_config_log_addr(struct cec_adapter *adap,
         /* Send poll message */
         msg.len = 1;
         msg.msg[0] = (log_addr << 4) | log_addr;
-        err = cec_transmit_msg_fh(adap, &msg, NULL, true);
 
-        /*
-         * While trying to poll the physical address was reset
-         * and the adapter was unconfigured, so bail out.
-         */
-        if (!adap->is_configuring)
-                return -EINTR;
+        for (i = 0; i < max_retries; i++) {
+                err = cec_transmit_msg_fh(adap, &msg, NULL, true);
 
-        if (err)
-                return err;
+                /*
+                 * While trying to poll the physical address was reset
+                 * and the adapter was unconfigured, so bail out.
+                 */
+                if (!adap->is_configuring)
+                        return -EINTR;
+
+                if (err)
+                        return err;
 
-        if (msg.tx_status & CEC_TX_STATUS_OK)
+                /*
+                 * The message was aborted due to a disconnect or
+                 * unconfigure, just bail out.
+                 */
+                if (msg.tx_status & CEC_TX_STATUS_ABORTED)
+                        return -EINTR;
+                if (msg.tx_status & CEC_TX_STATUS_OK)
+                        return 0;
+                if (msg.tx_status & CEC_TX_STATUS_NACK)
+                        break;
+                /*
+                 * Retry up to max_retries times if the message was neither
+                 * OKed or NACKed. This can happen due to e.g. a Lost
+                 * Arbitration condition.
+                 */
+        }
+
+        /*
+         * If we are unable to get an OK or a NACK after max_retries attempts
+         * (and note that each attempt already consists of four polls), then
+         * then we assume that something is really weird and that it is not a
+         * good idea to try and claim this logical address.
+         */
+        if (i == max_retries)
                 return 0;
 
         /*
diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index a38e54b8f687..22cafc07de25 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -1918,7 +1918,6 @@ static int tc358743_probe_of(struct tc358743_state *state)
         ret = v4l2_fwnode_endpoint_alloc_parse(of_fwnode_handle(ep), &endpoint);
         if (ret) {
                 dev_err(dev, "failed to parse endpoint\n");
-                ret = ret;
                 goto put_node;
         }
 
diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.c b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
index 452eb9b42140..447baaebca44 100644
--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -1844,14 +1844,12 @@ fail_mutex_destroy:
 static void cio2_pci_remove(struct pci_dev *pci_dev)
 {
         struct cio2_device *cio2 = pci_get_drvdata(pci_dev);
-        unsigned int i;
 
+        media_device_unregister(&cio2->media_dev);
         cio2_notifier_exit(cio2);
+        cio2_queues_exit(cio2);
         cio2_fbpt_exit_dummy(cio2);
-        for (i = 0; i < CIO2_QUEUES; i++)
-                cio2_queue_exit(cio2, &cio2->queue[i]);
         v4l2_device_unregister(&cio2->v4l2_dev);
-        media_device_unregister(&cio2->media_dev);
         media_device_cleanup(&cio2->media_dev);
         mutex_destroy(&cio2->lock);
 }
diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
index 77fb7987b42f..13f2828d880d 100644
--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -1587,6 +1587,8 @@ static void isp_pm_complete(struct device *dev)
 
 static void isp_unregister_entities(struct isp_device *isp)
 {
+        media_device_unregister(&isp->media_dev);
+
         omap3isp_csi2_unregister_entities(&isp->isp_csi2a);
         omap3isp_ccp2_unregister_entities(&isp->isp_ccp2);
         omap3isp_ccdc_unregister_entities(&isp->isp_ccdc);
@@ -1597,7 +1599,6 @@ static void isp_unregister_entities(struct isp_device *isp)
         omap3isp_stat_unregister_entities(&isp->isp_hist);
 
         v4l2_device_unregister(&isp->v4l2_dev);
-        media_device_unregister(&isp->media_dev);
         media_device_cleanup(&isp->media_dev);
 }
 
diff --git a/drivers/media/platform/vicodec/vicodec-core.c b/drivers/media/platform/vicodec/vicodec-core.c
index 1eb9132bfc85..b292cff26c86 100644
--- a/drivers/media/platform/vicodec/vicodec-core.c
+++ b/drivers/media/platform/vicodec/vicodec-core.c
@@ -42,7 +42,7 @@ MODULE_PARM_DESC(debug, " activates debug info");
 #define MAX_WIDTH               4096U
 #define MIN_WIDTH               640U
 #define MAX_HEIGHT              2160U
-#define MIN_HEIGHT              480U
+#define MIN_HEIGHT              360U
 
 #define dprintk(dev, fmt, arg...) \
         v4l2_dbg(1, debug, &dev->v4l2_dev, "%s: " fmt, __func__, ## arg)
diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
index af150a0395df..d82db738f174 100644
--- a/drivers/media/platform/vim2m.c
+++ b/drivers/media/platform/vim2m.c
@@ -1009,7 +1009,7 @@ static const struct v4l2_m2m_ops m2m_ops = {
 
 static const struct media_device_ops m2m_media_ops = {
         .req_validate = vb2_request_validate,
-        .req_queue = vb2_m2m_request_queue,
+        .req_queue = v4l2_m2m_request_queue,
 };
 
 static int vim2m_probe(struct platform_device *pdev)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index 6e37950292cd..5f2b033a7a42 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -1664,6 +1664,11 @@ static int std_validate(const struct v4l2_ctrl *ctrl, u32 idx,
                     p_mpeg2_slice_params->forward_ref_index >= VIDEO_MAX_FRAME)
                         return -EINVAL;
 
+                if (p_mpeg2_slice_params->pad ||
+                    p_mpeg2_slice_params->picture.pad ||
+                    p_mpeg2_slice_params->sequence.pad)
+                        return -EINVAL;
+
                 return 0;
 
         case V4L2_CTRL_TYPE_MPEG2_QUANTIZATION:
diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c
index a3ef1f50a4b3..481e3c65cf97 100644
--- a/drivers/media/v4l2-core/v4l2-event.c
+++ b/drivers/media/v4l2-core/v4l2-event.c
@@ -193,6 +193,22 @@ int v4l2_event_pending(struct v4l2_fh *fh)
 }
 EXPORT_SYMBOL_GPL(v4l2_event_pending);
 
+static void __v4l2_event_unsubscribe(struct v4l2_subscribed_event *sev)
+{
+        struct v4l2_fh *fh = sev->fh;
+        unsigned int i;
+
+        lockdep_assert_held(&fh->subscribe_lock);
+        assert_spin_locked(&fh->vdev->fh_lock);
+
+        /* Remove any pending events for this subscription */
+        for (i = 0; i < sev->in_use; i++) {
+                list_del(&sev->events[sev_pos(sev, i)].list);
+                fh->navailable--;
+        }
+        list_del(&sev->list);
+}
+
 int v4l2_event_subscribe(struct v4l2_fh *fh,
                          const struct v4l2_event_subscription *sub, unsigned elems,
                          const struct v4l2_subscribed_event_ops *ops)
@@ -224,27 +240,23 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
 
         spin_lock_irqsave(&fh->vdev->fh_lock, flags);
         found_ev = v4l2_event_subscribed(fh, sub->type, sub->id);
+        if (!found_ev)
+                list_add(&sev->list, &fh->subscribed);
         spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
 
         if (found_ev) {
                 /* Already listening */
                 kvfree(sev);
-                goto out_unlock;
-        }
-
-        if (sev->ops && sev->ops->add) {
+        } else if (sev->ops && sev->ops->add) {
                 ret = sev->ops->add(sev, elems);
                 if (ret) {
+                        spin_lock_irqsave(&fh->vdev->fh_lock, flags);
+                        __v4l2_event_unsubscribe(sev);
+                        spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
                         kvfree(sev);
-                        goto out_unlock;
                 }
         }
 
-        spin_lock_irqsave(&fh->vdev->fh_lock, flags);
-        list_add(&sev->list, &fh->subscribed);
-        spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
-
-out_unlock:
         mutex_unlock(&fh->subscribe_lock);
 
         return ret;
@@ -279,7 +291,6 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
 {
         struct v4l2_subscribed_event *sev;
         unsigned long flags;
-        int i;
 
         if (sub->type == V4L2_EVENT_ALL) {
                 v4l2_event_unsubscribe_all(fh);
@@ -291,14 +302,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
         spin_lock_irqsave(&fh->vdev->fh_lock, flags);
 
         sev = v4l2_event_subscribed(fh, sub->type, sub->id);
-        if (sev != NULL) {
-                /* Remove any pending events for this subscription */
-                for (i = 0; i < sev->in_use; i++) {
-                        list_del(&sev->events[sev_pos(sev, i)].list);
-                        fh->navailable--;
-                }
-                list_del(&sev->list);
-        }
+        if (sev != NULL)
+                __v4l2_event_unsubscribe(sev);
 
         spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
 
diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
index d7806db222d8..1ed2465972ac 100644
--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
@@ -953,7 +953,7 @@ void v4l2_m2m_buf_queue(struct v4l2_m2m_ctx *m2m_ctx,
 }
 EXPORT_SYMBOL_GPL(v4l2_m2m_buf_queue);
 
-void vb2_m2m_request_queue(struct media_request *req)
+void v4l2_m2m_request_queue(struct media_request *req)
 {
         struct media_request_object *obj, *obj_safe;
         struct v4l2_m2m_ctx *m2m_ctx = NULL;
@@ -997,7 +997,7 @@ void vb2_m2m_request_queue(struct media_request *req)
         if (m2m_ctx)
                 v4l2_m2m_try_schedule(m2m_ctx);
 }
-EXPORT_SYMBOL_GPL(vb2_m2m_request_queue);
+EXPORT_SYMBOL_GPL(v4l2_m2m_request_queue);
 
 /* Videobuf2 ioctl helpers */
 
diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
index b2a0340f277e..d8e3cc2dc747 100644
--- a/drivers/misc/atmel-ssc.c
+++ b/drivers/misc/atmel-ssc.c
@@ -132,7 +132,7 @@ static const struct of_device_id atmel_ssc_dt_ids[] = {
 MODULE_DEVICE_TABLE(of, atmel_ssc_dt_ids);
 #endif
 
-static inline const struct atmel_ssc_platform_data * __init
+static inline const struct atmel_ssc_platform_data *
         atmel_ssc_get_driver_data(struct platform_device *pdev)
 {
         if (pdev->dev.of_node) {
diff --git a/drivers/misc/sgi-gru/grukdump.c b/drivers/misc/sgi-gru/grukdump.c
index 313da3150262..1540a7785e14 100644
--- a/drivers/misc/sgi-gru/grukdump.c
+++ b/drivers/misc/sgi-gru/grukdump.c
@@ -27,6 +27,9 @@
 #include <linux/delay.h>
 #include <linux/bitops.h>
 #include <asm/uv/uv_hub.h>
+
+#include <linux/nospec.h>
+
 #include "gru.h"
 #include "grutables.h"
 #include "gruhandles.h"
@@ -196,6 +199,7 @@ int gru_dump_chiplet_request(unsigned long arg)
         /* Currently, only dump by gid is implemented */
         if (req.gid >= gru_max_gids)
                 return -EINVAL;
+        req.gid = array_index_nospec(req.gid, gru_max_gids);
 
         gru = GID_TO_GRU(req.gid);
         ubuf = req.buf;
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index 7bfd366d970d..c4115bae5db1 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -12,6 +12,7 @@
  *     - JMicron (hardware and technical support)
  */
 
+#include <linux/bitfield.h>
 #include <linux/string.h>
 #include <linux/delay.h>
 #include <linux/highmem.h>
@@ -462,6 +463,9 @@ struct intel_host {
         u32     dsm_fns;
         int     drv_strength;
         bool    d3_retune;
+        bool    rpm_retune_ok;
+        u32     glk_rx_ctrl1;
+        u32     glk_tun_val;
 };
 
 static const guid_t intel_dsm_guid =
@@ -791,6 +795,77 @@ cleanup:
         return ret;
 }
 
+#ifdef CONFIG_PM
+#define GLK_RX_CTRL1    0x834
+#define GLK_TUN_VAL     0x840
+#define GLK_PATH_PLL    GENMASK(13, 8)
+#define GLK_DLY         GENMASK(6, 0)
+/* Workaround firmware failing to restore the tuning value */
+static void glk_rpm_retune_wa(struct sdhci_pci_chip *chip, bool susp)
+{
+        struct sdhci_pci_slot *slot = chip->slots[0];
+        struct intel_host *intel_host = sdhci_pci_priv(slot);
+        struct sdhci_host *host = slot->host;
+        u32 glk_rx_ctrl1;
+        u32 glk_tun_val;
+        u32 dly;
+
+        if (intel_host->rpm_retune_ok || !mmc_can_retune(host->mmc))
+                return;
+
+        glk_rx_ctrl1 = sdhci_readl(host, GLK_RX_CTRL1);
+        glk_tun_val = sdhci_readl(host, GLK_TUN_VAL);
+
+        if (susp) {
+                intel_host->glk_rx_ctrl1 = glk_rx_ctrl1;
+                intel_host->glk_tun_val = glk_tun_val;
+                return;
+        }
+
+        if (!intel_host->glk_tun_val)
+                return;
+
+        if (glk_rx_ctrl1 != intel_host->glk_rx_ctrl1) {
+                intel_host->rpm_retune_ok = true;
+                return;
+        }
+
+        dly = FIELD_PREP(GLK_DLY, FIELD_GET(GLK_PATH_PLL, glk_rx_ctrl1) +
+                                  (intel_host->glk_tun_val << 1));
+        if (dly == FIELD_GET(GLK_DLY, glk_rx_ctrl1))
+                return;
+
+        glk_rx_ctrl1 = (glk_rx_ctrl1 & ~GLK_DLY) | dly;
+        sdhci_writel(host, glk_rx_ctrl1, GLK_RX_CTRL1);
+
+        intel_host->rpm_retune_ok = true;
+        chip->rpm_retune = true;
+        mmc_retune_needed(host->mmc);
+        pr_info("%s: Requiring re-tune after rpm resume", mmc_hostname(host->mmc));
+}
+
+static void glk_rpm_retune_chk(struct sdhci_pci_chip *chip, bool susp)
+{
+        if (chip->pdev->device == PCI_DEVICE_ID_INTEL_GLK_EMMC &&
+            !chip->rpm_retune)
+                glk_rpm_retune_wa(chip, susp);
+}
+
+static int glk_runtime_suspend(struct sdhci_pci_chip *chip)
+{
+        glk_rpm_retune_chk(chip, true);
+
+        return sdhci_cqhci_runtime_suspend(chip);
+}
+
+static int glk_runtime_resume(struct sdhci_pci_chip *chip)
+{
+        glk_rpm_retune_chk(chip, false);
+
+        return sdhci_cqhci_runtime_resume(chip);
+}
+#endif
+
 #ifdef CONFIG_ACPI
 static int ni_set_max_freq(struct sdhci_pci_slot *slot)
 {
@@ -879,8 +954,8 @@ static const struct sdhci_pci_fixes sdhci_intel_glk_emmc = {
         .resume                 = sdhci_cqhci_resume,
 #endif
 #ifdef CONFIG_PM
-        .runtime_suspend        = sdhci_cqhci_runtime_suspend,
-        .runtime_resume         = sdhci_cqhci_runtime_resume,
+        .runtime_suspend        = glk_runtime_suspend,
+        .runtime_resume         = glk_runtime_resume,
 #endif
         .quirks                 = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC,
         .quirks2                = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
@@ -1762,8 +1837,13 @@ static struct sdhci_pci_slot *sdhci_pci_probe_slot(
                 device_init_wakeup(&pdev->dev, true);
 
         if (slot->cd_idx >= 0) {
-                ret = mmc_gpiod_request_cd(host->mmc, NULL, slot->cd_idx,
+                ret = mmc_gpiod_request_cd(host->mmc, "cd", slot->cd_idx,
                                            slot->cd_override_level, 0, NULL);
+                if (ret && ret != -EPROBE_DEFER)
+                        ret = mmc_gpiod_request_cd(host->mmc, NULL,
+                                                   slot->cd_idx,
+                                                   slot->cd_override_level,
+                                                   0, NULL);
                 if (ret == -EPROBE_DEFER)
                         goto remove;
 
diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
index fb33f6be7c4f..ad720494e8f7 100644
--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
@@ -2032,8 +2032,7 @@ atmel_hsmc_nand_controller_legacy_init(struct atmel_hsmc_nand_controller *nc)
         int ret;
 
         nand_np = dev->of_node;
-        nfc_np = of_find_compatible_node(dev->of_node, NULL,
-                                         "atmel,sama5d3-nfc");
+        nfc_np = of_get_compatible_child(dev->of_node, "atmel,sama5d3-nfc");
         if (!nfc_np) {
                 dev_err(dev, "Could not find device node for sama5d3-nfc\n");
                 return -ENODEV;
@@ -2447,15 +2446,19 @@ static int atmel_nand_controller_probe(struct platform_device *pdev)
         }
 
         if (caps->legacy_of_bindings) {
+                struct device_node *nfc_node;
                 u32 ale_offs = 21;
 
                 /*
                  * If we are parsing legacy DT props and the DT contains a
                  * valid NFC node, forward the request to the sama5 logic.
                  */
-                if (of_find_compatible_node(pdev->dev.of_node, NULL,
-                                            "atmel,sama5d3-nfc"))
+                nfc_node = of_get_compatible_child(pdev->dev.of_node,
+                                                   "atmel,sama5d3-nfc");
+                if (nfc_node) {
                         caps = &atmel_sama5_nand_caps;
+                        of_node_put(nfc_node);
+                }
 
                 /*
                  * Even if the compatible says we are dealing with an
diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
index ef75dfa62a4f..699d3cf49c6d 100644
--- a/drivers/mtd/nand/raw/qcom_nandc.c
+++ b/drivers/mtd/nand/raw/qcom_nandc.c
@@ -150,15 +150,15 @@
 #define NAND_VERSION_MINOR_SHIFT        16
 
 /* NAND OP_CMDs */
-#define PAGE_READ                       0x2
-#define PAGE_READ_WITH_ECC              0x3
-#define PAGE_READ_WITH_ECC_SPARE        0x4
-#define PROGRAM_PAGE                    0x6
-#define PAGE_PROGRAM_WITH_ECC           0x7
-#define PROGRAM_PAGE_SPARE              0x9
-#define BLOCK_ERASE                     0xa
-#define FETCH_ID                        0xb
-#define RESET_DEVICE                    0xd
+#define OP_PAGE_READ                    0x2
+#define OP_PAGE_READ_WITH_ECC           0x3
+#define OP_PAGE_READ_WITH_ECC_SPARE     0x4
+#define OP_PROGRAM_PAGE                 0x6
+#define OP_PAGE_PROGRAM_WITH_ECC        0x7
+#define OP_PROGRAM_PAGE_SPARE           0x9
+#define OP_BLOCK_ERASE                  0xa
+#define OP_FETCH_ID                     0xb
+#define OP_RESET_DEVICE                 0xd
 
 /* Default Value for NAND_DEV_CMD_VLD */
 #define NAND_DEV_CMD_VLD_VAL            (READ_START_VLD | WRITE_START_VLD | \
@@ -692,11 +692,11 @@ static void update_rw_regs(struct qcom_nand_host *host, int num_cw, bool read)
 
         if (read) {
                 if (host->use_ecc)
-                        cmd = PAGE_READ_WITH_ECC | PAGE_ACC | LAST_PAGE;
+                        cmd = OP_PAGE_READ_WITH_ECC | PAGE_ACC | LAST_PAGE;
                 else
-                        cmd = PAGE_READ | PAGE_ACC | LAST_PAGE;
+                        cmd = OP_PAGE_READ | PAGE_ACC | LAST_PAGE;
         } else {
-                        cmd = PROGRAM_PAGE | PAGE_ACC | LAST_PAGE;
+                cmd = OP_PROGRAM_PAGE | PAGE_ACC | LAST_PAGE;
         }
 
         if (host->use_ecc) {
@@ -1170,7 +1170,7 @@ static int nandc_param(struct qcom_nand_host *host)
          * in use. we configure the controller to perform a raw read of 512
          * bytes to read onfi params
          */
-        nandc_set_reg(nandc, NAND_FLASH_CMD, PAGE_READ | PAGE_ACC | LAST_PAGE);
+        nandc_set_reg(nandc, NAND_FLASH_CMD, OP_PAGE_READ | PAGE_ACC | LAST_PAGE);
         nandc_set_reg(nandc, NAND_ADDR0, 0);
         nandc_set_reg(nandc, NAND_ADDR1, 0);
         nandc_set_reg(nandc, NAND_DEV0_CFG0, 0 << CW_PER_PAGE
@@ -1224,7 +1224,7 @@ static int erase_block(struct qcom_nand_host *host, int page_addr)
         struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
 
         nandc_set_reg(nandc, NAND_FLASH_CMD,
-                      BLOCK_ERASE | PAGE_ACC | LAST_PAGE);
+                      OP_BLOCK_ERASE | PAGE_ACC | LAST_PAGE);
         nandc_set_reg(nandc, NAND_ADDR0, page_addr);
         nandc_set_reg(nandc, NAND_ADDR1, 0);
         nandc_set_reg(nandc, NAND_DEV0_CFG0,
@@ -1255,7 +1255,7 @@ static int read_id(struct qcom_nand_host *host, int column)
         if (column == -1)
                 return 0;
 
-        nandc_set_reg(nandc, NAND_FLASH_CMD, FETCH_ID);
+        nandc_set_reg(nandc, NAND_FLASH_CMD, OP_FETCH_ID);
         nandc_set_reg(nandc, NAND_ADDR0, column);
         nandc_set_reg(nandc, NAND_ADDR1, 0);
         nandc_set_reg(nandc, NAND_FLASH_CHIP_SELECT,
@@ -1276,7 +1276,7 @@ static int reset(struct qcom_nand_host *host)
         struct nand_chip *chip = &host->chip;
         struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
 
-        nandc_set_reg(nandc, NAND_FLASH_CMD, RESET_DEVICE);
+        nandc_set_reg(nandc, NAND_FLASH_CMD, OP_RESET_DEVICE);
         nandc_set_reg(nandc, NAND_EXEC_CMD, 1);
 
         write_reg_dma(nandc, NAND_FLASH_CMD, 1, NAND_BAM_NEXT_SGL);
diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
index d846428ef038..04cedd3a2bf6 100644
--- a/drivers/mtd/spi-nor/cadence-quadspi.c
+++ b/drivers/mtd/spi-nor/cadence-quadspi.c
@@ -644,9 +644,23 @@ static int cqspi_indirect_write_execute(struct spi_nor *nor, loff_t to_addr,
                 ndelay(cqspi->wr_delay);
 
         while (remaining > 0) {
+                size_t write_words, mod_bytes;
+
                 write_bytes = remaining > page_size ? page_size : remaining;
-                iowrite32_rep(cqspi->ahb_base, txbuf,
-                              DIV_ROUND_UP(write_bytes, 4));
+                write_words = write_bytes / 4;
+                mod_bytes = write_bytes % 4;
+                /* Write 4 bytes at a time then single bytes. */
+                if (write_words) {
+                        iowrite32_rep(cqspi->ahb_base, txbuf, write_words);
+                        txbuf += (write_words * 4);
+                }
+                if (mod_bytes) {
+                        unsigned int temp = 0xFFFFFFFF;
+
+                        memcpy(&temp, txbuf, mod_bytes);
+                        iowrite32(temp, cqspi->ahb_base);
+                        txbuf += mod_bytes;
+                }
 
                 if (!wait_for_completion_timeout(&cqspi->transfer_complete,
                                         msecs_to_jiffies(CQSPI_TIMEOUT_MS))) {
@@ -655,7 +669,6 @@ static int cqspi_indirect_write_execute(struct spi_nor *nor, loff_t to_addr,
                         goto failwr;
                 }
 
-                txbuf += write_bytes;
                 remaining -= write_bytes;
 
                 if (remaining > 0)
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index 3e54e31889c7..93c9bc8931fc 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -2156,7 +2156,7 @@ spi_nor_set_pp_settings(struct spi_nor_pp_command *pp,
  * @nor:        pointer to a 'struct spi_nor'
  * @addr:       offset in the serial flash memory
  * @len:        number of bytes to read
- * @buf:        buffer where the data is copied into
+ * @buf:        buffer where the data is copied into (dma-safe memory)
  *
  * Return: 0 on success, -errno otherwise.
  */
@@ -2522,6 +2522,34 @@ static int spi_nor_map_cmp_erase_type(const void *l, const void *r)
 }
 
 /**
+ * spi_nor_sort_erase_mask() - sort erase mask
+ * @map:        the erase map of the SPI NOR
+ * @erase_mask: the erase type mask to be sorted
+ *
+ * Replicate the sort done for the map's erase types in BFPT: sort the erase
+ * mask in ascending order with the smallest erase type size starting from
+ * BIT(0) in the sorted erase mask.
+ *
+ * Return: sorted erase mask.
+ */
+static u8 spi_nor_sort_erase_mask(struct spi_nor_erase_map *map, u8 erase_mask)
+{
+        struct spi_nor_erase_type *erase_type = map->erase_type;
+        int i;
+        u8 sorted_erase_mask = 0;
+
+        if (!erase_mask)
+                return 0;
+
+        /* Replicate the sort done for the map's erase types. */
+        for (i = 0; i < SNOR_ERASE_TYPE_MAX; i++)
+                if (erase_type[i].size && erase_mask & BIT(erase_type[i].idx))
+                        sorted_erase_mask |= BIT(i);
+
+        return sorted_erase_mask;
+}
+
+/**
  * spi_nor_regions_sort_erase_types() - sort erase types in each region
  * @map:        the erase map of the SPI NOR
  *
@@ -2536,19 +2564,13 @@ static int spi_nor_map_cmp_erase_type(const void *l, const void *r)
 static void spi_nor_regions_sort_erase_types(struct spi_nor_erase_map *map)
 {
         struct spi_nor_erase_region *region = map->regions;
-        struct spi_nor_erase_type *erase_type = map->erase_type;
-        int i;
         u8 region_erase_mask, sorted_erase_mask;
 
         while (region) {
                 region_erase_mask = region->offset & SNOR_ERASE_TYPE_MASK;
 
-                /* Replicate the sort done for the map's erase types. */
-                sorted_erase_mask = 0;
-                for (i = 0; i < SNOR_ERASE_TYPE_MAX; i++)
-                        if (erase_type[i].size &&
-                            region_erase_mask & BIT(erase_type[i].idx))
-                                sorted_erase_mask |= BIT(i);
+                sorted_erase_mask = spi_nor_sort_erase_mask(map,
+                                                            region_erase_mask);
 
                 /* Overwrite erase mask. */
                 region->offset = (region->offset & ~SNOR_ERASE_TYPE_MASK) |
@@ -2855,52 +2877,84 @@ static u8 spi_nor_smpt_read_dummy(const struct spi_nor *nor, const u32 settings)
  * spi_nor_get_map_in_use() - get the configuration map in use
  * @nor:        pointer to a 'struct spi_nor'
  * @smpt:       pointer to the sector map parameter table
+ * @smpt_len:   sector map parameter table length
+ *
+ * Return: pointer to the map in use, ERR_PTR(-errno) otherwise.
  */
-static const u32 *spi_nor_get_map_in_use(struct spi_nor *nor, const u32 *smpt)
+static const u32 *spi_nor_get_map_in_use(struct spi_nor *nor, const u32 *smpt,
+                                         u8 smpt_len)
 {
-        const u32 *ret = NULL;
-        u32 i, addr;
+        const u32 *ret;
+        u8 *buf;
+        u32 addr;
         int err;
+        u8 i;
         u8 addr_width, read_opcode, read_dummy;
-        u8 read_data_mask, data_byte, map_id;
+        u8 read_data_mask, map_id;
+
+        /* Use a kmalloc'ed bounce buffer to guarantee it is DMA-able. */
+        buf = kmalloc(sizeof(*buf), GFP_KERNEL);
+        if (!buf)
+                return ERR_PTR(-ENOMEM);
 
         addr_width = nor->addr_width;
         read_dummy = nor->read_dummy;
         read_opcode = nor->read_opcode;
 
         map_id = 0;
-        i = 0;
         /* Determine if there are any optional Detection Command Descriptors */
-        while (!(smpt[i] & SMPT_DESC_TYPE_MAP)) {
+        for (i = 0; i < smpt_len; i += 2) {
+                if (smpt[i] & SMPT_DESC_TYPE_MAP)
+                        break;
+
                 read_data_mask = SMPT_CMD_READ_DATA(smpt[i]);
                 nor->addr_width = spi_nor_smpt_addr_width(nor, smpt[i]);
                 nor->read_dummy = spi_nor_smpt_read_dummy(nor, smpt[i]);
                 nor->read_opcode = SMPT_CMD_OPCODE(smpt[i]);
                 addr = smpt[i + 1];
 
-                err = spi_nor_read_raw(nor, addr, 1, &data_byte);
-                if (err)
+                err = spi_nor_read_raw(nor, addr, 1, buf);
+                if (err) {
+                        ret = ERR_PTR(err);
                         goto out;
+                }
 
                 /*
                  * Build an index value that is used to select the Sector Map
                  * Configuration that is currently in use.
                  */
-                map_id = map_id << 1 | !!(data_byte & read_data_mask);
-                i = i + 2;
+                map_id = map_id << 1 | !!(*buf & read_data_mask);
         }
 
-        /* Find the matching configuration map */
-        while (SMPT_MAP_ID(smpt[i]) != map_id) {
+        /*
+         * If command descriptors are provided, they always precede map
+         * descriptors in the table. There is no need to start the iteration
+         * over smpt array all over again.
+         *
+         * Find the matching configuration map.
+         */
+        ret = ERR_PTR(-EINVAL);
+        while (i < smpt_len) {
+                if (SMPT_MAP_ID(smpt[i]) == map_id) {
+                        ret = smpt + i;
+                        break;
+                }
+
+                /*
+                 * If there are no more configuration map descriptors and no
+                 * configuration ID matched the configuration identifier, the
+                 * sector address map is unknown.
+                 */
                 if (smpt[i] & SMPT_DESC_END)
-                        goto out;
+                        break;
+
                 /* increment the table index to the next map */
                 i += SMPT_MAP_REGION_COUNT(smpt[i]) + 1;
         }
 
-        ret = smpt + i;
         /* fall through */
 out:
+        kfree(buf);
         nor->addr_width = addr_width;
         nor->read_dummy = read_dummy;
         nor->read_opcode = read_opcode;
@@ -2946,7 +3000,7 @@ static int spi_nor_init_non_uniform_erase_map(struct spi_nor *nor,
         u64 offset;
         u32 region_count;
         int i, j;
-        u8 erase_type;
+        u8 erase_type, uniform_erase_type;
 
         region_count = SMPT_MAP_REGION_COUNT(*smpt);
         /*
@@ -2959,7 +3013,7 @@ static int spi_nor_init_non_uniform_erase_map(struct spi_nor *nor,
                 return -ENOMEM;
         map->regions = region;
 
-        map->uniform_erase_type = 0xff;
+        uniform_erase_type = 0xff;
         offset = 0;
         /* Populate regions. */
         for (i = 0; i < region_count; i++) {
@@ -2974,12 +3028,15 @@ static int spi_nor_init_non_uniform_erase_map(struct spi_nor *nor,
                  * Save the erase types that are supported in all regions and
                  * can erase the entire flash memory.
                  */
-                map->uniform_erase_type &= erase_type;
+                uniform_erase_type &= erase_type;
 
                 offset = (region[i].offset & ~SNOR_ERASE_FLAGS_MASK) +
                          region[i].size;
         }
 
+        map->uniform_erase_type = spi_nor_sort_erase_mask(map,
+                                                          uniform_erase_type);
+
         spi_nor_region_mark_end(&region[i - 1]);
 
         return 0;
@@ -3020,9 +3077,9 @@ static int spi_nor_parse_smpt(struct spi_nor *nor,
         for (i = 0; i < smpt_header->length; i++)
                 smpt[i] = le32_to_cpu(smpt[i]);
 
-        sector_map = spi_nor_get_map_in_use(nor, smpt);
-        if (!sector_map) {
-                ret = -EINVAL;
+        sector_map = spi_nor_get_map_in_use(nor, smpt, smpt_header->length);
+        if (IS_ERR(sector_map)) {
+                ret = PTR_ERR(sector_map);
                 goto out;
         }
 
@@ -3125,7 +3182,7 @@ static int spi_nor_parse_sfdp(struct spi_nor *nor,
         if (err)
                 goto exit;
 
-        /* Parse other parameter headers. */
+        /* Parse optional parameter tables. */
         for (i = 0; i < header.nph; i++) {
                 param_header = &param_headers[i];
 
@@ -3138,8 +3195,17 @@ static int spi_nor_parse_sfdp(struct spi_nor *nor,
                         break;
                 }
 
-                if (err)
-                        goto exit;
+                if (err) {
+                        dev_warn(dev, "Failed to parse optional parameter table: %04x\n",
+                                 SFDP_PARAM_HEADER_ID(param_header));
+                        /*
+                         * Let's not drop all information we extracted so far
+                         * if optional table parsers fail. In case of failing,
+                         * each optional parser is responsible to roll back to
+                         * the previously known spi_nor data.
+                         */
+                        err = 0;
+                }
         }
 
 exit:
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 49163570a63a..3b3f88ffab53 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -477,6 +477,34 @@ void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
 }
 EXPORT_SYMBOL_GPL(can_put_echo_skb);
 
+struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr)
+{
+        struct can_priv *priv = netdev_priv(dev);
+        struct sk_buff *skb = priv->echo_skb[idx];
+        struct canfd_frame *cf;
+
+        if (idx >= priv->echo_skb_max) {
+                netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n",
+                           __func__, idx, priv->echo_skb_max);
+                return NULL;
+        }
+
+        if (!skb) {
+                netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n",
+                           __func__, idx);
+                return NULL;
+        }
+
+        /* Using "struct canfd_frame::len" for the frame
+         * length is supported on both CAN and CANFD frames.
+         */
+        cf = (struct canfd_frame *)skb->data;
+        *len_ptr = cf->len;
+        priv->echo_skb[idx] = NULL;
+
+        return skb;
+}
+
 /*
  * Get the skb from the stack and loop it back locally
  *
@@ -486,22 +514,16 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb);
  */
 unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx)
 {
-        struct can_priv *priv = netdev_priv(dev);
-
-        BUG_ON(idx >= priv->echo_skb_max);
-
-        if (priv->echo_skb[idx]) {
-                struct sk_buff *skb = priv->echo_skb[idx];
-                struct can_frame *cf = (struct can_frame *)skb->data;
-                u8 dlc = cf->can_dlc;
+        struct sk_buff *skb;
+        u8 len;
 
-                netif_rx(priv->echo_skb[idx]);
-                priv->echo_skb[idx] = NULL;
+        skb = __can_get_echo_skb(dev, idx, &len);
+        if (!skb)
+                return 0;
 
-                return dlc;
-        }
+        netif_rx(skb);
 
-        return 0;
+        return len;
 }
 EXPORT_SYMBOL_GPL(can_get_echo_skb);
 
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 8e972ef08637..75ce11395ee8 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -135,13 +135,12 @@
 
 /* FLEXCAN interrupt flag register (IFLAG) bits */
 /* Errata ERR005829 step7: Reserve first valid MB */
-#define FLEXCAN_TX_MB_RESERVED_OFF_FIFO 8
-#define FLEXCAN_TX_MB_OFF_FIFO          9
+#define FLEXCAN_TX_MB_RESERVED_OFF_FIFO         8
 #define FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP    0
-#define FLEXCAN_TX_MB_OFF_TIMESTAMP             1
-#define FLEXCAN_RX_MB_OFF_TIMESTAMP_FIRST       (FLEXCAN_TX_MB_OFF_TIMESTAMP + 1)
-#define FLEXCAN_RX_MB_OFF_TIMESTAMP_LAST        63
-#define FLEXCAN_IFLAG_MB(x)             BIT(x)
+#define FLEXCAN_TX_MB                           63
+#define FLEXCAN_RX_MB_OFF_TIMESTAMP_FIRST       (FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP + 1)
+#define FLEXCAN_RX_MB_OFF_TIMESTAMP_LAST        (FLEXCAN_TX_MB - 1)
+#define FLEXCAN_IFLAG_MB(x)             BIT(x & 0x1f)
 #define FLEXCAN_IFLAG_RX_FIFO_OVERFLOW  BIT(7)
 #define FLEXCAN_IFLAG_RX_FIFO_WARN      BIT(6)
 #define FLEXCAN_IFLAG_RX_FIFO_AVAILABLE BIT(5)
@@ -259,9 +258,7 @@ struct flexcan_priv {
         struct can_rx_offload offload;
 
         struct flexcan_regs __iomem *regs;
-        struct flexcan_mb __iomem *tx_mb;
         struct flexcan_mb __iomem *tx_mb_reserved;
-        u8 tx_mb_idx;
         u32 reg_ctrl_default;
         u32 reg_imask1_default;
         u32 reg_imask2_default;
@@ -515,6 +512,7 @@ static int flexcan_get_berr_counter(const struct net_device *dev,
 static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         const struct flexcan_priv *priv = netdev_priv(dev);
+        struct flexcan_regs __iomem *regs = priv->regs;
         struct can_frame *cf = (struct can_frame *)skb->data;
         u32 can_id;
         u32 data;
@@ -537,17 +535,17 @@ static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *de
 
         if (cf->can_dlc > 0) {
                 data = be32_to_cpup((__be32 *)&cf->data[0]);
-                priv->write(data, &priv->tx_mb->data[0]);
+                priv->write(data, &regs->mb[FLEXCAN_TX_MB].data[0]);
         }
         if (cf->can_dlc > 4) {
                 data = be32_to_cpup((__be32 *)&cf->data[4]);
-                priv->write(data, &priv->tx_mb->data[1]);
+                priv->write(data, &regs->mb[FLEXCAN_TX_MB].data[1]);
         }
 
         can_put_echo_skb(skb, dev, 0);
 
-        priv->write(can_id, &priv->tx_mb->can_id);
-        priv->write(ctrl, &priv->tx_mb->can_ctrl);
+        priv->write(can_id, &regs->mb[FLEXCAN_TX_MB].can_id);
+        priv->write(ctrl, &regs->mb[FLEXCAN_TX_MB].can_ctrl);
 
         /* Errata ERR005829 step8:
          * Write twice INACTIVE(0x8) code to first MB.
@@ -563,9 +561,13 @@ static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *de
 static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
 {
         struct flexcan_priv *priv = netdev_priv(dev);
+        struct flexcan_regs __iomem *regs = priv->regs;
         struct sk_buff *skb;
         struct can_frame *cf;
         bool rx_errors = false, tx_errors = false;
+        u32 timestamp;
+
+        timestamp = priv->read(&regs->timer) << 16;
 
         skb = alloc_can_err_skb(dev, &cf);
         if (unlikely(!skb))
@@ -612,17 +614,21 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
         if (tx_errors)
                 dev->stats.tx_errors++;
 
-        can_rx_offload_irq_queue_err_skb(&priv->offload, skb);
+        can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
 }
 
 static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
 {
         struct flexcan_priv *priv = netdev_priv(dev);
+        struct flexcan_regs __iomem *regs = priv->regs;
         struct sk_buff *skb;
         struct can_frame *cf;
         enum can_state new_state, rx_state, tx_state;
         int flt;
         struct can_berr_counter bec;
+        u32 timestamp;
+
+        timestamp = priv->read(&regs->timer) << 16;
 
         flt = reg_esr & FLEXCAN_ESR_FLT_CONF_MASK;
         if (likely(flt == FLEXCAN_ESR_FLT_CONF_ACTIVE)) {
@@ -652,7 +658,7 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
         if (unlikely(new_state == CAN_STATE_BUS_OFF))
                 can_bus_off(dev);
 
-        can_rx_offload_irq_queue_err_skb(&priv->offload, skb);
+        can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
 }
 
 static inline struct flexcan_priv *rx_offload_to_priv(struct can_rx_offload *offload)
@@ -720,9 +726,14 @@ static unsigned int flexcan_mailbox_read(struct can_rx_offload *offload,
                         priv->write(BIT(n - 32), &regs->iflag2);
         } else {
                 priv->write(FLEXCAN_IFLAG_RX_FIFO_AVAILABLE, &regs->iflag1);
-                priv->read(&regs->timer);
         }
 
+        /* Read the Free Running Timer. It is optional but recommended
+         * to unlock Mailbox as soon as possible and make it available
+         * for reception.
+         */
+        priv->read(&regs->timer);
+
         return 1;
 }
 
@@ -732,9 +743,9 @@ static inline u64 flexcan_read_reg_iflag_rx(struct flexcan_priv *priv)
         struct flexcan_regs __iomem *regs = priv->regs;
         u32 iflag1, iflag2;
 
-        iflag2 = priv->read(&regs->iflag2) & priv->reg_imask2_default;
-        iflag1 = priv->read(&regs->iflag1) & priv->reg_imask1_default &
-                ~FLEXCAN_IFLAG_MB(priv->tx_mb_idx);
+        iflag2 = priv->read(&regs->iflag2) & priv->reg_imask2_default &
+                ~FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB);
+        iflag1 = priv->read(&regs->iflag1) & priv->reg_imask1_default;
 
         return (u64)iflag2 << 32 | iflag1;
 }
@@ -746,11 +757,9 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
         struct flexcan_priv *priv = netdev_priv(dev);
         struct flexcan_regs __iomem *regs = priv->regs;
         irqreturn_t handled = IRQ_NONE;
-        u32 reg_iflag1, reg_esr;
+        u32 reg_iflag2, reg_esr;
         enum can_state last_state = priv->can.state;
 
-        reg_iflag1 = priv->read(&regs->iflag1);
-
         /* reception interrupt */
         if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
                 u64 reg_iflag;
@@ -764,6 +773,9 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
                                 break;
                 }
         } else {
+                u32 reg_iflag1;
+
+                reg_iflag1 = priv->read(&regs->iflag1);
                 if (reg_iflag1 & FLEXCAN_IFLAG_RX_FIFO_AVAILABLE) {
                         handled = IRQ_HANDLED;
                         can_rx_offload_irq_offload_fifo(&priv->offload);
@@ -779,17 +791,22 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
                 }
         }
 
+        reg_iflag2 = priv->read(&regs->iflag2);
+
         /* transmission complete interrupt */
-        if (reg_iflag1 & FLEXCAN_IFLAG_MB(priv->tx_mb_idx)) {
+        if (reg_iflag2 & FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB)) {
+                u32 reg_ctrl = priv->read(&regs->mb[FLEXCAN_TX_MB].can_ctrl);
+
                 handled = IRQ_HANDLED;
-                stats->tx_bytes += can_get_echo_skb(dev, 0);
+                stats->tx_bytes += can_rx_offload_get_echo_skb(&priv->offload,
+                                                               0, reg_ctrl << 16);
                 stats->tx_packets++;
                 can_led_event(dev, CAN_LED_EVENT_TX);
 
                 /* after sending a RTR frame MB is in RX mode */
                 priv->write(FLEXCAN_MB_CODE_TX_INACTIVE,
-                            &priv->tx_mb->can_ctrl);
-                priv->write(FLEXCAN_IFLAG_MB(priv->tx_mb_idx), &regs->iflag1);
+                            &regs->mb[FLEXCAN_TX_MB].can_ctrl);
+                priv->write(FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB), &regs->iflag2);
                 netif_wake_queue(dev);
         }
 
@@ -931,15 +948,13 @@ static int flexcan_chip_start(struct net_device *dev)
         reg_mcr &= ~FLEXCAN_MCR_MAXMB(0xff);
         reg_mcr |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT | FLEXCAN_MCR_SUPV |
                 FLEXCAN_MCR_WRN_EN | FLEXCAN_MCR_SRX_DIS | FLEXCAN_MCR_IRMQ |
-                FLEXCAN_MCR_IDAM_C;
+                FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_MAXMB(FLEXCAN_TX_MB);
 
-        if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
+        if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP)
                 reg_mcr &= ~FLEXCAN_MCR_FEN;
-                reg_mcr |= FLEXCAN_MCR_MAXMB(priv->offload.mb_last);
-        } else {
-                reg_mcr |= FLEXCAN_MCR_FEN |
-                        FLEXCAN_MCR_MAXMB(priv->tx_mb_idx);
-        }
+        else
+                reg_mcr |= FLEXCAN_MCR_FEN;
+
         netdev_dbg(dev, "%s: writing mcr=0x%08x", __func__, reg_mcr);
         priv->write(reg_mcr, &regs->mcr);
 
@@ -982,16 +997,17 @@ static int flexcan_chip_start(struct net_device *dev)
                 priv->write(reg_ctrl2, &regs->ctrl2);
         }
 
-        /* clear and invalidate all mailboxes first */
-        for (i = priv->tx_mb_idx; i < ARRAY_SIZE(regs->mb); i++) {
-                priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
-                            &regs->mb[i].can_ctrl);
-        }
-
         if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
-                for (i = priv->offload.mb_first; i <= priv->offload.mb_last; i++)
+                for (i = priv->offload.mb_first; i <= priv->offload.mb_last; i++) {
                         priv->write(FLEXCAN_MB_CODE_RX_EMPTY,
                                     &regs->mb[i].can_ctrl);
+                }
+        } else {
+                /* clear and invalidate unused mailboxes first */
+                for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i <= ARRAY_SIZE(regs->mb); i++) {
+                        priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
+                                    &regs->mb[i].can_ctrl);
+                }
         }
 
         /* Errata ERR005829: mark first TX mailbox as INACTIVE */
@@ -1000,7 +1016,7 @@ static int flexcan_chip_start(struct net_device *dev)
 
         /* mark TX mailbox as INACTIVE */
         priv->write(FLEXCAN_MB_CODE_TX_INACTIVE,
-                    &priv->tx_mb->can_ctrl);
+                    &regs->mb[FLEXCAN_TX_MB].can_ctrl);
 
         /* acceptance mask/acceptance code (accept everything) */
         priv->write(0x0, &regs->rxgmask);
@@ -1355,17 +1371,13 @@ static int flexcan_probe(struct platform_device *pdev)
         priv->devtype_data = devtype_data;
         priv->reg_xceiver = reg_xceiver;
 
-        if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
-                priv->tx_mb_idx = FLEXCAN_TX_MB_OFF_TIMESTAMP;
+        if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP)
                 priv->tx_mb_reserved = &regs->mb[FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP];
-        } else {
-                priv->tx_mb_idx = FLEXCAN_TX_MB_OFF_FIFO;
+        else
                 priv->tx_mb_reserved = &regs->mb[FLEXCAN_TX_MB_RESERVED_OFF_FIFO];
-        }
-        priv->tx_mb = &regs->mb[priv->tx_mb_idx];
 
-        priv->reg_imask1_default = FLEXCAN_IFLAG_MB(priv->tx_mb_idx);
-        priv->reg_imask2_default = 0;
+        priv->reg_imask1_default = 0;
+        priv->reg_imask2_default = FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB);
 
         priv->offload.mailbox_read = flexcan_mailbox_read;
 
diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c
index 11662f479e76..771a46083739 100644
--- a/drivers/net/can/rcar/rcar_can.c
+++ b/drivers/net/can/rcar/rcar_can.c
@@ -24,6 +24,9 @@
 
 #define RCAR_CAN_DRV_NAME       "rcar_can"
 
+#define RCAR_SUPPORTED_CLOCKS   (BIT(CLKR_CLKP1) | BIT(CLKR_CLKP2) | \
+                                 BIT(CLKR_CLKEXT))
+
 /* Mailbox configuration:
  * mailbox 60 - 63 - Rx FIFO mailboxes
  * mailbox 56 - 59 - Tx FIFO mailboxes
@@ -789,7 +792,7 @@ static int rcar_can_probe(struct platform_device *pdev)
                 goto fail_clk;
         }
 
-        if (clock_select >= ARRAY_SIZE(clock_names)) {
+        if (!(BIT(clock_select) & RCAR_SUPPORTED_CLOCKS)) {
                 err = -EINVAL;
                 dev_err(&pdev->dev, "invalid CAN clock selected\n");
                 goto fail_clk;
diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
index c7d05027a7a0..2ce4fa8698c7 100644
--- a/drivers/net/can/rx-offload.c
+++ b/drivers/net/can/rx-offload.c
@@ -211,7 +211,54 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
 }
 EXPORT_SYMBOL_GPL(can_rx_offload_irq_offload_fifo);
 
-int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_buff *skb)
+int can_rx_offload_queue_sorted(struct can_rx_offload *offload,
+                                struct sk_buff *skb, u32 timestamp)
+{
+        struct can_rx_offload_cb *cb;
+        unsigned long flags;
+
+        if (skb_queue_len(&offload->skb_queue) >
+            offload->skb_queue_len_max)
+                return -ENOMEM;
+
+        cb = can_rx_offload_get_cb(skb);
+        cb->timestamp = timestamp;
+
+        spin_lock_irqsave(&offload->skb_queue.lock, flags);
+        __skb_queue_add_sort(&offload->skb_queue, skb, can_rx_offload_compare);
+        spin_unlock_irqrestore(&offload->skb_queue.lock, flags);
+
+        can_rx_offload_schedule(offload);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(can_rx_offload_queue_sorted);
+
+unsigned int can_rx_offload_get_echo_skb(struct can_rx_offload *offload,
+                                         unsigned int idx, u32 timestamp)
+{
+        struct net_device *dev = offload->dev;
+        struct net_device_stats *stats = &dev->stats;
+        struct sk_buff *skb;
+        u8 len;
+        int err;
+
+        skb = __can_get_echo_skb(dev, idx, &len);
+        if (!skb)
+                return 0;
+
+        err = can_rx_offload_queue_sorted(offload, skb, timestamp);
+        if (err) {
+                stats->rx_errors++;
+                stats->tx_fifo_errors++;
+        }
+
+        return len;
+}
+EXPORT_SYMBOL_GPL(can_rx_offload_get_echo_skb);
+
+int can_rx_offload_queue_tail(struct can_rx_offload *offload,
+                              struct sk_buff *skb)
 {
         if (skb_queue_len(&offload->skb_queue) >
             offload->skb_queue_len_max)
@@ -222,7 +269,7 @@ int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_b
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(can_rx_offload_irq_queue_err_skb);
+EXPORT_SYMBOL_GPL(can_rx_offload_queue_tail);
 
 static int can_rx_offload_init_queue(struct net_device *dev, struct can_rx_offload *offload, unsigned int weight)
 {
diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
index 53e320c92a8b..ddaf46239e39 100644
--- a/drivers/net/can/spi/hi311x.c
+++ b/drivers/net/can/spi/hi311x.c
@@ -760,7 +760,7 @@ static int hi3110_open(struct net_device *net)
 {
         struct hi3110_priv *priv = netdev_priv(net);
         struct spi_device *spi = priv->spi;
-        unsigned long flags = IRQF_ONESHOT | IRQF_TRIGGER_RISING;
+        unsigned long flags = IRQF_ONESHOT | IRQF_TRIGGER_HIGH;
         int ret;
 
         ret = open_candev(net);
diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
index b939a4c10b84..c89c7d4900d7 100644
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
@@ -528,7 +528,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                         context = &priv->tx_contexts[i];
 
                         context->echo_index = i;
-                        can_put_echo_skb(skb, netdev, context->echo_index);
                         ++priv->active_tx_contexts;
                         if (priv->active_tx_contexts >= (int)dev->max_tx_urbs)
                                 netif_stop_queue(netdev);
@@ -553,7 +552,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                 dev_kfree_skb(skb);
                 spin_lock_irqsave(&priv->tx_contexts_lock, flags);
 
-                can_free_echo_skb(netdev, context->echo_index);
                 context->echo_index = dev->max_tx_urbs;
                 --priv->active_tx_contexts;
                 netif_wake_queue(netdev);
@@ -564,6 +562,8 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
 
         context->priv = priv;
 
+        can_put_echo_skb(skb, netdev, context->echo_index);
+
         usb_fill_bulk_urb(urb, dev->udev,
                           usb_sndbulkpipe(dev->udev,
                                           dev->bulk_out->bEndpointAddress),
diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
index c084bae5ec0a..5fc0be564274 100644
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
@@ -1019,6 +1019,11 @@ kvaser_usb_hydra_error_frame(struct kvaser_usb_net_priv *priv,
                                         new_state : CAN_STATE_ERROR_ACTIVE;
 
                         can_change_state(netdev, cf, tx_state, rx_state);
+
+                        if (priv->can.restart_ms &&
+                            old_state >= CAN_STATE_BUS_OFF &&
+                            new_state < CAN_STATE_BUS_OFF)
+                                cf->can_id |= CAN_ERR_RESTARTED;
                 }
 
                 if (new_state == CAN_STATE_BUS_OFF) {
@@ -1028,11 +1033,6 @@ kvaser_usb_hydra_error_frame(struct kvaser_usb_net_priv *priv,
 
                         can_bus_off(netdev);
                 }
-
-                if (priv->can.restart_ms &&
-                    old_state >= CAN_STATE_BUS_OFF &&
-                    new_state < CAN_STATE_BUS_OFF)
-                        cf->can_id |= CAN_ERR_RESTARTED;
         }
 
         if (!skb) {
diff --git a/drivers/net/can/usb/ucan.c b/drivers/net/can/usb/ucan.c
index 0678a38b1af4..f3d5bda012a1 100644
--- a/drivers/net/can/usb/ucan.c
+++ b/drivers/net/can/usb/ucan.c
@@ -35,10 +35,6 @@
 #include <linux/slab.h>
 #include <linux/usb.h>
 
-#include <linux/can.h>
-#include <linux/can/dev.h>
-#include <linux/can/error.h>
-
 #define UCAN_DRIVER_NAME "ucan"
 #define UCAN_MAX_RX_URBS 8
 /* the CAN controller needs a while to enable/disable the bus */
@@ -1575,11 +1571,8 @@ err_firmware_needs_update:
 /* disconnect the device */
 static void ucan_disconnect(struct usb_interface *intf)
 {
-        struct usb_device *udev;
         struct ucan_priv *up = usb_get_intfdata(intf);
 
-        udev = interface_to_usbdev(intf);
-
         usb_set_intfdata(intf, NULL);
 
         if (up) {
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index 18956e7604a3..a70bb1bb90e7 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -1848,6 +1848,8 @@ static void ena_down(struct ena_adapter *adapter)
                 rc = ena_com_dev_reset(adapter->ena_dev, adapter->reset_reason);
                 if (rc)
                         dev_err(&adapter->pdev->dev, "Device reset failed\n");
+                /* stop submitting admin commands on a device that was reset */
+                ena_com_set_admin_running_state(adapter->ena_dev, false);
         }
 
         ena_destroy_all_io_queues(adapter);
@@ -1914,6 +1916,9 @@ static int ena_close(struct net_device *netdev)
 
         netif_dbg(adapter, ifdown, netdev, "%s\n", __func__);
 
+        if (!test_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags))
+                return 0;
+
         if (test_bit(ENA_FLAG_DEV_UP, &adapter->flags))
                 ena_down(adapter);
 
@@ -2613,9 +2618,7 @@ static void ena_destroy_device(struct ena_adapter *adapter, bool graceful)
                 ena_down(adapter);
 
         /* Stop the device from sending AENQ events (in case reset flag is set
-         *  and device is up, ena_close already reset the device
-         * In case the reset flag is set and the device is up, ena_down()
-         * already perform the reset, so it can be skipped.
+         *  and device is up, ena_down() already reset the device.
          */
         if (!(test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags) && dev_up))
                 ena_com_dev_reset(adapter->ena_dev, adapter->reset_reason);
@@ -2694,8 +2697,8 @@ err_device_destroy:
         ena_com_abort_admin_commands(ena_dev);
         ena_com_wait_for_abort_completion(ena_dev);
         ena_com_admin_destroy(ena_dev);
-        ena_com_mmio_reg_read_request_destroy(ena_dev);
         ena_com_dev_reset(ena_dev, ENA_REGS_RESET_DRIVER_INVALID_STATE);
+        ena_com_mmio_reg_read_request_destroy(ena_dev);
 err:
         clear_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags);
         clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags);
@@ -3452,6 +3455,8 @@ err_rss:
         ena_com_rss_destroy(ena_dev);
 err_free_msix:
         ena_com_dev_reset(ena_dev, ENA_REGS_RESET_INIT_ERR);
+        /* stop submitting admin commands on a device that was reset */
+        ena_com_set_admin_running_state(ena_dev, false);
         ena_free_mgmnt_irq(adapter);
         ena_disable_msix(adapter);
 err_worker_destroy:
@@ -3498,18 +3503,12 @@ static void ena_remove(struct pci_dev *pdev)
 
         cancel_work_sync(&adapter->reset_task);
 
-        unregister_netdev(netdev);
-
-        /* If the device is running then we want to make sure the device will be
-         * reset to make sure no more events will be issued by the device.
-         */
-        if (test_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags))
-                set_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
-
         rtnl_lock();
         ena_destroy_device(adapter, true);
         rtnl_unlock();
 
+        unregister_netdev(netdev);
+
         free_netdev(netdev);
 
         ena_com_rss_destroy(ena_dev);
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h
index 521873642339..dc8b6173d8d8 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
@@ -45,7 +45,7 @@
 
 #define DRV_MODULE_VER_MAJOR    2
 #define DRV_MODULE_VER_MINOR    0
-#define DRV_MODULE_VER_SUBMINOR 1
+#define DRV_MODULE_VER_SUBMINOR 2
 
 #define DRV_MODULE_NAME         "ena"
 #ifndef DRV_MODULE_VERSION
diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c
index b4fc0ed5bce8..9d4899826823 100644
--- a/drivers/net/ethernet/amd/sunlance.c
+++ b/drivers/net/ethernet/amd/sunlance.c
@@ -1419,7 +1419,7 @@ static int sparc_lance_probe_one(struct platform_device *op,
 
                         prop = of_get_property(nd, "tpe-link-test?", NULL);
                         if (!prop)
-                                goto no_link_test;
+                                goto node_put;
 
                         if (strcmp(prop, "true")) {
                                 printk(KERN_NOTICE "SunLance: warning: overriding option "
@@ -1428,6 +1428,8 @@ static int sparc_lance_probe_one(struct platform_device *op,
                                        "to ecd@skynet.be\n");
                                 auxio_set_lte(AUXIO_LTE_ON);
                         }
+node_put:
+                        of_node_put(nd);
 no_link_test:
                         lp->auto_select = 1;
                         lp->tpe = 0;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index be1506169076..0de487a8f0eb 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -2191,6 +2191,13 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id,
 #define PMF_DMAE_C(bp)                  (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \
                                          E1HVN_MAX)
 
+/* Following is the DMAE channel number allocation for the clients.
+ *   MFW: OCBB/OCSD implementations use DMAE channels 14/15 respectively.
+ *   Driver: 0-3 and 8-11 (for PF dmae operations)
+ *           4 and 12 (for stats requests)
+ */
+#define BNX2X_FW_DMAE_C                 13 /* Channel for FW DMAE operations */
+
 /* PCIE link and speed */
 #define PCICFG_LINK_WIDTH               0x1f00000
 #define PCICFG_LINK_WIDTH_SHIFT         20
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
index 3f4d2c8da21a..a9eaaf3e73a4 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
@@ -6149,6 +6149,7 @@ static inline int bnx2x_func_send_start(struct bnx2x *bp,
         rdata->sd_vlan_tag      = cpu_to_le16(start_params->sd_vlan_tag);
         rdata->path_id          = BP_PATH(bp);
         rdata->network_cos_mode = start_params->network_cos_mode;
+        rdata->dmae_cmd_id      = BNX2X_FW_DMAE_C;
 
         rdata->vxlan_dst_port   = cpu_to_le16(start_params->vxlan_dst_port);
         rdata->geneve_dst_port  = cpu_to_le16(start_params->geneve_dst_port);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index dd85d790f638..d4c300117529 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1675,7 +1675,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
         } else {
                 if (rxcmp1->rx_cmp_cfa_code_errors_v2 & RX_CMP_L4_CS_ERR_BITS) {
                         if (dev->features & NETIF_F_RXCSUM)
-                                cpr->rx_l4_csum_errors++;
+                                bnapi->cp_ring.rx_l4_csum_errors++;
                 }
         }
 
@@ -8714,6 +8714,26 @@ static int bnxt_set_features(struct net_device *dev, netdev_features_t features)
         return rc;
 }
 
+static int bnxt_dbg_hwrm_ring_info_get(struct bnxt *bp, u8 ring_type,
+                                       u32 ring_id, u32 *prod, u32 *cons)
+{
+        struct hwrm_dbg_ring_info_get_output *resp = bp->hwrm_cmd_resp_addr;
+        struct hwrm_dbg_ring_info_get_input req = {0};
+        int rc;
+
+        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_DBG_RING_INFO_GET, -1, -1);
+        req.ring_type = ring_type;
+        req.fw_ring_id = cpu_to_le32(ring_id);
+        mutex_lock(&bp->hwrm_cmd_lock);
+        rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+        if (!rc) {
+                *prod = le32_to_cpu(resp->producer_index);
+                *cons = le32_to_cpu(resp->consumer_index);
+        }
+        mutex_unlock(&bp->hwrm_cmd_lock);
+        return rc;
+}
+
 static void bnxt_dump_tx_sw_state(struct bnxt_napi *bnapi)
 {
         struct bnxt_tx_ring_info *txr = bnapi->tx_ring;
@@ -8821,6 +8841,11 @@ static void bnxt_timer(struct timer_list *t)
                         bnxt_queue_sp_work(bp);
                 }
         }
+
+        if ((bp->flags & BNXT_FLAG_CHIP_P5) && netif_carrier_ok(dev)) {
+                set_bit(BNXT_RING_COAL_NOW_SP_EVENT, &bp->sp_event);
+                bnxt_queue_sp_work(bp);
+        }
 bnxt_restart_timer:
         mod_timer(&bp->timer, jiffies + bp->current_interval);
 }
@@ -8851,6 +8876,44 @@ static void bnxt_reset(struct bnxt *bp, bool silent)
         bnxt_rtnl_unlock_sp(bp);
 }
 
+static void bnxt_chk_missed_irq(struct bnxt *bp)
+{
+        int i;
+
+        if (!(bp->flags & BNXT_FLAG_CHIP_P5))
+                return;
+
+        for (i = 0; i < bp->cp_nr_rings; i++) {
+                struct bnxt_napi *bnapi = bp->bnapi[i];
+                struct bnxt_cp_ring_info *cpr;
+                u32 fw_ring_id;
+                int j;
+
+                if (!bnapi)
+                        continue;
+
+                cpr = &bnapi->cp_ring;
+                for (j = 0; j < 2; j++) {
+                        struct bnxt_cp_ring_info *cpr2 = cpr->cp_ring_arr[j];
+                        u32 val[2];
+
+                        if (!cpr2 || cpr2->has_more_work ||
+                            !bnxt_has_work(bp, cpr2))
+                                continue;
+
+                        if (cpr2->cp_raw_cons != cpr2->last_cp_raw_cons) {
+                                cpr2->last_cp_raw_cons = cpr2->cp_raw_cons;
+                                continue;
+                        }
+                        fw_ring_id = cpr2->cp_ring_struct.fw_ring_id;
+                        bnxt_dbg_hwrm_ring_info_get(bp,
+                                DBG_RING_INFO_GET_REQ_RING_TYPE_L2_CMPL,
+                                fw_ring_id, &val[0], &val[1]);
+                        cpr->missed_irqs++;
+                }
+        }
+}
+
 static void bnxt_cfg_ntp_filters(struct bnxt *);
 
 static void bnxt_sp_task(struct work_struct *work)
@@ -8930,6 +8993,9 @@ static void bnxt_sp_task(struct work_struct *work)
         if (test_and_clear_bit(BNXT_FLOW_STATS_SP_EVENT, &bp->sp_event))
                 bnxt_tc_flow_stats_work(bp);
 
+        if (test_and_clear_bit(BNXT_RING_COAL_NOW_SP_EVENT, &bp->sp_event))
+                bnxt_chk_missed_irq(bp);
+
         /* These functions below will clear BNXT_STATE_IN_SP_TASK.  They
          * must be the last functions to be called before exiting.
          */
@@ -10087,6 +10153,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         bnxt_hwrm_func_qcfg(bp);
+        bnxt_hwrm_vnic_qcaps(bp);
         bnxt_hwrm_port_led_qcaps(bp);
         bnxt_ethtool_init(bp);
         bnxt_dcb_init(bp);
@@ -10120,7 +10187,6 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                                     VNIC_RSS_CFG_REQ_HASH_TYPE_UDP_IPV6;
         }
 
-        bnxt_hwrm_vnic_qcaps(bp);
         if (bnxt_rfs_supported(bp)) {
                 dev->hw_features |= NETIF_F_NTUPLE;
                 if (bnxt_rfs_capable(bp)) {
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 498b373c992d..9e99d4ab3e06 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -798,6 +798,8 @@ struct bnxt_cp_ring_info {
         u8                      had_work_done:1;
         u8                      has_more_work:1;
 
+        u32                     last_cp_raw_cons;
+
         struct bnxt_coal        rx_ring_coal;
         u64                     rx_packets;
         u64                     rx_bytes;
@@ -816,6 +818,7 @@ struct bnxt_cp_ring_info {
         dma_addr_t              hw_stats_map;
         u32                     hw_stats_ctx_id;
         u64                     rx_l4_csum_errors;
+        u64                     missed_irqs;
 
         struct bnxt_ring_struct cp_ring_struct;
 
@@ -1527,6 +1530,7 @@ struct bnxt {
 #define BNXT_LINK_SPEED_CHNG_SP_EVENT   14
 #define BNXT_FLOW_STATS_SP_EVENT        15
 #define BNXT_UPDATE_PHY_SP_EVENT        16
+#define BNXT_RING_COAL_NOW_SP_EVENT     17
 
         struct bnxt_hw_resc     hw_resc;
         struct bnxt_pf_info     pf;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index 48078564f025..6cc69a58478a 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -137,7 +137,7 @@ reset_coalesce:
         return rc;
 }
 
-#define BNXT_NUM_STATS  21
+#define BNXT_NUM_STATS  22
 
 #define BNXT_RX_STATS_ENTRY(counter)    \
         { BNXT_RX_STATS_OFFSET(counter), __stringify(counter) }
@@ -384,6 +384,7 @@ static void bnxt_get_ethtool_stats(struct net_device *dev,
                 for (k = 0; k < stat_fields; j++, k++)
                         buf[j] = le64_to_cpu(hw_stats[k]);
                 buf[j++] = cpr->rx_l4_csum_errors;
+                buf[j++] = cpr->missed_irqs;
 
                 bnxt_sw_func_stats[RX_TOTAL_DISCARDS].counter +=
                         le64_to_cpu(cpr->hw_stats->rx_discard_pkts);
@@ -468,6 +469,8 @@ static void bnxt_get_strings(struct net_device *dev, u32 stringset, u8 *buf)
                         buf += ETH_GSTRING_LEN;
                         sprintf(buf, "[%d]: rx_l4_csum_errors", i);
                         buf += ETH_GSTRING_LEN;
+                        sprintf(buf, "[%d]: missed_irqs", i);
+                        buf += ETH_GSTRING_LEN;
                 }
                 for (i = 0; i < BNXT_NUM_SW_FUNC_STATS; i++) {
                         strcpy(buf, bnxt_sw_func_stats[i].string);
@@ -2942,8 +2945,8 @@ bnxt_fill_coredump_record(struct bnxt *bp, struct bnxt_coredump_record *record,
         record->asic_state = 0;
         strlcpy(record->system_name, utsname()->nodename,
                 sizeof(record->system_name));
-        record->year = cpu_to_le16(tm.tm_year);
-        record->month = cpu_to_le16(tm.tm_mon);
+        record->year = cpu_to_le16(tm.tm_year + 1900);
+        record->month = cpu_to_le16(tm.tm_mon + 1);
         record->day = cpu_to_le16(tm.tm_mday);
         record->hour = cpu_to_le16(tm.tm_hour);
         record->minute = cpu_to_le16(tm.tm_min);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
index beee61292d5e..b59b382d34f9 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
@@ -43,6 +43,9 @@ static int bnxt_register_dev(struct bnxt_en_dev *edev, int ulp_id,
         if (ulp_id == BNXT_ROCE_ULP) {
                 unsigned int max_stat_ctxs;
 
+                if (bp->flags & BNXT_FLAG_CHIP_P5)
+                        return -EOPNOTSUPP;
+
                 max_stat_ctxs = bnxt_get_max_func_stat_ctxs(bp);
                 if (max_stat_ctxs <= BNXT_MIN_ROCE_STAT_CTXS ||
                     bp->num_stat_ctxs == max_stat_ctxs)
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 89295306f161..432c3b867084 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -12422,6 +12422,7 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
 {
         struct tg3 *tp = netdev_priv(dev);
         int i, irq_sync = 0, err = 0;
+        bool reset_phy = false;
 
         if ((ering->rx_pending > tp->rx_std_ring_mask) ||
             (ering->rx_jumbo_pending > tp->rx_jmb_ring_mask) ||
@@ -12453,7 +12454,13 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
 
         if (netif_running(dev)) {
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                err = tg3_restart_hw(tp, false);
+                /* Reset PHY to avoid PHY lock up */
+                if (tg3_asic_rev(tp) == ASIC_REV_5717 ||
+                    tg3_asic_rev(tp) == ASIC_REV_5719 ||
+                    tg3_asic_rev(tp) == ASIC_REV_5720)
+                        reset_phy = true;
+
+                err = tg3_restart_hw(tp, reset_phy);
                 if (!err)
                         tg3_netif_start(tp);
         }
@@ -12487,6 +12494,7 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 {
         struct tg3 *tp = netdev_priv(dev);
         int err = 0;
+        bool reset_phy = false;
 
         if (tp->link_config.autoneg == AUTONEG_ENABLE)
                 tg3_warn_mgmt_link_flap(tp);
@@ -12556,7 +12564,13 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 
                 if (netif_running(dev)) {
                         tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                        err = tg3_restart_hw(tp, false);
+                        /* Reset PHY to avoid PHY lock up */
+                        if (tg3_asic_rev(tp) == ASIC_REV_5717 ||
+                            tg3_asic_rev(tp) == ASIC_REV_5719 ||
+                            tg3_asic_rev(tp) == ASIC_REV_5720)
+                                reset_phy = true;
+
+                        err = tg3_restart_hw(tp, reset_phy);
                         if (!err)
                                 tg3_netif_start(tp);
                 }
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index 768f584f8392..88f8a8fa93cd 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -1784,6 +1784,7 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
         bool if_up = netif_running(nic->netdev);
         struct bpf_prog *old_prog;
         bool bpf_attached = false;
+        int ret = 0;
 
         /* For now just support only the usual MTU sized frames */
         if (prog && (dev->mtu > 1500)) {
@@ -1817,8 +1818,12 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
         if (nic->xdp_prog) {
                 /* Attach BPF program */
                 nic->xdp_prog = bpf_prog_add(nic->xdp_prog, nic->rx_queues - 1);
-                if (!IS_ERR(nic->xdp_prog))
+                if (!IS_ERR(nic->xdp_prog)) {
                         bpf_attached = true;
+                } else {
+                        ret = PTR_ERR(nic->xdp_prog);
+                        nic->xdp_prog = NULL;
+                }
         }
 
         /* Calculate Tx queues needed for XDP and network stack */
@@ -1830,7 +1835,7 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
                 netif_trans_update(nic->netdev);
         }
 
-        return 0;
+        return ret;
 }
 
 static int nicvf_xdp(struct net_device *netdev, struct netdev_bpf *xdp)
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 187a249ff2d1..fcaf18fa3904 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -585,10 +585,12 @@ static void nicvf_free_snd_queue(struct nicvf *nic, struct snd_queue *sq)
         if (!sq->dmem.base)
                 return;
 
-        if (sq->tso_hdrs)
+        if (sq->tso_hdrs) {
                 dma_free_coherent(&nic->pdev->dev,
                                   sq->dmem.q_len * TSO_HEADER_SIZE,
                                   sq->tso_hdrs, sq->tso_hdrs_phys);
+                sq->tso_hdrs = NULL;
+        }
 
         /* Free pending skbs in the queue */
         smp_rmb();
diff --git a/drivers/net/ethernet/chelsio/Kconfig b/drivers/net/ethernet/chelsio/Kconfig
index 75c1c5ed2387..e2cdfa75673f 100644
--- a/drivers/net/ethernet/chelsio/Kconfig
+++ b/drivers/net/ethernet/chelsio/Kconfig
@@ -67,7 +67,6 @@ config CHELSIO_T3
 config CHELSIO_T4
         tristate "Chelsio Communications T4/T5/T6 Ethernet support"
         depends on PCI && (IPV6 || IPV6=n)
-        depends on THERMAL || !THERMAL
         select FW_LOADER
         select MDIO
         select ZLIB_DEFLATE
diff --git a/drivers/net/ethernet/chelsio/cxgb4/Makefile b/drivers/net/ethernet/chelsio/cxgb4/Makefile
index 78e5d17a1d5f..91d8a885deba 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/Makefile
+++ b/drivers/net/ethernet/chelsio/cxgb4/Makefile
@@ -12,6 +12,4 @@ cxgb4-objs := cxgb4_main.o l2t.o smt.o t4_hw.o sge.o clip_tbl.o cxgb4_ethtool.o
 cxgb4-$(CONFIG_CHELSIO_T4_DCB) +=  cxgb4_dcb.o
 cxgb4-$(CONFIG_CHELSIO_T4_FCOE) +=  cxgb4_fcoe.o
 cxgb4-$(CONFIG_DEBUG_FS) += cxgb4_debugfs.o
-ifdef CONFIG_THERMAL
-cxgb4-objs += cxgb4_thermal.o
-endif
+cxgb4-$(CONFIG_THERMAL) += cxgb4_thermal.o
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 05a46926016a..d49db46254cd 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -5863,7 +5863,7 @@ fw_attach_fail:
         if (!is_t4(adapter->params.chip))
                 cxgb4_ptp_init(adapter);
 
-        if (IS_ENABLED(CONFIG_THERMAL) &&
+        if (IS_REACHABLE(CONFIG_THERMAL) &&
             !is_t4(adapter->params.chip) && (adapter->flags & FW_OK))
                 cxgb4_thermal_init(adapter);
 
@@ -5932,7 +5932,7 @@ static void remove_one(struct pci_dev *pdev)
 
                 if (!is_t4(adapter->params.chip))
                         cxgb4_ptp_stop(adapter);
-                if (IS_ENABLED(CONFIG_THERMAL))
+                if (IS_REACHABLE(CONFIG_THERMAL))
                         cxgb4_thermal_remove(adapter);
 
                 /* If we allocated filters, free up state associated with any
diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index ceec467f590d..949103db8a8a 100644
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -660,7 +660,7 @@ static void gmac_clean_txq(struct net_device *netdev, struct gmac_txq *txq,
 
                         u64_stats_update_begin(&port->tx_stats_syncp);
                         port->tx_frag_stats[nfrags]++;
-                        u64_stats_update_end(&port->ir_stats_syncp);
+                        u64_stats_update_end(&port->tx_stats_syncp);
                 }
         }
 
diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
index 570caeb8ee9e..084f24daf2b5 100644
--- a/drivers/net/ethernet/faraday/ftmac100.c
+++ b/drivers/net/ethernet/faraday/ftmac100.c
@@ -872,11 +872,10 @@ static irqreturn_t ftmac100_interrupt(int irq, void *dev_id)
         struct net_device *netdev = dev_id;
         struct ftmac100 *priv = netdev_priv(netdev);
 
-        if (likely(netif_running(netdev))) {
-                /* Disable interrupts for polling */
-                ftmac100_disable_all_int(priv);
+        /* Disable interrupts for polling */
+        ftmac100_disable_all_int(priv);
+        if (likely(netif_running(netdev)))
                 napi_schedule(&priv->napi);
-        }
 
         return IRQ_HANDLED;
 }
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index c9d5d0a7fbf1..c0203a0d5e3b 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -485,8 +485,8 @@ static void release_rx_pools(struct ibmvnic_adapter *adapter)
 
                 for (j = 0; j < rx_pool->size; j++) {
                         if (rx_pool->rx_buff[j].skb) {
-                                dev_kfree_skb_any(rx_pool->rx_buff[i].skb);
-                                rx_pool->rx_buff[i].skb = NULL;
+                                dev_kfree_skb_any(rx_pool->rx_buff[j].skb);
+                                rx_pool->rx_buff[j].skb = NULL;
                         }
                 }
 
@@ -1103,20 +1103,15 @@ static int ibmvnic_open(struct net_device *netdev)
                 return 0;
         }
 
-        mutex_lock(&adapter->reset_lock);
-
         if (adapter->state != VNIC_CLOSED) {
                 rc = ibmvnic_login(netdev);
-                if (rc) {
-                        mutex_unlock(&adapter->reset_lock);
+                if (rc)
                         return rc;
-                }
 
                 rc = init_resources(adapter);
                 if (rc) {
                         netdev_err(netdev, "failed to initialize resources\n");
                         release_resources(adapter);
-                        mutex_unlock(&adapter->reset_lock);
                         return rc;
                 }
         }
@@ -1124,8 +1119,6 @@ static int ibmvnic_open(struct net_device *netdev)
         rc = __ibmvnic_open(netdev);
         netif_carrier_on(netdev);
 
-        mutex_unlock(&adapter->reset_lock);
-
         return rc;
 }
 
@@ -1269,10 +1262,8 @@ static int ibmvnic_close(struct net_device *netdev)
                 return 0;
         }
 
-        mutex_lock(&adapter->reset_lock);
         rc = __ibmvnic_close(netdev);
         ibmvnic_cleanup(netdev);
-        mutex_unlock(&adapter->reset_lock);
 
         return rc;
 }
@@ -1746,6 +1737,7 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                     struct ibmvnic_rwi *rwi, u32 reset_state)
 {
         u64 old_num_rx_queues, old_num_tx_queues;
+        u64 old_num_rx_slots, old_num_tx_slots;
         struct net_device *netdev = adapter->netdev;
         int i, rc;
 
@@ -1757,6 +1749,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
 
         old_num_rx_queues = adapter->req_rx_queues;
         old_num_tx_queues = adapter->req_tx_queues;
+        old_num_rx_slots = adapter->req_rx_add_entries_per_subcrq;
+        old_num_tx_slots = adapter->req_tx_entries_per_subcrq;
 
         ibmvnic_cleanup(netdev);
 
@@ -1819,21 +1813,20 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                         if (rc)
                                 return rc;
                 } else if (adapter->req_rx_queues != old_num_rx_queues ||
-                           adapter->req_tx_queues != old_num_tx_queues) {
-                        adapter->map_id = 1;
+                           adapter->req_tx_queues != old_num_tx_queues ||
+                           adapter->req_rx_add_entries_per_subcrq !=
+                                                        old_num_rx_slots ||
+                           adapter->req_tx_entries_per_subcrq !=
+                                                        old_num_tx_slots) {
                         release_rx_pools(adapter);
                         release_tx_pools(adapter);
-                        rc = init_rx_pools(netdev);
-                        if (rc)
-                                return rc;
-                        rc = init_tx_pools(netdev);
-                        if (rc)
-                                return rc;
-
                         release_napi(adapter);
-                        rc = init_napi(adapter);
+                        release_vpd_data(adapter);
+
+                        rc = init_resources(adapter);
                         if (rc)
                                 return rc;
+
                 } else {
                         rc = reset_tx_pools(adapter);
                         if (rc)
@@ -1917,17 +1910,8 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter,
                 adapter->state = VNIC_PROBED;
                 return 0;
         }
-        /* netif_set_real_num_xx_queues needs to take rtnl lock here
-         * unless wait_for_reset is set, in which case the rtnl lock
-         * has already been taken before initializing the reset
-         */
-        if (!adapter->wait_for_reset) {
-                rtnl_lock();
-                rc = init_resources(adapter);
-                rtnl_unlock();
-        } else {
-                rc = init_resources(adapter);
-        }
+
+        rc = init_resources(adapter);
         if (rc)
                 return rc;
 
@@ -1986,13 +1970,21 @@ static void __ibmvnic_reset(struct work_struct *work)
         struct ibmvnic_rwi *rwi;
         struct ibmvnic_adapter *adapter;
         struct net_device *netdev;
+        bool we_lock_rtnl = false;
         u32 reset_state;
         int rc = 0;
 
         adapter = container_of(work, struct ibmvnic_adapter, ibmvnic_reset);
         netdev = adapter->netdev;
 
-        mutex_lock(&adapter->reset_lock);
+        /* netif_set_real_num_xx_queues needs to take rtnl lock here
+         * unless wait_for_reset is set, in which case the rtnl lock
+         * has already been taken before initializing the reset
+         */
+        if (!adapter->wait_for_reset) {
+                rtnl_lock();
+                we_lock_rtnl = true;
+        }
         reset_state = adapter->state;
 
         rwi = get_next_rwi(adapter);
@@ -2020,12 +2012,11 @@ static void __ibmvnic_reset(struct work_struct *work)
         if (rc) {
                 netdev_dbg(adapter->netdev, "Reset failed\n");
                 free_all_rwi(adapter);
-                mutex_unlock(&adapter->reset_lock);
-                return;
         }
 
         adapter->resetting = false;
-        mutex_unlock(&adapter->reset_lock);
+        if (we_lock_rtnl)
+                rtnl_unlock();
 }
 
 static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
@@ -4768,7 +4759,6 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
 
         INIT_WORK(&adapter->ibmvnic_reset, __ibmvnic_reset);
         INIT_LIST_HEAD(&adapter->rwi_list);
-        mutex_init(&adapter->reset_lock);
         mutex_init(&adapter->rwi_lock);
         adapter->resetting = false;
 
@@ -4840,8 +4830,8 @@ static int ibmvnic_remove(struct vio_dev *dev)
         struct ibmvnic_adapter *adapter = netdev_priv(netdev);
 
         adapter->state = VNIC_REMOVING;
-        unregister_netdev(netdev);
-        mutex_lock(&adapter->reset_lock);
+        rtnl_lock();
+        unregister_netdevice(netdev);
 
         release_resources(adapter);
         release_sub_crqs(adapter, 1);
@@ -4852,7 +4842,7 @@ static int ibmvnic_remove(struct vio_dev *dev)
 
         adapter->state = VNIC_REMOVED;
 
-        mutex_unlock(&adapter->reset_lock);
+        rtnl_unlock();
         device_remove_file(&dev->dev, &dev_attr_failover);
         free_netdev(netdev);
         dev_set_drvdata(&dev->dev, NULL);
diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
index 18103b811d4d..99c4f8d331ce 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.h
+++ b/drivers/net/ethernet/ibm/ibmvnic.h
@@ -1075,7 +1075,7 @@ struct ibmvnic_adapter {
         struct tasklet_struct tasklet;
         enum vnic_state state;
         enum ibmvnic_reset_reason reset_reason;
-        struct mutex reset_lock, rwi_lock;
+        struct mutex rwi_lock;
         struct list_head rwi_list;
         struct work_struct ibmvnic_reset;
         bool resetting;
diff --git a/drivers/net/ethernet/lantiq_xrx200.c b/drivers/net/ethernet/lantiq_xrx200.c
index 8c5ba4b81fb7..2d4d10a017e5 100644
--- a/drivers/net/ethernet/lantiq_xrx200.c
+++ b/drivers/net/ethernet/lantiq_xrx200.c
@@ -512,7 +512,8 @@ static int xrx200_probe(struct platform_device *pdev)
         err = register_netdev(net_dev);
         if (err)
                 goto err_unprepare_clk;
-        return err;
+
+        return 0;
 
 err_unprepare_clk:
         clk_disable_unprepare(priv->clk);
@@ -520,7 +521,7 @@ err_unprepare_clk:
 err_uninit_dma:
         xrx200_hw_cleanup(priv);
 
-        return 0;
+        return err;
 }
 
 static int xrx200_remove(struct platform_device *pdev)
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 3ba672e9e353..e5397c8197b9 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -3343,7 +3343,6 @@ static void mvneta_validate(struct net_device *ndev, unsigned long *supported,
         if (state->interface != PHY_INTERFACE_MODE_NA &&
             state->interface != PHY_INTERFACE_MODE_QSGMII &&
             state->interface != PHY_INTERFACE_MODE_SGMII &&
-            state->interface != PHY_INTERFACE_MODE_2500BASEX &&
             !phy_interface_mode_is_8023z(state->interface) &&
             !phy_interface_mode_is_rgmii(state->interface)) {
                 bitmap_zero(supported, __ETHTOOL_LINK_MODE_MASK_NBITS);
@@ -3357,14 +3356,9 @@ static void mvneta_validate(struct net_device *ndev, unsigned long *supported,
         /* Asymmetric pause is unsupported */
         phylink_set(mask, Pause);
 
-        /* We cannot use 1Gbps when using the 2.5G interface. */
-        if (state->interface == PHY_INTERFACE_MODE_2500BASEX) {
-                phylink_set(mask, 2500baseT_Full);
-                phylink_set(mask, 2500baseX_Full);
-        } else {
-                phylink_set(mask, 1000baseT_Full);
-                phylink_set(mask, 1000baseX_Full);
-        }
+        /* Half-duplex at speeds higher than 100Mbit is unsupported */
+        phylink_set(mask, 1000baseT_Full);
+        phylink_set(mask, 1000baseX_Full);
 
         if (!phy_interface_mode_is_8023z(state->interface)) {
                 /* 10M and 100M are only supported in non-802.3z mode */
diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c
index deef5a998985..9af34e03892c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/alloc.c
+++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c
@@ -337,7 +337,7 @@ void mlx4_zone_allocator_destroy(struct mlx4_zone_allocator *zone_alloc)
 static u32 __mlx4_alloc_from_zone(struct mlx4_zone_entry *zone, int count,
                                   int align, u32 skip_mask, u32 *puid)
 {
-        u32 uid;
+        u32 uid = 0;
         u32 res;
         struct mlx4_zone_allocator *zone_alloc = zone->allocator;
         struct mlx4_zone_entry *curr_node;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index ebcd2778eeb3..23f1b5b512c2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -540,8 +540,8 @@ struct slave_list {
 struct resource_allocator {
         spinlock_t alloc_lock; /* protect quotas */
         union {
-                int res_reserved;
-                int res_port_rsvd[MLX4_MAX_PORTS];
+                unsigned int res_reserved;
+                unsigned int res_port_rsvd[MLX4_MAX_PORTS];
         };
         union {
                 int res_free;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
index 2e84f10f59ba..1a11bc0e1612 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
@@ -363,6 +363,7 @@ int mlx4_mr_hw_write_mpt(struct mlx4_dev *dev, struct mlx4_mr *mmr,
                         container_of((void *)mpt_entry, struct mlx4_cmd_mailbox,
                                      buf);
 
+                (*mpt_entry)->lkey = 0;
                 err = mlx4_SW2HW_MPT(dev, mailbox, key);
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index d7fbd5b6ac95..118324802926 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -569,6 +569,7 @@ struct mlx5e_rq {
 
         unsigned long          state;
         int                    ix;
+        unsigned int           hw_mtu;
 
         struct net_dim         dim; /* Dynamic Interrupt Moderation */
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
index 023dc4bccd28..4a37713023be 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
@@ -88,10 +88,8 @@ int mlx5e_port_linkspeed(struct mlx5_core_dev *mdev, u32 *speed)
 
         eth_proto_oper = MLX5_GET(ptys_reg, out, eth_proto_oper);
         *speed = mlx5e_port_ptys2speed(eth_proto_oper);
-        if (!(*speed)) {
-                mlx5_core_warn(mdev, "cannot get port speed\n");
+        if (!(*speed))
                 err = -EINVAL;
-        }
 
         return err;
 }
@@ -258,7 +256,7 @@ static int mlx5e_fec_admin_field(u32 *pplm,
         case 40000:
                 if (!write)
                         *fec_policy = MLX5_GET(pplm_reg, pplm,
-                                               fec_override_cap_10g_40g);
+                                               fec_override_admin_10g_40g);
                 else
                         MLX5_SET(pplm_reg, pplm,
                                  fec_override_admin_10g_40g, *fec_policy);
@@ -310,7 +308,7 @@ static int mlx5e_get_fec_cap_field(u32 *pplm,
         case 10000:
         case 40000:
                 *fec_cap = MLX5_GET(pplm_reg, pplm,
-                                    fec_override_admin_10g_40g);
+                                    fec_override_cap_10g_40g);
                 break;
         case 25000:
                 *fec_cap = MLX5_GET(pplm_reg, pplm,
@@ -394,12 +392,12 @@ int mlx5e_get_fec_mode(struct mlx5_core_dev *dev, u32 *fec_mode_active,
 
 int mlx5e_set_fec_mode(struct mlx5_core_dev *dev, u8 fec_policy)
 {
+        u8 fec_policy_nofec = BIT(MLX5E_FEC_NOFEC);
         bool fec_mode_not_supp_in_speed = false;
-        u8 no_fec_policy = BIT(MLX5E_FEC_NOFEC);
         u32 out[MLX5_ST_SZ_DW(pplm_reg)] = {};
         u32 in[MLX5_ST_SZ_DW(pplm_reg)] = {};
         int sz = MLX5_ST_SZ_BYTES(pplm_reg);
-        u32 current_fec_speed;
+        u8 fec_policy_auto = 0;
         u8 fec_caps = 0;
         int err;
         int i;
@@ -415,23 +413,19 @@ int mlx5e_set_fec_mode(struct mlx5_core_dev *dev, u8 fec_policy)
         if (err)
                 return err;
 
-        err = mlx5e_port_linkspeed(dev, &current_fec_speed);
-        if (err)
-                return err;
+        MLX5_SET(pplm_reg, out, local_port, 1);
 
-        memset(in, 0, sz);
-        MLX5_SET(pplm_reg, in, local_port, 1);
-        for (i = 0; i < MLX5E_FEC_SUPPORTED_SPEEDS && !!fec_policy; i++) {
+        for (i = 0; i < MLX5E_FEC_SUPPORTED_SPEEDS; i++) {
                 mlx5e_get_fec_cap_field(out, &fec_caps, fec_supported_speeds[i]);
-                /* policy supported for link speed */
-                if (!!(fec_caps & fec_policy)) {
-                        mlx5e_fec_admin_field(in, &fec_policy, 1,
+                /* policy supported for link speed, or policy is auto */
+                if (fec_caps & fec_policy || fec_policy == fec_policy_auto) {
+                        mlx5e_fec_admin_field(out, &fec_policy, 1,
                                               fec_supported_speeds[i]);
                 } else {
-                        if (fec_supported_speeds[i] == current_fec_speed)
-                                return -EOPNOTSUPP;
-                        mlx5e_fec_admin_field(in, &no_fec_policy, 1,
-                                              fec_supported_speeds[i]);
+                        /* turn off FEC if supported. Else, leave it the same */
+                        if (fec_caps & fec_policy_nofec)
+                                mlx5e_fec_admin_field(out, &fec_policy_nofec, 1,
+                                                      fec_supported_speeds[i]);
                         fec_mode_not_supp_in_speed = true;
                 }
         }
@@ -441,5 +435,5 @@ int mlx5e_set_fec_mode(struct mlx5_core_dev *dev, u8 fec_policy)
                               "FEC policy 0x%x is not supported for some speeds",
                               fec_policy);
 
-        return mlx5_core_access_reg(dev, in, sz, out, sz, MLX5_REG_PPLM, 0, 1);
+        return mlx5_core_access_reg(dev, out, sz, out, sz, MLX5_REG_PPLM, 0, 1);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
index c047da8752da..eac245a93f91 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
@@ -130,8 +130,10 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
         int err;
 
         err = mlx5e_port_linkspeed(priv->mdev, &speed);
-        if (err)
+        if (err) {
+                mlx5_core_warn(priv->mdev, "cannot get port speed\n");
                 return 0;
+        }
 
         xoff = (301 + 216 * priv->dcbx.cable_len / 100) * speed / 1000 + 272 * mtu / 100;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 3e770abfd802..25c1c4f96841 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -843,8 +843,7 @@ static int mlx5e_get_link_ksettings(struct net_device *netdev,
         ethtool_link_ksettings_add_link_mode(link_ksettings, supported,
                                              Autoneg);
 
-        err = get_fec_supported_advertised(mdev, link_ksettings);
-        if (err)
+        if (get_fec_supported_advertised(mdev, link_ksettings))
                 netdev_dbg(netdev, "%s: FEC caps query failed: %d\n",
                            __func__, err);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 1243edbedc9e..871313d6b34d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -502,6 +502,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
         rq->channel = c;
         rq->ix      = c->ix;
         rq->mdev    = mdev;
+        rq->hw_mtu  = MLX5E_SW2HW_MTU(params, params->sw_mtu);
         rq->stats   = &c->priv->channel_stats[c->ix].rq;
 
         rq->xdp_prog = params->xdp_prog ? bpf_prog_inc(params->xdp_prog) : NULL;
@@ -1623,13 +1624,15 @@ static int mlx5e_alloc_cq_common(struct mlx5_core_dev *mdev,
         int err;
         u32 i;
 
+        err = mlx5_vector2eqn(mdev, param->eq_ix, &eqn_not_used, &irqn);
+        if (err)
+                return err;
+
         err = mlx5_cqwq_create(mdev, &param->wq, param->cqc, &cq->wq,
                                &cq->wq_ctrl);
         if (err)
                 return err;
 
-        mlx5_vector2eqn(mdev, param->eq_ix, &eqn_not_used, &irqn);
-
         mcq->cqe_sz     = 64;
         mcq->set_ci_db  = cq->wq_ctrl.db.db;
         mcq->arm_db     = cq->wq_ctrl.db.db + 1;
@@ -1687,6 +1690,10 @@ static int mlx5e_create_cq(struct mlx5e_cq *cq, struct mlx5e_cq_param *param)
         int eqn;
         int err;
 
+        err = mlx5_vector2eqn(mdev, param->eq_ix, &eqn, &irqn_not_used);
+        if (err)
+                return err;
+
         inlen = MLX5_ST_SZ_BYTES(create_cq_in) +
                 sizeof(u64) * cq->wq_ctrl.buf.npages;
         in = kvzalloc(inlen, GFP_KERNEL);
@@ -1700,8 +1707,6 @@ static int mlx5e_create_cq(struct mlx5e_cq *cq, struct mlx5e_cq_param *param)
         mlx5_fill_page_frag_array(&cq->wq_ctrl.buf,
                                   (__be64 *)MLX5_ADDR_OF(create_cq_in, in, pas));
 
-        mlx5_vector2eqn(mdev, param->eq_ix, &eqn, &irqn_not_used);
-
         MLX5_SET(cqc,   cqc, cq_period_mode, param->cq_period_mode);
         MLX5_SET(cqc,   cqc, c_eqn,         eqn);
         MLX5_SET(cqc,   cqc, uar_page,      mdev->priv.uar->index);
@@ -1921,6 +1926,10 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
         int err;
         int eqn;
 
+        err = mlx5_vector2eqn(priv->mdev, ix, &eqn, &irq);
+        if (err)
+                return err;
+
         c = kvzalloc_node(sizeof(*c), GFP_KERNEL, cpu_to_node(cpu));
         if (!c)
                 return -ENOMEM;
@@ -1937,7 +1946,6 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
         c->xdp      = !!params->xdp_prog;
         c->stats    = &priv->channel_stats[ix].ch;
 
-        mlx5_vector2eqn(priv->mdev, ix, &eqn, &irq);
         c->irq_desc = irq_to_desc(irq);
 
         netif_napi_add(netdev, &c->napi, mlx5e_napi_poll, 64);
@@ -3574,6 +3582,7 @@ static int set_feature_cvlan_filter(struct net_device *netdev, bool enable)
         return 0;
 }
 
+#ifdef CONFIG_MLX5_ESWITCH
 static int set_feature_tc_num_filters(struct net_device *netdev, bool enable)
 {
         struct mlx5e_priv *priv = netdev_priv(netdev);
@@ -3586,6 +3595,7 @@ static int set_feature_tc_num_filters(struct net_device *netdev, bool enable)
 
         return 0;
 }
+#endif
 
 static int set_feature_rx_all(struct net_device *netdev, bool enable)
 {
@@ -3684,7 +3694,9 @@ static int mlx5e_set_features(struct net_device *netdev,
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_LRO, set_feature_lro);
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_VLAN_CTAG_FILTER,
                                     set_feature_cvlan_filter);
+#ifdef CONFIG_MLX5_ESWITCH
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_TC, set_feature_tc_num_filters);
+#endif
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_RXALL, set_feature_rx_all);
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_RXFCS, set_feature_rx_fcs);
         err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_VLAN_CTAG_RX, set_feature_rx_vlan);
@@ -3755,10 +3767,11 @@ int mlx5e_change_mtu(struct net_device *netdev, int new_mtu,
         }
 
         if (params->rq_wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ) {
+                bool is_linear = mlx5e_rx_mpwqe_is_linear_skb(priv->mdev, &new_channels.params);
                 u8 ppw_old = mlx5e_mpwqe_log_pkts_per_wqe(params);
                 u8 ppw_new = mlx5e_mpwqe_log_pkts_per_wqe(&new_channels.params);
 
-                reset = reset && (ppw_old != ppw_new);
+                reset = reset && (is_linear || (ppw_old != ppw_new));
         }
 
         if (!reset) {
@@ -4678,7 +4691,9 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
             FT_CAP(modify_root) &&
             FT_CAP(identified_miss_table_mode) &&
             FT_CAP(flow_table_modify)) {
+#ifdef CONFIG_MLX5_ESWITCH
                 netdev->hw_features      |= NETIF_F_HW_TC;
+#endif
 #ifdef CONFIG_MLX5_EN_ARFS
                 netdev->hw_features      |= NETIF_F_NTUPLE;
 #endif
@@ -5004,11 +5019,21 @@ err_free_netdev:
 int mlx5e_attach_netdev(struct mlx5e_priv *priv)
 {
         const struct mlx5e_profile *profile;
+        int max_nch;
         int err;
 
         profile = priv->profile;
         clear_bit(MLX5E_STATE_DESTROYING, &priv->state);
 
+        /* max number of channels may have changed */
+        max_nch = mlx5e_get_max_num_channels(priv->mdev);
+        if (priv->channels.params.num_channels > max_nch) {
+                mlx5_core_warn(priv->mdev, "MLX5E: Reducing number of channels to %d\n", max_nch);
+                priv->channels.params.num_channels = max_nch;
+                mlx5e_build_default_indir_rqt(priv->channels.params.indirection_rqt,
+                                              MLX5E_INDIR_RQT_SIZE, max_nch);
+        }
+
         err = profile->init_tx(priv);
         if (err)
                 goto out;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 79638dcbae78..16985ca3248d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -1104,6 +1104,12 @@ mlx5e_skb_from_cqe_mpwrq_linear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wi,
         u32 frag_size;
         bool consumed;
 
+        /* Check packet size. Note LRO doesn't use linear SKB */
+        if (unlikely(cqe_bcnt > rq->hw_mtu)) {
+                rq->stats->oversize_pkts_sw_drop++;
+                return NULL;
+        }
+
         va             = page_address(di->page) + head_offset;
         data           = va + rx_headroom;
         frag_size      = MLX5_SKB_FRAG_SZ(rx_headroom + cqe_bcnt32);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
index 35ded91203f5..4382ef85488c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
@@ -98,18 +98,17 @@ static int mlx5e_test_link_speed(struct mlx5e_priv *priv)
         return 1;
 }
 
-#ifdef CONFIG_INET
-/* loopback test */
-#define MLX5E_TEST_PKT_SIZE (MLX5E_RX_MAX_HEAD - NET_IP_ALIGN)
-static const char mlx5e_test_text[ETH_GSTRING_LEN] = "MLX5E SELF TEST";
-#define MLX5E_TEST_MAGIC 0x5AEED15C001ULL
-
 struct mlx5ehdr {
         __be32 version;
         __be64 magic;
-        char   text[ETH_GSTRING_LEN];
 };
 
+#ifdef CONFIG_INET
+/* loopback test */
+#define MLX5E_TEST_PKT_SIZE (sizeof(struct ethhdr) + sizeof(struct iphdr) +\
+                             sizeof(struct udphdr) + sizeof(struct mlx5ehdr))
+#define MLX5E_TEST_MAGIC 0x5AEED15C001ULL
+
 static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
 {
         struct sk_buff *skb = NULL;
@@ -117,10 +116,7 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
         struct ethhdr *ethh;
         struct udphdr *udph;
         struct iphdr *iph;
-        int datalen, iplen;
-
-        datalen = MLX5E_TEST_PKT_SIZE -
-                  (sizeof(*ethh) + sizeof(*iph) + sizeof(*udph));
+        int    iplen;
 
         skb = netdev_alloc_skb(priv->netdev, MLX5E_TEST_PKT_SIZE);
         if (!skb) {
@@ -149,7 +145,7 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
         /* Fill UDP header */
         udph->source = htons(9);
         udph->dest = htons(9); /* Discard Protocol */
-        udph->len = htons(datalen + sizeof(struct udphdr));
+        udph->len = htons(sizeof(struct mlx5ehdr) + sizeof(struct udphdr));
         udph->check = 0;
 
         /* Fill IP header */
@@ -157,7 +153,8 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
         iph->ttl = 32;
         iph->version = 4;
         iph->protocol = IPPROTO_UDP;
-        iplen = sizeof(struct iphdr) + sizeof(struct udphdr) + datalen;
+        iplen = sizeof(struct iphdr) + sizeof(struct udphdr) +
+                sizeof(struct mlx5ehdr);
         iph->tot_len = htons(iplen);
         iph->frag_off = 0;
         iph->saddr = 0;
@@ -170,9 +167,6 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
         mlxh = skb_put(skb, sizeof(*mlxh));
         mlxh->version = 0;
         mlxh->magic = cpu_to_be64(MLX5E_TEST_MAGIC);
-        strlcpy(mlxh->text, mlx5e_test_text, sizeof(mlxh->text));
-        datalen -= sizeof(*mlxh);
-        skb_put_zero(skb, datalen);
 
         skb->csum = 0;
         skb->ip_summed = CHECKSUM_PARTIAL;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
index 1e55b9c27ffc..3e99d0728b2f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
@@ -83,6 +83,7 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_wqe_err) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_filler_cqes) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_filler_strides) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_oversize_pkts_sw_drop) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_buff_alloc_err) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_cqe_compress_blks) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_cqe_compress_pkts) },
@@ -161,6 +162,7 @@ void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
                 s->rx_wqe_err   += rq_stats->wqe_err;
                 s->rx_mpwqe_filler_cqes    += rq_stats->mpwqe_filler_cqes;
                 s->rx_mpwqe_filler_strides += rq_stats->mpwqe_filler_strides;
+                s->rx_oversize_pkts_sw_drop += rq_stats->oversize_pkts_sw_drop;
                 s->rx_buff_alloc_err += rq_stats->buff_alloc_err;
                 s->rx_cqe_compress_blks += rq_stats->cqe_compress_blks;
                 s->rx_cqe_compress_pkts += rq_stats->cqe_compress_pkts;
@@ -1189,6 +1191,7 @@ static const struct counter_desc rq_stats_desc[] = {
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, wqe_err) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_filler_cqes) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_filler_strides) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, oversize_pkts_sw_drop) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, buff_alloc_err) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, cqe_compress_blks) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, cqe_compress_pkts) },
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 77f74ce11280..3f8e870ef4c9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -96,6 +96,7 @@ struct mlx5e_sw_stats {
         u64 rx_wqe_err;
         u64 rx_mpwqe_filler_cqes;
         u64 rx_mpwqe_filler_strides;
+        u64 rx_oversize_pkts_sw_drop;
         u64 rx_buff_alloc_err;
         u64 rx_cqe_compress_blks;
         u64 rx_cqe_compress_pkts;
@@ -193,6 +194,7 @@ struct mlx5e_rq_stats {
         u64 wqe_err;
         u64 mpwqe_filler_cqes;
         u64 mpwqe_filler_strides;
+        u64 oversize_pkts_sw_drop;
         u64 buff_alloc_err;
         u64 cqe_compress_blks;
         u64 cqe_compress_pkts;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 608025ca5c04..fca6f4132c91 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1447,31 +1447,21 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
                                          inner_headers);
         }
 
-        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
-                struct flow_dissector_key_eth_addrs *key =
+        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
+                struct flow_dissector_key_basic *key =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
+                                                  FLOW_DISSECTOR_KEY_BASIC,
                                                   f->key);
-                struct flow_dissector_key_eth_addrs *mask =
+                struct flow_dissector_key_basic *mask =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
+                                                  FLOW_DISSECTOR_KEY_BASIC,
                                                   f->mask);
+                MLX5_SET(fte_match_set_lyr_2_4, headers_c, ethertype,
+                         ntohs(mask->n_proto));
+                MLX5_SET(fte_match_set_lyr_2_4, headers_v, ethertype,
+                         ntohs(key->n_proto));
 
-                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
-                                             dmac_47_16),
-                                mask->dst);
-                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
-                                             dmac_47_16),
-                                key->dst);
-
-                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
-                                             smac_47_16),
-                                mask->src);
-                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
-                                             smac_47_16),
-                                key->src);
-
-                if (!is_zero_ether_addr(mask->src) || !is_zero_ether_addr(mask->dst))
+                if (mask->n_proto)
                         *match_level = MLX5_MATCH_L2;
         }
 
@@ -1505,9 +1495,10 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
 
                         *match_level = MLX5_MATCH_L2;
                 }
-        } else {
+        } else if (*match_level != MLX5_MATCH_NONE) {
                 MLX5_SET(fte_match_set_lyr_2_4, headers_c, svlan_tag, 1);
                 MLX5_SET(fte_match_set_lyr_2_4, headers_c, cvlan_tag, 1);
+                *match_level = MLX5_MATCH_L2;
         }
 
         if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CVLAN)) {
@@ -1545,21 +1536,31 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
                 }
         }
 
-        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
-                struct flow_dissector_key_basic *key =
+        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
+                struct flow_dissector_key_eth_addrs *key =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_BASIC,
+                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
                                                   f->key);
-                struct flow_dissector_key_basic *mask =
+                struct flow_dissector_key_eth_addrs *mask =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_BASIC,
+                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
                                                   f->mask);
-                MLX5_SET(fte_match_set_lyr_2_4, headers_c, ethertype,
-                         ntohs(mask->n_proto));
-                MLX5_SET(fte_match_set_lyr_2_4, headers_v, ethertype,
-                         ntohs(key->n_proto));
 
-                if (mask->n_proto)
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
+                                             dmac_47_16),
+                                mask->dst);
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
+                                             dmac_47_16),
+                                key->dst);
+
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
+                                             smac_47_16),
+                                mask->src);
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
+                                             smac_47_16),
+                                key->src);
+
+                if (!is_zero_ether_addr(mask->src) || !is_zero_ether_addr(mask->dst))
                         *match_level = MLX5_MATCH_L2;
         }
 
@@ -1586,10 +1587,10 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
 
                         /* the HW doesn't need L3 inline to match on frag=no */
                         if (!(key->flags & FLOW_DIS_IS_FRAGMENT))
-                                *match_level = MLX5_INLINE_MODE_L2;
+                                *match_level = MLX5_MATCH_L2;
         /* ***  L2 attributes parsing up to here *** */
                         else
-                                *match_level = MLX5_INLINE_MODE_IP;
+                                *match_level = MLX5_MATCH_L3;
                 }
         }
 
@@ -2979,7 +2980,7 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
         if (!actions_match_supported(priv, exts, parse_attr, flow, extack))
                 return -EOPNOTSUPP;
 
-        if (attr->out_count > 1 && !mlx5_esw_has_fwd_fdb(priv->mdev)) {
+        if (attr->mirror_count > 0 && !mlx5_esw_has_fwd_fdb(priv->mdev)) {
                 NL_SET_ERR_MSG_MOD(extack,
                                    "current firmware doesn't support split rule for port mirroring");
                 netdev_warn_once(priv->netdev, "current firmware doesn't support split rule for port mirroring\n");
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
index 515e3d6de051..5a22c5874f3b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
@@ -83,8 +83,14 @@ struct mlx5_fpga_ipsec_rule {
 };
 
 static const struct rhashtable_params rhash_sa = {
-        .key_len = FIELD_SIZEOF(struct mlx5_fpga_ipsec_sa_ctx, hw_sa),
-        .key_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hw_sa),
+        /* Keep out "cmd" field from the key as it's
+         * value is not constant during the lifetime
+         * of the key object.
+         */
+        .key_len = FIELD_SIZEOF(struct mlx5_fpga_ipsec_sa_ctx, hw_sa) -
+                   FIELD_SIZEOF(struct mlx5_ifc_fpga_ipsec_sa_v1, cmd),
+        .key_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hw_sa) +
+                      FIELD_SIZEOF(struct mlx5_ifc_fpga_ipsec_sa_v1, cmd),
         .head_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hash),
         .automatic_shrinking = true,
         .min_size = 1,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index b59953daf8b4..11dabd62e2c7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -560,9 +560,9 @@ static int mlx5i_close(struct net_device *netdev)
 
         netif_carrier_off(epriv->netdev);
         mlx5_fs_remove_rx_underlay_qpn(mdev, ipriv->qp.qpn);
-        mlx5i_uninit_underlay_qp(epriv);
         mlx5e_deactivate_priv_channels(epriv);
         mlx5e_close_channels(&epriv->channels);
+        mlx5i_uninit_underlay_qp(epriv);
 unlock:
         mutex_unlock(&epriv->state_lock);
         return 0;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index 8e8fa823d611..69966dfc6e3d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -191,7 +191,7 @@ qed_dcbx_dp_protocol(struct qed_hwfn *p_hwfn, struct qed_dcbx_results *p_data)
 static void
 qed_dcbx_set_params(struct qed_dcbx_results *p_data,
                     struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
-                    bool enable, u8 prio, u8 tc,
+                    bool app_tlv, bool enable, u8 prio, u8 tc,
                     enum dcbx_protocol_type type,
                     enum qed_pci_personality personality)
 {
@@ -210,7 +210,7 @@ qed_dcbx_set_params(struct qed_dcbx_results *p_data,
                 p_data->arr[type].dont_add_vlan0 = true;
 
         /* QM reconf data */
-        if (p_hwfn->hw_info.personality == personality)
+        if (app_tlv && p_hwfn->hw_info.personality == personality)
                 qed_hw_info_set_offload_tc(&p_hwfn->hw_info, tc);
 
         /* Configure dcbx vlan priority in doorbell block for roce EDPM */
@@ -225,7 +225,7 @@ qed_dcbx_set_params(struct qed_dcbx_results *p_data,
 static void
 qed_dcbx_update_app_info(struct qed_dcbx_results *p_data,
                          struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
-                         bool enable, u8 prio, u8 tc,
+                         bool app_tlv, bool enable, u8 prio, u8 tc,
                          enum dcbx_protocol_type type)
 {
         enum qed_pci_personality personality;
@@ -240,7 +240,7 @@ qed_dcbx_update_app_info(struct qed_dcbx_results *p_data,
 
                 personality = qed_dcbx_app_update[i].personality;
 
-                qed_dcbx_set_params(p_data, p_hwfn, p_ptt, enable,
+                qed_dcbx_set_params(p_data, p_hwfn, p_ptt, app_tlv, enable,
                                     prio, tc, type, personality);
         }
 }
@@ -319,8 +319,8 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
                                 enable = true;
                         }
 
-                        qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, enable,
-                                                 priority, tc, type);
+                        qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, true,
+                                                 enable, priority, tc, type);
                 }
         }
 
@@ -341,7 +341,7 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
                         continue;
 
                 enable = (type == DCBX_PROTOCOL_ETH) ? false : !!dcbx_version;
-                qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, enable,
+                qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, false, enable,
                                          priority, tc, type);
         }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 7ceb2b97538d..88a8576ca9ce 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -185,6 +185,10 @@ void qed_resc_free(struct qed_dev *cdev)
                         qed_iscsi_free(p_hwfn);
                         qed_ooo_free(p_hwfn);
                 }
+
+                if (QED_IS_RDMA_PERSONALITY(p_hwfn))
+                        qed_rdma_info_free(p_hwfn);
+
                 qed_iov_free(p_hwfn);
                 qed_l2_free(p_hwfn);
                 qed_dmae_info_free(p_hwfn);
@@ -481,8 +485,16 @@ static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn,
         struct qed_qm_info *qm_info = &p_hwfn->qm_info;
 
         /* Can't have multiple flags set here */
-        if (bitmap_weight((unsigned long *)&pq_flags, sizeof(pq_flags)) > 1)
+        if (bitmap_weight((unsigned long *)&pq_flags,
+                          sizeof(pq_flags) * BITS_PER_BYTE) > 1) {
+                DP_ERR(p_hwfn, "requested multiple pq flags 0x%x\n", pq_flags);
+                goto err;
+        }
+
+        if (!(qed_get_pq_flags(p_hwfn) & pq_flags)) {
+                DP_ERR(p_hwfn, "pq flag 0x%x is not set\n", pq_flags);
                 goto err;
+        }
 
         switch (pq_flags) {
         case PQ_FLAGS_RLS:
@@ -506,8 +518,7 @@ static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn,
         }
 
 err:
-        DP_ERR(p_hwfn, "BAD pq flags %d\n", pq_flags);
-        return NULL;
+        return &qm_info->start_pq;
 }
 
 /* save pq index in qm info */
@@ -531,20 +542,32 @@ u16 qed_get_cm_pq_idx_mcos(struct qed_hwfn *p_hwfn, u8 tc)
 {
         u8 max_tc = qed_init_qm_get_num_tcs(p_hwfn);
 
+        if (max_tc == 0) {
+                DP_ERR(p_hwfn, "pq with flag 0x%lx do not exist\n",
+                       PQ_FLAGS_MCOS);
+                return p_hwfn->qm_info.start_pq;
+        }
+
         if (tc > max_tc)
                 DP_ERR(p_hwfn, "tc %d must be smaller than %d\n", tc, max_tc);
 
-        return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_MCOS) + tc;
+        return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_MCOS) + (tc % max_tc);
 }
 
 u16 qed_get_cm_pq_idx_vf(struct qed_hwfn *p_hwfn, u16 vf)
 {
         u16 max_vf = qed_init_qm_get_num_vfs(p_hwfn);
 
+        if (max_vf == 0) {
+                DP_ERR(p_hwfn, "pq with flag 0x%lx do not exist\n",
+                       PQ_FLAGS_VFS);
+                return p_hwfn->qm_info.start_pq;
+        }
+
         if (vf > max_vf)
                 DP_ERR(p_hwfn, "vf %d must be smaller than %d\n", vf, max_vf);
 
-        return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_VFS) + vf;
+        return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_VFS) + (vf % max_vf);
 }
 
 u16 qed_get_cm_pq_idx_ofld_mtc(struct qed_hwfn *p_hwfn, u8 tc)
@@ -1081,6 +1104,12 @@ int qed_resc_alloc(struct qed_dev *cdev)
                                 goto alloc_err;
                 }
 
+                if (QED_IS_RDMA_PERSONALITY(p_hwfn)) {
+                        rc = qed_rdma_info_alloc(p_hwfn);
+                        if (rc)
+                                goto alloc_err;
+                }
+
                 /* DMA info initialization */
                 rc = qed_dmae_info_alloc(p_hwfn);
                 if (rc)
@@ -2102,11 +2131,8 @@ int qed_hw_start_fastpath(struct qed_hwfn *p_hwfn)
         if (!p_ptt)
                 return -EAGAIN;
 
-        /* If roce info is allocated it means roce is initialized and should
-         * be enabled in searcher.
-         */
         if (p_hwfn->p_rdma_info &&
-            p_hwfn->b_rdma_enabled_in_prs)
+            p_hwfn->p_rdma_info->active && p_hwfn->b_rdma_enabled_in_prs)
                 qed_wr(p_hwfn, p_ptt, p_hwfn->rdma_prs_search_reg, 0x1);
 
         /* Re-open incoming traffic */
diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
index 0f0aba793352..b22f464ea3fa 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
@@ -992,6 +992,8 @@ static int qed_int_attentions(struct qed_hwfn *p_hwfn)
          */
         do {
                 index = p_sb_attn->sb_index;
+                /* finish reading index before the loop condition */
+                dma_rmb();
                 attn_bits = le32_to_cpu(p_sb_attn->atten_bits);
                 attn_acks = le32_to_cpu(p_sb_attn->atten_ack);
         } while (index != p_sb_attn->sb_index);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 35fd0db6a677..fff7f04d4525 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -1782,9 +1782,9 @@ static int qed_drain(struct qed_dev *cdev)
                         return -EBUSY;
                 }
                 rc = qed_mcp_drain(hwfn, ptt);
+                qed_ptt_release(hwfn, ptt);
                 if (rc)
                         return rc;
-                qed_ptt_release(hwfn, ptt);
         }
 
         return 0;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
index 62113438c880..7873d6dfd91f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
@@ -140,22 +140,34 @@ static u32 qed_rdma_get_sb_id(void *p_hwfn, u32 rel_sb_id)
         return FEAT_NUM((struct qed_hwfn *)p_hwfn, QED_PF_L2_QUE) + rel_sb_id;
 }
 
-static int qed_rdma_alloc(struct qed_hwfn *p_hwfn,
-                          struct qed_ptt *p_ptt,
-                          struct qed_rdma_start_in_params *params)
+int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn)
 {
         struct qed_rdma_info *p_rdma_info;
-        u32 num_cons, num_tasks;
-        int rc = -ENOMEM;
 
-        DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Allocating RDMA\n");
-
-        /* Allocate a struct with current pf rdma info */
         p_rdma_info = kzalloc(sizeof(*p_rdma_info), GFP_KERNEL);
         if (!p_rdma_info)
-                return rc;
+                return -ENOMEM;
+
+        spin_lock_init(&p_rdma_info->lock);
 
         p_hwfn->p_rdma_info = p_rdma_info;
+        return 0;
+}
+
+void qed_rdma_info_free(struct qed_hwfn *p_hwfn)
+{
+        kfree(p_hwfn->p_rdma_info);
+        p_hwfn->p_rdma_info = NULL;
+}
+
+static int qed_rdma_alloc(struct qed_hwfn *p_hwfn)
+{
+        struct qed_rdma_info *p_rdma_info = p_hwfn->p_rdma_info;
+        u32 num_cons, num_tasks;
+        int rc = -ENOMEM;
+
+        DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Allocating RDMA\n");
+
         if (QED_IS_IWARP_PERSONALITY(p_hwfn))
                 p_rdma_info->proto = PROTOCOLID_IWARP;
         else
@@ -183,7 +195,7 @@ static int qed_rdma_alloc(struct qed_hwfn *p_hwfn,
         /* Allocate a struct with device params and fill it */
         p_rdma_info->dev = kzalloc(sizeof(*p_rdma_info->dev), GFP_KERNEL);
         if (!p_rdma_info->dev)
-                goto free_rdma_info;
+                return rc;
 
         /* Allocate a struct with port params and fill it */
         p_rdma_info->port = kzalloc(sizeof(*p_rdma_info->port), GFP_KERNEL);
@@ -298,8 +310,6 @@ free_rdma_port:
         kfree(p_rdma_info->port);
 free_rdma_dev:
         kfree(p_rdma_info->dev);
-free_rdma_info:
-        kfree(p_rdma_info);
 
         return rc;
 }
@@ -370,8 +380,6 @@ static void qed_rdma_resc_free(struct qed_hwfn *p_hwfn)
 
         kfree(p_rdma_info->port);
         kfree(p_rdma_info->dev);
-
-        kfree(p_rdma_info);
 }
 
 static void qed_rdma_free_tid(void *rdma_cxt, u32 itid)
@@ -679,8 +687,6 @@ static int qed_rdma_setup(struct qed_hwfn *p_hwfn,
 
         DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "RDMA setup\n");
 
-        spin_lock_init(&p_hwfn->p_rdma_info->lock);
-
         qed_rdma_init_devinfo(p_hwfn, params);
         qed_rdma_init_port(p_hwfn);
         qed_rdma_init_events(p_hwfn, params);
@@ -727,7 +733,7 @@ static int qed_rdma_stop(void *rdma_cxt)
         /* Disable RoCE search */
         qed_wr(p_hwfn, p_ptt, p_hwfn->rdma_prs_search_reg, 0);
         p_hwfn->b_rdma_enabled_in_prs = false;
-
+        p_hwfn->p_rdma_info->active = 0;
         qed_wr(p_hwfn, p_ptt, PRS_REG_ROCE_DEST_QP_MAX_PF, 0);
 
         ll2_ethertype_en = qed_rd(p_hwfn, p_ptt, PRS_REG_LIGHT_L2_ETHERTYPE_EN);
@@ -1236,7 +1242,8 @@ qed_rdma_create_qp(void *rdma_cxt,
         u8 max_stats_queues;
         int rc;
 
-        if (!rdma_cxt || !in_params || !out_params || !p_hwfn->p_rdma_info) {
+        if (!rdma_cxt || !in_params || !out_params ||
+            !p_hwfn->p_rdma_info->active) {
                 DP_ERR(p_hwfn->cdev,
                        "qed roce create qp failed due to NULL entry (rdma_cxt=%p, in=%p, out=%p, roce_info=?\n",
                        rdma_cxt, in_params, out_params);
@@ -1802,8 +1809,8 @@ bool qed_rdma_allocated_qps(struct qed_hwfn *p_hwfn)
 {
         bool result;
 
-        /* if rdma info has not been allocated, naturally there are no qps */
-        if (!p_hwfn->p_rdma_info)
+        /* if rdma wasn't activated yet, naturally there are no qps */
+        if (!p_hwfn->p_rdma_info->active)
                 return false;
 
         spin_lock_bh(&p_hwfn->p_rdma_info->lock);
@@ -1849,7 +1856,7 @@ static int qed_rdma_start(void *rdma_cxt,
         if (!p_ptt)
                 goto err;
 
-        rc = qed_rdma_alloc(p_hwfn, p_ptt, params);
+        rc = qed_rdma_alloc(p_hwfn);
         if (rc)
                 goto err1;
 
@@ -1858,6 +1865,7 @@ static int qed_rdma_start(void *rdma_cxt,
                 goto err2;
 
         qed_ptt_release(p_hwfn, p_ptt);
+        p_hwfn->p_rdma_info->active = 1;
 
         return rc;
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.h b/drivers/net/ethernet/qlogic/qed/qed_rdma.h
index 6f722ee8ee94..3689fe3e5935 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.h
@@ -102,6 +102,7 @@ struct qed_rdma_info {
         u16 max_queue_zones;
         enum protocol_type proto;
         struct qed_iwarp_info iwarp;
+        u8 active:1;
 };
 
 struct qed_rdma_qp {
@@ -176,10 +177,14 @@ struct qed_rdma_qp {
 #if IS_ENABLED(CONFIG_QED_RDMA)
 void qed_rdma_dpm_bar(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt);
 void qed_rdma_dpm_conf(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt);
+int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn);
+void qed_rdma_info_free(struct qed_hwfn *p_hwfn);
 #else
 static inline void qed_rdma_dpm_conf(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) {}
 static inline void qed_rdma_dpm_bar(struct qed_hwfn *p_hwfn,
                                     struct qed_ptt *p_ptt) {}
+static inline int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn) {return -EINVAL;}
+static inline void qed_rdma_info_free(struct qed_hwfn *p_hwfn) {}
 #endif
 
 int
diff --git a/drivers/net/phy/mdio-gpio.c b/drivers/net/phy/mdio-gpio.c
index 33265747bf39..0fbcedcdf6e2 100644
--- a/drivers/net/phy/mdio-gpio.c
+++ b/drivers/net/phy/mdio-gpio.c
@@ -63,7 +63,7 @@ static void mdio_dir(struct mdiobb_ctrl *ctrl, int dir)
                  * assume the pin serves as pull-up. If direction is
                  * output, the default value is high.
                  */
-                gpiod_set_value(bitbang->mdo, 1);
+                gpiod_set_value_cansleep(bitbang->mdo, 1);
                 return;
         }
 
@@ -78,7 +78,7 @@ static int mdio_get(struct mdiobb_ctrl *ctrl)
         struct mdio_gpio_info *bitbang =
                 container_of(ctrl, struct mdio_gpio_info, ctrl);
 
-        return gpiod_get_value(bitbang->mdio);
+        return gpiod_get_value_cansleep(bitbang->mdio);
 }
 
 static void mdio_set(struct mdiobb_ctrl *ctrl, int what)
@@ -87,9 +87,9 @@ static void mdio_set(struct mdiobb_ctrl *ctrl, int what)
                 container_of(ctrl, struct mdio_gpio_info, ctrl);
 
         if (bitbang->mdo)
-                gpiod_set_value(bitbang->mdo, what);
+                gpiod_set_value_cansleep(bitbang->mdo, what);
         else
-                gpiod_set_value(bitbang->mdio, what);
+                gpiod_set_value_cansleep(bitbang->mdio, what);
 }
 
 static void mdc_set(struct mdiobb_ctrl *ctrl, int what)
@@ -97,7 +97,7 @@ static void mdc_set(struct mdiobb_ctrl *ctrl, int what)
         struct mdio_gpio_info *bitbang =
                 container_of(ctrl, struct mdio_gpio_info, ctrl);
 
-        gpiod_set_value(bitbang->mdc, what);
+        gpiod_set_value_cansleep(bitbang->mdc, what);
 }
 
 static const struct mdiobb_ops mdio_gpio_ops = {
diff --git a/drivers/net/phy/mscc.c b/drivers/net/phy/mscc.c
index a2e59f4f6f01..7cae17517744 100644
--- a/drivers/net/phy/mscc.c
+++ b/drivers/net/phy/mscc.c
@@ -810,17 +810,13 @@ static int vsc85xx_default_config(struct phy_device *phydev)
 
         phydev->mdix_ctrl = ETH_TP_MDI_AUTO;
         mutex_lock(&phydev->lock);
-        rc = phy_select_page(phydev, MSCC_PHY_PAGE_EXTENDED_2);
-        if (rc < 0)
-                goto out_unlock;
 
-        reg_val = phy_read(phydev, MSCC_PHY_RGMII_CNTL);
-        reg_val &= ~(RGMII_RX_CLK_DELAY_MASK);
-        reg_val |= (RGMII_RX_CLK_DELAY_1_1_NS << RGMII_RX_CLK_DELAY_POS);
-        phy_write(phydev, MSCC_PHY_RGMII_CNTL, reg_val);
+        reg_val = RGMII_RX_CLK_DELAY_1_1_NS << RGMII_RX_CLK_DELAY_POS;
+
+        rc = phy_modify_paged(phydev, MSCC_PHY_PAGE_EXTENDED_2,
+                              MSCC_PHY_RGMII_CNTL, RGMII_RX_CLK_DELAY_MASK,
+                              reg_val);
 
-out_unlock:
-        rc = phy_restore_page(phydev, rc, rc > 0 ? 0 : rc);
         mutex_unlock(&phydev->lock);
 
         return rc;
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index db633ae9f784..364f514d56d8 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -985,8 +985,6 @@ static void team_port_disable(struct team *team,
         team->en_port_count--;
         team_queue_override_port_del(team, port);
         team_adjust_ops(team);
-        team_notify_peers(team);
-        team_mcast_rejoin(team);
         team_lower_state_changed(port);
 }
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 060135ceaf0e..e244f5d7512a 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1536,6 +1536,7 @@ static void tun_rx_batched(struct tun_struct *tun, struct tun_file *tfile,
 
         if (!rx_batched || (!more && skb_queue_empty(queue))) {
                 local_bh_disable();
+                skb_record_rx_queue(skb, tfile->queue_index);
                 netif_receive_skb(skb);
                 local_bh_enable();
                 return;
@@ -1555,8 +1556,11 @@ static void tun_rx_batched(struct tun_struct *tun, struct tun_file *tfile,
                 struct sk_buff *nskb;
 
                 local_bh_disable();
-                while ((nskb = __skb_dequeue(&process_queue)))
+                while ((nskb = __skb_dequeue(&process_queue))) {
+                        skb_record_rx_queue(nskb, tfile->queue_index);
                         netif_receive_skb(nskb);
+                }
+                skb_record_rx_queue(skb, tfile->queue_index);
                 netif_receive_skb(skb);
                 local_bh_enable();
         }
@@ -2451,6 +2455,7 @@ build:
         if (!rcu_dereference(tun->steering_prog))
                 rxhash = __skb_get_hash_symmetric(skb);
 
+        skb_record_rx_queue(skb, tfile->queue_index);
         netif_receive_skb(skb);
 
         stats = get_cpu_ptr(tun->pcpu_stats);
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 3e2c041d76ac..cecfd77c9f3c 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -70,7 +70,8 @@ static const unsigned long guest_offloads[] = {
         VIRTIO_NET_F_GUEST_TSO4,
         VIRTIO_NET_F_GUEST_TSO6,
         VIRTIO_NET_F_GUEST_ECN,
-        VIRTIO_NET_F_GUEST_UFO
+        VIRTIO_NET_F_GUEST_UFO,
+        VIRTIO_NET_F_GUEST_CSUM
 };
 
 struct virtnet_stat_desc {
@@ -2334,9 +2335,6 @@ static int virtnet_clear_guest_offloads(struct virtnet_info *vi)
         if (!vi->guest_offloads)
                 return 0;
 
-        if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))
-                offloads = 1ULL << VIRTIO_NET_F_GUEST_CSUM;
-
         return virtnet_set_guest_offloads(vi, offloads);
 }
 
@@ -2346,8 +2344,6 @@ static int virtnet_restore_guest_offloads(struct virtnet_info *vi)
 
         if (!vi->guest_offloads)
                 return 0;
-        if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))
-                offloads |= 1ULL << VIRTIO_NET_F_GUEST_CSUM;
 
         return virtnet_set_guest_offloads(vi, offloads);
 }
@@ -2365,8 +2361,9 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
             && (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_TSO4) ||
                 virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_TSO6) ||
                 virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_ECN) ||
-                virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO))) {
-                NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing LRO, disable LRO first");
+                virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO) ||
+                virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))) {
+                NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing LRO/CSUM, disable LRO/CSUM first");
                 return -EOPNOTSUPP;
         }
 
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index a1c2801ded10..7e49342bae38 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -6867,7 +6867,7 @@ static void ath10k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         u32 bitmap;
 
         if (drop) {
-                if (vif->type == NL80211_IFTYPE_STATION) {
+                if (vif && vif->type == NL80211_IFTYPE_STATION) {
                         bitmap = ~(1 << WMI_MGMT_TID);
                         list_for_each_entry(arvif, &ar->arvifs, list) {
                                 if (arvif->vdev_type == WMI_VDEV_TYPE_STA)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 1e3b5f4a4cf9..f23cb2f3d296 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1251,6 +1251,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
         struct ath_vif *avp = (void *)vif->drv_priv;
         struct ath_node *an = &avp->mcast_node;
 
+        mutex_lock(&sc->mutex);
         if (IS_ENABLED(CONFIG_ATH9K_TX99)) {
                 if (sc->cur_chan->nvifs >= 1) {
                         mutex_unlock(&sc->mutex);
@@ -1259,8 +1260,6 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
                 sc->tx99_vif = vif;
         }
 
-        mutex_lock(&sc->mutex);
-
         ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
         sc->cur_chan->nvifs++;
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 230a378c26fc..7f0a5bade70a 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -6005,7 +6005,8 @@ static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
                          * for subsequent chanspecs.
                          */
                         channel->flags = IEEE80211_CHAN_NO_HT40 |
-                                         IEEE80211_CHAN_NO_80MHZ;
+                                         IEEE80211_CHAN_NO_80MHZ |
+                                         IEEE80211_CHAN_NO_160MHZ;
                         ch.bw = BRCMU_CHAN_BW_20;
                         cfg->d11inf.encchspec(&ch);
                         chaninfo = ch.chspec;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
index e7584b842dce..eb5db94f5745 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
@@ -193,6 +193,9 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch)
                 }
                 break;
         case BRCMU_CHSPEC_D11AC_BW_160:
+                ch->bw = BRCMU_CHAN_BW_160;
+                ch->sb = brcmu_maskget16(ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK,
+                                         BRCMU_CHSPEC_D11AC_SB_SHIFT);
                 switch (ch->sb) {
                 case BRCMU_CHAN_SB_LLL:
                         ch->control_ch_num -= CH_70MHZ_APART;
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
index 2439e98431ee..7492dfb6729b 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
@@ -6,6 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -26,6 +27,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -81,7 +83,7 @@
 #define ACPI_WRDS_WIFI_DATA_SIZE        (ACPI_SAR_TABLE_SIZE + 2)
 #define ACPI_EWRD_WIFI_DATA_SIZE        ((ACPI_SAR_PROFILE_NUM - 1) * \
                                          ACPI_SAR_TABLE_SIZE + 3)
-#define ACPI_WGDS_WIFI_DATA_SIZE        18
+#define ACPI_WGDS_WIFI_DATA_SIZE        19
 #define ACPI_WRDD_WIFI_DATA_SIZE        2
 #define ACPI_SPLC_WIFI_DATA_SIZE        2
 
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
index 6b95d0e75889..2b8b50a77990 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
@@ -154,7 +154,11 @@ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,
                         const struct iwl_fw_runtime_ops *ops, void *ops_ctx,
                         struct dentry *dbgfs_dir);
 
-void iwl_fw_runtime_exit(struct iwl_fw_runtime *fwrt);
+static inline void iwl_fw_runtime_free(struct iwl_fw_runtime *fwrt)
+{
+        kfree(fwrt->dump.d3_debug_data);
+        fwrt->dump.d3_debug_data = NULL;
+}
 
 void iwl_fw_runtime_suspend(struct iwl_fw_runtime *fwrt);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index dade206d5511..2ba890445c35 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -893,7 +893,7 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
         IWL_DEBUG_RADIO(mvm, "Sending GEO_TX_POWER_LIMIT\n");
 
         BUILD_BUG_ON(ACPI_NUM_GEO_PROFILES * ACPI_WGDS_NUM_BANDS *
-                     ACPI_WGDS_TABLE_SIZE !=  ACPI_WGDS_WIFI_DATA_SIZE);
+                     ACPI_WGDS_TABLE_SIZE + 1 !=  ACPI_WGDS_WIFI_DATA_SIZE);
 
         BUILD_BUG_ON(ACPI_NUM_GEO_PROFILES > IWL_NUM_GEO_PROFILES);
 
@@ -928,6 +928,11 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm)
         return -ENOENT;
 }
 
+static int iwl_mvm_sar_get_wgds_table(struct iwl_mvm *mvm)
+{
+        return -ENOENT;
+}
+
 static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
 {
         return 0;
@@ -954,8 +959,11 @@ static int iwl_mvm_sar_init(struct iwl_mvm *mvm)
                 IWL_DEBUG_RADIO(mvm,
                                 "WRDS SAR BIOS table invalid or unavailable. (%d)\n",
                                 ret);
-                /* if not available, don't fail and don't bother with EWRD */
-                return 0;
+                /*
+                 * If not available, don't fail and don't bother with EWRD.
+                 * Return 1 to tell that we can't use WGDS either.
+                 */
+                return 1;
         }
 
         ret = iwl_mvm_sar_get_ewrd_table(mvm);
@@ -968,9 +976,13 @@ static int iwl_mvm_sar_init(struct iwl_mvm *mvm)
         /* choose profile 1 (WRDS) as default for both chains */
         ret = iwl_mvm_sar_select_profile(mvm, 1, 1);
 
-        /* if we don't have profile 0 from BIOS, just skip it */
+        /*
+         * If we don't have profile 0 from BIOS, just skip it.  This
+         * means that SAR Geo will not be enabled either, even if we
+         * have other valid profiles.
+         */
         if (ret == -ENOENT)
-                return 0;
+                return 1;
 
         return ret;
 }
@@ -1168,11 +1180,19 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
                 iwl_mvm_unref(mvm, IWL_MVM_REF_UCODE_DOWN);
 
         ret = iwl_mvm_sar_init(mvm);
-        if (ret)
-                goto error;
+        if (ret == 0) {
+                ret = iwl_mvm_sar_geo_init(mvm);
+        } else if (ret > 0 && !iwl_mvm_sar_get_wgds_table(mvm)) {
+                /*
+                 * If basic SAR is not available, we check for WGDS,
+                 * which should *not* be available either.  If it is
+                 * available, issue an error, because we can't use SAR
+                 * Geo without basic SAR.
+                 */
+                IWL_ERR(mvm, "BIOS contains WGDS but no WRDS\n");
+        }
 
-        ret = iwl_mvm_sar_geo_init(mvm);
-        if (ret)
+        if (ret < 0)
                 goto error;
 
         iwl_mvm_leds_sync(mvm);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 505b0385d800..00f831d88366 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -301,8 +301,12 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
                 goto out;
         }
 
-        if (changed)
-                *changed = (resp->status == MCC_RESP_NEW_CHAN_PROFILE);
+        if (changed) {
+                u32 status = le32_to_cpu(resp->status);
+
+                *changed = (status == MCC_RESP_NEW_CHAN_PROFILE ||
+                            status == MCC_RESP_ILLEGAL);
+        }
 
         regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
                                       __le32_to_cpu(resp->n_channels),
@@ -4444,10 +4448,6 @@ static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
         }
 
-        if (!fw_has_capa(&mvm->fw->ucode_capa,
-                         IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
-                return;
-
         /* if beacon filtering isn't on mac80211 does it anyway */
         if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
                 return;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
index 3633f27d048a..6fc5cc1f2b5b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
@@ -539,9 +539,8 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, const char *alpha2,
         }
 
         IWL_DEBUG_LAR(mvm,
-                      "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') change: %d n_chans: %d\n",
-                      status, mcc, mcc >> 8, mcc & 0xff,
-                      !!(status == MCC_RESP_NEW_CHAN_PROFILE), n_channels);
+                      "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') n_chans: %d\n",
+                      status, mcc, mcc >> 8, mcc & 0xff, n_channels);
 
 exit:
         iwl_free_resp(&cmd);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 0e2092526fae..af3fba10abc1 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -858,6 +858,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         iwl_mvm_thermal_exit(mvm);
  out_free:
         iwl_fw_flush_dump(&mvm->fwrt);
+        iwl_fw_runtime_free(&mvm->fwrt);
 
         if (iwlmvm_mod_params.init_dbg)
                 return op_mode;
@@ -910,6 +911,7 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
 
         iwl_mvm_tof_clean(mvm);
 
+        iwl_fw_runtime_free(&mvm->fwrt);
         mutex_destroy(&mvm->mutex);
         mutex_destroy(&mvm->d0i3_suspend_mutex);
 
diff --git a/drivers/net/wireless/mediatek/mt76/Kconfig b/drivers/net/wireless/mediatek/mt76/Kconfig
index 0ccbcd7e887d..c30d8f5bbf2a 100644
--- a/drivers/net/wireless/mediatek/mt76/Kconfig
+++ b/drivers/net/wireless/mediatek/mt76/Kconfig
@@ -1,6 +1,12 @@
 config MT76_CORE
         tristate
 
+config MT76_LEDS
+        bool
+        depends on MT76_CORE
+        depends on LEDS_CLASS=y || MT76_CORE=LEDS_CLASS
+        default y
+
 config MT76_USB
         tristate
         depends on MT76_CORE
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index 2a699e8b79bf..7d219ff2d480 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -345,9 +345,11 @@ int mt76_register_device(struct mt76_dev *dev, bool vht,
         mt76_check_sband(dev, NL80211_BAND_2GHZ);
         mt76_check_sband(dev, NL80211_BAND_5GHZ);
 
-        ret = mt76_led_init(dev);
-        if (ret)
-                return ret;
+        if (IS_ENABLED(CONFIG_MT76_LEDS)) {
+                ret = mt76_led_init(dev);
+                if (ret)
+                        return ret;
+        }
 
         return ieee80211_register_hw(hw);
 }
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02.h b/drivers/net/wireless/mediatek/mt76/mt76x02.h
index 47c42c607964..7806963b1905 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02.h
@@ -71,7 +71,6 @@ struct mt76x02_dev {
         struct mac_address macaddr_list[8];
 
         struct mutex phy_mutex;
-        struct mutex mutex;
 
         u8 txdone_seq;
         DECLARE_KFIFO_PTR(txstatus_fifo, struct mt76x02_tx_status);
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c
index 3824290b219d..fd125722d1fb 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_init.c
@@ -507,8 +507,10 @@ int mt76x2_register_device(struct mt76x02_dev *dev)
         mt76x2_dfs_init_detector(dev);
 
         /* init led callbacks */
-        dev->mt76.led_cdev.brightness_set = mt76x2_led_set_brightness;
-        dev->mt76.led_cdev.blink_set = mt76x2_led_set_blink;
+        if (IS_ENABLED(CONFIG_MT76_LEDS)) {
+                dev->mt76.led_cdev.brightness_set = mt76x2_led_set_brightness;
+                dev->mt76.led_cdev.blink_set = mt76x2_led_set_blink;
+        }
 
         ret = mt76_register_device(&dev->mt76, true, mt76x02_rates,
                                    ARRAY_SIZE(mt76x02_rates));
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c
index 034a06295668..3f001bd6806c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_main.c
@@ -272,9 +272,9 @@ mt76x2_set_rts_threshold(struct ieee80211_hw *hw, u32 val)
         if (val != ~0 && val > 0xffff)
                 return -EINVAL;
 
-        mutex_lock(&dev->mutex);
+        mutex_lock(&dev->mt76.mutex);
         mt76x2_mac_set_tx_protection(dev, val);
-        mutex_unlock(&dev->mutex);
+        mutex_unlock(&dev->mt76.mutex);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
index 4c2154b9e6a3..bd10165d7eec 100644
--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -285,7 +285,7 @@ static int wl1271_probe(struct sdio_func *func,
         struct resource res[2];
         mmc_pm_flag_t mmcflags;
         int ret = -ENOMEM;
-        int irq, wakeirq;
+        int irq, wakeirq, num_irqs;
         const char *chip_family;
 
         /* We are only able to handle the wlan function */
@@ -353,12 +353,17 @@ static int wl1271_probe(struct sdio_func *func,
                        irqd_get_trigger_type(irq_get_irq_data(irq));
         res[0].name = "irq";
 
-        res[1].start = wakeirq;
-        res[1].flags = IORESOURCE_IRQ |
-                       irqd_get_trigger_type(irq_get_irq_data(wakeirq));
-        res[1].name = "wakeirq";
 
-        ret = platform_device_add_resources(glue->core, res, ARRAY_SIZE(res));
+        if (wakeirq > 0) {
+                res[1].start = wakeirq;
+                res[1].flags = IORESOURCE_IRQ |
+                               irqd_get_trigger_type(irq_get_irq_data(wakeirq));
+                res[1].name = "wakeirq";
+                num_irqs = 2;
+        } else {
+                num_irqs = 1;
+        }
+        ret = platform_device_add_resources(glue->core, res, num_irqs);
         if (ret) {
                 dev_err(glue->dev, "can't add resources\n");
                 goto out_dev_put;
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 0b70c8bab045..54032c466636 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -152,6 +152,7 @@ struct nvme_fc_ctrl {
 
         bool                    ioq_live;
         bool                    assoc_active;
+        atomic_t                err_work_active;
         u64                     association_id;
 
         struct list_head        ctrl_list;      /* rport->ctrl_list */
@@ -160,6 +161,7 @@ struct nvme_fc_ctrl {
         struct blk_mq_tag_set   tag_set;
 
         struct delayed_work     connect_work;
+        struct work_struct      err_work;
 
         struct kref             ref;
         u32                     flags;
@@ -1531,6 +1533,10 @@ nvme_fc_abort_aen_ops(struct nvme_fc_ctrl *ctrl)
         struct nvme_fc_fcp_op *aen_op = ctrl->aen_ops;
         int i;
 
+        /* ensure we've initialized the ops once */
+        if (!(aen_op->flags & FCOP_FLAGS_AEN))
+                return;
+
         for (i = 0; i < NVME_NR_AEN_COMMANDS; i++, aen_op++)
                 __nvme_fc_abort_op(ctrl, aen_op);
 }
@@ -2049,7 +2055,25 @@ nvme_fc_nvme_ctrl_freed(struct nvme_ctrl *nctrl)
 static void
 nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)
 {
-        /* only proceed if in LIVE state - e.g. on first error */
+        int active;
+
+        /*
+         * if an error (io timeout, etc) while (re)connecting,
+         * it's an error on creating the new association.
+         * Start the error recovery thread if it hasn't already
+         * been started. It is expected there could be multiple
+         * ios hitting this path before things are cleaned up.
+         */
+        if (ctrl->ctrl.state == NVME_CTRL_CONNECTING) {
+                active = atomic_xchg(&ctrl->err_work_active, 1);
+                if (!active && !schedule_work(&ctrl->err_work)) {
+                        atomic_set(&ctrl->err_work_active, 0);
+                        WARN_ON(1);
+                }
+                return;
+        }
+
+        /* Otherwise, only proceed if in LIVE state - e.g. on first error */
         if (ctrl->ctrl.state != NVME_CTRL_LIVE)
                 return;
 
@@ -2814,6 +2838,7 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nctrl)
 {
         struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
 
+        cancel_work_sync(&ctrl->err_work);
         cancel_delayed_work_sync(&ctrl->connect_work);
         /*
          * kill the association on the link side.  this will block
@@ -2866,23 +2891,30 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status)
 }
 
 static void
-nvme_fc_reset_ctrl_work(struct work_struct *work)
+__nvme_fc_terminate_io(struct nvme_fc_ctrl *ctrl)
 {
-        struct nvme_fc_ctrl *ctrl =
-                container_of(work, struct nvme_fc_ctrl, ctrl.reset_work);
-        int ret;
-
-        nvme_stop_ctrl(&ctrl->ctrl);
+        nvme_stop_keep_alive(&ctrl->ctrl);
 
         /* will block will waiting for io to terminate */
         nvme_fc_delete_association(ctrl);
 
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
+        if (ctrl->ctrl.state != NVME_CTRL_CONNECTING &&
+            !nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING))
                 dev_err(ctrl->ctrl.device,
                         "NVME-FC{%d}: error_recovery: Couldn't change state "
                         "to CONNECTING\n", ctrl->cnum);
-                return;
-        }
+}
+
+static void
+nvme_fc_reset_ctrl_work(struct work_struct *work)
+{
+        struct nvme_fc_ctrl *ctrl =
+                container_of(work, struct nvme_fc_ctrl, ctrl.reset_work);
+        int ret;
+
+        __nvme_fc_terminate_io(ctrl);
+
+        nvme_stop_ctrl(&ctrl->ctrl);
 
         if (ctrl->rport->remoteport.port_state == FC_OBJSTATE_ONLINE)
                 ret = nvme_fc_create_association(ctrl);
@@ -2897,6 +2929,24 @@ nvme_fc_reset_ctrl_work(struct work_struct *work)
                         ctrl->cnum);
 }
 
+static void
+nvme_fc_connect_err_work(struct work_struct *work)
+{
+        struct nvme_fc_ctrl *ctrl =
+                        container_of(work, struct nvme_fc_ctrl, err_work);
+
+        __nvme_fc_terminate_io(ctrl);
+
+        atomic_set(&ctrl->err_work_active, 0);
+
+        /*
+         * Rescheduling the connection after recovering
+         * from the io error is left to the reconnect work
+         * item, which is what should have stalled waiting on
+         * the io that had the error that scheduled this work.
+         */
+}
+
 static const struct nvme_ctrl_ops nvme_fc_ctrl_ops = {
         .name                   = "fc",
         .module                 = THIS_MODULE,
@@ -3007,6 +3057,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
         ctrl->cnum = idx;
         ctrl->ioq_live = false;
         ctrl->assoc_active = false;
+        atomic_set(&ctrl->err_work_active, 0);
         init_waitqueue_head(&ctrl->ioabort_wait);
 
         get_device(ctrl->dev);
@@ -3014,6 +3065,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
 
         INIT_WORK(&ctrl->ctrl.reset_work, nvme_fc_reset_ctrl_work);
         INIT_DELAYED_WORK(&ctrl->connect_work, nvme_fc_connect_ctrl_work);
+        INIT_WORK(&ctrl->err_work, nvme_fc_connect_err_work);
         spin_lock_init(&ctrl->lock);
 
         /* io queue count */
@@ -3103,6 +3155,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
 fail_ctrl:
         nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_DELETING);
         cancel_work_sync(&ctrl->ctrl.reset_work);
+        cancel_work_sync(&ctrl->err_work);
         cancel_delayed_work_sync(&ctrl->connect_work);
 
         ctrl->ctrl.opts = NULL;
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 9b18ce90f907..27f67dfa649d 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -44,6 +44,7 @@ struct nvmem_cell {
         int                     bytes;
         int                     bit_offset;
         int                     nbits;
+        struct device_node      *np;
         struct nvmem_device     *nvmem;
         struct list_head        node;
 };
@@ -298,6 +299,7 @@ static void nvmem_cell_drop(struct nvmem_cell *cell)
         mutex_lock(&nvmem_mutex);
         list_del(&cell->node);
         mutex_unlock(&nvmem_mutex);
+        of_node_put(cell->np);
         kfree(cell->name);
         kfree(cell);
 }
@@ -530,6 +532,7 @@ static int nvmem_add_cells_from_of(struct nvmem_device *nvmem)
                         return -ENOMEM;
 
                 cell->nvmem = nvmem;
+                cell->np = of_node_get(child);
                 cell->offset = be32_to_cpup(addr++);
                 cell->bytes = be32_to_cpup(addr);
                 cell->name = kasprintf(GFP_KERNEL, "%pOFn", child);
@@ -960,14 +963,13 @@ out:
 
 #if IS_ENABLED(CONFIG_OF)
 static struct nvmem_cell *
-nvmem_find_cell_by_index(struct nvmem_device *nvmem, int index)
+nvmem_find_cell_by_node(struct nvmem_device *nvmem, struct device_node *np)
 {
         struct nvmem_cell *cell = NULL;
-        int i = 0;
 
         mutex_lock(&nvmem_mutex);
         list_for_each_entry(cell, &nvmem->cells, node) {
-                if (index == i++)
+                if (np == cell->np)
                         break;
         }
         mutex_unlock(&nvmem_mutex);
@@ -1011,7 +1013,7 @@ struct nvmem_cell *of_nvmem_cell_get(struct device_node *np, const char *id)
         if (IS_ERR(nvmem))
                 return ERR_CAST(nvmem);
 
-        cell = nvmem_find_cell_by_index(nvmem, index);
+        cell = nvmem_find_cell_by_node(nvmem, cell_np);
         if (!cell) {
                 __nvmem_device_put(nvmem);
                 return ERR_PTR(-ENOENT);
diff --git a/drivers/opp/ti-opp-supply.c b/drivers/opp/ti-opp-supply.c
index 9e5a9a3112c9..3f4fb4dbbe33 100644
--- a/drivers/opp/ti-opp-supply.c
+++ b/drivers/opp/ti-opp-supply.c
@@ -288,7 +288,10 @@ static int ti_opp_supply_set_opp(struct dev_pm_set_opp_data *data)
         int ret;
 
         vdd_uv = _get_optimal_vdd_voltage(dev, &opp_data,
-                                          new_supply_vbb->u_volt);
+                                          new_supply_vdd->u_volt);
+
+        if (new_supply_vdd->u_volt_min < vdd_uv)
+                new_supply_vdd->u_volt_min = vdd_uv;
 
         /* Scaling up? Scale voltage before frequency */
         if (freq > old_freq) {
diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
index f96ec68af2e5..dcbf5c857743 100644
--- a/drivers/s390/net/ism_drv.c
+++ b/drivers/s390/net/ism_drv.c
@@ -415,9 +415,9 @@ static irqreturn_t ism_handle_irq(int irq, void *data)
                         break;
 
                 clear_bit_inv(bit, bv);
+                ism->sba->dmbe_mask[bit + ISM_DMB_BIT_OFFSET] = 0;
                 barrier();
                 smcd_handle_irq(ism->smcd, bit + ISM_DMB_BIT_OFFSET);
-                ism->sba->dmbe_mask[bit + ISM_DMB_BIT_OFFSET] = 0;
         }
 
         if (ism->sba->e) {
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 20c85eed1a75..b658b9a5eb1e 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1749,7 +1749,7 @@ qla2x00_loop_reset(scsi_qla_host_t *vha)
 static void
 __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res)
 {
-        int cnt;
+        int cnt, status;
         unsigned long flags;
         srb_t *sp;
         scsi_qla_host_t *vha = qp->vha;
@@ -1799,10 +1799,16 @@ __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res)
                                         if (!sp_get(sp)) {
                                                 spin_unlock_irqrestore
                                                         (qp->qp_lock_ptr, flags);
-                                                qla2xxx_eh_abort(
+                                                status = qla2xxx_eh_abort(
                                                         GET_CMD_SP(sp));
                                                 spin_lock_irqsave
                                                         (qp->qp_lock_ptr, flags);
+                                                /*
+                                                 * Get rid of extra reference caused
+                                                 * by early exit from qla2xxx_eh_abort
+                                                 */
+                                                if (status == FAST_IO_FAIL)
+                                                        atomic_dec(&sp->ref_count);
                                         }
                                 }
                                 sp->done(sp, res);
diff --git a/drivers/scsi/ufs/ufs-hisi.c b/drivers/scsi/ufs/ufs-hisi.c
index 46df707e6f2c..452e19f8fb47 100644
--- a/drivers/scsi/ufs/ufs-hisi.c
+++ b/drivers/scsi/ufs/ufs-hisi.c
@@ -20,6 +20,7 @@
 #include "unipro.h"
 #include "ufs-hisi.h"
 #include "ufshci.h"
+#include "ufs_quirks.h"
 
 static int ufs_hisi_check_hibern8(struct ufs_hba *hba)
 {
@@ -390,6 +391,14 @@ static void ufs_hisi_set_dev_cap(struct ufs_hisi_dev_params *hisi_param)
 
 static void ufs_hisi_pwr_change_pre_change(struct ufs_hba *hba)
 {
+        if (hba->dev_quirks & UFS_DEVICE_QUIRK_HOST_VS_DEBUGSAVECONFIGTIME) {
+                pr_info("ufs flash device must set VS_DebugSaveConfigTime 0x10\n");
+                /* VS_DebugSaveConfigTime */
+                ufshcd_dme_set(hba, UIC_ARG_MIB(0xD0A0), 0x10);
+                /* sync length */
+                ufshcd_dme_set(hba, UIC_ARG_MIB(0x1556), 0x48);
+        }
+
         /* update */
         ufshcd_dme_set(hba, UIC_ARG_MIB(0x15A8), 0x1);
         /* PA_TxSkip */
diff --git a/drivers/scsi/ufs/ufs_quirks.h b/drivers/scsi/ufs/ufs_quirks.h
index 71f73d1d1ad1..5d2dfdb41a6f 100644
--- a/drivers/scsi/ufs/ufs_quirks.h
+++ b/drivers/scsi/ufs/ufs_quirks.h
@@ -131,4 +131,10 @@ struct ufs_dev_fix {
  */
 #define UFS_DEVICE_QUIRK_HOST_PA_SAVECONFIGTIME (1 << 8)
 
+/*
+ * Some UFS devices require VS_DebugSaveConfigTime is 0x10,
+ * enabling this quirk ensure this.
+ */
+#define UFS_DEVICE_QUIRK_HOST_VS_DEBUGSAVECONFIGTIME    (1 << 9)
+
 #endif /* UFS_QUIRKS_H_ */
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 27db55b0ca7f..f1c57cd33b5b 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -231,6 +231,8 @@ static struct ufs_dev_fix ufs_fixups[] = {
         UFS_FIX(UFS_VENDOR_SKHYNIX, UFS_ANY_MODEL, UFS_DEVICE_NO_VCCQ),
         UFS_FIX(UFS_VENDOR_SKHYNIX, UFS_ANY_MODEL,
                 UFS_DEVICE_QUIRK_HOST_PA_SAVECONFIGTIME),
+        UFS_FIX(UFS_VENDOR_SKHYNIX, "hB8aL1" /*H28U62301AMR*/,
+                UFS_DEVICE_QUIRK_HOST_VS_DEBUGSAVECONFIGTIME),
 
         END_FIX
 };
diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
index 7218fb963d0a..1382a8df6c75 100644
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -777,9 +777,6 @@ static int qcom_slim_ngd_xfer_msg(struct slim_controller *sctrl,
         u8 la = txn->la;
         bool usr_msg = false;
 
-        if (txn->mc & SLIM_MSG_CLK_PAUSE_SEQ_FLG)
-                return -EPROTONOSUPPORT;
-
         if (txn->mt == SLIM_MSG_MT_CORE &&
                 (txn->mc >= SLIM_MSG_MC_BEGIN_RECONFIGURATION &&
                  txn->mc <= SLIM_MSG_MC_RECONFIGURE_NOW))
diff --git a/drivers/slimbus/slimbus.h b/drivers/slimbus/slimbus.h
index 4399d1873e2d..9be41089edde 100644
--- a/drivers/slimbus/slimbus.h
+++ b/drivers/slimbus/slimbus.h
@@ -61,12 +61,6 @@
 #define SLIM_MSG_MC_NEXT_REMOVE_CHANNEL          0x58
 #define SLIM_MSG_MC_RECONFIGURE_NOW              0x5F
 
-/*
- * Clock pause flag to indicate that the reconfig message
- * corresponds to clock pause sequence
- */
-#define SLIM_MSG_CLK_PAUSE_SEQ_FLG              (1U << 8)
-
 /* Clock pause values per SLIMbus spec */
 #define SLIM_CLK_FAST                           0
 #define SLIM_CLK_CONST_PHASE                    1
diff --git a/drivers/staging/media/davinci_vpfe/dm365_ipipeif.c b/drivers/staging/media/davinci_vpfe/dm365_ipipeif.c
index a53231b08d30..e3425bf082ae 100644
--- a/drivers/staging/media/davinci_vpfe/dm365_ipipeif.c
+++ b/drivers/staging/media/davinci_vpfe/dm365_ipipeif.c
@@ -310,6 +310,7 @@ static int ipipeif_hw_setup(struct v4l2_subdev *sd)
                         ipipeif_write(val, ipipeif_base_addr, IPIPEIF_CFG2);
                         break;
                 }
+                /* fall through */
 
         case IPIPEIF_SDRAM_YUV:
                 /* Set clock divider */
diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c
index 82558455384a..dd121f66fa2d 100644
--- a/drivers/staging/media/sunxi/cedrus/cedrus.c
+++ b/drivers/staging/media/sunxi/cedrus/cedrus.c
@@ -253,7 +253,7 @@ static const struct v4l2_m2m_ops cedrus_m2m_ops = {
 
 static const struct media_device_ops cedrus_m2m_media_ops = {
         .req_validate   = cedrus_request_validate,
-        .req_queue      = vb2_m2m_request_queue,
+        .req_queue      = v4l2_m2m_request_queue,
 };
 
 static int cedrus_probe(struct platform_device *pdev)
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 85644669fbe7..0a357db4b31b 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -961,6 +961,8 @@ int __uio_register_device(struct module *owner,
         if (ret)
                 goto err_uio_dev_add_attributes;
 
+        info->uio_dev = idev;
+
         if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) {
                 /*
                  * Note that we deliberately don't use devm_request_irq
@@ -972,11 +974,12 @@ int __uio_register_device(struct module *owner,
                  */
                 ret = request_irq(info->irq, uio_interrupt,
                                   info->irq_flags, info->name, idev);
-                if (ret)
+                if (ret) {
+                        info->uio_dev = NULL;
                         goto err_request_irq;
+                }
         }
 
-        info->uio_dev = idev;
         return 0;
 
 err_request_irq:
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 47d75c20c211..1b68fed464cb 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1696,6 +1696,9 @@ static const struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
+        { USB_DEVICE(0x0572, 0x1349), /* Hiro (Conexant) USB MODEM H50228 */
+        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+        },
         { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */
         .driver_info = QUIRK_CONTROL_LINE_STATE, },
         { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index c6077d582d29..0f9381b69a3b 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2794,6 +2794,7 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
         int i, status;
         u16 portchange, portstatus;
         struct usb_port *port_dev = hub->ports[port1 - 1];
+        int reset_recovery_time;
 
         if (!hub_is_superspeed(hub->hdev)) {
                 if (warm) {
@@ -2849,7 +2850,9 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
                                         USB_PORT_FEAT_C_BH_PORT_RESET);
                         usb_clear_port_feature(hub->hdev, port1,
                                         USB_PORT_FEAT_C_PORT_LINK_STATE);
-                        usb_clear_port_feature(hub->hdev, port1,
+
+                        if (udev)
+                                usb_clear_port_feature(hub->hdev, port1,
                                         USB_PORT_FEAT_C_CONNECTION);
 
                         /*
@@ -2885,11 +2888,18 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
 
 done:
         if (status == 0) {
-                /* TRSTRCY = 10 ms; plus some extra */
                 if (port_dev->quirks & USB_PORT_QUIRK_FAST_ENUM)
                         usleep_range(10000, 12000);
-                else
-                        msleep(10 + 40);
+                else {
+                        /* TRSTRCY = 10 ms; plus some extra */
+                        reset_recovery_time = 10 + 40;
+
+                        /* Hub needs extra delay after resetting its port. */
+                        if (hub->hdev->quirks & USB_QUIRK_HUB_SLOW_RESET)
+                                reset_recovery_time += 100;
+
+                        msleep(reset_recovery_time);
+                }
 
                 if (udev) {
                         struct usb_hcd *hcd = bus_to_hcd(udev->bus);
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 178d6c6063c0..f9ff03e6af93 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -128,6 +128,9 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp)
                         case 'n':
                                 flags |= USB_QUIRK_DELAY_CTRL_MSG;
                                 break;
+                        case 'o':
+                                flags |= USB_QUIRK_HUB_SLOW_RESET;
+                                break;
                         /* Ignore unrecognized flag characters */
                         }
                 }
@@ -380,6 +383,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
                         USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
 
+        /* Terminus Technology Inc. Hub */
+        { USB_DEVICE(0x1a40, 0x0101), .driver_info = USB_QUIRK_HUB_SLOW_RESET },
+
         /* Corsair K70 RGB */
         { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
 
@@ -391,6 +397,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT |
           USB_QUIRK_DELAY_CTRL_MSG },
 
+        /* Corsair K70 LUX RGB */
+        { USB_DEVICE(0x1b1c, 0x1b33), .driver_info = USB_QUIRK_DELAY_INIT },
+
         /* Corsair K70 LUX */
         { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
 
@@ -411,6 +420,11 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x2040, 0x7200), .driver_info =
                         USB_QUIRK_CONFIG_INTF_STRINGS },
 
+        /* Raydium Touchscreen */
+        { USB_DEVICE(0x2386, 0x3114), .driver_info = USB_QUIRK_NO_LPM },
+
+        { USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM },
+
         /* DJI CineSSD */
         { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
 
diff --git a/drivers/usb/dwc2/pci.c b/drivers/usb/dwc2/pci.c
index d257c541e51b..7afc10872f1f 100644
--- a/drivers/usb/dwc2/pci.c
+++ b/drivers/usb/dwc2/pci.c
@@ -120,6 +120,7 @@ static int dwc2_pci_probe(struct pci_dev *pci,
         dwc2 = platform_device_alloc("dwc2", PLATFORM_DEVID_AUTO);
         if (!dwc2) {
                 dev_err(dev, "couldn't allocate dwc2 device\n");
+                ret = -ENOMEM;
                 goto err;
         }
 
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index becfbb87f791..2f2048aa5fde 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -1499,6 +1499,7 @@ static int dwc3_probe(struct platform_device *pdev)
 
 err5:
         dwc3_event_buffers_cleanup(dwc);
+        dwc3_ulpi_exit(dwc);
 
 err4:
         dwc3_free_scratch_buffers(dwc);
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 1286076a8890..842795856bf4 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -283,8 +283,10 @@ err:
 static void dwc3_pci_remove(struct pci_dev *pci)
 {
         struct dwc3_pci         *dwc = pci_get_drvdata(pci);
+        struct pci_dev          *pdev = dwc->pci;
 
-        gpiod_remove_lookup_table(&platform_bytcr_gpios);
+        if (pdev->device == PCI_DEVICE_ID_INTEL_BYT)
+                gpiod_remove_lookup_table(&platform_bytcr_gpios);
 #ifdef CONFIG_PM
         cancel_work_sync(&dwc->wakeup_work);
 #endif
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 679c12e14522..9faad896b3a1 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1081,7 +1081,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
                         /* Now prepare one extra TRB to align transfer size */
                         trb = &dep->trb_pool[dep->trb_enqueue];
                         __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr,
-                                        maxp - rem, false, 0,
+                                        maxp - rem, false, 1,
                                         req->request.stream_id,
                                         req->request.short_not_ok,
                                         req->request.no_interrupt);
@@ -1125,7 +1125,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
                 /* Now prepare one extra TRB to align transfer size */
                 trb = &dep->trb_pool[dep->trb_enqueue];
                 __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, maxp - rem,
-                                false, 0, req->request.stream_id,
+                                false, 1, req->request.stream_id,
                                 req->request.short_not_ok,
                                 req->request.no_interrupt);
         } else if (req->request.zero && req->request.length &&
@@ -1141,7 +1141,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
                 /* Now prepare one extra TRB to handle ZLP */
                 trb = &dep->trb_pool[dep->trb_enqueue];
                 __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, 0,
-                                false, 0, req->request.stream_id,
+                                false, 1, req->request.stream_id,
                                 req->request.short_not_ok,
                                 req->request.no_interrupt);
         } else {
@@ -2259,7 +2259,7 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep,
          * with one TRB pending in the ring. We need to manually clear HWO bit
          * from that TRB.
          */
-        if ((req->zero || req->unaligned) && (trb->ctrl & DWC3_TRB_CTRL_HWO)) {
+        if ((req->zero || req->unaligned) && !(trb->ctrl & DWC3_TRB_CTRL_CHN)) {
                 trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
                 return 1;
         }
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 3ada83d81bda..31e8bf3578c8 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -215,7 +215,6 @@ struct ffs_io_data {
 
         struct mm_struct *mm;
         struct work_struct work;
-        struct work_struct cancellation_work;
 
         struct usb_ep *ep;
         struct usb_request *req;
@@ -1073,31 +1072,22 @@ ffs_epfile_open(struct inode *inode, struct file *file)
         return 0;
 }
 
-static void ffs_aio_cancel_worker(struct work_struct *work)
-{
-        struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,
-                                                   cancellation_work);
-
-        ENTER();
-
-        usb_ep_dequeue(io_data->ep, io_data->req);
-}
-
 static int ffs_aio_cancel(struct kiocb *kiocb)
 {
         struct ffs_io_data *io_data = kiocb->private;
-        struct ffs_data *ffs = io_data->ffs;
+        struct ffs_epfile *epfile = kiocb->ki_filp->private_data;
         int value;
 
         ENTER();
 
-        if (likely(io_data && io_data->ep && io_data->req)) {
-                INIT_WORK(&io_data->cancellation_work, ffs_aio_cancel_worker);
-                queue_work(ffs->io_completion_wq, &io_data->cancellation_work);
-                value = -EINPROGRESS;
-        } else {
+        spin_lock_irq(&epfile->ffs->eps_lock);
+
+        if (likely(io_data && io_data->ep && io_data->req))
+                value = usb_ep_dequeue(io_data->ep, io_data->req);
+        else
                 value = -EINVAL;
-        }
+
+        spin_unlock_irq(&epfile->ffs->eps_lock);
 
         return value;
 }
diff --git a/drivers/usb/host/xhci-histb.c b/drivers/usb/host/xhci-histb.c
index 27f00160332e..3c4abb5a1c3f 100644
--- a/drivers/usb/host/xhci-histb.c
+++ b/drivers/usb/host/xhci-histb.c
@@ -325,14 +325,16 @@ static int xhci_histb_remove(struct platform_device *dev)
         struct xhci_hcd_histb *histb = platform_get_drvdata(dev);
         struct usb_hcd *hcd = histb->hcd;
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        struct usb_hcd *shared_hcd = xhci->shared_hcd;
 
         xhci->xhc_state |= XHCI_STATE_REMOVING;
 
-        usb_remove_hcd(xhci->shared_hcd);
+        usb_remove_hcd(shared_hcd);
+        xhci->shared_hcd = NULL;
         device_wakeup_disable(&dev->dev);
 
         usb_remove_hcd(hcd);
-        usb_put_hcd(xhci->shared_hcd);
+        usb_put_hcd(shared_hcd);
 
         xhci_histb_host_disable(histb);
         usb_put_hcd(hcd);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 12eea73d9f20..94aca1b5ac8a 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -876,7 +876,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                         status |= USB_PORT_STAT_SUSPEND;
         }
         if ((raw_port_status & PORT_PLS_MASK) == XDEV_RESUME &&
-                !DEV_SUPERSPEED_ANY(raw_port_status)) {
+                !DEV_SUPERSPEED_ANY(raw_port_status) && hcd->speed < HCD_USB3) {
                 if ((raw_port_status & PORT_RESET) ||
                                 !(raw_port_status & PORT_PE))
                         return 0xffffffff;
@@ -921,7 +921,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                         time_left = wait_for_completion_timeout(
                                         &bus_state->rexit_done[wIndex],
                                         msecs_to_jiffies(
-                                                XHCI_MAX_REXIT_TIMEOUT));
+                                                XHCI_MAX_REXIT_TIMEOUT_MS));
                         spin_lock_irqsave(&xhci->lock, flags);
 
                         if (time_left) {
@@ -935,7 +935,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                         } else {
                                 int port_status = readl(port->addr);
                                 xhci_warn(xhci, "Port resume took longer than %i msec, port status = 0x%x\n",
-                                                XHCI_MAX_REXIT_TIMEOUT,
+                                                XHCI_MAX_REXIT_TIMEOUT_MS,
                                                 port_status);
                                 status |= USB_PORT_STAT_SUSPEND;
                                 clear_bit(wIndex, &bus_state->rexit_ports);
@@ -1474,15 +1474,18 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
         unsigned long flags;
         struct xhci_hub *rhub;
         struct xhci_port **ports;
+        u32 portsc_buf[USB_MAXCHILDREN];
+        bool wake_enabled;
 
         rhub = xhci_get_rhub(hcd);
         ports = rhub->ports;
         max_ports = rhub->num_ports;
         bus_state = &xhci->bus_state[hcd_index(hcd)];
+        wake_enabled = hcd->self.root_hub->do_remote_wakeup;
 
         spin_lock_irqsave(&xhci->lock, flags);
 
-        if (hcd->self.root_hub->do_remote_wakeup) {
+        if (wake_enabled) {
                 if (bus_state->resuming_ports ||        /* USB2 */
                     bus_state->port_remote_wakeup) {    /* USB3 */
                         spin_unlock_irqrestore(&xhci->lock, flags);
@@ -1490,26 +1493,36 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                         return -EBUSY;
                 }
         }
-
-        port_index = max_ports;
+        /*
+         * Prepare ports for suspend, but don't write anything before all ports
+         * are checked and we know bus suspend can proceed
+         */
         bus_state->bus_suspended = 0;
+        port_index = max_ports;
         while (port_index--) {
-                /* suspend the port if the port is not suspended */
                 u32 t1, t2;
-                int slot_id;
 
                 t1 = readl(ports[port_index]->addr);
                 t2 = xhci_port_state_to_neutral(t1);
+                portsc_buf[port_index] = 0;
 
-                if ((t1 & PORT_PE) && !(t1 & PORT_PLS_MASK)) {
-                        xhci_dbg(xhci, "port %d not suspended\n", port_index);
-                        slot_id = xhci_find_slot_id_by_port(hcd, xhci,
-                                        port_index + 1);
-                        if (slot_id) {
+                /* Bail out if a USB3 port has a new device in link training */
+                if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) {
+                        bus_state->bus_suspended = 0;
+                        spin_unlock_irqrestore(&xhci->lock, flags);
+                        xhci_dbg(xhci, "Bus suspend bailout, port in polling\n");
+                        return -EBUSY;
+                }
+
+                /* suspend ports in U0, or bail out for new connect changes */
+                if ((t1 & PORT_PE) && (t1 & PORT_PLS_MASK) == XDEV_U0) {
+                        if ((t1 & PORT_CSC) && wake_enabled) {
+                                bus_state->bus_suspended = 0;
                                 spin_unlock_irqrestore(&xhci->lock, flags);
-                                xhci_stop_device(xhci, slot_id, 1);
-                                spin_lock_irqsave(&xhci->lock, flags);
+                                xhci_dbg(xhci, "Bus suspend bailout, port connect change\n");
+                                return -EBUSY;
                         }
+                        xhci_dbg(xhci, "port %d not suspended\n", port_index);
                         t2 &= ~PORT_PLS_MASK;
                         t2 |= PORT_LINK_STROBE | XDEV_U3;
                         set_bit(port_index, &bus_state->bus_suspended);
@@ -1518,7 +1531,7 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                  * including the USB 3.0 roothub, but only if CONFIG_PM
                  * is enabled, so also enable remote wake here.
                  */
-                if (hcd->self.root_hub->do_remote_wakeup) {
+                if (wake_enabled) {
                         if (t1 & PORT_CONNECT) {
                                 t2 |= PORT_WKOC_E | PORT_WKDISC_E;
                                 t2 &= ~PORT_WKCONN_E;
@@ -1538,7 +1551,26 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
 
                 t1 = xhci_port_state_to_neutral(t1);
                 if (t1 != t2)
-                        writel(t2, ports[port_index]->addr);
+                        portsc_buf[port_index] = t2;
+        }
+
+        /* write port settings, stopping and suspending ports if needed */
+        port_index = max_ports;
+        while (port_index--) {
+                if (!portsc_buf[port_index])
+                        continue;
+                if (test_bit(port_index, &bus_state->bus_suspended)) {
+                        int slot_id;
+
+                        slot_id = xhci_find_slot_id_by_port(hcd, xhci,
+                                                            port_index + 1);
+                        if (slot_id) {
+                                spin_unlock_irqrestore(&xhci->lock, flags);
+                                xhci_stop_device(xhci, slot_id, 1);
+                                spin_lock_irqsave(&xhci->lock, flags);
+                        }
+                }
+                writel(portsc_buf[port_index], ports[port_index]->addr);
         }
         hcd->state = HC_STATE_SUSPENDED;
         bus_state->next_statechange = jiffies + msecs_to_jiffies(10);
diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
index 71d0d33c3286..60987c787e44 100644
--- a/drivers/usb/host/xhci-mtk.c
+++ b/drivers/usb/host/xhci-mtk.c
@@ -590,12 +590,14 @@ static int xhci_mtk_remove(struct platform_device *dev)
         struct xhci_hcd_mtk *mtk = platform_get_drvdata(dev);
         struct usb_hcd  *hcd = mtk->hcd;
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        struct usb_hcd  *shared_hcd = xhci->shared_hcd;
 
-        usb_remove_hcd(xhci->shared_hcd);
+        usb_remove_hcd(shared_hcd);
+        xhci->shared_hcd = NULL;
         device_init_wakeup(&dev->dev, false);
 
         usb_remove_hcd(hcd);
-        usb_put_hcd(xhci->shared_hcd);
+        usb_put_hcd(shared_hcd);
         usb_put_hcd(hcd);
         xhci_mtk_sch_exit(mtk);
         xhci_mtk_clks_disable(mtk);
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 01c57055c0c5..a9515265db4d 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -248,6 +248,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241)
                 xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_7;
 
+        if ((pdev->vendor == PCI_VENDOR_ID_BROADCOM ||
+             pdev->vendor == PCI_VENDOR_ID_CAVIUM) &&
+             pdev->device == 0x9026)
+                xhci->quirks |= XHCI_RESET_PLL_ON_DISCONNECT;
+
         if (xhci->quirks & XHCI_RESET_ON_RESUME)
                 xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
                                 "QUIRK: Resetting on resume");
@@ -380,6 +385,7 @@ static void xhci_pci_remove(struct pci_dev *dev)
         if (xhci->shared_hcd) {
                 usb_remove_hcd(xhci->shared_hcd);
                 usb_put_hcd(xhci->shared_hcd);
+                xhci->shared_hcd = NULL;
         }
 
         /* Workaround for spurious wakeups at shutdown with HSW */
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 32b5574ad5c5..ef09cb06212f 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -362,14 +362,16 @@ static int xhci_plat_remove(struct platform_device *dev)
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         struct clk *clk = xhci->clk;
         struct clk *reg_clk = xhci->reg_clk;
+        struct usb_hcd *shared_hcd = xhci->shared_hcd;
 
         xhci->xhc_state |= XHCI_STATE_REMOVING;
 
-        usb_remove_hcd(xhci->shared_hcd);
+        usb_remove_hcd(shared_hcd);
+        xhci->shared_hcd = NULL;
         usb_phy_shutdown(hcd->usb_phy);
 
         usb_remove_hcd(hcd);
-        usb_put_hcd(xhci->shared_hcd);
+        usb_put_hcd(shared_hcd);
 
         clk_disable_unprepare(clk);
         clk_disable_unprepare(reg_clk);
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index a8d92c90fb58..65750582133f 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1521,6 +1521,35 @@ static void handle_device_notification(struct xhci_hcd *xhci,
                 usb_wakeup_notification(udev->parent, udev->portnum);
 }
 
+/*
+ * Quirk hanlder for errata seen on Cavium ThunderX2 processor XHCI
+ * Controller.
+ * As per ThunderX2errata-129 USB 2 device may come up as USB 1
+ * If a connection to a USB 1 device is followed by another connection
+ * to a USB 2 device.
+ *
+ * Reset the PHY after the USB device is disconnected if device speed
+ * is less than HCD_USB3.
+ * Retry the reset sequence max of 4 times checking the PLL lock status.
+ *
+ */
+static void xhci_cavium_reset_phy_quirk(struct xhci_hcd *xhci)
+{
+        struct usb_hcd *hcd = xhci_to_hcd(xhci);
+        u32 pll_lock_check;
+        u32 retry_count = 4;
+
+        do {
+                /* Assert PHY reset */
+                writel(0x6F, hcd->regs + 0x1048);
+                udelay(10);
+                /* De-assert the PHY reset */
+                writel(0x7F, hcd->regs + 0x1048);
+                udelay(200);
+                pll_lock_check = readl(hcd->regs + 0x1070);
+        } while (!(pll_lock_check & 0x1) && --retry_count);
+}
+
 static void handle_port_status(struct xhci_hcd *xhci,
                 union xhci_trb *event)
 {
@@ -1556,6 +1585,13 @@ static void handle_port_status(struct xhci_hcd *xhci,
                 goto cleanup;
         }
 
+        /* We might get interrupts after shared_hcd is removed */
+        if (port->rhub == &xhci->usb3_rhub && xhci->shared_hcd == NULL) {
+                xhci_dbg(xhci, "ignore port event for removed USB3 hcd\n");
+                bogus_port_status = true;
+                goto cleanup;
+        }
+
         hcd = port->rhub->hcd;
         bus_state = &xhci->bus_state[hcd_index(hcd)];
         hcd_portnum = port->hcd_portnum;
@@ -1639,7 +1675,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
          * RExit to a disconnect state).  If so, let the the driver know it's
          * out of the RExit state.
          */
-        if (!DEV_SUPERSPEED_ANY(portsc) &&
+        if (!DEV_SUPERSPEED_ANY(portsc) && hcd->speed < HCD_USB3 &&
                         test_and_clear_bit(hcd_portnum,
                                 &bus_state->rexit_ports)) {
                 complete(&bus_state->rexit_done[hcd_portnum]);
@@ -1647,8 +1683,12 @@ static void handle_port_status(struct xhci_hcd *xhci,
                 goto cleanup;
         }
 
-        if (hcd->speed < HCD_USB3)
+        if (hcd->speed < HCD_USB3) {
                 xhci_test_and_clear_bit(xhci, port, PORT_PLC);
+                if ((xhci->quirks & XHCI_RESET_PLL_ON_DISCONNECT) &&
+                    (portsc & PORT_CSC) && !(portsc & PORT_CONNECT))
+                        xhci_cavium_reset_phy_quirk(xhci);
+        }
 
 cleanup:
         /* Update event ring dequeue pointer before dropping the lock */
@@ -2266,6 +2306,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                         goto cleanup;
                 case COMP_RING_UNDERRUN:
                 case COMP_RING_OVERRUN:
+                case COMP_STOPPED_LENGTH_INVALID:
                         goto cleanup;
                 default:
                         xhci_err(xhci, "ERROR Transfer event for unknown stream ring slot %u ep %u\n",
diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
index 6b5db344de30..938ff06c0349 100644
--- a/drivers/usb/host/xhci-tegra.c
+++ b/drivers/usb/host/xhci-tegra.c
@@ -1303,6 +1303,7 @@ static int tegra_xusb_remove(struct platform_device *pdev)
 
         usb_remove_hcd(xhci->shared_hcd);
         usb_put_hcd(xhci->shared_hcd);
+        xhci->shared_hcd = NULL;
         usb_remove_hcd(tegra->hcd);
         usb_put_hcd(tegra->hcd);
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 0420eefa647a..c928dbbff881 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -719,8 +719,6 @@ static void xhci_stop(struct usb_hcd *hcd)
 
         /* Only halt host and free memory after both hcds are removed */
         if (!usb_hcd_is_primary_hcd(hcd)) {
-                /* usb core will free this hcd shortly, unset pointer */
-                xhci->shared_hcd = NULL;
                 mutex_unlock(&xhci->mutex);
                 return;
         }
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index bf0b3692dc9a..260b259b72bc 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1680,7 +1680,7 @@ struct xhci_bus_state {
  * It can take up to 20 ms to transition from RExit to U0 on the
  * Intel Lynx Point LP xHCI host.
  */
-#define XHCI_MAX_REXIT_TIMEOUT  (20 * 1000)
+#define XHCI_MAX_REXIT_TIMEOUT_MS       20
 
 static inline unsigned int hcd_index(struct usb_hcd *hcd)
 {
@@ -1849,6 +1849,7 @@ struct xhci_hcd {
 #define XHCI_INTEL_USB_ROLE_SW  BIT_ULL(31)
 #define XHCI_ZERO_64B_REGS      BIT_ULL(32)
 #define XHCI_DEFAULT_PM_RUNTIME_ALLOW   BIT_ULL(33)
+#define XHCI_RESET_PLL_ON_DISCONNECT    BIT_ULL(34)
 
         unsigned int            num_active_eps;
         unsigned int            limit_active_eps;
diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
index bd539f3058bc..85b48c6ddc7e 100644
--- a/drivers/usb/misc/appledisplay.c
+++ b/drivers/usb/misc/appledisplay.c
@@ -50,6 +50,7 @@ static const struct usb_device_id appledisplay_table[] = {
         { APPLEDISPLAY_DEVICE(0x9219) },
         { APPLEDISPLAY_DEVICE(0x921c) },
         { APPLEDISPLAY_DEVICE(0x921d) },
+        { APPLEDISPLAY_DEVICE(0x9222) },
         { APPLEDISPLAY_DEVICE(0x9236) },
 
         /* Terminating entry */
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index 59970886690f..a7b44863d502 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -576,6 +576,7 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
 {
         signed long rtt2, timeout;
         long ret;
+        bool stalled = false;
         u64 rtt;
         u32 life, last_life;
 
@@ -609,12 +610,20 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
 
                 life = rxrpc_kernel_check_life(call->net->socket, call->rxcall);
                 if (timeout == 0 &&
-                    life == last_life && signal_pending(current))
+                    life == last_life && signal_pending(current)) {
+                        if (stalled)
                                 break;
+                        __set_current_state(TASK_RUNNING);
+                        rxrpc_kernel_probe_life(call->net->socket, call->rxcall);
+                        timeout = rtt2;
+                        stalled = true;
+                        continue;
+                }
 
                 if (life != last_life) {
                         timeout = rtt2;
                         last_life = life;
+                        stalled = false;
                 }
 
                 timeout = schedule_timeout(timeout);
diff --git a/fs/dax.c b/fs/dax.c
index 616e36ea6aaa..9bcce89ea18e 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -98,12 +98,6 @@ static void *dax_make_entry(pfn_t pfn, unsigned long flags)
         return xa_mk_value(flags | (pfn_t_to_pfn(pfn) << DAX_SHIFT));
 }
 
-static void *dax_make_page_entry(struct page *page)
-{
-        pfn_t pfn = page_to_pfn_t(page);
-        return dax_make_entry(pfn, PageHead(page) ? DAX_PMD : 0);
-}
-
 static bool dax_is_locked(void *entry)
 {
         return xa_to_value(entry) & DAX_LOCKED;
@@ -116,12 +110,12 @@ static unsigned int dax_entry_order(void *entry)
         return 0;
 }
 
-static int dax_is_pmd_entry(void *entry)
+static unsigned long dax_is_pmd_entry(void *entry)
 {
         return xa_to_value(entry) & DAX_PMD;
 }
 
-static int dax_is_pte_entry(void *entry)
+static bool dax_is_pte_entry(void *entry)
 {
         return !(xa_to_value(entry) & DAX_PMD);
 }
@@ -222,9 +216,8 @@ static void *get_unlocked_entry(struct xa_state *xas)
         ewait.wait.func = wake_exceptional_entry_func;
 
         for (;;) {
-                entry = xas_load(xas);
-                if (!entry || xa_is_internal(entry) ||
-                                WARN_ON_ONCE(!xa_is_value(entry)) ||
+                entry = xas_find_conflict(xas);
+                if (!entry || WARN_ON_ONCE(!xa_is_value(entry)) ||
                                 !dax_is_locked(entry))
                         return entry;
 
@@ -255,6 +248,7 @@ static void dax_unlock_entry(struct xa_state *xas, void *entry)
 {
         void *old;
 
+        BUG_ON(dax_is_locked(entry));
         xas_reset(xas);
         xas_lock_irq(xas);
         old = xas_store(xas, entry);
@@ -352,16 +346,27 @@ static struct page *dax_busy_page(void *entry)
         return NULL;
 }
 
+/*
+ * dax_lock_mapping_entry - Lock the DAX entry corresponding to a page
+ * @page: The page whose entry we want to lock
+ *
+ * Context: Process context.
+ * Return: %true if the entry was locked or does not need to be locked.
+ */
 bool dax_lock_mapping_entry(struct page *page)
 {
         XA_STATE(xas, NULL, 0);
         void *entry;
+        bool locked;
 
+        /* Ensure page->mapping isn't freed while we look at it */
+        rcu_read_lock();
         for (;;) {
                 struct address_space *mapping = READ_ONCE(page->mapping);
 
+                locked = false;
                 if (!dax_mapping(mapping))
-                        return false;
+                        break;
 
                 /*
                  * In the device-dax case there's no need to lock, a
@@ -370,8 +375,9 @@ bool dax_lock_mapping_entry(struct page *page)
                  * otherwise we would not have a valid pfn_to_page()
                  * translation.
                  */
+                locked = true;
                 if (S_ISCHR(mapping->host->i_mode))
-                        return true;
+                        break;
 
                 xas.xa = &mapping->i_pages;
                 xas_lock_irq(&xas);
@@ -382,28 +388,35 @@ bool dax_lock_mapping_entry(struct page *page)
                 xas_set(&xas, page->index);
                 entry = xas_load(&xas);
                 if (dax_is_locked(entry)) {
+                        rcu_read_unlock();
                         entry = get_unlocked_entry(&xas);
-                        /* Did the page move while we slept? */
-                        if (dax_to_pfn(entry) != page_to_pfn(page)) {
-                                xas_unlock_irq(&xas);
-                                continue;
-                        }
+                        xas_unlock_irq(&xas);
+                        put_unlocked_entry(&xas, entry);
+                        rcu_read_lock();
+                        continue;
                 }
                 dax_lock_entry(&xas, entry);
                 xas_unlock_irq(&xas);
-                return true;
+                break;
         }
+        rcu_read_unlock();
+        return locked;
 }
 
 void dax_unlock_mapping_entry(struct page *page)
 {
         struct address_space *mapping = page->mapping;
         XA_STATE(xas, &mapping->i_pages, page->index);
+        void *entry;
 
         if (S_ISCHR(mapping->host->i_mode))
                 return;
 
-        dax_unlock_entry(&xas, dax_make_page_entry(page));
+        rcu_read_lock();
+        entry = xas_load(&xas);
+        rcu_read_unlock();
+        entry = dax_make_entry(page_to_pfn_t(page), dax_is_pmd_entry(entry));
+        dax_unlock_entry(&xas, entry);
 }
 
 /*
@@ -445,11 +458,9 @@ static void *grab_mapping_entry(struct xa_state *xas,
 retry:
         xas_lock_irq(xas);
         entry = get_unlocked_entry(xas);
-        if (xa_is_internal(entry))
-                goto fallback;
 
         if (entry) {
-                if (WARN_ON_ONCE(!xa_is_value(entry))) {
+                if (!xa_is_value(entry)) {
                         xas_set_err(xas, EIO);
                         goto out_unlock;
                 }
@@ -1628,8 +1639,7 @@ dax_insert_pfn_mkwrite(struct vm_fault *vmf, pfn_t pfn, unsigned int order)
         /* Did we race with someone splitting entry or so? */
         if (!entry ||
             (order == 0 && !dax_is_pte_entry(entry)) ||
-            (order == PMD_ORDER && (xa_is_internal(entry) ||
-                                    !dax_is_pmd_entry(entry)))) {
+            (order == PMD_ORDER && !dax_is_pmd_entry(entry))) {
                 put_unlocked_entry(&xas, entry);
                 xas_unlock_irq(&xas);
                 trace_dax_insert_pfn_mkwrite_no_entry(mapping->host, vmf,
diff --git a/fs/exec.c b/fs/exec.c
index fc281b738a98..acc3a5536384 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -62,6 +62,7 @@
 #include <linux/oom.h>
 #include <linux/compat.h>
 #include <linux/vmalloc.h>
+#include <linux/freezer.h>
 
 #include <linux/uaccess.h>
 #include <asm/mmu_context.h>
@@ -1083,7 +1084,7 @@ static int de_thread(struct task_struct *tsk)
         while (sig->notify_count) {
                 __set_current_state(TASK_KILLABLE);
                 spin_unlock_irq(lock);
-                schedule();
+                freezable_schedule();
                 if (unlikely(__fatal_signal_pending(tsk)))
                         goto killed;
                 spin_lock_irq(lock);
@@ -1111,7 +1112,7 @@ static int de_thread(struct task_struct *tsk)
                         __set_current_state(TASK_KILLABLE);
                         write_unlock_irq(&tasklist_lock);
                         cgroup_threadgroup_change_end(tsk);
-                        schedule();
+                        freezable_schedule();
                         if (unlikely(__fatal_signal_pending(tsk)))
                                 goto killed;
                 }
diff --git a/fs/iomap.c b/fs/iomap.c
index 64ce240217a1..3ffb776fbebe 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -142,13 +142,14 @@ static void
 iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop,
                 loff_t *pos, loff_t length, unsigned *offp, unsigned *lenp)
 {
+        loff_t orig_pos = *pos;
+        loff_t isize = i_size_read(inode);
         unsigned block_bits = inode->i_blkbits;
         unsigned block_size = (1 << block_bits);
         unsigned poff = offset_in_page(*pos);
         unsigned plen = min_t(loff_t, PAGE_SIZE - poff, length);
         unsigned first = poff >> block_bits;
         unsigned last = (poff + plen - 1) >> block_bits;
-        unsigned end = offset_in_page(i_size_read(inode)) >> block_bits;
 
         /*
          * If the block size is smaller than the page size we need to check the
@@ -183,8 +184,12 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop,
          * handle both halves separately so that we properly zero data in the
          * page cache for blocks that are entirely outside of i_size.
          */
-        if (first <= end && last > end)
-                plen -= (last - end) * block_size;
+        if (orig_pos <= isize && orig_pos + length > isize) {
+                unsigned end = offset_in_page(isize - 1) >> block_bits;
+
+                if (first <= end && last > end)
+                        plen -= (last - end) * block_size;
+        }
 
         *offp = poff;
         *lenp = plen;
@@ -1580,7 +1585,7 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
         struct bio *bio;
         bool need_zeroout = false;
         bool use_fua = false;
-        int nr_pages, ret;
+        int nr_pages, ret = 0;
         size_t copied = 0;
 
         if ((pos | length | align) & ((1 << blkbits) - 1))
@@ -1596,12 +1601,13 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
 
         if (iomap->flags & IOMAP_F_NEW) {
                 need_zeroout = true;
-        } else {
+        } else if (iomap->type == IOMAP_MAPPED) {
                 /*
-                 * Use a FUA write if we need datasync semantics, this
-                 * is a pure data IO that doesn't require any metadata
-                 * updates and the underlying device supports FUA. This
-                 * allows us to avoid cache flushes on IO completion.
+                 * Use a FUA write if we need datasync semantics, this is a pure
+                 * data IO that doesn't require any metadata updates (including
+                 * after IO completion such as unwritten extent conversion) and
+                 * the underlying device supports FUA. This allows us to avoid
+                 * cache flushes on IO completion.
                  */
                 if (!(iomap->flags & (IOMAP_F_SHARED|IOMAP_F_DIRTY)) &&
                     (dio->flags & IOMAP_DIO_WRITE_FUA) &&
@@ -1644,8 +1650,14 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
 
                 ret = bio_iov_iter_get_pages(bio, &iter);
                 if (unlikely(ret)) {
+                        /*
+                         * We have to stop part way through an IO. We must fall
+                         * through to the sub-block tail zeroing here, otherwise
+                         * this short IO may expose stale data in the tail of
+                         * the block we haven't written data to.
+                         */
                         bio_put(bio);
-                        return copied ? copied : ret;
+                        goto zero_tail;
                 }
 
                 n = bio->bi_iter.bi_size;
@@ -1676,13 +1688,21 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
                 dio->submit.cookie = submit_bio(bio);
         } while (nr_pages);
 
-        if (need_zeroout) {
+        /*
+         * We need to zeroout the tail of a sub-block write if the extent type
+         * requires zeroing or the write extends beyond EOF. If we don't zero
+         * the block tail in the latter case, we can expose stale data via mmap
+         * reads of the EOF block.
+         */
+zero_tail:
+        if (need_zeroout ||
+            ((dio->flags & IOMAP_DIO_WRITE) && pos >= i_size_read(inode))) {
                 /* zero out from the end of the write to the end of the block */
                 pad = pos & (fs_block_size - 1);
                 if (pad)
                         iomap_dio_zero(dio, iomap, pos, fs_block_size - pad);
         }
-        return copied;
+        return copied ? copied : ret;
 }
 
 static loff_t
@@ -1857,6 +1877,15 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                                 dio->wait_for_completion = true;
                                 ret = 0;
                         }
+
+                        /*
+                         * Splicing to pipes can fail on a full pipe. We have to
+                         * swallow this to make it look like a short IO
+                         * otherwise the higher splice layers will completely
+                         * mishandle the error and stop moving data.
+                         */
+                        if (ret == -EFAULT)
+                                ret = 0;
                         break;
                 }
                 pos += ret;
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index 7b861bbc0b43..315967354954 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -686,20 +686,24 @@ __be32 nfs4_callback_offload(void *data, void *dummy,
 {
         struct cb_offloadargs *args = data;
         struct nfs_server *server;
-        struct nfs4_copy_state *copy;
+        struct nfs4_copy_state *copy, *tmp_copy;
         bool found = false;
 
+        copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS);
+        if (!copy)
+                return htonl(NFS4ERR_SERVERFAULT);
+
         spin_lock(&cps->clp->cl_lock);
         rcu_read_lock();
         list_for_each_entry_rcu(server, &cps->clp->cl_superblocks,
                                 client_link) {
-                list_for_each_entry(copy, &server->ss_copies, copies) {
+                list_for_each_entry(tmp_copy, &server->ss_copies, copies) {
                         if (memcmp(args->coa_stateid.other,
-                                        copy->stateid.other,
+                                        tmp_copy->stateid.other,
                                         sizeof(args->coa_stateid.other)))
                                 continue;
-                        nfs4_copy_cb_args(copy, args);
-                        complete(&copy->completion);
+                        nfs4_copy_cb_args(tmp_copy, args);
+                        complete(&tmp_copy->completion);
                         found = true;
                         goto out;
                 }
@@ -707,15 +711,11 @@ __be32 nfs4_callback_offload(void *data, void *dummy,
 out:
         rcu_read_unlock();
         if (!found) {
-                copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS);
-                if (!copy) {
-                        spin_unlock(&cps->clp->cl_lock);
-                        return htonl(NFS4ERR_SERVERFAULT);
-                }
                 memcpy(&copy->stateid, &args->coa_stateid, NFS4_STATEID_SIZE);
                 nfs4_copy_cb_args(copy, args);
                 list_add_tail(&copy->copies, &cps->clp->pending_cb_stateids);
-        }
+        } else
+                kfree(copy);
         spin_unlock(&cps->clp->cl_lock);
 
         return 0;
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index 86bcba40ca61..74b36ed883ca 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1361,12 +1361,7 @@ static void ff_layout_read_prepare_v4(struct rpc_task *task, void *data)
                                 task))
                 return;
 
-        if (ff_layout_read_prepare_common(task, hdr))
-                return;
-
-        if (nfs4_set_rw_stateid(&hdr->args.stateid, hdr->args.context,
-                        hdr->args.lock_context, FMODE_READ) == -EIO)
-                rpc_exit(task, -EIO); /* lost lock, terminate I/O */
+        ff_layout_read_prepare_common(task, hdr);
 }
 
 static void ff_layout_read_call_done(struct rpc_task *task, void *data)
@@ -1542,12 +1537,7 @@ static void ff_layout_write_prepare_v4(struct rpc_task *task, void *data)
                                 task))
                 return;
 
-        if (ff_layout_write_prepare_common(task, hdr))
-                return;
-
-        if (nfs4_set_rw_stateid(&hdr->args.stateid, hdr->args.context,
-                        hdr->args.lock_context, FMODE_WRITE) == -EIO)
-                rpc_exit(task, -EIO); /* lost lock, terminate I/O */
+        ff_layout_write_prepare_common(task, hdr);
 }
 
 static void ff_layout_write_call_done(struct rpc_task *task, void *data)
@@ -1742,6 +1732,10 @@ ff_layout_read_pagelist(struct nfs_pgio_header *hdr)
         fh = nfs4_ff_layout_select_ds_fh(lseg, idx);
         if (fh)
                 hdr->args.fh = fh;
+
+        if (!nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid))
+                goto out_failed;
+
         /*
          * Note that if we ever decide to split across DSes,
          * then we may need to handle dense-like offsets.
@@ -1804,6 +1798,9 @@ ff_layout_write_pagelist(struct nfs_pgio_header *hdr, int sync)
         if (fh)
                 hdr->args.fh = fh;
 
+        if (!nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid))
+                goto out_failed;
+
         /*
          * Note that if we ever decide to split across DSes,
          * then we may need to handle dense-like offsets.
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
index 411798346e48..de50a342d5a5 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.h
+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
@@ -215,6 +215,10 @@ unsigned int ff_layout_fetch_ds_ioerr(struct pnfs_layout_hdr *lo,
                 unsigned int maxnum);
 struct nfs_fh *
 nfs4_ff_layout_select_ds_fh(struct pnfs_layout_segment *lseg, u32 mirror_idx);
+int
+nfs4_ff_layout_select_ds_stateid(struct pnfs_layout_segment *lseg,
+                                u32 mirror_idx,
+                                nfs4_stateid *stateid);
 
 struct nfs4_pnfs_ds *
 nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index 74d8d5352438..d23347389626 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -370,6 +370,25 @@ out:
         return fh;
 }
 
+int
+nfs4_ff_layout_select_ds_stateid(struct pnfs_layout_segment *lseg,
+                                u32 mirror_idx,
+                                nfs4_stateid *stateid)
+{
+        struct nfs4_ff_layout_mirror *mirror = FF_LAYOUT_COMP(lseg, mirror_idx);
+
+        if (!ff_layout_mirror_valid(lseg, mirror, false)) {
+                pr_err_ratelimited("NFS: %s: No data server for mirror offset index %d\n",
+                        __func__, mirror_idx);
+                goto out;
+        }
+
+        nfs4_stateid_copy(stateid, &mirror->stateid);
+        return 1;
+out:
+        return 0;
+}
+
 /**
  * nfs4_ff_layout_prepare_ds - prepare a DS connection for an RPC call
  * @lseg: the layout segment we're operating on
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index ac5b784a1de0..fed06fd9998d 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -137,31 +137,32 @@ static int handle_async_copy(struct nfs42_copy_res *res,
                              struct file *dst,
                              nfs4_stateid *src_stateid)
 {
-        struct nfs4_copy_state *copy;
+        struct nfs4_copy_state *copy, *tmp_copy;
         int status = NFS4_OK;
         bool found_pending = false;
         struct nfs_open_context *ctx = nfs_file_open_context(dst);
 
+        copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS);
+        if (!copy)
+                return -ENOMEM;
+
         spin_lock(&server->nfs_client->cl_lock);
-        list_for_each_entry(copy, &server->nfs_client->pending_cb_stateids,
+        list_for_each_entry(tmp_copy, &server->nfs_client->pending_cb_stateids,
                                 copies) {
-                if (memcmp(&res->write_res.stateid, &copy->stateid,
+                if (memcmp(&res->write_res.stateid, &tmp_copy->stateid,
                                 NFS4_STATEID_SIZE))
                         continue;
                 found_pending = true;
-                list_del(&copy->copies);
+                list_del(&tmp_copy->copies);
                 break;
         }
         if (found_pending) {
                 spin_unlock(&server->nfs_client->cl_lock);
+                kfree(copy);
+                copy = tmp_copy;
                 goto out;
         }
 
-        copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS);
-        if (!copy) {
-                spin_unlock(&server->nfs_client->cl_lock);
-                return -ENOMEM;
-        }
         memcpy(&copy->stateid, &res->write_res.stateid, NFS4_STATEID_SIZE);
         init_completion(&copy->completion);
         copy->parent_state = ctx->state;
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 8d59c9655ec4..1b994b527518 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -41,6 +41,8 @@ enum nfs4_client_state {
         NFS4CLNT_MOVED,
         NFS4CLNT_LEASE_MOVED,
         NFS4CLNT_DELEGATION_EXPIRED,
+        NFS4CLNT_RUN_MANAGER,
+        NFS4CLNT_DELEGRETURN_RUNNING,
 };
 
 #define NFS4_RENEW_TIMEOUT              0x01
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index ffea57885394..d8decf2ec48f 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1210,6 +1210,7 @@ void nfs4_schedule_state_manager(struct nfs_client *clp)
         struct task_struct *task;
         char buf[INET6_ADDRSTRLEN + sizeof("-manager") + 1];
 
+        set_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state);
         if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
                 return;
         __module_get(THIS_MODULE);
@@ -2503,6 +2504,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
 
         /* Ensure exclusive access to NFSv4 state */
         do {
+                clear_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state);
                 if (test_bit(NFS4CLNT_PURGE_STATE, &clp->cl_state)) {
                         section = "purge state";
                         status = nfs4_purge_lease(clp);
@@ -2593,14 +2595,18 @@ static void nfs4_state_manager(struct nfs_client *clp)
                 }
 
                 nfs4_end_drain_session(clp);
-                if (test_and_clear_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state)) {
-                        nfs_client_return_marked_delegations(clp);
-                        continue;
+                nfs4_clear_state_manager_bit(clp);
+
+                if (!test_and_set_bit(NFS4CLNT_DELEGRETURN_RUNNING, &clp->cl_state)) {
+                        if (test_and_clear_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state)) {
+                                nfs_client_return_marked_delegations(clp);
+                                set_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state);
+                        }
+                        clear_bit(NFS4CLNT_DELEGRETURN_RUNNING, &clp->cl_state);
                 }
 
-                nfs4_clear_state_manager_bit(clp);
                 /* Did we race with an attempt to give us more work? */
-                if (clp->cl_state == 0)
+                if (!test_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state))
                         return;
                 if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
                         return;
diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c
index de99db518571..f2129a5d9f23 100644
--- a/fs/nilfs2/btnode.c
+++ b/fs/nilfs2/btnode.c
@@ -266,9 +266,7 @@ void nilfs_btnode_abort_change_key(struct address_space *btnc,
                 return;
 
         if (nbh == NULL) {      /* blocksize == pagesize */
-                xa_lock_irq(&btnc->i_pages);
-                __xa_erase(&btnc->i_pages, newkey);
-                xa_unlock_irq(&btnc->i_pages);
+                xa_erase_irq(&btnc->i_pages, newkey);
                 unlock_page(ctxt->bh->b_page);
         } else
                 brelse(nbh);
diff --git a/fs/read_write.c b/fs/read_write.c
index bfcb4ced5664..4dae0399c75a 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -2094,17 +2094,18 @@ int vfs_dedupe_file_range(struct file *file, struct file_dedupe_range *same)
         off = same->src_offset;
         len = same->src_length;
 
-        ret = -EISDIR;
         if (S_ISDIR(src->i_mode))
-                goto out;
+                return -EISDIR;
 
-        ret = -EINVAL;
         if (!S_ISREG(src->i_mode))
-                goto out;
+                return -EINVAL;
+
+        if (!file->f_op->remap_file_range)
+                return -EOPNOTSUPP;
 
         ret = remap_verify_area(file, off, len, false);
         if (ret < 0)
-                goto out;
+                return ret;
         ret = 0;
 
         if (off + len > i_size_read(src))
@@ -2147,10 +2148,8 @@ next_fdput:
                 fdput(dst_fd);
 next_loop:
                 if (fatal_signal_pending(current))
-                        goto out;
+                        break;
         }
-
-out:
         return ret;
 }
 EXPORT_SYMBOL(vfs_dedupe_file_range);
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 74d7228e755b..19e921d1586f 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -1694,10 +1694,13 @@ xfs_bmap_add_extent_delay_real(
         case BMAP_LEFT_FILLING | BMAP_RIGHT_FILLING | BMAP_RIGHT_CONTIG:
                 /*
                  * Filling in all of a previously delayed allocation extent.
-                 * The right neighbor is contiguous, the left is not.
+                 * The right neighbor is contiguous, the left is not. Take care
+                 * with delay -> unwritten extent allocation here because the
+                 * delalloc record we are overwriting is always written.
                  */
                 PREV.br_startblock = new->br_startblock;
                 PREV.br_blockcount += RIGHT.br_blockcount;
+                PREV.br_state = new->br_state;
 
                 xfs_iext_next(ifp, &bma->icur);
                 xfs_iext_remove(bma->ip, &bma->icur, state);
diff --git a/fs/xfs/libxfs/xfs_ialloc_btree.c b/fs/xfs/libxfs/xfs_ialloc_btree.c
index 86c50208a143..7fbf8af0b159 100644
--- a/fs/xfs/libxfs/xfs_ialloc_btree.c
+++ b/fs/xfs/libxfs/xfs_ialloc_btree.c
@@ -538,15 +538,18 @@ xfs_inobt_rec_check_count(
 
 static xfs_extlen_t
 xfs_inobt_max_size(
-        struct xfs_mount        *mp)
+        struct xfs_mount        *mp,
+        xfs_agnumber_t          agno)
 {
+        xfs_agblock_t           agblocks = xfs_ag_block_count(mp, agno);
+
         /* Bail out if we're uninitialized, which can happen in mkfs. */
         if (mp->m_inobt_mxr[0] == 0)
                 return 0;
 
         return xfs_btree_calc_size(mp->m_inobt_mnr,
-                (uint64_t)mp->m_sb.sb_agblocks * mp->m_sb.sb_inopblock /
-                                XFS_INODES_PER_CHUNK);
+                                (uint64_t)agblocks * mp->m_sb.sb_inopblock /
+                                        XFS_INODES_PER_CHUNK);
 }
 
 static int
@@ -594,7 +597,7 @@ xfs_finobt_calc_reserves(
         if (error)
                 return error;
 
-        *ask += xfs_inobt_max_size(mp);
+        *ask += xfs_inobt_max_size(mp, agno);
         *used += tree_len;
         return 0;
 }
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 5d263dfdb3bc..404e581f1ea1 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1042,7 +1042,7 @@ out_trans_cancel:
         goto out_unlock;
 }
 
-static int
+int
 xfs_flush_unmap_range(
         struct xfs_inode        *ip,
         xfs_off_t               offset,
@@ -1195,13 +1195,7 @@ xfs_prepare_shift(
          * Writeback and invalidate cache for the remainder of the file as we're
          * about to shift down every extent from offset to EOF.
          */
-        error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping, offset, -1);
-        if (error)
-                return error;
-        error = invalidate_inode_pages2_range(VFS_I(ip)->i_mapping,
-                                        offset >> PAGE_SHIFT, -1);
-        if (error)
-                return error;
+        error = xfs_flush_unmap_range(ip, offset, XFS_ISIZE(ip));
 
         /*
          * Clean out anything hanging around in the cow fork now that
diff --git a/fs/xfs/xfs_bmap_util.h b/fs/xfs/xfs_bmap_util.h
index 87363d136bb6..7a78229cf1a7 100644
--- a/fs/xfs/xfs_bmap_util.h
+++ b/fs/xfs/xfs_bmap_util.h
@@ -80,4 +80,7 @@ int xfs_bmap_count_blocks(struct xfs_trans *tp, struct xfs_inode *ip,
                           int whichfork, xfs_extnum_t *nextents,
                           xfs_filblks_t *count);
 
+int     xfs_flush_unmap_range(struct xfs_inode *ip, xfs_off_t offset,
+                              xfs_off_t len);
+
 #endif  /* __XFS_BMAP_UTIL_H__ */
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 12d8455bfbb2..010db5f8fb00 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -1233,9 +1233,23 @@ xfs_buf_iodone(
 }
 
 /*
- * Requeue a failed buffer for writeback
+ * Requeue a failed buffer for writeback.
  *
- * Return true if the buffer has been re-queued properly, false otherwise
+ * We clear the log item failed state here as well, but we have to be careful
+ * about reference counts because the only active reference counts on the buffer
+ * may be the failed log items. Hence if we clear the log item failed state
+ * before queuing the buffer for IO we can release all active references to
+ * the buffer and free it, leading to use after free problems in
+ * xfs_buf_delwri_queue. It makes no difference to the buffer or log items which
+ * order we process them in - the buffer is locked, and we own the buffer list
+ * so nothing on them is going to change while we are performing this action.
+ *
+ * Hence we can safely queue the buffer for IO before we clear the failed log
+ * item state, therefore  always having an active reference to the buffer and
+ * avoiding the transient zero-reference state that leads to use-after-free.
+ *
+ * Return true if the buffer was added to the buffer list, false if it was
+ * already on the buffer list.
  */
 bool
 xfs_buf_resubmit_failed_buffers(
@@ -1243,16 +1257,16 @@ xfs_buf_resubmit_failed_buffers(
         struct list_head        *buffer_list)
 {
         struct xfs_log_item     *lip;
+        bool                    ret;
+
+        ret = xfs_buf_delwri_queue(bp, buffer_list);
 
         /*
-         * Clear XFS_LI_FAILED flag from all items before resubmit
-         *
-         * XFS_LI_FAILED set/clear is protected by ail_lock, caller  this
+         * XFS_LI_FAILED set/clear is protected by ail_lock, caller of this
          * function already have it acquired
          */
         list_for_each_entry(lip, &bp->b_li_list, li_bio_list)
                 xfs_clear_li_failed(lip);
 
-        /* Add this buffer back to the delayed write list */
-        return xfs_buf_delwri_queue(bp, buffer_list);
+        return ret;
 }
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 53c9ab8fb777..e47425071e65 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -920,7 +920,7 @@ out_unlock:
 }
 
 
-loff_t
+STATIC loff_t
 xfs_file_remap_range(
         struct file             *file_in,
         loff_t                  pos_in,
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index ecdb086bc23e..322a852ce284 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -296,6 +296,7 @@ xfs_reflink_reserve_cow(
         if (error)
                 return error;
 
+        xfs_trim_extent(imap, got.br_startoff, got.br_blockcount);
         trace_xfs_reflink_cow_alloc(ip, &got);
         return 0;
 }
@@ -1351,10 +1352,19 @@ xfs_reflink_remap_prep(
         if (ret)
                 goto out_unlock;
 
-        /* Zap any page cache for the destination file's range. */
-        truncate_inode_pages_range(&inode_out->i_data,
-                        round_down(pos_out, PAGE_SIZE),
-                        round_up(pos_out + *len, PAGE_SIZE) - 1);
+        /*
+         * If pos_out > EOF, we may have dirtied blocks between EOF and
+         * pos_out. In that case, we need to extend the flush and unmap to cover
+         * from EOF to the end of the copy length.
+         */
+        if (pos_out > XFS_ISIZE(dest)) {
+                loff_t  flen = *len + (pos_out - XFS_ISIZE(dest));
+                ret = xfs_flush_unmap_range(dest, XFS_ISIZE(dest), flen);
+        } else {
+                ret = xfs_flush_unmap_range(dest, pos_out, *len);
+        }
+        if (ret)
+                goto out_unlock;
 
         return 1;
 out_unlock:
diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
index 3043e5ed6495..8a6532aae779 100644
--- a/fs/xfs/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
@@ -280,7 +280,10 @@ DECLARE_EVENT_CLASS(xfs_buf_class,
         ),
         TP_fast_assign(
                 __entry->dev = bp->b_target->bt_dev;
-                __entry->bno = bp->b_bn;
+                if (bp->b_bn == XFS_BUF_DADDR_NULL)
+                        __entry->bno = bp->b_maps[0].bm_bn;
+                else
+                        __entry->bno = bp->b_bn;
                 __entry->nblks = bp->b_length;
                 __entry->hold = atomic_read(&bp->b_hold);
                 __entry->pincount = atomic_read(&bp->b_pin_count);
diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
index a83e1f632eb7..f01623aef2f7 100644
--- a/include/linux/can/dev.h
+++ b/include/linux/can/dev.h
@@ -169,6 +169,7 @@ void can_change_state(struct net_device *dev, struct can_frame *cf,
 
 void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
                       unsigned int idx);
+struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr);
 unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx);
 void can_free_echo_skb(struct net_device *dev, unsigned int idx);
 
diff --git a/include/linux/can/rx-offload.h b/include/linux/can/rx-offload.h
index cb31683bbe15..8268811a697e 100644
--- a/include/linux/can/rx-offload.h
+++ b/include/linux/can/rx-offload.h
@@ -41,7 +41,12 @@ int can_rx_offload_add_timestamp(struct net_device *dev, struct can_rx_offload *
 int can_rx_offload_add_fifo(struct net_device *dev, struct can_rx_offload *offload, unsigned int weight);
 int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 reg);
 int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload);
-int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_buff *skb);
+int can_rx_offload_queue_sorted(struct can_rx_offload *offload,
+                                struct sk_buff *skb, u32 timestamp);
+unsigned int can_rx_offload_get_echo_skb(struct can_rx_offload *offload,
+                                         unsigned int idx, u32 timestamp);
+int can_rx_offload_queue_tail(struct can_rx_offload *offload,
+                              struct sk_buff *skb);
 void can_rx_offload_reset(struct can_rx_offload *offload);
 void can_rx_offload_del(struct can_rx_offload *offload);
 void can_rx_offload_enable(struct can_rx_offload *offload);
diff --git a/include/linux/dma-direct.h b/include/linux/dma-direct.h
index bd73e7a91410..9e66bfe369aa 100644
--- a/include/linux/dma-direct.h
+++ b/include/linux/dma-direct.h
@@ -5,7 +5,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/mem_encrypt.h>
 
-#define DIRECT_MAPPING_ERROR            0
+#define DIRECT_MAPPING_ERROR            (~(dma_addr_t)0)
 
 #ifdef CONFIG_ARCH_HAS_PHYS_TO_DMA
 #include <asm/dma-direct.h>
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 387c70df6f29..a355d61940f2 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -1139,34 +1139,6 @@ static inline u32 hid_report_len(struct hid_report *report)
 int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
                 int interrupt);
 
-
-/**
- * struct hid_scroll_counter - Utility class for processing high-resolution
- *                             scroll events.
- * @dev: the input device for which events should be reported.
- * @microns_per_hi_res_unit: the amount moved by the user's finger for each
- *                           high-resolution unit reported by the mouse, in
- *                           microns.
- * @resolution_multiplier: the wheel's resolution in high-resolution mode as a
- *                         multiple of its lower resolution. For example, if
- *                         moving the wheel by one "notch" would result in a
- *                         value of 1 in low-resolution mode but 8 in
- *                         high-resolution, the multiplier is 8.
- * @remainder: counts the number of high-resolution units moved since the last
- *             low-resolution event (REL_WHEEL or REL_HWHEEL) was sent. Should
- *             only be used by class methods.
- */
-struct hid_scroll_counter {
-        struct input_dev *dev;
-        int microns_per_hi_res_unit;
-        int resolution_multiplier;
-
-        int remainder;
-};
-
-void hid_scroll_counter_handle_scroll(struct hid_scroll_counter *counter,
-                                      int hi_res_value);
-
 /* HID quirks API */
 unsigned long hid_lookup_quirk(const struct hid_device *hdev);
 int hid_quirks_init(char **quirks_param, __u16 bus, int count);
diff --git a/include/linux/net_dim.h b/include/linux/net_dim.h
index c79e859408e6..fd458389f7d1 100644
--- a/include/linux/net_dim.h
+++ b/include/linux/net_dim.h
@@ -406,6 +406,8 @@ static inline void net_dim(struct net_dim *dim,
                 }
                 /* fall through */
         case NET_DIM_START_MEASURE:
+                net_dim_sample(end_sample.event_ctr, end_sample.pkt_ctr, end_sample.byte_ctr,
+                               &dim->start_sample);
                 dim->state = NET_DIM_MEASURE_IN_PROGRESS;
                 break;
         case NET_DIM_APPLY_NEW_PROFILE:
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 0ba687454267..0d1b2c3f127b 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1326,6 +1326,22 @@ static inline void skb_zcopy_set(struct sk_buff *skb, struct ubuf_info *uarg)
         }
 }
 
+static inline void skb_zcopy_set_nouarg(struct sk_buff *skb, void *val)
+{
+        skb_shinfo(skb)->destructor_arg = (void *)((uintptr_t) val | 0x1UL);
+        skb_shinfo(skb)->tx_flags |= SKBTX_ZEROCOPY_FRAG;
+}
+
+static inline bool skb_zcopy_is_nouarg(struct sk_buff *skb)
+{
+        return (uintptr_t) skb_shinfo(skb)->destructor_arg & 0x1UL;
+}
+
+static inline void *skb_zcopy_get_nouarg(struct sk_buff *skb)
+{
+        return (void *)((uintptr_t) skb_shinfo(skb)->destructor_arg & ~0x1UL);
+}
+
 /* Release a reference on a zerocopy structure */
 static inline void skb_zcopy_clear(struct sk_buff *skb, bool zerocopy)
 {
@@ -1335,7 +1351,7 @@ static inline void skb_zcopy_clear(struct sk_buff *skb, bool zerocopy)
                 if (uarg->callback == sock_zerocopy_callback) {
                         uarg->zerocopy = uarg->zerocopy && zerocopy;
                         sock_zerocopy_put(uarg);
-                } else {
+                } else if (!skb_zcopy_is_nouarg(skb)) {
                         uarg->callback(uarg, zerocopy);
                 }
 
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 8ed77bb4ed86..a9b0280687d5 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -196,6 +196,7 @@ struct tcp_sock {
         u32     rcv_tstamp;     /* timestamp of last received ACK (for keepalives) */
         u32     lsndtime;       /* timestamp of last sent data packet (for restart window) */
         u32     last_oow_ack_time;  /* timestamp of last out-of-window ACK */
+        u32     compressed_ack_rcv_nxt;
 
         u32     tsoffset;       /* timestamp offset */
 
diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
index b7a99ce56bc9..a1be64c9940f 100644
--- a/include/linux/usb/quirks.h
+++ b/include/linux/usb/quirks.h
@@ -66,4 +66,7 @@
 /* Device needs a pause after every control message. */
 #define USB_QUIRK_DELAY_CTRL_MSG                BIT(13)
 
+/* Hub needs extra delay after resetting its port. */
+#define USB_QUIRK_HUB_SLOW_RESET                BIT(14)
+
 #endif /* __LINUX_USB_QUIRKS_H */
diff --git a/include/linux/xarray.h b/include/linux/xarray.h
index d9514928ddac..564892e19f8c 100644
--- a/include/linux/xarray.h
+++ b/include/linux/xarray.h
@@ -289,9 +289,7 @@ struct xarray {
 void xa_init_flags(struct xarray *, gfp_t flags);
 void *xa_load(struct xarray *, unsigned long index);
 void *xa_store(struct xarray *, unsigned long index, void *entry, gfp_t);
-void *xa_cmpxchg(struct xarray *, unsigned long index,
-                        void *old, void *entry, gfp_t);
-int xa_reserve(struct xarray *, unsigned long index, gfp_t);
+void *xa_erase(struct xarray *, unsigned long index);
 void *xa_store_range(struct xarray *, unsigned long first, unsigned long last,
                         void *entry, gfp_t);
 bool xa_get_mark(struct xarray *, unsigned long index, xa_mark_t);
@@ -344,65 +342,6 @@ static inline bool xa_marked(const struct xarray *xa, xa_mark_t mark)
 }
 
 /**
- * xa_erase() - Erase this entry from the XArray.
- * @xa: XArray.
- * @index: Index of entry.
- *
- * This function is the equivalent of calling xa_store() with %NULL as
- * the third argument.  The XArray does not need to allocate memory, so
- * the user does not need to provide GFP flags.
- *
- * Context: Process context.  Takes and releases the xa_lock.
- * Return: The entry which used to be at this index.
- */
-static inline void *xa_erase(struct xarray *xa, unsigned long index)
-{
-        return xa_store(xa, index, NULL, 0);
-}
-
-/**
- * xa_insert() - Store this entry in the XArray unless another entry is
- *                      already present.
- * @xa: XArray.
- * @index: Index into array.
- * @entry: New entry.
- * @gfp: Memory allocation flags.
- *
- * If you would rather see the existing entry in the array, use xa_cmpxchg().
- * This function is for users who don't care what the entry is, only that
- * one is present.
- *
- * Context: Process context.  Takes and releases the xa_lock.
- *          May sleep if the @gfp flags permit.
- * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
- * -ENOMEM if memory could not be allocated.
- */
-static inline int xa_insert(struct xarray *xa, unsigned long index,
-                void *entry, gfp_t gfp)
-{
-        void *curr = xa_cmpxchg(xa, index, NULL, entry, gfp);
-        if (!curr)
-                return 0;
-        if (xa_is_err(curr))
-                return xa_err(curr);
-        return -EEXIST;
-}
-
-/**
- * xa_release() - Release a reserved entry.
- * @xa: XArray.
- * @index: Index of entry.
- *
- * After calling xa_reserve(), you can call this function to release the
- * reservation.  If the entry at @index has been stored to, this function
- * will do nothing.
- */
-static inline void xa_release(struct xarray *xa, unsigned long index)
-{
-        xa_cmpxchg(xa, index, NULL, NULL, 0);
-}
-
-/**
  * xa_for_each() - Iterate over a portion of an XArray.
  * @xa: XArray.
  * @entry: Entry retrieved from array.
@@ -455,6 +394,7 @@ void *__xa_store(struct xarray *, unsigned long index, void *entry, gfp_t);
 void *__xa_cmpxchg(struct xarray *, unsigned long index, void *old,
                 void *entry, gfp_t);
 int __xa_alloc(struct xarray *, u32 *id, u32 max, void *entry, gfp_t);
+int __xa_reserve(struct xarray *, unsigned long index, gfp_t);
 void __xa_set_mark(struct xarray *, unsigned long index, xa_mark_t);
 void __xa_clear_mark(struct xarray *, unsigned long index, xa_mark_t);
 
@@ -487,6 +427,58 @@ static inline int __xa_insert(struct xarray *xa, unsigned long index,
 }
 
 /**
+ * xa_store_bh() - Store this entry in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * This function is like calling xa_store() except it disables softirqs
+ * while holding the array lock.
+ *
+ * Context: Any context.  Takes and releases the xa_lock while
+ * disabling softirqs.
+ * Return: The entry which used to be at this index.
+ */
+static inline void *xa_store_bh(struct xarray *xa, unsigned long index,
+                void *entry, gfp_t gfp)
+{
+        void *curr;
+
+        xa_lock_bh(xa);
+        curr = __xa_store(xa, index, entry, gfp);
+        xa_unlock_bh(xa);
+
+        return curr;
+}
+
+/**
+ * xa_store_irq() - Erase this entry from the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * This function is like calling xa_store() except it disables interrupts
+ * while holding the array lock.
+ *
+ * Context: Process context.  Takes and releases the xa_lock while
+ * disabling interrupts.
+ * Return: The entry which used to be at this index.
+ */
+static inline void *xa_store_irq(struct xarray *xa, unsigned long index,
+                void *entry, gfp_t gfp)
+{
+        void *curr;
+
+        xa_lock_irq(xa);
+        curr = __xa_store(xa, index, entry, gfp);
+        xa_unlock_irq(xa);
+
+        return curr;
+}
+
+/**
  * xa_erase_bh() - Erase this entry from the XArray.
  * @xa: XArray.
  * @index: Index of entry.
@@ -495,7 +487,7 @@ static inline int __xa_insert(struct xarray *xa, unsigned long index,
  * the third argument.  The XArray does not need to allocate memory, so
  * the user does not need to provide GFP flags.
  *
- * Context: Process context.  Takes and releases the xa_lock while
+ * Context: Any context.  Takes and releases the xa_lock while
  * disabling softirqs.
  * Return: The entry which used to be at this index.
  */
@@ -535,6 +527,61 @@ static inline void *xa_erase_irq(struct xarray *xa, unsigned long index)
 }
 
 /**
+ * xa_cmpxchg() - Conditionally replace an entry in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @old: Old value to test against.
+ * @entry: New value to place in array.
+ * @gfp: Memory allocation flags.
+ *
+ * If the entry at @index is the same as @old, replace it with @entry.
+ * If the return value is equal to @old, then the exchange was successful.
+ *
+ * Context: Any context.  Takes and releases the xa_lock.  May sleep
+ * if the @gfp flags permit.
+ * Return: The old value at this index or xa_err() if an error happened.
+ */
+static inline void *xa_cmpxchg(struct xarray *xa, unsigned long index,
+                        void *old, void *entry, gfp_t gfp)
+{
+        void *curr;
+
+        xa_lock(xa);
+        curr = __xa_cmpxchg(xa, index, old, entry, gfp);
+        xa_unlock(xa);
+
+        return curr;
+}
+
+/**
+ * xa_insert() - Store this entry in the XArray unless another entry is
+ *                      already present.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * If you would rather see the existing entry in the array, use xa_cmpxchg().
+ * This function is for users who don't care what the entry is, only that
+ * one is present.
+ *
+ * Context: Process context.  Takes and releases the xa_lock.
+ *          May sleep if the @gfp flags permit.
+ * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
+ * -ENOMEM if memory could not be allocated.
+ */
+static inline int xa_insert(struct xarray *xa, unsigned long index,
+                void *entry, gfp_t gfp)
+{
+        void *curr = xa_cmpxchg(xa, index, NULL, entry, gfp);
+        if (!curr)
+                return 0;
+        if (xa_is_err(curr))
+                return xa_err(curr);
+        return -EEXIST;
+}
+
+/**
  * xa_alloc() - Find somewhere to store this entry in the XArray.
  * @xa: XArray.
  * @id: Pointer to ID.
@@ -575,7 +622,7 @@ static inline int xa_alloc(struct xarray *xa, u32 *id, u32 max, void *entry,
  * Updates the @id pointer with the index, then stores the entry at that
  * index.  A concurrent lookup will not see an uninitialised @id.
  *
- * Context: Process context.  Takes and releases the xa_lock while
+ * Context: Any context.  Takes and releases the xa_lock while
  * disabling softirqs.  May sleep if the @gfp flags permit.
  * Return: 0 on success, -ENOMEM if memory allocation fails or -ENOSPC if
  * there is no more space in the XArray.
@@ -621,6 +668,98 @@ static inline int xa_alloc_irq(struct xarray *xa, u32 *id, u32 max, void *entry,
         return err;
 }
 
+/**
+ * xa_reserve() - Reserve this index in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @gfp: Memory allocation flags.
+ *
+ * Ensures there is somewhere to store an entry at @index in the array.
+ * If there is already something stored at @index, this function does
+ * nothing.  If there was nothing there, the entry is marked as reserved.
+ * Loading from a reserved entry returns a %NULL pointer.
+ *
+ * If you do not use the entry that you have reserved, call xa_release()
+ * or xa_erase() to free any unnecessary memory.
+ *
+ * Context: Any context.  Takes and releases the xa_lock.
+ * May sleep if the @gfp flags permit.
+ * Return: 0 if the reservation succeeded or -ENOMEM if it failed.
+ */
+static inline
+int xa_reserve(struct xarray *xa, unsigned long index, gfp_t gfp)
+{
+        int ret;
+
+        xa_lock(xa);
+        ret = __xa_reserve(xa, index, gfp);
+        xa_unlock(xa);
+
+        return ret;
+}
+
+/**
+ * xa_reserve_bh() - Reserve this index in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @gfp: Memory allocation flags.
+ *
+ * A softirq-disabling version of xa_reserve().
+ *
+ * Context: Any context.  Takes and releases the xa_lock while
+ * disabling softirqs.
+ * Return: 0 if the reservation succeeded or -ENOMEM if it failed.
+ */
+static inline
+int xa_reserve_bh(struct xarray *xa, unsigned long index, gfp_t gfp)
+{
+        int ret;
+
+        xa_lock_bh(xa);
+        ret = __xa_reserve(xa, index, gfp);
+        xa_unlock_bh(xa);
+
+        return ret;
+}
+
+/**
+ * xa_reserve_irq() - Reserve this index in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @gfp: Memory allocation flags.
+ *
+ * An interrupt-disabling version of xa_reserve().
+ *
+ * Context: Process context.  Takes and releases the xa_lock while
+ * disabling interrupts.
+ * Return: 0 if the reservation succeeded or -ENOMEM if it failed.
+ */
+static inline
+int xa_reserve_irq(struct xarray *xa, unsigned long index, gfp_t gfp)
+{
+        int ret;
+
+        xa_lock_irq(xa);
+        ret = __xa_reserve(xa, index, gfp);
+        xa_unlock_irq(xa);
+
+        return ret;
+}
+
+/**
+ * xa_release() - Release a reserved entry.
+ * @xa: XArray.
+ * @index: Index of entry.
+ *
+ * After calling xa_reserve(), you can call this function to release the
+ * reservation.  If the entry at @index has been stored to, this function
+ * will do nothing.
+ */
+static inline void xa_release(struct xarray *xa, unsigned long index)
+{
+        xa_cmpxchg(xa, index, NULL, NULL, 0);
+}
+
 /* Everything below here is the Advanced API.  Proceed with caution. */
 
 /*
diff --git a/include/media/v4l2-mem2mem.h b/include/media/v4l2-mem2mem.h
index 58c1ecf3d648..5467264771ec 100644
--- a/include/media/v4l2-mem2mem.h
+++ b/include/media/v4l2-mem2mem.h
@@ -624,7 +624,7 @@ v4l2_m2m_dst_buf_remove_by_idx(struct v4l2_m2m_ctx *m2m_ctx, unsigned int idx)
 
 /* v4l2 request helper */
 
-void vb2_m2m_request_queue(struct media_request *req);
+void v4l2_m2m_request_queue(struct media_request *req);
 
 /* v4l2 ioctl helpers */
 
diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
index de587948042a..1adefe42c0a6 100644
--- a/include/net/af_rxrpc.h
+++ b/include/net/af_rxrpc.h
@@ -77,7 +77,8 @@ int rxrpc_kernel_retry_call(struct socket *, struct rxrpc_call *,
                             struct sockaddr_rxrpc *, struct key *);
 int rxrpc_kernel_check_call(struct socket *, struct rxrpc_call *,
                             enum rxrpc_call_completion *, u32 *);
-u32 rxrpc_kernel_check_life(struct socket *, struct rxrpc_call *);
+u32 rxrpc_kernel_check_life(const struct socket *, const struct rxrpc_call *);
+void rxrpc_kernel_probe_life(struct socket *, struct rxrpc_call *);
 u32 rxrpc_kernel_get_epoch(struct socket *, struct rxrpc_call *);
 bool rxrpc_kernel_get_reply_time(struct socket *, struct rxrpc_call *,
                                  ktime_t *);
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 8c2caa370e0f..ab9242e51d9e 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -608,4 +608,16 @@ static inline __u32 sctp_dst_mtu(const struct dst_entry *dst)
                                  SCTP_DEFAULT_MINSEGMENT));
 }
 
+static inline bool sctp_transport_pmtu_check(struct sctp_transport *t)
+{
+        __u32 pmtu = sctp_dst_mtu(t->dst);
+
+        if (t->pathmtu == pmtu)
+                return true;
+
+        t->pathmtu = pmtu;
+
+        return false;
+}
+
 #endif /* __net_sctp_h__ */
diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
index 573d5b901fb1..5b50fe4906d2 100644
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -181,6 +181,7 @@ enum rxrpc_timer_trace {
 enum rxrpc_propose_ack_trace {
         rxrpc_propose_ack_client_tx_end,
         rxrpc_propose_ack_input_data,
+        rxrpc_propose_ack_ping_for_check_life,
         rxrpc_propose_ack_ping_for_keepalive,
         rxrpc_propose_ack_ping_for_lost_ack,
         rxrpc_propose_ack_ping_for_lost_reply,
@@ -380,6 +381,7 @@ enum rxrpc_tx_point {
 #define rxrpc_propose_ack_traces \
         EM(rxrpc_propose_ack_client_tx_end,     "ClTxEnd") \
         EM(rxrpc_propose_ack_input_data,        "DataIn ") \
+        EM(rxrpc_propose_ack_ping_for_check_life, "ChkLife") \
         EM(rxrpc_propose_ack_ping_for_keepalive, "KeepAlv") \
         EM(rxrpc_propose_ack_ping_for_lost_ack, "LostAck") \
         EM(rxrpc_propose_ack_ping_for_lost_reply, "LostRpl") \
diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
index 6d180cc60a5d..3eb5a4c3d60a 100644
--- a/include/uapi/linux/input-event-codes.h
+++ b/include/uapi/linux/input-event-codes.h
@@ -716,7 +716,6 @@
  * the situation described above.
  */
 #define REL_RESERVED            0x0a
-#define REL_WHEEL_HI_RES        0x0b
 #define REL_MAX                 0x0f
 #define REL_CNT                 (REL_MAX+1)
 
@@ -753,15 +752,6 @@
 
 #define ABS_MISC                0x28
 
-/*
- * 0x2e is reserved and should not be used in input drivers.
- * It was used by HID as ABS_MISC+6 and userspace needs to detect if
- * the next ABS_* event is correct or is just ABS_MISC + n.
- * We define here ABS_RESERVED so userspace can rely on it and detect
- * the situation described above.
- */
-#define ABS_RESERVED            0x2e
-
 #define ABS_MT_SLOT             0x2f    /* MT slot being modified */
 #define ABS_MT_TOUCH_MAJOR      0x30    /* Major axis of touching ellipse */
 #define ABS_MT_TOUCH_MINOR      0x31    /* Minor axis (omit if circular) */
diff --git a/include/uapi/linux/v4l2-controls.h b/include/uapi/linux/v4l2-controls.h
index 51b095898f4b..998983a6e6b7 100644
--- a/include/uapi/linux/v4l2-controls.h
+++ b/include/uapi/linux/v4l2-controls.h
@@ -50,6 +50,8 @@
 #ifndef __LINUX_V4L2_CONTROLS_H
 #define __LINUX_V4L2_CONTROLS_H
 
+#include <linux/types.h>
+
 /* Control classes */
 #define V4L2_CTRL_CLASS_USER            0x00980000      /* Old-style 'user' controls */
 #define V4L2_CTRL_CLASS_MPEG            0x00990000      /* MPEG-compression controls */
@@ -1110,6 +1112,7 @@ struct v4l2_mpeg2_sequence {
         __u8    profile_and_level_indication;
         __u8    progressive_sequence;
         __u8    chroma_format;
+        __u8    pad;
 };
 
 struct v4l2_mpeg2_picture {
@@ -1128,6 +1131,7 @@ struct v4l2_mpeg2_picture {
         __u8    alternate_scan;
         __u8    repeat_first_field;
         __u8    progressive_frame;
+        __u8    pad;
 };
 
 struct v4l2_ctrl_mpeg2_slice_params {
@@ -1142,6 +1146,7 @@ struct v4l2_ctrl_mpeg2_slice_params {
 
         __u8    backward_ref_index;
         __u8    forward_ref_index;
+        __u8    pad;
 };
 
 struct v4l2_ctrl_mpeg2_quantization {
diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
index 5731daa09a32..045930e32c0e 100644
--- a/kernel/dma/swiotlb.c
+++ b/kernel/dma/swiotlb.c
@@ -679,7 +679,8 @@ dma_addr_t swiotlb_map_page(struct device *dev, struct page *page,
         }
 
         if (!dev_is_dma_coherent(dev) &&
-            (attrs & DMA_ATTR_SKIP_CPU_SYNC) == 0)
+            (attrs & DMA_ATTR_SKIP_CPU_SYNC) == 0 &&
+            dev_addr != DIRECT_MAPPING_ERROR)
                 arch_sync_dma_for_device(dev, phys, size, dir);
 
         return dev_addr;
diff --git a/lib/test_firmware.c b/lib/test_firmware.c
index b984806d7d7b..7cab9a9869ac 100644
--- a/lib/test_firmware.c
+++ b/lib/test_firmware.c
@@ -837,6 +837,7 @@ static ssize_t read_firmware_show(struct device *dev,
         if (req->fw->size > PAGE_SIZE) {
                 pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
                 rc = -EINVAL;
+                goto out;
         }
         memcpy(buf, req->fw->data, req->fw->size);
 
diff --git a/lib/test_xarray.c b/lib/test_xarray.c
index aa47754150ce..0598e86af8fc 100644
--- a/lib/test_xarray.c
+++ b/lib/test_xarray.c
@@ -208,15 +208,19 @@ static noinline void check_xa_mark_1(struct xarray *xa, unsigned long index)
                         XA_BUG_ON(xa, xa_get_mark(xa, i, XA_MARK_2));
 
                         /* We should see two elements in the array */
+                        rcu_read_lock();
                         xas_for_each(&xas, entry, ULONG_MAX)
                                 seen++;
+                        rcu_read_unlock();
                         XA_BUG_ON(xa, seen != 2);
 
                         /* One of which is marked */
                         xas_set(&xas, 0);
                         seen = 0;
+                        rcu_read_lock();
                         xas_for_each_marked(&xas, entry, ULONG_MAX, XA_MARK_0)
                                 seen++;
+                        rcu_read_unlock();
                         XA_BUG_ON(xa, seen != 1);
                 }
                 XA_BUG_ON(xa, xa_get_mark(xa, next, XA_MARK_0));
@@ -373,6 +377,12 @@ static noinline void check_reserve(struct xarray *xa)
         xa_erase_index(xa, 12345678);
         XA_BUG_ON(xa, !xa_empty(xa));
 
+        /* And so does xa_insert */
+        xa_reserve(xa, 12345678, GFP_KERNEL);
+        XA_BUG_ON(xa, xa_insert(xa, 12345678, xa_mk_value(12345678), 0) != 0);
+        xa_erase_index(xa, 12345678);
+        XA_BUG_ON(xa, !xa_empty(xa));
+
         /* Can iterate through a reserved entry */
         xa_store_index(xa, 5, GFP_KERNEL);
         xa_reserve(xa, 6, GFP_KERNEL);
@@ -436,7 +446,9 @@ static noinline void check_multi_store_1(struct xarray *xa, unsigned long index,
         XA_BUG_ON(xa, xa_load(xa, max) != NULL);
         XA_BUG_ON(xa, xa_load(xa, min - 1) != NULL);
 
+        xas_lock(&xas);
         XA_BUG_ON(xa, xas_store(&xas, xa_mk_value(min)) != xa_mk_value(index));
+        xas_unlock(&xas);
         XA_BUG_ON(xa, xa_load(xa, min) != xa_mk_value(min));
         XA_BUG_ON(xa, xa_load(xa, max - 1) != xa_mk_value(min));
         XA_BUG_ON(xa, xa_load(xa, max) != NULL);
@@ -452,9 +464,11 @@ static noinline void check_multi_store_2(struct xarray *xa, unsigned long index,
         XA_STATE(xas, xa, index);
         xa_store_order(xa, index, order, xa_mk_value(0), GFP_KERNEL);
 
+        xas_lock(&xas);
         XA_BUG_ON(xa, xas_store(&xas, xa_mk_value(1)) != xa_mk_value(0));
         XA_BUG_ON(xa, xas.xa_index != index);
         XA_BUG_ON(xa, xas_store(&xas, NULL) != xa_mk_value(1));
+        xas_unlock(&xas);
         XA_BUG_ON(xa, !xa_empty(xa));
 }
 #endif
@@ -498,7 +512,7 @@ static noinline void check_multi_store(struct xarray *xa)
         rcu_read_unlock();
 
         /* We can erase multiple values with a single store */
-        xa_store_order(xa, 0, 63, NULL, GFP_KERNEL);
+        xa_store_order(xa, 0, BITS_PER_LONG - 1, NULL, GFP_KERNEL);
         XA_BUG_ON(xa, !xa_empty(xa));
 
         /* Even when the first slot is empty but the others aren't */
@@ -702,7 +716,7 @@ static noinline void check_multi_find_2(struct xarray *xa)
         }
 }
 
-static noinline void check_find(struct xarray *xa)
+static noinline void check_find_1(struct xarray *xa)
 {
         unsigned long i, j, k;
 
@@ -748,6 +762,34 @@ static noinline void check_find(struct xarray *xa)
                 XA_BUG_ON(xa, xa_get_mark(xa, i, XA_MARK_0));
         }
         XA_BUG_ON(xa, !xa_empty(xa));
+}
+
+static noinline void check_find_2(struct xarray *xa)
+{
+        void *entry;
+        unsigned long i, j, index = 0;
+
+        xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) {
+                XA_BUG_ON(xa, true);
+        }
+
+        for (i = 0; i < 1024; i++) {
+                xa_store_index(xa, index, GFP_KERNEL);
+                j = 0;
+                index = 0;
+                xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) {
+                        XA_BUG_ON(xa, xa_mk_value(index) != entry);
+                        XA_BUG_ON(xa, index != j++);
+                }
+        }
+
+        xa_destroy(xa);
+}
+
+static noinline void check_find(struct xarray *xa)
+{
+        check_find_1(xa);
+        check_find_2(xa);
         check_multi_find(xa);
         check_multi_find_2(xa);
 }
@@ -1067,7 +1109,7 @@ static noinline void check_store_range(struct xarray *xa)
                         __check_store_range(xa, 4095 + i, 4095 + j);
                         __check_store_range(xa, 4096 + i, 4096 + j);
                         __check_store_range(xa, 123456 + i, 123456 + j);
-                        __check_store_range(xa, UINT_MAX + i, UINT_MAX + j);
+                        __check_store_range(xa, (1 << 24) + i, (1 << 24) + j);
                 }
         }
 }
@@ -1146,10 +1188,12 @@ static noinline void check_account(struct xarray *xa)
                 XA_STATE(xas, xa, 1 << order);
 
                 xa_store_order(xa, 0, order, xa, GFP_KERNEL);
+                rcu_read_lock();
                 xas_load(&xas);
                 XA_BUG_ON(xa, xas.xa_node->count == 0);
                 XA_BUG_ON(xa, xas.xa_node->count > (1 << order));
                 XA_BUG_ON(xa, xas.xa_node->nr_values != 0);
+                rcu_read_unlock();
 
                 xa_store_order(xa, 1 << order, order, xa_mk_value(1 << order),
                                 GFP_KERNEL);
diff --git a/lib/xarray.c b/lib/xarray.c
index 8b176f009c08..bbacca576593 100644
--- a/lib/xarray.c
+++ b/lib/xarray.c
@@ -610,8 +610,8 @@ static int xas_expand(struct xa_state *xas, void *head)
  * (see the xa_cmpxchg() implementation for an example).
  *
  * Return: If the slot already existed, returns the contents of this slot.
- * If the slot was newly created, returns NULL.  If it failed to create the
- * slot, returns NULL and indicates the error in @xas.
+ * If the slot was newly created, returns %NULL.  If it failed to create the
+ * slot, returns %NULL and indicates the error in @xas.
  */
 static void *xas_create(struct xa_state *xas)
 {
@@ -1334,44 +1334,31 @@ void *__xa_erase(struct xarray *xa, unsigned long index)
         XA_STATE(xas, xa, index);
         return xas_result(&xas, xas_store(&xas, NULL));
 }
-EXPORT_SYMBOL_GPL(__xa_erase);
+EXPORT_SYMBOL(__xa_erase);
 
 /**
- * xa_store() - Store this entry in the XArray.
+ * xa_erase() - Erase this entry from the XArray.
  * @xa: XArray.
- * @index: Index into array.
- * @entry: New entry.
- * @gfp: Memory allocation flags.
+ * @index: Index of entry.
  *
- * After this function returns, loads from this index will return @entry.
- * Storing into an existing multislot entry updates the entry of every index.
- * The marks associated with @index are unaffected unless @entry is %NULL.
+ * This function is the equivalent of calling xa_store() with %NULL as
+ * the third argument.  The XArray does not need to allocate memory, so
+ * the user does not need to provide GFP flags.
  *
- * Context: Process context.  Takes and releases the xa_lock.  May sleep
- * if the @gfp flags permit.
- * Return: The old entry at this index on success, xa_err(-EINVAL) if @entry
- * cannot be stored in an XArray, or xa_err(-ENOMEM) if memory allocation
- * failed.
+ * Context: Any context.  Takes and releases the xa_lock.
+ * Return: The entry which used to be at this index.
  */
-void *xa_store(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
+void *xa_erase(struct xarray *xa, unsigned long index)
 {
-        XA_STATE(xas, xa, index);
-        void *curr;
-
-        if (WARN_ON_ONCE(xa_is_internal(entry)))
-                return XA_ERROR(-EINVAL);
+        void *entry;
 
-        do {
-                xas_lock(&xas);
-                curr = xas_store(&xas, entry);
-                if (xa_track_free(xa) && entry)
-                        xas_clear_mark(&xas, XA_FREE_MARK);
-                xas_unlock(&xas);
-        } while (xas_nomem(&xas, gfp));
+        xa_lock(xa);
+        entry = __xa_erase(xa, index);
+        xa_unlock(xa);
 
-        return xas_result(&xas, curr);
+        return entry;
 }
-EXPORT_SYMBOL(xa_store);
+EXPORT_SYMBOL(xa_erase);
 
 /**
  * __xa_store() - Store this entry in the XArray.
@@ -1395,10 +1382,12 @@ void *__xa_store(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
 
         if (WARN_ON_ONCE(xa_is_internal(entry)))
                 return XA_ERROR(-EINVAL);
+        if (xa_track_free(xa) && !entry)
+                entry = XA_ZERO_ENTRY;
 
         do {
                 curr = xas_store(&xas, entry);
-                if (xa_track_free(xa) && entry)
+                if (xa_track_free(xa))
                         xas_clear_mark(&xas, XA_FREE_MARK);
         } while (__xas_nomem(&xas, gfp));
 
@@ -1407,45 +1396,33 @@ void *__xa_store(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
 EXPORT_SYMBOL(__xa_store);
 
 /**
- * xa_cmpxchg() - Conditionally replace an entry in the XArray.
+ * xa_store() - Store this entry in the XArray.
  * @xa: XArray.
  * @index: Index into array.
- * @old: Old value to test against.
- * @entry: New value to place in array.
+ * @entry: New entry.
  * @gfp: Memory allocation flags.
  *
- * If the entry at @index is the same as @old, replace it with @entry.
- * If the return value is equal to @old, then the exchange was successful.
+ * After this function returns, loads from this index will return @entry.
+ * Storing into an existing multislot entry updates the entry of every index.
+ * The marks associated with @index are unaffected unless @entry is %NULL.
  *
- * Context: Process context.  Takes and releases the xa_lock.  May sleep
- * if the @gfp flags permit.
- * Return: The old value at this index or xa_err() if an error happened.
+ * Context: Any context.  Takes and releases the xa_lock.
+ * May sleep if the @gfp flags permit.
+ * Return: The old entry at this index on success, xa_err(-EINVAL) if @entry
+ * cannot be stored in an XArray, or xa_err(-ENOMEM) if memory allocation
+ * failed.
  */
-void *xa_cmpxchg(struct xarray *xa, unsigned long index,
-                        void *old, void *entry, gfp_t gfp)
+void *xa_store(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
 {
-        XA_STATE(xas, xa, index);
         void *curr;
 
-        if (WARN_ON_ONCE(xa_is_internal(entry)))
-                return XA_ERROR(-EINVAL);
-
-        do {
-                xas_lock(&xas);
-                curr = xas_load(&xas);
-                if (curr == XA_ZERO_ENTRY)
-                        curr = NULL;
-                if (curr == old) {
-                        xas_store(&xas, entry);
-                        if (xa_track_free(xa) && entry)
-                                xas_clear_mark(&xas, XA_FREE_MARK);
-                }
-                xas_unlock(&xas);
-        } while (xas_nomem(&xas, gfp));
+        xa_lock(xa);
+        curr = __xa_store(xa, index, entry, gfp);
+        xa_unlock(xa);
 
-        return xas_result(&xas, curr);
+        return curr;
 }
-EXPORT_SYMBOL(xa_cmpxchg);
+EXPORT_SYMBOL(xa_store);
 
 /**
  * __xa_cmpxchg() - Store this entry in the XArray.
@@ -1471,6 +1448,8 @@ void *__xa_cmpxchg(struct xarray *xa, unsigned long index,
 
         if (WARN_ON_ONCE(xa_is_internal(entry)))
                 return XA_ERROR(-EINVAL);
+        if (xa_track_free(xa) && !entry)
+                entry = XA_ZERO_ENTRY;
 
         do {
                 curr = xas_load(&xas);
@@ -1478,7 +1457,7 @@ void *__xa_cmpxchg(struct xarray *xa, unsigned long index,
                         curr = NULL;
                 if (curr == old) {
                         xas_store(&xas, entry);
-                        if (xa_track_free(xa) && entry)
+                        if (xa_track_free(xa))
                                 xas_clear_mark(&xas, XA_FREE_MARK);
                 }
         } while (__xas_nomem(&xas, gfp));
@@ -1488,7 +1467,7 @@ void *__xa_cmpxchg(struct xarray *xa, unsigned long index,
 EXPORT_SYMBOL(__xa_cmpxchg);
 
 /**
- * xa_reserve() - Reserve this index in the XArray.
+ * __xa_reserve() - Reserve this index in the XArray.
  * @xa: XArray.
  * @index: Index into array.
  * @gfp: Memory allocation flags.
@@ -1496,33 +1475,32 @@ EXPORT_SYMBOL(__xa_cmpxchg);
  * Ensures there is somewhere to store an entry at @index in the array.
  * If there is already something stored at @index, this function does
  * nothing.  If there was nothing there, the entry is marked as reserved.
- * Loads from @index will continue to see a %NULL pointer until a
- * subsequent store to @index.
+ * Loading from a reserved entry returns a %NULL pointer.
  *
  * If you do not use the entry that you have reserved, call xa_release()
  * or xa_erase() to free any unnecessary memory.
  *
- * Context: Process context.  Takes and releases the xa_lock, IRQ or BH safe
- * if specified in XArray flags.  May sleep if the @gfp flags permit.
+ * Context: Any context.  Expects the xa_lock to be held on entry.  May
+ * release the lock, sleep and reacquire the lock if the @gfp flags permit.
  * Return: 0 if the reservation succeeded or -ENOMEM if it failed.
  */
-int xa_reserve(struct xarray *xa, unsigned long index, gfp_t gfp)
+int __xa_reserve(struct xarray *xa, unsigned long index, gfp_t gfp)
 {
         XA_STATE(xas, xa, index);
-        unsigned int lock_type = xa_lock_type(xa);
         void *curr;
 
         do {
-                xas_lock_type(&xas, lock_type);
                 curr = xas_load(&xas);
-                if (!curr)
+                if (!curr) {
                         xas_store(&xas, XA_ZERO_ENTRY);
-                xas_unlock_type(&xas, lock_type);
-        } while (xas_nomem(&xas, gfp));
+                        if (xa_track_free(xa))
+                                xas_clear_mark(&xas, XA_FREE_MARK);
+                }
+        } while (__xas_nomem(&xas, gfp));
 
         return xas_error(&xas);
 }
-EXPORT_SYMBOL(xa_reserve);
+EXPORT_SYMBOL(__xa_reserve);
 
 #ifdef CONFIG_XARRAY_MULTI
 static void xas_set_range(struct xa_state *xas, unsigned long first,
@@ -1587,8 +1565,9 @@ void *xa_store_range(struct xarray *xa, unsigned long first,
         do {
                 xas_lock(&xas);
                 if (entry) {
-                        unsigned int order = (last == ~0UL) ? 64 :
-                                                ilog2(last + 1);
+                        unsigned int order = BITS_PER_LONG;
+                        if (last + 1)
+                                order = __ffs(last + 1);
                         xas_set_order(&xas, last, order);
                         xas_create(&xas);
                         if (xas_error(&xas))
@@ -1662,7 +1641,7 @@ EXPORT_SYMBOL(__xa_alloc);
  * @index: Index of entry.
  * @mark: Mark number.
  *
- * Attempting to set a mark on a NULL entry does not succeed.
+ * Attempting to set a mark on a %NULL entry does not succeed.
  *
  * Context: Any context.  Expects xa_lock to be held on entry.
  */
@@ -1674,7 +1653,7 @@ void __xa_set_mark(struct xarray *xa, unsigned long index, xa_mark_t mark)
         if (entry)
                 xas_set_mark(&xas, mark);
 }
-EXPORT_SYMBOL_GPL(__xa_set_mark);
+EXPORT_SYMBOL(__xa_set_mark);
 
 /**
  * __xa_clear_mark() - Clear this mark on this entry while locked.
@@ -1692,7 +1671,7 @@ void __xa_clear_mark(struct xarray *xa, unsigned long index, xa_mark_t mark)
         if (entry)
                 xas_clear_mark(&xas, mark);
 }
-EXPORT_SYMBOL_GPL(__xa_clear_mark);
+EXPORT_SYMBOL(__xa_clear_mark);
 
 /**
  * xa_get_mark() - Inquire whether this mark is set on this entry.
@@ -1732,7 +1711,7 @@ EXPORT_SYMBOL(xa_get_mark);
  * @index: Index of entry.
  * @mark: Mark number.
  *
- * Attempting to set a mark on a NULL entry does not succeed.
+ * Attempting to set a mark on a %NULL entry does not succeed.
  *
  * Context: Process context.  Takes and releases the xa_lock.
  */
@@ -1829,6 +1808,8 @@ void *xa_find_after(struct xarray *xa, unsigned long *indexp,
                         entry = xas_find_marked(&xas, max, filter);
                 else
                         entry = xas_find(&xas, max);
+                if (xas.xa_node == XAS_BOUNDS)
+                        break;
                 if (xas.xa_shift) {
                         if (xas.xa_index & ((1UL << xas.xa_shift) - 1))
                                 continue;
@@ -1899,7 +1880,7 @@ static unsigned int xas_extract_marked(struct xa_state *xas, void **dst,
  *
  * The @filter may be an XArray mark value, in which case entries which are
  * marked with that mark will be copied.  It may also be %XA_PRESENT, in
- * which case all entries which are not NULL will be copied.
+ * which case all entries which are not %NULL will be copied.
  *
  * The entries returned may not represent a snapshot of the XArray at a
  * moment in time.  For example, if another thread stores to index 5, then
diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
index 9f481cfdf77d..e8090f099eb8 100644
--- a/net/batman-adv/bat_v_elp.c
+++ b/net/batman-adv/bat_v_elp.c
@@ -352,19 +352,21 @@ out:
  */
 int batadv_v_elp_iface_enable(struct batadv_hard_iface *hard_iface)
 {
+        static const size_t tvlv_padding = sizeof(__be32);
         struct batadv_elp_packet *elp_packet;
         unsigned char *elp_buff;
         u32 random_seqno;
         size_t size;
         int res = -ENOMEM;
 
-        size = ETH_HLEN + NET_IP_ALIGN + BATADV_ELP_HLEN;
+        size = ETH_HLEN + NET_IP_ALIGN + BATADV_ELP_HLEN + tvlv_padding;
         hard_iface->bat_v.elp_skb = dev_alloc_skb(size);
         if (!hard_iface->bat_v.elp_skb)
                 goto out;
 
         skb_reserve(hard_iface->bat_v.elp_skb, ETH_HLEN + NET_IP_ALIGN);
-        elp_buff = skb_put_zero(hard_iface->bat_v.elp_skb, BATADV_ELP_HLEN);
+        elp_buff = skb_put_zero(hard_iface->bat_v.elp_skb,
+                                BATADV_ELP_HLEN + tvlv_padding);
         elp_packet = (struct batadv_elp_packet *)elp_buff;
 
         elp_packet->packet_type = BATADV_ELP;
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 0fddc17106bd..5b71a289d04f 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -275,7 +275,7 @@ batadv_frag_merge_packets(struct hlist_head *chain)
         kfree(entry);
 
         packet = (struct batadv_frag_packet *)skb_out->data;
-        size = ntohs(packet->total_size);
+        size = ntohs(packet->total_size) + hdr_size;
 
         /* Make room for the rest of the fragments. */
         if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 2920e06a5403..04c19a37e500 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -102,12 +102,18 @@ struct br_tunnel_info {
         struct metadata_dst     *tunnel_dst;
 };
 
+/* private vlan flags */
+enum {
+        BR_VLFLAG_PER_PORT_STATS = BIT(0),
+};
+
 /**
  * struct net_bridge_vlan - per-vlan entry
  *
  * @vnode: rhashtable member
  * @vid: VLAN id
  * @flags: bridge vlan flags
+ * @priv_flags: private (in-kernel) bridge vlan flags
  * @stats: per-cpu VLAN statistics
  * @br: if MASTER flag set, this points to a bridge struct
  * @port: if MASTER flag unset, this points to a port struct
@@ -127,6 +133,7 @@ struct net_bridge_vlan {
         struct rhash_head               tnode;
         u16                             vid;
         u16                             flags;
+        u16                             priv_flags;
         struct br_vlan_stats __percpu   *stats;
         union {
                 struct net_bridge       *br;
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 8c9297a01947..e84be08b8285 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -197,7 +197,7 @@ static void nbp_vlan_rcu_free(struct rcu_head *rcu)
         v = container_of(rcu, struct net_bridge_vlan, rcu);
         WARN_ON(br_vlan_is_master(v));
         /* if we had per-port stats configured then free them here */
-        if (v->brvlan->stats != v->stats)
+        if (v->priv_flags & BR_VLFLAG_PER_PORT_STATS)
                 free_percpu(v->stats);
         v->stats = NULL;
         kfree(v);
@@ -264,6 +264,7 @@ static int __vlan_add(struct net_bridge_vlan *v, u16 flags)
                                 err = -ENOMEM;
                                 goto out_filt;
                         }
+                        v->priv_flags |= BR_VLFLAG_PER_PORT_STATS;
                 } else {
                         v->stats = masterv->stats;
                 }
diff --git a/net/can/raw.c b/net/can/raw.c
index 1051eee82581..3aab7664933f 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -745,18 +745,19 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
         } else
                 ifindex = ro->ifindex;
 
-        if (ro->fd_frames) {
+        dev = dev_get_by_index(sock_net(sk), ifindex);
+        if (!dev)
+                return -ENXIO;
+
+        err = -EINVAL;
+        if (ro->fd_frames && dev->mtu == CANFD_MTU) {
                 if (unlikely(size != CANFD_MTU && size != CAN_MTU))
-                        return -EINVAL;
+                        goto put_dev;
         } else {
                 if (unlikely(size != CAN_MTU))
-                        return -EINVAL;
+                        goto put_dev;
         }
 
-        dev = dev_get_by_index(sock_net(sk), ifindex);
-        if (!dev)
-                return -ENXIO;
-
         skb = sock_alloc_send_skb(sk, size + sizeof(struct can_skb_priv),
                                   msg->msg_flags & MSG_DONTWAIT, &err);
         if (!skb)
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 57fcc6b4bf6e..2f126eff275d 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -580,9 +580,15 @@ static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
         struct bio_vec bvec;
         int ret;
 
-        /* sendpage cannot properly handle pages with page_count == 0,
-         * we need to fallback to sendmsg if that's the case */
-        if (page_count(page) >= 1)
+        /*
+         * sendpage cannot properly handle pages with page_count == 0,
+         * we need to fall back to sendmsg if that's the case.
+         *
+         * Same goes for slab pages: skb_can_coalesce() allows
+         * coalescing neighboring slab objects into a single frag which
+         * triggers one of hardened usercopy checks.
+         */
+        if (page_count(page) >= 1 && !PageSlab(page))
                 return __ceph_tcp_sendpage(sock, page, offset, size, more);
 
         bvec.bv_page = page;
diff --git a/net/core/dev.c b/net/core/dev.c
index 0ffcbdd55fa9..ddc551f24ba2 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5655,6 +5655,10 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
         skb->vlan_tci = 0;
         skb->dev = napi->dev;
         skb->skb_iif = 0;
+
+        /* eth_type_trans() assumes pkt_type is PACKET_HOST */
+        skb->pkt_type = PACKET_HOST;
+
         skb->encapsulation = 0;
         skb_shinfo(skb)->gso_type = 0;
         skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
@@ -5966,11 +5970,14 @@ bool napi_complete_done(struct napi_struct *n, int work_done)
                 if (work_done)
                         timeout = n->dev->gro_flush_timeout;
 
+                /* When the NAPI instance uses a timeout and keeps postponing
+                 * it, we need to bound somehow the time packets are kept in
+                 * the GRO layer
+                 */
+                napi_gro_flush(n, !!timeout);
                 if (timeout)
                         hrtimer_start(&n->timer, ns_to_ktime(timeout),
                                       HRTIMER_MODE_REL_PINNED);
-                else
-                        napi_gro_flush(n, false);
         }
         if (unlikely(!list_empty(&n->poll_list))) {
                 /* If n->poll_list is not empty, we need to mask irqs */
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index b4ee5c8b928f..a8217e221e19 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4854,6 +4854,11 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
         nf_reset(skb);
         nf_reset_trace(skb);
 
+#ifdef CONFIG_NET_SWITCHDEV
+        skb->offload_fwd_mark = 0;
+        skb->offload_mr_fwd_mark = 0;
+#endif
+
         if (!xnet)
                 return;
 
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index dde671e97829..c248e0dccbe1 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -80,7 +80,7 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
 
         iph->version    =       4;
         iph->ihl        =       sizeof(struct iphdr) >> 2;
-        iph->frag_off   =       df;
+        iph->frag_off   =       ip_mtu_locked(&rt->dst) ? 0 : df;
         iph->protocol   =       proto;
         iph->tos        =       tos;
         iph->daddr      =       dst;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2868ef28ce52..1e37c1388189 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4268,7 +4268,7 @@ static void tcp_sack_new_ofo_skb(struct sock *sk, u32 seq, u32 end_seq)
          * If the sack array is full, forget about the last one.
          */
         if (this_sack >= TCP_NUM_SACKS) {
-                if (tp->compressed_ack)
+                if (tp->compressed_ack > TCP_FASTRETRANS_THRESH)
                         tcp_send_ack(sk);
                 this_sack--;
                 tp->rx_opt.num_sacks--;
@@ -4363,6 +4363,7 @@ static bool tcp_try_coalesce(struct sock *sk,
         if (TCP_SKB_CB(from)->has_rxtstamp) {
                 TCP_SKB_CB(to)->has_rxtstamp = true;
                 to->tstamp = from->tstamp;
+                skb_hwtstamps(to)->hwtstamp = skb_hwtstamps(from)->hwtstamp;
         }
 
         return true;
@@ -5188,7 +5189,17 @@ send_now:
         if (!tcp_is_sack(tp) ||
             tp->compressed_ack >= sock_net(sk)->ipv4.sysctl_tcp_comp_sack_nr)
                 goto send_now;
-        tp->compressed_ack++;
+
+        if (tp->compressed_ack_rcv_nxt != tp->rcv_nxt) {
+                tp->compressed_ack_rcv_nxt = tp->rcv_nxt;
+                if (tp->compressed_ack > TCP_FASTRETRANS_THRESH)
+                        NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPACKCOMPRESSED,
+                                      tp->compressed_ack - TCP_FASTRETRANS_THRESH);
+                tp->compressed_ack = 0;
+        }
+
+        if (++tp->compressed_ack <= TCP_FASTRETRANS_THRESH)
+                goto send_now;
 
         if (hrtimer_is_queued(&tp->compressed_ack_timer))
                 return;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 9c34b97d365d..3f510cad0b3e 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -180,10 +180,10 @@ static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts,
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
-        if (unlikely(tp->compressed_ack)) {
+        if (unlikely(tp->compressed_ack > TCP_FASTRETRANS_THRESH)) {
                 NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPACKCOMPRESSED,
-                              tp->compressed_ack);
-                tp->compressed_ack = 0;
+                              tp->compressed_ack - TCP_FASTRETRANS_THRESH);
+                tp->compressed_ack = TCP_FASTRETRANS_THRESH;
                 if (hrtimer_try_to_cancel(&tp->compressed_ack_timer) == 1)
                         __sock_put(sk);
         }
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 676020663ce8..5f8b6d3cd855 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -740,7 +740,7 @@ static enum hrtimer_restart tcp_compressed_ack_kick(struct hrtimer *timer)
 
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk)) {
-                if (tp->compressed_ack)
+                if (tp->compressed_ack > TCP_FASTRETRANS_THRESH)
                         tcp_send_ack(sk);
         } else {
                 if (!test_and_set_bit(TCP_DELACK_TIMER_DEFERRED,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 63a808d5af15..045597b9a7c0 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -179,7 +179,7 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp);
 static void addrconf_dad_work(struct work_struct *w);
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
                                    bool send_na);
-static void addrconf_dad_run(struct inet6_dev *idev);
+static void addrconf_dad_run(struct inet6_dev *idev, bool restart);
 static void addrconf_rs_timer(struct timer_list *t);
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
@@ -3439,6 +3439,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                            void *ptr)
 {
         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct netdev_notifier_change_info *change_info;
         struct netdev_notifier_changeupper_info *info;
         struct inet6_dev *idev = __in6_dev_get(dev);
         struct net *net = dev_net(dev);
@@ -3513,7 +3514,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                                 break;
                         }
 
-                        if (idev) {
+                        if (!IS_ERR_OR_NULL(idev)) {
                                 if (idev->if_flags & IF_READY) {
                                         /* device is already configured -
                                          * but resend MLD reports, we might
@@ -3521,6 +3522,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                                          * multicast snooping switches
                                          */
                                         ipv6_mc_up(idev);
+                                        change_info = ptr;
+                                        if (change_info->flags_changed & IFF_NOARP)
+                                                addrconf_dad_run(idev, true);
                                         rt6_sync_up(dev, RTNH_F_LINKDOWN);
                                         break;
                                 }
@@ -3555,7 +3559,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 
                 if (!IS_ERR_OR_NULL(idev)) {
                         if (run_pending)
-                                addrconf_dad_run(idev);
+                                addrconf_dad_run(idev, false);
 
                         /* Device has an address by now */
                         rt6_sync_up(dev, RTNH_F_DEAD);
@@ -4173,16 +4177,19 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
                 addrconf_verify_rtnl();
 }
 
-static void addrconf_dad_run(struct inet6_dev *idev)
+static void addrconf_dad_run(struct inet6_dev *idev, bool restart)
 {
         struct inet6_ifaddr *ifp;
 
         read_lock_bh(&idev->lock);
         list_for_each_entry(ifp, &idev->addr_list, if_list) {
                 spin_lock(&ifp->lock);
-                if (ifp->flags & IFA_F_TENTATIVE &&
-                    ifp->state == INET6_IFADDR_STATE_DAD)
+                if ((ifp->flags & IFA_F_TENTATIVE &&
+                     ifp->state == INET6_IFADDR_STATE_DAD) || restart) {
+                        if (restart)
+                                ifp->state = INET6_IFADDR_STATE_PREDAD;
                         addrconf_dad_kick(ifp);
+                }
                 spin_unlock(&ifp->lock);
         }
         read_unlock_bh(&idev->lock);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 2a7423c39456..059f0531f7c1 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2232,8 +2232,7 @@ static void ip6_link_failure(struct sk_buff *skb)
         if (rt) {
                 rcu_read_lock();
                 if (rt->rt6i_flags & RTF_CACHE) {
-                        if (dst_hold_safe(&rt->dst))
-                                rt6_remove_exception_rt(rt);
+                        rt6_remove_exception_rt(rt);
                 } else {
                         struct fib6_info *from;
                         struct fib6_node *fn;
@@ -2360,10 +2359,13 @@ EXPORT_SYMBOL_GPL(ip6_update_pmtu);
 
 void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu)
 {
+        int oif = sk->sk_bound_dev_if;
         struct dst_entry *dst;
 
-        ip6_update_pmtu(skb, sock_net(sk), mtu,
-                        sk->sk_bound_dev_if, sk->sk_mark, sk->sk_uid);
+        if (!oif && skb->dev)
+                oif = l3mdev_master_ifindex(skb->dev);
+
+        ip6_update_pmtu(skb, sock_net(sk), mtu, oif, sk->sk_mark, sk->sk_uid);
 
         dst = __sk_dst_get(sk);
         if (!dst || !dst->obsolete ||
@@ -3214,8 +3216,8 @@ static int ip6_del_cached_rt(struct rt6_info *rt, struct fib6_config *cfg)
         if (cfg->fc_flags & RTF_GATEWAY &&
             !ipv6_addr_equal(&cfg->fc_gateway, &rt->rt6i_gateway))
                 goto out;
-        if (dst_hold_safe(&rt->dst))
-                rc = rt6_remove_exception_rt(rt);
+
+        rc = rt6_remove_exception_rt(rt);
 out:
         return rc;
 }
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 82cdf9020b53..26f1d435696a 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1490,12 +1490,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
                         goto err_sock;
         }
 
-        sk = sock->sk;
-
-        sock_hold(sk);
-        tunnel->sock = sk;
         tunnel->l2tp_net = net;
-
         pn = l2tp_pernet(net);
 
         spin_lock_bh(&pn->l2tp_tunnel_list_lock);
@@ -1510,6 +1505,10 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
         list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
         spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
 
+        sk = sock->sk;
+        sock_hold(sk);
+        tunnel->sock = sk;
+
         if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
                 struct udp_tunnel_sock_cfg udp_cfg = {
                         .sk_user_data = tunnel,
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ec3095f13aae..a74650e98f42 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2394,7 +2394,7 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
                 void *ph;
                 __u32 ts;
 
-                ph = skb_shinfo(skb)->destructor_arg;
+                ph = skb_zcopy_get_nouarg(skb);
                 packet_dec_pending(&po->tx_ring);
 
                 ts = __packet_set_timestamp(po, ph, skb);
@@ -2461,7 +2461,7 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
         skb->mark = po->sk.sk_mark;
         skb->tstamp = sockc->transmit_time;
         sock_tx_timestamp(&po->sk, sockc->tsflags, &skb_shinfo(skb)->tx_flags);
-        skb_shinfo(skb)->destructor_arg = ph.raw;
+        skb_zcopy_set_nouarg(skb, ph.raw);
 
         skb_reserve(skb, hlen);
         skb_reset_network_header(skb);
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 64362d078da8..a2522f9d71e2 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -375,17 +375,36 @@ EXPORT_SYMBOL(rxrpc_kernel_end_call);
  * getting ACKs from the server.  Returns a number representing the life state
  * which can be compared to that returned by a previous call.
  *
- * If this is a client call, ping ACKs will be sent to the server to find out
- * whether it's still responsive and whether the call is still alive on the
- * server.
+ * If the life state stalls, rxrpc_kernel_probe_life() should be called and
+ * then 2RTT waited.
  */
-u32 rxrpc_kernel_check_life(struct socket *sock, struct rxrpc_call *call)
+u32 rxrpc_kernel_check_life(const struct socket *sock,
+                            const struct rxrpc_call *call)
 {
         return call->acks_latest;
 }
 EXPORT_SYMBOL(rxrpc_kernel_check_life);
 
 /**
+ * rxrpc_kernel_probe_life - Poke the peer to see if it's still alive
+ * @sock: The socket the call is on
+ * @call: The call to check
+ *
+ * In conjunction with rxrpc_kernel_check_life(), allow a kernel service to
+ * find out whether a call is still alive by pinging it.  This should cause the
+ * life state to be bumped in about 2*RTT.
+ *
+ * The must be called in TASK_RUNNING state on pain of might_sleep() objecting.
+ */
+void rxrpc_kernel_probe_life(struct socket *sock, struct rxrpc_call *call)
+{
+        rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, 0, true, false,
+                          rxrpc_propose_ack_ping_for_check_life);
+        rxrpc_send_ack_packet(call, true, NULL);
+}
+EXPORT_SYMBOL(rxrpc_kernel_probe_life);
+
+/**
  * rxrpc_kernel_get_epoch - Retrieve the epoch value from a call.
  * @sock: The socket the call is on
  * @call: The call to query
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index da3dd0f68cc2..2b372a06b432 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -201,7 +201,8 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
                         goto out_release;
                 }
         } else {
-                return err;
+                ret = err;
+                goto out_free;
         }
 
         p = to_pedit(*a);
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 052855d47354..37c9b8f0e10f 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -27,10 +27,7 @@ struct tcf_police_params {
         u32                     tcfp_ewma_rate;
         s64                     tcfp_burst;
         u32                     tcfp_mtu;
-        s64                     tcfp_toks;
-        s64                     tcfp_ptoks;
         s64                     tcfp_mtu_ptoks;
-        s64                     tcfp_t_c;
         struct psched_ratecfg   rate;
         bool                    rate_present;
         struct psched_ratecfg   peak;
@@ -41,6 +38,11 @@ struct tcf_police_params {
 struct tcf_police {
         struct tc_action        common;
         struct tcf_police_params __rcu *params;
+
+        spinlock_t              tcfp_lock ____cacheline_aligned_in_smp;
+        s64                     tcfp_toks;
+        s64                     tcfp_ptoks;
+        s64                     tcfp_t_c;
 };
 
 #define to_police(pc) ((struct tcf_police *)pc)
@@ -122,6 +124,7 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
                         return ret;
                 }
                 ret = ACT_P_CREATED;
+                spin_lock_init(&(to_police(*a)->tcfp_lock));
         } else if (!ovr) {
                 tcf_idr_release(*a, bind);
                 return -EEXIST;
@@ -186,12 +189,9 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
         }
 
         new->tcfp_burst = PSCHED_TICKS2NS(parm->burst);
-        new->tcfp_toks = new->tcfp_burst;
-        if (new->peak_present) {
+        if (new->peak_present)
                 new->tcfp_mtu_ptoks = (s64)psched_l2t_ns(&new->peak,
                                                          new->tcfp_mtu);
-                new->tcfp_ptoks = new->tcfp_mtu_ptoks;
-        }
 
         if (tb[TCA_POLICE_AVRATE])
                 new->tcfp_ewma_rate = nla_get_u32(tb[TCA_POLICE_AVRATE]);
@@ -207,7 +207,12 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
         }
 
         spin_lock_bh(&police->tcf_lock);
-        new->tcfp_t_c = ktime_get_ns();
+        spin_lock_bh(&police->tcfp_lock);
+        police->tcfp_t_c = ktime_get_ns();
+        police->tcfp_toks = new->tcfp_burst;
+        if (new->peak_present)
+                police->tcfp_ptoks = new->tcfp_mtu_ptoks;
+        spin_unlock_bh(&police->tcfp_lock);
         police->tcf_action = parm->action;
         rcu_swap_protected(police->params,
                            new,
@@ -257,25 +262,28 @@ static int tcf_police_act(struct sk_buff *skb, const struct tc_action *a,
                 }
 
                 now = ktime_get_ns();
-                toks = min_t(s64, now - p->tcfp_t_c, p->tcfp_burst);
+                spin_lock_bh(&police->tcfp_lock);
+                toks = min_t(s64, now - police->tcfp_t_c, p->tcfp_burst);
                 if (p->peak_present) {
-                        ptoks = toks + p->tcfp_ptoks;
+                        ptoks = toks + police->tcfp_ptoks;
                         if (ptoks > p->tcfp_mtu_ptoks)
                                 ptoks = p->tcfp_mtu_ptoks;
                         ptoks -= (s64)psched_l2t_ns(&p->peak,
                                                     qdisc_pkt_len(skb));
                 }
-                toks += p->tcfp_toks;
+                toks += police->tcfp_toks;
                 if (toks > p->tcfp_burst)
                         toks = p->tcfp_burst;
                 toks -= (s64)psched_l2t_ns(&p->rate, qdisc_pkt_len(skb));
                 if ((toks|ptoks) >= 0) {
-                        p->tcfp_t_c = now;
-                        p->tcfp_toks = toks;
-                        p->tcfp_ptoks = ptoks;
+                        police->tcfp_t_c = now;
+                        police->tcfp_toks = toks;
+                        police->tcfp_ptoks = ptoks;
+                        spin_unlock_bh(&police->tcfp_lock);
                         ret = p->tcfp_result;
                         goto inc_drops;
                 }
+                spin_unlock_bh(&police->tcfp_lock);
         }
 
 inc_overlimits:
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 4b1af706896c..25a7cf6d380f 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -469,22 +469,29 @@ begin:
                 goto begin;
         }
         prefetch(&skb->end);
-        f->credit -= qdisc_pkt_len(skb);
+        plen = qdisc_pkt_len(skb);
+        f->credit -= plen;
 
-        if (ktime_to_ns(skb->tstamp) || !q->rate_enable)
+        if (!q->rate_enable)
                 goto out;
 
         rate = q->flow_max_rate;
-        if (skb->sk)
-                rate = min(skb->sk->sk_pacing_rate, rate);
-
-        if (rate <= q->low_rate_threshold) {
-                f->credit = 0;
-                plen = qdisc_pkt_len(skb);
-        } else {
-                plen = max(qdisc_pkt_len(skb), q->quantum);
-                if (f->credit > 0)
-                        goto out;
+
+        /* If EDT time was provided for this skb, we need to
+         * update f->time_next_packet only if this qdisc enforces
+         * a flow max rate.
+         */
+        if (!skb->tstamp) {
+                if (skb->sk)
+                        rate = min(skb->sk->sk_pacing_rate, rate);
+
+                if (rate <= q->low_rate_threshold) {
+                        f->credit = 0;
+                } else {
+                        plen = max(plen, q->quantum);
+                        if (f->credit > 0)
+                                goto out;
+                }
         }
         if (rate != ~0UL) {
                 u64 len = (u64)plen * NSEC_PER_SEC;
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 67939ad99c01..b0e74a3e77ec 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -118,6 +118,9 @@ void sctp_packet_config(struct sctp_packet *packet, __u32 vtag,
                 sctp_transport_route(tp, NULL, sp);
                 if (asoc->param_flags & SPP_PMTUD_ENABLE)
                         sctp_assoc_sync_pmtu(asoc);
+        } else if (!sctp_transport_pmtu_check(tp)) {
+                if (asoc->param_flags & SPP_PMTUD_ENABLE)
+                        sctp_assoc_sync_pmtu(asoc);
         }
 
         if (asoc->pmtu_pending) {
@@ -396,25 +399,6 @@ finish:
         return retval;
 }
 
-static void sctp_packet_release_owner(struct sk_buff *skb)
-{
-        sk_free(skb->sk);
-}
-
-static void sctp_packet_set_owner_w(struct sk_buff *skb, struct sock *sk)
-{
-        skb_orphan(skb);
-        skb->sk = sk;
-        skb->destructor = sctp_packet_release_owner;
-
-        /*
-         * The data chunks have already been accounted for in sctp_sendmsg(),
-         * therefore only reserve a single byte to keep socket around until
-         * the packet has been transmitted.
-         */
-        refcount_inc(&sk->sk_wmem_alloc);
-}
-
 static void sctp_packet_gso_append(struct sk_buff *head, struct sk_buff *skb)
 {
         if (SCTP_OUTPUT_CB(head)->last == head)
@@ -601,7 +585,7 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
         if (!head)
                 goto out;
         skb_reserve(head, packet->overhead + MAX_HEADER);
-        sctp_packet_set_owner_w(head, sk);
+        skb_set_owner_w(head, sk);
 
         /* set sctp header */
         sh = skb_push(head, sizeof(struct sctphdr));
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 739f3e50120d..bf618d1b41fd 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3940,32 +3940,16 @@ static int sctp_setsockopt_pr_supported(struct sock *sk,
                                         unsigned int optlen)
 {
         struct sctp_assoc_value params;
-        struct sctp_association *asoc;
-        int retval = -EINVAL;
 
         if (optlen != sizeof(params))
-                goto out;
-
-        if (copy_from_user(&params, optval, optlen)) {
-                retval = -EFAULT;
-                goto out;
-        }
-
-        asoc = sctp_id2assoc(sk, params.assoc_id);
-        if (asoc) {
-                asoc->prsctp_enable = !!params.assoc_value;
-        } else if (!params.assoc_id) {
-                struct sctp_sock *sp = sctp_sk(sk);
+                return -EINVAL;
 
-                sp->ep->prsctp_enable = !!params.assoc_value;
-        } else {
-                goto out;
-        }
+        if (copy_from_user(&params, optval, optlen))
+                return -EFAULT;
 
-        retval = 0;
+        sctp_sk(sk)->ep->prsctp_enable = !!params.assoc_value;
 
-out:
-        return retval;
+        return 0;
 }
 
 static int sctp_setsockopt_default_prinfo(struct sock *sk,
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index ffb940d3b57c..3892e7630f3a 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -535,7 +535,6 @@ int sctp_send_add_streams(struct sctp_association *asoc,
                 goto out;
         }
 
-        stream->incnt = incnt;
         stream->outcnt = outcnt;
 
         asoc->strreset_outstanding = !!out + !!in;
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 80e2119f1c70..5fbaf1901571 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -127,6 +127,8 @@ static int smc_release(struct socket *sock)
         smc = smc_sk(sk);
 
         /* cleanup for a dangling non-blocking connect */
+        if (smc->connect_info && sk->sk_state == SMC_INIT)
+                tcp_abort(smc->clcsock->sk, ECONNABORTED);
         flush_work(&smc->connect_work);
         kfree(smc->connect_info);
         smc->connect_info = NULL;
@@ -547,7 +549,8 @@ static int smc_connect_rdma(struct smc_sock *smc,
 
         mutex_lock(&smc_create_lgr_pending);
         local_contact = smc_conn_create(smc, false, aclc->hdr.flag, ibdev,
-                                        ibport, &aclc->lcl, NULL, 0);
+                                        ibport, ntoh24(aclc->qpn), &aclc->lcl,
+                                        NULL, 0);
         if (local_contact < 0) {
                 if (local_contact == -ENOMEM)
                         reason_code = SMC_CLC_DECL_MEM;/* insufficient memory*/
@@ -618,7 +621,7 @@ static int smc_connect_ism(struct smc_sock *smc,
         int rc = 0;
 
         mutex_lock(&smc_create_lgr_pending);
-        local_contact = smc_conn_create(smc, true, aclc->hdr.flag, NULL, 0,
+        local_contact = smc_conn_create(smc, true, aclc->hdr.flag, NULL, 0, 0,
                                         NULL, ismdev, aclc->gid);
         if (local_contact < 0)
                 return smc_connect_abort(smc, SMC_CLC_DECL_MEM, 0);
@@ -1083,7 +1086,7 @@ static int smc_listen_rdma_init(struct smc_sock *new_smc,
                                 int *local_contact)
 {
         /* allocate connection / link group */
-        *local_contact = smc_conn_create(new_smc, false, 0, ibdev, ibport,
+        *local_contact = smc_conn_create(new_smc, false, 0, ibdev, ibport, 0,
                                          &pclc->lcl, NULL, 0);
         if (*local_contact < 0) {
                 if (*local_contact == -ENOMEM)
@@ -1107,7 +1110,7 @@ static int smc_listen_ism_init(struct smc_sock *new_smc,
         struct smc_clc_msg_smcd *pclc_smcd;
 
         pclc_smcd = smc_get_clc_msg_smcd(pclc);
-        *local_contact = smc_conn_create(new_smc, true, 0, NULL, 0, NULL,
+        *local_contact = smc_conn_create(new_smc, true, 0, NULL, 0, 0, NULL,
                                          ismdev, pclc_smcd->gid);
         if (*local_contact < 0) {
                 if (*local_contact == -ENOMEM)
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index ed5dcf03fe0b..db83332ac1c8 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -81,7 +81,7 @@ static inline void smc_cdc_add_pending_send(struct smc_connection *conn,
                 sizeof(struct smc_cdc_msg) > SMC_WR_BUF_SIZE,
                 "must increase SMC_WR_BUF_SIZE to at least sizeof(struct smc_cdc_msg)");
         BUILD_BUG_ON_MSG(
-                sizeof(struct smc_cdc_msg) != SMC_WR_TX_SIZE,
+                offsetofend(struct smc_cdc_msg, reserved) > SMC_WR_TX_SIZE,
                 "must adapt SMC_WR_TX_SIZE to sizeof(struct smc_cdc_msg); if not all smc_wr upper layer protocols use the same message size any more, must start to set link->wr_tx_sges[i].length on each individual smc_wr_tx_send()");
         BUILD_BUG_ON_MSG(
                 sizeof(struct smc_cdc_tx_pend) > SMC_WR_TX_PEND_PRIV_SIZE,
@@ -177,23 +177,24 @@ void smc_cdc_tx_dismiss_slots(struct smc_connection *conn)
 int smcd_cdc_msg_send(struct smc_connection *conn)
 {
         struct smc_sock *smc = container_of(conn, struct smc_sock, conn);
+        union smc_host_cursor curs;
         struct smcd_cdc_msg cdc;
         int rc, diff;
 
         memset(&cdc, 0, sizeof(cdc));
         cdc.common.type = SMC_CDC_MSG_TYPE;
-        cdc.prod_wrap = conn->local_tx_ctrl.prod.wrap;
-        cdc.prod_count = conn->local_tx_ctrl.prod.count;
-
-        cdc.cons_wrap = conn->local_tx_ctrl.cons.wrap;
-        cdc.cons_count = conn->local_tx_ctrl.cons.count;
-        cdc.prod_flags = conn->local_tx_ctrl.prod_flags;
-        cdc.conn_state_flags = conn->local_tx_ctrl.conn_state_flags;
+        curs.acurs.counter = atomic64_read(&conn->local_tx_ctrl.prod.acurs);
+        cdc.prod.wrap = curs.wrap;
+        cdc.prod.count = curs.count;
+        curs.acurs.counter = atomic64_read(&conn->local_tx_ctrl.cons.acurs);
+        cdc.cons.wrap = curs.wrap;
+        cdc.cons.count = curs.count;
+        cdc.cons.prod_flags = conn->local_tx_ctrl.prod_flags;
+        cdc.cons.conn_state_flags = conn->local_tx_ctrl.conn_state_flags;
         rc = smcd_tx_ism_write(conn, &cdc, sizeof(cdc), 0, 1);
         if (rc)
                 return rc;
-        smc_curs_copy(&conn->rx_curs_confirmed, &conn->local_tx_ctrl.cons,
-                      conn);
+        smc_curs_copy(&conn->rx_curs_confirmed, &curs, conn);
         /* Calculate transmitted data and increment free send buffer space */
         diff = smc_curs_diff(conn->sndbuf_desc->len, &conn->tx_curs_fin,
                              &conn->tx_curs_sent);
@@ -331,13 +332,16 @@ static void smc_cdc_msg_recv(struct smc_sock *smc, struct smc_cdc_msg *cdc)
 static void smcd_cdc_rx_tsklet(unsigned long data)
 {
         struct smc_connection *conn = (struct smc_connection *)data;
+        struct smcd_cdc_msg *data_cdc;
         struct smcd_cdc_msg cdc;
         struct smc_sock *smc;
 
         if (!conn)
                 return;
 
-        memcpy(&cdc, conn->rmb_desc->cpu_addr, sizeof(cdc));
+        data_cdc = (struct smcd_cdc_msg *)conn->rmb_desc->cpu_addr;
+        smcd_curs_copy(&cdc.prod, &data_cdc->prod, conn);
+        smcd_curs_copy(&cdc.cons, &data_cdc->cons, conn);
         smc = container_of(conn, struct smc_sock, conn);
         smc_cdc_msg_recv(smc, (struct smc_cdc_msg *)&cdc);
 }
diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
index 934df4473a7c..b5bfe38c7f9b 100644
--- a/net/smc/smc_cdc.h
+++ b/net/smc/smc_cdc.h
@@ -48,21 +48,31 @@ struct smc_cdc_msg {
         struct smc_cdc_producer_flags   prod_flags;
         struct smc_cdc_conn_state_flags conn_state_flags;
         u8                              reserved[18];
-} __packed;                                     /* format defined in RFC7609 */
+};
+
+/* SMC-D cursor format */
+union smcd_cdc_cursor {
+        struct {
+                u16     wrap;
+                u32     count;
+                struct smc_cdc_producer_flags   prod_flags;
+                struct smc_cdc_conn_state_flags conn_state_flags;
+        } __packed;
+#ifdef KERNEL_HAS_ATOMIC64
+        atomic64_t              acurs;          /* for atomic processing */
+#else
+        u64                     acurs;          /* for atomic processing */
+#endif
+} __aligned(8);
 
 /* CDC message for SMC-D */
 struct smcd_cdc_msg {
         struct smc_wr_rx_hdr common;    /* Type = 0xFE */
         u8 res1[7];
-        u16 prod_wrap;
-        u32 prod_count;
-        u8 res2[2];
-        u16 cons_wrap;
-        u32 cons_count;
-        struct smc_cdc_producer_flags   prod_flags;
-        struct smc_cdc_conn_state_flags conn_state_flags;
+        union smcd_cdc_cursor   prod;
+        union smcd_cdc_cursor   cons;
         u8 res3[8];
-} __packed;
+} __aligned(8);
 
 static inline bool smc_cdc_rxed_any_close(struct smc_connection *conn)
 {
@@ -135,6 +145,21 @@ static inline void smc_curs_copy_net(union smc_cdc_cursor *tgt,
 #endif
 }
 
+static inline void smcd_curs_copy(union smcd_cdc_cursor *tgt,
+                                  union smcd_cdc_cursor *src,
+                                  struct smc_connection *conn)
+{
+#ifndef KERNEL_HAS_ATOMIC64
+        unsigned long flags;
+
+        spin_lock_irqsave(&conn->acurs_lock, flags);
+        tgt->acurs = src->acurs;
+        spin_unlock_irqrestore(&conn->acurs_lock, flags);
+#else
+        atomic64_set(&tgt->acurs, atomic64_read(&src->acurs));
+#endif
+}
+
 /* calculate cursor difference between old and new, where old <= new */
 static inline int smc_curs_diff(unsigned int size,
                                 union smc_host_cursor *old,
@@ -222,12 +247,17 @@ static inline void smcr_cdc_msg_to_host(struct smc_host_cdc_msg *local,
 static inline void smcd_cdc_msg_to_host(struct smc_host_cdc_msg *local,
                                         struct smcd_cdc_msg *peer)
 {
-        local->prod.wrap = peer->prod_wrap;
-        local->prod.count = peer->prod_count;
-        local->cons.wrap = peer->cons_wrap;
-        local->cons.count = peer->cons_count;
-        local->prod_flags = peer->prod_flags;
-        local->conn_state_flags = peer->conn_state_flags;
+        union smc_host_cursor temp;
+
+        temp.wrap = peer->prod.wrap;
+        temp.count = peer->prod.count;
+        atomic64_set(&local->prod.acurs, atomic64_read(&temp.acurs));
+
+        temp.wrap = peer->cons.wrap;
+        temp.count = peer->cons.count;
+        atomic64_set(&local->cons.acurs, atomic64_read(&temp.acurs));
+        local->prod_flags = peer->cons.prod_flags;
+        local->conn_state_flags = peer->cons.conn_state_flags;
 }
 
 static inline void smc_cdc_msg_to_host(struct smc_host_cdc_msg *local,
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 18daebcef181..1c9fa7f0261a 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -184,6 +184,8 @@ free:
 
                 if (!lgr->is_smcd && lnk->state != SMC_LNK_INACTIVE)
                         smc_llc_link_inactive(lnk);
+                if (lgr->is_smcd)
+                        smc_ism_signal_shutdown(lgr);
                 smc_lgr_free(lgr);
         }
 }
@@ -485,7 +487,7 @@ void smc_port_terminate(struct smc_ib_device *smcibdev, u8 ibport)
 }
 
 /* Called when SMC-D device is terminated or peer is lost */
-void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid)
+void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid, unsigned short vlan)
 {
         struct smc_link_group *lgr, *l;
         LIST_HEAD(lgr_free_list);
@@ -495,7 +497,7 @@ void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid)
         list_for_each_entry_safe(lgr, l, &smc_lgr_list.list, list) {
                 if (lgr->is_smcd && lgr->smcd == dev &&
                     (!peer_gid || lgr->peer_gid == peer_gid) &&
-                    !list_empty(&lgr->list)) {
+                    (vlan == VLAN_VID_MASK || lgr->vlan_id == vlan)) {
                         __smc_lgr_terminate(lgr);
                         list_move(&lgr->list, &lgr_free_list);
                 }
@@ -506,6 +508,8 @@ void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid)
         list_for_each_entry_safe(lgr, l, &lgr_free_list, list) {
                 list_del_init(&lgr->list);
                 cancel_delayed_work_sync(&lgr->free_work);
+                if (!peer_gid && vlan == VLAN_VID_MASK) /* dev terminated? */
+                        smc_ism_signal_shutdown(lgr);
                 smc_lgr_free(lgr);
         }
 }
@@ -559,7 +563,7 @@ out:
 
 static bool smcr_lgr_match(struct smc_link_group *lgr,
                            struct smc_clc_msg_local *lcl,
-                           enum smc_lgr_role role)
+                           enum smc_lgr_role role, u32 clcqpn)
 {
         return !memcmp(lgr->peer_systemid, lcl->id_for_peer,
                        SMC_SYSTEMID_LEN) &&
@@ -567,7 +571,9 @@ static bool smcr_lgr_match(struct smc_link_group *lgr,
                         SMC_GID_SIZE) &&
                 !memcmp(lgr->lnk[SMC_SINGLE_LINK].peer_mac, lcl->mac,
                         sizeof(lcl->mac)) &&
-                lgr->role == role;
+                lgr->role == role &&
+                (lgr->role == SMC_SERV ||
+                 lgr->lnk[SMC_SINGLE_LINK].peer_qpn == clcqpn);
 }
 
 static bool smcd_lgr_match(struct smc_link_group *lgr,
@@ -578,7 +584,7 @@ static bool smcd_lgr_match(struct smc_link_group *lgr,
 
 /* create a new SMC connection (and a new link group if necessary) */
 int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
-                    struct smc_ib_device *smcibdev, u8 ibport,
+                    struct smc_ib_device *smcibdev, u8 ibport, u32 clcqpn,
                     struct smc_clc_msg_local *lcl, struct smcd_dev *smcd,
                     u64 peer_gid)
 {
@@ -603,7 +609,7 @@ int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
         list_for_each_entry(lgr, &smc_lgr_list.list, list) {
                 write_lock_bh(&lgr->conns_lock);
                 if ((is_smcd ? smcd_lgr_match(lgr, smcd, peer_gid) :
-                     smcr_lgr_match(lgr, lcl, role)) &&
+                     smcr_lgr_match(lgr, lcl, role, clcqpn)) &&
                     !lgr->sync_err &&
                     lgr->vlan_id == vlan_id &&
                     (role == SMC_CLNT ||
@@ -1024,6 +1030,8 @@ void smc_core_exit(void)
                         smc_llc_link_inactive(lnk);
                 }
                 cancel_delayed_work_sync(&lgr->free_work);
+                if (lgr->is_smcd)
+                        smc_ism_signal_shutdown(lgr);
                 smc_lgr_free(lgr); /* free link group */
         }
 }
diff --git a/net/smc/smc_core.h b/net/smc/smc_core.h
index c156674733c9..cf98f4d6093e 100644
--- a/net/smc/smc_core.h
+++ b/net/smc/smc_core.h
@@ -247,7 +247,8 @@ void smc_lgr_free(struct smc_link_group *lgr);
 void smc_lgr_forget(struct smc_link_group *lgr);
 void smc_lgr_terminate(struct smc_link_group *lgr);
 void smc_port_terminate(struct smc_ib_device *smcibdev, u8 ibport);
-void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid);
+void smc_smcd_terminate(struct smcd_dev *dev, u64 peer_gid,
+                        unsigned short vlan);
 int smc_buf_create(struct smc_sock *smc, bool is_smcd);
 int smc_uncompress_bufsize(u8 compressed);
 int smc_rmb_rtoken_handling(struct smc_connection *conn,
@@ -262,7 +263,7 @@ int smc_vlan_by_tcpsk(struct socket *clcsock, unsigned short *vlan_id);
 
 void smc_conn_free(struct smc_connection *conn);
 int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
-                    struct smc_ib_device *smcibdev, u8 ibport,
+                    struct smc_ib_device *smcibdev, u8 ibport, u32 clcqpn,
                     struct smc_clc_msg_local *lcl, struct smcd_dev *smcd,
                     u64 peer_gid);
 void smcd_conn_free(struct smc_connection *conn);
diff --git a/net/smc/smc_ism.c b/net/smc/smc_ism.c
index e36f21ce7252..2fff79db1a59 100644
--- a/net/smc/smc_ism.c
+++ b/net/smc/smc_ism.c
@@ -187,22 +187,28 @@ struct smc_ism_event_work {
 #define ISM_EVENT_REQUEST               0x0001
 #define ISM_EVENT_RESPONSE              0x0002
 #define ISM_EVENT_REQUEST_IR            0x00000001
+#define ISM_EVENT_CODE_SHUTDOWN         0x80
 #define ISM_EVENT_CODE_TESTLINK         0x83
 
+union smcd_sw_event_info {
+        u64     info;
+        struct {
+                u8              uid[SMC_LGR_ID_SIZE];
+                unsigned short  vlan_id;
+                u16             code;
+        };
+};
+
 static void smcd_handle_sw_event(struct smc_ism_event_work *wrk)
 {
-        union {
-                u64     info;
-                struct {
-                        u32             uid;
-                        unsigned short  vlanid;
-                        u16             code;
-                };
-        } ev_info;
+        union smcd_sw_event_info ev_info;
 
+        ev_info.info = wrk->event.info;
         switch (wrk->event.code) {
+        case ISM_EVENT_CODE_SHUTDOWN:   /* Peer shut down DMBs */
+                smc_smcd_terminate(wrk->smcd, wrk->event.tok, ev_info.vlan_id);
+                break;
         case ISM_EVENT_CODE_TESTLINK:   /* Activity timer */
-                ev_info.info = wrk->event.info;
                 if (ev_info.code == ISM_EVENT_REQUEST) {
                         ev_info.code = ISM_EVENT_RESPONSE;
                         wrk->smcd->ops->signal_event(wrk->smcd,
@@ -215,6 +221,21 @@ static void smcd_handle_sw_event(struct smc_ism_event_work *wrk)
         }
 }
 
+int smc_ism_signal_shutdown(struct smc_link_group *lgr)
+{
+        int rc;
+        union smcd_sw_event_info ev_info;
+
+        memcpy(ev_info.uid, lgr->id, SMC_LGR_ID_SIZE);
+        ev_info.vlan_id = lgr->vlan_id;
+        ev_info.code = ISM_EVENT_REQUEST;
+        rc = lgr->smcd->ops->signal_event(lgr->smcd, lgr->peer_gid,
+                                          ISM_EVENT_REQUEST_IR,
+                                          ISM_EVENT_CODE_SHUTDOWN,
+                                          ev_info.info);
+        return rc;
+}
+
 /* worker for SMC-D events */
 static void smc_ism_event_work(struct work_struct *work)
 {
@@ -223,7 +244,7 @@ static void smc_ism_event_work(struct work_struct *work)
 
         switch (wrk->event.type) {
         case ISM_EVENT_GID:     /* GID event, token is peer GID */
-                smc_smcd_terminate(wrk->smcd, wrk->event.tok);
+                smc_smcd_terminate(wrk->smcd, wrk->event.tok, VLAN_VID_MASK);
                 break;
         case ISM_EVENT_DMB:
                 break;
@@ -289,7 +310,7 @@ void smcd_unregister_dev(struct smcd_dev *smcd)
         spin_unlock(&smcd_dev_list.lock);
         flush_workqueue(smcd->event_wq);
         destroy_workqueue(smcd->event_wq);
-        smc_smcd_terminate(smcd, 0);
+        smc_smcd_terminate(smcd, 0, VLAN_VID_MASK);
 
         device_del(&smcd->dev);
 }
diff --git a/net/smc/smc_ism.h b/net/smc/smc_ism.h
index aee45b860b79..4da946cbfa29 100644
--- a/net/smc/smc_ism.h
+++ b/net/smc/smc_ism.h
@@ -45,4 +45,5 @@ int smc_ism_register_dmb(struct smc_link_group *lgr, int buf_size,
 int smc_ism_unregister_dmb(struct smcd_dev *dev, struct smc_buf_desc *dmb_desc);
 int smc_ism_write(struct smcd_dev *dev, const struct smc_ism_position *pos,
                   void *data, size_t len);
+int smc_ism_signal_shutdown(struct smc_link_group *lgr);
 #endif
diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c
index 3c458d279855..c2694750a6a8 100644
--- a/net/smc/smc_wr.c
+++ b/net/smc/smc_wr.c
@@ -215,12 +215,14 @@ int smc_wr_tx_put_slot(struct smc_link *link,
 
         pend = container_of(wr_pend_priv, struct smc_wr_tx_pend, priv);
         if (pend->idx < link->wr_tx_cnt) {
+                u32 idx = pend->idx;
+
                 /* clear the full struct smc_wr_tx_pend including .priv */
                 memset(&link->wr_tx_pends[pend->idx], 0,
                        sizeof(link->wr_tx_pends[pend->idx]));
                 memset(&link->wr_tx_bufs[pend->idx], 0,
                        sizeof(link->wr_tx_bufs[pend->idx]));
-                test_and_clear_bit(pend->idx, link->wr_tx_mask);
+                test_and_clear_bit(idx, link->wr_tx_mask);
                 return 1;
         }
 
diff --git a/net/socket.c b/net/socket.c
index 593826e11a53..334fcc617ef2 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -853,7 +853,7 @@ static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
         struct socket *sock = file->private_data;
 
         if (unlikely(!sock->ops->splice_read))
-                return -EINVAL;
+                return generic_file_splice_read(file, ppos, pipe, len, flags);
 
         return sock->ops->splice_read(sock, ppos, pipe, len, flags);
 }
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index 2830709957bd..c138d68e8a69 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -166,7 +166,8 @@ static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d,
 
         /* Apply trial address if we just left trial period */
         if (!trial && !self) {
-                tipc_net_finalize(net, tn->trial_addr);
+                tipc_sched_net_finalize(net, tn->trial_addr);
+                msg_set_prevnode(buf_msg(d->skb), tn->trial_addr);
                 msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
         }
 
@@ -300,14 +301,12 @@ static void tipc_disc_timeout(struct timer_list *t)
                 goto exit;
         }
 
-        /* Trial period over ? */
-        if (!time_before(jiffies, tn->addr_trial_end)) {
-                /* Did we just leave it ? */
-                if (!tipc_own_addr(net))
-                        tipc_net_finalize(net, tn->trial_addr);
-
-                msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
-                msg_set_prevnode(buf_msg(d->skb), tipc_own_addr(net));
+        /* Did we just leave trial period ? */
+        if (!time_before(jiffies, tn->addr_trial_end) && !tipc_own_addr(net)) {
+                mod_timer(&d->timer, jiffies + TIPC_DISC_INIT);
+                spin_unlock_bh(&d->lock);
+                tipc_sched_net_finalize(net, tn->trial_addr);
+                return;
         }
 
         /* Adjust timeout interval according to discovery phase */
@@ -319,6 +318,8 @@ static void tipc_disc_timeout(struct timer_list *t)
                         d->timer_intv = TIPC_DISC_SLOW;
                 else if (!d->num_nodes && d->timer_intv > TIPC_DISC_FAST)
                         d->timer_intv = TIPC_DISC_FAST;
+                msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
+                msg_set_prevnode(buf_msg(d->skb), tn->trial_addr);
         }
 
         mod_timer(&d->timer, jiffies + d->timer_intv);
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 62199cf5a56c..f076edb74338 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -104,6 +104,14 @@
  *     - A local spin_lock protecting the queue of subscriber events.
 */
 
+struct tipc_net_work {
+        struct work_struct work;
+        struct net *net;
+        u32 addr;
+};
+
+static void tipc_net_finalize(struct net *net, u32 addr);
+
 int tipc_net_init(struct net *net, u8 *node_id, u32 addr)
 {
         if (tipc_own_id(net)) {
@@ -119,17 +127,38 @@ int tipc_net_init(struct net *net, u8 *node_id, u32 addr)
         return 0;
 }
 
-void tipc_net_finalize(struct net *net, u32 addr)
+static void tipc_net_finalize(struct net *net, u32 addr)
 {
         struct tipc_net *tn = tipc_net(net);
 
-        if (!cmpxchg(&tn->node_addr, 0, addr)) {
-                tipc_set_node_addr(net, addr);
-                tipc_named_reinit(net);
-                tipc_sk_reinit(net);
-                tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
-                                     TIPC_CLUSTER_SCOPE, 0, addr);
-        }
+        if (cmpxchg(&tn->node_addr, 0, addr))
+                return;
+        tipc_set_node_addr(net, addr);
+        tipc_named_reinit(net);
+        tipc_sk_reinit(net);
+        tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
+                             TIPC_CLUSTER_SCOPE, 0, addr);
+}
+
+static void tipc_net_finalize_work(struct work_struct *work)
+{
+        struct tipc_net_work *fwork;
+
+        fwork = container_of(work, struct tipc_net_work, work);
+        tipc_net_finalize(fwork->net, fwork->addr);
+        kfree(fwork);
+}
+
+void tipc_sched_net_finalize(struct net *net, u32 addr)
+{
+        struct tipc_net_work *fwork = kzalloc(sizeof(*fwork), GFP_ATOMIC);
+
+        if (!fwork)
+                return;
+        INIT_WORK(&fwork->work, tipc_net_finalize_work);
+        fwork->net = net;
+        fwork->addr = addr;
+        schedule_work(&fwork->work);
 }
 
 void tipc_net_stop(struct net *net)
diff --git a/net/tipc/net.h b/net/tipc/net.h
index 09ad02b50bb1..b7f2e364eb99 100644
--- a/net/tipc/net.h
+++ b/net/tipc/net.h
@@ -42,7 +42,7 @@
 extern const struct nla_policy tipc_nl_net_policy[];
 
 int tipc_net_init(struct net *net, u8 *node_id, u32 addr);
-void tipc_net_finalize(struct net *net, u32 addr);
+void tipc_sched_net_finalize(struct net *net, u32 addr);
 void tipc_net_stop(struct net *net);
 int tipc_nl_net_dump(struct sk_buff *skb, struct netlink_callback *cb);
 int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info);
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 636e6131769d..b57b1be7252b 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1555,16 +1555,17 @@ static void tipc_sk_set_orig_addr(struct msghdr *m, struct sk_buff *skb)
 /**
  * tipc_sk_anc_data_recv - optionally capture ancillary data for received message
  * @m: descriptor for message info
- * @msg: received message header
+ * @skb: received message buffer
  * @tsk: TIPC port associated with message
  *
  * Note: Ancillary data is not captured if not requested by receiver.
  *
  * Returns 0 if successful, otherwise errno
  */
-static int tipc_sk_anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
+static int tipc_sk_anc_data_recv(struct msghdr *m, struct sk_buff *skb,
                                  struct tipc_sock *tsk)
 {
+        struct tipc_msg *msg;
         u32 anc_data[3];
         u32 err;
         u32 dest_type;
@@ -1573,6 +1574,7 @@ static int tipc_sk_anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
 
         if (likely(m->msg_controllen == 0))
                 return 0;
+        msg = buf_msg(skb);
 
         /* Optionally capture errored message object(s) */
         err = msg ? msg_errcode(msg) : 0;
@@ -1583,6 +1585,9 @@ static int tipc_sk_anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
                 if (res)
                         return res;
                 if (anc_data[1]) {
+                        if (skb_linearize(skb))
+                                return -ENOMEM;
+                        msg = buf_msg(skb);
                         res = put_cmsg(m, SOL_TIPC, TIPC_RETDATA, anc_data[1],
                                        msg_data(msg));
                         if (res)
@@ -1744,9 +1749,10 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
 
         /* Collect msg meta data, including error code and rejected data */
         tipc_sk_set_orig_addr(m, skb);
-        rc = tipc_sk_anc_data_recv(m, hdr, tsk);
+        rc = tipc_sk_anc_data_recv(m, skb, tsk);
         if (unlikely(rc))
                 goto exit;
+        hdr = buf_msg(skb);
 
         /* Capture data if non-error msg, otherwise just set return value */
         if (likely(!err)) {
@@ -1856,9 +1862,10 @@ static int tipc_recvstream(struct socket *sock, struct msghdr *m,
                 /* Collect msg meta data, incl. error code and rejected data */
                 if (!copied) {
                         tipc_sk_set_orig_addr(m, skb);
-                        rc = tipc_sk_anc_data_recv(m, hdr, tsk);
+                        rc = tipc_sk_anc_data_recv(m, skb, tsk);
                         if (rc)
                                 break;
+                        hdr = buf_msg(skb);
                 }
 
                 /* Copy data if msg ok, otherwise return error/partial data */
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index f8d4a419f3af..467039b342b5 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1062,8 +1062,8 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
         runtime->oss.channels = params_channels(params);
         runtime->oss.rate = params_rate(params);
 
-        vfree(runtime->oss.buffer);
-        runtime->oss.buffer = vmalloc(runtime->oss.period_bytes);
+        kvfree(runtime->oss.buffer);
+        runtime->oss.buffer = kvzalloc(runtime->oss.period_bytes, GFP_KERNEL);
         if (!runtime->oss.buffer) {
                 err = -ENOMEM;
                 goto failure;
@@ -2328,7 +2328,7 @@ static void snd_pcm_oss_release_substream(struct snd_pcm_substream *substream)
 {
         struct snd_pcm_runtime *runtime;
         runtime = substream->runtime;
-        vfree(runtime->oss.buffer);
+        kvfree(runtime->oss.buffer);
         runtime->oss.buffer = NULL;
 #ifdef CONFIG_SND_PCM_OSS_PLUGINS
         snd_pcm_oss_plugin_clear(substream);
diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
index 141c5f3a9575..31cb2acf8afc 100644
--- a/sound/core/oss/pcm_plugin.c
+++ b/sound/core/oss/pcm_plugin.c
@@ -66,8 +66,8 @@ static int snd_pcm_plugin_alloc(struct snd_pcm_plugin *plugin, snd_pcm_uframes_t
                 return -ENXIO;
         size /= 8;
         if (plugin->buf_frames < frames) {
-                vfree(plugin->buf);
-                plugin->buf = vmalloc(size);
+                kvfree(plugin->buf);
+                plugin->buf = kvzalloc(size, GFP_KERNEL);
                 plugin->buf_frames = frames;
         }
         if (!plugin->buf) {
@@ -191,7 +191,7 @@ int snd_pcm_plugin_free(struct snd_pcm_plugin *plugin)
         if (plugin->private_free)
                 plugin->private_free(plugin);
         kfree(plugin->buf_channels);
-        vfree(plugin->buf);
+        kvfree(plugin->buf);
         kfree(plugin);
         return 0;
 }
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index 0a24037184c3..0a567634e5fa 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -1177,6 +1177,7 @@ static const struct snd_pci_quirk ca0132_quirks[] = {
         SND_PCI_QUIRK(0x1028, 0x0708, "Alienware 15 R2 2016", QUIRK_ALIENWARE),
         SND_PCI_QUIRK(0x1102, 0x0010, "Sound Blaster Z", QUIRK_SBZ),
         SND_PCI_QUIRK(0x1102, 0x0023, "Sound Blaster Z", QUIRK_SBZ),
+        SND_PCI_QUIRK(0x1102, 0x0033, "Sound Blaster ZxR", QUIRK_SBZ),
         SND_PCI_QUIRK(0x1458, 0xA016, "Recon3Di", QUIRK_R3DI),
         SND_PCI_QUIRK(0x1458, 0xA026, "Gigabyte G1.Sniper Z97", QUIRK_R3DI),
         SND_PCI_QUIRK(0x1458, 0xA036, "Gigabyte GA-Z170X-Gaming 7", QUIRK_R3DI),
@@ -8413,7 +8414,7 @@ static void ca0132_free(struct hda_codec *codec)
 
         snd_hda_power_down(codec);
         if (spec->mem_base)
-                iounmap(spec->mem_base);
+                pci_iounmap(codec->bus->pci, spec->mem_base);
         kfree(spec->spec_init_verbs);
         kfree(codec->spec);
 }
@@ -8488,7 +8489,7 @@ static void ca0132_config(struct hda_codec *codec)
                 break;
         case QUIRK_AE5:
                 codec_dbg(codec, "%s: QUIRK_AE5 applied.\n", __func__);
-                snd_hda_apply_pincfgs(codec, r3di_pincfgs);
+                snd_hda_apply_pincfgs(codec, ae5_pincfgs);
                 break;
         }
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index fa61674a5605..970bc44a378b 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6481,6 +6481,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
+        SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
         SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
         SND_PCI_QUIRK(0x103c, 0x827e, "HP x360", ALC295_FIXUP_HP_X360),
         SND_PCI_QUIRK(0x103c, 0x82bf, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
diff --git a/tools/power/cpupower/Makefile b/tools/power/cpupower/Makefile
index 1dd5f4fcffd5..db66a952c173 100644
--- a/tools/power/cpupower/Makefile
+++ b/tools/power/cpupower/Makefile
@@ -129,7 +129,7 @@ WARNINGS += $(call cc-supports,-Wno-pointer-sign)
 WARNINGS += $(call cc-supports,-Wdeclaration-after-statement)
 WARNINGS += -Wshadow
 
-CFLAGS += -DVERSION=\"$(VERSION)\" -DPACKAGE=\"$(PACKAGE)\" \
+override CFLAGS += -DVERSION=\"$(VERSION)\" -DPACKAGE=\"$(PACKAGE)\" \
                 -DPACKAGE_BUGREPORT=\"$(PACKAGE_BUGREPORT)\" -D_GNU_SOURCE
 
 UTIL_OBJS =  utils/helpers/amd.o utils/helpers/msr.o \
@@ -156,12 +156,12 @@ LIB_SRC = 	lib/cpufreq.c lib/cpupower.c lib/cpuidle.c
 LIB_OBJS =      lib/cpufreq.o lib/cpupower.o lib/cpuidle.o
 LIB_OBJS :=     $(addprefix $(OUTPUT),$(LIB_OBJS))
 
-CFLAGS +=       -pipe
+override CFLAGS +=      -pipe
 
 ifeq ($(strip $(NLS)),true)
         INSTALL_NLS += install-gmo
         COMPILE_NLS += create-gmo
-        CFLAGS += -DNLS
+        override CFLAGS += -DNLS
 endif
 
 ifeq ($(strip $(CPUFREQ_BENCH)),true)
@@ -175,7 +175,7 @@ ifeq ($(strip $(STATIC)),true)
         UTIL_SRC += $(LIB_SRC)
 endif
 
-CFLAGS += $(WARNINGS)
+override CFLAGS += $(WARNINGS)
 
 ifeq ($(strip $(V)),false)
         QUIET=@
@@ -188,10 +188,10 @@ export QUIET ECHO
 
 # if DEBUG is enabled, then we do not strip or optimize
 ifeq ($(strip $(DEBUG)),true)
-        CFLAGS += -O1 -g -DDEBUG
+        override CFLAGS += -O1 -g -DDEBUG
         STRIPCMD = /bin/true -Since_we_are_debugging
 else
-        CFLAGS += $(OPTIMIZATION) -fomit-frame-pointer
+        override CFLAGS += $(OPTIMIZATION) -fomit-frame-pointer
         STRIPCMD = $(STRIP) -s --remove-section=.note --remove-section=.comment
 endif
 
diff --git a/tools/power/cpupower/bench/Makefile b/tools/power/cpupower/bench/Makefile
index d79ab161cc75..f68b4bc55273 100644
--- a/tools/power/cpupower/bench/Makefile
+++ b/tools/power/cpupower/bench/Makefile
@@ -9,7 +9,7 @@ endif
 ifeq ($(strip $(STATIC)),true)
 LIBS = -L../ -L$(OUTPUT) -lm
 OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o \
-       $(OUTPUT)../lib/cpufreq.o $(OUTPUT)../lib/sysfs.o
+       $(OUTPUT)../lib/cpufreq.o $(OUTPUT)../lib/cpupower.o
 else
 LIBS = -L../ -L$(OUTPUT) -lm -lcpupower
 OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o
diff --git a/tools/power/cpupower/debug/x86_64/Makefile b/tools/power/cpupower/debug/x86_64/Makefile
index 59af84b8ef45..b1b6c43644e7 100644
--- a/tools/power/cpupower/debug/x86_64/Makefile
+++ b/tools/power/cpupower/debug/x86_64/Makefile
@@ -13,10 +13,10 @@ INSTALL = /usr/bin/install
 default: all
 
 $(OUTPUT)centrino-decode: ../i386/centrino-decode.c
-        $(CC) $(CFLAGS) -o $@ $<
+        $(CC) $(CFLAGS) -o $@ $(LDFLAGS) $<
 
 $(OUTPUT)powernow-k8-decode: ../i386/powernow-k8-decode.c
-        $(CC) $(CFLAGS) -o $@ $<
+        $(CC) $(CFLAGS) -o $@ $(LDFLAGS) $<
 
 all: $(OUTPUT)centrino-decode $(OUTPUT)powernow-k8-decode
 
diff --git a/tools/power/cpupower/lib/cpufreq.c b/tools/power/cpupower/lib/cpufreq.c
index 1b993fe1ce23..0c0f3e3f0d80 100644
--- a/tools/power/cpupower/lib/cpufreq.c
+++ b/tools/power/cpupower/lib/cpufreq.c
@@ -28,7 +28,7 @@ static unsigned int sysfs_cpufreq_read_file(unsigned int cpu, const char *fname,
 
         snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u/cpufreq/%s",
                          cpu, fname);
-        return sysfs_read_file(path, buf, buflen);
+        return cpupower_read_sysfs(path, buf, buflen);
 }
 
 /* helper function to write a new value to a /sys file */
diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
index 9bd4c7655fdb..852d25462388 100644
--- a/tools/power/cpupower/lib/cpuidle.c
+++ b/tools/power/cpupower/lib/cpuidle.c
@@ -319,7 +319,7 @@ static unsigned int sysfs_cpuidle_read_file(const char *fname, char *buf,
 
         snprintf(path, sizeof(path), PATH_TO_CPU "cpuidle/%s", fname);
 
-        return sysfs_read_file(path, buf, buflen);
+        return cpupower_read_sysfs(path, buf, buflen);
 }
 
 
diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
index 9c395ec924de..9711d628b0f4 100644
--- a/tools/power/cpupower/lib/cpupower.c
+++ b/tools/power/cpupower/lib/cpupower.c
@@ -15,7 +15,7 @@
 #include "cpupower.h"
 #include "cpupower_intern.h"
 
-unsigned int sysfs_read_file(const char *path, char *buf, size_t buflen)
+unsigned int cpupower_read_sysfs(const char *path, char *buf, size_t buflen)
 {
         int fd;
         ssize_t numread;
@@ -95,7 +95,7 @@ static int sysfs_topology_read_file(unsigned int cpu, const char *fname, int *re
 
         snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u/topology/%s",
                          cpu, fname);
-        if (sysfs_read_file(path, linebuf, MAX_LINE_LEN) == 0)
+        if (cpupower_read_sysfs(path, linebuf, MAX_LINE_LEN) == 0)
                 return -1;
         *result = strtol(linebuf, &endp, 0);
         if (endp == linebuf || errno == ERANGE)
diff --git a/tools/power/cpupower/lib/cpupower_intern.h b/tools/power/cpupower/lib/cpupower_intern.h
index 92affdfbe417..4887c76d23f8 100644
--- a/tools/power/cpupower/lib/cpupower_intern.h
+++ b/tools/power/cpupower/lib/cpupower_intern.h
@@ -3,4 +3,4 @@
 #define MAX_LINE_LEN 4096
 #define SYSFS_PATH_MAX 255
 
-unsigned int sysfs_read_file(const char *path, char *buf, size_t buflen);
+unsigned int cpupower_read_sysfs(const char *path, char *buf, size_t buflen);
diff --git a/tools/testing/selftests/tc-testing/tdc.py b/tools/testing/selftests/tc-testing/tdc.py
index 87a04a8a5945..7607ba3e3cbe 100755
--- a/tools/testing/selftests/tc-testing/tdc.py
+++ b/tools/testing/selftests/tc-testing/tdc.py
@@ -134,9 +134,9 @@ def exec_cmd(args, pm, stage, command):
     (rawout, serr) = proc.communicate()
 
     if proc.returncode != 0 and len(serr) > 0:
-        foutput = serr.decode("utf-8")
+        foutput = serr.decode("utf-8", errors="ignore")
     else:
-        foutput = rawout.decode("utf-8")
+        foutput = rawout.decode("utf-8", errors="ignore")
 
     proc.stdout.close()
     proc.stderr.close()
@@ -169,6 +169,8 @@ def prepare_env(args, pm, stage, prefix, cmdlist, output = None):
                   file=sys.stderr)
             print("\n{} *** Error message: \"{}\"".format(prefix, foutput),
                   file=sys.stderr)
+            print("returncode {}; expected {}".format(proc.returncode,
+                                                      exit_codes))
             print("\n{} *** Aborting test run.".format(prefix), file=sys.stderr)
             print("\n\n{} *** stdout ***".format(proc.stdout), file=sys.stderr)
             print("\n\n{} *** stderr ***".format(proc.stderr), file=sys.stderr)
@@ -195,12 +197,18 @@ def run_one_test(pm, args, index, tidx):
         print('-----> execute stage')
     pm.call_pre_execute()
     (p, procout) = exec_cmd(args, pm, 'execute', tidx["cmdUnderTest"])
-    exit_code = p.returncode
+    if p:
+        exit_code = p.returncode
+    else:
+        exit_code = None
+
     pm.call_post_execute()
 
-    if (exit_code != int(tidx["expExitCode"])):
+    if (exit_code is None or exit_code != int(tidx["expExitCode"])):
         result = False
-        print("exit:", exit_code, int(tidx["expExitCode"]))
+        print("exit: {!r}".format(exit_code))
+        print("exit: {}".format(int(tidx["expExitCode"])))
+        #print("exit: {!r} {}".format(exit_code, int(tidx["expExitCode"])))
         print(procout)
     else:
         if args.verbose > 0: