681 files changed, 6463 insertions, 2859 deletions

diff --git a/Documentation/ABI/stable/sysfs-driver-mlxreg-io b/Documentation/ABI/stable/sysfs-driver-mlxreg-io
index 9b642669cb16..169fe08a649b 100644
--- a/Documentation/ABI/stable/sysfs-driver-mlxreg-io
+++ b/Documentation/ABI/stable/sysfs-driver-mlxreg-io
@@ -24,7 +24,7 @@ What:		/sys/devices/platform/mlxplat/mlxreg-io/hwmon/hwmon*/
                                                         cpld3_version
 
 Date:           November 2018
-KernelVersion:  4.21
+KernelVersion:  5.0
 Contact:        Vadim Pasternak <vadimpmellanox.com>
 Description:    These files show with which CPLD versions have been burned
                 on LED board.
@@ -35,7 +35,7 @@ What:		/sys/devices/platform/mlxplat/mlxreg-io/hwmon/hwmon*/
                                                         jtag_enable
 
 Date:           November 2018
-KernelVersion:  4.21
+KernelVersion:  5.0
 Contact:        Vadim Pasternak <vadimpmellanox.com>
 Description:    These files enable and disable the access to the JTAG domain.
                 By default access to the JTAG domain is disabled.
@@ -105,7 +105,7 @@ What:		/sys/devices/platform/mlxplat/mlxreg-io/hwmon/hwmon*/
                                                 reset_voltmon_upgrade_fail
 
 Date:           November 2018
-KernelVersion:  4.21
+KernelVersion:  5.0
 Contact:        Vadim Pasternak <vadimpmellanox.com>
 Description:    These files show the system reset cause, as following: ComEx
                 power fail, reset from ComEx, system platform reset, reset
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index b799bcf67d7b..858b6c0b9a15 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -1696,12 +1696,11 @@
                         By default, super page will be supported if Intel IOMMU
                         has the capability. With this option, super page will
                         not be supported.
-                sm_off [Default Off]
-                        By default, scalable mode will be supported if the
+                sm_on [Default Off]
+                        By default, scalable mode will be disabled even if the
                         hardware advertises that it has support for the scalable
                         mode translation. With this option set, scalable mode
-                        will not be used even on hardware which claims to support
-                        it.
+                        will be used on hardware which claims to support it.
                 tboot_noforce [Default Off]
                         Do not force the Intel IOMMU enabled under tboot.
                         By default, tboot will force Intel IOMMU on, which
diff --git a/Documentation/devicetree/bindings/Makefile b/Documentation/devicetree/bindings/Makefile
index 6e5cef0ed6fb..50daa0b3b032 100644
--- a/Documentation/devicetree/bindings/Makefile
+++ b/Documentation/devicetree/bindings/Makefile
@@ -17,7 +17,11 @@ extra-y += $(DT_TMP_SCHEMA)
 quiet_cmd_mk_schema = SCHEMA  $@
       cmd_mk_schema = $(DT_MK_SCHEMA) $(DT_MK_SCHEMA_FLAGS) -o $@ $(filter-out FORCE, $^)
 
-DT_DOCS = $(shell cd $(srctree)/$(src) && find * -name '*.yaml')
+DT_DOCS = $(shell \
+        cd $(srctree)/$(src) && \
+        find * \( -name '*.yaml' ! -name $(DT_TMP_SCHEMA) \) \
+        )
+
 DT_SCHEMA_FILES ?= $(addprefix $(src)/,$(DT_DOCS))
 
 extra-y += $(patsubst $(src)/%.yaml,%.example.dts, $(DT_SCHEMA_FILES))
diff --git a/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt b/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt
index 36603419d6f8..0e72183f52bc 100644
--- a/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt
+++ b/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt
@@ -4,14 +4,10 @@ Required properties:
 - compatible : "olpc,ap-sp"
 - reg : base address and length of SoC's WTM registers
 - interrupts : SP-AP interrupt
-- clocks : phandle + clock-specifier for the clock that drives the WTM
-- clock-names:  should be "sp"
 
 Example:
         ap-sp@d4290000 {
                 compatible = "olpc,ap-sp";
                 reg = <0xd4290000 0x1000>;
                 interrupts = <40>;
-                clocks = <&soc_clocks MMP2_CLK_SP>;
-                clock-names = "sp";
         }
diff --git a/Documentation/networking/operstates.txt b/Documentation/networking/operstates.txt
index 355c6d8ef8ad..b203d1334822 100644
--- a/Documentation/networking/operstates.txt
+++ b/Documentation/networking/operstates.txt
@@ -22,8 +22,9 @@ and changeable from userspace under certain rules.
 2. Querying from userspace
 
 Both admin and operational state can be queried via the netlink
-operation RTM_GETLINK. It is also possible to subscribe to RTMGRP_LINK
-to be notified of updates. This is important for setting from userspace.
+operation RTM_GETLINK. It is also possible to subscribe to RTNLGRP_LINK
+to be notified of updates while the interface is admin up. This is
+important for setting from userspace.
 
 These values contain interface state:
 
@@ -101,8 +102,9 @@ because some driver controlled protocol establishment has to
 complete. Corresponding functions are netif_dormant_on() to set the
 flag, netif_dormant_off() to clear it and netif_dormant() to query.
 
-On device allocation, networking core sets the flags equivalent to
-netif_carrier_ok() and !netif_dormant().
+On device allocation, both flags __LINK_STATE_NOCARRIER and
+__LINK_STATE_DORMANT are cleared, so the effective state is equivalent
+to netif_carrier_ok() and !netif_dormant().
 
 
 Whenever the driver CHANGES one of these flags, a workqueue event is
@@ -133,11 +135,11 @@ netif_carrier_ok() && !netif_dormant() is set by the
 driver. Afterwards, the userspace application can set IFLA_OPERSTATE
 to IF_OPER_DORMANT or IF_OPER_UP as long as the driver does not set
 netif_carrier_off() or netif_dormant_on(). Changes made by userspace
-are multicasted on the netlink group RTMGRP_LINK.
+are multicasted on the netlink group RTNLGRP_LINK.
 
 So basically a 802.1X supplicant interacts with the kernel like this:
 
--subscribe to RTMGRP_LINK
+-subscribe to RTNLGRP_LINK
 -set IFLA_LINKMODE to 1 via RTM_SETLINK
 -query RTM_GETLINK once to get initial state
 -if initial flags are not (IFF_LOWER_UP && !IFF_DORMANT), wait until
diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
index 819caf8ca05f..ebc679bcb2dc 100644
--- a/Documentation/sysctl/fs.txt
+++ b/Documentation/sysctl/fs.txt
@@ -56,26 +56,34 @@ of any kernel data structures.
 
 dentry-state:
 
-From linux/fs/dentry.c:
+From linux/include/linux/dcache.h:
 --------------------------------------------------------------
-struct {
+struct dentry_stat_t dentry_stat {
         int nr_dentry;
         int nr_unused;
         int age_limit;         /* age in seconds */
         int want_pages;        /* pages requested by system */
-        int dummy[2];
-} dentry_stat = {0, 0, 45, 0,};
--------------------------------------------------------------- 
-
-Dentries are dynamically allocated and deallocated, and
-nr_dentry seems to be 0 all the time. Hence it's safe to
-assume that only nr_unused, age_limit and want_pages are
-used. Nr_unused seems to be exactly what its name says.
+        int nr_negative;       /* # of unused negative dentries */
+        int dummy;             /* Reserved for future use */
+};
+--------------------------------------------------------------
+
+Dentries are dynamically allocated and deallocated.
+
+nr_dentry shows the total number of dentries allocated (active
++ unused). nr_unused shows the number of dentries that are not
+actively used, but are saved in the LRU list for future reuse.
+
 Age_limit is the age in seconds after which dcache entries
 can be reclaimed when memory is short and want_pages is
 nonzero when shrink_dcache_pages() has been called and the
 dcache isn't pruned yet.
 
+nr_negative shows the number of unused dentries that are also
+negative dentries which do not map to any files. Instead,
+they help speeding up rejection of non-existing files provided
+by the users.
+
 ==============================================================
 
 dquot-max & dquot-nr:
diff --git a/Documentation/x86/resctrl_ui.txt b/Documentation/x86/resctrl_ui.txt
index e8e8d14d3c4e..c1f95b59e14d 100644
--- a/Documentation/x86/resctrl_ui.txt
+++ b/Documentation/x86/resctrl_ui.txt
@@ -9,7 +9,7 @@ Fenghua Yu <fenghua.yu@intel.com>
 Tony Luck <tony.luck@intel.com>
 Vikas Shivappa <vikas.shivappa@intel.com>
 
-This feature is enabled by the CONFIG_X86_RESCTRL and the x86 /proc/cpuinfo
+This feature is enabled by the CONFIG_X86_CPU_RESCTRL and the x86 /proc/cpuinfo
 flag bits:
 RDT (Resource Director Technology) Allocation - "rdt_a"
 CAT (Cache Allocation Technology) - "cat_l3", "cat_l2"
diff --git a/MAINTAINERS b/MAINTAINERS
index 9f64f8d3740e..41ce5f4ad838 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2848,6 +2848,9 @@ F:	include/uapi/linux/if_bonding.h
 BPF (Safe dynamic programs and tools)
 M:      Alexei Starovoitov <ast@kernel.org>
 M:      Daniel Borkmann <daniel@iogearbox.net>
+R:      Martin KaFai Lau <kafai@fb.com>
+R:      Song Liu <songliubraving@fb.com>
+R:      Yonghong Song <yhs@fb.com>
 L:      netdev@vger.kernel.org
 L:      linux-kernel@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
@@ -2873,6 +2876,8 @@ F:	samples/bpf/
 F:      tools/bpf/
 F:      tools/lib/bpf/
 F:      tools/testing/selftests/bpf/
+K:      bpf
+N:      bpf
 
 BPF JIT for ARM
 M:      Shubham Bansal <illusionist.neo@gmail.com>
@@ -5181,7 +5186,7 @@ DRM DRIVERS FOR XEN
 M:      Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
 T:      git git://anongit.freedesktop.org/drm/drm-misc
 L:      dri-devel@lists.freedesktop.org
-L:      xen-devel@lists.xen.org
+L:      xen-devel@lists.xenproject.org (moderated for non-subscribers)
 S:      Supported
 F:      drivers/gpu/drm/xen/
 F:      Documentation/gpu/xen-front.rst
@@ -6146,7 +6151,7 @@ FREESCALE SOC SOUND DRIVERS
 M:      Timur Tabi <timur@kernel.org>
 M:      Nicolin Chen <nicoleotsuka@gmail.com>
 M:      Xiubo Li <Xiubo.Lee@gmail.com>
-R:      Fabio Estevam <fabio.estevam@nxp.com>
+R:      Fabio Estevam <festevam@gmail.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 L:      linuxppc-dev@lists.ozlabs.org
 S:      Maintained
@@ -10893,7 +10898,7 @@ F:	include/linux/nvmem-consumer.h
 F:      include/linux/nvmem-provider.h
 
 NXP SGTL5000 DRIVER
-M:      Fabio Estevam <fabio.estevam@nxp.com>
+M:      Fabio Estevam <festevam@gmail.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 S:      Maintained
 F:      Documentation/devicetree/bindings/sound/sgtl5000.txt
@@ -11307,10 +11312,12 @@ F:	include/dt-bindings/
 
 OPENCORES I2C BUS DRIVER
 M:      Peter Korsgaard <peter@korsgaard.com>
+M:      Andrew Lunn <andrew@lunn.ch>
 L:      linux-i2c@vger.kernel.org
 S:      Maintained
 F:      Documentation/i2c/busses/i2c-ocores
 F:      drivers/i2c/busses/i2c-ocores.c
+F:      include/linux/platform_data/i2c-ocores.h
 
 OPENRISC ARCHITECTURE
 M:      Jonas Bonn <jonas@southpole.se>
@@ -12868,6 +12875,13 @@ F:	Documentation/devicetree/bindings/net/dsa/realtek-smi.txt
 F:      drivers/net/dsa/realtek-smi*
 F:      drivers/net/dsa/rtl83*
 
+REDPINE WIRELESS DRIVER
+M:      Amitkumar Karwar <amitkarwar@gmail.com>
+M:      Siva Rebbagondla <siva8118@gmail.com>
+L:      linux-wireless@vger.kernel.org
+S:      Maintained
+F:      drivers/net/wireless/rsi/
+
 REGISTER MAP ABSTRACTION
 M:      Mark Brown <broonie@kernel.org>
 L:      linux-kernel@vger.kernel.org
@@ -13696,6 +13710,15 @@ L:	netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/sfc/
 
+SFF/SFP/SFP+ MODULE SUPPORT
+M:      Russell King <linux@armlinux.org.uk>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      drivers/net/phy/phylink.c
+F:      drivers/net/phy/sfp*
+F:      include/linux/phylink.h
+F:      include/linux/sfp.h
+
 SGI GRU DRIVER
 M:      Dimitri Sivanich <sivanich@sgi.com>
 S:      Maintained
@@ -16641,6 +16664,15 @@ S:	Maintained
 F:      drivers/platform/x86/
 F:      drivers/platform/olpc/
 
+X86 PLATFORM DRIVERS - ARCH
+R:      Darren Hart <dvhart@infradead.org>
+R:      Andy Shevchenko <andy@infradead.org>
+L:      platform-driver-x86@vger.kernel.org
+L:      x86@kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git x86/core
+S:      Maintained
+F:      arch/x86/platform
+
 X86 VDSO
 M:      Andy Lutomirski <luto@kernel.org>
 L:      linux-kernel@vger.kernel.org
@@ -16673,6 +16705,24 @@ T:	git git://linuxtv.org/media_tree.git
 S:      Maintained
 F:      drivers/media/tuners/tuner-xc2028.*
 
+XDP (eXpress Data Path)
+M:      Alexei Starovoitov <ast@kernel.org>
+M:      Daniel Borkmann <daniel@iogearbox.net>
+M:      David S. Miller <davem@davemloft.net>
+M:      Jakub Kicinski <jakub.kicinski@netronome.com>
+M:      Jesper Dangaard Brouer <hawk@kernel.org>
+M:      John Fastabend <john.fastabend@gmail.com>
+L:      netdev@vger.kernel.org
+L:      xdp-newbies@vger.kernel.org
+S:      Supported
+F:      net/core/xdp.c
+F:      include/net/xdp.h
+F:      kernel/bpf/devmap.c
+F:      kernel/bpf/cpumap.c
+F:      include/trace/events/xdp.h
+K:      xdp
+N:      xdp
+
 XDP SOCKETS (AF_XDP)
 M:      Björn Töpel <bjorn.topel@intel.com>
 M:      Magnus Karlsson <magnus.karlsson@intel.com>
diff --git a/Makefile b/Makefile
index 141653226f3c..86cf35d1d79d 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 0
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc6
 NAME = Shy Crocodile
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/asm/irq.h b/arch/alpha/include/asm/irq.h
index 4d17cacd1462..432402c8e47f 100644
--- a/arch/alpha/include/asm/irq.h
+++ b/arch/alpha/include/asm/irq.h
@@ -56,15 +56,15 @@
 
 #elif defined(CONFIG_ALPHA_DP264) || \
       defined(CONFIG_ALPHA_LYNX)  || \
-      defined(CONFIG_ALPHA_SHARK) || \
-      defined(CONFIG_ALPHA_EIGER)
+      defined(CONFIG_ALPHA_SHARK)
 # define NR_IRQS        64
 
 #elif defined(CONFIG_ALPHA_TITAN)
 #define NR_IRQS         80
 
 #elif defined(CONFIG_ALPHA_RAWHIDE) || \
-        defined(CONFIG_ALPHA_TAKARA)
+      defined(CONFIG_ALPHA_TAKARA) || \
+      defined(CONFIG_ALPHA_EIGER)
 # define NR_IRQS        128
 
 #elif defined(CONFIG_ALPHA_WILDFIRE)
diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
index d73dc473fbb9..188fc9256baf 100644
--- a/arch/alpha/mm/fault.c
+++ b/arch/alpha/mm/fault.c
@@ -78,7 +78,7 @@ __load_new_mm_context(struct mm_struct *next_mm)
 /* Macro for exception fixup code to access integer registers.  */
 #define dpf_reg(r)                                                      \
         (((unsigned long *)regs)[(r) <= 8 ? (r) : (r) <= 15 ? (r)-16 :  \
-                                 (r) <= 18 ? (r)+8 : (r)-10])
+                                 (r) <= 18 ? (r)+10 : (r)-10])
 
 asmlinkage void
 do_page_fault(unsigned long address, unsigned long mmcsr,
diff --git a/arch/arm/boot/dts/am335x-shc.dts b/arch/arm/boot/dts/am335x-shc.dts
index d0fd68873689..5b250060f6dd 100644
--- a/arch/arm/boot/dts/am335x-shc.dts
+++ b/arch/arm/boot/dts/am335x-shc.dts
@@ -215,7 +215,7 @@
         pinctrl-names = "default";
         pinctrl-0 = <&mmc1_pins>;
         bus-width = <0x4>;
-        cd-gpios = <&gpio0 6 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio0 6 GPIO_ACTIVE_LOW>;
         cd-inverted;
         max-frequency = <26000000>;
         vmmc-supply = <&vmmcsd_fixed>;
diff --git a/arch/arm/boot/dts/da850.dtsi b/arch/arm/boot/dts/da850.dtsi
index 47aa53ba6b92..559659b399d0 100644
--- a/arch/arm/boot/dts/da850.dtsi
+++ b/arch/arm/boot/dts/da850.dtsi
@@ -476,7 +476,7 @@
                 clocksource: timer@20000 {
                         compatible = "ti,da830-timer";
                         reg = <0x20000 0x1000>;
-                        interrupts = <12>, <13>;
+                        interrupts = <21>, <22>;
                         interrupt-names = "tint12", "tint34";
                         clocks = <&pll0_auxclk>;
                 };
diff --git a/arch/arm/boot/dts/imx6q-pistachio.dts b/arch/arm/boot/dts/imx6q-pistachio.dts
index 5edf858c8b86..a31b17eaf51c 100644
--- a/arch/arm/boot/dts/imx6q-pistachio.dts
+++ b/arch/arm/boot/dts/imx6q-pistachio.dts
@@ -103,7 +103,7 @@
                 power {
                         label = "Power Button";
                         gpios = <&gpio2 12 GPIO_ACTIVE_LOW>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                         linux,code = <KEY_POWER>;
                 };
         };
diff --git a/arch/arm/boot/dts/imx6sll-evk.dts b/arch/arm/boot/dts/imx6sll-evk.dts
index d8163705363e..4a31a415f88e 100644
--- a/arch/arm/boot/dts/imx6sll-evk.dts
+++ b/arch/arm/boot/dts/imx6sll-evk.dts
@@ -309,7 +309,7 @@
         pinctrl-2 = <&pinctrl_usdhc3_200mhz>;
         cd-gpios = <&gpio3 22 GPIO_ACTIVE_LOW>;
         keep-power-in-suspend;
-        enable-sdio-wakeup;
+        wakeup-source;
         vmmc-supply = <&reg_sd3_vmmc>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi
index 272ff6133ec1..d1375d3650fd 100644
--- a/arch/arm/boot/dts/imx6sx.dtsi
+++ b/arch/arm/boot/dts/imx6sx.dtsi
@@ -467,7 +467,7 @@
                         };
 
                         gpt: gpt@2098000 {
-                                compatible = "fsl,imx6sx-gpt", "fsl,imx31-gpt";
+                                compatible = "fsl,imx6sx-gpt", "fsl,imx6dl-gpt";
                                 reg = <0x02098000 0x4000>;
                                 interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>;
                                 clocks = <&clks IMX6SX_CLK_GPT_BUS>,
diff --git a/arch/arm/boot/dts/meson.dtsi b/arch/arm/boot/dts/meson.dtsi
index e4645f612712..2ab74860d962 100644
--- a/arch/arm/boot/dts/meson.dtsi
+++ b/arch/arm/boot/dts/meson.dtsi
@@ -274,7 +274,7 @@
                         compatible = "amlogic,meson6-dwmac", "snps,dwmac";
                         reg = <0xc9410000 0x10000
                                0xc1108108 0x4>;
-                        interrupts = <GIC_SPI 8 IRQ_TYPE_EDGE_RISING>;
+                        interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>;
                         interrupt-names = "macirq";
                         status = "disabled";
                 };
diff --git a/arch/arm/boot/dts/meson8b-ec100.dts b/arch/arm/boot/dts/meson8b-ec100.dts
index 0872f6e3abf5..d50fc2f60fa3 100644
--- a/arch/arm/boot/dts/meson8b-ec100.dts
+++ b/arch/arm/boot/dts/meson8b-ec100.dts
@@ -205,8 +205,7 @@
                 cap-sd-highspeed;
                 disable-wp;
 
-                cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-                cd-inverted;
+                cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
                 vmmc-supply = <&vcc_3v3>;
         };
diff --git a/arch/arm/boot/dts/meson8b-odroidc1.dts b/arch/arm/boot/dts/meson8b-odroidc1.dts
index 58669abda259..0f0a46ddf3ff 100644
--- a/arch/arm/boot/dts/meson8b-odroidc1.dts
+++ b/arch/arm/boot/dts/meson8b-odroidc1.dts
@@ -221,7 +221,6 @@
                 /* Realtek RTL8211F (0x001cc916) */
                 eth_phy: ethernet-phy@0 {
                         reg = <0>;
-                        eee-broken-1000t;
                         interrupt-parent = <&gpio_intc>;
                         /* GPIOH_3 */
                         interrupts = <17 IRQ_TYPE_LEVEL_LOW>;
@@ -273,8 +272,7 @@
                 cap-sd-highspeed;
                 disable-wp;
 
-                cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-                cd-inverted;
+                cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
                 vmmc-supply = <&tflash_vdd>;
                 vqmmc-supply = <&tf_io>;
diff --git a/arch/arm/boot/dts/meson8m2-mxiii-plus.dts b/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
index f5853610b20b..6ac02beb5fa7 100644
--- a/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
+++ b/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
@@ -206,8 +206,7 @@
                 cap-sd-highspeed;
                 disable-wp;
 
-                cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-                cd-inverted;
+                cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
                 vmmc-supply = <&vcc_3v3>;
         };
diff --git a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
index ddc7a7bb33c0..f57acf8f66b9 100644
--- a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
+++ b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
@@ -105,7 +105,7 @@
                         interrupts-extended = <
                                 &cpcap 15 0 &cpcap 14 0 &cpcap 28 0 &cpcap 19 0
                                 &cpcap 18 0 &cpcap 17 0 &cpcap 16 0 &cpcap 49 0
-                                &cpcap 48 1
+                                &cpcap 48 0
                         >;
                         interrupt-names =
                                 "id_ground", "id_float", "se0conn", "vbusvld",
diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
index e53d32691308..93b420934e8e 100644
--- a/arch/arm/boot/dts/omap3-gta04.dtsi
+++ b/arch/arm/boot/dts/omap3-gta04.dtsi
@@ -714,11 +714,7 @@
 
         vdda-supply = <&vdac>;
 
-        #address-cells = <1>;
-        #size-cells = <0>;
-
         port {
-                reg = <0>;
                 venc_out: endpoint {
                         remote-endpoint = <&opa_in>;
                         ti,channels = <1>;
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index 182a53991c90..826920e6b878 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -814,7 +814,7 @@
         /* For debugging, it is often good idea to remove this GPIO.
            It means you can remove back cover (to reboot by removing
            battery) and still use the MMC card. */
-        cd-gpios = <&gpio6 0 GPIO_ACTIVE_HIGH>; /* 160 */
+        cd-gpios = <&gpio6 0 GPIO_ACTIVE_LOW>; /* 160 */
 };
 
 /* most boards use vaux3, only some old versions use vmmc2 instead */
diff --git a/arch/arm/boot/dts/omap3-n950-n9.dtsi b/arch/arm/boot/dts/omap3-n950-n9.dtsi
index 0d9b85317529..e142e6c70a59 100644
--- a/arch/arm/boot/dts/omap3-n950-n9.dtsi
+++ b/arch/arm/boot/dts/omap3-n950-n9.dtsi
@@ -370,6 +370,19 @@
                 compatible = "ti,omap2-onenand";
                 reg = <0 0 0x20000>;    /* CS0, offset 0, IO size 128K */
 
+                /*
+                 * These timings are based on CONFIG_OMAP_GPMC_DEBUG=y reported
+                 * bootloader set values when booted with v4.19 using both N950
+                 * and N9 devices (OneNAND Manufacturer: Samsung):
+                 *
+                 *   gpmc cs0 before gpmc_cs_program_settings:
+                 *   cs0 GPMC_CS_CONFIG1: 0xfd001202
+                 *   cs0 GPMC_CS_CONFIG2: 0x00181800
+                 *   cs0 GPMC_CS_CONFIG3: 0x00030300
+                 *   cs0 GPMC_CS_CONFIG4: 0x18001804
+                 *   cs0 GPMC_CS_CONFIG5: 0x03171d1d
+                 *   cs0 GPMC_CS_CONFIG6: 0x97080000
+                 */
                 gpmc,sync-read;
                 gpmc,sync-write;
                 gpmc,burst-length = <16>;
@@ -379,26 +392,27 @@
                 gpmc,device-width = <2>;
                 gpmc,mux-add-data = <2>;
                 gpmc,cs-on-ns = <0>;
-                gpmc,cs-rd-off-ns = <87>;
-                gpmc,cs-wr-off-ns = <87>;
+                gpmc,cs-rd-off-ns = <122>;
+                gpmc,cs-wr-off-ns = <122>;
                 gpmc,adv-on-ns = <0>;
-                gpmc,adv-rd-off-ns = <10>;
-                gpmc,adv-wr-off-ns = <10>;
-                gpmc,oe-on-ns = <15>;
-                gpmc,oe-off-ns = <87>;
+                gpmc,adv-rd-off-ns = <15>;
+                gpmc,adv-wr-off-ns = <15>;
+                gpmc,oe-on-ns = <20>;
+                gpmc,oe-off-ns = <122>;
                 gpmc,we-on-ns = <0>;
-                gpmc,we-off-ns = <87>;
-                gpmc,rd-cycle-ns = <112>;
-                gpmc,wr-cycle-ns = <112>;
-                gpmc,access-ns = <81>;
+                gpmc,we-off-ns = <122>;
+                gpmc,rd-cycle-ns = <148>;
+                gpmc,wr-cycle-ns = <148>;
+                gpmc,access-ns = <117>;
                 gpmc,page-burst-access-ns = <15>;
                 gpmc,bus-turnaround-ns = <0>;
                 gpmc,cycle2cycle-delay-ns = <0>;
                 gpmc,wait-monitoring-ns = <0>;
-                gpmc,clk-activation-ns = <5>;
-                gpmc,wr-data-mux-bus-ns = <30>;
-                gpmc,wr-access-ns = <81>;
-                gpmc,sync-clk-ps = <15000>;
+                gpmc,clk-activation-ns = <10>;
+                gpmc,wr-data-mux-bus-ns = <40>;
+                gpmc,wr-access-ns = <117>;
+
+                gpmc,sync-clk-ps = <15000>; /* TBC; Where this value came? */
 
                 /*
                  * MTD partition table corresponding to Nokia's MeeGo 1.2
diff --git a/arch/arm/boot/dts/omap5-l4.dtsi b/arch/arm/boot/dts/omap5-l4.dtsi
index 9c7e309d9c2c..0960348002ad 100644
--- a/arch/arm/boot/dts/omap5-l4.dtsi
+++ b/arch/arm/boot/dts/omap5-l4.dtsi
@@ -1046,8 +1046,6 @@
                                         <SYSC_IDLE_SMART>,
                                         <SYSC_IDLE_SMART_WKUP>;
                         ti,syss-mask = <1>;
-                        ti,no-reset-on-init;
-                        ti,no-idle-on-init;
                         /* Domains (V, P, C): core, core_pwrdm, l4per_clkdm */
                         clocks = <&l4per_clkctrl OMAP5_UART3_CLKCTRL 0>;
                         clock-names = "fck";
diff --git a/arch/arm/boot/dts/r8a7743.dtsi b/arch/arm/boot/dts/r8a7743.dtsi
index 3cc33f7ff7fe..3adc158a40bb 100644
--- a/arch/arm/boot/dts/r8a7743.dtsi
+++ b/arch/arm/boot/dts/r8a7743.dtsi
@@ -1681,15 +1681,12 @@
 
                 du: display@feb00000 {
                         compatible = "renesas,du-r8a7743";
-                        reg = <0 0xfeb00000 0 0x40000>,
-                              <0 0xfeb90000 0 0x1c>;
-                        reg-names = "du", "lvds.0";
+                        reg = <0 0xfeb00000 0 0x40000>;
                         interrupts = <GIC_SPI 256 IRQ_TYPE_LEVEL_HIGH>,
                                      <GIC_SPI 268 IRQ_TYPE_LEVEL_HIGH>;
                         clocks = <&cpg CPG_MOD 724>,
-                                 <&cpg CPG_MOD 723>,
-                                 <&cpg CPG_MOD 726>;
-                        clock-names = "du.0", "du.1", "lvds.0";
+                                 <&cpg CPG_MOD 723>;
+                        clock-names = "du.0", "du.1";
                         status = "disabled";
 
                         ports {
@@ -1704,6 +1701,33 @@
                                 port@1 {
                                         reg = <1>;
                                         du_out_lvds0: endpoint {
+                                                remote-endpoint = <&lvds0_in>;
+                                        };
+                                };
+                        };
+                };
+
+                lvds0: lvds@feb90000 {
+                        compatible = "renesas,r8a7743-lvds";
+                        reg = <0 0xfeb90000 0 0x1c>;
+                        clocks = <&cpg CPG_MOD 726>;
+                        power-domains = <&sysc R8A7743_PD_ALWAYS_ON>;
+                        resets = <&cpg 726>;
+                        status = "disabled";
+
+                        ports {
+                                #address-cells = <1>;
+                                #size-cells = <0>;
+
+                                port@0 {
+                                        reg = <0>;
+                                        lvds0_in: endpoint {
+                                                remote-endpoint = <&du_out_lvds0>;
+                                        };
+                                };
+                                port@1 {
+                                        reg = <1>;
+                                        lvds0_out: endpoint {
                                         };
                                 };
                         };
diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi
index 353d90f99b40..13304b8c5139 100644
--- a/arch/arm/boot/dts/sun6i-a31.dtsi
+++ b/arch/arm/boot/dts/sun6i-a31.dtsi
@@ -216,6 +216,7 @@
                         #clock-cells = <0>;
                         compatible = "fixed-clock";
                         clock-frequency = <24000000>;
+                        clock-output-names = "osc24M";
                 };
 
                 osc32k: clk-32k {
diff --git a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
index 5d23667dc2d2..25540b7694d5 100644
--- a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
+++ b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
@@ -53,7 +53,7 @@
 
         aliases {
                 serial0 = &uart0;
-                /* ethernet0 is the H3 emac, defined in sun8i-h3.dtsi */
+                ethernet0 = &emac;
                 ethernet1 = &sdiowifi;
         };
 
diff --git a/arch/arm/boot/dts/vf610-bk4.dts b/arch/arm/boot/dts/vf610-bk4.dts
index 689c8930dce3..b08d561d6748 100644
--- a/arch/arm/boot/dts/vf610-bk4.dts
+++ b/arch/arm/boot/dts/vf610-bk4.dts
@@ -110,11 +110,11 @@
         bus-num = <3>;
         status = "okay";
         spi-slave;
+        #address-cells = <0>;
 
-        slave@0 {
+        slave {
                 compatible = "lwn,bk4";
                 spi-max-frequency = <30000000>;
-                reg = <0>;
         };
 };
 
diff --git a/arch/arm/mach-cns3xxx/pcie.c b/arch/arm/mach-cns3xxx/pcie.c
index 318394ed5c7a..95a11d5b3587 100644
--- a/arch/arm/mach-cns3xxx/pcie.c
+++ b/arch/arm/mach-cns3xxx/pcie.c
@@ -83,7 +83,7 @@ static void __iomem *cns3xxx_pci_map_bus(struct pci_bus *bus,
         } else /* remote PCI bus */
                 base = cnspci->cfg1_regs + ((busno & 0xf) << 20);
 
-        return base + (where & 0xffc) + (devfn << 12);
+        return base + where + (devfn << 12);
 }
 
 static int cns3xxx_pci_read_config(struct pci_bus *bus, unsigned int devfn,
@@ -93,7 +93,7 @@ static int cns3xxx_pci_read_config(struct pci_bus *bus, unsigned int devfn,
         u32 mask = (0x1ull << (size * 8)) - 1;
         int shift = (where % 4) * 8;
 
-        ret = pci_generic_config_read32(bus, devfn, where, size, val);
+        ret = pci_generic_config_read(bus, devfn, where, size, val);
 
         if (ret == PCIBIOS_SUCCESSFUL && !bus->number && !devfn &&
             (where & 0xffc) == PCI_CLASS_REVISION)
diff --git a/arch/arm/mach-iop32x/n2100.c b/arch/arm/mach-iop32x/n2100.c
index 3b73813c6b04..23e8c93515d4 100644
--- a/arch/arm/mach-iop32x/n2100.c
+++ b/arch/arm/mach-iop32x/n2100.c
@@ -75,8 +75,7 @@ void __init n2100_map_io(void)
 /*
  * N2100 PCI.
  */
-static int __init
-n2100_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+static int n2100_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         int irq;
 
diff --git a/arch/arm/mach-tango/pm.c b/arch/arm/mach-tango/pm.c
index 028e50c6383f..a32c3b631484 100644
--- a/arch/arm/mach-tango/pm.c
+++ b/arch/arm/mach-tango/pm.c
@@ -3,6 +3,7 @@
 #include <linux/suspend.h>
 #include <asm/suspend.h>
 #include "smc.h"
+#include "pm.h"
 
 static int tango_pm_powerdown(unsigned long arg)
 {
@@ -24,10 +25,7 @@ static const struct platform_suspend_ops tango_pm_ops = {
         .valid = suspend_valid_only_mem,
 };
 
-static int __init tango_pm_init(void)
+void __init tango_pm_init(void)
 {
         suspend_set_ops(&tango_pm_ops);
-        return 0;
 }
-
-late_initcall(tango_pm_init);
diff --git a/arch/arm/mach-tango/pm.h b/arch/arm/mach-tango/pm.h
new file mode 100644
index 000000000000..35ea705a0ee2
--- /dev/null
+++ b/arch/arm/mach-tango/pm.h
@@ -0,0 +1,7 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#ifdef CONFIG_SUSPEND
+void __init tango_pm_init(void);
+#else
+#define tango_pm_init NULL
+#endif
diff --git a/arch/arm/mach-tango/setup.c b/arch/arm/mach-tango/setup.c
index 677dd7b5efd9..824f90737b04 100644
--- a/arch/arm/mach-tango/setup.c
+++ b/arch/arm/mach-tango/setup.c
@@ -2,6 +2,7 @@
 #include <asm/mach/arch.h>
 #include <asm/hardware/cache-l2x0.h>
 #include "smc.h"
+#include "pm.h"
 
 static void tango_l2c_write(unsigned long val, unsigned int reg)
 {
@@ -15,4 +16,5 @@ DT_MACHINE_START(TANGO_DT, "Sigma Tango DT")
         .dt_compat      = tango_dt_compat,
         .l2c_aux_mask   = ~0,
         .l2c_write_sec  = tango_l2c_write,
+        .init_late      = tango_pm_init,
 MACHINE_END
diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c
index ed36dcab80f1..f51919974183 100644
--- a/arch/arm/plat-pxa/ssp.c
+++ b/arch/arm/plat-pxa/ssp.c
@@ -190,8 +190,6 @@ static int pxa_ssp_remove(struct platform_device *pdev)
         if (ssp == NULL)
                 return -ENODEV;
 
-        iounmap(ssp->mmio_base);
-
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         release_mem_region(res->start, resource_size(res));
 
@@ -201,7 +199,6 @@ static int pxa_ssp_remove(struct platform_device *pdev)
         list_del(&ssp->node);
         mutex_unlock(&ssp_lock);
 
-        kfree(ssp);
         return 0;
 }
 
diff --git a/arch/arm/xen/mm.c b/arch/arm/xen/mm.c
index cb44aa290e73..e1d44b903dfc 100644
--- a/arch/arm/xen/mm.c
+++ b/arch/arm/xen/mm.c
@@ -7,7 +7,6 @@
 #include <linux/of_address.h>
 #include <linux/slab.h>
 #include <linux/types.h>
-#include <linux/dma-mapping.h>
 #include <linux/vmalloc.h>
 #include <linux/swiotlb.h>
 
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
index b0c64f75792c..8974b5a1d3b1 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
@@ -188,6 +188,7 @@
                 reg = <0x3a3>;
                 interrupt-parent = <&r_intc>;
                 interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
+                x-powers,drive-vbus-en; /* set N_VBUSEN as output pin */
         };
 };
 
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
index 837a03dee875..2abb335145a6 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
@@ -390,7 +390,7 @@
                 };
 
                 video-codec@1c0e000 {
-                        compatible = "allwinner,sun50i-h5-video-engine";
+                        compatible = "allwinner,sun50i-a64-video-engine";
                         reg = <0x01c0e000 0x1000>;
                         clocks = <&ccu CLK_BUS_VE>, <&ccu CLK_VE>,
                                  <&ccu CLK_DRAM_VE>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
index e14e0ce7e89f..016641a41694 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
@@ -187,8 +187,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_boot>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
index 8cd50b75171d..ade2ee09ae96 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
@@ -305,8 +305,7 @@
         max-frequency = <200000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddio_ao3v3>;
         vqmmc-supply = <&vddio_tf>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
index 4cf7f6e80c6a..25105ac96d55 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
@@ -238,8 +238,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_card>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
index 2e1cd5e3a246..1cc9dc68ef00 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
@@ -258,8 +258,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&tflash_vdd>;
         vqmmc-supply = <&tf_io>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
index ce862266b9aa..0be0f2a5d2fe 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
@@ -196,8 +196,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_card>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
index 93a4acf2c46c..ad4d50bd9d77 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
@@ -154,8 +154,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vcc_3v3>;
 };
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
index ec09bb5792b7..2d2db783c44c 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
@@ -211,8 +211,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vcc_3v3>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts
index f1c410e2da2b..796baea7a0bf 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts
@@ -131,8 +131,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_card>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
index db293440e4ca..255cede7b447 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
@@ -238,8 +238,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vcc_3v3>;
         vqmmc-supply = <&vcc_card>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
index 6739697be1de..9cbdb85fb591 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
@@ -183,8 +183,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_card>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
index a1b31013ab6e..bc811a2faf42 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
@@ -137,8 +137,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_boot>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
index 3c3a667a8df8..3f086ed7de05 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
@@ -356,8 +356,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_boot>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
index f7a1cffab4a8..8acfd40090d2 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
@@ -147,8 +147,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_boot>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
index 7212dc4531e4..7fa20a8ede17 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
@@ -170,8 +170,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_boot>;
diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
index 99b7495455a6..838e32cc14c9 100644
--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
@@ -404,7 +404,7 @@
                 };
 
                 intc: interrupt-controller@9bc0000 {
-                        compatible = "arm,gic-v3";
+                        compatible = "qcom,msm8996-gic-v3", "arm,gic-v3";
                         #interrupt-cells = <3>;
                         interrupt-controller;
                         #redistributor-regions = <1>;
diff --git a/arch/arm64/boot/dts/renesas/r8a774a1.dtsi b/arch/arm64/boot/dts/renesas/r8a774a1.dtsi
index 20745a8528c5..719ed9d9067d 100644
--- a/arch/arm64/boot/dts/renesas/r8a774a1.dtsi
+++ b/arch/arm64/boot/dts/renesas/r8a774a1.dtsi
@@ -1011,6 +1011,9 @@
                                  <&cpg CPG_CORE R8A774A1_CLK_S3D1>,
                                  <&scif_clk>;
                         clock-names = "fck", "brg_int", "scif_clk";
+                        dmas = <&dmac1 0x13>, <&dmac1 0x12>,
+                               <&dmac2 0x13>, <&dmac2 0x12>;
+                        dma-names = "tx", "rx", "tx", "rx";
                         power-domains = <&sysc R8A774A1_PD_ALWAYS_ON>;
                         resets = <&cpg 310>;
                         status = "disabled";
diff --git a/arch/arm64/boot/dts/renesas/r8a7796.dtsi b/arch/arm64/boot/dts/renesas/r8a7796.dtsi
index afedbf5728ec..0648d12778ed 100644
--- a/arch/arm64/boot/dts/renesas/r8a7796.dtsi
+++ b/arch/arm64/boot/dts/renesas/r8a7796.dtsi
@@ -1262,6 +1262,9 @@
                                  <&cpg CPG_CORE R8A7796_CLK_S3D1>,
                                  <&scif_clk>;
                         clock-names = "fck", "brg_int", "scif_clk";
+                        dmas = <&dmac1 0x13>, <&dmac1 0x12>,
+                               <&dmac2 0x13>, <&dmac2 0x12>;
+                        dma-names = "tx", "rx", "tx", "rx";
                         power-domains = <&sysc R8A7796_PD_ALWAYS_ON>;
                         resets = <&cpg 310>;
                         status = "disabled";
diff --git a/arch/arm64/boot/dts/renesas/r8a77965.dtsi b/arch/arm64/boot/dts/renesas/r8a77965.dtsi
index 6dc9b1fef830..4b3730f640ef 100644
--- a/arch/arm64/boot/dts/renesas/r8a77965.dtsi
+++ b/arch/arm64/boot/dts/renesas/r8a77965.dtsi
@@ -1068,6 +1068,9 @@
                                  <&cpg CPG_CORE R8A77965_CLK_S3D1>,
                                  <&scif_clk>;
                         clock-names = "fck", "brg_int", "scif_clk";
+                        dmas = <&dmac1 0x13>, <&dmac1 0x12>,
+                               <&dmac2 0x13>, <&dmac2 0x12>;
+                        dma-names = "tx", "rx", "tx", "rx";
                         power-domains = <&sysc R8A77965_PD_ALWAYS_ON>;
                         resets = <&cpg 310>;
                         status = "disabled";
diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
index 29cdc99688f3..9859e1178e6b 100644
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -299,8 +299,10 @@ int swsusp_arch_suspend(void)
                 dcache_clean_range(__idmap_text_start, __idmap_text_end);
 
                 /* Clean kvm setup code to PoC? */
-                if (el2_reset_needed())
+                if (el2_reset_needed()) {
                         dcache_clean_range(__hyp_idmap_text_start, __hyp_idmap_text_end);
+                        dcache_clean_range(__hyp_text_start, __hyp_text_end);
+                }
 
                 /* make the crash dump kernel image protected again */
                 crash_post_resume();
diff --git a/arch/arm64/kernel/hyp-stub.S b/arch/arm64/kernel/hyp-stub.S
index e1261fbaa374..17f325ba831e 100644
--- a/arch/arm64/kernel/hyp-stub.S
+++ b/arch/arm64/kernel/hyp-stub.S
@@ -28,6 +28,8 @@
 #include <asm/virt.h>
 
         .text
+        .pushsection    .hyp.text, "ax"
+
         .align 11
 
 ENTRY(__hyp_stub_vectors)
diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c
index ba6b41790fcd..b09b6f75f759 100644
--- a/arch/arm64/kernel/kaslr.c
+++ b/arch/arm64/kernel/kaslr.c
@@ -88,6 +88,7 @@ u64 __init kaslr_early_init(u64 dt_phys)
          * we end up running with module randomization disabled.
          */
         module_alloc_base = (u64)_etext - MODULES_VSIZE;
+        __flush_dcache_area(&module_alloc_base, sizeof(module_alloc_base));
 
         /*
          * Try to map the FDT early. If this fails, we simply bail,
diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c
index f2c211a6229b..58871333737a 100644
--- a/arch/arm64/kernel/machine_kexec_file.c
+++ b/arch/arm64/kernel/machine_kexec_file.c
@@ -120,10 +120,12 @@ static int create_dtb(struct kimage *image,
 {
         void *buf;
         size_t buf_size;
+        size_t cmdline_len;
         int ret;
 
+        cmdline_len = cmdline ? strlen(cmdline) : 0;
         buf_size = fdt_totalsize(initial_boot_params)
-                        + strlen(cmdline) + DTB_EXTRA_SPACE;
+                        + cmdline_len + DTB_EXTRA_SPACE;
 
         for (;;) {
                 buf = vmalloc(buf_size);
diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
index 2a5b338b2542..f17afb99890c 100644
--- a/arch/arm64/kernel/probes/kprobes.c
+++ b/arch/arm64/kernel/probes/kprobes.c
@@ -478,13 +478,13 @@ bool arch_within_kprobe_blacklist(unsigned long addr)
             addr < (unsigned long)__entry_text_end) ||
             (addr >= (unsigned long)__idmap_text_start &&
             addr < (unsigned long)__idmap_text_end) ||
+            (addr >= (unsigned long)__hyp_text_start &&
+            addr < (unsigned long)__hyp_text_end) ||
             !!search_exception_tables(addr))
                 return true;
 
         if (!is_kernel_in_hyp_mode()) {
-                if ((addr >= (unsigned long)__hyp_text_start &&
-                    addr < (unsigned long)__hyp_text_end) ||
-                    (addr >= (unsigned long)__hyp_idmap_text_start &&
+                if ((addr >= (unsigned long)__hyp_idmap_text_start &&
                     addr < (unsigned long)__hyp_idmap_text_end))
                         return true;
         }
diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
index fcb1f2a6d7c6..99bb8facb5cb 100644
--- a/arch/arm64/mm/dump.c
+++ b/arch/arm64/mm/dump.c
@@ -286,74 +286,73 @@ static void note_page(struct pg_state *st, unsigned long addr, unsigned level,
 
 }
 
-static void walk_pte(struct pg_state *st, pmd_t *pmdp, unsigned long start)
+static void walk_pte(struct pg_state *st, pmd_t *pmdp, unsigned long start,
+                     unsigned long end)
 {
-        pte_t *ptep = pte_offset_kernel(pmdp, 0UL);
-        unsigned long addr;
-        unsigned i;
+        unsigned long addr = start;
+        pte_t *ptep = pte_offset_kernel(pmdp, start);
 
-        for (i = 0; i < PTRS_PER_PTE; i++, ptep++) {
-                addr = start + i * PAGE_SIZE;
+        do {
                 note_page(st, addr, 4, READ_ONCE(pte_val(*ptep)));
-        }
+        } while (ptep++, addr += PAGE_SIZE, addr != end);
 }
 
-static void walk_pmd(struct pg_state *st, pud_t *pudp, unsigned long start)
+static void walk_pmd(struct pg_state *st, pud_t *pudp, unsigned long start,
+                     unsigned long end)
 {
-        pmd_t *pmdp = pmd_offset(pudp, 0UL);
-        unsigned long addr;
-        unsigned i;
+        unsigned long next, addr = start;
+        pmd_t *pmdp = pmd_offset(pudp, start);
 
-        for (i = 0; i < PTRS_PER_PMD; i++, pmdp++) {
+        do {
                 pmd_t pmd = READ_ONCE(*pmdp);
+                next = pmd_addr_end(addr, end);
 
-                addr = start + i * PMD_SIZE;
                 if (pmd_none(pmd) || pmd_sect(pmd)) {
                         note_page(st, addr, 3, pmd_val(pmd));
                 } else {
                         BUG_ON(pmd_bad(pmd));
-                        walk_pte(st, pmdp, addr);
+                        walk_pte(st, pmdp, addr, next);
                 }
-        }
+        } while (pmdp++, addr = next, addr != end);
 }
 
-static void walk_pud(struct pg_state *st, pgd_t *pgdp, unsigned long start)
+static void walk_pud(struct pg_state *st, pgd_t *pgdp, unsigned long start,
+                     unsigned long end)
 {
-        pud_t *pudp = pud_offset(pgdp, 0UL);
-        unsigned long addr;
-        unsigned i;
+        unsigned long next, addr = start;
+        pud_t *pudp = pud_offset(pgdp, start);
 
-        for (i = 0; i < PTRS_PER_PUD; i++, pudp++) {
+        do {
                 pud_t pud = READ_ONCE(*pudp);
+                next = pud_addr_end(addr, end);
 
-                addr = start + i * PUD_SIZE;
                 if (pud_none(pud) || pud_sect(pud)) {
                         note_page(st, addr, 2, pud_val(pud));
                 } else {
                         BUG_ON(pud_bad(pud));
-                        walk_pmd(st, pudp, addr);
+                        walk_pmd(st, pudp, addr, next);
                 }
-        }
+        } while (pudp++, addr = next, addr != end);
 }
 
 static void walk_pgd(struct pg_state *st, struct mm_struct *mm,
                      unsigned long start)
 {
-        pgd_t *pgdp = pgd_offset(mm, 0UL);
-        unsigned i;
-        unsigned long addr;
+        unsigned long end = (start < TASK_SIZE_64) ? TASK_SIZE_64 : 0;
+        unsigned long next, addr = start;
+        pgd_t *pgdp = pgd_offset(mm, start);
 
-        for (i = 0; i < PTRS_PER_PGD; i++, pgdp++) {
+        do {
                 pgd_t pgd = READ_ONCE(*pgdp);
+                next = pgd_addr_end(addr, end);
 
-                addr = start + i * PGDIR_SIZE;
                 if (pgd_none(pgd)) {
                         note_page(st, addr, 1, pgd_val(pgd));
                 } else {
                         BUG_ON(pgd_bad(pgd));
-                        walk_pud(st, pgdp, addr);
+                        walk_pud(st, pgdp, addr, next);
                 }
-        }
+        } while (pgdp++, addr = next, addr != end);
 }
 
 void ptdump_walk_pgd(struct seq_file *m, struct ptdump_info *info)
diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c
index 30695a868107..5c9073bace83 100644
--- a/arch/arm64/mm/flush.c
+++ b/arch/arm64/mm/flush.c
@@ -33,7 +33,11 @@ void sync_icache_aliases(void *kaddr, unsigned long len)
                 __clean_dcache_area_pou(kaddr, len);
                 __flush_icache_all();
         } else {
-                flush_icache_range(addr, addr + len);
+                /*
+                 * Don't issue kick_all_cpus_sync() after I-cache invalidation
+                 * for user mappings.
+                 */
+                __flush_icache_range(addr, addr + len);
         }
 }
 
diff --git a/arch/c6x/include/asm/Kbuild b/arch/c6x/include/asm/Kbuild
index 33a2c94fed0d..63b4a1705182 100644
--- a/arch/c6x/include/asm/Kbuild
+++ b/arch/c6x/include/asm/Kbuild
@@ -30,6 +30,7 @@ generic-y += pgalloc.h
 generic-y += preempt.h
 generic-y += segment.h
 generic-y += serial.h
+generic-y += shmparam.h
 generic-y += tlbflush.h
 generic-y += topology.h
 generic-y += trace_clock.h
diff --git a/arch/c6x/include/uapi/asm/Kbuild b/arch/c6x/include/uapi/asm/Kbuild
index 6c6f6301012e..0febf1a07c30 100644
--- a/arch/c6x/include/uapi/asm/Kbuild
+++ b/arch/c6x/include/uapi/asm/Kbuild
@@ -1,5 +1,4 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += kvm_para.h
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/h8300/include/asm/Kbuild b/arch/h8300/include/asm/Kbuild
index cd400d353d18..961c1dc064e1 100644
--- a/arch/h8300/include/asm/Kbuild
+++ b/arch/h8300/include/asm/Kbuild
@@ -40,6 +40,7 @@ generic-y += preempt.h
 generic-y += scatterlist.h
 generic-y += sections.h
 generic-y += serial.h
+generic-y += shmparam.h
 generic-y += sizes.h
 generic-y += spinlock.h
 generic-y += timex.h
diff --git a/arch/h8300/include/uapi/asm/Kbuild b/arch/h8300/include/uapi/asm/Kbuild
index 6c6f6301012e..0febf1a07c30 100644
--- a/arch/h8300/include/uapi/asm/Kbuild
+++ b/arch/h8300/include/uapi/asm/Kbuild
@@ -1,5 +1,4 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += kvm_para.h
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/hexagon/include/asm/Kbuild b/arch/hexagon/include/asm/Kbuild
index 47c4da3d64a4..b25fd42aa0f4 100644
--- a/arch/hexagon/include/asm/Kbuild
+++ b/arch/hexagon/include/asm/Kbuild
@@ -30,6 +30,7 @@ generic-y += rwsem.h
 generic-y += sections.h
 generic-y += segment.h
 generic-y += serial.h
+generic-y += shmparam.h
 generic-y += sizes.h
 generic-y += topology.h
 generic-y += trace_clock.h
diff --git a/arch/hexagon/include/uapi/asm/Kbuild b/arch/hexagon/include/uapi/asm/Kbuild
index 61d955c1747a..c1b06dcf6cf8 100644
--- a/arch/hexagon/include/uapi/asm/Kbuild
+++ b/arch/hexagon/include/uapi/asm/Kbuild
@@ -1,4 +1,3 @@
 include include/uapi/asm-generic/Kbuild.asm
 
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/m68k/include/asm/Kbuild b/arch/m68k/include/asm/Kbuild
index 9f1dd26903e3..95f8f631c4df 100644
--- a/arch/m68k/include/asm/Kbuild
+++ b/arch/m68k/include/asm/Kbuild
@@ -20,6 +20,7 @@ generic-y += mm-arch-hooks.h
 generic-y += percpu.h
 generic-y += preempt.h
 generic-y += sections.h
+generic-y += shmparam.h
 generic-y += spinlock.h
 generic-y += topology.h
 generic-y += trace_clock.h
diff --git a/arch/m68k/include/uapi/asm/Kbuild b/arch/m68k/include/uapi/asm/Kbuild
index b8b3525271fa..960bf1e4be53 100644
--- a/arch/m68k/include/uapi/asm/Kbuild
+++ b/arch/m68k/include/uapi/asm/Kbuild
@@ -2,4 +2,3 @@ include include/uapi/asm-generic/Kbuild.asm
 
 generated-y += unistd_32.h
 generic-y += kvm_para.h
-generic-y += shmparam.h
diff --git a/arch/microblaze/include/asm/Kbuild b/arch/microblaze/include/asm/Kbuild
index 9c7d1d25bf3d..791cc8d54d0a 100644
--- a/arch/microblaze/include/asm/Kbuild
+++ b/arch/microblaze/include/asm/Kbuild
@@ -26,6 +26,7 @@ generic-y += parport.h
 generic-y += percpu.h
 generic-y += preempt.h
 generic-y += serial.h
+generic-y += shmparam.h
 generic-y += syscalls.h
 generic-y += topology.h
 generic-y += trace_clock.h
diff --git a/arch/microblaze/include/uapi/asm/Kbuild b/arch/microblaze/include/uapi/asm/Kbuild
index 28823e3db825..97823ec46e97 100644
--- a/arch/microblaze/include/uapi/asm/Kbuild
+++ b/arch/microblaze/include/uapi/asm/Kbuild
@@ -2,5 +2,4 @@ include include/uapi/asm-generic/Kbuild.asm
 
 generated-y += unistd_32.h
 generic-y += kvm_para.h
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 0d14f51d0002..a84c24d894aa 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1403,6 +1403,21 @@ config LOONGSON3_ENHANCEMENT
           please say 'N' here. If you want a high-performance kernel to run on
           new Loongson 3 machines only, please say 'Y' here.
 
+config CPU_LOONGSON3_WORKAROUNDS
+        bool "Old Loongson 3 LLSC Workarounds"
+        default y if SMP
+        depends on CPU_LOONGSON3
+        help
+          Loongson 3 processors have the llsc issues which require workarounds.
+          Without workarounds the system may hang unexpectedly.
+
+          Newer Loongson 3 will fix these issues and no workarounds are needed.
+          The workarounds have no significant side effect on them but may
+          decrease the performance of the system so this option should be
+          disabled unless the kernel is intended to be run on old systems.
+
+          If unsure, please say Y.
+
 config CPU_LOONGSON2E
         bool "Loongson 2E"
         depends on SYS_HAS_CPU_LOONGSON2E
diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts
index 50cff3cbcc6d..4f7b1fa31cf5 100644
--- a/arch/mips/boot/dts/ingenic/ci20.dts
+++ b/arch/mips/boot/dts/ingenic/ci20.dts
@@ -76,7 +76,7 @@
         status = "okay";
 
         pinctrl-names = "default";
-        pinctrl-0 = <&pins_uart2>;
+        pinctrl-0 = <&pins_uart3>;
 };
 
 &uart4 {
@@ -196,9 +196,9 @@
                 bias-disable;
         };
 
-        pins_uart2: uart2 {
-                function = "uart2";
-                groups = "uart2-data", "uart2-hwflow";
+        pins_uart3: uart3 {
+                function = "uart3";
+                groups = "uart3-data", "uart3-hwflow";
                 bias-disable;
         };
 
diff --git a/arch/mips/boot/dts/ingenic/jz4740.dtsi b/arch/mips/boot/dts/ingenic/jz4740.dtsi
index 6fb16fd24035..2beb78a62b7d 100644
--- a/arch/mips/boot/dts/ingenic/jz4740.dtsi
+++ b/arch/mips/boot/dts/ingenic/jz4740.dtsi
@@ -161,7 +161,7 @@
                 #dma-cells = <2>;
 
                 interrupt-parent = <&intc>;
-                interrupts = <29>;
+                interrupts = <20>;
 
                 clocks = <&cgu JZ4740_CLK_DMA>;
 
diff --git a/arch/mips/boot/dts/xilfpga/nexys4ddr.dts b/arch/mips/boot/dts/xilfpga/nexys4ddr.dts
index 2152b7ba65fb..cc8dbea0911f 100644
--- a/arch/mips/boot/dts/xilfpga/nexys4ddr.dts
+++ b/arch/mips/boot/dts/xilfpga/nexys4ddr.dts
@@ -90,11 +90,11 @@
                 interrupts = <0>;
         };
 
-        axi_i2c: i2c@10A00000 {
+        axi_i2c: i2c@10a00000 {
             compatible = "xlnx,xps-iic-2.00.a";
             interrupt-parent = <&axi_intc>;
             interrupts = <4>;
-            reg = < 0x10A00000 0x10000 >;
+            reg = < 0x10a00000 0x10000 >;
             clocks = <&ext>;
             xlnx,clk-freq = <0x5f5e100>;
             xlnx,family = "Artix7";
@@ -106,9 +106,9 @@
             #address-cells = <1>;
             #size-cells = <0>;
 
-            ad7420@4B {
+            ad7420@4b {
                 compatible = "adi,adt7420";
-                reg = <0x4B>;
+                reg = <0x4b>;
             };
         } ;
 };
diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
index 43fcd35e2957..94096299fc56 100644
--- a/arch/mips/include/asm/atomic.h
+++ b/arch/mips/include/asm/atomic.h
@@ -58,6 +58,7 @@ static __inline__ void atomic_##op(int i, atomic_t * v)			      \
         if (kernel_uses_llsc) {                                               \
                 int temp;                                                     \
                                                                               \
+                loongson_llsc_mb();                                           \
                 __asm__ __volatile__(                                         \
                 "       .set    push                                    \n"   \
                 "       .set    "MIPS_ISA_LEVEL"                        \n"   \
@@ -85,6 +86,7 @@ static __inline__ int atomic_##op##_return_relaxed(int i, atomic_t * v)	      \
         if (kernel_uses_llsc) {                                               \
                 int temp;                                                     \
                                                                               \
+                loongson_llsc_mb();                                           \
                 __asm__ __volatile__(                                         \
                 "       .set    push                                    \n"   \
                 "       .set    "MIPS_ISA_LEVEL"                        \n"   \
@@ -118,6 +120,7 @@ static __inline__ int atomic_fetch_##op##_relaxed(int i, atomic_t * v)	      \
         if (kernel_uses_llsc) {                                               \
                 int temp;                                                     \
                                                                               \
+                loongson_llsc_mb();                                           \
                 __asm__ __volatile__(                                         \
                 "       .set    push                                    \n"   \
                 "       .set    "MIPS_ISA_LEVEL"                        \n"   \
@@ -256,6 +259,7 @@ static __inline__ void atomic64_##op(long i, atomic64_t * v)		      \
         if (kernel_uses_llsc) {                                               \
                 long temp;                                                    \
                                                                               \
+                loongson_llsc_mb();                                           \
                 __asm__ __volatile__(                                         \
                 "       .set    push                                    \n"   \
                 "       .set    "MIPS_ISA_LEVEL"                        \n"   \
@@ -283,6 +287,7 @@ static __inline__ long atomic64_##op##_return_relaxed(long i, atomic64_t * v) \
         if (kernel_uses_llsc) {                                               \
                 long temp;                                                    \
                                                                               \
+                loongson_llsc_mb();                                           \
                 __asm__ __volatile__(                                         \
                 "       .set    push                                    \n"   \
                 "       .set    "MIPS_ISA_LEVEL"                        \n"   \
@@ -316,6 +321,7 @@ static __inline__ long atomic64_fetch_##op##_relaxed(long i, atomic64_t * v)  \
         if (kernel_uses_llsc) {                                               \
                 long temp;                                                    \
                                                                               \
+                loongson_llsc_mb();                                           \
                 __asm__ __volatile__(                                         \
                 "       .set    push                                    \n"   \
                 "       .set    "MIPS_ISA_LEVEL"                        \n"   \
diff --git a/arch/mips/include/asm/barrier.h b/arch/mips/include/asm/barrier.h
index a5eb1bb199a7..b7f6ac5e513c 100644
--- a/arch/mips/include/asm/barrier.h
+++ b/arch/mips/include/asm/barrier.h
@@ -222,6 +222,42 @@
 #define __smp_mb__before_atomic()       __smp_mb__before_llsc()
 #define __smp_mb__after_atomic()        smp_llsc_mb()
 
+/*
+ * Some Loongson 3 CPUs have a bug wherein execution of a memory access (load,
+ * store or pref) in between an ll & sc can cause the sc instruction to
+ * erroneously succeed, breaking atomicity. Whilst it's unusual to write code
+ * containing such sequences, this bug bites harder than we might otherwise
+ * expect due to reordering & speculation:
+ *
+ * 1) A memory access appearing prior to the ll in program order may actually
+ *    be executed after the ll - this is the reordering case.
+ *
+ *    In order to avoid this we need to place a memory barrier (ie. a sync
+ *    instruction) prior to every ll instruction, in between it & any earlier
+ *    memory access instructions. Many of these cases are already covered by
+ *    smp_mb__before_llsc() but for the remaining cases, typically ones in
+ *    which multiple CPUs may operate on a memory location but ordering is not
+ *    usually guaranteed, we use loongson_llsc_mb() below.
+ *
+ *    This reordering case is fixed by 3A R2 CPUs, ie. 3A2000 models and later.
+ *
+ * 2) If a conditional branch exists between an ll & sc with a target outside
+ *    of the ll-sc loop, for example an exit upon value mismatch in cmpxchg()
+ *    or similar, then misprediction of the branch may allow speculative
+ *    execution of memory accesses from outside of the ll-sc loop.
+ *
+ *    In order to avoid this we need a memory barrier (ie. a sync instruction)
+ *    at each affected branch target, for which we also use loongson_llsc_mb()
+ *    defined below.
+ *
+ *    This case affects all current Loongson 3 CPUs.
+ */
+#ifdef CONFIG_CPU_LOONGSON3_WORKAROUNDS /* Loongson-3's LLSC workaround */
+#define loongson_llsc_mb()      __asm__ __volatile__(__WEAK_LLSC_MB : : :"memory")
+#else
+#define loongson_llsc_mb()      do { } while (0)
+#endif
+
 #include <asm-generic/barrier.h>
 
 #endif /* __ASM_BARRIER_H */
diff --git a/arch/mips/include/asm/bitops.h b/arch/mips/include/asm/bitops.h
index c4675957b21b..830c93a010c3 100644
--- a/arch/mips/include/asm/bitops.h
+++ b/arch/mips/include/asm/bitops.h
@@ -69,6 +69,7 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr)
                 : "ir" (1UL << bit), GCC_OFF_SMALL_ASM() (*m));
 #if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6)
         } else if (kernel_uses_llsc && __builtin_constant_p(bit)) {
+                loongson_llsc_mb();
                 do {
                         __asm__ __volatile__(
                         "       " __LL "%0, %1          # set_bit       \n"
@@ -79,6 +80,7 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr)
                 } while (unlikely(!temp));
 #endif /* CONFIG_CPU_MIPSR2 || CONFIG_CPU_MIPSR6 */
         } else if (kernel_uses_llsc) {
+                loongson_llsc_mb();
                 do {
                         __asm__ __volatile__(
                         "       .set    push                            \n"
@@ -123,6 +125,7 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr)
                 : "ir" (~(1UL << bit)));
 #if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6)
         } else if (kernel_uses_llsc && __builtin_constant_p(bit)) {
+                loongson_llsc_mb();
                 do {
                         __asm__ __volatile__(
                         "       " __LL "%0, %1          # clear_bit     \n"
@@ -133,6 +136,7 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr)
                 } while (unlikely(!temp));
 #endif /* CONFIG_CPU_MIPSR2 || CONFIG_CPU_MIPSR6 */
         } else if (kernel_uses_llsc) {
+                loongson_llsc_mb();
                 do {
                         __asm__ __volatile__(
                         "       .set    push                            \n"
@@ -193,6 +197,7 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *addr)
                 unsigned long *m = ((unsigned long *) addr) + (nr >> SZLONG_LOG);
                 unsigned long temp;
 
+                loongson_llsc_mb();
                 do {
                         __asm__ __volatile__(
                         "       .set    push                            \n"
diff --git a/arch/mips/include/asm/futex.h b/arch/mips/include/asm/futex.h
index c14d798f3888..b83b0397462d 100644
--- a/arch/mips/include/asm/futex.h
+++ b/arch/mips/include/asm/futex.h
@@ -50,6 +50,7 @@
                   "i" (-EFAULT)                                         \
                 : "memory");                                            \
         } else if (cpu_has_llsc) {                                      \
+                loongson_llsc_mb();                                     \
                 __asm__ __volatile__(                                   \
                 "       .set    push                            \n"     \
                 "       .set    noat                            \n"     \
@@ -163,6 +164,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
                   "i" (-EFAULT)
                 : "memory");
         } else if (cpu_has_llsc) {
+                loongson_llsc_mb();
                 __asm__ __volatile__(
                 "# futex_atomic_cmpxchg_inatomic                        \n"
                 "       .set    push                                    \n"
@@ -192,6 +194,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
                 : GCC_OFF_SMALL_ASM() (*uaddr), "Jr" (oldval), "Jr" (newval),
                   "i" (-EFAULT)
                 : "memory");
+                loongson_llsc_mb();
         } else
                 return -ENOSYS;
 
diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h
index 57933fc8fd98..910851c62db3 100644
--- a/arch/mips/include/asm/pgtable.h
+++ b/arch/mips/include/asm/pgtable.h
@@ -228,6 +228,7 @@ static inline void set_pte(pte_t *ptep, pte_t pteval)
                         : [buddy] "+m" (buddy->pte), [tmp] "=&r" (tmp)
                         : [global] "r" (page_global));
                 } else if (kernel_uses_llsc) {
+                        loongson_llsc_mb();
                         __asm__ __volatile__ (
                         "       .set    push                            \n"
                         "       .set    "MIPS_ISA_ARCH_LEVEL"           \n"
@@ -242,6 +243,7 @@ static inline void set_pte(pte_t *ptep, pte_t pteval)
                         "       .set    pop                             \n"
                         : [buddy] "+m" (buddy->pte), [tmp] "=&r" (tmp)
                         : [global] "r" (page_global));
+                        loongson_llsc_mb();
                 }
 #else /* !CONFIG_SMP */
                 if (pte_none(*buddy))
diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c
index 8f5bd04f320a..7f3f136572de 100644
--- a/arch/mips/kernel/mips-cm.c
+++ b/arch/mips/kernel/mips-cm.c
@@ -457,5 +457,5 @@ void mips_cm_error_report(void)
         }
 
         /* reprime cause register */
-        write_gcr_error_cause(0);
+        write_gcr_error_cause(cm_error);
 }
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 6829a064aac8..339870ed92f7 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -371,7 +371,7 @@ static inline int is_sp_move_ins(union mips_instruction *ip, int *frame_size)
 static int get_frame_info(struct mips_frame_info *info)
 {
         bool is_mmips = IS_ENABLED(CONFIG_CPU_MICROMIPS);
-        union mips_instruction insn, *ip, *ip_end;
+        union mips_instruction insn, *ip;
         const unsigned int max_insns = 128;
         unsigned int last_insn_size = 0;
         unsigned int i;
@@ -384,10 +384,9 @@ static int get_frame_info(struct mips_frame_info *info)
         if (!ip)
                 goto err;
 
-        ip_end = (void *)ip + info->func_size;
-
-        for (i = 0; i < max_insns && ip < ip_end; i++) {
+        for (i = 0; i < max_insns; i++) {
                 ip = (void *)ip + last_insn_size;
+
                 if (is_mmips && mm_insn_16bit(ip->halfword[0])) {
                         insn.word = ip->halfword[0] << 16;
                         last_insn_size = 2;
diff --git a/arch/mips/loongson64/Platform b/arch/mips/loongson64/Platform
index 0fce4608aa88..c1a4d4dc4665 100644
--- a/arch/mips/loongson64/Platform
+++ b/arch/mips/loongson64/Platform
@@ -23,6 +23,29 @@ ifdef CONFIG_CPU_LOONGSON2F_WORKAROUNDS
 endif
 
 cflags-$(CONFIG_CPU_LOONGSON3)  += -Wa,--trap
+
+#
+# Some versions of binutils, not currently mainline as of 2019/02/04, support
+# an -mfix-loongson3-llsc flag which emits a sync prior to each ll instruction
+# to work around a CPU bug (see loongson_llsc_mb() in asm/barrier.h for a
+# description).
+#
+# We disable this in order to prevent the assembler meddling with the
+# instruction that labels refer to, ie. if we label an ll instruction:
+#
+# 1: ll v0, 0(a0)
+#
+# ...then with the assembler fix applied the label may actually point at a sync
+# instruction inserted by the assembler, and if we were using the label in an
+# exception table the table would no longer contain the address of the ll
+# instruction.
+#
+# Avoid this by explicitly disabling that assembler behaviour. If upstream
+# binutils does not merge support for the flag then we can revisit & remove
+# this later - for now it ensures vendor toolchains don't cause problems.
+#
+cflags-$(CONFIG_CPU_LOONGSON3)  += $(call as-option,-Wa$(comma)-mno-fix-loongson3-llsc,)
+
 #
 # binutils from v2.25 on and gcc starting from v4.9.0 treat -march=loongson3a
 # as MIPS64 R2; older versions as just R1.  This leaves the possibility open
diff --git a/arch/mips/loongson64/common/reset.c b/arch/mips/loongson64/common/reset.c
index a60715e11306..b26892ce871c 100644
--- a/arch/mips/loongson64/common/reset.c
+++ b/arch/mips/loongson64/common/reset.c
@@ -59,7 +59,12 @@ static void loongson_poweroff(void)
 {
 #ifndef CONFIG_LEFI_FIRMWARE_INTERFACE
         mach_prepare_shutdown();
-        unreachable();
+
+        /*
+         * It needs a wait loop here, but mips/kernel/reset.c already calls
+         * a generic delay loop, machine_hang(), so simply return.
+         */
+        return;
 #else
         void (*fw_poweroff)(void) = (void *)loongson_sysconf.poweroff_addr;
 
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 37b1cb246332..65b6e85447b1 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -932,6 +932,8 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
                  * to mimic that here by taking a load/istream page
                  * fault.
                  */
+                if (IS_ENABLED(CONFIG_CPU_LOONGSON3_WORKAROUNDS))
+                        uasm_i_sync(p, 0);
                 UASM_i_LA(p, ptr, (unsigned long)tlb_do_page_fault_0);
                 uasm_i_jr(p, ptr);
 
@@ -1646,6 +1648,8 @@ static void
 iPTE_LW(u32 **p, unsigned int pte, unsigned int ptr)
 {
 #ifdef CONFIG_SMP
+        if (IS_ENABLED(CONFIG_CPU_LOONGSON3_WORKAROUNDS))
+                uasm_i_sync(p, 0);
 # ifdef CONFIG_PHYS_ADDR_T_64BIT
         if (cpu_has_64bits)
                 uasm_i_lld(p, pte, 0, ptr);
@@ -2259,6 +2263,8 @@ static void build_r4000_tlb_load_handler(void)
 #endif
 
         uasm_l_nopage_tlbl(&l, p);
+        if (IS_ENABLED(CONFIG_CPU_LOONGSON3_WORKAROUNDS))
+                uasm_i_sync(&p, 0);
         build_restore_work_registers(&p);
 #ifdef CONFIG_CPU_MICROMIPS
         if ((unsigned long)tlb_do_page_fault_0 & 1) {
@@ -2313,6 +2319,8 @@ static void build_r4000_tlb_store_handler(void)
 #endif
 
         uasm_l_nopage_tlbs(&l, p);
+        if (IS_ENABLED(CONFIG_CPU_LOONGSON3_WORKAROUNDS))
+                uasm_i_sync(&p, 0);
         build_restore_work_registers(&p);
 #ifdef CONFIG_CPU_MICROMIPS
         if ((unsigned long)tlb_do_page_fault_1 & 1) {
@@ -2368,6 +2376,8 @@ static void build_r4000_tlb_modify_handler(void)
 #endif
 
         uasm_l_nopage_tlbm(&l, p);
+        if (IS_ENABLED(CONFIG_CPU_LOONGSON3_WORKAROUNDS))
+                uasm_i_sync(&p, 0);
         build_restore_work_registers(&p);
 #ifdef CONFIG_CPU_MICROMIPS
         if ((unsigned long)tlb_do_page_fault_1 & 1) {
diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c
index 5017d5843c5a..fc29b85cfa92 100644
--- a/arch/mips/pci/pci-octeon.c
+++ b/arch/mips/pci/pci-octeon.c
@@ -568,6 +568,11 @@ static int __init octeon_pci_setup(void)
         if (octeon_has_feature(OCTEON_FEATURE_PCIE))
                 return 0;
 
+        if (!octeon_is_pci_host()) {
+                pr_notice("Not in host mode, PCI Controller not initialized\n");
+                return 0;
+        }
+
         /* Point pcibios_map_irq() to the PCI version of it */
         octeon_pcibios_map_irq = octeon_pci_pcibios_map_irq;
 
@@ -579,11 +584,6 @@ static int __init octeon_pci_setup(void)
         else
                 octeon_dma_bar_type = OCTEON_DMA_BAR_TYPE_BIG;
 
-        if (!octeon_is_pci_host()) {
-                pr_notice("Not in host mode, PCI Controller not initialized\n");
-                return 0;
-        }
-
         /* PCI I/O and PCI MEM values */
         set_io_port_base(OCTEON_PCI_IOSPACE_BASE);
         ioport_resource.start = 0;
diff --git a/arch/mips/vdso/Makefile b/arch/mips/vdso/Makefile
index f6fd340e39c2..0ede4deb8181 100644
--- a/arch/mips/vdso/Makefile
+++ b/arch/mips/vdso/Makefile
@@ -8,6 +8,7 @@ ccflags-vdso := \
         $(filter -E%,$(KBUILD_CFLAGS)) \
         $(filter -mmicromips,$(KBUILD_CFLAGS)) \
         $(filter -march=%,$(KBUILD_CFLAGS)) \
+        $(filter -m%-float,$(KBUILD_CFLAGS)) \
         -D__VDSO__
 
 ifdef CONFIG_CC_IS_CLANG
@@ -129,7 +130,7 @@ $(obj)/%-o32.o: $(src)/%.c FORCE
         $(call cmd,force_checksrc)
         $(call if_changed_rule,cc_o_c)
 
-$(obj)/vdso-o32.lds: KBUILD_CPPFLAGS := -mabi=32
+$(obj)/vdso-o32.lds: KBUILD_CPPFLAGS := $(ccflags-vdso) -mabi=32
 $(obj)/vdso-o32.lds: $(src)/vdso.lds.S FORCE
         $(call if_changed_dep,cpp_lds_S)
 
@@ -169,7 +170,7 @@ $(obj)/%-n32.o: $(src)/%.c FORCE
         $(call cmd,force_checksrc)
         $(call if_changed_rule,cc_o_c)
 
-$(obj)/vdso-n32.lds: KBUILD_CPPFLAGS := -mabi=n32
+$(obj)/vdso-n32.lds: KBUILD_CPPFLAGS := $(ccflags-vdso) -mabi=n32
 $(obj)/vdso-n32.lds: $(src)/vdso.lds.S FORCE
         $(call if_changed_dep,cpp_lds_S)
 
diff --git a/arch/openrisc/include/asm/Kbuild b/arch/openrisc/include/asm/Kbuild
index eb87cd8327c8..1f04844b6b82 100644
--- a/arch/openrisc/include/asm/Kbuild
+++ b/arch/openrisc/include/asm/Kbuild
@@ -34,6 +34,7 @@ generic-y += qrwlock_types.h
 generic-y += qrwlock.h
 generic-y += sections.h
 generic-y += segment.h
+generic-y += shmparam.h
 generic-y += string.h
 generic-y += switch_to.h
 generic-y += topology.h
diff --git a/arch/openrisc/include/uapi/asm/Kbuild b/arch/openrisc/include/uapi/asm/Kbuild
index 6c6f6301012e..0febf1a07c30 100644
--- a/arch/openrisc/include/uapi/asm/Kbuild
+++ b/arch/openrisc/include/uapi/asm/Kbuild
@@ -1,5 +1,4 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += kvm_para.h
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
index 2e6ada28da64..c9bfe526ca9d 100644
--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
@@ -1258,21 +1258,13 @@ extern pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
 
 #define pmd_move_must_withdraw pmd_move_must_withdraw
 struct spinlock;
-static inline int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
-                                         struct spinlock *old_pmd_ptl,
-                                         struct vm_area_struct *vma)
-{
-        if (radix_enabled())
-                return false;
-        /*
-         * Archs like ppc64 use pgtable to store per pmd
-         * specific information. So when we switch the pmd,
-         * we should also withdraw and deposit the pgtable
-         */
-        return true;
-}
-
-
+extern int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
+                                  struct spinlock *old_pmd_ptl,
+                                  struct vm_area_struct *vma);
+/*
+ * Hash translation mode use the deposited table to store hash pte
+ * slot information.
+ */
 #define arch_needs_pgtable_deposit arch_needs_pgtable_deposit
 static inline bool arch_needs_pgtable_deposit(void)
 {
diff --git a/arch/powerpc/mm/pgtable-book3s64.c b/arch/powerpc/mm/pgtable-book3s64.c
index f3c31f5e1026..ecd31569a120 100644
--- a/arch/powerpc/mm/pgtable-book3s64.c
+++ b/arch/powerpc/mm/pgtable-book3s64.c
@@ -400,3 +400,25 @@ void arch_report_meminfo(struct seq_file *m)
                    atomic_long_read(&direct_pages_count[MMU_PAGE_1G]) << 20);
 }
 #endif /* CONFIG_PROC_FS */
+
+/*
+ * For hash translation mode, we use the deposited table to store hash slot
+ * information and they are stored at PTRS_PER_PMD offset from related pmd
+ * location. Hence a pmd move requires deposit and withdraw.
+ *
+ * For radix translation with split pmd ptl, we store the deposited table in the
+ * pmd page. Hence if we have different pmd page we need to withdraw during pmd
+ * move.
+ *
+ * With hash we use deposited table always irrespective of anon or not.
+ * With radix we use deposited table only for anonymous mapping.
+ */
+int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
+                           struct spinlock *old_pmd_ptl,
+                           struct vm_area_struct *vma)
+{
+        if (radix_enabled())
+                return (new_pmd_ptl != old_pmd_ptl) && vma_is_anonymous(vma);
+
+        return true;
+}
diff --git a/arch/powerpc/platforms/pseries/papr_scm.c b/arch/powerpc/platforms/pseries/papr_scm.c
index 7d6457ab5d34..bba281b1fe1b 100644
--- a/arch/powerpc/platforms/pseries/papr_scm.c
+++ b/arch/powerpc/platforms/pseries/papr_scm.c
@@ -43,6 +43,7 @@ static int drc_pmem_bind(struct papr_scm_priv *p)
 {
         unsigned long ret[PLPAR_HCALL_BUFSIZE];
         uint64_t rc, token;
+        uint64_t saved = 0;
 
         /*
          * When the hypervisor cannot map all the requested memory in a single
@@ -56,6 +57,8 @@ static int drc_pmem_bind(struct papr_scm_priv *p)
                 rc = plpar_hcall(H_SCM_BIND_MEM, ret, p->drc_index, 0,
                                 p->blocks, BIND_ANY_ADDR, token);
                 token = ret[0];
+                if (!saved)
+                        saved = ret[1];
                 cond_resched();
         } while (rc == H_BUSY);
 
@@ -64,7 +67,7 @@ static int drc_pmem_bind(struct papr_scm_priv *p)
                 return -ENXIO;
         }
 
-        p->bound_addr = ret[1];
+        p->bound_addr = saved;
 
         dev_dbg(&p->pdev->dev, "bound drc %x to %pR\n", p->drc_index, &p->res);
 
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index feeeaa60697c..515fc3cc9687 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -103,7 +103,7 @@ choice
         prompt "Base ISA"
         default ARCH_RV64I
         help
-          This selects the base ISA that this kernel will traget and must match
+          This selects the base ISA that this kernel will target and must match
           the target platform.
 
 config ARCH_RV32I
diff --git a/arch/riscv/configs/defconfig b/arch/riscv/configs/defconfig
index f399659d3b8d..2fd3461e50ab 100644
--- a/arch/riscv/configs/defconfig
+++ b/arch/riscv/configs/defconfig
@@ -13,8 +13,6 @@ CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_SMP=y
-CONFIG_PCI=y
-CONFIG_PCIE_XILINX=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_NET=y
@@ -28,6 +26,10 @@ CONFIG_IP_PNP_DHCP=y
 CONFIG_IP_PNP_BOOTP=y
 CONFIG_IP_PNP_RARP=y
 CONFIG_NETLINK_DIAG=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_XILINX=y
 CONFIG_DEVTMPFS=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_VIRTIO_BLK=y
@@ -63,7 +65,6 @@ CONFIG_USB_STORAGE=y
 CONFIG_USB_UAS=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_SIFIVE_PLIC=y
-CONFIG_RAS=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_AUTOFS4_FS=y
@@ -77,5 +78,6 @@ CONFIG_NFS_V4_1=y
 CONFIG_NFS_V4_2=y
 CONFIG_ROOT_NFS=y
 CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_CRYPTO_DEV_VIRTIO=y
 CONFIG_PRINTK_TIME=y
 # CONFIG_RCU_TRACE is not set
diff --git a/arch/riscv/include/asm/page.h b/arch/riscv/include/asm/page.h
index 06cfbb3aacbb..2a546a52f02a 100644
--- a/arch/riscv/include/asm/page.h
+++ b/arch/riscv/include/asm/page.h
@@ -80,7 +80,7 @@ typedef struct page *pgtable_t;
 #define __pgd(x)        ((pgd_t) { (x) })
 #define __pgprot(x)     ((pgprot_t) { (x) })
 
-#ifdef CONFIG_64BITS
+#ifdef CONFIG_64BIT
 #define PTE_FMT "%016lx"
 #else
 #define PTE_FMT "%08lx"
diff --git a/arch/riscv/include/asm/pgtable-bits.h b/arch/riscv/include/asm/pgtable-bits.h
index 2fa2942be221..470755cb7558 100644
--- a/arch/riscv/include/asm/pgtable-bits.h
+++ b/arch/riscv/include/asm/pgtable-bits.h
@@ -35,6 +35,12 @@
 #define _PAGE_SPECIAL   _PAGE_SOFT
 #define _PAGE_TABLE     _PAGE_PRESENT
 
+/*
+ * _PAGE_PROT_NONE is set on not-present pages (and ignored by the hardware) to
+ * distinguish them from swapped out pages
+ */
+#define _PAGE_PROT_NONE _PAGE_READ
+
 #define _PAGE_PFN_SHIFT 10
 
 /* Set of bits to preserve across pte_modify() */
diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
index 16301966d65b..a8179a8c1491 100644
--- a/arch/riscv/include/asm/pgtable.h
+++ b/arch/riscv/include/asm/pgtable.h
@@ -44,7 +44,7 @@
 /* Page protection bits */
 #define _PAGE_BASE      (_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_USER)
 
-#define PAGE_NONE               __pgprot(0)
+#define PAGE_NONE               __pgprot(_PAGE_PROT_NONE)
 #define PAGE_READ               __pgprot(_PAGE_BASE | _PAGE_READ)
 #define PAGE_WRITE              __pgprot(_PAGE_BASE | _PAGE_READ | _PAGE_WRITE)
 #define PAGE_EXEC               __pgprot(_PAGE_BASE | _PAGE_EXEC)
@@ -98,7 +98,7 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
 
 static inline int pmd_present(pmd_t pmd)
 {
-        return (pmd_val(pmd) & _PAGE_PRESENT);
+        return (pmd_val(pmd) & (_PAGE_PRESENT | _PAGE_PROT_NONE));
 }
 
 static inline int pmd_none(pmd_t pmd)
@@ -178,7 +178,7 @@ static inline pte_t *pte_offset_kernel(pmd_t *pmd, unsigned long addr)
 
 static inline int pte_present(pte_t pte)
 {
-        return (pte_val(pte) & _PAGE_PRESENT);
+        return (pte_val(pte) & (_PAGE_PRESENT | _PAGE_PROT_NONE));
 }
 
 static inline int pte_none(pte_t pte)
@@ -380,7 +380,7 @@ static inline int ptep_clear_flush_young(struct vm_area_struct *vma,
  *
  * Format of swap PTE:
  *      bit            0:       _PAGE_PRESENT (zero)
- *      bit            1:       reserved for future use (zero)
+ *      bit            1:       _PAGE_PROT_NONE (zero)
  *      bits      2 to 6:       swap type
  *      bits 7 to XLEN-1:       swap offset
  */
diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/processor.h
index 0531f49af5c3..ce70bceb8872 100644
--- a/arch/riscv/include/asm/processor.h
+++ b/arch/riscv/include/asm/processor.h
@@ -22,7 +22,7 @@
  * This decides where the kernel will search for a free chunk of vm
  * space during mmap's.
  */
-#define TASK_UNMAPPED_BASE      PAGE_ALIGN(TASK_SIZE >> 1)
+#define TASK_UNMAPPED_BASE      PAGE_ALIGN(TASK_SIZE / 3)
 
 #define STACK_TOP               TASK_SIZE
 #define STACK_TOP_MAX           STACK_TOP
diff --git a/arch/riscv/kernel/asm-offsets.c b/arch/riscv/kernel/asm-offsets.c
index 6a92a2fe198e..dac98348c6a3 100644
--- a/arch/riscv/kernel/asm-offsets.c
+++ b/arch/riscv/kernel/asm-offsets.c
@@ -39,6 +39,7 @@ void asm_offsets(void)
         OFFSET(TASK_STACK, task_struct, stack);
         OFFSET(TASK_TI, task_struct, thread_info);
         OFFSET(TASK_TI_FLAGS, task_struct, thread_info.flags);
+        OFFSET(TASK_TI_PREEMPT_COUNT, task_struct, thread_info.preempt_count);
         OFFSET(TASK_TI_KERNEL_SP, task_struct, thread_info.kernel_sp);
         OFFSET(TASK_TI_USER_SP, task_struct, thread_info.user_sp);
         OFFSET(TASK_TI_CPU, task_struct, thread_info.cpu);
diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
index 355166f57205..fd9b57c8b4ce 100644
--- a/arch/riscv/kernel/entry.S
+++ b/arch/riscv/kernel/entry.S
@@ -144,6 +144,10 @@ _save_context:
         REG_L x2,  PT_SP(sp)
         .endm
 
+#if !IS_ENABLED(CONFIG_PREEMPT)
+.set resume_kernel, restore_all
+#endif
+
 ENTRY(handle_exception)
         SAVE_ALL
 
@@ -228,7 +232,7 @@ ret_from_exception:
         REG_L s0, PT_SSTATUS(sp)
         csrc sstatus, SR_SIE
         andi s0, s0, SR_SPP
-        bnez s0, restore_all
+        bnez s0, resume_kernel
 
 resume_userspace:
         /* Interrupts must be disabled here so flags are checked atomically */
@@ -250,6 +254,18 @@ restore_all:
         RESTORE_ALL
         sret
 
+#if IS_ENABLED(CONFIG_PREEMPT)
+resume_kernel:
+        REG_L s0, TASK_TI_PREEMPT_COUNT(tp)
+        bnez s0, restore_all
+need_resched:
+        REG_L s0, TASK_TI_FLAGS(tp)
+        andi s0, s0, _TIF_NEED_RESCHED
+        beqz s0, restore_all
+        call preempt_schedule_irq
+        j need_resched
+#endif
+
 work_pending:
         /* Enter slow path for supplementary processing */
         la ra, ret_from_exception
diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
index 6e079e94b638..77564310235f 100644
--- a/arch/riscv/kernel/setup.c
+++ b/arch/riscv/kernel/setup.c
@@ -181,7 +181,7 @@ static void __init setup_bootmem(void)
         BUG_ON(mem_size == 0);
 
         set_max_mapnr(PFN_DOWN(mem_size));
-        max_low_pfn = memblock_end_of_DRAM();
+        max_low_pfn = PFN_DOWN(memblock_end_of_DRAM());
 
 #ifdef CONFIG_BLK_DEV_INITRD
         setup_initrd();
diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c
index fc185ecabb0a..18cda0e8cf94 100644
--- a/arch/riscv/kernel/smpboot.c
+++ b/arch/riscv/kernel/smpboot.c
@@ -57,15 +57,12 @@ void __init setup_smp(void)
 
         while ((dn = of_find_node_by_type(dn, "cpu"))) {
                 hart = riscv_of_processor_hartid(dn);
-                if (hart < 0) {
-                        of_node_put(dn);
+                if (hart < 0)
                         continue;
-                }
 
                 if (hart == cpuid_to_hartid_map(0)) {
                         BUG_ON(found_boot_cpu);
                         found_boot_cpu = 1;
-                        of_node_put(dn);
                         continue;
                 }
 
@@ -73,7 +70,6 @@ void __init setup_smp(void)
                 set_cpu_possible(cpuid, true);
                 set_cpu_present(cpuid, true);
                 cpuid++;
-                of_node_put(dn);
         }
 
         BUG_ON(!found_boot_cpu);
diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S
index 1e1395d63dab..65df1dfdc303 100644
--- a/arch/riscv/kernel/vmlinux.lds.S
+++ b/arch/riscv/kernel/vmlinux.lds.S
@@ -18,8 +18,6 @@
 #include <asm/cache.h>
 #include <asm/thread_info.h>
 
-#define MAX_BYTES_PER_LONG      0x10
-
 OUTPUT_ARCH(riscv)
 ENTRY(_start)
 
@@ -76,6 +74,8 @@ SECTIONS
                 *(.sbss*)
         }
 
+        BSS_SECTION(PAGE_SIZE, PAGE_SIZE, 0)
+
         EXCEPTION_TABLE(0x10)
         NOTES
 
@@ -83,10 +83,6 @@ SECTIONS
                 *(.rel.dyn*)
         }
 
-        BSS_SECTION(MAX_BYTES_PER_LONG,
-                    MAX_BYTES_PER_LONG,
-                    MAX_BYTES_PER_LONG)
-
         _end = .;
 
         STABS_DEBUG
diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index 1d9bfaff60bc..658ebf645f42 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -28,7 +28,8 @@ static void __init zone_sizes_init(void)
         unsigned long max_zone_pfns[MAX_NR_ZONES] = { 0, };
 
 #ifdef CONFIG_ZONE_DMA32
-        max_zone_pfns[ZONE_DMA32] = PFN_DOWN(min(4UL * SZ_1G, max_low_pfn));
+        max_zone_pfns[ZONE_DMA32] = PFN_DOWN(min(4UL * SZ_1G,
+                        (unsigned long) PFN_PHYS(max_low_pfn)));
 #endif
         max_zone_pfns[ZONE_NORMAL] = max_low_pfn;
 
diff --git a/arch/s390/kernel/swsusp.S b/arch/s390/kernel/swsusp.S
index 537f97fde37f..b6796e616812 100644
--- a/arch/s390/kernel/swsusp.S
+++ b/arch/s390/kernel/swsusp.S
@@ -30,10 +30,10 @@
         .section .text
 ENTRY(swsusp_arch_suspend)
         lg      %r1,__LC_NODAT_STACK
-        aghi    %r1,-STACK_FRAME_OVERHEAD
         stmg    %r6,%r15,__SF_GPRS(%r1)
+        aghi    %r1,-STACK_FRAME_OVERHEAD
         stg     %r15,__SF_BACKCHAIN(%r1)
-        lgr     %r1,%r15
+        lgr     %r15,%r1
 
         /* Store FPU registers */
         brasl   %r14,save_fpu_regs
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index a966d7bfac57..4266a4de3160 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -382,7 +382,9 @@ static void zpci_irq_handler(struct airq_struct *airq)
                         if (ai == -1UL)
                                 break;
                         inc_irq_stat(IRQIO_MSI);
+                        airq_iv_lock(aibv, ai);
                         generic_handle_irq(airq_iv_get_data(aibv, ai));
+                        airq_iv_unlock(aibv, ai);
                 }
         }
 }
@@ -408,7 +410,7 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
         zdev->aisb = aisb;
 
         /* Create adapter interrupt vector */
-        zdev->aibv = airq_iv_create(msi_vecs, AIRQ_IV_DATA);
+        zdev->aibv = airq_iv_create(msi_vecs, AIRQ_IV_DATA | AIRQ_IV_BITLOCK);
         if (!zdev->aibv)
                 return -ENOMEM;
 
diff --git a/arch/unicore32/include/asm/Kbuild b/arch/unicore32/include/asm/Kbuild
index 1372553dc0a9..1d1544b6ca74 100644
--- a/arch/unicore32/include/asm/Kbuild
+++ b/arch/unicore32/include/asm/Kbuild
@@ -28,6 +28,7 @@ generic-y += preempt.h
 generic-y += sections.h
 generic-y += segment.h
 generic-y += serial.h
+generic-y += shmparam.h
 generic-y += sizes.h
 generic-y += syscalls.h
 generic-y += topology.h
diff --git a/arch/unicore32/include/uapi/asm/Kbuild b/arch/unicore32/include/uapi/asm/Kbuild
index 6c6f6301012e..0febf1a07c30 100644
--- a/arch/unicore32/include/uapi/asm/Kbuild
+++ b/arch/unicore32/include/uapi/asm/Kbuild
@@ -1,5 +1,4 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += kvm_para.h
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 26387c7bf305..68261430fe6e 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -446,12 +446,12 @@ config RETPOLINE
           branches. Requires a compiler with -mindirect-branch=thunk-extern
           support for full protection. The kernel may run slower.
 
-config X86_RESCTRL
-        bool "Resource Control support"
+config X86_CPU_RESCTRL
+        bool "x86 CPU resource control support"
         depends on X86 && (CPU_SUP_INTEL || CPU_SUP_AMD)
         select KERNFS
         help
-          Enable Resource Control support.
+          Enable x86 CPU resource control support.
 
           Provide support for the allocation and monitoring of system resources
           usage by the CPU.
diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
index 64037895b085..f62e347862cc 100644
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -600,6 +600,16 @@ ENTRY(trampoline_32bit_src)
         leal    TRAMPOLINE_32BIT_PGTABLE_OFFSET(%ecx), %eax
         movl    %eax, %cr3
 3:
+        /* Set EFER.LME=1 as a precaution in case hypervsior pulls the rug */
+        pushl   %ecx
+        pushl   %edx
+        movl    $MSR_EFER, %ecx
+        rdmsr
+        btsl    $_EFER_LME, %eax
+        wrmsr
+        popl    %edx
+        popl    %ecx
+
         /* Enable PAE and LA57 (if required) paging modes */
         movl    $X86_CR4_PAE, %eax
         cmpl    $0, %edx
diff --git a/arch/x86/boot/compressed/pgtable.h b/arch/x86/boot/compressed/pgtable.h
index 91f75638f6e6..6ff7e81b5628 100644
--- a/arch/x86/boot/compressed/pgtable.h
+++ b/arch/x86/boot/compressed/pgtable.h
@@ -6,7 +6,7 @@
 #define TRAMPOLINE_32BIT_PGTABLE_OFFSET 0
 
 #define TRAMPOLINE_32BIT_CODE_OFFSET    PAGE_SIZE
-#define TRAMPOLINE_32BIT_CODE_SIZE      0x60
+#define TRAMPOLINE_32BIT_CODE_SIZE      0x70
 
 #define TRAMPOLINE_32BIT_STACK_END      TRAMPOLINE_32BIT_SIZE
 
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 40e12cfc87f6..daafb893449b 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3559,6 +3559,14 @@ static void free_excl_cntrs(int cpu)
 
 static void intel_pmu_cpu_dying(int cpu)
 {
+        fini_debug_store_on_cpu(cpu);
+
+        if (x86_pmu.counter_freezing)
+                disable_counter_freeze();
+}
+
+static void intel_pmu_cpu_dead(int cpu)
+{
         struct cpu_hw_events *cpuc = &per_cpu(cpu_hw_events, cpu);
         struct intel_shared_regs *pc;
 
@@ -3570,11 +3578,6 @@ static void intel_pmu_cpu_dying(int cpu)
         }
 
         free_excl_cntrs(cpu);
-
-        fini_debug_store_on_cpu(cpu);
-
-        if (x86_pmu.counter_freezing)
-                disable_counter_freeze();
 }
 
 static void intel_pmu_sched_task(struct perf_event_context *ctx,
@@ -3663,6 +3666,7 @@ static __initconst const struct x86_pmu core_pmu = {
         .cpu_prepare            = intel_pmu_cpu_prepare,
         .cpu_starting           = intel_pmu_cpu_starting,
         .cpu_dying              = intel_pmu_cpu_dying,
+        .cpu_dead               = intel_pmu_cpu_dead,
 };
 
 static struct attribute *intel_pmu_attrs[];
@@ -3703,6 +3707,8 @@ static __initconst const struct x86_pmu intel_pmu = {
         .cpu_prepare            = intel_pmu_cpu_prepare,
         .cpu_starting           = intel_pmu_cpu_starting,
         .cpu_dying              = intel_pmu_cpu_dying,
+        .cpu_dead               = intel_pmu_cpu_dead,
+
         .guest_get_msrs         = intel_guest_get_msrs,
         .sched_task             = intel_pmu_sched_task,
 };
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index c07bee31abe8..b10e04387f38 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -1222,6 +1222,8 @@ static struct pci_driver snbep_uncore_pci_driver = {
         .id_table       = snbep_uncore_pci_ids,
 };
 
+#define NODE_ID_MASK    0x7
+
 /*
  * build pci bus to socket mapping
  */
@@ -1243,7 +1245,7 @@ static int snbep_pci2phy_map_init(int devid, int nodeid_loc, int idmap_loc, bool
                 err = pci_read_config_dword(ubox_dev, nodeid_loc, &config);
                 if (err)
                         break;
-                nodeid = config;
+                nodeid = config & NODE_ID_MASK;
                 /* get the Node ID mapping */
                 err = pci_read_config_dword(ubox_dev, idmap_loc, &config);
                 if (err)
diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
index 0dd6b0f4000e..d9a9993af882 100644
--- a/arch/x86/include/asm/intel-family.h
+++ b/arch/x86/include/asm/intel-family.h
@@ -6,7 +6,7 @@
  * "Big Core" Processors (Branded as Core, Xeon, etc...)
  *
  * The "_X" parts are generally the EP and EX Xeons, or the
- * "Extreme" ones, like Broadwell-E.
+ * "Extreme" ones, like Broadwell-E, or Atom microserver.
  *
  * While adding a new CPUID for a new microarchitecture, add a new
  * group to keep logically sorted out in chronological order. Within
@@ -71,6 +71,7 @@
 #define INTEL_FAM6_ATOM_GOLDMONT        0x5C /* Apollo Lake */
 #define INTEL_FAM6_ATOM_GOLDMONT_X      0x5F /* Denverton */
 #define INTEL_FAM6_ATOM_GOLDMONT_PLUS   0x7A /* Gemini Lake */
+#define INTEL_FAM6_ATOM_TREMONT_X       0x86 /* Jacobsville */
 
 /* Xeon Phi */
 
diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
index 8f657286d599..0ce558a8150d 100644
--- a/arch/x86/include/asm/page_64_types.h
+++ b/arch/x86/include/asm/page_64_types.h
@@ -7,7 +7,11 @@
 #endif
 
 #ifdef CONFIG_KASAN
+#ifdef CONFIG_KASAN_EXTRA
+#define KASAN_STACK_ORDER 2
+#else
 #define KASAN_STACK_ORDER 1
+#endif
 #else
 #define KASAN_STACK_ORDER 0
 #endif
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 40616e805292..2779ace16d23 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -1065,7 +1065,7 @@ static inline void native_set_pte_at(struct mm_struct *mm, unsigned long addr,
 static inline void set_pmd_at(struct mm_struct *mm, unsigned long addr,
                               pmd_t *pmdp, pmd_t pmd)
 {
-        native_set_pmd(pmdp, pmd);
+        set_pmd(pmdp, pmd);
 }
 
 static inline void set_pud_at(struct mm_struct *mm, unsigned long addr,
diff --git a/arch/x86/include/asm/resctrl_sched.h b/arch/x86/include/asm/resctrl_sched.h
index 40ebddde6ac2..f6b7fe2833cc 100644
--- a/arch/x86/include/asm/resctrl_sched.h
+++ b/arch/x86/include/asm/resctrl_sched.h
@@ -2,7 +2,7 @@
 #ifndef _ASM_X86_RESCTRL_SCHED_H
 #define _ASM_X86_RESCTRL_SCHED_H
 
-#ifdef CONFIG_X86_RESCTRL
+#ifdef CONFIG_X86_CPU_RESCTRL
 
 #include <linux/sched.h>
 #include <linux/jump_label.h>
@@ -88,6 +88,6 @@ static inline void resctrl_sched_in(void)
 
 static inline void resctrl_sched_in(void) {}
 
-#endif /* CONFIG_X86_RESCTRL */
+#endif /* CONFIG_X86_CPU_RESCTRL */
 
 #endif /* _ASM_X86_RESCTRL_SCHED_H */
diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
index b6fa0869f7aa..cfd24f9f7614 100644
--- a/arch/x86/kernel/cpu/Makefile
+++ b/arch/x86/kernel/cpu/Makefile
@@ -39,7 +39,7 @@ obj-$(CONFIG_CPU_SUP_UMC_32)		+= umc.o
 obj-$(CONFIG_X86_MCE)                   += mce/
 obj-$(CONFIG_MTRR)                      += mtrr/
 obj-$(CONFIG_MICROCODE)                 += microcode/
-obj-$(CONFIG_X86_RESCTRL)               += resctrl/
+obj-$(CONFIG_X86_CPU_RESCTRL)           += resctrl/
 
 obj-$(CONFIG_X86_LOCAL_APIC)            += perfctr-watchdog.o
 
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 1de0f4170178..01874d54f4fd 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -71,7 +71,7 @@ void __init check_bugs(void)
          * identify_boot_cpu() initialized SMT support information, let the
          * core code know.
          */
-        cpu_smt_check_topology_early();
+        cpu_smt_check_topology();
 
         if (!IS_ENABLED(CONFIG_SMP)) {
                 pr_info("CPU: ");
diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
index 672c7225cb1b..6ce290c506d9 100644
--- a/arch/x86/kernel/cpu/mce/core.c
+++ b/arch/x86/kernel/cpu/mce/core.c
@@ -784,6 +784,7 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
                         quirk_no_way_out(i, m, regs);
 
                 if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= MCE_PANIC_SEVERITY) {
+                        m->bank = i;
                         mce_read_aux(m, i);
                         *msg = tmp;
                         return 1;
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 51adde0a0f1a..e1f3ba19ba54 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -855,7 +855,7 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
         if (!p) {
                 return ret;
         } else {
-                if (boot_cpu_data.microcode == p->patch_id)
+                if (boot_cpu_data.microcode >= p->patch_id)
                         return ret;
 
                 ret = UCODE_NEW;
diff --git a/arch/x86/kernel/cpu/resctrl/Makefile b/arch/x86/kernel/cpu/resctrl/Makefile
index 1cabe6fd8e11..4a06c37b9cf1 100644
--- a/arch/x86/kernel/cpu/resctrl/Makefile
+++ b/arch/x86/kernel/cpu/resctrl/Makefile
@@ -1,4 +1,4 @@
 # SPDX-License-Identifier: GPL-2.0
-obj-$(CONFIG_X86_RESCTRL)       += core.o rdtgroup.o monitor.o
-obj-$(CONFIG_X86_RESCTRL)       += ctrlmondata.o pseudo_lock.o
+obj-$(CONFIG_X86_CPU_RESCTRL)   += core.o rdtgroup.o monitor.o
+obj-$(CONFIG_X86_CPU_RESCTRL)   += ctrlmondata.o pseudo_lock.o
 CFLAGS_pseudo_lock.o = -I$(src)
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 0d5efa34f359..53917a3ebf94 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -167,6 +167,9 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr,
         struct efi_info *current_ei = &boot_params.efi_info;
         struct efi_info *ei = &params->efi_info;
 
+        if (!efi_enabled(EFI_RUNTIME_SERVICES))
+                return 0;
+
         if (!current_ei->efi_memmap_size)
                 return 0;
 
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 8ff20523661b..d8ea4ebd79e7 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -211,6 +211,7 @@ static void free_nested(struct kvm_vcpu *vcpu)
         if (!vmx->nested.vmxon && !vmx->nested.smm.vmxon)
                 return;
 
+        hrtimer_cancel(&vmx->nested.preemption_timer);
         vmx->nested.vmxon = false;
         vmx->nested.smm.vmxon = false;
         free_vpid(vmx->nested.vpid02);
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 4341175339f3..95d618045001 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -26,6 +26,7 @@
 #include <linux/mod_devicetable.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
+#include <linux/sched/smt.h>
 #include <linux/slab.h>
 #include <linux/tboot.h>
 #include <linux/trace_events.h>
@@ -6823,7 +6824,7 @@ static int vmx_vm_init(struct kvm *kvm)
                          * Warn upon starting the first VM in a potentially
                          * insecure environment.
                          */
-                        if (cpu_smt_control == CPU_SMT_ENABLED)
+                        if (sched_smt_active())
                                 pr_warn_once(L1TF_MSG_SMT);
                         if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER)
                                 pr_warn_once(L1TF_MSG_L1D);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 3d27206f6c01..e67ecf25e690 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5116,6 +5116,13 @@ int kvm_read_guest_virt(struct kvm_vcpu *vcpu,
 {
         u32 access = (kvm_x86_ops->get_cpl(vcpu) == 3) ? PFERR_USER_MASK : 0;
 
+        /*
+         * FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED
+         * is returned, but our callers are not ready for that and they blindly
+         * call kvm_inject_page_fault.  Ensure that they at least do not leak
+         * uninitialized kernel stack memory into cr2 and error code.
+         */
+        memset(exception, 0, sizeof(*exception));
         return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access,
                                           exception);
 }
diff --git a/arch/x86/lib/iomem.c b/arch/x86/lib/iomem.c
index 66894675f3c8..df50451d94ef 100644
--- a/arch/x86/lib/iomem.c
+++ b/arch/x86/lib/iomem.c
@@ -2,8 +2,11 @@
 #include <linux/module.h>
 #include <linux/io.h>
 
+#define movs(type,to,from) \
+        asm volatile("movs" type:"=&D" (to), "=&S" (from):"0" (to), "1" (from):"memory")
+
 /* Originally from i386/string.h */
-static __always_inline void __iomem_memcpy(void *to, const void *from, size_t n)
+static __always_inline void rep_movs(void *to, const void *from, size_t n)
 {
         unsigned long d0, d1, d2;
         asm volatile("rep ; movsl\n\t"
@@ -21,13 +24,37 @@ static __always_inline void __iomem_memcpy(void *to, const void *from, size_t n)
 
 void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
 {
-        __iomem_memcpy(to, (const void *)from, n);
+        if (unlikely(!n))
+                return;
+
+        /* Align any unaligned source IO */
+        if (unlikely(1 & (unsigned long)from)) {
+                movs("b", to, from);
+                n--;
+        }
+        if (n > 1 && unlikely(2 & (unsigned long)from)) {
+                movs("w", to, from);
+                n-=2;
+        }
+        rep_movs(to, (const void *)from, n);
 }
 EXPORT_SYMBOL(memcpy_fromio);
 
 void memcpy_toio(volatile void __iomem *to, const void *from, size_t n)
 {
-        __iomem_memcpy((void *)to, (const void *) from, n);
+        if (unlikely(!n))
+                return;
+
+        /* Align any unaligned destination IO */
+        if (unlikely(1 & (unsigned long)to)) {
+                movs("b", to, from);
+                n--;
+        }
+        if (n > 1 && unlikely(2 & (unsigned long)to)) {
+                movs("w", to, from);
+                n-=2;
+        }
+        rep_movs((void *)to, (const void *) from, n);
 }
 EXPORT_SYMBOL(memcpy_toio);
 
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 2ff25ad33233..9d5c75f02295 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -595,7 +595,7 @@ static void show_ldttss(const struct desc_ptr *gdt, const char *name, u16 index)
                 return;
         }
 
-        addr = desc.base0 | (desc.base1 << 16) | (desc.base2 << 24);
+        addr = desc.base0 | (desc.base1 << 16) | ((unsigned long)desc.base2 << 24);
 #ifdef CONFIG_X86_64
         addr |= ((u64)desc.base3 << 32);
 #endif
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 4f8972311a77..14e6119838a6 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -230,6 +230,29 @@ static bool __cpa_pfn_in_highmap(unsigned long pfn)
 
 #endif
 
+/*
+ * See set_mce_nospec().
+ *
+ * Machine check recovery code needs to change cache mode of poisoned pages to
+ * UC to avoid speculative access logging another error. But passing the
+ * address of the 1:1 mapping to set_memory_uc() is a fine way to encourage a
+ * speculative access. So we cheat and flip the top bit of the address. This
+ * works fine for the code that updates the page tables. But at the end of the
+ * process we need to flush the TLB and cache and the non-canonical address
+ * causes a #GP fault when used by the INVLPG and CLFLUSH instructions.
+ *
+ * But in the common case we already have a canonical address. This code
+ * will fix the top bit if needed and is a no-op otherwise.
+ */
+static inline unsigned long fix_addr(unsigned long addr)
+{
+#ifdef CONFIG_X86_64
+        return (long)(addr << 1) >> 1;
+#else
+        return addr;
+#endif
+}
+
 static unsigned long __cpa_addr(struct cpa_data *cpa, unsigned long idx)
 {
         if (cpa->flags & CPA_PAGES_ARRAY) {
@@ -313,7 +336,7 @@ void __cpa_flush_tlb(void *data)
         unsigned int i;
 
         for (i = 0; i < cpa->numpages; i++)
-                __flush_tlb_one_kernel(__cpa_addr(cpa, i));
+                __flush_tlb_one_kernel(fix_addr(__cpa_addr(cpa, i)));
 }
 
 static void cpa_flush(struct cpa_data *data, int cache)
@@ -347,7 +370,7 @@ static void cpa_flush(struct cpa_data *data, int cache)
                  * Only flush present addresses:
                  */
                 if (pte && (pte_val(*pte) & _PAGE_PRESENT))
-                        clflush_cache_range_opt((void *)addr, PAGE_SIZE);
+                        clflush_cache_range_opt((void *)fix_addr(addr), PAGE_SIZE);
         }
         mb();
 }
@@ -1627,29 +1650,6 @@ out:
         return ret;
 }
 
-/*
- * Machine check recovery code needs to change cache mode of poisoned
- * pages to UC to avoid speculative access logging another error. But
- * passing the address of the 1:1 mapping to set_memory_uc() is a fine
- * way to encourage a speculative access. So we cheat and flip the top
- * bit of the address. This works fine for the code that updates the
- * page tables. But at the end of the process we need to flush the cache
- * and the non-canonical address causes a #GP fault when used by the
- * CLFLUSH instruction.
- *
- * But in the common case we already have a canonical address. This code
- * will fix the top bit if needed and is a no-op otherwise.
- */
-static inline unsigned long make_addr_canonical_again(unsigned long addr)
-{
-#ifdef CONFIG_X86_64
-        return (long)(addr << 1) >> 1;
-#else
-        return addr;
-#endif
-}
-
-
 static int change_page_attr_set_clr(unsigned long *addr, int numpages,
                                     pgprot_t mask_set, pgprot_t mask_clr,
                                     int force_split, int in_flag,
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index 20a0756f27ef..ce91682770cb 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -164,7 +164,7 @@ config XTENSA_FAKE_NMI
           If unsure, say N.
 
 config XTENSA_UNALIGNED_USER
-        bool "Unaligned memory access in use space"
+        bool "Unaligned memory access in user space"
         help
           The Xtensa architecture currently does not handle unaligned
           memory accesses in hardware but through an exception handler.
@@ -451,7 +451,7 @@ config USE_OF
         help
           Include support for flattened device tree machine descriptions.
 
-config BUILTIN_DTB
+config BUILTIN_DTB_SOURCE
         string "DTB to build into the kernel image"
         depends on OF
 
diff --git a/arch/xtensa/boot/dts/Makefile b/arch/xtensa/boot/dts/Makefile
index f8052ba5aea8..0b8d00cdae7c 100644
--- a/arch/xtensa/boot/dts/Makefile
+++ b/arch/xtensa/boot/dts/Makefile
@@ -7,9 +7,9 @@
 #
 #
 
-BUILTIN_DTB := $(patsubst "%",%,$(CONFIG_BUILTIN_DTB)).dtb.o
-ifneq ($(CONFIG_BUILTIN_DTB),"")
-obj-$(CONFIG_OF) += $(BUILTIN_DTB)
+BUILTIN_DTB_SOURCE := $(patsubst "%",%,$(CONFIG_BUILTIN_DTB_SOURCE)).dtb.o
+ifneq ($(CONFIG_BUILTIN_DTB_SOURCE),"")
+obj-$(CONFIG_OF) += $(BUILTIN_DTB_SOURCE)
 endif
 
 # for CONFIG_OF_ALL_DTBS test
diff --git a/arch/xtensa/configs/audio_kc705_defconfig b/arch/xtensa/configs/audio_kc705_defconfig
index 2bf964df37ba..f378e56f9ce6 100644
--- a/arch/xtensa/configs/audio_kc705_defconfig
+++ b/arch/xtensa/configs/audio_kc705_defconfig
@@ -34,7 +34,7 @@ CONFIG_XTENSA_PLATFORM_XTFPGA=y
 CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="earlycon=uart8250,mmio32native,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=0x38000000@0"
 CONFIG_USE_OF=y
-CONFIG_BUILTIN_DTB="kc705"
+CONFIG_BUILTIN_DTB_SOURCE="kc705"
 # CONFIG_COMPACTION is not set
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_PM=y
diff --git a/arch/xtensa/configs/cadence_csp_defconfig b/arch/xtensa/configs/cadence_csp_defconfig
index 3221b7053fa3..62f32a902568 100644
--- a/arch/xtensa/configs/cadence_csp_defconfig
+++ b/arch/xtensa/configs/cadence_csp_defconfig
@@ -38,7 +38,7 @@ CONFIG_HIGHMEM=y
 # CONFIG_PCI is not set
 CONFIG_XTENSA_PLATFORM_XTFPGA=y
 CONFIG_USE_OF=y
-CONFIG_BUILTIN_DTB="csp"
+CONFIG_BUILTIN_DTB_SOURCE="csp"
 # CONFIG_COMPACTION is not set
 CONFIG_XTFPGA_LCD=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
diff --git a/arch/xtensa/configs/generic_kc705_defconfig b/arch/xtensa/configs/generic_kc705_defconfig
index 985fa8546e4e..8bebe07f1060 100644
--- a/arch/xtensa/configs/generic_kc705_defconfig
+++ b/arch/xtensa/configs/generic_kc705_defconfig
@@ -33,7 +33,7 @@ CONFIG_XTENSA_PLATFORM_XTFPGA=y
 CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="earlycon=uart8250,mmio32native,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=0x38000000@0"
 CONFIG_USE_OF=y
-CONFIG_BUILTIN_DTB="kc705"
+CONFIG_BUILTIN_DTB_SOURCE="kc705"
 # CONFIG_COMPACTION is not set
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_NET=y
diff --git a/arch/xtensa/configs/nommu_kc705_defconfig b/arch/xtensa/configs/nommu_kc705_defconfig
index f3fc4f970ca8..933ab2adf434 100644
--- a/arch/xtensa/configs/nommu_kc705_defconfig
+++ b/arch/xtensa/configs/nommu_kc705_defconfig
@@ -39,7 +39,7 @@ CONFIG_XTENSA_PLATFORM_XTFPGA=y
 CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="earlycon=uart8250,mmio32native,0x9d050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=256M@0x60000000"
 CONFIG_USE_OF=y
-CONFIG_BUILTIN_DTB="kc705_nommu"
+CONFIG_BUILTIN_DTB_SOURCE="kc705_nommu"
 CONFIG_BINFMT_FLAT=y
 CONFIG_NET=y
 CONFIG_PACKET=y
diff --git a/arch/xtensa/configs/smp_lx200_defconfig b/arch/xtensa/configs/smp_lx200_defconfig
index 11fed6c06a7c..e29c5b179a5b 100644
--- a/arch/xtensa/configs/smp_lx200_defconfig
+++ b/arch/xtensa/configs/smp_lx200_defconfig
@@ -33,11 +33,12 @@ CONFIG_SMP=y
 CONFIG_HOTPLUG_CPU=y
 # CONFIG_INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX is not set
 # CONFIG_PCI is not set
+CONFIG_VECTORS_OFFSET=0x00002000
 CONFIG_XTENSA_PLATFORM_XTFPGA=y
 CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="earlycon=uart8250,mmio32native,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=96M@0"
 CONFIG_USE_OF=y
-CONFIG_BUILTIN_DTB="lx200mx"
+CONFIG_BUILTIN_DTB_SOURCE="lx200mx"
 # CONFIG_COMPACTION is not set
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_NET=y
diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S
index da08e75100ab..7f009719304e 100644
--- a/arch/xtensa/kernel/head.S
+++ b/arch/xtensa/kernel/head.S
@@ -276,12 +276,13 @@ should_never_return:
 
         movi    a2, cpu_start_ccount
 1:
+        memw
         l32i    a3, a2, 0
         beqi    a3, 0, 1b
         movi    a3, 0
         s32i    a3, a2, 0
-        memw
 1:
+        memw
         l32i    a3, a2, 0
         beqi    a3, 0, 1b
         wsr     a3, ccount
@@ -317,11 +318,13 @@ ENTRY(cpu_restart)
         rsr     a0, prid
         neg     a2, a0
         movi    a3, cpu_start_id
+        memw
         s32i    a2, a3, 0
 #if XCHAL_DCACHE_IS_WRITEBACK
         dhwbi   a3, 0
 #endif
 1:
+        memw
         l32i    a2, a3, 0
         dhi     a3, 0
         bne     a2, a0, 1b
diff --git a/arch/xtensa/kernel/smp.c b/arch/xtensa/kernel/smp.c
index 932d64689bac..be1f280c322c 100644
--- a/arch/xtensa/kernel/smp.c
+++ b/arch/xtensa/kernel/smp.c
@@ -83,7 +83,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
 {
         unsigned i;
 
-        for (i = 0; i < max_cpus; ++i)
+        for_each_possible_cpu(i)
                 set_cpu_present(i, true);
 }
 
@@ -96,6 +96,11 @@ void __init smp_init_cpus(void)
         pr_info("%s: Core Count = %d\n", __func__, ncpus);
         pr_info("%s: Core Id = %d\n", __func__, core_id);
 
+        if (ncpus > NR_CPUS) {
+                ncpus = NR_CPUS;
+                pr_info("%s: limiting core count by %d\n", __func__, ncpus);
+        }
+
         for (i = 0; i < ncpus; ++i)
                 set_cpu_possible(i, true);
 }
@@ -195,9 +200,11 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts)
         int i;
 
 #ifdef CONFIG_HOTPLUG_CPU
-        cpu_start_id = cpu;
-        system_flush_invalidate_dcache_range(
-                        (unsigned long)&cpu_start_id, sizeof(cpu_start_id));
+        WRITE_ONCE(cpu_start_id, cpu);
+        /* Pairs with the third memw in the cpu_restart */
+        mb();
+        system_flush_invalidate_dcache_range((unsigned long)&cpu_start_id,
+                                             sizeof(cpu_start_id));
 #endif
         smp_call_function_single(0, mx_cpu_start, (void *)cpu, 1);
 
@@ -206,18 +213,21 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts)
                         ccount = get_ccount();
                 while (!ccount);
 
-                cpu_start_ccount = ccount;
+                WRITE_ONCE(cpu_start_ccount, ccount);
 
-                while (time_before(jiffies, timeout)) {
+                do {
+                        /*
+                         * Pairs with the first two memws in the
+                         * .Lboot_secondary.
+                         */
                         mb();
-                        if (!cpu_start_ccount)
-                                break;
-                }
+                        ccount = READ_ONCE(cpu_start_ccount);
+                } while (ccount && time_before(jiffies, timeout));
 
-                if (cpu_start_ccount) {
+                if (ccount) {
                         smp_call_function_single(0, mx_cpu_stop,
-                                        (void *)cpu, 1);
-                        cpu_start_ccount = 0;
+                                                 (void *)cpu, 1);
+                        WRITE_ONCE(cpu_start_ccount, 0);
                         return -EIO;
                 }
         }
@@ -237,6 +247,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
         pr_debug("%s: Calling wakeup_secondary(cpu:%d, idle:%p, sp: %08lx)\n",
                         __func__, cpu, idle, start_info.stack);
 
+        init_completion(&cpu_running);
         ret = boot_secondary(cpu, idle);
         if (ret == 0) {
                 wait_for_completion_timeout(&cpu_running,
@@ -298,8 +309,10 @@ void __cpu_die(unsigned int cpu)
         unsigned long timeout = jiffies + msecs_to_jiffies(1000);
         while (time_before(jiffies, timeout)) {
                 system_invalidate_dcache_range((unsigned long)&cpu_start_id,
-                                sizeof(cpu_start_id));
-                if (cpu_start_id == -cpu) {
+                                               sizeof(cpu_start_id));
+                /* Pairs with the second memw in the cpu_restart */
+                mb();
+                if (READ_ONCE(cpu_start_id) == -cpu) {
                         platform_cpu_kill(cpu);
                         return;
                 }
diff --git a/arch/xtensa/kernel/time.c b/arch/xtensa/kernel/time.c
index fd524a54d2ab..378186b5eb40 100644
--- a/arch/xtensa/kernel/time.c
+++ b/arch/xtensa/kernel/time.c
@@ -89,7 +89,7 @@ static int ccount_timer_shutdown(struct clock_event_device *evt)
                 container_of(evt, struct ccount_timer, evt);
 
         if (timer->irq_enabled) {
-                disable_irq(evt->irq);
+                disable_irq_nosync(evt->irq);
                 timer->irq_enabled = 0;
         }
         return 0;
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
index f8120832ca7b..7921573aebbc 100644
--- a/block/blk-mq-debugfs.c
+++ b/block/blk-mq-debugfs.c
@@ -839,6 +839,9 @@ static const struct blk_mq_debugfs_attr blk_mq_debugfs_ctx_attrs[] = {
 static bool debugfs_create_files(struct dentry *parent, void *data,
                                  const struct blk_mq_debugfs_attr *attr)
 {
+        if (IS_ERR_OR_NULL(parent))
+                return false;
+
         d_inode(parent)->i_private = data;
 
         for (; attr->name; attr++) {
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 5c093ce01bcd..147f6c7ea59c 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -1029,6 +1029,9 @@ void __init acpi_early_init(void)
 
         acpi_permanent_mmap = true;
 
+        /* Initialize debug output. Linux does not use ACPICA defaults */
+        acpi_dbg_level = ACPI_LV_INFO | ACPI_LV_REPAIR;
+
 #ifdef CONFIG_X86
         /*
          * If the machine falls into the DMI check table,
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index cdfc87629efb..4d2b2ad1ee0e 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -5854,9 +5854,10 @@ static int __init init_binder_device(const char *name)
 static int __init binder_init(void)
 {
         int ret;
-        char *device_name, *device_names, *device_tmp;
+        char *device_name, *device_tmp;
         struct binder_device *device;
         struct hlist_node *tmp;
+        char *device_names = NULL;
 
         ret = binder_alloc_shrinker_init();
         if (ret)
@@ -5898,23 +5899,29 @@ static int __init binder_init(void)
                                     &transaction_log_fops);
         }
 
-        /*
-         * Copy the module_parameter string, because we don't want to
-         * tokenize it in-place.
-         */
-        device_names = kstrdup(binder_devices_param, GFP_KERNEL);
-        if (!device_names) {
-                ret = -ENOMEM;
-                goto err_alloc_device_names_failed;
-        }
+        if (strcmp(binder_devices_param, "") != 0) {
+                /*
+                * Copy the module_parameter string, because we don't want to
+                * tokenize it in-place.
+                 */
+                device_names = kstrdup(binder_devices_param, GFP_KERNEL);
+                if (!device_names) {
+                        ret = -ENOMEM;
+                        goto err_alloc_device_names_failed;
+                }
 
-        device_tmp = device_names;
-        while ((device_name = strsep(&device_tmp, ","))) {
-                ret = init_binder_device(device_name);
-                if (ret)
-                        goto err_init_binder_device_failed;
+                device_tmp = device_names;
+                while ((device_name = strsep(&device_tmp, ","))) {
+                        ret = init_binder_device(device_name);
+                        if (ret)
+                                goto err_init_binder_device_failed;
+                }
         }
 
+        ret = init_binderfs();
+        if (ret)
+                goto err_init_binder_device_failed;
+
         return ret;
 
 err_init_binder_device_failed:
diff --git a/drivers/android/binder_internal.h b/drivers/android/binder_internal.h
index 7fb97f503ef2..045b3e42d98b 100644
--- a/drivers/android/binder_internal.h
+++ b/drivers/android/binder_internal.h
@@ -46,4 +46,13 @@ static inline bool is_binderfs_device(const struct inode *inode)
 }
 #endif
 
+#ifdef CONFIG_ANDROID_BINDERFS
+extern int __init init_binderfs(void);
+#else
+static inline int __init init_binderfs(void)
+{
+        return 0;
+}
+#endif
+
 #endif /* _LINUX_BINDER_INTERNAL_H */
diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index 6a2185eb66c5..e773f45d19d9 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -395,6 +395,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
         struct inode *inode = NULL;
         struct dentry *root = sb->s_root;
         struct binderfs_info *info = sb->s_fs_info;
+#if defined(CONFIG_IPC_NS)
+        bool use_reserve = (info->ipc_ns == &init_ipc_ns);
+#else
+        bool use_reserve = true;
+#endif
 
         device = kzalloc(sizeof(*device), GFP_KERNEL);
         if (!device)
@@ -413,7 +418,10 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
 
         /* Reserve a new minor number for the new device. */
         mutex_lock(&binderfs_minors_mutex);
-        minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
+        minor = ida_alloc_max(&binderfs_minors,
+                              use_reserve ? BINDERFS_MAX_MINOR :
+                                            BINDERFS_MAX_MINOR_CAPPED,
+                              GFP_KERNEL);
         mutex_unlock(&binderfs_minors_mutex);
         if (minor < 0) {
                 ret = minor;
@@ -542,7 +550,7 @@ static struct file_system_type binder_fs_type = {
         .fs_flags       = FS_USERNS_MOUNT,
 };
 
-static int __init init_binderfs(void)
+int __init init_binderfs(void)
 {
         int ret;
 
@@ -560,5 +568,3 @@ static int __init init_binderfs(void)
 
         return ret;
 }
-
-device_initcall(init_binderfs);
diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
index cf78fa6d470d..a7359535caf5 100644
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -79,8 +79,7 @@ static void cache_size(struct cacheinfo *this_leaf, struct device_node *np)
         ct_idx = get_cacheinfo_idx(this_leaf->type);
         propname = cache_type_info[ct_idx].size_prop;
 
-        if (of_property_read_u32(np, propname, &this_leaf->size))
-                this_leaf->size = 0;
+        of_property_read_u32(np, propname, &this_leaf->size);
 }
 
 /* not cache_line_size() because that's a macro in include/linux/cache.h */
@@ -114,8 +113,7 @@ static void cache_nr_sets(struct cacheinfo *this_leaf, struct device_node *np)
         ct_idx = get_cacheinfo_idx(this_leaf->type);
         propname = cache_type_info[ct_idx].nr_sets_prop;
 
-        if (of_property_read_u32(np, propname, &this_leaf->number_of_sets))
-                this_leaf->number_of_sets = 0;
+        of_property_read_u32(np, propname, &this_leaf->number_of_sets);
 }
 
 static void cache_associativity(struct cacheinfo *this_leaf)
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 457be03b744d..0ea2139c50d8 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -130,7 +130,7 @@ u64 pm_runtime_autosuspend_expiration(struct device *dev)
 {
         int autosuspend_delay;
         u64 last_busy, expires = 0;
-        u64 now = ktime_to_ns(ktime_get());
+        u64 now = ktime_get_mono_fast_ns();
 
         if (!dev->power.use_autosuspend)
                 goto out;
@@ -909,7 +909,7 @@ static enum hrtimer_restart  pm_suspend_timer_fn(struct hrtimer *timer)
          * If 'expires' is after the current time, we've been called
          * too early.
          */
-        if (expires > 0 && expires < ktime_to_ns(ktime_get())) {
+        if (expires > 0 && expires < ktime_get_mono_fast_ns()) {
                 dev->power.timer_expires = 0;
                 rpm_suspend(dev, dev->power.timer_autosuspends ?
                     (RPM_ASYNC | RPM_AUTO) : RPM_ASYNC);
@@ -928,7 +928,7 @@ static enum hrtimer_restart  pm_suspend_timer_fn(struct hrtimer *timer)
 int pm_schedule_suspend(struct device *dev, unsigned int delay)
 {
         unsigned long flags;
-        ktime_t expires;
+        u64 expires;
         int retval;
 
         spin_lock_irqsave(&dev->power.lock, flags);
@@ -945,8 +945,8 @@ int pm_schedule_suspend(struct device *dev, unsigned int delay)
         /* Other scheduled or pending requests need to be canceled. */
         pm_runtime_cancel_pending(dev);
 
-        expires = ktime_add(ktime_get(), ms_to_ktime(delay));
-        dev->power.timer_expires = ktime_to_ns(expires);
+        expires = ktime_get_mono_fast_ns() + (u64)delay * NSEC_PER_MSEC;
+        dev->power.timer_expires = expires;
         dev->power.timer_autosuspends = 0;
         hrtimer_start(&dev->power.suspend_timer, expires, HRTIMER_MODE_ABS);
 
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 6ccdbedb02f3..d2477a5058ac 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1513,9 +1513,19 @@ static int clk_fetch_parent_index(struct clk_core *core,
         if (!parent)
                 return -EINVAL;
 
-        for (i = 0; i < core->num_parents; i++)
-                if (clk_core_get_parent_by_index(core, i) == parent)
+        for (i = 0; i < core->num_parents; i++) {
+                if (core->parents[i] == parent)
+                        return i;
+
+                if (core->parents[i])
+                        continue;
+
+                /* Fallback to comparing globally unique names */
+                if (!strcmp(parent->name, core->parent_names[i])) {
+                        core->parents[i] = parent;
                         return i;
+                }
+        }
 
         return -EINVAL;
 }
diff --git a/drivers/clk/imx/clk-frac-pll.c b/drivers/clk/imx/clk-frac-pll.c
index 0026c3969b1e..76b9eb15604e 100644
--- a/drivers/clk/imx/clk-frac-pll.c
+++ b/drivers/clk/imx/clk-frac-pll.c
@@ -155,13 +155,14 @@ static int clk_pll_set_rate(struct clk_hw *hw, unsigned long rate,
 {
         struct clk_frac_pll *pll = to_clk_frac_pll(hw);
         u32 val, divfi, divff;
-        u64 temp64 = parent_rate;
+        u64 temp64;
         int ret;
 
         parent_rate *= 8;
         rate *= 2;
         divfi = rate / parent_rate;
-        temp64 *= rate - divfi;
+        temp64 = parent_rate * divfi;
+        temp64 = rate - temp64;
         temp64 *= PLL_FRAC_DENOM;
         do_div(temp64, parent_rate);
         divff = temp64;
diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c
index 61fefc046ec5..d083b860f083 100644
--- a/drivers/clk/mmp/clk-of-mmp2.c
+++ b/drivers/clk/mmp/clk-of-mmp2.c
@@ -53,7 +53,6 @@
 #define APMU_DISP1      0x110
 #define APMU_CCIC0      0x50
 #define APMU_CCIC1      0xf4
-#define APMU_SP         0x68
 #define MPMU_UART_PLL   0x14
 
 struct mmp2_clk_unit {
@@ -210,8 +209,6 @@ static struct mmp_clk_mix_config ccic1_mix_config = {
         .reg_info = DEFINE_MIX_REG_INFO(4, 16, 2, 6, 32),
 };
 
-static DEFINE_SPINLOCK(sp_lock);
-
 static struct mmp_param_mux_clk apmu_mux_clks[] = {
         {MMP2_CLK_DISP0_MUX, "disp0_mux", disp_parent_names, ARRAY_SIZE(disp_parent_names), CLK_SET_RATE_PARENT, APMU_DISP0, 6, 2, 0, &disp0_lock},
         {MMP2_CLK_DISP1_MUX, "disp1_mux", disp_parent_names, ARRAY_SIZE(disp_parent_names), CLK_SET_RATE_PARENT, APMU_DISP1, 6, 2, 0, &disp1_lock},
@@ -242,7 +239,6 @@ static struct mmp_param_gate_clk apmu_gate_clks[] = {
         {MMP2_CLK_CCIC1, "ccic1_clk", "ccic1_mix_clk", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x1b, 0x1b, 0x0, 0, &ccic1_lock},
         {MMP2_CLK_CCIC1_PHY, "ccic1_phy_clk", "ccic1_mix_clk", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x24, 0x24, 0x0, 0, &ccic1_lock},
         {MMP2_CLK_CCIC1_SPHY, "ccic1_sphy_clk", "ccic1_sphy_div", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x300, 0x300, 0x0, 0, &ccic1_lock},
-        {MMP2_CLK_SP, "sp_clk", NULL, CLK_SET_RATE_PARENT, APMU_SP, 0x1b, 0x1b, 0x0, 0, &sp_lock},
 };
 
 static void mmp2_axi_periph_clk_init(struct mmp2_clk_unit *pxa_unit)
diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c
index c782e62dd98b..58fa5c247af1 100644
--- a/drivers/clk/qcom/gcc-sdm845.c
+++ b/drivers/clk/qcom/gcc-sdm845.c
@@ -115,8 +115,8 @@ static const char * const gcc_parent_names_6[] = {
         "core_bi_pll_test_se",
 };
 
-static const char * const gcc_parent_names_7[] = {
-        "bi_tcxo",
+static const char * const gcc_parent_names_7_ao[] = {
+        "bi_tcxo_ao",
         "gpll0",
         "gpll0_out_even",
         "core_bi_pll_test_se",
@@ -128,6 +128,12 @@ static const char * const gcc_parent_names_8[] = {
         "core_bi_pll_test_se",
 };
 
+static const char * const gcc_parent_names_8_ao[] = {
+        "bi_tcxo_ao",
+        "gpll0",
+        "core_bi_pll_test_se",
+};
+
 static const struct parent_map gcc_parent_map_10[] = {
         { P_BI_TCXO, 0 },
         { P_GPLL0_OUT_MAIN, 1 },
@@ -210,7 +216,7 @@ static struct clk_rcg2 gcc_cpuss_ahb_clk_src = {
         .freq_tbl = ftbl_gcc_cpuss_ahb_clk_src,
         .clkr.hw.init = &(struct clk_init_data){
                 .name = "gcc_cpuss_ahb_clk_src",
-                .parent_names = gcc_parent_names_7,
+                .parent_names = gcc_parent_names_7_ao,
                 .num_parents = 4,
                 .ops = &clk_rcg2_ops,
         },
@@ -229,7 +235,7 @@ static struct clk_rcg2 gcc_cpuss_rbcpr_clk_src = {
         .freq_tbl = ftbl_gcc_cpuss_rbcpr_clk_src,
         .clkr.hw.init = &(struct clk_init_data){
                 .name = "gcc_cpuss_rbcpr_clk_src",
-                .parent_names = gcc_parent_names_8,
+                .parent_names = gcc_parent_names_8_ao,
                 .num_parents = 3,
                 .ops = &clk_rcg2_ops,
         },
diff --git a/drivers/clk/ti/divider.c b/drivers/clk/ti/divider.c
index 8d77090ad94a..0241450f3eb3 100644
--- a/drivers/clk/ti/divider.c
+++ b/drivers/clk/ti/divider.c
@@ -403,8 +403,10 @@ int ti_clk_parse_divider_data(int *div_table, int num_dividers, int max_div,
         num_dividers = i;
 
         tmp = kcalloc(valid_div + 1, sizeof(*tmp), GFP_KERNEL);
-        if (!tmp)
+        if (!tmp) {
+                *table = ERR_PTR(-ENOMEM);
                 return -ENOMEM;
+        }
 
         valid_div = 0;
         *width = 0;
@@ -439,6 +441,7 @@ struct clk_hw *ti_clk_build_component_div(struct ti_clk_divider *setup)
 {
         struct clk_omap_divider *div;
         struct clk_omap_reg *reg;
+        int ret;
 
         if (!setup)
                 return NULL;
@@ -458,6 +461,12 @@ struct clk_hw *ti_clk_build_component_div(struct ti_clk_divider *setup)
                 div->flags |= CLK_DIVIDER_POWER_OF_TWO;
 
         div->table = _get_div_table_from_setup(setup, &div->width);
+        if (IS_ERR(div->table)) {
+                ret = PTR_ERR(div->table);
+                kfree(div);
+                return ERR_PTR(ret);
+        }
+
 
         div->shift = setup->bit_shift;
         div->latch = -EINVAL;
diff --git a/drivers/cpuidle/poll_state.c b/drivers/cpuidle/poll_state.c
index b17d153e724f..23a1b27579a5 100644
--- a/drivers/cpuidle/poll_state.c
+++ b/drivers/cpuidle/poll_state.c
@@ -21,7 +21,7 @@ static int __cpuidle poll_idle(struct cpuidle_device *dev,
         local_irq_enable();
         if (!current_set_polling_and_test()) {
                 unsigned int loop_count = 0;
-                u64 limit = TICK_USEC;
+                u64 limit = TICK_NSEC;
                 int i;
 
                 for (i = 1; i < drv->state_count; i++) {
diff --git a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
index fe070d75c842..4c97478d44bd 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
+++ b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
@@ -537,6 +537,8 @@ static void process_response_list(struct nitrox_cmdq *cmdq)
         struct nitrox_device *ndev = cmdq->ndev;
         struct nitrox_softreq *sr;
         int req_completed = 0, err = 0, budget;
+        completion_t callback;
+        void *cb_arg;
 
         /* check all pending requests */
         budget = atomic_read(&cmdq->pending_count);
@@ -564,13 +566,13 @@ static void process_response_list(struct nitrox_cmdq *cmdq)
                 smp_mb__after_atomic();
                 /* remove from response list */
                 response_list_del(sr, cmdq);
-
                 /* ORH error code */
                 err = READ_ONCE(*sr->resp.orh) & 0xff;
-
-                if (sr->callback)
-                        sr->callback(sr->cb_arg, err);
+                callback = sr->callback;
+                cb_arg = sr->cb_arg;
                 softreq_destroy(sr);
+                if (callback)
+                        callback(cb_arg, err);
 
                 req_completed++;
         }
diff --git a/drivers/crypto/ccree/cc_driver.c b/drivers/crypto/ccree/cc_driver.c
index 8ada308d72ee..b0125ad65825 100644
--- a/drivers/crypto/ccree/cc_driver.c
+++ b/drivers/crypto/ccree/cc_driver.c
@@ -380,7 +380,7 @@ static int init_cc_resources(struct platform_device *plat_dev)
         rc = cc_ivgen_init(new_drvdata);
         if (rc) {
                 dev_err(dev, "cc_ivgen_init failed\n");
-                goto post_power_mgr_err;
+                goto post_buf_mgr_err;
         }
 
         /* Allocate crypto algs */
@@ -403,6 +403,9 @@ static int init_cc_resources(struct platform_device *plat_dev)
                 goto post_hash_err;
         }
 
+        /* All set, we can allow autosuspend */
+        cc_pm_go(new_drvdata);
+
         /* If we got here and FIPS mode is enabled
          * it means all FIPS test passed, so let TEE
          * know we're good.
@@ -417,8 +420,6 @@ post_cipher_err:
         cc_cipher_free(new_drvdata);
 post_ivgen_err:
         cc_ivgen_fini(new_drvdata);
-post_power_mgr_err:
-        cc_pm_fini(new_drvdata);
 post_buf_mgr_err:
          cc_buffer_mgr_fini(new_drvdata);
 post_req_mgr_err:
diff --git a/drivers/crypto/ccree/cc_pm.c b/drivers/crypto/ccree/cc_pm.c
index d990f472e89f..6ff7e75ad90e 100644
--- a/drivers/crypto/ccree/cc_pm.c
+++ b/drivers/crypto/ccree/cc_pm.c
@@ -100,20 +100,19 @@ int cc_pm_put_suspend(struct device *dev)
 
 int cc_pm_init(struct cc_drvdata *drvdata)
 {
-        int rc = 0;
         struct device *dev = drvdata_to_dev(drvdata);
 
         /* must be before the enabling to avoid resdundent suspending */
         pm_runtime_set_autosuspend_delay(dev, CC_SUSPEND_TIMEOUT);
         pm_runtime_use_autosuspend(dev);
         /* activate the PM module */
-        rc = pm_runtime_set_active(dev);
-        if (rc)
-                return rc;
-        /* enable the PM module*/
-        pm_runtime_enable(dev);
+        return pm_runtime_set_active(dev);
+}
 
-        return rc;
+/* enable the PM module*/
+void cc_pm_go(struct cc_drvdata *drvdata)
+{
+        pm_runtime_enable(drvdata_to_dev(drvdata));
 }
 
 void cc_pm_fini(struct cc_drvdata *drvdata)
diff --git a/drivers/crypto/ccree/cc_pm.h b/drivers/crypto/ccree/cc_pm.h
index 020a5403c58b..f62624357020 100644
--- a/drivers/crypto/ccree/cc_pm.h
+++ b/drivers/crypto/ccree/cc_pm.h
@@ -16,6 +16,7 @@
 extern const struct dev_pm_ops ccree_pm;
 
 int cc_pm_init(struct cc_drvdata *drvdata);
+void cc_pm_go(struct cc_drvdata *drvdata);
 void cc_pm_fini(struct cc_drvdata *drvdata);
 int cc_pm_suspend(struct device *dev);
 int cc_pm_resume(struct device *dev);
@@ -29,6 +30,8 @@ static inline int cc_pm_init(struct cc_drvdata *drvdata)
         return 0;
 }
 
+static void cc_pm_go(struct cc_drvdata *drvdata) {}
+
 static inline void cc_pm_fini(struct cc_drvdata *drvdata) {}
 
 static inline int cc_pm_suspend(struct device *dev)
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index 4e557684f792..fe69dccfa0c0 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -203,6 +203,7 @@ struct at_xdmac_chan {
         u32                             save_cim;
         u32                             save_cnda;
         u32                             save_cndc;
+        u32                             irq_status;
         unsigned long                   status;
         struct tasklet_struct           tasklet;
         struct dma_slave_config         sconfig;
@@ -1580,8 +1581,8 @@ static void at_xdmac_tasklet(unsigned long data)
         struct at_xdmac_desc    *desc;
         u32                     error_mask;
 
-        dev_dbg(chan2dev(&atchan->chan), "%s: status=0x%08lx\n",
-                 __func__, atchan->status);
+        dev_dbg(chan2dev(&atchan->chan), "%s: status=0x%08x\n",
+                __func__, atchan->irq_status);
 
         error_mask = AT_XDMAC_CIS_RBEIS
                      | AT_XDMAC_CIS_WBEIS
@@ -1589,15 +1590,15 @@ static void at_xdmac_tasklet(unsigned long data)
 
         if (at_xdmac_chan_is_cyclic(atchan)) {
                 at_xdmac_handle_cyclic(atchan);
-        } else if ((atchan->status & AT_XDMAC_CIS_LIS)
-                   || (atchan->status & error_mask)) {
+        } else if ((atchan->irq_status & AT_XDMAC_CIS_LIS)
+                   || (atchan->irq_status & error_mask)) {
                 struct dma_async_tx_descriptor  *txd;
 
-                if (atchan->status & AT_XDMAC_CIS_RBEIS)
+                if (atchan->irq_status & AT_XDMAC_CIS_RBEIS)
                         dev_err(chan2dev(&atchan->chan), "read bus error!!!");
-                if (atchan->status & AT_XDMAC_CIS_WBEIS)
+                if (atchan->irq_status & AT_XDMAC_CIS_WBEIS)
                         dev_err(chan2dev(&atchan->chan), "write bus error!!!");
-                if (atchan->status & AT_XDMAC_CIS_ROIS)
+                if (atchan->irq_status & AT_XDMAC_CIS_ROIS)
                         dev_err(chan2dev(&atchan->chan), "request overflow error!!!");
 
                 spin_lock(&atchan->lock);
@@ -1652,7 +1653,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id)
                         atchan = &atxdmac->chan[i];
                         chan_imr = at_xdmac_chan_read(atchan, AT_XDMAC_CIM);
                         chan_status = at_xdmac_chan_read(atchan, AT_XDMAC_CIS);
-                        atchan->status = chan_status & chan_imr;
+                        atchan->irq_status = chan_status & chan_imr;
                         dev_vdbg(atxdmac->dma.dev,
                                  "%s: chan%d: imr=0x%x, status=0x%x\n",
                                  __func__, i, chan_imr, chan_status);
@@ -1666,7 +1667,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id)
                                  at_xdmac_chan_read(atchan, AT_XDMAC_CDA),
                                  at_xdmac_chan_read(atchan, AT_XDMAC_CUBC));
 
-                        if (atchan->status & (AT_XDMAC_CIS_RBEIS | AT_XDMAC_CIS_WBEIS))
+                        if (atchan->irq_status & (AT_XDMAC_CIS_RBEIS | AT_XDMAC_CIS_WBEIS))
                                 at_xdmac_write(atxdmac, AT_XDMAC_GD, atchan->mask);
 
                         tasklet_schedule(&atchan->tasklet);
diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index 1a44c8086d77..ae10f5614f95 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -406,38 +406,32 @@ static void bcm2835_dma_fill_cb_chain_with_sg(
         }
 }
 
-static int bcm2835_dma_abort(void __iomem *chan_base)
+static int bcm2835_dma_abort(struct bcm2835_chan *c)
 {
-        unsigned long cs;
+        void __iomem *chan_base = c->chan_base;
         long int timeout = 10000;
 
-        cs = readl(chan_base + BCM2835_DMA_CS);
-        if (!(cs & BCM2835_DMA_ACTIVE))
+        /*
+         * A zero control block address means the channel is idle.
+         * (The ACTIVE flag in the CS register is not a reliable indicator.)
+         */
+        if (!readl(chan_base + BCM2835_DMA_ADDR))
                 return 0;
 
         /* Write 0 to the active bit - Pause the DMA */
         writel(0, chan_base + BCM2835_DMA_CS);
 
         /* Wait for any current AXI transfer to complete */
-        while ((cs & BCM2835_DMA_ISPAUSED) && --timeout) {
+        while ((readl(chan_base + BCM2835_DMA_CS) &
+                BCM2835_DMA_WAITING_FOR_WRITES) && --timeout)
                 cpu_relax();
-                cs = readl(chan_base + BCM2835_DMA_CS);
-        }
 
-        /* We'll un-pause when we set of our next DMA */
+        /* Peripheral might be stuck and fail to signal AXI write responses */
         if (!timeout)
-                return -ETIMEDOUT;
-
-        if (!(cs & BCM2835_DMA_ACTIVE))
-                return 0;
-
-        /* Terminate the control block chain */
-        writel(0, chan_base + BCM2835_DMA_NEXTCB);
-
-        /* Abort the whole DMA */
-        writel(BCM2835_DMA_ABORT | BCM2835_DMA_ACTIVE,
-               chan_base + BCM2835_DMA_CS);
+                dev_err(c->vc.chan.device->dev,
+                        "failed to complete outstanding writes\n");
 
+        writel(BCM2835_DMA_RESET, chan_base + BCM2835_DMA_CS);
         return 0;
 }
 
@@ -476,8 +470,15 @@ static irqreturn_t bcm2835_dma_callback(int irq, void *data)
 
         spin_lock_irqsave(&c->vc.lock, flags);
 
-        /* Acknowledge interrupt */
-        writel(BCM2835_DMA_INT, c->chan_base + BCM2835_DMA_CS);
+        /*
+         * Clear the INT flag to receive further interrupts. Keep the channel
+         * active in case the descriptor is cyclic or in case the client has
+         * already terminated the descriptor and issued a new one. (May happen
+         * if this IRQ handler is threaded.) If the channel is finished, it
+         * will remain idle despite the ACTIVE flag being set.
+         */
+        writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE,
+               c->chan_base + BCM2835_DMA_CS);
 
         d = c->desc;
 
@@ -485,11 +486,7 @@ static irqreturn_t bcm2835_dma_callback(int irq, void *data)
                 if (d->cyclic) {
                         /* call the cyclic callback */
                         vchan_cyclic_callback(&d->vd);
-
-                        /* Keep the DMA engine running */
-                        writel(BCM2835_DMA_ACTIVE,
-                               c->chan_base + BCM2835_DMA_CS);
-                } else {
+                } else if (!readl(c->chan_base + BCM2835_DMA_ADDR)) {
                         vchan_cookie_complete(&c->desc->vd);
                         bcm2835_dma_start_desc(c);
                 }
@@ -779,7 +776,6 @@ static int bcm2835_dma_terminate_all(struct dma_chan *chan)
         struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
         struct bcm2835_dmadev *d = to_bcm2835_dma_dev(c->vc.chan.device);
         unsigned long flags;
-        int timeout = 10000;
         LIST_HEAD(head);
 
         spin_lock_irqsave(&c->vc.lock, flags);
@@ -789,27 +785,11 @@ static int bcm2835_dma_terminate_all(struct dma_chan *chan)
         list_del_init(&c->node);
         spin_unlock(&d->lock);
 
-        /*
-         * Stop DMA activity: we assume the callback will not be called
-         * after bcm_dma_abort() returns (even if it does, it will see
-         * c->desc is NULL and exit.)
-         */
+        /* stop DMA activity */
         if (c->desc) {
                 vchan_terminate_vdesc(&c->desc->vd);
                 c->desc = NULL;
-                bcm2835_dma_abort(c->chan_base);
-
-                /* Wait for stopping */
-                while (--timeout) {
-                        if (!(readl(c->chan_base + BCM2835_DMA_CS) &
-                                                BCM2835_DMA_ACTIVE))
-                                break;
-
-                        cpu_relax();
-                }
-
-                if (!timeout)
-                        dev_err(d->ddev.dev, "DMA transfer could not be terminated\n");
+                bcm2835_dma_abort(c);
         }
 
         vchan_get_all_descriptors(&c->vc, &head);
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 2eea4ef72915..6511928b4cdf 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -711,11 +711,9 @@ static int dmatest_func(void *data)
                         srcs[i] = um->addr[i] + src_off;
                         ret = dma_mapping_error(dev->dev, um->addr[i]);
                         if (ret) {
-                                dmaengine_unmap_put(um);
                                 result("src mapping error", total_tests,
                                        src_off, dst_off, len, ret);
-                                failed_tests++;
-                                continue;
+                                goto error_unmap_continue;
                         }
                         um->to_cnt++;
                 }
@@ -730,11 +728,9 @@ static int dmatest_func(void *data)
                                                DMA_BIDIRECTIONAL);
                         ret = dma_mapping_error(dev->dev, dsts[i]);
                         if (ret) {
-                                dmaengine_unmap_put(um);
                                 result("dst mapping error", total_tests,
                                        src_off, dst_off, len, ret);
-                                failed_tests++;
-                                continue;
+                                goto error_unmap_continue;
                         }
                         um->bidi_cnt++;
                 }
@@ -762,12 +758,10 @@ static int dmatest_func(void *data)
                 }
 
                 if (!tx) {
-                        dmaengine_unmap_put(um);
                         result("prep error", total_tests, src_off,
                                dst_off, len, ret);
                         msleep(100);
-                        failed_tests++;
-                        continue;
+                        goto error_unmap_continue;
                 }
 
                 done->done = false;
@@ -776,12 +770,10 @@ static int dmatest_func(void *data)
                 cookie = tx->tx_submit(tx);
 
                 if (dma_submit_error(cookie)) {
-                        dmaengine_unmap_put(um);
                         result("submit error", total_tests, src_off,
                                dst_off, len, ret);
                         msleep(100);
-                        failed_tests++;
-                        continue;
+                        goto error_unmap_continue;
                 }
                 dma_async_issue_pending(chan);
 
@@ -790,22 +782,20 @@ static int dmatest_func(void *data)
 
                 status = dma_async_is_tx_complete(chan, cookie, NULL, NULL);
 
-                dmaengine_unmap_put(um);
-
                 if (!done->done) {
                         result("test timed out", total_tests, src_off, dst_off,
                                len, 0);
-                        failed_tests++;
-                        continue;
+                        goto error_unmap_continue;
                 } else if (status != DMA_COMPLETE) {
                         result(status == DMA_ERROR ?
                                "completion error status" :
                                "completion busy status", total_tests, src_off,
                                dst_off, len, ret);
-                        failed_tests++;
-                        continue;
+                        goto error_unmap_continue;
                 }
 
+                dmaengine_unmap_put(um);
+
                 if (params->noverify) {
                         verbose_result("test passed", total_tests, src_off,
                                        dst_off, len, 0);
@@ -846,6 +836,12 @@ static int dmatest_func(void *data)
                         verbose_result("test passed", total_tests, src_off,
                                        dst_off, len, 0);
                 }
+
+                continue;
+
+error_unmap_continue:
+                dmaengine_unmap_put(um);
+                failed_tests++;
         }
         ktime = ktime_sub(ktime_get(), ktime);
         ktime = ktime_sub(ktime, comparetime);
diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
index c2fff3f6c9ca..4a09af3cd546 100644
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -618,7 +618,7 @@ static void imxdma_tasklet(unsigned long data)
 {
         struct imxdma_channel *imxdmac = (void *)data;
         struct imxdma_engine *imxdma = imxdmac->imxdma;
-        struct imxdma_desc *desc;
+        struct imxdma_desc *desc, *next_desc;
         unsigned long flags;
 
         spin_lock_irqsave(&imxdma->lock, flags);
@@ -648,10 +648,10 @@ static void imxdma_tasklet(unsigned long data)
         list_move_tail(imxdmac->ld_active.next, &imxdmac->ld_free);
 
         if (!list_empty(&imxdmac->ld_queue)) {
-                desc = list_first_entry(&imxdmac->ld_queue, struct imxdma_desc,
-                                        node);
+                next_desc = list_first_entry(&imxdmac->ld_queue,
+                                             struct imxdma_desc, node);
                 list_move_tail(imxdmac->ld_queue.next, &imxdmac->ld_active);
-                if (imxdma_xfer_desc(desc) < 0)
+                if (imxdma_xfer_desc(next_desc) < 0)
                         dev_warn(imxdma->dev, "%s: channel: %d couldn't xfer desc\n",
                                  __func__, imxdmac->channel);
         }
diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c
index 472c88ae1c0f..92f843eaf1e0 100644
--- a/drivers/firmware/arm_scmi/bus.c
+++ b/drivers/firmware/arm_scmi/bus.c
@@ -119,6 +119,11 @@ void scmi_driver_unregister(struct scmi_driver *driver)
 }
 EXPORT_SYMBOL_GPL(scmi_driver_unregister);
 
+static void scmi_device_release(struct device *dev)
+{
+        kfree(to_scmi_dev(dev));
+}
+
 struct scmi_device *
 scmi_device_create(struct device_node *np, struct device *parent, int protocol)
 {
@@ -138,6 +143,7 @@ scmi_device_create(struct device_node *np, struct device *parent, int protocol)
         scmi_dev->dev.parent = parent;
         scmi_dev->dev.of_node = np;
         scmi_dev->dev.bus = &scmi_bus_type;
+        scmi_dev->dev.release = scmi_device_release;
         dev_set_name(&scmi_dev->dev, "scmi_dev.%d", id);
 
         retval = device_register(&scmi_dev->dev);
@@ -156,9 +162,8 @@ free_mem:
 void scmi_device_destroy(struct scmi_device *scmi_dev)
 {
         scmi_handle_put(scmi_dev->handle);
-        device_unregister(&scmi_dev->dev);
         ida_simple_remove(&scmi_bus_id, scmi_dev->id);
-        kfree(scmi_dev);
+        device_unregister(&scmi_dev->dev);
 }
 
 void scmi_set_handle(struct scmi_device *scmi_dev)
diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c
index 23ea1ed409d1..352bd2473162 100644
--- a/drivers/firmware/efi/arm-runtime.c
+++ b/drivers/firmware/efi/arm-runtime.c
@@ -37,8 +37,9 @@ extern u64 efi_system_table;
 static struct ptdump_info efi_ptdump_info = {
         .mm             = &efi_mm,
         .markers        = (struct addr_marker[]){
-                { 0,            "UEFI runtime start" },
-                { DEFAULT_MAP_WINDOW_64, "UEFI runtime end" }
+                { 0,                            "UEFI runtime start" },
+                { DEFAULT_MAP_WINDOW_64,        "UEFI runtime end" },
+                { -1,                           NULL }
         },
         .base_addr      = 0,
 };
diff --git a/drivers/fpga/stratix10-soc.c b/drivers/fpga/stratix10-soc.c
index a1a09e04fab8..13851b3d1c56 100644
--- a/drivers/fpga/stratix10-soc.c
+++ b/drivers/fpga/stratix10-soc.c
@@ -508,14 +508,11 @@ static int __init s10_init(void)
                 return -ENODEV;
 
         np = of_find_matching_node(fw_np, s10_of_match);
-        if (!np) {
-                of_node_put(fw_np);
+        if (!np)
                 return -ENODEV;
-        }
 
         of_node_put(np);
         ret = of_platform_populate(fw_np, s10_of_match, NULL, NULL);
-        of_node_put(fw_np);
         if (ret)
                 return ret;
 
diff --git a/drivers/gpio/gpio-altera-a10sr.c b/drivers/gpio/gpio-altera-a10sr.c
index 6b11f1314248..7f9e0304b510 100644
--- a/drivers/gpio/gpio-altera-a10sr.c
+++ b/drivers/gpio/gpio-altera-a10sr.c
@@ -66,8 +66,10 @@ static int altr_a10sr_gpio_direction_input(struct gpio_chip *gc,
 static int altr_a10sr_gpio_direction_output(struct gpio_chip *gc,
                                             unsigned int nr, int value)
 {
-        if (nr <= (ALTR_A10SR_OUT_VALID_RANGE_HI - ALTR_A10SR_LED_VALID_SHIFT))
+        if (nr <= (ALTR_A10SR_OUT_VALID_RANGE_HI - ALTR_A10SR_LED_VALID_SHIFT)) {
+                altr_a10sr_gpio_set(gc, nr, value);
                 return 0;
+        }
         return -EINVAL;
 }
 
diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
index e0d6a0a7bc69..e41223c05f6e 100644
--- a/drivers/gpio/gpio-eic-sprd.c
+++ b/drivers/gpio/gpio-eic-sprd.c
@@ -180,7 +180,18 @@ static void sprd_eic_free(struct gpio_chip *chip, unsigned int offset)
 
 static int sprd_eic_get(struct gpio_chip *chip, unsigned int offset)
 {
-        return sprd_eic_read(chip, offset, SPRD_EIC_DBNC_DATA);
+        struct sprd_eic *sprd_eic = gpiochip_get_data(chip);
+
+        switch (sprd_eic->type) {
+        case SPRD_EIC_DEBOUNCE:
+                return sprd_eic_read(chip, offset, SPRD_EIC_DBNC_DATA);
+        case SPRD_EIC_ASYNC:
+                return sprd_eic_read(chip, offset, SPRD_EIC_ASYNC_DATA);
+        case SPRD_EIC_SYNC:
+                return sprd_eic_read(chip, offset, SPRD_EIC_SYNC_DATA);
+        default:
+                return -ENOTSUPP;
+        }
 }
 
 static int sprd_eic_direction_input(struct gpio_chip *chip, unsigned int offset)
@@ -368,6 +379,7 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type)
                         irq_set_handler_locked(data, handle_edge_irq);
                         break;
                 case IRQ_TYPE_EDGE_BOTH:
+                        sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 0);
                         sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 1);
                         irq_set_handler_locked(data, handle_edge_irq);
                         break;
diff --git a/drivers/gpio/gpio-pcf857x.c b/drivers/gpio/gpio-pcf857x.c
index adf72dda25a2..68a35b65925a 100644
--- a/drivers/gpio/gpio-pcf857x.c
+++ b/drivers/gpio/gpio-pcf857x.c
@@ -84,6 +84,7 @@ MODULE_DEVICE_TABLE(of, pcf857x_of_table);
  */
 struct pcf857x {
         struct gpio_chip        chip;
+        struct irq_chip         irqchip;
         struct i2c_client       *client;
         struct mutex            lock;           /* protect 'out' */
         unsigned                out;            /* software latch */
@@ -252,18 +253,6 @@ static void pcf857x_irq_bus_sync_unlock(struct irq_data *data)
         mutex_unlock(&gpio->lock);
 }
 
-static struct irq_chip pcf857x_irq_chip = {
-        .name           = "pcf857x",
-        .irq_enable     = pcf857x_irq_enable,
-        .irq_disable    = pcf857x_irq_disable,
-        .irq_ack        = noop,
-        .irq_mask       = noop,
-        .irq_unmask     = noop,
-        .irq_set_wake   = pcf857x_irq_set_wake,
-        .irq_bus_lock           = pcf857x_irq_bus_lock,
-        .irq_bus_sync_unlock    = pcf857x_irq_bus_sync_unlock,
-};
-
 /*-------------------------------------------------------------------------*/
 
 static int pcf857x_probe(struct i2c_client *client,
@@ -376,8 +365,17 @@ static int pcf857x_probe(struct i2c_client *client,
 
         /* Enable irqchip if we have an interrupt */
         if (client->irq) {
+                gpio->irqchip.name = "pcf857x",
+                gpio->irqchip.irq_enable = pcf857x_irq_enable,
+                gpio->irqchip.irq_disable = pcf857x_irq_disable,
+                gpio->irqchip.irq_ack = noop,
+                gpio->irqchip.irq_mask = noop,
+                gpio->irqchip.irq_unmask = noop,
+                gpio->irqchip.irq_set_wake = pcf857x_irq_set_wake,
+                gpio->irqchip.irq_bus_lock = pcf857x_irq_bus_lock,
+                gpio->irqchip.irq_bus_sync_unlock = pcf857x_irq_bus_sync_unlock,
                 status = gpiochip_irqchip_add_nested(&gpio->chip,
-                                                     &pcf857x_irq_chip,
+                                                     &gpio->irqchip,
                                                      0, handle_level_irq,
                                                      IRQ_TYPE_NONE);
                 if (status) {
@@ -392,7 +390,7 @@ static int pcf857x_probe(struct i2c_client *client,
                 if (status)
                         goto fail;
 
-                gpiochip_set_nested_irqchip(&gpio->chip, &pcf857x_irq_chip,
+                gpiochip_set_nested_irqchip(&gpio->chip, &gpio->irqchip,
                                             client->irq);
                 gpio->irq_parent = client->irq;
         }
diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
index 1b79ebcfce3e..541fa6ac399d 100644
--- a/drivers/gpio/gpio-vf610.c
+++ b/drivers/gpio/gpio-vf610.c
@@ -253,6 +253,7 @@ static int vf610_gpio_probe(struct platform_device *pdev)
         struct vf610_gpio_port *port;
         struct resource *iores;
         struct gpio_chip *gc;
+        int i;
         int ret;
 
         port = devm_kzalloc(&pdev->dev, sizeof(*port), GFP_KERNEL);
@@ -319,6 +320,10 @@ static int vf610_gpio_probe(struct platform_device *pdev)
         if (ret < 0)
                 return ret;
 
+        /* Mask all GPIO interrupts */
+        for (i = 0; i < gc->ngpio; i++)
+                vf610_gpio_writel(0, port->base + PORT_PCR(i));
+
         /* Clear the interrupt status register for all GPIO's */
         vf610_gpio_writel(~0, port->base + PORT_ISFR);
 
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 1651d7f0a303..d1adfdf50fb3 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -828,7 +828,14 @@ static irqreturn_t lineevent_irq_thread(int irq, void *p)
         /* Do not leak kernel stack to userspace */
         memset(&ge, 0, sizeof(ge));
 
-        ge.timestamp = le->timestamp;
+        /*
+         * We may be running from a nested threaded interrupt in which case
+         * we didn't get the timestamp from lineevent_irq_handler().
+         */
+        if (!le->timestamp)
+                ge.timestamp = ktime_get_real_ns();
+        else
+                ge.timestamp = le->timestamp;
 
         if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE
             && le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
index 6896dec97fc7..0ed41a9d2d77 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
@@ -1686,7 +1686,8 @@ static umode_t hwmon_attributes_visible(struct kobject *kobj,
                 effective_mode &= ~S_IWUSR;
 
         if ((adev->flags & AMD_IS_APU) &&
-            (attr == &sensor_dev_attr_power1_cap_max.dev_attr.attr ||
+            (attr == &sensor_dev_attr_power1_average.dev_attr.attr ||
+             attr == &sensor_dev_attr_power1_cap_max.dev_attr.attr ||
              attr == &sensor_dev_attr_power1_cap_min.dev_attr.attr||
              attr == &sensor_dev_attr_power1_cap.dev_attr.attr))
                 return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
index 71913a18d142..a38e0fb4a6fe 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
@@ -38,6 +38,7 @@
 #include "amdgpu_gem.h"
 #include <drm/amdgpu_drm.h>
 #include <linux/dma-buf.h>
+#include <linux/dma-fence-array.h>
 
 /**
  * amdgpu_gem_prime_get_sg_table - &drm_driver.gem_prime_get_sg_table
@@ -187,6 +188,48 @@ error:
         return ERR_PTR(ret);
 }
 
+static int
+__reservation_object_make_exclusive(struct reservation_object *obj)
+{
+        struct dma_fence **fences;
+        unsigned int count;
+        int r;
+
+        if (!reservation_object_get_list(obj)) /* no shared fences to convert */
+                return 0;
+
+        r = reservation_object_get_fences_rcu(obj, NULL, &count, &fences);
+        if (r)
+                return r;
+
+        if (count == 0) {
+                /* Now that was unexpected. */
+        } else if (count == 1) {
+                reservation_object_add_excl_fence(obj, fences[0]);
+                dma_fence_put(fences[0]);
+                kfree(fences);
+        } else {
+                struct dma_fence_array *array;
+
+                array = dma_fence_array_create(count, fences,
+                                               dma_fence_context_alloc(1), 0,
+                                               false);
+                if (!array)
+                        goto err_fences_put;
+
+                reservation_object_add_excl_fence(obj, &array->base);
+                dma_fence_put(&array->base);
+        }
+
+        return 0;
+
+err_fences_put:
+        while (count--)
+                dma_fence_put(fences[count]);
+        kfree(fences);
+        return -ENOMEM;
+}
+
 /**
  * amdgpu_gem_map_attach - &dma_buf_ops.attach implementation
  * @dma_buf: Shared DMA buffer
@@ -218,16 +261,16 @@ static int amdgpu_gem_map_attach(struct dma_buf *dma_buf,
 
         if (attach->dev->driver != adev->dev->driver) {
                 /*
-                 * Wait for all shared fences to complete before we switch to future
-                 * use of exclusive fence on this prime shared bo.
+                 * We only create shared fences for internal use, but importers
+                 * of the dmabuf rely on exclusive fences for implicitly
+                 * tracking write hazards. As any of the current fences may
+                 * correspond to a write, we need to convert all existing
+                 * fences on the reservation object into a single exclusive
+                 * fence.
                  */
-                r = reservation_object_wait_timeout_rcu(bo->tbo.resv,
-                                                        true, false,
-                                                        MAX_SCHEDULE_TIMEOUT);
-                if (unlikely(r < 0)) {
-                        DRM_DEBUG_PRIME("Fence wait failed: %li\n", r);
+                r = __reservation_object_make_exclusive(bo->tbo.resv);
+                if (r)
                         goto error_unreserve;
-                }
         }
 
         /* pin buffer into GTT */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
index 8fab0d637ee5..3a9b48b227ac 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
@@ -90,8 +90,10 @@ static int psp_sw_fini(void *handle)
         adev->psp.sos_fw = NULL;
         release_firmware(adev->psp.asd_fw);
         adev->psp.asd_fw = NULL;
-        release_firmware(adev->psp.ta_fw);
-        adev->psp.ta_fw = NULL;
+        if (adev->psp.ta_fw) {
+                release_firmware(adev->psp.ta_fw);
+                adev->psp.ta_fw = NULL;
+        }
         return 0;
 }
 
@@ -435,6 +437,9 @@ static int psp_xgmi_initialize(struct psp_context *psp)
         struct ta_xgmi_shared_memory *xgmi_cmd;
         int ret;
 
+        if (!psp->adev->psp.ta_fw)
+                return -ENOENT;
+
         if (!psp->xgmi_context.initialized) {
                 ret = psp_xgmi_init_shared_buf(psp);
                 if (ret)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index d2ea5ce2cefb..7c108e687683 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -3363,14 +3363,15 @@ void amdgpu_vm_get_task_info(struct amdgpu_device *adev, unsigned int pasid,
                          struct amdgpu_task_info *task_info)
 {
         struct amdgpu_vm *vm;
+        unsigned long flags;
 
-        spin_lock(&adev->vm_manager.pasid_lock);
+        spin_lock_irqsave(&adev->vm_manager.pasid_lock, flags);
 
         vm = idr_find(&adev->vm_manager.pasid_idr, pasid);
         if (vm)
                 *task_info = vm->task_info;
 
-        spin_unlock(&adev->vm_manager.pasid_lock);
+        spin_unlock_irqrestore(&adev->vm_manager.pasid_lock, flags);
 }
 
 /**
diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
index 4cd31a276dcd..186db182f924 100644
--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
+++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c
@@ -93,7 +93,20 @@ static void nbio_v7_4_enable_doorbell_aperture(struct amdgpu_device *adev,
 static void nbio_v7_4_enable_doorbell_selfring_aperture(struct amdgpu_device *adev,
                                                         bool enable)
 {
+        u32 tmp = 0;
 
+        if (enable) {
+                tmp = REG_SET_FIELD(tmp, DOORBELL_SELFRING_GPA_APER_CNTL, DOORBELL_SELFRING_GPA_APER_EN, 1) |
+                      REG_SET_FIELD(tmp, DOORBELL_SELFRING_GPA_APER_CNTL, DOORBELL_SELFRING_GPA_APER_MODE, 1) |
+                      REG_SET_FIELD(tmp, DOORBELL_SELFRING_GPA_APER_CNTL, DOORBELL_SELFRING_GPA_APER_SIZE, 0);
+
+                WREG32_SOC15(NBIO, 0, mmDOORBELL_SELFRING_GPA_APER_BASE_LOW,
+                             lower_32_bits(adev->doorbell.base));
+                WREG32_SOC15(NBIO, 0, mmDOORBELL_SELFRING_GPA_APER_BASE_HIGH,
+                             upper_32_bits(adev->doorbell.base));
+        }
+
+        WREG32_SOC15(NBIO, 0, mmDOORBELL_SELFRING_GPA_APER_CNTL, tmp);
 }
 
 static void nbio_v7_4_ih_doorbell_range(struct amdgpu_device *adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
index 0c6e7f9b143f..189fcb004579 100644
--- a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
@@ -152,18 +152,22 @@ static int psp_v11_0_init_microcode(struct psp_context *psp)
 
         snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_ta.bin", chip_name);
         err = request_firmware(&adev->psp.ta_fw, fw_name, adev->dev);
-        if (err)
-                goto out2;
-
-        err = amdgpu_ucode_validate(adev->psp.ta_fw);
-        if (err)
-                goto out2;
-
-        ta_hdr = (const struct ta_firmware_header_v1_0 *)adev->psp.ta_fw->data;
-        adev->psp.ta_xgmi_ucode_version = le32_to_cpu(ta_hdr->ta_xgmi_ucode_version);
-        adev->psp.ta_xgmi_ucode_size = le32_to_cpu(ta_hdr->ta_xgmi_size_bytes);
-        adev->psp.ta_xgmi_start_addr = (uint8_t *)ta_hdr +
-                le32_to_cpu(ta_hdr->header.ucode_array_offset_bytes);
+        if (err) {
+                release_firmware(adev->psp.ta_fw);
+                adev->psp.ta_fw = NULL;
+                dev_info(adev->dev,
+                         "psp v11.0: Failed to load firmware \"%s\"\n", fw_name);
+        } else {
+                err = amdgpu_ucode_validate(adev->psp.ta_fw);
+                if (err)
+                        goto out2;
+
+                ta_hdr = (const struct ta_firmware_header_v1_0 *)adev->psp.ta_fw->data;
+                adev->psp.ta_xgmi_ucode_version = le32_to_cpu(ta_hdr->ta_xgmi_ucode_version);
+                adev->psp.ta_xgmi_ucode_size = le32_to_cpu(ta_hdr->ta_xgmi_size_bytes);
+                adev->psp.ta_xgmi_start_addr = (uint8_t *)ta_hdr +
+                        le32_to_cpu(ta_hdr->header.ucode_array_offset_bytes);
+        }
 
         return 0;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
index 8849b74078d6..9b639974c70c 100644
--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
+++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
@@ -729,11 +729,13 @@ static int soc15_common_early_init(void *handle)
         case CHIP_RAVEN:
                 adev->asic_funcs = &soc15_asic_funcs;
                 if (adev->rev_id >= 0x8)
-                        adev->external_rev_id = adev->rev_id + 0x81;
+                        adev->external_rev_id = adev->rev_id + 0x79;
                 else if (adev->pdev->device == 0x15d8)
                         adev->external_rev_id = adev->rev_id + 0x41;
+                else if (adev->rev_id == 1)
+                        adev->external_rev_id = adev->rev_id + 0x20;
                 else
-                        adev->external_rev_id = 0x1;
+                        adev->external_rev_id = adev->rev_id + 0x01;
 
                 if (adev->rev_id >= 0x8) {
                         adev->cg_flags = AMD_CG_SUPPORT_GFX_MGCG |
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
index 5d85ff341385..2e7c44955f43 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
@@ -863,7 +863,7 @@ static int kfd_fill_mem_info_for_cpu(int numa_node_id, int *avail_size,
         return 0;
 }
 
-#if CONFIG_X86_64
+#ifdef CONFIG_X86_64
 static int kfd_fill_iolink_info_for_cpu(int numa_node_id, int *avail_size,
                                 uint32_t *num_entries,
                                 struct crat_subtype_iolink *sub_type_hdr)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index f4fa40c387d3..0b392bfca284 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -4082,7 +4082,8 @@ void amdgpu_dm_connector_init_helper(struct amdgpu_display_manager *dm,
         }
 
         if (connector_type == DRM_MODE_CONNECTOR_HDMIA ||
-            connector_type == DRM_MODE_CONNECTOR_DisplayPort) {
+            connector_type == DRM_MODE_CONNECTOR_DisplayPort ||
+            connector_type == DRM_MODE_CONNECTOR_eDP) {
                 drm_connector_attach_vrr_capable_property(
                         &aconnector->base);
         }
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index 9a7ac58eb18e..ddd75a4d8ba5 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -671,6 +671,25 @@ static ssize_t dp_phy_test_pattern_debugfs_write(struct file *f, const char __us
         return bytes_from_user;
 }
 
+/*
+ * Returns the min and max vrr vfreq through the connector's debugfs file.
+ * Example usage: cat /sys/kernel/debug/dri/0/DP-1/vrr_range
+ */
+static int vrr_range_show(struct seq_file *m, void *data)
+{
+        struct drm_connector *connector = m->private;
+        struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
+
+        if (connector->status != connector_status_connected)
+                return -ENODEV;
+
+        seq_printf(m, "Min: %u\n", (unsigned int)aconnector->min_vfreq);
+        seq_printf(m, "Max: %u\n", (unsigned int)aconnector->max_vfreq);
+
+        return 0;
+}
+DEFINE_SHOW_ATTRIBUTE(vrr_range);
+
 static const struct file_operations dp_link_settings_debugfs_fops = {
         .owner = THIS_MODULE,
         .read = dp_link_settings_read,
@@ -697,7 +716,8 @@ static const struct {
 } dp_debugfs_entries[] = {
                 {"link_settings", &dp_link_settings_debugfs_fops},
                 {"phy_settings", &dp_phy_settings_debugfs_fop},
-                {"test_pattern", &dp_phy_test_pattern_fops}
+                {"test_pattern", &dp_phy_test_pattern_fops},
+                {"vrr_range", &vrr_range_fops}
 };
 
 int connector_debugfs_init(struct amdgpu_dm_connector *connector)
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c
index afd287f08bc9..19801bdba0d2 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c
@@ -591,7 +591,15 @@ static void dce11_pplib_apply_display_requirements(
                         dc,
                         context->bw.dce.sclk_khz);
 
-        pp_display_cfg->min_dcfclock_khz = pp_display_cfg->min_engine_clock_khz;
+        /*
+         * As workaround for >4x4K lightup set dcfclock to min_engine_clock value.
+         * This is not required for less than 5 displays,
+         * thus don't request decfclk in dc to avoid impact
+         * on power saving.
+         *
+         */
+        pp_display_cfg->min_dcfclock_khz = (context->stream_count > 4)?
+                        pp_display_cfg->min_engine_clock_khz : 0;
 
         pp_display_cfg->min_engine_clock_deep_sleep_khz
                         = context->bw.dce.sclk_deep_sleep_khz;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
index f95c5f50eb0f..5273de3c5b98 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
@@ -1033,6 +1033,7 @@ static int smu10_get_clock_by_type_with_latency(struct pp_hwmgr *hwmgr,
                 break;
         case amd_pp_dpp_clock:
                 pclk_vol_table = pinfo->vdd_dep_on_dppclk;
+                break;
         default:
                 return -EINVAL;
         }
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index 99cba8ea5d82..5df1256618cc 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -528,7 +528,8 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 
         object_count = cl->object_count;
 
-        object_ids = memdup_user(u64_to_user_ptr(cl->object_ids), object_count * sizeof(__u32));
+        object_ids = memdup_user(u64_to_user_ptr(cl->object_ids),
+                        array_size(object_count, sizeof(__u32)));
         if (IS_ERR(object_ids))
                 return PTR_ERR(object_ids);
 
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index 24a750436559..f91e02c87fd8 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -758,7 +758,7 @@ int drm_mode_hsync(const struct drm_display_mode *mode)
         if (mode->hsync)
                 return mode->hsync;
 
-        if (mode->htotal < 0)
+        if (mode->htotal <= 0)
                 return 0;
 
         calc_val = (mode->clock * 1000) / mode->htotal; /* hsync in Hz */
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 216f52b744a6..c882ea94172c 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1824,6 +1824,16 @@ i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
         return 0;
 }
 
+static inline bool
+__vma_matches(struct vm_area_struct *vma, struct file *filp,
+              unsigned long addr, unsigned long size)
+{
+        if (vma->vm_file != filp)
+                return false;
+
+        return vma->vm_start == addr && (vma->vm_end - vma->vm_start) == size;
+}
+
 /**
  * i915_gem_mmap_ioctl - Maps the contents of an object, returning the address
  *                       it is mapped to.
@@ -1882,7 +1892,7 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
                         return -EINTR;
                 }
                 vma = find_vma(mm, addr);
-                if (vma)
+                if (vma && __vma_matches(vma, obj->base.filp, addr, args->size))
                         vma->vm_page_prot =
                                 pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
                 else
diff --git a/drivers/gpu/drm/i915/i915_pmu.c b/drivers/gpu/drm/i915/i915_pmu.c
index d6c8f8fdfda5..017fc602a10e 100644
--- a/drivers/gpu/drm/i915/i915_pmu.c
+++ b/drivers/gpu/drm/i915/i915_pmu.c
@@ -594,7 +594,8 @@ static void i915_pmu_enable(struct perf_event *event)
          * Update the bitmask of enabled events and increment
          * the event reference counter.
          */
-        GEM_BUG_ON(bit >= I915_PMU_MASK_BITS);
+        BUILD_BUG_ON(ARRAY_SIZE(i915->pmu.enable_count) != I915_PMU_MASK_BITS);
+        GEM_BUG_ON(bit >= ARRAY_SIZE(i915->pmu.enable_count));
         GEM_BUG_ON(i915->pmu.enable_count[bit] == ~0);
         i915->pmu.enable |= BIT_ULL(bit);
         i915->pmu.enable_count[bit]++;
@@ -615,11 +616,16 @@ static void i915_pmu_enable(struct perf_event *event)
                 engine = intel_engine_lookup_user(i915,
                                                   engine_event_class(event),
                                                   engine_event_instance(event));
-                GEM_BUG_ON(!engine);
-                engine->pmu.enable |= BIT(sample);
 
-                GEM_BUG_ON(sample >= I915_PMU_SAMPLE_BITS);
+                BUILD_BUG_ON(ARRAY_SIZE(engine->pmu.enable_count) !=
+                             I915_ENGINE_SAMPLE_COUNT);
+                BUILD_BUG_ON(ARRAY_SIZE(engine->pmu.sample) !=
+                             I915_ENGINE_SAMPLE_COUNT);
+                GEM_BUG_ON(sample >= ARRAY_SIZE(engine->pmu.enable_count));
+                GEM_BUG_ON(sample >= ARRAY_SIZE(engine->pmu.sample));
                 GEM_BUG_ON(engine->pmu.enable_count[sample] == ~0);
+
+                engine->pmu.enable |= BIT(sample);
                 engine->pmu.enable_count[sample]++;
         }
 
@@ -649,9 +655,11 @@ static void i915_pmu_disable(struct perf_event *event)
                 engine = intel_engine_lookup_user(i915,
                                                   engine_event_class(event),
                                                   engine_event_instance(event));
-                GEM_BUG_ON(!engine);
-                GEM_BUG_ON(sample >= I915_PMU_SAMPLE_BITS);
+
+                GEM_BUG_ON(sample >= ARRAY_SIZE(engine->pmu.enable_count));
+                GEM_BUG_ON(sample >= ARRAY_SIZE(engine->pmu.sample));
                 GEM_BUG_ON(engine->pmu.enable_count[sample] == 0);
+
                 /*
                  * Decrement the reference count and clear the enabled
                  * bitmask when the last listener on an event goes away.
@@ -660,7 +668,7 @@ static void i915_pmu_disable(struct perf_event *event)
                         engine->pmu.enable &= ~BIT(sample);
         }
 
-        GEM_BUG_ON(bit >= I915_PMU_MASK_BITS);
+        GEM_BUG_ON(bit >= ARRAY_SIZE(i915->pmu.enable_count));
         GEM_BUG_ON(i915->pmu.enable_count[bit] == 0);
         /*
          * Decrement the reference count and clear the enabled
diff --git a/drivers/gpu/drm/i915/i915_pmu.h b/drivers/gpu/drm/i915/i915_pmu.h
index 7f164ca3db12..b3728c5f13e7 100644
--- a/drivers/gpu/drm/i915/i915_pmu.h
+++ b/drivers/gpu/drm/i915/i915_pmu.h
@@ -31,6 +31,8 @@ enum {
         ((1 << I915_PMU_SAMPLE_BITS) + \
          (I915_PMU_LAST + 1 - __I915_PMU_OTHER(0)))
 
+#define I915_ENGINE_SAMPLE_COUNT (I915_SAMPLE_SEMA + 1)
+
 struct i915_pmu_sample {
         u64 cur;
 };
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 0a7d60509ca7..067054cf4a86 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -1790,7 +1790,7 @@ enum i915_power_well_id {
 #define _CNL_PORT_TX_C_LN0_OFFSET               0x162C40
 #define _CNL_PORT_TX_D_LN0_OFFSET               0x162E40
 #define _CNL_PORT_TX_F_LN0_OFFSET               0x162840
-#define _CNL_PORT_TX_DW_GRP(port, dw)   (_PICK((port), \
+#define _CNL_PORT_TX_DW_GRP(dw, port)   (_PICK((port), \
                                                _CNL_PORT_TX_AE_GRP_OFFSET, \
                                                _CNL_PORT_TX_B_GRP_OFFSET, \
                                                _CNL_PORT_TX_B_GRP_OFFSET, \
@@ -1798,7 +1798,7 @@ enum i915_power_well_id {
                                                _CNL_PORT_TX_AE_GRP_OFFSET, \
                                                _CNL_PORT_TX_F_GRP_OFFSET) + \
                                                4 * (dw))
-#define _CNL_PORT_TX_DW_LN0(port, dw)   (_PICK((port), \
+#define _CNL_PORT_TX_DW_LN0(dw, port)   (_PICK((port), \
                                                _CNL_PORT_TX_AE_LN0_OFFSET, \
                                                _CNL_PORT_TX_B_LN0_OFFSET, \
                                                _CNL_PORT_TX_B_LN0_OFFSET, \
@@ -1834,9 +1834,9 @@ enum i915_power_well_id {
 
 #define _CNL_PORT_TX_DW4_LN0_AE         0x162450
 #define _CNL_PORT_TX_DW4_LN1_AE         0x1624D0
-#define CNL_PORT_TX_DW4_GRP(port)       _MMIO(_CNL_PORT_TX_DW_GRP((port), 4))
-#define CNL_PORT_TX_DW4_LN0(port)       _MMIO(_CNL_PORT_TX_DW_LN0((port), 4))
-#define CNL_PORT_TX_DW4_LN(port, ln)   _MMIO(_CNL_PORT_TX_DW_LN0((port), 4) + \
+#define CNL_PORT_TX_DW4_GRP(port)       _MMIO(_CNL_PORT_TX_DW_GRP(4, (port)))
+#define CNL_PORT_TX_DW4_LN0(port)       _MMIO(_CNL_PORT_TX_DW_LN0(4, (port)))
+#define CNL_PORT_TX_DW4_LN(port, ln)   _MMIO(_CNL_PORT_TX_DW_LN0(4, (port)) + \
                                            ((ln) * (_CNL_PORT_TX_DW4_LN1_AE - \
                                                     _CNL_PORT_TX_DW4_LN0_AE)))
 #define ICL_PORT_TX_DW4_AUX(port)       _MMIO(_ICL_PORT_TX_DW_AUX(4, port))
@@ -1864,8 +1864,12 @@ enum i915_power_well_id {
 #define   RTERM_SELECT(x)               ((x) << 3)
 #define   RTERM_SELECT_MASK             (0x7 << 3)
 
-#define CNL_PORT_TX_DW7_GRP(port)       _MMIO(_CNL_PORT_TX_DW_GRP((port), 7))
-#define CNL_PORT_TX_DW7_LN0(port)       _MMIO(_CNL_PORT_TX_DW_LN0((port), 7))
+#define CNL_PORT_TX_DW7_GRP(port)       _MMIO(_CNL_PORT_TX_DW_GRP(7, (port)))
+#define CNL_PORT_TX_DW7_LN0(port)       _MMIO(_CNL_PORT_TX_DW_LN0(7, (port)))
+#define ICL_PORT_TX_DW7_AUX(port)       _MMIO(_ICL_PORT_TX_DW_AUX(7, port))
+#define ICL_PORT_TX_DW7_GRP(port)       _MMIO(_ICL_PORT_TX_DW_GRP(7, port))
+#define ICL_PORT_TX_DW7_LN0(port)       _MMIO(_ICL_PORT_TX_DW_LN(7, 0, port))
+#define ICL_PORT_TX_DW7_LN(port, ln)    _MMIO(_ICL_PORT_TX_DW_LN(7, ln, port))
 #define   N_SCALAR(x)                   ((x) << 24)
 #define   N_SCALAR_MASK                 (0x7F << 24)
 
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index f3e1d6a0b7dd..7edce1b7b348 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -494,103 +494,58 @@ static const struct cnl_ddi_buf_trans cnl_ddi_translations_edp_1_05V[] = {
         { 0x2, 0x7F, 0x3F, 0x00, 0x00 },        /* 400   400      0.0   */
 };
 
-struct icl_combo_phy_ddi_buf_trans {
-        u32 dw2_swing_select;
-        u32 dw2_swing_scalar;
-        u32 dw4_scaling;
-};
-
-/* Voltage Swing Programming for VccIO 0.85V for DP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_dp_hdmi_0_85V[] = {
-                                /* Voltage mV  db    */
-        { 0x2, 0x98, 0x0018 },  /* 400         0.0   */
-        { 0x2, 0x98, 0x3015 },  /* 400         3.5   */
-        { 0x2, 0x98, 0x6012 },  /* 400         6.0   */
-        { 0x2, 0x98, 0x900F },  /* 400         9.5   */
-        { 0xB, 0x70, 0x0018 },  /* 600         0.0   */
-        { 0xB, 0x70, 0x3015 },  /* 600         3.5   */
-        { 0xB, 0x70, 0x6012 },  /* 600         6.0   */
-        { 0x5, 0x00, 0x0018 },  /* 800         0.0   */
-        { 0x5, 0x00, 0x3015 },  /* 800         3.5   */
-        { 0x6, 0x98, 0x0018 },  /* 1200        0.0   */
-};
-
-/* FIXME - After table is updated in Bspec */
-/* Voltage Swing Programming for VccIO 0.85V for eDP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_edp_0_85V[] = {
-                                /* Voltage mV  db    */
-        { 0x0, 0x00, 0x00 },    /* 200         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 200         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         6.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 250         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 350         0.0   */
-};
-
-/* Voltage Swing Programming for VccIO 0.95V for DP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_dp_hdmi_0_95V[] = {
-                                /* Voltage mV  db    */
-        { 0x2, 0x98, 0x0018 },  /* 400         0.0   */
-        { 0x2, 0x98, 0x3015 },  /* 400         3.5   */
-        { 0x2, 0x98, 0x6012 },  /* 400         6.0   */
-        { 0x2, 0x98, 0x900F },  /* 400         9.5   */
-        { 0x4, 0x98, 0x0018 },  /* 600         0.0   */
-        { 0x4, 0x98, 0x3015 },  /* 600         3.5   */
-        { 0x4, 0x98, 0x6012 },  /* 600         6.0   */
-        { 0x5, 0x76, 0x0018 },  /* 800         0.0   */
-        { 0x5, 0x76, 0x3015 },  /* 800         3.5   */
-        { 0x6, 0x98, 0x0018 },  /* 1200        0.0   */
+/* icl_combo_phy_ddi_translations */
+static const struct cnl_ddi_buf_trans icl_combo_phy_ddi_translations_dp_hbr2[] = {
+                                                /* NT mV Trans mV db    */
+        { 0xA, 0x35, 0x3F, 0x00, 0x00 },        /* 350   350      0.0   */
+        { 0xA, 0x4F, 0x37, 0x00, 0x08 },        /* 350   500      3.1   */
+        { 0xC, 0x71, 0x2F, 0x00, 0x10 },        /* 350   700      6.0   */
+        { 0x6, 0x7F, 0x2B, 0x00, 0x14 },        /* 350   900      8.2   */
+        { 0xA, 0x4C, 0x3F, 0x00, 0x00 },        /* 500   500      0.0   */
+        { 0xC, 0x73, 0x34, 0x00, 0x0B },        /* 500   700      2.9   */
+        { 0x6, 0x7F, 0x2F, 0x00, 0x10 },        /* 500   900      5.1   */
+        { 0xC, 0x6C, 0x3C, 0x00, 0x03 },        /* 650   700      0.6   */
+        { 0x6, 0x7F, 0x35, 0x00, 0x0A },        /* 600   900      3.5   */
+        { 0x6, 0x7F, 0x3F, 0x00, 0x00 },        /* 900   900      0.0   */
 };
 
-/* FIXME - After table is updated in Bspec */
-/* Voltage Swing Programming for VccIO 0.95V for eDP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_edp_0_95V[] = {
-                                /* Voltage mV  db    */
-        { 0x0, 0x00, 0x00 },    /* 200         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 200         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         6.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 250         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 350         0.0   */
+static const struct cnl_ddi_buf_trans icl_combo_phy_ddi_translations_edp_hbr2[] = {
+                                                /* NT mV Trans mV db    */
+        { 0x0, 0x7F, 0x3F, 0x00, 0x00 },        /* 200   200      0.0   */
+        { 0x8, 0x7F, 0x38, 0x00, 0x07 },        /* 200   250      1.9   */
+        { 0x1, 0x7F, 0x33, 0x00, 0x0C },        /* 200   300      3.5   */
+        { 0x9, 0x7F, 0x31, 0x00, 0x0E },        /* 200   350      4.9   */
+        { 0x8, 0x7F, 0x3F, 0x00, 0x00 },        /* 250   250      0.0   */
+        { 0x1, 0x7F, 0x38, 0x00, 0x07 },        /* 250   300      1.6   */
+        { 0x9, 0x7F, 0x35, 0x00, 0x0A },        /* 250   350      2.9   */
+        { 0x1, 0x7F, 0x3F, 0x00, 0x00 },        /* 300   300      0.0   */
+        { 0x9, 0x7F, 0x38, 0x00, 0x07 },        /* 300   350      1.3   */
+        { 0x9, 0x7F, 0x3F, 0x00, 0x00 },        /* 350   350      0.0   */
 };
 
-/* Voltage Swing Programming for VccIO 1.05V for DP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_dp_hdmi_1_05V[] = {
-                                /* Voltage mV  db    */
-        { 0x2, 0x98, 0x0018 },  /* 400         0.0   */
-        { 0x2, 0x98, 0x3015 },  /* 400         3.5   */
-        { 0x2, 0x98, 0x6012 },  /* 400         6.0   */
-        { 0x2, 0x98, 0x900F },  /* 400         9.5   */
-        { 0x4, 0x98, 0x0018 },  /* 600         0.0   */
-        { 0x4, 0x98, 0x3015 },  /* 600         3.5   */
-        { 0x4, 0x98, 0x6012 },  /* 600         6.0   */
-        { 0x5, 0x71, 0x0018 },  /* 800         0.0   */
-        { 0x5, 0x71, 0x3015 },  /* 800         3.5   */
-        { 0x6, 0x98, 0x0018 },  /* 1200        0.0   */
+static const struct cnl_ddi_buf_trans icl_combo_phy_ddi_translations_edp_hbr3[] = {
+                                                /* NT mV Trans mV db    */
+        { 0xA, 0x35, 0x3F, 0x00, 0x00 },        /* 350   350      0.0   */
+        { 0xA, 0x4F, 0x37, 0x00, 0x08 },        /* 350   500      3.1   */
+        { 0xC, 0x71, 0x2F, 0x00, 0x10 },        /* 350   700      6.0   */
+        { 0x6, 0x7F, 0x2B, 0x00, 0x14 },        /* 350   900      8.2   */
+        { 0xA, 0x4C, 0x3F, 0x00, 0x00 },        /* 500   500      0.0   */
+        { 0xC, 0x73, 0x34, 0x00, 0x0B },        /* 500   700      2.9   */
+        { 0x6, 0x7F, 0x2F, 0x00, 0x10 },        /* 500   900      5.1   */
+        { 0xC, 0x6C, 0x3C, 0x00, 0x03 },        /* 650   700      0.6   */
+        { 0x6, 0x7F, 0x35, 0x00, 0x0A },        /* 600   900      3.5   */
+        { 0x6, 0x7F, 0x3F, 0x00, 0x00 },        /* 900   900      0.0   */
 };
 
-/* FIXME - After table is updated in Bspec */
-/* Voltage Swing Programming for VccIO 1.05V for eDP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_edp_1_05V[] = {
-                                /* Voltage mV  db    */
-        { 0x0, 0x00, 0x00 },    /* 200         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 200         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         6.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 250         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 350         0.0   */
+static const struct cnl_ddi_buf_trans icl_combo_phy_ddi_translations_hdmi[] = {
+                                                /* NT mV Trans mV db    */
+        { 0xA, 0x60, 0x3F, 0x00, 0x00 },        /* 450   450      0.0   */
+        { 0xB, 0x73, 0x36, 0x00, 0x09 },        /* 450   650      3.2   */
+        { 0x6, 0x7F, 0x31, 0x00, 0x0E },        /* 450   850      5.5   */
+        { 0xB, 0x73, 0x3F, 0x00, 0x00 },        /* 650   650      0.0   ALS */
+        { 0x6, 0x7F, 0x37, 0x00, 0x08 },        /* 650   850      2.3   */
+        { 0x6, 0x7F, 0x3F, 0x00, 0x00 },        /* 850   850      0.0   */
+        { 0x6, 0x7F, 0x35, 0x00, 0x0A },        /* 600   850      3.0   */
 };
 
 struct icl_mg_phy_ddi_buf_trans {
@@ -871,43 +826,23 @@ cnl_get_buf_trans_edp(struct drm_i915_private *dev_priv, int *n_entries)
         }
 }
 
-static const struct icl_combo_phy_ddi_buf_trans *
+static const struct cnl_ddi_buf_trans *
 icl_get_combo_buf_trans(struct drm_i915_private *dev_priv, enum port port,
-                        int type, int *n_entries)
+                        int type, int rate, int *n_entries)
 {
-        u32 voltage = I915_READ(ICL_PORT_COMP_DW3(port)) & VOLTAGE_INFO_MASK;
-
-        if (type == INTEL_OUTPUT_EDP && dev_priv->vbt.edp.low_vswing) {
-                switch (voltage) {
-                case VOLTAGE_INFO_0_85V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_edp_0_85V);
-                        return icl_combo_phy_ddi_translations_edp_0_85V;
-                case VOLTAGE_INFO_0_95V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_edp_0_95V);
-                        return icl_combo_phy_ddi_translations_edp_0_95V;
-                case VOLTAGE_INFO_1_05V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_edp_1_05V);
-                        return icl_combo_phy_ddi_translations_edp_1_05V;
-                default:
-                        MISSING_CASE(voltage);
-                        return NULL;
-                }
-        } else {
-                switch (voltage) {
-                case VOLTAGE_INFO_0_85V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_dp_hdmi_0_85V);
-                        return icl_combo_phy_ddi_translations_dp_hdmi_0_85V;
-                case VOLTAGE_INFO_0_95V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_dp_hdmi_0_95V);
-                        return icl_combo_phy_ddi_translations_dp_hdmi_0_95V;
-                case VOLTAGE_INFO_1_05V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_dp_hdmi_1_05V);
-                        return icl_combo_phy_ddi_translations_dp_hdmi_1_05V;
-                default:
-                        MISSING_CASE(voltage);
-                        return NULL;
-                }
+        if (type == INTEL_OUTPUT_HDMI) {
+                *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_hdmi);
+                return icl_combo_phy_ddi_translations_hdmi;
+        } else if (rate > 540000 && type == INTEL_OUTPUT_EDP) {
+                *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_edp_hbr3);
+                return icl_combo_phy_ddi_translations_edp_hbr3;
+        } else if (type == INTEL_OUTPUT_EDP && dev_priv->vbt.edp.low_vswing) {
+                *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_edp_hbr2);
+                return icl_combo_phy_ddi_translations_edp_hbr2;
         }
+
+        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_dp_hbr2);
+        return icl_combo_phy_ddi_translations_dp_hbr2;
 }
 
 static int intel_ddi_hdmi_level(struct drm_i915_private *dev_priv, enum port port)
@@ -918,8 +853,8 @@ static int intel_ddi_hdmi_level(struct drm_i915_private *dev_priv, enum port por
 
         if (IS_ICELAKE(dev_priv)) {
                 if (intel_port_is_combophy(dev_priv, port))
-                        icl_get_combo_buf_trans(dev_priv, port,
-                                                INTEL_OUTPUT_HDMI, &n_entries);
+                        icl_get_combo_buf_trans(dev_priv, port, INTEL_OUTPUT_HDMI,
+                                                0, &n_entries);
                 else
                         n_entries = ARRAY_SIZE(icl_mg_phy_ddi_translations);
                 default_entry = n_entries - 1;
@@ -1086,7 +1021,7 @@ static uint32_t icl_pll_to_ddi_pll_sel(struct intel_encoder *encoder,
                         return DDI_CLK_SEL_TBT_810;
                 default:
                         MISSING_CASE(clock);
-                        break;
+                        return DDI_CLK_SEL_NONE;
                 }
         case DPLL_ID_ICL_MGPLL1:
         case DPLL_ID_ICL_MGPLL2:
@@ -2275,13 +2210,14 @@ static void bxt_ddi_vswing_sequence(struct intel_encoder *encoder,
 u8 intel_ddi_dp_voltage_max(struct intel_encoder *encoder)
 {
         struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
+        struct intel_dp *intel_dp = enc_to_intel_dp(&encoder->base);
         enum port port = encoder->port;
         int n_entries;
 
         if (IS_ICELAKE(dev_priv)) {
                 if (intel_port_is_combophy(dev_priv, port))
                         icl_get_combo_buf_trans(dev_priv, port, encoder->type,
-                                                &n_entries);
+                                                intel_dp->link_rate, &n_entries);
                 else
                         n_entries = ARRAY_SIZE(icl_mg_phy_ddi_translations);
         } else if (IS_CANNONLAKE(dev_priv)) {
@@ -2462,14 +2398,15 @@ static void cnl_ddi_vswing_sequence(struct intel_encoder *encoder,
 }
 
 static void icl_ddi_combo_vswing_program(struct drm_i915_private *dev_priv,
-                                         u32 level, enum port port, int type)
+                                        u32 level, enum port port, int type,
+                                        int rate)
 {
-        const struct icl_combo_phy_ddi_buf_trans *ddi_translations = NULL;
+        const struct cnl_ddi_buf_trans *ddi_translations = NULL;
         u32 n_entries, val;
         int ln;
 
         ddi_translations = icl_get_combo_buf_trans(dev_priv, port, type,
-                                                   &n_entries);
+                                                   rate, &n_entries);
         if (!ddi_translations)
                 return;
 
@@ -2478,34 +2415,23 @@ static void icl_ddi_combo_vswing_program(struct drm_i915_private *dev_priv,
                 level = n_entries - 1;
         }
 
-        /* Set PORT_TX_DW5 Rterm Sel to 110b. */
+        /* Set PORT_TX_DW5 */
         val = I915_READ(ICL_PORT_TX_DW5_LN0(port));
-        val &= ~RTERM_SELECT_MASK;
+        val &= ~(SCALING_MODE_SEL_MASK | RTERM_SELECT_MASK |
+                  TAP2_DISABLE | TAP3_DISABLE);
+        val |= SCALING_MODE_SEL(0x2);
         val |= RTERM_SELECT(0x6);
-        I915_WRITE(ICL_PORT_TX_DW5_GRP(port), val);
-
-        /* Program PORT_TX_DW5 */
-        val = I915_READ(ICL_PORT_TX_DW5_LN0(port));
-        /* Set DisableTap2 and DisableTap3 if MIPI DSI
-         * Clear DisableTap2 and DisableTap3 for all other Ports
-         */
-        if (type == INTEL_OUTPUT_DSI) {
-                val |= TAP2_DISABLE;
-                val |= TAP3_DISABLE;
-        } else {
-                val &= ~TAP2_DISABLE;
-                val &= ~TAP3_DISABLE;
-        }
+        val |= TAP3_DISABLE;
         I915_WRITE(ICL_PORT_TX_DW5_GRP(port), val);
 
         /* Program PORT_TX_DW2 */
         val = I915_READ(ICL_PORT_TX_DW2_LN0(port));
         val &= ~(SWING_SEL_LOWER_MASK | SWING_SEL_UPPER_MASK |
                  RCOMP_SCALAR_MASK);
-        val |= SWING_SEL_UPPER(ddi_translations[level].dw2_swing_select);
-        val |= SWING_SEL_LOWER(ddi_translations[level].dw2_swing_select);
+        val |= SWING_SEL_UPPER(ddi_translations[level].dw2_swing_sel);
+        val |= SWING_SEL_LOWER(ddi_translations[level].dw2_swing_sel);
         /* Program Rcomp scalar for every table entry */
-        val |= RCOMP_SCALAR(ddi_translations[level].dw2_swing_scalar);
+        val |= RCOMP_SCALAR(0x98);
         I915_WRITE(ICL_PORT_TX_DW2_GRP(port), val);
 
         /* Program PORT_TX_DW4 */
@@ -2514,9 +2440,17 @@ static void icl_ddi_combo_vswing_program(struct drm_i915_private *dev_priv,
                 val = I915_READ(ICL_PORT_TX_DW4_LN(port, ln));
                 val &= ~(POST_CURSOR_1_MASK | POST_CURSOR_2_MASK |
                          CURSOR_COEFF_MASK);
-                val |= ddi_translations[level].dw4_scaling;
+                val |= POST_CURSOR_1(ddi_translations[level].dw4_post_cursor_1);
+                val |= POST_CURSOR_2(ddi_translations[level].dw4_post_cursor_2);
+                val |= CURSOR_COEFF(ddi_translations[level].dw4_cursor_coeff);
                 I915_WRITE(ICL_PORT_TX_DW4_LN(port, ln), val);
         }
+
+        /* Program PORT_TX_DW7 */
+        val = I915_READ(ICL_PORT_TX_DW7_LN0(port));
+        val &= ~N_SCALAR_MASK;
+        val |= N_SCALAR(ddi_translations[level].dw7_n_scalar);
+        I915_WRITE(ICL_PORT_TX_DW7_GRP(port), val);
 }
 
 static void icl_combo_phy_ddi_vswing_sequence(struct intel_encoder *encoder,
@@ -2581,7 +2515,7 @@ static void icl_combo_phy_ddi_vswing_sequence(struct intel_encoder *encoder,
         I915_WRITE(ICL_PORT_TX_DW5_GRP(port), val);
 
         /* 5. Program swing and de-emphasis */
-        icl_ddi_combo_vswing_program(dev_priv, level, port, type);
+        icl_ddi_combo_vswing_program(dev_priv, level, port, type, rate);
 
         /* 6. Set training enable to trigger update */
         val = I915_READ(ICL_PORT_TX_DW5_LN0(port));
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3da9c0f9e948..248128126422 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -15415,16 +15415,45 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc,
         }
 }
 
+static bool has_bogus_dpll_config(const struct intel_crtc_state *crtc_state)
+{
+        struct drm_i915_private *dev_priv = to_i915(crtc_state->base.crtc->dev);
+
+        /*
+         * Some SNB BIOSen (eg. ASUS K53SV) are known to misprogram
+         * the hardware when a high res displays plugged in. DPLL P
+         * divider is zero, and the pipe timings are bonkers. We'll
+         * try to disable everything in that case.
+         *
+         * FIXME would be nice to be able to sanitize this state
+         * without several WARNs, but for now let's take the easy
+         * road.
+         */
+        return IS_GEN6(dev_priv) &&
+                crtc_state->base.active &&
+                crtc_state->shared_dpll &&
+                crtc_state->port_clock == 0;
+}
+
 static void intel_sanitize_encoder(struct intel_encoder *encoder)
 {
         struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
         struct intel_connector *connector;
+        struct intel_crtc *crtc = to_intel_crtc(encoder->base.crtc);
+        struct intel_crtc_state *crtc_state = crtc ?
+                to_intel_crtc_state(crtc->base.state) : NULL;
 
         /* We need to check both for a crtc link (meaning that the
          * encoder is active and trying to read from a pipe) and the
          * pipe itself being active. */
-        bool has_active_crtc = encoder->base.crtc &&
-                to_intel_crtc(encoder->base.crtc)->active;
+        bool has_active_crtc = crtc_state &&
+                crtc_state->base.active;
+
+        if (crtc_state && has_bogus_dpll_config(crtc_state)) {
+                DRM_DEBUG_KMS("BIOS has misprogrammed the hardware. Disabling pipe %c\n",
+                              pipe_name(crtc->pipe));
+                has_active_crtc = false;
+        }
 
         connector = intel_encoder_find_connector(encoder);
         if (connector && !has_active_crtc) {
@@ -15435,16 +15464,25 @@ static void intel_sanitize_encoder(struct intel_encoder *encoder)
                 /* Connector is active, but has no active pipe. This is
                  * fallout from our resume register restoring. Disable
                  * the encoder manually again. */
-                if (encoder->base.crtc) {
-                        struct drm_crtc_state *crtc_state = encoder->base.crtc->state;
+                if (crtc_state) {
+                        struct drm_encoder *best_encoder;
 
                         DRM_DEBUG_KMS("[ENCODER:%d:%s] manually disabled\n",
                                       encoder->base.base.id,
                                       encoder->base.name);
+
+                        /* avoid oopsing in case the hooks consult best_encoder */
+                        best_encoder = connector->base.state->best_encoder;
+                        connector->base.state->best_encoder = &encoder->base;
+
                         if (encoder->disable)
-                                encoder->disable(encoder, to_intel_crtc_state(crtc_state), connector->base.state);
+                                encoder->disable(encoder, crtc_state,
+                                                 connector->base.state);
                         if (encoder->post_disable)
-                                encoder->post_disable(encoder, to_intel_crtc_state(crtc_state), connector->base.state);
+                                encoder->post_disable(encoder, crtc_state,
+                                                      connector->base.state);
+
+                        connector->base.state->best_encoder = best_encoder;
                 }
                 encoder->base.crtc = NULL;
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index fdd2cbc56fa3..22a74608c6e4 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -304,9 +304,11 @@ static int cnl_max_source_rate(struct intel_dp *intel_dp)
 static int icl_max_source_rate(struct intel_dp *intel_dp)
 {
         struct intel_digital_port *dig_port = dp_to_dig_port(intel_dp);
+        struct drm_i915_private *dev_priv = to_i915(dig_port->base.base.dev);
         enum port port = dig_port->base.port;
 
-        if (port == PORT_B)
+        if (intel_port_is_combophy(dev_priv, port) &&
+            !intel_dp_is_edp(intel_dp))
                 return 540000;
 
         return 810000;
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index f94a04b4ad87..e9ddeaf05a14 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -209,6 +209,16 @@ struct intel_fbdev {
         unsigned long vma_flags;
         async_cookie_t cookie;
         int preferred_bpp;
+
+        /* Whether or not fbdev hpd processing is temporarily suspended */
+        bool hpd_suspended : 1;
+        /* Set when a hotplug was received while HPD processing was
+         * suspended
+         */
+        bool hpd_waiting : 1;
+
+        /* Protects hpd_suspended */
+        struct mutex hpd_lock;
 };
 
 struct intel_encoder {
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index fb5bb5b32a60..7f365ac0b549 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -679,6 +679,7 @@ int intel_fbdev_init(struct drm_device *dev)
         if (ifbdev == NULL)
                 return -ENOMEM;
 
+        mutex_init(&ifbdev->hpd_lock);
         drm_fb_helper_prepare(dev, &ifbdev->helper, &intel_fb_helper_funcs);
 
         if (!intel_fbdev_init_bios(dev, ifbdev))
@@ -752,6 +753,26 @@ void intel_fbdev_fini(struct drm_i915_private *dev_priv)
         intel_fbdev_destroy(ifbdev);
 }
 
+/* Suspends/resumes fbdev processing of incoming HPD events. When resuming HPD
+ * processing, fbdev will perform a full connector reprobe if a hotplug event
+ * was received while HPD was suspended.
+ */
+static void intel_fbdev_hpd_set_suspend(struct intel_fbdev *ifbdev, int state)
+{
+        bool send_hpd = false;
+
+        mutex_lock(&ifbdev->hpd_lock);
+        ifbdev->hpd_suspended = state == FBINFO_STATE_SUSPENDED;
+        send_hpd = !ifbdev->hpd_suspended && ifbdev->hpd_waiting;
+        ifbdev->hpd_waiting = false;
+        mutex_unlock(&ifbdev->hpd_lock);
+
+        if (send_hpd) {
+                DRM_DEBUG_KMS("Handling delayed fbcon HPD event\n");
+                drm_fb_helper_hotplug_event(&ifbdev->helper);
+        }
+}
+
 void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous)
 {
         struct drm_i915_private *dev_priv = to_i915(dev);
@@ -773,6 +794,7 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous
                  */
                 if (state != FBINFO_STATE_RUNNING)
                         flush_work(&dev_priv->fbdev_suspend_work);
+
                 console_lock();
         } else {
                 /*
@@ -800,17 +822,26 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous
 
         drm_fb_helper_set_suspend(&ifbdev->helper, state);
         console_unlock();
+
+        intel_fbdev_hpd_set_suspend(ifbdev, state);
 }
 
 void intel_fbdev_output_poll_changed(struct drm_device *dev)
 {
         struct intel_fbdev *ifbdev = to_i915(dev)->fbdev;
+        bool send_hpd;
 
         if (!ifbdev)
                 return;
 
         intel_fbdev_sync(ifbdev);
-        if (ifbdev->vma || ifbdev->helper.deferred_setup)
+
+        mutex_lock(&ifbdev->hpd_lock);
+        send_hpd = !ifbdev->hpd_suspended;
+        ifbdev->hpd_waiting = true;
+        mutex_unlock(&ifbdev->hpd_lock);
+
+        if (send_hpd && (ifbdev->vma || ifbdev->helper.deferred_setup))
                 drm_fb_helper_hotplug_event(&ifbdev->helper);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
index b8f106d9ecf8..3ac20153705a 100644
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -55,7 +55,12 @@
 struct opregion_header {
         u8 signature[16];
         u32 size;
-        u32 opregion_ver;
+        struct {
+                u8 rsvd;
+                u8 revision;
+                u8 minor;
+                u8 major;
+        }  __packed over;
         u8 bios_ver[32];
         u8 vbios_ver[16];
         u8 driver_ver[16];
@@ -119,7 +124,8 @@ struct opregion_asle {
         u64 fdss;
         u32 fdsp;
         u32 stat;
-        u64 rvda;       /* Physical address of raw vbt data */
+        u64 rvda;       /* Physical (2.0) or relative from opregion (2.1+)
+                         * address of raw VBT data. */
         u32 rvds;       /* Size of raw vbt data */
         u8 rsvd[58];
 } __packed;
@@ -925,6 +931,11 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
         opregion->header = base;
         opregion->lid_state = base + ACPI_CLID;
 
+        DRM_DEBUG_DRIVER("ACPI OpRegion version %u.%u.%u\n",
+                         opregion->header->over.major,
+                         opregion->header->over.minor,
+                         opregion->header->over.revision);
+
         mboxes = opregion->header->mboxes;
         if (mboxes & MBOX_ACPI) {
                 DRM_DEBUG_DRIVER("Public ACPI methods supported\n");
@@ -953,11 +964,26 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
         if (dmi_check_system(intel_no_opregion_vbt))
                 goto out;
 
-        if (opregion->header->opregion_ver >= 2 && opregion->asle &&
+        if (opregion->header->over.major >= 2 && opregion->asle &&
             opregion->asle->rvda && opregion->asle->rvds) {
-                opregion->rvda = memremap(opregion->asle->rvda,
-                                          opregion->asle->rvds,
+                resource_size_t rvda = opregion->asle->rvda;
+
+                /*
+                 * opregion 2.0: rvda is the physical VBT address.
+                 *
+                 * opregion 2.1+: rvda is unsigned, relative offset from
+                 * opregion base, and should never point within opregion.
+                 */
+                if (opregion->header->over.major > 2 ||
+                    opregion->header->over.minor >= 1) {
+                        WARN_ON(rvda < OPREGION_SIZE);
+
+                        rvda += asls;
+                }
+
+                opregion->rvda = memremap(rvda, opregion->asle->rvds,
                                           MEMREMAP_WB);
+
                 vbt = opregion->rvda;
                 vbt_size = opregion->asle->rvds;
                 if (intel_bios_is_valid_vbt(vbt, vbt_size)) {
@@ -967,6 +993,8 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
                         goto out;
                 } else {
                         DRM_DEBUG_KMS("Invalid VBT in ACPI OpRegion (RVDA)\n");
+                        memunmap(opregion->rvda);
+                        opregion->rvda = NULL;
                 }
         }
 
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index 72edaa7ff411..a1a7cc29fdd1 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -415,16 +415,17 @@ struct intel_engine_cs {
                 /**
                  * @enable_count: Reference count for the enabled samplers.
                  *
-                 * Index number corresponds to the bit number from @enable.
+                 * Index number corresponds to @enum drm_i915_pmu_engine_sample.
                  */
-                unsigned int enable_count[I915_PMU_SAMPLE_BITS];
+                unsigned int enable_count[I915_ENGINE_SAMPLE_COUNT];
                 /**
                  * @sample: Counter values for sampling events.
                  *
                  * Our internal timer stores the current counters in this field.
+                 *
+                 * Index number corresponds to @enum drm_i915_pmu_engine_sample.
                  */
-#define I915_ENGINE_SAMPLE_MAX (I915_SAMPLE_SEMA + 1)
-                struct i915_pmu_sample sample[I915_ENGINE_SAMPLE_MAX];
+                struct i915_pmu_sample sample[I915_ENGINE_SAMPLE_COUNT];
         } pmu;
 
         /*
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index d2e003d8f3db..5170a0f5fe7b 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -494,7 +494,7 @@ skl_program_plane(struct intel_plane *plane,
 
         keymax = (key->max_value & 0xffffff) | PLANE_KEYMAX_ALPHA(alpha);
 
-        keymsk = key->channel_mask & 0x3ffffff;
+        keymsk = key->channel_mask & 0x7ffffff;
         if (alpha < 0xff)
                 keymsk |= PLANE_KEYMSK_ALPHA_ENABLE;
 
diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index 2c5bbe317353..e31e263cf86b 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -643,8 +643,10 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 int bus_format;
 
                 ret = of_property_read_u32(child, "reg", &i);
-                if (ret || i < 0 || i > 1)
-                        return -EINVAL;
+                if (ret || i < 0 || i > 1) {
+                        ret = -EINVAL;
+                        goto free_child;
+                }
 
                 if (!of_device_is_available(child))
                         continue;
@@ -657,7 +659,6 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 channel = &imx_ldb->channel[i];
                 channel->ldb = imx_ldb;
                 channel->chno = i;
-                channel->child = child;
 
                 /*
                  * The output port is port@4 with an external 4-port mux or
@@ -667,13 +668,13 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                                                   imx_ldb->lvds_mux ? 4 : 2, 0,
                                                   &channel->panel, &channel->bridge);
                 if (ret && ret != -ENODEV)
-                        return ret;
+                        goto free_child;
 
                 /* panel ddc only if there is no bridge */
                 if (!channel->bridge) {
                         ret = imx_ldb_panel_ddc(dev, channel, child);
                         if (ret)
-                                return ret;
+                                goto free_child;
                 }
 
                 bus_format = of_get_bus_format(dev, child);
@@ -689,18 +690,26 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 if (bus_format < 0) {
                         dev_err(dev, "could not determine data mapping: %d\n",
                                 bus_format);
-                        return bus_format;
+                        ret = bus_format;
+                        goto free_child;
                 }
                 channel->bus_format = bus_format;
+                channel->child = child;
 
                 ret = imx_ldb_register(drm, channel);
-                if (ret)
-                        return ret;
+                if (ret) {
+                        channel->child = NULL;
+                        goto free_child;
+                }
         }
 
         dev_set_drvdata(dev, imx_ldb);
 
         return 0;
+
+free_child:
+        of_node_put(child);
+        return ret;
 }
 
 static void imx_ldb_unbind(struct device *dev, struct device *master,
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
index c390924de93d..21e964f6ab5c 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
@@ -370,9 +370,9 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
         if (ret)
                 return ret;
 
-        /* CRTC should be enabled */
+        /* nothing to check when disabling or disabled */
         if (!crtc_state->enable)
-                return -EINVAL;
+                return 0;
 
         switch (plane->type) {
         case DRM_PLANE_TYPE_PRIMARY:
diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
index 00a9c2ab9e6c..64fb788b6647 100644
--- a/drivers/gpu/drm/omapdrm/dss/dsi.c
+++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
@@ -1406,7 +1406,7 @@ static void dsi_pll_disable(struct dss_pll *pll)
 
 static int dsi_dump_dsi_clocks(struct seq_file *s, void *p)
 {
-        struct dsi_data *dsi = p;
+        struct dsi_data *dsi = s->private;
         struct dss_pll_clock_info *cinfo = &dsi->pll.cinfo;
         enum dss_clk_source dispc_clk_src, dsi_clk_src;
         int dsi_module = dsi->module_id;
@@ -1467,7 +1467,7 @@ static int dsi_dump_dsi_clocks(struct seq_file *s, void *p)
 #ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
 static int dsi_dump_dsi_irqs(struct seq_file *s, void *p)
 {
-        struct dsi_data *dsi = p;
+        struct dsi_data *dsi = s->private;
         unsigned long flags;
         struct dsi_irq_stats stats;
 
@@ -1558,7 +1558,7 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p)
 
 static int dsi_dump_dsi_regs(struct seq_file *s, void *p)
 {
-        struct dsi_data *dsi = p;
+        struct dsi_data *dsi = s->private;
 
         if (dsi_runtime_get(dsi))
                 return 0;
@@ -4751,6 +4751,17 @@ static int dsi_set_config(struct omap_dss_device *dssdev,
         dsi->vm.flags |= DISPLAY_FLAGS_HSYNC_HIGH;
         dsi->vm.flags &= ~DISPLAY_FLAGS_VSYNC_LOW;
         dsi->vm.flags |= DISPLAY_FLAGS_VSYNC_HIGH;
+        /*
+         * HACK: These flags should be handled through the omap_dss_device bus
+         * flags, but this will only be possible when the DSI encoder will be
+         * converted to the omapdrm-managed encoder model.
+         */
+        dsi->vm.flags &= ~DISPLAY_FLAGS_PIXDATA_NEGEDGE;
+        dsi->vm.flags |= DISPLAY_FLAGS_PIXDATA_POSEDGE;
+        dsi->vm.flags &= ~DISPLAY_FLAGS_DE_LOW;
+        dsi->vm.flags |= DISPLAY_FLAGS_DE_HIGH;
+        dsi->vm.flags &= ~DISPLAY_FLAGS_SYNC_POSEDGE;
+        dsi->vm.flags |= DISPLAY_FLAGS_SYNC_NEGEDGE;
 
         dss_mgr_set_timings(&dsi->output, &dsi->vm);
 
@@ -5083,15 +5094,15 @@ static int dsi_bind(struct device *dev, struct device *master, void *data)
 
         snprintf(name, sizeof(name), "dsi%u_regs", dsi->module_id + 1);
         dsi->debugfs.regs = dss_debugfs_create_file(dss, name,
-                                                    dsi_dump_dsi_regs, &dsi);
+                                                    dsi_dump_dsi_regs, dsi);
 #ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
         snprintf(name, sizeof(name), "dsi%u_irqs", dsi->module_id + 1);
         dsi->debugfs.irqs = dss_debugfs_create_file(dss, name,
-                                                    dsi_dump_dsi_irqs, &dsi);
+                                                    dsi_dump_dsi_irqs, dsi);
 #endif
         snprintf(name, sizeof(name), "dsi%u_clks", dsi->module_id + 1);
         dsi->debugfs.clks = dss_debugfs_create_file(dss, name,
-                                                    dsi_dump_dsi_clocks, &dsi);
+                                                    dsi_dump_dsi_clocks, dsi);
 
         return 0;
 }
@@ -5104,8 +5115,6 @@ static void dsi_unbind(struct device *dev, struct device *master, void *data)
         dss_debugfs_remove_file(dsi->debugfs.irqs);
         dss_debugfs_remove_file(dsi->debugfs.regs);
 
-        of_platform_depopulate(dev);
-
         WARN_ON(dsi->scp_clk_refcount > 0);
 
         dss_pll_unregister(&dsi->pll);
@@ -5457,6 +5466,8 @@ static int dsi_remove(struct platform_device *pdev)
 
         dsi_uninit_output(dsi);
 
+        of_platform_depopulate(&pdev->dev);
+
         pm_runtime_disable(&pdev->dev);
 
         if (dsi->vdds_dsi_reg != NULL && dsi->vdds_dsi_enabled) {
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index d587779a80b4..a97294ac96d5 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -5676,7 +5676,7 @@ int ci_dpm_init(struct radeon_device *rdev)
         u16 data_offset, size;
         u8 frev, crev;
         struct ci_power_info *pi;
-        enum pci_bus_speed speed_cap;
+        enum pci_bus_speed speed_cap = PCI_SPEED_UNKNOWN;
         struct pci_dev *root = rdev->pdev->bus->self;
         int ret;
 
@@ -5685,7 +5685,8 @@ int ci_dpm_init(struct radeon_device *rdev)
                 return -ENOMEM;
         rdev->pm.dpm.priv = pi;
 
-        speed_cap = pcie_get_speed_cap(root);
+        if (!pci_is_root_bus(rdev->pdev->bus))
+                speed_cap = pcie_get_speed_cap(root);
         if (speed_cap == PCI_SPEED_UNKNOWN) {
                 pi->sys_pcie_mask = 0;
         } else {
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 8fb60b3af015..0a785ef0ab66 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -6899,7 +6899,7 @@ int si_dpm_init(struct radeon_device *rdev)
         struct ni_power_info *ni_pi;
         struct si_power_info *si_pi;
         struct atom_clock_dividers dividers;
-        enum pci_bus_speed speed_cap;
+        enum pci_bus_speed speed_cap = PCI_SPEED_UNKNOWN;
         struct pci_dev *root = rdev->pdev->bus->self;
         int ret;
 
@@ -6911,7 +6911,8 @@ int si_dpm_init(struct radeon_device *rdev)
         eg_pi = &ni_pi->eg;
         pi = &eg_pi->rv7xx;
 
-        speed_cap = pcie_get_speed_cap(root);
+        if (!pci_is_root_bus(rdev->pdev->bus))
+                speed_cap = pcie_get_speed_cap(root);
         if (speed_cap == PCI_SPEED_UNKNOWN) {
                 si_pi->sys_pcie_mask = 0;
         } else {
diff --git a/drivers/gpu/drm/rockchip/rockchip_rgb.c b/drivers/gpu/drm/rockchip/rockchip_rgb.c
index 37f93022a106..c0351abf83a3 100644
--- a/drivers/gpu/drm/rockchip/rockchip_rgb.c
+++ b/drivers/gpu/drm/rockchip/rockchip_rgb.c
@@ -1,17 +1,8 @@
-//SPDX-License-Identifier: GPL-2.0+
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) Fuzhou Rockchip Electronics Co.Ltd
  * Author:
  *      Sandy Huang <hjc@rock-chips.com>
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
  */
 
 #include <drm/drmP.h>
diff --git a/drivers/gpu/drm/rockchip/rockchip_rgb.h b/drivers/gpu/drm/rockchip/rockchip_rgb.h
index 38b52e63b2b0..27b9635124bc 100644
--- a/drivers/gpu/drm/rockchip/rockchip_rgb.h
+++ b/drivers/gpu/drm/rockchip/rockchip_rgb.h
@@ -1,17 +1,8 @@
-//SPDX-License-Identifier: GPL-2.0+
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (C) Fuzhou Rockchip Electronics Co.Ltd
  * Author:
  *      Sandy Huang <hjc@rock-chips.com>
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
  */
 
 #ifdef CONFIG_ROCKCHIP_RGB
diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c
index 4463d3826ecb..e2942c9a11a7 100644
--- a/drivers/gpu/drm/scheduler/sched_entity.c
+++ b/drivers/gpu/drm/scheduler/sched_entity.c
@@ -440,13 +440,10 @@ struct drm_sched_job *drm_sched_entity_pop_job(struct drm_sched_entity *entity)
 
         while ((entity->dependency =
                         sched->ops->dependency(sched_job, entity))) {
+                trace_drm_sched_job_wait_dep(sched_job, entity->dependency);
 
-                if (drm_sched_entity_add_dependency_cb(entity)) {
-
-                        trace_drm_sched_job_wait_dep(sched_job,
-                                                     entity->dependency);
+                if (drm_sched_entity_add_dependency_cb(entity))
                         return NULL;
-                }
         }
 
         /* skip jobs from entity that marked guilty */
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index 0420f5c978b9..cf45d0f940f9 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -761,6 +761,7 @@ static int sun4i_tcon_init_clocks(struct device *dev,
                         return PTR_ERR(tcon->sclk0);
                 }
         }
+        clk_prepare_enable(tcon->sclk0);
 
         if (tcon->quirks->has_channel_1) {
                 tcon->sclk1 = devm_clk_get(dev, "tcon-ch1");
@@ -775,6 +776,7 @@ static int sun4i_tcon_init_clocks(struct device *dev,
 
 static void sun4i_tcon_free_clocks(struct sun4i_tcon *tcon)
 {
+        clk_disable_unprepare(tcon->sclk0);
         clk_disable_unprepare(tcon->clk);
 }
 
diff --git a/drivers/gpu/drm/vkms/vkms_crc.c b/drivers/gpu/drm/vkms/vkms_crc.c
index 9d9e8146db90..d7b409a3c0f8 100644
--- a/drivers/gpu/drm/vkms/vkms_crc.c
+++ b/drivers/gpu/drm/vkms/vkms_crc.c
@@ -1,4 +1,5 @@
-// SPDX-License-Identifier: GPL-2.0
+// SPDX-License-Identifier: GPL-2.0+
+
 #include "vkms_drv.h"
 #include <linux/crc32.h>
 #include <drm/drm_atomic.h>
diff --git a/drivers/gpu/drm/vkms/vkms_crtc.c b/drivers/gpu/drm/vkms/vkms_crtc.c
index 177bbcb38306..eb56ee893761 100644
--- a/drivers/gpu/drm/vkms/vkms_crtc.c
+++ b/drivers/gpu/drm/vkms/vkms_crtc.c
@@ -1,10 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
+// SPDX-License-Identifier: GPL-2.0+
 
 #include "vkms_drv.h"
 #include <drm/drm_atomic_helper.h>
diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
index 83087877565c..7dcbecb5fac2 100644
--- a/drivers/gpu/drm/vkms/vkms_drv.c
+++ b/drivers/gpu/drm/vkms/vkms_drv.c
@@ -1,9 +1,4 @@
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
+// SPDX-License-Identifier: GPL-2.0+
 
 /**
  * DOC: vkms (Virtual Kernel Modesetting)
diff --git a/drivers/gpu/drm/vkms/vkms_drv.h b/drivers/gpu/drm/vkms/vkms_drv.h
index e4469cd3d254..81f1cfbeb936 100644
--- a/drivers/gpu/drm/vkms/vkms_drv.h
+++ b/drivers/gpu/drm/vkms/vkms_drv.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+
 #ifndef _VKMS_DRV_H_
 #define _VKMS_DRV_H_
 
diff --git a/drivers/gpu/drm/vkms/vkms_gem.c b/drivers/gpu/drm/vkms/vkms_gem.c
index 80311daed47a..138b0bb325cf 100644
--- a/drivers/gpu/drm/vkms/vkms_gem.c
+++ b/drivers/gpu/drm/vkms/vkms_gem.c
@@ -1,10 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
+// SPDX-License-Identifier: GPL-2.0+
 
 #include <linux/shmem_fs.h>
 
diff --git a/drivers/gpu/drm/vkms/vkms_output.c b/drivers/gpu/drm/vkms/vkms_output.c
index 271a0eb9042c..4173e4f48334 100644
--- a/drivers/gpu/drm/vkms/vkms_output.c
+++ b/drivers/gpu/drm/vkms/vkms_output.c
@@ -1,10 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
+// SPDX-License-Identifier: GPL-2.0+
 
 #include "vkms_drv.h"
 #include <drm/drm_crtc_helper.h>
diff --git a/drivers/gpu/drm/vkms/vkms_plane.c b/drivers/gpu/drm/vkms/vkms_plane.c
index 418817600ad1..0e67d2d42f0c 100644
--- a/drivers/gpu/drm/vkms/vkms_plane.c
+++ b/drivers/gpu/drm/vkms/vkms_plane.c
@@ -1,10 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
+// SPDX-License-Identifier: GPL-2.0+
 
 #include "vkms_drv.h"
 #include <drm/drm_plane_helper.h>
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 25afb1d594e3..7ef5dcb06104 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -26,6 +26,7 @@
  **************************************************************************/
 #include <linux/module.h>
 #include <linux/console.h>
+#include <linux/dma-mapping.h>
 
 #include <drm/drmP.h>
 #include "vmwgfx_drv.h"
@@ -34,7 +35,6 @@
 #include <drm/ttm/ttm_placement.h>
 #include <drm/ttm/ttm_bo_driver.h>
 #include <drm/ttm/ttm_module.h>
-#include <linux/intel-iommu.h>
 
 #define VMWGFX_DRIVER_DESC "Linux drm driver for VMware graphics devices"
 #define VMWGFX_CHIP_SVGAII 0
@@ -546,6 +546,21 @@ static void vmw_get_initial_size(struct vmw_private *dev_priv)
 }
 
 /**
+ * vmw_assume_iommu - Figure out whether coherent dma-remapping might be
+ * taking place.
+ * @dev: Pointer to the struct drm_device.
+ *
+ * Return: true if iommu present, false otherwise.
+ */
+static bool vmw_assume_iommu(struct drm_device *dev)
+{
+        const struct dma_map_ops *ops = get_dma_ops(dev->dev);
+
+        return !dma_is_direct(ops) && ops &&
+                ops->map_page != dma_direct_map_page;
+}
+
+/**
  * vmw_dma_select_mode - Determine how DMA mappings should be set up for this
  * system.
  *
@@ -565,55 +580,27 @@ static int vmw_dma_select_mode(struct vmw_private *dev_priv)
                 [vmw_dma_alloc_coherent] = "Using coherent TTM pages.",
                 [vmw_dma_map_populate] = "Keeping DMA mappings.",
                 [vmw_dma_map_bind] = "Giving up DMA mappings early."};
-#ifdef CONFIG_X86
-        const struct dma_map_ops *dma_ops = get_dma_ops(dev_priv->dev->dev);
 
-#ifdef CONFIG_INTEL_IOMMU
-        if (intel_iommu_enabled) {
+        if (vmw_force_coherent)
+                dev_priv->map_mode = vmw_dma_alloc_coherent;
+        else if (vmw_assume_iommu(dev_priv->dev))
                 dev_priv->map_mode = vmw_dma_map_populate;
-                goto out_fixup;
-        }
-#endif
-
-        if (!(vmw_force_iommu || vmw_force_coherent)) {
+        else if (!vmw_force_iommu)
                 dev_priv->map_mode = vmw_dma_phys;
-                DRM_INFO("DMA map mode: %s\n", names[dev_priv->map_mode]);
-                return 0;
-        }
-
-        dev_priv->map_mode = vmw_dma_map_populate;
-
-        if (dma_ops && dma_ops->sync_single_for_cpu)
+        else if (IS_ENABLED(CONFIG_SWIOTLB) && swiotlb_nr_tbl())
                 dev_priv->map_mode = vmw_dma_alloc_coherent;
-#ifdef CONFIG_SWIOTLB
-        if (swiotlb_nr_tbl() == 0)
+        else
                 dev_priv->map_mode = vmw_dma_map_populate;
-#endif
 
-#ifdef CONFIG_INTEL_IOMMU
-out_fixup:
-#endif
-        if (dev_priv->map_mode == vmw_dma_map_populate &&
-            vmw_restrict_iommu)
+        if (dev_priv->map_mode == vmw_dma_map_populate && vmw_restrict_iommu)
                 dev_priv->map_mode = vmw_dma_map_bind;
 
-        if (vmw_force_coherent)
-                dev_priv->map_mode = vmw_dma_alloc_coherent;
-
-#if !defined(CONFIG_SWIOTLB) && !defined(CONFIG_INTEL_IOMMU)
-        /*
-         * No coherent page pool
-         */
-        if (dev_priv->map_mode == vmw_dma_alloc_coherent)
+        /* No TTM coherent page pool? FIXME: Ask TTM instead! */
+        if (!(IS_ENABLED(CONFIG_SWIOTLB) || IS_ENABLED(CONFIG_INTEL_IOMMU)) &&
+            (dev_priv->map_mode == vmw_dma_alloc_coherent))
                 return -EINVAL;
-#endif
-
-#else /* CONFIG_X86 */
-        dev_priv->map_mode = vmw_dma_map_populate;
-#endif /* CONFIG_X86 */
 
         DRM_INFO("DMA map mode: %s\n", names[dev_priv->map_mode]);
-
         return 0;
 }
 
@@ -625,24 +612,20 @@ out_fixup:
  * With 32-bit we can only handle 32 bit PFNs. Optionally set that
  * restriction also for 64-bit systems.
  */
-#ifdef CONFIG_INTEL_IOMMU
 static int vmw_dma_masks(struct vmw_private *dev_priv)
 {
         struct drm_device *dev = dev_priv->dev;
+        int ret = 0;
 
-        if (intel_iommu_enabled &&
+        ret = dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(64));
+        if (dev_priv->map_mode != vmw_dma_phys &&
             (sizeof(unsigned long) == 4 || vmw_restrict_dma_mask)) {
                 DRM_INFO("Restricting DMA addresses to 44 bits.\n");
-                return dma_set_mask(dev->dev, DMA_BIT_MASK(44));
+                return dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(44));
         }
-        return 0;
-}
-#else
-static int vmw_dma_masks(struct vmw_private *dev_priv)
-{
-        return 0;
+
+        return ret;
 }
-#endif
 
 static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
 {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index f2d13a72c05d..88b8178d4687 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -3570,7 +3570,7 @@ int vmw_execbuf_fence_commands(struct drm_file *file_priv,
                 *p_fence = NULL;
         }
 
-        return 0;
+        return ret;
 }
 
 /**
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index b351fb5214d3..ed2f67822f45 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1646,7 +1646,7 @@ static int vmw_kms_check_topology(struct drm_device *dev,
                 struct drm_connector_state *conn_state;
                 struct vmw_connector_state *vmw_conn_state;
 
-                if (!du->pref_active) {
+                if (!du->pref_active && new_crtc_state->enable) {
                         ret = -EINVAL;
                         goto clean;
                 }
@@ -2554,8 +2554,8 @@ void vmw_kms_helper_validation_finish(struct vmw_private *dev_priv,
                                       user_fence_rep)
 {
         struct vmw_fence_obj *fence = NULL;
-        uint32_t handle;
-        int ret;
+        uint32_t handle = 0;
+        int ret = 0;
 
         if (file_priv || user_fence_rep || vmw_validation_has_bos(ctx) ||
             out_fence)
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index 474b00e19697..0a7d4395d427 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -898,8 +898,8 @@ static struct ipu_devtype ipu_type_imx51 = {
         .cpmem_ofs = 0x1f000000,
         .srm_ofs = 0x1f040000,
         .tpm_ofs = 0x1f060000,
-        .csi0_ofs = 0x1f030000,
-        .csi1_ofs = 0x1f038000,
+        .csi0_ofs = 0x1e030000,
+        .csi1_ofs = 0x1e038000,
         .ic_ofs = 0x1e020000,
         .disp0_ofs = 0x1e040000,
         .disp1_ofs = 0x1e048000,
@@ -914,8 +914,8 @@ static struct ipu_devtype ipu_type_imx53 = {
         .cpmem_ofs = 0x07000000,
         .srm_ofs = 0x07040000,
         .tpm_ofs = 0x07060000,
-        .csi0_ofs = 0x07030000,
-        .csi1_ofs = 0x07038000,
+        .csi0_ofs = 0x06030000,
+        .csi1_ofs = 0x06038000,
         .ic_ofs = 0x06020000,
         .disp0_ofs = 0x06040000,
         .disp1_ofs = 0x06048000,
diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c
index 2f8db9d62551..4a28f3fbb0a2 100644
--- a/drivers/gpu/ipu-v3/ipu-pre.c
+++ b/drivers/gpu/ipu-v3/ipu-pre.c
@@ -106,6 +106,7 @@ struct ipu_pre {
         void                    *buffer_virt;
         bool                    in_use;
         unsigned int            safe_window_end;
+        unsigned int            last_bufaddr;
 };
 
 static DEFINE_MUTEX(ipu_pre_list_mutex);
@@ -185,6 +186,7 @@ void ipu_pre_configure(struct ipu_pre *pre, unsigned int width,
 
         writel(bufaddr, pre->regs + IPU_PRE_CUR_BUF);
         writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
+        pre->last_bufaddr = bufaddr;
 
         val = IPU_PRE_PREF_ENG_CTRL_INPUT_PIXEL_FORMAT(0) |
               IPU_PRE_PREF_ENG_CTRL_INPUT_ACTIVE_BPP(active_bpp) |
@@ -242,7 +244,11 @@ void ipu_pre_update(struct ipu_pre *pre, unsigned int bufaddr)
         unsigned short current_yblock;
         u32 val;
 
+        if (bufaddr == pre->last_bufaddr)
+                return;
+
         writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
+        pre->last_bufaddr = bufaddr;
 
         do {
                 if (time_after(jiffies, timeout)) {
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index c530476edba6..ac9fda1b5a72 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -30,6 +30,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
+#include <linux/kfifo.h>
 #include <linux/sched/signal.h>
 #include <linux/export.h>
 #include <linux/slab.h>
@@ -661,17 +662,12 @@ EXPORT_SYMBOL_GPL(hid_dump_device);
 /* enqueue string to 'events' ring buffer */
 void hid_debug_event(struct hid_device *hdev, char *buf)
 {
-        unsigned i;
         struct hid_debug_list *list;
         unsigned long flags;
 
         spin_lock_irqsave(&hdev->debug_list_lock, flags);
-        list_for_each_entry(list, &hdev->debug_list, node) {
-                for (i = 0; buf[i]; i++)
-                        list->hid_debug_buf[(list->tail + i) % HID_DEBUG_BUFSIZE] =
-                                buf[i];
-                list->tail = (list->tail + i) % HID_DEBUG_BUFSIZE;
-        }
+        list_for_each_entry(list, &hdev->debug_list, node)
+                kfifo_in(&list->hid_debug_fifo, buf, strlen(buf));
         spin_unlock_irqrestore(&hdev->debug_list_lock, flags);
 
         wake_up_interruptible(&hdev->debug_wait);
@@ -722,8 +718,7 @@ void hid_dump_input(struct hid_device *hdev, struct hid_usage *usage, __s32 valu
         hid_debug_event(hdev, buf);
 
         kfree(buf);
-        wake_up_interruptible(&hdev->debug_wait);
-
+        wake_up_interruptible(&hdev->debug_wait);
 }
 EXPORT_SYMBOL_GPL(hid_dump_input);
 
@@ -1083,8 +1078,8 @@ static int hid_debug_events_open(struct inode *inode, struct file *file)
                 goto out;
         }
 
-        if (!(list->hid_debug_buf = kzalloc(HID_DEBUG_BUFSIZE, GFP_KERNEL))) {
-                err = -ENOMEM;
+        err = kfifo_alloc(&list->hid_debug_fifo, HID_DEBUG_FIFOSIZE, GFP_KERNEL);
+        if (err) {
                 kfree(list);
                 goto out;
         }
@@ -1104,77 +1099,57 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer,
                 size_t count, loff_t *ppos)
 {
         struct hid_debug_list *list = file->private_data;
-        int ret = 0, len;
+        int ret = 0, copied;
         DECLARE_WAITQUEUE(wait, current);
 
         mutex_lock(&list->read_mutex);
-        while (ret == 0) {
-                if (list->head == list->tail) {
-                        add_wait_queue(&list->hdev->debug_wait, &wait);
-                        set_current_state(TASK_INTERRUPTIBLE);
-
-                        while (list->head == list->tail) {
-                                if (file->f_flags & O_NONBLOCK) {
-                                        ret = -EAGAIN;
-                                        break;
-                                }
-                                if (signal_pending(current)) {
-                                        ret = -ERESTARTSYS;
-                                        break;
-                                }
+        if (kfifo_is_empty(&list->hid_debug_fifo)) {
+                add_wait_queue(&list->hdev->debug_wait, &wait);
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                while (kfifo_is_empty(&list->hid_debug_fifo)) {
+                        if (file->f_flags & O_NONBLOCK) {
+                                ret = -EAGAIN;
+                                break;
+                        }
 
-                                if (!list->hdev || !list->hdev->debug) {
-                                        ret = -EIO;
-                                        set_current_state(TASK_RUNNING);
-                                        goto out;
-                                }
+                        if (signal_pending(current)) {
+                                ret = -ERESTARTSYS;
+                                break;
+                        }
 
-                                /* allow O_NONBLOCK from other threads */
-                                mutex_unlock(&list->read_mutex);
-                                schedule();
-                                mutex_lock(&list->read_mutex);
-                                set_current_state(TASK_INTERRUPTIBLE);
+                        /* if list->hdev is NULL we cannot remove_wait_queue().
+                         * if list->hdev->debug is 0 then hid_debug_unregister()
+                         * was already called and list->hdev is being destroyed.
+                         * if we add remove_wait_queue() here we can hit a race.
+                         */
+                        if (!list->hdev || !list->hdev->debug) {
+                                ret = -EIO;
+                                set_current_state(TASK_RUNNING);
+                                goto out;
                         }
 
-                        set_current_state(TASK_RUNNING);
-                        remove_wait_queue(&list->hdev->debug_wait, &wait);
+                        /* allow O_NONBLOCK from other threads */
+                        mutex_unlock(&list->read_mutex);
+                        schedule();
+                        mutex_lock(&list->read_mutex);
+                        set_current_state(TASK_INTERRUPTIBLE);
                 }
 
-                if (ret)
-                        goto out;
+                __set_current_state(TASK_RUNNING);
+                remove_wait_queue(&list->hdev->debug_wait, &wait);
 
-                /* pass the ringbuffer contents to userspace */
-copy_rest:
-                if (list->tail == list->head)
+                if (ret)
                         goto out;
-                if (list->tail > list->head) {
-                        len = list->tail - list->head;
-                        if (len > count)
-                                len = count;
-
-                        if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) {
-                                ret = -EFAULT;
-                                goto out;
-                        }
-                        ret += len;
-                        list->head += len;
-                } else {
-                        len = HID_DEBUG_BUFSIZE - list->head;
-                        if (len > count)
-                                len = count;
-
-                        if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) {
-                                ret = -EFAULT;
-                                goto out;
-                        }
-                        list->head = 0;
-                        ret += len;
-                        count -= len;
-                        if (count > 0)
-                                goto copy_rest;
-                }
-
         }
+
+        /* pass the fifo content to userspace, locking is not needed with only
+         * one concurrent reader and one concurrent writer
+         */
+        ret = kfifo_to_user(&list->hid_debug_fifo, buffer, count, &copied);
+        if (ret)
+                goto out;
+        ret = copied;
 out:
         mutex_unlock(&list->read_mutex);
         return ret;
@@ -1185,7 +1160,7 @@ static __poll_t hid_debug_events_poll(struct file *file, poll_table *wait)
         struct hid_debug_list *list = file->private_data;
 
         poll_wait(file, &list->hdev->debug_wait, wait);
-        if (list->head != list->tail)
+        if (!kfifo_is_empty(&list->hid_debug_fifo))
                 return EPOLLIN | EPOLLRDNORM;
         if (!list->hdev->debug)
                 return EPOLLERR | EPOLLHUP;
@@ -1200,7 +1175,7 @@ static int hid_debug_events_release(struct inode *inode, struct file *file)
         spin_lock_irqsave(&list->hdev->debug_list_lock, flags);
         list_del(&list->node);
         spin_unlock_irqrestore(&list->hdev->debug_list_lock, flags);
-        kfree(list->hid_debug_buf);
+        kfifo_free(&list->hid_debug_fifo);
         kfree(list);
 
         return 0;
@@ -1246,4 +1221,3 @@ void hid_debug_exit(void)
 {
         debugfs_remove_recursive(hid_debug_root);
 }
-
diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index 4adec4ab7d06..59ee01f3d022 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -3594,7 +3594,8 @@ nct6775_check_fan_inputs(struct nct6775_data *data)
                         fan5pin |= cr1b & BIT(5);
                         fan5pin |= creb & BIT(5);
 
-                        fan6pin = creb & BIT(3);
+                        fan6pin = !dsw_en && (cr2d & BIT(1));
+                        fan6pin |= creb & BIT(3);
 
                         pwm5pin |= cr2d & BIT(7);
                         pwm5pin |= (creb & BIT(4)) && !(cr2a & BIT(0));
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index b1086bfb0465..cd9c65f3d404 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -1500,8 +1500,7 @@ static int omap_i2c_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int omap_i2c_runtime_suspend(struct device *dev)
+static int __maybe_unused omap_i2c_runtime_suspend(struct device *dev)
 {
         struct omap_i2c_dev *omap = dev_get_drvdata(dev);
 
@@ -1527,7 +1526,7 @@ static int omap_i2c_runtime_suspend(struct device *dev)
         return 0;
 }
 
-static int omap_i2c_runtime_resume(struct device *dev)
+static int __maybe_unused omap_i2c_runtime_resume(struct device *dev)
 {
         struct omap_i2c_dev *omap = dev_get_drvdata(dev);
 
@@ -1542,20 +1541,18 @@ static int omap_i2c_runtime_resume(struct device *dev)
 }
 
 static const struct dev_pm_ops omap_i2c_pm_ops = {
+        SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                      pm_runtime_force_resume)
         SET_RUNTIME_PM_OPS(omap_i2c_runtime_suspend,
                            omap_i2c_runtime_resume, NULL)
 };
-#define OMAP_I2C_PM_OPS (&omap_i2c_pm_ops)
-#else
-#define OMAP_I2C_PM_OPS NULL
-#endif /* CONFIG_PM */
 
 static struct platform_driver omap_i2c_driver = {
         .probe          = omap_i2c_probe,
         .remove         = omap_i2c_remove,
         .driver         = {
                 .name   = "omap_i2c",
-                .pm     = OMAP_I2C_PM_OPS,
+                .pm     = &omap_i2c_pm_ops,
                 .of_match_table = of_match_ptr(omap_i2c_of_match),
         },
 };
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index c39f89d2deba..2dc628d4f1ae 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -1828,7 +1828,7 @@ int i3c_master_add_i3c_dev_locked(struct i3c_master_controller *master,
 
         ret = i3c_master_retrieve_dev_info(newdev);
         if (ret)
-                goto err_free_dev;
+                goto err_detach_dev;
 
         olddev = i3c_master_search_i3c_dev_duplicate(newdev);
         if (olddev) {
diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
index f8c00b94817f..bb03079fbade 100644
--- a/drivers/i3c/master/dw-i3c-master.c
+++ b/drivers/i3c/master/dw-i3c-master.c
@@ -419,12 +419,9 @@ static void dw_i3c_master_enqueue_xfer(struct dw_i3c_master *master,
         spin_unlock_irqrestore(&master->xferqueue.lock, flags);
 }
 
-static void dw_i3c_master_dequeue_xfer(struct dw_i3c_master *master,
-                                       struct dw_i3c_xfer *xfer)
+static void dw_i3c_master_dequeue_xfer_locked(struct dw_i3c_master *master,
+                                              struct dw_i3c_xfer *xfer)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&master->xferqueue.lock, flags);
         if (master->xferqueue.cur == xfer) {
                 u32 status;
 
@@ -439,6 +436,15 @@ static void dw_i3c_master_dequeue_xfer(struct dw_i3c_master *master,
         } else {
                 list_del_init(&xfer->node);
         }
+}
+
+static void dw_i3c_master_dequeue_xfer(struct dw_i3c_master *master,
+                                       struct dw_i3c_xfer *xfer)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&master->xferqueue.lock, flags);
+        dw_i3c_master_dequeue_xfer_locked(master, xfer);
         spin_unlock_irqrestore(&master->xferqueue.lock, flags);
 }
 
@@ -494,7 +500,7 @@ static void dw_i3c_master_end_xfer_locked(struct dw_i3c_master *master, u32 isr)
         complete(&xfer->comp);
 
         if (ret < 0) {
-                dw_i3c_master_dequeue_xfer(master, xfer);
+                dw_i3c_master_dequeue_xfer_locked(master, xfer);
                 writel(readl(master->regs + DEVICE_CTRL) | DEV_CTRL_RESUME,
                        master->regs + DEVICE_CTRL);
         }
diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c
index 031d568b4972..4e339cfd0c54 100644
--- a/drivers/iio/adc/axp288_adc.c
+++ b/drivers/iio/adc/axp288_adc.c
@@ -27,9 +27,18 @@
 #include <linux/iio/machine.h>
 #include <linux/iio/driver.h>
 
-#define AXP288_ADC_EN_MASK              0xF1
-#define AXP288_ADC_TS_PIN_GPADC         0xF2
-#define AXP288_ADC_TS_PIN_ON            0xF3
+/*
+ * This mask enables all ADCs except for the battery temp-sensor (TS), that is
+ * left as-is to avoid breaking charging on devices without a temp-sensor.
+ */
+#define AXP288_ADC_EN_MASK                              0xF0
+#define AXP288_ADC_TS_ENABLE                            0x01
+
+#define AXP288_ADC_TS_CURRENT_ON_OFF_MASK               GENMASK(1, 0)
+#define AXP288_ADC_TS_CURRENT_OFF                       (0 << 0)
+#define AXP288_ADC_TS_CURRENT_ON_WHEN_CHARGING          (1 << 0)
+#define AXP288_ADC_TS_CURRENT_ON_ONDEMAND               (2 << 0)
+#define AXP288_ADC_TS_CURRENT_ON                        (3 << 0)
 
 enum axp288_adc_id {
         AXP288_ADC_TS,
@@ -44,6 +53,7 @@ enum axp288_adc_id {
 struct axp288_adc_info {
         int irq;
         struct regmap *regmap;
+        bool ts_enabled;
 };
 
 static const struct iio_chan_spec axp288_adc_channels[] = {
@@ -115,21 +125,33 @@ static int axp288_adc_read_channel(int *val, unsigned long address,
         return IIO_VAL_INT;
 }
 
-static int axp288_adc_set_ts(struct regmap *regmap, unsigned int mode,
-                                unsigned long address)
+/*
+ * The current-source used for the battery temp-sensor (TS) is shared
+ * with the GPADC. For proper fuel-gauge and charger operation the TS
+ * current-source needs to be permanently on. But to read the GPADC we
+ * need to temporary switch the TS current-source to ondemand, so that
+ * the GPADC can use it, otherwise we will always read an all 0 value.
+ */
+static int axp288_adc_set_ts(struct axp288_adc_info *info,
+                             unsigned int mode, unsigned long address)
 {
         int ret;
 
-        /* channels other than GPADC do not need to switch TS pin */
+        /* No need to switch the current-source if the TS pin is disabled */
+        if (!info->ts_enabled)
+                return 0;
+
+        /* Channels other than GPADC do not need the current source */
         if (address != AXP288_GP_ADC_H)
                 return 0;
 
-        ret = regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, mode);
+        ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
+                                 AXP288_ADC_TS_CURRENT_ON_OFF_MASK, mode);
         if (ret)
                 return ret;
 
         /* When switching to the GPADC pin give things some time to settle */
-        if (mode == AXP288_ADC_TS_PIN_GPADC)
+        if (mode == AXP288_ADC_TS_CURRENT_ON_ONDEMAND)
                 usleep_range(6000, 10000);
 
         return 0;
@@ -145,14 +167,14 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
         mutex_lock(&indio_dev->mlock);
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
-                if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_GPADC,
+                if (axp288_adc_set_ts(info, AXP288_ADC_TS_CURRENT_ON_ONDEMAND,
                                         chan->address)) {
                         dev_err(&indio_dev->dev, "GPADC mode\n");
                         ret = -EINVAL;
                         break;
                 }
                 ret = axp288_adc_read_channel(val, chan->address, info->regmap);
-                if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_ON,
+                if (axp288_adc_set_ts(info, AXP288_ADC_TS_CURRENT_ON,
                                                 chan->address))
                         dev_err(&indio_dev->dev, "TS pin restore\n");
                 break;
@@ -164,13 +186,35 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
         return ret;
 }
 
-static int axp288_adc_set_state(struct regmap *regmap)
+static int axp288_adc_initialize(struct axp288_adc_info *info)
 {
-        /* ADC should be always enabled for internal FG to function */
-        if (regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON))
-                return -EIO;
+        int ret, adc_enable_val;
+
+        /*
+         * Determine if the TS pin is enabled and set the TS current-source
+         * accordingly.
+         */
+        ret = regmap_read(info->regmap, AXP20X_ADC_EN1, &adc_enable_val);
+        if (ret)
+                return ret;
+
+        if (adc_enable_val & AXP288_ADC_TS_ENABLE) {
+                info->ts_enabled = true;
+                ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
+                                         AXP288_ADC_TS_CURRENT_ON_OFF_MASK,
+                                         AXP288_ADC_TS_CURRENT_ON);
+        } else {
+                info->ts_enabled = false;
+                ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
+                                         AXP288_ADC_TS_CURRENT_ON_OFF_MASK,
+                                         AXP288_ADC_TS_CURRENT_OFF);
+        }
+        if (ret)
+                return ret;
 
-        return regmap_write(regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
+        /* Turn on the ADC for all channels except TS, leave TS as is */
+        return regmap_update_bits(info->regmap, AXP20X_ADC_EN1,
+                                  AXP288_ADC_EN_MASK, AXP288_ADC_EN_MASK);
 }
 
 static const struct iio_info axp288_adc_iio_info = {
@@ -200,7 +244,7 @@ static int axp288_adc_probe(struct platform_device *pdev)
          * Set ADC to enabled state at all time, including system suspend.
          * otherwise internal fuel gauge functionality may be affected.
          */
-        ret = axp288_adc_set_state(axp20x->regmap);
+        ret = axp288_adc_initialize(info);
         if (ret) {
                 dev_err(&pdev->dev, "unable to enable ADC device\n");
                 return ret;
diff --git a/drivers/iio/adc/ti-ads8688.c b/drivers/iio/adc/ti-ads8688.c
index 184d686ebd99..8b4568edd5cb 100644
--- a/drivers/iio/adc/ti-ads8688.c
+++ b/drivers/iio/adc/ti-ads8688.c
@@ -41,6 +41,7 @@
 
 #define ADS8688_VREF_MV                 4096
 #define ADS8688_REALBITS                16
+#define ADS8688_MAX_CHANNELS            8
 
 /*
  * enum ads8688_range - ADS8688 reference voltage range
@@ -385,7 +386,7 @@ static irqreturn_t ads8688_trigger_handler(int irq, void *p)
 {
         struct iio_poll_func *pf = p;
         struct iio_dev *indio_dev = pf->indio_dev;
-        u16 buffer[8];
+        u16 buffer[ADS8688_MAX_CHANNELS + sizeof(s64)/sizeof(u16)];
         int i, j = 0;
 
         for (i = 0; i < indio_dev->masklength; i++) {
diff --git a/drivers/iio/chemical/atlas-ph-sensor.c b/drivers/iio/chemical/atlas-ph-sensor.c
index a406ad31b096..3a20cb5d9bff 100644
--- a/drivers/iio/chemical/atlas-ph-sensor.c
+++ b/drivers/iio/chemical/atlas-ph-sensor.c
@@ -444,9 +444,8 @@ static int atlas_read_raw(struct iio_dev *indio_dev,
         case IIO_CHAN_INFO_SCALE:
                 switch (chan->type) {
                 case IIO_TEMP:
-                        *val = 1; /* 0.01 */
-                        *val2 = 100;
-                        break;
+                        *val = 10;
+                        return IIO_VAL_INT;
                 case IIO_PH:
                         *val = 1; /* 0.001 */
                         *val2 = 1000;
@@ -477,7 +476,7 @@ static int atlas_write_raw(struct iio_dev *indio_dev,
                            int val, int val2, long mask)
 {
         struct atlas_data *data = iio_priv(indio_dev);
-        __be32 reg = cpu_to_be32(val);
+        __be32 reg = cpu_to_be32(val / 10);
 
         if (val2 != 0 || val < 0 || val > 20000)
                 return -EINVAL;
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index 3cd830d52967..616734313f0c 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -267,7 +267,6 @@ static inline int ib_mad_enforce_security(struct ib_mad_agent_private *map,
 #endif
 
 struct ib_device *ib_device_get_by_index(u32 ifindex);
-void ib_device_put(struct ib_device *device);
 /* RDMA device netlink */
 void nldev_init(void);
 void nldev_exit(void);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 8872453e26c0..238ec42778ef 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -156,19 +156,26 @@ struct ib_device *ib_device_get_by_index(u32 index)
         down_read(&lists_rwsem);
         device = __ib_device_get_by_index(index);
         if (device) {
-                /* Do not return a device if unregistration has started. */
-                if (!refcount_inc_not_zero(&device->refcount))
+                if (!ib_device_try_get(device))
                         device = NULL;
         }
         up_read(&lists_rwsem);
         return device;
 }
 
+/**
+ * ib_device_put - Release IB device reference
+ * @device: device whose reference to be released
+ *
+ * ib_device_put() releases reference to the IB device to allow it to be
+ * unregistered and eventually free.
+ */
 void ib_device_put(struct ib_device *device)
 {
         if (refcount_dec_and_test(&device->refcount))
                 complete(&device->unreg_completion);
 }
+EXPORT_SYMBOL(ib_device_put);
 
 static struct ib_device *__ib_device_get_by_name(const char *name)
 {
@@ -303,7 +310,6 @@ struct ib_device *ib_alloc_device(size_t size)
         rwlock_init(&device->client_data_lock);
         INIT_LIST_HEAD(&device->client_data_list);
         INIT_LIST_HEAD(&device->port_list);
-        refcount_set(&device->refcount, 1);
         init_completion(&device->unreg_completion);
 
         return device;
@@ -620,6 +626,7 @@ int ib_register_device(struct ib_device *device, const char *name,
                 goto cg_cleanup;
         }
 
+        refcount_set(&device->refcount, 1);
         device->reg_state = IB_DEV_REGISTERED;
 
         list_for_each_entry(client, &client_list, list)
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index a4ec43093cb3..acb882f279cb 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -352,6 +352,8 @@ struct ib_umem_odp *ib_alloc_odp_umem(struct ib_ucontext_per_mm *per_mm,
         umem->writable   = 1;
         umem->is_odp = 1;
         odp_data->per_mm = per_mm;
+        umem->owning_mm  = per_mm->mm;
+        mmgrab(umem->owning_mm);
 
         mutex_init(&odp_data->umem_mutex);
         init_completion(&odp_data->notifier_completion);
@@ -384,6 +386,7 @@ struct ib_umem_odp *ib_alloc_odp_umem(struct ib_ucontext_per_mm *per_mm,
 out_page_list:
         vfree(odp_data->page_list);
 out_odp_data:
+        mmdrop(umem->owning_mm);
         kfree(odp_data);
         return ERR_PTR(ret);
 }
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 2890a77339e1..5f366838b7ff 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -204,6 +204,9 @@ void ib_uverbs_release_file(struct kref *ref)
         if (atomic_dec_and_test(&file->device->refcount))
                 ib_uverbs_comp_dev(file->device);
 
+        if (file->async_file)
+                kref_put(&file->async_file->ref,
+                         ib_uverbs_release_async_event_file);
         put_device(&file->device->dev);
         kfree(file);
 }
@@ -964,11 +967,19 @@ void uverbs_user_mmap_disassociate(struct ib_uverbs_file *ufile)
 
                 /* Get an arbitrary mm pointer that hasn't been cleaned yet */
                 mutex_lock(&ufile->umap_lock);
-                if (!list_empty(&ufile->umaps)) {
-                        mm = list_first_entry(&ufile->umaps,
-                                              struct rdma_umap_priv, list)
-                                     ->vma->vm_mm;
-                        mmget(mm);
+                while (!list_empty(&ufile->umaps)) {
+                        int ret;
+
+                        priv = list_first_entry(&ufile->umaps,
+                                                struct rdma_umap_priv, list);
+                        mm = priv->vma->vm_mm;
+                        ret = mmget_not_zero(mm);
+                        if (!ret) {
+                                list_del_init(&priv->list);
+                                mm = NULL;
+                                continue;
+                        }
+                        break;
                 }
                 mutex_unlock(&ufile->umap_lock);
                 if (!mm)
@@ -1096,10 +1107,6 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
         list_del_init(&file->list);
         mutex_unlock(&file->device->lists_mutex);
 
-        if (file->async_file)
-                kref_put(&file->async_file->ref,
-                         ib_uverbs_release_async_event_file);
-
         kref_put(&file->ref, ib_uverbs_release_file);
 
         return 0;
diff --git a/drivers/infiniband/core/uverbs_std_types_device.c b/drivers/infiniband/core/uverbs_std_types_device.c
index 5030ec480370..2a3f2f01028d 100644
--- a/drivers/infiniband/core/uverbs_std_types_device.c
+++ b/drivers/infiniband/core/uverbs_std_types_device.c
@@ -168,12 +168,18 @@ void copy_port_attr_to_resp(struct ib_port_attr *attr,
 static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_PORT)(
         struct uverbs_attr_bundle *attrs)
 {
-        struct ib_device *ib_dev = attrs->ufile->device->ib_dev;
+        struct ib_device *ib_dev;
         struct ib_port_attr attr = {};
         struct ib_uverbs_query_port_resp_ex resp = {};
+        struct ib_ucontext *ucontext;
         int ret;
         u8 port_num;
 
+        ucontext = ib_uverbs_get_ucontext(attrs);
+        if (IS_ERR(ucontext))
+                return PTR_ERR(ucontext);
+        ib_dev = ucontext->device;
+
         /* FIXME: Extend the UAPI_DEF_OBJ_NEEDS_FN stuff.. */
         if (!ib_dev->ops.query_port)
                 return -EOPNOTSUPP;
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index c22ebc774a6a..f9a7e9d29c8b 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -488,7 +488,7 @@ static int hfi1_file_mmap(struct file *fp, struct vm_area_struct *vma)
                 vmf = 1;
                 break;
         case STATUS:
-                if (flags & (unsigned long)(VM_WRITE | VM_EXEC)) {
+                if (flags & VM_WRITE) {
                         ret = -EPERM;
                         goto done;
                 }
diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
index 88242fe95eaa..bf96067876c9 100644
--- a/drivers/infiniband/hw/hfi1/ud.c
+++ b/drivers/infiniband/hw/hfi1/ud.c
@@ -987,7 +987,6 @@ void hfi1_ud_rcv(struct hfi1_packet *packet)
             opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
                 wc.ex.imm_data = packet->ohdr->u.ud.imm_data;
                 wc.wc_flags = IB_WC_WITH_IMM;
-                tlen -= sizeof(u32);
         } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
                 wc.ex.imm_data = 0;
                 wc.wc_flags = 0;
diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c
index 960b1946c365..12deacf442cf 100644
--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
+++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
@@ -210,6 +210,7 @@ struct ib_srq *hns_roce_create_srq(struct ib_pd *pd,
                                    struct ib_udata *udata)
 {
         struct hns_roce_dev *hr_dev = to_hr_dev(pd->device);
+        struct hns_roce_ib_create_srq_resp resp = {};
         struct hns_roce_srq *srq;
         int srq_desc_size;
         int srq_buf_size;
@@ -378,16 +379,21 @@ struct ib_srq *hns_roce_create_srq(struct ib_pd *pd,
 
         srq->event = hns_roce_ib_srq_event;
         srq->ibsrq.ext.xrc.srq_num = srq->srqn;
+        resp.srqn = srq->srqn;
 
         if (udata) {
-                if (ib_copy_to_udata(udata, &srq->srqn, sizeof(__u32))) {
+                if (ib_copy_to_udata(udata, &resp,
+                                     min(udata->outlen, sizeof(resp)))) {
                         ret = -EFAULT;
-                        goto err_wrid;
+                        goto err_srqc_alloc;
                 }
         }
 
         return &srq->ibsrq;
 
+err_srqc_alloc:
+        hns_roce_srq_free(hr_dev, srq);
+
 err_wrid:
         kvfree(srq->wrid);
 
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 25439da8976c..936ee1314bcd 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1411,7 +1411,7 @@ int mlx4_ib_send_to_wire(struct mlx4_ib_dev *dev, int slave, u8 port,
 
         sqp_mad = (struct mlx4_mad_snd_buf *) (sqp->tx_ring[wire_tx_ix].buf.addr);
         if (sqp->tx_ring[wire_tx_ix].ah)
-                rdma_destroy_ah(sqp->tx_ring[wire_tx_ix].ah, 0);
+                mlx4_ib_destroy_ah(sqp->tx_ring[wire_tx_ix].ah, 0);
         sqp->tx_ring[wire_tx_ix].ah = ah;
         ib_dma_sync_single_for_cpu(&dev->ib_dev,
                                    sqp->tx_ring[wire_tx_ix].buf.map,
@@ -1902,7 +1902,7 @@ static void mlx4_ib_sqp_comp_worker(struct work_struct *work)
                 if (wc.status == IB_WC_SUCCESS) {
                         switch (wc.opcode) {
                         case IB_WC_SEND:
-                                rdma_destroy_ah(sqp->tx_ring[wc.wr_id &
+                                mlx4_ib_destroy_ah(sqp->tx_ring[wc.wr_id &
                                               (MLX4_NUM_TUNNEL_BUFS - 1)].ah, 0);
                                 sqp->tx_ring[wc.wr_id & (MLX4_NUM_TUNNEL_BUFS - 1)].ah
                                         = NULL;
@@ -1931,7 +1931,7 @@ static void mlx4_ib_sqp_comp_worker(struct work_struct *work)
                                  " status = %d, wrid = 0x%llx\n",
                                  ctx->slave, wc.status, wc.wr_id);
                         if (!MLX4_TUN_IS_RECV(wc.wr_id)) {
-                                rdma_destroy_ah(sqp->tx_ring[wc.wr_id &
+                                mlx4_ib_destroy_ah(sqp->tx_ring[wc.wr_id &
                                               (MLX4_NUM_TUNNEL_BUFS - 1)].ah, 0);
                                 sqp->tx_ring[wc.wr_id & (MLX4_NUM_TUNNEL_BUFS - 1)].ah
                                         = NULL;
diff --git a/drivers/infiniband/hw/mlx5/flow.c b/drivers/infiniband/hw/mlx5/flow.c
index e8a1e4498e3f..798591a18484 100644
--- a/drivers/infiniband/hw/mlx5/flow.c
+++ b/drivers/infiniband/hw/mlx5/flow.c
@@ -630,8 +630,7 @@ const struct uapi_definition mlx5_ib_flow_defs[] = {
                 UAPI_DEF_IS_OBJ_SUPPORTED(flow_is_supported)),
         UAPI_DEF_CHAIN_OBJ_TREE(
                 UVERBS_OBJECT_FLOW,
-                &mlx5_ib_fs,
-                UAPI_DEF_IS_OBJ_SUPPORTED(flow_is_supported)),
+                &mlx5_ib_fs),
         UAPI_DEF_CHAIN_OBJ_TREE(UVERBS_OBJECT_FLOW_ACTION,
                                 &mlx5_ib_flow_actions),
         {},
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index 01e0f6200631..4ee32964e1dd 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -1595,10 +1595,12 @@ static void mlx5_ib_prefetch_mr_work(struct work_struct *work)
         struct prefetch_mr_work *w =
                 container_of(work, struct prefetch_mr_work, work);
 
-        if (w->dev->ib_dev.reg_state == IB_DEV_REGISTERED)
+        if (ib_device_try_get(&w->dev->ib_dev)) {
                 mlx5_ib_prefetch_sg_list(w->dev, w->pf_flags, w->sg_list,
                                          w->num_sge);
-
+                ib_device_put(&w->dev->ib_dev);
+        }
+        put_device(&w->dev->ib_dev.dev);
         kfree(w);
 }
 
@@ -1617,15 +1619,13 @@ int mlx5_ib_advise_mr_prefetch(struct ib_pd *pd,
                 return mlx5_ib_prefetch_sg_list(dev, pf_flags, sg_list,
                                                 num_sge);
 
-        if (dev->ib_dev.reg_state != IB_DEV_REGISTERED)
-                return -ENODEV;
-
         work = kvzalloc(struct_size(work, sg_list, num_sge), GFP_KERNEL);
         if (!work)
                 return -ENOMEM;
 
         memcpy(work->sg_list, sg_list, num_sge * sizeof(struct ib_sge));
 
+        get_device(&dev->ib_dev.dev);
         work->dev = dev;
         work->pf_flags = pf_flags;
         work->num_sge = num_sge;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index dd2ae640bc84..7db778d96ef5 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1912,14 +1912,16 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
                 }
 
                 if (!check_flags_mask(ucmd.flags,
+                                      MLX5_QP_FLAG_ALLOW_SCATTER_CQE |
+                                      MLX5_QP_FLAG_BFREG_INDEX |
+                                      MLX5_QP_FLAG_PACKET_BASED_CREDIT_MODE |
+                                      MLX5_QP_FLAG_SCATTER_CQE |
                                       MLX5_QP_FLAG_SIGNATURE |
-                                              MLX5_QP_FLAG_SCATTER_CQE |
-                                              MLX5_QP_FLAG_TUNNEL_OFFLOADS |
-                                              MLX5_QP_FLAG_BFREG_INDEX |
-                                              MLX5_QP_FLAG_TYPE_DCT |
-                                              MLX5_QP_FLAG_TYPE_DCI |
-                                              MLX5_QP_FLAG_ALLOW_SCATTER_CQE |
-                                              MLX5_QP_FLAG_PACKET_BASED_CREDIT_MODE))
+                                      MLX5_QP_FLAG_TIR_ALLOW_SELF_LB_MC |
+                                      MLX5_QP_FLAG_TIR_ALLOW_SELF_LB_UC |
+                                      MLX5_QP_FLAG_TUNNEL_OFFLOADS |
+                                      MLX5_QP_FLAG_TYPE_DCI |
+                                      MLX5_QP_FLAG_TYPE_DCT))
                         return -EINVAL;
 
                 err = get_qp_user_index(to_mucontext(pd->uobject->context),
diff --git a/drivers/infiniband/hw/qib/qib_ud.c b/drivers/infiniband/hw/qib/qib_ud.c
index 868da0ece7ba..445ea19a2ec8 100644
--- a/drivers/infiniband/hw/qib/qib_ud.c
+++ b/drivers/infiniband/hw/qib/qib_ud.c
@@ -512,7 +512,6 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct ib_header *hdr,
             opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
                 wc.ex.imm_data = ohdr->u.ud.imm_data;
                 wc.wc_flags = IB_WC_WITH_IMM;
-                tlen -= sizeof(u32);
         } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
                 wc.ex.imm_data = 0;
                 wc.wc_flags = 0;
diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
index a1bd8cfc2c25..c6cc3e4ab71d 100644
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -2910,6 +2910,8 @@ send:
                         goto op_err;
                 if (!ret)
                         goto rnr_nak;
+                if (wqe->length > qp->r_len)
+                        goto inv_err;
                 break;
 
         case IB_WR_RDMA_WRITE_WITH_IMM:
@@ -3078,7 +3080,10 @@ op_err:
         goto err;
 
 inv_err:
-        send_status = IB_WC_REM_INV_REQ_ERR;
+        send_status =
+                sqp->ibqp.qp_type == IB_QPT_RC ?
+                        IB_WC_REM_INV_REQ_ERR :
+                        IB_WC_SUCCESS;
         wc.status = IB_WC_LOC_QP_OP_ERR;
         goto err;
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 1da119d901a9..73e808c1e6ad 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -248,7 +248,6 @@ struct ipoib_cm_tx {
         struct list_head     list;
         struct net_device   *dev;
         struct ipoib_neigh  *neigh;
-        struct ipoib_path   *path;
         struct ipoib_tx_buf *tx_ring;
         unsigned int         tx_head;
         unsigned int         tx_tail;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 0428e01e8f69..aa9dcfc36cd3 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1312,7 +1312,6 @@ struct ipoib_cm_tx *ipoib_cm_create_tx(struct net_device *dev, struct ipoib_path
 
         neigh->cm = tx;
         tx->neigh = neigh;
-        tx->path = path;
         tx->dev = dev;
         list_add(&tx->list, &priv->cm.start_list);
         set_bit(IPOIB_FLAG_INITIALIZED, &tx->flags);
@@ -1371,7 +1370,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
                                 neigh->daddr + QPN_AND_OPTIONS_OFFSET);
                         goto free_neigh;
                 }
-                memcpy(&pathrec, &p->path->pathrec, sizeof(pathrec));
+                memcpy(&pathrec, &path->pathrec, sizeof(pathrec));
 
                 spin_unlock_irqrestore(&priv->lock, flags);
                 netif_tx_unlock_bh(dev);
diff --git a/drivers/input/serio/olpc_apsp.c b/drivers/input/serio/olpc_apsp.c
index bae08226e3d9..a7cfab3db9ee 100644
--- a/drivers/input/serio/olpc_apsp.c
+++ b/drivers/input/serio/olpc_apsp.c
@@ -23,7 +23,6 @@
 #include <linux/of.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
-#include <linux/clk.h>
 
 /*
  * The OLPC XO-1.75 and XO-4 laptops do not have a hardware PS/2 controller.
@@ -75,7 +74,6 @@ struct olpc_apsp {
         struct serio *kbio;
         struct serio *padio;
         void __iomem *base;
-        struct clk *clk;
         int open_count;
         int irq;
 };
@@ -148,17 +146,11 @@ static int olpc_apsp_open(struct serio *port)
         struct olpc_apsp *priv = port->port_data;
         unsigned int tmp;
         unsigned long l;
-        int error;
 
         if (priv->open_count++ == 0) {
-                error = clk_prepare_enable(priv->clk);
-                if (error)
-                        return error;
-
                 l = readl(priv->base + COMMAND_FIFO_STATUS);
                 if (!(l & CMD_STS_MASK)) {
                         dev_err(priv->dev, "SP cannot accept commands.\n");
-                        clk_disable_unprepare(priv->clk);
                         return -EIO;
                 }
 
@@ -179,8 +171,6 @@ static void olpc_apsp_close(struct serio *port)
                 /* Disable interrupt 0 */
                 tmp = readl(priv->base + PJ_INTERRUPT_MASK);
                 writel(tmp | INT_0, priv->base + PJ_INTERRUPT_MASK);
-
-                clk_disable_unprepare(priv->clk);
         }
 }
 
@@ -208,10 +198,6 @@ static int olpc_apsp_probe(struct platform_device *pdev)
         if (priv->irq < 0)
                 return priv->irq;
 
-        priv->clk = devm_clk_get(&pdev->dev, "sp");
-        if (IS_ERR(priv->clk))
-                return PTR_ERR(priv->clk);
-
         /* KEYBOARD */
         kb_serio = kzalloc(sizeof(struct serio), GFP_KERNEL);
         if (!kb_serio)
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 87ba23a75b38..2a7b78bb98b4 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -1991,16 +1991,13 @@ static void do_attach(struct iommu_dev_data *dev_data,
 
 static void do_detach(struct iommu_dev_data *dev_data)
 {
+        struct protection_domain *domain = dev_data->domain;
         struct amd_iommu *iommu;
         u16 alias;
 
         iommu = amd_iommu_rlookup_table[dev_data->devid];
         alias = dev_data->alias;
 
-        /* decrease reference counters */
-        dev_data->domain->dev_iommu[iommu->index] -= 1;
-        dev_data->domain->dev_cnt                 -= 1;
-
         /* Update data structures */
         dev_data->domain = NULL;
         list_del(&dev_data->list);
@@ -2010,6 +2007,16 @@ static void do_detach(struct iommu_dev_data *dev_data)
 
         /* Flush the DTE entry */
         device_flush_dte(dev_data);
+
+        /* Flush IOTLB */
+        domain_flush_tlb_pde(domain);
+
+        /* Wait for the flushes to finish */
+        domain_flush_complete(domain);
+
+        /* decrease reference counters - needs to happen after the flushes */
+        domain->dev_iommu[iommu->index] -= 1;
+        domain->dev_cnt                 -= 1;
 }
 
 /*
@@ -2617,13 +2624,13 @@ out_unmap:
                         bus_addr  = address + s->dma_address + (j << PAGE_SHIFT);
                         iommu_unmap_page(domain, bus_addr, PAGE_SIZE);
 
-                        if (--mapped_pages)
+                        if (--mapped_pages == 0)
                                 goto out_free_iova;
                 }
         }
 
 out_free_iova:
-        free_iova_fast(&dma_dom->iovad, address, npages);
+        free_iova_fast(&dma_dom->iovad, address >> PAGE_SHIFT, npages);
 
 out_err:
         return 0;
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 2bd9ac285c0d..78188bf7e90d 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -363,7 +363,7 @@ static int dmar_map_gfx = 1;
 static int dmar_forcedac;
 static int intel_iommu_strict;
 static int intel_iommu_superpage = 1;
-static int intel_iommu_sm = 1;
+static int intel_iommu_sm;
 static int iommu_identity_mapping;
 
 #define IDENTMAP_ALL            1
@@ -456,9 +456,9 @@ static int __init intel_iommu_setup(char *str)
                 } else if (!strncmp(str, "sp_off", 6)) {
                         pr_info("Disable supported super page\n");
                         intel_iommu_superpage = 0;
-                } else if (!strncmp(str, "sm_off", 6)) {
-                        pr_info("Intel-IOMMU: disable scalable mode support\n");
-                        intel_iommu_sm = 0;
+                } else if (!strncmp(str, "sm_on", 5)) {
+                        pr_info("Intel-IOMMU: scalable mode supported\n");
+                        intel_iommu_sm = 1;
                 } else if (!strncmp(str, "tboot_noforce", 13)) {
                         printk(KERN_INFO
                                 "Intel-IOMMU: not forcing on after tboot. This could expose security risk for tboot\n");
@@ -5294,7 +5294,7 @@ static void intel_iommu_put_resv_regions(struct device *dev,
         struct iommu_resv_region *entry, *next;
 
         list_for_each_entry_safe(entry, next, head, list) {
-                if (entry->type == IOMMU_RESV_RESERVED)
+                if (entry->type == IOMMU_RESV_MSI)
                         kfree(entry);
         }
 }
diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
index 730f7dabcf37..7e0df67bd3e9 100644
--- a/drivers/iommu/mtk_iommu_v1.c
+++ b/drivers/iommu/mtk_iommu_v1.c
@@ -441,6 +441,10 @@ static int mtk_iommu_add_device(struct device *dev)
                 iommu_spec.args_count = count;
 
                 mtk_iommu_create_mapping(dev, &iommu_spec);
+
+                /* dev->iommu_fwspec might have changed */
+                fwspec = dev_iommu_fwspec_get(dev);
+
                 of_node_put(iommu_spec.np);
         }
 
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 7f2a45445b00..c3aba3fc818d 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -97,9 +97,14 @@ struct its_device;
  * The ITS structure - contains most of the infrastructure, with the
  * top-level MSI domain, the command queue, the collections, and the
  * list of devices writing to it.
+ *
+ * dev_alloc_lock has to be taken for device allocations, while the
+ * spinlock must be taken to parse data structures such as the device
+ * list.
  */
 struct its_node {
         raw_spinlock_t          lock;
+        struct mutex            dev_alloc_lock;
         struct list_head        entry;
         void __iomem            *base;
         phys_addr_t             phys_base;
@@ -156,6 +161,7 @@ struct its_device {
         void                    *itt;
         u32                     nr_ites;
         u32                     device_id;
+        bool                    shared;
 };
 
 static struct {
@@ -1580,6 +1586,9 @@ static unsigned long *its_lpi_alloc(int nr_irqs, u32 *base, int *nr_ids)
                 nr_irqs /= 2;
         } while (nr_irqs > 0);
 
+        if (!nr_irqs)
+                err = -ENOSPC;
+
         if (err)
                 goto out;
 
@@ -2059,6 +2068,29 @@ static int __init allocate_lpi_tables(void)
         return 0;
 }
 
+static u64 its_clear_vpend_valid(void __iomem *vlpi_base)
+{
+        u32 count = 1000000;    /* 1s! */
+        bool clean;
+        u64 val;
+
+        val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER);
+        val &= ~GICR_VPENDBASER_Valid;
+        gits_write_vpendbaser(val, vlpi_base + GICR_VPENDBASER);
+
+        do {
+                val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER);
+                clean = !(val & GICR_VPENDBASER_Dirty);
+                if (!clean) {
+                        count--;
+                        cpu_relax();
+                        udelay(1);
+                }
+        } while (!clean && count);
+
+        return val;
+}
+
 static void its_cpu_init_lpis(void)
 {
         void __iomem *rbase = gic_data_rdist_rd_base();
@@ -2144,6 +2176,30 @@ static void its_cpu_init_lpis(void)
         val |= GICR_CTLR_ENABLE_LPIS;
         writel_relaxed(val, rbase + GICR_CTLR);
 
+        if (gic_rdists->has_vlpis) {
+                void __iomem *vlpi_base = gic_data_rdist_vlpi_base();
+
+                /*
+                 * It's possible for CPU to receive VLPIs before it is
+                 * sheduled as a vPE, especially for the first CPU, and the
+                 * VLPI with INTID larger than 2^(IDbits+1) will be considered
+                 * as out of range and dropped by GIC.
+                 * So we initialize IDbits to known value to avoid VLPI drop.
+                 */
+                val = (LPI_NRBITS - 1) & GICR_VPROPBASER_IDBITS_MASK;
+                pr_debug("GICv4: CPU%d: Init IDbits to 0x%llx for GICR_VPROPBASER\n",
+                        smp_processor_id(), val);
+                gits_write_vpropbaser(val, vlpi_base + GICR_VPROPBASER);
+
+                /*
+                 * Also clear Valid bit of GICR_VPENDBASER, in case some
+                 * ancient programming gets left in and has possibility of
+                 * corrupting memory.
+                 */
+                val = its_clear_vpend_valid(vlpi_base);
+                WARN_ON(val & GICR_VPENDBASER_Dirty);
+        }
+
         /* Make sure the GIC has seen the above */
         dsb(sy);
 out:
@@ -2422,6 +2478,7 @@ static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
         struct its_device *its_dev;
         struct msi_domain_info *msi_info;
         u32 dev_id;
+        int err = 0;
 
         /*
          * We ignore "dev" entierely, and rely on the dev_id that has
@@ -2444,6 +2501,7 @@ static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
                 return -EINVAL;
         }
 
+        mutex_lock(&its->dev_alloc_lock);
         its_dev = its_find_device(its, dev_id);
         if (its_dev) {
                 /*
@@ -2451,18 +2509,22 @@ static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
                  * another alias (PCI bridge of some sort). No need to
                  * create the device.
                  */
+                its_dev->shared = true;
                 pr_debug("Reusing ITT for devID %x\n", dev_id);
                 goto out;
         }
 
         its_dev = its_create_device(its, dev_id, nvec, true);
-        if (!its_dev)
-                return -ENOMEM;
+        if (!its_dev) {
+                err = -ENOMEM;
+                goto out;
+        }
 
         pr_debug("ITT %d entries, %d bits\n", nvec, ilog2(nvec));
 out:
+        mutex_unlock(&its->dev_alloc_lock);
         info->scratchpad[0].ptr = its_dev;
-        return 0;
+        return err;
 }
 
 static struct msi_domain_ops its_msi_domain_ops = {
@@ -2566,6 +2628,7 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
 {
         struct irq_data *d = irq_domain_get_irq_data(domain, virq);
         struct its_device *its_dev = irq_data_get_irq_chip_data(d);
+        struct its_node *its = its_dev->its;
         int i;
 
         for (i = 0; i < nr_irqs; i++) {
@@ -2580,8 +2643,14 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
                 irq_domain_reset_irq_data(data);
         }
 
-        /* If all interrupts have been freed, start mopping the floor */
-        if (bitmap_empty(its_dev->event_map.lpi_map,
+        mutex_lock(&its->dev_alloc_lock);
+
+        /*
+         * If all interrupts have been freed, start mopping the
+         * floor. This is conditionned on the device not being shared.
+         */
+        if (!its_dev->shared &&
+            bitmap_empty(its_dev->event_map.lpi_map,
                          its_dev->event_map.nr_lpis)) {
                 its_lpi_free(its_dev->event_map.lpi_map,
                              its_dev->event_map.lpi_base,
@@ -2593,6 +2662,8 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
                 its_free_device(its_dev);
         }
 
+        mutex_unlock(&its->dev_alloc_lock);
+
         irq_domain_free_irqs_parent(domain, virq, nr_irqs);
 }
 
@@ -2755,26 +2826,11 @@ static void its_vpe_schedule(struct its_vpe *vpe)
 static void its_vpe_deschedule(struct its_vpe *vpe)
 {
         void __iomem *vlpi_base = gic_data_rdist_vlpi_base();
-        u32 count = 1000000;    /* 1s! */
-        bool clean;
         u64 val;
 
-        /* We're being scheduled out */
-        val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER);
-        val &= ~GICR_VPENDBASER_Valid;
-        gits_write_vpendbaser(val, vlpi_base + GICR_VPENDBASER);
-
-        do {
-                val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER);
-                clean = !(val & GICR_VPENDBASER_Dirty);
-                if (!clean) {
-                        count--;
-                        cpu_relax();
-                        udelay(1);
-                }
-        } while (!clean && count);
+        val = its_clear_vpend_valid(vlpi_base);
 
-        if (unlikely(!clean && !count)) {
+        if (unlikely(val & GICR_VPENDBASER_Dirty)) {
                 pr_err_ratelimited("ITS virtual pending table not cleaning\n");
                 vpe->idai = false;
                 vpe->pending_last = true;
@@ -3517,6 +3573,7 @@ static int __init its_probe_one(struct resource *res,
         }
 
         raw_spin_lock_init(&its->lock);
+        mutex_init(&its->dev_alloc_lock);
         INIT_LIST_HEAD(&its->entry);
         INIT_LIST_HEAD(&its->its_device_list);
         typer = gic_read_typer(its_base + GITS_TYPER);
diff --git a/drivers/irqchip/irq-mmp.c b/drivers/irqchip/irq-mmp.c
index 25f32e1d7764..3496b61a312a 100644
--- a/drivers/irqchip/irq-mmp.c
+++ b/drivers/irqchip/irq-mmp.c
@@ -34,6 +34,9 @@
 #define SEL_INT_PENDING         (1 << 6)
 #define SEL_INT_NUM_MASK        0x3f
 
+#define MMP2_ICU_INT_ROUTE_PJ4_IRQ      (1 << 5)
+#define MMP2_ICU_INT_ROUTE_PJ4_FIQ      (1 << 6)
+
 struct icu_chip_data {
         int                     nr_irqs;
         unsigned int            virq_base;
@@ -190,7 +193,8 @@ static const struct mmp_intc_conf mmp_conf = {
 static const struct mmp_intc_conf mmp2_conf = {
         .conf_enable    = 0x20,
         .conf_disable   = 0x0,
-        .conf_mask      = 0x7f,
+        .conf_mask      = MMP2_ICU_INT_ROUTE_PJ4_IRQ |
+                          MMP2_ICU_INT_ROUTE_PJ4_FIQ,
 };
 
 static void __exception_irq_entry mmp_handle_irq(struct pt_regs *regs)
diff --git a/drivers/irqchip/irq-xtensa-mx.c b/drivers/irqchip/irq-xtensa-mx.c
index 5385f5768345..27933338f7b3 100644
--- a/drivers/irqchip/irq-xtensa-mx.c
+++ b/drivers/irqchip/irq-xtensa-mx.c
@@ -71,14 +71,17 @@ static void xtensa_mx_irq_mask(struct irq_data *d)
         unsigned int mask = 1u << d->hwirq;
 
         if (mask & (XCHAL_INTTYPE_MASK_EXTERN_EDGE |
-                                XCHAL_INTTYPE_MASK_EXTERN_LEVEL)) {
-                set_er(1u << (xtensa_get_ext_irq_no(d->hwirq) -
-                                        HW_IRQ_MX_BASE), MIENG);
-        } else {
-                mask = __this_cpu_read(cached_irq_mask) & ~mask;
-                __this_cpu_write(cached_irq_mask, mask);
-                xtensa_set_sr(mask, intenable);
+                    XCHAL_INTTYPE_MASK_EXTERN_LEVEL)) {
+                unsigned int ext_irq = xtensa_get_ext_irq_no(d->hwirq);
+
+                if (ext_irq >= HW_IRQ_MX_BASE) {
+                        set_er(1u << (ext_irq - HW_IRQ_MX_BASE), MIENG);
+                        return;
+                }
         }
+        mask = __this_cpu_read(cached_irq_mask) & ~mask;
+        __this_cpu_write(cached_irq_mask, mask);
+        xtensa_set_sr(mask, intenable);
 }
 
 static void xtensa_mx_irq_unmask(struct irq_data *d)
@@ -86,14 +89,17 @@ static void xtensa_mx_irq_unmask(struct irq_data *d)
         unsigned int mask = 1u << d->hwirq;
 
         if (mask & (XCHAL_INTTYPE_MASK_EXTERN_EDGE |
-                                XCHAL_INTTYPE_MASK_EXTERN_LEVEL)) {
-                set_er(1u << (xtensa_get_ext_irq_no(d->hwirq) -
-                                        HW_IRQ_MX_BASE), MIENGSET);
-        } else {
-                mask |= __this_cpu_read(cached_irq_mask);
-                __this_cpu_write(cached_irq_mask, mask);
-                xtensa_set_sr(mask, intenable);
+                    XCHAL_INTTYPE_MASK_EXTERN_LEVEL)) {
+                unsigned int ext_irq = xtensa_get_ext_irq_no(d->hwirq);
+
+                if (ext_irq >= HW_IRQ_MX_BASE) {
+                        set_er(1u << (ext_irq - HW_IRQ_MX_BASE), MIENGSET);
+                        return;
+                }
         }
+        mask |= __this_cpu_read(cached_irq_mask);
+        __this_cpu_write(cached_irq_mask, mask);
+        xtensa_set_sr(mask, intenable);
 }
 
 static void xtensa_mx_irq_enable(struct irq_data *d)
@@ -113,7 +119,11 @@ static void xtensa_mx_irq_ack(struct irq_data *d)
 
 static int xtensa_mx_irq_retrigger(struct irq_data *d)
 {
-        xtensa_set_sr(1 << d->hwirq, intset);
+        unsigned int mask = 1u << d->hwirq;
+
+        if (WARN_ON(mask & ~XCHAL_INTTYPE_MASK_SOFTWARE))
+                return 0;
+        xtensa_set_sr(mask, intset);
         return 1;
 }
 
diff --git a/drivers/irqchip/irq-xtensa-pic.c b/drivers/irqchip/irq-xtensa-pic.c
index c200234dd2c9..ab12328be5ee 100644
--- a/drivers/irqchip/irq-xtensa-pic.c
+++ b/drivers/irqchip/irq-xtensa-pic.c
@@ -70,7 +70,11 @@ static void xtensa_irq_ack(struct irq_data *d)
 
 static int xtensa_irq_retrigger(struct irq_data *d)
 {
-        xtensa_set_sr(1 << d->hwirq, intset);
+        unsigned int mask = 1u << d->hwirq;
+
+        if (WARN_ON(mask & ~XCHAL_INTTYPE_MASK_SOFTWARE))
+                return 0;
+        xtensa_set_sr(mask, intset);
         return 1;
 }
 
diff --git a/drivers/isdn/mISDN/timerdev.c b/drivers/isdn/mISDN/timerdev.c
index 211ed6cffd10..578978711887 100644
--- a/drivers/isdn/mISDN/timerdev.c
+++ b/drivers/isdn/mISDN/timerdev.c
@@ -170,8 +170,8 @@ dev_expire_timer(struct timer_list *t)
         spin_lock_irqsave(&timer->dev->lock, flags);
         if (timer->id >= 0)
                 list_move_tail(&timer->list, &timer->dev->expired);
-        spin_unlock_irqrestore(&timer->dev->lock, flags);
         wake_up_interruptible(&timer->dev->wait);
+        spin_unlock_irqrestore(&timer->dev->lock, flags);
 }
 
 static int
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 47d4e0d30bf0..dd538e6b2748 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -932,7 +932,7 @@ static int dm_crypt_integrity_io_alloc(struct dm_crypt_io *io, struct bio *bio)
         if (IS_ERR(bip))
                 return PTR_ERR(bip);
 
-        tag_len = io->cc->on_disk_tag_size * bio_sectors(bio);
+        tag_len = io->cc->on_disk_tag_size * (bio_sectors(bio) >> io->cc->sector_shift);
 
         bip->bip_iter.bi_size = tag_len;
         bip->bip_iter.bi_sector = io->cc->start + io->sector;
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 4eb5f8c56535..a20531e5f3b4 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -131,7 +131,7 @@ static void rq_end_stats(struct mapped_device *md, struct request *orig)
 static void rq_completed(struct mapped_device *md)
 {
         /* nudge anyone waiting on suspend queue */
-        if (unlikely(waitqueue_active(&md->wait)))
+        if (unlikely(wq_has_sleeper(&md->wait)))
                 wake_up(&md->wait);
 
         /*
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index ca8af21bf644..e83b63608262 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -257,6 +257,7 @@ struct pool {
 
         spinlock_t lock;
         struct bio_list deferred_flush_bios;
+        struct bio_list deferred_flush_completions;
         struct list_head prepared_mappings;
         struct list_head prepared_discards;
         struct list_head prepared_discards_pt2;
@@ -956,6 +957,39 @@ static void process_prepared_mapping_fail(struct dm_thin_new_mapping *m)
         mempool_free(m, &m->tc->pool->mapping_pool);
 }
 
+static void complete_overwrite_bio(struct thin_c *tc, struct bio *bio)
+{
+        struct pool *pool = tc->pool;
+        unsigned long flags;
+
+        /*
+         * If the bio has the REQ_FUA flag set we must commit the metadata
+         * before signaling its completion.
+         */
+        if (!bio_triggers_commit(tc, bio)) {
+                bio_endio(bio);
+                return;
+        }
+
+        /*
+         * Complete bio with an error if earlier I/O caused changes to the
+         * metadata that can't be committed, e.g, due to I/O errors on the
+         * metadata device.
+         */
+        if (dm_thin_aborted_changes(tc->td)) {
+                bio_io_error(bio);
+                return;
+        }
+
+        /*
+         * Batch together any bios that trigger commits and then issue a
+         * single commit for them in process_deferred_bios().
+         */
+        spin_lock_irqsave(&pool->lock, flags);
+        bio_list_add(&pool->deferred_flush_completions, bio);
+        spin_unlock_irqrestore(&pool->lock, flags);
+}
+
 static void process_prepared_mapping(struct dm_thin_new_mapping *m)
 {
         struct thin_c *tc = m->tc;
@@ -988,7 +1022,7 @@ static void process_prepared_mapping(struct dm_thin_new_mapping *m)
          */
         if (bio) {
                 inc_remap_and_issue_cell(tc, m->cell, m->data_block);
-                bio_endio(bio);
+                complete_overwrite_bio(tc, bio);
         } else {
                 inc_all_io_entry(tc->pool, m->cell->holder);
                 remap_and_issue(tc, m->cell->holder, m->data_block);
@@ -2317,7 +2351,7 @@ static void process_deferred_bios(struct pool *pool)
 {
         unsigned long flags;
         struct bio *bio;
-        struct bio_list bios;
+        struct bio_list bios, bio_completions;
         struct thin_c *tc;
 
         tc = get_first_thin(pool);
@@ -2328,26 +2362,36 @@ static void process_deferred_bios(struct pool *pool)
         }
 
         /*
-         * If there are any deferred flush bios, we must commit
-         * the metadata before issuing them.
+         * If there are any deferred flush bios, we must commit the metadata
+         * before issuing them or signaling their completion.
          */
         bio_list_init(&bios);
+        bio_list_init(&bio_completions);
+
         spin_lock_irqsave(&pool->lock, flags);
         bio_list_merge(&bios, &pool->deferred_flush_bios);
         bio_list_init(&pool->deferred_flush_bios);
+
+        bio_list_merge(&bio_completions, &pool->deferred_flush_completions);
+        bio_list_init(&pool->deferred_flush_completions);
         spin_unlock_irqrestore(&pool->lock, flags);
 
-        if (bio_list_empty(&bios) &&
+        if (bio_list_empty(&bios) && bio_list_empty(&bio_completions) &&
             !(dm_pool_changed_this_transaction(pool->pmd) && need_commit_due_to_time(pool)))
                 return;
 
         if (commit(pool)) {
+                bio_list_merge(&bios, &bio_completions);
+
                 while ((bio = bio_list_pop(&bios)))
                         bio_io_error(bio);
                 return;
         }
         pool->last_commit_jiffies = jiffies;
 
+        while ((bio = bio_list_pop(&bio_completions)))
+                bio_endio(bio);
+
         while ((bio = bio_list_pop(&bios)))
                 generic_make_request(bio);
 }
@@ -2954,6 +2998,7 @@ static struct pool *pool_create(struct mapped_device *pool_md,
         INIT_DELAYED_WORK(&pool->no_space_timeout, do_no_space_timeout);
         spin_lock_init(&pool->lock);
         bio_list_init(&pool->deferred_flush_bios);
+        bio_list_init(&pool->deferred_flush_completions);
         INIT_LIST_HEAD(&pool->prepared_mappings);
         INIT_LIST_HEAD(&pool->prepared_discards);
         INIT_LIST_HEAD(&pool->prepared_discards_pt2);
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 2b53c3841b53..515e6af9bed2 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -699,7 +699,7 @@ static void end_io_acct(struct dm_io *io)
                                     true, duration, &io->stats_aux);
 
         /* nudge anyone waiting on suspend queue */
-        if (unlikely(waitqueue_active(&md->wait)))
+        if (unlikely(wq_has_sleeper(&md->wait)))
                 wake_up(&md->wait);
 }
 
@@ -1336,7 +1336,11 @@ static int clone_bio(struct dm_target_io *tio, struct bio *bio,
                         return r;
         }
 
-        bio_trim(clone, sector - clone->bi_iter.bi_sector, len);
+        bio_advance(clone, to_bytes(sector - clone->bi_iter.bi_sector));
+        clone->bi_iter.bi_size = to_bytes(len);
+
+        if (bio_integrity(bio))
+                bio_integrity_trim(clone);
 
         return 0;
 }
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index f461460a2aeb..76f9909cf396 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -1419,7 +1419,7 @@ config MFD_TPS65217
 
 config MFD_TPS68470
         bool "TI TPS68470 Power Management / LED chips"
-        depends on ACPI && I2C=y
+        depends on ACPI && PCI && I2C=y
         select MFD_CORE
         select REGMAP_I2C
         select I2C_DESIGNWARE_PLATFORM
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 1fc8ea0f519b..ca4c9cc218a2 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -401,8 +401,11 @@ static void mei_io_list_flush_cl(struct list_head *head,
         struct mei_cl_cb *cb, *next;
 
         list_for_each_entry_safe(cb, next, head, list) {
-                if (cl == cb->cl)
+                if (cl == cb->cl) {
                         list_del_init(&cb->list);
+                        if (cb->fop_type == MEI_FOP_READ)
+                                mei_io_cb_free(cb);
+                }
         }
 }
 
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index 23739a60517f..bb1ee9834a02 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -139,6 +139,8 @@
 #define MEI_DEV_ID_CNP_H      0xA360  /* Cannon Point H */
 #define MEI_DEV_ID_CNP_H_4    0xA364  /* Cannon Point H 4 (iTouch) */
 
+#define MEI_DEV_ID_ICP_LP     0x34E0  /* Ice Lake Point LP */
+
 /*
  * MEI HW Section
  */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index e89497f858ae..3ab946ad3257 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -105,6 +105,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
         {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH12_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)},
 
+        {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
+
         /* required last entry */
         {0, }
 };
diff --git a/drivers/misc/mic/vop/vop_main.c b/drivers/misc/mic/vop/vop_main.c
index 2bfa3a903bf9..744757f541be 100644
--- a/drivers/misc/mic/vop/vop_main.c
+++ b/drivers/misc/mic/vop/vop_main.c
@@ -47,7 +47,8 @@
  * @dc: Virtio device control
  * @vpdev: VOP device which is the parent for this virtio device
  * @vr: Buffer for accessing the VRING
- * @used: Buffer for used
+ * @used_virt: Virtual address of used ring
+ * @used: DMA address of used ring
  * @used_size: Size of the used buffer
  * @reset_done: Track whether VOP reset is complete
  * @virtio_cookie: Cookie returned upon requesting a interrupt
@@ -61,6 +62,7 @@ struct _vop_vdev {
         struct mic_device_ctrl __iomem *dc;
         struct vop_device *vpdev;
         void __iomem *vr[VOP_MAX_VRINGS];
+        void *used_virt[VOP_MAX_VRINGS];
         dma_addr_t used[VOP_MAX_VRINGS];
         int used_size[VOP_MAX_VRINGS];
         struct completion reset_done;
@@ -260,12 +262,12 @@ static bool vop_notify(struct virtqueue *vq)
 static void vop_del_vq(struct virtqueue *vq, int n)
 {
         struct _vop_vdev *vdev = to_vopvdev(vq->vdev);
-        struct vring *vr = (struct vring *)(vq + 1);
         struct vop_device *vpdev = vdev->vpdev;
 
         dma_unmap_single(&vpdev->dev, vdev->used[n],
                          vdev->used_size[n], DMA_BIDIRECTIONAL);
-        free_pages((unsigned long)vr->used, get_order(vdev->used_size[n]));
+        free_pages((unsigned long)vdev->used_virt[n],
+                   get_order(vdev->used_size[n]));
         vring_del_virtqueue(vq);
         vpdev->hw_ops->iounmap(vpdev, vdev->vr[n]);
         vdev->vr[n] = NULL;
@@ -283,6 +285,26 @@ static void vop_del_vqs(struct virtio_device *dev)
                 vop_del_vq(vq, idx++);
 }
 
+static struct virtqueue *vop_new_virtqueue(unsigned int index,
+                                      unsigned int num,
+                                      struct virtio_device *vdev,
+                                      bool context,
+                                      void *pages,
+                                      bool (*notify)(struct virtqueue *vq),
+                                      void (*callback)(struct virtqueue *vq),
+                                      const char *name,
+                                      void *used)
+{
+        bool weak_barriers = false;
+        struct vring vring;
+
+        vring_init(&vring, num, pages, MIC_VIRTIO_RING_ALIGN);
+        vring.used = used;
+
+        return __vring_new_virtqueue(index, vring, vdev, weak_barriers, context,
+                                     notify, callback, name);
+}
+
 /*
  * This routine will assign vring's allocated in host/io memory. Code in
  * virtio_ring.c however continues to access this io memory as if it were local
@@ -302,7 +324,6 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
         struct _mic_vring_info __iomem *info;
         void *used;
         int vr_size, _vr_size, err, magic;
-        struct vring *vr;
         u8 type = ioread8(&vdev->desc->type);
 
         if (index >= ioread8(&vdev->desc->num_vq))
@@ -322,17 +343,7 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
                 return ERR_PTR(-ENOMEM);
         vdev->vr[index] = va;
         memset_io(va, 0x0, _vr_size);
-        vq = vring_new_virtqueue(
-                                index,
-                                le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN,
-                                dev,
-                                false,
-                                ctx,
-                                (void __force *)va, vop_notify, callback, name);
-        if (!vq) {
-                err = -ENOMEM;
-                goto unmap;
-        }
+
         info = va + _vr_size;
         magic = ioread32(&info->magic);
 
@@ -341,18 +352,27 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
                 goto unmap;
         }
 
-        /* Allocate and reassign used ring now */
         vdev->used_size[index] = PAGE_ALIGN(sizeof(__u16) * 3 +
                                              sizeof(struct vring_used_elem) *
                                              le16_to_cpu(config.num));
         used = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
                                         get_order(vdev->used_size[index]));
+        vdev->used_virt[index] = used;
         if (!used) {
                 err = -ENOMEM;
                 dev_err(_vop_dev(vdev), "%s %d err %d\n",
                         __func__, __LINE__, err);
-                goto del_vq;
+                goto unmap;
+        }
+
+        vq = vop_new_virtqueue(index, le16_to_cpu(config.num), dev, ctx,
+                               (void __force *)va, vop_notify, callback,
+                               name, used);
+        if (!vq) {
+                err = -ENOMEM;
+                goto free_used;
         }
+
         vdev->used[index] = dma_map_single(&vpdev->dev, used,
                                             vdev->used_size[index],
                                             DMA_BIDIRECTIONAL);
@@ -360,26 +380,17 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
                 err = -ENOMEM;
                 dev_err(_vop_dev(vdev), "%s %d err %d\n",
                         __func__, __LINE__, err);
-                goto free_used;
+                goto del_vq;
         }
         writeq(vdev->used[index], &vqconfig->used_address);
-        /*
-         * To reassign the used ring here we are directly accessing
-         * struct vring_virtqueue which is a private data structure
-         * in virtio_ring.c. At the minimum, a BUILD_BUG_ON() in
-         * vring_new_virtqueue() would ensure that
-         *  (&vq->vring == (struct vring *) (&vq->vq + 1));
-         */
-        vr = (struct vring *)(vq + 1);
-        vr->used = used;
 
         vq->priv = vdev;
         return vq;
+del_vq:
+        vring_del_virtqueue(vq);
 free_used:
         free_pages((unsigned long)used,
                    get_order(vdev->used_size[index]));
-del_vq:
-        vring_del_virtqueue(vq);
 unmap:
         vpdev->hw_ops->iounmap(vpdev, vdev->vr[index]);
         return ERR_PTR(err);
@@ -581,6 +592,8 @@ static int _vop_remove_device(struct mic_device_desc __iomem *d,
         int ret = -1;
 
         if (ioread8(&dc->config_change) == MIC_VIRTIO_PARAM_DEV_REMOVE) {
+                struct device *dev = get_device(&vdev->vdev.dev);
+
                 dev_dbg(&vpdev->dev,
                         "%s %d config_change %d type %d vdev %p\n",
                         __func__, __LINE__,
@@ -592,7 +605,7 @@ static int _vop_remove_device(struct mic_device_desc __iomem *d,
                 iowrite8(-1, &dc->h2c_vdev_db);
                 if (status & VIRTIO_CONFIG_S_DRIVER_OK)
                         wait_for_completion(&vdev->reset_done);
-                put_device(&vdev->vdev.dev);
+                put_device(dev);
                 iowrite8(1, &dc->guest_ack);
                 dev_dbg(&vpdev->dev, "%s %d guest_ack %d\n",
                         __func__, __LINE__, ioread8(&dc->guest_ack));
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index aef1185f383d..14f3fdb8c6bb 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -2112,7 +2112,7 @@ static void mmc_blk_mq_req_done(struct mmc_request *mrq)
                 if (waiting)
                         wake_up(&mq->wait);
                 else
-                        kblockd_schedule_work(&mq->complete_work);
+                        queue_work(mq->card->complete_wq, &mq->complete_work);
 
                 return;
         }
@@ -2924,6 +2924,13 @@ static int mmc_blk_probe(struct mmc_card *card)
 
         mmc_fixup_device(card, mmc_blk_fixups);
 
+        card->complete_wq = alloc_workqueue("mmc_complete",
+                                        WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
+        if (unlikely(!card->complete_wq)) {
+                pr_err("Failed to create mmc completion workqueue");
+                return -ENOMEM;
+        }
+
         md = mmc_blk_alloc(card);
         if (IS_ERR(md))
                 return PTR_ERR(md);
@@ -2987,6 +2994,7 @@ static void mmc_blk_remove(struct mmc_card *card)
         pm_runtime_put_noidle(&card->dev);
         mmc_blk_remove_req(md);
         dev_set_drvdata(&card->dev, NULL);
+        destroy_workqueue(card->complete_wq);
 }
 
 static int _mmc_blk_suspend(struct mmc_card *card)
diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c
index 50293529d6de..c9e7aa50bb0a 100644
--- a/drivers/mmc/host/bcm2835.c
+++ b/drivers/mmc/host/bcm2835.c
@@ -1431,6 +1431,8 @@ static int bcm2835_probe(struct platform_device *pdev)
 
 err:
         dev_dbg(dev, "%s -> err %d\n", __func__, ret);
+        if (host->dma_chan_rxtx)
+                dma_release_channel(host->dma_chan_rxtx);
         mmc_free_host(mmc);
 
         return ret;
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index f19ec60bcbdc..2eba507790e4 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -1338,7 +1338,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
                host->regs + SD_EMMC_IRQ_EN);
 
         ret = request_threaded_irq(host->irq, meson_mmc_irq,
-                        meson_mmc_irq_thread, IRQF_SHARED, NULL, host);
+                                   meson_mmc_irq_thread, IRQF_SHARED,
+                                   dev_name(&pdev->dev), host);
         if (ret)
                 goto err_init_clk;
 
diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
index 8afeaf81ae66..833ef0590af8 100644
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -846,7 +846,7 @@ static void msdc_set_mclk(struct msdc_host *host, unsigned char timing, u32 hz)
 
         if (timing == MMC_TIMING_MMC_HS400 &&
             host->dev_comp->hs400_tune)
-                sdr_set_field(host->base + PAD_CMD_TUNE,
+                sdr_set_field(host->base + tune_reg,
                               MSDC_PAD_TUNE_CMDRRDLY,
                               host->hs400_cmd_int_delay);
         dev_dbg(host->dev, "sclk: %d, timing: %d\n", host->mmc->actual_clock,
diff --git a/drivers/mmc/host/sunxi-mmc.c b/drivers/mmc/host/sunxi-mmc.c
index 279e326e397e..70fadc976795 100644
--- a/drivers/mmc/host/sunxi-mmc.c
+++ b/drivers/mmc/host/sunxi-mmc.c
@@ -1399,13 +1399,37 @@ static int sunxi_mmc_probe(struct platform_device *pdev)
         mmc->caps              |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
                                   MMC_CAP_ERASE | MMC_CAP_SDIO_IRQ;
 
-        if (host->cfg->clk_delays || host->use_new_timings)
+        /*
+         * Some H5 devices do not have signal traces precise enough to
+         * use HS DDR mode for their eMMC chips.
+         *
+         * We still enable HS DDR modes for all the other controller
+         * variants that support them.
+         */
+        if ((host->cfg->clk_delays || host->use_new_timings) &&
+            !of_device_is_compatible(pdev->dev.of_node,
+                                     "allwinner,sun50i-h5-emmc"))
                 mmc->caps      |= MMC_CAP_1_8V_DDR | MMC_CAP_3_3V_DDR;
 
         ret = mmc_of_parse(mmc);
         if (ret)
                 goto error_free_dma;
 
+        /*
+         * If we don't support delay chains in the SoC, we can't use any
+         * of the higher speed modes. Mask them out in case the device
+         * tree specifies the properties for them, which gets added to
+         * the caps by mmc_of_parse() above.
+         */
+        if (!(host->cfg->clk_delays || host->use_new_timings)) {
+                mmc->caps &= ~(MMC_CAP_3_3V_DDR | MMC_CAP_1_8V_DDR |
+                               MMC_CAP_1_2V_DDR | MMC_CAP_UHS);
+                mmc->caps2 &= ~MMC_CAP2_HS200;
+        }
+
+        /* TODO: This driver doesn't support HS400 mode yet */
+        mmc->caps2 &= ~MMC_CAP2_HS400;
+
         ret = sunxi_mmc_init_host(host);
         if (ret)
                 goto error_free_dma;
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 60104e1079c5..37f174ccbcec 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -480,6 +480,10 @@ static struct mtd_part *allocate_partition(struct mtd_info *parent,
                 /* let's register it anyway to preserve ordering */
                 slave->offset = 0;
                 slave->mtd.size = 0;
+
+                /* Initialize ->erasesize to make add_mtd_device() happy. */
+                slave->mtd.erasesize = parent->erasesize;
+
                 printk(KERN_ERR"mtd: partition \"%s\" is out of reach -- disabled\n",
                         part->name);
                 goto out_register;
@@ -632,7 +636,6 @@ err_remove_part:
         mutex_unlock(&mtd_partitions_mutex);
 
         free_partition(new);
-        pr_info("%s:%i\n", __func__, __LINE__);
 
         return ret;
 }
diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c
index bd4cfac6b5aa..a4768df5083f 100644
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c
@@ -155,9 +155,10 @@ int gpmi_init(struct gpmi_nand_data *this)
 
         /*
          * Reset BCH here, too. We got failures otherwise :(
-         * See later BCH reset for explanation of MX23 handling
+         * See later BCH reset for explanation of MX23 and MX28 handling
          */
-        ret = gpmi_reset_block(r->bch_regs, GPMI_IS_MX23(this));
+        ret = gpmi_reset_block(r->bch_regs,
+                               GPMI_IS_MX23(this) || GPMI_IS_MX28(this));
         if (ret)
                 goto err_out;
 
@@ -263,12 +264,10 @@ int bch_set_geometry(struct gpmi_nand_data *this)
         /*
         * Due to erratum #2847 of the MX23, the BCH cannot be soft reset on this
         * chip, otherwise it will lock up. So we skip resetting BCH on the MX23.
-        * On the other hand, the MX28 needs the reset, because one case has been
-        * seen where the BCH produced ECC errors constantly after 10000
-        * consecutive reboots. The latter case has not been seen on the MX23
-        * yet, still we don't know if it could happen there as well.
+        * and MX28.
         */
-        ret = gpmi_reset_block(r->bch_regs, GPMI_IS_MX23(this));
+        ret = gpmi_reset_block(r->bch_regs,
+                               GPMI_IS_MX23(this) || GPMI_IS_MX28(this));
         if (ret)
                 goto err_out;
 
diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
index cca4b24d2ffa..839494ac457c 100644
--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -410,6 +410,7 @@ static int nand_check_wp(struct nand_chip *chip)
 
 /**
  * nand_fill_oob - [INTERN] Transfer client buffer to oob
+ * @chip: NAND chip object
  * @oob: oob data buffer
  * @len: oob data write length
  * @ops: oob ops structure
diff --git a/drivers/mtd/nand/raw/nand_bbt.c b/drivers/mtd/nand/raw/nand_bbt.c
index 1b722fe9213c..19a2b563acdf 100644
--- a/drivers/mtd/nand/raw/nand_bbt.c
+++ b/drivers/mtd/nand/raw/nand_bbt.c
@@ -158,7 +158,7 @@ static u32 add_marker_len(struct nand_bbt_descr *td)
 
 /**
  * read_bbt - [GENERIC] Read the bad block table starting from page
- * @chip: NAND chip object
+ * @this: NAND chip object
  * @buf: temporary buffer
  * @page: the starting page
  * @num: the number of bbt descriptors to read
diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
index 479c2f2cf17f..fa87ae28cdfe 100644
--- a/drivers/mtd/nand/spi/core.c
+++ b/drivers/mtd/nand/spi/core.c
@@ -304,24 +304,30 @@ static int spinand_write_to_cache_op(struct spinand_device *spinand,
         struct nand_device *nand = spinand_to_nand(spinand);
         struct mtd_info *mtd = nanddev_to_mtd(nand);
         struct nand_page_io_req adjreq = *req;
-        unsigned int nbytes = 0;
-        void *buf = NULL;
+        void *buf = spinand->databuf;
+        unsigned int nbytes;
         u16 column = 0;
         int ret;
 
-        memset(spinand->databuf, 0xff,
-               nanddev_page_size(nand) +
-               nanddev_per_page_oobsize(nand));
+        /*
+         * Looks like PROGRAM LOAD (AKA write cache) does not necessarily reset
+         * the cache content to 0xFF (depends on vendor implementation), so we
+         * must fill the page cache entirely even if we only want to program
+         * the data portion of the page, otherwise we might corrupt the BBM or
+         * user data previously programmed in OOB area.
+         */
+        nbytes = nanddev_page_size(nand) + nanddev_per_page_oobsize(nand);
+        memset(spinand->databuf, 0xff, nbytes);
+        adjreq.dataoffs = 0;
+        adjreq.datalen = nanddev_page_size(nand);
+        adjreq.databuf.out = spinand->databuf;
+        adjreq.ooblen = nanddev_per_page_oobsize(nand);
+        adjreq.ooboffs = 0;
+        adjreq.oobbuf.out = spinand->oobbuf;
 
-        if (req->datalen) {
+        if (req->datalen)
                 memcpy(spinand->databuf + req->dataoffs, req->databuf.out,
                        req->datalen);
-                adjreq.dataoffs = 0;
-                adjreq.datalen = nanddev_page_size(nand);
-                adjreq.databuf.out = spinand->databuf;
-                nbytes = adjreq.datalen;
-                buf = spinand->databuf;
-        }
 
         if (req->ooblen) {
                 if (req->mode == MTD_OPS_AUTO_OOB)
@@ -332,14 +338,6 @@ static int spinand_write_to_cache_op(struct spinand_device *spinand,
                 else
                         memcpy(spinand->oobbuf + req->ooboffs, req->oobbuf.out,
                                req->ooblen);
-
-                adjreq.ooblen = nanddev_per_page_oobsize(nand);
-                adjreq.ooboffs = 0;
-                nbytes += nanddev_per_page_oobsize(nand);
-                if (!buf) {
-                        buf = spinand->oobbuf;
-                        column = nanddev_page_size(nand);
-                }
         }
 
         spinand_cache_op_adjust_colum(spinand, &adjreq, &column);
@@ -370,8 +368,8 @@ static int spinand_write_to_cache_op(struct spinand_device *spinand,
 
                 /*
                  * We need to use the RANDOM LOAD CACHE operation if there's
-                 * more than one iteration, because the LOAD operation resets
-                 * the cache to 0xff.
+                 * more than one iteration, because the LOAD operation might
+                 * reset the cache to 0xff.
                  */
                 if (nbytes) {
                         column = op.addr.val;
@@ -1018,11 +1016,11 @@ static int spinand_init(struct spinand_device *spinand)
         for (i = 0; i < nand->memorg.ntargets; i++) {
                 ret = spinand_select_target(spinand, i);
                 if (ret)
-                        goto err_free_bufs;
+                        goto err_manuf_cleanup;
 
                 ret = spinand_lock_block(spinand, BL_ALL_UNLOCKED);
                 if (ret)
-                        goto err_free_bufs;
+                        goto err_manuf_cleanup;
         }
 
         ret = nanddev_init(nand, &spinand_ops, THIS_MODULE);
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index edb1c023a753..21bf8ac78380 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -197,9 +197,9 @@ config VXLAN
 
 config GENEVE
        tristate "Generic Network Virtualization Encapsulation"
-       depends on INET && NET_UDP_TUNNEL
+       depends on INET
        depends on IPV6 || !IPV6
-       select NET_IP_TUNNEL
+       select NET_UDP_TUNNEL
        select GRO_CELLS
        ---help---
           This allows one to create geneve virtual interfaces that provide
diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
index a0f954f36c09..44e6c7b1b222 100644
--- a/drivers/net/caif/caif_serial.c
+++ b/drivers/net/caif/caif_serial.c
@@ -257,10 +257,7 @@ static int handle_tx(struct ser_device *ser)
                 if (skb->len == 0) {
                         struct sk_buff *tmp = skb_dequeue(&ser->head);
                         WARN_ON(tmp != skb);
-                        if (in_interrupt())
-                                dev_kfree_skb_irq(skb);
-                        else
-                                kfree_skb(skb);
+                        dev_consume_skb_any(skb);
                 }
         }
         /* Send flow off if queue is empty */
diff --git a/drivers/net/dsa/b53/b53_srab.c b/drivers/net/dsa/b53/b53_srab.c
index 90f514252987..d9c56a779c08 100644
--- a/drivers/net/dsa/b53/b53_srab.c
+++ b/drivers/net/dsa/b53/b53_srab.c
@@ -511,9 +511,6 @@ static void b53_srab_prepare_irq(struct platform_device *pdev)
         /* Clear all pending interrupts */
         writel(0xffffffff, priv->regs + B53_SRAB_INTR);
 
-        if (dev->pdata && dev->pdata->chip_id != BCM58XX_DEVICE_ID)
-                return;
-
         for (i = 0; i < B53_N_PORTS; i++) {
                 port = &priv->port_intrs[i];
 
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index 361fbde76654..17ec32b0a1cc 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -690,7 +690,7 @@ static int bcm_sf2_sw_suspend(struct dsa_switch *ds)
          * port, the other ones have already been disabled during
          * bcm_sf2_sw_setup
          */
-        for (port = 0; port < DSA_MAX_PORTS; port++) {
+        for (port = 0; port < ds->num_ports; port++) {
                 if (dsa_is_user_port(ds, port) || dsa_is_cpu_port(ds, port))
                         bcm_sf2_port_disable(ds, port, NULL);
         }
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 8dca2c949e73..12fd7ce3f1ff 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -261,6 +261,7 @@ static irqreturn_t mv88e6xxx_g1_irq_thread_work(struct mv88e6xxx_chip *chip)
         unsigned int sub_irq;
         unsigned int n;
         u16 reg;
+        u16 ctl1;
         int err;
 
         mutex_lock(&chip->reg_lock);
@@ -270,13 +271,28 @@ static irqreturn_t mv88e6xxx_g1_irq_thread_work(struct mv88e6xxx_chip *chip)
         if (err)
                 goto out;
 
-        for (n = 0; n < chip->g1_irq.nirqs; ++n) {
-                if (reg & (1 << n)) {
-                        sub_irq = irq_find_mapping(chip->g1_irq.domain, n);
-                        handle_nested_irq(sub_irq);
-                        ++nhandled;
+        do {
+                for (n = 0; n < chip->g1_irq.nirqs; ++n) {
+                        if (reg & (1 << n)) {
+                                sub_irq = irq_find_mapping(chip->g1_irq.domain,
+                                                           n);
+                                handle_nested_irq(sub_irq);
+                                ++nhandled;
+                        }
                 }
-        }
+
+                mutex_lock(&chip->reg_lock);
+                err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, &ctl1);
+                if (err)
+                        goto unlock;
+                err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_STS, &reg);
+unlock:
+                mutex_unlock(&chip->reg_lock);
+                if (err)
+                        goto out;
+                ctl1 &= GENMASK(chip->g1_irq.nirqs, 0);
+        } while (reg & ctl1);
+
 out:
         return (nhandled > 0 ? IRQ_HANDLED : IRQ_NONE);
 }
diff --git a/drivers/net/dsa/mv88e6xxx/global1_atu.c b/drivers/net/dsa/mv88e6xxx/global1_atu.c
index 5200e4bdce93..ea243840ee0f 100644
--- a/drivers/net/dsa/mv88e6xxx/global1_atu.c
+++ b/drivers/net/dsa/mv88e6xxx/global1_atu.c
@@ -314,6 +314,7 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id)
 {
         struct mv88e6xxx_chip *chip = dev_id;
         struct mv88e6xxx_atu_entry entry;
+        int spid;
         int err;
         u16 val;
 
@@ -336,6 +337,8 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id)
         if (err)
                 goto out;
 
+        spid = entry.state;
+
         if (val & MV88E6XXX_G1_ATU_OP_AGE_OUT_VIOLATION) {
                 dev_err_ratelimited(chip->dev,
                                     "ATU age out violation for %pM\n",
@@ -344,23 +347,23 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id)
 
         if (val & MV88E6XXX_G1_ATU_OP_MEMBER_VIOLATION) {
                 dev_err_ratelimited(chip->dev,
-                                    "ATU member violation for %pM portvec %x\n",
-                                    entry.mac, entry.portvec);
-                chip->ports[entry.portvec].atu_member_violation++;
+                                    "ATU member violation for %pM portvec %x spid %d\n",
+                                    entry.mac, entry.portvec, spid);
+                chip->ports[spid].atu_member_violation++;
         }
 
         if (val & MV88E6XXX_G1_ATU_OP_MISS_VIOLATION) {
                 dev_err_ratelimited(chip->dev,
-                                    "ATU miss violation for %pM portvec %x\n",
-                                    entry.mac, entry.portvec);
-                chip->ports[entry.portvec].atu_miss_violation++;
+                                    "ATU miss violation for %pM portvec %x spid %d\n",
+                                    entry.mac, entry.portvec, spid);
+                chip->ports[spid].atu_miss_violation++;
         }
 
         if (val & MV88E6XXX_G1_ATU_OP_FULL_VIOLATION) {
                 dev_err_ratelimited(chip->dev,
-                                    "ATU full violation for %pM portvec %x\n",
-                                    entry.mac, entry.portvec);
-                chip->ports[entry.portvec].atu_full_violation++;
+                                    "ATU full violation for %pM portvec %x spid %d\n",
+                                    entry.mac, entry.portvec, spid);
+                chip->ports[spid].atu_full_violation++;
         }
         mutex_unlock(&chip->reg_lock);
 
diff --git a/drivers/net/dsa/mv88e6xxx/serdes.c b/drivers/net/dsa/mv88e6xxx/serdes.c
index 2caa8c8b4b55..1bfc5ff8d81d 100644
--- a/drivers/net/dsa/mv88e6xxx/serdes.c
+++ b/drivers/net/dsa/mv88e6xxx/serdes.c
@@ -664,7 +664,7 @@ int mv88e6390_serdes_irq_setup(struct mv88e6xxx_chip *chip, int port)
         if (port < 9)
                 return 0;
 
-        return mv88e6390_serdes_irq_setup(chip, port);
+        return mv88e6390x_serdes_irq_setup(chip, port);
 }
 
 void mv88e6390x_serdes_irq_free(struct mv88e6xxx_chip *chip, int port)
diff --git a/drivers/net/ethernet/alteon/acenic.c b/drivers/net/ethernet/alteon/acenic.c
index 4f11f98347ed..1827ef1f6d55 100644
--- a/drivers/net/ethernet/alteon/acenic.c
+++ b/drivers/net/ethernet/alteon/acenic.c
@@ -2059,7 +2059,7 @@ static inline void ace_tx_int(struct net_device *dev,
                 if (skb) {
                         dev->stats.tx_packets++;
                         dev->stats.tx_bytes += skb->len;
-                        dev_kfree_skb_irq(skb);
+                        dev_consume_skb_irq(skb);
                         info->skb = NULL;
                 }
 
diff --git a/drivers/net/ethernet/altera/altera_msgdma.c b/drivers/net/ethernet/altera/altera_msgdma.c
index 0fb986ba3290..0ae723f75341 100644
--- a/drivers/net/ethernet/altera/altera_msgdma.c
+++ b/drivers/net/ethernet/altera/altera_msgdma.c
@@ -145,7 +145,8 @@ u32 msgdma_tx_completions(struct altera_tse_private *priv)
                         & 0xffff;
 
         if (inuse) { /* Tx FIFO is not empty */
-                ready = priv->tx_prod - priv->tx_cons - inuse - 1;
+                ready = max_t(int,
+                              priv->tx_prod - priv->tx_cons - inuse - 1, 0);
         } else {
                 /* Check for buffered last packet */
                 status = csrrd32(priv->tx_dma_csr, msgdma_csroffs(status));
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index a70bb1bb90e7..a6eacf2099c3 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -2663,11 +2663,6 @@ static int ena_restore_device(struct ena_adapter *adapter)
                 goto err_device_destroy;
         }
 
-        clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags);
-        /* Make sure we don't have a race with AENQ Links state handler */
-        if (test_bit(ENA_FLAG_LINK_UP, &adapter->flags))
-                netif_carrier_on(adapter->netdev);
-
         rc = ena_enable_msix_and_set_admin_interrupts(adapter,
                                                       adapter->num_queues);
         if (rc) {
@@ -2684,6 +2679,11 @@ static int ena_restore_device(struct ena_adapter *adapter)
         }
 
         set_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags);
+
+        clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags);
+        if (test_bit(ENA_FLAG_LINK_UP, &adapter->flags))
+                netif_carrier_on(adapter->netdev);
+
         mod_timer(&adapter->timer_service, round_jiffies(jiffies + HZ));
         dev_err(&pdev->dev,
                 "Device reset completed successfully, Driver info: %s\n",
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h
index dc8b6173d8d8..63870072cbbd 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
@@ -45,7 +45,7 @@
 
 #define DRV_MODULE_VER_MAJOR    2
 #define DRV_MODULE_VER_MINOR    0
-#define DRV_MODULE_VER_SUBMINOR 2
+#define DRV_MODULE_VER_SUBMINOR 3
 
 #define DRV_MODULE_NAME         "ena"
 #ifndef DRV_MODULE_VERSION
diff --git a/drivers/net/ethernet/amd/amd8111e.c b/drivers/net/ethernet/amd/amd8111e.c
index a90080f12e67..e548c0ae2e00 100644
--- a/drivers/net/ethernet/amd/amd8111e.c
+++ b/drivers/net/ethernet/amd/amd8111e.c
@@ -666,7 +666,7 @@ static int amd8111e_tx(struct net_device *dev)
                         pci_unmap_single(lp->pci_dev, lp->tx_dma_addr[tx_index],
                                         lp->tx_skbuff[tx_index]->len,
                                         PCI_DMA_TODEVICE);
-                        dev_kfree_skb_irq (lp->tx_skbuff[tx_index]);
+                        dev_consume_skb_irq(lp->tx_skbuff[tx_index]);
                         lp->tx_skbuff[tx_index] = NULL;
                         lp->tx_dma_addr[tx_index] = 0;
                 }
diff --git a/drivers/net/ethernet/apple/bmac.c b/drivers/net/ethernet/apple/bmac.c
index 6a8e2567f2bd..4d3855ceb500 100644
--- a/drivers/net/ethernet/apple/bmac.c
+++ b/drivers/net/ethernet/apple/bmac.c
@@ -777,7 +777,7 @@ static irqreturn_t bmac_txdma_intr(int irq, void *dev_id)
 
                 if (bp->tx_bufs[bp->tx_empty]) {
                         ++dev->stats.tx_packets;
-                        dev_kfree_skb_irq(bp->tx_bufs[bp->tx_empty]);
+                        dev_consume_skb_irq(bp->tx_bufs[bp->tx_empty]);
                 }
                 bp->tx_bufs[bp->tx_empty] = NULL;
                 bp->tx_fullup = 0;
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index f44808959ff3..97ab0dd25552 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -638,7 +638,7 @@ static void b44_tx(struct b44 *bp)
                 bytes_compl += skb->len;
                 pkts_compl++;
 
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
         }
 
         netdev_completed_queue(bp->dev, pkts_compl, bytes_compl);
@@ -1012,7 +1012,7 @@ static netdev_tx_t b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
 
                 skb_copy_from_linear_data(skb, skb_put(bounce_skb, len), len);
-                dev_kfree_skb_any(skb);
+                dev_consume_skb_any(skb);
                 skb = bounce_skb;
         }
 
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index f9521d0274b7..28c9b0bdf2f6 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -520,7 +520,6 @@ static void bcm_sysport_get_wol(struct net_device *dev,
                                 struct ethtool_wolinfo *wol)
 {
         struct bcm_sysport_priv *priv = netdev_priv(dev);
-        u32 reg;
 
         wol->supported = WAKE_MAGIC | WAKE_MAGICSECURE | WAKE_FILTER;
         wol->wolopts = priv->wolopts;
@@ -528,11 +527,7 @@ static void bcm_sysport_get_wol(struct net_device *dev,
         if (!(priv->wolopts & WAKE_MAGICSECURE))
                 return;
 
-        /* Return the programmed SecureOn password */
-        reg = umac_readl(priv, UMAC_PSW_MS);
-        put_unaligned_be16(reg, &wol->sopass[0]);
-        reg = umac_readl(priv, UMAC_PSW_LS);
-        put_unaligned_be32(reg, &wol->sopass[2]);
+        memcpy(wol->sopass, priv->sopass, sizeof(priv->sopass));
 }
 
 static int bcm_sysport_set_wol(struct net_device *dev,
@@ -548,13 +543,8 @@ static int bcm_sysport_set_wol(struct net_device *dev,
         if (wol->wolopts & ~supported)
                 return -EINVAL;
 
-        /* Program the SecureOn password */
-        if (wol->wolopts & WAKE_MAGICSECURE) {
-                umac_writel(priv, get_unaligned_be16(&wol->sopass[0]),
-                            UMAC_PSW_MS);
-                umac_writel(priv, get_unaligned_be32(&wol->sopass[2]),
-                            UMAC_PSW_LS);
-        }
+        if (wol->wolopts & WAKE_MAGICSECURE)
+                memcpy(priv->sopass, wol->sopass, sizeof(priv->sopass));
 
         /* Flag the device and relevant IRQ as wakeup capable */
         if (wol->wolopts) {
@@ -2649,13 +2639,18 @@ static int bcm_sysport_suspend_to_wol(struct bcm_sysport_priv *priv)
         unsigned int index, i = 0;
         u32 reg;
 
-        /* Password has already been programmed */
         reg = umac_readl(priv, UMAC_MPD_CTRL);
         if (priv->wolopts & (WAKE_MAGIC | WAKE_MAGICSECURE))
                 reg |= MPD_EN;
         reg &= ~PSW_EN;
-        if (priv->wolopts & WAKE_MAGICSECURE)
+        if (priv->wolopts & WAKE_MAGICSECURE) {
+                /* Program the SecureOn password */
+                umac_writel(priv, get_unaligned_be16(&priv->sopass[0]),
+                            UMAC_PSW_MS);
+                umac_writel(priv, get_unaligned_be32(&priv->sopass[2]),
+                            UMAC_PSW_LS);
                 reg |= PSW_EN;
+        }
         umac_writel(priv, reg, UMAC_MPD_CTRL);
 
         if (priv->wolopts & WAKE_FILTER) {
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h
index 0887e6356649..0b192fea9c5d 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.h
+++ b/drivers/net/ethernet/broadcom/bcmsysport.h
@@ -12,6 +12,7 @@
 #define __BCM_SYSPORT_H
 
 #include <linux/bitmap.h>
+#include <linux/ethtool.h>
 #include <linux/if_vlan.h>
 #include <linux/net_dim.h>
 
@@ -778,6 +779,7 @@ struct bcm_sysport_priv {
         unsigned int            crc_fwd:1;
         u16                     rev;
         u32                     wolopts;
+        u8                      sopass[SOPASS_MAX];
         unsigned int            wol_irq_disabled:1;
 
         /* MIB related fields */
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 6a512871176b..8bc7e495b027 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -4973,12 +4973,18 @@ static int bnxt_hwrm_ring_alloc(struct bnxt *bp)
                 struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring;
                 struct bnxt_ring_struct *ring = &cpr->cp_ring_struct;
                 u32 map_idx = ring->map_idx;
+                unsigned int vector;
 
+                vector = bp->irq_tbl[map_idx].vector;
+                disable_irq_nosync(vector);
                 rc = hwrm_ring_alloc_send_msg(bp, ring, type, map_idx);
-                if (rc)
+                if (rc) {
+                        enable_irq(vector);
                         goto err_out;
+                }
                 bnxt_set_db(bp, &cpr->cp_db, type, map_idx, ring->fw_ring_id);
                 bnxt_db_nq(bp, &cpr->cp_db, cpr->cp_raw_cons);
+                enable_irq(vector);
                 bp->grp_info[i].cp_fw_ring_id = ring->fw_ring_id;
 
                 if (!i) {
diff --git a/drivers/net/ethernet/broadcom/sb1250-mac.c b/drivers/net/ethernet/broadcom/sb1250-mac.c
index 5db9f4158e62..134ae2862efa 100644
--- a/drivers/net/ethernet/broadcom/sb1250-mac.c
+++ b/drivers/net/ethernet/broadcom/sb1250-mac.c
@@ -1288,7 +1288,7 @@ static void sbdma_tx_process(struct sbmac_softc *sc, struct sbmacdma *d,
                  * for transmits, we just free buffers.
                  */
 
-                dev_kfree_skb_irq(sb);
+                dev_consume_skb_irq(sb);
 
                 /*
                  * .. and advance to the next buffer.
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index 3d45f4c92cf6..9bbaad9f3d63 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -643,6 +643,7 @@
 #define MACB_CAPS_JUMBO                         0x00000020
 #define MACB_CAPS_GEM_HAS_PTP                   0x00000040
 #define MACB_CAPS_BD_RD_PREFETCH                0x00000080
+#define MACB_CAPS_NEEDS_RSTONUBR                0x00000100
 #define MACB_CAPS_FIFO_MODE                     0x10000000
 #define MACB_CAPS_GIGABIT_MODE_AVAILABLE        0x20000000
 #define MACB_CAPS_SG_DISABLED                   0x40000000
@@ -1214,6 +1215,8 @@ struct macb {
 
         int     rx_bd_rd_prefetch;
         int     tx_bd_rd_prefetch;
+
+        u32     rx_intr_mask;
 };
 
 #ifdef CONFIG_MACB_USE_HWSTAMP
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 66cc7927061a..2b2882615e8b 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -56,8 +56,7 @@
 /* level of occupied TX descriptors under which we wake up TX process */
 #define MACB_TX_WAKEUP_THRESH(bp)       (3 * (bp)->tx_ring_size / 4)
 
-#define MACB_RX_INT_FLAGS       (MACB_BIT(RCOMP) | MACB_BIT(RXUBR)      \
-                                 | MACB_BIT(ISR_ROVR))
+#define MACB_RX_INT_FLAGS       (MACB_BIT(RCOMP) | MACB_BIT(ISR_ROVR))
 #define MACB_TX_ERR_FLAGS       (MACB_BIT(ISR_TUND)                     \
                                         | MACB_BIT(ISR_RLE)             \
                                         | MACB_BIT(TXERR))
@@ -1270,7 +1269,7 @@ static int macb_poll(struct napi_struct *napi, int budget)
                                 queue_writel(queue, ISR, MACB_BIT(RCOMP));
                         napi_reschedule(napi);
                 } else {
-                        queue_writel(queue, IER, MACB_RX_INT_FLAGS);
+                        queue_writel(queue, IER, bp->rx_intr_mask);
                 }
         }
 
@@ -1288,7 +1287,7 @@ static void macb_hresp_error_task(unsigned long data)
         u32 ctrl;
 
         for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
-                queue_writel(queue, IDR, MACB_RX_INT_FLAGS |
+                queue_writel(queue, IDR, bp->rx_intr_mask |
                                          MACB_TX_INT_FLAGS |
                                          MACB_BIT(HRESP));
         }
@@ -1318,7 +1317,7 @@ static void macb_hresp_error_task(unsigned long data)
 
                 /* Enable interrupts */
                 queue_writel(queue, IER,
-                             MACB_RX_INT_FLAGS |
+                             bp->rx_intr_mask |
                              MACB_TX_INT_FLAGS |
                              MACB_BIT(HRESP));
         }
@@ -1372,14 +1371,14 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                             (unsigned int)(queue - bp->queues),
                             (unsigned long)status);
 
-                if (status & MACB_RX_INT_FLAGS) {
+                if (status & bp->rx_intr_mask) {
                         /* There's no point taking any more interrupts
                          * until we have processed the buffers. The
                          * scheduling call may fail if the poll routine
                          * is already scheduled, so disable interrupts
                          * now.
                          */
-                        queue_writel(queue, IDR, MACB_RX_INT_FLAGS);
+                        queue_writel(queue, IDR, bp->rx_intr_mask);
                         if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
                                 queue_writel(queue, ISR, MACB_BIT(RCOMP));
 
@@ -1412,8 +1411,9 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                 /* There is a hardware issue under heavy load where DMA can
                  * stop, this causes endless "used buffer descriptor read"
                  * interrupts but it can be cleared by re-enabling RX. See
-                 * the at91 manual, section 41.3.1 or the Zynq manual
-                 * section 16.7.4 for details.
+                 * the at91rm9200 manual, section 41.3.1 or the Zynq manual
+                 * section 16.7.4 for details. RXUBR is only enabled for
+                 * these two versions.
                  */
                 if (status & MACB_BIT(RXUBR)) {
                         ctrl = macb_readl(bp, NCR);
@@ -2259,7 +2259,7 @@ static void macb_init_hw(struct macb *bp)
 
                 /* Enable interrupts */
                 queue_writel(queue, IER,
-                             MACB_RX_INT_FLAGS |
+                             bp->rx_intr_mask |
                              MACB_TX_INT_FLAGS |
                              MACB_BIT(HRESP));
         }
@@ -3907,6 +3907,7 @@ static const struct macb_config sama5d4_config = {
 };
 
 static const struct macb_config emac_config = {
+        .caps = MACB_CAPS_NEEDS_RSTONUBR,
         .clk_init = at91ether_clk_init,
         .init = at91ether_init,
 };
@@ -3928,7 +3929,8 @@ static const struct macb_config zynqmp_config = {
 };
 
 static const struct macb_config zynq_config = {
-        .caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE | MACB_CAPS_NO_GIGABIT_HALF,
+        .caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE | MACB_CAPS_NO_GIGABIT_HALF |
+                MACB_CAPS_NEEDS_RSTONUBR,
         .dma_burst_length = 16,
         .clk_init = macb_clk_init,
         .init = macb_init,
@@ -4083,6 +4085,10 @@ static int macb_probe(struct platform_device *pdev)
                                                 macb_dma_desc_get_size(bp);
         }
 
+        bp->rx_intr_mask = MACB_RX_INT_FLAGS;
+        if (bp->caps & MACB_CAPS_NEEDS_RSTONUBR)
+                bp->rx_intr_mask |= MACB_BIT(RXUBR);
+
         mac = of_get_mac_address(np);
         if (mac) {
                 ether_addr_copy(bp->dev->dev_addr, mac);
diff --git a/drivers/net/ethernet/cavium/Kconfig b/drivers/net/ethernet/cavium/Kconfig
index 5f03199a3acf..05f4a3b21e29 100644
--- a/drivers/net/ethernet/cavium/Kconfig
+++ b/drivers/net/ethernet/cavium/Kconfig
@@ -54,7 +54,6 @@ config CAVIUM_PTP
         tristate "Cavium PTP coprocessor as PTP clock"
         depends on 64BIT && PCI
         imply PTP_1588_CLOCK
-        default y
         ---help---
           This driver adds support for the Precision Time Protocol Clocks and
           Timestamping coprocessor (PTP) found on Cavium processors.
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 60641e202534..9a7f70db20c7 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1434,7 +1434,8 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
                  * csum is correct or is zero.
                  */
                 if ((netdev->features & NETIF_F_RXCSUM) && !csum_not_calc &&
-                    tcp_udp_csum_ok && ipv4_csum_ok && outer_csum_ok) {
+                    tcp_udp_csum_ok && outer_csum_ok &&
+                    (ipv4_csum_ok || ipv6)) {
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                         skb->csum_level = encap;
                 }
diff --git a/drivers/net/ethernet/dec/tulip/de2104x.c b/drivers/net/ethernet/dec/tulip/de2104x.c
index 13430f75496c..f1a2da15dd0a 100644
--- a/drivers/net/ethernet/dec/tulip/de2104x.c
+++ b/drivers/net/ethernet/dec/tulip/de2104x.c
@@ -585,7 +585,7 @@ static void de_tx (struct de_private *de)
                                 netif_dbg(de, tx_done, de->dev,
                                           "tx done, slot %d\n", tx_tail);
                         }
-                        dev_kfree_skb_irq(skb);
+                        dev_consume_skb_irq(skb);
                 }
 
 next:
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 2370dc204202..697c2427f2b7 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -2098,6 +2098,7 @@ static int fec_enet_get_regs_len(struct net_device *ndev)
 #if defined(CONFIG_M523x) || defined(CONFIG_M527x) || defined(CONFIG_M528x) || \
         defined(CONFIG_M520x) || defined(CONFIG_M532x) || defined(CONFIG_ARM) || \
         defined(CONFIG_ARM64) || defined(CONFIG_COMPILE_TEST)
+static __u32 fec_enet_register_version = 2;
 static u32 fec_enet_register_offset[] = {
         FEC_IEVENT, FEC_IMASK, FEC_R_DES_ACTIVE_0, FEC_X_DES_ACTIVE_0,
         FEC_ECNTRL, FEC_MII_DATA, FEC_MII_SPEED, FEC_MIB_CTRLSTAT, FEC_R_CNTRL,
@@ -2128,6 +2129,7 @@ static u32 fec_enet_register_offset[] = {
         IEEE_R_FDXFC, IEEE_R_OCTETS_OK
 };
 #else
+static __u32 fec_enet_register_version = 1;
 static u32 fec_enet_register_offset[] = {
         FEC_ECNTRL, FEC_IEVENT, FEC_IMASK, FEC_IVEC, FEC_R_DES_ACTIVE_0,
         FEC_R_DES_ACTIVE_1, FEC_R_DES_ACTIVE_2, FEC_X_DES_ACTIVE_0,
@@ -2149,6 +2151,8 @@ static void fec_enet_get_regs(struct net_device *ndev,
         u32 *buf = (u32 *)regbuf;
         u32 i, off;
 
+        regs->version = fec_enet_register_version;
+
         memset(buf, 0, regs->len);
 
         for (i = 0; i < ARRAY_SIZE(fec_enet_register_offset); i++) {
diff --git a/drivers/net/ethernet/freescale/fec_mpc52xx.c b/drivers/net/ethernet/freescale/fec_mpc52xx.c
index b90bab72efdb..c1968b3ecec8 100644
--- a/drivers/net/ethernet/freescale/fec_mpc52xx.c
+++ b/drivers/net/ethernet/freescale/fec_mpc52xx.c
@@ -369,7 +369,7 @@ static irqreturn_t mpc52xx_fec_tx_interrupt(int irq, void *dev_id)
                 dma_unmap_single(dev->dev.parent, bd->skb_pa, skb->len,
                                  DMA_TO_DEVICE);
 
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
         }
         spin_unlock(&priv->lock);
 
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index c3d539e209ed..eb3e65e8868f 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -1879,6 +1879,8 @@ static void ucc_geth_free_tx(struct ucc_geth_private *ugeth)
         u16 i, j;
         u8 __iomem *bd;
 
+        netdev_reset_queue(ugeth->ndev);
+
         ug_info = ugeth->ug_info;
         uf_info = &ug_info->uf_info;
 
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index 3b9e74be5fbd..b8155f5e71b4 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -3081,6 +3081,7 @@ int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset)
         dsaf_dev = dev_get_drvdata(&pdev->dev);
         if (!dsaf_dev) {
                 dev_err(&pdev->dev, "dsaf_dev is NULL\n");
+                put_device(&pdev->dev);
                 return -ENODEV;
         }
 
@@ -3088,6 +3089,7 @@ int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset)
         if (AE_IS_VER1(dsaf_dev->dsaf_ver)) {
                 dev_err(dsaf_dev->dev, "%s v1 chip doesn't support RoCE!\n",
                         dsaf_dev->ae_dev.name);
+                put_device(&pdev->dev);
                 return -ENODEV;
         }
 
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 5b33238c6680..60e7d7ae3787 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -2418,6 +2418,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
 out_notify_fail:
         (void)cancel_work_sync(&priv->service_task);
 out_read_prop_fail:
+        /* safe for ACPI FW */
+        of_node_put(to_of_node(priv->fwnode));
         free_netdev(ndev);
         return ret;
 }
@@ -2447,6 +2449,9 @@ static int hns_nic_dev_remove(struct platform_device *pdev)
         set_bit(NIC_STATE_REMOVING, &priv->state);
         (void)cancel_work_sync(&priv->service_task);
 
+        /* safe for ACPI FW */
+        of_node_put(to_of_node(priv->fwnode));
+
         free_netdev(ndev);
         return 0;
 }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
index 8e9b95871d30..ce15d2350db9 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
@@ -1157,16 +1157,18 @@ static int hns_get_regs_len(struct net_device *net_dev)
  */
 static int hns_nic_nway_reset(struct net_device *netdev)
 {
-        int ret = 0;
         struct phy_device *phy = netdev->phydev;
 
-        if (netif_running(netdev)) {
-                /* if autoneg is disabled, don't restart auto-negotiation */
-                if (phy && phy->autoneg == AUTONEG_ENABLE)
-                        ret = genphy_restart_aneg(phy);
-        }
+        if (!netif_running(netdev))
+                return 0;
 
-        return ret;
+        if (!phy)
+                return -EOPNOTSUPP;
+
+        if (phy->autoneg != AUTONEG_ENABLE)
+                return -EINVAL;
+
+        return genphy_restart_aneg(phy);
 }
 
 static u32
diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c
index 017e08452d8c..baf5cc251f32 100644
--- a/drivers/net/ethernet/hisilicon/hns_mdio.c
+++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
@@ -321,7 +321,7 @@ static int hns_mdio_read(struct mii_bus *bus, int phy_id, int regnum)
                 }
 
                 hns_mdio_cmd_write(mdio_dev, is_c45,
-                                   MDIO_C45_WRITE_ADDR, phy_id, devad);
+                                   MDIO_C45_READ, phy_id, devad);
         }
 
         /* Step 5: waitting for MDIO_COMMAND_REG 's mdio_start==0,*/
diff --git a/drivers/net/ethernet/i825xx/82596.c b/drivers/net/ethernet/i825xx/82596.c
index d719668a6684..92929750f832 100644
--- a/drivers/net/ethernet/i825xx/82596.c
+++ b/drivers/net/ethernet/i825xx/82596.c
@@ -1310,7 +1310,7 @@ static irqreturn_t i596_interrupt(int irq, void *dev_id)
                                                 dev->stats.tx_aborted_errors++;
                                 }
 
-                                dev_kfree_skb_irq(skb);
+                                dev_consume_skb_irq(skb);
 
                                 tx_cmd->cmd.command = 0; /* Mark free */
                                 break;
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index 04fd1f135011..654ac534b10e 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -152,8 +152,10 @@ static void skge_get_regs(struct net_device *dev, struct ethtool_regs *regs,
         memset(p, 0, regs->len);
         memcpy_fromio(p, io, B3_RAM_ADDR);
 
-        memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1,
-                      regs->len - B3_RI_WTO_R1);
+        if (regs->len > B3_RI_WTO_R1) {
+                memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1,
+                              regs->len - B3_RI_WTO_R1);
+        }
 }
 
 /* Wake on Lan only supported on Yukon chips with rev 1 or above */
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index 9a0881cb7f51..6c01314e87b0 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -617,6 +617,8 @@ static int get_fixed_ipv6_csum(__wsum hw_checksum, struct sk_buff *skb,
 }
 #endif
 
+#define short_frame(size) ((size) <= ETH_ZLEN + ETH_FCS_LEN)
+
 /* We reach this function only after checking that any of
  * the (IPv4 | IPv6) bits are set in cqe->status.
  */
@@ -624,9 +626,20 @@ static int check_csum(struct mlx4_cqe *cqe, struct sk_buff *skb, void *va,
                       netdev_features_t dev_features)
 {
         __wsum hw_checksum = 0;
+        void *hdr;
+
+        /* CQE csum doesn't cover padding octets in short ethernet
+         * frames. And the pad field is appended prior to calculating
+         * and appending the FCS field.
+         *
+         * Detecting these padded frames requires to verify and parse
+         * IP headers, so we simply force all those small frames to skip
+         * checksum complete.
+         */
+        if (short_frame(skb->len))
+                return -EINVAL;
 
-        void *hdr = (u8 *)va + sizeof(struct ethhdr);
-
+        hdr = (u8 *)va + sizeof(struct ethhdr);
         hw_checksum = csum_unfold((__force __sum16)cqe->checksum);
 
         if (cqe->vlan_my_qpn & cpu_to_be32(MLX4_CQE_CVLAN_PRESENT_MASK) &&
@@ -819,6 +832,11 @@ xdp_drop_no_cnt:
                 skb_record_rx_queue(skb, cq_ring);
 
                 if (likely(dev->features & NETIF_F_RXCSUM)) {
+                        /* TODO: For IP non TCP/UDP packets when csum complete is
+                         * not an option (not supported or any other reason) we can
+                         * actually check cqe IPOK status bit and report
+                         * CHECKSUM_UNNECESSARY rather than CHECKSUM_NONE
+                         */
                         if ((cqe->status & cpu_to_be16(MLX4_CQE_STATUS_TCP |
                                                        MLX4_CQE_STATUS_UDP)) &&
                             (cqe->status & cpu_to_be16(MLX4_CQE_STATUS_IPOK)) &&
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 3e0fa8a8077b..e267ff93e8a8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -1583,6 +1583,24 @@ no_trig:
         spin_unlock_irqrestore(&dev->cmd.alloc_lock, flags);
 }
 
+void mlx5_cmd_flush(struct mlx5_core_dev *dev)
+{
+        struct mlx5_cmd *cmd = &dev->cmd;
+        int i;
+
+        for (i = 0; i < cmd->max_reg_cmds; i++)
+                while (down_trylock(&cmd->sem))
+                        mlx5_cmd_trigger_completions(dev);
+
+        while (down_trylock(&cmd->pages_sem))
+                mlx5_cmd_trigger_completions(dev);
+
+        /* Unlock cmdif */
+        up(&cmd->pages_sem);
+        for (i = 0; i < cmd->max_reg_cmds; i++)
+                up(&cmd->sem);
+}
+
 static int status_to_err(u8 status)
 {
         return status ? -1 : 0; /* TBD more meaningful codes */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 8fa8fdd30b85..448a92561567 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -657,6 +657,7 @@ struct mlx5e_channel_stats {
 enum {
         MLX5E_STATE_OPENED,
         MLX5E_STATE_DESTROYING,
+        MLX5E_STATE_XDP_TX_ENABLED,
 };
 
 struct mlx5e_rqt {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
index 046948ead152..f3c7ab6faea5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
@@ -256,6 +256,7 @@ int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv,
         e->m_neigh.family = n->ops->family;
         memcpy(&e->m_neigh.dst_ip, n->primary_key, n->tbl->key_len);
         e->out_dev = out_dev;
+        e->route_dev = route_dev;
 
         /* It's important to add the neigh to the hash table before checking
          * the neigh validity state. So if we'll get a notification, in case the
@@ -369,6 +370,7 @@ int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv,
         e->m_neigh.family = n->ops->family;
         memcpy(&e->m_neigh.dst_ip, n->primary_key, n->tbl->key_len);
         e->out_dev = out_dev;
+        e->route_dev = route_dev;
 
         /* It's importent to add the neigh to the hash table before checking
          * the neigh validity state. So if we'll get a notification, in case the
@@ -612,16 +614,18 @@ int mlx5e_tc_tun_parse(struct net_device *filter_dev,
                        struct mlx5_flow_spec *spec,
                        struct tc_cls_flower_offload *f,
                        void *headers_c,
-                       void *headers_v)
+                       void *headers_v, u8 *match_level)
 {
         int tunnel_type;
         int err = 0;
 
         tunnel_type = mlx5e_tc_tun_get_type(filter_dev);
         if (tunnel_type == MLX5E_TC_TUNNEL_TYPE_VXLAN) {
+                *match_level = MLX5_MATCH_L4;
                 err = mlx5e_tc_tun_parse_vxlan(priv, spec, f,
                                                headers_c, headers_v);
         } else if (tunnel_type == MLX5E_TC_TUNNEL_TYPE_GRETAP) {
+                *match_level = MLX5_MATCH_L3;
                 err = mlx5e_tc_tun_parse_gretap(priv, spec, f,
                                                 headers_c, headers_v);
         } else {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.h b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.h
index 706ce7bf15e7..b63f15de899d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.h
@@ -39,6 +39,6 @@ int mlx5e_tc_tun_parse(struct net_device *filter_dev,
                        struct mlx5_flow_spec *spec,
                        struct tc_cls_flower_offload *f,
                        void *headers_c,
-                       void *headers_v);
+                       void *headers_v, u8 *match_level);
 
 #endif //__MLX5_EN_TC_TUNNEL_H__
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
index 3740177eed09..03b2a9f9c589 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
@@ -365,7 +365,8 @@ int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames,
         int sq_num;
         int i;
 
-        if (unlikely(!test_bit(MLX5E_STATE_OPENED, &priv->state)))
+        /* this flag is sufficient, no need to test internal sq state */
+        if (unlikely(!mlx5e_xdp_tx_is_enabled(priv)))
                 return -ENETDOWN;
 
         if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK))
@@ -378,9 +379,6 @@ int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames,
 
         sq = &priv->channels.c[sq_num]->xdpsq;
 
-        if (unlikely(!test_bit(MLX5E_SQ_STATE_ENABLED, &sq->state)))
-                return -ENETDOWN;
-
         for (i = 0; i < n; i++) {
                 struct xdp_frame *xdpf = frames[i];
                 struct mlx5e_xdp_info xdpi;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
index 3a67cb3cd179..ee27a7c8cd87 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
@@ -50,6 +50,23 @@ void mlx5e_xdp_rx_poll_complete(struct mlx5e_rq *rq);
 int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames,
                    u32 flags);
 
+static inline void mlx5e_xdp_tx_enable(struct mlx5e_priv *priv)
+{
+        set_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
+}
+
+static inline void mlx5e_xdp_tx_disable(struct mlx5e_priv *priv)
+{
+        clear_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
+        /* let other device's napi(s) see our new state */
+        synchronize_rcu();
+}
+
+static inline bool mlx5e_xdp_tx_is_enabled(struct mlx5e_priv *priv)
+{
+        return test_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
+}
+
 static inline void mlx5e_xmit_xdp_doorbell(struct mlx5e_xdpsq *sq)
 {
         if (sq->doorbell_cseg) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 3bbccead2f63..47233b9a4f81 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -354,9 +354,6 @@ int mlx5e_ethtool_set_channels(struct mlx5e_priv *priv,
 
         new_channels.params = priv->channels.params;
         new_channels.params.num_channels = count;
-        if (!netif_is_rxfh_configured(priv->netdev))
-                mlx5e_build_default_indir_rqt(priv->rss_params.indirection_rqt,
-                                              MLX5E_INDIR_RQT_SIZE, count);
 
         if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
                 priv->channels.params = new_channels.params;
@@ -372,6 +369,10 @@ int mlx5e_ethtool_set_channels(struct mlx5e_priv *priv,
         if (arfs_enabled)
                 mlx5e_arfs_disable(priv);
 
+        if (!netif_is_rxfh_configured(priv->netdev))
+                mlx5e_build_default_indir_rqt(priv->rss_params.indirection_rqt,
+                                              MLX5E_INDIR_RQT_SIZE, count);
+
         /* Switch to new channels, set new parameters and close old ones */
         mlx5e_switch_priv_channels(priv, &new_channels, NULL);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 8cfd2ec7c0a2..93e50ccd44c3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -950,7 +950,7 @@ static int mlx5e_open_rq(struct mlx5e_channel *c,
         if (params->rx_dim_enabled)
                 __set_bit(MLX5E_RQ_STATE_AM, &c->rq.state);
 
-        if (params->pflags & MLX5E_PFLAG_RX_NO_CSUM_COMPLETE)
+        if (MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_NO_CSUM_COMPLETE))
                 __set_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &c->rq.state);
 
         return 0;
@@ -2938,6 +2938,7 @@ void mlx5e_activate_priv_channels(struct mlx5e_priv *priv)
 
         mlx5e_build_tx2sq_maps(priv);
         mlx5e_activate_channels(&priv->channels);
+        mlx5e_xdp_tx_enable(priv);
         netif_tx_start_all_queues(priv->netdev);
 
         if (mlx5e_is_vport_rep(priv))
@@ -2959,6 +2960,7 @@ void mlx5e_deactivate_priv_channels(struct mlx5e_priv *priv)
          */
         netif_tx_stop_all_queues(priv->netdev);
         netif_tx_disable(priv->netdev);
+        mlx5e_xdp_tx_disable(priv);
         mlx5e_deactivate_channels(&priv->channels);
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 04736212a21c..ef9e472daffb 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -596,6 +596,10 @@ static void mlx5e_rep_update_flows(struct mlx5e_priv *priv,
         if (neigh_connected && !(e->flags & MLX5_ENCAP_ENTRY_VALID)) {
                 ether_addr_copy(e->h_dest, ha);
                 ether_addr_copy(eth->h_dest, ha);
+                /* Update the encap source mac, in case that we delete
+                 * the flows when encap source mac changed.
+                 */
+                ether_addr_copy(eth->h_source, e->route_dev->dev_addr);
 
                 mlx5e_tc_encap_flows_add(priv, e);
         }
@@ -1126,9 +1130,17 @@ static int mlx5e_rep_get_phys_port_name(struct net_device *dev,
         struct mlx5e_priv *priv = netdev_priv(dev);
         struct mlx5e_rep_priv *rpriv = priv->ppriv;
         struct mlx5_eswitch_rep *rep = rpriv->rep;
-        int ret;
+        int ret, pf_num;
+
+        ret = mlx5_lag_get_pf_num(priv->mdev, &pf_num);
+        if (ret)
+                return ret;
+
+        if (rep->vport == FDB_UPLINK_VPORT)
+                ret = snprintf(buf, len, "p%d", pf_num);
+        else
+                ret = snprintf(buf, len, "pf%dvf%d", pf_num, rep->vport - 1);
 
-        ret = snprintf(buf, len, "%d", rep->vport - 1);
         if (ret >= len)
                 return -EOPNOTSUPP;
 
@@ -1285,6 +1297,18 @@ static int mlx5e_uplink_rep_set_mac(struct net_device *netdev, void *addr)
         return 0;
 }
 
+static int mlx5e_uplink_rep_set_vf_vlan(struct net_device *dev, int vf, u16 vlan, u8 qos,
+                                        __be16 vlan_proto)
+{
+        netdev_warn_once(dev, "legacy vf vlan setting isn't supported in switchdev mode\n");
+
+        if (vlan != 0)
+                return -EOPNOTSUPP;
+
+        /* allow setting 0-vid for compatibility with libvirt */
+        return 0;
+}
+
 static const struct switchdev_ops mlx5e_rep_switchdev_ops = {
         .switchdev_port_attr_get        = mlx5e_attr_get,
 };
@@ -1319,6 +1343,7 @@ static const struct net_device_ops mlx5e_netdev_ops_uplink_rep = {
         .ndo_set_vf_rate         = mlx5e_set_vf_rate,
         .ndo_get_vf_config       = mlx5e_get_vf_config,
         .ndo_get_vf_stats        = mlx5e_get_vf_stats,
+        .ndo_set_vf_vlan         = mlx5e_uplink_rep_set_vf_vlan,
 };
 
 bool mlx5e_eswitch_rep(struct net_device *netdev)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h
index edd722824697..36eafc877e6b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h
@@ -148,6 +148,7 @@ struct mlx5e_encap_entry {
         unsigned char h_dest[ETH_ALEN]; /* destination eth addr */
 
         struct net_device *out_dev;
+        struct net_device *route_dev;
         int tunnel_type;
         int tunnel_hlen;
         int reformat_type;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index cae6c6d48984..b5c1b039375a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -128,6 +128,7 @@ struct mlx5e_tc_flow_parse_attr {
         struct net_device *filter_dev;
         struct mlx5_flow_spec spec;
         int num_mod_hdr_actions;
+        int max_mod_hdr_actions;
         void *mod_hdr_actions;
         int mirred_ifindex[MLX5_MAX_FLOW_FWD_VPORTS];
 };
@@ -1302,7 +1303,7 @@ static void mlx5e_tc_del_flow(struct mlx5e_priv *priv,
 static int parse_tunnel_attr(struct mlx5e_priv *priv,
                              struct mlx5_flow_spec *spec,
                              struct tc_cls_flower_offload *f,
-                             struct net_device *filter_dev)
+                             struct net_device *filter_dev, u8 *match_level)
 {
         struct netlink_ext_ack *extack = f->common.extack;
         void *headers_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
@@ -1317,7 +1318,7 @@ static int parse_tunnel_attr(struct mlx5e_priv *priv,
         int err = 0;
 
         err = mlx5e_tc_tun_parse(filter_dev, priv, spec, f,
-                                 headers_c, headers_v);
+                                 headers_c, headers_v, match_level);
         if (err) {
                 NL_SET_ERR_MSG_MOD(extack,
                                    "failed to parse tunnel attributes");
@@ -1426,7 +1427,7 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
                               struct mlx5_flow_spec *spec,
                               struct tc_cls_flower_offload *f,
                               struct net_device *filter_dev,
-                              u8 *match_level)
+                              u8 *match_level, u8 *tunnel_match_level)
 {
         struct netlink_ext_ack *extack = f->common.extack;
         void *headers_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
@@ -1477,7 +1478,7 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
                 switch (key->addr_type) {
                 case FLOW_DISSECTOR_KEY_IPV4_ADDRS:
                 case FLOW_DISSECTOR_KEY_IPV6_ADDRS:
-                        if (parse_tunnel_attr(priv, spec, f, filter_dev))
+                        if (parse_tunnel_attr(priv, spec, f, filter_dev, tunnel_match_level))
                                 return -EOPNOTSUPP;
                         break;
                 default:
@@ -1826,11 +1827,11 @@ static int parse_cls_flower(struct mlx5e_priv *priv,
         struct mlx5_core_dev *dev = priv->mdev;
         struct mlx5_eswitch *esw = dev->priv.eswitch;
         struct mlx5e_rep_priv *rpriv = priv->ppriv;
+        u8 match_level, tunnel_match_level = MLX5_MATCH_NONE;
         struct mlx5_eswitch_rep *rep;
-        u8 match_level;
         int err;
 
-        err = __parse_cls_flower(priv, spec, f, filter_dev, &match_level);
+        err = __parse_cls_flower(priv, spec, f, filter_dev, &match_level, &tunnel_match_level);
 
         if (!err && (flow->flags & MLX5E_TC_FLOW_ESWITCH)) {
                 rep = rpriv->rep;
@@ -1846,10 +1847,12 @@ static int parse_cls_flower(struct mlx5e_priv *priv,
                 }
         }
 
-        if (flow->flags & MLX5E_TC_FLOW_ESWITCH)
+        if (flow->flags & MLX5E_TC_FLOW_ESWITCH) {
                 flow->esw_attr->match_level = match_level;
-        else
+                flow->esw_attr->tunnel_match_level = tunnel_match_level;
+        } else {
                 flow->nic_attr->match_level = match_level;
+        }
 
         return err;
 }
@@ -1934,9 +1937,9 @@ static struct mlx5_fields fields[] = {
         OFFLOAD(UDP_DPORT, 2, udp.dest,   0),
 };
 
-/* On input attr->num_mod_hdr_actions tells how many HW actions can be parsed at
- * max from the SW pedit action. On success, it says how many HW actions were
- * actually parsed.
+/* On input attr->max_mod_hdr_actions tells how many HW actions can be parsed at
+ * max from the SW pedit action. On success, attr->num_mod_hdr_actions
+ * says how many HW actions were actually parsed.
  */
 static int offload_pedit_fields(struct pedit_headers *masks,
                                 struct pedit_headers *vals,
@@ -1960,9 +1963,11 @@ static int offload_pedit_fields(struct pedit_headers *masks,
         add_vals = &vals[TCA_PEDIT_KEY_EX_CMD_ADD];
 
         action_size = MLX5_UN_SZ_BYTES(set_action_in_add_action_in_auto);
-        action = parse_attr->mod_hdr_actions;
-        max_actions = parse_attr->num_mod_hdr_actions;
-        nactions = 0;
+        action = parse_attr->mod_hdr_actions +
+                 parse_attr->num_mod_hdr_actions * action_size;
+
+        max_actions = parse_attr->max_mod_hdr_actions;
+        nactions = parse_attr->num_mod_hdr_actions;
 
         for (i = 0; i < ARRAY_SIZE(fields); i++) {
                 f = &fields[i];
@@ -2073,7 +2078,7 @@ static int alloc_mod_hdr_actions(struct mlx5e_priv *priv,
         if (!parse_attr->mod_hdr_actions)
                 return -ENOMEM;
 
-        parse_attr->num_mod_hdr_actions = max_actions;
+        parse_attr->max_mod_hdr_actions = max_actions;
         return 0;
 }
 
@@ -2119,9 +2124,11 @@ static int parse_tc_pedit_action(struct mlx5e_priv *priv,
                         goto out_err;
         }
 
-        err = alloc_mod_hdr_actions(priv, a, namespace, parse_attr);
-        if (err)
-                goto out_err;
+        if (!parse_attr->mod_hdr_actions) {
+                err = alloc_mod_hdr_actions(priv, a, namespace, parse_attr);
+                if (err)
+                        goto out_err;
+        }
 
         err = offload_pedit_fields(masks, vals, parse_attr, extack);
         if (err < 0)
@@ -2179,6 +2186,7 @@ static bool csum_offload_supported(struct mlx5e_priv *priv,
 
 static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
                                           struct tcf_exts *exts,
+                                          u32 actions,
                                           struct netlink_ext_ack *extack)
 {
         const struct tc_action *a;
@@ -2188,7 +2196,11 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
         u16 ethertype;
         int nkeys, i;
 
-        headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, outer_headers);
+        if (actions & MLX5_FLOW_CONTEXT_ACTION_DECAP)
+                headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, inner_headers);
+        else
+                headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, outer_headers);
+
         ethertype = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ethertype);
 
         /* for non-IP we only re-write MACs, so we're okay */
@@ -2245,7 +2257,7 @@ static bool actions_match_supported(struct mlx5e_priv *priv,
 
         if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)
                 return modify_header_match_supported(&parse_attr->spec, exts,
-                                                     extack);
+                                                     actions, extack);
 
         return true;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index 598ad7e4d5c9..0e55cd1f2e98 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -387,8 +387,14 @@ netdev_tx_t mlx5e_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb,
         num_wqebbs = DIV_ROUND_UP(ds_cnt, MLX5_SEND_WQEBB_NUM_DS);
         contig_wqebbs_room = mlx5_wq_cyc_get_contig_wqebbs(wq, pi);
         if (unlikely(contig_wqebbs_room < num_wqebbs)) {
+#ifdef CONFIG_MLX5_EN_IPSEC
+                struct mlx5_wqe_eth_seg cur_eth = wqe->eth;
+#endif
                 mlx5e_fill_sq_frag_edge(sq, wq, pi, contig_wqebbs_room);
                 mlx5e_sq_fetch_wqe(sq, &wqe, &pi);
+#ifdef CONFIG_MLX5_EN_IPSEC
+                wqe->eth = cur_eth;
+#endif
         }
 
         /* fill wqe */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index a44ea7b85614..5b492b67f4e1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1134,13 +1134,6 @@ static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
         int err = 0;
         u8 *smac_v;
 
-        if (vport->info.spoofchk && !is_valid_ether_addr(vport->info.mac)) {
-                mlx5_core_warn(esw->dev,
-                               "vport[%d] configure ingress rules failed, illegal mac with spoofchk\n",
-                               vport->vport);
-                return -EPERM;
-        }
-
         esw_vport_cleanup_ingress_rules(esw, vport);
 
         if (!vport->info.vlan && !vport->info.qos && !vport->info.spoofchk) {
@@ -1728,7 +1721,7 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev)
         int vport_num;
         int err;
 
-        if (!MLX5_ESWITCH_MANAGER(dev))
+        if (!MLX5_VPORT_MANAGER(dev))
                 return 0;
 
         esw_info(dev,
@@ -1797,7 +1790,7 @@ abort:
 
 void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw)
 {
-        if (!esw || !MLX5_ESWITCH_MANAGER(esw->dev))
+        if (!esw || !MLX5_VPORT_MANAGER(esw->dev))
                 return;
 
         esw_info(esw->dev, "cleanup\n");
@@ -1827,13 +1820,10 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
         mutex_lock(&esw->state_lock);
         evport = &esw->vports[vport];
 
-        if (evport->info.spoofchk && !is_valid_ether_addr(mac)) {
+        if (evport->info.spoofchk && !is_valid_ether_addr(mac))
                 mlx5_core_warn(esw->dev,
-                               "MAC invalidation is not allowed when spoofchk is on, vport(%d)\n",
+                               "Set invalid MAC while spoofchk is on, vport(%d)\n",
                                vport);
-                err = -EPERM;
-                goto unlock;
-        }
 
         err = mlx5_modify_nic_vport_mac_address(esw->dev, vport, mac);
         if (err) {
@@ -1979,6 +1969,10 @@ int mlx5_eswitch_set_vport_spoofchk(struct mlx5_eswitch *esw,
         evport = &esw->vports[vport];
         pschk = evport->info.spoofchk;
         evport->info.spoofchk = spoofchk;
+        if (pschk && !is_valid_ether_addr(evport->info.mac))
+                mlx5_core_warn(esw->dev,
+                               "Spoofchk in set while MAC is invalid, vport(%d)\n",
+                               evport->vport);
         if (evport->enabled && esw->mode == SRIOV_LEGACY)
                 err = esw_vport_ingress_config(esw, evport);
         if (err)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index 9c89eea9b2c3..748ff178a1d6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -312,6 +312,7 @@ struct mlx5_esw_flow_attr {
         } dests[MLX5_MAX_FLOW_FWD_VPORTS];
         u32     mod_hdr_id;
         u8      match_level;
+        u8      tunnel_match_level;
         struct mlx5_fc *counter;
         u32     chain;
         u16     prio;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 53065b6ae593..d4e6fe5b9300 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -160,14 +160,15 @@ mlx5_eswitch_add_offloaded_rule(struct mlx5_eswitch *esw,
                 MLX5_SET_TO_ONES(fte_match_set_misc, misc,
                                  source_eswitch_owner_vhca_id);
 
-        if (attr->match_level == MLX5_MATCH_NONE)
-                spec->match_criteria_enable = MLX5_MATCH_MISC_PARAMETERS;
-        else
-                spec->match_criteria_enable = MLX5_MATCH_OUTER_HEADERS |
-                                              MLX5_MATCH_MISC_PARAMETERS;
-
-        if (flow_act.action & MLX5_FLOW_CONTEXT_ACTION_DECAP)
-                spec->match_criteria_enable |= MLX5_MATCH_INNER_HEADERS;
+        spec->match_criteria_enable = MLX5_MATCH_MISC_PARAMETERS;
+        if (flow_act.action & MLX5_FLOW_CONTEXT_ACTION_DECAP) {
+                if (attr->tunnel_match_level != MLX5_MATCH_NONE)
+                        spec->match_criteria_enable |= MLX5_MATCH_OUTER_HEADERS;
+                if (attr->match_level != MLX5_MATCH_NONE)
+                        spec->match_criteria_enable |= MLX5_MATCH_INNER_HEADERS;
+        } else if (attr->match_level != MLX5_MATCH_NONE) {
+                spec->match_criteria_enable |= MLX5_MATCH_OUTER_HEADERS;
+        }
 
         if (flow_act.action & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)
                 flow_act.modify_id = attr->mod_hdr_id;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/events.c b/drivers/net/ethernet/mellanox/mlx5/core/events.c
index fbc42b7252a9..503035469d2d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/events.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/events.c
@@ -211,11 +211,10 @@ static int port_module(struct notifier_block *nb, unsigned long type, void *data
         enum port_module_event_status_type module_status;
         enum port_module_event_error_type error_type;
         struct mlx5_eqe_port_module *module_event_eqe;
-        const char *status_str, *error_str;
+        const char *status_str;
         u8 module_num;
 
         module_event_eqe = &eqe->data.port_module;
-        module_num = module_event_eqe->module;
         module_status = module_event_eqe->module_status &
                         PORT_MODULE_EVENT_MODULE_STATUS_MASK;
         error_type = module_event_eqe->error_type &
@@ -223,25 +222,27 @@ static int port_module(struct notifier_block *nb, unsigned long type, void *data
 
         if (module_status < MLX5_MODULE_STATUS_NUM)
                 events->pme_stats.status_counters[module_status]++;
-        status_str = mlx5_pme_status_to_string(module_status);
 
-        if (module_status == MLX5_MODULE_STATUS_ERROR) {
+        if (module_status == MLX5_MODULE_STATUS_ERROR)
                 if (error_type < MLX5_MODULE_EVENT_ERROR_NUM)
                         events->pme_stats.error_counters[error_type]++;
-                error_str = mlx5_pme_error_to_string(error_type);
-        }
 
         if (!printk_ratelimit())
                 return NOTIFY_OK;
 
-        if (module_status == MLX5_MODULE_STATUS_ERROR)
+        module_num = module_event_eqe->module;
+        status_str = mlx5_pme_status_to_string(module_status);
+        if (module_status == MLX5_MODULE_STATUS_ERROR) {
+                const char *error_str = mlx5_pme_error_to_string(error_type);
+
                 mlx5_core_err(events->dev,
                               "Port module event[error]: module %u, %s, %s\n",
                               module_num, status_str, error_str);
-        else
+        } else {
                 mlx5_core_info(events->dev,
                                "Port module event: module %u, %s\n",
                                module_num, status_str);
+        }
 
         return NOTIFY_OK;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index 196c07383082..cb9fa3430c53 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -103,7 +103,7 @@ void mlx5_enter_error_state(struct mlx5_core_dev *dev, bool force)
         mlx5_core_err(dev, "start\n");
         if (pci_channel_offline(dev->pdev) || in_fatal(dev) || force) {
                 dev->state = MLX5_DEVICE_STATE_INTERNAL_ERROR;
-                mlx5_cmd_trigger_completions(dev);
+                mlx5_cmd_flush(dev);
         }
 
         mlx5_notifier_call_chain(dev->priv.events, MLX5_DEV_EVENT_SYS_ERROR, (void *)1);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
index 3a6baed722d8..2d223385dc81 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
@@ -616,6 +616,27 @@ void mlx5_lag_add(struct mlx5_core_dev *dev, struct net_device *netdev)
         }
 }
 
+int mlx5_lag_get_pf_num(struct mlx5_core_dev *dev, int *pf_num)
+{
+        struct mlx5_lag *ldev;
+        int n;
+
+        ldev = mlx5_lag_dev_get(dev);
+        if (!ldev) {
+                mlx5_core_warn(dev, "no lag device, can't get pf num\n");
+                return -EINVAL;
+        }
+
+        for (n = 0; n < MLX5_MAX_PORTS; n++)
+                if (ldev->pf[n].dev == dev) {
+                        *pf_num = n;
+                        return 0;
+                }
+
+        mlx5_core_warn(dev, "wasn't able to locate pf in the lag device\n");
+        return -EINVAL;
+}
+
 /* Must be called with intf_mutex held */
 void mlx5_lag_remove(struct mlx5_core_dev *dev)
 {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
index c68dcea5985b..4fdac020b795 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
@@ -126,6 +126,7 @@ u64 mlx5_read_internal_timer(struct mlx5_core_dev *dev,
                              struct ptp_system_timestamp *sts);
 
 void mlx5_cmd_trigger_completions(struct mlx5_core_dev *dev);
+void mlx5_cmd_flush(struct mlx5_core_dev *dev);
 int mlx5_cq_debugfs_init(struct mlx5_core_dev *dev);
 void mlx5_cq_debugfs_cleanup(struct mlx5_core_dev *dev);
 
@@ -187,6 +188,8 @@ static inline int mlx5_lag_is_lacp_owner(struct mlx5_core_dev *dev)
                     MLX5_CAP_GEN(dev, lag_master);
 }
 
+int mlx5_lag_get_pf_num(struct mlx5_core_dev *dev, int *pf_num);
+
 void mlx5_reload_interface(struct mlx5_core_dev *mdev, int protocol);
 void mlx5_lag_update(struct mlx5_core_dev *dev);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
index 388f205a497f..370ca94b6775 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
@@ -44,14 +44,15 @@ static struct mlx5_core_rsc_common *
 mlx5_get_rsc(struct mlx5_qp_table *table, u32 rsn)
 {
         struct mlx5_core_rsc_common *common;
+        unsigned long flags;
 
-        spin_lock(&table->lock);
+        spin_lock_irqsave(&table->lock, flags);
 
         common = radix_tree_lookup(&table->tree, rsn);
         if (common)
                 atomic_inc(&common->refcount);
 
-        spin_unlock(&table->lock);
+        spin_unlock_irqrestore(&table->lock, flags);
 
         return common;
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed.h b/drivers/net/ethernet/qlogic/qed/qed.h
index 24a90163775e..2d8a77cc156b 100644
--- a/drivers/net/ethernet/qlogic/qed/qed.h
+++ b/drivers/net/ethernet/qlogic/qed/qed.h
@@ -53,7 +53,7 @@
 extern const struct qed_common_ops qed_common_ops_pass;
 
 #define QED_MAJOR_VERSION               8
-#define QED_MINOR_VERSION               33
+#define QED_MINOR_VERSION               37
 #define QED_REVISION_VERSION            0
 #define QED_ENGINEERING_VERSION         20
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 8f6551421945..2ecaaaa4469a 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -795,19 +795,19 @@ static void qed_init_qm_pq(struct qed_hwfn *p_hwfn,
 
 /* get pq index according to PQ_FLAGS */
 static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn,
-                                           u32 pq_flags)
+                                           unsigned long pq_flags)
 {
         struct qed_qm_info *qm_info = &p_hwfn->qm_info;
 
         /* Can't have multiple flags set here */
-        if (bitmap_weight((unsigned long *)&pq_flags,
+        if (bitmap_weight(&pq_flags,
                           sizeof(pq_flags) * BITS_PER_BYTE) > 1) {
-                DP_ERR(p_hwfn, "requested multiple pq flags 0x%x\n", pq_flags);
+                DP_ERR(p_hwfn, "requested multiple pq flags 0x%lx\n", pq_flags);
                 goto err;
         }
 
         if (!(qed_get_pq_flags(p_hwfn) & pq_flags)) {
-                DP_ERR(p_hwfn, "pq flag 0x%x is not set\n", pq_flags);
+                DP_ERR(p_hwfn, "pq flag 0x%lx is not set\n", pq_flags);
                 goto err;
         }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index 67c02ea93906..58be1c4c6668 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -609,6 +609,10 @@ qed_sp_update_accept_mode(struct qed_hwfn *p_hwfn,
                           (!!(accept_filter & QED_ACCEPT_MCAST_MATCHED) &&
                            !!(accept_filter & QED_ACCEPT_MCAST_UNMATCHED)));
 
+                SET_FIELD(state, ETH_VPORT_TX_MODE_UCAST_ACCEPT_ALL,
+                          (!!(accept_filter & QED_ACCEPT_UCAST_MATCHED) &&
+                           !!(accept_filter & QED_ACCEPT_UCAST_UNMATCHED)));
+
                 SET_FIELD(state, ETH_VPORT_TX_MODE_BCAST_ACCEPT_ALL,
                           !!(accept_filter & QED_ACCEPT_BCAST));
 
@@ -744,6 +748,11 @@ int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
                 return rc;
         }
 
+        if (p_params->update_ctl_frame_check) {
+                p_cmn->ctl_frame_mac_check_en = p_params->mac_chk_en;
+                p_cmn->ctl_frame_ethtype_check_en = p_params->ethtype_chk_en;
+        }
+
         /* Update mcast bins for VFs, PF doesn't use this functionality */
         qed_sp_update_mcast_bin(p_hwfn, p_ramrod, p_params);
 
@@ -2207,7 +2216,7 @@ static int qed_fill_eth_dev_info(struct qed_dev *cdev,
                         u16 num_queues = 0;
 
                         /* Since the feature controls only queue-zones,
-                         * make sure we have the contexts [rx, tx, xdp] to
+                         * make sure we have the contexts [rx, xdp, tcs] to
                          * match.
                          */
                         for_each_hwfn(cdev, i) {
@@ -2217,7 +2226,8 @@ static int qed_fill_eth_dev_info(struct qed_dev *cdev,
                                 u16 cids;
 
                                 cids = hwfn->pf_params.eth_pf_params.num_cons;
-                                num_queues += min_t(u16, l2_queues, cids / 3);
+                                cids /= (2 + info->num_tc);
+                                num_queues += min_t(u16, l2_queues, cids);
                         }
 
                         /* queues might theoretically be >256, but interrupts'
@@ -2688,7 +2698,8 @@ static int qed_configure_filter_rx_mode(struct qed_dev *cdev,
         if (type == QED_FILTER_RX_MODE_TYPE_PROMISC) {
                 accept_flags.rx_accept_filter |= QED_ACCEPT_UCAST_UNMATCHED |
                                                  QED_ACCEPT_MCAST_UNMATCHED;
-                accept_flags.tx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
+                accept_flags.tx_accept_filter |= QED_ACCEPT_UCAST_UNMATCHED |
+                                                 QED_ACCEPT_MCAST_UNMATCHED;
         } else if (type == QED_FILTER_RX_MODE_TYPE_MULTI_PROMISC) {
                 accept_flags.rx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
                 accept_flags.tx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
@@ -2860,7 +2871,8 @@ static int qed_get_coalesce(struct qed_dev *cdev, u16 *coal, void *handle)
         p_hwfn = p_cid->p_owner;
         rc = qed_get_queue_coalesce(p_hwfn, coal, handle);
         if (rc)
-                DP_NOTICE(p_hwfn, "Unable to read queue coalescing\n");
+                DP_VERBOSE(cdev, QED_MSG_DEBUG,
+                           "Unable to read queue coalescing\n");
 
         return rc;
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.h b/drivers/net/ethernet/qlogic/qed/qed_l2.h
index 8d80f1095d17..7127d5aaac42 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.h
@@ -219,6 +219,9 @@ struct qed_sp_vport_update_params {
         struct qed_rss_params           *rss_params;
         struct qed_filter_accept_flags  accept_flags;
         struct qed_sge_tpa_params       *sge_tpa_params;
+        u8                              update_ctl_frame_check;
+        u8                              mac_chk_en;
+        u8                              ethtype_chk_en;
 };
 
 int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index d9237c65a838..b5f419b71287 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -2451,19 +2451,24 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
 {
         struct qed_ll2_tx_pkt_info pkt;
         const skb_frag_t *frag;
+        u8 flags = 0, nr_frags;
         int rc = -EINVAL, i;
         dma_addr_t mapping;
         u16 vlan = 0;
-        u8 flags = 0;
 
         if (unlikely(skb->ip_summed != CHECKSUM_NONE)) {
                 DP_INFO(cdev, "Cannot transmit a checksummed packet\n");
                 return -EINVAL;
         }
 
-        if (1 + skb_shinfo(skb)->nr_frags > CORE_LL2_TX_MAX_BDS_PER_PACKET) {
+        /* Cache number of fragments from SKB since SKB may be freed by
+         * the completion routine after calling qed_ll2_prepare_tx_packet()
+         */
+        nr_frags = skb_shinfo(skb)->nr_frags;
+
+        if (1 + nr_frags > CORE_LL2_TX_MAX_BDS_PER_PACKET) {
                 DP_ERR(cdev, "Cannot transmit a packet with %d fragments\n",
-                       1 + skb_shinfo(skb)->nr_frags);
+                       1 + nr_frags);
                 return -EINVAL;
         }
 
@@ -2485,7 +2490,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
         }
 
         memset(&pkt, 0, sizeof(pkt));
-        pkt.num_of_bds = 1 + skb_shinfo(skb)->nr_frags;
+        pkt.num_of_bds = 1 + nr_frags;
         pkt.vlan = vlan;
         pkt.bd_flags = flags;
         pkt.tx_dest = QED_LL2_TX_DEST_NW;
@@ -2496,12 +2501,17 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
             test_bit(QED_LL2_XMIT_FLAGS_FIP_DISCOVERY, &xmit_flags))
                 pkt.remove_stag = true;
 
+        /* qed_ll2_prepare_tx_packet() may actually send the packet if
+         * there are no fragments in the skb and subsequently the completion
+         * routine may run and free the SKB, so no dereferencing the SKB
+         * beyond this point unless skb has any fragments.
+         */
         rc = qed_ll2_prepare_tx_packet(&cdev->hwfns[0], cdev->ll2->handle,
                                        &pkt, 1);
         if (rc)
                 goto err;
 
-        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+        for (i = 0; i < nr_frags; i++) {
                 frag = &skb_shinfo(skb)->frags[i];
 
                 mapping = skb_frag_dma_map(&cdev->pdev->dev, frag, 0,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h
index 4179c9013fc6..96ab77ae6af5 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h
@@ -382,6 +382,7 @@ void qed_consq_setup(struct qed_hwfn *p_hwfn);
  * @param p_hwfn
  */
 void qed_consq_free(struct qed_hwfn *p_hwfn);
+int qed_spq_pend_post(struct qed_hwfn *p_hwfn);
 
 /**
  * @file
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
index 888274fa208b..5a495fda9e9d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
@@ -604,6 +604,9 @@ int qed_sp_pf_update_stag(struct qed_hwfn *p_hwfn)
 
         p_ent->ramrod.pf_update.update_mf_vlan_flag = true;
         p_ent->ramrod.pf_update.mf_vlan = cpu_to_le16(p_hwfn->hw_info.ovlan);
+        if (test_bit(QED_MF_UFP_SPECIFIC, &p_hwfn->cdev->mf_bits))
+                p_ent->ramrod.pf_update.mf_vlan |=
+                        cpu_to_le16(((u16)p_hwfn->ufp_info.tc << 13));
 
         return qed_spq_post(p_hwfn, p_ent, NULL);
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
index eb88bbc6b193..ba64ff9bedbd 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
@@ -397,6 +397,11 @@ int qed_eq_completion(struct qed_hwfn *p_hwfn, void *cookie)
 
         qed_eq_prod_update(p_hwfn, qed_chain_get_prod_idx(p_chain));
 
+        /* Attempt to post pending requests */
+        spin_lock_bh(&p_hwfn->p_spq->lock);
+        rc = qed_spq_pend_post(p_hwfn);
+        spin_unlock_bh(&p_hwfn->p_spq->lock);
+
         return rc;
 }
 
@@ -767,7 +772,7 @@ static int qed_spq_post_list(struct qed_hwfn *p_hwfn,
         return 0;
 }
 
-static int qed_spq_pend_post(struct qed_hwfn *p_hwfn)
+int qed_spq_pend_post(struct qed_hwfn *p_hwfn)
 {
         struct qed_spq *p_spq = p_hwfn->p_spq;
         struct qed_spq_entry *p_ent = NULL;
@@ -905,7 +910,6 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
         struct qed_spq_entry    *p_ent = NULL;
         struct qed_spq_entry    *tmp;
         struct qed_spq_entry    *found = NULL;
-        int                     rc;
 
         if (!p_hwfn)
                 return -EINVAL;
@@ -963,12 +967,7 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
                  */
                 qed_spq_return_entry(p_hwfn, found);
 
-        /* Attempt to post pending requests */
-        spin_lock_bh(&p_spq->lock);
-        rc = qed_spq_pend_post(p_hwfn);
-        spin_unlock_bh(&p_spq->lock);
-
-        return rc;
+        return 0;
 }
 
 int qed_consq_alloc(struct qed_hwfn *p_hwfn)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
index ca6290fa0f30..71a7af134dd8 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
@@ -1969,7 +1969,9 @@ static void qed_iov_vf_mbx_start_vport(struct qed_hwfn *p_hwfn,
         params.vport_id = vf->vport_id;
         params.max_buffers_per_cqe = start->max_buffers_per_cqe;
         params.mtu = vf->mtu;
-        params.check_mac = true;
+
+        /* Non trusted VFs should enable control frame filtering */
+        params.check_mac = !vf->p_vf_info.is_trusted_configured;
 
         rc = qed_sp_eth_vport_start(p_hwfn, &params);
         if (rc) {
@@ -5130,6 +5132,9 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn)
                 params.opaque_fid = vf->opaque_fid;
                 params.vport_id = vf->vport_id;
 
+                params.update_ctl_frame_check = 1;
+                params.mac_chk_en = !vf_info->is_trusted_configured;
+
                 if (vf_info->rx_accept_mode & mask) {
                         flags->update_rx_mode_config = 1;
                         flags->rx_accept_filter = vf_info->rx_accept_mode;
@@ -5147,7 +5152,8 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn)
                 }
 
                 if (flags->update_rx_mode_config ||
-                    flags->update_tx_mode_config)
+                    flags->update_tx_mode_config ||
+                    params.update_ctl_frame_check)
                         qed_sp_vport_update(hwfn, &params,
                                             QED_SPQ_MODE_EBLOCK, NULL);
         }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c
index b6cccf44bf40..5dda547772c1 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c
@@ -261,6 +261,7 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn)
         struct pfvf_acquire_resp_tlv *resp = &p_iov->pf2vf_reply->acquire_resp;
         struct pf_vf_pfdev_info *pfdev_info = &resp->pfdev_info;
         struct vf_pf_resc_request *p_resc;
+        u8 retry_cnt = VF_ACQUIRE_THRESH;
         bool resources_acquired = false;
         struct vfpf_acquire_tlv *req;
         int rc = 0, attempts = 0;
@@ -314,6 +315,15 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn)
 
                 /* send acquire request */
                 rc = qed_send_msg2pf(p_hwfn, &resp->hdr.status, sizeof(*resp));
+
+                /* Re-try acquire in case of vf-pf hw channel timeout */
+                if (retry_cnt && rc == -EBUSY) {
+                        DP_VERBOSE(p_hwfn, QED_MSG_IOV,
+                                   "VF retrying to acquire due to VPC timeout\n");
+                        retry_cnt--;
+                        continue;
+                }
+
                 if (rc)
                         goto exit;
 
diff --git a/drivers/net/ethernet/qlogic/qede/qede.h b/drivers/net/ethernet/qlogic/qede/qede.h
index 613249d1e967..730997b13747 100644
--- a/drivers/net/ethernet/qlogic/qede/qede.h
+++ b/drivers/net/ethernet/qlogic/qede/qede.h
@@ -56,7 +56,7 @@
 #include <net/tc_act/tc_gact.h>
 
 #define QEDE_MAJOR_VERSION              8
-#define QEDE_MINOR_VERSION              33
+#define QEDE_MINOR_VERSION              37
 #define QEDE_REVISION_VERSION           0
 #define QEDE_ENGINEERING_VERSION        20
 #define DRV_MODULE_VERSION __stringify(QEDE_MAJOR_VERSION) "."  \
@@ -494,6 +494,9 @@ struct qede_reload_args {
 
 /* Datapath functions definition */
 netdev_tx_t qede_start_xmit(struct sk_buff *skb, struct net_device *ndev);
+u16 qede_select_queue(struct net_device *dev, struct sk_buff *skb,
+                      struct net_device *sb_dev,
+                      select_queue_fallback_t fallback);
 netdev_features_t qede_features_check(struct sk_buff *skb,
                                       struct net_device *dev,
                                       netdev_features_t features);
diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c
index bdf816fe5a16..31b046e24565 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
@@ -1695,6 +1695,19 @@ netdev_tx_t qede_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         return NETDEV_TX_OK;
 }
 
+u16 qede_select_queue(struct net_device *dev, struct sk_buff *skb,
+                      struct net_device *sb_dev,
+                      select_queue_fallback_t fallback)
+{
+        struct qede_dev *edev = netdev_priv(dev);
+        int total_txq;
+
+        total_txq = QEDE_TSS_COUNT(edev) * edev->dev_info.num_tc;
+
+        return QEDE_TSS_COUNT(edev) ?
+                fallback(dev, skb, NULL) % total_txq :  0;
+}
+
 /* 8B udp header + 8B base tunnel header + 32B option length */
 #define QEDE_MAX_TUN_HDR_LEN 48
 
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index 5a74fcbdbc2b..9790f26d17c4 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -631,6 +631,7 @@ static const struct net_device_ops qede_netdev_ops = {
         .ndo_open = qede_open,
         .ndo_stop = qede_close,
         .ndo_start_xmit = qede_start_xmit,
+        .ndo_select_queue = qede_select_queue,
         .ndo_set_rx_mode = qede_set_rx_mode,
         .ndo_set_mac_address = qede_set_mac_addr,
         .ndo_validate_addr = eth_validate_addr,
@@ -666,6 +667,7 @@ static const struct net_device_ops qede_netdev_vf_ops = {
         .ndo_open = qede_open,
         .ndo_stop = qede_close,
         .ndo_start_xmit = qede_start_xmit,
+        .ndo_select_queue = qede_select_queue,
         .ndo_set_rx_mode = qede_set_rx_mode,
         .ndo_set_mac_address = qede_set_mac_addr,
         .ndo_validate_addr = eth_validate_addr,
@@ -684,6 +686,7 @@ static const struct net_device_ops qede_netdev_vf_xdp_ops = {
         .ndo_open = qede_open,
         .ndo_stop = qede_close,
         .ndo_start_xmit = qede_start_xmit,
+        .ndo_select_queue = qede_select_queue,
         .ndo_set_rx_mode = qede_set_rx_mode,
         .ndo_set_mac_address = qede_set_mac_addr,
         .ndo_validate_addr = eth_validate_addr,
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index 44f6e4873aad..4f910c4f67b0 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -691,7 +691,7 @@ static void cp_tx (struct cp_private *cp)
                         }
                         bytes_compl += skb->len;
                         pkts_compl++;
-                        dev_kfree_skb_irq(skb);
+                        dev_consume_skb_irq(skb);
                 }
 
                 cp->tx_skb[tx_tail] = NULL;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index abb94c543aa2..6e36b88ca7c9 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -1286,11 +1286,13 @@ static u16 rtl_get_events(struct rtl8169_private *tp)
 static void rtl_ack_events(struct rtl8169_private *tp, u16 bits)
 {
         RTL_W16(tp, IntrStatus, bits);
+        mmiowb();
 }
 
 static void rtl_irq_disable(struct rtl8169_private *tp)
 {
         RTL_W16(tp, IntrMask, 0);
+        mmiowb();
 }
 
 #define RTL_EVENT_NAPI_RX       (RxOK | RxErr)
@@ -6072,7 +6074,6 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
         struct device *d = tp_to_dev(tp);
         dma_addr_t mapping;
         u32 opts[2], len;
-        bool stop_queue;
         int frags;
 
         if (unlikely(!rtl_tx_slots_avail(tp, skb_shinfo(skb)->nr_frags))) {
@@ -6114,6 +6115,8 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
 
         txd->opts2 = cpu_to_le32(opts[1]);
 
+        netdev_sent_queue(dev, skb->len);
+
         skb_tx_timestamp(skb);
 
         /* Force memory writes to complete before releasing descriptor */
@@ -6126,14 +6129,16 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
 
         tp->cur_tx += frags + 1;
 
-        stop_queue = !rtl_tx_slots_avail(tp, MAX_SKB_FRAGS);
-        if (unlikely(stop_queue))
-                netif_stop_queue(dev);
+        RTL_W8(tp, TxPoll, NPQ);
 
-        if (__netdev_sent_queue(dev, skb->len, skb->xmit_more))
-                RTL_W8(tp, TxPoll, NPQ);
+        mmiowb();
 
-        if (unlikely(stop_queue)) {
+        if (!rtl_tx_slots_avail(tp, MAX_SKB_FRAGS)) {
+                /* Avoid wrongly optimistic queue wake-up: rtl_tx thread must
+                 * not miss a ring update when it notices a stopped queue.
+                 */
+                smp_wmb();
+                netif_stop_queue(dev);
                 /* Sync with rtl_tx:
                  * - publish queue status and cur_tx ring index (write barrier)
                  * - refresh dirty_tx ring index (read barrier).
@@ -6483,7 +6488,9 @@ static int rtl8169_poll(struct napi_struct *napi, int budget)
 
         if (work_done < budget) {
                 napi_complete_done(napi, work_done);
+
                 rtl_irq_enable(tp);
+                mmiowb();
         }
 
         return work_done;
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 2f2bda68d861..c08034154a9a 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -6115,7 +6115,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
 static int efx_ef10_mtd_probe(struct efx_nic *efx)
 {
         MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
-        DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
+        DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT) = { 0 };
         struct efx_mcdi_mtd_partition *parts;
         size_t outlen, n_parts_total, i, n_parts;
         unsigned int type;
diff --git a/drivers/net/ethernet/smsc/epic100.c b/drivers/net/ethernet/smsc/epic100.c
index 15c62c160953..be47d864f8b9 100644
--- a/drivers/net/ethernet/smsc/epic100.c
+++ b/drivers/net/ethernet/smsc/epic100.c
@@ -1037,7 +1037,7 @@ static void epic_tx(struct net_device *dev, struct epic_private *ep)
                 skb = ep->tx_skbuff[entry];
                 pci_unmap_single(ep->pci_dev, ep->tx_ring[entry].bufaddr,
                                  skb->len, PCI_DMA_TODEVICE);
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
                 ep->tx_skbuff[entry] = NULL;
         }
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
index 7b923362ee55..3b174eae77c1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
@@ -1342,8 +1342,10 @@ static int rk_gmac_powerup(struct rk_priv_data *bsp_priv)
         }
 
         ret = phy_power_on(bsp_priv, true);
-        if (ret)
+        if (ret) {
+                gmac_clk_enable(bsp_priv, false);
                 return ret;
+        }
 
         pm_runtime_enable(dev);
         pm_runtime_get_sync(dev);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
index d1f61c25d82b..5d85742a2be0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
@@ -721,8 +721,11 @@ static u32 stmmac_usec2riwt(u32 usec, struct stmmac_priv *priv)
 {
         unsigned long clk = clk_get_rate(priv->plat->stmmac_clk);
 
-        if (!clk)
-                return 0;
+        if (!clk) {
+                clk = priv->plat->clk_ref_rate;
+                if (!clk)
+                        return 0;
+        }
 
         return (usec * (clk / 1000000)) / 256;
 }
@@ -731,8 +734,11 @@ static u32 stmmac_riwt2usec(u32 riwt, struct stmmac_priv *priv)
 {
         unsigned long clk = clk_get_rate(priv->plat->stmmac_clk);
 
-        if (!clk)
-                return 0;
+        if (!clk) {
+                clk = priv->plat->clk_ref_rate;
+                if (!clk)
+                        return 0;
+        }
 
         return (riwt * 256) / (clk / 1000000);
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 5afba69981cf..685d20472358 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3023,10 +3023,22 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
 
         tx_q = &priv->tx_queue[queue];
 
+        if (priv->tx_path_in_lpi_mode)
+                stmmac_disable_eee_mode(priv);
+
         /* Manage oversized TCP frames for GMAC4 device */
         if (skb_is_gso(skb) && priv->tso) {
-                if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))
+                if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) {
+                        /*
+                         * There is no way to determine the number of TSO
+                         * capable Queues. Let's use always the Queue 0
+                         * because if TSO is supported then at least this
+                         * one will be capable.
+                         */
+                        skb_set_queue_mapping(skb, 0);
+
                         return stmmac_tso_xmit(skb, dev);
+                }
         }
 
         if (unlikely(stmmac_tx_avail(priv, queue) < nfrags + 1)) {
@@ -3041,9 +3053,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_BUSY;
         }
 
-        if (priv->tx_path_in_lpi_mode)
-                stmmac_disable_eee_mode(priv);
-
         entry = tx_q->cur_tx;
         first_entry = entry;
         WARN_ON(tx_q->tx_skbuff[first_entry]);
diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c
index 7ec4eb74fe21..6fc05c106afc 100644
--- a/drivers/net/ethernet/sun/cassini.c
+++ b/drivers/net/ethernet/sun/cassini.c
@@ -1898,7 +1898,7 @@ static inline void cas_tx_ringN(struct cas *cp, int ring, int limit)
                 cp->net_stats[ring].tx_packets++;
                 cp->net_stats[ring].tx_bytes += skb->len;
                 spin_unlock(&cp->stat_lock[ring]);
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
         }
         cp->tx_old[ring] = entry;
 
diff --git a/drivers/net/ethernet/sun/sunbmac.c b/drivers/net/ethernet/sun/sunbmac.c
index 720b7ac77f3b..e9b757b03b56 100644
--- a/drivers/net/ethernet/sun/sunbmac.c
+++ b/drivers/net/ethernet/sun/sunbmac.c
@@ -781,7 +781,7 @@ static void bigmac_tx(struct bigmac *bp)
 
                 DTX(("skb(%p) ", skb));
                 bp->tx_skbs[elem] = NULL;
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
 
                 elem = NEXT_TX(elem);
         }
diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
index ff641cf30a4e..d007dfeba5c3 100644
--- a/drivers/net/ethernet/sun/sunhme.c
+++ b/drivers/net/ethernet/sun/sunhme.c
@@ -1962,7 +1962,7 @@ static void happy_meal_tx(struct happy_meal *hp)
                         this = &txbase[elem];
                 }
 
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
                 dev->stats.tx_packets++;
         }
         hp->tx_old = elem;
diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
index dc966ddb6d81..b24c11187017 100644
--- a/drivers/net/ethernet/tehuti/tehuti.c
+++ b/drivers/net/ethernet/tehuti/tehuti.c
@@ -1739,7 +1739,7 @@ static void bdx_tx_cleanup(struct bdx_priv *priv)
                 tx_level -= db->rptr->len;      /* '-' koz len is negative */
 
                 /* now should come skb pointer - free it */
-                dev_kfree_skb_irq(db->rptr->addr.skb);
+                dev_consume_skb_irq(db->rptr->addr.skb);
                 bdx_tx_db_inc_rptr(db);
         }
 
diff --git a/drivers/net/ethernet/ti/cpmac.c b/drivers/net/ethernet/ti/cpmac.c
index 810dfc7de1f9..e2d47b24a869 100644
--- a/drivers/net/ethernet/ti/cpmac.c
+++ b/drivers/net/ethernet/ti/cpmac.c
@@ -608,7 +608,7 @@ static void cpmac_end_xmit(struct net_device *dev, int queue)
                         netdev_dbg(dev, "sent 0x%p, len=%d\n",
                                    desc->skb, desc->skb->len);
 
-                dev_kfree_skb_irq(desc->skb);
+                dev_consume_skb_irq(desc->skb);
                 desc->skb = NULL;
                 if (__netif_subqueue_stopped(dev, queue))
                         netif_wake_subqueue(dev, queue);
diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
index 82412691ee66..27f6cf140845 100644
--- a/drivers/net/ethernet/via/via-velocity.c
+++ b/drivers/net/ethernet/via/via-velocity.c
@@ -1740,7 +1740,7 @@ static void velocity_free_tx_buf(struct velocity_info *vptr,
                 dma_unmap_single(vptr->dev, tdinfo->skb_dma[i],
                                  le16_to_cpu(pktlen), DMA_TO_DEVICE);
         }
-        dev_kfree_skb_irq(skb);
+        dev_consume_skb_irq(skb);
         tdinfo->skb = NULL;
 }
 
diff --git a/drivers/net/fddi/defxx.c b/drivers/net/fddi/defxx.c
index 38ac8ef41f5f..56b7791911bf 100644
--- a/drivers/net/fddi/defxx.c
+++ b/drivers/net/fddi/defxx.c
@@ -3512,7 +3512,7 @@ static int dfx_xmt_done(DFX_board_t *bp)
                                  bp->descr_block_virt->xmt_data[comp].long_1,
                                  p_xmt_drv_descr->p_skb->len,
                                  DMA_TO_DEVICE);
-                dev_kfree_skb_irq(p_xmt_drv_descr->p_skb);
+                dev_consume_skb_irq(p_xmt_drv_descr->p_skb);
 
                 /*
                  * Move to start of next packet by updating completion index
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 58bbba8582b0..3377ac66a347 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1512,9 +1512,13 @@ static void geneve_link_config(struct net_device *dev,
         }
 #if IS_ENABLED(CONFIG_IPV6)
         case AF_INET6: {
-                struct rt6_info *rt = rt6_lookup(geneve->net,
-                                                 &info->key.u.ipv6.dst, NULL, 0,
-                                                 NULL, 0);
+                struct rt6_info *rt;
+
+                if (!__in6_dev_get(dev))
+                        break;
+
+                rt = rt6_lookup(geneve->net, &info->key.u.ipv6.dst, NULL, 0,
+                                NULL, 0);
 
                 if (rt && rt->dst.dev)
                         ldev_mtu = rt->dst.dev->mtu - GENEVE_IPV6_HLEN;
diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c
index 44de81e5f140..c589f5ae75bb 100644
--- a/drivers/net/ieee802154/mcr20a.c
+++ b/drivers/net/ieee802154/mcr20a.c
@@ -905,9 +905,9 @@ mcr20a_irq_clean_complete(void *context)
                 }
                 break;
         case (DAR_IRQSTS1_RXIRQ | DAR_IRQSTS1_SEQIRQ):
-                        /* rx is starting */
-                        dev_dbg(printdev(lp), "RX is starting\n");
-                        mcr20a_handle_rx(lp);
+                /* rx is starting */
+                dev_dbg(printdev(lp), "RX is starting\n");
+                mcr20a_handle_rx(lp);
                 break;
         case (DAR_IRQSTS1_RXIRQ | DAR_IRQSTS1_TXIRQ | DAR_IRQSTS1_SEQIRQ):
                 if (lp->is_tx) {
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 19bdde60680c..7cdac77d0c68 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -100,12 +100,12 @@ static int ipvlan_set_port_mode(struct ipvl_port *port, u16 nval,
                         err = ipvlan_register_nf_hook(read_pnet(&port->pnet));
                         if (!err) {
                                 mdev->l3mdev_ops = &ipvl_l3mdev_ops;
-                                mdev->priv_flags |= IFF_L3MDEV_MASTER;
+                                mdev->priv_flags |= IFF_L3MDEV_RX_HANDLER;
                         } else
                                 goto fail;
                 } else if (port->mode == IPVLAN_MODE_L3S) {
                         /* Old mode was L3S */
-                        mdev->priv_flags &= ~IFF_L3MDEV_MASTER;
+                        mdev->priv_flags &= ~IFF_L3MDEV_RX_HANDLER;
                         ipvlan_unregister_nf_hook(read_pnet(&port->pnet));
                         mdev->l3mdev_ops = NULL;
                 }
@@ -167,7 +167,7 @@ static void ipvlan_port_destroy(struct net_device *dev)
         struct sk_buff *skb;
 
         if (port->mode == IPVLAN_MODE_L3S) {
-                dev->priv_flags &= ~IFF_L3MDEV_MASTER;
+                dev->priv_flags &= ~IFF_L3MDEV_RX_HANDLER;
                 ipvlan_unregister_nf_hook(dev_net(dev));
                 dev->l3mdev_ops = NULL;
         }
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 18b41bc345ab..6e8807212aa3 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -898,14 +898,14 @@ static void decode_txts(struct dp83640_private *dp83640,
                         struct phy_txts *phy_txts)
 {
         struct skb_shared_hwtstamps shhwtstamps;
+        struct dp83640_skb_info *skb_info;
         struct sk_buff *skb;
-        u64 ns;
         u8 overflow;
+        u64 ns;
 
         /* We must already have the skb that triggered this. */
-
+again:
         skb = skb_dequeue(&dp83640->tx_queue);
-
         if (!skb) {
                 pr_debug("have timestamp but tx_queue empty\n");
                 return;
@@ -920,6 +920,11 @@ static void decode_txts(struct dp83640_private *dp83640,
                 }
                 return;
         }
+        skb_info = (struct dp83640_skb_info *)skb->cb;
+        if (time_after(jiffies, skb_info->tmo)) {
+                kfree_skb(skb);
+                goto again;
+        }
 
         ns = phy2txts(phy_txts);
         memset(&shhwtstamps, 0, sizeof(shhwtstamps));
@@ -1472,6 +1477,7 @@ static bool dp83640_rxtstamp(struct phy_device *phydev,
 static void dp83640_txtstamp(struct phy_device *phydev,
                              struct sk_buff *skb, int type)
 {
+        struct dp83640_skb_info *skb_info = (struct dp83640_skb_info *)skb->cb;
         struct dp83640_private *dp83640 = phydev->priv;
 
         switch (dp83640->hwts_tx_en) {
@@ -1484,6 +1490,7 @@ static void dp83640_txtstamp(struct phy_device *phydev,
                 /* fall through */
         case HWTSTAMP_TX_ON:
                 skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+                skb_info->tmo = jiffies + SKB_TIMESTAMP_TIMEOUT;
                 skb_queue_tail(&dp83640->tx_queue, skb);
                 break;
 
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 2e12f982534f..abb7876a8776 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -847,7 +847,6 @@ static int m88e1510_config_init(struct phy_device *phydev)
 
         /* SGMII-to-Copper mode initialization */
         if (phydev->interface == PHY_INTERFACE_MODE_SGMII) {
-
                 /* Select page 18 */
                 err = marvell_set_page(phydev, 18);
                 if (err < 0)
@@ -870,21 +869,6 @@ static int m88e1510_config_init(struct phy_device *phydev)
                 err = marvell_set_page(phydev, MII_MARVELL_COPPER_PAGE);
                 if (err < 0)
                         return err;
-
-                /* There appears to be a bug in the 88e1512 when used in
-                 * SGMII to copper mode, where the AN advertisement register
-                 * clears the pause bits each time a negotiation occurs.
-                 * This means we can never be truely sure what was advertised,
-                 * so disable Pause support.
-                 */
-                linkmode_clear_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
-                                   phydev->supported);
-                linkmode_clear_bit(ETHTOOL_LINK_MODE_Pause_BIT,
-                                   phydev->supported);
-                linkmode_clear_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT,
-                                   phydev->advertising);
-                linkmode_clear_bit(ETHTOOL_LINK_MODE_Pause_BIT,
-                                   phydev->advertising);
         }
 
         return m88e1318_config_init(phydev);
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 189cd2048c3a..c5675df5fc6f 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -553,7 +553,7 @@ int phy_start_aneg(struct phy_device *phydev)
         if (err < 0)
                 goto out_unlock;
 
-        if (__phy_is_started(phydev)) {
+        if (phy_is_started(phydev)) {
                 if (phydev->autoneg == AUTONEG_ENABLE) {
                         err = phy_check_link_status(phydev);
                 } else {
@@ -709,7 +709,7 @@ void phy_stop_machine(struct phy_device *phydev)
         cancel_delayed_work_sync(&phydev->state_queue);
 
         mutex_lock(&phydev->lock);
-        if (__phy_is_started(phydev))
+        if (phy_is_started(phydev))
                 phydev->state = PHY_UP;
         mutex_unlock(&phydev->lock);
 }
@@ -762,9 +762,6 @@ static irqreturn_t phy_interrupt(int irq, void *phy_dat)
 {
         struct phy_device *phydev = phy_dat;
 
-        if (!phy_is_started(phydev))
-                return IRQ_NONE;                /* It can't be ours.  */
-
         if (phydev->drv->did_interrupt && !phydev->drv->did_interrupt(phydev))
                 return IRQ_NONE;
 
@@ -842,15 +839,14 @@ EXPORT_SYMBOL(phy_stop_interrupts);
  */
 void phy_stop(struct phy_device *phydev)
 {
-        mutex_lock(&phydev->lock);
-
-        if (!__phy_is_started(phydev)) {
+        if (!phy_is_started(phydev)) {
                 WARN(1, "called from state %s\n",
                      phy_state_to_str(phydev->state));
-                mutex_unlock(&phydev->lock);
                 return;
         }
 
+        mutex_lock(&phydev->lock);
+
         if (phy_interrupt_is_valid(phydev))
                 phy_disable_interrupts(phydev);
 
@@ -989,8 +985,10 @@ void phy_state_machine(struct work_struct *work)
          * state machine would be pointless and possibly error prone when
          * called from phy_disconnect() synchronously.
          */
+        mutex_lock(&phydev->lock);
         if (phy_polling_mode(phydev) && phy_is_started(phydev))
                 phy_queue_state_machine(phydev, PHY_STATE_TIME);
+        mutex_unlock(&phydev->lock);
 }
 
 /**
diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
index e7becc7379d7..938803237d7f 100644
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -474,6 +474,17 @@ static void phylink_run_resolve(struct phylink *pl)
                 queue_work(system_power_efficient_wq, &pl->resolve);
 }
 
+static void phylink_run_resolve_and_disable(struct phylink *pl, int bit)
+{
+        unsigned long state = pl->phylink_disable_state;
+
+        set_bit(bit, &pl->phylink_disable_state);
+        if (state == 0) {
+                queue_work(system_power_efficient_wq, &pl->resolve);
+                flush_work(&pl->resolve);
+        }
+}
+
 static void phylink_fixed_poll(struct timer_list *t)
 {
         struct phylink *pl = container_of(t, struct phylink, link_poll);
@@ -924,9 +935,7 @@ void phylink_stop(struct phylink *pl)
         if (pl->link_an_mode == MLO_AN_FIXED && !IS_ERR(pl->link_gpio))
                 del_timer_sync(&pl->link_poll);
 
-        set_bit(PHYLINK_DISABLE_STOPPED, &pl->phylink_disable_state);
-        queue_work(system_power_efficient_wq, &pl->resolve);
-        flush_work(&pl->resolve);
+        phylink_run_resolve_and_disable(pl, PHYLINK_DISABLE_STOPPED);
 }
 EXPORT_SYMBOL_GPL(phylink_stop);
 
@@ -1632,9 +1641,7 @@ static void phylink_sfp_link_down(void *upstream)
 
         ASSERT_RTNL();
 
-        set_bit(PHYLINK_DISABLE_LINK, &pl->phylink_disable_state);
-        queue_work(system_power_efficient_wq, &pl->resolve);
-        flush_work(&pl->resolve);
+        phylink_run_resolve_and_disable(pl, PHYLINK_DISABLE_LINK);
 }
 
 static void phylink_sfp_link_up(void *upstream)
diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
index ad9db652874d..fef701bfad62 100644
--- a/drivers/net/phy/sfp-bus.c
+++ b/drivers/net/phy/sfp-bus.c
@@ -347,6 +347,7 @@ static int sfp_register_bus(struct sfp_bus *bus)
                                 return ret;
                 }
         }
+        bus->socket_ops->attach(bus->sfp);
         if (bus->started)
                 bus->socket_ops->start(bus->sfp);
         bus->netdev->sfp_bus = bus;
@@ -362,6 +363,7 @@ static void sfp_unregister_bus(struct sfp_bus *bus)
         if (bus->registered) {
                 if (bus->started)
                         bus->socket_ops->stop(bus->sfp);
+                bus->socket_ops->detach(bus->sfp);
                 if (bus->phydev && ops && ops->disconnect_phy)
                         ops->disconnect_phy(bus->upstream);
         }
diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
index fd8bb998ae52..68c8fbf099f8 100644
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -184,6 +184,7 @@ struct sfp {
 
         struct gpio_desc *gpio[GPIO_MAX];
 
+        bool attached;
         unsigned int state;
         struct delayed_work poll;
         struct delayed_work timeout;
@@ -1475,7 +1476,7 @@ static void sfp_sm_event(struct sfp *sfp, unsigned int event)
          */
         switch (sfp->sm_mod_state) {
         default:
-                if (event == SFP_E_INSERT) {
+                if (event == SFP_E_INSERT && sfp->attached) {
                         sfp_module_tx_disable(sfp);
                         sfp_sm_ins_next(sfp, SFP_MOD_PROBE, T_PROBE_INIT);
                 }
@@ -1607,6 +1608,19 @@ static void sfp_sm_event(struct sfp *sfp, unsigned int event)
         mutex_unlock(&sfp->sm_mutex);
 }
 
+static void sfp_attach(struct sfp *sfp)
+{
+        sfp->attached = true;
+        if (sfp->state & SFP_F_PRESENT)
+                sfp_sm_event(sfp, SFP_E_INSERT);
+}
+
+static void sfp_detach(struct sfp *sfp)
+{
+        sfp->attached = false;
+        sfp_sm_event(sfp, SFP_E_REMOVE);
+}
+
 static void sfp_start(struct sfp *sfp)
 {
         sfp_sm_event(sfp, SFP_E_DEV_UP);
@@ -1667,6 +1681,8 @@ static int sfp_module_eeprom(struct sfp *sfp, struct ethtool_eeprom *ee,
 }
 
 static const struct sfp_socket_ops sfp_module_ops = {
+        .attach = sfp_attach,
+        .detach = sfp_detach,
         .start = sfp_start,
         .stop = sfp_stop,
         .module_info = sfp_module_info,
@@ -1834,10 +1850,6 @@ static int sfp_probe(struct platform_device *pdev)
         dev_info(sfp->dev, "Host maximum power %u.%uW\n",
                  sfp->max_power_mW / 1000, (sfp->max_power_mW / 100) % 10);
 
-        sfp->sfp_bus = sfp_register_socket(sfp->dev, sfp, &sfp_module_ops);
-        if (!sfp->sfp_bus)
-                return -ENOMEM;
-
         /* Get the initial state, and always signal TX disable,
          * since the network interface will not be up.
          */
@@ -1848,10 +1860,6 @@ static int sfp_probe(struct platform_device *pdev)
                 sfp->state |= SFP_F_RATE_SELECT;
         sfp_set_state(sfp, sfp->state);
         sfp_module_tx_disable(sfp);
-        rtnl_lock();
-        if (sfp->state & SFP_F_PRESENT)
-                sfp_sm_event(sfp, SFP_E_INSERT);
-        rtnl_unlock();
 
         for (i = 0; i < GPIO_MAX; i++) {
                 if (gpio_flags[i] != GPIOD_IN || !sfp->gpio[i])
@@ -1884,6 +1892,10 @@ static int sfp_probe(struct platform_device *pdev)
                 dev_warn(sfp->dev,
                          "No tx_disable pin: SFP modules will always be emitting.\n");
 
+        sfp->sfp_bus = sfp_register_socket(sfp->dev, sfp, &sfp_module_ops);
+        if (!sfp->sfp_bus)
+                return -ENOMEM;
+
         return 0;
 }
 
diff --git a/drivers/net/phy/sfp.h b/drivers/net/phy/sfp.h
index 31b0acf337e2..64f54b0bbd8c 100644
--- a/drivers/net/phy/sfp.h
+++ b/drivers/net/phy/sfp.h
@@ -7,6 +7,8 @@
 struct sfp;
 
 struct sfp_socket_ops {
+        void (*attach)(struct sfp *sfp);
+        void (*detach)(struct sfp *sfp);
         void (*start)(struct sfp *sfp);
         void (*stop)(struct sfp *sfp);
         int (*module_info)(struct sfp *sfp, struct ethtool_modinfo *modinfo);
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index afd9d25d1992..958f1cf67282 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -256,17 +256,6 @@ static void __team_option_inst_mark_removed_port(struct team *team,
         }
 }
 
-static bool __team_option_inst_tmp_find(const struct list_head *opts,
-                                        const struct team_option_inst *needle)
-{
-        struct team_option_inst *opt_inst;
-
-        list_for_each_entry(opt_inst, opts, tmp_list)
-                if (opt_inst == needle)
-                        return true;
-        return false;
-}
-
 static int __team_options_register(struct team *team,
                                    const struct team_option *option,
                                    size_t option_count)
@@ -2460,7 +2449,6 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
         int err = 0;
         int i;
         struct nlattr *nl_option;
-        LIST_HEAD(opt_inst_list);
 
         rtnl_lock();
 
@@ -2480,6 +2468,7 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
                 struct nlattr *opt_attrs[TEAM_ATTR_OPTION_MAX + 1];
                 struct nlattr *attr;
                 struct nlattr *attr_data;
+                LIST_HEAD(opt_inst_list);
                 enum team_option_type opt_type;
                 int opt_port_ifindex = 0; /* != 0 for per-port options */
                 u32 opt_array_index = 0;
@@ -2584,23 +2573,17 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
                         if (err)
                                 goto team_put;
                         opt_inst->changed = true;
-
-                        /* dumb/evil user-space can send us duplicate opt,
-                         * keep only the last one
-                         */
-                        if (__team_option_inst_tmp_find(&opt_inst_list,
-                                                        opt_inst))
-                                continue;
-
                         list_add(&opt_inst->tmp_list, &opt_inst_list);
                 }
                 if (!opt_found) {
                         err = -ENOENT;
                         goto team_put;
                 }
-        }
 
-        err = team_nl_send_event_options_get(team, &opt_inst_list);
+                err = team_nl_send_event_options_get(team, &opt_inst_list);
+                if (err)
+                        break;
+        }
 
 team_put:
         team_nl_team_put(team);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 18656c4094b3..fed298c0cb39 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -866,8 +866,6 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
         if (rtnl_dereference(tun->xdp_prog))
                 sock_set_flag(&tfile->sk, SOCK_XDP);
 
-        tun_set_real_num_queues(tun);
-
         /* device is allowed to go away first, so no need to hold extra
          * refcnt.
          */
@@ -879,6 +877,7 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
         rcu_assign_pointer(tfile->tun, tun);
         rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
         tun->numqueues++;
+        tun_set_real_num_queues(tun);
 out:
         return err;
 }
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 8fadd8eaf601..4cfceb789eea 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -57,6 +57,8 @@ module_param(napi_tx, bool, 0644);
 #define VIRTIO_XDP_TX           BIT(0)
 #define VIRTIO_XDP_REDIR        BIT(1)
 
+#define VIRTIO_XDP_FLAG BIT(0)
+
 /* RX packet size EWMA. The average packet size is used to determine the packet
  * buffer size when refilling RX rings. As the entire RX ring may be refilled
  * at once, the weight is chosen so that the EWMA will be insensitive to short-
@@ -252,6 +254,21 @@ struct padded_vnet_hdr {
         char padding[4];
 };
 
+static bool is_xdp_frame(void *ptr)
+{
+        return (unsigned long)ptr & VIRTIO_XDP_FLAG;
+}
+
+static void *xdp_to_ptr(struct xdp_frame *ptr)
+{
+        return (void *)((unsigned long)ptr | VIRTIO_XDP_FLAG);
+}
+
+static struct xdp_frame *ptr_to_xdp(void *ptr)
+{
+        return (struct xdp_frame *)((unsigned long)ptr & ~VIRTIO_XDP_FLAG);
+}
+
 /* Converting between virtqueue no. and kernel tx/rx queue no.
  * 0:rx0 1:tx0 2:rx1 3:tx1 ... 2N:rxN 2N+1:txN 2N+2:cvq
  */
@@ -462,7 +479,8 @@ static int __virtnet_xdp_xmit_one(struct virtnet_info *vi,
 
         sg_init_one(sq->sg, xdpf->data, xdpf->len);
 
-        err = virtqueue_add_outbuf(sq->vq, sq->sg, 1, xdpf, GFP_ATOMIC);
+        err = virtqueue_add_outbuf(sq->vq, sq->sg, 1, xdp_to_ptr(xdpf),
+                                   GFP_ATOMIC);
         if (unlikely(err))
                 return -ENOSPC; /* Caller handle free/refcnt */
 
@@ -482,36 +500,47 @@ static int virtnet_xdp_xmit(struct net_device *dev,
 {
         struct virtnet_info *vi = netdev_priv(dev);
         struct receive_queue *rq = vi->rq;
-        struct xdp_frame *xdpf_sent;
         struct bpf_prog *xdp_prog;
         struct send_queue *sq;
         unsigned int len;
+        int packets = 0;
+        int bytes = 0;
         int drops = 0;
         int kicks = 0;
         int ret, err;
+        void *ptr;
         int i;
 
-        sq = virtnet_xdp_sq(vi);
-
-        if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {
-                ret = -EINVAL;
-                drops = n;
-                goto out;
-        }
-
         /* Only allow ndo_xdp_xmit if XDP is loaded on dev, as this
          * indicate XDP resources have been successfully allocated.
          */
         xdp_prog = rcu_dereference(rq->xdp_prog);
-        if (!xdp_prog) {
-                ret = -ENXIO;
+        if (!xdp_prog)
+                return -ENXIO;
+
+        sq = virtnet_xdp_sq(vi);
+
+        if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {
+                ret = -EINVAL;
                 drops = n;
                 goto out;
         }
 
         /* Free up any pending old buffers before queueing new ones. */
-        while ((xdpf_sent = virtqueue_get_buf(sq->vq, &len)) != NULL)
-                xdp_return_frame(xdpf_sent);
+        while ((ptr = virtqueue_get_buf(sq->vq, &len)) != NULL) {
+                if (likely(is_xdp_frame(ptr))) {
+                        struct xdp_frame *frame = ptr_to_xdp(ptr);
+
+                        bytes += frame->len;
+                        xdp_return_frame(frame);
+                } else {
+                        struct sk_buff *skb = ptr;
+
+                        bytes += skb->len;
+                        napi_consume_skb(skb, false);
+                }
+                packets++;
+        }
 
         for (i = 0; i < n; i++) {
                 struct xdp_frame *xdpf = frames[i];
@@ -530,6 +559,8 @@ static int virtnet_xdp_xmit(struct net_device *dev,
         }
 out:
         u64_stats_update_begin(&sq->stats.syncp);
+        sq->stats.bytes += bytes;
+        sq->stats.packets += packets;
         sq->stats.xdp_tx += n;
         sq->stats.xdp_tx_drops += drops;
         sq->stats.kicks += kicks;
@@ -1332,18 +1363,26 @@ static int virtnet_receive(struct receive_queue *rq, int budget,
 
 static void free_old_xmit_skbs(struct send_queue *sq, bool in_napi)
 {
-        struct sk_buff *skb;
         unsigned int len;
         unsigned int packets = 0;
         unsigned int bytes = 0;
+        void *ptr;
 
-        while ((skb = virtqueue_get_buf(sq->vq, &len)) != NULL) {
-                pr_debug("Sent skb %p\n", skb);
+        while ((ptr = virtqueue_get_buf(sq->vq, &len)) != NULL) {
+                if (likely(!is_xdp_frame(ptr))) {
+                        struct sk_buff *skb = ptr;
 
-                bytes += skb->len;
-                packets++;
+                        pr_debug("Sent skb %p\n", skb);
+
+                        bytes += skb->len;
+                        napi_consume_skb(skb, in_napi);
+                } else {
+                        struct xdp_frame *frame = ptr_to_xdp(ptr);
 
-                napi_consume_skb(skb, in_napi);
+                        bytes += frame->len;
+                        xdp_return_frame(frame);
+                }
+                packets++;
         }
 
         /* Avoid overhead when no packets have been processed
@@ -1358,6 +1397,16 @@ static void free_old_xmit_skbs(struct send_queue *sq, bool in_napi)
         u64_stats_update_end(&sq->stats.syncp);
 }
 
+static bool is_xdp_raw_buffer_queue(struct virtnet_info *vi, int q)
+{
+        if (q < (vi->curr_queue_pairs - vi->xdp_queue_pairs))
+                return false;
+        else if (q < vi->curr_queue_pairs)
+                return true;
+        else
+                return false;
+}
+
 static void virtnet_poll_cleantx(struct receive_queue *rq)
 {
         struct virtnet_info *vi = rq->vq->vdev->priv;
@@ -1365,7 +1414,7 @@ static void virtnet_poll_cleantx(struct receive_queue *rq)
         struct send_queue *sq = &vi->sq[index];
         struct netdev_queue *txq = netdev_get_tx_queue(vi->dev, index);
 
-        if (!sq->napi.weight)
+        if (!sq->napi.weight || is_xdp_raw_buffer_queue(vi, index))
                 return;
 
         if (__netif_tx_trylock(txq)) {
@@ -1442,8 +1491,16 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget)
 {
         struct send_queue *sq = container_of(napi, struct send_queue, napi);
         struct virtnet_info *vi = sq->vq->vdev->priv;
-        struct netdev_queue *txq = netdev_get_tx_queue(vi->dev, vq2txq(sq->vq));
+        unsigned int index = vq2txq(sq->vq);
+        struct netdev_queue *txq;
 
+        if (unlikely(is_xdp_raw_buffer_queue(vi, index))) {
+                /* We don't need to enable cb for XDP */
+                napi_complete_done(napi, 0);
+                return 0;
+        }
+
+        txq = netdev_get_tx_queue(vi->dev, index);
         __netif_tx_lock(txq, raw_smp_processor_id());
         free_old_xmit_skbs(sq, true);
         __netif_tx_unlock(txq);
@@ -2395,6 +2452,10 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
                 return -ENOMEM;
         }
 
+        old_prog = rtnl_dereference(vi->rq[0].xdp_prog);
+        if (!prog && !old_prog)
+                return 0;
+
         if (prog) {
                 prog = bpf_prog_add(prog, vi->max_queue_pairs - 1);
                 if (IS_ERR(prog))
@@ -2402,36 +2463,62 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
         }
 
         /* Make sure NAPI is not using any XDP TX queues for RX. */
-        if (netif_running(dev))
-                for (i = 0; i < vi->max_queue_pairs; i++)
+        if (netif_running(dev)) {
+                for (i = 0; i < vi->max_queue_pairs; i++) {
                         napi_disable(&vi->rq[i].napi);
+                        virtnet_napi_tx_disable(&vi->sq[i].napi);
+                }
+        }
+
+        if (!prog) {
+                for (i = 0; i < vi->max_queue_pairs; i++) {
+                        rcu_assign_pointer(vi->rq[i].xdp_prog, prog);
+                        if (i == 0)
+                                virtnet_restore_guest_offloads(vi);
+                }
+                synchronize_net();
+        }
 
-        netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp);
         err = _virtnet_set_queues(vi, curr_qp + xdp_qp);
         if (err)
                 goto err;
+        netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp);
         vi->xdp_queue_pairs = xdp_qp;
 
-        for (i = 0; i < vi->max_queue_pairs; i++) {
-                old_prog = rtnl_dereference(vi->rq[i].xdp_prog);
-                rcu_assign_pointer(vi->rq[i].xdp_prog, prog);
-                if (i == 0) {
-                        if (!old_prog)
+        if (prog) {
+                for (i = 0; i < vi->max_queue_pairs; i++) {
+                        rcu_assign_pointer(vi->rq[i].xdp_prog, prog);
+                        if (i == 0 && !old_prog)
                                 virtnet_clear_guest_offloads(vi);
-                        if (!prog)
-                                virtnet_restore_guest_offloads(vi);
                 }
+        }
+
+        for (i = 0; i < vi->max_queue_pairs; i++) {
                 if (old_prog)
                         bpf_prog_put(old_prog);
-                if (netif_running(dev))
+                if (netif_running(dev)) {
                         virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
+                        virtnet_napi_tx_enable(vi, vi->sq[i].vq,
+                                               &vi->sq[i].napi);
+                }
         }
 
         return 0;
 
 err:
-        for (i = 0; i < vi->max_queue_pairs; i++)
-                virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
+        if (!prog) {
+                virtnet_clear_guest_offloads(vi);
+                for (i = 0; i < vi->max_queue_pairs; i++)
+                        rcu_assign_pointer(vi->rq[i].xdp_prog, old_prog);
+        }
+
+        if (netif_running(dev)) {
+                for (i = 0; i < vi->max_queue_pairs; i++) {
+                        virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
+                        virtnet_napi_tx_enable(vi, vi->sq[i].vq,
+                                               &vi->sq[i].napi);
+                }
+        }
         if (prog)
                 bpf_prog_sub(prog, vi->max_queue_pairs - 1);
         return err;
@@ -2613,16 +2700,6 @@ static void free_receive_page_frags(struct virtnet_info *vi)
                         put_page(vi->rq[i].alloc_frag.page);
 }
 
-static bool is_xdp_raw_buffer_queue(struct virtnet_info *vi, int q)
-{
-        if (q < (vi->curr_queue_pairs - vi->xdp_queue_pairs))
-                return false;
-        else if (q < vi->curr_queue_pairs)
-                return true;
-        else
-                return false;
-}
-
 static void free_unused_bufs(struct virtnet_info *vi)
 {
         void *buf;
@@ -2631,10 +2708,10 @@ static void free_unused_bufs(struct virtnet_info *vi)
         for (i = 0; i < vi->max_queue_pairs; i++) {
                 struct virtqueue *vq = vi->sq[i].vq;
                 while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) {
-                        if (!is_xdp_raw_buffer_queue(vi, i))
+                        if (!is_xdp_frame(buf))
                                 dev_kfree_skb(buf);
                         else
-                                put_page(virt_to_head_page(buf));
+                                xdp_return_frame(ptr_to_xdp(buf));
                 }
         }
 
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 5209ee9aac47..2aae11feff0c 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2219,7 +2219,7 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
         struct pcpu_sw_netstats *tx_stats, *rx_stats;
         union vxlan_addr loopback;
         union vxlan_addr *remote_ip = &dst_vxlan->default_dst.remote_ip;
-        struct net_device *dev = skb->dev;
+        struct net_device *dev;
         int len = skb->len;
 
         tx_stats = this_cpu_ptr(src_vxlan->dev->tstats);
@@ -2239,9 +2239,15 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
 #endif
         }
 
+        rcu_read_lock();
+        dev = skb->dev;
+        if (unlikely(!(dev->flags & IFF_UP))) {
+                kfree_skb(skb);
+                goto drop;
+        }
+
         if (dst_vxlan->cfg.flags & VXLAN_F_LEARN)
-                vxlan_snoop(skb->dev, &loopback, eth_hdr(skb)->h_source, 0,
-                            vni);
+                vxlan_snoop(dev, &loopback, eth_hdr(skb)->h_source, 0, vni);
 
         u64_stats_update_begin(&tx_stats->syncp);
         tx_stats->tx_packets++;
@@ -2254,8 +2260,10 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
                 rx_stats->rx_bytes += len;
                 u64_stats_update_end(&rx_stats->syncp);
         } else {
+drop:
                 dev->stats.rx_dropped++;
         }
+        rcu_read_unlock();
 }
 
 static int encap_bypass_if_local(struct sk_buff *skb, struct net_device *dev,
diff --git a/drivers/net/wan/dscc4.c b/drivers/net/wan/dscc4.c
index c0b0f525c87c..27decf8ae840 100644
--- a/drivers/net/wan/dscc4.c
+++ b/drivers/net/wan/dscc4.c
@@ -1575,7 +1575,7 @@ try:
                                         dev->stats.tx_packets++;
                                         dev->stats.tx_bytes += skb->len;
                                 }
-                                dev_kfree_skb_irq(skb);
+                                dev_consume_skb_irq(skb);
                                 dpriv->tx_skbuff[cur] = NULL;
                                 ++dpriv->tx_dirty;
                         } else {
diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index 66d889d54e58..a08f04c3f644 100644
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -482,7 +482,7 @@ static int hdlc_tx_done(struct ucc_hdlc_private *priv)
                 memset(priv->tx_buffer +
                        (be32_to_cpu(bd->buf) - priv->dma_tx_addr),
                        0, skb->len);
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
 
                 priv->tx_skbuff[priv->skb_dirtytx] = NULL;
                 priv->skb_dirtytx =
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 399b501f3c3c..e8891f5fc83a 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -548,7 +548,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
         {
                 .id = WCN3990_HW_1_0_DEV_VERSION,
                 .dev_id = 0,
-                .bus = ATH10K_BUS_PCI,
+                .bus = ATH10K_BUS_SNOC,
                 .name = "wcn3990 hw1.0",
                 .continuous_frag_desc = true,
                 .tx_chain_mask = 0x7,
diff --git a/drivers/net/wireless/intel/iwlwifi/Kconfig b/drivers/net/wireless/intel/iwlwifi/Kconfig
index 491ca3c8b43c..83d5bceea08f 100644
--- a/drivers/net/wireless/intel/iwlwifi/Kconfig
+++ b/drivers/net/wireless/intel/iwlwifi/Kconfig
@@ -1,6 +1,6 @@
 config IWLWIFI
         tristate "Intel Wireless WiFi Next Gen AGN - Wireless-N/Advanced-N/Ultimate-N (iwlwifi) "
-        depends on PCI && HAS_IOMEM
+        depends on PCI && HAS_IOMEM && CFG80211
         select FW_LOADER
         ---help---
           Select to build the driver supporting the:
@@ -47,6 +47,7 @@ if IWLWIFI
 config IWLWIFI_LEDS
         bool
         depends on LEDS_CLASS=y || LEDS_CLASS=IWLWIFI
+        depends on IWLMVM || IWLDVM
         select LEDS_TRIGGERS
         select MAC80211_LEDS
         default y
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c
index 497e762978cc..b2cabce1d74d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c
@@ -212,24 +212,24 @@ void mt76x0_get_tx_power_per_rate(struct mt76x02_dev *dev)
         mt76x02_add_rate_power_offset(t, delta);
 }
 
-void mt76x0_get_power_info(struct mt76x02_dev *dev, u8 *info)
+void mt76x0_get_power_info(struct mt76x02_dev *dev, s8 *tp)
 {
         struct mt76x0_chan_map {
                 u8 chan;
                 u8 offset;
         } chan_map[] = {
-                {   2,  0 }, {   4,  1 }, {   6,  2 }, {   8,  3 },
-                {  10,  4 }, {  12,  5 }, {  14,  6 }, {  38,  0 },
-                {  44,  1 }, {  48,  2 }, {  54,  3 }, {  60,  4 },
-                {  64,  5 }, { 102,  6 }, { 108,  7 }, { 112,  8 },
-                { 118,  9 }, { 124, 10 }, { 128, 11 }, { 134, 12 },
-                { 140, 13 }, { 151, 14 }, { 157, 15 }, { 161, 16 },
-                { 167, 17 }, { 171, 18 }, { 173, 19 },
+                {   2,  0 }, {   4,  2 }, {   6,  4 }, {   8,  6 },
+                {  10,  8 }, {  12, 10 }, {  14, 12 }, {  38,  0 },
+                {  44,  2 }, {  48,  4 }, {  54,  6 }, {  60,  8 },
+                {  64, 10 }, { 102, 12 }, { 108, 14 }, { 112, 16 },
+                { 118, 18 }, { 124, 20 }, { 128, 22 }, { 134, 24 },
+                { 140, 26 }, { 151, 28 }, { 157, 30 }, { 161, 32 },
+                { 167, 34 }, { 171, 36 }, { 175, 38 },
         };
         struct ieee80211_channel *chan = dev->mt76.chandef.chan;
         u8 offset, addr;
+        int i, idx = 0;
         u16 data;
-        int i;
 
         if (mt76x0_tssi_enabled(dev)) {
                 s8 target_power;
@@ -239,14 +239,14 @@ void mt76x0_get_power_info(struct mt76x02_dev *dev, u8 *info)
                 else
                         data = mt76x02_eeprom_get(dev, MT_EE_2G_TARGET_POWER);
                 target_power = (data & 0xff) - dev->mt76.rate_power.ofdm[7];
-                info[0] = target_power + mt76x0_get_delta(dev);
-                info[1] = 0;
+                *tp = target_power + mt76x0_get_delta(dev);
 
                 return;
         }
 
         for (i = 0; i < ARRAY_SIZE(chan_map); i++) {
-                if (chan_map[i].chan <= chan->hw_value) {
+                if (chan->hw_value <= chan_map[i].chan) {
+                        idx = (chan->hw_value == chan_map[i].chan);
                         offset = chan_map[i].offset;
                         break;
                 }
@@ -258,13 +258,16 @@ void mt76x0_get_power_info(struct mt76x02_dev *dev, u8 *info)
                 addr = MT_EE_TX_POWER_DELTA_BW80 + offset;
         } else {
                 switch (chan->hw_value) {
+                case 42:
+                        offset = 2;
+                        break;
                 case 58:
                         offset = 8;
                         break;
                 case 106:
                         offset = 14;
                         break;
-                case 112:
+                case 122:
                         offset = 20;
                         break;
                 case 155:
@@ -277,14 +280,9 @@ void mt76x0_get_power_info(struct mt76x02_dev *dev, u8 *info)
         }
 
         data = mt76x02_eeprom_get(dev, addr);
-
-        info[0] = data;
-        if (!info[0] || info[0] > 0x3f)
-                info[0] = 5;
-
-        info[1] = data >> 8;
-        if (!info[1] || info[1] > 0x3f)
-                info[1] = 5;
+        *tp = data >> (8 * idx);
+        if (*tp < 0 || *tp > 0x3f)
+                *tp = 5;
 }
 
 static int mt76x0_check_eeprom(struct mt76x02_dev *dev)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.h
index ee9ade9f3c8b..42b259f90b6d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.h
@@ -26,7 +26,7 @@ struct mt76x02_dev;
 int mt76x0_eeprom_init(struct mt76x02_dev *dev);
 void mt76x0_read_rx_gain(struct mt76x02_dev *dev);
 void mt76x0_get_tx_power_per_rate(struct mt76x02_dev *dev);
-void mt76x0_get_power_info(struct mt76x02_dev *dev, u8 *info);
+void mt76x0_get_power_info(struct mt76x02_dev *dev, s8 *tp);
 
 static inline s8 s6_to_s8(u32 val)
 {
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
index 1eb1a802ed20..b6166703ad76 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
@@ -845,17 +845,17 @@ static void mt76x0_phy_tssi_calibrate(struct mt76x02_dev *dev)
 void mt76x0_phy_set_txpower(struct mt76x02_dev *dev)
 {
         struct mt76_rate_power *t = &dev->mt76.rate_power;
-        u8 info[2];
+        s8 info;
 
         mt76x0_get_tx_power_per_rate(dev);
-        mt76x0_get_power_info(dev, info);
+        mt76x0_get_power_info(dev, &info);
 
-        mt76x02_add_rate_power_offset(t, info[0]);
+        mt76x02_add_rate_power_offset(t, info);
         mt76x02_limit_rate_power(t, dev->mt76.txpower_conf);
         dev->mt76.txpower_cur = mt76x02_get_max_rate_power(t);
-        mt76x02_add_rate_power_offset(t, -info[0]);
+        mt76x02_add_rate_power_offset(t, -info);
 
-        mt76x02_phy_set_txpower(dev, info[0], info[1]);
+        mt76x02_phy_set_txpower(dev, info, info);
 }
 
 void mt76x0_phy_calibrate(struct mt76x02_dev *dev, bool power_on)
diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
index bd10165d7eec..4d4b07701149 100644
--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -164,6 +164,12 @@ static int wl12xx_sdio_power_on(struct wl12xx_sdio_glue *glue)
         }
 
         sdio_claim_host(func);
+        /*
+         * To guarantee that the SDIO card is power cycled, as required to make
+         * the FW programming to succeed, let's do a brute force HW reset.
+         */
+        mmc_hw_reset(card->host);
+
         sdio_enable_func(func);
         sdio_release_host(func);
 
@@ -174,20 +180,13 @@ static int wl12xx_sdio_power_off(struct wl12xx_sdio_glue *glue)
 {
         struct sdio_func *func = dev_to_sdio_func(glue->dev);
         struct mmc_card *card = func->card;
-        int error;
 
         sdio_claim_host(func);
         sdio_disable_func(func);
         sdio_release_host(func);
 
         /* Let runtime PM know the card is powered off */
-        error = pm_runtime_put(&card->dev);
-        if (error < 0 && error != -EBUSY) {
-                dev_err(&card->dev, "%s failed: %i\n", __func__, error);
-
-                return error;
-        }
-
+        pm_runtime_put(&card->dev);
         return 0;
 }
 
diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
index 52e47dac028f..80f843030e36 100644
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -310,6 +310,9 @@ static int imx6_pcie_attach_pd(struct device *dev)
         imx6_pcie->pd_pcie = dev_pm_domain_attach_by_name(dev, "pcie");
         if (IS_ERR(imx6_pcie->pd_pcie))
                 return PTR_ERR(imx6_pcie->pd_pcie);
+        /* Do nothing when power domain missing */
+        if (!imx6_pcie->pd_pcie)
+                return 0;
         link = device_link_add(dev, imx6_pcie->pd_pcie,
                         DL_FLAG_STATELESS |
                         DL_FLAG_PM_RUNTIME |
@@ -323,13 +326,13 @@ static int imx6_pcie_attach_pd(struct device *dev)
         if (IS_ERR(imx6_pcie->pd_pcie_phy))
                 return PTR_ERR(imx6_pcie->pd_pcie_phy);
 
-        device_link_add(dev, imx6_pcie->pd_pcie_phy,
+        link = device_link_add(dev, imx6_pcie->pd_pcie_phy,
                         DL_FLAG_STATELESS |
                         DL_FLAG_PM_RUNTIME |
                         DL_FLAG_RPM_ACTIVE);
-        if (IS_ERR(link)) {
-                dev_err(dev, "Failed to add device_link to pcie_phy pd: %ld\n", PTR_ERR(link));
-                return PTR_ERR(link);
+        if (!link) {
+                dev_err(dev, "Failed to add device_link to pcie_phy pd.\n");
+                return -EINVAL;
         }
 
         return 0;
diff --git a/drivers/pci/controller/dwc/pcie-armada8k.c b/drivers/pci/controller/dwc/pcie-armada8k.c
index b171b6bc15c8..0c389a30ef5d 100644
--- a/drivers/pci/controller/dwc/pcie-armada8k.c
+++ b/drivers/pci/controller/dwc/pcie-armada8k.c
@@ -22,7 +22,6 @@
 #include <linux/resource.h>
 #include <linux/of_pci.h>
 #include <linux/of_irq.h>
-#include <linux/gpio/consumer.h>
 
 #include "pcie-designware.h"
 
@@ -30,7 +29,6 @@ struct armada8k_pcie {
         struct dw_pcie *pci;
         struct clk *clk;
         struct clk *clk_reg;
-        struct gpio_desc *reset_gpio;
 };
 
 #define PCIE_VENDOR_REGS_OFFSET         0x8000
@@ -139,12 +137,6 @@ static int armada8k_pcie_host_init(struct pcie_port *pp)
         struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
         struct armada8k_pcie *pcie = to_armada8k_pcie(pci);
 
-        if (pcie->reset_gpio) {
-                /* assert and then deassert the reset signal */
-                gpiod_set_value_cansleep(pcie->reset_gpio, 1);
-                msleep(100);
-                gpiod_set_value_cansleep(pcie->reset_gpio, 0);
-        }
         dw_pcie_setup_rc(pp);
         armada8k_pcie_establish_link(pcie);
 
@@ -257,14 +249,6 @@ static int armada8k_pcie_probe(struct platform_device *pdev)
                 goto fail_clkreg;
         }
 
-        /* Get reset gpio signal and hold asserted (logically high) */
-        pcie->reset_gpio = devm_gpiod_get_optional(dev, "reset",
-                                                   GPIOD_OUT_HIGH);
-        if (IS_ERR(pcie->reset_gpio)) {
-                ret = PTR_ERR(pcie->reset_gpio);
-                goto fail_clkreg;
-        }
-
         platform_set_drvdata(pdev, pcie);
 
         ret = armada8k_add_pcie_port(pcie, pdev);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index b0a413f3f7ca..e2a879e93d86 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -639,8 +639,9 @@ static void quirk_synopsys_haps(struct pci_dev *pdev)
                 break;
         }
 }
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SYNOPSYS, PCI_ANY_ID,
-                         quirk_synopsys_haps);
+DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_SYNOPSYS, PCI_ANY_ID,
+                               PCI_CLASS_SERIAL_USB_XHCI, 0,
+                               quirk_synopsys_haps);
 
 /*
  * Let's make the southbridge information explicit instead of having to
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 05044e323ea5..03ec7a5d9d0b 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1513,7 +1513,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
                         DMI_MATCH(DMI_PRODUCT_FAMILY, "Intel_Strago"),
-                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
                 },
         },
         {
@@ -1521,7 +1521,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "HP"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "Setzer"),
-                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
                 },
         },
         {
@@ -1529,7 +1529,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "Cyan"),
-                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
                 },
         },
         {
@@ -1537,7 +1537,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "Celes"),
-                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
                 },
         },
         {}
diff --git a/drivers/pinctrl/mediatek/Kconfig b/drivers/pinctrl/mediatek/Kconfig
index 1817786ab6aa..a005cbccb4f7 100644
--- a/drivers/pinctrl/mediatek/Kconfig
+++ b/drivers/pinctrl/mediatek/Kconfig
@@ -45,12 +45,14 @@ config PINCTRL_MT2701
 config PINCTRL_MT7623
         bool "Mediatek MT7623 pin control with generic binding"
         depends on MACH_MT7623 || COMPILE_TEST
+        depends on OF
         default MACH_MT7623
         select PINCTRL_MTK_MOORE
 
 config PINCTRL_MT7629
         bool "Mediatek MT7629 pin control"
         depends on MACH_MT7629 || COMPILE_TEST
+        depends on OF
         default MACH_MT7629
         select PINCTRL_MTK_MOORE
 
@@ -92,6 +94,7 @@ config PINCTRL_MT6797
 
 config PINCTRL_MT7622
         bool "MediaTek MT7622 pin control"
+        depends on OF
         depends on ARM64 || COMPILE_TEST
         default ARM64 && ARCH_MEDIATEK
         select PINCTRL_MTK_MOORE
diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c
index b03481ef99a1..98905d4a79ca 100644
--- a/drivers/pinctrl/pinctrl-mcp23s08.c
+++ b/drivers/pinctrl/pinctrl-mcp23s08.c
@@ -832,8 +832,13 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
                 break;
 
         case MCP_TYPE_S18:
+                one_regmap_config =
+                        devm_kmemdup(dev, &mcp23x17_regmap,
+                                sizeof(struct regmap_config), GFP_KERNEL);
+                if (!one_regmap_config)
+                        return -ENOMEM;
                 mcp->regmap = devm_regmap_init(dev, &mcp23sxx_spi_regmap, mcp,
-                                               &mcp23x17_regmap);
+                                               one_regmap_config);
                 mcp->reg_shift = 1;
                 mcp->chip.ngpio = 16;
                 mcp->chip.label = "mcp23s18";
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c b/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c
index aa8b58125568..ef4268cc6227 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c
@@ -588,7 +588,7 @@ static const unsigned int h6_irq_bank_map[] = { 1, 5, 6, 7 };
 static const struct sunxi_pinctrl_desc h6_pinctrl_data = {
         .pins = h6_pins,
         .npins = ARRAY_SIZE(h6_pins),
-        .irq_banks = 3,
+        .irq_banks = 4,
         .irq_bank_map = h6_irq_bank_map,
         .irq_read_needs_mux = true,
 };
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index 5d9184d18c16..0e7fa69e93df 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -698,26 +698,24 @@ static int sunxi_pmx_request(struct pinctrl_dev *pctldev, unsigned offset)
 {
         struct sunxi_pinctrl *pctl = pinctrl_dev_get_drvdata(pctldev);
         unsigned short bank = offset / PINS_PER_BANK;
-        struct sunxi_pinctrl_regulator *s_reg = &pctl->regulators[bank];
-        struct regulator *reg;
+        unsigned short bank_offset = bank - pctl->desc->pin_base /
+                                            PINS_PER_BANK;
+        struct sunxi_pinctrl_regulator *s_reg = &pctl->regulators[bank_offset];
+        struct regulator *reg = s_reg->regulator;
+        char supply[16];
         int ret;
 
-        reg = s_reg->regulator;
-        if (!reg) {
-                char supply[16];
-
-                snprintf(supply, sizeof(supply), "vcc-p%c", 'a' + bank);
-                reg = regulator_get(pctl->dev, supply);
-                if (IS_ERR(reg)) {
-                        dev_err(pctl->dev, "Couldn't get bank P%c regulator\n",
-                                'A' + bank);
-                        return PTR_ERR(reg);
-                }
-
-                s_reg->regulator = reg;
-                refcount_set(&s_reg->refcount, 1);
-        } else {
+        if (reg) {
                 refcount_inc(&s_reg->refcount);
+                return 0;
+        }
+
+        snprintf(supply, sizeof(supply), "vcc-p%c", 'a' + bank);
+        reg = regulator_get(pctl->dev, supply);
+        if (IS_ERR(reg)) {
+                dev_err(pctl->dev, "Couldn't get bank P%c regulator\n",
+                        'A' + bank);
+                return PTR_ERR(reg);
         }
 
         ret = regulator_enable(reg);
@@ -727,13 +725,13 @@ static int sunxi_pmx_request(struct pinctrl_dev *pctldev, unsigned offset)
                 goto out;
         }
 
+        s_reg->regulator = reg;
+        refcount_set(&s_reg->refcount, 1);
+
         return 0;
 
 out:
-        if (refcount_dec_and_test(&s_reg->refcount)) {
-                regulator_put(s_reg->regulator);
-                s_reg->regulator = NULL;
-        }
+        regulator_put(s_reg->regulator);
 
         return ret;
 }
@@ -742,7 +740,9 @@ static int sunxi_pmx_free(struct pinctrl_dev *pctldev, unsigned offset)
 {
         struct sunxi_pinctrl *pctl = pinctrl_dev_get_drvdata(pctldev);
         unsigned short bank = offset / PINS_PER_BANK;
-        struct sunxi_pinctrl_regulator *s_reg = &pctl->regulators[bank];
+        unsigned short bank_offset = bank - pctl->desc->pin_base /
+                                            PINS_PER_BANK;
+        struct sunxi_pinctrl_regulator *s_reg = &pctl->regulators[bank_offset];
 
         if (!refcount_dec_and_test(&s_reg->refcount))
                 return 0;
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.h b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
index e340d2a24b44..034c0317c8d6 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.h
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
@@ -136,7 +136,7 @@ struct sunxi_pinctrl {
         struct gpio_chip                *chip;
         const struct sunxi_pinctrl_desc *desc;
         struct device                   *dev;
-        struct sunxi_pinctrl_regulator  regulators[12];
+        struct sunxi_pinctrl_regulator  regulators[9];
         struct irq_domain               *domain;
         struct sunxi_pinctrl_function   *functions;
         unsigned                        nfunctions;
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 5e2109c54c7c..b5e9db85e881 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -905,6 +905,7 @@ config TOSHIBA_WMI
 config ACPI_CMPC
         tristate "CMPC Laptop Extras"
         depends on ACPI && INPUT
+        depends on BACKLIGHT_LCD_SUPPORT
         depends on RFKILL || RFKILL=n
         select BACKLIGHT_CLASS_DEVICE
         help
@@ -1128,6 +1129,7 @@ config INTEL_OAKTRAIL
 config SAMSUNG_Q10
         tristate "Samsung Q10 Extras"
         depends on ACPI
+        depends on BACKLIGHT_LCD_SUPPORT
         select BACKLIGHT_CLASS_DEVICE
         ---help---
           This driver provides support for backlight control on Samsung Q10
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 4e7b55a14b1a..6e294b4d3635 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -4469,6 +4469,14 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp)
                 usrparm.psf_data &= 0x7fffffffULL;
                 usrparm.rssd_result &= 0x7fffffffULL;
         }
+        /* at least 2 bytes are accessed and should be allocated */
+        if (usrparm.psf_data_len < 2) {
+                DBF_DEV_EVENT(DBF_WARNING, device,
+                              "Symmetrix ioctl invalid data length %d",
+                              usrparm.psf_data_len);
+                rc = -EINVAL;
+                goto out;
+        }
         /* alloc I/O data area */
         psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL | GFP_DMA);
         rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL | GFP_DMA);
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 48ea0004a56d..5a699746c357 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -248,7 +248,8 @@ static inline int ap_test_config(unsigned int *field, unsigned int nr)
 static inline int ap_test_config_card_id(unsigned int id)
 {
         if (!ap_configuration)  /* QCI not supported */
-                return 1;
+                /* only ids 0...3F may be probed */
+                return id < 0x40 ? 1 : 0;
         return ap_test_config(ap_configuration->apm, id);
 }
 
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index 0ee026947f20..122059ecad84 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -22,6 +22,7 @@
 #include <linux/hashtable.h>
 #include <linux/ip.h>
 #include <linux/refcount.h>
+#include <linux/workqueue.h>
 
 #include <net/ipv6.h>
 #include <net/if_inet6.h>
@@ -789,6 +790,7 @@ struct qeth_card {
         struct qeth_seqno seqno;
         struct qeth_card_options options;
 
+        struct workqueue_struct *event_wq;
         wait_queue_head_t wait_q;
         spinlock_t mclock;
         unsigned long active_vlans[BITS_TO_LONGS(VLAN_N_VID)];
@@ -962,7 +964,6 @@ extern const struct attribute_group *qeth_osn_attr_groups[];
 extern const struct attribute_group qeth_device_attr_group;
 extern const struct attribute_group qeth_device_blkt_group;
 extern const struct device_type qeth_generic_devtype;
-extern struct workqueue_struct *qeth_wq;
 
 int qeth_card_hw_is_reachable(struct qeth_card *);
 const char *qeth_get_cardname_short(struct qeth_card *);
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index e63e03143ca7..89f912213e62 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -74,8 +74,7 @@ static void qeth_notify_skbs(struct qeth_qdio_out_q *queue,
 static void qeth_release_skbs(struct qeth_qdio_out_buffer *buf);
 static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *, int);
 
-struct workqueue_struct *qeth_wq;
-EXPORT_SYMBOL_GPL(qeth_wq);
+static struct workqueue_struct *qeth_wq;
 
 int qeth_card_hw_is_reachable(struct qeth_card *card)
 {
@@ -566,6 +565,7 @@ static int __qeth_issue_next_read(struct qeth_card *card)
                 QETH_DBF_MESSAGE(2, "error %i on device %x when starting next read ccw!\n",
                                  rc, CARD_DEVID(card));
                 atomic_set(&channel->irq_pending, 0);
+                qeth_release_buffer(channel, iob);
                 card->read_or_write_problem = 1;
                 qeth_schedule_recovery(card);
                 wake_up(&card->wait_q);
@@ -1127,6 +1127,8 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
                 rc = qeth_get_problem(card, cdev, irb);
                 if (rc) {
                         card->read_or_write_problem = 1;
+                        if (iob)
+                                qeth_release_buffer(iob->channel, iob);
                         qeth_clear_ipacmd_list(card);
                         qeth_schedule_recovery(card);
                         goto out;
@@ -1466,6 +1468,10 @@ static struct qeth_card *qeth_alloc_card(struct ccwgroup_device *gdev)
         CARD_RDEV(card) = gdev->cdev[0];
         CARD_WDEV(card) = gdev->cdev[1];
         CARD_DDEV(card) = gdev->cdev[2];
+
+        card->event_wq = alloc_ordered_workqueue("%s", 0, dev_name(&gdev->dev));
+        if (!card->event_wq)
+                goto out_wq;
         if (qeth_setup_channel(&card->read, true))
                 goto out_ip;
         if (qeth_setup_channel(&card->write, true))
@@ -1481,6 +1487,8 @@ out_data:
 out_channel:
         qeth_clean_channel(&card->read);
 out_ip:
+        destroy_workqueue(card->event_wq);
+out_wq:
         dev_set_drvdata(&gdev->dev, NULL);
         kfree(card);
 out:
@@ -1809,6 +1817,7 @@ static int qeth_idx_activate_get_answer(struct qeth_card *card,
                 QETH_DBF_MESSAGE(2, "Error2 in activating channel rc=%d\n", rc);
                 QETH_DBF_TEXT_(SETUP, 2, "2err%d", rc);
                 atomic_set(&channel->irq_pending, 0);
+                qeth_release_buffer(channel, iob);
                 wake_up(&card->wait_q);
                 return rc;
         }
@@ -1878,6 +1887,7 @@ static int qeth_idx_activate_channel(struct qeth_card *card,
                         rc);
                 QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
                 atomic_set(&channel->irq_pending, 0);
+                qeth_release_buffer(channel, iob);
                 wake_up(&card->wait_q);
                 return rc;
         }
@@ -2058,6 +2068,7 @@ int qeth_send_control_data(struct qeth_card *card, int len,
         }
         reply = qeth_alloc_reply(card);
         if (!reply) {
+                qeth_release_buffer(channel, iob);
                 return -ENOMEM;
         }
         reply->callback = reply_cb;
@@ -2389,11 +2400,12 @@ static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *q, int bidx)
         return 0;
 }
 
-static void qeth_free_qdio_out_buf(struct qeth_qdio_out_q *q)
+static void qeth_free_output_queue(struct qeth_qdio_out_q *q)
 {
         if (!q)
                 return;
 
+        qeth_clear_outq_buffers(q, 1);
         qdio_free_buffers(q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q);
         kfree(q);
 }
@@ -2467,10 +2479,8 @@ out_freeoutqbufs:
                 card->qdio.out_qs[i]->bufs[j] = NULL;
         }
 out_freeoutq:
-        while (i > 0) {
-                qeth_free_qdio_out_buf(card->qdio.out_qs[--i]);
-                qeth_clear_outq_buffers(card->qdio.out_qs[i], 1);
-        }
+        while (i > 0)
+                qeth_free_output_queue(card->qdio.out_qs[--i]);
         kfree(card->qdio.out_qs);
         card->qdio.out_qs = NULL;
 out_freepool:
@@ -2503,10 +2513,8 @@ static void qeth_free_qdio_buffers(struct qeth_card *card)
         qeth_free_buffer_pool(card);
         /* free outbound qdio_qs */
         if (card->qdio.out_qs) {
-                for (i = 0; i < card->qdio.no_out_queues; ++i) {
-                        qeth_clear_outq_buffers(card->qdio.out_qs[i], 1);
-                        qeth_free_qdio_out_buf(card->qdio.out_qs[i]);
-                }
+                for (i = 0; i < card->qdio.no_out_queues; i++)
+                        qeth_free_output_queue(card->qdio.out_qs[i]);
                 kfree(card->qdio.out_qs);
                 card->qdio.out_qs = NULL;
         }
@@ -5028,6 +5036,7 @@ static void qeth_core_free_card(struct qeth_card *card)
         qeth_clean_channel(&card->read);
         qeth_clean_channel(&card->write);
         qeth_clean_channel(&card->data);
+        destroy_workqueue(card->event_wq);
         qeth_free_qdio_buffers(card);
         unregister_service_level(&card->qeth_service_level);
         dev_set_drvdata(&card->gdev->dev, NULL);
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index f108d4b44605..a43de2f9bcac 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -369,6 +369,8 @@ static void qeth_l2_stop_card(struct qeth_card *card, int recovery_mode)
                 qeth_clear_cmd_buffers(&card->read);
                 qeth_clear_cmd_buffers(&card->write);
         }
+
+        flush_workqueue(card->event_wq);
 }
 
 static int qeth_l2_process_inbound_buffer(struct qeth_card *card,
@@ -801,6 +803,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)
 
         if (cgdev->state == CCWGROUP_ONLINE)
                 qeth_l2_set_offline(cgdev);
+
+        cancel_work_sync(&card->close_dev_work);
         if (qeth_netdev_is_registered(card->dev))
                 unregister_netdev(card->dev);
 }
@@ -1434,7 +1438,7 @@ static void qeth_bridge_state_change(struct qeth_card *card,
         data->card = card;
         memcpy(&data->qports, qports,
                         sizeof(struct qeth_sbp_state_change) + extrasize);
-        queue_work(qeth_wq, &data->worker);
+        queue_work(card->event_wq, &data->worker);
 }
 
 struct qeth_bridge_host_data {
@@ -1506,7 +1510,7 @@ static void qeth_bridge_host_event(struct qeth_card *card,
         data->card = card;
         memcpy(&data->hostevs, hostevs,
                         sizeof(struct qeth_ipacmd_addr_change) + extrasize);
-        queue_work(qeth_wq, &data->worker);
+        queue_work(card->event_wq, &data->worker);
 }
 
 /* SETBRIDGEPORT support; sending commands */
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 42a7cdc59b76..df34bff4ac31 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -1433,6 +1433,8 @@ static void qeth_l3_stop_card(struct qeth_card *card, int recovery_mode)
                 qeth_clear_cmd_buffers(&card->read);
                 qeth_clear_cmd_buffers(&card->write);
         }
+
+        flush_workqueue(card->event_wq);
 }
 
 /*
@@ -2338,6 +2340,7 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev)
         if (cgdev->state == CCWGROUP_ONLINE)
                 qeth_l3_set_offline(cgdev);
 
+        cancel_work_sync(&card->close_dev_work);
         if (qeth_netdev_is_registered(card->dev))
                 unregister_netdev(card->dev);
         qeth_l3_clear_ip_htable(card, 0);
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index 9cf30d124b9e..e390f8c6d5f3 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -403,7 +403,6 @@ struct zfcp_adapter *zfcp_adapter_enqueue(struct ccw_device *ccw_device)
                 goto failed;
 
         /* report size limit per scatter-gather segment */
-        adapter->dma_parms.max_segment_size = ZFCP_QDIO_SBALE_LEN;
         adapter->ccw_device->dev.dma_parms = &adapter->dma_parms;
 
         adapter->stat_read_buf_num = FSF_STATUS_READS_RECOM;
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 00acc7144bbc..f4f6a07c5222 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -428,6 +428,8 @@ static struct scsi_host_template zfcp_scsi_host_template = {
         .max_sectors             = (((QDIO_MAX_ELEMENTS_PER_BUFFER - 1)
                                      * ZFCP_QDIO_MAX_SBALS_PER_REQ) - 2) * 8,
                                    /* GCD, adjusted later */
+        /* report size limit per scatter-gather segment */
+        .max_segment_size        = ZFCP_QDIO_SBALE_LEN,
         .dma_boundary            = ZFCP_QDIO_SBALE_LEN - 1,
         .shost_attrs             = zfcp_sysfs_shost_attrs,
         .sdev_attrs              = zfcp_sysfs_sdev_attrs,
diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c
index 128d658d472a..16957d7ac414 100644
--- a/drivers/scsi/53c700.c
+++ b/drivers/scsi/53c700.c
@@ -295,7 +295,7 @@ NCR_700_detect(struct scsi_host_template *tpnt,
         if(tpnt->sdev_attrs == NULL)
                 tpnt->sdev_attrs = NCR_700_dev_attrs;
 
-        memory = dma_alloc_attrs(hostdata->dev, TOTAL_MEM_SIZE, &pScript,
+        memory = dma_alloc_attrs(dev, TOTAL_MEM_SIZE, &pScript,
                                  GFP_KERNEL, DMA_ATTR_NON_CONSISTENT);
         if(memory == NULL) {
                 printk(KERN_ERR "53c700: Failed to allocate memory for driver, detaching\n");
diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
index f83f79b07b50..07efcb9b5b94 100644
--- a/drivers/scsi/aic94xx/aic94xx_init.c
+++ b/drivers/scsi/aic94xx/aic94xx_init.c
@@ -280,7 +280,7 @@ static ssize_t asd_show_dev_rev(struct device *dev,
         return snprintf(buf, PAGE_SIZE, "%s\n",
                         asd_dev_rev[asd_ha->revision_id]);
 }
-static DEVICE_ATTR(revision, S_IRUGO, asd_show_dev_rev, NULL);
+static DEVICE_ATTR(aic_revision, S_IRUGO, asd_show_dev_rev, NULL);
 
 static ssize_t asd_show_dev_bios_build(struct device *dev,
                                        struct device_attribute *attr,char *buf)
@@ -477,7 +477,7 @@ static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
 {
         int err;
 
-        err = device_create_file(&asd_ha->pcidev->dev, &dev_attr_revision);
+        err = device_create_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
         if (err)
                 return err;
 
@@ -499,13 +499,13 @@ err_update_bios:
 err_biosb:
         device_remove_file(&asd_ha->pcidev->dev, &dev_attr_bios_build);
 err_rev:
-        device_remove_file(&asd_ha->pcidev->dev, &dev_attr_revision);
+        device_remove_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
         return err;
 }
 
 static void asd_remove_dev_attrs(struct asd_ha_struct *asd_ha)
 {
-        device_remove_file(&asd_ha->pcidev->dev, &dev_attr_revision);
+        device_remove_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
         device_remove_file(&asd_ha->pcidev->dev, &dev_attr_bios_build);
         device_remove_file(&asd_ha->pcidev->dev, &dev_attr_pcba_sn);
         device_remove_file(&asd_ha->pcidev->dev, &dev_attr_update_bios);
diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
index 350257c13a5b..bc9f2a2365f4 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -240,6 +240,7 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
                 return NULL;
         }
 
+        cmgr->hba = hba;
         cmgr->free_list = kcalloc(arr_sz, sizeof(*cmgr->free_list),
                                   GFP_KERNEL);
         if (!cmgr->free_list) {
@@ -256,7 +257,6 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
                 goto mem_err;
         }
 
-        cmgr->hba = hba;
         cmgr->cmds = (struct bnx2fc_cmd **)(cmgr + 1);
 
         for (i = 0; i < arr_sz; i++)  {
@@ -295,7 +295,7 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
 
         /* Allocate pool of io_bdts - one for each bnx2fc_cmd */
         mem_size = num_ios * sizeof(struct io_bdt *);
-        cmgr->io_bdt_pool = kmalloc(mem_size, GFP_KERNEL);
+        cmgr->io_bdt_pool = kzalloc(mem_size, GFP_KERNEL);
         if (!cmgr->io_bdt_pool) {
                 printk(KERN_ERR PFX "failed to alloc io_bdt_pool\n");
                 goto mem_err;
diff --git a/drivers/scsi/cxlflash/main.c b/drivers/scsi/cxlflash/main.c
index bfa13e3b191c..c8bad2c093b8 100644
--- a/drivers/scsi/cxlflash/main.c
+++ b/drivers/scsi/cxlflash/main.c
@@ -3687,6 +3687,7 @@ static int cxlflash_probe(struct pci_dev *pdev,
         host->max_cmd_len = CXLFLASH_MAX_CDB_LEN;
 
         cfg = shost_priv(host);
+        cfg->state = STATE_PROBING;
         cfg->host = host;
         rc = alloc_mem(cfg);
         if (rc) {
@@ -3775,6 +3776,7 @@ out:
         return rc;
 
 out_remove:
+        cfg->state = STATE_PROBED;
         cxlflash_remove(pdev);
         goto out;
 }
diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index be83590ed955..ff943f477d6f 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -1726,14 +1726,14 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
             fc_frame_payload_op(fp) != ELS_LS_ACC) {
                 FC_LPORT_DBG(lport, "FLOGI not accepted or bad response\n");
                 fc_lport_error(lport, fp);
-                goto err;
+                goto out;
         }
 
         flp = fc_frame_payload_get(fp, sizeof(*flp));
         if (!flp) {
                 FC_LPORT_DBG(lport, "FLOGI bad response\n");
                 fc_lport_error(lport, fp);
-                goto err;
+                goto out;
         }
 
         mfs = ntohs(flp->fl_csp.sp_bb_data) &
@@ -1743,7 +1743,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
                 FC_LPORT_DBG(lport, "FLOGI bad mfs:%hu response, "
                              "lport->mfs:%hu\n", mfs, lport->mfs);
                 fc_lport_error(lport, fp);
-                goto err;
+                goto out;
         }
 
         if (mfs <= lport->mfs) {
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index 9192a1d9dec6..dfba4921b265 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -184,7 +184,6 @@ void fc_rport_destroy(struct kref *kref)
         struct fc_rport_priv *rdata;
 
         rdata = container_of(kref, struct fc_rport_priv, kref);
-        WARN_ON(!list_empty(&rdata->peers));
         kfree_rcu(rdata, rcu);
 }
 EXPORT_SYMBOL(fc_rport_destroy);
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 661512bec3ac..e27f4df24021 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -62,7 +62,7 @@
 
 /* make sure inq_product_rev string corresponds to this version */
 #define SDEBUG_VERSION "0188"   /* format to fit INQUIRY revision field */
-static const char *sdebug_version_date = "20180128";
+static const char *sdebug_version_date = "20190125";
 
 #define MY_NAME "scsi_debug"
 
@@ -735,7 +735,7 @@ static inline bool scsi_debug_lbp(void)
                 (sdebug_lbpu || sdebug_lbpws || sdebug_lbpws10);
 }
 
-static void *fake_store(unsigned long long lba)
+static void *lba2fake_store(unsigned long long lba)
 {
         lba = do_div(lba, sdebug_store_sectors);
 
@@ -2514,8 +2514,8 @@ static int do_device_access(struct scsi_cmnd *scmd, u32 sg_skip, u64 lba,
         return ret;
 }
 
-/* If fake_store(lba,num) compares equal to arr(num), then copy top half of
- * arr into fake_store(lba,num) and return true. If comparison fails then
+/* If lba2fake_store(lba,num) compares equal to arr(num), then copy top half of
+ * arr into lba2fake_store(lba,num) and return true. If comparison fails then
  * return false. */
 static bool comp_write_worker(u64 lba, u32 num, const u8 *arr)
 {
@@ -2643,7 +2643,7 @@ static int prot_verify_read(struct scsi_cmnd *SCpnt, sector_t start_sec,
                 if (sdt->app_tag == cpu_to_be16(0xffff))
                         continue;
 
-                ret = dif_verify(sdt, fake_store(sector), sector, ei_lba);
+                ret = dif_verify(sdt, lba2fake_store(sector), sector, ei_lba);
                 if (ret) {
                         dif_errors++;
                         return ret;
@@ -3261,10 +3261,12 @@ err_out:
 static int resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num,
                            u32 ei_lba, bool unmap, bool ndob)
 {
+        int ret;
         unsigned long iflags;
         unsigned long long i;
-        int ret;
-        u64 lba_off;
+        u32 lb_size = sdebug_sector_size;
+        u64 block, lbaa;
+        u8 *fs1p;
 
         ret = check_device_access_params(scp, lba, num);
         if (ret)
@@ -3276,31 +3278,30 @@ static int resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num,
                 unmap_region(lba, num);
                 goto out;
         }
-
-        lba_off = lba * sdebug_sector_size;
+        lbaa = lba;
+        block = do_div(lbaa, sdebug_store_sectors);
         /* if ndob then zero 1 logical block, else fetch 1 logical block */
+        fs1p = fake_storep + (block * lb_size);
         if (ndob) {
-                memset(fake_storep + lba_off, 0, sdebug_sector_size);
+                memset(fs1p, 0, lb_size);
                 ret = 0;
         } else
-                ret = fetch_to_dev_buffer(scp, fake_storep + lba_off,
-                                          sdebug_sector_size);
+                ret = fetch_to_dev_buffer(scp, fs1p, lb_size);
 
         if (-1 == ret) {
                 write_unlock_irqrestore(&atomic_rw, iflags);
                 return DID_ERROR << 16;
-        } else if (sdebug_verbose && !ndob && (ret < sdebug_sector_size))
+        } else if (sdebug_verbose && !ndob && (ret < lb_size))
                 sdev_printk(KERN_INFO, scp->device,
                             "%s: %s: lb size=%u, IO sent=%d bytes\n",
-                            my_name, "write same",
-                            sdebug_sector_size, ret);
+                            my_name, "write same", lb_size, ret);
 
         /* Copy first sector to remaining blocks */
-        for (i = 1 ; i < num ; i++)
-                memcpy(fake_storep + ((lba + i) * sdebug_sector_size),
-                       fake_storep + lba_off,
-                       sdebug_sector_size);
-
+        for (i = 1 ; i < num ; i++) {
+                lbaa = lba + i;
+                block = do_div(lbaa, sdebug_store_sectors);
+                memmove(fake_storep + (block * lb_size), fs1p, lb_size);
+        }
         if (scsi_debug_lbp())
                 map_region(lba, num);
 out:
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 83365b29a4d8..fff86940388b 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -462,12 +462,16 @@ int sd_zbc_read_zones(struct scsi_disk *sdkp, unsigned char *buf)
         sdkp->device->use_10_for_rw = 0;
 
         /*
-         * If something changed, revalidate the disk zone bitmaps once we have
-         * the capacity, that is on the second revalidate execution during disk
-         * scan and always during normal revalidate.
+         * Revalidate the disk zone bitmaps once the block device capacity is
+         * set on the second revalidate execution during disk scan and if
+         * something changed when executing a normal revalidate.
          */
-        if (sdkp->first_scan)
+        if (sdkp->first_scan) {
+                sdkp->zone_blocks = zone_blocks;
+                sdkp->nr_zones = nr_zones;
                 return 0;
+        }
+
         if (sdkp->zone_blocks != zone_blocks ||
             sdkp->nr_zones != nr_zones ||
             disk->queue->nr_zones != nr_zones) {
diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
index 52c153cd795a..636f83f781f5 100644
--- a/drivers/soc/fsl/qbman/qman.c
+++ b/drivers/soc/fsl/qbman/qman.c
@@ -1143,18 +1143,19 @@ static void qm_mr_process_task(struct work_struct *work);
 static irqreturn_t portal_isr(int irq, void *ptr)
 {
         struct qman_portal *p = ptr;
-
-        u32 clear = QM_DQAVAIL_MASK | p->irq_sources;
         u32 is = qm_in(&p->p, QM_REG_ISR) & p->irq_sources;
+        u32 clear = 0;
 
         if (unlikely(!is))
                 return IRQ_NONE;
 
         /* DQRR-handling if it's interrupt-driven */
-        if (is & QM_PIRQ_DQRI)
+        if (is & QM_PIRQ_DQRI) {
                 __poll_portal_fast(p, QMAN_POLL_LIMIT);
+                clear = QM_DQAVAIL_MASK | QM_PIRQ_DQRI;
+        }
         /* Handling of anything else that's interrupt-driven */
-        clear |= __poll_portal_slow(p, is);
+        clear |= __poll_portal_slow(p, is) & QM_PIRQ_SLOW;
         qm_out(&p->p, QM_REG_ISR, clear);
         return IRQ_HANDLED;
 }
diff --git a/drivers/staging/octeon/ethernet-mdio.c b/drivers/staging/octeon/ethernet-mdio.c
index 2848fa71a33d..d6248eecf123 100644
--- a/drivers/staging/octeon/ethernet-mdio.c
+++ b/drivers/staging/octeon/ethernet-mdio.c
@@ -170,7 +170,7 @@ int cvm_oct_phy_setup_device(struct net_device *dev)
                 return -ENODEV;
 
         priv->last_link = 0;
-        phy_start_aneg(phydev);
+        phy_start(phydev);
 
         return 0;
 no_phy:
diff --git a/drivers/staging/speakup/spk_ttyio.c b/drivers/staging/speakup/spk_ttyio.c
index c92bbd05516e..005de0024dd4 100644
--- a/drivers/staging/speakup/spk_ttyio.c
+++ b/drivers/staging/speakup/spk_ttyio.c
@@ -265,7 +265,8 @@ static void spk_ttyio_send_xchar(char ch)
                 return;
         }
 
-        speakup_tty->ops->send_xchar(speakup_tty, ch);
+        if (speakup_tty->ops->send_xchar)
+                speakup_tty->ops->send_xchar(speakup_tty, ch);
         mutex_unlock(&speakup_tty_mutex);
 }
 
@@ -277,7 +278,8 @@ static void spk_ttyio_tiocmset(unsigned int set, unsigned int clear)
                 return;
         }
 
-        speakup_tty->ops->tiocmset(speakup_tty, set, clear);
+        if (speakup_tty->ops->tiocmset)
+                speakup_tty->ops->tiocmset(speakup_tty, set, clear);
         mutex_unlock(&speakup_tty_mutex);
 }
 
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 72016d0dfca5..8e7fffbb8802 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -852,6 +852,12 @@ static ssize_t pi_prot_type_store(struct config_item *item,
         return count;
 }
 
+/* always zero, but attr needs to remain RW to avoid userspace breakage */
+static ssize_t pi_prot_format_show(struct config_item *item, char *page)
+{
+        return snprintf(page, PAGE_SIZE, "0\n");
+}
+
 static ssize_t pi_prot_format_store(struct config_item *item,
                 const char *page, size_t count)
 {
@@ -1132,7 +1138,7 @@ CONFIGFS_ATTR(, emulate_3pc);
 CONFIGFS_ATTR(, emulate_pr);
 CONFIGFS_ATTR(, pi_prot_type);
 CONFIGFS_ATTR_RO(, hw_pi_prot_type);
-CONFIGFS_ATTR_WO(, pi_prot_format);
+CONFIGFS_ATTR(, pi_prot_format);
 CONFIGFS_ATTR(, pi_prot_verify);
 CONFIGFS_ATTR(, enforce_pr_isids);
 CONFIGFS_ATTR(, is_nonrot);
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index dfd23245f778..6fff16113628 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -774,7 +774,7 @@ of_cpufreq_cooling_register(struct cpufreq_policy *policy)
 
                 cdev = __cpufreq_cooling_register(np, policy, capacitance);
                 if (IS_ERR(cdev)) {
-                        pr_err("cpu_cooling: cpu%d is not running as cooling device: %ld\n",
+                        pr_err("cpu_cooling: cpu%d failed to register as cooling device: %ld\n",
                                policy->cpu, PTR_ERR(cdev));
                         cdev = NULL;
                 }
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index 4bfdb4a1e47d..2df059cc07e2 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -867,14 +867,14 @@ __init *thermal_of_build_thermal_zone(struct device_node *np)
 
         ret = of_property_read_u32(np, "polling-delay-passive", &prop);
         if (ret < 0) {
-                pr_err("missing polling-delay-passive property\n");
+                pr_err("%pOFn: missing polling-delay-passive property\n", np);
                 goto free_tz;
         }
         tz->passive_delay = prop;
 
         ret = of_property_read_u32(np, "polling-delay", &prop);
         if (ret < 0) {
-                pr_err("missing polling-delay property\n");
+                pr_err("%pOFn: missing polling-delay property\n", np);
                 goto free_tz;
         }
         tz->polling_delay = prop;
diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
index e2c407656fa6..c1fdbc0b6840 100644
--- a/drivers/tty/serial/8250/8250_mtk.c
+++ b/drivers/tty/serial/8250/8250_mtk.c
@@ -357,6 +357,9 @@ static int mtk8250_probe_of(struct platform_device *pdev, struct uart_port *p,
         if (dmacnt == 2) {
                 data->dma = devm_kzalloc(&pdev->dev, sizeof(*data->dma),
                                          GFP_KERNEL);
+                if (!data->dma)
+                        return -ENOMEM;
+
                 data->dma->fn = mtk8250_dma_filter;
                 data->dma->rx_size = MTK_UART_RX_SIZE;
                 data->dma->rxconf.src_maxburst = MTK_UART_RX_TRIGGER;
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index f80a300b5d68..48bd694a5fa1 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -3420,6 +3420,11 @@ static int
 serial_pci_guess_board(struct pci_dev *dev, struct pciserial_board *board)
 {
         int num_iomem, num_port, first_port = -1, i;
+        int rc;
+
+        rc = serial_pci_is_class_communication(dev);
+        if (rc)
+                return rc;
 
         /*
          * Should we try to make guesses for multiport serial devices later?
@@ -3647,10 +3652,6 @@ pciserial_init_one(struct pci_dev *dev, const struct pci_device_id *ent)
 
         board = &pci_boards[ent->driver_data];
 
-        rc = serial_pci_is_class_communication(dev);
-        if (rc)
-                return rc;
-
         rc = serial_pci_is_blacklisted(dev);
         if (rc)
                 return rc;
diff --git a/drivers/tty/serial/earlycon-riscv-sbi.c b/drivers/tty/serial/earlycon-riscv-sbi.c
index e1a551aae336..ce81523c3113 100644
--- a/drivers/tty/serial/earlycon-riscv-sbi.c
+++ b/drivers/tty/serial/earlycon-riscv-sbi.c
@@ -10,13 +10,16 @@
 #include <linux/serial_core.h>
 #include <asm/sbi.h>
 
-static void sbi_console_write(struct console *con,
-                              const char *s, unsigned int n)
+static void sbi_putc(struct uart_port *port, int c)
 {
-        int i;
+        sbi_console_putchar(c);
+}
 
-        for (i = 0; i < n; ++i)
-                sbi_console_putchar(s[i]);
+static void sbi_console_write(struct console *con,
+                              const char *s, unsigned n)
+{
+        struct earlycon_device *dev = con->data;
+        uart_console_write(&dev->port, s, n, sbi_putc);
 }
 
 static int __init early_sbi_setup(struct earlycon_device *device,
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 5c01bb6d1c24..556f50aa1b58 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -130,6 +130,9 @@ static void uart_start(struct tty_struct *tty)
         struct uart_port *port;
         unsigned long flags;
 
+        if (!state)
+                return;
+
         port = uart_port_lock(state, flags);
         __uart_start(tty);
         uart_port_unlock(port, flags);
@@ -727,6 +730,9 @@ static void uart_unthrottle(struct tty_struct *tty)
         upstat_t mask = UPSTAT_SYNC_FIFO;
         struct uart_port *port;
 
+        if (!state)
+                return;
+
         port = uart_port_ref(state);
         if (!port)
                 return;
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 8df0fd824520..64bbeb7d7e0c 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1921,7 +1921,7 @@ out_nomem:
 
 static void sci_free_irq(struct sci_port *port)
 {
-        int i;
+        int i, j;
 
         /*
          * Intentionally in reverse order so we iterate over the muxed
@@ -1937,6 +1937,13 @@ static void sci_free_irq(struct sci_port *port)
                 if (unlikely(irq < 0))
                         continue;
 
+                /* Check if already freed (irq was muxed) */
+                for (j = 0; j < i; j++)
+                        if (port->irqs[j] == irq)
+                                j = i + 1;
+                if (j > i)
+                        continue;
+
                 free_irq(port->irqs[i], port);
                 kfree(port->irqstr[i]);
 
diff --git a/drivers/usb/dwc3/dwc3-exynos.c b/drivers/usb/dwc3/dwc3-exynos.c
index cb7fcd7c0ad8..c1e9ea621f41 100644
--- a/drivers/usb/dwc3/dwc3-exynos.c
+++ b/drivers/usb/dwc3/dwc3-exynos.c
@@ -78,7 +78,7 @@ static int dwc3_exynos_probe(struct platform_device *pdev)
         for (i = 0; i < exynos->num_clks; i++) {
                 ret = clk_prepare_enable(exynos->clks[i]);
                 if (ret) {
-                        while (--i > 0)
+                        while (i-- > 0)
                                 clk_disable_unprepare(exynos->clks[i]);
                         return ret;
                 }
@@ -223,7 +223,7 @@ static int dwc3_exynos_resume(struct device *dev)
         for (i = 0; i < exynos->num_clks; i++) {
                 ret = clk_prepare_enable(exynos->clks[i]);
                 if (ret) {
-                        while (--i > 0)
+                        while (i-- > 0)
                                 clk_disable_unprepare(exynos->clks[i]);
                         return ret;
                 }
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index bed2ff42780b..6c9b76bcc2e1 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1119,7 +1119,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
         unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);
         unsigned int rem = length % maxp;
 
-        if (rem && usb_endpoint_dir_out(dep->endpoint.desc)) {
+        if ((!length || rem) && usb_endpoint_dir_out(dep->endpoint.desc)) {
                 struct dwc3     *dwc = dep->dwc;
                 struct dwc3_trb *trb;
 
diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c
index 660878a19505..b77f3126580e 100644
--- a/drivers/usb/gadget/udc/net2272.c
+++ b/drivers/usb/gadget/udc/net2272.c
@@ -2083,7 +2083,7 @@ static irqreturn_t net2272_irq(int irq, void *_dev)
 #if defined(PLX_PCI_RDK2)
         /* see if PCI int for us by checking irqstat */
         intcsr = readl(dev->rdk2.fpga_base_addr + RDK2_IRQSTAT);
-        if (!intcsr & (1 << NET2272_PCI_IRQ)) {
+        if (!(intcsr & (1 << NET2272_PCI_IRQ))) {
                 spin_unlock(&dev->lock);
                 return IRQ_NONE;
         }
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index eae8b1b1b45b..ffe462a657b1 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -452,13 +452,10 @@ void musb_g_tx(struct musb *musb, u8 epnum)
         }
 
         if (request) {
-                u8      is_dma = 0;
-                bool    short_packet = false;
 
                 trace_musb_req_tx(req);
 
                 if (dma && (csr & MUSB_TXCSR_DMAENAB)) {
-                        is_dma = 1;
                         csr |= MUSB_TXCSR_P_WZC_BITS;
                         csr &= ~(MUSB_TXCSR_DMAENAB | MUSB_TXCSR_P_UNDERRUN |
                                  MUSB_TXCSR_TXPKTRDY | MUSB_TXCSR_AUTOSET);
@@ -476,16 +473,8 @@ void musb_g_tx(struct musb *musb, u8 epnum)
                  */
                 if ((request->zero && request->length)
                         && (request->length % musb_ep->packet_sz == 0)
-                        && (request->actual == request->length))
-                                short_packet = true;
+                        && (request->actual == request->length)) {
 
-                if ((musb_dma_inventra(musb) || musb_dma_ux500(musb)) &&
-                        (is_dma && (!dma->desired_mode ||
-                                (request->actual &
-                                        (musb_ep->packet_sz - 1)))))
-                                short_packet = true;
-
-                if (short_packet) {
                         /*
                          * On DMA completion, FIFO may not be
                          * available yet...
diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
index a688f7f87829..5fc6825745f2 100644
--- a/drivers/usb/musb/musbhsdma.c
+++ b/drivers/usb/musb/musbhsdma.c
@@ -346,12 +346,10 @@ static irqreturn_t dma_controller_irq(int irq, void *private_data)
                                 channel->status = MUSB_DMA_STATUS_FREE;
 
                                 /* completed */
-                                if ((devctl & MUSB_DEVCTL_HM)
-                                        && (musb_channel->transmit)
-                                        && ((channel->desired_mode == 0)
-                                            || (channel->actual_len &
-                                            (musb_channel->max_packet_sz - 1)))
-                                    ) {
+                                if (musb_channel->transmit &&
+                                        (!channel->desired_mode ||
+                                        (channel->actual_len %
+                                            musb_channel->max_packet_sz))) {
                                         u8  epnum  = musb_channel->epnum;
                                         int offset = musb->io.ep_offset(epnum,
                                                                     MUSB_TXCSR);
@@ -363,11 +361,14 @@ static irqreturn_t dma_controller_irq(int irq, void *private_data)
                                          */
                                         musb_ep_select(mbase, epnum);
                                         txcsr = musb_readw(mbase, offset);
-                                        txcsr &= ~(MUSB_TXCSR_DMAENAB
+                                        if (channel->desired_mode == 1) {
+                                                txcsr &= ~(MUSB_TXCSR_DMAENAB
                                                         | MUSB_TXCSR_AUTOSET);
-                                        musb_writew(mbase, offset, txcsr);
-                                        /* Send out the packet */
-                                        txcsr &= ~MUSB_TXCSR_DMAMODE;
+                                                musb_writew(mbase, offset, txcsr);
+                                                /* Send out the packet */
+                                                txcsr &= ~MUSB_TXCSR_DMAMODE;
+                                                txcsr |= MUSB_TXCSR_DMAENAB;
+                                        }
                                         txcsr |=  MUSB_TXCSR_TXPKTRDY;
                                         musb_writew(mbase, offset, txcsr);
                                 }
diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index d7312eed6088..91ea3083e7ad 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -21,7 +21,7 @@ config AB8500_USB
 
 config FSL_USB2_OTG
         bool "Freescale USB OTG Transceiver Driver"
-        depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM && PM
+        depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM
         depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y'
         select USB_PHY
         help
diff --git a/drivers/usb/phy/phy-am335x.c b/drivers/usb/phy/phy-am335x.c
index 27bdb7222527..f5f0568d8533 100644
--- a/drivers/usb/phy/phy-am335x.c
+++ b/drivers/usb/phy/phy-am335x.c
@@ -61,9 +61,6 @@ static int am335x_phy_probe(struct platform_device *pdev)
         if (ret)
                 return ret;
 
-        ret = usb_add_phy_dev(&am_phy->usb_phy_gen.phy);
-        if (ret)
-                return ret;
         am_phy->usb_phy_gen.phy.init = am335x_init;
         am_phy->usb_phy_gen.phy.shutdown = am335x_shutdown;
 
@@ -82,7 +79,7 @@ static int am335x_phy_probe(struct platform_device *pdev)
         device_set_wakeup_enable(dev, false);
         phy_ctrl_power(am_phy->phy_ctrl, am_phy->id, am_phy->dr_mode, false);
 
-        return 0;
+        return usb_add_phy_dev(&am_phy->usb_phy_gen.phy);
 }
 
 static int am335x_phy_remove(struct platform_device *pdev)
diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index 4bc29b586698..f1c39a3c7534 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -2297,7 +2297,8 @@ static unsigned int tcpm_pd_select_pps_apdo(struct tcpm_port *port)
                                               pdo_pps_apdo_max_voltage(snk));
                 port->pps_data.max_curr = min_pps_apdo_current(src, snk);
                 port->pps_data.out_volt = min(port->pps_data.max_volt,
-                                              port->pps_data.out_volt);
+                                              max(port->pps_data.min_volt,
+                                                  port->pps_data.out_volt));
                 port->pps_data.op_curr = min(port->pps_data.max_curr,
                                              port->pps_data.op_curr);
         }
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index bca86bf7189f..df51a35cf537 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -1337,7 +1337,8 @@ static int vhost_net_open(struct inode *inode, struct file *f)
                 n->vqs[i].rx_ring = NULL;
                 vhost_net_buf_init(&n->vqs[i].rxq);
         }
-        vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX);
+        vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX,
+                       UIO_MAXIOV + VHOST_NET_BATCH);
 
         vhost_poll_init(n->poll + VHOST_NET_VQ_TX, handle_tx_net, EPOLLOUT, dev);
         vhost_poll_init(n->poll + VHOST_NET_VQ_RX, handle_rx_net, EPOLLIN, dev);
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 344684f3e2e4..23593cb23dd0 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1627,7 +1627,7 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
                 vqs[i] = &vs->vqs[i].vq;
                 vs->vqs[i].vq.handle_kick = vhost_scsi_handle_kick;
         }
-        vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ);
+        vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ, UIO_MAXIOV);
 
         vhost_scsi_init_inflight(vs, NULL);
 
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 15a216cdd507..24a129fcdd61 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -390,9 +390,9 @@ static long vhost_dev_alloc_iovecs(struct vhost_dev *dev)
                 vq->indirect = kmalloc_array(UIO_MAXIOV,
                                              sizeof(*vq->indirect),
                                              GFP_KERNEL);
-                vq->log = kmalloc_array(UIO_MAXIOV, sizeof(*vq->log),
+                vq->log = kmalloc_array(dev->iov_limit, sizeof(*vq->log),
                                         GFP_KERNEL);
-                vq->heads = kmalloc_array(UIO_MAXIOV, sizeof(*vq->heads),
+                vq->heads = kmalloc_array(dev->iov_limit, sizeof(*vq->heads),
                                           GFP_KERNEL);
                 if (!vq->indirect || !vq->log || !vq->heads)
                         goto err_nomem;
@@ -414,7 +414,7 @@ static void vhost_dev_free_iovecs(struct vhost_dev *dev)
 }
 
 void vhost_dev_init(struct vhost_dev *dev,
-                    struct vhost_virtqueue **vqs, int nvqs)
+                    struct vhost_virtqueue **vqs, int nvqs, int iov_limit)
 {
         struct vhost_virtqueue *vq;
         int i;
@@ -427,6 +427,7 @@ void vhost_dev_init(struct vhost_dev *dev,
         dev->iotlb = NULL;
         dev->mm = NULL;
         dev->worker = NULL;
+        dev->iov_limit = iov_limit;
         init_llist_head(&dev->work_list);
         init_waitqueue_head(&dev->wait);
         INIT_LIST_HEAD(&dev->read_list);
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 1b675dad5e05..9490e7ddb340 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -170,9 +170,11 @@ struct vhost_dev {
         struct list_head read_list;
         struct list_head pending_list;
         wait_queue_head_t wait;
+        int iov_limit;
 };
 
-void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs, int nvqs);
+void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs,
+                    int nvqs, int iov_limit);
 long vhost_dev_set_owner(struct vhost_dev *dev);
 bool vhost_dev_has_owner(struct vhost_dev *dev);
 long vhost_dev_check_owner(struct vhost_dev *);
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index 3fbc068eaa9b..bb5fc0e9fbc2 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -531,7 +531,7 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file)
         vsock->vqs[VSOCK_VQ_TX].handle_kick = vhost_vsock_handle_tx_kick;
         vsock->vqs[VSOCK_VQ_RX].handle_kick = vhost_vsock_handle_rx_kick;
 
-        vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs));
+        vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs), UIO_MAXIOV);
 
         file->private_data = vsock;
         spin_lock_init(&vsock->send_pkt_list_lock);
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index cd7e755484e3..a0b07c331255 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -152,7 +152,12 @@ struct vring_virtqueue {
                 /* Available for packed ring */
                 struct {
                         /* Actual memory layout for this queue. */
-                        struct vring_packed vring;
+                        struct {
+                                unsigned int num;
+                                struct vring_packed_desc *desc;
+                                struct vring_packed_desc_event *driver;
+                                struct vring_packed_desc_event *device;
+                        } vring;
 
                         /* Driver ring wrap counter. */
                         bool avail_wrap_counter;
@@ -1609,6 +1614,9 @@ static struct virtqueue *vring_create_virtqueue_packed(
                 !context;
         vq->event = virtio_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX);
 
+        if (virtio_has_feature(vdev, VIRTIO_F_ORDER_PLATFORM))
+                vq->weak_barriers = false;
+
         vq->packed.ring_dma_addr = ring_dma_addr;
         vq->packed.driver_event_dma_addr = driver_event_dma_addr;
         vq->packed.device_event_dma_addr = device_event_dma_addr;
@@ -2079,6 +2087,9 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index,
                 !context;
         vq->event = virtio_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX);
 
+        if (virtio_has_feature(vdev, VIRTIO_F_ORDER_PLATFORM))
+                vq->weak_barriers = false;
+
         vq->split.queue_dma_addr = 0;
         vq->split.queue_size_in_bytes = 0;
 
@@ -2213,6 +2224,8 @@ void vring_transport_features(struct virtio_device *vdev)
                         break;
                 case VIRTIO_F_RING_PACKED:
                         break;
+                case VIRTIO_F_ORDER_PLATFORM:
+                        break;
                 default:
                         /* We don't understand this bit. */
                         __virtio_clear_bit(vdev, i);
diff --git a/fs/autofs/expire.c b/fs/autofs/expire.c
index d441244b79df..28d9c2b1b3bb 100644
--- a/fs/autofs/expire.c
+++ b/fs/autofs/expire.c
@@ -596,7 +596,6 @@ int autofs_expire_run(struct super_block *sb,
         pkt.len = dentry->d_name.len;
         memcpy(pkt.name, dentry->d_name.name, pkt.len);
         pkt.name[pkt.len] = '\0';
-        dput(dentry);
 
         if (copy_to_user(pkt_p, &pkt, sizeof(struct autofs_packet_expire)))
                 ret = -EFAULT;
@@ -609,6 +608,8 @@ int autofs_expire_run(struct super_block *sb,
         complete_all(&ino->expire_complete);
         spin_unlock(&sbi->fs_lock);
 
+        dput(dentry);
+
         return ret;
 }
 
diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c
index 0e8ea2d9a2bb..078992eee299 100644
--- a/fs/autofs/inode.c
+++ b/fs/autofs/inode.c
@@ -266,8 +266,10 @@ int autofs_fill_super(struct super_block *s, void *data, int silent)
         }
         root_inode = autofs_get_inode(s, S_IFDIR | 0755);
         root = d_make_root(root_inode);
-        if (!root)
+        if (!root) {
+                ret = -ENOMEM;
                 goto fail_ino;
+        }
         pipe = NULL;
 
         root->d_fsdata = ino;
diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
index d0078cbb718b..7cde3f46ad26 100644
--- a/fs/binfmt_script.c
+++ b/fs/binfmt_script.c
@@ -42,14 +42,10 @@ static int load_script(struct linux_binprm *bprm)
         fput(bprm->file);
         bprm->file = NULL;
 
-        for (cp = bprm->buf+2;; cp++) {
-                if (cp >= bprm->buf + BINPRM_BUF_SIZE)
-                        return -ENOEXEC;
-                if (!*cp || (*cp == '\n'))
-                        break;
-        }
+        bprm->buf[BINPRM_BUF_SIZE - 1] = '\0';
+        if ((cp = strchr(bprm->buf, '\n')) == NULL)
+                cp = bprm->buf+BINPRM_BUF_SIZE-1;
         *cp = '\0';
-
         while (cp > bprm->buf) {
                 cp--;
                 if ((*cp == ' ') || (*cp == '\t'))
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index f64aad613727..5a6c39b44c84 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -968,6 +968,48 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
         return 0;
 }
 
+static struct extent_buffer *alloc_tree_block_no_bg_flush(
+                                          struct btrfs_trans_handle *trans,
+                                          struct btrfs_root *root,
+                                          u64 parent_start,
+                                          const struct btrfs_disk_key *disk_key,
+                                          int level,
+                                          u64 hint,
+                                          u64 empty_size)
+{
+        struct btrfs_fs_info *fs_info = root->fs_info;
+        struct extent_buffer *ret;
+
+        /*
+         * If we are COWing a node/leaf from the extent, chunk, device or free
+         * space trees, make sure that we do not finish block group creation of
+         * pending block groups. We do this to avoid a deadlock.
+         * COWing can result in allocation of a new chunk, and flushing pending
+         * block groups (btrfs_create_pending_block_groups()) can be triggered
+         * when finishing allocation of a new chunk. Creation of a pending block
+         * group modifies the extent, chunk, device and free space trees,
+         * therefore we could deadlock with ourselves since we are holding a
+         * lock on an extent buffer that btrfs_create_pending_block_groups() may
+         * try to COW later.
+         * For similar reasons, we also need to delay flushing pending block
+         * groups when splitting a leaf or node, from one of those trees, since
+         * we are holding a write lock on it and its parent or when inserting a
+         * new root node for one of those trees.
+         */
+        if (root == fs_info->extent_root ||
+            root == fs_info->chunk_root ||
+            root == fs_info->dev_root ||
+            root == fs_info->free_space_root)
+                trans->can_flush_pending_bgs = false;
+
+        ret = btrfs_alloc_tree_block(trans, root, parent_start,
+                                     root->root_key.objectid, disk_key, level,
+                                     hint, empty_size);
+        trans->can_flush_pending_bgs = true;
+
+        return ret;
+}
+
 /*
  * does the dirty work in cow of a single block.  The parent block (if
  * supplied) is updated to point to the new cow copy.  The new buffer is marked
@@ -1015,28 +1057,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
         if ((root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) && parent)
                 parent_start = parent->start;
 
-        /*
-         * If we are COWing a node/leaf from the extent, chunk, device or free
-         * space trees, make sure that we do not finish block group creation of
-         * pending block groups. We do this to avoid a deadlock.
-         * COWing can result in allocation of a new chunk, and flushing pending
-         * block groups (btrfs_create_pending_block_groups()) can be triggered
-         * when finishing allocation of a new chunk. Creation of a pending block
-         * group modifies the extent, chunk, device and free space trees,
-         * therefore we could deadlock with ourselves since we are holding a
-         * lock on an extent buffer that btrfs_create_pending_block_groups() may
-         * try to COW later.
-         */
-        if (root == fs_info->extent_root ||
-            root == fs_info->chunk_root ||
-            root == fs_info->dev_root ||
-            root == fs_info->free_space_root)
-                trans->can_flush_pending_bgs = false;
-
-        cow = btrfs_alloc_tree_block(trans, root, parent_start,
-                        root->root_key.objectid, &disk_key, level,
-                        search_start, empty_size);
-        trans->can_flush_pending_bgs = true;
+        cow = alloc_tree_block_no_bg_flush(trans, root, parent_start, &disk_key,
+                                           level, search_start, empty_size);
         if (IS_ERR(cow))
                 return PTR_ERR(cow);
 
@@ -3345,8 +3367,8 @@ static noinline int insert_new_root(struct btrfs_trans_handle *trans,
         else
                 btrfs_node_key(lower, &lower_key, 0);
 
-        c = btrfs_alloc_tree_block(trans, root, 0, root->root_key.objectid,
-                                   &lower_key, level, root->node->start, 0);
+        c = alloc_tree_block_no_bg_flush(trans, root, 0, &lower_key, level,
+                                         root->node->start, 0);
         if (IS_ERR(c))
                 return PTR_ERR(c);
 
@@ -3475,8 +3497,8 @@ static noinline int split_node(struct btrfs_trans_handle *trans,
         mid = (c_nritems + 1) / 2;
         btrfs_node_key(c, &disk_key, mid);
 
-        split = btrfs_alloc_tree_block(trans, root, 0, root->root_key.objectid,
-                        &disk_key, level, c->start, 0);
+        split = alloc_tree_block_no_bg_flush(trans, root, 0, &disk_key, level,
+                                             c->start, 0);
         if (IS_ERR(split))
                 return PTR_ERR(split);
 
@@ -4260,8 +4282,8 @@ again:
         else
                 btrfs_item_key(l, &disk_key, mid);
 
-        right = btrfs_alloc_tree_block(trans, root, 0, root->root_key.objectid,
-                        &disk_key, 0, l->start, 0);
+        right = alloc_tree_block_no_bg_flush(trans, root, 0, &disk_key, 0,
+                                             l->start, 0);
         if (IS_ERR(right))
                 return PTR_ERR(right);
 
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index c5586ffd1426..0a3f122dd61f 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1621,6 +1621,7 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
                                 flags | SB_RDONLY, device_name, data);
                         if (IS_ERR(mnt_root)) {
                                 root = ERR_CAST(mnt_root);
+                                kfree(subvol_name);
                                 goto out;
                         }
 
@@ -1630,12 +1631,14 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
                         if (error < 0) {
                                 root = ERR_PTR(error);
                                 mntput(mnt_root);
+                                kfree(subvol_name);
                                 goto out;
                         }
                 }
         }
         if (IS_ERR(mnt_root)) {
                 root = ERR_CAST(mnt_root);
+                kfree(subvol_name);
                 goto out;
         }
 
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 127fa1535f58..4ec2b660d014 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -850,14 +850,6 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
 
         btrfs_trans_release_chunk_metadata(trans);
 
-        if (lock && should_end_transaction(trans) &&
-            READ_ONCE(cur_trans->state) == TRANS_STATE_RUNNING) {
-                spin_lock(&info->trans_lock);
-                if (cur_trans->state == TRANS_STATE_RUNNING)
-                        cur_trans->state = TRANS_STATE_BLOCKED;
-                spin_unlock(&info->trans_lock);
-        }
-
         if (lock && READ_ONCE(cur_trans->state) == TRANS_STATE_BLOCKED) {
                 if (throttle)
                         return btrfs_commit_transaction(trans);
@@ -1879,6 +1871,21 @@ static void cleanup_transaction(struct btrfs_trans_handle *trans, int err)
         kmem_cache_free(btrfs_trans_handle_cachep, trans);
 }
 
+/*
+ * Release reserved delayed ref space of all pending block groups of the
+ * transaction and remove them from the list
+ */
+static void btrfs_cleanup_pending_block_groups(struct btrfs_trans_handle *trans)
+{
+       struct btrfs_fs_info *fs_info = trans->fs_info;
+       struct btrfs_block_group_cache *block_group, *tmp;
+
+       list_for_each_entry_safe(block_group, tmp, &trans->new_bgs, bg_list) {
+               btrfs_delayed_refs_rsv_release(fs_info, 1);
+               list_del_init(&block_group->bg_list);
+       }
+}
+
 static inline int btrfs_start_delalloc_flush(struct btrfs_fs_info *fs_info)
 {
         /*
@@ -2270,6 +2277,7 @@ scrub_continue:
         btrfs_scrub_continue(fs_info);
 cleanup_transaction:
         btrfs_trans_release_metadata(trans);
+        btrfs_cleanup_pending_block_groups(trans);
         btrfs_trans_release_chunk_metadata(trans);
         trans->block_rsv = NULL;
         btrfs_warn(fs_info, "Skipping commit of aborted transaction.");
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 3e4f8f88353e..15561926ab32 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -957,11 +957,11 @@ static noinline struct btrfs_device *device_list_add(const char *path,
                 else
                         fs_devices = alloc_fs_devices(disk_super->fsid, NULL);
 
-                fs_devices->fsid_change = fsid_change_in_progress;
-
                 if (IS_ERR(fs_devices))
                         return ERR_CAST(fs_devices);
 
+                fs_devices->fsid_change = fsid_change_in_progress;
+
                 mutex_lock(&fs_devices->device_list_mutex);
                 list_add(&fs_devices->fs_list, &fs_uuids);
 
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index d1f9c2f3f575..7652551a1fc4 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -150,5 +150,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CONFIG_CIFS_NFSD_EXPORT */
 
-#define CIFS_VERSION   "2.16"
+#define CIFS_VERSION   "2.17"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 2c7689f3998d..659ce1b92c44 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2696,6 +2696,7 @@ cifs_write_from_iter(loff_t offset, size_t len, struct iov_iter *from,
 
                         rc = cifs_write_allocate_pages(wdata->pages, nr_pages);
                         if (rc) {
+                                kvfree(wdata->pages);
                                 kfree(wdata);
                                 add_credits_and_wake_if(server, credits, 0);
                                 break;
@@ -2707,6 +2708,7 @@ cifs_write_from_iter(loff_t offset, size_t len, struct iov_iter *from,
                         if (rc) {
                                 for (i = 0; i < nr_pages; i++)
                                         put_page(wdata->pages[i]);
+                                kvfree(wdata->pages);
                                 kfree(wdata);
                                 add_credits_and_wake_if(server, credits, 0);
                                 break;
@@ -3386,8 +3388,12 @@ cifs_send_async_read(loff_t offset, size_t len, struct cifsFileInfo *open_file,
                         }
 
                         rc = cifs_read_allocate_pages(rdata, npages);
-                        if (rc)
-                                goto error;
+                        if (rc) {
+                                kvfree(rdata->pages);
+                                kfree(rdata);
+                                add_credits_and_wake_if(server, credits, 0);
+                                break;
+                        }
 
                         rdata->tailsz = PAGE_SIZE;
                 }
@@ -3407,7 +3413,6 @@ cifs_send_async_read(loff_t offset, size_t len, struct cifsFileInfo *open_file,
                 if (!rdata->cfile->invalidHandle ||
                     !(rc = cifs_reopen_file(rdata->cfile, true)))
                         rc = server->ops->async_readv(rdata);
-error:
                 if (rc) {
                         add_credits_and_wake_if(server, rdata->credits, 0);
                         kref_put(&rdata->refcount,
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 153238fc4fa9..6f96e2292856 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -866,7 +866,9 @@ smb2_query_eas(const unsigned int xid, struct cifs_tcon *tcon,
                                       FILE_READ_EA,
                                       FILE_FULL_EA_INFORMATION,
                                       SMB2_O_INFO_FILE,
-                                      SMB2_MAX_EA_BUF,
+                                      CIFSMaxBufSize -
+                                      MAX_SMB2_CREATE_RESPONSE_SIZE -
+                                      MAX_SMB2_CLOSE_RESPONSE_SIZE,
                                       &rsp_iov, &buftype, cifs_sb);
         if (rc) {
                 /*
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 2ff209ec4fab..77b3aaa39b35 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -3241,8 +3241,17 @@ smb2_readv_callback(struct mid_q_entry *mid)
                 rdata->mr = NULL;
         }
 #endif
-        if (rdata->result)
+        if (rdata->result && rdata->result != -ENODATA) {
                 cifs_stats_fail_inc(tcon, SMB2_READ_HE);
+                trace_smb3_read_err(0 /* xid */,
+                                    rdata->cfile->fid.persistent_fid,
+                                    tcon->tid, tcon->ses->Suid, rdata->offset,
+                                    rdata->bytes, rdata->result);
+        } else
+                trace_smb3_read_done(0 /* xid */,
+                                     rdata->cfile->fid.persistent_fid,
+                                     tcon->tid, tcon->ses->Suid,
+                                     rdata->offset, rdata->got_bytes);
 
         queue_work(cifsiod_wq, &rdata->work);
         DeleteMidQEntry(mid);
@@ -3317,13 +3326,11 @@ smb2_async_readv(struct cifs_readdata *rdata)
         if (rc) {
                 kref_put(&rdata->refcount, cifs_readdata_release);
                 cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE);
-                trace_smb3_read_err(rc, 0 /* xid */, io_parms.persistent_fid,
-                                   io_parms.tcon->tid, io_parms.tcon->ses->Suid,
-                                   io_parms.offset, io_parms.length);
-        } else
-                trace_smb3_read_done(0 /* xid */, io_parms.persistent_fid,
-                                   io_parms.tcon->tid, io_parms.tcon->ses->Suid,
-                                   io_parms.offset, io_parms.length);
+                trace_smb3_read_err(0 /* xid */, io_parms.persistent_fid,
+                                    io_parms.tcon->tid,
+                                    io_parms.tcon->ses->Suid,
+                                    io_parms.offset, io_parms.length, rc);
+        }
 
         cifs_small_buf_release(buf);
         return rc;
@@ -3367,10 +3374,11 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
                 if (rc != -ENODATA) {
                         cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
                         cifs_dbg(VFS, "Send error in read = %d\n", rc);
+                        trace_smb3_read_err(xid, req->PersistentFileId,
+                                            io_parms->tcon->tid, ses->Suid,
+                                            io_parms->offset, io_parms->length,
+                                            rc);
                 }
-                trace_smb3_read_err(rc, xid, req->PersistentFileId,
-                                    io_parms->tcon->tid, ses->Suid,
-                                    io_parms->offset, io_parms->length);
                 free_rsp_buf(resp_buftype, rsp_iov.iov_base);
                 return rc == -ENODATA ? 0 : rc;
         } else
@@ -3459,8 +3467,17 @@ smb2_writev_callback(struct mid_q_entry *mid)
                 wdata->mr = NULL;
         }
 #endif
-        if (wdata->result)
+        if (wdata->result) {
                 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
+                trace_smb3_write_err(0 /* no xid */,
+                                     wdata->cfile->fid.persistent_fid,
+                                     tcon->tid, tcon->ses->Suid, wdata->offset,
+                                     wdata->bytes, wdata->result);
+        } else
+                trace_smb3_write_done(0 /* no xid */,
+                                      wdata->cfile->fid.persistent_fid,
+                                      tcon->tid, tcon->ses->Suid,
+                                      wdata->offset, wdata->bytes);
 
         queue_work(cifsiod_wq, &wdata->work);
         DeleteMidQEntry(mid);
@@ -3602,10 +3619,7 @@ smb2_async_writev(struct cifs_writedata *wdata,
                                      wdata->bytes, rc);
                 kref_put(&wdata->refcount, release);
                 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
-        } else
-                trace_smb3_write_done(0 /* no xid */, req->PersistentFileId,
-                                     tcon->tid, tcon->ses->Suid, wdata->offset,
-                                     wdata->bytes);
+        }
 
 async_writev_out:
         cifs_small_buf_release(req);
@@ -3831,8 +3845,8 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
                     rsp->sync_hdr.Status == STATUS_NO_MORE_FILES) {
                         srch_inf->endOfSearch = true;
                         rc = 0;
-                }
-                cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
+                } else
+                        cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
                 goto qdir_exit;
         }
 
@@ -4427,8 +4441,8 @@ SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon,
         rc = cifs_send_recv(xid, ses, &rqst, &resp_buf_type, flags, &rsp_iov);
         cifs_small_buf_release(req);
 
-        please_key_low = (__u64 *)req->LeaseKey;
-        please_key_high = (__u64 *)(req->LeaseKey+8);
+        please_key_low = (__u64 *)lease_key;
+        please_key_high = (__u64 *)(lease_key+8);
         if (rc) {
                 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
                 trace_smb3_lease_err(le32_to_cpu(lease_state), tcon->tid,
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index 7a2d0a2255e6..538e2299805f 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -84,8 +84,9 @@
 
 #define NUMBER_OF_SMB2_COMMANDS 0x0013
 
-/* 4 len + 52 transform hdr + 64 hdr + 56 create rsp */
-#define MAX_SMB2_HDR_SIZE 0x00b0
+/* 52 transform hdr + 64 hdr + 88 create rsp */
+#define SMB2_TRANSFORM_HEADER_SIZE 52
+#define MAX_SMB2_HDR_SIZE 204
 
 #define SMB2_PROTO_NUMBER cpu_to_le32(0x424d53fe)
 #define SMB2_TRANSFORM_PROTO_NUM cpu_to_le32(0x424d53fd)
@@ -648,6 +649,13 @@ struct smb2_create_req {
         __u8   Buffer[0];
 } __packed;
 
+/*
+ * Maximum size of a SMB2_CREATE response is 64 (smb2 header) +
+ * 88 (fixed part of create response) + 520 (path) + 150 (contexts) +
+ * 2 bytes of padding.
+ */
+#define MAX_SMB2_CREATE_RESPONSE_SIZE 824
+
 struct smb2_create_rsp {
         struct smb2_sync_hdr sync_hdr;
         __le16 StructureSize;   /* Must be 89 */
@@ -996,6 +1004,11 @@ struct smb2_close_req {
         __u64  VolatileFileId; /* opaque endianness */
 } __packed;
 
+/*
+ * Maximum size of a SMB2_CLOSE response is 64 (smb2 header) + 60 (data)
+ */
+#define MAX_SMB2_CLOSE_RESPONSE_SIZE 124
+
 struct smb2_close_rsp {
         struct smb2_sync_hdr sync_hdr;
         __le16 StructureSize; /* 60 */
@@ -1398,8 +1411,6 @@ struct smb2_file_link_info { /* encoding of request for level 11 */
         char   FileName[0];     /* Name to be assigned to new link */
 } __packed; /* level 11 Set */
 
-#define SMB2_MAX_EA_BUF 65536
-
 struct smb2_file_full_ea_info { /* encoding of response for level 15 */
         __le32 next_entry_offset;
         __u8   flags;
diff --git a/fs/dcache.c b/fs/dcache.c
index 2593153471cf..aac41adf4743 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -119,6 +119,7 @@ struct dentry_stat_t dentry_stat = {
 
 static DEFINE_PER_CPU(long, nr_dentry);
 static DEFINE_PER_CPU(long, nr_dentry_unused);
+static DEFINE_PER_CPU(long, nr_dentry_negative);
 
 #if defined(CONFIG_SYSCTL) && defined(CONFIG_PROC_FS)
 
@@ -152,11 +153,22 @@ static long get_nr_dentry_unused(void)
         return sum < 0 ? 0 : sum;
 }
 
+static long get_nr_dentry_negative(void)
+{
+        int i;
+        long sum = 0;
+
+        for_each_possible_cpu(i)
+                sum += per_cpu(nr_dentry_negative, i);
+        return sum < 0 ? 0 : sum;
+}
+
 int proc_nr_dentry(struct ctl_table *table, int write, void __user *buffer,
                    size_t *lenp, loff_t *ppos)
 {
         dentry_stat.nr_dentry = get_nr_dentry();
         dentry_stat.nr_unused = get_nr_dentry_unused();
+        dentry_stat.nr_negative = get_nr_dentry_negative();
         return proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
 }
 #endif
@@ -317,6 +329,8 @@ static inline void __d_clear_type_and_inode(struct dentry *dentry)
         flags &= ~(DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU);
         WRITE_ONCE(dentry->d_flags, flags);
         dentry->d_inode = NULL;
+        if (dentry->d_flags & DCACHE_LRU_LIST)
+                this_cpu_inc(nr_dentry_negative);
 }
 
 static void dentry_free(struct dentry *dentry)
@@ -371,6 +385,11 @@ static void dentry_unlink_inode(struct dentry * dentry)
  * The per-cpu "nr_dentry_unused" counters are updated with
  * the DCACHE_LRU_LIST bit.
  *
+ * The per-cpu "nr_dentry_negative" counters are only updated
+ * when deleted from or added to the per-superblock LRU list, not
+ * from/to the shrink list. That is to avoid an unneeded dec/inc
+ * pair when moving from LRU to shrink list in select_collect().
+ *
  * These helper functions make sure we always follow the
  * rules. d_lock must be held by the caller.
  */
@@ -380,6 +399,8 @@ static void d_lru_add(struct dentry *dentry)
         D_FLAG_VERIFY(dentry, 0);
         dentry->d_flags |= DCACHE_LRU_LIST;
         this_cpu_inc(nr_dentry_unused);
+        if (d_is_negative(dentry))
+                this_cpu_inc(nr_dentry_negative);
         WARN_ON_ONCE(!list_lru_add(&dentry->d_sb->s_dentry_lru, &dentry->d_lru));
 }
 
@@ -388,6 +409,8 @@ static void d_lru_del(struct dentry *dentry)
         D_FLAG_VERIFY(dentry, DCACHE_LRU_LIST);
         dentry->d_flags &= ~DCACHE_LRU_LIST;
         this_cpu_dec(nr_dentry_unused);
+        if (d_is_negative(dentry))
+                this_cpu_dec(nr_dentry_negative);
         WARN_ON_ONCE(!list_lru_del(&dentry->d_sb->s_dentry_lru, &dentry->d_lru));
 }
 
@@ -418,6 +441,8 @@ static void d_lru_isolate(struct list_lru_one *lru, struct dentry *dentry)
         D_FLAG_VERIFY(dentry, DCACHE_LRU_LIST);
         dentry->d_flags &= ~DCACHE_LRU_LIST;
         this_cpu_dec(nr_dentry_unused);
+        if (d_is_negative(dentry))
+                this_cpu_dec(nr_dentry_negative);
         list_lru_isolate(lru, &dentry->d_lru);
 }
 
@@ -426,6 +451,8 @@ static void d_lru_shrink_move(struct list_lru_one *lru, struct dentry *dentry,
 {
         D_FLAG_VERIFY(dentry, DCACHE_LRU_LIST);
         dentry->d_flags |= DCACHE_SHRINK_LIST;
+        if (d_is_negative(dentry))
+                this_cpu_dec(nr_dentry_negative);
         list_lru_isolate_move(lru, &dentry->d_lru, list);
 }
 
@@ -1188,15 +1215,11 @@ static enum lru_status dentry_lru_isolate_shrink(struct list_head *item,
  */
 void shrink_dcache_sb(struct super_block *sb)
 {
-        long freed;
-
         do {
                 LIST_HEAD(dispose);
 
-                freed = list_lru_walk(&sb->s_dentry_lru,
+                list_lru_walk(&sb->s_dentry_lru,
                         dentry_lru_isolate_shrink, &dispose, 1024);
-
-                this_cpu_sub(nr_dentry_unused, freed);
                 shrink_dentry_list(&dispose);
         } while (list_lru_count(&sb->s_dentry_lru) > 0);
 }
@@ -1820,6 +1843,11 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode)
         WARN_ON(d_in_lookup(dentry));
 
         spin_lock(&dentry->d_lock);
+        /*
+         * Decrement negative dentry count if it was in the LRU list.
+         */
+        if (dentry->d_flags & DCACHE_LRU_LIST)
+                this_cpu_dec(nr_dentry_negative);
         hlist_add_head(&dentry->d_u.d_alias, &inode->i_dentry);
         raw_write_seqcount_begin(&dentry->d_seq);
         __d_set_inode_and_type(dentry, inode, add_flags);
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index 13b01351dd1c..29c68c5d44d5 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -324,7 +324,7 @@ static struct dentry *failed_creating(struct dentry *dentry)
         inode_unlock(d_inode(dentry->d_parent));
         dput(dentry);
         simple_release_fs(&debugfs_mount, &debugfs_mount_count);
-        return NULL;
+        return ERR_PTR(-ENOMEM);
 }
 
 static struct dentry *end_creating(struct dentry *dentry)
@@ -347,7 +347,7 @@ static struct dentry *__debugfs_create_file(const char *name, umode_t mode,
         dentry = start_creating(name, parent);
 
         if (IS_ERR(dentry))
-                return NULL;
+                return dentry;
 
         inode = debugfs_get_inode(dentry->d_sb);
         if (unlikely(!inode))
@@ -386,7 +386,8 @@ static struct dentry *__debugfs_create_file(const char *name, umode_t mode,
  * This function will return a pointer to a dentry if it succeeds.  This
  * pointer must be passed to the debugfs_remove() function when the file is
  * to be removed (no automatic cleanup happens if your module is unloaded,
- * you are responsible here.)  If an error occurs, %NULL will be returned.
+ * you are responsible here.)  If an error occurs, %ERR_PTR(-ERROR) will be
+ * returned.
  *
  * If debugfs is not enabled in the kernel, the value -%ENODEV will be
  * returned.
@@ -464,7 +465,8 @@ EXPORT_SYMBOL_GPL(debugfs_create_file_unsafe);
  * This function will return a pointer to a dentry if it succeeds.  This
  * pointer must be passed to the debugfs_remove() function when the file is
  * to be removed (no automatic cleanup happens if your module is unloaded,
- * you are responsible here.)  If an error occurs, %NULL will be returned.
+ * you are responsible here.)  If an error occurs, %ERR_PTR(-ERROR) will be
+ * returned.
  *
  * If debugfs is not enabled in the kernel, the value -%ENODEV will be
  * returned.
@@ -495,7 +497,8 @@ EXPORT_SYMBOL_GPL(debugfs_create_file_size);
  * This function will return a pointer to a dentry if it succeeds.  This
  * pointer must be passed to the debugfs_remove() function when the file is
  * to be removed (no automatic cleanup happens if your module is unloaded,
- * you are responsible here.)  If an error occurs, %NULL will be returned.
+ * you are responsible here.)  If an error occurs, %ERR_PTR(-ERROR) will be
+ * returned.
  *
  * If debugfs is not enabled in the kernel, the value -%ENODEV will be
  * returned.
@@ -506,7 +509,7 @@ struct dentry *debugfs_create_dir(const char *name, struct dentry *parent)
         struct inode *inode;
 
         if (IS_ERR(dentry))
-                return NULL;
+                return dentry;
 
         inode = debugfs_get_inode(dentry->d_sb);
         if (unlikely(!inode))
@@ -545,7 +548,7 @@ struct dentry *debugfs_create_automount(const char *name,
         struct inode *inode;
 
         if (IS_ERR(dentry))
-                return NULL;
+                return dentry;
 
         inode = debugfs_get_inode(dentry->d_sb);
         if (unlikely(!inode))
@@ -581,8 +584,8 @@ EXPORT_SYMBOL(debugfs_create_automount);
  * This function will return a pointer to a dentry if it succeeds.  This
  * pointer must be passed to the debugfs_remove() function when the symbolic
  * link is to be removed (no automatic cleanup happens if your module is
- * unloaded, you are responsible here.)  If an error occurs, %NULL will be
- * returned.
+ * unloaded, you are responsible here.)  If an error occurs, %ERR_PTR(-ERROR)
+ * will be returned.
  *
  * If debugfs is not enabled in the kernel, the value -%ENODEV will be
  * returned.
@@ -594,12 +597,12 @@ struct dentry *debugfs_create_symlink(const char *name, struct dentry *parent,
         struct inode *inode;
         char *link = kstrdup(target, GFP_KERNEL);
         if (!link)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         dentry = start_creating(name, parent);
         if (IS_ERR(dentry)) {
                 kfree(link);
-                return NULL;
+                return dentry;
         }
 
         inode = debugfs_get_inode(dentry->d_sb);
@@ -787,6 +790,13 @@ struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry,
         struct dentry *dentry = NULL, *trap;
         struct name_snapshot old_name;
 
+        if (IS_ERR(old_dir))
+                return old_dir;
+        if (IS_ERR(new_dir))
+                return new_dir;
+        if (IS_ERR_OR_NULL(old_dentry))
+                return old_dentry;
+
         trap = lock_rename(new_dir, old_dir);
         /* Source or destination directories don't exist? */
         if (d_really_is_negative(old_dir) || d_really_is_negative(new_dir))
@@ -820,7 +830,9 @@ exit:
         if (dentry && !IS_ERR(dentry))
                 dput(dentry);
         unlock_rename(new_dir, old_dir);
-        return NULL;
+        if (IS_ERR(dentry))
+                return dentry;
+        return ERR_PTR(-EINVAL);
 }
 EXPORT_SYMBOL_GPL(debugfs_rename);
 
diff --git a/fs/drop_caches.c b/fs/drop_caches.c
index 82377017130f..d31b6c72b476 100644
--- a/fs/drop_caches.c
+++ b/fs/drop_caches.c
@@ -21,8 +21,13 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)
         spin_lock(&sb->s_inode_list_lock);
         list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
                 spin_lock(&inode->i_lock);
+                /*
+                 * We must skip inodes in unusual state. We may also skip
+                 * inodes without pages but we deliberately won't in case
+                 * we need to reschedule to avoid softlockups.
+                 */
                 if ((inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW)) ||
-                    (inode->i_mapping->nrpages == 0)) {
+                    (inode->i_mapping->nrpages == 0 && !need_resched())) {
                         spin_unlock(&inode->i_lock);
                         continue;
                 }
@@ -30,6 +35,7 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)
                 spin_unlock(&inode->i_lock);
                 spin_unlock(&sb->s_inode_list_lock);
 
+                cond_resched();
                 invalidate_mapping_pages(inode->i_mapping, 0, -1);
                 iput(toput_inode);
                 toput_inode = inode;
diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
index 712f00995390..5508baa11bb6 100644
--- a/fs/ext4/fsync.c
+++ b/fs/ext4/fsync.c
@@ -116,16 +116,8 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
                 goto out;
         }
 
-        ret = file_write_and_wait_range(file, start, end);
-        if (ret)
-                return ret;
-
         if (!journal) {
-                struct writeback_control wbc = {
-                        .sync_mode = WB_SYNC_ALL
-                };
-
-                ret = ext4_write_inode(inode, &wbc);
+                ret = __generic_file_fsync(file, start, end, datasync);
                 if (!ret)
                         ret = ext4_sync_parent(inode);
                 if (test_opt(inode->i_sb, BARRIER))
@@ -133,6 +125,9 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
                 goto out;
         }
 
+        ret = file_write_and_wait_range(file, start, end);
+        if (ret)
+                return ret;
         /*
          * data=writeback,ordered:
          *  The caller's filemap_fdatawrite()/wait will sync the data.
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index a5e516a40e7a..809c0f2f9942 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1742,7 +1742,6 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
         req->in.h.nodeid = outarg->nodeid;
         req->in.numargs = 2;
         req->in.argpages = 1;
-        req->page_descs[0].offset = offset;
         req->end = fuse_retrieve_end;
 
         index = outarg->offset >> PAGE_SHIFT;
@@ -1757,6 +1756,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
 
                 this_num = min_t(unsigned, num, PAGE_SIZE - offset);
                 req->pages[req->num_pages] = page;
+                req->page_descs[req->num_pages].offset = offset;
                 req->page_descs[req->num_pages].length = this_num;
                 req->num_pages++;
 
@@ -2077,8 +2077,10 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
 
         ret = fuse_dev_do_write(fud, &cs, len);
 
+        pipe_lock(pipe);
         for (idx = 0; idx < nbuf; idx++)
                 pipe_buf_release(pipe, &bufs[idx]);
+        pipe_unlock(pipe);
 
 out:
         kvfree(bufs);
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index ffaffe18352a..a59c16bd90ac 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1782,7 +1782,7 @@ static bool fuse_writepage_in_flight(struct fuse_req *new_req,
                 spin_unlock(&fc->lock);
 
                 dec_wb_stat(&bdi->wb, WB_WRITEBACK);
-                dec_node_page_state(page, NR_WRITEBACK_TEMP);
+                dec_node_page_state(new_req->pages[0], NR_WRITEBACK_TEMP);
                 wb_writeout_inc(&bdi->wb);
                 fuse_writepage_free(fc, new_req);
                 fuse_request_free(new_req);
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 76baaa6be393..c2d4099429be 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -628,6 +628,7 @@ void fuse_conn_init(struct fuse_conn *fc, struct user_namespace *user_ns)
         get_random_bytes(&fc->scramble_key, sizeof(fc->scramble_key));
         fc->pid_ns = get_pid_ns(task_active_pid_ns(current));
         fc->user_ns = get_user_ns(user_ns);
+        fc->max_pages = FUSE_DEFAULT_MAX_PAGES_PER_REQ;
 }
 EXPORT_SYMBOL_GPL(fuse_conn_init);
 
@@ -1162,7 +1163,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         fc->user_id = d.user_id;
         fc->group_id = d.group_id;
         fc->max_read = max_t(unsigned, 4096, d.max_read);
-        fc->max_pages = FUSE_DEFAULT_MAX_PAGES_PER_REQ;
 
         /* Used by get_root_inode() */
         sb->s_fs_info = fc;
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index f15b4c57c4bd..78510ab91835 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -28,7 +28,6 @@
 #include "util.h"
 #include "trans.h"
 #include "dir.h"
-#include "lops.h"
 
 struct workqueue_struct *gfs2_freeze_wq;
 
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 5bfaf381921a..b8830fda51e8 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -733,7 +733,7 @@ void gfs2_write_log_header(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd,
         lh->lh_crc = cpu_to_be32(crc);
 
         gfs2_log_write(sdp, page, sb->s_blocksize, 0, addr);
-        gfs2_log_submit_bio(&sdp->sd_log_bio, REQ_OP_WRITE | op_flags);
+        gfs2_log_submit_bio(&sdp->sd_log_bio, REQ_OP_WRITE, op_flags);
         log_flush_wait(sdp);
 }
 
@@ -810,7 +810,7 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags)
 
         gfs2_ordered_write(sdp);
         lops_before_commit(sdp, tr);
-        gfs2_log_submit_bio(&sdp->sd_log_bio, REQ_OP_WRITE);
+        gfs2_log_submit_bio(&sdp->sd_log_bio, REQ_OP_WRITE, 0);
 
         if (sdp->sd_log_head != sdp->sd_log_flush_head) {
                 log_flush_wait(sdp);
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 94dcab655bc0..2295042bc625 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -17,9 +17,7 @@
 #include <linux/bio.h>
 #include <linux/fs.h>
 #include <linux/list_sort.h>
-#include <linux/blkdev.h>
 
-#include "bmap.h"
 #include "dir.h"
 #include "gfs2.h"
 #include "incore.h"
@@ -195,6 +193,7 @@ static void gfs2_end_log_write_bh(struct gfs2_sbd *sdp, struct bio_vec *bvec,
 /**
  * gfs2_end_log_write - end of i/o to the log
  * @bio: The bio
+ * @error: Status of i/o request
  *
  * Each bio_vec contains either data from the pagecache or data
  * relating to the log itself. Here we iterate over the bio_vec
@@ -231,19 +230,20 @@ static void gfs2_end_log_write(struct bio *bio)
 /**
  * gfs2_log_submit_bio - Submit any pending log bio
  * @biop: Address of the bio pointer
- * @opf: REQ_OP | op_flags
+ * @op: REQ_OP
+ * @op_flags: req_flag_bits
  *
  * Submit any pending part-built or full bio to the block device. If
  * there is no pending bio, then this is a no-op.
  */
 
-void gfs2_log_submit_bio(struct bio **biop, int opf)
+void gfs2_log_submit_bio(struct bio **biop, int op, int op_flags)
 {
         struct bio *bio = *biop;
         if (bio) {
                 struct gfs2_sbd *sdp = bio->bi_private;
                 atomic_inc(&sdp->sd_log_in_flight);
-                bio->bi_opf = opf;
+                bio_set_op_attrs(bio, op, op_flags);
                 submit_bio(bio);
                 *biop = NULL;
         }
@@ -304,7 +304,7 @@ static struct bio *gfs2_log_get_bio(struct gfs2_sbd *sdp, u64 blkno,
                 nblk >>= sdp->sd_fsb2bb_shift;
                 if (blkno == nblk && !flush)
                         return bio;
-                gfs2_log_submit_bio(biop, op);
+                gfs2_log_submit_bio(biop, op, 0);
         }
 
         *biop = gfs2_log_alloc_bio(sdp, blkno, end_io);
@@ -375,184 +375,6 @@ void gfs2_log_write_page(struct gfs2_sbd *sdp, struct page *page)
                        gfs2_log_bmap(sdp));
 }
 
-/**
- * gfs2_end_log_read - end I/O callback for reads from the log
- * @bio: The bio
- *
- * Simply unlock the pages in the bio. The main thread will wait on them and
- * process them in order as necessary.
- */
-
-static void gfs2_end_log_read(struct bio *bio)
-{
-        struct page *page;
-        struct bio_vec *bvec;
-        int i;
-
-        bio_for_each_segment_all(bvec, bio, i) {
-                page = bvec->bv_page;
-                if (bio->bi_status) {
-                        int err = blk_status_to_errno(bio->bi_status);
-
-                        SetPageError(page);
-                        mapping_set_error(page->mapping, err);
-                }
-                unlock_page(page);
-        }
-
-        bio_put(bio);
-}
-
-/**
- * gfs2_jhead_pg_srch - Look for the journal head in a given page.
- * @jd: The journal descriptor
- * @page: The page to look in
- *
- * Returns: 1 if found, 0 otherwise.
- */
-
-static bool gfs2_jhead_pg_srch(struct gfs2_jdesc *jd,
-                              struct gfs2_log_header_host *head,
-                              struct page *page)
-{
-        struct gfs2_sbd *sdp = GFS2_SB(jd->jd_inode);
-        struct gfs2_log_header_host uninitialized_var(lh);
-        void *kaddr = kmap_atomic(page);
-        unsigned int offset;
-        bool ret = false;
-
-        for (offset = 0; offset < PAGE_SIZE; offset += sdp->sd_sb.sb_bsize) {
-                if (!__get_log_header(sdp, kaddr + offset, 0, &lh)) {
-                        if (lh.lh_sequence > head->lh_sequence)
-                                *head = lh;
-                        else {
-                                ret = true;
-                                break;
-                        }
-                }
-        }
-        kunmap_atomic(kaddr);
-        return ret;
-}
-
-/**
- * gfs2_jhead_process_page - Search/cleanup a page
- * @jd: The journal descriptor
- * @index: Index of the page to look into
- * @done: If set, perform only cleanup, else search and set if found.
- *
- * Find the page with 'index' in the journal's mapping. Search the page for
- * the journal head if requested (cleanup == false). Release refs on the
- * page so the page cache can reclaim it (put_page() twice). We grabbed a
- * reference on this page two times, first when we did a find_or_create_page()
- * to obtain the page to add it to the bio and second when we do a
- * find_get_page() here to get the page to wait on while I/O on it is being
- * completed.
- * This function is also used to free up a page we might've grabbed but not
- * used. Maybe we added it to a bio, but not submitted it for I/O. Or we
- * submitted the I/O, but we already found the jhead so we only need to drop
- * our references to the page.
- */
-
-static void gfs2_jhead_process_page(struct gfs2_jdesc *jd, unsigned long index,
-                                    struct gfs2_log_header_host *head,
-                                    bool *done)
-{
-        struct page *page;
-
-        page = find_get_page(jd->jd_inode->i_mapping, index);
-        wait_on_page_locked(page);
-
-        if (PageError(page))
-                *done = true;
-
-        if (!*done)
-                *done = gfs2_jhead_pg_srch(jd, head, page);
-
-        put_page(page); /* Once for find_get_page */
-        put_page(page); /* Once more for find_or_create_page */
-}
-
-/**
- * gfs2_find_jhead - find the head of a log
- * @jd: The journal descriptor
- * @head: The log descriptor for the head of the log is returned here
- *
- * Do a search of a journal by reading it in large chunks using bios and find
- * the valid log entry with the highest sequence number.  (i.e. the log head)
- *
- * Returns: 0 on success, errno otherwise
- */
-
-int gfs2_find_jhead(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head)
-{
-        struct gfs2_sbd *sdp = GFS2_SB(jd->jd_inode);
-        struct address_space *mapping = jd->jd_inode->i_mapping;
-        struct gfs2_journal_extent *je;
-        u32 block, read_idx = 0, submit_idx = 0, index = 0;
-        int shift = PAGE_SHIFT - sdp->sd_sb.sb_bsize_shift;
-        int blocks_per_page = 1 << shift, sz, ret = 0;
-        struct bio *bio = NULL;
-        struct page *page;
-        bool done = false;
-        errseq_t since;
-
-        memset(head, 0, sizeof(*head));
-        if (list_empty(&jd->extent_list))
-                gfs2_map_journal_extents(sdp, jd);
-
-        since = filemap_sample_wb_err(mapping);
-        list_for_each_entry(je, &jd->extent_list, list) {
-                for (block = 0; block < je->blocks; block += blocks_per_page) {
-                        index = (je->lblock + block) >> shift;
-
-                        page = find_or_create_page(mapping, index, GFP_NOFS);
-                        if (!page) {
-                                ret = -ENOMEM;
-                                done = true;
-                                goto out;
-                        }
-
-                        if (bio) {
-                                sz = bio_add_page(bio, page, PAGE_SIZE, 0);
-                                if (sz == PAGE_SIZE)
-                                        goto page_added;
-                                submit_idx = index;
-                                submit_bio(bio);
-                                bio = NULL;
-                        }
-
-                        bio = gfs2_log_alloc_bio(sdp,
-                                                 je->dblock + (index << shift),
-                                                 gfs2_end_log_read);
-                        bio->bi_opf = REQ_OP_READ;
-                        sz = bio_add_page(bio, page, PAGE_SIZE, 0);
-                        gfs2_assert_warn(sdp, sz == PAGE_SIZE);
-
-page_added:
-                        if (submit_idx <= read_idx + BIO_MAX_PAGES) {
-                                /* Keep at least one bio in flight */
-                                continue;
-                        }
-
-                        gfs2_jhead_process_page(jd, read_idx++, head, &done);
-                        if (done)
-                                goto out;  /* found */
-                }
-        }
-
-out:
-        if (bio)
-                submit_bio(bio);
-        while (read_idx <= index)
-                gfs2_jhead_process_page(jd, read_idx++, head, &done);
-
-        if (!ret)
-                ret = filemap_check_wb_err(mapping, since);
-
-        return ret;
-}
-
 static struct page *gfs2_get_log_desc(struct gfs2_sbd *sdp, u32 ld_type,
                                       u32 ld_length, u32 ld_data1)
 {
diff --git a/fs/gfs2/lops.h b/fs/gfs2/lops.h
index 331160fc568b..711c4d89c063 100644
--- a/fs/gfs2/lops.h
+++ b/fs/gfs2/lops.h
@@ -30,10 +30,8 @@ extern u64 gfs2_log_bmap(struct gfs2_sbd *sdp);
 extern void gfs2_log_write(struct gfs2_sbd *sdp, struct page *page,
                            unsigned size, unsigned offset, u64 blkno);
 extern void gfs2_log_write_page(struct gfs2_sbd *sdp, struct page *page);
-extern void gfs2_log_submit_bio(struct bio **biop, int opf);
+extern void gfs2_log_submit_bio(struct bio **biop, int op, int op_flags);
 extern void gfs2_pin(struct gfs2_sbd *sdp, struct buffer_head *bh);
-extern int gfs2_find_jhead(struct gfs2_jdesc *jd,
-                           struct gfs2_log_header_host *head);
 
 static inline unsigned int buf_limit(struct gfs2_sbd *sdp)
 {
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 1179763f6370..b041cb8ae383 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -41,7 +41,6 @@
 #include "dir.h"
 #include "meta_io.h"
 #include "trace_gfs2.h"
-#include "lops.h"
 
 #define DO 0
 #define UNDO 1
diff --git a/fs/gfs2/recovery.c b/fs/gfs2/recovery.c
index 7389e445a7a7..2dac43065382 100644
--- a/fs/gfs2/recovery.c
+++ b/fs/gfs2/recovery.c
@@ -182,6 +182,129 @@ static int get_log_header(struct gfs2_jdesc *jd, unsigned int blk,
 }
 
 /**
+ * find_good_lh - find a good log header
+ * @jd: the journal
+ * @blk: the segment to start searching from
+ * @lh: the log header to fill in
+ * @forward: if true search forward in the log, else search backward
+ *
+ * Call get_log_header() to get a log header for a segment, but if the
+ * segment is bad, either scan forward or backward until we find a good one.
+ *
+ * Returns: errno
+ */
+
+static int find_good_lh(struct gfs2_jdesc *jd, unsigned int *blk,
+                        struct gfs2_log_header_host *head)
+{
+        unsigned int orig_blk = *blk;
+        int error;
+
+        for (;;) {
+                error = get_log_header(jd, *blk, head);
+                if (error <= 0)
+                        return error;
+
+                if (++*blk == jd->jd_blocks)
+                        *blk = 0;
+
+                if (*blk == orig_blk) {
+                        gfs2_consist_inode(GFS2_I(jd->jd_inode));
+                        return -EIO;
+                }
+        }
+}
+
+/**
+ * jhead_scan - make sure we've found the head of the log
+ * @jd: the journal
+ * @head: this is filled in with the log descriptor of the head
+ *
+ * At this point, seg and lh should be either the head of the log or just
+ * before.  Scan forward until we find the head.
+ *
+ * Returns: errno
+ */
+
+static int jhead_scan(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head)
+{
+        unsigned int blk = head->lh_blkno;
+        struct gfs2_log_header_host lh;
+        int error;
+
+        for (;;) {
+                if (++blk == jd->jd_blocks)
+                        blk = 0;
+
+                error = get_log_header(jd, blk, &lh);
+                if (error < 0)
+                        return error;
+                if (error == 1)
+                        continue;
+
+                if (lh.lh_sequence == head->lh_sequence) {
+                        gfs2_consist_inode(GFS2_I(jd->jd_inode));
+                        return -EIO;
+                }
+                if (lh.lh_sequence < head->lh_sequence)
+                        break;
+
+                *head = lh;
+        }
+
+        return 0;
+}
+
+/**
+ * gfs2_find_jhead - find the head of a log
+ * @jd: the journal
+ * @head: the log descriptor for the head of the log is returned here
+ *
+ * Do a binary search of a journal and find the valid log entry with the
+ * highest sequence number.  (i.e. the log head)
+ *
+ * Returns: errno
+ */
+
+int gfs2_find_jhead(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head)
+{
+        struct gfs2_log_header_host lh_1, lh_m;
+        u32 blk_1, blk_2, blk_m;
+        int error;
+
+        blk_1 = 0;
+        blk_2 = jd->jd_blocks - 1;
+
+        for (;;) {
+                blk_m = (blk_1 + blk_2) / 2;
+
+                error = find_good_lh(jd, &blk_1, &lh_1);
+                if (error)
+                        return error;
+
+                error = find_good_lh(jd, &blk_m, &lh_m);
+                if (error)
+                        return error;
+
+                if (blk_1 == blk_m || blk_m == blk_2)
+                        break;
+
+                if (lh_1.lh_sequence <= lh_m.lh_sequence)
+                        blk_1 = blk_m;
+                else
+                        blk_2 = blk_m;
+        }
+
+        error = jhead_scan(jd, &lh_1);
+        if (error)
+                return error;
+
+        *head = lh_1;
+
+        return error;
+}
+
+/**
  * foreach_descriptor - go through the active part of the log
  * @jd: the journal
  * @start: the first log header in the active region
diff --git a/fs/gfs2/recovery.h b/fs/gfs2/recovery.h
index 99575ab81202..11d81248be85 100644
--- a/fs/gfs2/recovery.h
+++ b/fs/gfs2/recovery.h
@@ -27,6 +27,8 @@ extern int gfs2_revoke_add(struct gfs2_jdesc *jd, u64 blkno, unsigned int where)
 extern int gfs2_revoke_check(struct gfs2_jdesc *jd, u64 blkno, unsigned int where);
 extern void gfs2_revoke_clean(struct gfs2_jdesc *jd);
 
+extern int gfs2_find_jhead(struct gfs2_jdesc *jd,
+                    struct gfs2_log_header_host *head);
 extern int gfs2_recover_journal(struct gfs2_jdesc *gfs2_jd, bool wait);
 extern void gfs2_recover_func(struct work_struct *work);
 extern int __get_log_header(struct gfs2_sbd *sdp,
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 831d7cb5a49c..17a8d3b43990 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -1780,9 +1780,9 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext,
                         goto next_iter;
                 }
                 if (ret == -E2BIG) {
-                        n += rbm->bii - initial_bii;
                         rbm->bii = 0;
                         rbm->offset = 0;
+                        n += (rbm->bii - initial_bii);
                         goto res_covered_end_of_rgrp;
                 }
                 return ret;
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index d4b11c903971..ca71163ff7cf 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -45,7 +45,6 @@
 #include "util.h"
 #include "sys.h"
 #include "xattr.h"
-#include "lops.h"
 
 #define args_neq(a1, a2, x) ((a1)->ar_##x != (a2)->ar_##x)
 
diff --git a/fs/inode.c b/fs/inode.c
index 0cd47fe0dbe5..73432e64f874 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -730,11 +730,8 @@ static enum lru_status inode_lru_isolate(struct list_head *item,
                 return LRU_REMOVED;
         }
 
-        /*
-         * Recently referenced inodes and inodes with many attached pages
-         * get one more pass.
-         */
-        if (inode->i_state & I_REFERENCED || inode->i_data.nrpages > 1) {
+        /* recently referenced inodes get one more pass */
+        if (inode->i_state & I_REFERENCED) {
                 inode->i_state &= ~I_REFERENCED;
                 spin_unlock(&inode->i_lock);
                 return LRU_ROTATE;
diff --git a/fs/iomap.c b/fs/iomap.c
index a3088fae567b..897c60215dd1 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -116,6 +116,12 @@ iomap_page_create(struct inode *inode, struct page *page)
         atomic_set(&iop->read_count, 0);
         atomic_set(&iop->write_count, 0);
         bitmap_zero(iop->uptodate, PAGE_SIZE / SECTOR_SIZE);
+
+        /*
+         * migrate_page_move_mapping() assumes that pages with private data have
+         * their count elevated by 1.
+         */
+        get_page(page);
         set_page_private(page, (unsigned long)iop);
         SetPagePrivate(page);
         return iop;
@@ -132,6 +138,7 @@ iomap_page_release(struct page *page)
         WARN_ON_ONCE(atomic_read(&iop->write_count));
         ClearPagePrivate(page);
         set_page_private(page, 0);
+        put_page(page);
         kfree(iop);
 }
 
@@ -569,8 +576,10 @@ iomap_migrate_page(struct address_space *mapping, struct page *newpage,
 
         if (page_has_private(page)) {
                 ClearPagePrivate(page);
+                get_page(newpage);
                 set_page_private(newpage, page_private(page));
                 set_page_private(page, 0);
+                put_page(page);
                 SetPagePrivate(newpage);
         }
 
@@ -1804,6 +1813,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         loff_t pos = iocb->ki_pos, start = pos;
         loff_t end = iocb->ki_pos + count - 1, ret = 0;
         unsigned int flags = IOMAP_DIRECT;
+        bool wait_for_completion = is_sync_kiocb(iocb);
         struct blk_plug plug;
         struct iomap_dio *dio;
 
@@ -1823,7 +1833,6 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         dio->end_io = end_io;
         dio->error = 0;
         dio->flags = 0;
-        dio->wait_for_completion = is_sync_kiocb(iocb);
 
         dio->submit.iter = iter;
         dio->submit.waiter = current;
@@ -1878,7 +1887,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                 dio_warn_stale_pagecache(iocb->ki_filp);
         ret = 0;
 
-        if (iov_iter_rw(iter) == WRITE && !dio->wait_for_completion &&
+        if (iov_iter_rw(iter) == WRITE && !wait_for_completion &&
             !inode->i_sb->s_dio_done_wq) {
                 ret = sb_init_dio_done_wq(inode->i_sb);
                 if (ret < 0)
@@ -1894,7 +1903,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                 if (ret <= 0) {
                         /* magic error code to fall back to buffered I/O */
                         if (ret == -ENOTBLK) {
-                                dio->wait_for_completion = true;
+                                wait_for_completion = true;
                                 ret = 0;
                         }
                         break;
@@ -1916,8 +1925,24 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         if (dio->flags & IOMAP_DIO_WRITE_FUA)
                 dio->flags &= ~IOMAP_DIO_NEED_SYNC;
 
+        /*
+         * We are about to drop our additional submission reference, which
+         * might be the last reference to the dio.  There are three three
+         * different ways we can progress here:
+         *
+         *  (a) If this is the last reference we will always complete and free
+         *      the dio ourselves.
+         *  (b) If this is not the last reference, and we serve an asynchronous
+         *      iocb, we must never touch the dio after the decrement, the
+         *      I/O completion handler will complete and free it.
+         *  (c) If this is not the last reference, but we serve a synchronous
+         *      iocb, the I/O completion handler will wake us up on the drop
+         *      of the final reference, and we will complete and free it here
+         *      after we got woken by the I/O completion handler.
+         */
+        dio->wait_for_completion = wait_for_completion;
         if (!atomic_dec_and_test(&dio->ref)) {
-                if (!dio->wait_for_completion)
+                if (!wait_for_completion)
                         return -EIOCBQUEUED;
 
                 for (;;) {
@@ -1934,9 +1959,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                 __set_current_state(TASK_RUNNING);
         }
 
-        ret = iomap_dio_complete(dio);
-
-        return ret;
+        return iomap_dio_complete(dio);
 
 out_free_dio:
         kfree(dio);
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 22ce3c8a2f46..0570391eaa16 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1895,6 +1895,11 @@ static int nfs_parse_devname(const char *dev_name,
         size_t len;
         char *end;
 
+        if (unlikely(!dev_name || !*dev_name)) {
+                dfprintk(MOUNT, "NFS: device name not specified\n");
+                return -EINVAL;
+        }
+
         /* Is the host name protected with square brakcets? */
         if (*dev_name == '[') {
                 end = strchr(++dev_name, ']');
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 5a0bbf917a32..f12cb31a41e5 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -621,11 +621,12 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
         nfs_set_page_writeback(page);
         WARN_ON_ONCE(test_bit(PG_CLEAN, &req->wb_flags));
 
-        ret = 0;
+        ret = req->wb_context->error;
         /* If there is a fatal error that covers this write, just exit */
-        if (nfs_error_is_fatal_on_server(req->wb_context->error))
+        if (nfs_error_is_fatal_on_server(ret))
                 goto out_launder;
 
+        ret = 0;
         if (!nfs_pageio_add_request(pgio, req)) {
                 ret = pgio->pg_error;
                 /*
@@ -635,9 +636,9 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
                         nfs_context_set_write_error(req->wb_context, ret);
                         if (nfs_error_is_fatal_on_server(ret))
                                 goto out_launder;
-                }
+                } else
+                        ret = -EAGAIN;
                 nfs_redirty_request(req);
-                ret = -EAGAIN;
         } else
                 nfs_add_stats(page_file_mapping(page)->host,
                                 NFSIOS_WRITEPAGES, 1);
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 9824e32b2f23..7dc98e14655d 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -557,9 +557,11 @@ __be32 nfsd4_clone_file_range(struct file *src, u64 src_pos, struct file *dst,
         loff_t cloned;
 
         cloned = vfs_clone_file_range(src, src_pos, dst, dst_pos, count, 0);
+        if (cloned < 0)
+                return nfserrno(cloned);
         if (count && cloned != count)
-                cloned = -EINVAL;
-        return nfserrno(cloned < 0 ? cloned : 0);
+                return nfserrno(-EINVAL);
+        return 0;
 }
 
 ssize_t nfsd_copy_file_range(struct file *src, u64 src_pos, struct file *dst,
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 8ae109429a88..e39bac94dead 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -256,7 +256,7 @@ struct dentry *proc_lookup_de(struct inode *dir, struct dentry *dentry,
                 inode = proc_get_inode(dir->i_sb, de);
                 if (!inode)
                         return ERR_PTR(-ENOMEM);
-                d_set_d_op(dentry, &proc_misc_dentry_ops);
+                d_set_d_op(dentry, de->proc_dops);
                 return d_splice_alias(inode, dentry);
         }
         read_unlock(&proc_subdir_lock);
@@ -429,6 +429,8 @@ static struct proc_dir_entry *__proc_create(struct proc_dir_entry **parent,
         INIT_LIST_HEAD(&ent->pde_openers);
         proc_set_user(ent, (*parent)->uid, (*parent)->gid);
 
+        ent->proc_dops = &proc_misc_dentry_ops;
+
 out:
         return ent;
 }
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index 5185d7f6a51e..95b14196f284 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -44,6 +44,7 @@ struct proc_dir_entry {
         struct completion *pde_unload_completion;
         const struct inode_operations *proc_iops;
         const struct file_operations *proc_fops;
+        const struct dentry_operations *proc_dops;
         union {
                 const struct seq_operations *seq_ops;
                 int (*single_show)(struct seq_file *, void *);
diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
index d5e0fcb3439e..a7b12435519e 100644
--- a/fs/proc/proc_net.c
+++ b/fs/proc/proc_net.c
@@ -38,6 +38,22 @@ static struct net *get_proc_net(const struct inode *inode)
         return maybe_get_net(PDE_NET(PDE(inode)));
 }
 
+static int proc_net_d_revalidate(struct dentry *dentry, unsigned int flags)
+{
+        return 0;
+}
+
+static const struct dentry_operations proc_net_dentry_ops = {
+        .d_revalidate   = proc_net_d_revalidate,
+        .d_delete       = always_delete_dentry,
+};
+
+static void pde_force_lookup(struct proc_dir_entry *pde)
+{
+        /* /proc/net/ entries can be changed under us by setns(CLONE_NEWNET) */
+        pde->proc_dops = &proc_net_dentry_ops;
+}
+
 static int seq_open_net(struct inode *inode, struct file *file)
 {
         unsigned int state_size = PDE(inode)->state_size;
@@ -90,6 +106,7 @@ struct proc_dir_entry *proc_create_net_data(const char *name, umode_t mode,
         p = proc_create_reg(name, mode, &parent, data);
         if (!p)
                 return NULL;
+        pde_force_lookup(p);
         p->proc_fops = &proc_net_seq_fops;
         p->seq_ops = ops;
         p->state_size = state_size;
@@ -133,6 +150,7 @@ struct proc_dir_entry *proc_create_net_data_write(const char *name, umode_t mode
         p = proc_create_reg(name, mode, &parent, data);
         if (!p)
                 return NULL;
+        pde_force_lookup(p);
         p->proc_fops = &proc_net_seq_fops;
         p->seq_ops = ops;
         p->state_size = state_size;
@@ -181,6 +199,7 @@ struct proc_dir_entry *proc_create_net_single(const char *name, umode_t mode,
         p = proc_create_reg(name, mode, &parent, data);
         if (!p)
                 return NULL;
+        pde_force_lookup(p);
         p->proc_fops = &proc_net_single_fops;
         p->single_show = show;
         return proc_register(parent, p);
@@ -223,6 +242,7 @@ struct proc_dir_entry *proc_create_net_single_write(const char *name, umode_t mo
         p = proc_create_reg(name, mode, &parent, data);
         if (!p)
                 return NULL;
+        pde_force_lookup(p);
         p->proc_fops = &proc_net_single_fops;
         p->single_show = show;
         p->write = write;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index f0ec9edab2f3..85b0ef890b28 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -423,7 +423,7 @@ struct mem_size_stats {
 };
 
 static void smaps_account(struct mem_size_stats *mss, struct page *page,
-                bool compound, bool young, bool dirty)
+                bool compound, bool young, bool dirty, bool locked)
 {
         int i, nr = compound ? 1 << compound_order(page) : 1;
         unsigned long size = nr * PAGE_SIZE;
@@ -450,24 +450,31 @@ static void smaps_account(struct mem_size_stats *mss, struct page *page,
                 else
                         mss->private_clean += size;
                 mss->pss += (u64)size << PSS_SHIFT;
+                if (locked)
+                        mss->pss_locked += (u64)size << PSS_SHIFT;
                 return;
         }
 
         for (i = 0; i < nr; i++, page++) {
                 int mapcount = page_mapcount(page);
+                unsigned long pss = (PAGE_SIZE << PSS_SHIFT);
 
                 if (mapcount >= 2) {
                         if (dirty || PageDirty(page))
                                 mss->shared_dirty += PAGE_SIZE;
                         else
                                 mss->shared_clean += PAGE_SIZE;
-                        mss->pss += (PAGE_SIZE << PSS_SHIFT) / mapcount;
+                        mss->pss += pss / mapcount;
+                        if (locked)
+                                mss->pss_locked += pss / mapcount;
                 } else {
                         if (dirty || PageDirty(page))
                                 mss->private_dirty += PAGE_SIZE;
                         else
                                 mss->private_clean += PAGE_SIZE;
-                        mss->pss += PAGE_SIZE << PSS_SHIFT;
+                        mss->pss += pss;
+                        if (locked)
+                                mss->pss_locked += pss;
                 }
         }
 }
@@ -490,6 +497,7 @@ static void smaps_pte_entry(pte_t *pte, unsigned long addr,
 {
         struct mem_size_stats *mss = walk->private;
         struct vm_area_struct *vma = walk->vma;
+        bool locked = !!(vma->vm_flags & VM_LOCKED);
         struct page *page = NULL;
 
         if (pte_present(*pte)) {
@@ -532,7 +540,7 @@ static void smaps_pte_entry(pte_t *pte, unsigned long addr,
         if (!page)
                 return;
 
-        smaps_account(mss, page, false, pte_young(*pte), pte_dirty(*pte));
+        smaps_account(mss, page, false, pte_young(*pte), pte_dirty(*pte), locked);
 }
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
@@ -541,6 +549,7 @@ static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
 {
         struct mem_size_stats *mss = walk->private;
         struct vm_area_struct *vma = walk->vma;
+        bool locked = !!(vma->vm_flags & VM_LOCKED);
         struct page *page;
 
         /* FOLL_DUMP will return -EFAULT on huge zero page */
@@ -555,7 +564,7 @@ static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
                 /* pass */;
         else
                 VM_BUG_ON_PAGE(1, page);
-        smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd));
+        smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd), locked);
 }
 #else
 static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
@@ -737,11 +746,8 @@ static void smap_gather_stats(struct vm_area_struct *vma,
                 }
         }
 #endif
-
         /* mmap_sem is held in m_start */
         walk_page_vma(vma, &smaps_walk);
-        if (vma->vm_flags & VM_LOCKED)
-                mss->pss_locked += mss->pss;
 }
 
 #define SEQ_PUT_DEC(str, val) \
diff --git a/fs/xfs/scrub/repair.c b/fs/xfs/scrub/repair.c
index 1c8eecfe52b8..6acf1bfa0bfe 100644
--- a/fs/xfs/scrub/repair.c
+++ b/fs/xfs/scrub/repair.c
@@ -768,18 +768,23 @@ xrep_findroot_block(
                 if (!uuid_equal(&btblock->bb_u.s.bb_uuid,
                                 &mp->m_sb.sb_meta_uuid))
                         goto out;
+                /*
+                 * Read verifiers can reference b_ops, so we set the pointer
+                 * here.  If the verifier fails we'll reset the buffer state
+                 * to what it was before we touched the buffer.
+                 */
+                bp->b_ops = fab->buf_ops;
                 fab->buf_ops->verify_read(bp);
                 if (bp->b_error) {
+                        bp->b_ops = NULL;
                         bp->b_error = 0;
                         goto out;
                 }
 
                 /*
                  * Some read verifiers will (re)set b_ops, so we must be
-                 * careful not to blow away any such assignment.
+                 * careful not to change b_ops after running the verifier.
                  */
-                if (!bp->b_ops)
-                        bp->b_ops = fab->buf_ops;
         }
 
         /*
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 338b9d9984e0..d9048bcea49c 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -449,6 +449,7 @@ xfs_map_blocks(
         }
 
         wpc->imap = imap;
+        xfs_trim_extent_eof(&wpc->imap, ip);
         trace_xfs_map_blocks_found(ip, offset, count, wpc->io_type, &imap);
         return 0;
 allocate_blocks:
@@ -459,6 +460,7 @@ allocate_blocks:
         ASSERT(whichfork == XFS_COW_FORK || cow_fsb == NULLFILEOFF ||
                imap.br_startoff + imap.br_blockcount <= cow_fsb);
         wpc->imap = imap;
+        xfs_trim_extent_eof(&wpc->imap, ip);
         trace_xfs_map_blocks_alloc(ip, offset, count, wpc->io_type, &imap);
         return 0;
 }
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index eedc5e0156ff..4f5f2ff3f70f 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -776,10 +776,26 @@ _xfs_buf_read(
 }
 
 /*
+ * Set buffer ops on an unchecked buffer and validate it, if possible.
+ *
  * If the caller passed in an ops structure and the buffer doesn't have ops
  * assigned, set the ops and use them to verify the contents.  If the contents
  * cannot be verified, we'll clear XBF_DONE.  We assume the buffer has no
  * recorded errors and is already in XBF_DONE state.
+ *
+ * Under normal operations, every in-core buffer must have buffer ops assigned
+ * to them when the buffer is read in from disk so that we can validate the
+ * metadata.
+ *
+ * However, there are two scenarios where one can encounter in-core buffers
+ * that don't have buffer ops.  The first is during log recovery of buffers on
+ * a V4 filesystem, though these buffers are purged at the end of recovery.
+ *
+ * The other is online repair, which tries to match arbitrary metadata blocks
+ * with btree types in order to find the root.  If online repair doesn't match
+ * the buffer with /any/ btree type, the buffer remains in memory in DONE state
+ * with no ops, and a subsequent read_buf call from elsewhere will not set the
+ * ops.  This function helps us fix this situation.
  */
 int
 xfs_buf_ensure_ops(
@@ -1536,8 +1552,7 @@ __xfs_buf_submit(
                 xfs_buf_ioerror(bp, -EIO);
                 bp->b_flags &= ~XBF_DONE;
                 xfs_buf_stale(bp);
-                if (bp->b_flags & XBF_ASYNC)
-                        xfs_buf_ioend(bp);
+                xfs_buf_ioend(bp);
                 return -EIO;
         }
 
diff --git a/include/uapi/asm-generic/shmparam.h b/include/asm-generic/shmparam.h
index 8b78c0ba08b1..8b78c0ba08b1 100644
--- a/include/uapi/asm-generic/shmparam.h
+++ b/include/asm-generic/shmparam.h
diff --git a/include/dt-bindings/clock/imx8mq-clock.h b/include/dt-bindings/clock/imx8mq-clock.h
index b53be41929be..04f7ac345984 100644
--- a/include/dt-bindings/clock/imx8mq-clock.h
+++ b/include/dt-bindings/clock/imx8mq-clock.h
@@ -350,7 +350,7 @@
 #define IMX8MQ_CLK_VPU_G2_ROOT                  241
 
 /* SCCG PLL GATE */
-#define IMX8MQ_SYS1_PLL_OUT                     232
+#define IMX8MQ_SYS1_PLL_OUT                     242
 #define IMX8MQ_SYS2_PLL_OUT                     243
 #define IMX8MQ_SYS3_PLL_OUT                     244
 #define IMX8MQ_DRAM_PLL_OUT                     245
@@ -372,24 +372,24 @@
 /* txesc clock */
 #define IMX8MQ_CLK_DSI_IPG_DIV                  256
 
-#define IMX8MQ_CLK_TMU_ROOT                     265
+#define IMX8MQ_CLK_TMU_ROOT                     257
 
 /* Display root clocks */
-#define IMX8MQ_CLK_DISP_AXI_ROOT                266
-#define IMX8MQ_CLK_DISP_APB_ROOT                267
-#define IMX8MQ_CLK_DISP_RTRM_ROOT               268
+#define IMX8MQ_CLK_DISP_AXI_ROOT                258
+#define IMX8MQ_CLK_DISP_APB_ROOT                259
+#define IMX8MQ_CLK_DISP_RTRM_ROOT               260
 
-#define IMX8MQ_CLK_OCOTP_ROOT                   269
+#define IMX8MQ_CLK_OCOTP_ROOT                   261
 
-#define IMX8MQ_CLK_DRAM_ALT_ROOT                270
-#define IMX8MQ_CLK_DRAM_CORE                    271
+#define IMX8MQ_CLK_DRAM_ALT_ROOT                262
+#define IMX8MQ_CLK_DRAM_CORE                    263
 
-#define IMX8MQ_CLK_MU_ROOT                      272
-#define IMX8MQ_VIDEO2_PLL_OUT                   273
+#define IMX8MQ_CLK_MU_ROOT                      264
+#define IMX8MQ_VIDEO2_PLL_OUT                   265
 
-#define IMX8MQ_CLK_CLKO2                        274
+#define IMX8MQ_CLK_CLKO2                        266
 
-#define IMX8MQ_CLK_NAND_USDHC_BUS_RAWNAND_CLK   275
+#define IMX8MQ_CLK_NAND_USDHC_BUS_RAWNAND_CLK   267
 
-#define IMX8MQ_CLK_END                          276
+#define IMX8MQ_CLK_END                          268
 #endif /* __DT_BINDINGS_CLOCK_IMX8MQ_H */
diff --git a/include/dt-bindings/clock/marvell,mmp2.h b/include/dt-bindings/clock/marvell,mmp2.h
index 7b24fc791146..228a5e234af0 100644
--- a/include/dt-bindings/clock/marvell,mmp2.h
+++ b/include/dt-bindings/clock/marvell,mmp2.h
@@ -71,7 +71,6 @@
 #define MMP2_CLK_CCIC1_MIX              117
 #define MMP2_CLK_CCIC1_PHY              118
 #define MMP2_CLK_CCIC1_SPHY             119
-#define MMP2_CLK_SP                     120
 
 #define MMP2_NR_CLKS                    200
 #endif
diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index 218df7f4d3e1..5041357d0297 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -180,12 +180,10 @@ enum cpuhp_smt_control {
 #if defined(CONFIG_SMP) && defined(CONFIG_HOTPLUG_SMT)
 extern enum cpuhp_smt_control cpu_smt_control;
 extern void cpu_smt_disable(bool force);
-extern void cpu_smt_check_topology_early(void);
 extern void cpu_smt_check_topology(void);
 #else
 # define cpu_smt_control                (CPU_SMT_ENABLED)
 static inline void cpu_smt_disable(bool force) { }
-static inline void cpu_smt_check_topology_early(void) { }
 static inline void cpu_smt_check_topology(void) { }
 #endif
 
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index ef4b70f64f33..60996e64c579 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -62,9 +62,10 @@ extern const struct qstr slash_name;
 struct dentry_stat_t {
         long nr_dentry;
         long nr_unused;
-        long age_limit;          /* age in seconds */
-        long want_pages;         /* pages requested by system */
-        long dummy[2];
+        long age_limit;         /* age in seconds */
+        long want_pages;        /* pages requested by system */
+        long nr_negative;       /* # of unused negative dentries */
+        long dummy;             /* Reserved for future use */
 };
 extern struct dentry_stat_t dentry_stat;
 
diff --git a/include/linux/filter.h b/include/linux/filter.h
index ad106d845b22..e532fcc6e4b5 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -591,8 +591,8 @@ static inline u8 *bpf_skb_cb(struct sk_buff *skb)
         return qdisc_skb_cb(skb)->data;
 }
 
-static inline u32 bpf_prog_run_save_cb(const struct bpf_prog *prog,
-                                       struct sk_buff *skb)
+static inline u32 __bpf_prog_run_save_cb(const struct bpf_prog *prog,
+                                         struct sk_buff *skb)
 {
         u8 *cb_data = bpf_skb_cb(skb);
         u8 cb_saved[BPF_SKB_CB_LEN];
@@ -611,15 +611,30 @@ static inline u32 bpf_prog_run_save_cb(const struct bpf_prog *prog,
         return res;
 }
 
+static inline u32 bpf_prog_run_save_cb(const struct bpf_prog *prog,
+                                       struct sk_buff *skb)
+{
+        u32 res;
+
+        preempt_disable();
+        res = __bpf_prog_run_save_cb(prog, skb);
+        preempt_enable();
+        return res;
+}
+
 static inline u32 bpf_prog_run_clear_cb(const struct bpf_prog *prog,
                                         struct sk_buff *skb)
 {
         u8 *cb_data = bpf_skb_cb(skb);
+        u32 res;
 
         if (unlikely(prog->cb_access))
                 memset(cb_data, 0, BPF_SKB_CB_LEN);
 
-        return BPF_PROG_RUN(prog, skb);
+        preempt_disable();
+        res = BPF_PROG_RUN(prog, skb);
+        preempt_enable();
+        return res;
 }
 
 static __always_inline u32 bpf_prog_run_xdp(const struct bpf_prog *prog,
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 811c77743dad..29d8e2cfed0e 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1479,11 +1479,12 @@ struct super_block {
         struct user_namespace *s_user_ns;
 
         /*
-         * Keep the lru lists last in the structure so they always sit on their
-         * own individual cachelines.
+         * The list_lru structure is essentially just a pointer to a table
+         * of per-node lru lists, each of which has its own spinlock.
+         * There is no need to put them into separate cachelines.
          */
-        struct list_lru         s_dentry_lru ____cacheline_aligned_in_smp;
-        struct list_lru         s_inode_lru ____cacheline_aligned_in_smp;
+        struct list_lru         s_dentry_lru;
+        struct list_lru         s_inode_lru;
         struct rcu_head         rcu;
         struct work_struct      destroy_work;
 
diff --git a/include/linux/hid-debug.h b/include/linux/hid-debug.h
index 8663f216c563..2d6100edf204 100644
--- a/include/linux/hid-debug.h
+++ b/include/linux/hid-debug.h
@@ -24,7 +24,10 @@
 
 #ifdef CONFIG_DEBUG_FS
 
+#include <linux/kfifo.h>
+
 #define HID_DEBUG_BUFSIZE 512
+#define HID_DEBUG_FIFOSIZE 512
 
 void hid_dump_input(struct hid_device *, struct hid_usage *, __s32);
 void hid_dump_report(struct hid_device *, int , u8 *, int);
@@ -37,11 +40,8 @@ void hid_debug_init(void);
 void hid_debug_exit(void);
 void hid_debug_event(struct hid_device *, char *);
 
-
 struct hid_debug_list {
-        char *hid_debug_buf;
-        int head;
-        int tail;
+        DECLARE_KFIFO_PTR(hid_debug_fifo, char);
         struct fasync_struct *fasync;
         struct hid_device *hdev;
         struct list_head node;
@@ -64,4 +64,3 @@ struct hid_debug_list {
 #endif
 
 #endif
-
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index 071b4cbdf010..c848a7cc502e 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -319,7 +319,7 @@
 #define GITS_TYPER_PLPIS                (1UL << 0)
 #define GITS_TYPER_VLPIS                (1UL << 1)
 #define GITS_TYPER_ITT_ENTRY_SIZE_SHIFT 4
-#define GITS_TYPER_ITT_ENTRY_SIZE(r)    ((((r) >> GITS_TYPER_ITT_ENTRY_SIZE_SHIFT) & 0x1f) + 1)
+#define GITS_TYPER_ITT_ENTRY_SIZE(r)    ((((r) >> GITS_TYPER_ITT_ENTRY_SIZE_SHIFT) & 0xf) + 1)
 #define GITS_TYPER_IDBITS_SHIFT         8
 #define GITS_TYPER_DEVBITS_SHIFT        13
 #define GITS_TYPER_DEVBITS(r)           ((((r) >> GITS_TYPER_DEVBITS_SHIFT) & 0x1f) + 1)
diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index 07da5c6c5ba0..368267c1b71b 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -21,14 +21,16 @@ struct vmem_altmap;
  * walkers which rely on the fully initialized page->flags and others
  * should use this rather than pfn_valid && pfn_to_page
  */
-#define pfn_to_online_page(pfn)                         \
-({                                                      \
-        struct page *___page = NULL;                    \
-        unsigned long ___nr = pfn_to_section_nr(pfn);   \
-                                                        \
-        if (___nr < NR_MEM_SECTIONS && online_section_nr(___nr))\
-                ___page = pfn_to_page(pfn);             \
-        ___page;                                        \
+#define pfn_to_online_page(pfn)                                    \
+({                                                                 \
+        struct page *___page = NULL;                               \
+        unsigned long ___pfn = pfn;                                \
+        unsigned long ___nr = pfn_to_section_nr(___pfn);           \
+                                                                   \
+        if (___nr < NR_MEM_SECTIONS && online_section_nr(___nr) && \
+            pfn_valid_within(___pfn))                              \
+                ___page = pfn_to_page(___pfn);                     \
+        ___page;                                                   \
 })
 
 /*
diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
index de7377815b6b..8ef330027b13 100644
--- a/include/linux/mmc/card.h
+++ b/include/linux/mmc/card.h
@@ -308,6 +308,7 @@ struct mmc_card {
         unsigned int    nr_parts;
 
         unsigned int            bouncesz;       /* Bounce buffer size */
+        struct workqueue_struct *complete_wq;   /* Private workqueue */
 };
 
 static inline bool mmc_large_sector(struct mmc_card *card)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 1377d085ef99..86dbb3e29139 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1483,6 +1483,7 @@ struct net_device_ops {
  * @IFF_NO_RX_HANDLER: device doesn't support the rx_handler hook
  * @IFF_FAILOVER: device is a failover master device
  * @IFF_FAILOVER_SLAVE: device is lower dev of a failover master device
+ * @IFF_L3MDEV_RX_HANDLER: only invoke the rx handler of L3 master device
  */
 enum netdev_priv_flags {
         IFF_802_1Q_VLAN                 = 1<<0,
@@ -1514,6 +1515,7 @@ enum netdev_priv_flags {
         IFF_NO_RX_HANDLER               = 1<<26,
         IFF_FAILOVER                    = 1<<27,
         IFF_FAILOVER_SLAVE              = 1<<28,
+        IFF_L3MDEV_RX_HANDLER           = 1<<29,
 };
 
 #define IFF_802_1Q_VLAN                 IFF_802_1Q_VLAN
@@ -1544,6 +1546,7 @@ enum netdev_priv_flags {
 #define IFF_NO_RX_HANDLER               IFF_NO_RX_HANDLER
 #define IFF_FAILOVER                    IFF_FAILOVER
 #define IFF_FAILOVER_SLAVE              IFF_FAILOVER_SLAVE
+#define IFF_L3MDEV_RX_HANDLER           IFF_L3MDEV_RX_HANDLER
 
 /**
  *      struct net_device - The DEVICE structure.
@@ -4549,6 +4552,11 @@ static inline bool netif_supports_nofcs(struct net_device *dev)
         return dev->priv_flags & IFF_SUPP_NOFCS;
 }
 
+static inline bool netif_has_l3_rx_handler(const struct net_device *dev)
+{
+        return dev->priv_flags & IFF_L3MDEV_RX_HANDLER;
+}
+
 static inline bool netif_is_l3_master(const struct net_device *dev)
 {
         return dev->priv_flags & IFF_L3MDEV_MASTER;
diff --git a/include/linux/phy.h b/include/linux/phy.h
index ef20aeea10cc..127fcc9c3778 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -674,26 +674,13 @@ phy_lookup_setting(int speed, int duplex, const unsigned long *mask,
 size_t phy_speeds(unsigned int *speeds, size_t size,
                   unsigned long *mask);
 
-static inline bool __phy_is_started(struct phy_device *phydev)
-{
-        WARN_ON(!mutex_is_locked(&phydev->lock));
-
-        return phydev->state >= PHY_UP;
-}
-
 /**
  * phy_is_started - Convenience function to check whether PHY is started
  * @phydev: The phy_device struct
  */
 static inline bool phy_is_started(struct phy_device *phydev)
 {
-        bool started;
-
-        mutex_lock(&phydev->lock);
-        started = __phy_is_started(phydev);
-        mutex_unlock(&phydev->lock);
-
-        return started;
+        return phydev->state >= PHY_UP;
 }
 
 void phy_resolve_aneg_linkmode(struct phy_device *phydev);
diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
index 54af4eef169f..fed5be706bc9 100644
--- a/include/linux/pm_runtime.h
+++ b/include/linux/pm_runtime.h
@@ -105,7 +105,7 @@ static inline bool pm_runtime_callbacks_present(struct device *dev)
 
 static inline void pm_runtime_mark_last_busy(struct device *dev)
 {
-        WRITE_ONCE(dev->power.last_busy, ktime_to_ns(ktime_get()));
+        WRITE_ONCE(dev->power.last_busy, ktime_get_mono_fast_ns());
 }
 
 static inline bool pm_runtime_is_irq_safe(struct device *dev)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index d2f90fa92468..bba3afb4e9bf 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -995,7 +995,7 @@ struct task_struct {
         /* cg_list protected by css_set_lock and tsk->alloc_lock: */
         struct list_head                cg_list;
 #endif
-#ifdef CONFIG_X86_RESCTRL
+#ifdef CONFIG_X86_CPU_RESCTRL
         u32                             closid;
         u32                             rmid;
 #endif
diff --git a/include/linux/sched/coredump.h b/include/linux/sched/coredump.h
index ec912d01126f..ecdc6542070f 100644
--- a/include/linux/sched/coredump.h
+++ b/include/linux/sched/coredump.h
@@ -71,6 +71,7 @@ static inline int get_dumpable(struct mm_struct *mm)
 #define MMF_HUGE_ZERO_PAGE      23      /* mm has ever used the global huge zero page */
 #define MMF_DISABLE_THP         24      /* disable THP for all VMAs */
 #define MMF_OOM_VICTIM          25      /* mm is the oom victim */
+#define MMF_OOM_REAP_QUEUED     26      /* mm was queued for oom_reaper */
 #define MMF_DISABLE_THP_MASK    (1 << MMF_DISABLE_THP)
 
 #define MMF_INIT_MASK           (MMF_DUMPABLE_MASK | MMF_DUMP_FILTER_MASK |\
diff --git a/include/linux/signal.h b/include/linux/signal.h
index cc7e2c1cd444..9702016734b1 100644
--- a/include/linux/signal.h
+++ b/include/linux/signal.h
@@ -392,7 +392,7 @@ extern bool unhandled_signal(struct task_struct *tsk, int sig);
 #endif
 
 #define siginmask(sig, mask) \
-        ((sig) < SIGRTMIN && (rt_sigmask(sig) & (mask)))
+        ((sig) > 0 && (sig) < SIGRTMIN && (rt_sigmask(sig) & (mask)))
 
 #define SIG_KERNEL_ONLY_MASK (\
         rt_sigmask(SIGKILL)   |  rt_sigmask(SIGSTOP))
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
index 7ddfc65586b0..4335bd771ce5 100644
--- a/include/linux/stmmac.h
+++ b/include/linux/stmmac.h
@@ -184,6 +184,7 @@ struct plat_stmmacenet_data {
         struct clk *pclk;
         struct clk *clk_ptp_ref;
         unsigned int clk_ptp_rate;
+        unsigned int clk_ref_rate;
         struct reset_control *stmmac_rst;
         struct stmmac_axi *axi;
         int has_gmac4;
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 00b5e7825508..74ff688568a0 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -39,6 +39,7 @@ struct inet_peer {
 
         u32                     metrics[RTAX_MAX];
         u32                     rate_tokens;    /* rate limiting for ICMP */
+        u32                     n_redirects;
         unsigned long           rate_last;
         /*
          * Once inet_peer is queued for deletion (refcnt == 0), following field
diff --git a/include/net/l3mdev.h b/include/net/l3mdev.h
index 78fa0ac4613c..5175fd63cd82 100644
--- a/include/net/l3mdev.h
+++ b/include/net/l3mdev.h
@@ -153,7 +153,8 @@ struct sk_buff *l3mdev_l3_rcv(struct sk_buff *skb, u16 proto)
 
         if (netif_is_l3_slave(skb->dev))
                 master = netdev_master_upper_dev_get_rcu(skb->dev);
-        else if (netif_is_l3_master(skb->dev))
+        else if (netif_is_l3_master(skb->dev) ||
+                 netif_has_l3_rx_handler(skb->dev))
                 master = skb->dev;
 
         if (master && master->l3mdev_ops->l3mdev_l3_rcv)
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 841835a387e1..b4984bbbe157 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -469,9 +469,7 @@ struct nft_set_binding {
 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
                        struct nft_set_binding *binding);
 void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
-                          struct nft_set_binding *binding);
-void nf_tables_rebind_set(const struct nft_ctx *ctx, struct nft_set *set,
-                          struct nft_set_binding *binding);
+                          struct nft_set_binding *binding, bool commit);
 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set);
 
 /**
@@ -721,6 +719,13 @@ struct nft_expr_type {
 #define NFT_EXPR_STATEFUL               0x1
 #define NFT_EXPR_GC                     0x2
 
+enum nft_trans_phase {
+        NFT_TRANS_PREPARE,
+        NFT_TRANS_ABORT,
+        NFT_TRANS_COMMIT,
+        NFT_TRANS_RELEASE
+};
+
 /**
  *      struct nft_expr_ops - nf_tables expression operations
  *
@@ -750,7 +755,8 @@ struct nft_expr_ops {
         void                            (*activate)(const struct nft_ctx *ctx,
                                                     const struct nft_expr *expr);
         void                            (*deactivate)(const struct nft_ctx *ctx,
-                                                      const struct nft_expr *expr);
+                                                      const struct nft_expr *expr,
+                                                      enum nft_trans_phase phase);
         void                            (*destroy)(const struct nft_ctx *ctx,
                                                    const struct nft_expr *expr);
         void                            (*destroy_clone)(const struct nft_ctx *ctx,
@@ -1323,12 +1329,15 @@ struct nft_trans_rule {
 struct nft_trans_set {
         struct nft_set                  *set;
         u32                             set_id;
+        bool                            bound;
 };
 
 #define nft_trans_set(trans)    \
         (((struct nft_trans_set *)trans->data)->set)
 #define nft_trans_set_id(trans) \
         (((struct nft_trans_set *)trans->data)->set_id)
+#define nft_trans_set_bound(trans)      \
+        (((struct nft_trans_set *)trans->data)->bound)
 
 struct nft_trans_chain {
         bool                            update;
diff --git a/include/net/sock.h b/include/net/sock.h
index 2b229f7be8eb..f43f935cb113 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1277,7 +1277,7 @@ static inline void sk_sockets_allocated_inc(struct sock *sk)
         percpu_counter_inc(sk->sk_prot->sockets_allocated);
 }
 
-static inline int
+static inline u64
 sk_sockets_allocated_read_positive(struct sock *sk)
 {
         return percpu_counter_read_positive(sk->sk_prot->sockets_allocated);
diff --git a/include/net/tls.h b/include/net/tls.h
index 2a6ac8d642af..1486b60c4de8 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -120,6 +120,8 @@ struct tls_rec {
         struct scatterlist sg_aead_out[2];
 
         char aad_space[TLS_AAD_SPACE_SIZE];
+        u8 iv_data[TLS_CIPHER_AES_GCM_128_IV_SIZE +
+                   TLS_CIPHER_AES_GCM_128_SALT_SIZE];
         struct aead_request aead_req;
         u8 aead_req_ctx[];
 };
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index a3ceed3a040a..80debf5982ac 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -2579,9 +2579,10 @@ struct ib_device {
 
         const struct uapi_definition   *driver_def;
         enum rdma_driver_id             driver_id;
+
         /*
-         * Provides synchronization between device unregistration and netlink
-         * commands on a device. To be used only by core.
+         * Positive refcount indicates that the device is currently
+         * registered and cannot be unregistered.
          */
         refcount_t refcount;
         struct completion unreg_completion;
@@ -3926,6 +3927,25 @@ static inline bool ib_access_writable(int access_flags)
 int ib_check_mr_status(struct ib_mr *mr, u32 check_mask,
                        struct ib_mr_status *mr_status);
 
+/**
+ * ib_device_try_get: Hold a registration lock
+ * device: The device to lock
+ *
+ * A device under an active registration lock cannot become unregistered. It
+ * is only possible to obtain a registration lock on a device that is fully
+ * registered, otherwise this function returns false.
+ *
+ * The registration lock is only necessary for actions which require the
+ * device to still be registered. Uses that only require the device pointer to
+ * be valid should use get_device(&ibdev->dev) to hold the memory.
+ *
+ */
+static inline bool ib_device_try_get(struct ib_device *dev)
+{
+        return refcount_inc_not_zero(&dev->refcount);
+}
+
+void ib_device_put(struct ib_device *device);
 struct net_device *ib_get_net_dev_by_params(struct ib_device *dev, u8 port,
                                             u16 pkey, const union ib_gid *gid,
                                             const struct sockaddr *addr);
diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h
index 0cdc3999ecfa..c5188ff724d1 100644
--- a/include/sound/compress_driver.h
+++ b/include/sound/compress_driver.h
@@ -173,7 +173,11 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream)
         if (snd_BUG_ON(!stream))
                 return;
 
-        stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+        if (stream->direction == SND_COMPRESS_PLAYBACK)
+                stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+        else
+                stream->runtime->state = SNDRV_PCM_STATE_PREPARED;
+
         wake_up(&stream->runtime->sleep);
 }
 
diff --git a/include/sound/hda_codec.h b/include/sound/hda_codec.h
index 7fa48b100936..cc7c8d42d4fd 100644
--- a/include/sound/hda_codec.h
+++ b/include/sound/hda_codec.h
@@ -68,6 +68,7 @@ struct hda_bus {
         unsigned int response_reset:1;  /* controller was reset */
         unsigned int in_reset:1;        /* during reset operation */
         unsigned int no_response_fallback:1; /* don't fallback at RIRB error */
+        unsigned int bus_probing :1;    /* during probing process */
 
         int primary_dig_out_type;       /* primary digital out PCM type */
         unsigned int mixer_assigned;    /* codec addr for mixer name */
diff --git a/include/uapi/linux/inet_diag.h b/include/uapi/linux/inet_diag.h
index 14565d703291..e8baca85bac6 100644
--- a/include/uapi/linux/inet_diag.h
+++ b/include/uapi/linux/inet_diag.h
@@ -137,15 +137,21 @@ enum {
         INET_DIAG_TCLASS,
         INET_DIAG_SKMEMINFO,
         INET_DIAG_SHUTDOWN,
-        INET_DIAG_DCTCPINFO,
-        INET_DIAG_PROTOCOL,  /* response attribute only */
+
+        /*
+         * Next extenstions cannot be requested in struct inet_diag_req_v2:
+         * its field idiag_ext has only 8 bits.
+         */
+
+        INET_DIAG_DCTCPINFO,    /* request as INET_DIAG_VEGASINFO */
+        INET_DIAG_PROTOCOL,     /* response attribute only */
         INET_DIAG_SKV6ONLY,
         INET_DIAG_LOCALS,
         INET_DIAG_PEERS,
         INET_DIAG_PAD,
-        INET_DIAG_MARK,
-        INET_DIAG_BBRINFO,
-        INET_DIAG_CLASS_ID,
+        INET_DIAG_MARK,         /* only with CAP_NET_ADMIN */
+        INET_DIAG_BBRINFO,      /* request as INET_DIAG_VEGASINFO */
+        INET_DIAG_CLASS_ID,     /* request as INET_DIAG_TCLASS */
         INET_DIAG_MD5SIG,
         __INET_DIAG_MAX,
 };
diff --git a/include/uapi/linux/virtio_config.h b/include/uapi/linux/virtio_config.h
index 1196e1c1d4f6..ff8e7dc9d4dd 100644
--- a/include/uapi/linux/virtio_config.h
+++ b/include/uapi/linux/virtio_config.h
@@ -79,6 +79,12 @@
 #define VIRTIO_F_RING_PACKED            34
 
 /*
+ * This feature indicates that memory accesses by the driver and the
+ * device are ordered in a way described by the platform.
+ */
+#define VIRTIO_F_ORDER_PLATFORM         36
+
+/*
  * Does the device support Single Root I/O Virtualization?
  */
 #define VIRTIO_F_SR_IOV                 37
diff --git a/include/uapi/linux/virtio_ring.h b/include/uapi/linux/virtio_ring.h
index 2414f8af26b3..4c4e24c291a5 100644
--- a/include/uapi/linux/virtio_ring.h
+++ b/include/uapi/linux/virtio_ring.h
@@ -213,14 +213,4 @@ struct vring_packed_desc {
         __le16 flags;
 };
 
-struct vring_packed {
-        unsigned int num;
-
-        struct vring_packed_desc *desc;
-
-        struct vring_packed_desc_event *driver;
-
-        struct vring_packed_desc_event *device;
-};
-
 #endif /* _UAPI_LINUX_VIRTIO_RING_H */
diff --git a/include/uapi/rdma/hns-abi.h b/include/uapi/rdma/hns-abi.h
index ef3c7ec793a7..eb76b38a00d4 100644
--- a/include/uapi/rdma/hns-abi.h
+++ b/include/uapi/rdma/hns-abi.h
@@ -52,6 +52,11 @@ struct hns_roce_ib_create_srq {
         __aligned_u64 que_addr;
 };
 
+struct hns_roce_ib_create_srq_resp {
+        __u32   srqn;
+        __u32   reserved;
+};
+
 struct hns_roce_ib_create_qp {
         __aligned_u64 buf_addr;
         __aligned_u64 db_addr;
diff --git a/init/Kconfig b/init/Kconfig
index 513fa544a134..c9386a365eea 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -512,6 +512,17 @@ config PSI_DEFAULT_DISABLED
           per default but can be enabled through passing psi=1 on the
           kernel commandline during boot.
 
+          This feature adds some code to the task wakeup and sleep
+          paths of the scheduler. The overhead is too low to affect
+          common scheduling-intense workloads in practice (such as
+          webservers, memcache), but it does show up in artificial
+          scheduler stress tests, such as hackbench.
+
+          If you are paranoid and not sure what the kernel will be
+          used for, say Y.
+
+          Say N if unsure.
+
 endmenu # "CPU/Task time and stats accounting"
 
 config CPU_ISOLATION
@@ -825,7 +836,7 @@ config CGROUP_PIDS
           PIDs controller is designed to stop this from happening.
 
           It should be noted that organisational operations (such as attaching
-          to a cgroup hierarchy will *not* be blocked by the PIDs controller),
+          to a cgroup hierarchy) will *not* be blocked by the PIDs controller,
           since the PIDs limit only affects a process's ability to fork, not to
           attach to a cgroup.
 
diff --git a/init/main.c b/init/main.c
index e2e80ca3165a..c86a1c8f19f4 100644
--- a/init/main.c
+++ b/init/main.c
@@ -695,7 +695,6 @@ asmlinkage __visible void __init start_kernel(void)
                 initrd_start = 0;
         }
 #endif
-        page_ext_init();
         kmemleak_init();
         setup_per_cpu_pageset();
         numa_policy_init();
@@ -1131,6 +1130,8 @@ static noinline void __init kernel_init_freeable(void)
         sched_init_smp();
 
         page_alloc_init_late();
+        /* Initialize page ext after all struct pages are initialized. */
+        page_ext_init();
 
         do_basic_setup();
 
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index befe570be5ba..c57bd10340ed 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -1459,7 +1459,8 @@ static int btf_modifier_resolve(struct btf_verifier_env *env,
 
                 /* "typedef void new_void", "const void"...etc */
                 if (!btf_type_is_void(next_type) &&
-                    !btf_type_is_fwd(next_type)) {
+                    !btf_type_is_fwd(next_type) &&
+                    !btf_type_is_func_proto(next_type)) {
                         btf_verifier_log_type(env, v->t, "Invalid type_id");
                         return -EINVAL;
                 }
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index ab612fe9862f..d17d05570a3f 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -572,7 +572,7 @@ int __cgroup_bpf_run_filter_skb(struct sock *sk,
         bpf_compute_and_save_data_end(skb, &saved_data_end);
 
         ret = BPF_PROG_RUN_ARRAY(cgrp->bpf.effective[type], skb,
-                                 bpf_prog_run_save_cb);
+                                 __bpf_prog_run_save_cb);
         bpf_restore_data_end(skb, saved_data_end);
         __skb_pull(skb, offset);
         skb->sk = save_sk;
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 4b7c76765d9d..f9274114c88d 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -686,7 +686,7 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
         }
 
         if (htab_is_prealloc(htab)) {
-                pcpu_freelist_push(&htab->freelist, &l->fnode);
+                __pcpu_freelist_push(&htab->freelist, &l->fnode);
         } else {
                 atomic_dec(&htab->count);
                 l->htab = htab;
@@ -748,7 +748,7 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
                 } else {
                         struct pcpu_freelist_node *l;
 
-                        l = pcpu_freelist_pop(&htab->freelist);
+                        l = __pcpu_freelist_pop(&htab->freelist);
                         if (!l)
                                 return ERR_PTR(-E2BIG);
                         l_new = container_of(l, struct htab_elem, fnode);
diff --git a/kernel/bpf/percpu_freelist.c b/kernel/bpf/percpu_freelist.c
index 673fa6fe2d73..0c1b4ba9e90e 100644
--- a/kernel/bpf/percpu_freelist.c
+++ b/kernel/bpf/percpu_freelist.c
@@ -28,8 +28,8 @@ void pcpu_freelist_destroy(struct pcpu_freelist *s)
         free_percpu(s->freelist);
 }
 
-static inline void __pcpu_freelist_push(struct pcpu_freelist_head *head,
-                                        struct pcpu_freelist_node *node)
+static inline void ___pcpu_freelist_push(struct pcpu_freelist_head *head,
+                                         struct pcpu_freelist_node *node)
 {
         raw_spin_lock(&head->lock);
         node->next = head->first;
@@ -37,12 +37,22 @@ static inline void __pcpu_freelist_push(struct pcpu_freelist_head *head,
         raw_spin_unlock(&head->lock);
 }
 
-void pcpu_freelist_push(struct pcpu_freelist *s,
+void __pcpu_freelist_push(struct pcpu_freelist *s,
                         struct pcpu_freelist_node *node)
 {
         struct pcpu_freelist_head *head = this_cpu_ptr(s->freelist);
 
-        __pcpu_freelist_push(head, node);
+        ___pcpu_freelist_push(head, node);
+}
+
+void pcpu_freelist_push(struct pcpu_freelist *s,
+                        struct pcpu_freelist_node *node)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+        __pcpu_freelist_push(s, node);
+        local_irq_restore(flags);
 }
 
 void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size,
@@ -63,7 +73,7 @@ void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size,
         for_each_possible_cpu(cpu) {
 again:
                 head = per_cpu_ptr(s->freelist, cpu);
-                __pcpu_freelist_push(head, buf);
+                ___pcpu_freelist_push(head, buf);
                 i++;
                 buf += elem_size;
                 if (i == nr_elems)
@@ -74,14 +84,12 @@ again:
         local_irq_restore(flags);
 }
 
-struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s)
+struct pcpu_freelist_node *__pcpu_freelist_pop(struct pcpu_freelist *s)
 {
         struct pcpu_freelist_head *head;
         struct pcpu_freelist_node *node;
-        unsigned long flags;
         int orig_cpu, cpu;
 
-        local_irq_save(flags);
         orig_cpu = cpu = raw_smp_processor_id();
         while (1) {
                 head = per_cpu_ptr(s->freelist, cpu);
@@ -89,16 +97,25 @@ struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s)
                 node = head->first;
                 if (node) {
                         head->first = node->next;
-                        raw_spin_unlock_irqrestore(&head->lock, flags);
+                        raw_spin_unlock(&head->lock);
                         return node;
                 }
                 raw_spin_unlock(&head->lock);
                 cpu = cpumask_next(cpu, cpu_possible_mask);
                 if (cpu >= nr_cpu_ids)
                         cpu = 0;
-                if (cpu == orig_cpu) {
-                        local_irq_restore(flags);
+                if (cpu == orig_cpu)
                         return NULL;
-                }
         }
 }
+
+struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s)
+{
+        struct pcpu_freelist_node *ret;
+        unsigned long flags;
+
+        local_irq_save(flags);
+        ret = __pcpu_freelist_pop(s);
+        local_irq_restore(flags);
+        return ret;
+}
diff --git a/kernel/bpf/percpu_freelist.h b/kernel/bpf/percpu_freelist.h
index 3049aae8ea1e..c3960118e617 100644
--- a/kernel/bpf/percpu_freelist.h
+++ b/kernel/bpf/percpu_freelist.h
@@ -22,8 +22,12 @@ struct pcpu_freelist_node {
         struct pcpu_freelist_node *next;
 };
 
+/* pcpu_freelist_* do spin_lock_irqsave. */
 void pcpu_freelist_push(struct pcpu_freelist *, struct pcpu_freelist_node *);
 struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *);
+/* __pcpu_freelist_* do spin_lock only. caller must disable irqs. */
+void __pcpu_freelist_push(struct pcpu_freelist *, struct pcpu_freelist_node *);
+struct pcpu_freelist_node *__pcpu_freelist_pop(struct pcpu_freelist *);
 void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size,
                             u32 nr_elems);
 int pcpu_freelist_init(struct pcpu_freelist *);
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index b155cd17c1bd..8577bb7f8be6 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -713,8 +713,13 @@ static int map_lookup_elem(union bpf_attr *attr)
 
         if (bpf_map_is_dev_bound(map)) {
                 err = bpf_map_offload_lookup_elem(map, key, value);
-        } else if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
-                   map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH) {
+                goto done;
+        }
+
+        preempt_disable();
+        this_cpu_inc(bpf_prog_active);
+        if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
+            map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH) {
                 err = bpf_percpu_hash_copy(map, key, value);
         } else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
                 err = bpf_percpu_array_copy(map, key, value);
@@ -744,7 +749,10 @@ static int map_lookup_elem(union bpf_attr *attr)
                 }
                 rcu_read_unlock();
         }
+        this_cpu_dec(bpf_prog_active);
+        preempt_enable();
 
+done:
         if (err)
                 goto free_value;
 
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 91d5c38eb7e5..d1c6d152da89 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -376,9 +376,6 @@ void __weak arch_smt_update(void) { }
 
 #ifdef CONFIG_HOTPLUG_SMT
 enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED;
-EXPORT_SYMBOL_GPL(cpu_smt_control);
-
-static bool cpu_smt_available __read_mostly;
 
 void __init cpu_smt_disable(bool force)
 {
@@ -397,25 +394,11 @@ void __init cpu_smt_disable(bool force)
 
 /*
  * The decision whether SMT is supported can only be done after the full
- * CPU identification. Called from architecture code before non boot CPUs
- * are brought up.
- */
-void __init cpu_smt_check_topology_early(void)
-{
-        if (!topology_smt_supported())
-                cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
-}
-
-/*
- * If SMT was disabled by BIOS, detect it here, after the CPUs have been
- * brought online. This ensures the smt/l1tf sysfs entries are consistent
- * with reality. cpu_smt_available is set to true during the bringup of non
- * boot CPUs when a SMT sibling is detected. Note, this may overwrite
- * cpu_smt_control's previous setting.
+ * CPU identification. Called from architecture code.
  */
 void __init cpu_smt_check_topology(void)
 {
-        if (!cpu_smt_available)
+        if (!topology_smt_supported())
                 cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
 }
 
@@ -428,18 +411,10 @@ early_param("nosmt", smt_cmdline_disable);
 
 static inline bool cpu_smt_allowed(unsigned int cpu)
 {
-        if (topology_is_primary_thread(cpu))
+        if (cpu_smt_control == CPU_SMT_ENABLED)
                 return true;
 
-        /*
-         * If the CPU is not a 'primary' thread and the booted_once bit is
-         * set then the processor has SMT support. Store this information
-         * for the late check of SMT support in cpu_smt_check_topology().
-         */
-        if (per_cpu(cpuhp_state, cpu).booted_once)
-                cpu_smt_available = true;
-
-        if (cpu_smt_control == CPU_SMT_ENABLED)
+        if (topology_is_primary_thread(cpu))
                 return true;
 
         /*
@@ -2090,10 +2065,8 @@ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
                  */
                 cpuhp_offline_cpu_device(cpu);
         }
-        if (!ret) {
+        if (!ret)
                 cpu_smt_control = ctrlval;
-                arch_smt_update();
-        }
         cpu_maps_update_done();
         return ret;
 }
@@ -2104,7 +2077,6 @@ static int cpuhp_smt_enable(void)
 
         cpu_maps_update_begin();
         cpu_smt_control = CPU_SMT_ENABLED;
-        arch_smt_update();
         for_each_present_cpu(cpu) {
                 /* Skip online CPUs and CPUs on offline nodes */
                 if (cpu_online(cpu) || !node_online(cpu_to_node(cpu)))
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 3cd13a30f732..e5ede6918050 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -436,18 +436,18 @@ int perf_proc_update_handler(struct ctl_table *table, int write,
                 void __user *buffer, size_t *lenp,
                 loff_t *ppos)
 {
-        int ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
-
-        if (ret || !write)
-                return ret;
-
+        int ret;
+        int perf_cpu = sysctl_perf_cpu_time_max_percent;
         /*
          * If throttling is disabled don't allow the write:
          */
-        if (sysctl_perf_cpu_time_max_percent == 100 ||
-            sysctl_perf_cpu_time_max_percent == 0)
+        if (write && (perf_cpu == 100 || perf_cpu == 0))
                 return -EINVAL;
 
+        ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+        if (ret || !write)
+                return ret;
+
         max_samples_per_tick = DIV_ROUND_UP(sysctl_perf_event_sample_rate, HZ);
         perf_sample_period_ns = NSEC_PER_SEC / sysctl_perf_event_sample_rate;
         update_perf_cpu_limits();
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 4a9937076331..309ef5a64af5 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -734,6 +734,9 @@ struct ring_buffer *rb_alloc(int nr_pages, long watermark, int cpu, int flags)
         size = sizeof(struct ring_buffer);
         size += nr_pages * sizeof(void *);
 
+        if (order_base_2(size) >= MAX_ORDER)
+                goto fail;
+
         rb = kzalloc(size, GFP_KERNEL);
         if (!rb)
                 goto fail;
diff --git a/kernel/exit.c b/kernel/exit.c
index 3fb7be001964..2639a30a8aa5 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -558,12 +558,14 @@ static struct task_struct *find_alive_thread(struct task_struct *p)
         return NULL;
 }
 
-static struct task_struct *find_child_reaper(struct task_struct *father)
+static struct task_struct *find_child_reaper(struct task_struct *father,
+                                                struct list_head *dead)
         __releases(&tasklist_lock)
         __acquires(&tasklist_lock)
 {
         struct pid_namespace *pid_ns = task_active_pid_ns(father);
         struct task_struct *reaper = pid_ns->child_reaper;
+        struct task_struct *p, *n;
 
         if (likely(reaper != father))
                 return reaper;
@@ -579,6 +581,12 @@ static struct task_struct *find_child_reaper(struct task_struct *father)
                 panic("Attempted to kill init! exitcode=0x%08x\n",
                         father->signal->group_exit_code ?: father->exit_code);
         }
+
+        list_for_each_entry_safe(p, n, dead, ptrace_entry) {
+                list_del_init(&p->ptrace_entry);
+                release_task(p);
+        }
+
         zap_pid_ns_processes(pid_ns);
         write_lock_irq(&tasklist_lock);
 
@@ -668,7 +676,7 @@ static void forget_original_parent(struct task_struct *father,
                 exit_ptrace(father, dead);
 
         /* Can drop and reacquire tasklist_lock */
-        reaper = find_child_reaper(father);
+        reaper = find_child_reaper(father, dead);
         if (list_empty(&father->children))
                 return;
 
diff --git a/kernel/futex.c b/kernel/futex.c
index fdd312da0992..a0514e01c3eb 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2221,11 +2221,11 @@ static inline struct futex_hash_bucket *queue_lock(struct futex_q *q)
          * decrement the counter at queue_unlock() when some error has
          * occurred and we don't end up adding the task to the list.
          */
-        hb_waiters_inc(hb);
+        hb_waiters_inc(hb); /* implies smp_mb(); (A) */
 
         q->lock_ptr = &hb->lock;
 
-        spin_lock(&hb->lock); /* implies smp_mb(); (A) */
+        spin_lock(&hb->lock);
         return hb;
 }
 
@@ -2861,35 +2861,39 @@ retry_private:
          * and BUG when futex_unlock_pi() interleaves with this.
          *
          * Therefore acquire wait_lock while holding hb->lock, but drop the
-         * latter before calling rt_mutex_start_proxy_lock(). This still fully
-         * serializes against futex_unlock_pi() as that does the exact same
-         * lock handoff sequence.
+         * latter before calling __rt_mutex_start_proxy_lock(). This
+         * interleaves with futex_unlock_pi() -- which does a similar lock
+         * handoff -- such that the latter can observe the futex_q::pi_state
+         * before __rt_mutex_start_proxy_lock() is done.
          */
         raw_spin_lock_irq(&q.pi_state->pi_mutex.wait_lock);
         spin_unlock(q.lock_ptr);
+        /*
+         * __rt_mutex_start_proxy_lock() unconditionally enqueues the @rt_waiter
+         * such that futex_unlock_pi() is guaranteed to observe the waiter when
+         * it sees the futex_q::pi_state.
+         */
         ret = __rt_mutex_start_proxy_lock(&q.pi_state->pi_mutex, &rt_waiter, current);
         raw_spin_unlock_irq(&q.pi_state->pi_mutex.wait_lock);
 
         if (ret) {
                 if (ret == 1)
                         ret = 0;
-
-                spin_lock(q.lock_ptr);
-                goto no_block;
+                goto cleanup;
         }
 
-
         if (unlikely(to))
                 hrtimer_start_expires(&to->timer, HRTIMER_MODE_ABS);
 
         ret = rt_mutex_wait_proxy_lock(&q.pi_state->pi_mutex, to, &rt_waiter);
 
+cleanup:
         spin_lock(q.lock_ptr);
         /*
-         * If we failed to acquire the lock (signal/timeout), we must
+         * If we failed to acquire the lock (deadlock/signal/timeout), we must
          * first acquire the hb->lock before removing the lock from the
-         * rt_mutex waitqueue, such that we can keep the hb and rt_mutex
-         * wait lists consistent.
+         * rt_mutex waitqueue, such that we can keep the hb and rt_mutex wait
+         * lists consistent.
          *
          * In particular; it is important that futex_unlock_pi() can not
          * observe this inconsistency.
@@ -3013,6 +3017,10 @@ retry:
                  * there is no point where we hold neither; and therefore
                  * wake_futex_pi() must observe a state consistent with what we
                  * observed.
+                 *
+                 * In particular; this forces __rt_mutex_start_proxy() to
+                 * complete such that we're guaranteed to observe the
+                 * rt_waiter. Also see the WARN in wake_futex_pi().
                  */
                 raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
                 spin_unlock(&hb->lock);
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 581edcc63c26..978d63a8261c 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1726,12 +1726,33 @@ void rt_mutex_proxy_unlock(struct rt_mutex *lock,
         rt_mutex_set_owner(lock, NULL);
 }
 
+/**
+ * __rt_mutex_start_proxy_lock() - Start lock acquisition for another task
+ * @lock:               the rt_mutex to take
+ * @waiter:             the pre-initialized rt_mutex_waiter
+ * @task:               the task to prepare
+ *
+ * Starts the rt_mutex acquire; it enqueues the @waiter and does deadlock
+ * detection. It does not wait, see rt_mutex_wait_proxy_lock() for that.
+ *
+ * NOTE: does _NOT_ remove the @waiter on failure; must either call
+ * rt_mutex_wait_proxy_lock() or rt_mutex_cleanup_proxy_lock() after this.
+ *
+ * Returns:
+ *  0 - task blocked on lock
+ *  1 - acquired the lock for task, caller should wake it up
+ * <0 - error
+ *
+ * Special API call for PI-futex support.
+ */
 int __rt_mutex_start_proxy_lock(struct rt_mutex *lock,
                               struct rt_mutex_waiter *waiter,
                               struct task_struct *task)
 {
         int ret;
 
+        lockdep_assert_held(&lock->wait_lock);
+
         if (try_to_take_rt_mutex(lock, task, NULL))
                 return 1;
 
@@ -1749,9 +1770,6 @@ int __rt_mutex_start_proxy_lock(struct rt_mutex *lock,
                 ret = 0;
         }
 
-        if (unlikely(ret))
-                remove_waiter(lock, waiter);
-
         debug_rt_mutex_print_deadlock(waiter);
 
         return ret;
@@ -1763,12 +1781,18 @@ int __rt_mutex_start_proxy_lock(struct rt_mutex *lock,
  * @waiter:             the pre-initialized rt_mutex_waiter
  * @task:               the task to prepare
  *
+ * Starts the rt_mutex acquire; it enqueues the @waiter and does deadlock
+ * detection. It does not wait, see rt_mutex_wait_proxy_lock() for that.
+ *
+ * NOTE: unlike __rt_mutex_start_proxy_lock this _DOES_ remove the @waiter
+ * on failure.
+ *
  * Returns:
  *  0 - task blocked on lock
  *  1 - acquired the lock for task, caller should wake it up
  * <0 - error
  *
- * Special API call for FUTEX_REQUEUE_PI support.
+ * Special API call for PI-futex support.
  */
 int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
                               struct rt_mutex_waiter *waiter,
@@ -1778,6 +1802,8 @@ int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
 
         raw_spin_lock_irq(&lock->wait_lock);
         ret = __rt_mutex_start_proxy_lock(lock, waiter, task);
+        if (unlikely(ret))
+                remove_waiter(lock, waiter);
         raw_spin_unlock_irq(&lock->wait_lock);
 
         return ret;
@@ -1845,7 +1871,8 @@ int rt_mutex_wait_proxy_lock(struct rt_mutex *lock,
  * @lock:               the rt_mutex we were woken on
  * @waiter:             the pre-initialized rt_mutex_waiter
  *
- * Attempt to clean up after a failed rt_mutex_wait_proxy_lock().
+ * Attempt to clean up after a failed __rt_mutex_start_proxy_lock() or
+ * rt_mutex_wait_proxy_lock().
  *
  * Unless we acquired the lock; we're still enqueued on the wait-list and can
  * in fact still be granted ownership until we're removed. Therefore we can
diff --git a/kernel/relay.c b/kernel/relay.c
index 04f248644e06..9e0f52375487 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -428,6 +428,8 @@ static struct dentry *relay_create_buf_file(struct rchan *chan,
         dentry = chan->cb->create_buf_file(tmpname, chan->parent,
                                            S_IRUSR, buf,
                                            &chan->is_global);
+        if (IS_ERR(dentry))
+                dentry = NULL;
 
         kfree(tmpname);
 
@@ -461,7 +463,7 @@ static struct rchan_buf *relay_open_buf(struct rchan *chan, unsigned int cpu)
                 dentry = chan->cb->create_buf_file(NULL, NULL,
                                                    S_IRUSR, buf,
                                                    &chan->is_global);
-                if (WARN_ON(dentry))
+                if (IS_ERR_OR_NULL(dentry))
                         goto free_buf;
         }
 
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 50aa2aba69bd..310d0637fe4b 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5980,6 +5980,7 @@ static inline int find_idlest_cpu(struct sched_domain *sd, struct task_struct *p
 
 #ifdef CONFIG_SCHED_SMT
 DEFINE_STATIC_KEY_FALSE(sched_smt_present);
+EXPORT_SYMBOL_GPL(sched_smt_present);
 
 static inline void set_idle_cores(int cpu, int val)
 {
diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
index fe24de3fbc93..c3484785b179 100644
--- a/kernel/sched/psi.c
+++ b/kernel/sched/psi.c
@@ -124,6 +124,7 @@
  * sampling of the aggregate task states would be.
  */
 
+#include "../workqueue_internal.h"
 #include <linux/sched/loadavg.h>
 #include <linux/seq_file.h>
 #include <linux/proc_fs.h>
@@ -480,9 +481,6 @@ static void psi_group_change(struct psi_group *group, int cpu,
                         groupc->tasks[t]++;
 
         write_seqcount_end(&groupc->seq);
-
-        if (!delayed_work_pending(&group->clock_work))
-                schedule_delayed_work(&group->clock_work, PSI_FREQ);
 }
 
 static struct psi_group *iterate_groups(struct task_struct *task, void **iter)
@@ -513,6 +511,7 @@ void psi_task_change(struct task_struct *task, int clear, int set)
 {
         int cpu = task_cpu(task);
         struct psi_group *group;
+        bool wake_clock = true;
         void *iter = NULL;
 
         if (!task->pid)
@@ -530,8 +529,22 @@ void psi_task_change(struct task_struct *task, int clear, int set)
         task->psi_flags &= ~clear;
         task->psi_flags |= set;
 
-        while ((group = iterate_groups(task, &iter)))
+        /*
+         * Periodic aggregation shuts off if there is a period of no
+         * task changes, so we wake it back up if necessary. However,
+         * don't do this if the task change is the aggregation worker
+         * itself going to sleep, or we'll ping-pong forever.
+         */
+        if (unlikely((clear & TSK_RUNNING) &&
+                     (task->flags & PF_WQ_WORKER) &&
+                     wq_worker_last_func(task) == psi_update_work))
+                wake_clock = false;
+
+        while ((group = iterate_groups(task, &iter))) {
                 psi_group_change(group, cpu, clear, set);
+                if (wake_clock && !delayed_work_pending(&group->clock_work))
+                        schedule_delayed_work(&group->clock_work, PSI_FREQ);
+        }
 }
 
 void psi_memstall_tick(struct task_struct *task, int cpu)
diff --git a/kernel/signal.c b/kernel/signal.c
index e1d7ad8e6ab1..57b7771e20d7 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -688,6 +688,48 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, kernel_siginfo_t *in
 }
 EXPORT_SYMBOL_GPL(dequeue_signal);
 
+static int dequeue_synchronous_signal(kernel_siginfo_t *info)
+{
+        struct task_struct *tsk = current;
+        struct sigpending *pending = &tsk->pending;
+        struct sigqueue *q, *sync = NULL;
+
+        /*
+         * Might a synchronous signal be in the queue?
+         */
+        if (!((pending->signal.sig[0] & ~tsk->blocked.sig[0]) & SYNCHRONOUS_MASK))
+                return 0;
+
+        /*
+         * Return the first synchronous signal in the queue.
+         */
+        list_for_each_entry(q, &pending->list, list) {
+                /* Synchronous signals have a postive si_code */
+                if ((q->info.si_code > SI_USER) &&
+                    (sigmask(q->info.si_signo) & SYNCHRONOUS_MASK)) {
+                        sync = q;
+                        goto next;
+                }
+        }
+        return 0;
+next:
+        /*
+         * Check if there is another siginfo for the same signal.
+         */
+        list_for_each_entry_continue(q, &pending->list, list) {
+                if (q->info.si_signo == sync->info.si_signo)
+                        goto still_pending;
+        }
+
+        sigdelset(&pending->signal, sync->info.si_signo);
+        recalc_sigpending();
+still_pending:
+        list_del_init(&sync->list);
+        copy_siginfo(info, &sync->info);
+        __sigqueue_free(sync);
+        return info->si_signo;
+}
+
 /*
  * Tell a process that it has a new active signal..
  *
@@ -1057,10 +1099,9 @@ static int __send_signal(int sig, struct kernel_siginfo *info, struct task_struc
 
         result = TRACE_SIGNAL_DELIVERED;
         /*
-         * Skip useless siginfo allocation for SIGKILL SIGSTOP,
-         * and kernel threads.
+         * Skip useless siginfo allocation for SIGKILL and kernel threads.
          */
-        if (sig_kernel_only(sig) || (t->flags & PF_KTHREAD))
+        if ((sig == SIGKILL) || (t->flags & PF_KTHREAD))
                 goto out_set;
 
         /*
@@ -2394,6 +2435,14 @@ relock:
                 goto relock;
         }
 
+        /* Has this task already been marked for death? */
+        if (signal_group_exit(signal)) {
+                ksig->info.si_signo = signr = SIGKILL;
+                sigdelset(&current->pending.signal, SIGKILL);
+                recalc_sigpending();
+                goto fatal;
+        }
+
         for (;;) {
                 struct k_sigaction *ka;
 
@@ -2407,7 +2456,15 @@ relock:
                         goto relock;
                 }
 
-                signr = dequeue_signal(current, &current->blocked, &ksig->info);
+                /*
+                 * Signals generated by the execution of an instruction
+                 * need to be delivered before any other pending signals
+                 * so that the instruction pointer in the signal stack
+                 * frame points to the faulting instruction.
+                 */
+                signr = dequeue_synchronous_signal(&ksig->info);
+                if (!signr)
+                        signr = dequeue_signal(current, &current->blocked, &ksig->info);
 
                 if (!signr)
                         break; /* will return 0 */
@@ -2489,6 +2546,7 @@ relock:
                         continue;
                 }
 
+        fatal:
                 spin_unlock_irq(&sighand->siglock);
 
                 /*
diff --git a/kernel/smp.c b/kernel/smp.c
index 163c451af42e..f4cf1b0bb3b8 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -584,8 +584,6 @@ void __init smp_init(void)
                 num_nodes, (num_nodes > 1 ? "s" : ""),
                 num_cpus,  (num_cpus  > 1 ? "s" : ""));
 
-        /* Final decision about SMT support */
-        cpu_smt_check_topology();
         /* Any cleanup work */
         smp_cpus_done(setup_max_cpus);
 }
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 8b068adb9da1..f1a86a0d881d 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -1204,22 +1204,12 @@ static int __bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog *
 
 int bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog *prog)
 {
-        int err;
-
-        mutex_lock(&bpf_event_mutex);
-        err = __bpf_probe_register(btp, prog);
-        mutex_unlock(&bpf_event_mutex);
-        return err;
+        return __bpf_probe_register(btp, prog);
 }
 
 int bpf_probe_unregister(struct bpf_raw_event_map *btp, struct bpf_prog *prog)
 {
-        int err;
-
-        mutex_lock(&bpf_event_mutex);
-        err = tracepoint_probe_unregister(btp->tp, (void *)btp->bpf_func, prog);
-        mutex_unlock(&bpf_event_mutex);
-        return err;
+        return tracepoint_probe_unregister(btp->tp, (void *)btp->bpf_func, prog);
 }
 
 int bpf_get_perf_event_info(const struct perf_event *event, u32 *prog_id,
diff --git a/kernel/trace/trace_probe_tmpl.h b/kernel/trace/trace_probe_tmpl.h
index 5c56afc17cf8..4737bb8c07a3 100644
--- a/kernel/trace/trace_probe_tmpl.h
+++ b/kernel/trace/trace_probe_tmpl.h
@@ -180,10 +180,12 @@ store_trace_args(void *data, struct trace_probe *tp, struct pt_regs *regs,
                 if (unlikely(arg->dynamic))
                         *dl = make_data_loc(maxlen, dyndata - base);
                 ret = process_fetch_insn(arg->code, regs, dl, base);
-                if (unlikely(ret < 0 && arg->dynamic))
+                if (unlikely(ret < 0 && arg->dynamic)) {
                         *dl = make_data_loc(0, dyndata - base);
-                else
+                } else {
                         dyndata += ret;
+                        maxlen -= ret;
+                }
         }
 }
 
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index e335576b9411..9bde07c06362 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -5,7 +5,7 @@
  * Copyright (C) IBM Corporation, 2010-2012
  * Author:      Srikar Dronamraju <srikar@linux.vnet.ibm.com>
  */
-#define pr_fmt(fmt)     "trace_kprobe: " fmt
+#define pr_fmt(fmt)     "trace_uprobe: " fmt
 
 #include <linux/ctype.h>
 #include <linux/module.h>
@@ -160,6 +160,13 @@ fetch_store_string(unsigned long addr, void *dest, void *base)
         if (ret >= 0) {
                 if (ret == maxlen)
                         dst[ret - 1] = '\0';
+                else
+                        /*
+                         * Include the terminating null byte. In this case it
+                         * was copied by strncpy_from_user but not accounted
+                         * for in ret.
+                         */
+                        ret++;
                 *(u32 *)dest = make_data_loc(ret, (void *)dst - base);
         }
 
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 392be4b252f6..fc5d23d752a5 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -910,6 +910,26 @@ struct task_struct *wq_worker_sleeping(struct task_struct *task)
 }
 
 /**
+ * wq_worker_last_func - retrieve worker's last work function
+ *
+ * Determine the last function a worker executed. This is called from
+ * the scheduler to get a worker's last known identity.
+ *
+ * CONTEXT:
+ * spin_lock_irq(rq->lock)
+ *
+ * Return:
+ * The last work function %current executed as a worker, NULL if it
+ * hasn't executed any work yet.
+ */
+work_func_t wq_worker_last_func(struct task_struct *task)
+{
+        struct worker *worker = kthread_data(task);
+
+        return worker->last_func;
+}
+
+/**
  * worker_set_flags - set worker flags and adjust nr_running accordingly
  * @worker: self
  * @flags: flags to set
@@ -2184,6 +2204,9 @@ __acquires(&pool->lock)
         if (unlikely(cpu_intensive))
                 worker_clr_flags(worker, WORKER_CPU_INTENSIVE);
 
+        /* tag the worker for identification in schedule() */
+        worker->last_func = worker->current_func;
+
         /* we're done with it, release */
         hash_del(&worker->hentry);
         worker->current_work = NULL;
diff --git a/kernel/workqueue_internal.h b/kernel/workqueue_internal.h
index 66fbb5a9e633..cb68b03ca89a 100644
--- a/kernel/workqueue_internal.h
+++ b/kernel/workqueue_internal.h
@@ -53,6 +53,9 @@ struct worker {
 
         /* used only by rescuers to point to the target workqueue */
         struct workqueue_struct *rescue_wq;     /* I: the workqueue to rescue */
+
+        /* used by the scheduler to determine a worker's last known identity */
+        work_func_t             last_func;
 };
 
 /**
@@ -67,9 +70,10 @@ static inline struct worker *current_wq_worker(void)
 
 /*
  * Scheduler hooks for concurrency managed workqueue.  Only to be used from
- * sched/core.c and workqueue.c.
+ * sched/ and workqueue.c.
  */
 void wq_worker_waking_up(struct task_struct *task, int cpu);
 struct task_struct *wq_worker_sleeping(struct task_struct *task);
+work_func_t wq_worker_last_func(struct task_struct *task);
 
 #endif /* _KERNEL_WORKQUEUE_INTERNAL_H */
diff --git a/lib/test_kmod.c b/lib/test_kmod.c
index d82d022111e0..9cf77628fc91 100644
--- a/lib/test_kmod.c
+++ b/lib/test_kmod.c
@@ -632,7 +632,7 @@ static void __kmod_config_free(struct test_config *config)
         config->test_driver = NULL;
 
         kfree_const(config->test_fs);
-        config->test_driver = NULL;
+        config->test_fs = NULL;
 }
 
 static void kmod_config_free(struct kmod_test_device *test_dev)
diff --git a/lib/test_rhashtable.c b/lib/test_rhashtable.c
index 6a8ac7626797..e52f8cafe227 100644
--- a/lib/test_rhashtable.c
+++ b/lib/test_rhashtable.c
@@ -541,38 +541,45 @@ static unsigned int __init print_ht(struct rhltable *rhlt)
 static int __init test_insert_dup(struct test_obj_rhl *rhl_test_objects,
                                   int cnt, bool slow)
 {
-        struct rhltable rhlt;
+        struct rhltable *rhlt;
         unsigned int i, ret;
         const char *key;
         int err = 0;
 
-        err = rhltable_init(&rhlt, &test_rht_params_dup);
-        if (WARN_ON(err))
+        rhlt = kmalloc(sizeof(*rhlt), GFP_KERNEL);
+        if (WARN_ON(!rhlt))
+                return -EINVAL;
+
+        err = rhltable_init(rhlt, &test_rht_params_dup);
+        if (WARN_ON(err)) {
+                kfree(rhlt);
                 return err;
+        }
 
         for (i = 0; i < cnt; i++) {
                 rhl_test_objects[i].value.tid = i;
-                key = rht_obj(&rhlt.ht, &rhl_test_objects[i].list_node.rhead);
+                key = rht_obj(&rhlt->ht, &rhl_test_objects[i].list_node.rhead);
                 key += test_rht_params_dup.key_offset;
 
                 if (slow) {
-                        err = PTR_ERR(rhashtable_insert_slow(&rhlt.ht, key,
+                        err = PTR_ERR(rhashtable_insert_slow(&rhlt->ht, key,
                                                              &rhl_test_objects[i].list_node.rhead));
                         if (err == -EAGAIN)
                                 err = 0;
                 } else
-                        err = rhltable_insert(&rhlt,
+                        err = rhltable_insert(rhlt,
                                               &rhl_test_objects[i].list_node,
                                               test_rht_params_dup);
                 if (WARN(err, "error %d on element %d/%d (%s)\n", err, i, cnt, slow? "slow" : "fast"))
                         goto skip_print;
         }
 
-        ret = print_ht(&rhlt);
+        ret = print_ht(rhlt);
         WARN(ret != cnt, "missing rhltable elements (%d != %d, %s)\n", ret, cnt, slow? "slow" : "fast");
 
 skip_print:
-        rhltable_destroy(&rhlt);
+        rhltable_destroy(rhlt);
+        kfree(rhlt);
 
         return 0;
 }
diff --git a/mm/gup.c b/mm/gup.c
index 05acd7e2eb22..75029649baca 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1674,7 +1674,8 @@ static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,
                 if (!pmd_present(pmd))
                         return 0;
 
-                if (unlikely(pmd_trans_huge(pmd) || pmd_huge(pmd))) {
+                if (unlikely(pmd_trans_huge(pmd) || pmd_huge(pmd) ||
+                             pmd_devmap(pmd))) {
                         /*
                          * NUMA hinting faults need to be handled in the GUP
                          * slowpath for accounting purposes and so that they
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index df2e7dd5ff17..afef61656c1e 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4268,7 +4268,8 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
                                 break;
                         }
                         if (ret & VM_FAULT_RETRY) {
-                                if (nonblocking)
+                                if (nonblocking &&
+                                    !(fault_flags & FAULT_FLAG_RETRY_NOWAIT))
                                         *nonblocking = 0;
                                 *nr_pages = 0;
                                 /*
diff --git a/mm/kasan/Makefile b/mm/kasan/Makefile
index 0a14fcff70ed..e2bb06c1b45e 100644
--- a/mm/kasan/Makefile
+++ b/mm/kasan/Makefile
@@ -5,6 +5,7 @@ UBSAN_SANITIZE_generic.o := n
 UBSAN_SANITIZE_tags.o := n
 KCOV_INSTRUMENT := n
 
+CFLAGS_REMOVE_common.o = -pg
 CFLAGS_REMOVE_generic.o = -pg
 # Function splitter causes unnecessary splits in __asan_load1/__asan_store1
 # see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63533
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 7c72f2a95785..831be5ff5f4d 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -372,7 +372,8 @@ static void kill_procs(struct list_head *to_kill, int forcekill, bool fail,
                         if (fail || tk->addr_valid == 0) {
                                 pr_err("Memory failure: %#lx: forcibly killing %s:%d because of failure to unmap corrupted page\n",
                                        pfn, tk->tsk->comm, tk->tsk->pid);
-                                force_sig(SIGKILL, tk->tsk);
+                                do_send_sig_info(SIGKILL, SEND_SIG_PRIV,
+                                                 tk->tsk, PIDTYPE_PID);
                         }
 
                         /*
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index b9a667d36c55..124e794867c5 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1233,7 +1233,8 @@ static bool is_pageblock_removable_nolock(struct page *page)
 bool is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages)
 {
         struct page *page = pfn_to_page(start_pfn);
-        struct page *end_page = page + nr_pages;
+        unsigned long end_pfn = min(start_pfn + nr_pages, zone_end_pfn(page_zone(page)));
+        struct page *end_page = pfn_to_page(end_pfn);
 
         /* Check the starting page of each pageblock within the range */
         for (; page < end_page; page = next_active_pageblock(page)) {
@@ -1273,6 +1274,9 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn,
                                 i++;
                         if (i == MAX_ORDER_NR_PAGES || pfn + i >= end_pfn)
                                 continue;
+                        /* Check if we got outside of the zone */
+                        if (zone && !zone_spans_pfn(zone, pfn + i))
+                                return 0;
                         page = pfn_to_page(pfn + i);
                         if (zone && page_zone(page) != zone)
                                 return 0;
@@ -1301,23 +1305,27 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn,
 static unsigned long scan_movable_pages(unsigned long start, unsigned long end)
 {
         unsigned long pfn;
-        struct page *page;
+
         for (pfn = start; pfn < end; pfn++) {
-                if (pfn_valid(pfn)) {
-                        page = pfn_to_page(pfn);
-                        if (PageLRU(page))
-                                return pfn;
-                        if (__PageMovable(page))
-                                return pfn;
-                        if (PageHuge(page)) {
-                                if (hugepage_migration_supported(page_hstate(page)) &&
-                                    page_huge_active(page))
-                                        return pfn;
-                                else
-                                        pfn = round_up(pfn + 1,
-                                                1 << compound_order(page)) - 1;
-                        }
-                }
+                struct page *page, *head;
+                unsigned long skip;
+
+                if (!pfn_valid(pfn))
+                        continue;
+                page = pfn_to_page(pfn);
+                if (PageLRU(page))
+                        return pfn;
+                if (__PageMovable(page))
+                        return pfn;
+
+                if (!PageHuge(page))
+                        continue;
+                head = compound_head(page);
+                if (hugepage_migration_supported(page_hstate(head)) &&
+                    page_huge_active(head))
+                        return pfn;
+                skip = (1 << compound_order(head)) - (page - head);
+                pfn += skip - 1;
         }
         return 0;
 }
@@ -1344,7 +1352,6 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
 {
         unsigned long pfn;
         struct page *page;
-        int not_managed = 0;
         int ret = 0;
         LIST_HEAD(source);
 
@@ -1392,7 +1399,6 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
                 else
                         ret = isolate_movable_page(page, ISOLATE_UNEVICTABLE);
                 if (!ret) { /* Success */
-                        put_page(page);
                         list_add_tail(&page->lru, &source);
                         if (!__PageMovable(page))
                                 inc_node_page_state(page, NR_ISOLATED_ANON +
@@ -1401,22 +1407,10 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
                 } else {
                         pr_warn("failed to isolate pfn %lx\n", pfn);
                         dump_page(page, "isolation failed");
-                        put_page(page);
-                        /* Because we don't have big zone->lock. we should
-                           check this again here. */
-                        if (page_count(page)) {
-                                not_managed++;
-                                ret = -EBUSY;
-                                break;
-                        }
                 }
+                put_page(page);
         }
         if (!list_empty(&source)) {
-                if (not_managed) {
-                        putback_movable_pages(&source);
-                        goto out;
-                }
-
                 /* Allocate a new page from the nearest neighbor node */
                 ret = migrate_pages(&source, new_node_page, NULL, 0,
                                         MIGRATE_SYNC, MR_MEMORY_HOTPLUG);
@@ -1429,7 +1423,7 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
                         putback_movable_pages(&source);
                 }
         }
-out:
+
         return ret;
 }
 
@@ -1576,7 +1570,6 @@ static int __ref __offline_pages(unsigned long start_pfn,
            we assume this for now. .*/
         if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start,
                                   &valid_end)) {
-                mem_hotplug_done();
                 ret = -EINVAL;
                 reason = "multizone range";
                 goto failed_removal;
@@ -1591,7 +1584,6 @@ static int __ref __offline_pages(unsigned long start_pfn,
                                        MIGRATE_MOVABLE,
                                        SKIP_HWPOISON | REPORT_FAILURE);
         if (ret) {
-                mem_hotplug_done();
                 reason = "failure to isolate range";
                 goto failed_removal;
         }
diff --git a/mm/migrate.c b/mm/migrate.c
index a16b15090df3..d4fd680be3b0 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -709,7 +709,6 @@ static bool buffer_migrate_lock_buffers(struct buffer_head *head,
         /* Simple case, sync compaction */
         if (mode != MIGRATE_ASYNC) {
                 do {
-                        get_bh(bh);
                         lock_buffer(bh);
                         bh = bh->b_this_page;
 
@@ -720,18 +719,15 @@ static bool buffer_migrate_lock_buffers(struct buffer_head *head,
 
         /* async case, we cannot block on lock_buffer so use trylock_buffer */
         do {
-                get_bh(bh);
                 if (!trylock_buffer(bh)) {
                         /*
                          * We failed to lock the buffer and cannot stall in
                          * async migration. Release the taken locks
                          */
                         struct buffer_head *failed_bh = bh;
-                        put_bh(failed_bh);
                         bh = head;
                         while (bh != failed_bh) {
                                 unlock_buffer(bh);
-                                put_bh(bh);
                                 bh = bh->b_this_page;
                         }
                         return false;
@@ -818,7 +814,6 @@ unlock_buffers:
         bh = head;
         do {
                 unlock_buffer(bh);
-                put_bh(bh);
                 bh = bh->b_this_page;
 
         } while (bh != head);
@@ -1135,10 +1130,13 @@ out:
          * If migration is successful, decrease refcount of the newpage
          * which will not free the page because new page owner increased
          * refcounter. As well, if it is LRU page, add the page to LRU
-         * list in here.
+         * list in here. Use the old state of the isolated source page to
+         * determine if we migrated a LRU page. newpage was already unlocked
+         * and possibly modified by its owner - don't rely on the page
+         * state.
          */
         if (rc == MIGRATEPAGE_SUCCESS) {
-                if (unlikely(__PageMovable(newpage)))
+                if (unlikely(!is_lru))
                         put_page(newpage);
                 else
                         putback_lru_page(newpage);
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index f0e8cd9edb1a..26ea8636758f 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -647,8 +647,8 @@ static int oom_reaper(void *unused)
 
 static void wake_oom_reaper(struct task_struct *tsk)
 {
-        /* tsk is already queued? */
-        if (tsk == oom_reaper_list || tsk->oom_reaper_list)
+        /* mm is already queued? */
+        if (test_and_set_bit(MMF_OOM_REAP_QUEUED, &tsk->signal->oom_mm->flags))
                 return;
 
         get_task_struct(tsk);
@@ -975,6 +975,13 @@ static void oom_kill_process(struct oom_control *oc, const char *message)
          * still freeing memory.
          */
         read_lock(&tasklist_lock);
+
+        /*
+         * The task 'p' might have already exited before reaching here. The
+         * put_task_struct() will free task_struct 'p' while the loop still try
+         * to access the field of 'p', so, get an extra reference.
+         */
+        get_task_struct(p);
         for_each_thread(p, t) {
                 list_for_each_entry(child, &t->children, sibling) {
                         unsigned int child_points;
@@ -994,6 +1001,7 @@ static void oom_kill_process(struct oom_control *oc, const char *message)
                         }
                 }
         }
+        put_task_struct(p);
         read_unlock(&tasklist_lock);
 
         /*
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 35fdde041f5c..46285d28e43b 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4675,11 +4675,11 @@ refill:
                 /* Even if we own the page, we do not use atomic_set().
                  * This would break get_page_unless_zero() users.
                  */
-                page_ref_add(page, size - 1);
+                page_ref_add(page, size);
 
                 /* reset page count bias and offset to start of new frag */
                 nc->pfmemalloc = page_is_pfmemalloc(page);
-                nc->pagecnt_bias = size;
+                nc->pagecnt_bias = size + 1;
                 nc->offset = size;
         }
 
@@ -4695,10 +4695,10 @@ refill:
                 size = nc->size;
 #endif
                 /* OK, page count is 0, we can safely set it */
-                set_page_count(page, size);
+                set_page_count(page, size + 1);
 
                 /* reset page count bias and offset to start of new frag */
-                nc->pagecnt_bias = size;
+                nc->pagecnt_bias = size + 1;
                 offset = size - fragsz;
         }
 
diff --git a/mm/page_ext.c b/mm/page_ext.c
index ae44f7adbe07..8c78b8d45117 100644
--- a/mm/page_ext.c
+++ b/mm/page_ext.c
@@ -398,10 +398,8 @@ void __init page_ext_init(void)
                          * We know some arch can have a nodes layout such as
                          * -------------pfn-------------->
                          * N0 | N1 | N2 | N0 | N1 | N2|....
-                         *
-                         * Take into account DEFERRED_STRUCT_PAGE_INIT.
                          */
-                        if (early_pfn_to_nid(pfn) != nid)
+                        if (pfn_to_nid(pfn) != nid)
                                 continue;
                         if (init_section_page_ext(pfn, nid))
                                 goto oom;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index a714c4f800e9..e979705bbf32 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -491,16 +491,6 @@ static unsigned long do_shrink_slab(struct shrink_control *shrinkctl,
                 delta = freeable / 2;
         }
 
-        /*
-         * Make sure we apply some minimal pressure on default priority
-         * even on small cgroups. Stale objects are not only consuming memory
-         * by themselves, but can also hold a reference to a dying cgroup,
-         * preventing it from being reclaimed. A dying cgroup with all
-         * corresponding structures like per-cpu stats and kmem caches
-         * can be really big, so it may lead to a significant waste of memory.
-         */
-        delta = max_t(unsigned long long, delta, min(freeable, batch_size));
-
         total_scan += delta;
         if (total_scan < 0) {
                 pr_err("shrink_slab: %pF negative objects to delete nr=%ld\n",
diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
index e8090f099eb8..ef0dec20c7d8 100644
--- a/net/batman-adv/bat_v_elp.c
+++ b/net/batman-adv/bat_v_elp.c
@@ -104,6 +104,9 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh)
 
                 ret = cfg80211_get_station(real_netdev, neigh->addr, &sinfo);
 
+                /* free the TID stats immediately */
+                cfg80211_sinfo_release_content(&sinfo);
+
                 dev_put(real_netdev);
                 if (ret == -ENOENT) {
                         /* Node is not associated anymore! It would be
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index 508f4416dfc9..415d494cbe22 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -20,7 +20,6 @@
 #include "main.h"
 
 #include <linux/atomic.h>
-#include <linux/bug.h>
 #include <linux/byteorder/generic.h>
 #include <linux/errno.h>
 #include <linux/gfp.h>
@@ -179,8 +178,10 @@ static bool batadv_is_on_batman_iface(const struct net_device *net_dev)
         parent_dev = __dev_get_by_index((struct net *)parent_net,
                                         dev_get_iflink(net_dev));
         /* if we got a NULL parent_dev there is something broken.. */
-        if (WARN(!parent_dev, "Cannot find parent device"))
+        if (!parent_dev) {
+                pr_err("Cannot find parent device\n");
                 return false;
+        }
 
         if (batadv_mutual_parents(net_dev, net, parent_dev, parent_net))
                 return false;
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 5db5a0a4c959..ffc83bebfe40 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -221,10 +221,14 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
 
         netif_trans_update(soft_iface);
         vid = batadv_get_vid(skb, 0);
+
+        skb_reset_mac_header(skb);
         ethhdr = eth_hdr(skb);
 
         switch (ntohs(ethhdr->h_proto)) {
         case ETH_P_8021Q:
+                if (!pskb_may_pull(skb, sizeof(*vhdr)))
+                        goto dropped;
                 vhdr = vlan_eth_hdr(skb);
 
                 /* drop batman-in-batman packets to prevent loops */
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 5e55cef0cec3..6693e209efe8 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -2293,9 +2293,12 @@ static int compat_do_replace(struct net *net, void __user *user,
 
         xt_compat_lock(NFPROTO_BRIDGE);
 
-        ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
-        if (ret < 0)
-                goto out_unlock;
+        if (tmp.nentries) {
+                ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
+                if (ret < 0)
+                        goto out_unlock;
+        }
+
         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
         if (ret < 0)
                 goto out_unlock;
diff --git a/net/core/dev.c b/net/core/dev.c
index 82f20022259d..8e276e0192a1 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -8712,6 +8712,9 @@ int init_dummy_netdev(struct net_device *dev)
         set_bit(__LINK_STATE_PRESENT, &dev->state);
         set_bit(__LINK_STATE_START, &dev->state);
 
+        /* napi_busy_loop stats accounting wants this */
+        dev_net_set(dev, &init_net);
+
         /* Note : We dont allocate pcpu_refcnt for dummy devices,
          * because users of this 'device' dont need to change
          * its refcount.
diff --git a/net/core/filter.c b/net/core/filter.c
index 7559d6835ecb..7a54dc11ac2d 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4112,10 +4112,12 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
                 /* Only some socketops are supported */
                 switch (optname) {
                 case SO_RCVBUF:
+                        val = min_t(u32, val, sysctl_rmem_max);
                         sk->sk_userlocks |= SOCK_RCVBUF_LOCK;
                         sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF);
                         break;
                 case SO_SNDBUF:
+                        val = min_t(u32, val, sysctl_wmem_max);
                         sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
                         sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF);
                         break;
diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index d6d5c20d7044..8c826603bf36 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -545,8 +545,7 @@ static void sk_psock_destroy_deferred(struct work_struct *gc)
         struct sk_psock *psock = container_of(gc, struct sk_psock, gc);
 
         /* No sk_callback_lock since already detached. */
-        if (psock->parser.enabled)
-                strp_done(&psock->parser.strp);
+        strp_done(&psock->parser.strp);
 
         cancel_work_sync(&psock->work);
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 6aa2e7e0b4fb..bc3512f230a3 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2380,7 +2380,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
         }
 
         if (sk_has_memory_pressure(sk)) {
-                int alloc;
+                u64 alloc;
 
                 if (!sk_under_memory_pressure(sk))
                         return 1;
diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
index 6eb837a47b5c..baaaeb2b2c42 100644
--- a/net/dccp/ccid.h
+++ b/net/dccp/ccid.h
@@ -202,7 +202,7 @@ static inline void ccid_hc_tx_packet_recv(struct ccid *ccid, struct sock *sk,
 static inline int ccid_hc_tx_parse_options(struct ccid *ccid, struct sock *sk,
                                            u8 pkt, u8 opt, u8 *val, u8 len)
 {
-        if (ccid->ccid_ops->ccid_hc_tx_parse_options == NULL)
+        if (!ccid || !ccid->ccid_ops->ccid_hc_tx_parse_options)
                 return 0;
         return ccid->ccid_ops->ccid_hc_tx_parse_options(sk, pkt, opt, val, len);
 }
@@ -214,7 +214,7 @@ static inline int ccid_hc_tx_parse_options(struct ccid *ccid, struct sock *sk,
 static inline int ccid_hc_rx_parse_options(struct ccid *ccid, struct sock *sk,
                                            u8 pkt, u8 opt, u8 *val, u8 len)
 {
-        if (ccid->ccid_ops->ccid_hc_rx_parse_options == NULL)
+        if (!ccid || !ccid->ccid_ops->ccid_hc_rx_parse_options)
                 return 0;
         return ccid->ccid_ops->ccid_hc_rx_parse_options(sk, pkt, opt, val, len);
 }
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index d0b3e69c6b39..0962f9201baa 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -56,7 +56,7 @@
 #include <net/dn_neigh.h>
 #include <net/dn_fib.h>
 
-#define DN_IFREQ_SIZE (sizeof(struct ifreq) - sizeof(struct sockaddr) + sizeof(struct sockaddr_dn))
+#define DN_IFREQ_SIZE (offsetof(struct ifreq, ifr_ifru) + sizeof(struct sockaddr_dn))
 
 static char dn_rt_all_end_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x04,0x00,0x00};
 static char dn_rt_all_rt_mcast[ETH_ALEN]  = {0xAB,0x00,0x00,0x03,0x00,0x00};
diff --git a/net/dsa/master.c b/net/dsa/master.c
index 71bb15f491c8..54f5551fb799 100644
--- a/net/dsa/master.c
+++ b/net/dsa/master.c
@@ -205,6 +205,8 @@ static void dsa_master_reset_mtu(struct net_device *dev)
         rtnl_unlock();
 }
 
+static struct lock_class_key dsa_master_addr_list_lock_key;
+
 int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
 {
         int ret;
@@ -218,6 +220,8 @@ int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
         wmb();
 
         dev->dsa_ptr = cpu_dp;
+        lockdep_set_class(&dev->addr_list_lock,
+                          &dsa_master_addr_list_lock_key);
 
         ret = dsa_master_ethtool_setup(dev);
         if (ret)
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index a3fcc1d01615..a1c9fe155057 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -140,11 +140,14 @@ static int dsa_slave_close(struct net_device *dev)
 static void dsa_slave_change_rx_flags(struct net_device *dev, int change)
 {
         struct net_device *master = dsa_slave_to_master(dev);
-
-        if (change & IFF_ALLMULTI)
-                dev_set_allmulti(master, dev->flags & IFF_ALLMULTI ? 1 : -1);
-        if (change & IFF_PROMISC)
-                dev_set_promiscuity(master, dev->flags & IFF_PROMISC ? 1 : -1);
+        if (dev->flags & IFF_UP) {
+                if (change & IFF_ALLMULTI)
+                        dev_set_allmulti(master,
+                                         dev->flags & IFF_ALLMULTI ? 1 : -1);
+                if (change & IFF_PROMISC)
+                        dev_set_promiscuity(master,
+                                            dev->flags & IFF_PROMISC ? 1 : -1);
+        }
 }
 
 static void dsa_slave_set_rx_mode(struct net_device *dev)
@@ -639,7 +642,7 @@ static int dsa_slave_set_eee(struct net_device *dev, struct ethtool_eee *e)
         int ret;
 
         /* Port's PHY and MAC both need to be EEE capable */
-        if (!dev->phydev && !dp->pl)
+        if (!dev->phydev || !dp->pl)
                 return -ENODEV;
 
         if (!ds->ops->set_mac_eee)
@@ -659,7 +662,7 @@ static int dsa_slave_get_eee(struct net_device *dev, struct ethtool_eee *e)
         int ret;
 
         /* Port's PHY and MAC both need to be EEE capable */
-        if (!dev->phydev && !dp->pl)
+        if (!dev->phydev || !dp->pl)
                 return -ENODEV;
 
         if (!ds->ops->get_mac_eee)
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 1a4e9ff02762..5731670c560b 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -108,6 +108,7 @@ static size_t inet_sk_attr_size(struct sock *sk,
                 + nla_total_size(1) /* INET_DIAG_TOS */
                 + nla_total_size(1) /* INET_DIAG_TCLASS */
                 + nla_total_size(4) /* INET_DIAG_MARK */
+                + nla_total_size(4) /* INET_DIAG_CLASS_ID */
                 + nla_total_size(sizeof(struct inet_diag_meminfo))
                 + nla_total_size(sizeof(struct inet_diag_msg))
                 + nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
@@ -287,12 +288,19 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
                         goto errout;
         }
 
-        if (ext & (1 << (INET_DIAG_CLASS_ID - 1))) {
+        if (ext & (1 << (INET_DIAG_CLASS_ID - 1)) ||
+            ext & (1 << (INET_DIAG_TCLASS - 1))) {
                 u32 classid = 0;
 
 #ifdef CONFIG_SOCK_CGROUP_DATA
                 classid = sock_cgroup_classid(&sk->sk_cgrp_data);
 #endif
+                /* Fallback to socket priority if class id isn't set.
+                 * Classful qdiscs use it as direct reference to class.
+                 * For cgroup2 classid is always zero.
+                 */
+                if (!classid)
+                        classid = sk->sk_priority;
 
                 if (nla_put_u32(skb, INET_DIAG_CLASS_ID, classid))
                         goto errout;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index d757b9642d0d..be778599bfed 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -216,6 +216,7 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base,
                         atomic_set(&p->rid, 0);
                         p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
                         p->rate_tokens = 0;
+                        p->n_redirects = 0;
                         /* 60*HZ is arbitrary, but chosen enough high so that the first
                          * calculation of tokens is at its maximum.
                          */
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 20a64fe6254b..3978f807fa8b 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1455,12 +1455,17 @@ static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
 {
         struct ip_tunnel *t = netdev_priv(dev);
         struct ip_tunnel_parm *p = &t->parms;
+        __be16 o_flags = p->o_flags;
+
+        if ((t->erspan_ver == 1 || t->erspan_ver == 2) &&
+            !t->collect_md)
+                o_flags |= TUNNEL_KEY;
 
         if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
             nla_put_be16(skb, IFLA_GRE_IFLAGS,
                          gre_tnl_flags_to_gre_flags(p->i_flags)) ||
             nla_put_be16(skb, IFLA_GRE_OFLAGS,
-                         gre_tnl_flags_to_gre_flags(p->o_flags)) ||
+                         gre_tnl_flags_to_gre_flags(o_flags)) ||
             nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) ||
             nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) ||
             nla_put_in_addr(skb, IFLA_GRE_LOCAL, p->iph.saddr) ||
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index d7b43e700023..68a21bf75dd0 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -74,6 +74,33 @@ drop:
         return 0;
 }
 
+static int vti_input_ipip(struct sk_buff *skb, int nexthdr, __be32 spi,
+                     int encap_type)
+{
+        struct ip_tunnel *tunnel;
+        const struct iphdr *iph = ip_hdr(skb);
+        struct net *net = dev_net(skb->dev);
+        struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
+
+        tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
+                                  iph->saddr, iph->daddr, 0);
+        if (tunnel) {
+                if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
+                        goto drop;
+
+                XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
+
+                skb->dev = tunnel->dev;
+
+                return xfrm_input(skb, nexthdr, spi, encap_type);
+        }
+
+        return -EINVAL;
+drop:
+        kfree_skb(skb);
+        return 0;
+}
+
 static int vti_rcv(struct sk_buff *skb)
 {
         XFRM_SPI_SKB_CB(skb)->family = AF_INET;
@@ -82,6 +109,14 @@ static int vti_rcv(struct sk_buff *skb)
         return vti_input(skb, ip_hdr(skb)->protocol, 0, 0);
 }
 
+static int vti_rcv_ipip(struct sk_buff *skb)
+{
+        XFRM_SPI_SKB_CB(skb)->family = AF_INET;
+        XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
+
+        return vti_input_ipip(skb, ip_hdr(skb)->protocol, ip_hdr(skb)->saddr, 0);
+}
+
 static int vti_rcv_cb(struct sk_buff *skb, int err)
 {
         unsigned short family;
@@ -435,6 +470,12 @@ static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = {
         .priority       =       100,
 };
 
+static struct xfrm_tunnel ipip_handler __read_mostly = {
+        .handler        =       vti_rcv_ipip,
+        .err_handler    =       vti4_err,
+        .priority       =       0,
+};
+
 static int __net_init vti_init_net(struct net *net)
 {
         int err;
@@ -603,6 +644,13 @@ static int __init vti_init(void)
         if (err < 0)
                 goto xfrm_proto_comp_failed;
 
+        msg = "ipip tunnel";
+        err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
+        if (err < 0) {
+                pr_info("%s: cant't register tunnel\n",__func__);
+                goto xfrm_tunnel_failed;
+        }
+
         msg = "netlink interface";
         err = rtnl_link_register(&vti_link_ops);
         if (err < 0)
@@ -612,6 +660,8 @@ static int __init vti_init(void)
 
 rtnl_link_failed:
         xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP);
+xfrm_tunnel_failed:
+        xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
 xfrm_proto_comp_failed:
         xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
 xfrm_proto_ah_failed:
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index b61977db9b7f..2a909e5f9ba0 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -846,9 +846,9 @@ static int clusterip_net_init(struct net *net)
 
 static void clusterip_net_exit(struct net *net)
 {
+#ifdef CONFIG_PROC_FS
         struct clusterip_net *cn = clusterip_pernet(net);
 
-#ifdef CONFIG_PROC_FS
         mutex_lock(&cn->mutex);
         proc_remove(cn->procdir);
         cn->procdir = NULL;
diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
index 2687db015b6f..fa2ba7c500e4 100644
--- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
@@ -215,6 +215,7 @@ int nf_nat_icmp_reply_translation(struct sk_buff *skb,
 
         /* Change outer to look like the reply to an incoming packet */
         nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
+        target.dst.protonum = IPPROTO_ICMP;
         if (!nf_nat_ipv4_manip_pkt(skb, 0, &target, manip))
                 return 0;
 
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic_main.c b/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
index a0aa13bcabda..0a8a60c1bf9a 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
@@ -105,6 +105,8 @@ static void fast_csum(struct snmp_ctx *ctx, unsigned char offset)
 int snmp_version(void *context, size_t hdrlen, unsigned char tag,
                  const void *data, size_t datalen)
 {
+        if (datalen != 1)
+                return -EINVAL;
         if (*(unsigned char *)data > 1)
                 return -ENOTSUPP;
         return 1;
@@ -114,8 +116,11 @@ int snmp_helper(void *context, size_t hdrlen, unsigned char tag,
                 const void *data, size_t datalen)
 {
         struct snmp_ctx *ctx = (struct snmp_ctx *)context;
-        __be32 *pdata = (__be32 *)data;
+        __be32 *pdata;
 
+        if (datalen != 4)
+                return -EINVAL;
+        pdata = (__be32 *)data;
         if (*pdata == ctx->from) {
                 pr_debug("%s: %pI4 to %pI4\n", __func__,
                          (void *)&ctx->from, (void *)&ctx->to);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index ce92f73cf104..5163b64f8fb3 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -887,13 +887,15 @@ void ip_rt_send_redirect(struct sk_buff *skb)
         /* No redirected packets during ip_rt_redirect_silence;
          * reset the algorithm.
          */
-        if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence))
+        if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence)) {
                 peer->rate_tokens = 0;
+                peer->n_redirects = 0;
+        }
 
         /* Too many ignored redirects; do not send anything
          * set dst.rate_last to the last seen redirected packet.
          */
-        if (peer->rate_tokens >= ip_rt_redirect_number) {
+        if (peer->n_redirects >= ip_rt_redirect_number) {
                 peer->rate_last = jiffies;
                 goto out_put_peer;
         }
@@ -910,6 +912,7 @@ void ip_rt_send_redirect(struct sk_buff *skb)
                 icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
                 peer->rate_last = jiffies;
                 ++peer->rate_tokens;
+                ++peer->n_redirects;
 #ifdef CONFIG_IP_ROUTE_VERBOSE
                 if (log_martians &&
                     peer->rate_tokens == ip_rt_redirect_number)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 84c358804355..72ffd3d760ff 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1165,7 +1165,8 @@ check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires)
         list_for_each_entry(ifa, &idev->addr_list, if_list) {
                 if (ifa == ifp)
                         continue;
-                if (!ipv6_prefix_equal(&ifa->addr, &ifp->addr,
+                if (ifa->prefix_len != ifp->prefix_len ||
+                    !ipv6_prefix_equal(&ifa->addr, &ifp->addr,
                                        ifp->prefix_len))
                         continue;
                 if (ifa->flags & (IFA_F_PERMANENT | IFA_F_NOPREFIXROUTE))
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 4416368dbd49..801a9a0c217e 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -2098,12 +2098,17 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
         struct __ip6_tnl_parm *p = &t->parms;
+        __be16 o_flags = p->o_flags;
+
+        if ((p->erspan_ver == 1 || p->erspan_ver == 2) &&
+            !p->collect_md)
+                o_flags |= TUNNEL_KEY;
 
         if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
             nla_put_be16(skb, IFLA_GRE_IFLAGS,
                          gre_tnl_flags_to_gre_flags(p->i_flags)) ||
             nla_put_be16(skb, IFLA_GRE_OFLAGS,
-                         gre_tnl_flags_to_gre_flags(p->o_flags)) ||
+                         gre_tnl_flags_to_gre_flags(o_flags)) ||
             nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) ||
             nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) ||
             nla_put_in6_addr(skb, IFLA_GRE_LOCAL, &p->laddr) ||
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 30337b38274b..cc01aa3f2b5e 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1516,6 +1516,9 @@ static void mroute_clean_tables(struct mr_table *mrt, bool all)
                         continue;
                 rhltable_remove(&mrt->mfc_hash, &c->mnode, ip6mr_rht_params);
                 list_del_rcu(&c->list);
+                call_ip6mr_mfc_entry_notifiers(read_pnet(&mrt->net),
+                                               FIB_EVENT_ENTRY_DEL,
+                                               (struct mfc6_cache *)c, mrt->id);
                 mr6_netlink_event(mrt, (struct mfc6_cache *)c, RTM_DELROUTE);
                 mr_cache_put(c);
         }
@@ -1524,10 +1527,6 @@ static void mroute_clean_tables(struct mr_table *mrt, bool all)
                 spin_lock_bh(&mfc_unres_lock);
                 list_for_each_entry_safe(c, tmp, &mrt->mfc_unres_queue, list) {
                         list_del(&c->list);
-                        call_ip6mr_mfc_entry_notifiers(read_pnet(&mrt->net),
-                                                       FIB_EVENT_ENTRY_DEL,
-                                                       (struct mfc6_cache *)c,
-                                                       mrt->id);
                         mr6_netlink_event(mrt, (struct mfc6_cache *)c,
                                           RTM_DELROUTE);
                         ip6mr_destroy_unres(mrt, (struct mfc6_cache *)c);
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 8b075f0bc351..6d0b1f3e927b 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -23,9 +23,11 @@ int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
         struct sock *sk = sk_to_full_sk(skb->sk);
         unsigned int hh_len;
         struct dst_entry *dst;
+        int strict = (ipv6_addr_type(&iph->daddr) &
+                      (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL));
         struct flowi6 fl6 = {
                 .flowi6_oif = sk && sk->sk_bound_dev_if ? sk->sk_bound_dev_if :
-                        rt6_need_strict(&iph->daddr) ? skb_dst(skb)->dev->ifindex : 0,
+                        strict ? skb_dst(skb)->dev->ifindex : 0,
                 .flowi6_mark = skb->mark,
                 .flowi6_uid = sock_net_uid(net, sk),
                 .daddr = iph->daddr,
diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
index 23022447eb49..7a41ee3c11b4 100644
--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
@@ -226,6 +226,7 @@ int nf_nat_icmpv6_reply_translation(struct sk_buff *skb,
         }
 
         nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
+        target.dst.protonum = IPPROTO_ICMPV6;
         if (!nf_nat_ipv6_manip_pkt(skb, 0, &target, manip))
                 return 0;
 
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index 8d0ba757a46c..9b2f272ca164 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -221,9 +221,7 @@ static int seg6_genl_get_tunsrc(struct sk_buff *skb, struct genl_info *info)
         rcu_read_unlock();
 
         genlmsg_end(msg, hdr);
-        genlmsg_reply(msg, info);
-
-        return 0;
+        return genlmsg_reply(msg, info);
 
 nla_put_failure:
         rcu_read_unlock();
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index 8181ee7e1e27..ee5403cbe655 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -146,6 +146,8 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
         } else {
                 ip6_flow_hdr(hdr, 0, flowlabel);
                 hdr->hop_limit = ip6_dst_hoplimit(skb_dst(skb));
+
+                memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
         }
 
         hdr->nexthdr = NEXTHDR_ROUTING;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 1e03305c0549..e8a1dabef803 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -546,7 +546,8 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
         }
 
         err = 0;
-        if (!ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4, type, data_len))
+        if (__in6_dev_get(skb->dev) &&
+            !ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4, type, data_len))
                 goto out;
 
         if (t->parms.iph.daddr == 0)
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 26f1d435696a..fed6becc5daf 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -83,8 +83,7 @@
 #define L2TP_SLFLAG_S      0x40000000
 #define L2TP_SL_SEQ_MASK   0x00ffffff
 
-#define L2TP_HDR_SIZE_SEQ               10
-#define L2TP_HDR_SIZE_NOSEQ             6
+#define L2TP_HDR_SIZE_MAX               14
 
 /* Default trace flags */
 #define L2TP_DEFAULT_DEBUG_FLAGS        0
@@ -808,7 +807,7 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb)
         __skb_pull(skb, sizeof(struct udphdr));
 
         /* Short packet? */
-        if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) {
+        if (!pskb_may_pull(skb, L2TP_HDR_SIZE_MAX)) {
                 l2tp_info(tunnel, L2TP_MSG_DATA,
                           "%s: recv short packet (len=%d)\n",
                           tunnel->name, skb->len);
@@ -884,6 +883,10 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb)
                 goto error;
         }
 
+        if (tunnel->version == L2TP_HDR_VER_3 &&
+            l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr))
+                goto error;
+
         l2tp_recv_common(session, skb, ptr, optr, hdrflags, length);
         l2tp_session_dec_refcount(session);
 
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 9c9afe94d389..b2ce90260c35 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -301,6 +301,26 @@ static inline bool l2tp_tunnel_uses_xfrm(const struct l2tp_tunnel *tunnel)
 }
 #endif
 
+static inline int l2tp_v3_ensure_opt_in_linear(struct l2tp_session *session, struct sk_buff *skb,
+                                               unsigned char **ptr, unsigned char **optr)
+{
+        int opt_len = session->peer_cookie_len + l2tp_get_l2specific_len(session);
+
+        if (opt_len > 0) {
+                int off = *ptr - *optr;
+
+                if (!pskb_may_pull(skb, off + opt_len))
+                        return -1;
+
+                if (skb->data != *optr) {
+                        *optr = skb->data;
+                        *ptr = skb->data + off;
+                }
+        }
+
+        return 0;
+}
+
 #define l2tp_printk(ptr, type, func, fmt, ...)                          \
 do {                                                                    \
         if (((ptr)->debug) & (type))                                    \
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 35f6f86d4dcc..d4c60523c549 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -165,6 +165,9 @@ static int l2tp_ip_recv(struct sk_buff *skb)
                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
         }
 
+        if (l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr))
+                goto discard_sess;
+
         l2tp_recv_common(session, skb, ptr, optr, 0, skb->len);
         l2tp_session_dec_refcount(session);
 
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 237f1a4a0b0c..0ae6899edac0 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -178,6 +178,9 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
         }
 
+        if (l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr))
+                goto discard_sess;
+
         l2tp_recv_common(session, skb, ptr, optr, 0, skb->len);
         l2tp_session_dec_refcount(session);
 
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 69e831bc317b..54821fb1a960 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -8,7 +8,7 @@
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2007-2010, Intel Corporation
  * Copyright(c) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -366,6 +366,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 
         set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
 
+        ieee80211_agg_stop_txq(sta, tid);
+
         spin_unlock_bh(&sta->lock);
 
         ht_dbg(sta->sdata, "Tx BA session stop requested for %pM tid %u\n",
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index f170d6c6629a..928f13a208b0 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1938,9 +1938,16 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
                                 int head_need, bool may_encrypt)
 {
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_hdr *hdr;
+        bool enc_tailroom;
         int tail_need = 0;
 
-        if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) {
+        hdr = (struct ieee80211_hdr *) skb->data;
+        enc_tailroom = may_encrypt &&
+                       (sdata->crypto_tx_tailroom_needed_cnt ||
+                        ieee80211_is_mgmt(hdr->frame_control));
+
+        if (enc_tailroom) {
                 tail_need = IEEE80211_ENCRYPT_TAILROOM;
                 tail_need -= skb_tailroom(skb);
                 tail_need = max_t(int, tail_need, 0);
@@ -1948,8 +1955,7 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
 
         if (skb_cloned(skb) &&
             (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) ||
-             !skb_clone_writable(skb, ETH_HLEN) ||
-             (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt)))
+             !skb_clone_writable(skb, ETH_HLEN) || enc_tailroom))
                 I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
         else if (head_need || tail_need)
                 I802_DEBUG_INC(local->tx_expand_skb_head);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index d0eb38b890aa..ba950ae974fc 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -5,7 +5,7 @@
  * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
  * Copyright 2013-2014  Intel Mobile Communications GmbH
  * Copyright (C) 2015-2017      Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -2146,6 +2146,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 case NL80211_IFTYPE_AP_VLAN:
                 case NL80211_IFTYPE_MONITOR:
                         break;
+                case NL80211_IFTYPE_ADHOC:
+                        if (sdata->vif.bss_conf.ibss_joined)
+                                WARN_ON(drv_join_ibss(local, sdata));
+                        /* fall through */
                 default:
                         ieee80211_reconfig_stations(sdata);
                         /* fall through */
diff --git a/net/netfilter/ipvs/Kconfig b/net/netfilter/ipvs/Kconfig
index cad48d07c818..8401cefd9f65 100644
--- a/net/netfilter/ipvs/Kconfig
+++ b/net/netfilter/ipvs/Kconfig
@@ -29,6 +29,7 @@ config	IP_VS_IPV6
         bool "IPv6 support for IPVS"
         depends on IPV6 = y || IP_VS = IPV6
         select IP6_NF_IPTABLES
+        select NF_DEFRAG_IPV6
         ---help---
           Add IPv6 support to IPVS.
 
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index fe9abf3cc10a..235205c93e14 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1536,14 +1536,12 @@ ip_vs_try_to_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
                 /* sorry, all this trouble for a no-hit :) */
                 IP_VS_DBG_PKT(12, af, pp, skb, iph->off,
                               "ip_vs_in: packet continues traversal as normal");
-                if (iph->fragoffs) {
-                        /* Fragment that couldn't be mapped to a conn entry
-                         * is missing module nf_defrag_ipv6
-                         */
-                        IP_VS_DBG_RL("Unhandled frag, load nf_defrag_ipv6\n");
+
+                /* Fragment couldn't be mapped to a conn entry */
+                if (iph->fragoffs)
                         IP_VS_DBG_PKT(7, af, pp, skb, iph->off,
                                       "unhandled fragment");
-                }
+
                 *verdict = NF_ACCEPT;
                 return 0;
         }
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 432141f04af3..86afacb07e5f 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -43,6 +43,7 @@
 #ifdef CONFIG_IP_VS_IPV6
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
+#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 #endif
 #include <net/route.h>
 #include <net/sock.h>
@@ -895,6 +896,7 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
 {
         struct ip_vs_dest *dest;
         unsigned int atype, i;
+        int ret = 0;
 
         EnterFunction(2);
 
@@ -905,6 +907,10 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
                         atype & IPV6_ADDR_LINKLOCAL) &&
                         !__ip_vs_addr_is_local_v6(svc->ipvs->net, &udest->addr.in6))
                         return -EINVAL;
+
+                ret = nf_defrag_ipv6_enable(svc->ipvs->net);
+                if (ret)
+                        return ret;
         } else
 #endif
         {
@@ -1228,6 +1234,10 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
                         ret = -EINVAL;
                         goto out_err;
                 }
+
+                ret = nf_defrag_ipv6_enable(ipvs->net);
+                if (ret)
+                        goto out_err;
         }
 #endif
 
@@ -2221,6 +2231,18 @@ static int ip_vs_set_timeout(struct netns_ipvs *ipvs, struct ip_vs_timeout_user
                   u->udp_timeout);
 
 #ifdef CONFIG_IP_VS_PROTO_TCP
+        if (u->tcp_timeout < 0 || u->tcp_timeout > (INT_MAX / HZ) ||
+            u->tcp_fin_timeout < 0 || u->tcp_fin_timeout > (INT_MAX / HZ)) {
+                return -EINVAL;
+        }
+#endif
+
+#ifdef CONFIG_IP_VS_PROTO_UDP
+        if (u->udp_timeout < 0 || u->udp_timeout > (INT_MAX / HZ))
+                return -EINVAL;
+#endif
+
+#ifdef CONFIG_IP_VS_PROTO_TCP
         if (u->tcp_timeout) {
                 pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP);
                 pd->timeout_table[IP_VS_TCP_S_ESTABLISHED]
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 741b533148ba..db4d46332e86 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1007,6 +1007,22 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
                 }
 
                 if (nf_ct_key_equal(h, tuple, zone, net)) {
+                        /* Tuple is taken already, so caller will need to find
+                         * a new source port to use.
+                         *
+                         * Only exception:
+                         * If the *original tuples* are identical, then both
+                         * conntracks refer to the same flow.
+                         * This is a rare situation, it can occur e.g. when
+                         * more than one UDP packet is sent from same socket
+                         * in different threads.
+                         *
+                         * Let nf_ct_resolve_clash() deal with this later.
+                         */
+                        if (nf_ct_tuple_equal(&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+                                              &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple))
+                                continue;
+
                         NF_CT_STAT_INC_ATOMIC(net, found);
                         rcu_read_unlock();
                         return 1;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index fb07f6cfc719..5a92f23f179f 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -116,6 +116,23 @@ static void nft_trans_destroy(struct nft_trans *trans)
         kfree(trans);
 }
 
+static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
+{
+        struct net *net = ctx->net;
+        struct nft_trans *trans;
+
+        if (!nft_set_is_anonymous(set))
+                return;
+
+        list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
+                if (trans->msg_type == NFT_MSG_NEWSET &&
+                    nft_trans_set(trans) == set) {
+                        nft_trans_set_bound(trans) = true;
+                        break;
+                }
+        }
+}
+
 static int nf_tables_register_hook(struct net *net,
                                    const struct nft_table *table,
                                    struct nft_chain *chain)
@@ -211,18 +228,6 @@ static int nft_delchain(struct nft_ctx *ctx)
         return err;
 }
 
-/* either expr ops provide both activate/deactivate, or neither */
-static bool nft_expr_check_ops(const struct nft_expr_ops *ops)
-{
-        if (!ops)
-                return true;
-
-        if (WARN_ON_ONCE((!ops->activate ^ !ops->deactivate)))
-                return false;
-
-        return true;
-}
-
 static void nft_rule_expr_activate(const struct nft_ctx *ctx,
                                    struct nft_rule *rule)
 {
@@ -238,14 +243,15 @@ static void nft_rule_expr_activate(const struct nft_ctx *ctx,
 }
 
 static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
-                                     struct nft_rule *rule)
+                                     struct nft_rule *rule,
+                                     enum nft_trans_phase phase)
 {
         struct nft_expr *expr;
 
         expr = nft_expr_first(rule);
         while (expr != nft_expr_last(rule) && expr->ops) {
                 if (expr->ops->deactivate)
-                        expr->ops->deactivate(ctx, expr);
+                        expr->ops->deactivate(ctx, expr, phase);
 
                 expr = nft_expr_next(expr);
         }
@@ -296,7 +302,7 @@ static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
                 nft_trans_destroy(trans);
                 return err;
         }
-        nft_rule_expr_deactivate(ctx, rule);
+        nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE);
 
         return 0;
 }
@@ -1929,9 +1935,6 @@ static int nf_tables_delchain(struct net *net, struct sock *nlsk,
  */
 int nft_register_expr(struct nft_expr_type *type)
 {
-        if (!nft_expr_check_ops(type->ops))
-                return -EINVAL;
-
         nfnl_lock(NFNL_SUBSYS_NFTABLES);
         if (type->family == NFPROTO_UNSPEC)
                 list_add_tail_rcu(&type->list, &nf_tables_expressions);
@@ -2079,10 +2082,6 @@ static int nf_tables_expr_parse(const struct nft_ctx *ctx,
                         err = PTR_ERR(ops);
                         goto err1;
                 }
-                if (!nft_expr_check_ops(ops)) {
-                        err = -EINVAL;
-                        goto err1;
-                }
         } else
                 ops = type->ops;
 
@@ -2511,7 +2510,7 @@ static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
 static void nf_tables_rule_release(const struct nft_ctx *ctx,
                                    struct nft_rule *rule)
 {
-        nft_rule_expr_deactivate(ctx, rule);
+        nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE);
         nf_tables_rule_destroy(ctx, rule);
 }
 
@@ -3708,39 +3707,30 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
 bind:
         binding->chain = ctx->chain;
         list_add_tail_rcu(&binding->list, &set->bindings);
+        nft_set_trans_bind(ctx, set);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(nf_tables_bind_set);
 
-void nf_tables_rebind_set(const struct nft_ctx *ctx, struct nft_set *set,
-                          struct nft_set_binding *binding)
-{
-        if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
-            nft_is_active(ctx->net, set))
-                list_add_tail_rcu(&set->list, &ctx->table->sets);
-
-        list_add_tail_rcu(&binding->list, &set->bindings);
-}
-EXPORT_SYMBOL_GPL(nf_tables_rebind_set);
-
 void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
-                          struct nft_set_binding *binding)
+                          struct nft_set_binding *binding, bool event)
 {
         list_del_rcu(&binding->list);
 
-        if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
-            nft_is_active(ctx->net, set))
+        if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) {
                 list_del_rcu(&set->list);
+                if (event)
+                        nf_tables_set_notify(ctx, set, NFT_MSG_DELSET,
+                                             GFP_KERNEL);
+        }
 }
 EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
 
 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set)
 {
-        if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
-            nft_is_active(ctx->net, set)) {
-                nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
+        if (list_empty(&set->bindings) && nft_set_is_anonymous(set))
                 nft_set_destroy(set);
-        }
 }
 EXPORT_SYMBOL_GPL(nf_tables_destroy_set);
 
@@ -6535,6 +6525,9 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
                         nf_tables_rule_notify(&trans->ctx,
                                               nft_trans_rule(trans),
                                               NFT_MSG_DELRULE);
+                        nft_rule_expr_deactivate(&trans->ctx,
+                                                 nft_trans_rule(trans),
+                                                 NFT_TRANS_COMMIT);
                         break;
                 case NFT_MSG_NEWSET:
                         nft_clear(net, nft_trans_set(trans));
@@ -6621,7 +6614,8 @@ static void nf_tables_abort_release(struct nft_trans *trans)
                 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
                 break;
         case NFT_MSG_NEWSET:
-                nft_set_destroy(nft_trans_set(trans));
+                if (!nft_trans_set_bound(trans))
+                        nft_set_destroy(nft_trans_set(trans));
                 break;
         case NFT_MSG_NEWSETELEM:
                 nft_set_elem_destroy(nft_trans_elem_set(trans),
@@ -6682,7 +6676,9 @@ static int __nf_tables_abort(struct net *net)
                 case NFT_MSG_NEWRULE:
                         trans->ctx.chain->use--;
                         list_del_rcu(&nft_trans_rule(trans)->list);
-                        nft_rule_expr_deactivate(&trans->ctx, nft_trans_rule(trans));
+                        nft_rule_expr_deactivate(&trans->ctx,
+                                                 nft_trans_rule(trans),
+                                                 NFT_TRANS_ABORT);
                         break;
                 case NFT_MSG_DELRULE:
                         trans->ctx.chain->use++;
@@ -6692,7 +6688,8 @@ static int __nf_tables_abort(struct net *net)
                         break;
                 case NFT_MSG_NEWSET:
                         trans->ctx.table->use--;
-                        list_del_rcu(&nft_trans_set(trans)->list);
+                        if (!nft_trans_set_bound(trans))
+                                list_del_rcu(&nft_trans_set(trans)->list);
                         break;
                 case NFT_MSG_DELSET:
                         trans->ctx.table->use++;
diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
index 6f41dd74729d..1f1d90c1716b 100644
--- a/net/netfilter/nfnetlink_osf.c
+++ b/net/netfilter/nfnetlink_osf.c
@@ -66,6 +66,7 @@ static bool nf_osf_match_one(const struct sk_buff *skb,
                              int ttl_check,
                              struct nf_osf_hdr_ctx *ctx)
 {
+        const __u8 *optpinit = ctx->optp;
         unsigned int check_WSS = 0;
         int fmatch = FMATCH_WRONG;
         int foptsize, optnum;
@@ -155,6 +156,9 @@ static bool nf_osf_match_one(const struct sk_buff *skb,
                 }
         }
 
+        if (fmatch != FMATCH_OK)
+                ctx->optp = optpinit;
+
         return fmatch == FMATCH_OK;
 }
 
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 7334e0b80a5e..0a4bad55a8aa 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -22,11 +22,15 @@
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_arp/arp_tables.h>
 #include <net/netfilter/nf_tables.h>
+#include <net/netns/generic.h>
 
 struct nft_xt {
         struct list_head        head;
         struct nft_expr_ops     ops;
-        unsigned int            refcnt;
+        refcount_t              refcnt;
+
+        /* used only when transaction mutex is locked */
+        unsigned int            listcnt;
 
         /* Unlike other expressions, ops doesn't have static storage duration.
          * nft core assumes they do.  We use kfree_rcu so that nft core can
@@ -43,10 +47,39 @@ struct nft_xt_match_priv {
         void *info;
 };
 
+struct nft_compat_net {
+        struct list_head nft_target_list;
+        struct list_head nft_match_list;
+};
+
+static unsigned int nft_compat_net_id __read_mostly;
+static struct nft_expr_type nft_match_type;
+static struct nft_expr_type nft_target_type;
+
+static struct nft_compat_net *nft_compat_pernet(struct net *net)
+{
+        return net_generic(net, nft_compat_net_id);
+}
+
+static void nft_xt_get(struct nft_xt *xt)
+{
+        /* refcount_inc() warns on 0 -> 1 transition, but we can't
+         * init the reference count to 1 in .select_ops -- we can't
+         * undo such an increase when another expression inside the same
+         * rule fails afterwards.
+         */
+        if (xt->listcnt == 0)
+                refcount_set(&xt->refcnt, 1);
+        else
+                refcount_inc(&xt->refcnt);
+
+        xt->listcnt++;
+}
+
 static bool nft_xt_put(struct nft_xt *xt)
 {
-        if (--xt->refcnt == 0) {
-                list_del(&xt->head);
+        if (refcount_dec_and_test(&xt->refcnt)) {
+                WARN_ON_ONCE(!list_empty(&xt->head));
                 kfree_rcu(xt, rcu_head);
                 return true;
         }
@@ -273,7 +306,7 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
                 return -EINVAL;
 
         nft_xt = container_of(expr->ops, struct nft_xt, ops);
-        nft_xt->refcnt++;
+        nft_xt_get(nft_xt);
         return 0;
 }
 
@@ -282,6 +315,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
         struct xt_target *target = expr->ops->data;
         void *info = nft_expr_priv(expr);
+        struct module *me = target->me;
         struct xt_tgdtor_param par;
 
         par.net = ctx->net;
@@ -292,7 +326,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
                 par.target->destroy(&par);
 
         if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops)))
-                module_put(target->me);
+                module_put(me);
 }
 
 static int nft_extension_dump_info(struct sk_buff *skb, int attr,
@@ -486,7 +520,7 @@ __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
                 return ret;
 
         nft_xt = container_of(expr->ops, struct nft_xt, ops);
-        nft_xt->refcnt++;
+        nft_xt_get(nft_xt);
         return 0;
 }
 
@@ -540,6 +574,18 @@ nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
         __nft_match_destroy(ctx, expr, nft_expr_priv(expr));
 }
 
+static void nft_compat_deactivate(const struct nft_ctx *ctx,
+                                  const struct nft_expr *expr,
+                                  enum nft_trans_phase phase)
+{
+        struct nft_xt *xt = container_of(expr->ops, struct nft_xt, ops);
+
+        if (phase == NFT_TRANS_ABORT || phase == NFT_TRANS_COMMIT) {
+                if (--xt->listcnt == 0)
+                        list_del_init(&xt->head);
+        }
+}
+
 static void
 nft_match_large_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
@@ -734,10 +780,6 @@ static const struct nfnetlink_subsystem nfnl_compat_subsys = {
         .cb             = nfnl_nft_compat_cb,
 };
 
-static LIST_HEAD(nft_match_list);
-
-static struct nft_expr_type nft_match_type;
-
 static bool nft_match_cmp(const struct xt_match *match,
                           const char *name, u32 rev, u32 family)
 {
@@ -749,6 +791,7 @@ static const struct nft_expr_ops *
 nft_match_select_ops(const struct nft_ctx *ctx,
                      const struct nlattr * const tb[])
 {
+        struct nft_compat_net *cn;
         struct nft_xt *nft_match;
         struct xt_match *match;
         unsigned int matchsize;
@@ -765,8 +808,10 @@ nft_match_select_ops(const struct nft_ctx *ctx,
         rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV]));
         family = ctx->family;
 
+        cn = nft_compat_pernet(ctx->net);
+
         /* Re-use the existing match if it's already loaded. */
-        list_for_each_entry(nft_match, &nft_match_list, head) {
+        list_for_each_entry(nft_match, &cn->nft_match_list, head) {
                 struct xt_match *match = nft_match->ops.data;
 
                 if (nft_match_cmp(match, mt_name, rev, family))
@@ -789,11 +834,12 @@ nft_match_select_ops(const struct nft_ctx *ctx,
                 goto err;
         }
 
-        nft_match->refcnt = 0;
+        refcount_set(&nft_match->refcnt, 0);
         nft_match->ops.type = &nft_match_type;
         nft_match->ops.eval = nft_match_eval;
         nft_match->ops.init = nft_match_init;
         nft_match->ops.destroy = nft_match_destroy;
+        nft_match->ops.deactivate = nft_compat_deactivate;
         nft_match->ops.dump = nft_match_dump;
         nft_match->ops.validate = nft_match_validate;
         nft_match->ops.data = match;
@@ -810,7 +856,8 @@ nft_match_select_ops(const struct nft_ctx *ctx,
 
         nft_match->ops.size = matchsize;
 
-        list_add(&nft_match->head, &nft_match_list);
+        nft_match->listcnt = 0;
+        list_add(&nft_match->head, &cn->nft_match_list);
 
         return &nft_match->ops;
 err:
@@ -826,10 +873,6 @@ static struct nft_expr_type nft_match_type __read_mostly = {
         .owner          = THIS_MODULE,
 };
 
-static LIST_HEAD(nft_target_list);
-
-static struct nft_expr_type nft_target_type;
-
 static bool nft_target_cmp(const struct xt_target *tg,
                            const char *name, u32 rev, u32 family)
 {
@@ -841,6 +884,7 @@ static const struct nft_expr_ops *
 nft_target_select_ops(const struct nft_ctx *ctx,
                       const struct nlattr * const tb[])
 {
+        struct nft_compat_net *cn;
         struct nft_xt *nft_target;
         struct xt_target *target;
         char *tg_name;
@@ -861,8 +905,9 @@ nft_target_select_ops(const struct nft_ctx *ctx,
             strcmp(tg_name, "standard") == 0)
                 return ERR_PTR(-EINVAL);
 
+        cn = nft_compat_pernet(ctx->net);
         /* Re-use the existing target if it's already loaded. */
-        list_for_each_entry(nft_target, &nft_target_list, head) {
+        list_for_each_entry(nft_target, &cn->nft_target_list, head) {
                 struct xt_target *target = nft_target->ops.data;
 
                 if (!target->target)
@@ -893,11 +938,12 @@ nft_target_select_ops(const struct nft_ctx *ctx,
                 goto err;
         }
 
-        nft_target->refcnt = 0;
+        refcount_set(&nft_target->refcnt, 0);
         nft_target->ops.type = &nft_target_type;
         nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));
         nft_target->ops.init = nft_target_init;
         nft_target->ops.destroy = nft_target_destroy;
+        nft_target->ops.deactivate = nft_compat_deactivate;
         nft_target->ops.dump = nft_target_dump;
         nft_target->ops.validate = nft_target_validate;
         nft_target->ops.data = target;
@@ -907,7 +953,8 @@ nft_target_select_ops(const struct nft_ctx *ctx,
         else
                 nft_target->ops.eval = nft_target_eval_xt;
 
-        list_add(&nft_target->head, &nft_target_list);
+        nft_target->listcnt = 0;
+        list_add(&nft_target->head, &cn->nft_target_list);
 
         return &nft_target->ops;
 err:
@@ -923,13 +970,74 @@ static struct nft_expr_type nft_target_type __read_mostly = {
         .owner          = THIS_MODULE,
 };
 
+static int __net_init nft_compat_init_net(struct net *net)
+{
+        struct nft_compat_net *cn = nft_compat_pernet(net);
+
+        INIT_LIST_HEAD(&cn->nft_target_list);
+        INIT_LIST_HEAD(&cn->nft_match_list);
+
+        return 0;
+}
+
+static void __net_exit nft_compat_exit_net(struct net *net)
+{
+        struct nft_compat_net *cn = nft_compat_pernet(net);
+        struct nft_xt *xt, *next;
+
+        if (list_empty(&cn->nft_match_list) &&
+            list_empty(&cn->nft_target_list))
+                return;
+
+        /* If there was an error that caused nft_xt expr to not be initialized
+         * fully and noone else requested the same expression later, the lists
+         * contain 0-refcount entries that still hold module reference.
+         *
+         * Clean them here.
+         */
+        mutex_lock(&net->nft.commit_mutex);
+        list_for_each_entry_safe(xt, next, &cn->nft_target_list, head) {
+                struct xt_target *target = xt->ops.data;
+
+                list_del_init(&xt->head);
+
+                if (refcount_read(&xt->refcnt))
+                        continue;
+                module_put(target->me);
+                kfree(xt);
+        }
+
+        list_for_each_entry_safe(xt, next, &cn->nft_match_list, head) {
+                struct xt_match *match = xt->ops.data;
+
+                list_del_init(&xt->head);
+
+                if (refcount_read(&xt->refcnt))
+                        continue;
+                module_put(match->me);
+                kfree(xt);
+        }
+        mutex_unlock(&net->nft.commit_mutex);
+}
+
+static struct pernet_operations nft_compat_net_ops = {
+        .init   = nft_compat_init_net,
+        .exit   = nft_compat_exit_net,
+        .id     = &nft_compat_net_id,
+        .size   = sizeof(struct nft_compat_net),
+};
+
 static int __init nft_compat_module_init(void)
 {
         int ret;
 
+        ret = register_pernet_subsys(&nft_compat_net_ops);
+        if (ret < 0)
+                goto err_target;
+
         ret = nft_register_expr(&nft_match_type);
         if (ret < 0)
-                return ret;
+                goto err_pernet;
 
         ret = nft_register_expr(&nft_target_type);
         if (ret < 0)
@@ -942,45 +1050,21 @@ static int __init nft_compat_module_init(void)
         }
 
         return ret;
-
 err_target:
         nft_unregister_expr(&nft_target_type);
 err_match:
         nft_unregister_expr(&nft_match_type);
+err_pernet:
+        unregister_pernet_subsys(&nft_compat_net_ops);
         return ret;
 }
 
 static void __exit nft_compat_module_exit(void)
 {
-        struct nft_xt *xt, *next;
-
-        /* list should be empty here, it can be non-empty only in case there
-         * was an error that caused nft_xt expr to not be initialized fully
-         * and noone else requested the same expression later.
-         *
-         * In this case, the lists contain 0-refcount entries that still
-         * hold module reference.
-         */
-        list_for_each_entry_safe(xt, next, &nft_target_list, head) {
-                struct xt_target *target = xt->ops.data;
-
-                if (WARN_ON_ONCE(xt->refcnt))
-                        continue;
-                module_put(target->me);
-                kfree(xt);
-        }
-
-        list_for_each_entry_safe(xt, next, &nft_match_list, head) {
-                struct xt_match *match = xt->ops.data;
-
-                if (WARN_ON_ONCE(xt->refcnt))
-                        continue;
-                module_put(match->me);
-                kfree(xt);
-        }
         nfnetlink_subsys_unregister(&nfnl_compat_subsys);
         nft_unregister_expr(&nft_target_type);
         nft_unregister_expr(&nft_match_type);
+        unregister_pernet_subsys(&nft_compat_net_ops);
 }
 
 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT);
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 07d4efd3d851..f1172f99752b 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -235,20 +235,17 @@ err1:
         return err;
 }
 
-static void nft_dynset_activate(const struct nft_ctx *ctx,
-                                const struct nft_expr *expr)
-{
-        struct nft_dynset *priv = nft_expr_priv(expr);
-
-        nf_tables_rebind_set(ctx, priv->set, &priv->binding);
-}
-
 static void nft_dynset_deactivate(const struct nft_ctx *ctx,
-                                  const struct nft_expr *expr)
+                                  const struct nft_expr *expr,
+                                  enum nft_trans_phase phase)
 {
         struct nft_dynset *priv = nft_expr_priv(expr);
 
-        nf_tables_unbind_set(ctx, priv->set, &priv->binding);
+        if (phase == NFT_TRANS_PREPARE)
+                return;
+
+        nf_tables_unbind_set(ctx, priv->set, &priv->binding,
+                             phase == NFT_TRANS_COMMIT);
 }
 
 static void nft_dynset_destroy(const struct nft_ctx *ctx,
@@ -296,7 +293,6 @@ static const struct nft_expr_ops nft_dynset_ops = {
         .eval           = nft_dynset_eval,
         .init           = nft_dynset_init,
         .destroy        = nft_dynset_destroy,
-        .activate       = nft_dynset_activate,
         .deactivate     = nft_dynset_deactivate,
         .dump           = nft_dynset_dump,
 };
diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index 0777a93211e2..3f6d1d2a6281 100644
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -72,10 +72,14 @@ static void nft_immediate_activate(const struct nft_ctx *ctx,
 }
 
 static void nft_immediate_deactivate(const struct nft_ctx *ctx,
-                                     const struct nft_expr *expr)
+                                     const struct nft_expr *expr,
+                                     enum nft_trans_phase phase)
 {
         const struct nft_immediate_expr *priv = nft_expr_priv(expr);
 
+        if (phase == NFT_TRANS_COMMIT)
+                return;
+
         return nft_data_release(&priv->data, nft_dreg_to_type(priv->dreg));
 }
 
diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
index 227b2b15a19c..14496da5141d 100644
--- a/net/netfilter/nft_lookup.c
+++ b/net/netfilter/nft_lookup.c
@@ -121,20 +121,17 @@ static int nft_lookup_init(const struct nft_ctx *ctx,
         return 0;
 }
 
-static void nft_lookup_activate(const struct nft_ctx *ctx,
-                                const struct nft_expr *expr)
-{
-        struct nft_lookup *priv = nft_expr_priv(expr);
-
-        nf_tables_rebind_set(ctx, priv->set, &priv->binding);
-}
-
 static void nft_lookup_deactivate(const struct nft_ctx *ctx,
-                                  const struct nft_expr *expr)
+                                  const struct nft_expr *expr,
+                                  enum nft_trans_phase phase)
 {
         struct nft_lookup *priv = nft_expr_priv(expr);
 
-        nf_tables_unbind_set(ctx, priv->set, &priv->binding);
+        if (phase == NFT_TRANS_PREPARE)
+                return;
+
+        nf_tables_unbind_set(ctx, priv->set, &priv->binding,
+                             phase == NFT_TRANS_COMMIT);
 }
 
 static void nft_lookup_destroy(const struct nft_ctx *ctx,
@@ -225,7 +222,6 @@ static const struct nft_expr_ops nft_lookup_ops = {
         .size           = NFT_EXPR_SIZE(sizeof(struct nft_lookup)),
         .eval           = nft_lookup_eval,
         .init           = nft_lookup_init,
-        .activate       = nft_lookup_activate,
         .deactivate     = nft_lookup_deactivate,
         .destroy        = nft_lookup_destroy,
         .dump           = nft_lookup_dump,
diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
index a3185ca2a3a9..ae178e914486 100644
--- a/net/netfilter/nft_objref.c
+++ b/net/netfilter/nft_objref.c
@@ -155,20 +155,17 @@ nla_put_failure:
         return -1;
 }
 
-static void nft_objref_map_activate(const struct nft_ctx *ctx,
-                                    const struct nft_expr *expr)
-{
-        struct nft_objref_map *priv = nft_expr_priv(expr);
-
-        nf_tables_rebind_set(ctx, priv->set, &priv->binding);
-}
-
 static void nft_objref_map_deactivate(const struct nft_ctx *ctx,
-                                      const struct nft_expr *expr)
+                                      const struct nft_expr *expr,
+                                      enum nft_trans_phase phase)
 {
         struct nft_objref_map *priv = nft_expr_priv(expr);
 
-        nf_tables_unbind_set(ctx, priv->set, &priv->binding);
+        if (phase == NFT_TRANS_PREPARE)
+                return;
+
+        nf_tables_unbind_set(ctx, priv->set, &priv->binding,
+                             phase == NFT_TRANS_COMMIT);
 }
 
 static void nft_objref_map_destroy(const struct nft_ctx *ctx,
@@ -185,7 +182,6 @@ static const struct nft_expr_ops nft_objref_map_ops = {
         .size           = NFT_EXPR_SIZE(sizeof(struct nft_objref_map)),
         .eval           = nft_objref_map_eval,
         .init           = nft_objref_map_init,
-        .activate       = nft_objref_map_activate,
         .deactivate     = nft_objref_map_deactivate,
         .destroy        = nft_objref_map_destroy,
         .dump           = nft_objref_map_dump,
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index aecadd471e1d..13e1ac333fa4 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1899,7 +1899,7 @@ static int __init xt_init(void)
                 seqcount_init(&per_cpu(xt_recseq, i));
         }
 
-        xt = kmalloc_array(NFPROTO_NUMPROTO, sizeof(struct xt_af), GFP_KERNEL);
+        xt = kcalloc(NFPROTO_NUMPROTO, sizeof(struct xt_af), GFP_KERNEL);
         if (!xt)
                 return -ENOMEM;
 
diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c
index cbd51ed5a2d7..908e53ab47a4 100644
--- a/net/netrom/nr_timer.c
+++ b/net/netrom/nr_timer.c
@@ -52,21 +52,21 @@ void nr_start_t1timer(struct sock *sk)
 {
         struct nr_sock *nr = nr_sk(sk);
 
-        mod_timer(&nr->t1timer, jiffies + nr->t1);
+        sk_reset_timer(sk, &nr->t1timer, jiffies + nr->t1);
 }
 
 void nr_start_t2timer(struct sock *sk)
 {
         struct nr_sock *nr = nr_sk(sk);
 
-        mod_timer(&nr->t2timer, jiffies + nr->t2);
+        sk_reset_timer(sk, &nr->t2timer, jiffies + nr->t2);
 }
 
 void nr_start_t4timer(struct sock *sk)
 {
         struct nr_sock *nr = nr_sk(sk);
 
-        mod_timer(&nr->t4timer, jiffies + nr->t4);
+        sk_reset_timer(sk, &nr->t4timer, jiffies + nr->t4);
 }
 
 void nr_start_idletimer(struct sock *sk)
@@ -74,37 +74,37 @@ void nr_start_idletimer(struct sock *sk)
         struct nr_sock *nr = nr_sk(sk);
 
         if (nr->idle > 0)
-                mod_timer(&nr->idletimer, jiffies + nr->idle);
+                sk_reset_timer(sk, &nr->idletimer, jiffies + nr->idle);
 }
 
 void nr_start_heartbeat(struct sock *sk)
 {
-        mod_timer(&sk->sk_timer, jiffies + 5 * HZ);
+        sk_reset_timer(sk, &sk->sk_timer, jiffies + 5 * HZ);
 }
 
 void nr_stop_t1timer(struct sock *sk)
 {
-        del_timer(&nr_sk(sk)->t1timer);
+        sk_stop_timer(sk, &nr_sk(sk)->t1timer);
 }
 
 void nr_stop_t2timer(struct sock *sk)
 {
-        del_timer(&nr_sk(sk)->t2timer);
+        sk_stop_timer(sk, &nr_sk(sk)->t2timer);
 }
 
 void nr_stop_t4timer(struct sock *sk)
 {
-        del_timer(&nr_sk(sk)->t4timer);
+        sk_stop_timer(sk, &nr_sk(sk)->t4timer);
 }
 
 void nr_stop_idletimer(struct sock *sk)
 {
-        del_timer(&nr_sk(sk)->idletimer);
+        sk_stop_timer(sk, &nr_sk(sk)->idletimer);
 }
 
 void nr_stop_heartbeat(struct sock *sk)
 {
-        del_timer(&sk->sk_timer);
+        sk_stop_timer(sk, &sk->sk_timer);
 }
 
 int nr_t1timer_running(struct sock *sk)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 3b1a78906bc0..1cd1d83a4be0 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4292,7 +4292,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 rb->frames_per_block = req->tp_block_size / req->tp_frame_size;
                 if (unlikely(rb->frames_per_block == 0))
                         goto out;
-                if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr))
+                if (unlikely(rb->frames_per_block > UINT_MAX / req->tp_block_nr))
                         goto out;
                 if (unlikely((rb->frames_per_block * req->tp_block_nr) !=
                                         req->tp_frame_nr))
diff --git a/net/rds/bind.c b/net/rds/bind.c
index 762d2c6788a3..17c9d9f0c848 100644
--- a/net/rds/bind.c
+++ b/net/rds/bind.c
@@ -78,10 +78,10 @@ struct rds_sock *rds_find_bound(const struct in6_addr *addr, __be16 port,
         __rds_create_bind_key(key, addr, port, scope_id);
         rcu_read_lock();
         rs = rhashtable_lookup(&bind_hash_table, key, ht_parms);
-        if (rs && !sock_flag(rds_rs_to_sk(rs), SOCK_DEAD))
-                rds_sock_addref(rs);
-        else
+        if (rs && (sock_flag(rds_rs_to_sk(rs), SOCK_DEAD) ||
+                   !refcount_inc_not_zero(&rds_rs_to_sk(rs)->sk_refcnt)))
                 rs = NULL;
+
         rcu_read_unlock();
 
         rdsdebug("returning rs %p for %pI6c:%u\n", rs, addr,
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index 77e9f85a2c92..f2ff21d7df08 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -850,6 +850,7 @@ void rose_link_device_down(struct net_device *dev)
 
 /*
  *      Route a frame to an appropriate AX.25 connection.
+ *      A NULL ax25_cb indicates an internally generated frame.
  */
 int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
 {
@@ -867,6 +868,10 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
 
         if (skb->len < ROSE_MIN_LEN)
                 return res;
+
+        if (!ax25)
+                return rose_loopback_queue(skb, NULL);
+
         frametype = skb->data[2];
         lci = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
         if (frametype == ROSE_CALL_REQUEST &&
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index eaf19ebaa964..3f7bb11f3290 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -596,6 +596,7 @@ error_requeue_call:
         }
 error_no_call:
         release_sock(&rx->sk);
+error_trace:
         trace_rxrpc_recvmsg(call, rxrpc_recvmsg_return, 0, 0, 0, ret);
         return ret;
 
@@ -604,7 +605,7 @@ wait_interrupted:
 wait_error:
         finish_wait(sk_sleep(&rx->sk), &wait);
         call = NULL;
-        goto error_no_call;
+        goto error_trace;
 }
 
 /**
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index f6aa57fbbbaf..12ca9d13db83 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -1371,7 +1371,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
         if (!tc_skip_hw(fnew->flags)) {
                 err = fl_hw_replace_filter(tp, fnew, extack);
                 if (err)
-                        goto errout_mask;
+                        goto errout_mask_ht;
         }
 
         if (!tc_in_hw(fnew->flags))
@@ -1401,6 +1401,10 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
         kfree(mask);
         return 0;
 
+errout_mask_ht:
+        rhashtable_remove_fast(&fnew->mask->ht, &fnew->ht_node,
+                               fnew->mask->filter_ht_params);
+
 errout_mask:
         fl_mask_put(head, fnew->mask, false);
 
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 9ccc93f257db..38bb882bb958 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -48,7 +48,7 @@ struct tcindex_data {
         u32 hash;               /* hash table size; 0 if undefined */
         u32 alloc_hash;         /* allocated size */
         u32 fall_through;       /* 0: only classify if explicit match */
-        struct rcu_head rcu;
+        struct rcu_work rwork;
 };
 
 static inline int tcindex_filter_is_set(struct tcindex_filter_result *r)
@@ -221,17 +221,11 @@ found:
         return 0;
 }
 
-static int tcindex_destroy_element(struct tcf_proto *tp,
-                                   void *arg, struct tcf_walker *walker)
-{
-        bool last;
-
-        return tcindex_delete(tp, arg, &last, NULL);
-}
-
-static void __tcindex_destroy(struct rcu_head *head)
+static void tcindex_destroy_work(struct work_struct *work)
 {
-        struct tcindex_data *p = container_of(head, struct tcindex_data, rcu);
+        struct tcindex_data *p = container_of(to_rcu_work(work),
+                                              struct tcindex_data,
+                                              rwork);
 
         kfree(p->perfect);
         kfree(p->h);
@@ -258,9 +252,11 @@ static int tcindex_filter_result_init(struct tcindex_filter_result *r)
         return tcf_exts_init(&r->exts, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
 }
 
-static void __tcindex_partial_destroy(struct rcu_head *head)
+static void tcindex_partial_destroy_work(struct work_struct *work)
 {
-        struct tcindex_data *p = container_of(head, struct tcindex_data, rcu);
+        struct tcindex_data *p = container_of(to_rcu_work(work),
+                                              struct tcindex_data,
+                                              rwork);
 
         kfree(p->perfect);
         kfree(p);
@@ -275,7 +271,7 @@ static void tcindex_free_perfect_hash(struct tcindex_data *cp)
         kfree(cp->perfect);
 }
 
-static int tcindex_alloc_perfect_hash(struct tcindex_data *cp)
+static int tcindex_alloc_perfect_hash(struct net *net, struct tcindex_data *cp)
 {
         int i, err = 0;
 
@@ -289,6 +285,9 @@ static int tcindex_alloc_perfect_hash(struct tcindex_data *cp)
                                     TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
                 if (err < 0)
                         goto errout;
+#ifdef CONFIG_NET_CLS_ACT
+                cp->perfect[i].exts.net = net;
+#endif
         }
 
         return 0;
@@ -305,9 +304,9 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
                   struct nlattr *est, bool ovr, struct netlink_ext_ack *extack)
 {
         struct tcindex_filter_result new_filter_result, *old_r = r;
-        struct tcindex_filter_result cr;
         struct tcindex_data *cp = NULL, *oldp;
         struct tcindex_filter *f = NULL; /* make gcc behave */
+        struct tcf_result cr = {};
         int err, balloc = 0;
         struct tcf_exts e;
 
@@ -337,7 +336,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
         if (p->perfect) {
                 int i;
 
-                if (tcindex_alloc_perfect_hash(cp) < 0)
+                if (tcindex_alloc_perfect_hash(net, cp) < 0)
                         goto errout;
                 for (i = 0; i < cp->hash; i++)
                         cp->perfect[i].res = p->perfect[i].res;
@@ -348,11 +347,8 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
         err = tcindex_filter_result_init(&new_filter_result);
         if (err < 0)
                 goto errout1;
-        err = tcindex_filter_result_init(&cr);
-        if (err < 0)
-                goto errout1;
         if (old_r)
-                cr.res = r->res;
+                cr = r->res;
 
         if (tb[TCA_TCINDEX_HASH])
                 cp->hash = nla_get_u32(tb[TCA_TCINDEX_HASH]);
@@ -406,7 +402,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
         err = -ENOMEM;
         if (!cp->perfect && !cp->h) {
                 if (valid_perfect_hash(cp)) {
-                        if (tcindex_alloc_perfect_hash(cp) < 0)
+                        if (tcindex_alloc_perfect_hash(net, cp) < 0)
                                 goto errout_alloc;
                         balloc = 1;
                 } else {
@@ -443,8 +439,8 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
         }
 
         if (tb[TCA_TCINDEX_CLASSID]) {
-                cr.res.classid = nla_get_u32(tb[TCA_TCINDEX_CLASSID]);
-                tcf_bind_filter(tp, &cr.res, base);
+                cr.classid = nla_get_u32(tb[TCA_TCINDEX_CLASSID]);
+                tcf_bind_filter(tp, &cr, base);
         }
 
         if (old_r && old_r != r) {
@@ -456,7 +452,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
         }
 
         oldp = p;
-        r->res = cr.res;
+        r->res = cr;
         tcf_exts_change(&r->exts, &e);
 
         rcu_assign_pointer(tp->root, cp);
@@ -475,10 +471,12 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
                                 ; /* nothing */
 
                 rcu_assign_pointer(*fp, f);
+        } else {
+                tcf_exts_destroy(&new_filter_result.exts);
         }
 
         if (oldp)
-                call_rcu(&oldp->rcu, __tcindex_partial_destroy);
+                tcf_queue_work(&oldp->rwork, tcindex_partial_destroy_work);
         return 0;
 
 errout_alloc:
@@ -487,7 +485,6 @@ errout_alloc:
         else if (balloc == 2)
                 kfree(cp->h);
 errout1:
-        tcf_exts_destroy(&cr.exts);
         tcf_exts_destroy(&new_filter_result.exts);
 errout:
         kfree(cp);
@@ -562,15 +559,34 @@ static void tcindex_destroy(struct tcf_proto *tp,
                             struct netlink_ext_ack *extack)
 {
         struct tcindex_data *p = rtnl_dereference(tp->root);
-        struct tcf_walker walker;
+        int i;
 
         pr_debug("tcindex_destroy(tp %p),p %p\n", tp, p);
-        walker.count = 0;
-        walker.skip = 0;
-        walker.fn = tcindex_destroy_element;
-        tcindex_walk(tp, &walker);
 
-        call_rcu(&p->rcu, __tcindex_destroy);
+        if (p->perfect) {
+                for (i = 0; i < p->hash; i++) {
+                        struct tcindex_filter_result *r = p->perfect + i;
+
+                        tcf_unbind_filter(tp, &r->res);
+                        if (tcf_exts_get_net(&r->exts))
+                                tcf_queue_work(&r->rwork,
+                                               tcindex_destroy_rexts_work);
+                        else
+                                __tcindex_destroy_rexts(r);
+                }
+        }
+
+        for (i = 0; p->h && i < p->hash; i++) {
+                struct tcindex_filter *f, *next;
+                bool last;
+
+                for (f = rtnl_dereference(p->h[i]); f; f = next) {
+                        next = rtnl_dereference(f->next);
+                        tcindex_delete(tp, &f->result, &last, NULL);
+                }
+        }
+
+        tcf_queue_work(&p->rwork, tcindex_destroy_work);
 }
 
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 66ba2ce2320f..968a85fe4d4a 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -500,7 +500,7 @@ static void dev_watchdog_down(struct net_device *dev)
  *      netif_carrier_on - set carrier
  *      @dev: network device
  *
- * Device has detected that carrier.
+ * Device has detected acquisition of carrier.
  */
 void netif_carrier_on(struct net_device *dev)
 {
diff --git a/net/sctp/diag.c b/net/sctp/diag.c
index 078f01a8d582..435847d98b51 100644
--- a/net/sctp/diag.c
+++ b/net/sctp/diag.c
@@ -256,6 +256,7 @@ static size_t inet_assoc_attr_size(struct sctp_association *asoc)
                 + nla_total_size(1) /* INET_DIAG_TOS */
                 + nla_total_size(1) /* INET_DIAG_TCLASS */
                 + nla_total_size(4) /* INET_DIAG_MARK */
+                + nla_total_size(4) /* INET_DIAG_CLASS_ID */
                 + nla_total_size(addrlen * asoc->peer.transport_count)
                 + nla_total_size(addrlen * addrcnt)
                 + nla_total_size(sizeof(struct inet_diag_meminfo))
diff --git a/net/sctp/offload.c b/net/sctp/offload.c
index 123e9f2dc226..edfcf16e704c 100644
--- a/net/sctp/offload.c
+++ b/net/sctp/offload.c
@@ -36,6 +36,7 @@ static __le32 sctp_gso_make_checksum(struct sk_buff *skb)
 {
         skb->ip_summed = CHECKSUM_NONE;
         skb->csum_not_inet = 0;
+        gso_reset_checksum(skb, ~0);
         return sctp_compute_cksum(skb, skb_transport_offset(skb));
 }
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index f93c3cf9e567..65d6d04546ae 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2027,7 +2027,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
         struct sctp_endpoint *ep = sctp_sk(sk)->ep;
         struct sctp_transport *transport = NULL;
         struct sctp_sndrcvinfo _sinfo, *sinfo;
-        struct sctp_association *asoc;
+        struct sctp_association *asoc, *tmp;
         struct sctp_cmsgs cmsgs;
         union sctp_addr *daddr;
         bool new = false;
@@ -2053,7 +2053,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
 
         /* SCTP_SENDALL process */
         if ((sflags & SCTP_SENDALL) && sctp_style(sk, UDP)) {
-                list_for_each_entry(asoc, &ep->asocs, asocs) {
+                list_for_each_entry_safe(asoc, tmp, &ep->asocs, asocs) {
                         err = sctp_sendmsg_check_sflags(asoc, sflags, msg,
                                                         msg_len);
                         if (err == 0)
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 80e0ae5534ec..2936ed17bf9e 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -84,6 +84,19 @@ static void fa_zero(struct flex_array *fa, size_t index, size_t count)
         }
 }
 
+static size_t fa_index(struct flex_array *fa, void *elem, size_t count)
+{
+        size_t index = 0;
+
+        while (count--) {
+                if (elem == flex_array_get(fa, index))
+                        break;
+                index++;
+        }
+
+        return index;
+}
+
 /* Migrates chunks from stream queues to new stream queues if needed,
  * but not across associations. Also, removes those chunks to streams
  * higher than the new max.
@@ -131,8 +144,10 @@ static void sctp_stream_outq_migrate(struct sctp_stream *stream,
                 }
         }
 
-        for (i = outcnt; i < stream->outcnt; i++)
+        for (i = outcnt; i < stream->outcnt; i++) {
                 kfree(SCTP_SO(stream, i)->ext);
+                SCTP_SO(stream, i)->ext = NULL;
+        }
 }
 
 static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
@@ -147,6 +162,13 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
 
         if (stream->out) {
                 fa_copy(out, stream->out, 0, min(outcnt, stream->outcnt));
+                if (stream->out_curr) {
+                        size_t index = fa_index(stream->out, stream->out_curr,
+                                                stream->outcnt);
+
+                        BUG_ON(index == stream->outcnt);
+                        stream->out_curr = flex_array_get(out, index);
+                }
                 fa_free(stream->out);
         }
 
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index c4e56602e0c6..b04a813fc865 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1505,6 +1505,11 @@ static int smc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
 
         smc = smc_sk(sk);
         lock_sock(sk);
+        if (sk->sk_state == SMC_CLOSED && (sk->sk_shutdown & RCV_SHUTDOWN)) {
+                /* socket was connected before, no more data to read */
+                rc = 0;
+                goto out;
+        }
         if ((sk->sk_state == SMC_INIT) ||
             (sk->sk_state == SMC_LISTEN) ||
             (sk->sk_state == SMC_CLOSED))
@@ -1840,7 +1845,11 @@ static ssize_t smc_splice_read(struct socket *sock, loff_t *ppos,
 
         smc = smc_sk(sk);
         lock_sock(sk);
-
+        if (sk->sk_state == SMC_CLOSED && (sk->sk_shutdown & RCV_SHUTDOWN)) {
+                /* socket was connected before, no more data to read */
+                rc = 0;
+                goto out;
+        }
         if (sk->sk_state == SMC_INIT ||
             sk->sk_state == SMC_LISTEN ||
             sk->sk_state == SMC_CLOSED)
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index db83332ac1c8..fb07ad8d69a6 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -21,13 +21,6 @@
 
 /********************************** send *************************************/
 
-struct smc_cdc_tx_pend {
-        struct smc_connection   *conn;          /* socket connection */
-        union smc_host_cursor   cursor; /* tx sndbuf cursor sent */
-        union smc_host_cursor   p_cursor;       /* rx RMBE cursor produced */
-        u16                     ctrl_seq;       /* conn. tx sequence # */
-};
-
 /* handler for send/transmission completion of a CDC msg */
 static void smc_cdc_tx_handler(struct smc_wr_tx_pend_priv *pnd_snd,
                                struct smc_link *link,
@@ -61,12 +54,14 @@ static void smc_cdc_tx_handler(struct smc_wr_tx_pend_priv *pnd_snd,
 
 int smc_cdc_get_free_slot(struct smc_connection *conn,
                           struct smc_wr_buf **wr_buf,
+                          struct smc_rdma_wr **wr_rdma_buf,
                           struct smc_cdc_tx_pend **pend)
 {
         struct smc_link *link = &conn->lgr->lnk[SMC_SINGLE_LINK];
         int rc;
 
         rc = smc_wr_tx_get_free_slot(link, smc_cdc_tx_handler, wr_buf,
+                                     wr_rdma_buf,
                                      (struct smc_wr_tx_pend_priv **)pend);
         if (!conn->alert_token_local)
                 /* abnormal termination */
@@ -96,6 +91,7 @@ int smc_cdc_msg_send(struct smc_connection *conn,
                      struct smc_wr_buf *wr_buf,
                      struct smc_cdc_tx_pend *pend)
 {
+        union smc_host_cursor cfed;
         struct smc_link *link;
         int rc;
 
@@ -105,12 +101,10 @@ int smc_cdc_msg_send(struct smc_connection *conn,
 
         conn->tx_cdc_seq++;
         conn->local_tx_ctrl.seqno = conn->tx_cdc_seq;
-        smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf,
-                            &conn->local_tx_ctrl, conn);
+        smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf, conn, &cfed);
         rc = smc_wr_tx_send(link, (struct smc_wr_tx_pend_priv *)pend);
         if (!rc)
-                smc_curs_copy(&conn->rx_curs_confirmed,
-                              &conn->local_tx_ctrl.cons, conn);
+                smc_curs_copy(&conn->rx_curs_confirmed, &cfed, conn);
 
         return rc;
 }
@@ -121,11 +115,14 @@ static int smcr_cdc_get_slot_and_msg_send(struct smc_connection *conn)
         struct smc_wr_buf *wr_buf;
         int rc;
 
-        rc = smc_cdc_get_free_slot(conn, &wr_buf, &pend);
+        rc = smc_cdc_get_free_slot(conn, &wr_buf, NULL, &pend);
         if (rc)
                 return rc;
 
-        return smc_cdc_msg_send(conn, wr_buf, pend);
+        spin_lock_bh(&conn->send_lock);
+        rc = smc_cdc_msg_send(conn, wr_buf, pend);
+        spin_unlock_bh(&conn->send_lock);
+        return rc;
 }
 
 int smc_cdc_get_slot_and_msg_send(struct smc_connection *conn)
diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
index b5bfe38c7f9b..f1cdde9d4b89 100644
--- a/net/smc/smc_cdc.h
+++ b/net/smc/smc_cdc.h
@@ -160,7 +160,9 @@ static inline void smcd_curs_copy(union smcd_cdc_cursor *tgt,
 #endif
 }
 
-/* calculate cursor difference between old and new, where old <= new */
+/* calculate cursor difference between old and new, where old <= new and
+ * difference cannot exceed size
+ */
 static inline int smc_curs_diff(unsigned int size,
                                 union smc_host_cursor *old,
                                 union smc_host_cursor *new)
@@ -185,28 +187,51 @@ static inline int smc_curs_comp(unsigned int size,
         return smc_curs_diff(size, old, new);
 }
 
+/* calculate cursor difference between old and new, where old <= new and
+ * difference may exceed size
+ */
+static inline int smc_curs_diff_large(unsigned int size,
+                                      union smc_host_cursor *old,
+                                      union smc_host_cursor *new)
+{
+        if (old->wrap < new->wrap)
+                return min_t(int,
+                             (size - old->count) + new->count +
+                             (new->wrap - old->wrap - 1) * size,
+                             size);
+
+        if (old->wrap > new->wrap) /* wrap has switched from 0xffff to 0x0000 */
+                return min_t(int,
+                             (size - old->count) + new->count +
+                             (new->wrap + 0xffff - old->wrap) * size,
+                             size);
+
+        return max_t(int, 0, (new->count - old->count));
+}
+
 static inline void smc_host_cursor_to_cdc(union smc_cdc_cursor *peer,
                                           union smc_host_cursor *local,
+                                          union smc_host_cursor *save,
                                           struct smc_connection *conn)
 {
-        union smc_host_cursor temp;
-
-        smc_curs_copy(&temp, local, conn);
-        peer->count = htonl(temp.count);
-        peer->wrap = htons(temp.wrap);
+        smc_curs_copy(save, local, conn);
+        peer->count = htonl(save->count);
+        peer->wrap = htons(save->wrap);
         /* peer->reserved = htons(0); must be ensured by caller */
 }
 
 static inline void smc_host_msg_to_cdc(struct smc_cdc_msg *peer,
-                                       struct smc_host_cdc_msg *local,
-                                       struct smc_connection *conn)
+                                       struct smc_connection *conn,
+                                       union smc_host_cursor *save)
 {
+        struct smc_host_cdc_msg *local = &conn->local_tx_ctrl;
+
         peer->common.type = local->common.type;
         peer->len = local->len;
         peer->seqno = htons(local->seqno);
         peer->token = htonl(local->token);
-        smc_host_cursor_to_cdc(&peer->prod, &local->prod, conn);
-        smc_host_cursor_to_cdc(&peer->cons, &local->cons, conn);
+        smc_host_cursor_to_cdc(&peer->prod, &local->prod, save, conn);
+        smc_host_cursor_to_cdc(&peer->cons, &local->cons, save, conn);
         peer->prod_flags = local->prod_flags;
         peer->conn_state_flags = local->conn_state_flags;
 }
@@ -270,10 +295,16 @@ static inline void smc_cdc_msg_to_host(struct smc_host_cdc_msg *local,
                 smcr_cdc_msg_to_host(local, peer, conn);
 }
 
-struct smc_cdc_tx_pend;
+struct smc_cdc_tx_pend {
+        struct smc_connection   *conn;          /* socket connection */
+        union smc_host_cursor   cursor;         /* tx sndbuf cursor sent */
+        union smc_host_cursor   p_cursor;       /* rx RMBE cursor produced */
+        u16                     ctrl_seq;       /* conn. tx sequence # */
+};
 
 int smc_cdc_get_free_slot(struct smc_connection *conn,
                           struct smc_wr_buf **wr_buf,
+                          struct smc_rdma_wr **wr_rdma_buf,
                           struct smc_cdc_tx_pend **pend);
 void smc_cdc_tx_dismiss_slots(struct smc_connection *conn);
 int smc_cdc_msg_send(struct smc_connection *conn, struct smc_wr_buf *wr_buf,
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index 776e9dfc915d..d53fd588d1f5 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -378,7 +378,7 @@ int smc_clc_send_decline(struct smc_sock *smc, u32 peer_diag_info)
         vec.iov_len = sizeof(struct smc_clc_msg_decline);
         len = kernel_sendmsg(smc->clcsock, &msg, &vec, 1,
                              sizeof(struct smc_clc_msg_decline));
-        if (len < sizeof(struct smc_clc_msg_decline))
+        if (len < 0 || len < sizeof(struct smc_clc_msg_decline))
                 len = -EPROTO;
         return len > 0 ? 0 : len;
 }
diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
index ea2b87f29469..e39cadda1bf5 100644
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -345,14 +345,7 @@ static void smc_close_passive_work(struct work_struct *work)
 
         switch (sk->sk_state) {
         case SMC_INIT:
-                if (atomic_read(&conn->bytes_to_rcv) ||
-                    (rxflags->peer_done_writing &&
-                     !smc_cdc_rxed_any_close(conn))) {
-                        sk->sk_state = SMC_APPCLOSEWAIT1;
-                } else {
-                        sk->sk_state = SMC_CLOSED;
-                        sock_put(sk); /* passive closing */
-                }
+                sk->sk_state = SMC_APPCLOSEWAIT1;
                 break;
         case SMC_ACTIVE:
                 sk->sk_state = SMC_APPCLOSEWAIT1;
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 35c1cdc93e1c..aa1c551cee81 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -128,6 +128,8 @@ static void smc_lgr_unregister_conn(struct smc_connection *conn)
 {
         struct smc_link_group *lgr = conn->lgr;
 
+        if (!lgr)
+                return;
         write_lock_bh(&lgr->conns_lock);
         if (conn->alert_token_local) {
                 __smc_lgr_unregister_conn(conn);
@@ -300,13 +302,13 @@ static void smc_buf_unuse(struct smc_connection *conn,
                 conn->sndbuf_desc->used = 0;
         if (conn->rmb_desc) {
                 if (!conn->rmb_desc->regerr) {
-                        conn->rmb_desc->used = 0;
                         if (!lgr->is_smcd) {
                                 /* unregister rmb with peer */
                                 smc_llc_do_delete_rkey(
                                                 &lgr->lnk[SMC_SINGLE_LINK],
                                                 conn->rmb_desc);
                         }
+                        conn->rmb_desc->used = 0;
                 } else {
                         /* buf registration failed, reuse not possible */
                         write_lock_bh(&lgr->rmbs_lock);
@@ -628,6 +630,8 @@ int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
                         local_contact = SMC_REUSE_CONTACT;
                         conn->lgr = lgr;
                         smc_lgr_register_conn(conn); /* add smc conn to lgr */
+                        if (delayed_work_pending(&lgr->free_work))
+                                cancel_delayed_work(&lgr->free_work);
                         write_unlock_bh(&lgr->conns_lock);
                         break;
                 }
diff --git a/net/smc/smc_core.h b/net/smc/smc_core.h
index b00287989a3d..8806d2afa6ed 100644
--- a/net/smc/smc_core.h
+++ b/net/smc/smc_core.h
@@ -52,6 +52,24 @@ enum smc_wr_reg_state {
         FAILED          /* ib_wr_reg_mr response: failure */
 };
 
+struct smc_rdma_sge {                           /* sges for RDMA writes */
+        struct ib_sge           wr_tx_rdma_sge[SMC_IB_MAX_SEND_SGE];
+};
+
+#define SMC_MAX_RDMA_WRITES     2               /* max. # of RDMA writes per
+                                                 * message send
+                                                 */
+
+struct smc_rdma_sges {                          /* sges per message send */
+        struct smc_rdma_sge     tx_rdma_sge[SMC_MAX_RDMA_WRITES];
+};
+
+struct smc_rdma_wr {                            /* work requests per message
+                                                 * send
+                                                 */
+        struct ib_rdma_wr       wr_tx_rdma[SMC_MAX_RDMA_WRITES];
+};
+
 struct smc_link {
         struct smc_ib_device    *smcibdev;      /* ib-device */
         u8                      ibport;         /* port - values 1 | 2 */
@@ -64,6 +82,8 @@ struct smc_link {
         struct smc_wr_buf       *wr_tx_bufs;    /* WR send payload buffers */
         struct ib_send_wr       *wr_tx_ibs;     /* WR send meta data */
         struct ib_sge           *wr_tx_sges;    /* WR send gather meta data */
+        struct smc_rdma_sges    *wr_tx_rdma_sges;/*RDMA WRITE gather meta data*/
+        struct smc_rdma_wr      *wr_tx_rdmas;   /* WR RDMA WRITE */
         struct smc_wr_tx_pend   *wr_tx_pends;   /* WR send waiting for CQE */
         /* above four vectors have wr_tx_cnt elements and use the same index */
         dma_addr_t              wr_tx_dma_addr; /* DMA address of wr_tx_bufs */
diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
index e519ef29c0ff..76487a16934e 100644
--- a/net/smc/smc_ib.c
+++ b/net/smc/smc_ib.c
@@ -289,8 +289,8 @@ int smc_ib_create_protection_domain(struct smc_link *lnk)
 
 static void smc_ib_qp_event_handler(struct ib_event *ibevent, void *priv)
 {
-        struct smc_ib_device *smcibdev =
-                (struct smc_ib_device *)ibevent->device;
+        struct smc_link *lnk = (struct smc_link *)priv;
+        struct smc_ib_device *smcibdev = lnk->smcibdev;
         u8 port_idx;
 
         switch (ibevent->event) {
@@ -298,7 +298,7 @@ static void smc_ib_qp_event_handler(struct ib_event *ibevent, void *priv)
         case IB_EVENT_GID_CHANGE:
         case IB_EVENT_PORT_ERR:
         case IB_EVENT_QP_ACCESS_ERR:
-                port_idx = ibevent->element.port_num - 1;
+                port_idx = ibevent->element.qp->port - 1;
                 set_bit(port_idx, &smcibdev->port_event_mask);
                 schedule_work(&smcibdev->port_event_work);
                 break;
diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c
index a6d3623d06f4..4fd60c522802 100644
--- a/net/smc/smc_llc.c
+++ b/net/smc/smc_llc.c
@@ -166,7 +166,8 @@ static int smc_llc_add_pending_send(struct smc_link *link,
 {
         int rc;
 
-        rc = smc_wr_tx_get_free_slot(link, smc_llc_tx_handler, wr_buf, pend);
+        rc = smc_wr_tx_get_free_slot(link, smc_llc_tx_handler, wr_buf, NULL,
+                                     pend);
         if (rc < 0)
                 return rc;
         BUILD_BUG_ON_MSG(
diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c
index 7cb3e4f07c10..632c3109dee5 100644
--- a/net/smc/smc_pnet.c
+++ b/net/smc/smc_pnet.c
@@ -27,7 +27,7 @@
 static struct nla_policy smc_pnet_policy[SMC_PNETID_MAX + 1] = {
         [SMC_PNETID_NAME] = {
                 .type = NLA_NUL_STRING,
-                .len = SMC_MAX_PNETID_LEN - 1
+                .len = SMC_MAX_PNETID_LEN
         },
         [SMC_PNETID_ETHNAME] = {
                 .type = NLA_NUL_STRING,
diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
index d8366ed51757..f93f3580c100 100644
--- a/net/smc/smc_tx.c
+++ b/net/smc/smc_tx.c
@@ -165,12 +165,11 @@ int smc_tx_sendmsg(struct smc_sock *smc, struct msghdr *msg, size_t len)
                         conn->local_tx_ctrl.prod_flags.urg_data_pending = 1;
 
                 if (!atomic_read(&conn->sndbuf_space) || conn->urg_tx_pend) {
+                        if (send_done)
+                                return send_done;
                         rc = smc_tx_wait(smc, msg->msg_flags);
-                        if (rc) {
-                                if (send_done)
-                                        return send_done;
+                        if (rc)
                                 goto out_err;
-                        }
                         continue;
                 }
 
@@ -267,27 +266,23 @@ int smcd_tx_ism_write(struct smc_connection *conn, void *data, size_t len,
 
 /* sndbuf consumer: actual data transfer of one target chunk with RDMA write */
 static int smc_tx_rdma_write(struct smc_connection *conn, int peer_rmbe_offset,
-                             int num_sges, struct ib_sge sges[])
+                             int num_sges, struct ib_rdma_wr *rdma_wr)
 {
         struct smc_link_group *lgr = conn->lgr;
-        struct ib_rdma_wr rdma_wr;
         struct smc_link *link;
         int rc;
 
-        memset(&rdma_wr, 0, sizeof(rdma_wr));
         link = &lgr->lnk[SMC_SINGLE_LINK];
-        rdma_wr.wr.wr_id = smc_wr_tx_get_next_wr_id(link);
-        rdma_wr.wr.sg_list = sges;
-        rdma_wr.wr.num_sge = num_sges;
-        rdma_wr.wr.opcode = IB_WR_RDMA_WRITE;
-        rdma_wr.remote_addr =
+        rdma_wr->wr.wr_id = smc_wr_tx_get_next_wr_id(link);
+        rdma_wr->wr.num_sge = num_sges;
+        rdma_wr->remote_addr =
                 lgr->rtokens[conn->rtoken_idx][SMC_SINGLE_LINK].dma_addr +
                 /* RMBE within RMB */
                 conn->tx_off +
                 /* offset within RMBE */
                 peer_rmbe_offset;
-        rdma_wr.rkey = lgr->rtokens[conn->rtoken_idx][SMC_SINGLE_LINK].rkey;
-        rc = ib_post_send(link->roce_qp, &rdma_wr.wr, NULL);
+        rdma_wr->rkey = lgr->rtokens[conn->rtoken_idx][SMC_SINGLE_LINK].rkey;
+        rc = ib_post_send(link->roce_qp, &rdma_wr->wr, NULL);
         if (rc) {
                 conn->local_tx_ctrl.conn_state_flags.peer_conn_abort = 1;
                 smc_lgr_terminate(lgr);
@@ -314,24 +309,25 @@ static inline void smc_tx_advance_cursors(struct smc_connection *conn,
 /* SMC-R helper for smc_tx_rdma_writes() */
 static int smcr_tx_rdma_writes(struct smc_connection *conn, size_t len,
                                size_t src_off, size_t src_len,
-                               size_t dst_off, size_t dst_len)
+                               size_t dst_off, size_t dst_len,
+                               struct smc_rdma_wr *wr_rdma_buf)
 {
         dma_addr_t dma_addr =
                 sg_dma_address(conn->sndbuf_desc->sgt[SMC_SINGLE_LINK].sgl);
-        struct smc_link *link = &conn->lgr->lnk[SMC_SINGLE_LINK];
         int src_len_sum = src_len, dst_len_sum = dst_len;
-        struct ib_sge sges[SMC_IB_MAX_SEND_SGE];
         int sent_count = src_off;
         int srcchunk, dstchunk;
         int num_sges;
         int rc;
 
         for (dstchunk = 0; dstchunk < 2; dstchunk++) {
+                struct ib_sge *sge =
+                        wr_rdma_buf->wr_tx_rdma[dstchunk].wr.sg_list;
+
                 num_sges = 0;
                 for (srcchunk = 0; srcchunk < 2; srcchunk++) {
-                        sges[srcchunk].addr = dma_addr + src_off;
-                        sges[srcchunk].length = src_len;
-                        sges[srcchunk].lkey = link->roce_pd->local_dma_lkey;
+                        sge[srcchunk].addr = dma_addr + src_off;
+                        sge[srcchunk].length = src_len;
                         num_sges++;
 
                         src_off += src_len;
@@ -344,7 +340,8 @@ static int smcr_tx_rdma_writes(struct smc_connection *conn, size_t len,
                         src_len = dst_len - src_len; /* remainder */
                         src_len_sum += src_len;
                 }
-                rc = smc_tx_rdma_write(conn, dst_off, num_sges, sges);
+                rc = smc_tx_rdma_write(conn, dst_off, num_sges,
+                                       &wr_rdma_buf->wr_tx_rdma[dstchunk]);
                 if (rc)
                         return rc;
                 if (dst_len_sum == len)
@@ -403,7 +400,8 @@ static int smcd_tx_rdma_writes(struct smc_connection *conn, size_t len,
 /* sndbuf consumer: prepare all necessary (src&dst) chunks of data transmit;
  * usable snd_wnd as max transmit
  */
-static int smc_tx_rdma_writes(struct smc_connection *conn)
+static int smc_tx_rdma_writes(struct smc_connection *conn,
+                              struct smc_rdma_wr *wr_rdma_buf)
 {
         size_t len, src_len, dst_off, dst_len; /* current chunk values */
         union smc_host_cursor sent, prep, prod, cons;
@@ -464,7 +462,7 @@ static int smc_tx_rdma_writes(struct smc_connection *conn)
                                          dst_off, dst_len);
         else
                 rc = smcr_tx_rdma_writes(conn, len, sent.count, src_len,
-                                         dst_off, dst_len);
+                                         dst_off, dst_len, wr_rdma_buf);
         if (rc)
                 return rc;
 
@@ -485,31 +483,30 @@ static int smc_tx_rdma_writes(struct smc_connection *conn)
 static int smcr_tx_sndbuf_nonempty(struct smc_connection *conn)
 {
         struct smc_cdc_producer_flags *pflags;
+        struct smc_rdma_wr *wr_rdma_buf;
         struct smc_cdc_tx_pend *pend;
         struct smc_wr_buf *wr_buf;
         int rc;
 
-        spin_lock_bh(&conn->send_lock);
-        rc = smc_cdc_get_free_slot(conn, &wr_buf, &pend);
+        rc = smc_cdc_get_free_slot(conn, &wr_buf, &wr_rdma_buf, &pend);
         if (rc < 0) {
                 if (rc == -EBUSY) {
                         struct smc_sock *smc =
                                 container_of(conn, struct smc_sock, conn);
 
-                        if (smc->sk.sk_err == ECONNABORTED) {
-                                rc = sock_error(&smc->sk);
-                                goto out_unlock;
-                        }
+                        if (smc->sk.sk_err == ECONNABORTED)
+                                return sock_error(&smc->sk);
                         rc = 0;
                         if (conn->alert_token_local) /* connection healthy */
                                 mod_delayed_work(system_wq, &conn->tx_work,
                                                  SMC_TX_WORK_DELAY);
                 }
-                goto out_unlock;
+                return rc;
         }
 
+        spin_lock_bh(&conn->send_lock);
         if (!conn->local_tx_ctrl.prod_flags.urg_data_present) {
-                rc = smc_tx_rdma_writes(conn);
+                rc = smc_tx_rdma_writes(conn, wr_rdma_buf);
                 if (rc) {
                         smc_wr_tx_put_slot(&conn->lgr->lnk[SMC_SINGLE_LINK],
                                            (struct smc_wr_tx_pend_priv *)pend);
@@ -536,7 +533,7 @@ static int smcd_tx_sndbuf_nonempty(struct smc_connection *conn)
 
         spin_lock_bh(&conn->send_lock);
         if (!pflags->urg_data_present)
-                rc = smc_tx_rdma_writes(conn);
+                rc = smc_tx_rdma_writes(conn, NULL);
         if (!rc)
                 rc = smcd_cdc_msg_send(conn);
 
@@ -598,7 +595,8 @@ void smc_tx_consumer_update(struct smc_connection *conn, bool force)
         if (to_confirm > conn->rmbe_update_limit) {
                 smc_curs_copy(&prod, &conn->local_rx_ctrl.prod, conn);
                 sender_free = conn->rmb_desc->len -
-                              smc_curs_diff(conn->rmb_desc->len, &prod, &cfed);
+                              smc_curs_diff_large(conn->rmb_desc->len,
+                                                  &cfed, &prod);
         }
 
         if (conn->local_rx_ctrl.prod_flags.cons_curs_upd_req ||
diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c
index c2694750a6a8..253aa75dc2b6 100644
--- a/net/smc/smc_wr.c
+++ b/net/smc/smc_wr.c
@@ -160,6 +160,7 @@ static inline int smc_wr_tx_get_free_slot_index(struct smc_link *link, u32 *idx)
  * @link:               Pointer to smc_link used to later send the message.
  * @handler:            Send completion handler function pointer.
  * @wr_buf:             Out value returns pointer to message buffer.
+ * @wr_rdma_buf:        Out value returns pointer to rdma work request.
  * @wr_pend_priv:       Out value returns pointer serving as handler context.
  *
  * Return: 0 on success, or -errno on error.
@@ -167,6 +168,7 @@ static inline int smc_wr_tx_get_free_slot_index(struct smc_link *link, u32 *idx)
 int smc_wr_tx_get_free_slot(struct smc_link *link,
                             smc_wr_tx_handler handler,
                             struct smc_wr_buf **wr_buf,
+                            struct smc_rdma_wr **wr_rdma_buf,
                             struct smc_wr_tx_pend_priv **wr_pend_priv)
 {
         struct smc_wr_tx_pend *wr_pend;
@@ -204,6 +206,8 @@ int smc_wr_tx_get_free_slot(struct smc_link *link,
         wr_ib = &link->wr_tx_ibs[idx];
         wr_ib->wr_id = wr_id;
         *wr_buf = &link->wr_tx_bufs[idx];
+        if (wr_rdma_buf)
+                *wr_rdma_buf = &link->wr_tx_rdmas[idx];
         *wr_pend_priv = &wr_pend->priv;
         return 0;
 }
@@ -218,10 +222,10 @@ int smc_wr_tx_put_slot(struct smc_link *link,
                 u32 idx = pend->idx;
 
                 /* clear the full struct smc_wr_tx_pend including .priv */
-                memset(&link->wr_tx_pends[pend->idx], 0,
-                       sizeof(link->wr_tx_pends[pend->idx]));
-                memset(&link->wr_tx_bufs[pend->idx], 0,
-                       sizeof(link->wr_tx_bufs[pend->idx]));
+                memset(&link->wr_tx_pends[idx], 0,
+                       sizeof(link->wr_tx_pends[idx]));
+                memset(&link->wr_tx_bufs[idx], 0,
+                       sizeof(link->wr_tx_bufs[idx]));
                 test_and_clear_bit(idx, link->wr_tx_mask);
                 return 1;
         }
@@ -465,12 +469,26 @@ static void smc_wr_init_sge(struct smc_link *lnk)
                         lnk->wr_tx_dma_addr + i * SMC_WR_BUF_SIZE;
                 lnk->wr_tx_sges[i].length = SMC_WR_TX_SIZE;
                 lnk->wr_tx_sges[i].lkey = lnk->roce_pd->local_dma_lkey;
+                lnk->wr_tx_rdma_sges[i].tx_rdma_sge[0].wr_tx_rdma_sge[0].lkey =
+                        lnk->roce_pd->local_dma_lkey;
+                lnk->wr_tx_rdma_sges[i].tx_rdma_sge[0].wr_tx_rdma_sge[1].lkey =
+                        lnk->roce_pd->local_dma_lkey;
+                lnk->wr_tx_rdma_sges[i].tx_rdma_sge[1].wr_tx_rdma_sge[0].lkey =
+                        lnk->roce_pd->local_dma_lkey;
+                lnk->wr_tx_rdma_sges[i].tx_rdma_sge[1].wr_tx_rdma_sge[1].lkey =
+                        lnk->roce_pd->local_dma_lkey;
                 lnk->wr_tx_ibs[i].next = NULL;
                 lnk->wr_tx_ibs[i].sg_list = &lnk->wr_tx_sges[i];
                 lnk->wr_tx_ibs[i].num_sge = 1;
                 lnk->wr_tx_ibs[i].opcode = IB_WR_SEND;
                 lnk->wr_tx_ibs[i].send_flags =
                         IB_SEND_SIGNALED | IB_SEND_SOLICITED;
+                lnk->wr_tx_rdmas[i].wr_tx_rdma[0].wr.opcode = IB_WR_RDMA_WRITE;
+                lnk->wr_tx_rdmas[i].wr_tx_rdma[1].wr.opcode = IB_WR_RDMA_WRITE;
+                lnk->wr_tx_rdmas[i].wr_tx_rdma[0].wr.sg_list =
+                        lnk->wr_tx_rdma_sges[i].tx_rdma_sge[0].wr_tx_rdma_sge;
+                lnk->wr_tx_rdmas[i].wr_tx_rdma[1].wr.sg_list =
+                        lnk->wr_tx_rdma_sges[i].tx_rdma_sge[1].wr_tx_rdma_sge;
         }
         for (i = 0; i < lnk->wr_rx_cnt; i++) {
                 lnk->wr_rx_sges[i].addr =
@@ -521,8 +539,12 @@ void smc_wr_free_link_mem(struct smc_link *lnk)
         lnk->wr_tx_mask = NULL;
         kfree(lnk->wr_tx_sges);
         lnk->wr_tx_sges = NULL;
+        kfree(lnk->wr_tx_rdma_sges);
+        lnk->wr_tx_rdma_sges = NULL;
         kfree(lnk->wr_rx_sges);
         lnk->wr_rx_sges = NULL;
+        kfree(lnk->wr_tx_rdmas);
+        lnk->wr_tx_rdmas = NULL;
         kfree(lnk->wr_rx_ibs);
         lnk->wr_rx_ibs = NULL;
         kfree(lnk->wr_tx_ibs);
@@ -552,10 +574,20 @@ int smc_wr_alloc_link_mem(struct smc_link *link)
                                   GFP_KERNEL);
         if (!link->wr_rx_ibs)
                 goto no_mem_wr_tx_ibs;
+        link->wr_tx_rdmas = kcalloc(SMC_WR_BUF_CNT,
+                                    sizeof(link->wr_tx_rdmas[0]),
+                                    GFP_KERNEL);
+        if (!link->wr_tx_rdmas)
+                goto no_mem_wr_rx_ibs;
+        link->wr_tx_rdma_sges = kcalloc(SMC_WR_BUF_CNT,
+                                        sizeof(link->wr_tx_rdma_sges[0]),
+                                        GFP_KERNEL);
+        if (!link->wr_tx_rdma_sges)
+                goto no_mem_wr_tx_rdmas;
         link->wr_tx_sges = kcalloc(SMC_WR_BUF_CNT, sizeof(link->wr_tx_sges[0]),
                                    GFP_KERNEL);
         if (!link->wr_tx_sges)
-                goto no_mem_wr_rx_ibs;
+                goto no_mem_wr_tx_rdma_sges;
         link->wr_rx_sges = kcalloc(SMC_WR_BUF_CNT * 3,
                                    sizeof(link->wr_rx_sges[0]),
                                    GFP_KERNEL);
@@ -579,6 +611,10 @@ no_mem_wr_rx_sges:
         kfree(link->wr_rx_sges);
 no_mem_wr_tx_sges:
         kfree(link->wr_tx_sges);
+no_mem_wr_tx_rdma_sges:
+        kfree(link->wr_tx_rdma_sges);
+no_mem_wr_tx_rdmas:
+        kfree(link->wr_tx_rdmas);
 no_mem_wr_rx_ibs:
         kfree(link->wr_rx_ibs);
 no_mem_wr_tx_ibs:
diff --git a/net/smc/smc_wr.h b/net/smc/smc_wr.h
index 1d85bb14fd6f..09bf32fd3959 100644
--- a/net/smc/smc_wr.h
+++ b/net/smc/smc_wr.h
@@ -85,6 +85,7 @@ void smc_wr_add_dev(struct smc_ib_device *smcibdev);
 
 int smc_wr_tx_get_free_slot(struct smc_link *link, smc_wr_tx_handler handler,
                             struct smc_wr_buf **wr_buf,
+                            struct smc_rdma_wr **wrs,
                             struct smc_wr_tx_pend_priv **wr_pend_priv);
 int smc_wr_tx_put_slot(struct smc_link *link,
                        struct smc_wr_tx_pend_priv *wr_pend_priv);
diff --git a/net/socket.c b/net/socket.c
index e89884e2197b..d80d87a395ea 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -941,8 +941,7 @@ void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
 EXPORT_SYMBOL(dlci_ioctl_set);
 
 static long sock_do_ioctl(struct net *net, struct socket *sock,
-                          unsigned int cmd, unsigned long arg,
-                          unsigned int ifreq_size)
+                          unsigned int cmd, unsigned long arg)
 {
         int err;
         void __user *argp = (void __user *)arg;
@@ -968,11 +967,11 @@ static long sock_do_ioctl(struct net *net, struct socket *sock,
         } else {
                 struct ifreq ifr;
                 bool need_copyout;
-                if (copy_from_user(&ifr, argp, ifreq_size))
+                if (copy_from_user(&ifr, argp, sizeof(struct ifreq)))
                         return -EFAULT;
                 err = dev_ioctl(net, cmd, &ifr, &need_copyout);
                 if (!err && need_copyout)
-                        if (copy_to_user(argp, &ifr, ifreq_size))
+                        if (copy_to_user(argp, &ifr, sizeof(struct ifreq)))
                                 return -EFAULT;
         }
         return err;
@@ -1071,8 +1070,7 @@ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
                         err = open_related_ns(&net->ns, get_net_ns);
                         break;
                 default:
-                        err = sock_do_ioctl(net, sock, cmd, arg,
-                                            sizeof(struct ifreq));
+                        err = sock_do_ioctl(net, sock, cmd, arg);
                         break;
                 }
         return err;
@@ -2780,8 +2778,7 @@ static int do_siocgstamp(struct net *net, struct socket *sock,
         int err;
 
         set_fs(KERNEL_DS);
-        err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv,
-                            sizeof(struct compat_ifreq));
+        err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
         set_fs(old_fs);
         if (!err)
                 err = compat_put_timeval(&ktv, up);
@@ -2797,8 +2794,7 @@ static int do_siocgstampns(struct net *net, struct socket *sock,
         int err;
 
         set_fs(KERNEL_DS);
-        err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts,
-                            sizeof(struct compat_ifreq));
+        err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
         set_fs(old_fs);
         if (!err)
                 err = compat_put_timespec(&kts, up);
@@ -2994,6 +2990,54 @@ static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
         return dev_ioctl(net, cmd, &ifreq, NULL);
 }
 
+static int compat_ifreq_ioctl(struct net *net, struct socket *sock,
+                              unsigned int cmd,
+                              struct compat_ifreq __user *uifr32)
+{
+        struct ifreq __user *uifr;
+        int err;
+
+        /* Handle the fact that while struct ifreq has the same *layout* on
+         * 32/64 for everything but ifreq::ifru_ifmap and ifreq::ifru_data,
+         * which are handled elsewhere, it still has different *size* due to
+         * ifreq::ifru_ifmap (which is 16 bytes on 32 bit, 24 bytes on 64-bit,
+         * resulting in struct ifreq being 32 and 40 bytes respectively).
+         * As a result, if the struct happens to be at the end of a page and
+         * the next page isn't readable/writable, we get a fault. To prevent
+         * that, copy back and forth to the full size.
+         */
+
+        uifr = compat_alloc_user_space(sizeof(*uifr));
+        if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
+                return -EFAULT;
+
+        err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
+
+        if (!err) {
+                switch (cmd) {
+                case SIOCGIFFLAGS:
+                case SIOCGIFMETRIC:
+                case SIOCGIFMTU:
+                case SIOCGIFMEM:
+                case SIOCGIFHWADDR:
+                case SIOCGIFINDEX:
+                case SIOCGIFADDR:
+                case SIOCGIFBRDADDR:
+                case SIOCGIFDSTADDR:
+                case SIOCGIFNETMASK:
+                case SIOCGIFPFLAGS:
+                case SIOCGIFTXQLEN:
+                case SIOCGMIIPHY:
+                case SIOCGMIIREG:
+                case SIOCGIFNAME:
+                        if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
+                                err = -EFAULT;
+                        break;
+                }
+        }
+        return err;
+}
+
 static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
                         struct compat_ifreq __user *uifr32)
 {
@@ -3109,8 +3153,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
         }
 
         set_fs(KERNEL_DS);
-        ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r,
-                            sizeof(struct compat_ifreq));
+        ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
         set_fs(old_fs);
 
 out:
@@ -3210,21 +3253,22 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
         case SIOCSIFTXQLEN:
         case SIOCBRADDIF:
         case SIOCBRDELIF:
+        case SIOCGIFNAME:
         case SIOCSIFNAME:
         case SIOCGMIIPHY:
         case SIOCGMIIREG:
         case SIOCSMIIREG:
-        case SIOCSARP:
-        case SIOCGARP:
-        case SIOCDARP:
-        case SIOCATMARK:
         case SIOCBONDENSLAVE:
         case SIOCBONDRELEASE:
         case SIOCBONDSETHWADDR:
         case SIOCBONDCHANGEACTIVE:
-        case SIOCGIFNAME:
-                return sock_do_ioctl(net, sock, cmd, arg,
-                                     sizeof(struct compat_ifreq));
+                return compat_ifreq_ioctl(net, sock, cmd, argp);
+
+        case SIOCSARP:
+        case SIOCGARP:
+        case SIOCDARP:
+        case SIOCATMARK:
+                return sock_do_ioctl(net, sock, cmd, arg);
         }
 
         return -ENOIOCTLCMD;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index cf51b8f9b15f..1f200119268c 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -537,6 +537,99 @@ void svc_rdma_sync_reply_hdr(struct svcxprt_rdma *rdma,
                                       DMA_TO_DEVICE);
 }
 
+/* If the xdr_buf has more elements than the device can
+ * transmit in a single RDMA Send, then the reply will
+ * have to be copied into a bounce buffer.
+ */
+static bool svc_rdma_pull_up_needed(struct svcxprt_rdma *rdma,
+                                    struct xdr_buf *xdr,
+                                    __be32 *wr_lst)
+{
+        int elements;
+
+        /* xdr->head */
+        elements = 1;
+
+        /* xdr->pages */
+        if (!wr_lst) {
+                unsigned int remaining;
+                unsigned long pageoff;
+
+                pageoff = xdr->page_base & ~PAGE_MASK;
+                remaining = xdr->page_len;
+                while (remaining) {
+                        ++elements;
+                        remaining -= min_t(u32, PAGE_SIZE - pageoff,
+                                           remaining);
+                        pageoff = 0;
+                }
+        }
+
+        /* xdr->tail */
+        if (xdr->tail[0].iov_len)
+                ++elements;
+
+        /* assume 1 SGE is needed for the transport header */
+        return elements >= rdma->sc_max_send_sges;
+}
+
+/* The device is not capable of sending the reply directly.
+ * Assemble the elements of @xdr into the transport header
+ * buffer.
+ */
+static int svc_rdma_pull_up_reply_msg(struct svcxprt_rdma *rdma,
+                                      struct svc_rdma_send_ctxt *ctxt,
+                                      struct xdr_buf *xdr, __be32 *wr_lst)
+{
+        unsigned char *dst, *tailbase;
+        unsigned int taillen;
+
+        dst = ctxt->sc_xprt_buf;
+        dst += ctxt->sc_sges[0].length;
+
+        memcpy(dst, xdr->head[0].iov_base, xdr->head[0].iov_len);
+        dst += xdr->head[0].iov_len;
+
+        tailbase = xdr->tail[0].iov_base;
+        taillen = xdr->tail[0].iov_len;
+        if (wr_lst) {
+                u32 xdrpad;
+
+                xdrpad = xdr_padsize(xdr->page_len);
+                if (taillen && xdrpad) {
+                        tailbase += xdrpad;
+                        taillen -= xdrpad;
+                }
+        } else {
+                unsigned int len, remaining;
+                unsigned long pageoff;
+                struct page **ppages;
+
+                ppages = xdr->pages + (xdr->page_base >> PAGE_SHIFT);
+                pageoff = xdr->page_base & ~PAGE_MASK;
+                remaining = xdr->page_len;
+                while (remaining) {
+                        len = min_t(u32, PAGE_SIZE - pageoff, remaining);
+
+                        memcpy(dst, page_address(*ppages), len);
+                        remaining -= len;
+                        dst += len;
+                        pageoff = 0;
+                }
+        }
+
+        if (taillen)
+                memcpy(dst, tailbase, taillen);
+
+        ctxt->sc_sges[0].length += xdr->len;
+        ib_dma_sync_single_for_device(rdma->sc_pd->device,
+                                      ctxt->sc_sges[0].addr,
+                                      ctxt->sc_sges[0].length,
+                                      DMA_TO_DEVICE);
+
+        return 0;
+}
+
 /* svc_rdma_map_reply_msg - Map the buffer holding RPC message
  * @rdma: controlling transport
  * @ctxt: send_ctxt for the Send WR
@@ -559,8 +652,10 @@ int svc_rdma_map_reply_msg(struct svcxprt_rdma *rdma,
         u32 xdr_pad;
         int ret;
 
-        if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
-                return -EIO;
+        if (svc_rdma_pull_up_needed(rdma, xdr, wr_lst))
+                return svc_rdma_pull_up_reply_msg(rdma, ctxt, xdr, wr_lst);
+
+        ++ctxt->sc_cur_sge_no;
         ret = svc_rdma_dma_map_buf(rdma, ctxt,
                                    xdr->head[0].iov_base,
                                    xdr->head[0].iov_len);
@@ -591,8 +686,7 @@ int svc_rdma_map_reply_msg(struct svcxprt_rdma *rdma,
         while (remaining) {
                 len = min_t(u32, PAGE_SIZE - page_off, remaining);
 
-                if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
-                        return -EIO;
+                ++ctxt->sc_cur_sge_no;
                 ret = svc_rdma_dma_map_page(rdma, ctxt, *ppages++,
                                             page_off, len);
                 if (ret < 0)
@@ -606,8 +700,7 @@ int svc_rdma_map_reply_msg(struct svcxprt_rdma *rdma,
         len = xdr->tail[0].iov_len;
 tail:
         if (len) {
-                if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
-                        return -EIO;
+                ++ctxt->sc_cur_sge_no;
                 ret = svc_rdma_dma_map_buf(rdma, ctxt, base, len);
                 if (ret < 0)
                         return ret;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 924c17d46903..57f86c63a463 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -419,12 +419,9 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
         /* Transport header, head iovec, tail iovec */
         newxprt->sc_max_send_sges = 3;
         /* Add one SGE per page list entry */
-        newxprt->sc_max_send_sges += svcrdma_max_req_size / PAGE_SIZE;
-        if (newxprt->sc_max_send_sges > dev->attrs.max_send_sge) {
-                pr_err("svcrdma: too few Send SGEs available (%d needed)\n",
-                       newxprt->sc_max_send_sges);
-                goto errout;
-        }
+        newxprt->sc_max_send_sges += (svcrdma_max_req_size / PAGE_SIZE) + 1;
+        if (newxprt->sc_max_send_sges > dev->attrs.max_send_sge)
+                newxprt->sc_max_send_sges = dev->attrs.max_send_sge;
         newxprt->sc_max_req_size = svcrdma_max_req_size;
         newxprt->sc_max_requests = svcrdma_max_requests;
         newxprt->sc_max_bc_requests = svcrdma_max_bc_requests;
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 2792a3cae682..85ad5c0678d0 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1145,7 +1145,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb,
         default:
                 pr_warn("Dropping received illegal msg type\n");
                 kfree_skb(skb);
-                return false;
+                return true;
         };
 }
 
@@ -1425,6 +1425,10 @@ static void tipc_link_build_proto_msg(struct tipc_link *l, int mtyp, bool probe,
                 l->rcv_unacked = 0;
         } else {
                 /* RESET_MSG or ACTIVATE_MSG */
+                if (mtyp == ACTIVATE_MSG) {
+                        msg_set_dest_session_valid(hdr, 1);
+                        msg_set_dest_session(hdr, l->peer_session);
+                }
                 msg_set_max_pkt(hdr, l->advertised_mtu);
                 strcpy(data, l->if_name);
                 msg_set_size(hdr, INT_H_SIZE + TIPC_MAX_IF_NAME);
@@ -1642,6 +1646,17 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
                         rc = tipc_link_fsm_evt(l, LINK_FAILURE_EVT);
                         break;
                 }
+
+                /* If this endpoint was re-created while peer was ESTABLISHING
+                 * it doesn't know current session number. Force re-synch.
+                 */
+                if (mtyp == ACTIVATE_MSG && msg_dest_session_valid(hdr) &&
+                    l->session != msg_dest_session(hdr)) {
+                        if (less(l->session, msg_dest_session(hdr)))
+                                l->session = msg_dest_session(hdr) + 1;
+                        break;
+                }
+
                 /* ACTIVATE_MSG serves as PEER_RESET if link is already down */
                 if (mtyp == RESET_MSG || !link_is_up(l))
                         rc = tipc_link_fsm_evt(l, LINK_PEER_RESET_EVT);
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index a0924956bb61..d7e4b8b93f9d 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -360,6 +360,28 @@ static inline void msg_set_bcast_ack(struct tipc_msg *m, u16 n)
         msg_set_bits(m, 1, 0, 0xffff, n);
 }
 
+/* Note: reusing bits in word 1 for ACTIVATE_MSG only, to re-synch
+ * link peer session number
+ */
+static inline bool msg_dest_session_valid(struct tipc_msg *m)
+{
+        return msg_bits(m, 1, 16, 0x1);
+}
+
+static inline void msg_set_dest_session_valid(struct tipc_msg *m, bool valid)
+{
+        msg_set_bits(m, 1, 16, 0x1, valid);
+}
+
+static inline u16 msg_dest_session(struct tipc_msg *m)
+{
+        return msg_bits(m, 1, 0, 0xffff);
+}
+
+static inline void msg_set_dest_session(struct tipc_msg *m, u16 n)
+{
+        msg_set_bits(m, 1, 0, 0xffff, n);
+}
 
 /*
  * Word 2
diff --git a/net/tipc/node.c b/net/tipc/node.c
index db2a6c3e0be9..2dc4919ab23c 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -830,15 +830,16 @@ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
         tipc_node_write_lock(n);
         if (!tipc_link_is_establishing(l)) {
                 __tipc_node_link_down(n, &bearer_id, &xmitq, &maddr);
-                if (delete) {
-                        kfree(l);
-                        le->link = NULL;
-                        n->link_cnt--;
-                }
         } else {
                 /* Defuse pending tipc_node_link_up() */
+                tipc_link_reset(l);
                 tipc_link_fsm_evt(l, LINK_RESET_EVT);
         }
+        if (delete) {
+                kfree(l);
+                le->link = NULL;
+                n->link_cnt--;
+        }
         trace_tipc_node_link_down(n, true, "node link down or deleted!");
         tipc_node_write_unlock(n);
         if (delete)
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 11cdc8f7db63..bf5b54b513bc 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -439,6 +439,8 @@ static int tls_do_encryption(struct sock *sk,
         struct scatterlist *sge = sk_msg_elem(msg_en, start);
         int rc;
 
+        memcpy(rec->iv_data, tls_ctx->tx.iv, sizeof(rec->iv_data));
+
         sge->offset += tls_ctx->tx.prepend_size;
         sge->length -= tls_ctx->tx.prepend_size;
 
@@ -448,7 +450,7 @@ static int tls_do_encryption(struct sock *sk,
         aead_request_set_ad(aead_req, TLS_AAD_SPACE_SIZE);
         aead_request_set_crypt(aead_req, rec->sg_aead_in,
                                rec->sg_aead_out,
-                               data_len, tls_ctx->tx.iv);
+                               data_len, rec->iv_data);
 
         aead_request_set_callback(aead_req, CRYPTO_TFM_REQ_MAY_BACKLOG,
                                   tls_encrypt_done, sk);
@@ -1792,7 +1794,9 @@ void tls_sw_free_resources_tx(struct sock *sk)
         if (atomic_read(&ctx->encrypt_pending))
                 crypto_wait_req(-EINPROGRESS, &ctx->async_wait);
 
+        release_sock(sk);
         cancel_delayed_work_sync(&ctx->tx_work.work);
+        lock_sock(sk);
 
         /* Tx whatever records we can transmit and abandon the rest */
         tls_tx_records(sk, -1);
diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
index 5d3cce9e8744..15eb5d3d4750 100644
--- a/net/vmw_vsock/virtio_transport.c
+++ b/net/vmw_vsock/virtio_transport.c
@@ -75,6 +75,9 @@ static u32 virtio_transport_get_local_cid(void)
 {
         struct virtio_vsock *vsock = virtio_vsock_get();
 
+        if (!vsock)
+                return VMADDR_CID_ANY;
+
         return vsock->guest_cid;
 }
 
@@ -584,10 +587,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
 
         virtio_vsock_update_guest_cid(vsock);
 
-        ret = vsock_core_init(&virtio_transport.transport);
-        if (ret < 0)
-                goto out_vqs;
-
         vsock->rx_buf_nr = 0;
         vsock->rx_buf_max_nr = 0;
         atomic_set(&vsock->queued_replies, 0);
@@ -618,8 +617,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
         mutex_unlock(&the_virtio_vsock_mutex);
         return 0;
 
-out_vqs:
-        vsock->vdev->config->del_vqs(vsock->vdev);
 out:
         kfree(vsock);
         mutex_unlock(&the_virtio_vsock_mutex);
@@ -637,6 +634,9 @@ static void virtio_vsock_remove(struct virtio_device *vdev)
         flush_work(&vsock->event_work);
         flush_work(&vsock->send_pkt_work);
 
+        /* Reset all connected sockets when the device disappear */
+        vsock_for_each_connected_socket(virtio_vsock_reset_sock);
+
         vdev->config->reset(vdev);
 
         mutex_lock(&vsock->rx_lock);
@@ -669,7 +669,6 @@ static void virtio_vsock_remove(struct virtio_device *vdev)
 
         mutex_lock(&the_virtio_vsock_mutex);
         the_virtio_vsock = NULL;
-        vsock_core_exit();
         mutex_unlock(&the_virtio_vsock_mutex);
 
         vdev->config->del_vqs(vdev);
@@ -702,14 +701,28 @@ static int __init virtio_vsock_init(void)
         virtio_vsock_workqueue = alloc_workqueue("virtio_vsock", 0, 0);
         if (!virtio_vsock_workqueue)
                 return -ENOMEM;
+
         ret = register_virtio_driver(&virtio_vsock_driver);
         if (ret)
-                destroy_workqueue(virtio_vsock_workqueue);
+                goto out_wq;
+
+        ret = vsock_core_init(&virtio_transport.transport);
+        if (ret)
+                goto out_vdr;
+
+        return 0;
+
+out_vdr:
+        unregister_virtio_driver(&virtio_vsock_driver);
+out_wq:
+        destroy_workqueue(virtio_vsock_workqueue);
         return ret;
+
 }
 
 static void __exit virtio_vsock_exit(void)
 {
+        vsock_core_exit();
         unregister_virtio_driver(&virtio_vsock_driver);
         destroy_workqueue(virtio_vsock_workqueue);
 }
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
index c361ce782412..c3d5ab01fba7 100644
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -1651,6 +1651,10 @@ static void vmci_transport_cleanup(struct work_struct *work)
 
 static void vmci_transport_destruct(struct vsock_sock *vsk)
 {
+        /* transport can be NULL if we hit a failure at init() time */
+        if (!vmci_trans(vsk))
+                return;
+
         /* Ensure that the detach callback doesn't use the sk/vsk
          * we are about to destruct.
          */
diff --git a/net/wireless/ap.c b/net/wireless/ap.c
index 882d97bdc6bf..550ac9d827fe 100644
--- a/net/wireless/ap.c
+++ b/net/wireless/ap.c
@@ -41,6 +41,8 @@ int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
                 cfg80211_sched_dfs_chan_update(rdev);
         }
 
+        schedule_work(&cfg80211_disconnect_work);
+
         return err;
 }
 
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 623dfe5e211c..b36ad8efb5e5 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1068,6 +1068,8 @@ static void __cfg80211_unregister_wdev(struct wireless_dev *wdev, bool sync)
 
         ASSERT_RTNL();
 
+        flush_work(&wdev->pmsr_free_wk);
+
         nl80211_notify_iface(rdev, wdev, NL80211_CMD_DEL_INTERFACE);
 
         list_del_rcu(&wdev->list);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index c5d6f3418601..f6b40563dc63 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -445,6 +445,8 @@ void cfg80211_process_wdev_events(struct wireless_dev *wdev);
 bool cfg80211_does_bw_fit_range(const struct ieee80211_freq_range *freq_range,
                                 u32 center_freq_khz, u32 bw_khz);
 
+extern struct work_struct cfg80211_disconnect_work;
+
 /**
  * cfg80211_chandef_dfs_usable - checks if chandef is DFS usable
  * @wiphy: the wiphy to validate against
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 74150ad95823..d91a408db113 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -250,7 +250,7 @@ nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
                 NLA_POLICY_MAX(NLA_U8, 15),
         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
-                NLA_POLICY_MAX(NLA_U8, 15),
+                NLA_POLICY_MAX(NLA_U8, 31),
         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index de9286703280..0216ab555249 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -256,8 +256,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
                 if (err)
                         goto out_err;
         } else {
-                memcpy(req->mac_addr, nla_data(info->attrs[NL80211_ATTR_MAC]),
-                       ETH_ALEN);
+                memcpy(req->mac_addr, wdev_address(wdev), ETH_ALEN);
                 memset(req->mac_addr_mask, 0xff, ETH_ALEN);
         }
 
@@ -272,6 +271,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
 
         req->n_peers = count;
         req->cookie = cfg80211_assign_cookie(rdev);
+        req->nl_portid = info->snd_portid;
 
         err = rdev_start_pmsr(rdev, wdev, req);
         if (err)
@@ -530,14 +530,14 @@ free:
 }
 EXPORT_SYMBOL_GPL(cfg80211_pmsr_report);
 
-void cfg80211_pmsr_free_wk(struct work_struct *work)
+static void cfg80211_pmsr_process_abort(struct wireless_dev *wdev)
 {
-        struct wireless_dev *wdev = container_of(work, struct wireless_dev,
-                                                 pmsr_free_wk);
         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_pmsr_request *req, *tmp;
         LIST_HEAD(free_list);
 
+        lockdep_assert_held(&wdev->mtx);
+
         spin_lock_bh(&wdev->pmsr_lock);
         list_for_each_entry_safe(req, tmp, &wdev->pmsr_list, list) {
                 if (req->nl_portid)
@@ -547,14 +547,22 @@ void cfg80211_pmsr_free_wk(struct work_struct *work)
         spin_unlock_bh(&wdev->pmsr_lock);
 
         list_for_each_entry_safe(req, tmp, &free_list, list) {
-                wdev_lock(wdev);
                 rdev_abort_pmsr(rdev, wdev, req);
-                wdev_unlock(wdev);
 
                 kfree(req);
         }
 }
 
+void cfg80211_pmsr_free_wk(struct work_struct *work)
+{
+        struct wireless_dev *wdev = container_of(work, struct wireless_dev,
+                                                 pmsr_free_wk);
+
+        wdev_lock(wdev);
+        cfg80211_pmsr_process_abort(wdev);
+        wdev_unlock(wdev);
+}
+
 void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev)
 {
         struct cfg80211_pmsr_request *req;
@@ -568,8 +576,8 @@ void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev)
         spin_unlock_bh(&wdev->pmsr_lock);
 
         if (found)
-                schedule_work(&wdev->pmsr_free_wk);
-        flush_work(&wdev->pmsr_free_wk);
+                cfg80211_pmsr_process_abort(wdev);
+
         WARN_ON(!list_empty(&wdev->pmsr_list));
 }
 
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index f741d8376a46..7d34cb884840 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -667,7 +667,7 @@ static void disconnect_work(struct work_struct *work)
         rtnl_unlock();
 }
 
-static DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
+DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
 
 
 /*
diff --git a/net/wireless/util.c b/net/wireless/util.c
index cd48cdd582c0..ec30e3732c7b 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -5,7 +5,7 @@
  * Copyright 2007-2009  Johannes Berg <johannes@sipsolutions.net>
  * Copyright 2013-2014  Intel Mobile Communications GmbH
  * Copyright 2017       Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
  */
 #include <linux/export.h>
 #include <linux/bitops.h>
@@ -19,6 +19,7 @@
 #include <linux/mpls.h>
 #include <linux/gcd.h>
 #include <linux/bitfield.h>
+#include <linux/nospec.h>
 #include "core.h"
 #include "rdev-ops.h"
 
@@ -715,20 +716,25 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
 {
         unsigned int dscp;
         unsigned char vlan_priority;
+        unsigned int ret;
 
         /* skb->priority values from 256->263 are magic values to
          * directly indicate a specific 802.1d priority.  This is used
          * to allow 802.1d priority to be passed directly in from VLAN
          * tags, etc.
          */
-        if (skb->priority >= 256 && skb->priority <= 263)
-                return skb->priority - 256;
+        if (skb->priority >= 256 && skb->priority <= 263) {
+                ret = skb->priority - 256;
+                goto out;
+        }
 
         if (skb_vlan_tag_present(skb)) {
                 vlan_priority = (skb_vlan_tag_get(skb) & VLAN_PRIO_MASK)
                         >> VLAN_PRIO_SHIFT;
-                if (vlan_priority > 0)
-                        return vlan_priority;
+                if (vlan_priority > 0) {
+                        ret = vlan_priority;
+                        goto out;
+                }
         }
 
         switch (skb->protocol) {
@@ -747,8 +753,9 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
                 if (!mpls)
                         return 0;
 
-                return (ntohl(mpls->entry) & MPLS_LS_TC_MASK)
+                ret = (ntohl(mpls->entry) & MPLS_LS_TC_MASK)
                         >> MPLS_LS_TC_SHIFT;
+                goto out;
         }
         case htons(ETH_P_80221):
                 /* 802.21 is always network control traffic */
@@ -761,18 +768,24 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
                 unsigned int i, tmp_dscp = dscp >> 2;
 
                 for (i = 0; i < qos_map->num_des; i++) {
-                        if (tmp_dscp == qos_map->dscp_exception[i].dscp)
-                                return qos_map->dscp_exception[i].up;
+                        if (tmp_dscp == qos_map->dscp_exception[i].dscp) {
+                                ret = qos_map->dscp_exception[i].up;
+                                goto out;
+                        }
                 }
 
                 for (i = 0; i < 8; i++) {
                         if (tmp_dscp >= qos_map->up[i].low &&
-                            tmp_dscp <= qos_map->up[i].high)
-                                return i;
+                            tmp_dscp <= qos_map->up[i].high) {
+                                ret = i;
+                                goto out;
+                        }
                 }
         }
 
-        return dscp >> 5;
+        ret = dscp >> 5;
+out:
+        return array_index_nospec(ret, IEEE80211_NUM_TIDS);
 }
 EXPORT_SYMBOL(cfg80211_classify8021d);
 
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 5121729b8b63..ec3a828672ef 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -352,17 +352,15 @@ static unsigned int x25_new_lci(struct x25_neigh *nb)
         unsigned int lci = 1;
         struct sock *sk;
 
-        read_lock_bh(&x25_list_lock);
-
-        while ((sk = __x25_find_socket(lci, nb)) != NULL) {
+        while ((sk = x25_find_socket(lci, nb)) != NULL) {
                 sock_put(sk);
                 if (++lci == 4096) {
                         lci = 0;
                         break;
                 }
+                cond_resched();
         }
 
-        read_unlock_bh(&x25_list_lock);
         return lci;
 }
 
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 934492bad8e0..ba0a4048c846 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -680,16 +680,6 @@ static void xfrm_hash_resize(struct work_struct *work)
         mutex_unlock(&hash_resize_mutex);
 }
 
-static void xfrm_hash_reset_inexact_table(struct net *net)
-{
-        struct xfrm_pol_inexact_bin *b;
-
-        lockdep_assert_held(&net->xfrm.xfrm_policy_lock);
-
-        list_for_each_entry(b, &net->xfrm.inexact_bins, inexact_bins)
-                INIT_HLIST_HEAD(&b->hhead);
-}
-
 /* Make sure *pol can be inserted into fastbin.
  * Useful to check that later insert requests will be sucessful
  * (provided xfrm_policy_lock is held throughout).
@@ -833,13 +823,13 @@ static void xfrm_policy_inexact_list_reinsert(struct net *net,
                                               u16 family)
 {
         unsigned int matched_s, matched_d;
-        struct hlist_node *newpos = NULL;
         struct xfrm_policy *policy, *p;
 
         matched_s = 0;
         matched_d = 0;
 
         list_for_each_entry_reverse(policy, &net->xfrm.policy_all, walk.all) {
+                struct hlist_node *newpos = NULL;
                 bool matches_s, matches_d;
 
                 if (!policy->bydst_reinsert)
@@ -849,16 +839,19 @@ static void xfrm_policy_inexact_list_reinsert(struct net *net,
 
                 policy->bydst_reinsert = false;
                 hlist_for_each_entry(p, &n->hhead, bydst) {
-                        if (policy->priority >= p->priority)
+                        if (policy->priority > p->priority)
+                                newpos = &p->bydst;
+                        else if (policy->priority == p->priority &&
+                                 policy->pos > p->pos)
                                 newpos = &p->bydst;
                         else
                                 break;
                 }
 
                 if (newpos)
-                        hlist_add_behind(&policy->bydst, newpos);
+                        hlist_add_behind_rcu(&policy->bydst, newpos);
                 else
-                        hlist_add_head(&policy->bydst, &n->hhead);
+                        hlist_add_head_rcu(&policy->bydst, &n->hhead);
 
                 /* paranoia checks follow.
                  * Check that the reinserted policy matches at least
@@ -893,12 +886,13 @@ static void xfrm_policy_inexact_node_reinsert(struct net *net,
                                               struct rb_root *new,
                                               u16 family)
 {
-        struct rb_node **p, *parent = NULL;
         struct xfrm_pol_inexact_node *node;
+        struct rb_node **p, *parent;
 
         /* we should not have another subtree here */
         WARN_ON_ONCE(!RB_EMPTY_ROOT(&n->root));
-
+restart:
+        parent = NULL;
         p = &new->rb_node;
         while (*p) {
                 u8 prefixlen;
@@ -918,12 +912,11 @@ static void xfrm_policy_inexact_node_reinsert(struct net *net,
                 } else {
                         struct xfrm_policy *tmp;
 
-                        hlist_for_each_entry(tmp, &node->hhead, bydst)
-                                tmp->bydst_reinsert = true;
-                        hlist_for_each_entry(tmp, &n->hhead, bydst)
+                        hlist_for_each_entry(tmp, &n->hhead, bydst) {
                                 tmp->bydst_reinsert = true;
+                                hlist_del_rcu(&tmp->bydst);
+                        }
 
-                        INIT_HLIST_HEAD(&node->hhead);
                         xfrm_policy_inexact_list_reinsert(net, node, family);
 
                         if (node->prefixlen == n->prefixlen) {
@@ -935,8 +928,7 @@ static void xfrm_policy_inexact_node_reinsert(struct net *net,
                         kfree_rcu(n, rcu);
                         n = node;
                         n->prefixlen = prefixlen;
-                        *p = new->rb_node;
-                        parent = NULL;
+                        goto restart;
                 }
         }
 
@@ -965,12 +957,11 @@ static void xfrm_policy_inexact_node_merge(struct net *net,
                                                   family);
         }
 
-        hlist_for_each_entry(tmp, &v->hhead, bydst)
-                tmp->bydst_reinsert = true;
-        hlist_for_each_entry(tmp, &n->hhead, bydst)
+        hlist_for_each_entry(tmp, &v->hhead, bydst) {
                 tmp->bydst_reinsert = true;
+                hlist_del_rcu(&tmp->bydst);
+        }
 
-        INIT_HLIST_HEAD(&n->hhead);
         xfrm_policy_inexact_list_reinsert(net, n, family);
 }
 
@@ -1235,6 +1226,7 @@ static void xfrm_hash_rebuild(struct work_struct *work)
         } while (read_seqretry(&net->xfrm.policy_hthresh.lock, seq));
 
         spin_lock_bh(&net->xfrm.xfrm_policy_lock);
+        write_seqcount_begin(&xfrm_policy_hash_generation);
 
         /* make sure that we can insert the indirect policies again before
          * we start with destructive action.
@@ -1278,10 +1270,14 @@ static void xfrm_hash_rebuild(struct work_struct *work)
         }
 
         /* reset the bydst and inexact table in all directions */
-        xfrm_hash_reset_inexact_table(net);
-
         for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
-                INIT_HLIST_HEAD(&net->xfrm.policy_inexact[dir]);
+                struct hlist_node *n;
+
+                hlist_for_each_entry_safe(policy, n,
+                                          &net->xfrm.policy_inexact[dir],
+                                          bydst_inexact_list)
+                        hlist_del_init(&policy->bydst_inexact_list);
+
                 hmask = net->xfrm.policy_bydst[dir].hmask;
                 odst = net->xfrm.policy_bydst[dir].table;
                 for (i = hmask; i >= 0; i--)
@@ -1313,6 +1309,9 @@ static void xfrm_hash_rebuild(struct work_struct *work)
                 newpos = NULL;
                 chain = policy_hash_bysel(net, &policy->selector,
                                           policy->family, dir);
+
+                hlist_del_rcu(&policy->bydst);
+
                 if (!chain) {
                         void *p = xfrm_policy_inexact_insert(policy, dir, 0);
 
@@ -1334,6 +1333,7 @@ static void xfrm_hash_rebuild(struct work_struct *work)
 
 out_unlock:
         __xfrm_policy_inexact_flush(net);
+        write_seqcount_end(&xfrm_policy_hash_generation);
         spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
 
         mutex_unlock(&hash_resize_mutex);
@@ -2600,7 +2600,10 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
                 dst_copy_metrics(dst1, dst);
 
                 if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
-                        __u32 mark = xfrm_smark_get(fl->flowi_mark, xfrm[i]);
+                        __u32 mark = 0;
+
+                        if (xfrm[i]->props.smark.v || xfrm[i]->props.smark.m)
+                                mark = xfrm_smark_get(fl->flowi_mark, xfrm[i]);
 
                         family = xfrm[i]->props.family;
                         dst = xfrm_dst_lookup(xfrm[i], tos, fl->flowi_oif,
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 277c1c46fe94..c6d26afcf89d 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1488,10 +1488,15 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
                 if (!ut[i].family)
                         ut[i].family = family;
 
-                if ((ut[i].mode == XFRM_MODE_TRANSPORT) &&
-                    (ut[i].family != prev_family))
-                        return -EINVAL;
-
+                switch (ut[i].mode) {
+                case XFRM_MODE_TUNNEL:
+                case XFRM_MODE_BEET:
+                        break;
+                default:
+                        if (ut[i].family != prev_family)
+                                return -EINVAL;
+                        break;
+                }
                 if (ut[i].mode >= XFRM_MODE_MAX)
                         return -EINVAL;
 
diff --git a/samples/mei/mei-amt-version.c b/samples/mei/mei-amt-version.c
index 33e67bd1dc34..32234481ad7d 100644
--- a/samples/mei/mei-amt-version.c
+++ b/samples/mei/mei-amt-version.c
@@ -117,7 +117,7 @@ static bool mei_init(struct mei *me, const uuid_le *guid,
 
         me->verbose = verbose;
 
-        me->fd = open("/dev/mei", O_RDWR);
+        me->fd = open("/dev/mei0", O_RDWR);
         if (me->fd == -1) {
                 mei_err(me, "Cannot establish a handle to the Intel MEI driver\n");
                 goto err;
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 08c88de0ffda..11975ec8d566 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -1444,7 +1444,10 @@ check:
                         new = aa_label_merge(label, target, GFP_KERNEL);
                 if (IS_ERR_OR_NULL(new)) {
                         info = "failed to build target label";
-                        error = PTR_ERR(new);
+                        if (!new)
+                                error = -ENOMEM;
+                        else
+                                error = PTR_ERR(new);
                         new = NULL;
                         perms.allow = 0;
                         goto audit;
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 2c010874329f..8db1731d046a 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -1599,12 +1599,14 @@ static unsigned int apparmor_ipv4_postroute(void *priv,
         return apparmor_ip_postroute(priv, skb, state);
 }
 
+#if IS_ENABLED(CONFIG_IPV6)
 static unsigned int apparmor_ipv6_postroute(void *priv,
                                             struct sk_buff *skb,
                                             const struct nf_hook_state *state)
 {
         return apparmor_ip_postroute(priv, skb, state);
 }
+#endif
 
 static const struct nf_hook_ops apparmor_nf_ops[] = {
         {
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 40013b26f671..6c0b30391ba9 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -2177,16 +2177,11 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
                 snd_pcm_update_hw_ptr(substream);
 
         if (!is_playback &&
-            runtime->status->state == SNDRV_PCM_STATE_PREPARED) {
-                if (size >= runtime->start_threshold) {
-                        err = snd_pcm_start(substream);
-                        if (err < 0)
-                                goto _end_unlock;
-                } else {
-                        /* nothing to do */
-                        err = 0;
+            runtime->status->state == SNDRV_PCM_STATE_PREPARED &&
+            size >= runtime->start_threshold) {
+                err = snd_pcm_start(substream);
+                if (err < 0)
                         goto _end_unlock;
-                }
         }
 
         avail = snd_pcm_avail(substream);
diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c
index 9174f1b3a987..1ec706ced75c 100644
--- a/sound/pci/hda/hda_bind.c
+++ b/sound/pci/hda/hda_bind.c
@@ -115,7 +115,8 @@ static int hda_codec_driver_probe(struct device *dev)
         err = snd_hda_codec_build_controls(codec);
         if (err < 0)
                 goto error_module;
-        if (codec->card->registered) {
+        /* only register after the bus probe finished; otherwise it's racy */
+        if (!codec->bus->bus_probing && codec->card->registered) {
                 err = snd_card_register(codec->card);
                 if (err < 0)
                         goto error_module;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index e784130ea4e0..e5c49003e75f 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2185,6 +2185,7 @@ static int azx_probe_continue(struct azx *chip)
         int dev = chip->dev_index;
         int err;
 
+        to_hda_bus(bus)->bus_probing = 1;
         hda->probe_continued = 1;
 
         /* bind with i915 if needed */
@@ -2269,6 +2270,7 @@ out_free:
         if (err < 0)
                 hda->init_failed = 1;
         complete_all(&hda->probe_wait);
+        to_hda_bus(bus)->bus_probing = 0;
         return err;
 }
 
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index e5bdbc245682..29882bda7632 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -8451,8 +8451,10 @@ static void ca0132_free(struct hda_codec *codec)
         ca0132_exit_chip(codec);
 
         snd_hda_power_down(codec);
-        if (IS_ENABLED(CONFIG_PCI) && spec->mem_base)
+#ifdef CONFIG_PCI
+        if (spec->mem_base)
                 pci_iounmap(codec->bus->pci, spec->mem_base);
+#endif
         kfree(spec->spec_init_verbs);
         kfree(codec->spec);
 }
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 152f54137082..a4ee7656d9ee 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -924,6 +924,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
         SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK),
+        SND_PCI_QUIRK(0x103c, 0x83b2, "HP EliteBook 840 G5", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index b4f472157ebd..6df758adff84 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -117,6 +117,7 @@ struct alc_spec {
         int codec_variant;      /* flag for other variants */
         unsigned int has_alc5505_dsp:1;
         unsigned int no_depop_delay:1;
+        unsigned int done_hp_init:1;
 
         /* for PLL fix */
         hda_nid_t pll_nid;
@@ -514,6 +515,15 @@ static void alc_auto_init_amp(struct hda_codec *codec, int type)
         }
 }
 
+/* get a primary headphone pin if available */
+static hda_nid_t alc_get_hp_pin(struct alc_spec *spec)
+{
+        if (spec->gen.autocfg.hp_pins[0])
+                return spec->gen.autocfg.hp_pins[0];
+        if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
+                return spec->gen.autocfg.line_out_pins[0];
+        return 0;
+}
 
 /*
  * Realtek SSID verification
@@ -724,9 +734,7 @@ do_sku:
          * 15   : 1 --> enable the function "Mute internal speaker
          *              when the external headphone out jack is plugged"
          */
-        if (!spec->gen.autocfg.hp_pins[0] &&
-            !(spec->gen.autocfg.line_out_pins[0] &&
-              spec->gen.autocfg.line_out_type == AUTO_PIN_HP_OUT)) {
+        if (!alc_get_hp_pin(spec)) {
                 hda_nid_t nid;
                 tmp = (ass >> 11) & 0x3;        /* HP to chassis */
                 nid = ports[tmp];
@@ -2958,7 +2966,7 @@ static void alc282_restore_default_value(struct hda_codec *codec)
 static void alc282_init(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp_pin_sense;
         int coef78;
 
@@ -2995,7 +3003,7 @@ static void alc282_init(struct hda_codec *codec)
 static void alc282_shutup(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp_pin_sense;
         int coef78;
 
@@ -3073,14 +3081,9 @@ static void alc283_restore_default_value(struct hda_codec *codec)
 static void alc283_init(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp_pin_sense;
 
-        if (!spec->gen.autocfg.hp_outs) {
-                if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-                        hp_pin = spec->gen.autocfg.line_out_pins[0];
-        }
-
         alc283_restore_default_value(codec);
 
         if (!hp_pin)
@@ -3114,14 +3117,9 @@ static void alc283_init(struct hda_codec *codec)
 static void alc283_shutup(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp_pin_sense;
 
-        if (!spec->gen.autocfg.hp_outs) {
-                if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-                        hp_pin = spec->gen.autocfg.line_out_pins[0];
-        }
-
         if (!hp_pin) {
                 alc269_shutup(codec);
                 return;
@@ -3155,7 +3153,7 @@ static void alc283_shutup(struct hda_codec *codec)
 static void alc256_init(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp_pin_sense;
 
         if (!hp_pin)
@@ -3191,7 +3189,7 @@ static void alc256_init(struct hda_codec *codec)
 static void alc256_shutup(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp_pin_sense;
 
         if (!hp_pin) {
@@ -3227,7 +3225,7 @@ static void alc256_shutup(struct hda_codec *codec)
 static void alc225_init(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp1_pin_sense, hp2_pin_sense;
 
         if (!hp_pin)
@@ -3270,7 +3268,7 @@ static void alc225_init(struct hda_codec *codec)
 static void alc225_shutup(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp1_pin_sense, hp2_pin_sense;
 
         if (!hp_pin) {
@@ -3314,7 +3312,7 @@ static void alc225_shutup(struct hda_codec *codec)
 static void alc_default_init(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp_pin_sense;
 
         if (!hp_pin)
@@ -3343,7 +3341,7 @@ static void alc_default_init(struct hda_codec *codec)
 static void alc_default_shutup(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
         bool hp_pin_sense;
 
         if (!hp_pin) {
@@ -3372,6 +3370,48 @@ static void alc_default_shutup(struct hda_codec *codec)
         snd_hda_shutup_pins(codec);
 }
 
+static void alc294_hp_init(struct hda_codec *codec)
+{
+        struct alc_spec *spec = codec->spec;
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
+        int i, val;
+
+        if (!hp_pin)
+                return;
+
+        snd_hda_codec_write(codec, hp_pin, 0,
+                            AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+
+        msleep(100);
+
+        snd_hda_codec_write(codec, hp_pin, 0,
+                            AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+        alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */
+        alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */
+
+        /* Wait for depop procedure finish  */
+        val = alc_read_coefex_idx(codec, 0x58, 0x01);
+        for (i = 0; i < 20 && val & 0x0080; i++) {
+                msleep(50);
+                val = alc_read_coefex_idx(codec, 0x58, 0x01);
+        }
+        /* Set HP depop to auto mode */
+        alc_update_coef_idx(codec, 0x6f, 0x000f, 0x000b);
+        msleep(50);
+}
+
+static void alc294_init(struct hda_codec *codec)
+{
+        struct alc_spec *spec = codec->spec;
+
+        if (!spec->done_hp_init) {
+                alc294_hp_init(codec);
+                spec->done_hp_init = true;
+        }
+        alc_default_init(codec);
+}
+
 static void alc5505_coef_set(struct hda_codec *codec, unsigned int index_reg,
                              unsigned int val)
 {
@@ -4737,7 +4777,7 @@ static void alc_update_headset_mode(struct hda_codec *codec)
         struct alc_spec *spec = codec->spec;
 
         hda_nid_t mux_pin = spec->gen.imux_pins[spec->gen.cur_mux[0]];
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
 
         int new_headset_mode;
 
@@ -5016,7 +5056,7 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec,
 static void alc_shutup_dell_xps13(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        int hp_pin = spec->gen.autocfg.hp_pins[0];
+        int hp_pin = alc_get_hp_pin(spec);
 
         /* Prevent pop noises when headphones are plugged in */
         snd_hda_codec_write(codec, hp_pin, 0,
@@ -5109,7 +5149,7 @@ static void alc271_hp_gate_mic_jack(struct hda_codec *codec,
 
         if (action == HDA_FIXUP_ACT_PROBE) {
                 int mic_pin = find_ext_mic_pin(codec);
-                int hp_pin = spec->gen.autocfg.hp_pins[0];
+                int hp_pin = alc_get_hp_pin(spec);
 
                 if (snd_BUG_ON(!mic_pin || !hp_pin))
                         return;
@@ -5591,6 +5631,7 @@ enum {
         ALC294_FIXUP_ASUS_HEADSET_MIC,
         ALC294_FIXUP_ASUS_SPK,
         ALC225_FIXUP_HEADSET_JACK,
+        ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -6537,6 +6578,15 @@ static const struct hda_fixup alc269_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc_fixup_headset_jack,
         },
+        [ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x1a, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6715,6 +6765,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
         SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
         SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
+        SND_PCI_QUIRK(0x1558, 0x1325, "System76 Darter Pro (darp5)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
@@ -7373,37 +7424,6 @@ static void alc269_fill_coef(struct hda_codec *codec)
         alc_update_coef_idx(codec, 0x4, 0, 1<<11);
 }
 
-static void alc294_hp_init(struct hda_codec *codec)
-{
-        struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
-        int i, val;
-
-        if (!hp_pin)
-                return;
-
-        snd_hda_codec_write(codec, hp_pin, 0,
-                            AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
-
-        msleep(100);
-
-        snd_hda_codec_write(codec, hp_pin, 0,
-                            AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
-
-        alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */
-        alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */
-
-        /* Wait for depop procedure finish  */
-        val = alc_read_coefex_idx(codec, 0x58, 0x01);
-        for (i = 0; i < 20 && val & 0x0080; i++) {
-                msleep(50);
-                val = alc_read_coefex_idx(codec, 0x58, 0x01);
-        }
-        /* Set HP depop to auto mode */
-        alc_update_coef_idx(codec, 0x6f, 0x000f, 0x000b);
-        msleep(50);
-}
-
 /*
  */
 static int patch_alc269(struct hda_codec *codec)
@@ -7529,7 +7549,7 @@ static int patch_alc269(struct hda_codec *codec)
                 spec->codec_variant = ALC269_TYPE_ALC294;
                 spec->gen.mixer_nid = 0; /* ALC2x4 does not have any loopback mixer path */
                 alc_update_coef_idx(codec, 0x6b, 0x0018, (1<<4) | (1<<3)); /* UAJ MIC Vref control by verb */
-                alc294_hp_init(codec);
+                spec->init_hook = alc294_init;
                 break;
         case 0x10ec0300:
                 spec->codec_variant = ALC269_TYPE_ALC300;
@@ -7541,7 +7561,7 @@ static int patch_alc269(struct hda_codec *codec)
                 spec->codec_variant = ALC269_TYPE_ALC700;
                 spec->gen.mixer_nid = 0; /* ALC700 does not have any loopback mixer path */
                 alc_update_coef_idx(codec, 0x4a, 1 << 15, 0); /* Combo jack auto trigger control */
-                alc294_hp_init(codec);
+                spec->init_hook = alc294_init;
                 break;
 
         }
diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
index d00734d31e04..e5b6769b9797 100644
--- a/sound/soc/codecs/hdmi-codec.c
+++ b/sound/soc/codecs/hdmi-codec.c
@@ -795,6 +795,8 @@ static int hdmi_codec_probe(struct platform_device *pdev)
         if (hcd->spdif)
                 hcp->daidrv[i] = hdmi_spdif_dai;
 
+        dev_set_drvdata(dev, hcp);
+
         ret = devm_snd_soc_register_component(dev, &hdmi_driver, hcp->daidrv,
                                      dai_count);
         if (ret) {
@@ -802,8 +804,6 @@ static int hdmi_codec_probe(struct platform_device *pdev)
                         __func__, ret);
                 return ret;
         }
-
-        dev_set_drvdata(dev, hcp);
         return 0;
 }
 
diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
index 89c43b26c379..a9b91bcfcc09 100644
--- a/sound/soc/codecs/rt5682.c
+++ b/sound/soc/codecs/rt5682.c
@@ -1778,7 +1778,9 @@ static const struct snd_soc_dapm_route rt5682_dapm_routes[] = {
         {"ADC Stereo1 Filter", NULL, "ADC STO1 ASRC", is_using_asrc},
         {"DAC Stereo1 Filter", NULL, "DAC STO1 ASRC", is_using_asrc},
         {"ADC STO1 ASRC", NULL, "AD ASRC"},
+        {"ADC STO1 ASRC", NULL, "DA ASRC"},
         {"ADC STO1 ASRC", NULL, "CLKDET"},
+        {"DAC STO1 ASRC", NULL, "AD ASRC"},
         {"DAC STO1 ASRC", NULL, "DA ASRC"},
         {"DAC STO1 ASRC", NULL, "CLKDET"},
 
diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
index d6c62aa13041..ce00fe2f6aae 100644
--- a/sound/soc/samsung/i2s.c
+++ b/sound/soc/samsung/i2s.c
@@ -700,6 +700,7 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
 {
         struct i2s_dai *i2s = to_info(dai);
         u32 mod, mask = 0, val = 0;
+        struct clk *rclksrc;
         unsigned long flags;
 
         WARN_ON(!pm_runtime_active(dai->dev));
@@ -782,6 +783,10 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
 
         i2s->frmclk = params_rate(params);
 
+        rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC];
+        if (rclksrc && !IS_ERR(rclksrc))
+                i2s->rclk_srcrate = clk_get_rate(rclksrc);
+
         return 0;
 }
 
@@ -886,11 +891,6 @@ static int config_setup(struct i2s_dai *i2s)
                 return 0;
 
         if (!(i2s->quirks & QUIRK_NO_MUXPSR)) {
-                struct clk *rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC];
-
-                if (rclksrc && !IS_ERR(rclksrc))
-                        i2s->rclk_srcrate = clk_get_rate(rclksrc);
-
                 psr = i2s->rclk_srcrate / i2s->frmclk / rfs;
                 writel(((psr - 1) << 8) | PSR_PSREN, i2s->addr + I2SPSR);
                 dev_dbg(&i2s->pdev->dev,
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 59e250cc2e9d..e819e965e1db 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -1526,14 +1526,14 @@ int rsnd_kctrl_new(struct rsnd_mod *mod,
         int ret;
 
         /*
-         * 1) Avoid duplicate register (ex. MIXer case)
-         * 2) re-register if card was rebinded
+         * 1) Avoid duplicate register for DVC with MIX case
+         * 2) Allow duplicate register for MIX
+         * 3) re-register if card was rebinded
          */
         list_for_each_entry(kctrl, &card->controls, list) {
                 struct rsnd_kctrl_cfg *c = kctrl->private_data;
 
-                if (strcmp(kctrl->id.name, name) == 0 &&
-                    c->mod == mod)
+                if (c == cfg)
                         return 0;
         }
 
diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
index 45ef295743ec..f5afab631abb 100644
--- a/sound/soc/sh/rcar/ssi.c
+++ b/sound/soc/sh/rcar/ssi.c
@@ -286,7 +286,7 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,
         if (rsnd_ssi_is_multi_slave(mod, io))
                 return 0;
 
-        if (ssi->usrcnt > 1) {
+        if (ssi->usrcnt > 0) {
                 if (ssi->rate != rate) {
                         dev_err(dev, "SSI parent/child should use same rate\n");
                         return -EINVAL;
diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c
index c5934adcfd01..c74991dd18ab 100644
--- a/sound/soc/sh/rcar/ssiu.c
+++ b/sound/soc/sh/rcar/ssiu.c
@@ -79,7 +79,7 @@ static int rsnd_ssiu_init(struct rsnd_mod *mod,
                 break;
         case 9:
                 for (i = 0; i < 4; i++)
-                        rsnd_mod_write(mod, SSI_SYS_STATUS((i * 2) + 1), 0xf << (id * 4));
+                        rsnd_mod_write(mod, SSI_SYS_STATUS((i * 2) + 1), 0xf << 4);
                 break;
         }
 
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index aae450ba4f08..50617db05c46 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -735,12 +735,17 @@ static struct snd_soc_component *soc_find_component(
         const struct device_node *of_node, const char *name)
 {
         struct snd_soc_component *component;
+        struct device_node *component_of_node;
 
         lockdep_assert_held(&client_mutex);
 
         for_each_component(component) {
                 if (of_node) {
-                        if (component->dev->of_node == of_node)
+                        component_of_node = component->dev->of_node;
+                        if (!component_of_node && component->dev->parent)
+                                component_of_node = component->dev->parent->of_node;
+
+                        if (component_of_node == of_node)
                                 return component;
                 } else if (name && strcmp(component->name, name) == 0) {
                         return component;
@@ -951,7 +956,7 @@ static void soc_remove_dai(struct snd_soc_dai *dai, int order)
 {
         int err;
 
-        if (!dai || !dai->probed ||
+        if (!dai || !dai->probed || !dai->driver ||
             dai->driver->remove_order != order)
                 return;
 
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 2c4c13419539..20bad755888b 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -70,12 +70,16 @@ static int dapm_up_seq[] = {
         [snd_soc_dapm_clock_supply] = 1,
         [snd_soc_dapm_supply] = 2,
         [snd_soc_dapm_micbias] = 3,
+        [snd_soc_dapm_vmid] = 3,
         [snd_soc_dapm_dai_link] = 2,
         [snd_soc_dapm_dai_in] = 4,
         [snd_soc_dapm_dai_out] = 4,
         [snd_soc_dapm_aif_in] = 4,
         [snd_soc_dapm_aif_out] = 4,
         [snd_soc_dapm_mic] = 5,
+        [snd_soc_dapm_siggen] = 5,
+        [snd_soc_dapm_input] = 5,
+        [snd_soc_dapm_output] = 5,
         [snd_soc_dapm_mux] = 6,
         [snd_soc_dapm_demux] = 6,
         [snd_soc_dapm_dac] = 7,
@@ -83,11 +87,19 @@ static int dapm_up_seq[] = {
         [snd_soc_dapm_mixer] = 8,
         [snd_soc_dapm_mixer_named_ctl] = 8,
         [snd_soc_dapm_pga] = 9,
+        [snd_soc_dapm_buffer] = 9,
+        [snd_soc_dapm_scheduler] = 9,
+        [snd_soc_dapm_effect] = 9,
+        [snd_soc_dapm_src] = 9,
+        [snd_soc_dapm_asrc] = 9,
+        [snd_soc_dapm_encoder] = 9,
+        [snd_soc_dapm_decoder] = 9,
         [snd_soc_dapm_adc] = 10,
         [snd_soc_dapm_out_drv] = 11,
         [snd_soc_dapm_hp] = 11,
         [snd_soc_dapm_spk] = 11,
         [snd_soc_dapm_line] = 11,
+        [snd_soc_dapm_sink] = 11,
         [snd_soc_dapm_kcontrol] = 12,
         [snd_soc_dapm_post] = 13,
 };
@@ -100,13 +112,25 @@ static int dapm_down_seq[] = {
         [snd_soc_dapm_spk] = 3,
         [snd_soc_dapm_line] = 3,
         [snd_soc_dapm_out_drv] = 3,
+        [snd_soc_dapm_sink] = 3,
         [snd_soc_dapm_pga] = 4,
+        [snd_soc_dapm_buffer] = 4,
+        [snd_soc_dapm_scheduler] = 4,
+        [snd_soc_dapm_effect] = 4,
+        [snd_soc_dapm_src] = 4,
+        [snd_soc_dapm_asrc] = 4,
+        [snd_soc_dapm_encoder] = 4,
+        [snd_soc_dapm_decoder] = 4,
         [snd_soc_dapm_switch] = 5,
         [snd_soc_dapm_mixer_named_ctl] = 5,
         [snd_soc_dapm_mixer] = 5,
         [snd_soc_dapm_dac] = 6,
         [snd_soc_dapm_mic] = 7,
+        [snd_soc_dapm_siggen] = 7,
+        [snd_soc_dapm_input] = 7,
+        [snd_soc_dapm_output] = 7,
         [snd_soc_dapm_micbias] = 8,
+        [snd_soc_dapm_vmid] = 8,
         [snd_soc_dapm_mux] = 9,
         [snd_soc_dapm_demux] = 9,
         [snd_soc_dapm_aif_in] = 10,
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index 045ef136903d..fc79ec6927e3 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -502,6 +502,7 @@ static void remove_dai(struct snd_soc_component *comp,
 {
         struct snd_soc_dai_driver *dai_drv =
                 container_of(dobj, struct snd_soc_dai_driver, dobj);
+        struct snd_soc_dai *dai;
 
         if (pass != SOC_TPLG_PASS_PCM_DAI)
                 return;
@@ -509,6 +510,10 @@ static void remove_dai(struct snd_soc_component *comp,
         if (dobj->ops && dobj->ops->dai_unload)
                 dobj->ops->dai_unload(comp, dobj);
 
+        list_for_each_entry(dai, &comp->dai_list, list)
+                if (dai->driver == dai_drv)
+                        dai->driver = NULL;
+
         kfree(dai_drv->name);
         list_del(&dobj->list);
         kfree(dai_drv);
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 382847154227..db114f3977e0 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -314,6 +314,9 @@ static int search_roland_implicit_fb(struct usb_device *dev, int ifnum,
         return 0;
 }
 
+/* Setup an implicit feedback endpoint from a quirk. Returns 0 if no quirk
+ * applies. Returns 1 if a quirk was found.
+ */
 static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
                                          struct usb_device *dev,
                                          struct usb_interface_descriptor *altsd,
@@ -384,7 +387,7 @@ add_sync_ep:
 
         subs->data_endpoint->sync_master = subs->sync_endpoint;
 
-        return 0;
+        return 1;
 }
 
 static int set_sync_endpoint(struct snd_usb_substream *subs,
@@ -423,6 +426,10 @@ static int set_sync_endpoint(struct snd_usb_substream *subs,
         if (err < 0)
                 return err;
 
+        /* endpoint set by quirk */
+        if (err > 0)
+                return 0;
+
         if (altsd->bNumEndpoints < 2)
                 return 0;
 
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index ebbadb3a7094..7e65fe853ee3 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1492,6 +1492,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
                         return SNDRV_PCM_FMTBIT_DSD_U32_BE;
                 break;
 
+        case USB_ID(0x10cb, 0x0103): /* The Bit Opus #3; with fp->dsd_raw */
         case USB_ID(0x152a, 0x85de): /* SMSL D1 DAC */
         case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
         case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */
@@ -1566,6 +1567,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
         case 0x20b1:  /* XMOS based devices */
         case 0x152a:  /* Thesycon devices */
         case 0x25ce:  /* Mytek devices */
+        case 0x2ab6:  /* T+A devices */
                 if (fp->dsd_raw)
                         return SNDRV_PCM_FMTBIT_DSD_U32_BE;
                 break;
diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
index 897483457bf0..f7261fad45c1 100644
--- a/tools/bpf/bpftool/common.c
+++ b/tools/bpf/bpftool/common.c
@@ -297,10 +297,8 @@ char *get_fdinfo(int fd, const char *key)
         snprintf(path, sizeof(path), "/proc/self/fdinfo/%d", fd);
 
         fdi = fopen(path, "r");
-        if (!fdi) {
-                p_err("can't open fdinfo: %s", strerror(errno));
+        if (!fdi)
                 return NULL;
-        }
 
         while ((n = getline(&line, &line_n, fdi)) > 0) {
                 char *value;
@@ -313,7 +311,6 @@ char *get_fdinfo(int fd, const char *key)
 
                 value = strchr(line, '\t');
                 if (!value || !value[1]) {
-                        p_err("malformed fdinfo!?");
                         free(line);
                         return NULL;
                 }
@@ -326,7 +323,6 @@ char *get_fdinfo(int fd, const char *key)
                 return line;
         }
 
-        p_err("key '%s' not found in fdinfo", key);
         free(line);
         fclose(fdi);
         return NULL;
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index 2037e3dc864b..1ef1ee2280a2 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -347,6 +347,20 @@ static char **parse_bytes(char **argv, const char *name, unsigned char *val,
         return argv + i;
 }
 
+/* on per cpu maps we must copy the provided value on all value instances */
+static void fill_per_cpu_value(struct bpf_map_info *info, void *value)
+{
+        unsigned int i, n, step;
+
+        if (!map_is_per_cpu(info->type))
+                return;
+
+        n = get_possible_cpus();
+        step = round_up(info->value_size, 8);
+        for (i = 1; i < n; i++)
+                memcpy(value + i * step, value, info->value_size);
+}
+
 static int parse_elem(char **argv, struct bpf_map_info *info,
                       void *key, void *value, __u32 key_size, __u32 value_size,
                       __u32 *flags, __u32 **value_fd)
@@ -426,6 +440,8 @@ static int parse_elem(char **argv, struct bpf_map_info *info,
                         argv = parse_bytes(argv, "value", value, value_size);
                         if (!argv)
                                 return -1;
+
+                        fill_per_cpu_value(info, value);
                 }
 
                 return parse_elem(argv, info, key, NULL, key_size, value_size,
@@ -497,10 +513,9 @@ static int show_map_close_json(int fd, struct bpf_map_info *info)
                                 jsonw_uint_field(json_wtr, "owner_prog_type",
                                                  prog_type);
                 }
-                if (atoi(owner_jited))
-                        jsonw_bool_field(json_wtr, "owner_jited", true);
-                else
-                        jsonw_bool_field(json_wtr, "owner_jited", false);
+                if (owner_jited)
+                        jsonw_bool_field(json_wtr, "owner_jited",
+                                         !!atoi(owner_jited));
 
                 free(owner_prog_type);
                 free(owner_jited);
@@ -553,7 +568,8 @@ static int show_map_close_plain(int fd, struct bpf_map_info *info)
                 char *owner_prog_type = get_fdinfo(fd, "owner_prog_type");
                 char *owner_jited = get_fdinfo(fd, "owner_jited");
 
-                printf("\n\t");
+                if (owner_prog_type || owner_jited)
+                        printf("\n\t");
                 if (owner_prog_type) {
                         unsigned int prog_type = atoi(owner_prog_type);
 
@@ -563,10 +579,9 @@ static int show_map_close_plain(int fd, struct bpf_map_info *info)
                         else
                                 printf("owner_prog_type %d  ", prog_type);
                 }
-                if (atoi(owner_jited))
-                        printf("owner jited");
-                else
-                        printf("owner not jited");
+                if (owner_jited)
+                        printf("owner%s jited",
+                               atoi(owner_jited) ? "" : " not");
 
                 free(owner_prog_type);
                 free(owner_jited);
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 2d1bb7d6ff51..b54ed82b9589 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -78,13 +78,14 @@ static void print_boot_time(__u64 nsecs, char *buf, unsigned int size)
 
 static int prog_fd_by_tag(unsigned char *tag)
 {
-        struct bpf_prog_info info = {};
-        __u32 len = sizeof(info);
         unsigned int id = 0;
         int err;
         int fd;
 
         while (true) {
+                struct bpf_prog_info info = {};
+                __u32 len = sizeof(info);
+
                 err = bpf_prog_get_next_id(id, &id);
                 if (err) {
                         p_err("%s", strerror(errno));
diff --git a/tools/iio/iio_generic_buffer.c b/tools/iio/iio_generic_buffer.c
index 3040830d7797..84545666a09c 100644
--- a/tools/iio/iio_generic_buffer.c
+++ b/tools/iio/iio_generic_buffer.c
@@ -330,7 +330,7 @@ static const struct option longopts[] = {
 
 int main(int argc, char **argv)
 {
-        unsigned long long num_loops = 2;
+        long long num_loops = 2;
         unsigned long timedelay = 1000000;
         unsigned long buf_len = 128;
 
diff --git a/tools/include/uapi/asm/bitsperlong.h b/tools/include/uapi/asm/bitsperlong.h
index fd92ce8388fc..57aaeaf8e192 100644
--- a/tools/include/uapi/asm/bitsperlong.h
+++ b/tools/include/uapi/asm/bitsperlong.h
@@ -15,6 +15,8 @@
 #include "../../arch/ia64/include/uapi/asm/bitsperlong.h"
 #elif defined(__riscv)
 #include "../../arch/riscv/include/uapi/asm/bitsperlong.h"
+#elif defined(__alpha__)
+#include "../../arch/alpha/include/uapi/asm/bitsperlong.h"
 #else
 #include <asm-generic/bitsperlong.h>
 #endif
diff --git a/tools/include/uapi/linux/in.h b/tools/include/uapi/linux/in.h
index f6052e70bf40..a55cb8b10165 100644
--- a/tools/include/uapi/linux/in.h
+++ b/tools/include/uapi/linux/in.h
@@ -268,7 +268,7 @@ struct sockaddr_in {
 #define IN_MULTICAST(a)         IN_CLASSD(a)
 #define IN_MULTICAST_NET        0xe0000000
 
-#define IN_BADCLASS(a)          ((((long int) (a) ) == 0xffffffff)
+#define IN_BADCLASS(a)          (((long int) (a) ) == (long int)0xffffffff)
 #define IN_EXPERIMENTAL(a)      IN_BADCLASS((a))
 
 #define IN_CLASSE(a)            ((((long int) (a)) & 0xf0000000) == 0xf0000000)
diff --git a/tools/perf/Documentation/perf-c2c.txt b/tools/perf/Documentation/perf-c2c.txt
index 095aebdc5bb7..e6150f21267d 100644
--- a/tools/perf/Documentation/perf-c2c.txt
+++ b/tools/perf/Documentation/perf-c2c.txt
@@ -19,8 +19,11 @@ C2C stands for Cache To Cache.
 The perf c2c tool provides means for Shared Data C2C/HITM analysis. It allows
 you to track down the cacheline contentions.
 
-The tool is based on x86's load latency and precise store facility events
-provided by Intel CPUs. These events provide:
+On x86, the tool is based on load latency and precise store facility events
+provided by Intel CPUs. On PowerPC, the tool uses random instruction sampling
+with thresholding feature.
+
+These events provide:
   - memory address of the access
   - type of the access (load and store details)
   - latency (in cycles) of the load access
@@ -46,7 +49,7 @@ RECORD OPTIONS
 
 -l::
 --ldlat::
-        Configure mem-loads latency.
+        Configure mem-loads latency. (x86 only)
 
 -k::
 --all-kernel::
@@ -119,11 +122,16 @@ Following perf record options are configured by default:
   -W,-d,--phys-data,--sample-cpu
 
 Unless specified otherwise with '-e' option, following events are monitored by
-default:
+default on x86:
 
   cpu/mem-loads,ldlat=30/P
   cpu/mem-stores/P
 
+and following on PowerPC:
+
+  cpu/mem-loads/
+  cpu/mem-stores/
+
 User can pass any 'perf record' option behind '--' mark, like (to enable
 callchains and system wide monitoring):
 
diff --git a/tools/perf/Documentation/perf-mem.txt b/tools/perf/Documentation/perf-mem.txt
index f8d2167cf3e7..199ea0f0a6c0 100644
--- a/tools/perf/Documentation/perf-mem.txt
+++ b/tools/perf/Documentation/perf-mem.txt
@@ -82,7 +82,7 @@ RECORD OPTIONS
         Be more verbose (show counter open errors, etc)
 
 --ldlat <n>::
-        Specify desired latency for loads event.
+        Specify desired latency for loads event. (x86 only)
 
 In addition, for report all perf report options are valid, and for record
 all perf record options.
diff --git a/tools/perf/arch/powerpc/util/Build b/tools/perf/arch/powerpc/util/Build
index 2e6595310420..ba98bd006488 100644
--- a/tools/perf/arch/powerpc/util/Build
+++ b/tools/perf/arch/powerpc/util/Build
@@ -2,6 +2,7 @@ libperf-y += header.o
 libperf-y += sym-handling.o
 libperf-y += kvm-stat.o
 libperf-y += perf_regs.o
+libperf-y += mem-events.o
 
 libperf-$(CONFIG_DWARF) += dwarf-regs.o
 libperf-$(CONFIG_DWARF) += skip-callchain-idx.o
diff --git a/tools/perf/arch/powerpc/util/mem-events.c b/tools/perf/arch/powerpc/util/mem-events.c
new file mode 100644
index 000000000000..d08311f04e95
--- /dev/null
+++ b/tools/perf/arch/powerpc/util/mem-events.c
@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: GPL-2.0
+#include "mem-events.h"
+
+/* PowerPC does not support 'ldlat' parameter. */
+char *perf_mem_events__name(int i)
+{
+        if (i == PERF_MEM_EVENTS__LOAD)
+                return (char *) "cpu/mem-loads/";
+
+        return (char *) "cpu/mem-stores/";
+}
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index d079f36d342d..ac221f137ed2 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -1681,13 +1681,8 @@ static void perf_sample__fprint_metric(struct perf_script *script,
                 .force_header = false,
         };
         struct perf_evsel *ev2;
-        static bool init;
         u64 val;
 
-        if (!init) {
-                perf_stat__init_shadow_stats();
-                init = true;
-        }
         if (!evsel->stats)
                 perf_evlist__alloc_stats(script->session->evlist, false);
         if (evsel_script(evsel->leader)->gnum++ == 0)
@@ -1794,7 +1789,7 @@ static void process_event(struct perf_script *script,
                 return;
         }
 
-        if (PRINT_FIELD(TRACE)) {
+        if (PRINT_FIELD(TRACE) && sample->raw_data) {
                 event_format__fprintf(evsel->tp_format, sample->cpu,
                                       sample->raw_data, sample->raw_size, fp);
         }
@@ -2359,6 +2354,8 @@ static int __cmd_script(struct perf_script *script)
 
         signal(SIGINT, sig_handler);
 
+        perf_stat__init_shadow_stats();
+
         /* override event processing functions */
         if (script->show_task_events) {
                 script->tool.comm = process_comm_event;
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index ed4583128b9c..b36061cd1ab8 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -2514,19 +2514,30 @@ static size_t trace__fprintf_thread_summary(struct trace *trace, FILE *fp);
 
 static bool perf_evlist__add_vfs_getname(struct perf_evlist *evlist)
 {
-        struct perf_evsel *evsel = perf_evsel__newtp("probe", "vfs_getname");
+        bool found = false;
+        struct perf_evsel *evsel, *tmp;
+        struct parse_events_error err = { .idx = 0, };
+        int ret = parse_events(evlist, "probe:vfs_getname*", &err);
 
-        if (IS_ERR(evsel))
+        if (ret)
                 return false;
 
-        if (perf_evsel__field(evsel, "pathname") == NULL) {
+        evlist__for_each_entry_safe(evlist, evsel, tmp) {
+                if (!strstarts(perf_evsel__name(evsel), "probe:vfs_getname"))
+                        continue;
+
+                if (perf_evsel__field(evsel, "pathname")) {
+                        evsel->handler = trace__vfs_getname;
+                        found = true;
+                        continue;
+                }
+
+                list_del_init(&evsel->node);
+                evsel->evlist = NULL;
                 perf_evsel__delete(evsel);
-                return false;
         }
 
-        evsel->handler = trace__vfs_getname;
-        perf_evlist__add(evlist, evsel);
-        return true;
+        return found;
 }
 
 static struct perf_evsel *perf_evsel__new_pgfault(u64 config)
diff --git a/tools/perf/tests/attr.py b/tools/perf/tests/attr.py
index 44090a9a19f3..e952127e4fb0 100644
--- a/tools/perf/tests/attr.py
+++ b/tools/perf/tests/attr.py
@@ -1,6 +1,8 @@
 #! /usr/bin/python
 # SPDX-License-Identifier: GPL-2.0
 
+from __future__ import print_function
+
 import os
 import sys
 import glob
@@ -8,7 +10,11 @@ import optparse
 import tempfile
 import logging
 import shutil
-import ConfigParser
+
+try:
+    import configparser
+except ImportError:
+    import ConfigParser as configparser
 
 def data_equal(a, b):
     # Allow multiple values in assignment separated by '|'
@@ -100,20 +106,20 @@ class Event(dict):
     def equal(self, other):
         for t in Event.terms:
             log.debug("      [%s] %s %s" % (t, self[t], other[t]));
-            if not self.has_key(t) or not other.has_key(t):
+            if t not in self or t not in other:
                 return False
             if not data_equal(self[t], other[t]):
                 return False
         return True
 
     def optional(self):
-        if self.has_key('optional') and self['optional'] == '1':
+        if 'optional' in self and self['optional'] == '1':
             return True
         return False
 
     def diff(self, other):
         for t in Event.terms:
-            if not self.has_key(t) or not other.has_key(t):
+            if t not in self or t not in other:
                 continue
             if not data_equal(self[t], other[t]):
                 log.warning("expected %s=%s, got %s" % (t, self[t], other[t]))
@@ -134,7 +140,7 @@ class Event(dict):
 #   - expected values assignments
 class Test(object):
     def __init__(self, path, options):
-        parser = ConfigParser.SafeConfigParser()
+        parser = configparser.SafeConfigParser()
         parser.read(path)
 
         log.warning("running '%s'" % path)
@@ -193,7 +199,7 @@ class Test(object):
         return True
 
     def load_events(self, path, events):
-        parser_event = ConfigParser.SafeConfigParser()
+        parser_event = configparser.SafeConfigParser()
         parser_event.read(path)
 
         # The event record section header contains 'event' word,
@@ -207,7 +213,7 @@ class Test(object):
             # Read parent event if there's any
             if (':' in section):
                 base = section[section.index(':') + 1:]
-                parser_base = ConfigParser.SafeConfigParser()
+                parser_base = configparser.SafeConfigParser()
                 parser_base.read(self.test_dir + '/' + base)
                 base_items = parser_base.items('event')
 
@@ -322,9 +328,9 @@ def run_tests(options):
     for f in glob.glob(options.test_dir + '/' + options.test):
         try:
             Test(f, options).run()
-        except Unsup, obj:
+        except Unsup as obj:
             log.warning("unsupp  %s" % obj.getMsg())
-        except Notest, obj:
+        except Notest as obj:
             log.warning("skipped %s" % obj.getMsg())
 
 def setup_log(verbose):
@@ -363,7 +369,7 @@ def main():
     parser.add_option("-p", "--perf",
                       action="store", type="string", dest="perf")
     parser.add_option("-v", "--verbose",
-                      action="count", dest="verbose")
+                      default=0, action="count", dest="verbose")
 
     options, args = parser.parse_args()
     if args:
@@ -373,7 +379,7 @@ def main():
     setup_log(options.verbose)
 
     if not options.test_dir:
-        print 'FAILED no -d option specified'
+        print('FAILED no -d option specified')
         sys.exit(-1)
 
     if not options.test:
@@ -382,8 +388,8 @@ def main():
     try:
         run_tests(options)
 
-    except Fail, obj:
-        print "FAILED %s" % obj.getMsg();
+    except Fail as obj:
+        print("FAILED %s" % obj.getMsg())
         sys.exit(-1)
 
     sys.exit(0)
diff --git a/tools/perf/tests/evsel-tp-sched.c b/tools/perf/tests/evsel-tp-sched.c
index 5f8501c68da4..5cbba70bcdd0 100644
--- a/tools/perf/tests/evsel-tp-sched.c
+++ b/tools/perf/tests/evsel-tp-sched.c
@@ -17,7 +17,7 @@ static int perf_evsel__test_field(struct perf_evsel *evsel, const char *name,
                 return -1;
         }
 
-        is_signed = !!(field->flags | TEP_FIELD_IS_SIGNED);
+        is_signed = !!(field->flags & TEP_FIELD_IS_SIGNED);
         if (should_be_signed && !is_signed) {
                 pr_debug("%s: \"%s\" signedness(%d) is wrong, should be %d\n",
                          evsel->name, name, is_signed, should_be_signed);
diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c
index 1d00e5ec7906..82e16bf84466 100644
--- a/tools/perf/ui/browsers/annotate.c
+++ b/tools/perf/ui/browsers/annotate.c
@@ -224,20 +224,24 @@ static unsigned int annotate_browser__refresh(struct ui_browser *browser)
         return ret;
 }
 
-static int disasm__cmp(struct annotation_line *a, struct annotation_line *b)
+static double disasm__cmp(struct annotation_line *a, struct annotation_line *b,
+                                                  int percent_type)
 {
         int i;
 
         for (i = 0; i < a->data_nr; i++) {
-                if (a->data[i].percent == b->data[i].percent)
+                if (a->data[i].percent[percent_type] == b->data[i].percent[percent_type])
                         continue;
-                return a->data[i].percent < b->data[i].percent;
+                return a->data[i].percent[percent_type] -
+                           b->data[i].percent[percent_type];
         }
         return 0;
 }
 
-static void disasm_rb_tree__insert(struct rb_root *root, struct annotation_line *al)
+static void disasm_rb_tree__insert(struct annotate_browser *browser,
+                                struct annotation_line *al)
 {
+        struct rb_root *root = &browser->entries;
         struct rb_node **p = &root->rb_node;
         struct rb_node *parent = NULL;
         struct annotation_line *l;
@@ -246,7 +250,7 @@ static void disasm_rb_tree__insert(struct rb_root *root, struct annotation_line
                 parent = *p;
                 l = rb_entry(parent, struct annotation_line, rb_node);
 
-                if (disasm__cmp(al, l))
+                if (disasm__cmp(al, l, browser->opts->percent_type) < 0)
                         p = &(*p)->rb_left;
                 else
                         p = &(*p)->rb_right;
@@ -329,7 +333,7 @@ static void annotate_browser__calc_percent(struct annotate_browser *browser,
                         RB_CLEAR_NODE(&pos->al.rb_node);
                         continue;
                 }
-                disasm_rb_tree__insert(&browser->entries, &pos->al);
+                disasm_rb_tree__insert(browser, &pos->al);
         }
         pthread_mutex_unlock(&notes->lock);
 
diff --git a/tools/perf/util/c++/clang.cpp b/tools/perf/util/c++/clang.cpp
index 89512504551b..39c0004f2886 100644
--- a/tools/perf/util/c++/clang.cpp
+++ b/tools/perf/util/c++/clang.cpp
@@ -160,7 +160,7 @@ getBPFObjectFromModule(llvm::Module *Module)
         }
         PM.run(*Module);
 
-        return std::move(Buffer);
+        return Buffer;
 }
 
 }
diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
index 1ccbd3342069..383674f448fc 100644
--- a/tools/perf/util/cpumap.c
+++ b/tools/perf/util/cpumap.c
@@ -134,7 +134,12 @@ struct cpu_map *cpu_map__new(const char *cpu_list)
         if (!cpu_list)
                 return cpu_map__read_all_cpu_map();
 
-        if (!isdigit(*cpu_list))
+        /*
+         * must handle the case of empty cpumap to cover
+         * TOPOLOGY header for NUMA nodes with no CPU
+         * ( e.g., because of CPU hotplug)
+         */
+        if (!isdigit(*cpu_list) && *cpu_list != '\0')
                 goto out;
 
         while (isdigit(*cpu_list)) {
@@ -181,8 +186,10 @@ struct cpu_map *cpu_map__new(const char *cpu_list)
 
         if (nr_cpus > 0)
                 cpus = cpu_map__trim_new(nr_cpus, tmp_cpus);
-        else
+        else if (*cpu_list != '\0')
                 cpus = cpu_map__default_new();
+        else
+                cpus = cpu_map__dummy_new();
 invalid:
         free(tmp_cpus);
 out:
diff --git a/tools/perf/util/mem-events.c b/tools/perf/util/mem-events.c
index 93f74d8d3cdd..42c3e5a229d2 100644
--- a/tools/perf/util/mem-events.c
+++ b/tools/perf/util/mem-events.c
@@ -28,7 +28,7 @@ struct perf_mem_event perf_mem_events[PERF_MEM_EVENTS__MAX] = {
 static char mem_loads_name[100];
 static bool mem_loads_name__init;
 
-char *perf_mem_events__name(int i)
+char * __weak perf_mem_events__name(int i)
 {
         if (i == PERF_MEM_EVENTS__LOAD) {
                 if (!mem_loads_name__init) {
diff --git a/tools/perf/util/ordered-events.c b/tools/perf/util/ordered-events.c
index 897589507d97..ea523d3b248f 100644
--- a/tools/perf/util/ordered-events.c
+++ b/tools/perf/util/ordered-events.c
@@ -391,8 +391,10 @@ void ordered_events__free(struct ordered_events *oe)
          * Current buffer might not have all the events allocated
          * yet, we need to free only allocated ones ...
          */
-        list_del(&oe->buffer->list);
-        ordered_events_buffer__free(oe->buffer, oe->buffer_idx, oe);
+        if (oe->buffer) {
+                list_del(&oe->buffer->list);
+                ordered_events_buffer__free(oe->buffer, oe->buffer_idx, oe);
+        }
 
         /* ... and continue with the rest */
         list_for_each_entry_safe(buffer, tmp, &oe->to_free, list) {
diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py
index 63f758c655d5..64d1f36dee99 100644
--- a/tools/perf/util/setup.py
+++ b/tools/perf/util/setup.py
@@ -17,6 +17,8 @@ if cc == "clang":
             vars[var] = sub("-mcet", "", vars[var])
         if not clang_has_option("-fcf-protection"):
             vars[var] = sub("-fcf-protection", "", vars[var])
+        if not clang_has_option("-fstack-clash-protection"):
+            vars[var] = sub("-fstack-clash-protection", "", vars[var])
 
 from distutils.core import setup, Extension
 
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 66a84d5846c8..dca7dfae69ad 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -19,6 +19,20 @@
 #define EM_AARCH64      183  /* ARM 64 bit */
 #endif
 
+#ifndef ELF32_ST_VISIBILITY
+#define ELF32_ST_VISIBILITY(o)  ((o) & 0x03)
+#endif
+
+/* For ELF64 the definitions are the same.  */
+#ifndef ELF64_ST_VISIBILITY
+#define ELF64_ST_VISIBILITY(o)  ELF32_ST_VISIBILITY (o)
+#endif
+
+/* How to extract information held in the st_other field.  */
+#ifndef GELF_ST_VISIBILITY
+#define GELF_ST_VISIBILITY(val) ELF64_ST_VISIBILITY (val)
+#endif
+
 typedef Elf64_Nhdr GElf_Nhdr;
 
 #ifdef HAVE_CPLUS_DEMANGLE_SUPPORT
@@ -87,6 +101,11 @@ static inline uint8_t elf_sym__type(const GElf_Sym *sym)
         return GELF_ST_TYPE(sym->st_info);
 }
 
+static inline uint8_t elf_sym__visibility(const GElf_Sym *sym)
+{
+        return GELF_ST_VISIBILITY(sym->st_other);
+}
+
 #ifndef STT_GNU_IFUNC
 #define STT_GNU_IFUNC 10
 #endif
@@ -111,7 +130,9 @@ static inline int elf_sym__is_label(const GElf_Sym *sym)
         return elf_sym__type(sym) == STT_NOTYPE &&
                 sym->st_name != 0 &&
                 sym->st_shndx != SHN_UNDEF &&
-                sym->st_shndx != SHN_ABS;
+                sym->st_shndx != SHN_ABS &&
+                elf_sym__visibility(sym) != STV_HIDDEN &&
+                elf_sym__visibility(sym) != STV_INTERNAL;
 }
 
 static bool elf_sym__filter(GElf_Sym *sym)
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 1a2bd15c5b6e..400ee81a3043 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -10,6 +10,7 @@ TARGETS += drivers/dma-buf
 TARGETS += efivarfs
 TARGETS += exec
 TARGETS += filesystems
+TARGETS += filesystems/binderfs
 TARGETS += firmware
 TARGETS += ftrace
 TARGETS += futex
diff --git a/tools/testing/selftests/bpf/bpf_util.h b/tools/testing/selftests/bpf/bpf_util.h
index 315a44fa32af..84fd6f1bf33e 100644
--- a/tools/testing/selftests/bpf/bpf_util.h
+++ b/tools/testing/selftests/bpf/bpf_util.h
@@ -13,7 +13,7 @@ static inline unsigned int bpf_num_possible_cpus(void)
         unsigned int start, end, possible_cpus = 0;
         char buff[128];
         FILE *fp;
-        int n;
+        int len, n, i, j = 0;
 
         fp = fopen(fcpu, "r");
         if (!fp) {
@@ -21,17 +21,27 @@ static inline unsigned int bpf_num_possible_cpus(void)
                 exit(1);
         }
 
-        while (fgets(buff, sizeof(buff), fp)) {
-                n = sscanf(buff, "%u-%u", &start, &end);
-                if (n == 0) {
-                        printf("Failed to retrieve # possible CPUs!\n");
-                        exit(1);
-                } else if (n == 1) {
-                        end = start;
+        if (!fgets(buff, sizeof(buff), fp)) {
+                printf("Failed to read %s!\n", fcpu);
+                exit(1);
+        }
+
+        len = strlen(buff);
+        for (i = 0; i <= len; i++) {
+                if (buff[i] == ',' || buff[i] == '\0') {
+                        buff[i] = '\0';
+                        n = sscanf(&buff[j], "%u-%u", &start, &end);
+                        if (n <= 0) {
+                                printf("Failed to retrieve # possible CPUs!\n");
+                                exit(1);
+                        } else if (n == 1) {
+                                end = start;
+                        }
+                        possible_cpus += end - start + 1;
+                        j = i + 1;
                 }
-                possible_cpus = start == 0 ? end + 1 : 0;
-                break;
         }
+
         fclose(fp);
 
         return possible_cpus;
diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c
index a0bd04befe87..91420fa83b08 100644
--- a/tools/testing/selftests/bpf/test_btf.c
+++ b/tools/testing/selftests/bpf/test_btf.c
@@ -1881,13 +1881,12 @@ static struct btf_raw_test raw_tests[] = {
 },
 
 {
-        .descr = "func proto (CONST=>TYPEDEF=>FUNC_PROTO)",
+        .descr = "func proto (TYPEDEF=>FUNC_PROTO)",
         .raw_types = {
                 BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),  /* [1] */
                 BTF_TYPE_INT_ENC(0, 0, 0, 32, 4),               /* [2] */
-                BTF_CONST_ENC(4),                               /* [3] */
-                BTF_TYPEDEF_ENC(NAME_TBD, 5),                   /* [4] */
-                BTF_FUNC_PROTO_ENC(0, 2),                       /* [5] */
+                BTF_TYPEDEF_ENC(NAME_TBD, 4),                   /* [3] */
+                BTF_FUNC_PROTO_ENC(0, 2),                       /* [4] */
                         BTF_FUNC_PROTO_ARG_ENC(0, 1),
                         BTF_FUNC_PROTO_ARG_ENC(0, 2),
                 BTF_END_RAW,
@@ -1901,8 +1900,6 @@ static struct btf_raw_test raw_tests[] = {
         .key_type_id = 1,
         .value_type_id = 1,
         .max_entries = 4,
-        .btf_load_err = true,
-        .err_str = "Invalid type_id",
 },
 
 {
diff --git a/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh b/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
index bab13dd025a6..0d26b5e3f966 100755
--- a/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
+++ b/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
@@ -37,6 +37,10 @@ prerequisite()
                 exit $ksft_skip
         fi
 
+        present_cpus=`cat $SYSFS/devices/system/cpu/present`
+        present_max=${present_cpus##*-}
+        echo "present_cpus = $present_cpus present_max = $present_max"
+
         echo -e "\t Cpus in online state: $online_cpus"
 
         offline_cpus=`cat $SYSFS/devices/system/cpu/offline`
@@ -151,6 +155,8 @@ online_cpus=0
 online_max=0
 offline_cpus=0
 offline_max=0
+present_cpus=0
+present_max=0
 
 while getopts e:ahp: opt; do
         case $opt in
@@ -190,9 +196,10 @@ if [ $allcpus -eq 0 ]; then
         online_cpu_expect_success $online_max
 
         if [[ $offline_cpus -gt 0 ]]; then
-                echo -e "\t offline to online to offline: cpu $offline_max"
-                online_cpu_expect_success $offline_max
-                offline_cpu_expect_success $offline_max
+                echo -e "\t offline to online to offline: cpu $present_max"
+                online_cpu_expect_success $present_max
+                offline_cpu_expect_success $present_max
+                online_cpu $present_max
         fi
         exit 0
 else
diff --git a/tools/testing/selftests/filesystems/binderfs/.gitignore b/tools/testing/selftests/filesystems/binderfs/.gitignore
new file mode 100644
index 000000000000..8a5d9bf63dd4
--- /dev/null
+++ b/tools/testing/selftests/filesystems/binderfs/.gitignore
@@ -0,0 +1 @@
+binderfs_test
diff --git a/tools/testing/selftests/filesystems/binderfs/Makefile b/tools/testing/selftests/filesystems/binderfs/Makefile
new file mode 100644
index 000000000000..58cb659b56b4
--- /dev/null
+++ b/tools/testing/selftests/filesystems/binderfs/Makefile
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0
+
+CFLAGS += -I../../../../../usr/include/
+TEST_GEN_PROGS := binderfs_test
+
+include ../../lib.mk
diff --git a/tools/testing/selftests/filesystems/binderfs/binderfs_test.c b/tools/testing/selftests/filesystems/binderfs/binderfs_test.c
new file mode 100644
index 000000000000..8c2ed962e1c7
--- /dev/null
+++ b/tools/testing/selftests/filesystems/binderfs/binderfs_test.c
@@ -0,0 +1,275 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <sched.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/mount.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <linux/android/binder.h>
+#include <linux/android/binderfs.h>
+#include "../../kselftest.h"
+
+static ssize_t write_nointr(int fd, const void *buf, size_t count)
+{
+        ssize_t ret;
+again:
+        ret = write(fd, buf, count);
+        if (ret < 0 && errno == EINTR)
+                goto again;
+
+        return ret;
+}
+
+static void write_to_file(const char *filename, const void *buf, size_t count,
+                          int allowed_errno)
+{
+        int fd, saved_errno;
+        ssize_t ret;
+
+        fd = open(filename, O_WRONLY | O_CLOEXEC);
+        if (fd < 0)
+                ksft_exit_fail_msg("%s - Failed to open file %s\n",
+                                   strerror(errno), filename);
+
+        ret = write_nointr(fd, buf, count);
+        if (ret < 0) {
+                if (allowed_errno && (errno == allowed_errno)) {
+                        close(fd);
+                        return;
+                }
+
+                goto on_error;
+        }
+
+        if ((size_t)ret != count)
+                goto on_error;
+
+        close(fd);
+        return;
+
+on_error:
+        saved_errno = errno;
+        close(fd);
+        errno = saved_errno;
+
+        if (ret < 0)
+                ksft_exit_fail_msg("%s - Failed to write to file %s\n",
+                                   strerror(errno), filename);
+
+        ksft_exit_fail_msg("Failed to write to file %s\n", filename);
+}
+
+static void change_to_userns(void)
+{
+        int ret;
+        uid_t uid;
+        gid_t gid;
+        /* {g,u}id_map files only allow a max of 4096 bytes written to them */
+        char idmap[4096];
+
+        uid = getuid();
+        gid = getgid();
+
+        ret = unshare(CLONE_NEWUSER);
+        if (ret < 0)
+                ksft_exit_fail_msg("%s - Failed to unshare user namespace\n",
+                                   strerror(errno));
+
+        write_to_file("/proc/self/setgroups", "deny", strlen("deny"), ENOENT);
+
+        ret = snprintf(idmap, sizeof(idmap), "0 %d 1", uid);
+        if (ret < 0 || (size_t)ret >= sizeof(idmap))
+                ksft_exit_fail_msg("%s - Failed to prepare uid mapping\n",
+                                   strerror(errno));
+
+        write_to_file("/proc/self/uid_map", idmap, strlen(idmap), 0);
+
+        ret = snprintf(idmap, sizeof(idmap), "0 %d 1", gid);
+        if (ret < 0 || (size_t)ret >= sizeof(idmap))
+                ksft_exit_fail_msg("%s - Failed to prepare uid mapping\n",
+                                   strerror(errno));
+
+        write_to_file("/proc/self/gid_map", idmap, strlen(idmap), 0);
+
+        ret = setgid(0);
+        if (ret)
+                ksft_exit_fail_msg("%s - Failed to setgid(0)\n",
+                                   strerror(errno));
+
+        ret = setuid(0);
+        if (ret)
+                ksft_exit_fail_msg("%s - Failed to setgid(0)\n",
+                                   strerror(errno));
+}
+
+static void change_to_mountns(void)
+{
+        int ret;
+
+        ret = unshare(CLONE_NEWNS);
+        if (ret < 0)
+                ksft_exit_fail_msg("%s - Failed to unshare mount namespace\n",
+                                   strerror(errno));
+
+        ret = mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, 0);
+        if (ret < 0)
+                ksft_exit_fail_msg("%s - Failed to mount / as private\n",
+                                   strerror(errno));
+}
+
+static void rmdir_protect_errno(const char *dir)
+{
+        int saved_errno = errno;
+        (void)rmdir(dir);
+        errno = saved_errno;
+}
+
+static void __do_binderfs_test(void)
+{
+        int fd, ret, saved_errno;
+        size_t len;
+        ssize_t wret;
+        bool keep = false;
+        struct binderfs_device device = { 0 };
+        struct binder_version version = { 0 };
+
+        change_to_mountns();
+
+        ret = mkdir("/dev/binderfs", 0755);
+        if (ret < 0) {
+                if (errno != EEXIST)
+                        ksft_exit_fail_msg(
+                                "%s - Failed to create binderfs mountpoint\n",
+                                strerror(errno));
+
+                keep = true;
+        }
+
+        ret = mount(NULL, "/dev/binderfs", "binder", 0, 0);
+        if (ret < 0) {
+                if (errno != ENODEV)
+                        ksft_exit_fail_msg("%s - Failed to mount binderfs\n",
+                                           strerror(errno));
+
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_skip(
+                        "The Android binderfs filesystem is not available\n");
+        }
+
+        /* binderfs mount test passed */
+        ksft_inc_pass_cnt();
+
+        memcpy(device.name, "my-binder", strlen("my-binder"));
+
+        fd = open("/dev/binderfs/binder-control", O_RDONLY | O_CLOEXEC);
+        if (fd < 0)
+                ksft_exit_fail_msg(
+                        "%s - Failed to open binder-control device\n",
+                        strerror(errno));
+
+        ret = ioctl(fd, BINDER_CTL_ADD, &device);
+        saved_errno = errno;
+        close(fd);
+        errno = saved_errno;
+        if (ret < 0) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg(
+                        "%s - Failed to allocate new binder device\n",
+                        strerror(errno));
+        }
+
+        ksft_print_msg(
+                "Allocated new binder device with major %d, minor %d, and name %s\n",
+                device.major, device.minor, device.name);
+
+        /* binder device allocation test passed */
+        ksft_inc_pass_cnt();
+
+        fd = open("/dev/binderfs/my-binder", O_CLOEXEC | O_RDONLY);
+        if (fd < 0) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg("%s - Failed to open my-binder device\n",
+                                   strerror(errno));
+        }
+
+        ret = ioctl(fd, BINDER_VERSION, &version);
+        saved_errno = errno;
+        close(fd);
+        errno = saved_errno;
+        if (ret < 0) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg(
+                        "%s - Failed to open perform BINDER_VERSION request\n",
+                        strerror(errno));
+        }
+
+        ksft_print_msg("Detected binder version: %d\n",
+                       version.protocol_version);
+
+        /* binder transaction with binderfs binder device passed */
+        ksft_inc_pass_cnt();
+
+        ret = unlink("/dev/binderfs/my-binder");
+        if (ret < 0) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg("%s - Failed to delete binder device\n",
+                                   strerror(errno));
+        }
+
+        /* binder device removal passed */
+        ksft_inc_pass_cnt();
+
+        ret = unlink("/dev/binderfs/binder-control");
+        if (!ret) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg("Managed to delete binder-control device\n");
+        } else if (errno != EPERM) {
+                keep ? : rmdir_protect_errno("/dev/binderfs");
+                ksft_exit_fail_msg(
+                        "%s - Failed to delete binder-control device but exited with unexpected error code\n",
+                        strerror(errno));
+        }
+
+        /* binder-control device removal failed as expected */
+        ksft_inc_xfail_cnt();
+
+on_error:
+        ret = umount2("/dev/binderfs", MNT_DETACH);
+        keep ?: rmdir_protect_errno("/dev/binderfs");
+        if (ret < 0)
+                ksft_exit_fail_msg("%s - Failed to unmount binderfs\n",
+                                   strerror(errno));
+
+        /* binderfs unmount test passed */
+        ksft_inc_pass_cnt();
+}
+
+static void binderfs_test_privileged()
+{
+        if (geteuid() != 0)
+                ksft_print_msg(
+                        "Tests are not run as root. Skipping privileged tests\n");
+        else
+                __do_binderfs_test();
+}
+
+static void binderfs_test_unprivileged()
+{
+        change_to_userns();
+        __do_binderfs_test();
+}
+
+int main(int argc, char *argv[])
+{
+        binderfs_test_privileged();
+        binderfs_test_unprivileged();
+        ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/filesystems/binderfs/config b/tools/testing/selftests/filesystems/binderfs/config
new file mode 100644
index 000000000000..02dd6cc9cf99
--- /dev/null
+++ b/tools/testing/selftests/filesystems/binderfs/config
@@ -0,0 +1,3 @@
+CONFIG_ANDROID=y
+CONFIG_ANDROID_BINDERFS=y
+CONFIG_ANDROID_BINDER_IPC=y
diff --git a/tools/testing/selftests/ir/Makefile b/tools/testing/selftests/ir/Makefile
index f4ba8eb84b95..ad06489c22a5 100644
--- a/tools/testing/selftests/ir/Makefile
+++ b/tools/testing/selftests/ir/Makefile
@@ -1,5 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 TEST_PROGS := ir_loopback.sh
 TEST_GEN_PROGS_EXTENDED := ir_loopback
+APIDIR := ../../../include/uapi
+CFLAGS += -Wall -O2 -I$(APIDIR)
 
 include ../lib.mk
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index f8f3e90700c0..1e6d14d2825c 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -21,6 +21,6 @@ TEST_GEN_PROGS += reuseport_dualstack reuseaddr_conflict tls
 KSFT_KHDR_INSTALL := 1
 include ../lib.mk
 
-$(OUTPUT)/reuseport_bpf_numa: LDFLAGS += -lnuma
+$(OUTPUT)/reuseport_bpf_numa: LDLIBS += -lnuma
 $(OUTPUT)/tcp_mmap: LDFLAGS += -lpthread
 $(OUTPUT)/tcp_inq: LDFLAGS += -lpthread
diff --git a/tools/testing/selftests/net/xfrm_policy.sh b/tools/testing/selftests/net/xfrm_policy.sh
index 8db35b99457c..71d7fdc513c1 100755
--- a/tools/testing/selftests/net/xfrm_policy.sh
+++ b/tools/testing/selftests/net/xfrm_policy.sh
@@ -28,6 +28,19 @@ KEY_AES=0x0123456789abcdef0123456789012345
 SPI1=0x1
 SPI2=0x2
 
+do_esp_policy() {
+    local ns=$1
+    local me=$2
+    local remote=$3
+    local lnet=$4
+    local rnet=$5
+
+    # to encrypt packets as they go out (includes forwarded packets that need encapsulation)
+    ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tunnel priority 100 action allow
+    # to fwd decrypted packets after esp processing:
+    ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tunnel priority 100 action allow
+}
+
 do_esp() {
     local ns=$1
     local me=$2
@@ -40,10 +53,59 @@ do_esp() {
     ip -net $ns xfrm state add src $remote dst $me proto esp spi $spi_in  enc aes $KEY_AES  auth sha1 $KEY_SHA  mode tunnel sel src $rnet dst $lnet
     ip -net $ns xfrm state add src $me  dst $remote proto esp spi $spi_out enc aes $KEY_AES auth sha1 $KEY_SHA mode tunnel sel src $lnet dst $rnet
 
-    # to encrypt packets as they go out (includes forwarded packets that need encapsulation)
-    ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tunnel priority 100 action allow
-    # to fwd decrypted packets after esp processing:
-    ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tunnel priority 100 action allow
+    do_esp_policy $ns $me $remote $lnet $rnet
+}
+
+# add policies with different netmasks, to make sure kernel carries
+# the policies contained within new netmask over when search tree is
+# re-built.
+# peer netns that are supposed to be encapsulated via esp have addresses
+# in the 10.0.1.0/24 and 10.0.2.0/24 subnets, respectively.
+#
+# Adding a policy for '10.0.1.0/23' will make it necessary to
+# alter the prefix of 10.0.1.0 subnet.
+# In case new prefix overlaps with existing node, the node and all
+# policies it carries need to be merged with the existing one(s).
+#
+# Do that here.
+do_overlap()
+{
+    local ns=$1
+
+    # adds new nodes to tree (neither network exists yet in policy database).
+    ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
+
+    # adds a new node in the 10.0.0.0/24 tree (dst node exists).
+    ip -net $ns xfrm policy add src 10.2.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
+
+    # adds a 10.2.0.0/23 node, but for different dst.
+    ip -net $ns xfrm policy add src 10.2.0.0/23 dst 10.0.1.0/24 dir fwd priority 200 action block
+
+    # dst now overlaps with the 10.0.1.0/24 ESP policy in fwd.
+    # kernel must 'promote' existing one (10.0.0.0/24) to 10.0.0.0/23.
+    # But 10.0.0.0/23 also includes existing 10.0.1.0/24, so that node
+    # also has to be merged too, including source-sorted subtrees.
+    # old:
+    # 10.0.0.0/24 (node 1 in dst tree of the bin)
+    #    10.1.0.0/24 (node in src tree of dst node 1)
+    #    10.2.0.0/24 (node in src tree of dst node 1)
+    # 10.0.1.0/24 (node 2 in dst tree of the bin)
+    #    10.0.2.0/24 (node in src tree of dst node 2)
+    #    10.2.0.0/24 (node in src tree of dst node 2)
+    #
+    # The next 'policy add' adds dst '10.0.0.0/23', which means
+    # that dst node 1 and dst node 2 have to be merged including
+    # the sub-tree.  As no duplicates are allowed, policies in
+    # the two '10.0.2.0/24' are also merged.
+    #
+    # after the 'add', internal search tree should look like this:
+    # 10.0.0.0/23 (node in dst tree of bin)
+    #     10.0.2.0/24 (node in src tree of dst node)
+    #     10.1.0.0/24 (node in src tree of dst node)
+    #     10.2.0.0/24 (node in src tree of dst node)
+    #
+    # 10.0.0.0/24 and 10.0.1.0/24 nodes have been merged as 10.0.0.0/23.
+    ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/23 dir fwd priority 200 action block
 }
 
 do_esp_policy_get_check() {
@@ -160,6 +222,41 @@ check_xfrm() {
         return $lret
 }
 
+check_exceptions()
+{
+        logpostfix="$1"
+        local lret=0
+
+        # ping to .254 should be excluded from the tunnel (exception is in place).
+        check_xfrm 0 254
+        if [ $? -ne 0 ]; then
+                echo "FAIL: expected ping to .254 to fail ($logpostfix)"
+                lret=1
+        else
+                echo "PASS: ping to .254 bypassed ipsec tunnel ($logpostfix)"
+        fi
+
+        # ping to .253 should use use ipsec due to direct policy exception.
+        check_xfrm 1 253
+        if [ $? -ne 0 ]; then
+                echo "FAIL: expected ping to .253 to use ipsec tunnel ($logpostfix)"
+                lret=1
+        else
+                echo "PASS: direct policy matches ($logpostfix)"
+        fi
+
+        # ping to .2 should use ipsec.
+        check_xfrm 1 2
+        if [ $? -ne 0 ]; then
+                echo "FAIL: expected ping to .2 to use ipsec tunnel ($logpostfix)"
+                lret=1
+        else
+                echo "PASS: policy matches ($logpostfix)"
+        fi
+
+        return $lret
+}
+
 #check for needed privileges
 if [ "$(id -u)" -ne 0 ];then
         echo "SKIP: Need root privileges"
@@ -270,33 +367,45 @@ do_exception ns4 10.0.3.10 10.0.3.1 10.0.1.253 10.0.1.240/28
 do_exception ns3 dead:3::1 dead:3::10 dead:2::fd  dead:2:f0::/96
 do_exception ns4 dead:3::10 dead:3::1 dead:1::fd  dead:1:f0::/96
 
-# ping to .254 should now be excluded from the tunnel
-check_xfrm 0 254
+check_exceptions "exceptions"
 if [ $? -ne 0 ]; then
-        echo "FAIL: expected ping to .254 to fail"
         ret=1
-else
-        echo "PASS: ping to .254 bypassed ipsec tunnel"
 fi
 
-# ping to .253 should use use ipsec due to direct policy exception.
-check_xfrm 1 253
-if [ $? -ne 0 ]; then
-        echo "FAIL: expected ping to .253 to use ipsec tunnel"
-        ret=1
-else
-        echo "PASS: direct policy matches"
-fi
+# insert block policies with adjacent/overlapping netmasks
+do_overlap ns3
 
-# ping to .2 should use ipsec.
-check_xfrm 1 2
+check_exceptions "exceptions and block policies"
 if [ $? -ne 0 ]; then
-        echo "FAIL: expected ping to .2 to use ipsec tunnel"
         ret=1
-else
-        echo "PASS: policy matches"
 fi
 
+for n in ns3 ns4;do
+        ip -net $n xfrm policy set hthresh4 28 24 hthresh6 126 125
+        sleep $((RANDOM%5))
+done
+
+check_exceptions "exceptions and block policies after hresh changes"
+
+# full flush of policy db, check everything gets freed incl. internal meta data
+ip -net ns3 xfrm policy flush
+
+do_esp_policy ns3 10.0.3.1 10.0.3.10 10.0.1.0/24 10.0.2.0/24
+do_exception ns3 10.0.3.1 10.0.3.10 10.0.2.253 10.0.2.240/28
+
+# move inexact policies to hash table
+ip -net ns3 xfrm policy set hthresh4 16 16
+
+sleep $((RANDOM%5))
+check_exceptions "exceptions and block policies after hthresh change in ns3"
+
+# restore original hthresh settings -- move policies back to tables
+for n in ns3 ns4;do
+        ip -net $n xfrm policy set hthresh4 32 32 hthresh6 128 128
+        sleep $((RANDOM%5))
+done
+check_exceptions "exceptions and block policies after hresh change to normal"
+
 for i in 1 2 3 4;do ip netns del ns$i;done
 
 exit $ret
diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile
index 47ed6cef93fb..c9ff2b47bd1c 100644
--- a/tools/testing/selftests/netfilter/Makefile
+++ b/tools/testing/selftests/netfilter/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 # Makefile for netfilter selftests
 
-TEST_PROGS := nft_trans_stress.sh
+TEST_PROGS := nft_trans_stress.sh nft_nat.sh
 
 include ../lib.mk
diff --git a/tools/testing/selftests/netfilter/config b/tools/testing/selftests/netfilter/config
index 1017313e41a8..59caa8f71cd8 100644
--- a/tools/testing/selftests/netfilter/config
+++ b/tools/testing/selftests/netfilter/config
@@ -1,2 +1,2 @@
 CONFIG_NET_NS=y
-NF_TABLES_INET=y
+CONFIG_NF_TABLES_INET=y
diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh
new file mode 100755
index 000000000000..8ec76681605c
--- /dev/null
+++ b/tools/testing/selftests/netfilter/nft_nat.sh
@@ -0,0 +1,762 @@
+#!/bin/bash
+#
+# This test is for basic NAT functionality: snat, dnat, redirect, masquerade.
+#
+
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+ret=0
+
+nft --version > /dev/null 2>&1
+if [ $? -ne 0 ];then
+        echo "SKIP: Could not run test without nft tool"
+        exit $ksft_skip
+fi
+
+ip -Version > /dev/null 2>&1
+if [ $? -ne 0 ];then
+        echo "SKIP: Could not run test without ip tool"
+        exit $ksft_skip
+fi
+
+ip netns add ns0
+ip netns add ns1
+ip netns add ns2
+
+ip link add veth0 netns ns0 type veth peer name eth0 netns ns1
+ip link add veth1 netns ns0 type veth peer name eth0 netns ns2
+
+ip -net ns0 link set lo up
+ip -net ns0 link set veth0 up
+ip -net ns0 addr add 10.0.1.1/24 dev veth0
+ip -net ns0 addr add dead:1::1/64 dev veth0
+
+ip -net ns0 link set veth1 up
+ip -net ns0 addr add 10.0.2.1/24 dev veth1
+ip -net ns0 addr add dead:2::1/64 dev veth1
+
+for i in 1 2; do
+  ip -net ns$i link set lo up
+  ip -net ns$i link set eth0 up
+  ip -net ns$i addr add 10.0.$i.99/24 dev eth0
+  ip -net ns$i route add default via 10.0.$i.1
+  ip -net ns$i addr add dead:$i::99/64 dev eth0
+  ip -net ns$i route add default via dead:$i::1
+done
+
+bad_counter()
+{
+        local ns=$1
+        local counter=$2
+        local expect=$3
+
+        echo "ERROR: $counter counter in $ns has unexpected value (expected $expect)" 1>&2
+        ip netns exec $ns nft list counter inet filter $counter 1>&2
+}
+
+check_counters()
+{
+        ns=$1
+        local lret=0
+
+        cnt=$(ip netns exec $ns nft list counter inet filter ns0in | grep -q "packets 1 bytes 84")
+        if [ $? -ne 0 ]; then
+                bad_counter $ns ns0in "packets 1 bytes 84"
+                lret=1
+        fi
+        cnt=$(ip netns exec $ns nft list counter inet filter ns0out | grep -q "packets 1 bytes 84")
+        if [ $? -ne 0 ]; then
+                bad_counter $ns ns0out "packets 1 bytes 84"
+                lret=1
+        fi
+
+        expect="packets 1 bytes 104"
+        cnt=$(ip netns exec $ns nft list counter inet filter ns0in6 | grep -q "$expect")
+        if [ $? -ne 0 ]; then
+                bad_counter $ns ns0in6 "$expect"
+                lret=1
+        fi
+        cnt=$(ip netns exec $ns nft list counter inet filter ns0out6 | grep -q "$expect")
+        if [ $? -ne 0 ]; then
+                bad_counter $ns ns0out6 "$expect"
+                lret=1
+        fi
+
+        return $lret
+}
+
+check_ns0_counters()
+{
+        local ns=$1
+        local lret=0
+
+        cnt=$(ip netns exec ns0 nft list counter inet filter ns0in | grep -q "packets 0 bytes 0")
+        if [ $? -ne 0 ]; then
+                bad_counter ns0 ns0in "packets 0 bytes 0"
+                lret=1
+        fi
+
+        cnt=$(ip netns exec ns0 nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0")
+        if [ $? -ne 0 ]; then
+                bad_counter ns0 ns0in6 "packets 0 bytes 0"
+                lret=1
+        fi
+
+        cnt=$(ip netns exec ns0 nft list counter inet filter ns0out | grep -q "packets 0 bytes 0")
+        if [ $? -ne 0 ]; then
+                bad_counter ns0 ns0out "packets 0 bytes 0"
+                lret=1
+        fi
+        cnt=$(ip netns exec ns0 nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0")
+        if [ $? -ne 0 ]; then
+                bad_counter ns0 ns0out6 "packets 0 bytes 0"
+                lret=1
+        fi
+
+        for dir in "in" "out" ; do
+                expect="packets 1 bytes 84"
+                cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 $ns$dir "$expect"
+                        lret=1
+                fi
+
+                expect="packets 1 bytes 104"
+                cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir}6 | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 $ns$dir6 "$expect"
+                        lret=1
+                fi
+        done
+
+        return $lret
+}
+
+reset_counters()
+{
+        for i in 0 1 2;do
+                ip netns exec ns$i nft reset counters inet > /dev/null
+        done
+}
+
+test_local_dnat6()
+{
+        local lret=0
+ip netns exec ns0 nft -f - <<EOF
+table ip6 nat {
+        chain output {
+                type nat hook output priority 0; policy accept;
+                ip6 daddr dead:1::99 dnat to dead:2::99
+        }
+}
+EOF
+        if [ $? -ne 0 ]; then
+                echo "SKIP: Could not add add ip6 dnat hook"
+                return $ksft_skip
+        fi
+
+        # ping netns1, expect rewrite to netns2
+        ip netns exec ns0 ping -q -c 1 dead:1::99 > /dev/null
+        if [ $? -ne 0 ]; then
+                lret=1
+                echo "ERROR: ping6 failed"
+                return $lret
+        fi
+
+        expect="packets 0 bytes 0"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns2$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 0 count in ns1
+        expect="packets 0 bytes 0"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 1 packet in ns2
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        test $lret -eq 0 && echo "PASS: ipv6 ping to ns1 was NATted to ns2"
+        ip netns exec ns0 nft flush chain ip6 nat output
+
+        return $lret
+}
+
+test_local_dnat()
+{
+        local lret=0
+ip netns exec ns0 nft -f - <<EOF
+table ip nat {
+        chain output {
+                type nat hook output priority 0; policy accept;
+                ip daddr 10.0.1.99 dnat to 10.0.2.99
+        }
+}
+EOF
+        # ping netns1, expect rewrite to netns2
+        ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null
+        if [ $? -ne 0 ]; then
+                lret=1
+                echo "ERROR: ping failed"
+                return $lret
+        fi
+
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns2$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 0 count in ns1
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 1 packet in ns2
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        test $lret -eq 0 && echo "PASS: ping to ns1 was NATted to ns2"
+
+        ip netns exec ns0 nft flush chain ip nat output
+
+        reset_counters
+        ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null
+        if [ $? -ne 0 ]; then
+                lret=1
+                echo "ERROR: ping failed"
+                return $lret
+        fi
+
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns2$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 1 count in ns1
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns0 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # expect 0 packet in ns2
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns2$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        test $lret -eq 0 && echo "PASS: ping to ns1 OK after nat output chain flush"
+
+        return $lret
+}
+
+
+test_masquerade6()
+{
+        local lret=0
+
+        ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
+
+        ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 via ipv6"
+                return 1
+                lret=1
+        fi
+
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns2$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        reset_counters
+
+# add masquerading rule
+ip netns exec ns0 nft -f - <<EOF
+table ip6 nat {
+        chain postrouting {
+                type nat hook postrouting priority 0; policy accept;
+                meta oif veth0 masquerade
+        }
+}
+EOF
+        ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerading"
+                lret=1
+        fi
+
+        # ns1 should have seen packets from ns0, due to masquerade
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # ns1 should not have seen packets from ns2, due to masquerade
+        expect="packets 0 bytes 0"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        ip netns exec ns0 nft flush chain ip6 nat postrouting
+        if [ $? -ne 0 ]; then
+                echo "ERROR: Could not flush ip6 nat postrouting" 1>&2
+                lret=1
+        fi
+
+        test $lret -eq 0 && echo "PASS: IPv6 masquerade for ns2"
+
+        return $lret
+}
+
+test_masquerade()
+{
+        local lret=0
+
+        ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
+        ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
+
+        ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: canot ping ns1 from ns2"
+                lret=1
+        fi
+
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns2$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        reset_counters
+
+# add masquerading rule
+ip netns exec ns0 nft -f - <<EOF
+table ip nat {
+        chain postrouting {
+                type nat hook postrouting priority 0; policy accept;
+                meta oif veth0 masquerade
+        }
+}
+EOF
+        ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 with active ip masquerading"
+                lret=1
+        fi
+
+        # ns1 should have seen packets from ns0, due to masquerade
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # ns1 should not have seen packets from ns2, due to masquerade
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        ip netns exec ns0 nft flush chain ip nat postrouting
+        if [ $? -ne 0 ]; then
+                echo "ERROR: Could not flush nat postrouting" 1>&2
+                lret=1
+        fi
+
+        test $lret -eq 0 && echo "PASS: IP masquerade for ns2"
+
+        return $lret
+}
+
+test_redirect6()
+{
+        local lret=0
+
+        ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
+
+        ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannnot ping ns1 from ns2 via ipv6"
+                lret=1
+        fi
+
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns2$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        reset_counters
+
+# add redirect rule
+ip netns exec ns0 nft -f - <<EOF
+table ip6 nat {
+        chain prerouting {
+                type nat hook prerouting priority 0; policy accept;
+                meta iif veth1 meta l4proto icmpv6 ip6 saddr dead:2::99 ip6 daddr dead:1::99 redirect
+        }
+}
+EOF
+        ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 with active ip6 redirect"
+                lret=1
+        fi
+
+        # ns1 should have seen no packets from ns2, due to redirection
+        expect="packets 0 bytes 0"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # ns0 should have seen packets from ns2, due to masquerade
+        expect="packets 1 bytes 104"
+        for dir in "in6" "out6" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        ip netns exec ns0 nft delete table ip6 nat
+        if [ $? -ne 0 ]; then
+                echo "ERROR: Could not delete ip6 nat table" 1>&2
+                lret=1
+        fi
+
+        test $lret -eq 0 && echo "PASS: IPv6 redirection for ns2"
+
+        return $lret
+}
+
+test_redirect()
+{
+        local lret=0
+
+        ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
+        ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
+
+        ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2"
+                lret=1
+        fi
+
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns2$dir "$expect"
+                        lret=1
+                fi
+
+                cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns2 ns1$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        reset_counters
+
+# add redirect rule
+ip netns exec ns0 nft -f - <<EOF
+table ip nat {
+        chain prerouting {
+                type nat hook prerouting priority 0; policy accept;
+                meta iif veth1 ip protocol icmp ip saddr 10.0.2.99 ip daddr 10.0.1.99 redirect
+        }
+}
+EOF
+        ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+        if [ $? -ne 0 ] ; then
+                echo "ERROR: cannot ping ns1 from ns2 with active ip redirect"
+                lret=1
+        fi
+
+        # ns1 should have seen no packets from ns2, due to redirection
+        expect="packets 0 bytes 0"
+        for dir in "in" "out" ; do
+
+                cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        # ns0 should have seen packets from ns2, due to masquerade
+        expect="packets 1 bytes 84"
+        for dir in "in" "out" ; do
+                cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
+                if [ $? -ne 0 ]; then
+                        bad_counter ns1 ns0$dir "$expect"
+                        lret=1
+                fi
+        done
+
+        ip netns exec ns0 nft delete table ip nat
+        if [ $? -ne 0 ]; then
+                echo "ERROR: Could not delete nat table" 1>&2
+                lret=1
+        fi
+
+        test $lret -eq 0 && echo "PASS: IP redirection for ns2"
+
+        return $lret
+}
+
+
+# ip netns exec ns0 ping -c 1 -q 10.0.$i.99
+for i in 0 1 2; do
+ip netns exec ns$i nft -f - <<EOF
+table inet filter {
+        counter ns0in {}
+        counter ns1in {}
+        counter ns2in {}
+
+        counter ns0out {}
+        counter ns1out {}
+        counter ns2out {}
+
+        counter ns0in6 {}
+        counter ns1in6 {}
+        counter ns2in6 {}
+
+        counter ns0out6 {}
+        counter ns1out6 {}
+        counter ns2out6 {}
+
+        map nsincounter {
+                type ipv4_addr : counter
+                elements = { 10.0.1.1 : "ns0in",
+                             10.0.2.1 : "ns0in",
+                             10.0.1.99 : "ns1in",
+                             10.0.2.99 : "ns2in" }
+        }
+
+        map nsincounter6 {
+                type ipv6_addr : counter
+                elements = { dead:1::1 : "ns0in6",
+                             dead:2::1 : "ns0in6",
+                             dead:1::99 : "ns1in6",
+                             dead:2::99 : "ns2in6" }
+        }
+
+        map nsoutcounter {
+                type ipv4_addr : counter
+                elements = { 10.0.1.1 : "ns0out",
+                             10.0.2.1 : "ns0out",
+                             10.0.1.99: "ns1out",
+                             10.0.2.99: "ns2out" }
+        }
+
+        map nsoutcounter6 {
+                type ipv6_addr : counter
+                elements = { dead:1::1 : "ns0out6",
+                             dead:2::1 : "ns0out6",
+                             dead:1::99 : "ns1out6",
+                             dead:2::99 : "ns2out6" }
+        }
+
+        chain input {
+                type filter hook input priority 0; policy accept;
+                counter name ip saddr map @nsincounter
+                icmpv6 type { "echo-request", "echo-reply" } counter name ip6 saddr map @nsincounter6
+        }
+        chain output {
+                type filter hook output priority 0; policy accept;
+                counter name ip daddr map @nsoutcounter
+                icmpv6 type { "echo-request", "echo-reply" } counter name ip6 daddr map @nsoutcounter6
+        }
+}
+EOF
+done
+
+sleep 3
+# test basic connectivity
+for i in 1 2; do
+  ip netns exec ns0 ping -c 1 -q 10.0.$i.99 > /dev/null
+  if [ $? -ne 0 ];then
+        echo "ERROR: Could not reach other namespace(s)" 1>&2
+        ret=1
+  fi
+
+  ip netns exec ns0 ping -c 1 -q dead:$i::99 > /dev/null
+  if [ $? -ne 0 ];then
+        echo "ERROR: Could not reach other namespace(s) via ipv6" 1>&2
+        ret=1
+  fi
+  check_counters ns$i
+  if [ $? -ne 0 ]; then
+        ret=1
+  fi
+
+  check_ns0_counters ns$i
+  if [ $? -ne 0 ]; then
+        ret=1
+  fi
+  reset_counters
+done
+
+if [ $ret -eq 0 ];then
+        echo "PASS: netns routing/connectivity: ns0 can reach ns1 and ns2"
+fi
+
+reset_counters
+test_local_dnat
+test_local_dnat6
+
+reset_counters
+test_masquerade
+test_masquerade6
+
+reset_counters
+test_redirect
+test_redirect6
+
+for i in 0 1 2; do ip netns del ns$i;done
+
+exit $ret
diff --git a/tools/testing/selftests/networking/timestamping/Makefile b/tools/testing/selftests/networking/timestamping/Makefile
index 9050eeea5f5f..1de8bd8ccf5d 100644
--- a/tools/testing/selftests/networking/timestamping/Makefile
+++ b/tools/testing/selftests/networking/timestamping/Makefile
@@ -9,6 +9,3 @@ all: $(TEST_PROGS)
 top_srcdir = ../../../../..
 KSFT_KHDR_INSTALL := 1
 include ../../lib.mk
-
-clean:
-        rm -fr $(TEST_GEN_FILES)
diff --git a/tools/testing/selftests/proc/.gitignore b/tools/testing/selftests/proc/.gitignore
index 82121a81681f..29bac5ef9a93 100644
--- a/tools/testing/selftests/proc/.gitignore
+++ b/tools/testing/selftests/proc/.gitignore
@@ -10,4 +10,5 @@
 /proc-uptime-002
 /read
 /self
+/setns-dcache
 /thread-self
diff --git a/tools/testing/selftests/proc/Makefile b/tools/testing/selftests/proc/Makefile
index 1c12c34cf85d..434d033ee067 100644
--- a/tools/testing/selftests/proc/Makefile
+++ b/tools/testing/selftests/proc/Makefile
@@ -14,6 +14,7 @@ TEST_GEN_PROGS += proc-uptime-001
 TEST_GEN_PROGS += proc-uptime-002
 TEST_GEN_PROGS += read
 TEST_GEN_PROGS += self
+TEST_GEN_PROGS += setns-dcache
 TEST_GEN_PROGS += thread-self
 
 include ../lib.mk
diff --git a/tools/testing/selftests/proc/setns-dcache.c b/tools/testing/selftests/proc/setns-dcache.c
new file mode 100644
index 000000000000..60ab197a73fc
--- /dev/null
+++ b/tools/testing/selftests/proc/setns-dcache.c
@@ -0,0 +1,129 @@
+/*
+ * Copyright © 2019 Alexey Dobriyan <adobriyan@gmail.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+/*
+ * Test that setns(CLONE_NEWNET) points to new /proc/net content even
+ * if old one is in dcache.
+ *
+ * FIXME /proc/net/unix is under CONFIG_UNIX which can be disabled.
+ */
+#undef NDEBUG
+#include <assert.h>
+#include <errno.h>
+#include <sched.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <sys/socket.h>
+
+static pid_t pid = -1;
+
+static void f(void)
+{
+        if (pid > 0) {
+                kill(pid, SIGTERM);
+        }
+}
+
+int main(void)
+{
+        int fd[2];
+        char _ = 0;
+        int nsfd;
+
+        atexit(f);
+
+        /* Check for priviledges and syscall availability straight away. */
+        if (unshare(CLONE_NEWNET) == -1) {
+                if (errno == ENOSYS || errno == EPERM) {
+                        return 4;
+                }
+                return 1;
+        }
+        /* Distinguisher between two otherwise empty net namespaces. */
+        if (socket(AF_UNIX, SOCK_STREAM, 0) == -1) {
+                return 1;
+        }
+
+        if (pipe(fd) == -1) {
+                return 1;
+        }
+
+        pid = fork();
+        if (pid == -1) {
+                return 1;
+        }
+
+        if (pid == 0) {
+                if (unshare(CLONE_NEWNET) == -1) {
+                        return 1;
+                }
+
+                if (write(fd[1], &_, 1) != 1) {
+                        return 1;
+                }
+
+                pause();
+
+                return 0;
+        }
+
+        if (read(fd[0], &_, 1) != 1) {
+                return 1;
+        }
+
+        {
+                char buf[64];
+                snprintf(buf, sizeof(buf), "/proc/%u/ns/net", pid);
+                nsfd = open(buf, O_RDONLY);
+                if (nsfd == -1) {
+                        return 1;
+                }
+        }
+
+        /* Reliably pin dentry into dcache. */
+        (void)open("/proc/net/unix", O_RDONLY);
+
+        if (setns(nsfd, CLONE_NEWNET) == -1) {
+                return 1;
+        }
+
+        kill(pid, SIGTERM);
+        pid = 0;
+
+        {
+                char buf[4096];
+                ssize_t rv;
+                int fd;
+
+                fd = open("/proc/net/unix", O_RDONLY);
+                if (fd == -1) {
+                        return 1;
+                }
+
+#define S "Num       RefCount Protocol Flags    Type St Inode Path\n"
+                rv = read(fd, buf, sizeof(buf));
+
+                assert(rv == strlen(S));
+                assert(memcmp(buf, S, strlen(S)) == 0);
+        }
+
+        return 0;
+}
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 496a9a8c773a..7e632b465ab4 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -1608,7 +1608,16 @@ TEST_F(TRACE_poke, getpid_runs_normally)
 #ifdef SYSCALL_NUM_RET_SHARE_REG
 # define EXPECT_SYSCALL_RETURN(val, action)     EXPECT_EQ(-1, action)
 #else
-# define EXPECT_SYSCALL_RETURN(val, action)     EXPECT_EQ(val, action)
+# define EXPECT_SYSCALL_RETURN(val, action)             \
+        do {                                            \
+                errno = 0;                              \
+                if (val < 0) {                          \
+                        EXPECT_EQ(-1, action);          \
+                        EXPECT_EQ(-(val), errno);       \
+                } else {                                \
+                        EXPECT_EQ(val, action);         \
+                }                                       \
+        } while (0)
 #endif
 
 /* Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for
@@ -1647,7 +1656,7 @@ int get_syscall(struct __test_metadata *_metadata, pid_t tracee)
 
 /* Architecture-specific syscall changing routine. */
 void change_syscall(struct __test_metadata *_metadata,
-                    pid_t tracee, int syscall)
+                    pid_t tracee, int syscall, int result)
 {
         int ret;
         ARCH_REGS regs;
@@ -1706,7 +1715,7 @@ void change_syscall(struct __test_metadata *_metadata,
 #ifdef SYSCALL_NUM_RET_SHARE_REG
                 TH_LOG("Can't modify syscall return on this architecture");
 #else
-                regs.SYSCALL_RET = EPERM;
+                regs.SYSCALL_RET = result;
 #endif
 
 #ifdef HAVE_GETREGS
@@ -1734,14 +1743,19 @@ void tracer_syscall(struct __test_metadata *_metadata, pid_t tracee,
         case 0x1002:
                 /* change getpid to getppid. */
                 EXPECT_EQ(__NR_getpid, get_syscall(_metadata, tracee));
-                change_syscall(_metadata, tracee, __NR_getppid);
+                change_syscall(_metadata, tracee, __NR_getppid, 0);
                 break;
         case 0x1003:
-                /* skip gettid. */
+                /* skip gettid with valid return code. */
                 EXPECT_EQ(__NR_gettid, get_syscall(_metadata, tracee));
-                change_syscall(_metadata, tracee, -1);
+                change_syscall(_metadata, tracee, -1, 45000);
                 break;
         case 0x1004:
+                /* skip openat with error. */
+                EXPECT_EQ(__NR_openat, get_syscall(_metadata, tracee));
+                change_syscall(_metadata, tracee, -1, -ESRCH);
+                break;
+        case 0x1005:
                 /* do nothing (allow getppid) */
                 EXPECT_EQ(__NR_getppid, get_syscall(_metadata, tracee));
                 break;
@@ -1774,9 +1788,11 @@ void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee,
         nr = get_syscall(_metadata, tracee);
 
         if (nr == __NR_getpid)
-                change_syscall(_metadata, tracee, __NR_getppid);
+                change_syscall(_metadata, tracee, __NR_getppid, 0);
+        if (nr == __NR_gettid)
+                change_syscall(_metadata, tracee, -1, 45000);
         if (nr == __NR_openat)
-                change_syscall(_metadata, tracee, -1);
+                change_syscall(_metadata, tracee, -1, -ESRCH);
 }
 
 FIXTURE_DATA(TRACE_syscall) {
@@ -1793,8 +1809,10 @@ FIXTURE_SETUP(TRACE_syscall)
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1002),
                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_gettid, 0, 1),
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1003),
-                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_openat, 0, 1),
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1004),
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1005),
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
         };
 
@@ -1842,15 +1860,26 @@ TEST_F(TRACE_syscall, ptrace_syscall_redirected)
         EXPECT_NE(self->mypid, syscall(__NR_getpid));
 }
 
-TEST_F(TRACE_syscall, ptrace_syscall_dropped)
+TEST_F(TRACE_syscall, ptrace_syscall_errno)
+{
+        /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
+        teardown_trace_fixture(_metadata, self->tracer);
+        self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
+                                           true);
+
+        /* Tracer should skip the open syscall, resulting in ESRCH. */
+        EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat));
+}
+
+TEST_F(TRACE_syscall, ptrace_syscall_faked)
 {
         /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
         teardown_trace_fixture(_metadata, self->tracer);
         self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
                                            true);
 
-        /* Tracer should skip the open syscall, resulting in EPERM. */
-        EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_openat));
+        /* Tracer should skip the gettid syscall, resulting fake pid. */
+        EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid));
 }
 
 TEST_F(TRACE_syscall, syscall_allowed)
@@ -1883,7 +1912,21 @@ TEST_F(TRACE_syscall, syscall_redirected)
         EXPECT_NE(self->mypid, syscall(__NR_getpid));
 }
 
-TEST_F(TRACE_syscall, syscall_dropped)
+TEST_F(TRACE_syscall, syscall_errno)
+{
+        long ret;
+
+        ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+        ASSERT_EQ(0, ret);
+
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
+        ASSERT_EQ(0, ret);
+
+        /* openat has been skipped and an errno return. */
+        EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat));
+}
+
+TEST_F(TRACE_syscall, syscall_faked)
 {
         long ret;
 
@@ -1894,8 +1937,7 @@ TEST_F(TRACE_syscall, syscall_dropped)
         ASSERT_EQ(0, ret);
 
         /* gettid has been skipped and an altered return value stored. */
-        EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_gettid));
-        EXPECT_NE(self->mytid, syscall(__NR_gettid));
+        EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid));
 }
 
 TEST_F(TRACE_syscall, skip_after_RET_TRACE)
diff --git a/tools/testing/selftests/timers/Makefile b/tools/testing/selftests/timers/Makefile
index c02683cfb6c9..7656c7ce79d9 100644
--- a/tools/testing/selftests/timers/Makefile
+++ b/tools/testing/selftests/timers/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 CFLAGS += -O3 -Wl,-no-as-needed -Wall
-LDFLAGS += -lrt -lpthread -lm
+LDLIBS += -lrt -lpthread -lm
 
 # these are all "safe" tests that don't modify
 # system time or require escalated privileges
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 5ecea812cb6a..585845203db8 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -3000,8 +3000,10 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
         if (ops->init)
                 ops->init(dev);
 
+        kvm_get_kvm(kvm);
         ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
         if (ret < 0) {
+                kvm_put_kvm(kvm);
                 mutex_lock(&kvm->lock);
                 list_del(&dev->vm_node);
                 mutex_unlock(&kvm->lock);
@@ -3009,7 +3011,6 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
                 return ret;
         }
 
-        kvm_get_kvm(kvm);
         cd->fd = ret;
         return 0;
 }