205 files changed, 1916 insertions, 1103 deletions

diff --git a/.mailmap b/.mailmap
index e18cab73e209..a2ce89a456c2 100644
--- a/.mailmap
+++ b/.mailmap
@@ -62,6 +62,7 @@ Frank Zago <fzago@systemfabricworks.com>
 Greg Kroah-Hartman <greg@echidna.(none)>
 Greg Kroah-Hartman <gregkh@suse.de>
 Greg Kroah-Hartman <greg@kroah.com>
+Gregory CLEMENT <gregory.clement@bootlin.com> <gregory.clement@free-electrons.com>
 Henk Vergonet <Henk.Vergonet@gmail.com>
 Henrik Kretzschmar <henne@nachtwindheim.de>
 Henrik Rydberg <rydberg@bitmath.org>
diff --git a/Documentation/devicetree/bindings/iio/adc/sigma-delta-modulator.txt b/Documentation/devicetree/bindings/iio/adc/sigma-delta-modulator.txt
index e9ebb8a20e0d..ba24ca7ba95e 100644
--- a/Documentation/devicetree/bindings/iio/adc/sigma-delta-modulator.txt
+++ b/Documentation/devicetree/bindings/iio/adc/sigma-delta-modulator.txt
@@ -3,11 +3,11 @@ Device-Tree bindings for sigma delta modulator
 Required properties:
 - compatible: should be "ads1201", "sd-modulator". "sd-modulator" can be use
         as a generic SD modulator if modulator not specified in compatible list.
-- #io-channel-cells = <1>: See the IIO bindings section "IIO consumers".
+- #io-channel-cells = <0>: See the IIO bindings section "IIO consumers".
 
 Example node:
 
         ads1202: adc@0 {
                 compatible = "sd-modulator";
-                #io-channel-cells = <1>;
+                #io-channel-cells = <0>;
         };
diff --git a/Documentation/isdn/INTERFACE.CAPI b/Documentation/isdn/INTERFACE.CAPI
index 1688b5a1fd77..021aa9cf139d 100644
--- a/Documentation/isdn/INTERFACE.CAPI
+++ b/Documentation/isdn/INTERFACE.CAPI
@@ -18,7 +18,7 @@ corresponding hardware driver. Kernel CAPI then forwards CAPI messages in both
 directions between the application and the hardware driver.
 
 Format and semantics of CAPI messages are specified in the CAPI 2.0 standard.
-This standard is freely available from http://www.capi.org.
+This standard is freely available from https://www.capi.org.
 
 
 2. Driver and Device Registration
diff --git a/Documentation/isdn/README b/Documentation/isdn/README
index 32d4e80c2c03..74bd2bdb455b 100644
--- a/Documentation/isdn/README
+++ b/Documentation/isdn/README
@@ -33,10 +33,10 @@ README for the ISDN-subsystem
      de.alt.comm.isdn4linux
 
   There is also a well maintained FAQ in English available at
-     http://www.mhessler.de/i4lfaq/
+     https://www.mhessler.de/i4lfaq/
   It can be viewed online, or downloaded in sgml/text/html format.
   The FAQ can also be viewed online at
-     http://www.isdn4linux.de/faq/
+     https://www.isdn4linux.de/faq/i4lfaq.html
   or downloaded from
      ftp://ftp.isdn4linux.de/pub/isdn4linux/FAQ/
 
diff --git a/Documentation/isdn/README.FAQ b/Documentation/isdn/README.FAQ
index 356f7944641d..e5dd1addacdd 100644
--- a/Documentation/isdn/README.FAQ
+++ b/Documentation/isdn/README.FAQ
@@ -8,9 +8,9 @@ You find it in:
 
 In case you just want to see the FAQ online, or download the newest version,
 you can have a look at my website:
-http://www.mhessler.de/i4lfaq/ (view + download)
+https://www.mhessler.de/i4lfaq/ (view + download)
 or:
-http://www.isdn4linux.de/faq/ (view)
+https://www.isdn4linux.de/faq/4lfaq.html (view)
 
 As the extension tells, the FAQ is in SGML format, and you can convert it
 into text/html/... format by using the sgml2txt/sgml2html/... tools.
diff --git a/Documentation/isdn/README.gigaset b/Documentation/isdn/README.gigaset
index 7534c6039adc..9b1ce277ca3d 100644
--- a/Documentation/isdn/README.gigaset
+++ b/Documentation/isdn/README.gigaset
@@ -29,8 +29,9 @@ GigaSet 307x Device Driver
         T-Com Sinus 721 data
         Chicago 390 USB (KPN)
 
-     See also http://www.erbze.info/sinus_gigaset.htm and
-              http://gigaset307x.sourceforge.net/
+     See also http://www.erbze.info/sinus_gigaset.htm
+       (archived at https://web.archive.org/web/20100717020421/http://www.erbze.info:80/sinus_gigaset.htm ) and
+        http://gigaset307x.sourceforge.net/
 
      We had also reports from users of Gigaset M105 who could use the drivers
      with SX 100 and CX 100 ISDN bases (only in unimodem mode, see section 2.5.)
@@ -52,7 +53,7 @@ GigaSet 307x Device Driver
      to use CAPI 2.0 or ISDN4Linux for ISDN connections (voice or data).
 
      There are some user space tools available at
-     http://sourceforge.net/projects/gigaset307x/
+     https://sourceforge.net/projects/gigaset307x/
      which provide access to additional device specific functions like SMS,
      phonebook or call journal.
 
@@ -202,7 +203,7 @@ GigaSet 307x Device Driver
      You can use some configuration tool of your distribution to configure this
      "modem" or configure pppd/wvdial manually. There are some example ppp
      configuration files and chat scripts in the gigaset-VERSION/ppp directory
-     in the driver packages from http://sourceforge.net/projects/gigaset307x/.
+     in the driver packages from https://sourceforge.net/projects/gigaset307x/.
      Please note that the USB drivers are not able to change the state of the
      control lines. This means you must use "Stupid Mode" if you are using
      wvdial or you should use the nocrtscts option of pppd.
@@ -361,7 +362,7 @@ GigaSet 307x Device Driver
      ---------------------------
      If you can't solve problems with the driver on your own, feel free to
      use one of the forums, bug trackers, or mailing lists on
-         http://sourceforge.net/projects/gigaset307x
+         https://sourceforge.net/projects/gigaset307x
      or write an electronic mail to the maintainers.
 
      Try to provide as much information as possible, such as
@@ -391,11 +392,12 @@ GigaSet 307x Device Driver
 4.   Links, other software
      ---------------------
      - Sourceforge project developing this driver and associated tools
-         http://sourceforge.net/projects/gigaset307x
+         https://sourceforge.net/projects/gigaset307x
      - Yahoo! Group on the Siemens Gigaset family of devices
-         http://de.groups.yahoo.com/group/Siemens-Gigaset
+         https://de.groups.yahoo.com/group/Siemens-Gigaset
      - Siemens Gigaset/T-Sinus compatibility table
          http://www.erbze.info/sinus_gigaset.htm
+            (archived at https://web.archive.org/web/20100717020421/http://www.erbze.info:80/sinus_gigaset.htm )
 
 
 5.   Credits
diff --git a/MAINTAINERS b/MAINTAINERS
index 22ef8d64fa59..cbffcd4b1320 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1060,41 +1060,42 @@ ARM PORT
 M:      Russell King <linux@armlinux.org.uk>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.armlinux.org.uk/
-S:      Maintained
+S:      Odd Fixes
 T:      git git://git.armlinux.org.uk/~rmk/linux-arm.git
 F:      arch/arm/
+X:      arch/arm/boot/dts/
 
 ARM PRIMECELL AACI PL041 DRIVER
 M:      Russell King <linux@armlinux.org.uk>
-S:      Maintained
+S:      Odd Fixes
 F:      sound/arm/aaci.*
 
 ARM PRIMECELL BUS SUPPORT
 M:      Russell King <linux@armlinux.org.uk>
-S:      Maintained
+S:      Odd Fixes
 F:      drivers/amba/
 F:      include/linux/amba/bus.h
 
 ARM PRIMECELL CLCD PL110 DRIVER
 M:      Russell King <linux@armlinux.org.uk>
-S:      Maintained
+S:      Odd Fixes
 F:      drivers/video/fbdev/amba-clcd.*
 
 ARM PRIMECELL KMI PL050 DRIVER
 M:      Russell King <linux@armlinux.org.uk>
-S:      Maintained
+S:      Odd Fixes
 F:      drivers/input/serio/ambakmi.*
 F:      include/linux/amba/kmi.h
 
 ARM PRIMECELL MMCI PL180/1 DRIVER
 M:      Russell King <linux@armlinux.org.uk>
-S:      Maintained
+S:      Odd Fixes
 F:      drivers/mmc/host/mmci.*
 F:      include/linux/amba/mmci.h
 
 ARM PRIMECELL UART PL010 AND PL011 DRIVERS
 M:      Russell King <linux@armlinux.org.uk>
-S:      Maintained
+S:      Odd Fixes
 F:      drivers/tty/serial/amba-pl01*.c
 F:      include/linux/amba/serial.h
 
@@ -1152,7 +1153,7 @@ S:	Maintained
 F:      drivers/clk/sunxi/
 
 ARM/Allwinner sunXi SoC support
-M:      Maxime Ripard <maxime.ripard@free-electrons.com>
+M:      Maxime Ripard <maxime.ripard@bootlin.com>
 M:      Chen-Yu Tsai <wens@csie.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
@@ -4626,7 +4627,7 @@ F:	include/uapi/drm/drm*
 F:      include/linux/vga*
 
 DRM DRIVERS FOR ALLWINNER A10
-M:      Maxime Ripard  <maxime.ripard@free-electrons.com>
+M:      Maxime Ripard  <maxime.ripard@bootlin.com>
 L:      dri-devel@lists.freedesktop.org
 S:      Supported
 F:      drivers/gpu/drm/sun4i/
@@ -8435,7 +8436,7 @@ S:	Orphan
 F:      drivers/net/wireless/marvell/libertas/
 
 MARVELL MACCHIATOBIN SUPPORT
-M:      Russell King <rmk@armlinux.org.uk>
+M:      Russell King <linux@armlinux.org.uk>
 L:      linux-arm-kernel@lists.infradead.org
 S:      Maintained
 F:      arch/arm64/boot/dts/marvell/armada-8040-mcbin.dts
@@ -8448,7 +8449,7 @@ F:	drivers/net/ethernet/marvell/mv643xx_eth.*
 F:      include/linux/mv643xx.h
 
 MARVELL MV88X3310 PHY DRIVER
-M:      Russell King <rmk@armlinux.org.uk>
+M:      Russell King <linux@armlinux.org.uk>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/phy/marvell10g.c
@@ -12892,6 +12893,19 @@ S:	Maintained
 F:      drivers/net/ethernet/socionext/netsec.c
 F:      Documentation/devicetree/bindings/net/socionext-netsec.txt
 
+SOLIDRUN CLEARFOG SUPPORT
+M:      Russell King <linux@armlinux.org.uk>
+S:      Maintained
+F:      arch/arm/boot/dts/armada-388-clearfog*
+F:      arch/arm/boot/dts/armada-38x-solidrun-*
+
+SOLIDRUN CUBOX-I/HUMMINGBOARD SUPPORT
+M:      Russell King <linux@armlinux.org.uk>
+S:      Maintained
+F:      arch/arm/boot/dts/imx6*-cubox-i*
+F:      arch/arm/boot/dts/imx6*-hummingboard*
+F:      arch/arm/boot/dts/imx6*-sr-*
+
 SONIC NETWORK DRIVER
 M:      Thomas Bogendoerfer <tsbogend@alpha.franken.de>
 L:      netdev@vger.kernel.org
@@ -13661,7 +13675,8 @@ S:	Supported
 F:      drivers/i2c/busses/i2c-tegra.c
 
 TEGRA IOMMU DRIVERS
-M:      Hiroshi Doyu <hdoyu@nvidia.com>
+M:      Thierry Reding <thierry.reding@gmail.com>
+L:      linux-tegra@vger.kernel.org
 S:      Supported
 F:      drivers/iommu/tegra*
 
diff --git a/Makefile b/Makefile
index 486db374d1c1..9f77440dcdfe 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 16
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
@@ -487,6 +487,8 @@ CLANG_GCC_TC	:= --gcc-toolchain=$(GCC_TOOLCHAIN)
 endif
 KBUILD_CFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC)
 KBUILD_AFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC)
+KBUILD_CFLAGS += $(call cc-option, -no-integrated-as)
+KBUILD_AFLAGS += $(call cc-option, -no-integrated-as)
 endif
 
 RETPOLINE_CFLAGS_GCC := -mindirect-branch=thunk-extern -mindirect-branch-register
@@ -743,8 +745,6 @@ KBUILD_CFLAGS += $(call cc-disable-warning, tautological-compare)
 # See modpost pattern 2
 KBUILD_CFLAGS += $(call cc-option, -mno-global-merge,)
 KBUILD_CFLAGS += $(call cc-option, -fcatch-undefined-behavior)
-KBUILD_CFLAGS += $(call cc-option, -no-integrated-as)
-KBUILD_AFLAGS += $(call cc-option, -no-integrated-as)
 else
 
 # These warnings generated too much noise in a regular build.
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index 78a647080ebc..199ebc1c4538 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -22,6 +22,7 @@ config ARM_PTDUMP_DEBUGFS
 
 config DEBUG_WX
         bool "Warn on W+X mappings at boot"
+        depends on MMU
         select ARM_PTDUMP_CORE
         ---help---
                 Generate a warning if any W+X mappings are found at boot.
diff --git a/arch/arm/boot/deflate_xip_data.sh b/arch/arm/boot/deflate_xip_data.sh
index 1189598a25eb..5e7d758ebdd6 100755
--- a/arch/arm/boot/deflate_xip_data.sh
+++ b/arch/arm/boot/deflate_xip_data.sh
@@ -30,7 +30,7 @@ esac
 
 sym_val() {
         # extract hex value for symbol in $1
-        local val=$($NM "$VMLINUX" | sed -n "/ $1$/{s/ .*$//p;q}")
+        local val=$($NM "$VMLINUX" 2>/dev/null | sed -n "/ $1\$/{s/ .*$//p;q}")
         [ "$val" ] || { echo "can't find $1 in $VMLINUX" 1>&2; exit 1; }
         # convert from hex to decimal
         echo $((0x$val))
@@ -48,12 +48,12 @@ data_end=$(($_edata_loc - $base_offset))
 file_end=$(stat -c "%s" "$XIPIMAGE")
 if [ "$file_end" != "$data_end" ]; then
         printf "end of xipImage doesn't match with _edata_loc (%#x vs %#x)\n" \
-               $(($file_end + $base_offset)) $_edata_loc 2>&1
+               $(($file_end + $base_offset)) $_edata_loc 1>&2
         exit 1;
 fi
 
 # be ready to clean up
-trap 'rm -f "$XIPIMAGE.tmp"' 0 1 2 3
+trap 'rm -f "$XIPIMAGE.tmp"; exit 1' 1 2 3
 
 # substitute the data section by a compressed version
 $DD if="$XIPIMAGE" count=$data_start iflag=count_bytes of="$XIPIMAGE.tmp"
diff --git a/arch/arm/boot/dts/aspeed-g4.dtsi b/arch/arm/boot/dts/aspeed-g4.dtsi
index b0d8431a3700..ae2b8c952e80 100644
--- a/arch/arm/boot/dts/aspeed-g4.dtsi
+++ b/arch/arm/boot/dts/aspeed-g4.dtsi
@@ -42,6 +42,11 @@
                 };
         };
 
+        memory@40000000 {
+                device_type = "memory";
+                reg = <0x40000000 0>;
+        };
+
         ahb {
                 compatible = "simple-bus";
                 #address-cells = <1>;
diff --git a/arch/arm/boot/dts/aspeed-g5.dtsi b/arch/arm/boot/dts/aspeed-g5.dtsi
index 40de3b66c33f..2477ebc11d9d 100644
--- a/arch/arm/boot/dts/aspeed-g5.dtsi
+++ b/arch/arm/boot/dts/aspeed-g5.dtsi
@@ -42,6 +42,11 @@
                 };
         };
 
+        memory@80000000 {
+                device_type = "memory";
+                reg = <0x80000000 0>;
+        };
+
         ahb {
                 compatible = "simple-bus";
                 #address-cells = <1>;
diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
index a7a5dc7b2700..e7d2db839d70 100644
--- a/arch/arm/boot/dts/imx7d-sdb.dts
+++ b/arch/arm/boot/dts/imx7d-sdb.dts
@@ -82,7 +82,7 @@
                 enable-active-high;
         };
 
-        reg_usb_otg2_vbus: regulator-usb-otg1-vbus {
+        reg_usb_otg2_vbus: regulator-usb-otg2-vbus {
                 compatible = "regulator-fixed";
                 regulator-name = "usb_otg2_vbus";
                 regulator-min-microvolt = <5000000>;
diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
index 6102e4e7f35c..354aff45c1af 100644
--- a/arch/arm/boot/dts/rk3288.dtsi
+++ b/arch/arm/boot/dts/rk3288.dtsi
@@ -927,6 +927,7 @@
         i2s: i2s@ff890000 {
                 compatible = "rockchip,rk3288-i2s", "rockchip,rk3066-i2s";
                 reg = <0x0 0xff890000 0x0 0x10000>;
+                #sound-dai-cells = <0>;
                 interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>;
                 #address-cells = <1>;
                 #size-cells = <0>;
@@ -1176,6 +1177,7 @@
                 compatible = "rockchip,rk3288-dw-hdmi";
                 reg = <0x0 0xff980000 0x0 0x20000>;
                 reg-io-width = <4>;
+                #sound-dai-cells = <0>;
                 rockchip,grf = <&grf>;
                 interrupts = <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&cru  PCLK_HDMI_CTRL>, <&cru SCLK_HDMI_HDCP>, <&cru SCLK_HDMI_CEC>;
diff --git a/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts b/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts
index 51e6f1d21c32..b2758dd8ce43 100644
--- a/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts
+++ b/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts
@@ -42,7 +42,6 @@
 
 /dts-v1/;
 #include "sun6i-a31s.dtsi"
-#include "sunxi-common-regulators.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 
 / {
@@ -99,6 +98,7 @@
         pinctrl-0 = <&gmac_pins_rgmii_a>, <&gmac_phy_reset_pin_bpi_m2>;
         phy = <&phy1>;
         phy-mode = "rgmii";
+        phy-supply = <&reg_dldo1>;
         snps,reset-gpio = <&pio 0 21 GPIO_ACTIVE_HIGH>; /* PA21 */
         snps,reset-active-low;
         snps,reset-delays-us = <0 10000 30000>;
@@ -118,7 +118,7 @@
 &mmc0 {
         pinctrl-names = "default";
         pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin_bpi_m2>;
-        vmmc-supply = <&reg_vcc3v0>;
+        vmmc-supply = <&reg_dcdc1>;
         bus-width = <4>;
         cd-gpios = <&pio 0 4 GPIO_ACTIVE_HIGH>; /* PA4 */
         cd-inverted;
@@ -132,7 +132,7 @@
 &mmc2 {
         pinctrl-names = "default";
         pinctrl-0 = <&mmc2_pins_a>;
-        vmmc-supply = <&reg_vcc3v0>;
+        vmmc-supply = <&reg_aldo1>;
         mmc-pwrseq = <&mmc2_pwrseq>;
         bus-width = <4>;
         non-removable;
@@ -163,6 +163,8 @@
                 reg = <0x68>;
                 interrupt-parent = <&nmi_intc>;
                 interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
+                eldoin-supply = <&reg_dcdc1>;
+                x-powers,drive-vbus-en;
         };
 };
 
@@ -193,7 +195,28 @@
 
 #include "axp22x.dtsi"
 
+&reg_aldo1 {
+        regulator-min-microvolt = <3300000>;
+        regulator-max-microvolt = <3300000>;
+        regulator-name = "vcc-wifi";
+};
+
+&reg_aldo2 {
+        regulator-always-on;
+        regulator-min-microvolt = <2500000>;
+        regulator-max-microvolt = <2500000>;
+        regulator-name = "vcc-gmac";
+};
+
+&reg_aldo3 {
+        regulator-always-on;
+        regulator-min-microvolt = <3000000>;
+        regulator-max-microvolt = <3000000>;
+        regulator-name = "avcc";
+};
+
 &reg_dc5ldo {
+        regulator-always-on;
         regulator-min-microvolt = <700000>;
         regulator-max-microvolt = <1320000>;
         regulator-name = "vdd-cpus";
@@ -233,6 +256,40 @@
         regulator-name = "vcc-dram";
 };
 
+&reg_dldo1 {
+        regulator-min-microvolt = <3000000>;
+        regulator-max-microvolt = <3000000>;
+        regulator-name = "vcc-mac";
+};
+
+&reg_dldo2 {
+        regulator-min-microvolt = <2800000>;
+        regulator-max-microvolt = <2800000>;
+        regulator-name = "avdd-csi";
+};
+
+&reg_dldo3 {
+        regulator-always-on;
+        regulator-min-microvolt = <3300000>;
+        regulator-max-microvolt = <3300000>;
+        regulator-name = "vcc-pb";
+};
+
+&reg_eldo1 {
+        regulator-min-microvolt = <1800000>;
+        regulator-max-microvolt = <1800000>;
+        regulator-name = "vdd-csi";
+        status = "okay";
+};
+
+&reg_ldo_io1 {
+        regulator-always-on;
+        regulator-min-microvolt = <1800000>;
+        regulator-max-microvolt = <1800000>;
+        regulator-name = "vcc-pm-cpus";
+        status = "okay";
+};
+
 &uart0 {
         pinctrl-names = "default";
         pinctrl-0 = <&uart0_pins_a>;
diff --git a/arch/arm/include/asm/vdso.h b/arch/arm/include/asm/vdso.h
index 9c99e817535e..5b85889f82ee 100644
--- a/arch/arm/include/asm/vdso.h
+++ b/arch/arm/include/asm/vdso.h
@@ -12,8 +12,6 @@ struct mm_struct;
 
 void arm_install_vdso(struct mm_struct *mm, unsigned long addr);
 
-extern char vdso_start, vdso_end;
-
 extern unsigned int vdso_total_pages;
 
 #else /* CONFIG_VDSO */
diff --git a/arch/arm/kernel/vdso.c b/arch/arm/kernel/vdso.c
index a4d6dc0f2427..f4dd7f9663c1 100644
--- a/arch/arm/kernel/vdso.c
+++ b/arch/arm/kernel/vdso.c
@@ -39,6 +39,8 @@
 
 static struct page **vdso_text_pagelist;
 
+extern char vdso_start[], vdso_end[];
+
 /* Total number of pages needed for the data and text portions of the VDSO. */
 unsigned int vdso_total_pages __ro_after_init;
 
@@ -197,13 +199,13 @@ static int __init vdso_init(void)
         unsigned int text_pages;
         int i;
 
-        if (memcmp(&vdso_start, "\177ELF", 4)) {
+        if (memcmp(vdso_start, "\177ELF", 4)) {
                 pr_err("VDSO is not a valid ELF object!\n");
                 return -ENOEXEC;
         }
 
-        text_pages = (&vdso_end - &vdso_start) >> PAGE_SHIFT;
-        pr_debug("vdso: %i text pages at base %p\n", text_pages, &vdso_start);
+        text_pages = (vdso_end - vdso_start) >> PAGE_SHIFT;
+        pr_debug("vdso: %i text pages at base %p\n", text_pages, vdso_start);
 
         /* Allocate the VDSO text pagelist */
         vdso_text_pagelist = kcalloc(text_pages, sizeof(struct page *),
@@ -218,7 +220,7 @@ static int __init vdso_init(void)
         for (i = 0; i < text_pages; i++) {
                 struct page *page;
 
-                page = virt_to_page(&vdso_start + i * PAGE_SIZE);
+                page = virt_to_page(vdso_start + i * PAGE_SIZE);
                 vdso_text_pagelist[i] = page;
         }
 
@@ -229,7 +231,7 @@ static int __init vdso_init(void)
 
         cntvct_ok = cntvct_functional();
 
-        patch_vdso(&vdso_start);
+        patch_vdso(vdso_start);
 
         return 0;
 }
diff --git a/arch/arm/mach-davinci/board-omapl138-hawk.c b/arch/arm/mach-davinci/board-omapl138-hawk.c
index a3e78074be70..62eb7d668890 100644
--- a/arch/arm/mach-davinci/board-omapl138-hawk.c
+++ b/arch/arm/mach-davinci/board-omapl138-hawk.c
@@ -127,8 +127,8 @@ static struct gpiod_lookup_table mmc_gpios_table = {
         .dev_id = "da830-mmc.0",
         .table = {
                 /* CD: gpio3_12: gpio60: chip 1 contains gpio range 32-63*/
-                GPIO_LOOKUP("davinci_gpio.1", 28, "cd", GPIO_ACTIVE_LOW),
-                GPIO_LOOKUP("davinci_gpio.1", 29, "wp", GPIO_ACTIVE_LOW),
+                GPIO_LOOKUP("davinci_gpio.0", 28, "cd", GPIO_ACTIVE_LOW),
+                GPIO_LOOKUP("davinci_gpio.0", 29, "wp", GPIO_ACTIVE_LOW),
         },
 };
 
diff --git a/arch/arm/mach-ux500/cpu-db8500.c b/arch/arm/mach-ux500/cpu-db8500.c
index 7e5d7a083707..36cd23c8be9b 100644
--- a/arch/arm/mach-ux500/cpu-db8500.c
+++ b/arch/arm/mach-ux500/cpu-db8500.c
@@ -133,6 +133,9 @@ static void __init u8500_init_machine(void)
         if (of_machine_is_compatible("st-ericsson,u8540"))
                 of_platform_populate(NULL, u8500_local_bus_nodes,
                                      u8540_auxdata_lookup, NULL);
+        else
+                of_platform_populate(NULL, u8500_local_bus_nodes,
+                                     NULL, NULL);
 }
 
 static const char * stericsson_dt_platform_compat[] = {
diff --git a/arch/arm/plat-omap/dmtimer.c b/arch/arm/plat-omap/dmtimer.c
index d443e481c3e9..8805a59bae53 100644
--- a/arch/arm/plat-omap/dmtimer.c
+++ b/arch/arm/plat-omap/dmtimer.c
@@ -888,11 +888,8 @@ static int omap_dm_timer_probe(struct platform_device *pdev)
         timer->irq = irq->start;
         timer->pdev = pdev;
 
-        /* Skip pm_runtime_enable for OMAP1 */
-        if (!(timer->capability & OMAP_TIMER_NEEDS_RESET)) {
-                pm_runtime_enable(dev);
-                pm_runtime_irq_safe(dev);
-        }
+        pm_runtime_enable(dev);
+        pm_runtime_irq_safe(dev);
 
         if (!timer->reserved) {
                 ret = pm_runtime_get_sync(dev);
diff --git a/arch/arm/plat-omap/include/plat/sram.h b/arch/arm/plat-omap/include/plat/sram.h
index fb061cf0d736..30a07730807a 100644
--- a/arch/arm/plat-omap/include/plat/sram.h
+++ b/arch/arm/plat-omap/include/plat/sram.h
@@ -5,13 +5,4 @@ void omap_map_sram(unsigned long start, unsigned long size,
                         unsigned long skip, int cached);
 void omap_sram_reset(void);
 
-extern void *omap_sram_push_address(unsigned long size);
-
-/* Macro to push a function to the internal SRAM, using the fncpy API */
-#define omap_sram_push(funcp, size) ({                          \
-        typeof(&(funcp)) _res = NULL;                           \
-        void *_sram_address = omap_sram_push_address(size);     \
-        if (_sram_address)                                      \
-                _res = fncpy(_sram_address, &(funcp), size);    \
-        _res;                                                   \
-})
+extern void *omap_sram_push(void *funcp, unsigned long size);
diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
index a5bc92d7e476..921840acf65c 100644
--- a/arch/arm/plat-omap/sram.c
+++ b/arch/arm/plat-omap/sram.c
@@ -23,6 +23,7 @@
 #include <asm/fncpy.h>
 #include <asm/tlb.h>
 #include <asm/cacheflush.h>
+#include <asm/set_memory.h>
 
 #include <asm/mach/map.h>
 
@@ -42,7 +43,7 @@ static void __iomem *omap_sram_ceil;
  * Note that fncpy requires the returned address to be aligned
  * to an 8-byte boundary.
  */
-void *omap_sram_push_address(unsigned long size)
+static void *omap_sram_push_address(unsigned long size)
 {
         unsigned long available, new_ceil = (unsigned long)omap_sram_ceil;
 
@@ -60,6 +61,30 @@ void *omap_sram_push_address(unsigned long size)
         return (void *)omap_sram_ceil;
 }
 
+void *omap_sram_push(void *funcp, unsigned long size)
+{
+        void *sram;
+        unsigned long base;
+        int pages;
+        void *dst = NULL;
+
+        sram = omap_sram_push_address(size);
+        if (!sram)
+                return NULL;
+
+        base = (unsigned long)sram & PAGE_MASK;
+        pages = PAGE_ALIGN(size) / PAGE_SIZE;
+
+        set_memory_rw(base, pages);
+
+        dst = fncpy(sram, funcp, size);
+
+        set_memory_ro(base, pages);
+        set_memory_x(base, pages);
+
+        return dst;
+}
+
 /*
  * The SRAM context is lost during off-idle and stack
  * needs to be reset.
@@ -75,6 +100,9 @@ void omap_sram_reset(void)
 void __init omap_map_sram(unsigned long start, unsigned long size,
                                  unsigned long skip, int cached)
 {
+        unsigned long base;
+        int pages;
+
         if (size == 0)
                 return;
 
@@ -95,4 +123,10 @@ void __init omap_map_sram(unsigned long start, unsigned long size,
          */
         memset_io(omap_sram_base + omap_sram_skip, 0,
                   omap_sram_size - omap_sram_skip);
+
+        base = (unsigned long)omap_sram_base;
+        pages = PAGE_ALIGN(omap_sram_size) / PAGE_SIZE;
+
+        set_memory_ro(base, pages);
+        set_memory_x(base, pages);
 }
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index 03c6a3c72f9c..4c375e11ae95 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -648,7 +648,7 @@ int vfp_restore_user_hwstate(struct user_vfp __user *ufp,
  */
 static int vfp_dying_cpu(unsigned int cpu)
 {
-        vfp_force_reload(cpu, current_thread_info());
+        vfp_current_hw_state[cpu] = NULL;
         return 0;
 }
 
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi
index 03f195025390..204bdb9857b9 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi
@@ -406,8 +406,9 @@
         wlan_pd_n: wlan-pd-n {
                 compatible = "regulator-fixed";
                 regulator-name = "wlan_pd_n";
+                pinctrl-names = "default";
+                pinctrl-0 = <&wlan_module_reset_l>;
 
-                /* Note the wlan_module_reset_l pinctrl */
                 enable-active-high;
                 gpio = <&gpio1 11 GPIO_ACTIVE_HIGH>;
 
@@ -983,12 +984,6 @@ ap_i2c_audio: &i2c8 {
         pinctrl-0 = <
                 &ap_pwroff      /* AP will auto-assert this when in S3 */
                 &clk_32k        /* This pin is always 32k on gru boards */
-
-                /*
-                 * We want this driven low ASAP; firmware should help us, but
-                 * we can help ourselves too.
-                 */
-                &wlan_module_reset_l
         >;
 
         pcfg_output_low: pcfg-output-low {
@@ -1168,12 +1163,7 @@ ap_i2c_audio: &i2c8 {
                 };
 
                 wlan_module_reset_l: wlan-module-reset-l {
-                        /*
-                         * We want this driven low ASAP (As {Soon,Strongly} As
-                         * Possible), to avoid leakage through the powered-down
-                         * WiFi.
-                         */
-                        rockchip,pins = <1 11 RK_FUNC_GPIO &pcfg_output_low>;
+                        rockchip,pins = <1 11 RK_FUNC_GPIO &pcfg_pull_none>;
                 };
 
                 bt_host_wake_l: bt-host-wake-l {
diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
index 2605118d4b4c..0b81ca1d07e7 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
@@ -411,8 +411,8 @@
                         reg = <0x0 0xfe800000 0x0 0x100000>;
                         interrupts = <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH 0>;
                         dr_mode = "otg";
-                        phys = <&u2phy0_otg>, <&tcphy0_usb3>;
-                        phy-names = "usb2-phy", "usb3-phy";
+                        phys = <&u2phy0_otg>;
+                        phy-names = "usb2-phy";
                         phy_type = "utmi_wide";
                         snps,dis_enblslpm_quirk;
                         snps,dis-u2-freeclk-exists-quirk;
@@ -444,8 +444,8 @@
                         reg = <0x0 0xfe900000 0x0 0x100000>;
                         interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH 0>;
                         dr_mode = "otg";
-                        phys = <&u2phy1_otg>, <&tcphy1_usb3>;
-                        phy-names = "usb2-phy", "usb3-phy";
+                        phys = <&u2phy1_otg>;
+                        phy-names = "usb2-phy";
                         phy_type = "utmi_wide";
                         snps,dis_enblslpm_quirk;
                         snps,dis-u2-freeclk-exists-quirk;
diff --git a/arch/mips/lantiq/Kconfig b/arch/mips/lantiq/Kconfig
index 692ae85a3e3d..8e3a1fc2bc39 100644
--- a/arch/mips/lantiq/Kconfig
+++ b/arch/mips/lantiq/Kconfig
@@ -13,6 +13,8 @@ choice
 config SOC_AMAZON_SE
         bool "Amazon SE"
         select SOC_TYPE_XWAY
+        select MFD_SYSCON
+        select MFD_CORE
 
 config SOC_XWAY
         bool "XWAY"
diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
index 52500d3b7004..e0af39b33e28 100644
--- a/arch/mips/lantiq/xway/sysctrl.c
+++ b/arch/mips/lantiq/xway/sysctrl.c
@@ -549,9 +549,9 @@ void __init ltq_soc_init(void)
                 clkdev_add_static(ltq_ar9_cpu_hz(), ltq_ar9_fpi_hz(),
                                 ltq_ar9_fpi_hz(), CLOCK_250M);
                 clkdev_add_pmu("1f203018.usb2-phy", "phy", 1, 0, PMU_USB0_P);
-                clkdev_add_pmu("1e101000.usb", "otg", 1, 0, PMU_USB0);
+                clkdev_add_pmu("1e101000.usb", "otg", 1, 0, PMU_USB0 | PMU_AHBM);
                 clkdev_add_pmu("1f203034.usb2-phy", "phy", 1, 0, PMU_USB1_P);
-                clkdev_add_pmu("1e106000.usb", "otg", 1, 0, PMU_USB1);
+                clkdev_add_pmu("1e106000.usb", "otg", 1, 0, PMU_USB1 | PMU_AHBM);
                 clkdev_add_pmu("1e180000.etop", "switch", 1, 0, PMU_SWITCH);
                 clkdev_add_pmu("1e103000.sdio", NULL, 1, 0, PMU_SDIO);
                 clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU);
@@ -560,7 +560,7 @@ void __init ltq_soc_init(void)
         } else {
                 clkdev_add_static(ltq_danube_cpu_hz(), ltq_danube_fpi_hz(),
                                 ltq_danube_fpi_hz(), ltq_danube_pp32_hz());
-                clkdev_add_pmu("1f203018.usb2-phy", "ctrl", 1, 0, PMU_USB0);
+                clkdev_add_pmu("1e101000.usb", "otg", 1, 0, PMU_USB0 | PMU_AHBM);
                 clkdev_add_pmu("1f203018.usb2-phy", "phy", 1, 0, PMU_USB0_P);
                 clkdev_add_pmu("1e103000.sdio", NULL, 1, 0, PMU_SDIO);
                 clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU);
diff --git a/arch/mips/ralink/mt7621.c b/arch/mips/ralink/mt7621.c
index 1b274742077d..d2718de60b9b 100644
--- a/arch/mips/ralink/mt7621.c
+++ b/arch/mips/ralink/mt7621.c
@@ -170,6 +170,28 @@ void prom_soc_init(struct ralink_soc_info *soc_info)
         u32 n1;
         u32 rev;
 
+        /* Early detection of CMP support */
+        mips_cm_probe();
+        mips_cpc_probe();
+
+        if (mips_cps_numiocu(0)) {
+                /*
+                 * mips_cm_probe() wipes out bootloader
+                 * config for CM regions and we have to configure them
+                 * again. This SoC cannot talk to pamlbus devices
+                 * witout proper iocu region set up.
+                 *
+                 * FIXME: it would be better to do this with values
+                 * from DT, but we need this very early because
+                 * without this we cannot talk to pretty much anything
+                 * including serial.
+                 */
+                write_gcr_reg0_base(MT7621_PALMBUS_BASE);
+                write_gcr_reg0_mask(~MT7621_PALMBUS_SIZE |
+                                    CM_GCR_REGn_MASK_CMTGT_IOCU0);
+                __sync();
+        }
+
         n0 = __raw_readl(sysc + SYSC_REG_CHIP_NAME0);
         n1 = __raw_readl(sysc + SYSC_REG_CHIP_NAME1);
 
@@ -194,26 +216,6 @@ void prom_soc_init(struct ralink_soc_info *soc_info)
 
         rt2880_pinmux_data = mt7621_pinmux_data;
 
-        /* Early detection of CMP support */
-        mips_cm_probe();
-        mips_cpc_probe();
-
-        if (mips_cps_numiocu(0)) {
-                /*
-                 * mips_cm_probe() wipes out bootloader
-                 * config for CM regions and we have to configure them
-                 * again. This SoC cannot talk to pamlbus devices
-                 * witout proper iocu region set up.
-                 *
-                 * FIXME: it would be better to do this with values
-                 * from DT, but we need this very early because
-                 * without this we cannot talk to pretty much anything
-                 * including serial.
-                 */
-                write_gcr_reg0_base(MT7621_PALMBUS_BASE);
-                write_gcr_reg0_mask(~MT7621_PALMBUS_SIZE |
-                                    CM_GCR_REGn_MASK_CMTGT_IOCU0);
-        }
 
         if (!register_cps_smp_ops())
                 return;
diff --git a/arch/mips/ralink/reset.c b/arch/mips/ralink/reset.c
index 64543d66e76b..e9531fea23a2 100644
--- a/arch/mips/ralink/reset.c
+++ b/arch/mips/ralink/reset.c
@@ -96,16 +96,9 @@ static void ralink_restart(char *command)
         unreachable();
 }
 
-static void ralink_halt(void)
-{
-        local_irq_disable();
-        unreachable();
-}
-
 static int __init mips_reboot_setup(void)
 {
         _machine_restart = ralink_restart;
-        _machine_halt = ralink_halt;
 
         return 0;
 }
diff --git a/arch/powerpc/include/asm/book3s/64/mmu.h b/arch/powerpc/include/asm/book3s/64/mmu.h
index 0abeb0e2d616..37671feb2bf6 100644
--- a/arch/powerpc/include/asm/book3s/64/mmu.h
+++ b/arch/powerpc/include/asm/book3s/64/mmu.h
@@ -87,6 +87,9 @@ typedef struct {
         /* Number of bits in the mm_cpumask */
         atomic_t active_cpus;
 
+        /* Number of users of the external (Nest) MMU */
+        atomic_t copros;
+
         /* NPU NMMU context */
         struct npu_context *npu_context;
 
diff --git a/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h b/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h
index 8eea90f80e45..19b45ba6caf9 100644
--- a/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h
+++ b/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h
@@ -47,9 +47,6 @@ extern void radix__flush_tlb_page_psize(struct mm_struct *mm, unsigned long vmad
 #endif
 extern void radix__flush_tlb_pwc(struct mmu_gather *tlb, unsigned long addr);
 extern void radix__flush_tlb_collapsed_pmd(struct mm_struct *mm, unsigned long addr);
-extern void radix__flush_tlb_lpid_va(unsigned long lpid, unsigned long gpa,
-                                     unsigned long page_size);
-extern void radix__flush_tlb_lpid(unsigned long lpid);
 extern void radix__flush_tlb_all(void);
 extern void radix__flush_tlb_pte_p9_dd1(unsigned long old_pte, struct mm_struct *mm,
                                         unsigned long address);
diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index a2c5c95882cf..2e2bacbdf6ed 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -203,6 +203,7 @@ static inline void cpu_feature_keys_init(void) { }
 #define CPU_FTR_DAWR                    LONG_ASM_CONST(0x0400000000000000)
 #define CPU_FTR_DABRX                   LONG_ASM_CONST(0x0800000000000000)
 #define CPU_FTR_PMAO_BUG                LONG_ASM_CONST(0x1000000000000000)
+#define CPU_FTR_P9_TLBIE_BUG            LONG_ASM_CONST(0x2000000000000000)
 #define CPU_FTR_POWER9_DD1              LONG_ASM_CONST(0x4000000000000000)
 #define CPU_FTR_POWER9_DD2_1            LONG_ASM_CONST(0x8000000000000000)
 
@@ -465,7 +466,7 @@ static inline void cpu_feature_keys_init(void) { }
             CPU_FTR_CFAR | CPU_FTR_HVMODE | CPU_FTR_VMX_COPY | \
             CPU_FTR_DBELL | CPU_FTR_HAS_PPR | CPU_FTR_DAWR | \
             CPU_FTR_ARCH_207S | CPU_FTR_TM_COMP | CPU_FTR_ARCH_300 | \
-            CPU_FTR_PKEY)
+            CPU_FTR_PKEY | CPU_FTR_P9_TLBIE_BUG)
 #define CPU_FTRS_POWER9_DD1 ((CPU_FTRS_POWER9 | CPU_FTR_POWER9_DD1) & \
                              (~CPU_FTR_SAO))
 #define CPU_FTRS_POWER9_DD2_0 CPU_FTRS_POWER9
diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h
index 051b3d63afe3..3a15b6db9501 100644
--- a/arch/powerpc/include/asm/mmu_context.h
+++ b/arch/powerpc/include/asm/mmu_context.h
@@ -92,15 +92,23 @@ static inline void dec_mm_active_cpus(struct mm_struct *mm)
 static inline void mm_context_add_copro(struct mm_struct *mm)
 {
         /*
-         * On hash, should only be called once over the lifetime of
-         * the context, as we can't decrement the active cpus count
-         * and flush properly for the time being.
+         * If any copro is in use, increment the active CPU count
+         * in order to force TLB invalidations to be global as to
+         * propagate to the Nest MMU.
          */
-        inc_mm_active_cpus(mm);
+        if (atomic_inc_return(&mm->context.copros) == 1)
+                inc_mm_active_cpus(mm);
 }
 
 static inline void mm_context_remove_copro(struct mm_struct *mm)
 {
+        int c;
+
+        c = atomic_dec_if_positive(&mm->context.copros);
+
+        /* Detect imbalance between add and remove */
+        WARN_ON(c < 0);
+
         /*
          * Need to broadcast a global flush of the full mm before
          * decrementing active_cpus count, as the next TLBI may be
@@ -111,7 +119,7 @@ static inline void mm_context_remove_copro(struct mm_struct *mm)
          * for the time being. Invalidations will remain global if
          * used on hash.
          */
-        if (radix_enabled()) {
+        if (c == 0 && radix_enabled()) {
                 flush_all_mm(mm);
                 dec_mm_active_cpus(mm);
         }
diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
index 945e2c29ad2d..8ca5d5b74618 100644
--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
+++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
@@ -709,6 +709,9 @@ static __init void cpufeatures_cpu_quirks(void)
                 cur_cpu_spec->cpu_features |= CPU_FTR_POWER9_DD1;
         else if ((version & 0xffffefff) == 0x004e0201)
                 cur_cpu_spec->cpu_features |= CPU_FTR_POWER9_DD2_1;
+
+        if ((version & 0xffff0000) == 0x004e0000)
+                cur_cpu_spec->cpu_features |= CPU_FTR_P9_TLBIE_BUG;
 }
 
 static void __init cpufeatures_setup_finished(void)
@@ -720,6 +723,9 @@ static void __init cpufeatures_setup_finished(void)
                 cur_cpu_spec->cpu_features |= CPU_FTR_HVMODE;
         }
 
+        /* Make sure powerpc_base_platform is non-NULL */
+        powerpc_base_platform = cur_cpu_spec->platform;
+
         system_registers.lpcr = mfspr(SPRN_LPCR);
         system_registers.hfscr = mfspr(SPRN_HFSCR);
         system_registers.fscr = mfspr(SPRN_FSCR);
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 3ac87e53b3da..1ecfd8ffb098 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -706,7 +706,7 @@ EXC_COMMON_BEGIN(bad_addr_slb)
         ld      r3, PACA_EXSLB+EX_DAR(r13)
         std     r3, _DAR(r1)
         beq     cr6, 2f
-        li      r10, 0x480              /* fix trap number for I-SLB miss */
+        li      r10, 0x481              /* fix trap number for I-SLB miss */
         std     r10, _TRAP(r1)
 2:      bl      save_nvgprs
         addi    r3, r1, STACK_FRAME_OVERHEAD
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index f88038847790..061aa0f47bb1 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -476,6 +476,14 @@ void force_external_irq_replay(void)
          */
         WARN_ON(!arch_irqs_disabled());
 
+        /*
+         * Interrupts must always be hard disabled before irq_happened is
+         * modified (to prevent lost update in case of interrupt between
+         * load and store).
+         */
+        __hard_irq_disable();
+        local_paca->irq_happened |= PACA_IRQ_HARD_DIS;
+
         /* Indicate in the PACA that we have an interrupt to replay */
         local_paca->irq_happened |= PACA_IRQ_EE;
 }
diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c
index 5cb4e4687107..5d9bafe9a371 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c
@@ -157,6 +157,9 @@ static void kvmppc_radix_tlbie_page(struct kvm *kvm, unsigned long addr,
         asm volatile("ptesync": : :"memory");
         asm volatile(PPC_TLBIE_5(%0, %1, 0, 0, 1)
                      : : "r" (addr), "r" (kvm->arch.lpid) : "memory");
+        if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG))
+                asm volatile(PPC_TLBIE_5(%0, %1, 0, 0, 1)
+                             : : "r" (addr), "r" (kvm->arch.lpid) : "memory");
         asm volatile("ptesync": : :"memory");
 }
 
diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
index 8888e625a999..e1c083fbe434 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
@@ -473,6 +473,17 @@ static void do_tlbies(struct kvm *kvm, unsigned long *rbvalues,
                         trace_tlbie(kvm->arch.lpid, 0, rbvalues[i],
                                 kvm->arch.lpid, 0, 0, 0);
                 }
+
+                if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG)) {
+                        /*
+                         * Need the extra ptesync to make sure we don't
+                         * re-order the tlbie
+                         */
+                        asm volatile("ptesync": : :"memory");
+                        asm volatile(PPC_TLBIE_5(%0,%1,0,0,0) : :
+                                     "r" (rbvalues[0]), "r" (kvm->arch.lpid));
+                }
+
                 asm volatile("eieio; tlbsync; ptesync" : : : "memory");
                 kvm->arch.tlbie_lock = 0;
         } else {
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index d33264697a31..f86a20270e50 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1557,6 +1557,24 @@ mc_cont:
         ptesync
 3:      stw     r5,VCPU_SLB_MAX(r9)
 
+        /* load host SLB entries */
+BEGIN_MMU_FTR_SECTION
+        b       0f
+END_MMU_FTR_SECTION_IFSET(MMU_FTR_TYPE_RADIX)
+        ld      r8,PACA_SLBSHADOWPTR(r13)
+
+        .rept   SLB_NUM_BOLTED
+        li      r3, SLBSHADOW_SAVEAREA
+        LDX_BE  r5, r8, r3
+        addi    r3, r3, 8
+        LDX_BE  r6, r8, r3
+        andis.  r7,r5,SLB_ESID_V@h
+        beq     1f
+        slbmte  r6,r5
+1:      addi    r8,r8,16
+        .endr
+0:
+
 guest_bypass:
         stw     r12, STACK_SLOT_TRAP(r1)
         mr      r3, r12
@@ -2018,23 +2036,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
         mtspr   SPRN_LPCR,r8
         isync
 48:
-        /* load host SLB entries */
-BEGIN_MMU_FTR_SECTION
-        b       0f
-END_MMU_FTR_SECTION_IFSET(MMU_FTR_TYPE_RADIX)
-        ld      r8,PACA_SLBSHADOWPTR(r13)
-
-        .rept   SLB_NUM_BOLTED
-        li      r3, SLBSHADOW_SAVEAREA
-        LDX_BE  r5, r8, r3
-        addi    r3, r3, 8
-        LDX_BE  r6, r8, r3
-        andis.  r7,r5,SLB_ESID_V@h
-        beq     1f
-        slbmte  r6,r5
-1:      addi    r8,r8,16
-        .endr
-0:
 #ifdef CONFIG_KVM_BOOK3S_HV_EXIT_TIMING
         /* Finish timing, if we have a vcpu */
         ld      r4, HSTATE_KVM_VCPU(r13)
diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
index a0675e91ad7d..656933c85925 100644
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -201,6 +201,15 @@ static inline unsigned long  ___tlbie(unsigned long vpn, int psize,
         return va;
 }
 
+static inline void fixup_tlbie(unsigned long vpn, int psize, int apsize, int ssize)
+{
+        if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG)) {
+                /* Need the extra ptesync to ensure we don't reorder tlbie*/
+                asm volatile("ptesync": : :"memory");
+                ___tlbie(vpn, psize, apsize, ssize);
+        }
+}
+
 static inline void __tlbie(unsigned long vpn, int psize, int apsize, int ssize)
 {
         unsigned long rb;
@@ -278,6 +287,7 @@ static inline void tlbie(unsigned long vpn, int psize, int apsize,
                 asm volatile("ptesync": : :"memory");
         } else {
                 __tlbie(vpn, psize, apsize, ssize);
+                fixup_tlbie(vpn, psize, apsize, ssize);
                 asm volatile("eieio; tlbsync; ptesync": : :"memory");
         }
         if (lock_tlbie && !use_local)
@@ -771,7 +781,7 @@ static void native_hpte_clear(void)
  */
 static void native_flush_hash_range(unsigned long number, int local)
 {
-        unsigned long vpn;
+        unsigned long vpn = 0;
         unsigned long hash, index, hidx, shift, slot;
         struct hash_pte *hptep;
         unsigned long hpte_v;
@@ -843,6 +853,10 @@ static void native_flush_hash_range(unsigned long number, int local)
                                 __tlbie(vpn, psize, psize, ssize);
                         } pte_iterate_hashed_end();
                 }
+                /*
+                 * Just do one more with the last used values.
+                 */
+                fixup_tlbie(vpn, psize, psize, ssize);
                 asm volatile("eieio; tlbsync; ptesync":::"memory");
 
                 if (lock_tlbie)
diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c
index 929d9ef7083f..3f980baade4c 100644
--- a/arch/powerpc/mm/mmu_context_book3s64.c
+++ b/arch/powerpc/mm/mmu_context_book3s64.c
@@ -173,6 +173,7 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
         mm_iommu_init(mm);
 #endif
         atomic_set(&mm->context.active_cpus, 0);
+        atomic_set(&mm->context.copros, 0);
 
         return 0;
 }
diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c
index 28c980eb4422..adf469f312f2 100644
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -481,6 +481,7 @@ void mmu_partition_table_set_entry(unsigned int lpid, unsigned long dw0,
                              "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
                 trace_tlbie(lpid, 0, TLBIEL_INVAL_SET_LPID, lpid, 2, 0, 0);
         }
+        /* do we need fixup here ?*/
         asm volatile("eieio; tlbsync; ptesync" : : : "memory");
 }
 EXPORT_SYMBOL_GPL(mmu_partition_table_set_entry);
diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
index 71d1b19ad1c0..a07f5372a4bf 100644
--- a/arch/powerpc/mm/tlb-radix.c
+++ b/arch/powerpc/mm/tlb-radix.c
@@ -119,6 +119,49 @@ static inline void __tlbie_pid(unsigned long pid, unsigned long ric)
         trace_tlbie(0, 0, rb, rs, ric, prs, r);
 }
 
+static inline void __tlbiel_va(unsigned long va, unsigned long pid,
+                               unsigned long ap, unsigned long ric)
+{
+        unsigned long rb,rs,prs,r;
+
+        rb = va & ~(PPC_BITMASK(52, 63));
+        rb |= ap << PPC_BITLSHIFT(58);
+        rs = pid << PPC_BITLSHIFT(31);
+        prs = 1; /* process scoped */
+        r = 1;   /* raidx format */
+
+        asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1)
+                     : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
+        trace_tlbie(0, 1, rb, rs, ric, prs, r);
+}
+
+static inline void __tlbie_va(unsigned long va, unsigned long pid,
+                              unsigned long ap, unsigned long ric)
+{
+        unsigned long rb,rs,prs,r;
+
+        rb = va & ~(PPC_BITMASK(52, 63));
+        rb |= ap << PPC_BITLSHIFT(58);
+        rs = pid << PPC_BITLSHIFT(31);
+        prs = 1; /* process scoped */
+        r = 1;   /* raidx format */
+
+        asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
+                     : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
+        trace_tlbie(0, 0, rb, rs, ric, prs, r);
+}
+
+static inline void fixup_tlbie(void)
+{
+        unsigned long pid = 0;
+        unsigned long va = ((1UL << 52) - 1);
+
+        if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG)) {
+                asm volatile("ptesync": : :"memory");
+                __tlbie_va(va, pid, mmu_get_ap(MMU_PAGE_64K), RIC_FLUSH_TLB);
+        }
+}
+
 /*
  * We use 128 set in radix mode and 256 set in hpt mode.
  */
@@ -151,24 +194,25 @@ static inline void _tlbiel_pid(unsigned long pid, unsigned long ric)
 static inline void _tlbie_pid(unsigned long pid, unsigned long ric)
 {
         asm volatile("ptesync": : :"memory");
-        __tlbie_pid(pid, ric);
-        asm volatile("eieio; tlbsync; ptesync": : :"memory");
-}
 
-static inline void __tlbiel_va(unsigned long va, unsigned long pid,
-                               unsigned long ap, unsigned long ric)
-{
-        unsigned long rb,rs,prs,r;
-
-        rb = va & ~(PPC_BITMASK(52, 63));
-        rb |= ap << PPC_BITLSHIFT(58);
-        rs = pid << PPC_BITLSHIFT(31);
-        prs = 1; /* process scoped */
-        r = 1;   /* raidx format */
-
-        asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1)
-                     : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
-        trace_tlbie(0, 1, rb, rs, ric, prs, r);
+        /*
+         * Workaround the fact that the "ric" argument to __tlbie_pid
+         * must be a compile-time contraint to match the "i" constraint
+         * in the asm statement.
+         */
+        switch (ric) {
+        case RIC_FLUSH_TLB:
+                __tlbie_pid(pid, RIC_FLUSH_TLB);
+                break;
+        case RIC_FLUSH_PWC:
+                __tlbie_pid(pid, RIC_FLUSH_PWC);
+                break;
+        case RIC_FLUSH_ALL:
+        default:
+                __tlbie_pid(pid, RIC_FLUSH_ALL);
+        }
+        fixup_tlbie();
+        asm volatile("eieio; tlbsync; ptesync": : :"memory");
 }
 
 static inline void __tlbiel_va_range(unsigned long start, unsigned long end,
@@ -203,22 +247,6 @@ static inline void _tlbiel_va_range(unsigned long start, unsigned long end,
         asm volatile("ptesync": : :"memory");
 }
 
-static inline void __tlbie_va(unsigned long va, unsigned long pid,
-                             unsigned long ap, unsigned long ric)
-{
-        unsigned long rb,rs,prs,r;
-
-        rb = va & ~(PPC_BITMASK(52, 63));
-        rb |= ap << PPC_BITLSHIFT(58);
-        rs = pid << PPC_BITLSHIFT(31);
-        prs = 1; /* process scoped */
-        r = 1;   /* raidx format */
-
-        asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
-                     : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
-        trace_tlbie(0, 0, rb, rs, ric, prs, r);
-}
-
 static inline void __tlbie_va_range(unsigned long start, unsigned long end,
                                     unsigned long pid, unsigned long page_size,
                                     unsigned long psize)
@@ -237,6 +265,7 @@ static inline void _tlbie_va(unsigned long va, unsigned long pid,
 
         asm volatile("ptesync": : :"memory");
         __tlbie_va(va, pid, ap, ric);
+        fixup_tlbie();
         asm volatile("eieio; tlbsync; ptesync": : :"memory");
 }
 
@@ -248,6 +277,7 @@ static inline void _tlbie_va_range(unsigned long start, unsigned long end,
         if (also_pwc)
                 __tlbie_pid(pid, RIC_FLUSH_PWC);
         __tlbie_va_range(start, end, pid, page_size, psize);
+        fixup_tlbie();
         asm volatile("eieio; tlbsync; ptesync": : :"memory");
 }
 
@@ -311,6 +341,16 @@ void radix__local_flush_tlb_page(struct vm_area_struct *vma, unsigned long vmadd
 }
 EXPORT_SYMBOL(radix__local_flush_tlb_page);
 
+static bool mm_needs_flush_escalation(struct mm_struct *mm)
+{
+        /*
+         * P9 nest MMU has issues with the page walk cache
+         * caching PTEs and not flushing them properly when
+         * RIC = 0 for a PID/LPID invalidate
+         */
+        return atomic_read(&mm->context.copros) != 0;
+}
+
 #ifdef CONFIG_SMP
 void radix__flush_tlb_mm(struct mm_struct *mm)
 {
@@ -321,9 +361,12 @@ void radix__flush_tlb_mm(struct mm_struct *mm)
                 return;
 
         preempt_disable();
-        if (!mm_is_thread_local(mm))
-                _tlbie_pid(pid, RIC_FLUSH_TLB);
-        else
+        if (!mm_is_thread_local(mm)) {
+                if (mm_needs_flush_escalation(mm))
+                        _tlbie_pid(pid, RIC_FLUSH_ALL);
+                else
+                        _tlbie_pid(pid, RIC_FLUSH_TLB);
+        } else
                 _tlbiel_pid(pid, RIC_FLUSH_TLB);
         preempt_enable();
 }
@@ -435,10 +478,14 @@ void radix__flush_tlb_range(struct vm_area_struct *vma, unsigned long start,
         }
 
         if (full) {
-                if (local)
+                if (local) {
                         _tlbiel_pid(pid, RIC_FLUSH_TLB);
-                else
-                        _tlbie_pid(pid, RIC_FLUSH_TLB);
+                } else {
+                        if (mm_needs_flush_escalation(mm))
+                                _tlbie_pid(pid, RIC_FLUSH_ALL);
+                        else
+                                _tlbie_pid(pid, RIC_FLUSH_TLB);
+                }
         } else {
                 bool hflush = false;
                 unsigned long hstart, hend;
@@ -465,6 +512,7 @@ void radix__flush_tlb_range(struct vm_area_struct *vma, unsigned long start,
                         if (hflush)
                                 __tlbie_va_range(hstart, hend, pid,
                                                 HPAGE_PMD_SIZE, MMU_PAGE_2M);
+                        fixup_tlbie();
                         asm volatile("eieio; tlbsync; ptesync": : :"memory");
                 }
         }
@@ -548,6 +596,9 @@ static inline void __radix__flush_tlb_range_psize(struct mm_struct *mm,
         }
 
         if (full) {
+                if (!local && mm_needs_flush_escalation(mm))
+                        also_pwc = true;
+
                 if (local)
                         _tlbiel_pid(pid, also_pwc ? RIC_FLUSH_ALL : RIC_FLUSH_TLB);
                 else
@@ -603,46 +654,6 @@ void radix__flush_tlb_collapsed_pmd(struct mm_struct *mm, unsigned long addr)
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 
-void radix__flush_tlb_lpid_va(unsigned long lpid, unsigned long gpa,
-                              unsigned long page_size)
-{
-        unsigned long rb,rs,prs,r;
-        unsigned long ap;
-        unsigned long ric = RIC_FLUSH_TLB;
-
-        ap = mmu_get_ap(radix_get_mmu_psize(page_size));
-        rb = gpa & ~(PPC_BITMASK(52, 63));
-        rb |= ap << PPC_BITLSHIFT(58);
-        rs = lpid & ((1UL << 32) - 1);
-        prs = 0; /* process scoped */
-        r = 1;   /* raidx format */
-
-        asm volatile("ptesync": : :"memory");
-        asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
-                     : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
-        asm volatile("eieio; tlbsync; ptesync": : :"memory");
-        trace_tlbie(lpid, 0, rb, rs, ric, prs, r);
-}
-EXPORT_SYMBOL(radix__flush_tlb_lpid_va);
-
-void radix__flush_tlb_lpid(unsigned long lpid)
-{
-        unsigned long rb,rs,prs,r;
-        unsigned long ric = RIC_FLUSH_ALL;
-
-        rb = 0x2 << PPC_BITLSHIFT(53); /* IS = 2 */
-        rs = lpid & ((1UL << 32) - 1);
-        prs = 0; /* partition scoped */
-        r = 1;   /* raidx format */
-
-        asm volatile("ptesync": : :"memory");
-        asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
-                     : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
-        asm volatile("eieio; tlbsync; ptesync": : :"memory");
-        trace_tlbie(lpid, 0, rb, rs, ric, prs, r);
-}
-EXPORT_SYMBOL(radix__flush_tlb_lpid);
-
 void radix__flush_pmd_tlb_range(struct vm_area_struct *vma,
                                 unsigned long start, unsigned long end)
 {
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index 8b8d2297d486..638411f22267 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -315,19 +315,6 @@ config X86_L1_CACHE_SHIFT
         default "4" if MELAN || M486 || MGEODEGX1
         default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
 
-config X86_PPRO_FENCE
-        bool "PentiumPro memory ordering errata workaround"
-        depends on M686 || M586MMX || M586TSC || M586 || M486 || MGEODEGX1
-        ---help---
-          Old PentiumPro multiprocessor systems had errata that could cause
-          memory operations to violate the x86 ordering standard in rare cases.
-          Enabling this option will attempt to work around some (but not all)
-          occurrences of this problem, at the cost of much heavier spinlock and
-          memory barrier operations.
-
-          If unsure, say n here. Even distro kernels should think twice before
-          enabling this: there are few systems, and an unlikely bug.
-
 config X86_F00F_BUG
         def_bool y
         depends on M586MMX || M586TSC || M586 || M486
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 498c1b812300..1c4d012550ec 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -223,6 +223,15 @@ KBUILD_CFLAGS += $(cfi) $(cfi-sigframe) $(cfi-sections) $(asinstr) $(avx_instr)
 
 LDFLAGS := -m elf_$(UTS_MACHINE)
 
+#
+# The 64-bit kernel must be aligned to 2MB.  Pass -z max-page-size=0x200000 to
+# the linker to force 2MB page size regardless of the default page size used
+# by the linker.
+#
+ifdef CONFIG_X86_64
+LDFLAGS += $(call ld-option, -z max-page-size=0x200000)
+endif
+
 # Speed up the build
 KBUILD_CFLAGS += -pipe
 # Workaround for a gcc prelease that unfortunately was shipped in a suse release
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 98761a1576ce..252fee320816 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -309,6 +309,10 @@ static void parse_elf(void *output)
 
                 switch (phdr->p_type) {
                 case PT_LOAD:
+#ifdef CONFIG_X86_64
+                        if ((phdr->p_align % 0x200000) != 0)
+                                error("Alignment of LOAD segment isn't multiple of 2MB");
+#endif
 #ifdef CONFIG_RELOCATABLE
                         dest = output;
                         dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 805f52703ee3..18ed349b4f83 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -1138,7 +1138,7 @@ apicinterrupt3 HYPERV_REENLIGHTENMENT_VECTOR \
 #endif /* CONFIG_HYPERV */
 
 idtentry debug                  do_debug                has_error_code=0        paranoid=1 shift_ist=DEBUG_STACK
-idtentry int3                   do_int3                 has_error_code=0        paranoid=1 shift_ist=DEBUG_STACK
+idtentry int3                   do_int3                 has_error_code=0
 idtentry stack_segment          do_stack_segment        has_error_code=1
 
 #ifdef CONFIG_XEN
diff --git a/arch/x86/entry/vdso/vdso32/vclock_gettime.c b/arch/x86/entry/vdso/vdso32/vclock_gettime.c
index 7780bbfb06ef..9242b28418d5 100644
--- a/arch/x86/entry/vdso/vdso32/vclock_gettime.c
+++ b/arch/x86/entry/vdso/vdso32/vclock_gettime.c
@@ -5,8 +5,6 @@
 #undef CONFIG_OPTIMIZE_INLINING
 #endif
 
-#undef CONFIG_X86_PPRO_FENCE
-
 #ifdef CONFIG_X86_64
 
 /*
diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
index 8560ef68a9d6..317be365bce3 100644
--- a/arch/x86/entry/vsyscall/vsyscall_64.c
+++ b/arch/x86/entry/vsyscall/vsyscall_64.c
@@ -347,7 +347,7 @@ void __init set_vsyscall_pgtable_user_bits(pgd_t *root)
         set_pgd(pgd, __pgd(pgd_val(*pgd) | _PAGE_USER));
         p4d = p4d_offset(pgd, VSYSCALL_ADDR);
 #if CONFIG_PGTABLE_LEVELS >= 5
-        p4d->p4d |= _PAGE_USER;
+        set_p4d(p4d, __p4d(p4d_val(*p4d) | _PAGE_USER));
 #endif
         pud = pud_offset(p4d, VSYSCALL_ADDR);
         set_pud(pud, __pud(pud_val(*pud) | _PAGE_USER));
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 140d33288e78..88797c80b3e0 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2118,7 +2118,8 @@ static int x86_pmu_event_init(struct perf_event *event)
                         event->destroy(event);
         }
 
-        if (READ_ONCE(x86_pmu.attr_rdpmc))
+        if (READ_ONCE(x86_pmu.attr_rdpmc) &&
+            !(event->hw.flags & PERF_X86_EVENT_LARGE_PEBS))
                 event->hw.flags |= PERF_X86_EVENT_RDPMC_ALLOWED;
 
         return err;
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 56457cb73448..1e41d7508d99 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -2952,9 +2952,9 @@ static void intel_pebs_aliases_skl(struct perf_event *event)
         return intel_pebs_aliases_precdist(event);
 }
 
-static unsigned long intel_pmu_free_running_flags(struct perf_event *event)
+static unsigned long intel_pmu_large_pebs_flags(struct perf_event *event)
 {
-        unsigned long flags = x86_pmu.free_running_flags;
+        unsigned long flags = x86_pmu.large_pebs_flags;
 
         if (event->attr.use_clockid)
                 flags &= ~PERF_SAMPLE_TIME;
@@ -2976,8 +2976,8 @@ static int intel_pmu_hw_config(struct perf_event *event)
                 if (!event->attr.freq) {
                         event->hw.flags |= PERF_X86_EVENT_AUTO_RELOAD;
                         if (!(event->attr.sample_type &
-                              ~intel_pmu_free_running_flags(event)))
-                                event->hw.flags |= PERF_X86_EVENT_FREERUNNING;
+                              ~intel_pmu_large_pebs_flags(event)))
+                                event->hw.flags |= PERF_X86_EVENT_LARGE_PEBS;
                 }
                 if (x86_pmu.pebs_aliases)
                         x86_pmu.pebs_aliases(event);
@@ -3194,7 +3194,7 @@ static unsigned bdw_limit_period(struct perf_event *event, unsigned left)
                         X86_CONFIG(.event=0xc0, .umask=0x01)) {
                 if (left < 128)
                         left = 128;
-                left &= ~0x3fu;
+                left &= ~0x3fULL;
         }
         return left;
 }
@@ -3460,7 +3460,7 @@ static __initconst const struct x86_pmu core_pmu = {
         .event_map              = intel_pmu_event_map,
         .max_events             = ARRAY_SIZE(intel_perfmon_event_map),
         .apic                   = 1,
-        .free_running_flags     = PEBS_FREERUNNING_FLAGS,
+        .large_pebs_flags       = LARGE_PEBS_FLAGS,
 
         /*
          * Intel PMCs cannot be accessed sanely above 32-bit width,
@@ -3502,7 +3502,7 @@ static __initconst const struct x86_pmu intel_pmu = {
         .event_map              = intel_pmu_event_map,
         .max_events             = ARRAY_SIZE(intel_perfmon_event_map),
         .apic                   = 1,
-        .free_running_flags     = PEBS_FREERUNNING_FLAGS,
+        .large_pebs_flags       = LARGE_PEBS_FLAGS,
         /*
          * Intel PMCs cannot be accessed sanely above 32 bit width,
          * so we install an artificial 1<<31 period regardless of
diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
index 18c25ab28557..d8015235ba76 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -935,7 +935,7 @@ void intel_pmu_pebs_add(struct perf_event *event)
         bool needed_cb = pebs_needs_sched_cb(cpuc);
 
         cpuc->n_pebs++;
-        if (hwc->flags & PERF_X86_EVENT_FREERUNNING)
+        if (hwc->flags & PERF_X86_EVENT_LARGE_PEBS)
                 cpuc->n_large_pebs++;
 
         pebs_update_state(needed_cb, cpuc, event->ctx->pmu);
@@ -975,7 +975,7 @@ void intel_pmu_pebs_del(struct perf_event *event)
         bool needed_cb = pebs_needs_sched_cb(cpuc);
 
         cpuc->n_pebs--;
-        if (hwc->flags & PERF_X86_EVENT_FREERUNNING)
+        if (hwc->flags & PERF_X86_EVENT_LARGE_PEBS)
                 cpuc->n_large_pebs--;
 
         pebs_update_state(needed_cb, cpuc, event->ctx->pmu);
@@ -1530,7 +1530,7 @@ void __init intel_ds_init(void)
                         x86_pmu.pebs_record_size =
                                                 sizeof(struct pebs_record_skl);
                         x86_pmu.drain_pebs = intel_pmu_drain_pebs_nhm;
-                        x86_pmu.free_running_flags |= PERF_SAMPLE_TIME;
+                        x86_pmu.large_pebs_flags |= PERF_SAMPLE_TIME;
                         break;
 
                 default:
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index 22ec65bc033a..c98b943e58b4 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -3343,6 +3343,7 @@ static struct extra_reg skx_uncore_cha_extra_regs[] = {
         SNBEP_CBO_EVENT_EXTRA_REG(0x9134, 0xffff, 0x4),
         SNBEP_CBO_EVENT_EXTRA_REG(0x35, 0xff, 0x8),
         SNBEP_CBO_EVENT_EXTRA_REG(0x36, 0xff, 0x8),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x38, 0xff, 0x3),
         EVENT_EXTRA_END
 };
 
@@ -3562,24 +3563,27 @@ static struct intel_uncore_type *skx_msr_uncores[] = {
         NULL,
 };
 
+/*
+ * To determine the number of CHAs, it should read bits 27:0 in the CAPID6
+ * register which located at Device 30, Function 3, Offset 0x9C. PCI ID 0x2083.
+ */
+#define SKX_CAPID6              0x9c
+#define SKX_CHA_BIT_MASK        GENMASK(27, 0)
+
 static int skx_count_chabox(void)
 {
-        struct pci_dev *chabox_dev = NULL;
-        int bus, count = 0;
+        struct pci_dev *dev = NULL;
+        u32 val = 0;
 
-        while (1) {
-                chabox_dev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x208d, chabox_dev);
-                if (!chabox_dev)
-                        break;
-                if (count == 0)
-                        bus = chabox_dev->bus->number;
-                if (bus != chabox_dev->bus->number)
-                        break;
-                count++;
-        }
+        dev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x2083, dev);
+        if (!dev)
+                goto out;
 
-        pci_dev_put(chabox_dev);
-        return count;
+        pci_read_config_dword(dev, SKX_CAPID6, &val);
+        val &= SKX_CHA_BIT_MASK;
+out:
+        pci_dev_put(dev);
+        return hweight32(val);
 }
 
 void skx_uncore_cpu_init(void)
diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
index 78f91ec1056e..39cd0615f04f 100644
--- a/arch/x86/events/perf_event.h
+++ b/arch/x86/events/perf_event.h
@@ -69,7 +69,7 @@ struct event_constraint {
 #define PERF_X86_EVENT_RDPMC_ALLOWED    0x0100 /* grant rdpmc permission */
 #define PERF_X86_EVENT_EXCL_ACCT        0x0200 /* accounted EXCL event */
 #define PERF_X86_EVENT_AUTO_RELOAD      0x0400 /* use PEBS auto-reload */
-#define PERF_X86_EVENT_FREERUNNING      0x0800 /* use freerunning PEBS */
+#define PERF_X86_EVENT_LARGE_PEBS       0x0800 /* use large PEBS */
 
 
 struct amd_nb {
@@ -88,7 +88,7 @@ struct amd_nb {
  * REGS_USER can be handled for events limited to ring 3.
  *
  */
-#define PEBS_FREERUNNING_FLAGS \
+#define LARGE_PEBS_FLAGS \
         (PERF_SAMPLE_IP | PERF_SAMPLE_TID | PERF_SAMPLE_ADDR | \
         PERF_SAMPLE_ID | PERF_SAMPLE_CPU | PERF_SAMPLE_STREAM_ID | \
         PERF_SAMPLE_DATA_SRC | PERF_SAMPLE_IDENTIFIER | \
@@ -608,7 +608,7 @@ struct x86_pmu {
         struct event_constraint *pebs_constraints;
         void            (*pebs_aliases)(struct perf_event *event);
         int             max_pebs_events;
-        unsigned long   free_running_flags;
+        unsigned long   large_pebs_flags;
 
         /*
          * Intel LBR
diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
index e1259f043ae9..042b5e892ed1 100644
--- a/arch/x86/include/asm/barrier.h
+++ b/arch/x86/include/asm/barrier.h
@@ -52,11 +52,7 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 #define barrier_nospec() alternative_2("", "mfence", X86_FEATURE_MFENCE_RDTSC, \
                                            "lfence", X86_FEATURE_LFENCE_RDTSC)
 
-#ifdef CONFIG_X86_PPRO_FENCE
-#define dma_rmb()       rmb()
-#else
 #define dma_rmb()       barrier()
-#endif
 #define dma_wmb()       barrier()
 
 #ifdef CONFIG_X86_32
@@ -68,30 +64,6 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 #define __smp_wmb()     barrier()
 #define __smp_store_mb(var, value) do { (void)xchg(&var, value); } while (0)
 
-#if defined(CONFIG_X86_PPRO_FENCE)
-
-/*
- * For this option x86 doesn't have a strong TSO memory
- * model and we should fall back to full barriers.
- */
-
-#define __smp_store_release(p, v)                                       \
-do {                                                                    \
-        compiletime_assert_atomic_type(*p);                             \
-        __smp_mb();                                                     \
-        WRITE_ONCE(*p, v);                                              \
-} while (0)
-
-#define __smp_load_acquire(p)                                           \
-({                                                                      \
-        typeof(*p) ___p1 = READ_ONCE(*p);                               \
-        compiletime_assert_atomic_type(*p);                             \
-        __smp_mb();                                                     \
-        ___p1;                                                          \
-})
-
-#else /* regular x86 TSO memory ordering */
-
 #define __smp_store_release(p, v)                                       \
 do {                                                                    \
         compiletime_assert_atomic_type(*p);                             \
@@ -107,8 +79,6 @@ do {									\
         ___p1;                                                          \
 })
 
-#endif
-
 /* Atomic operations are already serializing on x86 */
 #define __smp_mb__before_atomic()       barrier()
 #define __smp_mb__after_atomic()        barrier()
diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
index 95e948627fd0..f6e5b9375d8c 100644
--- a/arch/x86/include/asm/io.h
+++ b/arch/x86/include/asm/io.h
@@ -232,21 +232,6 @@ extern void set_iounmap_nonlazy(void);
  */
 #define __ISA_IO_base ((char __iomem *)(PAGE_OFFSET))
 
-/*
- *      Cache management
- *
- *      This needed for two cases
- *      1. Out of order aware processors
- *      2. Accidentally out of order processors (PPro errata #51)
- */
-
-static inline void flush_write_buffers(void)
-{
-#if defined(CONFIG_X86_PPRO_FENCE)
-        asm volatile("lock; addl $0,0(%%esp)": : :"memory");
-#endif
-}
-
 #endif /* __KERNEL__ */
 
 extern void native_io_delay(void);
diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c
index 56d99be3706a..50bee5fe1140 100644
--- a/arch/x86/kernel/idt.c
+++ b/arch/x86/kernel/idt.c
@@ -160,7 +160,6 @@ static const __initconst struct idt_data early_pf_idts[] = {
  */
 static const __initconst struct idt_data dbg_idts[] = {
         INTG(X86_TRAP_DB,       debug),
-        INTG(X86_TRAP_BP,       int3),
 };
 #endif
 
@@ -183,7 +182,6 @@ gate_desc debug_idt_table[IDT_ENTRIES] __page_aligned_bss;
 static const __initconst struct idt_data ist_idts[] = {
         ISTG(X86_TRAP_DB,       debug,          DEBUG_STACK),
         ISTG(X86_TRAP_NMI,      nmi,            NMI_STACK),
-        SISTG(X86_TRAP_BP,      int3,           DEBUG_STACK),
         ISTG(X86_TRAP_DF,       double_fault,   DOUBLEFAULT_STACK),
 #ifdef CONFIG_X86_MCE
         ISTG(X86_TRAP_MC,       &machine_check, MCE_STACK),
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index bc1a27280c4b..fae86e36e399 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -546,7 +546,7 @@ static void __init kvm_guest_init(void)
         }
 
         if (kvm_para_has_feature(KVM_FEATURE_PV_TLB_FLUSH) &&
-            !kvm_para_has_feature(KVM_FEATURE_STEAL_TIME))
+            kvm_para_has_feature(KVM_FEATURE_STEAL_TIME))
                 pv_mmu_ops.flush_tlb_others = kvm_flush_tlb_others;
 
         if (kvm_para_has_feature(KVM_FEATURE_PV_EOI))
@@ -635,7 +635,7 @@ static __init int kvm_setup_pv_tlb_flush(void)
         int cpu;
 
         if (kvm_para_has_feature(KVM_FEATURE_PV_TLB_FLUSH) &&
-            !kvm_para_has_feature(KVM_FEATURE_STEAL_TIME)) {
+            kvm_para_has_feature(KVM_FEATURE_STEAL_TIME)) {
                 for_each_possible_cpu(cpu) {
                         zalloc_cpumask_var_node(per_cpu_ptr(&__pv_tlb_mask, cpu),
                                 GFP_KERNEL, cpu_to_node(cpu));
diff --git a/arch/x86/kernel/pci-nommu.c b/arch/x86/kernel/pci-nommu.c
index 618285e475c6..ac7ea3a8242f 100644
--- a/arch/x86/kernel/pci-nommu.c
+++ b/arch/x86/kernel/pci-nommu.c
@@ -37,7 +37,6 @@ static dma_addr_t nommu_map_page(struct device *dev, struct page *page,
         WARN_ON(size == 0);
         if (!check_addr("map_single", dev, bus, size))
                 return NOMMU_MAPPING_ERROR;
-        flush_write_buffers();
         return bus;
 }
 
@@ -72,25 +71,9 @@ static int nommu_map_sg(struct device *hwdev, struct scatterlist *sg,
                         return 0;
                 s->dma_length = s->length;
         }
-        flush_write_buffers();
         return nents;
 }
 
-static void nommu_sync_single_for_device(struct device *dev,
-                        dma_addr_t addr, size_t size,
-                        enum dma_data_direction dir)
-{
-        flush_write_buffers();
-}
-
-
-static void nommu_sync_sg_for_device(struct device *dev,
-                        struct scatterlist *sg, int nelems,
-                        enum dma_data_direction dir)
-{
-        flush_write_buffers();
-}
-
 static int nommu_mapping_error(struct device *dev, dma_addr_t dma_addr)
 {
         return dma_addr == NOMMU_MAPPING_ERROR;
@@ -101,8 +84,6 @@ const struct dma_map_ops nommu_dma_ops = {
         .free                   = dma_generic_free_coherent,
         .map_sg                 = nommu_map_sg,
         .map_page               = nommu_map_page,
-        .sync_single_for_device = nommu_sync_single_for_device,
-        .sync_sg_for_device     = nommu_sync_sg_for_device,
         .is_phys                = 1,
         .mapping_error          = nommu_mapping_error,
         .dma_supported          = x86_dma_supported,
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 3d9b2308e7fa..03f3d7695dac 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -577,7 +577,6 @@ do_general_protection(struct pt_regs *regs, long error_code)
 }
 NOKPROBE_SYMBOL(do_general_protection);
 
-/* May run on IST stack. */
 dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code)
 {
 #ifdef CONFIG_DYNAMIC_FTRACE
@@ -592,6 +591,13 @@ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code)
         if (poke_int3_handler(regs))
                 return;
 
+        /*
+         * Use ist_enter despite the fact that we don't use an IST stack.
+         * We can be called from a kprobe in non-CONTEXT_KERNEL kernel
+         * mode or even during context tracking state changes.
+         *
+         * This means that we can't schedule.  That's okay.
+         */
         ist_enter(regs);
         RCU_LOCKDEP_WARN(!rcu_is_watching(), "entry code didn't wake RCU");
 #ifdef CONFIG_KGDB_LOW_LEVEL_TRAP
@@ -609,15 +615,10 @@ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code)
                         SIGTRAP) == NOTIFY_STOP)
                 goto exit;
 
-        /*
-         * Let others (NMI) know that the debug stack is in use
-         * as we may switch to the interrupt stack.
-         */
-        debug_stack_usage_inc();
         cond_local_irq_enable(regs);
         do_trap(X86_TRAP_BP, SIGTRAP, "int3", regs, error_code, NULL);
         cond_local_irq_disable(regs);
-        debug_stack_usage_dec();
+
 exit:
         ist_exit(regs);
 }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 2d87603f9179..657c93409042 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -10711,6 +10711,11 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
         struct vcpu_vmx *vmx = to_vmx(vcpu);
         u32 exec_control, vmcs12_exec_ctrl;
 
+        if (vmx->nested.dirty_vmcs12) {
+                prepare_vmcs02_full(vcpu, vmcs12, from_vmentry);
+                vmx->nested.dirty_vmcs12 = false;
+        }
+
         /*
          * First, the fields that are shadowed.  This must be kept in sync
          * with vmx_shadow_fields.h.
@@ -10948,11 +10953,6 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
         /* Note: modifies VM_ENTRY/EXIT_CONTROLS and GUEST/HOST_IA32_EFER */
         vmx_set_efer(vcpu, vcpu->arch.efer);
 
-        if (vmx->nested.dirty_vmcs12) {
-                prepare_vmcs02_full(vcpu, vmcs12, from_vmentry);
-                vmx->nested.dirty_vmcs12 = false;
-        }
-
         /* Shadow page tables on either EPT or shadow page tables. */
         if (nested_vmx_load_cr3(vcpu, vmcs12->guest_cr3, nested_cpu_has_ept(vmcs12),
                                 entry_failure_code))
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index c310a8284358..f9cfbc0d1f33 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -227,7 +227,7 @@ int __init efi_alloc_page_tables(void)
         if (!pud) {
                 if (CONFIG_PGTABLE_LEVELS > 4)
                         free_page((unsigned long) pgd_page_vaddr(*pgd));
-                free_page((unsigned long)efi_pgd);
+                free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER);
                 return -ENOMEM;
         }
 
diff --git a/arch/x86/um/asm/barrier.h b/arch/x86/um/asm/barrier.h
index b7d73400ea29..f31e5d903161 100644
--- a/arch/x86/um/asm/barrier.h
+++ b/arch/x86/um/asm/barrier.h
@@ -30,11 +30,7 @@
 
 #endif /* CONFIG_X86_32 */
 
-#ifdef CONFIG_X86_PPRO_FENCE
-#define dma_rmb()       rmb()
-#else /* CONFIG_X86_PPRO_FENCE */
 #define dma_rmb()       barrier()
-#endif /* CONFIG_X86_PPRO_FENCE */
 #define dma_wmb()       barrier()
 
 #include <asm-generic/barrier.h>
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index 98a3a43484c8..44abb8a0a5e5 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -3147,7 +3147,7 @@ static int ia_proc_read(struct atm_dev *dev,loff_t *pos,char *page)
                            "  Size of Tx Buffer  :  %u\n"
                            "  Number of Rx Buffer:  %u\n"
                            "  Size of Rx Buffer  :  %u\n"
-                           "  Packets Receiverd  :  %u\n"
+                           "  Packets Received   :  %u\n"
                            "  Packets Transmitted:  %u\n"
                            "  Cells Received     :  %u\n"
                            "  Cells Transmitted  :  %u\n"
diff --git a/drivers/dma/stm32-dmamux.c b/drivers/dma/stm32-dmamux.c
index 4dbb30cf94ac..b922db90939a 100644
--- a/drivers/dma/stm32-dmamux.c
+++ b/drivers/dma/stm32-dmamux.c
@@ -118,14 +118,15 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec,
         spin_lock_irqsave(&dmamux->lock, flags);
         mux->chan_id = find_first_zero_bit(dmamux->dma_inuse,
                                            dmamux->dma_requests);
-        set_bit(mux->chan_id, dmamux->dma_inuse);
-        spin_unlock_irqrestore(&dmamux->lock, flags);
 
         if (mux->chan_id == dmamux->dma_requests) {
+                spin_unlock_irqrestore(&dmamux->lock, flags);
                 dev_err(&pdev->dev, "Run out of free DMA requests\n");
                 ret = -ENOMEM;
-                goto error;
+                goto error_chan_id;
         }
+        set_bit(mux->chan_id, dmamux->dma_inuse);
+        spin_unlock_irqrestore(&dmamux->lock, flags);
 
         /* Look for DMA Master */
         for (i = 1, min = 0, max = dmamux->dma_reqs[i];
@@ -173,6 +174,8 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec,
 
 error:
         clear_bit(mux->chan_id, dmamux->dma_inuse);
+
+error_chan_id:
         kfree(mux);
         return ERR_PTR(ret);
 }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index b21285afa4ea..1bd5f26b3f00 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -821,13 +821,13 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q,
                 pr_warn("Can't create new usermode queue because %d queues were already created\n",
                                 dqm->total_queue_count);
                 retval = -EPERM;
-                goto out;
+                goto out_unlock;
         }
 
         if (q->properties.type == KFD_QUEUE_TYPE_SDMA) {
                 retval = allocate_sdma_queue(dqm, &q->sdma_id);
                 if (retval)
-                        goto out;
+                        goto out_unlock;
                 q->properties.sdma_queue_id =
                         q->sdma_id / CIK_SDMA_QUEUES_PER_ENGINE;
                 q->properties.sdma_engine_id =
@@ -838,7 +838,7 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q,
 
         if (!mqd) {
                 retval = -ENOMEM;
-                goto out;
+                goto out_deallocate_sdma_queue;
         }
 
         dqm->asic_ops.init_sdma_vm(dqm, q, qpd);
@@ -848,7 +848,7 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q,
         retval = mqd->init_mqd(mqd, &q->mqd, &q->mqd_mem_obj,
                                 &q->gart_mqd_addr, &q->properties);
         if (retval)
-                goto out;
+                goto out_deallocate_sdma_queue;
 
         list_add(&q->list, &qpd->queues_list);
         qpd->queue_count++;
@@ -869,7 +869,13 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q,
         pr_debug("Total of %d queues are accountable so far\n",
                         dqm->total_queue_count);
 
-out:
+        mutex_unlock(&dqm->lock);
+        return retval;
+
+out_deallocate_sdma_queue:
+        if (q->properties.type == KFD_QUEUE_TYPE_SDMA)
+                deallocate_sdma_queue(dqm, q->sdma_id);
+out_unlock:
         mutex_unlock(&dqm->lock);
         return retval;
 }
@@ -1188,8 +1194,10 @@ static int process_termination_cpsch(struct device_queue_manager *dqm,
 
         /* Clear all user mode queues */
         list_for_each_entry(q, &qpd->queues_list, list) {
-                if (q->properties.type == KFD_QUEUE_TYPE_SDMA)
+                if (q->properties.type == KFD_QUEUE_TYPE_SDMA) {
                         dqm->sdma_queue_count--;
+                        deallocate_sdma_queue(dqm, q->sdma_id);
+                }
 
                 if (q->properties.is_active)
                         dqm->queue_count--;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c
index 0ecbd1f9b606..0c3bc00978f7 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c
@@ -188,8 +188,7 @@ static int pm_create_map_process(struct packet_manager *pm, uint32_t *buffer,
         packet->sh_mem_ape1_base = qpd->sh_mem_ape1_base;
         packet->sh_mem_ape1_limit = qpd->sh_mem_ape1_limit;
 
-        /* TODO: scratch support */
-        packet->sh_hidden_private_base_vmid = 0;
+        packet->sh_hidden_private_base_vmid = qpd->sh_hidden_private_base;
 
         packet->gds_addr_lo = lower_32_bits(qpd->gds_context_area);
         packet->gds_addr_hi = upper_32_bits(qpd->gds_context_area);
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index fbffe1948b3b..90b25ce363ca 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -2009,9 +2009,9 @@ static const struct tegra_dc_soc_info tegra124_dc_soc_info = {
         .coupled_pm = false,
         .has_nvdisplay = false,
         .num_primary_formats = ARRAY_SIZE(tegra124_primary_formats),
-        .primary_formats = tegra114_primary_formats,
+        .primary_formats = tegra124_primary_formats,
         .num_overlay_formats = ARRAY_SIZE(tegra124_overlay_formats),
-        .overlay_formats = tegra114_overlay_formats,
+        .overlay_formats = tegra124_overlay_formats,
 };
 
 static const struct tegra_dc_soc_info tegra210_dc_soc_info = {
@@ -2160,7 +2160,7 @@ static int tegra_dc_couple(struct tegra_dc *dc)
                 struct device_link *link;
                 struct device *partner;
 
-                partner = driver_find_device(dc->dev->driver, NULL, 0,
+                partner = driver_find_device(dc->dev->driver, NULL, NULL,
                                              tegra_dc_match_by_pipe);
                 if (!partner)
                         return -EPROBE_DEFER;
diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index 50e071444a5c..8699bb969e7e 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -417,13 +417,24 @@ __hv_pkt_iter_next(struct vmbus_channel *channel,
 }
 EXPORT_SYMBOL_GPL(__hv_pkt_iter_next);
 
+/* How many bytes were read in this iterator cycle */
+static u32 hv_pkt_iter_bytes_read(const struct hv_ring_buffer_info *rbi,
+                                        u32 start_read_index)
+{
+        if (rbi->priv_read_index >= start_read_index)
+                return rbi->priv_read_index - start_read_index;
+        else
+                return rbi->ring_datasize - start_read_index +
+                        rbi->priv_read_index;
+}
+
 /*
  * Update host ring buffer after iterating over packets.
  */
 void hv_pkt_iter_close(struct vmbus_channel *channel)
 {
         struct hv_ring_buffer_info *rbi = &channel->inbound;
-        u32 orig_write_sz = hv_get_bytes_to_write(rbi);
+        u32 curr_write_sz, pending_sz, bytes_read, start_read_index;
 
         /*
          * Make sure all reads are done before we update the read index since
@@ -431,8 +442,12 @@ void hv_pkt_iter_close(struct vmbus_channel *channel)
          * is updated.
          */
         virt_rmb();
+        start_read_index = rbi->ring_buffer->read_index;
         rbi->ring_buffer->read_index = rbi->priv_read_index;
 
+        if (!rbi->ring_buffer->feature_bits.feat_pending_send_sz)
+                return;
+
         /*
          * Issue a full memory barrier before making the signaling decision.
          * Here is the reason for having this barrier:
@@ -446,26 +461,29 @@ void hv_pkt_iter_close(struct vmbus_channel *channel)
          */
         virt_mb();
 
-        /* If host has disabled notifications then skip */
-        if (rbi->ring_buffer->interrupt_mask)
+        pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz);
+        if (!pending_sz)
                 return;
 
-        if (rbi->ring_buffer->feature_bits.feat_pending_send_sz) {
-                u32 pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz);
+        /*
+         * Ensure the read of write_index in hv_get_bytes_to_write()
+         * happens after the read of pending_send_sz.
+         */
+        virt_rmb();
+        curr_write_sz = hv_get_bytes_to_write(rbi);
+        bytes_read = hv_pkt_iter_bytes_read(rbi, start_read_index);
 
-                /*
-                 * If there was space before we began iteration,
-                 * then host was not blocked. Also handles case where
-                 * pending_sz is zero then host has nothing pending
-                 * and does not need to be signaled.
-                 */
-                if (orig_write_sz > pending_sz)
-                        return;
+        /*
+         * If there was space before we began iteration,
+         * then host was not blocked.
+         */
 
-                /* If pending write will not fit, don't give false hope. */
-                if (hv_get_bytes_to_write(rbi) < pending_sz)
-                        return;
-        }
+        if (curr_write_sz - bytes_read > pending_sz)
+                return;
+
+        /* If pending write will not fit, don't give false hope. */
+        if (curr_write_sz <= pending_sz)
+                return;
 
         vmbus_setevent(channel);
 }
diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
index b445b3bb0bb1..f273e28c39db 100644
--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -888,6 +888,11 @@ static int stm32f7_i2c_probe(struct platform_device *pdev)
         }
 
         setup = of_device_get_match_data(&pdev->dev);
+        if (!setup) {
+                dev_err(&pdev->dev, "Can't get device data\n");
+                ret = -ENODEV;
+                goto clk_free;
+        }
         i2c_dev->setup = *setup;
 
         ret = device_property_read_u32(i2c_dev->dev, "i2c-scl-rising-time-ns",
diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c
index 6fe995cf16a6..3e6fd5a8ac5b 100644
--- a/drivers/iio/accel/st_accel_core.c
+++ b/drivers/iio/accel/st_accel_core.c
@@ -920,6 +920,8 @@ static const struct iio_trigger_ops st_accel_trigger_ops = {
 int st_accel_common_probe(struct iio_dev *indio_dev)
 {
         struct st_sensor_data *adata = iio_priv(indio_dev);
+        struct st_sensors_platform_data *pdata =
+                (struct st_sensors_platform_data *)adata->dev->platform_data;
         int irq = adata->get_irq_data_ready(indio_dev);
         int err;
 
@@ -946,7 +948,10 @@ int st_accel_common_probe(struct iio_dev *indio_dev)
                                         &adata->sensor_settings->fs.fs_avl[0];
         adata->odr = adata->sensor_settings->odr.odr_avl[0].hz;
 
-        err = st_sensors_init_sensor(indio_dev, adata->dev->platform_data);
+        if (!pdata)
+                pdata = (struct st_sensors_platform_data *)&default_accel_pdata;
+
+        err = st_sensors_init_sensor(indio_dev, pdata);
         if (err < 0)
                 goto st_accel_power_off;
 
diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
index 29fa7736d80c..ede955d9b2a4 100644
--- a/drivers/iio/adc/meson_saradc.c
+++ b/drivers/iio/adc/meson_saradc.c
@@ -462,8 +462,10 @@ static int meson_sar_adc_lock(struct iio_dev *indio_dev)
                         regmap_read(priv->regmap, MESON_SAR_ADC_DELAY, &val);
                 } while (val & MESON_SAR_ADC_DELAY_BL30_BUSY && timeout--);
 
-                if (timeout < 0)
+                if (timeout < 0) {
+                        mutex_unlock(&indio_dev->mlock);
                         return -ETIMEDOUT;
+                }
         }
 
         return 0;
diff --git a/drivers/iio/adc/stm32-dfsdm-adc.c b/drivers/iio/adc/stm32-dfsdm-adc.c
index daa026d6a94f..01422d11753c 100644
--- a/drivers/iio/adc/stm32-dfsdm-adc.c
+++ b/drivers/iio/adc/stm32-dfsdm-adc.c
@@ -54,7 +54,6 @@ struct stm32_dfsdm_adc {
         struct stm32_dfsdm *dfsdm;
         const struct stm32_dfsdm_dev_data *dev_data;
         unsigned int fl_id;
-        unsigned int ch_id;
 
         /* ADC specific */
         unsigned int oversamp;
@@ -384,7 +383,7 @@ static ssize_t dfsdm_adc_audio_set_spiclk(struct iio_dev *indio_dev,
 {
         struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
         struct stm32_dfsdm_filter *fl = &adc->dfsdm->fl_list[adc->fl_id];
-        struct stm32_dfsdm_channel *ch = &adc->dfsdm->ch_list[adc->ch_id];
+        struct stm32_dfsdm_channel *ch = &adc->dfsdm->ch_list[chan->channel];
         unsigned int sample_freq = adc->sample_freq;
         unsigned int spi_freq;
         int ret;
@@ -419,18 +418,20 @@ static ssize_t dfsdm_adc_audio_set_spiclk(struct iio_dev *indio_dev,
         return len;
 }
 
-static int stm32_dfsdm_start_conv(struct stm32_dfsdm_adc *adc, bool dma)
+static int stm32_dfsdm_start_conv(struct stm32_dfsdm_adc *adc,
+                                  const struct iio_chan_spec *chan,
+                                  bool dma)
 {
         struct regmap *regmap = adc->dfsdm->regmap;
         int ret;
         unsigned int dma_en = 0, cont_en = 0;
 
-        ret = stm32_dfsdm_start_channel(adc->dfsdm, adc->ch_id);
+        ret = stm32_dfsdm_start_channel(adc->dfsdm, chan->channel);
         if (ret < 0)
                 return ret;
 
         ret = stm32_dfsdm_filter_configure(adc->dfsdm, adc->fl_id,
-                                           adc->ch_id);
+                                           chan->channel);
         if (ret < 0)
                 goto stop_channels;
 
@@ -464,12 +465,13 @@ stop_channels:
 
         regmap_update_bits(regmap, DFSDM_CR1(adc->fl_id),
                            DFSDM_CR1_RCONT_MASK, 0);
-        stm32_dfsdm_stop_channel(adc->dfsdm, adc->fl_id);
+        stm32_dfsdm_stop_channel(adc->dfsdm, chan->channel);
 
         return ret;
 }
 
-static void stm32_dfsdm_stop_conv(struct stm32_dfsdm_adc *adc)
+static void stm32_dfsdm_stop_conv(struct stm32_dfsdm_adc *adc,
+                                  const struct iio_chan_spec *chan)
 {
         struct regmap *regmap = adc->dfsdm->regmap;
 
@@ -482,7 +484,7 @@ static void stm32_dfsdm_stop_conv(struct stm32_dfsdm_adc *adc)
         regmap_update_bits(regmap, DFSDM_CR1(adc->fl_id),
                            DFSDM_CR1_RCONT_MASK, 0);
 
-        stm32_dfsdm_stop_channel(adc->dfsdm, adc->ch_id);
+        stm32_dfsdm_stop_channel(adc->dfsdm, chan->channel);
 }
 
 static int stm32_dfsdm_set_watermark(struct iio_dev *indio_dev,
@@ -609,6 +611,7 @@ static int stm32_dfsdm_adc_dma_start(struct iio_dev *indio_dev)
 static int stm32_dfsdm_postenable(struct iio_dev *indio_dev)
 {
         struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
+        const struct iio_chan_spec *chan = &indio_dev->channels[0];
         int ret;
 
         /* Reset adc buffer index */
@@ -618,7 +621,7 @@ static int stm32_dfsdm_postenable(struct iio_dev *indio_dev)
         if (ret < 0)
                 return ret;
 
-        ret = stm32_dfsdm_start_conv(adc, true);
+        ret = stm32_dfsdm_start_conv(adc, chan, true);
         if (ret) {
                 dev_err(&indio_dev->dev, "Can't start conversion\n");
                 goto stop_dfsdm;
@@ -635,7 +638,7 @@ static int stm32_dfsdm_postenable(struct iio_dev *indio_dev)
         return 0;
 
 err_stop_conv:
-        stm32_dfsdm_stop_conv(adc);
+        stm32_dfsdm_stop_conv(adc, chan);
 stop_dfsdm:
         stm32_dfsdm_stop_dfsdm(adc->dfsdm);
 
@@ -645,11 +648,12 @@ stop_dfsdm:
 static int stm32_dfsdm_predisable(struct iio_dev *indio_dev)
 {
         struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
+        const struct iio_chan_spec *chan = &indio_dev->channels[0];
 
         if (adc->dma_chan)
                 dmaengine_terminate_all(adc->dma_chan);
 
-        stm32_dfsdm_stop_conv(adc);
+        stm32_dfsdm_stop_conv(adc, chan);
 
         stm32_dfsdm_stop_dfsdm(adc->dfsdm);
 
@@ -730,7 +734,7 @@ static int stm32_dfsdm_single_conv(struct iio_dev *indio_dev,
         if (ret < 0)
                 goto stop_dfsdm;
 
-        ret = stm32_dfsdm_start_conv(adc, false);
+        ret = stm32_dfsdm_start_conv(adc, chan, false);
         if (ret < 0) {
                 regmap_update_bits(adc->dfsdm->regmap, DFSDM_CR2(adc->fl_id),
                                    DFSDM_CR2_REOCIE_MASK, DFSDM_CR2_REOCIE(0));
@@ -751,7 +755,7 @@ static int stm32_dfsdm_single_conv(struct iio_dev *indio_dev,
         else
                 ret = IIO_VAL_INT;
 
-        stm32_dfsdm_stop_conv(adc);
+        stm32_dfsdm_stop_conv(adc, chan);
 
 stop_dfsdm:
         stm32_dfsdm_stop_dfsdm(adc->dfsdm);
@@ -765,7 +769,7 @@ static int stm32_dfsdm_write_raw(struct iio_dev *indio_dev,
 {
         struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
         struct stm32_dfsdm_filter *fl = &adc->dfsdm->fl_list[adc->fl_id];
-        struct stm32_dfsdm_channel *ch = &adc->dfsdm->ch_list[adc->ch_id];
+        struct stm32_dfsdm_channel *ch = &adc->dfsdm->ch_list[chan->channel];
         unsigned int spi_freq = adc->spi_freq;
         int ret = -EINVAL;
 
@@ -972,7 +976,6 @@ static int stm32_dfsdm_adc_chan_init_one(struct iio_dev *indio_dev,
         }
         ch->scan_type.realbits = 24;
         ch->scan_type.storagebits = 32;
-        adc->ch_id = ch->channel;
 
         return stm32_dfsdm_chan_configure(adc->dfsdm,
                                           &adc->dfsdm->ch_list[ch->channel]);
@@ -1001,7 +1004,7 @@ static int stm32_dfsdm_audio_init(struct iio_dev *indio_dev)
         }
         ch->info_mask_separate = BIT(IIO_CHAN_INFO_SAMP_FREQ);
 
-        d_ch = &adc->dfsdm->ch_list[adc->ch_id];
+        d_ch = &adc->dfsdm->ch_list[ch->channel];
         if (d_ch->src != DFSDM_CHANNEL_SPI_CLOCK_EXTERNAL)
                 adc->spi_freq = adc->dfsdm->spi_master_freq;
 
@@ -1042,8 +1045,8 @@ static int stm32_dfsdm_adc_init(struct iio_dev *indio_dev)
                 return -ENOMEM;
 
         for (chan_idx = 0; chan_idx < num_ch; chan_idx++) {
-                ch->scan_index = chan_idx;
-                ret = stm32_dfsdm_adc_chan_init_one(indio_dev, ch);
+                ch[chan_idx].scan_index = chan_idx;
+                ret = stm32_dfsdm_adc_chan_init_one(indio_dev, &ch[chan_idx]);
                 if (ret < 0) {
                         dev_err(&indio_dev->dev, "Channels init failed\n");
                         return ret;
diff --git a/drivers/iio/adc/stm32-dfsdm-core.c b/drivers/iio/adc/stm32-dfsdm-core.c
index 6290332cfd3f..e50efdcc41ff 100644
--- a/drivers/iio/adc/stm32-dfsdm-core.c
+++ b/drivers/iio/adc/stm32-dfsdm-core.c
@@ -83,7 +83,7 @@ int stm32_dfsdm_start_dfsdm(struct stm32_dfsdm *dfsdm)
 {
         struct dfsdm_priv *priv = container_of(dfsdm, struct dfsdm_priv, dfsdm);
         struct device *dev = &priv->pdev->dev;
-        unsigned int clk_div = priv->spi_clk_out_div;
+        unsigned int clk_div = priv->spi_clk_out_div, clk_src;
         int ret;
 
         if (atomic_inc_return(&priv->n_active_ch) == 1) {
@@ -100,6 +100,14 @@ int stm32_dfsdm_start_dfsdm(struct stm32_dfsdm *dfsdm)
                         }
                 }
 
+                /* select clock source, e.g. 0 for "dfsdm" or 1 for "audio" */
+                clk_src = priv->aclk ? 1 : 0;
+                ret = regmap_update_bits(dfsdm->regmap, DFSDM_CHCFGR1(0),
+                                         DFSDM_CHCFGR1_CKOUTSRC_MASK,
+                                         DFSDM_CHCFGR1_CKOUTSRC(clk_src));
+                if (ret < 0)
+                        goto disable_aclk;
+
                 /* Output the SPI CLKOUT (if clk_div == 0 clock if OFF) */
                 ret = regmap_update_bits(dfsdm->regmap, DFSDM_CHCFGR1(0),
                                          DFSDM_CHCFGR1_CKOUTDIV_MASK,
@@ -274,7 +282,7 @@ static int stm32_dfsdm_probe(struct platform_device *pdev)
 
         dfsdm->regmap = devm_regmap_init_mmio_clk(&pdev->dev, "dfsdm",
                                                   dfsdm->base,
-                                                  &stm32h7_dfsdm_regmap_cfg);
+                                                  dev_data->regmap_cfg);
         if (IS_ERR(dfsdm->regmap)) {
                 ret = PTR_ERR(dfsdm->regmap);
                 dev_err(&pdev->dev, "%s: Failed to allocate regmap: %d\n",
diff --git a/drivers/iio/chemical/ccs811.c b/drivers/iio/chemical/ccs811.c
index fbe2431f5b81..1ea9f5513b02 100644
--- a/drivers/iio/chemical/ccs811.c
+++ b/drivers/iio/chemical/ccs811.c
@@ -133,6 +133,9 @@ static int ccs811_start_sensor_application(struct i2c_client *client)
         if (ret < 0)
                 return ret;
 
+        if ((ret & CCS811_STATUS_FW_MODE_APPLICATION))
+                return 0;
+
         if ((ret & CCS811_STATUS_APP_VALID_MASK) !=
             CCS811_STATUS_APP_VALID_LOADED)
                 return -EIO;
diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c
index 349e5c713c03..4ddb6cf7d401 100644
--- a/drivers/iio/pressure/st_pressure_core.c
+++ b/drivers/iio/pressure/st_pressure_core.c
@@ -640,7 +640,7 @@ int st_press_common_probe(struct iio_dev *indio_dev)
                        press_data->sensor_settings->drdy_irq.int2.addr))
                 pdata = (struct st_sensors_platform_data *)&default_press_pdata;
 
-        err = st_sensors_init_sensor(indio_dev, press_data->dev->platform_data);
+        err = st_sensors_init_sensor(indio_dev, pdata);
         if (err < 0)
                 goto st_press_power_off;
 
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index 9183d148d644..cb1d2ab13c66 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -207,6 +207,22 @@ int rdma_addr_size(struct sockaddr *addr)
 }
 EXPORT_SYMBOL(rdma_addr_size);
 
+int rdma_addr_size_in6(struct sockaddr_in6 *addr)
+{
+        int ret = rdma_addr_size((struct sockaddr *) addr);
+
+        return ret <= sizeof(*addr) ? ret : 0;
+}
+EXPORT_SYMBOL(rdma_addr_size_in6);
+
+int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr)
+{
+        int ret = rdma_addr_size((struct sockaddr *) addr);
+
+        return ret <= sizeof(*addr) ? ret : 0;
+}
+EXPORT_SYMBOL(rdma_addr_size_kss);
+
 static struct rdma_addr_client self;
 
 void rdma_addr_register_client(struct rdma_addr_client *client)
@@ -586,6 +602,15 @@ static void process_one_req(struct work_struct *_work)
         list_del(&req->list);
         mutex_unlock(&lock);
 
+        /*
+         * Although the work will normally have been canceled by the
+         * workqueue, it can still be requeued as long as it is on the
+         * req_list, so it could have been requeued before we grabbed &lock.
+         * We need to cancel it after it is removed from req_list to really be
+         * sure it is safe to free.
+         */
+        cancel_delayed_work(&req->work);
+
         req->callback(req->status, (struct sockaddr *)&req->src_addr,
                 req->addr, req->context);
         put_client(req->client);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index bb065c9449be..b7459cf524e4 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -290,6 +290,7 @@ void ib_dealloc_device(struct ib_device *device)
 {
         WARN_ON(device->reg_state != IB_DEV_UNREGISTERED &&
                 device->reg_state != IB_DEV_UNINITIALIZED);
+        rdma_restrack_clean(&device->res);
         put_device(&device->dev);
 }
 EXPORT_SYMBOL(ib_dealloc_device);
@@ -600,8 +601,6 @@ void ib_unregister_device(struct ib_device *device)
         }
         up_read(&lists_rwsem);
 
-        rdma_restrack_clean(&device->res);
-
         ib_device_unregister_rdmacg(device);
         ib_device_unregister_sysfs(device);
 
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index e5a1e7d81326..d933336d7e01 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -632,6 +632,9 @@ static ssize_t ucma_bind_ip(struct ucma_file *file, const char __user *inbuf,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
+        if (!rdma_addr_size_in6(&cmd.addr))
+                return -EINVAL;
+
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
@@ -645,22 +648,21 @@ static ssize_t ucma_bind(struct ucma_file *file, const char __user *inbuf,
                          int in_len, int out_len)
 {
         struct rdma_ucm_bind cmd;
-        struct sockaddr *addr;
         struct ucma_context *ctx;
         int ret;
 
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        addr = (struct sockaddr *) &cmd.addr;
-        if (cmd.reserved || !cmd.addr_size || (cmd.addr_size != rdma_addr_size(addr)))
+        if (cmd.reserved || !cmd.addr_size ||
+            cmd.addr_size != rdma_addr_size_kss(&cmd.addr))
                 return -EINVAL;
 
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        ret = rdma_bind_addr(ctx->cm_id, addr);
+        ret = rdma_bind_addr(ctx->cm_id, (struct sockaddr *) &cmd.addr);
         ucma_put_ctx(ctx);
         return ret;
 }
@@ -670,23 +672,22 @@ static ssize_t ucma_resolve_ip(struct ucma_file *file,
                                int in_len, int out_len)
 {
         struct rdma_ucm_resolve_ip cmd;
-        struct sockaddr *src, *dst;
         struct ucma_context *ctx;
         int ret;
 
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        src = (struct sockaddr *) &cmd.src_addr;
-        dst = (struct sockaddr *) &cmd.dst_addr;
-        if (!rdma_addr_size(src) || !rdma_addr_size(dst))
+        if (!rdma_addr_size_in6(&cmd.src_addr) ||
+            !rdma_addr_size_in6(&cmd.dst_addr))
                 return -EINVAL;
 
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        ret = rdma_resolve_addr(ctx->cm_id, src, dst, cmd.timeout_ms);
+        ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr,
+                                (struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms);
         ucma_put_ctx(ctx);
         return ret;
 }
@@ -696,24 +697,23 @@ static ssize_t ucma_resolve_addr(struct ucma_file *file,
                                  int in_len, int out_len)
 {
         struct rdma_ucm_resolve_addr cmd;
-        struct sockaddr *src, *dst;
         struct ucma_context *ctx;
         int ret;
 
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        src = (struct sockaddr *) &cmd.src_addr;
-        dst = (struct sockaddr *) &cmd.dst_addr;
-        if (cmd.reserved || (cmd.src_size && (cmd.src_size != rdma_addr_size(src))) ||
-            !cmd.dst_size || (cmd.dst_size != rdma_addr_size(dst)))
+        if (cmd.reserved ||
+            (cmd.src_size && (cmd.src_size != rdma_addr_size_kss(&cmd.src_addr))) ||
+            !cmd.dst_size || (cmd.dst_size != rdma_addr_size_kss(&cmd.dst_addr)))
                 return -EINVAL;
 
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        ret = rdma_resolve_addr(ctx->cm_id, src, dst, cmd.timeout_ms);
+        ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr,
+                                (struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms);
         ucma_put_ctx(ctx);
         return ret;
 }
@@ -1166,6 +1166,11 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file,
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
+        if (!ctx->cm_id->device) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         resp.qp_attr_mask = 0;
         memset(&qp_attr, 0, sizeof qp_attr);
         qp_attr.qp_state = cmd.qp_state;
@@ -1307,7 +1312,7 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf,
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        if (unlikely(cmd.optval > KMALLOC_MAX_SIZE))
+        if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
                 return -EINVAL;
 
         optval = memdup_user((void __user *) (unsigned long) cmd.optval,
@@ -1331,7 +1336,7 @@ static ssize_t ucma_notify(struct ucma_file *file, const char __user *inbuf,
 {
         struct rdma_ucm_notify cmd;
         struct ucma_context *ctx;
-        int ret;
+        int ret = -EINVAL;
 
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
@@ -1340,7 +1345,9 @@ static ssize_t ucma_notify(struct ucma_file *file, const char __user *inbuf,
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        ret = rdma_notify(ctx->cm_id, (enum ib_event_type) cmd.event);
+        if (ctx->cm_id->device)
+                ret = rdma_notify(ctx->cm_id, (enum ib_event_type)cmd.event);
+
         ucma_put_ctx(ctx);
         return ret;
 }
@@ -1426,7 +1433,7 @@ static ssize_t ucma_join_ip_multicast(struct ucma_file *file,
         join_cmd.response = cmd.response;
         join_cmd.uid = cmd.uid;
         join_cmd.id = cmd.id;
-        join_cmd.addr_size = rdma_addr_size((struct sockaddr *) &cmd.addr);
+        join_cmd.addr_size = rdma_addr_size_in6(&cmd.addr);
         if (!join_cmd.addr_size)
                 return -EINVAL;
 
@@ -1445,7 +1452,7 @@ static ssize_t ucma_join_multicast(struct ucma_file *file,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        if (!rdma_addr_size((struct sockaddr *)&cmd.addr))
+        if (!rdma_addr_size_kss(&cmd.addr))
                 return -EINVAL;
 
         return ucma_process_join(file, &cmd, out_len);
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index db2ff352d75f..ec638778661c 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -4383,7 +4383,7 @@ err_dma_alloc_buf:
         eq->l0_dma = 0;
 
         if (mhop_num == 1)
-                for (i -= i; i >= 0; i--)
+                for (i -= 1; i >= 0; i--)
                         dma_free_coherent(dev, buf_chk_sz, eq->buf[i],
                                           eq->buf_dma[i]);
         else if (mhop_num == 2) {
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 390e4375647e..071fd9a7b919 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -3482,9 +3482,12 @@ static void destroy_umrc_res(struct mlx5_ib_dev *dev)
         if (err)
                 mlx5_ib_warn(dev, "mr cache cleanup failed\n");
 
-        mlx5_ib_destroy_qp(dev->umrc.qp);
-        ib_free_cq(dev->umrc.cq);
-        ib_dealloc_pd(dev->umrc.pd);
+        if (dev->umrc.qp)
+                mlx5_ib_destroy_qp(dev->umrc.qp);
+        if (dev->umrc.cq)
+                ib_free_cq(dev->umrc.cq);
+        if (dev->umrc.pd)
+                ib_dealloc_pd(dev->umrc.pd);
 }
 
 enum {
@@ -3586,12 +3589,15 @@ static int create_umr_res(struct mlx5_ib_dev *dev)
 
 error_4:
         mlx5_ib_destroy_qp(qp);
+        dev->umrc.qp = NULL;
 
 error_3:
         ib_free_cq(cq);
+        dev->umrc.cq = NULL;
 
 error_2:
         ib_dealloc_pd(pd);
+        dev->umrc.pd = NULL;
 
 error_0:
         kfree(attr);
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 95a36e9ea552..654bc31bc428 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -740,6 +740,9 @@ int mlx5_mr_cache_cleanup(struct mlx5_ib_dev *dev)
 {
         int i;
 
+        if (!dev->cache.wq)
+                return 0;
+
         dev->cache.stopped = 1;
         flush_workqueue(dev->cache.wq);
 
diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c
index eb32abb0099a..f9a645c869ce 100644
--- a/drivers/infiniband/hw/qedr/main.c
+++ b/drivers/infiniband/hw/qedr/main.c
@@ -833,7 +833,8 @@ static struct qedr_dev *qedr_add(struct qed_dev *cdev, struct pci_dev *pdev,
 
         dev->num_cnq = dev->ops->rdma_get_min_cnq_msix(cdev);
         if (!dev->num_cnq) {
-                DP_ERR(dev, "not enough CNQ resources.\n");
+                DP_ERR(dev, "Failed. At least one CNQ is required.\n");
+                rc = -ENOMEM;
                 goto init_err;
         }
 
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 7d51ef47667f..f9c3cc71f5c0 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -1841,14 +1841,15 @@ static void qedr_reset_qp_hwq_info(struct qedr_qp_hwq_info *qph)
 
 static int qedr_update_qp_state(struct qedr_dev *dev,
                                 struct qedr_qp *qp,
+                                enum qed_roce_qp_state cur_state,
                                 enum qed_roce_qp_state new_state)
 {
         int status = 0;
 
-        if (new_state == qp->state)
+        if (new_state == cur_state)
                 return 0;
 
-        switch (qp->state) {
+        switch (cur_state) {
         case QED_ROCE_QP_STATE_RESET:
                 switch (new_state) {
                 case QED_ROCE_QP_STATE_INIT:
@@ -1955,6 +1956,7 @@ int qedr_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
         struct qedr_dev *dev = get_qedr_dev(&qp->dev->ibdev);
         const struct ib_global_route *grh = rdma_ah_read_grh(&attr->ah_attr);
         enum ib_qp_state old_qp_state, new_qp_state;
+        enum qed_roce_qp_state cur_state;
         int rc = 0;
 
         DP_DEBUG(dev, QEDR_MSG_QP,
@@ -2086,18 +2088,23 @@ int qedr_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
                 SET_FIELD(qp_params.modify_flags,
                           QED_ROCE_MODIFY_QP_VALID_ACK_TIMEOUT, 1);
 
-                qp_params.ack_timeout = attr->timeout;
-                if (attr->timeout) {
-                        u32 temp;
-
-                        temp = 4096 * (1UL << attr->timeout) / 1000 / 1000;
-                        /* FW requires [msec] */
-                        qp_params.ack_timeout = temp;
-                } else {
-                        /* Infinite */
+                /* The received timeout value is an exponent used like this:
+                 *    "12.7.34 LOCAL ACK TIMEOUT
+                 *    Value representing the transport (ACK) timeout for use by
+                 *    the remote, expressed as: 4.096 * 2^timeout [usec]"
+                 * The FW expects timeout in msec so we need to divide the usec
+                 * result by 1000. We'll approximate 1000~2^10, and 4.096 ~ 2^2,
+                 * so we get: 2^2 * 2^timeout / 2^10 = 2^(timeout - 8).
+                 * The value of zero means infinite so we use a 'max_t' to make
+                 * sure that sub 1 msec values will be configured as 1 msec.
+                 */
+                if (attr->timeout)
+                        qp_params.ack_timeout =
+                                        1 << max_t(int, attr->timeout - 8, 0);
+                else
                         qp_params.ack_timeout = 0;
-                }
         }
+
         if (attr_mask & IB_QP_RETRY_CNT) {
                 SET_FIELD(qp_params.modify_flags,
                           QED_ROCE_MODIFY_QP_VALID_RETRY_CNT, 1);
@@ -2170,13 +2177,25 @@ int qedr_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
                 qp->dest_qp_num = attr->dest_qp_num;
         }
 
+        cur_state = qp->state;
+
+        /* Update the QP state before the actual ramrod to prevent a race with
+         * fast path. Modifying the QP state to error will cause the device to
+         * flush the CQEs and while polling the flushed CQEs will considered as
+         * a potential issue if the QP isn't in error state.
+         */
+        if ((attr_mask & IB_QP_STATE) && qp->qp_type != IB_QPT_GSI &&
+            !udata && qp_params.new_state == QED_ROCE_QP_STATE_ERR)
+                qp->state = QED_ROCE_QP_STATE_ERR;
+
         if (qp->qp_type != IB_QPT_GSI)
                 rc = dev->ops->rdma_modify_qp(dev->rdma_ctx,
                                               qp->qed_qp, &qp_params);
 
         if (attr_mask & IB_QP_STATE) {
                 if ((qp->qp_type != IB_QPT_GSI) && (!udata))
-                        rc = qedr_update_qp_state(dev, qp, qp_params.new_state);
+                        rc = qedr_update_qp_state(dev, qp, cur_state,
+                                                  qp_params.new_state);
                 qp->state = qp_params.new_state;
         }
 
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index a05a560d3cba..a6b7baf31cdd 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -887,7 +887,7 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
 
         q = bdev_get_queue(p->path.dev->bdev);
         attached_handler_name = scsi_dh_attached_handler_name(q, GFP_KERNEL);
-        if (attached_handler_name) {
+        if (attached_handler_name || m->hw_handler_name) {
                 INIT_DELAYED_WORK(&p->activate_path, activate_path_work);
                 r = setup_scsi_dh(p->path.dev->bdev, m, attached_handler_name, &ti->error);
                 if (r) {
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 45328d8b2859..353ea0ede091 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -466,7 +466,7 @@ static int dm_get_bdev_for_ioctl(struct mapped_device *md,
 {
         struct dm_target *tgt;
         struct dm_table *map;
-        int srcu_idx, r;
+        int srcu_idx, r, r2;
 
 retry:
         r = -ENOTTY;
@@ -492,9 +492,11 @@ retry:
                 goto out;
 
         bdgrab(*bdev);
-        r = blkdev_get(*bdev, *mode, _dm_claim_ptr);
-        if (r < 0)
+        r2 = blkdev_get(*bdev, *mode, _dm_claim_ptr);
+        if (r2 < 0) {
+                r = r2;
                 goto out;
+        }
 
         dm_put_live_table(md, srcu_idx);
         return r;
diff --git a/drivers/media/Kconfig b/drivers/media/Kconfig
index 372c074bb1b9..86c1a190d946 100644
--- a/drivers/media/Kconfig
+++ b/drivers/media/Kconfig
@@ -151,7 +151,7 @@ config DVB_MMAP
         select VIDEOBUF2_VMALLOC
         default n
         help
-          This option enables DVB experimental memory-mapped API, with
+          This option enables DVB experimental memory-mapped API, which
           reduces the number of context switches to read DVB buffers, as
           the buffers can use mmap() syscalls.
 
diff --git a/drivers/media/platform/tegra-cec/tegra_cec.c b/drivers/media/platform/tegra-cec/tegra_cec.c
index 92f93a880015..aba488cd0e64 100644
--- a/drivers/media/platform/tegra-cec/tegra_cec.c
+++ b/drivers/media/platform/tegra-cec/tegra_cec.c
@@ -172,16 +172,13 @@ static irqreturn_t tegra_cec_irq_handler(int irq, void *data)
                 }
         }
 
-        if (status & (TEGRA_CEC_INT_STAT_RX_REGISTER_OVERRUN |
-                      TEGRA_CEC_INT_STAT_RX_BUS_ANOMALY_DETECTED |
-                      TEGRA_CEC_INT_STAT_RX_START_BIT_DETECTED |
-                      TEGRA_CEC_INT_STAT_RX_BUS_ERROR_DETECTED)) {
+        if (status & TEGRA_CEC_INT_STAT_RX_START_BIT_DETECTED) {
                 cec_write(cec, TEGRA_CEC_INT_STAT,
-                          (TEGRA_CEC_INT_STAT_RX_REGISTER_OVERRUN |
-                           TEGRA_CEC_INT_STAT_RX_BUS_ANOMALY_DETECTED |
-                           TEGRA_CEC_INT_STAT_RX_START_BIT_DETECTED |
-                           TEGRA_CEC_INT_STAT_RX_BUS_ERROR_DETECTED));
-        } else if (status & TEGRA_CEC_INT_STAT_RX_REGISTER_FULL) {
+                          TEGRA_CEC_INT_STAT_RX_START_BIT_DETECTED);
+                cec->rx_done = false;
+                cec->rx_buf_cnt = 0;
+        }
+        if (status & TEGRA_CEC_INT_STAT_RX_REGISTER_FULL) {
                 u32 v;
 
                 cec_write(cec, TEGRA_CEC_INT_STAT,
@@ -255,7 +252,7 @@ static int tegra_cec_adap_enable(struct cec_adapter *adap, bool enable)
                   TEGRA_CEC_INT_MASK_TX_BUS_ANOMALY_DETECTED |
                   TEGRA_CEC_INT_MASK_TX_FRAME_TRANSMITTED |
                   TEGRA_CEC_INT_MASK_RX_REGISTER_FULL |
-                  TEGRA_CEC_INT_MASK_RX_REGISTER_OVERRUN);
+                  TEGRA_CEC_INT_MASK_RX_START_BIT_DETECTED);
 
         cec_write(cec, TEGRA_CEC_HW_CONTROL, TEGRA_CEC_HWCTRL_TX_RX_MODE);
         return 0;
diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c
index 7c0b27d132b1..b479bd81120b 100644
--- a/drivers/mtd/chips/jedec_probe.c
+++ b/drivers/mtd/chips/jedec_probe.c
@@ -1889,6 +1889,8 @@ static inline u32 jedec_read_mfr(struct map_info *map, uint32_t base,
         do {
                 uint32_t ofs = cfi_build_cmd_addr(0 + (bank << 8), map, cfi);
                 mask = (1 << (cfi->device_type * 8)) - 1;
+                if (ofs >= map->size)
+                        return 0;
                 result = map_read(map, base + ofs);
                 bank++;
         } while ((result.x[0] & mask) == CFI_MFR_CONTINUATION);
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index de8c902059b8..7d80a8bb96fe 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -479,7 +479,7 @@ static int shrink_ecclayout(struct mtd_info *mtd,
         for (i = 0; i < MTD_MAX_ECCPOS_ENTRIES;) {
                 u32 eccpos;
 
-                ret = mtd_ooblayout_ecc(mtd, section, &oobregion);
+                ret = mtd_ooblayout_ecc(mtd, section++, &oobregion);
                 if (ret < 0) {
                         if (ret != -ERANGE)
                                 return ret;
@@ -526,7 +526,7 @@ static int get_oobinfo(struct mtd_info *mtd, struct nand_oobinfo *to)
         for (i = 0; i < ARRAY_SIZE(to->eccpos);) {
                 u32 eccpos;
 
-                ret = mtd_ooblayout_ecc(mtd, section, &oobregion);
+                ret = mtd_ooblayout_ecc(mtd, section++, &oobregion);
                 if (ret < 0) {
                         if (ret != -ERANGE)
                                 return ret;
diff --git a/drivers/mtd/nand/atmel/pmecc.c b/drivers/mtd/nand/atmel/pmecc.c
index fcbe4fd6e684..ca0a70389ba9 100644
--- a/drivers/mtd/nand/atmel/pmecc.c
+++ b/drivers/mtd/nand/atmel/pmecc.c
@@ -426,7 +426,7 @@ static int get_strength(struct atmel_pmecc_user *user)
 
 static int get_sectorsize(struct atmel_pmecc_user *user)
 {
-        return user->cache.cfg & PMECC_LOOKUP_TABLE_SIZE_1024 ? 1024 : 512;
+        return user->cache.cfg & PMECC_CFG_SECTOR1024 ? 1024 : 512;
 }
 
 static void atmel_pmecc_gen_syndrome(struct atmel_pmecc_user *user, int sector)
diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c
index 4872a7ba6503..5a9c2f0020c2 100644
--- a/drivers/mtd/nand/fsl_ifc_nand.c
+++ b/drivers/mtd/nand/fsl_ifc_nand.c
@@ -173,14 +173,9 @@ static void set_addr(struct mtd_info *mtd, int column, int page_addr, int oob)
 
 /* returns nonzero if entire page is blank */
 static int check_read_ecc(struct mtd_info *mtd, struct fsl_ifc_ctrl *ctrl,
-                          u32 *eccstat, unsigned int bufnum)
+                          u32 eccstat, unsigned int bufnum)
 {
-        u32 reg = eccstat[bufnum / 4];
-        int errors;
-
-        errors = (reg >> ((3 - bufnum % 4) * 8)) & 15;
-
-        return errors;
+        return  (eccstat >> ((3 - bufnum % 4) * 8)) & 15;
 }
 
 /*
@@ -193,7 +188,7 @@ static void fsl_ifc_run_command(struct mtd_info *mtd)
         struct fsl_ifc_ctrl *ctrl = priv->ctrl;
         struct fsl_ifc_nand_ctrl *nctrl = ifc_nand_ctrl;
         struct fsl_ifc_runtime __iomem *ifc = ctrl->rregs;
-        u32 eccstat[4];
+        u32 eccstat;
         int i;
 
         /* set the chip select for NAND Transaction */
@@ -228,19 +223,17 @@ static void fsl_ifc_run_command(struct mtd_info *mtd)
         if (nctrl->eccread) {
                 int errors;
                 int bufnum = nctrl->page & priv->bufnum_mask;
-                int sector = bufnum * chip->ecc.steps;
-                int sector_end = sector + chip->ecc.steps - 1;
+                int sector_start = bufnum * chip->ecc.steps;
+                int sector_end = sector_start + chip->ecc.steps - 1;
                 __be32 *eccstat_regs;
 
-                if (ctrl->version >= FSL_IFC_VERSION_2_0_0)
-                        eccstat_regs = ifc->ifc_nand.v2_nand_eccstat;
-                else
-                        eccstat_regs = ifc->ifc_nand.v1_nand_eccstat;
+                eccstat_regs = ifc->ifc_nand.nand_eccstat;
+                eccstat = ifc_in32(&eccstat_regs[sector_start / 4]);
 
-                for (i = sector / 4; i <= sector_end / 4; i++)
-                        eccstat[i] = ifc_in32(&eccstat_regs[i]);
+                for (i = sector_start; i <= sector_end; i++) {
+                        if (i != sector_start && !(i % 4))
+                                eccstat = ifc_in32(&eccstat_regs[i / 4]);
 
-                for (i = sector; i <= sector_end; i++) {
                         errors = check_read_ecc(mtd, ctrl, eccstat, i);
 
                         if (errors == 15) {
@@ -626,6 +619,7 @@ static int fsl_ifc_wait(struct mtd_info *mtd, struct nand_chip *chip)
         struct fsl_ifc_ctrl *ctrl = priv->ctrl;
         struct fsl_ifc_runtime __iomem *ifc = ctrl->rregs;
         u32 nand_fsr;
+        int status;
 
         /* Use READ_STATUS command, but wait for the device to be ready */
         ifc_out32((IFC_FIR_OP_CW0 << IFC_NAND_FIR0_OP0_SHIFT) |
@@ -640,12 +634,12 @@ static int fsl_ifc_wait(struct mtd_info *mtd, struct nand_chip *chip)
         fsl_ifc_run_command(mtd);
 
         nand_fsr = ifc_in32(&ifc->ifc_nand.nand_fsr);
-
+        status = nand_fsr >> 24;
         /*
          * The chip always seems to report that it is
          * write-protected, even when it is not.
          */
-        return nand_fsr | NAND_STATUS_WP;
+        return status | NAND_STATUS_WP;
 }
 
 /*
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index c669554d70bb..b7b113018853 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1528,39 +1528,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
                         goto err_close;
         }
 
-        /* If the mode uses primary, then the following is handled by
-         * bond_change_active_slave().
-         */
-        if (!bond_uses_primary(bond)) {
-                /* set promiscuity level to new slave */
-                if (bond_dev->flags & IFF_PROMISC) {
-                        res = dev_set_promiscuity(slave_dev, 1);
-                        if (res)
-                                goto err_close;
-                }
-
-                /* set allmulti level to new slave */
-                if (bond_dev->flags & IFF_ALLMULTI) {
-                        res = dev_set_allmulti(slave_dev, 1);
-                        if (res)
-                                goto err_close;
-                }
-
-                netif_addr_lock_bh(bond_dev);
-
-                dev_mc_sync_multiple(slave_dev, bond_dev);
-                dev_uc_sync_multiple(slave_dev, bond_dev);
-
-                netif_addr_unlock_bh(bond_dev);
-        }
-
-        if (BOND_MODE(bond) == BOND_MODE_8023AD) {
-                /* add lacpdu mc addr to mc list */
-                u8 lacpdu_multicast[ETH_ALEN] = MULTICAST_LACPDU_ADDR;
-
-                dev_mc_add(slave_dev, lacpdu_multicast);
-        }
-
         res = vlan_vids_add_by_dev(slave_dev, bond_dev);
         if (res) {
                 netdev_err(bond_dev, "Couldn't add bond vlan ids to %s\n",
@@ -1725,6 +1692,40 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
                 goto err_upper_unlink;
         }
 
+        /* If the mode uses primary, then the following is handled by
+         * bond_change_active_slave().
+         */
+        if (!bond_uses_primary(bond)) {
+                /* set promiscuity level to new slave */
+                if (bond_dev->flags & IFF_PROMISC) {
+                        res = dev_set_promiscuity(slave_dev, 1);
+                        if (res)
+                                goto err_sysfs_del;
+                }
+
+                /* set allmulti level to new slave */
+                if (bond_dev->flags & IFF_ALLMULTI) {
+                        res = dev_set_allmulti(slave_dev, 1);
+                        if (res) {
+                                if (bond_dev->flags & IFF_PROMISC)
+                                        dev_set_promiscuity(slave_dev, -1);
+                                goto err_sysfs_del;
+                        }
+                }
+
+                netif_addr_lock_bh(bond_dev);
+                dev_mc_sync_multiple(slave_dev, bond_dev);
+                dev_uc_sync_multiple(slave_dev, bond_dev);
+                netif_addr_unlock_bh(bond_dev);
+
+                if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+                        /* add lacpdu mc addr to mc list */
+                        u8 lacpdu_multicast[ETH_ALEN] = MULTICAST_LACPDU_ADDR;
+
+                        dev_mc_add(slave_dev, lacpdu_multicast);
+                }
+        }
+
         bond->slave_cnt++;
         bond_compute_features(bond);
         bond_set_carrier(bond);
@@ -1748,6 +1749,9 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
         return 0;
 
 /* Undo stages on error */
+err_sysfs_del:
+        bond_sysfs_slave_del(new_slave);
+
 err_upper_unlink:
         bond_upper_dev_unlink(bond, new_slave);
 
@@ -1755,9 +1759,6 @@ err_unregister:
         netdev_rx_handler_unregister(slave_dev);
 
 err_detach:
-        if (!bond_uses_primary(bond))
-                bond_hw_addr_flush(bond_dev, slave_dev);
-
         vlan_vids_del_by_dev(slave_dev, bond_dev);
         if (rcu_access_pointer(bond->primary_slave) == new_slave)
                 RCU_INIT_POINTER(bond->primary_slave, NULL);
diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
index 511ca134f13f..d244c41898dd 100644
--- a/drivers/net/dsa/mt7530.c
+++ b/drivers/net/dsa/mt7530.c
@@ -1409,6 +1409,7 @@ static const struct of_device_id mt7530_of_match[] = {
         { .compatible = "mediatek,mt7530" },
         { /* sentinel */ },
 };
+MODULE_DEVICE_TABLE(of, mt7530_of_match);
 
 static struct mdio_driver mt7530_mdio_driver = {
         .probe  = mt7530_probe,
@@ -1424,4 +1425,3 @@ mdio_module_driver(mt7530_mdio_driver);
 MODULE_AUTHOR("Sean Wang <sean.wang@mediatek.com>");
 MODULE_DESCRIPTION("Driver for Mediatek MT7530 Switch");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:mediatek-mt7530");
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index a58acdb5eba3..b26bcdf4cd03 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -1132,6 +1132,7 @@ static void mvneta_port_up(struct mvneta_port *pp)
         }
         mvreg_write(pp, MVNETA_TXQ_CMD, q_map);
 
+        q_map = 0;
         /* Enable all initialized RXQs. */
         for (queue = 0; queue < rxq_number; queue++) {
                 struct mvneta_rx_queue *rxq = &pp->rxqs[queue];
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
index 1a0c3bf86ead..752a72499b4f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
@@ -156,57 +156,63 @@ static int mlx4_en_dcbnl_getnumtcs(struct net_device *netdev, int tcid, u8 *num)
 static u8 mlx4_en_dcbnl_set_all(struct net_device *netdev)
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
+        struct mlx4_en_port_profile *prof = priv->prof;
         struct mlx4_en_dev *mdev = priv->mdev;
+        u8 tx_pause, tx_ppp, rx_pause, rx_ppp;
 
         if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
                 return 1;
 
         if (priv->cee_config.pfc_state) {
                 int tc;
+                rx_ppp = prof->rx_ppp;
+                tx_ppp = prof->tx_ppp;
 
-                priv->prof->rx_pause = 0;
-                priv->prof->tx_pause = 0;
                 for (tc = 0; tc < CEE_DCBX_MAX_PRIO; tc++) {
                         u8 tc_mask = 1 << tc;
 
                         switch (priv->cee_config.dcb_pfc[tc]) {
                         case pfc_disabled:
-                                priv->prof->tx_ppp &= ~tc_mask;
-                                priv->prof->rx_ppp &= ~tc_mask;
+                                tx_ppp &= ~tc_mask;
+                                rx_ppp &= ~tc_mask;
                                 break;
                         case pfc_enabled_full:
-                                priv->prof->tx_ppp |= tc_mask;
-                                priv->prof->rx_ppp |= tc_mask;
+                                tx_ppp |= tc_mask;
+                                rx_ppp |= tc_mask;
                                 break;
                         case pfc_enabled_tx:
-                                priv->prof->tx_ppp |= tc_mask;
-                                priv->prof->rx_ppp &= ~tc_mask;
+                                tx_ppp |= tc_mask;
+                                rx_ppp &= ~tc_mask;
                                 break;
                         case pfc_enabled_rx:
-                                priv->prof->tx_ppp &= ~tc_mask;
-                                priv->prof->rx_ppp |= tc_mask;
+                                tx_ppp &= ~tc_mask;
+                                rx_ppp |= tc_mask;
                                 break;
                         default:
                                 break;
                         }
                 }
-                en_dbg(DRV, priv, "Set pfc on\n");
+                rx_pause = !!(rx_ppp || tx_ppp) ? 0 : prof->rx_pause;
+                tx_pause = !!(rx_ppp || tx_ppp) ? 0 : prof->tx_pause;
         } else {
-                priv->prof->rx_pause = 1;
-                priv->prof->tx_pause = 1;
-                en_dbg(DRV, priv, "Set pfc off\n");
+                rx_ppp = 0;
+                tx_ppp = 0;
+                rx_pause = prof->rx_pause;
+                tx_pause = prof->tx_pause;
         }
 
         if (mlx4_SET_PORT_general(mdev->dev, priv->port,
                                   priv->rx_skb_size + ETH_FCS_LEN,
-                                  priv->prof->tx_pause,
-                                  priv->prof->tx_ppp,
-                                  priv->prof->rx_pause,
-                                  priv->prof->rx_ppp)) {
+                                  tx_pause, tx_ppp, rx_pause, rx_ppp)) {
                 en_err(priv, "Failed setting pause params\n");
                 return 1;
         }
 
+        prof->tx_ppp = tx_ppp;
+        prof->rx_ppp = rx_ppp;
+        prof->tx_pause = tx_pause;
+        prof->rx_pause = rx_pause;
+
         return 0;
 }
 
@@ -408,6 +414,7 @@ static int mlx4_en_dcbnl_ieee_setpfc(struct net_device *dev,
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct mlx4_en_port_profile *prof = priv->prof;
         struct mlx4_en_dev *mdev = priv->mdev;
+        u32 tx_pause, tx_ppp, rx_pause, rx_ppp;
         int err;
 
         en_dbg(DRV, priv, "cap: 0x%x en: 0x%x mbc: 0x%x delay: %d\n",
@@ -416,23 +423,26 @@ static int mlx4_en_dcbnl_ieee_setpfc(struct net_device *dev,
                         pfc->mbc,
                         pfc->delay);
 
-        prof->rx_pause = !pfc->pfc_en;
-        prof->tx_pause = !pfc->pfc_en;
-        prof->rx_ppp = pfc->pfc_en;
-        prof->tx_ppp = pfc->pfc_en;
+        rx_pause = prof->rx_pause && !pfc->pfc_en;
+        tx_pause = prof->tx_pause && !pfc->pfc_en;
+        rx_ppp = pfc->pfc_en;
+        tx_ppp = pfc->pfc_en;
 
         err = mlx4_SET_PORT_general(mdev->dev, priv->port,
                                     priv->rx_skb_size + ETH_FCS_LEN,
-                                    prof->tx_pause,
-                                    prof->tx_ppp,
-                                    prof->rx_pause,
-                                    prof->rx_ppp);
-        if (err)
+                                    tx_pause, tx_ppp, rx_pause, rx_ppp);
+        if (err) {
                 en_err(priv, "Failed setting pause params\n");
-        else
-                mlx4_en_update_pfc_stats_bitmap(mdev->dev, &priv->stats_bitmap,
-                                                prof->rx_ppp, prof->rx_pause,
-                                                prof->tx_ppp, prof->tx_pause);
+                return err;
+        }
+
+        mlx4_en_update_pfc_stats_bitmap(mdev->dev, &priv->stats_bitmap,
+                                        rx_ppp, rx_pause, tx_ppp, tx_pause);
+
+        prof->tx_ppp = tx_ppp;
+        prof->rx_ppp = rx_ppp;
+        prof->rx_pause = rx_pause;
+        prof->tx_pause = tx_pause;
 
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index 9a7a2f05ab35..a30a2e95d13f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -1060,27 +1060,32 @@ static int mlx4_en_set_pauseparam(struct net_device *dev,
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct mlx4_en_dev *mdev = priv->mdev;
+        u8 tx_pause, tx_ppp, rx_pause, rx_ppp;
         int err;
 
         if (pause->autoneg)
                 return -EINVAL;
 
-        priv->prof->tx_pause = pause->tx_pause != 0;
-        priv->prof->rx_pause = pause->rx_pause != 0;
+        tx_pause = !!(pause->tx_pause);
+        rx_pause = !!(pause->rx_pause);
+        rx_ppp = priv->prof->rx_ppp && !(tx_pause || rx_pause);
+        tx_ppp = priv->prof->tx_ppp && !(tx_pause || rx_pause);
+
         err = mlx4_SET_PORT_general(mdev->dev, priv->port,
                                     priv->rx_skb_size + ETH_FCS_LEN,
-                                    priv->prof->tx_pause,
-                                    priv->prof->tx_ppp,
-                                    priv->prof->rx_pause,
-                                    priv->prof->rx_ppp);
-        if (err)
-                en_err(priv, "Failed setting pause params\n");
-        else
-                mlx4_en_update_pfc_stats_bitmap(mdev->dev, &priv->stats_bitmap,
-                                                priv->prof->rx_ppp,
-                                                priv->prof->rx_pause,
-                                                priv->prof->tx_ppp,
-                                                priv->prof->tx_pause);
+                                    tx_pause, tx_ppp, rx_pause, rx_ppp);
+        if (err) {
+                en_err(priv, "Failed setting pause params, err = %d\n", err);
+                return err;
+        }
+
+        mlx4_en_update_pfc_stats_bitmap(mdev->dev, &priv->stats_bitmap,
+                                        rx_ppp, rx_pause, tx_ppp, tx_pause);
+
+        priv->prof->tx_pause = tx_pause;
+        priv->prof->rx_pause = rx_pause;
+        priv->prof->tx_ppp = tx_ppp;
+        priv->prof->rx_ppp = rx_ppp;
 
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_main.c b/drivers/net/ethernet/mellanox/mlx4/en_main.c
index 2c2965497ed3..d25e16d2c319 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_main.c
@@ -163,9 +163,9 @@ static void mlx4_en_get_profile(struct mlx4_en_dev *mdev)
                 params->udp_rss = 0;
         }
         for (i = 1; i <= MLX4_MAX_PORTS; i++) {
-                params->prof[i].rx_pause = 1;
+                params->prof[i].rx_pause = !(pfcrx || pfctx);
                 params->prof[i].rx_ppp = pfcrx;
-                params->prof[i].tx_pause = 1;
+                params->prof[i].tx_pause = !(pfcrx || pfctx);
                 params->prof[i].tx_ppp = pfctx;
                 params->prof[i].tx_ring_size = MLX4_EN_DEF_TX_RING_SIZE;
                 params->prof[i].rx_ring_size = MLX4_EN_DEF_RX_RING_SIZE;
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 606a0e0beeae..29e50f787349 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -5088,6 +5088,7 @@ static void rem_slave_fs_rule(struct mlx4_dev *dev, int slave)
                                                  &tracker->res_tree[RES_FS_RULE]);
                                         list_del(&fs_rule->com.list);
                                         spin_unlock_irq(mlx4_tlock(dev));
+                                        kfree(fs_rule->mirr_mbox);
                                         kfree(fs_rule);
                                         state = 0;
                                         break;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
index 25deaa5a534c..c032319f1cb9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
+++ b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
@@ -46,7 +46,7 @@ config MLX5_MPFS
 
 config MLX5_ESWITCH
         bool "Mellanox Technologies MLX5 SRIOV E-Switch support"
-        depends on MLX5_CORE_EN
+        depends on MLX5_CORE_EN && NET_SWITCHDEV
         default y
         ---help---
           Mellanox Technologies Ethernet SRIOV E-Switch support in ConnectX NIC.
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index a87d46bc2299..37fd0245b6c1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -409,6 +409,9 @@ static int mlx5e_get_coalesce(struct net_device *netdev,
         return mlx5e_ethtool_get_coalesce(priv, coal);
 }
 
+#define MLX5E_MAX_COAL_TIME             MLX5_MAX_CQ_PERIOD
+#define MLX5E_MAX_COAL_FRAMES           MLX5_MAX_CQ_COUNT
+
 static void
 mlx5e_set_priv_channels_coalesce(struct mlx5e_priv *priv, struct ethtool_coalesce *coal)
 {
@@ -443,6 +446,20 @@ int mlx5e_ethtool_set_coalesce(struct mlx5e_priv *priv,
         if (!MLX5_CAP_GEN(mdev, cq_moderation))
                 return -EOPNOTSUPP;
 
+        if (coal->tx_coalesce_usecs > MLX5E_MAX_COAL_TIME ||
+            coal->rx_coalesce_usecs > MLX5E_MAX_COAL_TIME) {
+                netdev_info(priv->netdev, "%s: maximum coalesce time supported is %lu usecs\n",
+                            __func__, MLX5E_MAX_COAL_TIME);
+                return -ERANGE;
+        }
+
+        if (coal->tx_max_coalesced_frames > MLX5E_MAX_COAL_FRAMES ||
+            coal->rx_max_coalesced_frames > MLX5E_MAX_COAL_FRAMES) {
+                netdev_info(priv->netdev, "%s: maximum coalesced frames supported is %lu\n",
+                            __func__, MLX5E_MAX_COAL_FRAMES);
+                return -ERANGE;
+        }
+
         mutex_lock(&priv->state_lock);
         new_channels.params = priv->channels.params;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 0339609cfa56..c71f4f10283b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -2702,6 +2702,9 @@ int mlx5e_open(struct net_device *netdev)
                 mlx5_set_port_admin_status(priv->mdev, MLX5_PORT_UP);
         mutex_unlock(&priv->state_lock);
 
+        if (mlx5e_vxlan_allowed(priv->mdev))
+                udp_tunnel_get_rx_info(netdev);
+
         return err;
 }
 
@@ -4225,7 +4228,7 @@ static void mlx5e_set_netdev_dev_addr(struct net_device *netdev)
         }
 }
 
-#if IS_ENABLED(CONFIG_NET_SWITCHDEV) && IS_ENABLED(CONFIG_MLX5_ESWITCH)
+#if IS_ENABLED(CONFIG_MLX5_ESWITCH)
 static const struct switchdev_ops mlx5e_switchdev_ops = {
         .switchdev_port_attr_get        = mlx5e_attr_get,
 };
@@ -4334,7 +4337,7 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
 
         mlx5e_set_netdev_dev_addr(netdev);
 
-#if IS_ENABLED(CONFIG_NET_SWITCHDEV) && IS_ENABLED(CONFIG_MLX5_ESWITCH)
+#if IS_ENABLED(CONFIG_MLX5_ESWITCH)
         if (MLX5_VPORT_MANAGER(mdev))
                 netdev->switchdev_ops = &mlx5e_switchdev_ops;
 #endif
@@ -4493,12 +4496,6 @@ static void mlx5e_nic_enable(struct mlx5e_priv *priv)
 #ifdef CONFIG_MLX5_CORE_EN_DCB
         mlx5e_dcbnl_init_app(priv);
 #endif
-        /* Device already registered: sync netdev system state */
-        if (mlx5e_vxlan_allowed(mdev)) {
-                rtnl_lock();
-                udp_tunnel_get_rx_info(netdev);
-                rtnl_unlock();
-        }
 
         queue_work(priv->wq, &priv->set_rx_mode_work);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 8e70fa9ef39a..d8f68e4d1018 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -44,6 +44,11 @@
 #include "en_tc.h"
 #include "fs_core.h"
 
+#define MLX5E_REP_PARAMS_LOG_SQ_SIZE \
+        max(0x6, MLX5E_PARAMS_MINIMUM_LOG_SQ_SIZE)
+#define MLX5E_REP_PARAMS_LOG_RQ_SIZE \
+        max(0x6, MLX5E_PARAMS_MINIMUM_LOG_RQ_SIZE)
+
 static const char mlx5e_rep_driver_name[] = "mlx5e_rep";
 
 static void mlx5e_rep_get_drvinfo(struct net_device *dev,
@@ -209,7 +214,7 @@ static void mlx5e_sqs2vport_stop(struct mlx5_eswitch *esw,
 
 static int mlx5e_sqs2vport_start(struct mlx5_eswitch *esw,
                                  struct mlx5_eswitch_rep *rep,
-                                 u16 *sqns_array, int sqns_num)
+                                 u32 *sqns_array, int sqns_num)
 {
         struct mlx5_flow_handle *flow_rule;
         struct mlx5e_rep_priv *rpriv;
@@ -255,9 +260,9 @@ int mlx5e_add_sqs_fwd_rules(struct mlx5e_priv *priv)
         struct mlx5e_channel *c;
         int n, tc, num_sqs = 0;
         int err = -ENOMEM;
-        u16 *sqs;
+        u32 *sqs;
 
-        sqs = kcalloc(priv->channels.num * priv->channels.params.num_tc, sizeof(u16), GFP_KERNEL);
+        sqs = kcalloc(priv->channels.num * priv->channels.params.num_tc, sizeof(*sqs), GFP_KERNEL);
         if (!sqs)
                 goto out;
 
@@ -288,7 +293,7 @@ void mlx5e_remove_sqs_fwd_rules(struct mlx5e_priv *priv)
 static void mlx5e_rep_neigh_update_init_interval(struct mlx5e_rep_priv *rpriv)
 {
 #if IS_ENABLED(CONFIG_IPV6)
-        unsigned long ipv6_interval = NEIGH_VAR(&ipv6_stub->nd_tbl->parms,
+        unsigned long ipv6_interval = NEIGH_VAR(&nd_tbl.parms,
                                                 DELAY_PROBE_TIME);
 #else
         unsigned long ipv6_interval = ~0UL;
@@ -424,7 +429,7 @@ static int mlx5e_rep_netevent_event(struct notifier_block *nb,
         case NETEVENT_NEIGH_UPDATE:
                 n = ptr;
 #if IS_ENABLED(CONFIG_IPV6)
-                if (n->tbl != ipv6_stub->nd_tbl && n->tbl != &arp_tbl)
+                if (n->tbl != &nd_tbl && n->tbl != &arp_tbl)
 #else
                 if (n->tbl != &arp_tbl)
 #endif
@@ -472,7 +477,7 @@ static int mlx5e_rep_netevent_event(struct notifier_block *nb,
                  * done per device delay prob time parameter.
                  */
 #if IS_ENABLED(CONFIG_IPV6)
-                if (!p->dev || (p->tbl != ipv6_stub->nd_tbl && p->tbl != &arp_tbl))
+                if (!p->dev || (p->tbl != &nd_tbl && p->tbl != &arp_tbl))
 #else
                 if (!p->dev || p->tbl != &arp_tbl)
 #endif
@@ -668,7 +673,6 @@ static int mlx5e_rep_open(struct net_device *dev)
         struct mlx5e_priv *priv = netdev_priv(dev);
         struct mlx5e_rep_priv *rpriv = priv->ppriv;
         struct mlx5_eswitch_rep *rep = rpriv->rep;
-        struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
         int err;
 
         mutex_lock(&priv->state_lock);
@@ -676,8 +680,9 @@ static int mlx5e_rep_open(struct net_device *dev)
         if (err)
                 goto unlock;
 
-        if (!mlx5_eswitch_set_vport_state(esw, rep->vport,
-                                          MLX5_ESW_VPORT_ADMIN_STATE_UP))
+        if (!mlx5_modify_vport_admin_state(priv->mdev,
+                        MLX5_QUERY_VPORT_STATE_IN_OP_MOD_ESW_VPORT,
+                        rep->vport, MLX5_ESW_VPORT_ADMIN_STATE_UP))
                 netif_carrier_on(dev);
 
 unlock:
@@ -690,11 +695,12 @@ static int mlx5e_rep_close(struct net_device *dev)
         struct mlx5e_priv *priv = netdev_priv(dev);
         struct mlx5e_rep_priv *rpriv = priv->ppriv;
         struct mlx5_eswitch_rep *rep = rpriv->rep;
-        struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
         int ret;
 
         mutex_lock(&priv->state_lock);
-        (void)mlx5_eswitch_set_vport_state(esw, rep->vport, MLX5_ESW_VPORT_ADMIN_STATE_DOWN);
+        mlx5_modify_vport_admin_state(priv->mdev,
+                        MLX5_QUERY_VPORT_STATE_IN_OP_MOD_ESW_VPORT,
+                        rep->vport, MLX5_ESW_VPORT_ADMIN_STATE_DOWN);
         ret = mlx5e_close_locked(dev);
         mutex_unlock(&priv->state_lock);
         return ret;
@@ -878,9 +884,9 @@ static void mlx5e_build_rep_params(struct mlx5_core_dev *mdev,
                                          MLX5_CQ_PERIOD_MODE_START_FROM_EQE;
 
         params->hard_mtu    = MLX5E_ETH_HARD_MTU;
-        params->log_sq_size = MLX5E_PARAMS_MINIMUM_LOG_SQ_SIZE;
+        params->log_sq_size = MLX5E_REP_PARAMS_LOG_SQ_SIZE;
         params->rq_wq_type  = MLX5_WQ_TYPE_LINKED_LIST;
-        params->log_rq_mtu_frames = MLX5E_PARAMS_MINIMUM_LOG_RQ_SIZE;
+        params->log_rq_mtu_frames = MLX5E_REP_PARAMS_LOG_RQ_SIZE;
 
         params->rx_dim_enabled = MLX5_CAP_GEN(mdev, cq_moderation);
         mlx5e_set_rx_cq_mode_params(params, cq_period_mode);
@@ -899,9 +905,7 @@ static void mlx5e_build_rep_netdev(struct net_device *netdev)
 
         netdev->ethtool_ops       = &mlx5e_rep_ethtool_ops;
 
-#ifdef CONFIG_NET_SWITCHDEV
         netdev->switchdev_ops = &mlx5e_rep_switchdev_ops;
-#endif
 
         netdev->features         |= NETIF_F_VLAN_CHALLENGED | NETIF_F_HW_TC | NETIF_F_NETNS_LOCAL;
         netdev->hw_features      |= NETIF_F_HW_TC;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 3e4a7e81b67f..4197001f9801 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -964,7 +964,7 @@ void mlx5e_tc_update_neigh_used_value(struct mlx5e_neigh_hash_entry *nhe)
                 tbl = &arp_tbl;
 #if IS_ENABLED(CONFIG_IPV6)
         else if (m_neigh->family == AF_INET6)
-                tbl = ipv6_stub->nd_tbl;
+                tbl = &nd_tbl;
 #endif
         else
                 return;
@@ -2614,19 +2614,19 @@ int mlx5e_configure_flower(struct mlx5e_priv *priv,
         if (err != -EAGAIN)
                 flow->flags |= MLX5E_TC_FLOW_OFFLOADED;
 
+        if (!(flow->flags & MLX5E_TC_FLOW_ESWITCH) ||
+            !(flow->esw_attr->action & MLX5_FLOW_CONTEXT_ACTION_ENCAP))
+                kvfree(parse_attr);
+
         err = rhashtable_insert_fast(&tc->ht, &flow->node,
                                      tc->ht_params);
-        if (err)
-                goto err_del_rule;
+        if (err) {
+                mlx5e_tc_del_flow(priv, flow);
+                kfree(flow);
+        }
 
-        if (flow->flags & MLX5E_TC_FLOW_ESWITCH &&
-            !(flow->esw_attr->action & MLX5_FLOW_CONTEXT_ACTION_ENCAP))
-                kvfree(parse_attr);
         return err;
 
-err_del_rule:
-        mlx5e_tc_del_flow(priv, flow);
-
 err_free:
         kvfree(parse_attr);
         kfree(flow);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index a9ccd974c620..1904c0323d39 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -1406,6 +1406,55 @@ mlxsw_sp_ipip_entry_ol_up_event(struct mlxsw_sp *mlxsw_sp,
                                                   decap_fib_entry);
 }
 
+static int
+mlxsw_sp_rif_ipip_lb_op(struct mlxsw_sp_rif_ipip_lb *lb_rif,
+                        struct mlxsw_sp_vr *ul_vr, bool enable)
+{
+        struct mlxsw_sp_rif_ipip_lb_config lb_cf = lb_rif->lb_config;
+        struct mlxsw_sp_rif *rif = &lb_rif->common;
+        struct mlxsw_sp *mlxsw_sp = rif->mlxsw_sp;
+        char ritr_pl[MLXSW_REG_RITR_LEN];
+        u32 saddr4;
+
+        switch (lb_cf.ul_protocol) {
+        case MLXSW_SP_L3_PROTO_IPV4:
+                saddr4 = be32_to_cpu(lb_cf.saddr.addr4);
+                mlxsw_reg_ritr_pack(ritr_pl, enable, MLXSW_REG_RITR_LOOPBACK_IF,
+                                    rif->rif_index, rif->vr_id, rif->dev->mtu);
+                mlxsw_reg_ritr_loopback_ipip4_pack(ritr_pl, lb_cf.lb_ipipt,
+                            MLXSW_REG_RITR_LOOPBACK_IPIP_OPTIONS_GRE_KEY_PRESET,
+                            ul_vr->id, saddr4, lb_cf.okey);
+                break;
+
+        case MLXSW_SP_L3_PROTO_IPV6:
+                return -EAFNOSUPPORT;
+        }
+
+        return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ritr), ritr_pl);
+}
+
+static int mlxsw_sp_netdevice_ipip_ol_update_mtu(struct mlxsw_sp *mlxsw_sp,
+                                                 struct net_device *ol_dev)
+{
+        struct mlxsw_sp_ipip_entry *ipip_entry;
+        struct mlxsw_sp_rif_ipip_lb *lb_rif;
+        struct mlxsw_sp_vr *ul_vr;
+        int err = 0;
+
+        ipip_entry = mlxsw_sp_ipip_entry_find_by_ol_dev(mlxsw_sp, ol_dev);
+        if (ipip_entry) {
+                lb_rif = ipip_entry->ol_lb;
+                ul_vr = &mlxsw_sp->router->vrs[lb_rif->ul_vr_id];
+                err = mlxsw_sp_rif_ipip_lb_op(lb_rif, ul_vr, true);
+                if (err)
+                        goto out;
+                lb_rif->common.mtu = ol_dev->mtu;
+        }
+
+out:
+        return err;
+}
+
 static void mlxsw_sp_netdevice_ipip_ol_up_event(struct mlxsw_sp *mlxsw_sp,
                                                 struct net_device *ol_dev)
 {
@@ -1686,6 +1735,8 @@ int mlxsw_sp_netdevice_ipip_ol_event(struct mlxsw_sp *mlxsw_sp,
                 extack = info->extack;
                 return mlxsw_sp_netdevice_ipip_ol_change_event(mlxsw_sp,
                                                                ol_dev, extack);
+        case NETDEV_CHANGEMTU:
+                return mlxsw_sp_netdevice_ipip_ol_update_mtu(mlxsw_sp, ol_dev);
         }
         return 0;
 }
@@ -6910,33 +6961,6 @@ mlxsw_sp_rif_ipip_lb_setup(struct mlxsw_sp_rif *rif,
 }
 
 static int
-mlxsw_sp_rif_ipip_lb_op(struct mlxsw_sp_rif_ipip_lb *lb_rif,
-                        struct mlxsw_sp_vr *ul_vr, bool enable)
-{
-        struct mlxsw_sp_rif_ipip_lb_config lb_cf = lb_rif->lb_config;
-        struct mlxsw_sp_rif *rif = &lb_rif->common;
-        struct mlxsw_sp *mlxsw_sp = rif->mlxsw_sp;
-        char ritr_pl[MLXSW_REG_RITR_LEN];
-        u32 saddr4;
-
-        switch (lb_cf.ul_protocol) {
-        case MLXSW_SP_L3_PROTO_IPV4:
-                saddr4 = be32_to_cpu(lb_cf.saddr.addr4);
-                mlxsw_reg_ritr_pack(ritr_pl, enable, MLXSW_REG_RITR_LOOPBACK_IF,
-                                    rif->rif_index, rif->vr_id, rif->dev->mtu);
-                mlxsw_reg_ritr_loopback_ipip4_pack(ritr_pl, lb_cf.lb_ipipt,
-                            MLXSW_REG_RITR_LOOPBACK_IPIP_OPTIONS_GRE_KEY_PRESET,
-                            ul_vr->id, saddr4, lb_cf.okey);
-                break;
-
-        case MLXSW_SP_L3_PROTO_IPV6:
-                return -EAFNOSUPPORT;
-        }
-
-        return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ritr), ritr_pl);
-}
-
-static int
 mlxsw_sp_rif_ipip_lb_configure(struct mlxsw_sp_rif *rif)
 {
         struct mlxsw_sp_rif_ipip_lb *lb_rif = mlxsw_sp_rif_ipip_lb_rif(rif);
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/jit.c b/drivers/net/ethernet/netronome/nfp/bpf/jit.c
index 4b631e26f199..29b4e5f8c102 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/jit.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/jit.c
@@ -74,7 +74,9 @@ nfp_meta_has_prev(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
 
 static void nfp_prog_push(struct nfp_prog *nfp_prog, u64 insn)
 {
-        if (nfp_prog->__prog_alloc_len == nfp_prog->prog_len) {
+        if (nfp_prog->__prog_alloc_len / sizeof(u64) == nfp_prog->prog_len) {
+                pr_warn("instruction limit reached (%u NFP instructions)\n",
+                        nfp_prog->prog_len);
                 nfp_prog->error = -ENOSPC;
                 return;
         }
@@ -2732,6 +2734,8 @@ static int nfp_translate(struct nfp_prog *nfp_prog)
                 err = cb(nfp_prog, meta);
                 if (err)
                         return err;
+                if (nfp_prog->error)
+                        return nfp_prog->error;
 
                 nfp_prog->n_translated++;
         }
diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c
index dafc079ab6b9..14941303189d 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
@@ -320,13 +320,11 @@ static inline void qede_update_tx_producer(struct qede_tx_queue *txq)
         barrier();
         writel(txq->tx_db.raw, txq->doorbell_addr);
 
-        /* mmiowb is needed to synchronize doorbell writes from more than one
-         * processor. It guarantees that the write arrives to the device before
-         * the queue lock is released and another start_xmit is called (possibly
-         * on another CPU). Without this barrier, the next doorbell can bypass
-         * this doorbell. This is applicable to IA64/Altix systems.
+        /* Fence required to flush the write combined buffer, since another
+         * CPU may write to the same doorbell address and data may be lost
+         * due to relaxed order nature of write combined bar.
          */
-        mmiowb();
+        wmb();
 }
 
 static int qede_xdp_xmit(struct qede_dev *edev, struct qede_fastpath *fp,
@@ -1249,16 +1247,10 @@ static int qede_rx_process_cqe(struct qede_dev *edev,
 
         csum_flag = qede_check_csum(parse_flag);
         if (unlikely(csum_flag == QEDE_CSUM_ERROR)) {
-                if (qede_pkt_is_ip_fragmented(fp_cqe, parse_flag)) {
+                if (qede_pkt_is_ip_fragmented(fp_cqe, parse_flag))
                         rxq->rx_ip_frags++;
-                } else {
-                        DP_NOTICE(edev,
-                                  "CQE has error, flags = %x, dropping incoming packet\n",
-                                  parse_flag);
+                else
                         rxq->rx_hw_errors++;
-                        qede_recycle_rx_bd_ring(rxq, fp_cqe->bd_num);
-                        return 0;
-                }
         }
 
         /* Basic validation passed; Need to prepare an SKB. This would also
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 630409e0337f..604ae78381ae 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -8378,12 +8378,12 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (!tp->counters)
                 return -ENOMEM;
 
+        pci_set_drvdata(pdev, dev);
+
         rc = register_netdev(dev);
         if (rc < 0)
                 return rc;
 
-        pci_set_drvdata(pdev, dev);
-
         netif_info(tp, probe, dev, "%s at 0x%p, %pM, XID %08x IRQ %d\n",
                    rtl_chip_infos[chipset].name, tp->mmio_addr, dev->dev_addr,
                    (u32)(RTL_R32(tp, TxConfig) & 0x9cf0f8ff),
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index e2b68d9328a7..6b127be781d9 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -863,7 +863,7 @@ static void rndis_set_multicast(struct work_struct *w)
         if (flags & IFF_PROMISC) {
                 filter = NDIS_PACKET_TYPE_PROMISCUOUS;
         } else {
-                if (flags & IFF_ALLMULTI)
+                if (!netdev_mc_empty(rdev->ndev) || (flags & IFF_ALLMULTI))
                         filter |= NDIS_PACKET_TYPE_ALL_MULTICAST;
                 if (flags & IFF_BROADCAST)
                         filter |= NDIS_PACKET_TYPE_BROADCAST;
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 222093e878a8..a6c6ce19eeee 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1203,11 +1203,6 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
                 goto err_dev_open;
         }
 
-        netif_addr_lock_bh(dev);
-        dev_uc_sync_multiple(port_dev, dev);
-        dev_mc_sync_multiple(port_dev, dev);
-        netif_addr_unlock_bh(dev);
-
         err = vlan_vids_add_by_dev(port_dev, dev);
         if (err) {
                 netdev_err(dev, "Failed to add vlan ids to device %s\n",
@@ -1247,6 +1242,11 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
                 goto err_option_port_add;
         }
 
+        netif_addr_lock_bh(dev);
+        dev_uc_sync_multiple(port_dev, dev);
+        dev_mc_sync_multiple(port_dev, dev);
+        netif_addr_unlock_bh(dev);
+
         port->index = -1;
         list_add_tail_rcu(&port->list, &team->port_list);
         team_port_enable(team, port);
@@ -1271,8 +1271,6 @@ err_enable_netpoll:
         vlan_vids_del_by_dev(port_dev, dev);
 
 err_vids_add:
-        dev_uc_unsync(port_dev, dev);
-        dev_mc_unsync(port_dev, dev);
         dev_close(port_dev);
 
 err_dev_open:
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 60a604cc7647..55a78eb96961 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2351,6 +2351,7 @@ static int lan78xx_reset(struct lan78xx_net *dev)
         u32 buf;
         int ret = 0;
         unsigned long timeout;
+        u8 sig;
 
         ret = lan78xx_read_reg(dev, HW_CFG, &buf);
         buf |= HW_CFG_LRST_;
@@ -2450,6 +2451,15 @@ static int lan78xx_reset(struct lan78xx_net *dev)
         /* LAN7801 only has RGMII mode */
         if (dev->chipid == ID_REV_CHIP_ID_7801_)
                 buf &= ~MAC_CR_GMII_EN_;
+
+        if (dev->chipid == ID_REV_CHIP_ID_7800_) {
+                ret = lan78xx_read_raw_eeprom(dev, 0, 1, &sig);
+                if (!ret && sig != EEPROM_INDICATOR) {
+                        /* Implies there is no external eeprom. Set mac speed */
+                        netdev_info(dev->net, "No External EEPROM. Setting MAC Speed\n");
+                        buf |= MAC_CR_AUTO_DUPLEX_ | MAC_CR_AUTO_SPEED_;
+                }
+        }
         ret = lan78xx_write_reg(dev, MAC_CR, buf);
 
         ret = lan78xx_read_reg(dev, MAC_TX, &buf);
@@ -2863,8 +2873,7 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf)
         if (ret < 0) {
                 netdev_warn(dev->net,
                             "lan78xx_setup_irq_domain() failed : %d", ret);
-                kfree(pdata);
-                return ret;
+                goto out1;
         }
 
         dev->net->hard_header_len += TX_OVERHEAD;
@@ -2872,14 +2881,32 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf)
 
         /* Init all registers */
         ret = lan78xx_reset(dev);
+        if (ret) {
+                netdev_warn(dev->net, "Registers INIT FAILED....");
+                goto out2;
+        }
 
         ret = lan78xx_mdio_init(dev);
+        if (ret) {
+                netdev_warn(dev->net, "MDIO INIT FAILED.....");
+                goto out2;
+        }
 
         dev->net->flags |= IFF_MULTICAST;
 
         pdata->wol = WAKE_MAGIC;
 
         return ret;
+
+out2:
+        lan78xx_remove_irq_domain(dev);
+
+out1:
+        netdev_warn(dev->net, "Bind routine FAILED");
+        cancel_work_sync(&pdata->set_multicast);
+        cancel_work_sync(&pdata->set_vlan);
+        kfree(pdata);
+        return ret;
 }
 
 static void lan78xx_unbind(struct lan78xx_net *dev, struct usb_interface *intf)
@@ -2891,6 +2918,8 @@ static void lan78xx_unbind(struct lan78xx_net *dev, struct usb_interface *intf)
         lan78xx_remove_mdio(dev);
 
         if (pdata) {
+                cancel_work_sync(&pdata->set_multicast);
+                cancel_work_sync(&pdata->set_vlan);
                 netif_dbg(dev, ifdown, dev->net, "free pdata");
                 kfree(pdata);
                 pdata = NULL;
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 76ac48095c29..ca066b785e9f 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1104,6 +1104,9 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x0846, 0x68a2, 8)},
         {QMI_FIXED_INTF(0x12d1, 0x140c, 1)},    /* Huawei E173 */
         {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)},    /* Huawei E1820 */
+        {QMI_FIXED_INTF(0x1435, 0xd181, 3)},    /* Wistron NeWeb D18Q1 */
+        {QMI_FIXED_INTF(0x1435, 0xd181, 4)},    /* Wistron NeWeb D18Q1 */
+        {QMI_FIXED_INTF(0x1435, 0xd181, 5)},    /* Wistron NeWeb D18Q1 */
         {QMI_FIXED_INTF(0x16d8, 0x6003, 0)},    /* CMOTech 6003 */
         {QMI_FIXED_INTF(0x16d8, 0x6007, 0)},    /* CMOTech CHE-628S */
         {QMI_FIXED_INTF(0x16d8, 0x6008, 0)},    /* CMOTech CMU-301 */
@@ -1180,6 +1183,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x19d2, 0x2002, 4)},    /* ZTE (Vodafone) K3765-Z */
         {QMI_FIXED_INTF(0x2001, 0x7e19, 4)},    /* D-Link DWM-221 B1 */
         {QMI_FIXED_INTF(0x2001, 0x7e35, 4)},    /* D-Link DWM-222 */
+        {QMI_FIXED_INTF(0x2020, 0x2033, 4)},    /* BroadMobi BM806U */
         {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
         {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
         {QMI_FIXED_INTF(0x1199, 0x68a2, 8)},    /* Sierra Wireless MC7710 in QMI mode */
@@ -1240,6 +1244,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x413c, 0x81b6, 8)},    /* Dell Wireless 5811e */
         {QMI_FIXED_INTF(0x413c, 0x81b6, 10)},   /* Dell Wireless 5811e */
         {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)},    /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */
+        {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)},    /* HP lt4120 Snapdragon X5 LTE */
         {QMI_FIXED_INTF(0x22de, 0x9061, 3)},    /* WeTelecom WPD-600N */
         {QMI_FIXED_INTF(0x1e0e, 0x9001, 5)},    /* SIMCom 7230E */
         {QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)}, /* Quectel EC25, EC20 R2.0  Mini PCIe */
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 102582459bef..0a2b180d138a 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -578,12 +578,13 @@ static int vrf_finish_output(struct net *net, struct sock *sk, struct sk_buff *s
         if (!IS_ERR(neigh)) {
                 sock_confirm_neigh(skb, neigh);
                 ret = neigh_output(neigh, skb);
+                rcu_read_unlock_bh();
+                return ret;
         }
 
         rcu_read_unlock_bh();
 err:
-        if (unlikely(ret < 0))
-                vrf_tx_error(skb->dev, skb);
+        vrf_tx_error(skb->dev, skb);
         return ret;
 }
 
diff --git a/drivers/pinctrl/samsung/pinctrl-exynos-arm.c b/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
index c32399faff57..90c274490181 100644
--- a/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
+++ b/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
@@ -124,7 +124,7 @@ static const struct samsung_pin_bank_data s5pv210_pin_bank[] __initconst = {
         EXYNOS_PIN_BANK_EINTW(8, 0xc60, "gph3", 0x0c),
 };
 
-const struct samsung_pin_ctrl s5pv210_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s5pv210_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = s5pv210_pin_bank,
@@ -137,6 +137,11 @@ const struct samsung_pin_ctrl s5pv210_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data s5pv210_of_data __initconst = {
+        .ctrl           = s5pv210_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s5pv210_pin_ctrl),
+};
+
 /* Pad retention control code for accessing PMU regmap */
 static atomic_t exynos_shared_retention_refcnt;
 
@@ -199,7 +204,7 @@ static const struct samsung_retention_data exynos3250_retention_data __initconst
  * Samsung pinctrl driver data for Exynos3250 SoC. Exynos3250 SoC includes
  * two gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos3250_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos3250_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos3250_pin_banks0,
@@ -220,6 +225,11 @@ const struct samsung_pin_ctrl exynos3250_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos3250_of_data __initconst = {
+        .ctrl           = exynos3250_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos3250_pin_ctrl),
+};
+
 /* pin banks of exynos4210 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos4210_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
@@ -303,7 +313,7 @@ static const struct samsung_retention_data exynos4_audio_retention_data __initco
  * Samsung pinctrl driver data for Exynos4210 SoC. Exynos4210 SoC includes
  * three gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos4210_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos4210_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos4210_pin_banks0,
@@ -329,6 +339,11 @@ const struct samsung_pin_ctrl exynos4210_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos4210_of_data __initconst = {
+        .ctrl           = exynos4210_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos4210_pin_ctrl),
+};
+
 /* pin banks of exynos4x12 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos4x12_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
@@ -391,7 +406,7 @@ static const struct samsung_pin_bank_data exynos4x12_pin_banks3[] __initconst =
  * Samsung pinctrl driver data for Exynos4x12 SoC. Exynos4x12 SoC includes
  * four gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos4x12_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos4x12_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos4x12_pin_banks0,
@@ -427,6 +442,11 @@ const struct samsung_pin_ctrl exynos4x12_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos4x12_of_data __initconst = {
+        .ctrl           = exynos4x12_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos4x12_pin_ctrl),
+};
+
 /* pin banks of exynos5250 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos5250_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
@@ -487,7 +507,7 @@ static const struct samsung_pin_bank_data exynos5250_pin_banks3[] __initconst =
  * Samsung pinctrl driver data for Exynos5250 SoC. Exynos5250 SoC includes
  * four gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos5250_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos5250_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos5250_pin_banks0,
@@ -523,6 +543,11 @@ const struct samsung_pin_ctrl exynos5250_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos5250_of_data __initconst = {
+        .ctrl           = exynos5250_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos5250_pin_ctrl),
+};
+
 /* pin banks of exynos5260 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos5260_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(4, 0x000, "gpa0", 0x00),
@@ -567,7 +592,7 @@ static const struct samsung_pin_bank_data exynos5260_pin_banks2[] __initconst =
  * Samsung pinctrl driver data for Exynos5260 SoC. Exynos5260 SoC includes
  * three gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos5260_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos5260_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos5260_pin_banks0,
@@ -587,6 +612,11 @@ const struct samsung_pin_ctrl exynos5260_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos5260_of_data __initconst = {
+        .ctrl           = exynos5260_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos5260_pin_ctrl),
+};
+
 /* pin banks of exynos5410 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos5410_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
@@ -657,7 +687,7 @@ static const struct samsung_pin_bank_data exynos5410_pin_banks3[] __initconst =
  * Samsung pinctrl driver data for Exynos5410 SoC. Exynos5410 SoC includes
  * four gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos5410_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos5410_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos5410_pin_banks0,
@@ -690,6 +720,11 @@ const struct samsung_pin_ctrl exynos5410_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos5410_of_data __initconst = {
+        .ctrl           = exynos5410_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos5410_pin_ctrl),
+};
+
 /* pin banks of exynos5420 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos5420_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpy7", 0x00),
@@ -774,7 +809,7 @@ static const struct samsung_retention_data exynos5420_retention_data __initconst
  * Samsung pinctrl driver data for Exynos5420 SoC. Exynos5420 SoC includes
  * four gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos5420_pin_banks0,
@@ -808,3 +843,8 @@ const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = {
                 .retention_data = &exynos4_audio_retention_data,
         },
 };
+
+const struct samsung_pinctrl_of_match_data exynos5420_of_data __initconst = {
+        .ctrl           = exynos5420_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos5420_pin_ctrl),
+};
diff --git a/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c b/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c
index fc8f7833bec0..71c9d1d9f345 100644
--- a/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c
+++ b/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c
@@ -175,7 +175,7 @@ static const struct samsung_retention_data exynos5433_fsys_retention_data __init
  * Samsung pinctrl driver data for Exynos5433 SoC. Exynos5433 SoC includes
  * ten gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos5433_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos5433_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos5433_pin_banks0,
@@ -260,6 +260,11 @@ const struct samsung_pin_ctrl exynos5433_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos5433_of_data __initconst = {
+        .ctrl           = exynos5433_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos5433_pin_ctrl),
+};
+
 /* pin banks of exynos7 pin-controller - ALIVE */
 static const struct samsung_pin_bank_data exynos7_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTW(8, 0x000, "gpa0", 0x00),
@@ -339,7 +344,7 @@ static const struct samsung_pin_bank_data exynos7_pin_banks9[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(4, 0x020, "gpz1", 0x04),
 };
 
-const struct samsung_pin_ctrl exynos7_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos7_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 Alive data */
                 .pin_banks      = exynos7_pin_banks0,
@@ -392,3 +397,8 @@ const struct samsung_pin_ctrl exynos7_pin_ctrl[] __initconst = {
                 .eint_gpio_init = exynos_eint_gpio_init,
         },
 };
+
+const struct samsung_pinctrl_of_match_data exynos7_of_data __initconst = {
+        .ctrl           = exynos7_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos7_pin_ctrl),
+};
diff --git a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
index 10187cb0e9b9..7e824e4d20f4 100644
--- a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
+++ b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
@@ -565,7 +565,7 @@ static const struct samsung_pin_bank_data s3c2412_pin_banks[] __initconst = {
         PIN_BANK_2BIT(13, 0x080, "gpj"),
 };
 
-const struct samsung_pin_ctrl s3c2412_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s3c2412_pin_ctrl[] __initconst = {
         {
                 .pin_banks      = s3c2412_pin_banks,
                 .nr_banks       = ARRAY_SIZE(s3c2412_pin_banks),
@@ -573,6 +573,11 @@ const struct samsung_pin_ctrl s3c2412_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data s3c2412_of_data __initconst = {
+        .ctrl           = s3c2412_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s3c2412_pin_ctrl),
+};
+
 static const struct samsung_pin_bank_data s3c2416_pin_banks[] __initconst = {
         PIN_BANK_A(27, 0x000, "gpa"),
         PIN_BANK_2BIT(11, 0x010, "gpb"),
@@ -587,7 +592,7 @@ static const struct samsung_pin_bank_data s3c2416_pin_banks[] __initconst = {
         PIN_BANK_2BIT(2, 0x100, "gpm"),
 };
 
-const struct samsung_pin_ctrl s3c2416_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s3c2416_pin_ctrl[] __initconst = {
         {
                 .pin_banks      = s3c2416_pin_banks,
                 .nr_banks       = ARRAY_SIZE(s3c2416_pin_banks),
@@ -595,6 +600,11 @@ const struct samsung_pin_ctrl s3c2416_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data s3c2416_of_data __initconst = {
+        .ctrl           = s3c2416_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s3c2416_pin_ctrl),
+};
+
 static const struct samsung_pin_bank_data s3c2440_pin_banks[] __initconst = {
         PIN_BANK_A(25, 0x000, "gpa"),
         PIN_BANK_2BIT(11, 0x010, "gpb"),
@@ -607,7 +617,7 @@ static const struct samsung_pin_bank_data s3c2440_pin_banks[] __initconst = {
         PIN_BANK_2BIT(13, 0x0d0, "gpj"),
 };
 
-const struct samsung_pin_ctrl s3c2440_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s3c2440_pin_ctrl[] __initconst = {
         {
                 .pin_banks      = s3c2440_pin_banks,
                 .nr_banks       = ARRAY_SIZE(s3c2440_pin_banks),
@@ -615,6 +625,11 @@ const struct samsung_pin_ctrl s3c2440_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data s3c2440_of_data __initconst = {
+        .ctrl           = s3c2440_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s3c2440_pin_ctrl),
+};
+
 static const struct samsung_pin_bank_data s3c2450_pin_banks[] __initconst = {
         PIN_BANK_A(28, 0x000, "gpa"),
         PIN_BANK_2BIT(11, 0x010, "gpb"),
@@ -630,10 +645,15 @@ static const struct samsung_pin_bank_data s3c2450_pin_banks[] __initconst = {
         PIN_BANK_2BIT(2, 0x100, "gpm"),
 };
 
-const struct samsung_pin_ctrl s3c2450_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s3c2450_pin_ctrl[] __initconst = {
         {
                 .pin_banks      = s3c2450_pin_banks,
                 .nr_banks       = ARRAY_SIZE(s3c2450_pin_banks),
                 .eint_wkup_init = s3c24xx_eint_init,
         },
 };
+
+const struct samsung_pinctrl_of_match_data s3c2450_of_data __initconst = {
+        .ctrl           = s3c2450_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s3c2450_pin_ctrl),
+};
diff --git a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
index 679628ac4b31..288e6567ceb1 100644
--- a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
+++ b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
@@ -789,7 +789,7 @@ static const struct samsung_pin_bank_data s3c64xx_pin_banks0[] __initconst = {
  * Samsung pinctrl driver data for S3C64xx SoC. S3C64xx SoC includes
  * one gpio/pin-mux/pinconfig controller.
  */
-const struct samsung_pin_ctrl s3c64xx_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s3c64xx_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 1 data */
                 .pin_banks      = s3c64xx_pin_banks0,
@@ -798,3 +798,8 @@ const struct samsung_pin_ctrl s3c64xx_pin_ctrl[] __initconst = {
                 .eint_wkup_init = s3c64xx_eint_eint0_init,
         },
 };
+
+const struct samsung_pinctrl_of_match_data s3c64xx_of_data __initconst = {
+        .ctrl           = s3c64xx_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s3c64xx_pin_ctrl),
+};
diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
index da58e4554137..336e88d7bdb9 100644
--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
@@ -942,12 +942,33 @@ static int samsung_gpiolib_register(struct platform_device *pdev,
         return 0;
 }
 
+static const struct samsung_pin_ctrl *
+samsung_pinctrl_get_soc_data_for_of_alias(struct platform_device *pdev)
+{
+        struct device_node *node = pdev->dev.of_node;
+        const struct samsung_pinctrl_of_match_data *of_data;
+        int id;
+
+        id = of_alias_get_id(node, "pinctrl");
+        if (id < 0) {
+                dev_err(&pdev->dev, "failed to get alias id\n");
+                return NULL;
+        }
+
+        of_data = of_device_get_match_data(&pdev->dev);
+        if (id >= of_data->num_ctrl) {
+                dev_err(&pdev->dev, "invalid alias id %d\n", id);
+                return NULL;
+        }
+
+        return &(of_data->ctrl[id]);
+}
+
 /* retrieve the soc specific data */
 static const struct samsung_pin_ctrl *
 samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d,
                              struct platform_device *pdev)
 {
-        int id;
         struct device_node *node = pdev->dev.of_node;
         struct device_node *np;
         const struct samsung_pin_bank_data *bdata;
@@ -957,13 +978,9 @@ samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d,
         void __iomem *virt_base[SAMSUNG_PINCTRL_NUM_RESOURCES];
         unsigned int i;
 
-        id = of_alias_get_id(node, "pinctrl");
-        if (id < 0) {
-                dev_err(&pdev->dev, "failed to get alias id\n");
+        ctrl = samsung_pinctrl_get_soc_data_for_of_alias(pdev);
+        if (!ctrl)
                 return ERR_PTR(-ENOENT);
-        }
-        ctrl = of_device_get_match_data(&pdev->dev);
-        ctrl += id;
 
         d->suspend = ctrl->suspend;
         d->resume = ctrl->resume;
@@ -1188,41 +1205,41 @@ static int __maybe_unused samsung_pinctrl_resume(struct device *dev)
 static const struct of_device_id samsung_pinctrl_dt_match[] = {
 #ifdef CONFIG_PINCTRL_EXYNOS_ARM
         { .compatible = "samsung,exynos3250-pinctrl",
-                .data = exynos3250_pin_ctrl },
+                .data = &exynos3250_of_data },
         { .compatible = "samsung,exynos4210-pinctrl",
-                .data = exynos4210_pin_ctrl },
+                .data = &exynos4210_of_data },
         { .compatible = "samsung,exynos4x12-pinctrl",
-                .data = exynos4x12_pin_ctrl },
+                .data = &exynos4x12_of_data },
         { .compatible = "samsung,exynos5250-pinctrl",
-                .data = exynos5250_pin_ctrl },
+                .data = &exynos5250_of_data },
         { .compatible = "samsung,exynos5260-pinctrl",
-                .data = exynos5260_pin_ctrl },
+                .data = &exynos5260_of_data },
         { .compatible = "samsung,exynos5410-pinctrl",
-                .data = exynos5410_pin_ctrl },
+                .data = &exynos5410_of_data },
         { .compatible = "samsung,exynos5420-pinctrl",
-                .data = exynos5420_pin_ctrl },
+                .data = &exynos5420_of_data },
         { .compatible = "samsung,s5pv210-pinctrl",
-                .data = s5pv210_pin_ctrl },
+                .data = &s5pv210_of_data },
 #endif
 #ifdef CONFIG_PINCTRL_EXYNOS_ARM64
         { .compatible = "samsung,exynos5433-pinctrl",
-                .data = exynos5433_pin_ctrl },
+                .data = &exynos5433_of_data },
         { .compatible = "samsung,exynos7-pinctrl",
-                .data = exynos7_pin_ctrl },
+                .data = &exynos7_of_data },
 #endif
 #ifdef CONFIG_PINCTRL_S3C64XX
         { .compatible = "samsung,s3c64xx-pinctrl",
-                .data = s3c64xx_pin_ctrl },
+                .data = &s3c64xx_of_data },
 #endif
 #ifdef CONFIG_PINCTRL_S3C24XX
         { .compatible = "samsung,s3c2412-pinctrl",
-                .data = s3c2412_pin_ctrl },
+                .data = &s3c2412_of_data },
         { .compatible = "samsung,s3c2416-pinctrl",
-                .data = s3c2416_pin_ctrl },
+                .data = &s3c2416_of_data },
         { .compatible = "samsung,s3c2440-pinctrl",
-                .data = s3c2440_pin_ctrl },
+                .data = &s3c2440_of_data },
         { .compatible = "samsung,s3c2450-pinctrl",
-                .data = s3c2450_pin_ctrl },
+                .data = &s3c2450_of_data },
 #endif
         {},
 };
diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.h b/drivers/pinctrl/samsung/pinctrl-samsung.h
index e204f609823b..f0cda9424dfe 100644
--- a/drivers/pinctrl/samsung/pinctrl-samsung.h
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.h
@@ -282,6 +282,16 @@ struct samsung_pinctrl_drv_data {
 };
 
 /**
+ * struct samsung_pinctrl_of_match_data: OF match device specific configuration data.
+ * @ctrl: array of pin controller data.
+ * @num_ctrl: size of array @ctrl.
+ */
+struct samsung_pinctrl_of_match_data {
+        const struct samsung_pin_ctrl   *ctrl;
+        unsigned int                    num_ctrl;
+};
+
+/**
  * struct samsung_pin_group: represent group of pins of a pinmux function.
  * @name: name of the pin group, used to lookup the group.
  * @pins: the pins included in this group.
@@ -309,20 +319,20 @@ struct samsung_pmx_func {
 };
 
 /* list of all exported SoC specific data */
-extern const struct samsung_pin_ctrl exynos3250_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos4210_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos4x12_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos5250_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos5260_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos5410_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos5420_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos5433_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos7_pin_ctrl[];
-extern const struct samsung_pin_ctrl s3c64xx_pin_ctrl[];
-extern const struct samsung_pin_ctrl s3c2412_pin_ctrl[];
-extern const struct samsung_pin_ctrl s3c2416_pin_ctrl[];
-extern const struct samsung_pin_ctrl s3c2440_pin_ctrl[];
-extern const struct samsung_pin_ctrl s3c2450_pin_ctrl[];
-extern const struct samsung_pin_ctrl s5pv210_pin_ctrl[];
+extern const struct samsung_pinctrl_of_match_data exynos3250_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos4210_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos4x12_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos5250_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos5260_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos5410_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos5420_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos5433_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos7_of_data;
+extern const struct samsung_pinctrl_of_match_data s3c64xx_of_data;
+extern const struct samsung_pinctrl_of_match_data s3c2412_of_data;
+extern const struct samsung_pinctrl_of_match_data s3c2416_of_data;
+extern const struct samsung_pinctrl_of_match_data s3c2440_of_data;
+extern const struct samsung_pinctrl_of_match_data s3c2450_of_data;
+extern const struct samsung_pinctrl_of_match_data s5pv210_of_data;
 
 #endif /* __PINCTRL_SAMSUNG_H */
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7795.c b/drivers/pinctrl/sh-pfc/pfc-r8a7795.c
index 18aeee592fdc..35951e7b89d2 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7795.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7795.c
@@ -1538,7 +1538,6 @@ static const struct sh_pfc_pin pinmux_pins[] = {
         SH_PFC_PIN_NAMED_CFG('B', 18, AVB_TD1, CFG_FLAGS),
         SH_PFC_PIN_NAMED_CFG('B', 19, AVB_RXC, CFG_FLAGS),
         SH_PFC_PIN_NAMED_CFG('C',  1, PRESETOUT#, CFG_FLAGS),
-        SH_PFC_PIN_NAMED_CFG('F',  1, CLKOUT, CFG_FLAGS),
         SH_PFC_PIN_NAMED_CFG('H', 37, MLB_REF, CFG_FLAGS),
         SH_PFC_PIN_NAMED_CFG('V',  3, QSPI1_SPCLK, CFG_FLAGS),
         SH_PFC_PIN_NAMED_CFG('V',  5, QSPI1_SSL, CFG_FLAGS),
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index dd9464920456..ef22b275d050 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -474,6 +474,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
                 shost->dma_boundary = 0xffffffff;
 
         shost->use_blk_mq = scsi_use_blk_mq;
+        shost->use_blk_mq = scsi_use_blk_mq || shost->hostt->force_blk_mq;
 
         device_initialize(&shost->shost_gendev);
         dev_set_name(&shost->shost_gendev, "host%d", shost->host_no);
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 5293e6827ce5..3a9eca163db8 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -1045,11 +1045,7 @@ static void set_performant_mode(struct ctlr_info *h, struct CommandList *c,
                 c->busaddr |= 1 | (h->blockFetchTable[c->Header.SGList] << 1);
                 if (unlikely(!h->msix_vectors))
                         return;
-                if (likely(reply_queue == DEFAULT_REPLY_QUEUE))
-                        c->Header.ReplyQueue =
-                                raw_smp_processor_id() % h->nreply_queues;
-                else
-                        c->Header.ReplyQueue = reply_queue % h->nreply_queues;
+                c->Header.ReplyQueue = reply_queue;
         }
 }
 
@@ -1063,10 +1059,7 @@ static void set_ioaccel1_performant_mode(struct ctlr_info *h,
          * Tell the controller to post the reply to the queue for this
          * processor.  This seems to give the best I/O throughput.
          */
-        if (likely(reply_queue == DEFAULT_REPLY_QUEUE))
-                cp->ReplyQueue = smp_processor_id() % h->nreply_queues;
-        else
-                cp->ReplyQueue = reply_queue % h->nreply_queues;
+        cp->ReplyQueue = reply_queue;
         /*
          * Set the bits in the address sent down to include:
          *  - performant mode bit (bit 0)
@@ -1087,10 +1080,7 @@ static void set_ioaccel2_tmf_performant_mode(struct ctlr_info *h,
         /* Tell the controller to post the reply to the queue for this
          * processor.  This seems to give the best I/O throughput.
          */
-        if (likely(reply_queue == DEFAULT_REPLY_QUEUE))
-                cp->reply_queue = smp_processor_id() % h->nreply_queues;
-        else
-                cp->reply_queue = reply_queue % h->nreply_queues;
+        cp->reply_queue = reply_queue;
         /* Set the bits in the address sent down to include:
          *  - performant mode bit not used in ioaccel mode 2
          *  - pull count (bits 0-3)
@@ -1109,10 +1099,7 @@ static void set_ioaccel2_performant_mode(struct ctlr_info *h,
          * Tell the controller to post the reply to the queue for this
          * processor.  This seems to give the best I/O throughput.
          */
-        if (likely(reply_queue == DEFAULT_REPLY_QUEUE))
-                cp->reply_queue = smp_processor_id() % h->nreply_queues;
-        else
-                cp->reply_queue = reply_queue % h->nreply_queues;
+        cp->reply_queue = reply_queue;
         /*
          * Set the bits in the address sent down to include:
          *  - performant mode bit not used in ioaccel mode 2
@@ -1157,6 +1144,8 @@ static void __enqueue_cmd_and_start_io(struct ctlr_info *h,
 {
         dial_down_lockup_detection_during_fw_flash(h, c);
         atomic_inc(&h->commands_outstanding);
+
+        reply_queue = h->reply_map[raw_smp_processor_id()];
         switch (c->cmd_type) {
         case CMD_IOACCEL1:
                 set_ioaccel1_performant_mode(h, c, reply_queue);
@@ -7376,6 +7365,26 @@ static void hpsa_disable_interrupt_mode(struct ctlr_info *h)
         h->msix_vectors = 0;
 }
 
+static void hpsa_setup_reply_map(struct ctlr_info *h)
+{
+        const struct cpumask *mask;
+        unsigned int queue, cpu;
+
+        for (queue = 0; queue < h->msix_vectors; queue++) {
+                mask = pci_irq_get_affinity(h->pdev, queue);
+                if (!mask)
+                        goto fallback;
+
+                for_each_cpu(cpu, mask)
+                        h->reply_map[cpu] = queue;
+        }
+        return;
+
+fallback:
+        for_each_possible_cpu(cpu)
+                h->reply_map[cpu] = 0;
+}
+
 /* If MSI/MSI-X is supported by the kernel we will try to enable it on
  * controllers that are capable. If not, we use legacy INTx mode.
  */
@@ -7771,6 +7780,10 @@ static int hpsa_pci_init(struct ctlr_info *h)
         err = hpsa_interrupt_mode(h);
         if (err)
                 goto clean1;
+
+        /* setup mapping between CPU and reply queue */
+        hpsa_setup_reply_map(h);
+
         err = hpsa_pci_find_memory_BAR(h->pdev, &h->paddr);
         if (err)
                 goto clean2;    /* intmode+region, pci */
@@ -8480,6 +8493,28 @@ static struct workqueue_struct *hpsa_create_controller_wq(struct ctlr_info *h,
         return wq;
 }
 
+static void hpda_free_ctlr_info(struct ctlr_info *h)
+{
+        kfree(h->reply_map);
+        kfree(h);
+}
+
+static struct ctlr_info *hpda_alloc_ctlr_info(void)
+{
+        struct ctlr_info *h;
+
+        h = kzalloc(sizeof(*h), GFP_KERNEL);
+        if (!h)
+                return NULL;
+
+        h->reply_map = kzalloc(sizeof(*h->reply_map) * nr_cpu_ids, GFP_KERNEL);
+        if (!h->reply_map) {
+                kfree(h);
+                return NULL;
+        }
+        return h;
+}
+
 static int hpsa_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
         int dac, rc;
@@ -8517,7 +8552,7 @@ reinit_after_soft_reset:
          * the driver.  See comments in hpsa.h for more info.
          */
         BUILD_BUG_ON(sizeof(struct CommandList) % COMMANDLIST_ALIGNMENT);
-        h = kzalloc(sizeof(*h), GFP_KERNEL);
+        h = hpda_alloc_ctlr_info();
         if (!h) {
                 dev_err(&pdev->dev, "Failed to allocate controller head\n");
                 return -ENOMEM;
@@ -8916,7 +8951,7 @@ static void hpsa_remove_one(struct pci_dev *pdev)
         h->lockup_detected = NULL;                      /* init_one 2 */
         /* (void) pci_disable_pcie_error_reporting(pdev); */    /* init_one 1 */
 
-        kfree(h);                                       /* init_one 1 */
+        hpda_free_ctlr_info(h);                         /* init_one 1 */
 }
 
 static int hpsa_suspend(__attribute__((unused)) struct pci_dev *pdev,
diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
index 018f980a701c..fb9f5e7f8209 100644
--- a/drivers/scsi/hpsa.h
+++ b/drivers/scsi/hpsa.h
@@ -158,6 +158,7 @@ struct bmic_controller_parameters {
 #pragma pack()
 
 struct ctlr_info {
+        unsigned int *reply_map;
         int     ctlr;
         char    devname[8];
         char    *product_name;
diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
index b1b1d3a3b173..daefe8172b04 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -3579,11 +3579,9 @@ static void ibmvfc_tgt_implicit_logout(struct ibmvfc_target *tgt)
 static int ibmvfc_adisc_needs_plogi(struct ibmvfc_passthru_mad *mad,
                                     struct ibmvfc_target *tgt)
 {
-        if (memcmp(&mad->fc_iu.response[2], &tgt->ids.port_name,
-                   sizeof(tgt->ids.port_name)))
+        if (wwn_to_u64((u8 *)&mad->fc_iu.response[2]) != tgt->ids.port_name)
                 return 1;
-        if (memcmp(&mad->fc_iu.response[4], &tgt->ids.node_name,
-                   sizeof(tgt->ids.node_name)))
+        if (wwn_to_u64((u8 *)&mad->fc_iu.response[4]) != tgt->ids.node_name)
                 return 1;
         if (be32_to_cpu(mad->fc_iu.response[6]) != tgt->scsi_id)
                 return 1;
diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index 0ad00dbf912d..6d886b13dbe9 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -37,6 +37,7 @@
 #include <linux/kfifo.h>
 #include <linux/scatterlist.h>
 #include <linux/module.h>
+#include <linux/backing-dev.h>
 #include <net/tcp.h>
 #include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_device.h>
@@ -954,6 +955,13 @@ static int iscsi_sw_tcp_slave_alloc(struct scsi_device *sdev)
 
 static int iscsi_sw_tcp_slave_configure(struct scsi_device *sdev)
 {
+        struct iscsi_sw_tcp_host *tcp_sw_host = iscsi_host_priv(sdev->host);
+        struct iscsi_session *session = tcp_sw_host->session;
+        struct iscsi_conn *conn = session->leadconn;
+
+        if (conn->datadgst_en)
+                sdev->request_queue->backing_dev_info->capabilities
+                        |= BDI_CAP_STABLE_WRITES;
         blk_queue_bounce_limit(sdev->request_queue, BLK_BOUNCE_ANY);
         blk_queue_dma_alignment(sdev->request_queue, 0);
         return 0;
diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
index ba6503f37756..27fab8235ea5 100644
--- a/drivers/scsi/megaraid/megaraid_sas.h
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -2128,6 +2128,7 @@ enum MR_PD_TYPE {
 
 struct megasas_instance {
 
+        unsigned int *reply_map;
         __le32 *producer;
         dma_addr_t producer_h;
         __le32 *consumer;
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index a71ee67df084..dde0798b8a91 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -5165,6 +5165,26 @@ skip_alloc:
                 instance->use_seqnum_jbod_fp = false;
 }
 
+static void megasas_setup_reply_map(struct megasas_instance *instance)
+{
+        const struct cpumask *mask;
+        unsigned int queue, cpu;
+
+        for (queue = 0; queue < instance->msix_vectors; queue++) {
+                mask = pci_irq_get_affinity(instance->pdev, queue);
+                if (!mask)
+                        goto fallback;
+
+                for_each_cpu(cpu, mask)
+                        instance->reply_map[cpu] = queue;
+        }
+        return;
+
+fallback:
+        for_each_possible_cpu(cpu)
+                instance->reply_map[cpu] = cpu % instance->msix_vectors;
+}
+
 /**
  * megasas_init_fw -    Initializes the FW
  * @instance:           Adapter soft state
@@ -5343,6 +5363,8 @@ static int megasas_init_fw(struct megasas_instance *instance)
                         goto fail_setup_irqs;
         }
 
+        megasas_setup_reply_map(instance);
+
         dev_info(&instance->pdev->dev,
                 "firmware supports msix\t: (%d)", fw_msix_count);
         dev_info(&instance->pdev->dev,
@@ -6123,20 +6145,29 @@ static inline int megasas_alloc_mfi_ctrl_mem(struct megasas_instance *instance)
  */
 static int megasas_alloc_ctrl_mem(struct megasas_instance *instance)
 {
+        instance->reply_map = kzalloc(sizeof(unsigned int) * nr_cpu_ids,
+                                      GFP_KERNEL);
+        if (!instance->reply_map)
+                return -ENOMEM;
+
         switch (instance->adapter_type) {
         case MFI_SERIES:
                 if (megasas_alloc_mfi_ctrl_mem(instance))
-                        return -ENOMEM;
+                        goto fail;
                 break;
         case VENTURA_SERIES:
         case THUNDERBOLT_SERIES:
         case INVADER_SERIES:
                 if (megasas_alloc_fusion_context(instance))
-                        return -ENOMEM;
+                        goto fail;
                 break;
         }
 
         return 0;
+ fail:
+        kfree(instance->reply_map);
+        instance->reply_map = NULL;
+        return -ENOMEM;
 }
 
 /*
@@ -6148,6 +6179,7 @@ static int megasas_alloc_ctrl_mem(struct megasas_instance *instance)
  */
 static inline void megasas_free_ctrl_mem(struct megasas_instance *instance)
 {
+        kfree(instance->reply_map);
         if (instance->adapter_type == MFI_SERIES) {
                 if (instance->producer)
                         pci_free_consistent(instance->pdev, sizeof(u32),
@@ -6540,7 +6572,6 @@ fail_io_attach:
                 pci_free_irq_vectors(instance->pdev);
 fail_init_mfi:
         scsi_host_put(host);
-
 fail_alloc_instance:
         pci_disable_device(pdev);
 
@@ -6746,6 +6777,8 @@ megasas_resume(struct pci_dev *pdev)
         if (rval < 0)
                 goto fail_reenable_msix;
 
+        megasas_setup_reply_map(instance);
+
         if (instance->adapter_type != MFI_SERIES) {
                 megasas_reset_reply_desc(instance);
                 if (megasas_ioc_init_fusion(instance)) {
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index dc8e850fbfd2..5ec3b74e8aed 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -2641,11 +2641,8 @@ megasas_build_ldio_fusion(struct megasas_instance *instance,
                         fp_possible = (io_info.fpOkForIo > 0) ? true : false;
         }
 
-        /* Use raw_smp_processor_id() for now until cmd->request->cpu is CPU
-           id by default, not CPU group id, otherwise all MSI-X queues won't
-           be utilized */
-        cmd->request_desc->SCSIIO.MSIxIndex = instance->msix_vectors ?
-                raw_smp_processor_id() % instance->msix_vectors : 0;
+        cmd->request_desc->SCSIIO.MSIxIndex =
+                instance->reply_map[raw_smp_processor_id()];
 
         praid_context = &io_request->RaidContext;
 
@@ -2971,10 +2968,9 @@ megasas_build_syspd_fusion(struct megasas_instance *instance,
         }
 
         cmd->request_desc->SCSIIO.DevHandle = io_request->DevHandle;
-        cmd->request_desc->SCSIIO.MSIxIndex =
-                instance->msix_vectors ?
-                (raw_smp_processor_id() % instance->msix_vectors) : 0;
 
+        cmd->request_desc->SCSIIO.MSIxIndex =
+                instance->reply_map[raw_smp_processor_id()];
 
         if (!fp_possible) {
                 /* system pd firmware path */
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 3541caf3fceb..1fa84d6a0f8b 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2484,6 +2484,8 @@ sd_read_capacity(struct scsi_disk *sdkp, unsigned char *buffer)
                                 sector_size = old_sector_size;
                                 goto got_data;
                         }
+                        /* Remember that READ CAPACITY(16) succeeded */
+                        sdp->try_rc_10_first = 0;
                 }
         }
 
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 7c28e8d4955a..45d04631888a 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -91,9 +91,6 @@ struct virtio_scsi_vq {
 struct virtio_scsi_target_state {
         seqcount_t tgt_seq;
 
-        /* Count of outstanding requests. */
-        atomic_t reqs;
-
         /* Currently active virtqueue for requests sent to this target. */
         struct virtio_scsi_vq *req_vq;
 };
@@ -152,8 +149,6 @@ static void virtscsi_complete_cmd(struct virtio_scsi *vscsi, void *buf)
         struct virtio_scsi_cmd *cmd = buf;
         struct scsi_cmnd *sc = cmd->sc;
         struct virtio_scsi_cmd_resp *resp = &cmd->resp.cmd;
-        struct virtio_scsi_target_state *tgt =
-                                scsi_target(sc->device)->hostdata;
 
         dev_dbg(&sc->device->sdev_gendev,
                 "cmd %p response %u status %#02x sense_len %u\n",
@@ -210,8 +205,6 @@ static void virtscsi_complete_cmd(struct virtio_scsi *vscsi, void *buf)
         }
 
         sc->scsi_done(sc);
-
-        atomic_dec(&tgt->reqs);
 }
 
 static void virtscsi_vq_done(struct virtio_scsi *vscsi,
@@ -529,11 +522,20 @@ static void virtio_scsi_init_hdr_pi(struct virtio_device *vdev,
 }
 #endif
 
-static int virtscsi_queuecommand(struct virtio_scsi *vscsi,
-                                 struct virtio_scsi_vq *req_vq,
+static struct virtio_scsi_vq *virtscsi_pick_vq_mq(struct virtio_scsi *vscsi,
+                                                  struct scsi_cmnd *sc)
+{
+        u32 tag = blk_mq_unique_tag(sc->request);
+        u16 hwq = blk_mq_unique_tag_to_hwq(tag);
+
+        return &vscsi->req_vqs[hwq];
+}
+
+static int virtscsi_queuecommand(struct Scsi_Host *shost,
                                  struct scsi_cmnd *sc)
 {
-        struct Scsi_Host *shost = virtio_scsi_host(vscsi->vdev);
+        struct virtio_scsi *vscsi = shost_priv(shost);
+        struct virtio_scsi_vq *req_vq = virtscsi_pick_vq_mq(vscsi, sc);
         struct virtio_scsi_cmd *cmd = scsi_cmd_priv(sc);
         unsigned long flags;
         int req_size;
@@ -576,79 +578,6 @@ static int virtscsi_queuecommand(struct virtio_scsi *vscsi,
         return 0;
 }
 
-static int virtscsi_queuecommand_single(struct Scsi_Host *sh,
-                                        struct scsi_cmnd *sc)
-{
-        struct virtio_scsi *vscsi = shost_priv(sh);
-        struct virtio_scsi_target_state *tgt =
-                                scsi_target(sc->device)->hostdata;
-
-        atomic_inc(&tgt->reqs);
-        return virtscsi_queuecommand(vscsi, &vscsi->req_vqs[0], sc);
-}
-
-static struct virtio_scsi_vq *virtscsi_pick_vq_mq(struct virtio_scsi *vscsi,
-                                                  struct scsi_cmnd *sc)
-{
-        u32 tag = blk_mq_unique_tag(sc->request);
-        u16 hwq = blk_mq_unique_tag_to_hwq(tag);
-
-        return &vscsi->req_vqs[hwq];
-}
-
-static struct virtio_scsi_vq *virtscsi_pick_vq(struct virtio_scsi *vscsi,
-                                               struct virtio_scsi_target_state *tgt)
-{
-        struct virtio_scsi_vq *vq;
-        unsigned long flags;
-        u32 queue_num;
-
-        local_irq_save(flags);
-        if (atomic_inc_return(&tgt->reqs) > 1) {
-                unsigned long seq;
-
-                do {
-                        seq = read_seqcount_begin(&tgt->tgt_seq);
-                        vq = tgt->req_vq;
-                } while (read_seqcount_retry(&tgt->tgt_seq, seq));
-        } else {
-                /* no writes can be concurrent because of atomic_t */
-                write_seqcount_begin(&tgt->tgt_seq);
-
-                /* keep previous req_vq if a reader just arrived */
-                if (unlikely(atomic_read(&tgt->reqs) > 1)) {
-                        vq = tgt->req_vq;
-                        goto unlock;
-                }
-
-                queue_num = smp_processor_id();
-                while (unlikely(queue_num >= vscsi->num_queues))
-                        queue_num -= vscsi->num_queues;
-                tgt->req_vq = vq = &vscsi->req_vqs[queue_num];
- unlock:
-                write_seqcount_end(&tgt->tgt_seq);
-        }
-        local_irq_restore(flags);
-
-        return vq;
-}
-
-static int virtscsi_queuecommand_multi(struct Scsi_Host *sh,
-                                       struct scsi_cmnd *sc)
-{
-        struct virtio_scsi *vscsi = shost_priv(sh);
-        struct virtio_scsi_target_state *tgt =
-                                scsi_target(sc->device)->hostdata;
-        struct virtio_scsi_vq *req_vq;
-
-        if (shost_use_blk_mq(sh))
-                req_vq = virtscsi_pick_vq_mq(vscsi, sc);
-        else
-                req_vq = virtscsi_pick_vq(vscsi, tgt);
-
-        return virtscsi_queuecommand(vscsi, req_vq, sc);
-}
-
 static int virtscsi_tmf(struct virtio_scsi *vscsi, struct virtio_scsi_cmd *cmd)
 {
         DECLARE_COMPLETION_ONSTACK(comp);
@@ -775,7 +704,6 @@ static int virtscsi_target_alloc(struct scsi_target *starget)
                 return -ENOMEM;
 
         seqcount_init(&tgt->tgt_seq);
-        atomic_set(&tgt->reqs, 0);
         tgt->req_vq = &vscsi->req_vqs[0];
 
         starget->hostdata = tgt;
@@ -805,33 +733,13 @@ static enum blk_eh_timer_return virtscsi_eh_timed_out(struct scsi_cmnd *scmnd)
         return BLK_EH_RESET_TIMER;
 }
 
-static struct scsi_host_template virtscsi_host_template_single = {
-        .module = THIS_MODULE,
-        .name = "Virtio SCSI HBA",
-        .proc_name = "virtio_scsi",
-        .this_id = -1,
-        .cmd_size = sizeof(struct virtio_scsi_cmd),
-        .queuecommand = virtscsi_queuecommand_single,
-        .change_queue_depth = virtscsi_change_queue_depth,
-        .eh_abort_handler = virtscsi_abort,
-        .eh_device_reset_handler = virtscsi_device_reset,
-        .eh_timed_out = virtscsi_eh_timed_out,
-        .slave_alloc = virtscsi_device_alloc,
-
-        .dma_boundary = UINT_MAX,
-        .use_clustering = ENABLE_CLUSTERING,
-        .target_alloc = virtscsi_target_alloc,
-        .target_destroy = virtscsi_target_destroy,
-        .track_queue_depth = 1,
-};
-
-static struct scsi_host_template virtscsi_host_template_multi = {
+static struct scsi_host_template virtscsi_host_template = {
         .module = THIS_MODULE,
         .name = "Virtio SCSI HBA",
         .proc_name = "virtio_scsi",
         .this_id = -1,
         .cmd_size = sizeof(struct virtio_scsi_cmd),
-        .queuecommand = virtscsi_queuecommand_multi,
+        .queuecommand = virtscsi_queuecommand,
         .change_queue_depth = virtscsi_change_queue_depth,
         .eh_abort_handler = virtscsi_abort,
         .eh_device_reset_handler = virtscsi_device_reset,
@@ -844,6 +752,7 @@ static struct scsi_host_template virtscsi_host_template_multi = {
         .target_destroy = virtscsi_target_destroy,
         .map_queues = virtscsi_map_queues,
         .track_queue_depth = 1,
+        .force_blk_mq = 1,
 };
 
 #define virtscsi_config_get(vdev, fld) \
@@ -936,7 +845,6 @@ static int virtscsi_probe(struct virtio_device *vdev)
         u32 sg_elems, num_targets;
         u32 cmd_per_lun;
         u32 num_queues;
-        struct scsi_host_template *hostt;
 
         if (!vdev->config->get) {
                 dev_err(&vdev->dev, "%s failure: config access disabled\n",
@@ -949,12 +857,7 @@ static int virtscsi_probe(struct virtio_device *vdev)
 
         num_targets = virtscsi_config_get(vdev, max_target) + 1;
 
-        if (num_queues == 1)
-                hostt = &virtscsi_host_template_single;
-        else
-                hostt = &virtscsi_host_template_multi;
-
-        shost = scsi_host_alloc(hostt,
+        shost = scsi_host_alloc(&virtscsi_host_template,
                 sizeof(*vscsi) + sizeof(vscsi->req_vqs[0]) * num_queues);
         if (!shost)
                 return -ENOMEM;
diff --git a/drivers/staging/ncpfs/ncplib_kernel.c b/drivers/staging/ncpfs/ncplib_kernel.c
index 804adfebba2f..3e047eb4cc7c 100644
--- a/drivers/staging/ncpfs/ncplib_kernel.c
+++ b/drivers/staging/ncpfs/ncplib_kernel.c
@@ -981,6 +981,10 @@ ncp_read_kernel(struct ncp_server *server, const char *file_id,
                 goto out;
         }
         *bytes_read = ncp_reply_be16(server, 0);
+        if (*bytes_read > to_read) {
+                result = -EINVAL;
+                goto out;
+        }
         source = ncp_reply_data(server, 2 + (offset & 1));
 
         memcpy(target, source, *bytes_read);
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 88b902c525d7..b4e57c5a8bba 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1727,7 +1727,7 @@ static void reset_terminal(struct vc_data *vc, int do_clear)
         default_attr(vc);
         update_attr(vc);
 
-        vc->vc_tab_stop[0]      = 0x01010100;
+        vc->vc_tab_stop[0]      =
         vc->vc_tab_stop[1]      =
         vc->vc_tab_stop[2]      =
         vc->vc_tab_stop[3]      =
@@ -1771,7 +1771,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
                 vc->vc_pos -= (vc->vc_x << 1);
                 while (vc->vc_x < vc->vc_cols - 1) {
                         vc->vc_x++;
-                        if (vc->vc_tab_stop[vc->vc_x >> 5] & (1 << (vc->vc_x & 31)))
+                        if (vc->vc_tab_stop[7 & (vc->vc_x >> 5)] & (1 << (vc->vc_x & 31)))
                                 break;
                 }
                 vc->vc_pos += (vc->vc_x << 1);
@@ -1831,7 +1831,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
                         lf(vc);
                         return;
                 case 'H':
-                        vc->vc_tab_stop[vc->vc_x >> 5] |= (1 << (vc->vc_x & 31));
+                        vc->vc_tab_stop[7 & (vc->vc_x >> 5)] |= (1 << (vc->vc_x & 31));
                         return;
                 case 'Z':
                         respond_ID(tty);
@@ -2024,7 +2024,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
                         return;
                 case 'g':
                         if (!vc->vc_par[0])
-                                vc->vc_tab_stop[vc->vc_x >> 5] &= ~(1 << (vc->vc_x & 31));
+                                vc->vc_tab_stop[7 & (vc->vc_x >> 5)] &= ~(1 << (vc->vc_x & 31));
                         else if (vc->vc_par[0] == 3) {
                                 vc->vc_tab_stop[0] =
                                         vc->vc_tab_stop[1] =
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index b0f759476900..8a1508a8e481 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -207,9 +207,6 @@ static bool vfio_pci_nointx(struct pci_dev *pdev)
                 }
         }
 
-        if (!pdev->irq)
-                return true;
-
         return false;
 }
 
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index a31d9b240af8..edc6fec9ad84 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -630,7 +630,7 @@ static int vhost_net_rx_peek_head_len(struct vhost_net *net, struct sock *sk)
 
         if (!len && vq->busyloop_timeout) {
                 /* Both tx vq and rx socket were polled here */
-                mutex_lock(&vq->mutex);
+                mutex_lock_nested(&vq->mutex, 1);
                 vhost_disable_notify(&net->dev, vq);
 
                 preempt_disable();
@@ -763,7 +763,7 @@ static void handle_rx(struct vhost_net *net)
         struct iov_iter fixup;
         __virtio16 num_buffers;
 
-        mutex_lock(&vq->mutex);
+        mutex_lock_nested(&vq->mutex, 0);
         sock = vq->private_data;
         if (!sock)
                 goto out;
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 1b3e8d2d5c8b..5320039671b7 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -212,8 +212,7 @@ int vhost_poll_start(struct vhost_poll *poll, struct file *file)
         if (mask)
                 vhost_poll_wakeup(&poll->wait, 0, 0, poll_to_key(mask));
         if (mask & EPOLLERR) {
-                if (poll->wqh)
-                        remove_wait_queue(poll->wqh, &poll->wait);
+                vhost_poll_stop(poll);
                 ret = -EINVAL;
         }
 
@@ -1245,14 +1244,12 @@ static int vq_log_access_ok(struct vhost_virtqueue *vq,
 /* Caller should have vq mutex and device mutex */
 int vhost_vq_access_ok(struct vhost_virtqueue *vq)
 {
-        if (vq->iotlb) {
-                /* When device IOTLB was used, the access validation
-                 * will be validated during prefetching.
-                 */
-                return 1;
-        }
-        return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used) &&
-                vq_log_access_ok(vq, vq->log_base);
+        int ret = vq_log_access_ok(vq, vq->log_base);
+
+        if (ret || vq->iotlb)
+                return ret;
+
+        return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used);
 }
 EXPORT_SYMBOL_GPL(vhost_vq_access_ok);
 
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 6639926eed4e..b67eec3532a1 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -640,7 +640,8 @@ static ssize_t ceph_sync_read(struct kiocb *iocb, struct iov_iter *to,
 struct ceph_aio_request {
         struct kiocb *iocb;
         size_t total_len;
-        int write;
+        bool write;
+        bool should_dirty;
         int error;
         struct list_head osd_reqs;
         unsigned num_reqs;
@@ -750,7 +751,7 @@ static void ceph_aio_complete_req(struct ceph_osd_request *req)
                 }
         }
 
-        ceph_put_page_vector(osd_data->pages, num_pages, !aio_req->write);
+        ceph_put_page_vector(osd_data->pages, num_pages, aio_req->should_dirty);
         ceph_osdc_put_request(req);
 
         if (rc < 0)
@@ -847,6 +848,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter,
         size_t count = iov_iter_count(iter);
         loff_t pos = iocb->ki_pos;
         bool write = iov_iter_rw(iter) == WRITE;
+        bool should_dirty = !write && iter_is_iovec(iter);
 
         if (write && ceph_snap(file_inode(file)) != CEPH_NOSNAP)
                 return -EROFS;
@@ -914,6 +916,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter,
                         if (aio_req) {
                                 aio_req->iocb = iocb;
                                 aio_req->write = write;
+                                aio_req->should_dirty = should_dirty;
                                 INIT_LIST_HEAD(&aio_req->osd_reqs);
                                 if (write) {
                                         aio_req->mtime = mtime;
@@ -971,7 +974,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter,
                                 len = ret;
                 }
 
-                ceph_put_page_vector(pages, num_pages, !write);
+                ceph_put_page_vector(pages, num_pages, should_dirty);
 
                 ceph_osdc_put_request(req);
                 if (ret < 0)
diff --git a/include/linux/fsl_ifc.h b/include/linux/fsl_ifc.h
index c332f0a45607..3fdfede2f0f3 100644
--- a/include/linux/fsl_ifc.h
+++ b/include/linux/fsl_ifc.h
@@ -734,11 +734,7 @@ struct fsl_ifc_nand {
         u32 res19[0x10];
         __be32 nand_fsr;
         u32 res20;
-        /* The V1 nand_eccstat is actually 4 words that overlaps the
-         * V2 nand_eccstat.
-         */
-        __be32 v1_nand_eccstat[2];
-        __be32 v2_nand_eccstat[6];
+        __be32 nand_eccstat[8];
         u32 res21[0x1c];
         __be32 nanndcr;
         u32 res22[0x2];
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 24d1976c1e61..d11f41d5269f 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -347,13 +347,24 @@ static inline int __vlan_insert_inner_tag(struct sk_buff *skb,
         skb_push(skb, VLAN_HLEN);
 
         /* Move the mac header sans proto to the beginning of the new header. */
-        memmove(skb->data, skb->data + VLAN_HLEN, mac_len - ETH_TLEN);
+        if (likely(mac_len > ETH_TLEN))
+                memmove(skb->data, skb->data + VLAN_HLEN, mac_len - ETH_TLEN);
         skb->mac_header -= VLAN_HLEN;
 
         veth = (struct vlan_ethhdr *)(skb->data + mac_len - ETH_HLEN);
 
         /* first, the ethernet type */
-        veth->h_vlan_proto = vlan_proto;
+        if (likely(mac_len >= ETH_TLEN)) {
+                /* h_vlan_encapsulated_proto should already be populated, and
+                 * skb->data has space for h_vlan_proto
+                 */
+                veth->h_vlan_proto = vlan_proto;
+        } else {
+                /* h_vlan_encapsulated_proto should not be populated, and
+                 * skb->data has no space for h_vlan_proto
+                 */
+                veth->h_vlan_encapsulated_proto = skb->protocol;
+        }
 
         /* now, the TCI */
         veth->h_vlan_TCI = htons(vlan_tci);
diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
index 2168cc6b8b30..b46b541c67c4 100644
--- a/include/linux/jump_label.h
+++ b/include/linux/jump_label.h
@@ -151,7 +151,7 @@ extern struct jump_entry __start___jump_table[];
 extern struct jump_entry __stop___jump_table[];
 
 extern void jump_label_init(void);
-extern void jump_label_invalidate_init(void);
+extern void jump_label_invalidate_initmem(void);
 extern void jump_label_lock(void);
 extern void jump_label_unlock(void);
 extern void arch_jump_label_transform(struct jump_entry *entry,
@@ -199,7 +199,7 @@ static __always_inline void jump_label_init(void)
         static_key_initialized = true;
 }
 
-static inline void jump_label_invalidate_init(void) {}
+static inline void jump_label_invalidate_initmem(void) {}
 
 static __always_inline bool static_key_false(struct static_key *key)
 {
diff --git a/include/linux/net_dim.h b/include/linux/net_dim.h
index bebeaad897cc..29ed8fd6379a 100644
--- a/include/linux/net_dim.h
+++ b/include/linux/net_dim.h
@@ -231,7 +231,7 @@ static inline void net_dim_exit_parking(struct net_dim *dim)
 }
 
 #define IS_SIGNIFICANT_DIFF(val, ref) \
-        (((100 * abs((val) - (ref))) / (ref)) > 10) /* more than 10% difference */
+        (((100UL * abs((val) - (ref))) / (ref)) > 10) /* more than 10% difference */
 
 static inline int net_dim_stats_compare(struct net_dim_stats *curr,
                                         struct net_dim_stats *prev)
diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h
index fe994d2e5286..5c40f118c0fa 100644
--- a/include/net/llc_conn.h
+++ b/include/net/llc_conn.h
@@ -103,7 +103,7 @@ void llc_sk_reset(struct sock *sk);
 
 /* Access to a connection */
 int llc_conn_state_process(struct sock *sk, struct sk_buff *skb);
-void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb);
+int llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb);
 void llc_conn_rtn_pdu(struct sock *sk, struct sk_buff *skb);
 void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit);
 void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit);
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index bd2a18d66189..cd368d1b8cb8 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1072,6 +1072,8 @@ struct nft_object_ops {
 int nft_register_obj(struct nft_object_type *obj_type);
 void nft_unregister_obj(struct nft_object_type *obj_type);
 
+#define NFT_FLOWTABLE_DEVICE_MAX        8
+
 /**
  *      struct nft_flowtable - nf_tables flow table
  *
@@ -1084,6 +1086,7 @@ void nft_unregister_obj(struct nft_object_type *obj_type);
  *      @genmask: generation mask
  *      @use: number of references to this flow table
  *      @handle: unique object handle
+ *      @dev_name: array of device names
  *      @data: rhashtable and garbage collector
  *      @ops: array of hooks
  */
@@ -1097,6 +1100,7 @@ struct nft_flowtable {
         u32                             genmask:2,
                                         use:30;
         u64                             handle;
+        char                            *dev_name[NFT_FLOWTABLE_DEVICE_MAX];
         /* runtime data below here */
         struct nf_hook_ops              *ops ____cacheline_aligned;
         struct nf_flowtable             data;
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 493e311bbe93..5154c8300262 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -30,6 +30,7 @@ struct qdisc_rate_table {
 enum qdisc_state_t {
         __QDISC_STATE_SCHED,
         __QDISC_STATE_DEACTIVATED,
+        __QDISC_STATE_RUNNING,
 };
 
 struct qdisc_size_table {
diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h
index d656809f1217..415e09960017 100644
--- a/include/rdma/ib_addr.h
+++ b/include/rdma/ib_addr.h
@@ -130,6 +130,8 @@ void rdma_copy_addr(struct rdma_dev_addr *dev_addr,
                     const unsigned char *dst_dev_addr);
 
 int rdma_addr_size(struct sockaddr *addr);
+int rdma_addr_size_in6(struct sockaddr_in6 *addr);
+int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr);
 
 int rdma_addr_find_l2_eth_by_grh(const union ib_gid *sgid,
                                  const union ib_gid *dgid,
diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
index a8b7bf879ced..9c1e4bad6581 100644
--- a/include/scsi/scsi_host.h
+++ b/include/scsi/scsi_host.h
@@ -452,6 +452,9 @@ struct scsi_host_template {
         /* True if the controller does not support WRITE SAME */
         unsigned no_write_same:1;
 
+        /* True if the low-level driver supports blk-mq only */
+        unsigned force_blk_mq:1;
+
         /*
          * Countdown for host blocking with no commands outstanding.
          */
diff --git a/include/uapi/linux/lirc.h b/include/uapi/linux/lirc.h
index 4fe580d36e41..f5bf06ecd87d 100644
--- a/include/uapi/linux/lirc.h
+++ b/include/uapi/linux/lirc.h
@@ -54,7 +54,6 @@
 #define LIRC_CAN_SEND_RAW              LIRC_MODE2SEND(LIRC_MODE_RAW)
 #define LIRC_CAN_SEND_PULSE            LIRC_MODE2SEND(LIRC_MODE_PULSE)
 #define LIRC_CAN_SEND_MODE2            LIRC_MODE2SEND(LIRC_MODE_MODE2)
-#define LIRC_CAN_SEND_SCANCODE         LIRC_MODE2SEND(LIRC_MODE_SCANCODE)
 #define LIRC_CAN_SEND_LIRCCODE         LIRC_MODE2SEND(LIRC_MODE_LIRCCODE)
 
 #define LIRC_CAN_SEND_MASK             0x0000003f
diff --git a/include/uapi/linux/usb/audio.h b/include/uapi/linux/usb/audio.h
index 17a022c5b414..da3315ed1bcd 100644
--- a/include/uapi/linux/usb/audio.h
+++ b/include/uapi/linux/usb/audio.h
@@ -370,7 +370,7 @@ static inline __u8 uac_processing_unit_bControlSize(struct uac_processing_unit_d
 {
         return (protocol == UAC_VERSION_1) ?
                 desc->baSourceID[desc->bNrInPins + 4] :
-                desc->baSourceID[desc->bNrInPins + 6];
+                2; /* in UAC2, this value is constant */
 }
 
 static inline __u8 *uac_processing_unit_bmControls(struct uac_processing_unit_descriptor *desc,
@@ -378,7 +378,7 @@ static inline __u8 *uac_processing_unit_bmControls(struct uac_processing_unit_de
 {
         return (protocol == UAC_VERSION_1) ?
                 &desc->baSourceID[desc->bNrInPins + 5] :
-                &desc->baSourceID[desc->bNrInPins + 7];
+                &desc->baSourceID[desc->bNrInPins + 6];
 }
 
 static inline __u8 uac_processing_unit_iProcessing(struct uac_processing_unit_descriptor *desc,
diff --git a/init/main.c b/init/main.c
index 969eaf140ef0..21efbf6ace93 100644
--- a/init/main.c
+++ b/init/main.c
@@ -1001,7 +1001,7 @@ static int __ref kernel_init(void *unused)
         /* need to finish all async __init code before freeing the memory */
         async_synchronize_full();
         ftrace_free_init_mem();
-        jump_label_invalidate_init();
+        jump_label_invalidate_initmem();
         free_initmem();
         mark_readonly();
         system_state = SYSTEM_RUNNING;
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index d7f309f74dec..a808f29d4c5a 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -325,9 +325,8 @@ err:
 static int mqueue_fill_super(struct super_block *sb, void *data, int silent)
 {
         struct inode *inode;
-        struct ipc_namespace *ns = data;
+        struct ipc_namespace *ns = sb->s_fs_info;
 
-        sb->s_fs_info = ns;
         sb->s_iflags |= SB_I_NOEXEC | SB_I_NODEV;
         sb->s_blocksize = PAGE_SIZE;
         sb->s_blocksize_bits = PAGE_SHIFT;
@@ -344,44 +343,18 @@ static int mqueue_fill_super(struct super_block *sb, void *data, int silent)
         return 0;
 }
 
-static struct file_system_type mqueue_fs_type;
-/*
- * Return value is pinned only by reference in ->mq_mnt; it will
- * live until ipcns dies.  Caller does not need to drop it.
- */
-static struct vfsmount *mq_internal_mount(void)
-{
-        struct ipc_namespace *ns = current->nsproxy->ipc_ns;
-        struct vfsmount *m = ns->mq_mnt;
-        if (m)
-                return m;
-        m = kern_mount_data(&mqueue_fs_type, ns);
-        spin_lock(&mq_lock);
-        if (unlikely(ns->mq_mnt)) {
-                spin_unlock(&mq_lock);
-                if (!IS_ERR(m))
-                        kern_unmount(m);
-                return ns->mq_mnt;
-        }
-        if (!IS_ERR(m))
-                ns->mq_mnt = m;
-        spin_unlock(&mq_lock);
-        return m;
-}
-
 static struct dentry *mqueue_mount(struct file_system_type *fs_type,
                          int flags, const char *dev_name,
                          void *data)
 {
-        struct vfsmount *m;
-        if (flags & SB_KERNMOUNT)
-                return mount_nodev(fs_type, flags, data, mqueue_fill_super);
-        m = mq_internal_mount();
-        if (IS_ERR(m))
-                return ERR_CAST(m);
-        atomic_inc(&m->mnt_sb->s_active);
-        down_write(&m->mnt_sb->s_umount);
-        return dget(m->mnt_root);
+        struct ipc_namespace *ns;
+        if (flags & SB_KERNMOUNT) {
+                ns = data;
+                data = NULL;
+        } else {
+                ns = current->nsproxy->ipc_ns;
+        }
+        return mount_ns(fs_type, flags, data, ns, ns->user_ns, mqueue_fill_super);
 }
 
 static void init_once(void *foo)
@@ -771,16 +744,13 @@ static int prepare_open(struct dentry *dentry, int oflag, int ro,
 static int do_mq_open(const char __user *u_name, int oflag, umode_t mode,
                       struct mq_attr *attr)
 {
-        struct vfsmount *mnt = mq_internal_mount();
-        struct dentry *root;
+        struct vfsmount *mnt = current->nsproxy->ipc_ns->mq_mnt;
+        struct dentry *root = mnt->mnt_root;
         struct filename *name;
         struct path path;
         int fd, error;
         int ro;
 
-        if (IS_ERR(mnt))
-                return PTR_ERR(mnt);
-
         audit_mq_open(oflag, mode, attr);
 
         if (IS_ERR(name = getname(u_name)))
@@ -791,7 +761,6 @@ static int do_mq_open(const char __user *u_name, int oflag, umode_t mode,
                 goto out_putname;
 
         ro = mnt_want_write(mnt);       /* we'll drop it in any case */
-        root = mnt->mnt_root;
         inode_lock(d_inode(root));
         path.dentry = lookup_one_len(name->name, root, strlen(name->name));
         if (IS_ERR(path.dentry)) {
@@ -840,9 +809,6 @@ SYSCALL_DEFINE1(mq_unlink, const char __user *, u_name)
         struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
         struct vfsmount *mnt = ipc_ns->mq_mnt;
 
-        if (!mnt)
-                return -ENOENT;
-
         name = getname(u_name);
         if (IS_ERR(name))
                 return PTR_ERR(name);
@@ -1569,26 +1535,28 @@ int mq_init_ns(struct ipc_namespace *ns)
         ns->mq_msgsize_max   = DFLT_MSGSIZEMAX;
         ns->mq_msg_default   = DFLT_MSG;
         ns->mq_msgsize_default  = DFLT_MSGSIZE;
-        ns->mq_mnt = NULL;
 
+        ns->mq_mnt = kern_mount_data(&mqueue_fs_type, ns);
+        if (IS_ERR(ns->mq_mnt)) {
+                int err = PTR_ERR(ns->mq_mnt);
+                ns->mq_mnt = NULL;
+                return err;
+        }
         return 0;
 }
 
 void mq_clear_sbinfo(struct ipc_namespace *ns)
 {
-        if (ns->mq_mnt)
-                ns->mq_mnt->mnt_sb->s_fs_info = NULL;
+        ns->mq_mnt->mnt_sb->s_fs_info = NULL;
 }
 
 void mq_put_mnt(struct ipc_namespace *ns)
 {
-        if (ns->mq_mnt)
-                kern_unmount(ns->mq_mnt);
+        kern_unmount(ns->mq_mnt);
 }
 
 static int __init init_mqueue_fs(void)
 {
-        struct vfsmount *m;
         int error;
 
         mqueue_inode_cachep = kmem_cache_create("mqueue_inode_cache",
@@ -1610,10 +1578,6 @@ static int __init init_mqueue_fs(void)
         if (error)
                 goto out_filesystem;
 
-        m = kern_mount_data(&mqueue_fs_type, &init_ipc_ns);
-        if (IS_ERR(m))
-                goto out_filesystem;
-        init_ipc_ns.mq_mnt = m;
         return 0;
 
 out_filesystem:
diff --git a/ipc/shm.c b/ipc/shm.c
index 4643865e9171..93e0e3a4d009 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -386,6 +386,17 @@ static int shm_fault(struct vm_fault *vmf)
         return sfd->vm_ops->fault(vmf);
 }
 
+static int shm_split(struct vm_area_struct *vma, unsigned long addr)
+{
+        struct file *file = vma->vm_file;
+        struct shm_file_data *sfd = shm_file_data(file);
+
+        if (sfd->vm_ops && sfd->vm_ops->split)
+                return sfd->vm_ops->split(vma, addr);
+
+        return 0;
+}
+
 #ifdef CONFIG_NUMA
 static int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new)
 {
@@ -510,6 +521,7 @@ static const struct vm_operations_struct shm_vm_ops = {
         .open   = shm_open,     /* callback for a new vm-area open */
         .close  = shm_close,    /* callback for when the vm-area is released */
         .fault  = shm_fault,
+        .split  = shm_split,
 #if defined(CONFIG_NUMA)
         .set_policy = shm_set_policy,
         .get_policy = shm_get_policy,
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 4b838470fac4..709a55b9ad97 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -724,9 +724,15 @@ static inline void __update_cgrp_time(struct perf_cgroup *cgrp)
 
 static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx)
 {
-        struct perf_cgroup *cgrp_out = cpuctx->cgrp;
-        if (cgrp_out)
-                __update_cgrp_time(cgrp_out);
+        struct perf_cgroup *cgrp = cpuctx->cgrp;
+        struct cgroup_subsys_state *css;
+
+        if (cgrp) {
+                for (css = &cgrp->css; css; css = css->parent) {
+                        cgrp = container_of(css, struct perf_cgroup, css);
+                        __update_cgrp_time(cgrp);
+                }
+        }
 }
 
 static inline void update_cgrp_time_from_event(struct perf_event *event)
@@ -754,6 +760,7 @@ perf_cgroup_set_timestamp(struct task_struct *task,
 {
         struct perf_cgroup *cgrp;
         struct perf_cgroup_info *info;
+        struct cgroup_subsys_state *css;
 
         /*
          * ctx->lock held by caller
@@ -764,8 +771,12 @@ perf_cgroup_set_timestamp(struct task_struct *task,
                 return;
 
         cgrp = perf_cgroup_from_task(task, ctx);
-        info = this_cpu_ptr(cgrp->info);
-        info->timestamp = ctx->timestamp;
+
+        for (css = &cgrp->css; css; css = css->parent) {
+                cgrp = container_of(css, struct perf_cgroup, css);
+                info = this_cpu_ptr(cgrp->info);
+                info->timestamp = ctx->timestamp;
+        }
 }
 
 static DEFINE_PER_CPU(struct list_head, cgrp_cpuctx_list);
diff --git a/kernel/jump_label.c b/kernel/jump_label.c
index e7214093dcd1..01ebdf1f9f40 100644
--- a/kernel/jump_label.c
+++ b/kernel/jump_label.c
@@ -16,6 +16,7 @@
 #include <linux/jump_label_ratelimit.h>
 #include <linux/bug.h>
 #include <linux/cpu.h>
+#include <asm/sections.h>
 
 #ifdef HAVE_JUMP_LABEL
 
@@ -421,15 +422,15 @@ void __init jump_label_init(void)
         cpus_read_unlock();
 }
 
-/* Disable any jump label entries in __init code */
-void __init jump_label_invalidate_init(void)
+/* Disable any jump label entries in __init/__exit code */
+void __init jump_label_invalidate_initmem(void)
 {
         struct jump_entry *iter_start = __start___jump_table;
         struct jump_entry *iter_stop = __stop___jump_table;
         struct jump_entry *iter;
 
         for (iter = iter_start; iter < iter_stop; iter++) {
-                if (init_kernel_text(iter->code))
+                if (init_section_contains((void *)(unsigned long)iter->code, 1))
                         iter->code = 0;
         }
 }
diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
index 858a07590e39..2048359f33d2 100644
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -1082,15 +1082,16 @@ static noinline int __sched
 __mutex_lock_interruptible_slowpath(struct mutex *lock);
 
 /**
- * mutex_lock_interruptible - acquire the mutex, interruptible
- * @lock: the mutex to be acquired
+ * mutex_lock_interruptible() - Acquire the mutex, interruptible by signals.
+ * @lock: The mutex to be acquired.
  *
- * Lock the mutex like mutex_lock(), and return 0 if the mutex has
- * been acquired or sleep until the mutex becomes available. If a
- * signal arrives while waiting for the lock then this function
- * returns -EINTR.
+ * Lock the mutex like mutex_lock().  If a signal is delivered while the
+ * process is sleeping, this function will return without acquiring the
+ * mutex.
  *
- * This function is similar to (but not equivalent to) down_interruptible().
+ * Context: Process context.
+ * Return: 0 if the lock was successfully acquired or %-EINTR if a
+ * signal arrived.
  */
 int __sched mutex_lock_interruptible(struct mutex *lock)
 {
@@ -1104,6 +1105,18 @@ int __sched mutex_lock_interruptible(struct mutex *lock)
 
 EXPORT_SYMBOL(mutex_lock_interruptible);
 
+/**
+ * mutex_lock_killable() - Acquire the mutex, interruptible by fatal signals.
+ * @lock: The mutex to be acquired.
+ *
+ * Lock the mutex like mutex_lock().  If a signal which will be fatal to
+ * the current process is delivered while the process is sleeping, this
+ * function will return without acquiring the mutex.
+ *
+ * Context: Process context.
+ * Return: 0 if the lock was successfully acquired or %-EINTR if a
+ * fatal signal arrived.
+ */
 int __sched mutex_lock_killable(struct mutex *lock)
 {
         might_sleep();
@@ -1115,6 +1128,16 @@ int __sched mutex_lock_killable(struct mutex *lock)
 }
 EXPORT_SYMBOL(mutex_lock_killable);
 
+/**
+ * mutex_lock_io() - Acquire the mutex and mark the process as waiting for I/O
+ * @lock: The mutex to be acquired.
+ *
+ * Lock the mutex like mutex_lock().  While the task is waiting for this
+ * mutex, it will be accounted as being in the IO wait state by the
+ * scheduler.
+ *
+ * Context: Process context.
+ */
 void __sched mutex_lock_io(struct mutex *lock)
 {
         int token;
diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index 1ca0130ed4f9..72c401b3b15c 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -32,7 +32,7 @@ static DEFINE_SPINLOCK(sched_debug_lock);
         if (m)                                  \
                 seq_printf(m, x);               \
         else                                    \
-                printk(x);                      \
+                pr_cont(x);                     \
  } while (0)
 
 /*
@@ -501,12 +501,12 @@ static void print_rq(struct seq_file *m, struct rq *rq, int rq_cpu)
 {
         struct task_struct *g, *p;
 
-        SEQ_printf(m,
-        "\nrunnable tasks:\n"
-        " S           task   PID         tree-key  switches  prio"
-        "     wait-time             sum-exec        sum-sleep\n"
-        "-------------------------------------------------------"
-        "----------------------------------------------------\n");
+        SEQ_printf(m, "\n");
+        SEQ_printf(m, "runnable tasks:\n");
+        SEQ_printf(m, " S           task   PID         tree-key  switches  prio"
+                   "     wait-time             sum-exec        sum-sleep\n");
+        SEQ_printf(m, "-------------------------------------------------------"
+                   "----------------------------------------------------\n");
 
         rcu_read_lock();
         for_each_process_thread(g, p) {
@@ -527,9 +527,11 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
         unsigned long flags;
 
 #ifdef CONFIG_FAIR_GROUP_SCHED
-        SEQ_printf(m, "\ncfs_rq[%d]:%s\n", cpu, task_group_path(cfs_rq->tg));
+        SEQ_printf(m, "\n");
+        SEQ_printf(m, "cfs_rq[%d]:%s\n", cpu, task_group_path(cfs_rq->tg));
 #else
-        SEQ_printf(m, "\ncfs_rq[%d]:\n", cpu);
+        SEQ_printf(m, "\n");
+        SEQ_printf(m, "cfs_rq[%d]:\n", cpu);
 #endif
         SEQ_printf(m, "  .%-30s: %Ld.%06ld\n", "exec_clock",
                         SPLIT_NS(cfs_rq->exec_clock));
@@ -595,9 +597,11 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
 void print_rt_rq(struct seq_file *m, int cpu, struct rt_rq *rt_rq)
 {
 #ifdef CONFIG_RT_GROUP_SCHED
-        SEQ_printf(m, "\nrt_rq[%d]:%s\n", cpu, task_group_path(rt_rq->tg));
+        SEQ_printf(m, "\n");
+        SEQ_printf(m, "rt_rq[%d]:%s\n", cpu, task_group_path(rt_rq->tg));
 #else
-        SEQ_printf(m, "\nrt_rq[%d]:\n", cpu);
+        SEQ_printf(m, "\n");
+        SEQ_printf(m, "rt_rq[%d]:\n", cpu);
 #endif
 
 #define P(x) \
@@ -624,7 +628,8 @@ void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq)
 {
         struct dl_bw *dl_bw;
 
-        SEQ_printf(m, "\ndl_rq[%d]:\n", cpu);
+        SEQ_printf(m, "\n");
+        SEQ_printf(m, "dl_rq[%d]:\n", cpu);
 
 #define PU(x) \
         SEQ_printf(m, "  .%-30s: %lu\n", #x, (unsigned long)(dl_rq->x))
diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index 75043046914e..10b7186d0638 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -50,6 +50,7 @@
 #include <linux/export.h>
 #include <linux/hashtable.h>
 #include <linux/compat.h>
+#include <linux/nospec.h>
 
 #include "timekeeping.h"
 #include "posix-timers.h"
@@ -1346,11 +1347,15 @@ static const struct k_clock * const posix_clocks[] = {
 
 static const struct k_clock *clockid_to_kclock(const clockid_t id)
 {
-        if (id < 0)
+        clockid_t idx = id;
+
+        if (id < 0) {
                 return (id & CLOCKFD_MASK) == CLOCKFD ?
                         &clock_posix_dynamic : &clock_posix_cpu;
+        }
 
-        if (id >= ARRAY_SIZE(posix_clocks) || !posix_clocks[id])
+        if (id >= ARRAY_SIZE(posix_clocks))
                 return NULL;
-        return posix_clocks[id];
+
+        return posix_clocks[array_index_nospec(idx, ARRAY_SIZE(posix_clocks))];
 }
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 1fad24acd444..ae4147eaebd4 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -659,7 +659,7 @@ static int create_trace_kprobe(int argc, char **argv)
         char *symbol = NULL, *event = NULL, *group = NULL;
         int maxactive = 0;
         char *arg;
-        unsigned long offset = 0;
+        long offset = 0;
         void *addr = NULL;
         char buf[MAX_EVENT_NAME_LEN];
 
@@ -747,7 +747,7 @@ static int create_trace_kprobe(int argc, char **argv)
                 symbol = argv[1];
                 /* TODO: support .init module functions */
                 ret = traceprobe_split_symbol_offset(symbol, &offset);
-                if (ret) {
+                if (ret || offset < 0 || offset > UINT_MAX) {
                         pr_info("Failed to parse either an address or a symbol.\n");
                         return ret;
                 }
diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
index d59357308677..daf54bda4dc8 100644
--- a/kernel/trace/trace_probe.c
+++ b/kernel/trace/trace_probe.c
@@ -320,7 +320,7 @@ static fetch_func_t get_fetch_size_function(const struct fetch_type *type,
 }
 
 /* Split symbol and offset. */
-int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset)
+int traceprobe_split_symbol_offset(char *symbol, long *offset)
 {
         char *tmp;
         int ret;
@@ -328,13 +328,11 @@ int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset)
         if (!offset)
                 return -EINVAL;
 
-        tmp = strchr(symbol, '+');
+        tmp = strpbrk(symbol, "+-");
         if (tmp) {
-                /* skip sign because kstrtoul doesn't accept '+' */
-                ret = kstrtoul(tmp + 1, 0, offset);
+                ret = kstrtol(tmp, 0, offset);
                 if (ret)
                         return ret;
-
                 *tmp = '\0';
         } else
                 *offset = 0;
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index e101c5bb9eda..6a4d3fa94042 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -365,7 +365,7 @@ extern int traceprobe_conflict_field_name(const char *name,
 extern void traceprobe_update_arg(struct probe_arg *arg);
 extern void traceprobe_free_probe_arg(struct probe_arg *arg);
 
-extern int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset);
+extern int traceprobe_split_symbol_offset(char *symbol, long *offset);
 
 /* Sum up total data length for dynamic arraies (strings) */
 static nokprobe_inline int
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index e83987c55a08..46c2290a08f1 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1657,8 +1657,7 @@ static void start_scan_thread(void)
 }
 
 /*
- * Stop the automatic memory scanning thread. This function must be called
- * with the scan_mutex held.
+ * Stop the automatic memory scanning thread.
  */
 static void stop_scan_thread(void)
 {
@@ -1921,12 +1920,15 @@ static void kmemleak_do_cleanup(struct work_struct *work)
 {
         stop_scan_thread();
 
+        mutex_lock(&scan_mutex);
         /*
-         * Once the scan thread has stopped, it is safe to no longer track
-         * object freeing. Ordering of the scan thread stopping and the memory
-         * accesses below is guaranteed by the kthread_stop() function.
+         * Once it is made sure that kmemleak_scan has stopped, it is safe to no
+         * longer track object freeing. Ordering of the scan thread stopping and
+         * the memory accesses below is guaranteed by the kthread_stop()
+         * function.
          */
         kmemleak_free_enabled = 0;
+        mutex_unlock(&scan_mutex);
 
         if (!kmemleak_found_leaks)
                 __kmemleak_do_cleanup();
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 670e99b68aa6..9ec024b862ac 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -714,9 +714,9 @@ static struct mem_cgroup *get_mem_cgroup_from_mm(struct mm_struct *mm)
  * invocations for reference counting, or use mem_cgroup_iter_break()
  * to cancel a hierarchy walk before the round-trip is complete.
  *
- * Reclaimers can specify a zone and a priority level in @reclaim to
+ * Reclaimers can specify a node and a priority level in @reclaim to
  * divide up the memcgs in the hierarchy among all concurrent
- * reclaimers operating on the same zone and priority.
+ * reclaimers operating on the same node and priority.
  */
 struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *root,
                                    struct mem_cgroup *prev,
@@ -2299,7 +2299,7 @@ void memcg_kmem_put_cache(struct kmem_cache *cachep)
 }
 
 /**
- * memcg_kmem_charge: charge a kmem page
+ * memcg_kmem_charge_memcg: charge a kmem page
  * @page: page to charge
  * @gfp: reclaim mode
  * @order: allocation order
diff --git a/mm/page_owner.c b/mm/page_owner.c
index 9886c6073828..7172e0a80e13 100644
--- a/mm/page_owner.c
+++ b/mm/page_owner.c
@@ -123,13 +123,13 @@ void __reset_page_owner(struct page *page, unsigned int order)
 static inline bool check_recursive_alloc(struct stack_trace *trace,
                                         unsigned long ip)
 {
-        int i, count;
+        int i;
 
         if (!trace->nr_entries)
                 return false;
 
-        for (i = 0, count = 0; i < trace->nr_entries; i++) {
-                if (trace->entries[i] == ip && ++count == 2)
+        for (i = 0; i < trace->nr_entries; i++) {
+                if (trace->entries[i] == ip)
                         return true;
         }
 
diff --git a/mm/slab.c b/mm/slab.c
index 324446621b3e..9095c3945425 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -1283,6 +1283,7 @@ void __init kmem_cache_init(void)
                                   nr_node_ids * sizeof(struct kmem_cache_node *),
                                   SLAB_HWCACHE_ALIGN, 0, 0);
         list_add(&kmem_cache->list, &slab_caches);
+        memcg_link_cache(kmem_cache);
         slab_state = PARTIAL;
 
         /*
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 40b2db6db6b1..33581be705f0 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -1839,9 +1839,11 @@ static void vmstat_update(struct work_struct *w)
                  * to occur in the future. Keep on running the
                  * update worker thread.
                  */
+                preempt_disable();
                 queue_delayed_work_on(smp_processor_id(), mm_percpu_wq,
                                 this_cpu_ptr(&vmstat_work),
                                 round_jiffies_relative(sysctl_stat_interval));
+                preempt_enable();
         }
 }
 
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index c294f6fd43e0..8b198ee798c9 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -746,7 +746,7 @@ bool batadv_gw_out_of_range(struct batadv_priv *bat_priv,
 {
         struct batadv_neigh_node *neigh_curr = NULL;
         struct batadv_neigh_node *neigh_old = NULL;
-        struct batadv_orig_node *orig_dst_node;
+        struct batadv_orig_node *orig_dst_node = NULL;
         struct batadv_gw_node *gw_node = NULL;
         struct batadv_gw_node *curr_gw = NULL;
         struct batadv_neigh_ifinfo *curr_ifinfo, *old_ifinfo;
@@ -757,6 +757,9 @@ bool batadv_gw_out_of_range(struct batadv_priv *bat_priv,
 
         vid = batadv_get_vid(skb, 0);
 
+        if (is_multicast_ether_addr(ethhdr->h_dest))
+                goto out;
+
         orig_dst_node = batadv_transtable_search(bat_priv, ethhdr->h_source,
                                                  ethhdr->h_dest, vid);
         if (!orig_dst_node)
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index de3a055f7dd8..a11d3d89f012 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -869,8 +869,8 @@ static struct batadv_orig_node *
 batadv_mcast_forw_tt_node_get(struct batadv_priv *bat_priv,
                               struct ethhdr *ethhdr)
 {
-        return batadv_transtable_search(bat_priv, ethhdr->h_source,
-                                        ethhdr->h_dest, BATADV_NO_FLAGS);
+        return batadv_transtable_search(bat_priv, NULL, ethhdr->h_dest,
+                                        BATADV_NO_FLAGS);
 }
 
 /**
diff --git a/net/core/dev.c b/net/core/dev.c
index 8edb58829124..9b04a9fd1dfd 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2762,7 +2762,7 @@ __be16 skb_network_protocol(struct sk_buff *skb, int *depth)
                 if (unlikely(!pskb_may_pull(skb, sizeof(struct ethhdr))))
                         return 0;
 
-                eth = (struct ethhdr *)skb_mac_header(skb);
+                eth = (struct ethhdr *)skb->data;
                 type = eth->h_proto;
         }
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index b5c75d4fcf37..1bca1e0fc8f7 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5047,8 +5047,10 @@ static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
         }
 
         mac_len = skb->data - skb_mac_header(skb);
-        memmove(skb_mac_header(skb) + VLAN_HLEN, skb_mac_header(skb),
-                mac_len - VLAN_HLEN - ETH_TLEN);
+        if (likely(mac_len > VLAN_HLEN + ETH_TLEN)) {
+                memmove(skb_mac_header(skb) + VLAN_HLEN, skb_mac_header(skb),
+                        mac_len - VLAN_HLEN - ETH_TLEN);
+        }
         skb->mac_header += VLAN_HLEN;
         return skb;
 }
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 5fcb17cb426b..de6d94482fe7 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -346,12 +346,17 @@ static struct ip_tunnel *ip_tunnel_create(struct net *net,
         struct ip_tunnel *nt;
         struct net_device *dev;
         int t_hlen;
+        int mtu;
+        int err;
 
         dev = __ip_tunnel_create(net, itn->rtnl_link_ops, parms);
         if (IS_ERR(dev))
                 return ERR_CAST(dev);
 
-        dev->mtu = ip_tunnel_bind_dev(dev);
+        mtu = ip_tunnel_bind_dev(dev);
+        err = dev_set_mtu(dev, mtu);
+        if (err)
+                goto err_dev_set_mtu;
 
         nt = netdev_priv(dev);
         t_hlen = nt->hlen + sizeof(struct iphdr);
@@ -359,6 +364,10 @@ static struct ip_tunnel *ip_tunnel_create(struct net *net,
         dev->max_mtu = 0xFFF8 - dev->hard_header_len - t_hlen;
         ip_tunnel_add(itn, nt);
         return nt;
+
+err_dev_set_mtu:
+        unregister_netdevice(dev);
+        return ERR_PTR(err);
 }
 
 int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
@@ -1090,17 +1099,29 @@ int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[],
         nt->fwmark = fwmark;
         err = register_netdevice(dev);
         if (err)
-                goto out;
+                goto err_register_netdevice;
 
         if (dev->type == ARPHRD_ETHER && !tb[IFLA_ADDRESS])
                 eth_hw_addr_random(dev);
 
         mtu = ip_tunnel_bind_dev(dev);
-        if (!tb[IFLA_MTU])
-                dev->mtu = mtu;
+        if (tb[IFLA_MTU]) {
+                unsigned int max = 0xfff8 - dev->hard_header_len - nt->hlen;
+
+                mtu = clamp(dev->mtu, (unsigned int)ETH_MIN_MTU,
+                            (unsigned int)(max - sizeof(struct iphdr)));
+        }
+
+        err = dev_set_mtu(dev, mtu);
+        if (err)
+                goto err_dev_set_mtu;
 
         ip_tunnel_add(itn, nt);
-out:
+        return 0;
+
+err_dev_set_mtu:
+        unregister_netdevice(dev);
+err_register_netdevice:
         return err;
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_newlink);
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 51b1669334fe..3f091ccad9af 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -387,8 +387,6 @@ static int vti_tunnel_init(struct net_device *dev)
         memcpy(dev->dev_addr, &iph->saddr, 4);
         memcpy(dev->broadcast, &iph->daddr, 4);
 
-        dev->hard_header_len    = LL_MAX_HEADER + sizeof(struct iphdr);
-        dev->mtu                = ETH_DATA_LEN;
         dev->flags              = IFF_NOARP;
         dev->addr_len           = 4;
         dev->features           |= NETIF_F_LLTX;
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 62ede5e3a3de..7523ddb2566b 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -29,7 +29,7 @@ obj-$(CONFIG_NF_NAT_H323) += nf_nat_h323.o
 obj-$(CONFIG_NF_NAT_PPTP) += nf_nat_pptp.o
 
 nf_nat_snmp_basic-y := nf_nat_snmp_basic-asn1.o nf_nat_snmp_basic_main.o
-nf_nat_snmp_basic-y : nf_nat_snmp_basic-asn1.h nf_nat_snmp_basic-asn1.c
+$(obj)/nf_nat_snmp_basic_main.o: $(obj)/nf_nat_snmp_basic-asn1.h
 obj-$(CONFIG_NF_NAT_SNMP_BASIC) += nf_nat_snmp_basic.o
 clean-files := nf_nat_snmp_basic-asn1.c nf_nat_snmp_basic-asn1.h
 
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index b50721d9d30e..9db988f9a4d7 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -154,8 +154,20 @@ static unsigned int ipv4_conntrack_local(void *priv,
                                          struct sk_buff *skb,
                                          const struct nf_hook_state *state)
 {
-        if (ip_is_fragment(ip_hdr(skb))) /* IP_NODEFRAG setsockopt set */
+        if (ip_is_fragment(ip_hdr(skb))) { /* IP_NODEFRAG setsockopt set */
+                enum ip_conntrack_info ctinfo;
+                struct nf_conn *tmpl;
+
+                tmpl = nf_ct_get(skb, &ctinfo);
+                if (tmpl && nf_ct_is_template(tmpl)) {
+                        /* when skipping ct, clear templates to avoid fooling
+                         * later targets/matches
+                         */
+                        skb->_nfct = 0;
+                        nf_ct_put(tmpl);
+                }
                 return NF_ACCEPT;
+        }
 
         return nf_conntrack_in(state->net, PF_INET, state->hook, skb);
 }
diff --git a/net/ipv4/netfilter/nf_socket_ipv4.c b/net/ipv4/netfilter/nf_socket_ipv4.c
index e9293bdebba0..4824b1e183a1 100644
--- a/net/ipv4/netfilter/nf_socket_ipv4.c
+++ b/net/ipv4/netfilter/nf_socket_ipv4.c
@@ -108,10 +108,12 @@ struct sock *nf_sk_lookup_slow_v4(struct net *net, const struct sk_buff *skb,
         int doff = 0;
 
         if (iph->protocol == IPPROTO_UDP || iph->protocol == IPPROTO_TCP) {
-                struct udphdr _hdr, *hp;
+                struct tcphdr _hdr;
+                struct udphdr *hp;
 
                 hp = skb_header_pointer(skb, ip_hdrlen(skb),
-                                        sizeof(_hdr), &_hdr);
+                                        iph->protocol == IPPROTO_UDP ?
+                                        sizeof(*hp) : sizeof(_hdr), &_hdr);
                 if (hp == NULL)
                         return NULL;
 
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index fda37f2862c9..c3387dfd725b 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -349,6 +349,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
         req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
         treq->snt_synack        = 0;
         treq->tfo_listener      = false;
+        if (IS_ENABLED(CONFIG_SMC))
+                ireq->smc_ok = 0;
 
         ireq->ir_iif = inet_request_bound_dev_if(sk, skb);
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 451ef3012636..367def6ddeda 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6255,6 +6255,9 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
         if (want_cookie && !tmp_opt.saw_tstamp)
                 tcp_clear_options(&tmp_opt);
 
+        if (IS_ENABLED(CONFIG_SMC) && want_cookie)
+                tmp_opt.smc_ok = 0;
+
         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
         tcp_openreq_init(req, &tmp_opt, skb, sk);
         inet_rsk(req)->no_srccheck = inet_sk(sk)->transparent;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 323d7a354ffb..e6eaa4dd9f60 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1246,7 +1246,7 @@ static int __ip6_append_data(struct sock *sk,
                              const struct sockcm_cookie *sockc)
 {
         struct sk_buff *skb, *skb_prev = NULL;
-        unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
+        unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu, pmtu;
         int exthdrlen = 0;
         int dst_exthdrlen = 0;
         int hh_len;
@@ -1283,6 +1283,12 @@ static int __ip6_append_data(struct sock *sk,
                       sizeof(struct frag_hdr) : 0) +
                      rt->rt6i_nfheader_len;
 
+        /* as per RFC 7112 section 5, the entire IPv6 Header Chain must fit
+         * the first fragment
+         */
+        if (headersize + transhdrlen > mtu)
+                goto emsgsize;
+
         if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
             (sk->sk_protocol == IPPROTO_UDP ||
              sk->sk_protocol == IPPROTO_RAW)) {
@@ -1298,9 +1304,8 @@ static int __ip6_append_data(struct sock *sk,
 
         if (cork->length + length > maxnonfragsize - headersize) {
 emsgsize:
-                ipv6_local_error(sk, EMSGSIZE, fl6,
-                                 mtu - headersize +
-                                 sizeof(struct ipv6hdr));
+                pmtu = max_t(int, mtu - headersize + sizeof(struct ipv6hdr), 0);
+                ipv6_local_error(sk, EMSGSIZE, fl6, pmtu);
                 return -EMSGSIZE;
         }
 
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 60b771f49fb5..6ebb2e8777f4 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -622,11 +622,12 @@ static int vti6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         return 0;
 }
 
-static void vti6_link_config(struct ip6_tnl *t)
+static void vti6_link_config(struct ip6_tnl *t, bool keep_mtu)
 {
         struct net_device *dev = t->dev;
         struct __ip6_tnl_parm *p = &t->parms;
         struct net_device *tdev = NULL;
+        int mtu;
 
         memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
         memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr));
@@ -640,6 +641,11 @@ static void vti6_link_config(struct ip6_tnl *t)
         else
                 dev->flags &= ~IFF_POINTOPOINT;
 
+        if (keep_mtu && dev->mtu) {
+                dev->mtu = clamp(dev->mtu, dev->min_mtu, dev->max_mtu);
+                return;
+        }
+
         if (p->flags & IP6_TNL_F_CAP_XMIT) {
                 int strict = (ipv6_addr_type(&p->raddr) &
                               (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL));
@@ -656,20 +662,25 @@ static void vti6_link_config(struct ip6_tnl *t)
                 tdev = __dev_get_by_index(t->net, p->link);
 
         if (tdev)
-                dev->mtu = max_t(int, tdev->mtu - dev->hard_header_len,
-                                 IPV6_MIN_MTU);
+                mtu = tdev->mtu - sizeof(struct ipv6hdr);
+        else
+                mtu = ETH_DATA_LEN - LL_MAX_HEADER - sizeof(struct ipv6hdr);
+
+        dev->mtu = max_t(int, mtu, IPV6_MIN_MTU);
 }
 
 /**
  * vti6_tnl_change - update the tunnel parameters
  *   @t: tunnel to be changed
  *   @p: tunnel configuration parameters
+ *   @keep_mtu: MTU was set from userspace, don't re-compute it
  *
  * Description:
  *   vti6_tnl_change() updates the tunnel parameters
  **/
 static int
-vti6_tnl_change(struct ip6_tnl *t, const struct __ip6_tnl_parm *p)
+vti6_tnl_change(struct ip6_tnl *t, const struct __ip6_tnl_parm *p,
+                bool keep_mtu)
 {
         t->parms.laddr = p->laddr;
         t->parms.raddr = p->raddr;
@@ -679,11 +690,12 @@ vti6_tnl_change(struct ip6_tnl *t, const struct __ip6_tnl_parm *p)
         t->parms.proto = p->proto;
         t->parms.fwmark = p->fwmark;
         dst_cache_reset(&t->dst_cache);
-        vti6_link_config(t);
+        vti6_link_config(t, keep_mtu);
         return 0;
 }
 
-static int vti6_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p)
+static int vti6_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p,
+                       bool keep_mtu)
 {
         struct net *net = dev_net(t->dev);
         struct vti6_net *ip6n = net_generic(net, vti6_net_id);
@@ -691,7 +703,7 @@ static int vti6_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p)
 
         vti6_tnl_unlink(ip6n, t);
         synchronize_net();
-        err = vti6_tnl_change(t, p);
+        err = vti6_tnl_change(t, p, keep_mtu);
         vti6_tnl_link(ip6n, t);
         netdev_state_change(t->dev);
         return err;
@@ -804,7 +816,7 @@ vti6_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         } else
                                 t = netdev_priv(dev);
 
-                        err = vti6_update(t, &p1);
+                        err = vti6_update(t, &p1, false);
                 }
                 if (t) {
                         err = 0;
@@ -866,10 +878,8 @@ static void vti6_dev_setup(struct net_device *dev)
         dev->priv_destructor = vti6_dev_free;
 
         dev->type = ARPHRD_TUNNEL6;
-        dev->hard_header_len = LL_MAX_HEADER + sizeof(struct ipv6hdr);
-        dev->mtu = ETH_DATA_LEN;
         dev->min_mtu = IPV6_MIN_MTU;
-        dev->max_mtu = IP_MAX_MTU;
+        dev->max_mtu = IP_MAX_MTU - sizeof(struct ipv6hdr);
         dev->flags |= IFF_NOARP;
         dev->addr_len = sizeof(struct in6_addr);
         netif_keep_dst(dev);
@@ -905,7 +915,7 @@ static int vti6_dev_init(struct net_device *dev)
 
         if (err)
                 return err;
-        vti6_link_config(t);
+        vti6_link_config(t, true);
         return 0;
 }
 
@@ -1010,7 +1020,7 @@ static int vti6_changelink(struct net_device *dev, struct nlattr *tb[],
         } else
                 t = netdev_priv(dev);
 
-        return vti6_update(t, &p);
+        return vti6_update(t, &p, tb && tb[IFLA_MTU]);
 }
 
 static size_t vti6_get_size(const struct net_device *dev)
diff --git a/net/ipv6/netfilter/nf_socket_ipv6.c b/net/ipv6/netfilter/nf_socket_ipv6.c
index ebb2bf84232a..f14de4b6d639 100644
--- a/net/ipv6/netfilter/nf_socket_ipv6.c
+++ b/net/ipv6/netfilter/nf_socket_ipv6.c
@@ -116,9 +116,11 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb,
         }
 
         if (tproto == IPPROTO_UDP || tproto == IPPROTO_TCP) {
-                struct udphdr _hdr, *hp;
+                struct tcphdr _hdr;
+                struct udphdr *hp;
 
-                hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
+                hp = skb_header_pointer(skb, thoff, tproto == IPPROTO_UDP ?
+                                        sizeof(*hp) : sizeof(_hdr), &_hdr);
                 if (hp == NULL)
                         return NULL;
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index e461ef1158b6..f239f91d2efb 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -923,6 +923,9 @@ static struct rt6_info *ip6_pol_route_lookup(struct net *net,
         struct rt6_info *rt, *rt_cache;
         struct fib6_node *fn;
 
+        if (fl6->flowi6_flags & FLOWI_FLAG_SKIP_NH_OIF)
+                flags &= ~RT6_LOOKUP_F_IFACE;
+
         rcu_read_lock();
         fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
 restart:
@@ -1631,11 +1634,10 @@ static void rt6_age_examine_exception(struct rt6_exception_bucket *bucket,
                 struct neighbour *neigh;
                 __u8 neigh_flags = 0;
 
-                neigh = dst_neigh_lookup(&rt->dst, &rt->rt6i_gateway);
-                if (neigh) {
+                neigh = __ipv6_neigh_lookup_noref(rt->dst.dev, &rt->rt6i_gateway);
+                if (neigh)
                         neigh_flags = neigh->flags;
-                        neigh_release(neigh);
-                }
+
                 if (!(neigh_flags & NTF_ROUTER)) {
                         RT6_TRACE("purging route %p via non-router but gateway\n",
                                   rt);
@@ -1659,7 +1661,8 @@ void rt6_age_exceptions(struct rt6_info *rt,
         if (!rcu_access_pointer(rt->rt6i_exception_bucket))
                 return;
 
-        spin_lock_bh(&rt6_exception_lock);
+        rcu_read_lock_bh();
+        spin_lock(&rt6_exception_lock);
         bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
                                     lockdep_is_held(&rt6_exception_lock));
 
@@ -1673,7 +1676,8 @@ void rt6_age_exceptions(struct rt6_info *rt,
                         bucket++;
                 }
         }
-        spin_unlock_bh(&rt6_exception_lock);
+        spin_unlock(&rt6_exception_lock);
+        rcu_read_unlock_bh();
 }
 
 struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index 7a78dcfda68a..f343e6f0fc95 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -16,6 +16,7 @@
 #include <linux/net.h>
 #include <linux/module.h>
 #include <net/ip.h>
+#include <net/ip_tunnels.h>
 #include <net/lwtunnel.h>
 #include <net/netevent.h>
 #include <net/netns/generic.h>
@@ -211,11 +212,6 @@ static int seg6_do_srh(struct sk_buff *skb)
 
         tinfo = seg6_encap_lwtunnel(dst->lwtstate);
 
-        if (likely(!skb->encapsulation)) {
-                skb_reset_inner_headers(skb);
-                skb->encapsulation = 1;
-        }
-
         switch (tinfo->mode) {
         case SEG6_IPTUN_MODE_INLINE:
                 if (skb->protocol != htons(ETH_P_IPV6))
@@ -224,10 +220,12 @@ static int seg6_do_srh(struct sk_buff *skb)
                 err = seg6_do_srh_inline(skb, tinfo->srh);
                 if (err)
                         return err;
-
-                skb_reset_inner_headers(skb);
                 break;
         case SEG6_IPTUN_MODE_ENCAP:
+                err = iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6);
+                if (err)
+                        return err;
+
                 if (skb->protocol == htons(ETH_P_IPV6))
                         proto = IPPROTO_IPV6;
                 else if (skb->protocol == htons(ETH_P_IP))
@@ -239,6 +237,8 @@ static int seg6_do_srh(struct sk_buff *skb)
                 if (err)
                         return err;
 
+                skb_set_inner_transport_header(skb, skb_transport_offset(skb));
+                skb_set_inner_protocol(skb, skb->protocol);
                 skb->protocol = htons(ETH_P_IPV6);
                 break;
         case SEG6_IPTUN_MODE_L2ENCAP:
@@ -262,8 +262,6 @@ static int seg6_do_srh(struct sk_buff *skb)
         ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
         skb_set_transport_header(skb, sizeof(struct ipv6hdr));
 
-        skb_set_inner_protocol(skb, skb->protocol);
-
         return 0;
 }
 
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index e7a3a6b6cf56..e997141aed8c 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -217,6 +217,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         treq->snt_isn = cookie;
         treq->ts_off = 0;
         treq->txhash = net_tx_rndhash();
+        if (IS_ENABLED(CONFIG_SMC))
+                ireq->smc_ok = 0;
 
         /*
          * We need to lookup the dst_entry to get the correct window size.
diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c
index f59648018060..163121192aca 100644
--- a/net/llc/llc_c_ac.c
+++ b/net/llc/llc_c_ac.c
@@ -389,7 +389,7 @@ static int llc_conn_ac_send_i_cmd_p_set_0(struct sock *sk, struct sk_buff *skb)
         llc_pdu_init_as_i_cmd(skb, 0, llc->vS, llc->vR);
         rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac);
         if (likely(!rc)) {
-                llc_conn_send_pdu(sk, skb);
+                rc = llc_conn_send_pdu(sk, skb);
                 llc_conn_ac_inc_vs_by_1(sk, skb);
         }
         return rc;
@@ -916,7 +916,7 @@ static int llc_conn_ac_send_i_rsp_f_set_ackpf(struct sock *sk,
         llc_pdu_init_as_i_cmd(skb, llc->ack_pf, llc->vS, llc->vR);
         rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac);
         if (likely(!rc)) {
-                llc_conn_send_pdu(sk, skb);
+                rc = llc_conn_send_pdu(sk, skb);
                 llc_conn_ac_inc_vs_by_1(sk, skb);
         }
         return rc;
@@ -935,14 +935,17 @@ static int llc_conn_ac_send_i_rsp_f_set_ackpf(struct sock *sk,
 int llc_conn_ac_send_i_as_ack(struct sock *sk, struct sk_buff *skb)
 {
         struct llc_sock *llc = llc_sk(sk);
+        int ret;
 
         if (llc->ack_must_be_send) {
-                llc_conn_ac_send_i_rsp_f_set_ackpf(sk, skb);
+                ret = llc_conn_ac_send_i_rsp_f_set_ackpf(sk, skb);
                 llc->ack_must_be_send = 0 ;
                 llc->ack_pf = 0;
-        } else
-                llc_conn_ac_send_i_cmd_p_set_0(sk, skb);
-        return 0;
+        } else {
+                ret = llc_conn_ac_send_i_cmd_p_set_0(sk, skb);
+        }
+
+        return ret;
 }
 
 /**
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index 9177dbb16dce..110e32bcb399 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -30,7 +30,7 @@
 #endif
 
 static int llc_find_offset(int state, int ev_type);
-static void llc_conn_send_pdus(struct sock *sk);
+static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *skb);
 static int llc_conn_service(struct sock *sk, struct sk_buff *skb);
 static int llc_exec_conn_trans_actions(struct sock *sk,
                                        struct llc_conn_state_trans *trans,
@@ -193,11 +193,11 @@ out_skb_put:
         return rc;
 }
 
-void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb)
+int llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb)
 {
         /* queue PDU to send to MAC layer */
         skb_queue_tail(&sk->sk_write_queue, skb);
-        llc_conn_send_pdus(sk);
+        return llc_conn_send_pdus(sk, skb);
 }
 
 /**
@@ -255,7 +255,7 @@ void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit)
         if (howmany_resend > 0)
                 llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO;
         /* any PDUs to re-send are queued up; start sending to MAC */
-        llc_conn_send_pdus(sk);
+        llc_conn_send_pdus(sk, NULL);
 out:;
 }
 
@@ -296,7 +296,7 @@ void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit)
         if (howmany_resend > 0)
                 llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO;
         /* any PDUs to re-send are queued up; start sending to MAC */
-        llc_conn_send_pdus(sk);
+        llc_conn_send_pdus(sk, NULL);
 out:;
 }
 
@@ -340,12 +340,16 @@ out:
 /**
  *      llc_conn_send_pdus - Sends queued PDUs
  *      @sk: active connection
+ *      @hold_skb: the skb held by caller, or NULL if does not care
  *
- *      Sends queued pdus to MAC layer for transmission.
+ *      Sends queued pdus to MAC layer for transmission. When @hold_skb is
+ *      NULL, always return 0. Otherwise, return 0 if @hold_skb is sent
+ *      successfully, or 1 for failure.
  */
-static void llc_conn_send_pdus(struct sock *sk)
+static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *hold_skb)
 {
         struct sk_buff *skb;
+        int ret = 0;
 
         while ((skb = skb_dequeue(&sk->sk_write_queue)) != NULL) {
                 struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
@@ -357,10 +361,20 @@ static void llc_conn_send_pdus(struct sock *sk)
                         skb_queue_tail(&llc_sk(sk)->pdu_unack_q, skb);
                         if (!skb2)
                                 break;
-                        skb = skb2;
+                        dev_queue_xmit(skb2);
+                } else {
+                        bool is_target = skb == hold_skb;
+                        int rc;
+
+                        if (is_target)
+                                skb_get(skb);
+                        rc = dev_queue_xmit(skb);
+                        if (is_target)
+                                ret = rc;
                 }
-                dev_queue_xmit(skb);
         }
+
+        return ret;
 }
 
 /**
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 6e93782bbe4f..9134cc429ad4 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -74,15 +74,77 @@ static void nft_trans_destroy(struct nft_trans *trans)
         kfree(trans);
 }
 
+/* removal requests are queued in the commit_list, but not acted upon
+ * until after all new rules are in place.
+ *
+ * Therefore, nf_register_net_hook(net, &nat_hook) runs before pending
+ * nf_unregister_net_hook().
+ *
+ * nf_register_net_hook thus fails if a nat hook is already in place
+ * even if the conflicting hook is about to be removed.
+ *
+ * If collision is detected, search commit_log for DELCHAIN matching
+ * the new nat hooknum; if we find one collision is temporary:
+ *
+ * Either transaction is aborted (new/colliding hook is removed), or
+ * transaction is committed (old hook is removed).
+ */
+static bool nf_tables_allow_nat_conflict(const struct net *net,
+                                         const struct nf_hook_ops *ops)
+{
+        const struct nft_trans *trans;
+        bool ret = false;
+
+        if (!ops->nat_hook)
+                return false;
+
+        list_for_each_entry(trans, &net->nft.commit_list, list) {
+                const struct nf_hook_ops *pending_ops;
+                const struct nft_chain *pending;
+
+                if (trans->msg_type != NFT_MSG_NEWCHAIN &&
+                    trans->msg_type != NFT_MSG_DELCHAIN)
+                        continue;
+
+                pending = trans->ctx.chain;
+                if (!nft_is_base_chain(pending))
+                        continue;
+
+                pending_ops = &nft_base_chain(pending)->ops;
+                if (pending_ops->nat_hook &&
+                    pending_ops->pf == ops->pf &&
+                    pending_ops->hooknum == ops->hooknum) {
+                        /* other hook registration already pending? */
+                        if (trans->msg_type == NFT_MSG_NEWCHAIN)
+                                return false;
+
+                        ret = true;
+                }
+        }
+
+        return ret;
+}
+
 static int nf_tables_register_hook(struct net *net,
                                    const struct nft_table *table,
                                    struct nft_chain *chain)
 {
+        struct nf_hook_ops *ops;
+        int ret;
+
         if (table->flags & NFT_TABLE_F_DORMANT ||
             !nft_is_base_chain(chain))
                 return 0;
 
-        return nf_register_net_hook(net, &nft_base_chain(chain)->ops);
+        ops = &nft_base_chain(chain)->ops;
+        ret = nf_register_net_hook(net, ops);
+        if (ret == -EBUSY && nf_tables_allow_nat_conflict(net, ops)) {
+                ops->nat_hook = false;
+                ret = nf_register_net_hook(net, ops);
+                ops->nat_hook = true;
+        }
+
+        return ret;
 }
 
 static void nf_tables_unregister_hook(struct net *net,
@@ -1226,8 +1288,6 @@ static void nf_tables_chain_destroy(struct nft_ctx *ctx)
                 free_percpu(basechain->stats);
                 if (basechain->stats)
                         static_branch_dec(&nft_counters_enabled);
-                if (basechain->ops.dev != NULL)
-                        dev_put(basechain->ops.dev);
                 kfree(chain->name);
                 kfree(basechain);
         } else {
@@ -1294,7 +1354,7 @@ static int nft_chain_parse_hook(struct net *net,
                 }
 
                 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
-                dev = dev_get_by_name(net, ifname);
+                dev = __dev_get_by_name(net, ifname);
                 if (!dev) {
                         module_put(type->owner);
                         return -ENOENT;
@@ -1311,8 +1371,6 @@ static int nft_chain_parse_hook(struct net *net,
 static void nft_chain_release_hook(struct nft_chain_hook *hook)
 {
         module_put(hook->type->owner);
-        if (hook->dev != NULL)
-                dev_put(hook->dev);
 }
 
 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
@@ -1915,6 +1973,7 @@ static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
         [NFTA_RULE_POSITION]    = { .type = NLA_U64 },
         [NFTA_RULE_USERDATA]    = { .type = NLA_BINARY,
                                     .len = NFT_USERDATA_MAXLEN },
+        [NFTA_RULE_ID]          = { .type = NLA_U32 },
 };
 
 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
@@ -2450,6 +2509,9 @@ EXPORT_SYMBOL_GPL(nft_unregister_set);
 
 static bool nft_set_ops_candidate(const struct nft_set_ops *ops, u32 flags)
 {
+        if ((flags & NFT_SET_EVAL) && !ops->update)
+                return false;
+
         return (flags & ops->features) == (flags & NFT_SET_FEATURES);
 }
 
@@ -2514,7 +2576,7 @@ nft_select_set_ops(const struct nft_ctx *ctx,
                                 if (est.space == best.space &&
                                     est.lookup < best.lookup)
                                         break;
-                        } else if (est.size < best.size) {
+                        } else if (est.size < best.size || !bops) {
                                 break;
                         }
                         continue;
@@ -3319,6 +3381,8 @@ static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
         [NFTA_SET_ELEM_TIMEOUT]         = { .type = NLA_U64 },
         [NFTA_SET_ELEM_USERDATA]        = { .type = NLA_BINARY,
                                             .len = NFT_USERDATA_MAXLEN },
+        [NFTA_SET_ELEM_EXPR]            = { .type = NLA_NESTED },
+        [NFTA_SET_ELEM_OBJREF]          = { .type = NLA_STRING },
 };
 
 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
@@ -4868,8 +4932,6 @@ nf_tables_flowtable_lookup_byhandle(const struct nft_table *table,
        return ERR_PTR(-ENOENT);
 }
 
-#define NFT_FLOWTABLE_DEVICE_MAX        8
-
 static int nf_tables_parse_devices(const struct nft_ctx *ctx,
                                    const struct nlattr *attr,
                                    struct net_device *dev_array[], int *len)
@@ -4886,7 +4948,7 @@ static int nf_tables_parse_devices(const struct nft_ctx *ctx,
                 }
 
                 nla_strlcpy(ifname, tmp, IFNAMSIZ);
-                dev = dev_get_by_name(ctx->net, ifname);
+                dev = __dev_get_by_name(ctx->net, ifname);
                 if (!dev) {
                         err = -ENOENT;
                         goto err1;
@@ -4942,13 +5004,11 @@ static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
         err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS],
                                       dev_array, &n);
         if (err < 0)
-                goto err1;
+                return err;
 
         ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL);
-        if (!ops) {
-                err = -ENOMEM;
-                goto err1;
-        }
+        if (!ops)
+                return -ENOMEM;
 
         flowtable->hooknum      = hooknum;
         flowtable->priority     = priority;
@@ -4962,13 +5022,10 @@ static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
                 flowtable->ops[i].priv          = &flowtable->data.rhashtable;
                 flowtable->ops[i].hook          = flowtable->data.type->hook;
                 flowtable->ops[i].dev           = dev_array[i];
+                flowtable->dev_name[i]          = kstrdup(dev_array[i]->name,
+                                                          GFP_KERNEL);
         }
 
-        err = 0;
-err1:
-        for (i = 0; i < n; i++)
-                dev_put(dev_array[i]);
-
         return err;
 }
 
@@ -5139,8 +5196,10 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
 err5:
         i = flowtable->ops_len;
 err4:
-        for (k = i - 1; k >= 0; k--)
+        for (k = i - 1; k >= 0; k--) {
+                kfree(flowtable->dev_name[k]);
                 nf_unregister_net_hook(net, &flowtable->ops[k]);
+        }
 
         kfree(flowtable->ops);
 err3:
@@ -5230,9 +5289,9 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
                 goto nla_put_failure;
 
         for (i = 0; i < flowtable->ops_len; i++) {
-                if (flowtable->ops[i].dev &&
+                if (flowtable->dev_name[i][0] &&
                     nla_put_string(skb, NFTA_DEVICE_NAME,
-                                   flowtable->ops[i].dev->name))
+                                   flowtable->dev_name[i]))
                         goto nla_put_failure;
         }
         nla_nest_end(skb, nest_devs);
@@ -5474,6 +5533,7 @@ static void nft_flowtable_event(unsigned long event, struct net_device *dev,
                         continue;
 
                 nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]);
+                flowtable->dev_name[i][0] = '\0';
                 flowtable->ops[i].dev = NULL;
                 break;
         }
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index d40591fe1b2f..fc9c6d5d64cd 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -674,7 +674,7 @@ static const struct nft_set_ops *
 nft_hash_select_ops(const struct nft_ctx *ctx, const struct nft_set_desc *desc,
                     u32 flags)
 {
-        if (desc->size && !(flags & NFT_SET_TIMEOUT)) {
+        if (desc->size && !(flags & (NFT_SET_EVAL | NFT_SET_TIMEOUT))) {
                 switch (desc->klen) {
                 case 4:
                         return &nft_hash_fast_ops;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index f1b02d87e336..fa556fdef57d 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1085,6 +1085,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
         if (addr->sa_family != AF_NETLINK)
                 return -EINVAL;
 
+        if (alen < sizeof(struct sockaddr_nl))
+                return -EINVAL;
+
         if ((nladdr->nl_groups || nladdr->nl_pid) &&
             !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
                 return -EPERM;
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 0d78b58e1898..72251241665a 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -171,8 +171,10 @@ static int tcf_dump_walker(struct tcf_idrinfo *idrinfo, struct sk_buff *skb,
                         continue;
 
                 nest = nla_nest_start(skb, n_i);
-                if (!nest)
+                if (!nest) {
+                        index--;
                         goto nla_put_failure;
+                }
                 err = tcf_action_dump_1(skb, p, 0, 0);
                 if (err < 0) {
                         index--;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 7e3fbe9cc936..39c144b6ff98 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -373,24 +373,33 @@ bool sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,
  */
 static inline bool qdisc_restart(struct Qdisc *q, int *packets)
 {
+        bool more, validate, nolock = q->flags & TCQ_F_NOLOCK;
         spinlock_t *root_lock = NULL;
         struct netdev_queue *txq;
         struct net_device *dev;
         struct sk_buff *skb;
-        bool validate;
 
         /* Dequeue packet */
+        if (nolock && test_and_set_bit(__QDISC_STATE_RUNNING, &q->state))
+                return false;
+
         skb = dequeue_skb(q, &validate, packets);
-        if (unlikely(!skb))
+        if (unlikely(!skb)) {
+                if (nolock)
+                        clear_bit(__QDISC_STATE_RUNNING, &q->state);
                 return false;
+        }
 
-        if (!(q->flags & TCQ_F_NOLOCK))
+        if (!nolock)
                 root_lock = qdisc_lock(q);
 
         dev = qdisc_dev(q);
         txq = skb_get_tx_queue(dev, skb);
 
-        return sch_direct_xmit(skb, q, dev, txq, root_lock, validate);
+        more = sch_direct_xmit(skb, q, dev, txq, root_lock, validate);
+        if (nolock)
+                clear_bit(__QDISC_STATE_RUNNING, &q->state);
+        return more;
 }
 
 void __qdisc_run(struct Qdisc *q)
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index 64fbc3230e6c..3a988c22f627 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -304,7 +304,7 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
 
         /* receive the complete CLC message */
         memset(&msg, 0, sizeof(struct msghdr));
-        iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &vec, 1, buflen);
+        iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &vec, 1, datlen);
         krflags = MSG_WAITALL;
         smc->clcsock->sk->sk_rcvtimeo = CLC_WAIT_TIME;
         len = sock_recvmsg(smc->clcsock, &msg, krflags);
diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
index 1fdab5c4eda8..b9283ce5cd85 100644
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c
@@ -60,7 +60,7 @@ static void strp_abort_strp(struct strparser *strp, int err)
                 struct sock *sk = strp->sk;
 
                 /* Report an error on the lower socket */
-                sk->sk_err = err;
+                sk->sk_err = -err;
                 sk->sk_error_report(sk);
         }
 }
@@ -458,7 +458,7 @@ static void strp_msg_timeout(struct work_struct *w)
         /* Message assembly timed out */
         STRP_STATS_INCR(strp->stats.msg_timeouts);
         strp->cb.lock(strp);
-        strp->cb.abort_parser(strp, ETIMEDOUT);
+        strp->cb.abort_parser(strp, -ETIMEDOUT);
         strp->cb.unlock(strp);
 }
 
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 44fc54dc013c..352abca2605f 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -27,6 +27,12 @@ struct xfrm_trans_tasklet {
 };
 
 struct xfrm_trans_cb {
+        union {
+                struct inet_skb_parm    h4;
+#if IS_ENABLED(CONFIG_IPV6)
+                struct inet6_skb_parm   h6;
+#endif
+        } header;
         int (*finish)(struct net *net, struct sock *sk, struct sk_buff *skb);
 };
 
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 23468672a767..89b178a78dc7 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -285,8 +285,9 @@ void xfrm_local_error(struct sk_buff *skb, int mtu)
                 return;
 
         afinfo = xfrm_state_get_afinfo(proto);
-        if (afinfo)
+        if (afinfo) {
                 afinfo->local_error(skb, mtu);
-        rcu_read_unlock();
+                rcu_read_unlock();
+        }
 }
 EXPORT_SYMBOL_GPL(xfrm_local_error);
diff --git a/scripts/adjust_autoksyms.sh b/scripts/adjust_autoksyms.sh
index 513da1a4a2da..d67830e6e360 100755
--- a/scripts/adjust_autoksyms.sh
+++ b/scripts/adjust_autoksyms.sh
@@ -84,6 +84,13 @@ while read sympath; do
         depfile="include/config/ksym/${sympath}.h"
         mkdir -p "$(dirname "$depfile")"
         touch "$depfile"
+        # Filesystems with coarse time precision may create timestamps
+        # equal to the one from a file that was very recently built and that
+        # needs to be rebuild. Let's guard against that by making sure our
+        # dep files are always newer than the first file we created here.
+        while [ ! "$depfile" -nt "$new_ksyms_file" ]; do
+                touch "$depfile"
+        done
         echo $((count += 1))
 done | tail -1 )
 changed=${changed:-0}
diff --git a/scripts/package/builddeb b/scripts/package/builddeb
index b4f0f2b3f8d2..13fabb1f81db 100755
--- a/scripts/package/builddeb
+++ b/scripts/package/builddeb
@@ -313,7 +313,7 @@ fi
 
 # Build kernel header package
 (cd $srctree; find . -name Makefile\* -o -name Kconfig\* -o -name \*.pl) > "$objtree/debian/hdrsrcfiles"
-(cd $srctree; find arch/*/include include scripts -type f) >> "$objtree/debian/hdrsrcfiles"
+(cd $srctree; find arch/*/include include scripts -type f -o -type l) >> "$objtree/debian/hdrsrcfiles"
 (cd $srctree; find arch/$SRCARCH -name module.lds -o -name Kbuild.platforms -o -name Platform) >> "$objtree/debian/hdrsrcfiles"
 (cd $srctree; find $(find arch/$SRCARCH -name include -o -name scripts -type d) -type f) >> "$objtree/debian/hdrsrcfiles"
 if grep -q '^CONFIG_STACK_VALIDATION=y' $KCONFIG_CONFIG ; then
diff --git a/scripts/package/mkspec b/scripts/package/mkspec
index 280027fad991..61427c6f2209 100755
--- a/scripts/package/mkspec
+++ b/scripts/package/mkspec
@@ -98,7 +98,7 @@ $M	make %{?_smp_mflags} INSTALL_MOD_PATH=%{buildroot} KBUILD_SRC= modules_instal
 $S$M    rm -f %{buildroot}/lib/modules/$KERNELRELEASE/build
 $S$M    rm -f %{buildroot}/lib/modules/$KERNELRELEASE/source
 $S$M    mkdir -p %{buildroot}/usr/src/kernels/$KERNELRELEASE
-$S$M    tar cf - . $EXCLUDES | tar xf - -C %{buildroot}/usr/src/kernels/$KERNELRELEASE
+$S$M    tar cf - $EXCLUDES . | tar xf - -C %{buildroot}/usr/src/kernels/$KERNELRELEASE
 $S$M    cd %{buildroot}/lib/modules/$KERNELRELEASE
 $S$M    ln -sf /usr/src/kernels/$KERNELRELEASE build
 $S$M    ln -sf /usr/src/kernels/$KERNELRELEASE source
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index 02298c9c6020..441405081195 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1326,7 +1326,7 @@ static ssize_t snd_pcm_oss_write2(struct snd_pcm_substream *substream, const cha
 static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const char __user *buf, size_t bytes)
 {
         size_t xfer = 0;
-        ssize_t tmp;
+        ssize_t tmp = 0;
         struct snd_pcm_runtime *runtime = substream->runtime;
 
         if (atomic_read(&substream->mmap_count))
@@ -1433,7 +1433,7 @@ static ssize_t snd_pcm_oss_read2(struct snd_pcm_substream *substream, char *buf,
 static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __user *buf, size_t bytes)
 {
         size_t xfer = 0;
-        ssize_t tmp;
+        ssize_t tmp = 0;
         struct snd_pcm_runtime *runtime = substream->runtime;
 
         if (atomic_read(&substream->mmap_count))
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 77ba50ddcf9e..d18b3982548b 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -3422,7 +3422,7 @@ int snd_pcm_lib_default_mmap(struct snd_pcm_substream *substream,
                                          area,
                                          substream->runtime->dma_area,
                                          substream->runtime->dma_addr,
-                                         area->vm_end - area->vm_start);
+                                         substream->runtime->dma_bytes);
 #endif /* CONFIG_X86 */
         /* mmap with fault handler */
         area->vm_ops = &snd_pcm_vm_ops_data_fault;
diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index 0333143a1fa7..1063a4377502 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -192,6 +192,11 @@ static inline void loopback_timer_stop(struct loopback_pcm *dpcm)
         dpcm->timer.expires = 0;
 }
 
+static inline void loopback_timer_stop_sync(struct loopback_pcm *dpcm)
+{
+        del_timer_sync(&dpcm->timer);
+}
+
 #define CABLE_VALID_PLAYBACK    (1 << SNDRV_PCM_STREAM_PLAYBACK)
 #define CABLE_VALID_CAPTURE     (1 << SNDRV_PCM_STREAM_CAPTURE)
 #define CABLE_VALID_BOTH        (CABLE_VALID_PLAYBACK|CABLE_VALID_CAPTURE)
@@ -326,6 +331,8 @@ static int loopback_prepare(struct snd_pcm_substream *substream)
         struct loopback_cable *cable = dpcm->cable;
         int bps, salign;
 
+        loopback_timer_stop_sync(dpcm);
+
         salign = (snd_pcm_format_width(runtime->format) *
                                                 runtime->channels) / 8;
         bps = salign * runtime->rate;
@@ -659,7 +666,9 @@ static void free_cable(struct snd_pcm_substream *substream)
                 return;
         if (cable->streams[!substream->stream]) {
                 /* other stream is still alive */
+                spin_lock_irq(&cable->lock);
                 cable->streams[substream->stream] = NULL;
+                spin_unlock_irq(&cable->lock);
         } else {
                 /* free the cable */
                 loopback->cables[substream->number][dev] = NULL;
@@ -698,7 +707,6 @@ static int loopback_open(struct snd_pcm_substream *substream)
                 loopback->cables[substream->number][dev] = cable;
         }
         dpcm->cable = cable;
-        cable->streams[substream->stream] = dpcm;
 
         snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS);
 
@@ -730,6 +738,11 @@ static int loopback_open(struct snd_pcm_substream *substream)
                 runtime->hw = loopback_pcm_hardware;
         else
                 runtime->hw = cable->hw;
+
+        spin_lock_irq(&cable->lock);
+        cable->streams[substream->stream] = dpcm;
+        spin_unlock_irq(&cable->lock);
+
  unlock:
         if (err < 0) {
                 free_cable(substream);
@@ -744,7 +757,7 @@ static int loopback_close(struct snd_pcm_substream *substream)
         struct loopback *loopback = substream->private_data;
         struct loopback_pcm *dpcm = substream->runtime->private_data;
 
-        loopback_timer_stop(dpcm);
+        loopback_timer_stop_sync(dpcm);
         mutex_lock(&loopback->cable_lock);
         free_cable(substream);
         mutex_unlock(&loopback->cable_lock);
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index d5017adf9feb..c507c69029e3 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -375,6 +375,7 @@ enum {
                                         ((pci)->device == 0x160c))
 
 #define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98)
+#define IS_CFL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa348)
 
 static char *driver_short_names[] = {
         [AZX_DRIVER_ICH] = "HDA Intel",
@@ -1744,6 +1745,10 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
         else
                 chip->bdl_pos_adj = bdl_pos_adj[dev];
 
+        /* Workaround for a communication error on CFL (bko#199007) */
+        if (IS_CFL(pci))
+                chip->polling_mode = 1;
+
         err = azx_bus_init(chip, model[dev], &pci_hda_io_ops);
         if (err < 0) {
                 kfree(hda);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 9af301c6bba2..aef1f52db7d9 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3130,6 +3130,8 @@ static void alc256_init(struct hda_codec *codec)
 
         alc_update_coef_idx(codec, 0x46, 3 << 12, 0);
         alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */
+        alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 1 << 15); /* Clear bit */
+        alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 0 << 15);
 }
 
 static void alc256_shutup(struct hda_codec *codec)
@@ -3596,8 +3598,12 @@ static void alc269_fixup_mic_mute_hook(void *private_data, int enabled)
         pinval = snd_hda_codec_get_pin_target(codec, spec->mute_led_nid);
         pinval &= ~AC_PINCTL_VREFEN;
         pinval |= enabled ? AC_PINCTL_VREF_HIZ : AC_PINCTL_VREF_80;
-        if (spec->mute_led_nid)
+        if (spec->mute_led_nid) {
+                /* temporarily power up/down for setting VREF */
+                snd_hda_power_up_pm(codec);
                 snd_hda_set_pin_ctl_cache(codec, spec->mute_led_nid, pinval);
+                snd_hda_power_down_pm(codec);
+        }
 }
 
 /* Make sure the led works even in runtime suspend */
@@ -5497,6 +5503,7 @@ enum {
         ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
         ALC298_FIXUP_TPT470_DOCK,
         ALC255_FIXUP_DUMMY_LINEOUT_VERB,
+        ALC255_FIXUP_DELL_HEADSET_MIC,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -6357,6 +6364,13 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
         },
+        [ALC255_FIXUP_DELL_HEADSET_MIC] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+                        { }
+                },
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6411,6 +6425,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
         SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
         SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+        SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+        SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
         SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB),
         SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
@@ -7154,6 +7170,8 @@ static int patch_alc269(struct hda_codec *codec)
                 break;
         case 0x10ec0257:
                 spec->codec_variant = ALC269_TYPE_ALC257;
+                spec->shutup = alc256_shutup;
+                spec->init_hook = alc256_init;
                 spec->gen.mixer_nid = 0;
                 break;
         case 0x10ec0215:
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index ea8f3de92fa4..794224e1d6df 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1171,6 +1171,7 @@ static bool is_teac_dsd_dac(unsigned int id)
         switch (id) {
         case USB_ID(0x0644, 0x8043): /* TEAC UD-501/UD-503/NT-503 */
         case USB_ID(0x0644, 0x8044): /* Esoteric D-05X */
+        case USB_ID(0x0644, 0x804a): /* TEAC UD-301 */
                 return true;
         }
         return false;
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index f95fa67bb498..f509c86faede 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -428,7 +428,7 @@ static int show_map_close_json(int fd, struct bpf_map_info *info)
                 jsonw_string_field(json_wtr, "name", info->name);
 
         jsonw_name(json_wtr, "flags");
-        jsonw_printf(json_wtr, "%#x", info->map_flags);
+        jsonw_printf(json_wtr, "%d", info->map_flags);
 
         print_dev_json(info->ifindex, info->netns_dev, info->netns_ino);
 
diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_string.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_string.tc
new file mode 100644
index 000000000000..5ba73035e1d9
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_string.tc
@@ -0,0 +1,46 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0
+# description: Kprobe event string type argument
+
+[ -f kprobe_events ] || exit_unsupported # this is configurable
+
+echo 0 > events/enable
+echo > kprobe_events
+
+case `uname -m` in
+x86_64)
+  ARG2=%si
+  OFFS=8
+;;
+i[3456]86)
+  ARG2=%cx
+  OFFS=4
+;;
+aarch64)
+  ARG2=%x1
+  OFFS=8
+;;
+arm*)
+  ARG2=%r1
+  OFFS=4
+;;
+*)
+  echo "Please implement other architecture here"
+  exit_untested
+esac
+
+: "Test get argument (1)"
+echo "p:testprobe create_trace_kprobe arg1=+0(+0(${ARG2})):string" > kprobe_events
+echo 1 > events/kprobes/testprobe/enable
+! echo test >> kprobe_events
+tail -n 1 trace | grep -qe "testprobe.* arg1=\"test\""
+
+echo 0 > events/kprobes/testprobe/enable
+: "Test get argument (2)"
+echo "p:testprobe create_trace_kprobe arg1=+0(+0(${ARG2})):string arg2=+0(+${OFFS}(${ARG2})):string" > kprobe_events
+echo 1 > events/kprobes/testprobe/enable
+! echo test1 test2 >> kprobe_events
+tail -n 1 trace | grep -qe "testprobe.* arg1=\"test1\" arg2=\"test2\""
+
+echo 0 > events/enable
+echo > kprobe_events
diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc
new file mode 100644
index 000000000000..231bcd2c4eb5
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc
@@ -0,0 +1,97 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0
+# description: Kprobe event argument syntax
+
+[ -f kprobe_events ] || exit_unsupported # this is configurable
+
+grep "x8/16/32/64" README > /dev/null || exit_unsupported # version issue
+
+echo 0 > events/enable
+echo > kprobe_events
+
+PROBEFUNC="vfs_read"
+GOODREG=
+BADREG=
+GOODSYM="_sdata"
+if ! grep -qw ${GOODSYM} /proc/kallsyms ; then
+  GOODSYM=$PROBEFUNC
+fi
+BADSYM="deaqswdefr"
+SYMADDR=0x`grep -w ${GOODSYM} /proc/kallsyms | cut -f 1 -d " "`
+GOODTYPE="x16"
+BADTYPE="y16"
+
+case `uname -m` in
+x86_64|i[3456]86)
+  GOODREG=%ax
+  BADREG=%ex
+;;
+aarch64)
+  GOODREG=%x0
+  BADREG=%ax
+;;
+arm*)
+  GOODREG=%r0
+  BADREG=%ax
+;;
+esac
+
+test_goodarg() # Good-args
+{
+  while [ "$1" ]; do
+    echo "p ${PROBEFUNC} $1" > kprobe_events
+    shift 1
+  done;
+}
+
+test_badarg() # Bad-args
+{
+  while [ "$1" ]; do
+    ! echo "p ${PROBEFUNC} $1" > kprobe_events
+    shift 1
+  done;
+}
+
+echo > kprobe_events
+
+: "Register access"
+test_goodarg ${GOODREG}
+test_badarg ${BADREG}
+
+: "Symbol access"
+test_goodarg "@${GOODSYM}" "@${SYMADDR}" "@${GOODSYM}+10" "@${GOODSYM}-10"
+test_badarg "@" "@${BADSYM}" "@${GOODSYM}*10" "@${GOODSYM}/10" \
+            "@${GOODSYM}%10" "@${GOODSYM}&10" "@${GOODSYM}|10"
+
+: "Stack access"
+test_goodarg "\$stack" "\$stack0" "\$stack1"
+test_badarg "\$stackp" "\$stack0+10" "\$stack1-10"
+
+: "Retval access"
+echo "r ${PROBEFUNC} \$retval" > kprobe_events
+! echo "p ${PROBEFUNC} \$retval" > kprobe_events
+
+: "Comm access"
+test_goodarg "\$comm"
+
+: "Indirect memory access"
+test_goodarg "+0(${GOODREG})" "-0(${GOODREG})" "+10(\$stack)" \
+        "+0(\$stack1)" "+10(@${GOODSYM}-10)" "+0(+10(+20(\$stack)))"
+test_badarg "+(${GOODREG})" "(${GOODREG}+10)" "-(${GOODREG})" "(${GOODREG})" \
+        "+10(\$comm)" "+0(${GOODREG})+10"
+
+: "Name assignment"
+test_goodarg "varname=${GOODREG}"
+test_badarg "varname=varname2=${GOODREG}"
+
+: "Type syntax"
+test_goodarg "${GOODREG}:${GOODTYPE}"
+test_badarg "${GOODREG}::${GOODTYPE}" "${GOODREG}:${BADTYPE}" \
+        "${GOODTYPE}:${GOODREG}"
+
+: "Combination check"
+
+test_goodarg "\$comm:string" "+0(\$stack):string"
+test_badarg "\$comm:x64" "\$stack:string" "${GOODREG}:string"
+
+echo > kprobe_events
diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc b/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc
new file mode 100644
index 000000000000..4fda01a08da4
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc
@@ -0,0 +1,43 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0
+# description: Kprobe events - probe points
+
+[ -f kprobe_events ] || exit_unsupported # this is configurable
+
+TARGET_FUNC=create_trace_kprobe
+
+dec_addr() { # hexaddr
+  printf "%d" "0x"`echo $1 | tail -c 8`
+}
+
+set_offs() { # prev target next
+  A1=`dec_addr $1`
+  A2=`dec_addr $2`
+  A3=`dec_addr $3`
+  TARGET="0x$2" # an address
+  PREV=`expr $A1 - $A2` # offset to previous symbol
+  NEXT=+`expr $A3 - $A2` # offset to next symbol
+  OVERFLOW=+`printf "0x%x" ${PREV}` # overflow offset to previous symbol
+}
+
+# We have to decode symbol addresses to get correct offsets.
+# If the offset is not an instruction boundary, it cause -EILSEQ.
+set_offs `grep -A1 -B1 ${TARGET_FUNC} /proc/kallsyms | cut -f 1 -d " " | xargs`
+
+UINT_TEST=no
+# printf "%x" -1 returns (unsigned long)-1.
+if [ `printf "%x" -1 | wc -c` != 9 ]; then
+  UINT_TEST=yes
+fi
+
+echo 0 > events/enable
+echo > kprobe_events
+echo "p:testprobe ${TARGET_FUNC}" > kprobe_events
+echo "p:testprobe ${TARGET}" > kprobe_events
+echo "p:testprobe ${TARGET_FUNC}${NEXT}" > kprobe_events
+! echo "p:testprobe ${TARGET_FUNC}${PREV}" > kprobe_events
+if [ "${UINT_TEST}" = yes ]; then
+! echo "p:testprobe ${TARGET_FUNC}${OVERFLOW}" > kprobe_events
+fi
+echo > kprobe_events
+clear_trace
diff --git a/tools/testing/selftests/x86/ptrace_syscall.c b/tools/testing/selftests/x86/ptrace_syscall.c
index 1ae1c5a7392e..6f22238f3217 100644
--- a/tools/testing/selftests/x86/ptrace_syscall.c
+++ b/tools/testing/selftests/x86/ptrace_syscall.c
@@ -183,8 +183,10 @@ static void test_ptrace_syscall_restart(void)
                 if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
                         err(1, "PTRACE_TRACEME");
 
+                pid_t pid = getpid(), tid = syscall(SYS_gettid);
+
                 printf("\tChild will make one syscall\n");
-                raise(SIGSTOP);
+                syscall(SYS_tgkill, pid, tid, SIGSTOP);
 
                 syscall(SYS_gettid, 10, 11, 12, 13, 14, 15);
                 _exit(0);
@@ -301,9 +303,11 @@ static void test_restart_under_ptrace(void)
                 if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
                         err(1, "PTRACE_TRACEME");
 
+                pid_t pid = getpid(), tid = syscall(SYS_gettid);
+
                 printf("\tChild will take a nap until signaled\n");
                 setsigign(SIGUSR1, SA_RESTART);
-                raise(SIGSTOP);
+                syscall(SYS_tgkill, pid, tid, SIGSTOP);
 
                 syscall(SYS_pause, 0, 0, 0, 0, 0, 0);
                 _exit(0);