145 files changed, 1224 insertions, 824 deletions

diff --git a/CREDITS b/CREDITS
index e818eb6a3e71..0175098d4776 100644
--- a/CREDITS
+++ b/CREDITS
@@ -842,10 +842,9 @@ D: ax25-utils maintainer.
 
 N: Helge Deller
 E: deller@gmx.de
-E: hdeller@redhat.de
-D: PA-RISC Linux hacker, LASI-, ASP-, WAX-, LCD/LED-driver
-S: Schimmelsrain 1
-S: D-69231 Rauenberg
+W: http://www.parisc-linux.org/
+D: PA-RISC Linux architecture maintainer
+D: LASI-, ASP-, WAX-, LCD/LED-driver
 S: Germany
 
 N: Jean Delvare
@@ -1361,7 +1360,7 @@ S: Stellenbosch, Western Cape
 S: South Africa
 
 N: Grant Grundler
-E: grundler@parisc-linux.org
+E: grantgrundler@gmail.com
 W: http://obmouse.sourceforge.net/
 W: http://www.parisc-linux.org/
 D: obmouse - rewrote Olivier Florent's Omnibook 600 "pop-up" mouse driver
@@ -2492,7 +2491,7 @@ S: Syracuse, New York 13206
 S: USA
 
 N: Kyle McMartin
-E: kyle@parisc-linux.org
+E: kyle@mcmartin.ca
 D: Linux/PARISC hacker
 D: AD1889 sound driver
 S: Ottawa, Canada
@@ -3780,14 +3779,13 @@ S: 21513 Conradia Ct
 S: Cupertino, CA 95014
 S: USA
 
-N: Thibaut Varene
-E: T-Bone@parisc-linux.org
-W: http://www.parisc-linux.org/~varenet/
-P: 1024D/B7D2F063 E67C 0D43 A75E 12A5 BB1C  FA2F 1E32 C3DA B7D2 F063
+N: Thibaut Varène
+E: hacks+kernel@slashdirt.org
+W: http://hacks.slashdirt.org/
 D: PA-RISC port minion, PDC and GSCPS2 drivers, debuglocks and other bits
 D: Some ARM at91rm9200 bits, S1D13XXX FB driver, random patches here and there
 D: AD1889 sound driver
-S: Paris, France
+S: France
 
 N: Heikki Vatiainen
 E: hessu@cs.tut.fi
diff --git a/Documentation/admin-guide/README.rst b/Documentation/admin-guide/README.rst
index 0797eec76be1..47e577264198 100644
--- a/Documentation/admin-guide/README.rst
+++ b/Documentation/admin-guide/README.rst
@@ -1,9 +1,9 @@
 .. _readme:
 
-Linux kernel release 4.x <http://kernel.org/>
+Linux kernel release 5.x <http://kernel.org/>
 =============================================
 
-These are the release notes for Linux version 4.  Read them carefully,
+These are the release notes for Linux version 5.  Read them carefully,
 as they tell you what this is all about, explain how to install the
 kernel, and what to do if something goes wrong.
 
@@ -63,7 +63,7 @@ Installing the kernel source
    directory where you have permissions (e.g. your home directory) and
    unpack it::
 
-     xz -cd linux-4.X.tar.xz | tar xvf -
+     xz -cd linux-5.x.tar.xz | tar xvf -
 
    Replace "X" with the version number of the latest kernel.
 
@@ -72,26 +72,26 @@ Installing the kernel source
    files.  They should match the library, and not get messed up by
    whatever the kernel-du-jour happens to be.
 
- - You can also upgrade between 4.x releases by patching.  Patches are
+ - You can also upgrade between 5.x releases by patching.  Patches are
    distributed in the xz format.  To install by patching, get all the
    newer patch files, enter the top level directory of the kernel source
-   (linux-4.X) and execute::
+   (linux-5.x) and execute::
 
-     xz -cd ../patch-4.x.xz | patch -p1
+     xz -cd ../patch-5.x.xz | patch -p1
 
-   Replace "x" for all versions bigger than the version "X" of your current
+   Replace "x" for all versions bigger than the version "x" of your current
    source tree, **in_order**, and you should be ok.  You may want to remove
    the backup files (some-file-name~ or some-file-name.orig), and make sure
    that there are no failed patches (some-file-name# or some-file-name.rej).
    If there are, either you or I have made a mistake.
 
-   Unlike patches for the 4.x kernels, patches for the 4.x.y kernels
+   Unlike patches for the 5.x kernels, patches for the 5.x.y kernels
    (also known as the -stable kernels) are not incremental but instead apply
-   directly to the base 4.x kernel.  For example, if your base kernel is 4.0
-   and you want to apply the 4.0.3 patch, you must not first apply the 4.0.1
-   and 4.0.2 patches. Similarly, if you are running kernel version 4.0.2 and
-   want to jump to 4.0.3, you must first reverse the 4.0.2 patch (that is,
-   patch -R) **before** applying the 4.0.3 patch. You can read more on this in
+   directly to the base 5.x kernel.  For example, if your base kernel is 5.0
+   and you want to apply the 5.0.3 patch, you must not first apply the 5.0.1
+   and 5.0.2 patches. Similarly, if you are running kernel version 5.0.2 and
+   want to jump to 5.0.3, you must first reverse the 5.0.2 patch (that is,
+   patch -R) **before** applying the 5.0.3 patch. You can read more on this in
    :ref:`Documentation/process/applying-patches.rst <applying_patches>`.
 
    Alternatively, the script patch-kernel can be used to automate this
@@ -114,7 +114,7 @@ Installing the kernel source
 Software requirements
 ---------------------
 
-   Compiling and running the 4.x kernels requires up-to-date
+   Compiling and running the 5.x kernels requires up-to-date
    versions of various software packages.  Consult
    :ref:`Documentation/process/changes.rst <changes>` for the minimum version numbers
    required and how to get updates for these packages.  Beware that using
@@ -132,12 +132,12 @@ Build directory for the kernel
    place for the output files (including .config).
    Example::
 
-     kernel source code: /usr/src/linux-4.X
+     kernel source code: /usr/src/linux-5.x
      build directory:    /home/name/build/kernel
 
    To configure and build the kernel, use::
 
-     cd /usr/src/linux-4.X
+     cd /usr/src/linux-5.x
      make O=/home/name/build/kernel menuconfig
      make O=/home/name/build/kernel
      sudo make O=/home/name/build/kernel modules_install install
diff --git a/Documentation/networking/msg_zerocopy.rst b/Documentation/networking/msg_zerocopy.rst
index fe46d4867e2d..18c1415e7bfa 100644
--- a/Documentation/networking/msg_zerocopy.rst
+++ b/Documentation/networking/msg_zerocopy.rst
@@ -7,7 +7,7 @@ Intro
 =====
 
 The MSG_ZEROCOPY flag enables copy avoidance for socket send calls.
-The feature is currently implemented for TCP sockets.
+The feature is currently implemented for TCP and UDP sockets.
 
 
 Opportunity and Caveats
diff --git a/Documentation/process/applying-patches.rst b/Documentation/process/applying-patches.rst
index dc2ddc345044..fbb9297e6360 100644
--- a/Documentation/process/applying-patches.rst
+++ b/Documentation/process/applying-patches.rst
@@ -216,14 +216,14 @@ You can use the ``interdiff`` program (http://cyberelk.net/tim/patchutils/) to
 generate a patch representing the differences between two patches and then
 apply the result.
 
-This will let you move from something like 4.7.2 to 4.7.3 in a single
+This will let you move from something like 5.7.2 to 5.7.3 in a single
 step. The -z flag to interdiff will even let you feed it patches in gzip or
 bzip2 compressed form directly without the use of zcat or bzcat or manual
 decompression.
 
-Here's how you'd go from 4.7.2 to 4.7.3 in a single step::
+Here's how you'd go from 5.7.2 to 5.7.3 in a single step::
 
-        interdiff -z ../patch-4.7.2.gz ../patch-4.7.3.gz | patch -p1
+        interdiff -z ../patch-5.7.2.gz ../patch-5.7.3.gz | patch -p1
 
 Although interdiff may save you a step or two you are generally advised to
 do the additional steps since interdiff can get things wrong in some cases.
@@ -245,62 +245,67 @@ The patches are available at http://kernel.org/
 Most recent patches are linked from the front page, but they also have
 specific homes.
 
-The 4.x.y (-stable) and 4.x patches live at
+The 5.x.y (-stable) and 5.x patches live at
 
-        https://www.kernel.org/pub/linux/kernel/v4.x/
+        https://www.kernel.org/pub/linux/kernel/v5.x/
 
-The -rc patches live at
+The -rc patches are not stored on the webserver but are generated on
+demand from git tags such as
 
-        https://www.kernel.org/pub/linux/kernel/v4.x/testing/
+        https://git.kernel.org/torvalds/p/v5.1-rc1/v5.0
 
+The stable -rc patches live at
 
-The 4.x kernels
+        https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/
+
+
+The 5.x kernels
 ===============
 
 These are the base stable releases released by Linus. The highest numbered
 release is the most recent.
 
 If regressions or other serious flaws are found, then a -stable fix patch
-will be released (see below) on top of this base. Once a new 4.x base
+will be released (see below) on top of this base. Once a new 5.x base
 kernel is released, a patch is made available that is a delta between the
-previous 4.x kernel and the new one.
+previous 5.x kernel and the new one.
 
-To apply a patch moving from 4.6 to 4.7, you'd do the following (note
-that such patches do **NOT** apply on top of 4.x.y kernels but on top of the
-base 4.x kernel -- if you need to move from 4.x.y to 4.x+1 you need to
-first revert the 4.x.y patch).
+To apply a patch moving from 5.6 to 5.7, you'd do the following (note
+that such patches do **NOT** apply on top of 5.x.y kernels but on top of the
+base 5.x kernel -- if you need to move from 5.x.y to 5.x+1 you need to
+first revert the 5.x.y patch).
 
 Here are some examples::
 
-        # moving from 4.6 to 4.7
+        # moving from 5.6 to 5.7
 
-        $ cd ~/linux-4.6                # change to kernel source dir
-        $ patch -p1 < ../patch-4.7      # apply the 4.7 patch
+        $ cd ~/linux-5.6                # change to kernel source dir
+        $ patch -p1 < ../patch-5.7      # apply the 5.7 patch
         $ cd ..
-        $ mv linux-4.6 linux-4.7        # rename source dir
+        $ mv linux-5.6 linux-5.7        # rename source dir
 
-        # moving from 4.6.1 to 4.7
+        # moving from 5.6.1 to 5.7
 
-        $ cd ~/linux-4.6.1              # change to kernel source dir
-        $ patch -p1 -R < ../patch-4.6.1 # revert the 4.6.1 patch
-                                        # source dir is now 4.6
-        $ patch -p1 < ../patch-4.7      # apply new 4.7 patch
+        $ cd ~/linux-5.6.1              # change to kernel source dir
+        $ patch -p1 -R < ../patch-5.6.1 # revert the 5.6.1 patch
+                                        # source dir is now 5.6
+        $ patch -p1 < ../patch-5.7      # apply new 5.7 patch
         $ cd ..
-        $ mv linux-4.6.1 linux-4.7      # rename source dir
+        $ mv linux-5.6.1 linux-5.7      # rename source dir
 
 
-The 4.x.y kernels
+The 5.x.y kernels
 =================
 
 Kernels with 3-digit versions are -stable kernels. They contain small(ish)
 critical fixes for security problems or significant regressions discovered
-in a given 4.x kernel.
+in a given 5.x kernel.
 
 This is the recommended branch for users who want the most recent stable
 kernel and are not interested in helping test development/experimental
 versions.
 
-If no 4.x.y kernel is available, then the highest numbered 4.x kernel is
+If no 5.x.y kernel is available, then the highest numbered 5.x kernel is
 the current stable kernel.
 
 .. note::
@@ -308,23 +313,23 @@ the current stable kernel.
  The -stable team usually do make incremental patches available as well
  as patches against the latest mainline release, but I only cover the
  non-incremental ones below. The incremental ones can be found at
- https://www.kernel.org/pub/linux/kernel/v4.x/incr/
+ https://www.kernel.org/pub/linux/kernel/v5.x/incr/
 
-These patches are not incremental, meaning that for example the 4.7.3
-patch does not apply on top of the 4.7.2 kernel source, but rather on top
-of the base 4.7 kernel source.
+These patches are not incremental, meaning that for example the 5.7.3
+patch does not apply on top of the 5.7.2 kernel source, but rather on top
+of the base 5.7 kernel source.
 
-So, in order to apply the 4.7.3 patch to your existing 4.7.2 kernel
-source you have to first back out the 4.7.2 patch (so you are left with a
-base 4.7 kernel source) and then apply the new 4.7.3 patch.
+So, in order to apply the 5.7.3 patch to your existing 5.7.2 kernel
+source you have to first back out the 5.7.2 patch (so you are left with a
+base 5.7 kernel source) and then apply the new 5.7.3 patch.
 
 Here's a small example::
 
-        $ cd ~/linux-4.7.2              # change to the kernel source dir
-        $ patch -p1 -R < ../patch-4.7.2 # revert the 4.7.2 patch
-        $ patch -p1 < ../patch-4.7.3    # apply the new 4.7.3 patch
+        $ cd ~/linux-5.7.2              # change to the kernel source dir
+        $ patch -p1 -R < ../patch-5.7.2 # revert the 5.7.2 patch
+        $ patch -p1 < ../patch-5.7.3    # apply the new 5.7.3 patch
         $ cd ..
-        $ mv linux-4.7.2 linux-4.7.3    # rename the kernel source dir
+        $ mv linux-5.7.2 linux-5.7.3    # rename the kernel source dir
 
 The -rc kernels
 ===============
@@ -343,38 +348,38 @@ This is a good branch to run for people who want to help out testing
 development kernels but do not want to run some of the really experimental
 stuff (such people should see the sections about -next and -mm kernels below).
 
-The -rc patches are not incremental, they apply to a base 4.x kernel, just
-like the 4.x.y patches described above. The kernel version before the -rcN
+The -rc patches are not incremental, they apply to a base 5.x kernel, just
+like the 5.x.y patches described above. The kernel version before the -rcN
 suffix denotes the version of the kernel that this -rc kernel will eventually
 turn into.
 
-So, 4.8-rc5 means that this is the fifth release candidate for the 4.8
-kernel and the patch should be applied on top of the 4.7 kernel source.
+So, 5.8-rc5 means that this is the fifth release candidate for the 5.8
+kernel and the patch should be applied on top of the 5.7 kernel source.
 
 Here are 3 examples of how to apply these patches::
 
-        # first an example of moving from 4.7 to 4.8-rc3
+        # first an example of moving from 5.7 to 5.8-rc3
 
-        $ cd ~/linux-4.7                        # change to the 4.7 source dir
-        $ patch -p1 < ../patch-4.8-rc3          # apply the 4.8-rc3 patch
+        $ cd ~/linux-5.7                        # change to the 5.7 source dir
+        $ patch -p1 < ../patch-5.8-rc3          # apply the 5.8-rc3 patch
         $ cd ..
-        $ mv linux-4.7 linux-4.8-rc3            # rename the source dir
+        $ mv linux-5.7 linux-5.8-rc3            # rename the source dir
 
-        # now let's move from 4.8-rc3 to 4.8-rc5
+        # now let's move from 5.8-rc3 to 5.8-rc5
 
-        $ cd ~/linux-4.8-rc3                    # change to the 4.8-rc3 dir
-        $ patch -p1 -R < ../patch-4.8-rc3       # revert the 4.8-rc3 patch
-        $ patch -p1 < ../patch-4.8-rc5          # apply the new 4.8-rc5 patch
+        $ cd ~/linux-5.8-rc3                    # change to the 5.8-rc3 dir
+        $ patch -p1 -R < ../patch-5.8-rc3       # revert the 5.8-rc3 patch
+        $ patch -p1 < ../patch-5.8-rc5          # apply the new 5.8-rc5 patch
         $ cd ..
-        $ mv linux-4.8-rc3 linux-4.8-rc5        # rename the source dir
+        $ mv linux-5.8-rc3 linux-5.8-rc5        # rename the source dir
 
-        # finally let's try and move from 4.7.3 to 4.8-rc5
+        # finally let's try and move from 5.7.3 to 5.8-rc5
 
-        $ cd ~/linux-4.7.3                      # change to the kernel source dir
-        $ patch -p1 -R < ../patch-4.7.3         # revert the 4.7.3 patch
-        $ patch -p1 < ../patch-4.8-rc5          # apply new 4.8-rc5 patch
+        $ cd ~/linux-5.7.3                      # change to the kernel source dir
+        $ patch -p1 -R < ../patch-5.7.3         # revert the 5.7.3 patch
+        $ patch -p1 < ../patch-5.8-rc5          # apply new 5.8-rc5 patch
         $ cd ..
-        $ mv linux-4.7.3 linux-4.8-rc5          # rename the kernel source dir
+        $ mv linux-5.7.3 linux-5.8-rc5          # rename the kernel source dir
 
 
 The -mm patches and the linux-next tree
diff --git a/Documentation/translations/it_IT/admin-guide/README.rst b/Documentation/translations/it_IT/admin-guide/README.rst
index 80f5ffc94a9e..b37166817842 100644
--- a/Documentation/translations/it_IT/admin-guide/README.rst
+++ b/Documentation/translations/it_IT/admin-guide/README.rst
@@ -4,7 +4,7 @@
 
 .. _it_readme:
 
-Rilascio del kernel Linux  4.x <http://kernel.org/>
+Rilascio del kernel Linux  5.x <http://kernel.org/>
 ===================================================
 
 .. warning::
diff --git a/MAINTAINERS b/MAINTAINERS
index 41ce5f4ad838..e6e17d8c5aae 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -409,8 +409,7 @@ F:	drivers/platform/x86/wmi.c
 F:      include/uapi/linux/wmi.h
 
 AD1889 ALSA SOUND DRIVER
-M:      Thibaut Varene <T-Bone@parisc-linux.org>
-W:      http://wiki.parisc-linux.org/AD1889
+W:      https://parisc.wiki.kernel.org/index.php/AD1889
 L:      linux-parisc@vger.kernel.org
 S:      Maintained
 F:      sound/pci/ad1889.*
@@ -11488,7 +11487,7 @@ F:	Documentation/blockdev/paride.txt
 F:      drivers/block/paride/
 
 PARISC ARCHITECTURE
-M:      "James E.J. Bottomley" <jejb@parisc-linux.org>
+M:      "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com>
 M:      Helge Deller <deller@gmx.de>
 L:      linux-parisc@vger.kernel.org
 W:      http://www.parisc-linux.org/
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index 376366a7db81..d750b302d5ab 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -191,7 +191,6 @@ config NR_CPUS
 
 config ARC_SMP_HALT_ON_RESET
         bool "Enable Halt-on-reset boot mode"
-        default y if ARC_UBOOT_SUPPORT
         help
           In SMP configuration cores can be configured as Halt-on-reset
           or they could all start at same time. For Halt-on-reset, non
@@ -407,6 +406,14 @@ config ARC_HAS_ACCL_REGS
           (also referred to as r58:r59). These can also be used by gcc as GPR so
           kernel needs to save/restore per process
 
+config ARC_IRQ_NO_AUTOSAVE
+        bool "Disable hardware autosave regfile on interrupts"
+        default n
+        help
+          On HS cores, taken interrupt auto saves the regfile on stack.
+          This is programmable and can be optionally disabled in which case
+          software INTERRUPT_PROLOGUE/EPILGUE do the needed work
+
 endif   # ISA_ARCV2
 
 endmenu   # "ARC CPU Configuration"
@@ -515,17 +522,6 @@ config ARC_DBG_TLB_PARANOIA
 
 endif
 
-config ARC_UBOOT_SUPPORT
-        bool "Support uboot arg Handling"
-        help
-          ARC Linux by default checks for uboot provided args as pointers to
-          external cmdline or DTB. This however breaks in absence of uboot,
-          when booting from Metaware debugger directly, as the registers are
-          not zeroed out on reset by mdb and/or ARCv2 based cores. The bogus
-          registers look like uboot args to kernel which then chokes.
-          So only enable the uboot arg checking/processing if users are sure
-          of uboot being in play.
-
 config ARC_BUILTIN_DTB_NAME
         string "Built in DTB"
         help
diff --git a/arch/arc/configs/nps_defconfig b/arch/arc/configs/nps_defconfig
index 6e84060e7c90..621f59407d76 100644
--- a/arch/arc/configs/nps_defconfig
+++ b/arch/arc/configs/nps_defconfig
@@ -31,7 +31,6 @@ CONFIG_ARC_CACHE_LINE_SHIFT=5
 # CONFIG_ARC_HAS_LLSC is not set
 CONFIG_ARC_KVADDR_SIZE=402
 CONFIG_ARC_EMUL_UNALIGNED=y
-CONFIG_ARC_UBOOT_SUPPORT=y
 CONFIG_PREEMPT=y
 CONFIG_NET=y
 CONFIG_UNIX=y
diff --git a/arch/arc/configs/vdk_hs38_defconfig b/arch/arc/configs/vdk_hs38_defconfig
index 1e59a2e9c602..e447ace6fa1c 100644
--- a/arch/arc/configs/vdk_hs38_defconfig
+++ b/arch/arc/configs/vdk_hs38_defconfig
@@ -13,7 +13,6 @@ CONFIG_PARTITION_ADVANCED=y
 CONFIG_ARC_PLAT_AXS10X=y
 CONFIG_AXS103=y
 CONFIG_ISA_ARCV2=y
-CONFIG_ARC_UBOOT_SUPPORT=y
 CONFIG_ARC_BUILTIN_DTB_NAME="vdk_hs38"
 CONFIG_PREEMPT=y
 CONFIG_NET=y
diff --git a/arch/arc/configs/vdk_hs38_smp_defconfig b/arch/arc/configs/vdk_hs38_smp_defconfig
index b5c3f6c54b03..c82cdb10aaf4 100644
--- a/arch/arc/configs/vdk_hs38_smp_defconfig
+++ b/arch/arc/configs/vdk_hs38_smp_defconfig
@@ -15,8 +15,6 @@ CONFIG_AXS103=y
 CONFIG_ISA_ARCV2=y
 CONFIG_SMP=y
 # CONFIG_ARC_TIMERS_64BIT is not set
-# CONFIG_ARC_SMP_HALT_ON_RESET is not set
-CONFIG_ARC_UBOOT_SUPPORT=y
 CONFIG_ARC_BUILTIN_DTB_NAME="vdk_hs38_smp"
 CONFIG_PREEMPT=y
 CONFIG_NET=y
diff --git a/arch/arc/include/asm/arcregs.h b/arch/arc/include/asm/arcregs.h
index f1b86cef0905..a27eafdc8260 100644
--- a/arch/arc/include/asm/arcregs.h
+++ b/arch/arc/include/asm/arcregs.h
@@ -151,6 +151,14 @@ struct bcr_isa_arcv2 {
 #endif
 };
 
+struct bcr_uarch_build_arcv2 {
+#ifdef CONFIG_CPU_BIG_ENDIAN
+        unsigned int pad:8, prod:8, maj:8, min:8;
+#else
+        unsigned int min:8, maj:8, prod:8, pad:8;
+#endif
+};
+
 struct bcr_mpy {
 #ifdef CONFIG_CPU_BIG_ENDIAN
         unsigned int pad:8, x1616:8, dsp:4, cycles:2, type:2, ver:8;
diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
index f393b663413e..2ad77fb43639 100644
--- a/arch/arc/include/asm/cache.h
+++ b/arch/arc/include/asm/cache.h
@@ -52,6 +52,17 @@
 #define cache_line_size()       SMP_CACHE_BYTES
 #define ARCH_DMA_MINALIGN       SMP_CACHE_BYTES
 
+/*
+ * Make sure slab-allocated buffers are 64-bit aligned when atomic64_t uses
+ * ARCv2 64-bit atomics (LLOCKD/SCONDD). This guarantess runtime 64-bit
+ * alignment for any atomic64_t embedded in buffer.
+ * Default ARCH_SLAB_MINALIGN is __alignof__(long long) which has a relaxed
+ * value of 4 (and not 8) in ARC ABI.
+ */
+#if defined(CONFIG_ARC_HAS_LL64) && defined(CONFIG_ARC_HAS_LLSC)
+#define ARCH_SLAB_MINALIGN      8
+#endif
+
 extern void arc_cache_init(void);
 extern char *arc_cache_mumbojumbo(int cpu_id, char *buf, int len);
 extern void read_decode_cache_bcr(void);
diff --git a/arch/arc/include/asm/entry-arcv2.h b/arch/arc/include/asm/entry-arcv2.h
index 309f4e6721b3..225e7df2d8ed 100644
--- a/arch/arc/include/asm/entry-arcv2.h
+++ b/arch/arc/include/asm/entry-arcv2.h
@@ -17,6 +17,33 @@
         ;
         ; Now manually save: r12, sp, fp, gp, r25
 
+#ifdef CONFIG_ARC_IRQ_NO_AUTOSAVE
+.ifnc \called_from, exception
+        st.as   r9, [sp, -10]   ; save r9 in it's final stack slot
+        sub     sp, sp, 12      ; skip JLI, LDI, EI
+
+        PUSH    lp_count
+        PUSHAX  lp_start
+        PUSHAX  lp_end
+        PUSH    blink
+
+        PUSH    r11
+        PUSH    r10
+
+        sub     sp, sp, 4       ; skip r9
+
+        PUSH    r8
+        PUSH    r7
+        PUSH    r6
+        PUSH    r5
+        PUSH    r4
+        PUSH    r3
+        PUSH    r2
+        PUSH    r1
+        PUSH    r0
+.endif
+#endif
+
 #ifdef CONFIG_ARC_HAS_ACCL_REGS
         PUSH    r59
         PUSH    r58
@@ -86,6 +113,33 @@
         POP     r59
 #endif
 
+#ifdef CONFIG_ARC_IRQ_NO_AUTOSAVE
+.ifnc \called_from, exception
+        POP     r0
+        POP     r1
+        POP     r2
+        POP     r3
+        POP     r4
+        POP     r5
+        POP     r6
+        POP     r7
+        POP     r8
+        POP     r9
+        POP     r10
+        POP     r11
+
+        POP     blink
+        POPAX   lp_end
+        POPAX   lp_start
+
+        POP     r9
+        mov     lp_count, r9
+
+        add     sp, sp, 12      ; skip JLI, LDI, EI
+        ld.as   r9, [sp, -10]   ; reload r9 which got clobbered
+.endif
+#endif
+
 .endm
 
 /*------------------------------------------------------------------------*/
diff --git a/arch/arc/include/asm/uaccess.h b/arch/arc/include/asm/uaccess.h
index c9173c02081c..eabc3efa6c6d 100644
--- a/arch/arc/include/asm/uaccess.h
+++ b/arch/arc/include/asm/uaccess.h
@@ -207,7 +207,7 @@ raw_copy_from_user(void *to, const void __user *from, unsigned long n)
                 */
                   "=&r" (tmp), "+r" (to), "+r" (from)
                 :
-                : "lp_count", "lp_start", "lp_end", "memory");
+                : "lp_count", "memory");
 
                 return n;
         }
@@ -433,7 +433,7 @@ raw_copy_to_user(void __user *to, const void *from, unsigned long n)
                  */
                   "=&r" (tmp), "+r" (to), "+r" (from)
                 :
-                : "lp_count", "lp_start", "lp_end", "memory");
+                : "lp_count", "memory");
 
                 return n;
         }
@@ -653,7 +653,7 @@ static inline unsigned long __arc_clear_user(void __user *to, unsigned long n)
         "       .previous                       \n"
         : "+r"(d_char), "+r"(res)
         : "i"(0)
-        : "lp_count", "lp_start", "lp_end", "memory");
+        : "lp_count", "memory");
 
         return res;
 }
@@ -686,7 +686,7 @@ __arc_strncpy_from_user(char *dst, const char __user *src, long count)
         "       .previous                       \n"
         : "+r"(res), "+r"(dst), "+r"(src), "=r"(val)
         : "g"(-EFAULT), "r"(count)
-        : "lp_count", "lp_start", "lp_end", "memory");
+        : "lp_count", "memory");
 
         return res;
 }
diff --git a/arch/arc/kernel/entry-arcv2.S b/arch/arc/kernel/entry-arcv2.S
index cc558a25b8fa..562089d62d9d 100644
--- a/arch/arc/kernel/entry-arcv2.S
+++ b/arch/arc/kernel/entry-arcv2.S
@@ -209,7 +209,9 @@ restore_regs:
 ;####### Return from Intr #######
 
 debug_marker_l1:
-        bbit1.nt r0, STATUS_DE_BIT, .Lintr_ret_to_delay_slot
+        ; bbit1.nt r0, STATUS_DE_BIT, .Lintr_ret_to_delay_slot
+        btst    r0, STATUS_DE_BIT               ; Z flag set if bit clear
+        bnz     .Lintr_ret_to_delay_slot        ; branch if STATUS_DE_BIT set
 
 .Lisr_ret_fast_path:
         ; Handle special case #1: (Entry via Exception, Return via IRQ)
diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S
index 8b90d25a15cc..30e090625916 100644
--- a/arch/arc/kernel/head.S
+++ b/arch/arc/kernel/head.S
@@ -17,6 +17,7 @@
 #include <asm/entry.h>
 #include <asm/arcregs.h>
 #include <asm/cache.h>
+#include <asm/irqflags.h>
 
 .macro CPU_EARLY_SETUP
 
@@ -47,6 +48,15 @@
         sr      r5, [ARC_REG_DC_CTRL]
 
 1:
+
+#ifdef CONFIG_ISA_ARCV2
+        ; Unaligned access is disabled at reset, so re-enable early as
+        ; gcc 7.3.1 (ARC GNU 2018.03) onwards generates unaligned access
+        ; by default
+        lr      r5, [status32]
+        bset    r5, r5, STATUS_AD_BIT
+        kflag   r5
+#endif
 .endm
 
         .section .init.text, "ax",@progbits
@@ -90,15 +100,13 @@ ENTRY(stext)
         st.ab   0, [r5, 4]
 1:
 
-#ifdef CONFIG_ARC_UBOOT_SUPPORT
         ; Uboot - kernel ABI
         ;    r0 = [0] No uboot interaction, [1] cmdline in r2, [2] DTB in r2
-        ;    r1 = magic number (board identity, unused as of now
+        ;    r1 = magic number (always zero as of now)
         ;    r2 = pointer to uboot provided cmdline or external DTB in mem
-        ; These are handled later in setup_arch()
+        ; These are handled later in handle_uboot_args()
         st      r0, [@uboot_tag]
         st      r2, [@uboot_arg]
-#endif
 
         ; setup "current" tsk and optionally cache it in dedicated r25
         mov     r9, @init_task
diff --git a/arch/arc/kernel/intc-arcv2.c b/arch/arc/kernel/intc-arcv2.c
index 067ea362fb3e..cf18b3e5a934 100644
--- a/arch/arc/kernel/intc-arcv2.c
+++ b/arch/arc/kernel/intc-arcv2.c
@@ -49,11 +49,13 @@ void arc_init_IRQ(void)
 
         *(unsigned int *)&ictrl = 0;
 
+#ifndef CONFIG_ARC_IRQ_NO_AUTOSAVE
         ictrl.save_nr_gpr_pairs = 6;    /* r0 to r11 (r12 saved manually) */
         ictrl.save_blink = 1;
         ictrl.save_lp_regs = 1;         /* LP_COUNT, LP_START, LP_END */
         ictrl.save_u_to_u = 0;          /* user ctxt saved on kernel stack */
         ictrl.save_idx_regs = 1;        /* JLI, LDI, EI */
+#endif
 
         WRITE_AUX(AUX_IRQ_CTRL, ictrl);
 
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index feb90093e6b1..7b2340996cf8 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -199,20 +199,36 @@ static void read_arc_build_cfg_regs(void)
                 cpu->bpu.ret_stk = 4 << bpu.rse;
 
                 if (cpu->core.family >= 0x54) {
-                        unsigned int exec_ctrl;
 
-                        READ_BCR(AUX_EXEC_CTRL, exec_ctrl);
-                        cpu->extn.dual_enb = !(exec_ctrl & 1);
+                        struct bcr_uarch_build_arcv2 uarch;
 
-                        /* dual issue always present for this core */
-                        cpu->extn.dual = 1;
+                        /*
+                         * The first 0x54 core (uarch maj:min 0:1 or 0:2) was
+                         * dual issue only (HS4x). But next uarch rev (1:0)
+                         * allows it be configured for single issue (HS3x)
+                         * Ensure we fiddle with dual issue only on HS4x
+                         */
+                        READ_BCR(ARC_REG_MICRO_ARCH_BCR, uarch);
+
+                        if (uarch.prod == 4) {
+                                unsigned int exec_ctrl;
+
+                                /* dual issue hardware always present */
+                                cpu->extn.dual = 1;
+
+                                READ_BCR(AUX_EXEC_CTRL, exec_ctrl);
+
+                                /* dual issue hardware enabled ? */
+                                cpu->extn.dual_enb = !(exec_ctrl & 1);
+
+                        }
                 }
         }
 
         READ_BCR(ARC_REG_AP_BCR, ap);
         if (ap.ver) {
                 cpu->extn.ap_num = 2 << ap.num;
-                cpu->extn.ap_full = !!ap.min;
+                cpu->extn.ap_full = !ap.min;
         }
 
         READ_BCR(ARC_REG_SMART_BCR, bcr);
@@ -462,43 +478,78 @@ void setup_processor(void)
         arc_chk_core_config();
 }
 
-static inline int is_kernel(unsigned long addr)
+static inline bool uboot_arg_invalid(unsigned long addr)
 {
-        if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
-                return 1;
-        return 0;
+        /*
+         * Check that it is a untranslated address (although MMU is not enabled
+         * yet, it being a high address ensures this is not by fluke)
+         */
+        if (addr < PAGE_OFFSET)
+                return true;
+
+        /* Check that address doesn't clobber resident kernel image */
+        return addr >= (unsigned long)_stext && addr <= (unsigned long)_end;
 }
 
-void __init setup_arch(char **cmdline_p)
+#define IGNORE_ARGS             "Ignore U-boot args: "
+
+/* uboot_tag values for U-boot - kernel ABI revision 0; see head.S */
+#define UBOOT_TAG_NONE          0
+#define UBOOT_TAG_CMDLINE       1
+#define UBOOT_TAG_DTB           2
+
+void __init handle_uboot_args(void)
 {
-#ifdef CONFIG_ARC_UBOOT_SUPPORT
-        /* make sure that uboot passed pointer to cmdline/dtb is valid */
-        if (uboot_tag && is_kernel((unsigned long)uboot_arg))
-                panic("Invalid uboot arg\n");
-
-        /* See if u-boot passed an external Device Tree blob */
-        machine_desc = setup_machine_fdt(uboot_arg);    /* uboot_tag == 2 */
-        if (!machine_desc)
-#endif
-        {
-                /* No, so try the embedded one */
+        bool use_embedded_dtb = true;
+        bool append_cmdline = false;
+
+        /* check that we know this tag */
+        if (uboot_tag != UBOOT_TAG_NONE &&
+            uboot_tag != UBOOT_TAG_CMDLINE &&
+            uboot_tag != UBOOT_TAG_DTB) {
+                pr_warn(IGNORE_ARGS "invalid uboot tag: '%08x'\n", uboot_tag);
+                goto ignore_uboot_args;
+        }
+
+        if (uboot_tag != UBOOT_TAG_NONE &&
+            uboot_arg_invalid((unsigned long)uboot_arg)) {
+                pr_warn(IGNORE_ARGS "invalid uboot arg: '%px'\n", uboot_arg);
+                goto ignore_uboot_args;
+        }
+
+        /* see if U-boot passed an external Device Tree blob */
+        if (uboot_tag == UBOOT_TAG_DTB) {
+                machine_desc = setup_machine_fdt((void *)uboot_arg);
+
+                /* external Device Tree blob is invalid - use embedded one */
+                use_embedded_dtb = !machine_desc;
+        }
+
+        if (uboot_tag == UBOOT_TAG_CMDLINE)
+                append_cmdline = true;
+
+ignore_uboot_args:
+
+        if (use_embedded_dtb) {
                 machine_desc = setup_machine_fdt(__dtb_start);
                 if (!machine_desc)
                         panic("Embedded DT invalid\n");
+        }
 
-                /*
-                 * If we are here, it is established that @uboot_arg didn't
-                 * point to DT blob. Instead if u-boot says it is cmdline,
-                 * append to embedded DT cmdline.
-                 * setup_machine_fdt() would have populated @boot_command_line
-                 */
-                if (uboot_tag == 1) {
-                        /* Ensure a whitespace between the 2 cmdlines */
-                        strlcat(boot_command_line, " ", COMMAND_LINE_SIZE);
-                        strlcat(boot_command_line, uboot_arg,
-                                COMMAND_LINE_SIZE);
-                }
+        /*
+         * NOTE: @boot_command_line is populated by setup_machine_fdt() so this
+         * append processing can only happen after.
+         */
+        if (append_cmdline) {
+                /* Ensure a whitespace between the 2 cmdlines */
+                strlcat(boot_command_line, " ", COMMAND_LINE_SIZE);
+                strlcat(boot_command_line, uboot_arg, COMMAND_LINE_SIZE);
         }
+}
+
+void __init setup_arch(char **cmdline_p)
+{
+        handle_uboot_args();
 
         /* Save unparsed command line copy for /proc/cmdline */
         *cmdline_p = boot_command_line;
diff --git a/arch/arc/lib/memcpy-archs.S b/arch/arc/lib/memcpy-archs.S
index d61044dd8b58..ea14b0bf3116 100644
--- a/arch/arc/lib/memcpy-archs.S
+++ b/arch/arc/lib/memcpy-archs.S
@@ -25,15 +25,11 @@
 #endif
 
 #ifdef CONFIG_ARC_HAS_LL64
-# define PREFETCH_READ(RX)      prefetch    [RX, 56]
-# define PREFETCH_WRITE(RX)     prefetchw   [RX, 64]
 # define LOADX(DST,RX)          ldd.ab  DST, [RX, 8]
 # define STOREX(SRC,RX)         std.ab  SRC, [RX, 8]
 # define ZOLSHFT                5
 # define ZOLAND                 0x1F
 #else
-# define PREFETCH_READ(RX)      prefetch    [RX, 28]
-# define PREFETCH_WRITE(RX)     prefetchw   [RX, 32]
 # define LOADX(DST,RX)          ld.ab   DST, [RX, 4]
 # define STOREX(SRC,RX)         st.ab   SRC, [RX, 4]
 # define ZOLSHFT                4
@@ -41,8 +37,6 @@
 #endif
 
 ENTRY_CFI(memcpy)
-        prefetch [r1]           ; Prefetch the read location
-        prefetchw [r0]          ; Prefetch the write location
         mov.f   0, r2
 ;;; if size is zero
         jz.d    [blink]
@@ -72,8 +66,6 @@ ENTRY_CFI(memcpy)
         lpnz    @.Lcopy32_64bytes
         ;; LOOP START
         LOADX (r6, r1)
-        PREFETCH_READ (r1)
-        PREFETCH_WRITE (r3)
         LOADX (r8, r1)
         LOADX (r10, r1)
         LOADX (r4, r1)
@@ -117,9 +109,7 @@ ENTRY_CFI(memcpy)
         lpnz    @.Lcopy8bytes_1
         ;; LOOP START
         ld.ab   r6, [r1, 4]
-        prefetch [r1, 28]       ;Prefetch the next read location
         ld.ab   r8, [r1,4]
-        prefetchw [r3, 32]      ;Prefetch the next write location
 
         SHIFT_1 (r7, r6, 24)
         or      r7, r7, r5
@@ -162,9 +152,7 @@ ENTRY_CFI(memcpy)
         lpnz    @.Lcopy8bytes_2
         ;; LOOP START
         ld.ab   r6, [r1, 4]
-        prefetch [r1, 28]       ;Prefetch the next read location
         ld.ab   r8, [r1,4]
-        prefetchw [r3, 32]      ;Prefetch the next write location
 
         SHIFT_1 (r7, r6, 16)
         or      r7, r7, r5
@@ -204,9 +192,7 @@ ENTRY_CFI(memcpy)
         lpnz    @.Lcopy8bytes_3
         ;; LOOP START
         ld.ab   r6, [r1, 4]
-        prefetch [r1, 28]       ;Prefetch the next read location
         ld.ab   r8, [r1,4]
-        prefetchw [r3, 32]      ;Prefetch the next write location
 
         SHIFT_1 (r7, r6, 8)
         or      r7, r7, r5
diff --git a/arch/arc/plat-hsdk/Kconfig b/arch/arc/plat-hsdk/Kconfig
index f25c085b9874..23e00216e5a5 100644
--- a/arch/arc/plat-hsdk/Kconfig
+++ b/arch/arc/plat-hsdk/Kconfig
@@ -9,6 +9,7 @@ menuconfig ARC_SOC_HSDK
         bool "ARC HS Development Kit SOC"
         depends on ISA_ARCV2
         select ARC_HAS_ACCL_REGS
+        select ARC_IRQ_NO_AUTOSAVE
         select CLK_HSDK
         select RESET_HSDK
         select HAVE_PCI
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 664e918e2624..26524b75970a 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1400,6 +1400,7 @@ config NR_CPUS
 config HOTPLUG_CPU
         bool "Support for hot-pluggable CPUs"
         depends on SMP
+        select GENERIC_IRQ_MIGRATION
         help
           Say Y here to experiment with turning CPUs off and on.  CPUs
           can be controlled through /sys/devices/system/cpu.
diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts
index b67f5fee1469..dce5be5df97b 100644
--- a/arch/arm/boot/dts/am335x-evm.dts
+++ b/arch/arm/boot/dts/am335x-evm.dts
@@ -729,7 +729,7 @@
 
 &cpsw_emac0 {
         phy-handle = <&ethphy0>;
-        phy-mode = "rgmii-txid";
+        phy-mode = "rgmii-id";
 };
 
 &tscadc {
diff --git a/arch/arm/boot/dts/am335x-evmsk.dts b/arch/arm/boot/dts/am335x-evmsk.dts
index 172c0224e7f6..b128998097ce 100644
--- a/arch/arm/boot/dts/am335x-evmsk.dts
+++ b/arch/arm/boot/dts/am335x-evmsk.dts
@@ -651,13 +651,13 @@
 
 &cpsw_emac0 {
         phy-handle = <&ethphy0>;
-        phy-mode = "rgmii-txid";
+        phy-mode = "rgmii-id";
         dual_emac_res_vlan = <1>;
 };
 
 &cpsw_emac1 {
         phy-handle = <&ethphy1>;
-        phy-mode = "rgmii-txid";
+        phy-mode = "rgmii-id";
         dual_emac_res_vlan = <2>;
 };
 
diff --git a/arch/arm/boot/dts/armada-xp-db.dts b/arch/arm/boot/dts/armada-xp-db.dts
index f3ac7483afed..5d04dc68cf57 100644
--- a/arch/arm/boot/dts/armada-xp-db.dts
+++ b/arch/arm/boot/dts/armada-xp-db.dts
@@ -144,30 +144,32 @@
                                 status = "okay";
                         };
 
-                        nand@d0000 {
+                        nand-controller@d0000 {
                                 status = "okay";
-                                label = "pxa3xx_nand-0";
-                                num-cs = <1>;
-                                marvell,nand-keep-config;
-                                nand-on-flash-bbt;
-
-                                partitions {
-                                        compatible = "fixed-partitions";
-                                        #address-cells = <1>;
-                                        #size-cells = <1>;
-
-                                        partition@0 {
-                                                label = "U-Boot";
-                                                reg = <0 0x800000>;
-                                        };
-                                        partition@800000 {
-                                                label = "Linux";
-                                                reg = <0x800000 0x800000>;
-                                        };
-                                        partition@1000000 {
-                                                label = "Filesystem";
-                                                reg = <0x1000000 0x3f000000>;
 
+                                nand@0 {
+                                        reg = <0>;
+                                        label = "pxa3xx_nand-0";
+                                        nand-rb = <0>;
+                                        nand-on-flash-bbt;
+
+                                        partitions {
+                                                compatible = "fixed-partitions";
+                                                #address-cells = <1>;
+                                                #size-cells = <1>;
+
+                                                partition@0 {
+                                                        label = "U-Boot";
+                                                        reg = <0 0x800000>;
+                                                };
+                                                partition@800000 {
+                                                        label = "Linux";
+                                                        reg = <0x800000 0x800000>;
+                                                };
+                                                partition@1000000 {
+                                                        label = "Filesystem";
+                                                        reg = <0x1000000 0x3f000000>;
+                                                };
                                         };
                                 };
                         };
diff --git a/arch/arm/boot/dts/armada-xp-gp.dts b/arch/arm/boot/dts/armada-xp-gp.dts
index 1139e9469a83..b4cca507cf13 100644
--- a/arch/arm/boot/dts/armada-xp-gp.dts
+++ b/arch/arm/boot/dts/armada-xp-gp.dts
@@ -160,12 +160,15 @@
                                 status = "okay";
                         };
 
-                        nand@d0000 {
+                        nand-controller@d0000 {
                                 status = "okay";
-                                label = "pxa3xx_nand-0";
-                                num-cs = <1>;
-                                marvell,nand-keep-config;
-                                nand-on-flash-bbt;
+
+                                nand@0 {
+                                        reg = <0>;
+                                        label = "pxa3xx_nand-0";
+                                        nand-rb = <0>;
+                                        nand-on-flash-bbt;
+                                };
                         };
                 };
 
diff --git a/arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts b/arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts
index bbbb38888bb8..87dcb502f72d 100644
--- a/arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts
+++ b/arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts
@@ -81,49 +81,52 @@
 
                         };
 
-                        nand@d0000 {
+                        nand-controller@d0000 {
                                 status = "okay";
-                                label = "pxa3xx_nand-0";
-                                num-cs = <1>;
-                                marvell,nand-keep-config;
-                                nand-on-flash-bbt;
-
-                                partitions {
-                                        compatible = "fixed-partitions";
-                                        #address-cells = <1>;
-                                        #size-cells = <1>;
-
-                                        partition@0 {
-                                                label = "u-boot";
-                                                reg = <0x00000000 0x000e0000>;
-                                                read-only;
-                                        };
-
-                                        partition@e0000 {
-                                                label = "u-boot-env";
-                                                reg = <0x000e0000 0x00020000>;
-                                                read-only;
-                                        };
-
-                                        partition@100000 {
-                                                label = "u-boot-env2";
-                                                reg = <0x00100000 0x00020000>;
-                                                read-only;
-                                        };
-
-                                        partition@120000 {
-                                                label = "zImage";
-                                                reg = <0x00120000 0x00400000>;
-                                        };
-
-                                        partition@520000 {
-                                                label = "initrd";
-                                                reg = <0x00520000 0x00400000>;
-                                        };
 
-                                        partition@e00000 {
-                                                label = "boot";
-                                                reg = <0x00e00000 0x3f200000>;
+                                nand@0 {
+                                        reg = <0>;
+                                        label = "pxa3xx_nand-0";
+                                        nand-rb = <0>;
+                                        nand-on-flash-bbt;
+
+                                        partitions {
+                                                compatible = "fixed-partitions";
+                                                #address-cells = <1>;
+                                                #size-cells = <1>;
+
+                                                partition@0 {
+                                                        label = "u-boot";
+                                                        reg = <0x00000000 0x000e0000>;
+                                                        read-only;
+                                                };
+
+                                                partition@e0000 {
+                                                        label = "u-boot-env";
+                                                        reg = <0x000e0000 0x00020000>;
+                                                        read-only;
+                                                };
+
+                                                partition@100000 {
+                                                        label = "u-boot-env2";
+                                                        reg = <0x00100000 0x00020000>;
+                                                        read-only;
+                                                };
+
+                                                partition@120000 {
+                                                        label = "zImage";
+                                                        reg = <0x00120000 0x00400000>;
+                                                };
+
+                                                partition@520000 {
+                                                        label = "initrd";
+                                                        reg = <0x00520000 0x00400000>;
+                                                };
+
+                                                partition@e00000 {
+                                                        label = "boot";
+                                                        reg = <0x00e00000 0x3f200000>;
+                                                };
                                         };
                                 };
                         };
diff --git a/arch/arm/boot/dts/tegra124-nyan.dtsi b/arch/arm/boot/dts/tegra124-nyan.dtsi
index d5f11d6d987e..bc85b6a166c7 100644
--- a/arch/arm/boot/dts/tegra124-nyan.dtsi
+++ b/arch/arm/boot/dts/tegra124-nyan.dtsi
@@ -13,10 +13,25 @@
                 stdout-path = "serial0:115200n8";
         };
 
-        memory@80000000 {
+        /*
+         * Note that recent version of the device tree compiler (starting with
+         * version 1.4.2) warn about this node containing a reg property, but
+         * missing a unit-address. However, the bootloader on these Chromebook
+         * devices relies on the full name of this node to be exactly /memory.
+         * Adding the unit-address causes the bootloader to create a /memory
+         * node and write the memory bank configuration to that node, which in
+         * turn leads the kernel to believe that the device has 2 GiB of
+         * memory instead of the amount detected by the bootloader.
+         *
+         * The name of this node is effectively ABI and must not be changed.
+         */
+        memory {
+                device_type = "memory";
                 reg = <0x0 0x80000000 0x0 0x80000000>;
         };
 
+        /delete-node/ memory@80000000;
+
         host1x@50000000 {
                 hdmi@54280000 {
                         status = "okay";
diff --git a/arch/arm/include/asm/irq.h b/arch/arm/include/asm/irq.h
index c883fcbe93b6..46d41140df27 100644
--- a/arch/arm/include/asm/irq.h
+++ b/arch/arm/include/asm/irq.h
@@ -25,7 +25,6 @@
 #ifndef __ASSEMBLY__
 struct irqaction;
 struct pt_regs;
-extern void migrate_irqs(void);
 
 extern void asm_do_IRQ(unsigned int, struct pt_regs *);
 void handle_IRQ(unsigned int, struct pt_regs *);
diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c
index 9908dacf9229..844861368cd5 100644
--- a/arch/arm/kernel/irq.c
+++ b/arch/arm/kernel/irq.c
@@ -31,7 +31,6 @@
 #include <linux/smp.h>
 #include <linux/init.h>
 #include <linux/seq_file.h>
-#include <linux/ratelimit.h>
 #include <linux/errno.h>
 #include <linux/list.h>
 #include <linux/kallsyms.h>
@@ -109,64 +108,3 @@ int __init arch_probe_nr_irqs(void)
         return nr_irqs;
 }
 #endif
-
-#ifdef CONFIG_HOTPLUG_CPU
-static bool migrate_one_irq(struct irq_desc *desc)
-{
-        struct irq_data *d = irq_desc_get_irq_data(desc);
-        const struct cpumask *affinity = irq_data_get_affinity_mask(d);
-        struct irq_chip *c;
-        bool ret = false;
-
-        /*
-         * If this is a per-CPU interrupt, or the affinity does not
-         * include this CPU, then we have nothing to do.
-         */
-        if (irqd_is_per_cpu(d) || !cpumask_test_cpu(smp_processor_id(), affinity))
-                return false;
-
-        if (cpumask_any_and(affinity, cpu_online_mask) >= nr_cpu_ids) {
-                affinity = cpu_online_mask;
-                ret = true;
-        }
-
-        c = irq_data_get_irq_chip(d);
-        if (!c->irq_set_affinity)
-                pr_debug("IRQ%u: unable to set affinity\n", d->irq);
-        else if (c->irq_set_affinity(d, affinity, false) == IRQ_SET_MASK_OK && ret)
-                cpumask_copy(irq_data_get_affinity_mask(d), affinity);
-
-        return ret;
-}
-
-/*
- * The current CPU has been marked offline.  Migrate IRQs off this CPU.
- * If the affinity settings do not allow other CPUs, force them onto any
- * available CPU.
- *
- * Note: we must iterate over all IRQs, whether they have an attached
- * action structure or not, as we need to get chained interrupts too.
- */
-void migrate_irqs(void)
-{
-        unsigned int i;
-        struct irq_desc *desc;
-        unsigned long flags;
-
-        local_irq_save(flags);
-
-        for_each_irq_desc(i, desc) {
-                bool affinity_broken;
-
-                raw_spin_lock(&desc->lock);
-                affinity_broken = migrate_one_irq(desc);
-                raw_spin_unlock(&desc->lock);
-
-                if (affinity_broken)
-                        pr_warn_ratelimited("IRQ%u no longer affine to CPU%u\n",
-                                i, smp_processor_id());
-        }
-
-        local_irq_restore(flags);
-}
-#endif /* CONFIG_HOTPLUG_CPU */
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 3bf82232b1be..1d6f5ea522f4 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -254,7 +254,7 @@ int __cpu_disable(void)
         /*
          * OK - migrate IRQs away from this CPU
          */
-        migrate_irqs();
+        irq_migrate_all_off_this_cpu();
 
         /*
          * Flush user cache and TLB mappings, and then remove this CPU
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index f1e2922e447c..1e3e08a1c456 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -2390,4 +2390,6 @@ void arch_teardown_dma_ops(struct device *dev)
                 return;
 
         arm_teardown_iommu_dma_ops(dev);
+        /* Let arch_setup_dma_ops() start again from scratch upon re-probe */
+        set_dma_ops(dev, NULL);
 }
diff --git a/arch/arm/probes/kprobes/opt-arm.c b/arch/arm/probes/kprobes/opt-arm.c
index 2c118a6ab358..0dc23fc227ed 100644
--- a/arch/arm/probes/kprobes/opt-arm.c
+++ b/arch/arm/probes/kprobes/opt-arm.c
@@ -247,7 +247,7 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, struct kprobe *or
         }
 
         /* Copy arch-dep-instance from template. */
-        memcpy(code, (unsigned char *)optprobe_template_entry,
+        memcpy(code, (unsigned long *)&optprobe_template_entry,
                         TMPL_END_IDX * sizeof(kprobe_opcode_t));
 
         /* Adjust buffer according to instruction. */
diff --git a/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts b/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts
index 5b4a9609e31f..2468762283a5 100644
--- a/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts
+++ b/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts
@@ -351,7 +351,7 @@
                 reg = <0>;
                 pinctrl-names = "default";
                 pinctrl-0 = <&cp0_copper_eth_phy_reset>;
-                reset-gpios = <&cp1_gpio1 11 GPIO_ACTIVE_LOW>;
+                reset-gpios = <&cp0_gpio2 11 GPIO_ACTIVE_LOW>;
                 reset-assert-us = <10000>;
         };
 
diff --git a/arch/arm64/include/asm/neon-intrinsics.h b/arch/arm64/include/asm/neon-intrinsics.h
index 2ba6c6b9541f..71abfc7612b2 100644
--- a/arch/arm64/include/asm/neon-intrinsics.h
+++ b/arch/arm64/include/asm/neon-intrinsics.h
@@ -36,4 +36,8 @@
 #include <arm_neon.h>
 #endif
 
+#ifdef CONFIG_CC_IS_CLANG
+#pragma clang diagnostic ignored "-Wincompatible-pointer-types"
+#endif
+
 #endif /* __ASM_NEON_INTRINSICS_H */
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 15d79a8e5e5e..eecf7927dab0 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -539,8 +539,7 @@ set_hcr:
         /* GICv3 system register access */
         mrs     x0, id_aa64pfr0_el1
         ubfx    x0, x0, #24, #4
-        cmp     x0, #1
-        b.ne    3f
+        cbz     x0, 3f
 
         mrs_s   x0, SYS_ICC_SRE_EL2
         orr     x0, x0, #ICC_SRE_EL2_SRE        // Set ICC_SRE_EL2.SRE==1
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index 9dce33b0e260..ddaea0fd2fa4 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -1702,19 +1702,20 @@ void syscall_trace_exit(struct pt_regs *regs)
 }
 
 /*
- * SPSR_ELx bits which are always architecturally RES0 per ARM DDI 0487C.a
- * We also take into account DIT (bit 24), which is not yet documented, and
- * treat PAN and UAO as RES0 bits, as they are meaningless at EL0, and may be
- * allocated an EL0 meaning in future.
+ * SPSR_ELx bits which are always architecturally RES0 per ARM DDI 0487D.a.
+ * We permit userspace to set SSBS (AArch64 bit 12, AArch32 bit 23) which is
+ * not described in ARM DDI 0487D.a.
+ * We treat PAN and UAO as RES0 bits, as they are meaningless at EL0, and may
+ * be allocated an EL0 meaning in future.
  * Userspace cannot use these until they have an architectural meaning.
  * Note that this follows the SPSR_ELx format, not the AArch32 PSR format.
  * We also reserve IL for the kernel; SS is handled dynamically.
  */
 #define SPSR_EL1_AARCH64_RES0_BITS \
-        (GENMASK_ULL(63,32) | GENMASK_ULL(27, 25) | GENMASK_ULL(23, 22) | \
-         GENMASK_ULL(20, 10) | GENMASK_ULL(5, 5))
+        (GENMASK_ULL(63, 32) | GENMASK_ULL(27, 25) | GENMASK_ULL(23, 22) | \
+         GENMASK_ULL(20, 13) | GENMASK_ULL(11, 10) | GENMASK_ULL(5, 5))
 #define SPSR_EL1_AARCH32_RES0_BITS \
-        (GENMASK_ULL(63,32) | GENMASK_ULL(23, 22) | GENMASK_ULL(20,20))
+        (GENMASK_ULL(63, 32) | GENMASK_ULL(22, 22) | GENMASK_ULL(20, 20))
 
 static int valid_compat_regs(struct user_pt_regs *regs)
 {
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index d09ec76f08cf..009849328289 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -339,6 +339,9 @@ void __init setup_arch(char **cmdline_p)
         smp_init_cpus();
         smp_build_mpidr_hash();
 
+        /* Init percpu seeds for random tags after cpus are set up. */
+        kasan_init_tags();
+
 #ifdef CONFIG_ARM64_SW_TTBR0_PAN
         /*
          * Make sure init_thread_info.ttbr0 always generates translation
diff --git a/arch/arm64/mm/kasan_init.c b/arch/arm64/mm/kasan_init.c
index 4b55b15707a3..f37a86d2a69d 100644
--- a/arch/arm64/mm/kasan_init.c
+++ b/arch/arm64/mm/kasan_init.c
@@ -252,8 +252,6 @@ void __init kasan_init(void)
         memset(kasan_early_shadow_page, KASAN_SHADOW_INIT, PAGE_SIZE);
         cpu_replace_ttbr1(lm_alias(swapper_pg_dir));
 
-        kasan_init_tags();
-
         /* At this point kasan is fully initialized. Enable error messages */
         init_task.kasan_depth = 0;
         pr_info("KernelAddressSanitizer initialized\n");
diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c
index b16710a8a9e7..76e9bf88d3b9 100644
--- a/arch/mips/net/ebpf_jit.c
+++ b/arch/mips/net/ebpf_jit.c
@@ -79,8 +79,6 @@ enum reg_val_type {
         REG_64BIT_32BIT,
         /* 32-bit compatible, need truncation for 64-bit ops. */
         REG_32BIT,
-        /* 32-bit zero extended. */
-        REG_32BIT_ZERO_EX,
         /* 32-bit no sign/zero extension needed. */
         REG_32BIT_POS
 };
@@ -343,12 +341,15 @@ static int build_int_epilogue(struct jit_ctx *ctx, int dest_reg)
         const struct bpf_prog *prog = ctx->skf;
         int stack_adjust = ctx->stack_size;
         int store_offset = stack_adjust - 8;
+        enum reg_val_type td;
         int r0 = MIPS_R_V0;
 
-        if (dest_reg == MIPS_R_RA &&
-            get_reg_val_type(ctx, prog->len, BPF_REG_0) == REG_32BIT_ZERO_EX)
+        if (dest_reg == MIPS_R_RA) {
                 /* Don't let zero extended value escape. */
-                emit_instr(ctx, sll, r0, r0, 0);
+                td = get_reg_val_type(ctx, prog->len, BPF_REG_0);
+                if (td == REG_64BIT)
+                        emit_instr(ctx, sll, r0, r0, 0);
+        }
 
         if (ctx->flags & EBPF_SAVE_RA) {
                 emit_instr(ctx, ld, MIPS_R_RA, store_offset, MIPS_R_SP);
@@ -692,7 +693,7 @@ static int build_one_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
                 if (dst < 0)
                         return dst;
                 td = get_reg_val_type(ctx, this_idx, insn->dst_reg);
-                if (td == REG_64BIT || td == REG_32BIT_ZERO_EX) {
+                if (td == REG_64BIT) {
                         /* sign extend */
                         emit_instr(ctx, sll, dst, dst, 0);
                 }
@@ -707,7 +708,7 @@ static int build_one_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
                 if (dst < 0)
                         return dst;
                 td = get_reg_val_type(ctx, this_idx, insn->dst_reg);
-                if (td == REG_64BIT || td == REG_32BIT_ZERO_EX) {
+                if (td == REG_64BIT) {
                         /* sign extend */
                         emit_instr(ctx, sll, dst, dst, 0);
                 }
@@ -721,7 +722,7 @@ static int build_one_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
                 if (dst < 0)
                         return dst;
                 td = get_reg_val_type(ctx, this_idx, insn->dst_reg);
-                if (td == REG_64BIT || td == REG_32BIT_ZERO_EX)
+                if (td == REG_64BIT)
                         /* sign extend */
                         emit_instr(ctx, sll, dst, dst, 0);
                 if (insn->imm == 1) {
@@ -860,13 +861,13 @@ static int build_one_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
                 if (src < 0 || dst < 0)
                         return -EINVAL;
                 td = get_reg_val_type(ctx, this_idx, insn->dst_reg);
-                if (td == REG_64BIT || td == REG_32BIT_ZERO_EX) {
+                if (td == REG_64BIT) {
                         /* sign extend */
                         emit_instr(ctx, sll, dst, dst, 0);
                 }
                 did_move = false;
                 ts = get_reg_val_type(ctx, this_idx, insn->src_reg);
-                if (ts == REG_64BIT || ts == REG_32BIT_ZERO_EX) {
+                if (ts == REG_64BIT) {
                         int tmp_reg = MIPS_R_AT;
 
                         if (bpf_op == BPF_MOV) {
@@ -1254,8 +1255,7 @@ jeq_common:
                 if (insn->imm == 64 && td == REG_32BIT)
                         emit_instr(ctx, dinsu, dst, MIPS_R_ZERO, 32, 32);
 
-                if (insn->imm != 64 &&
-                    (td == REG_64BIT || td == REG_32BIT_ZERO_EX)) {
+                if (insn->imm != 64 && td == REG_64BIT) {
                         /* sign extend */
                         emit_instr(ctx, sll, dst, dst, 0);
                 }
diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
index 2582df1c529b..0964c236e3e5 100644
--- a/arch/parisc/kernel/ptrace.c
+++ b/arch/parisc/kernel/ptrace.c
@@ -308,15 +308,29 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
 
 long do_syscall_trace_enter(struct pt_regs *regs)
 {
-        if (test_thread_flag(TIF_SYSCALL_TRACE) &&
-            tracehook_report_syscall_entry(regs)) {
+        if (test_thread_flag(TIF_SYSCALL_TRACE)) {
+                int rc = tracehook_report_syscall_entry(regs);
+
                 /*
-                 * Tracing decided this syscall should not happen or the
-                 * debugger stored an invalid system call number. Skip
-                 * the system call and the system call restart handling.
+                 * As tracesys_next does not set %r28 to -ENOSYS
+                 * when %r20 is set to -1, initialize it here.
                  */
-                regs->gr[20] = -1UL;
-                goto out;
+                regs->gr[28] = -ENOSYS;
+
+                if (rc) {
+                        /*
+                         * A nonzero return code from
+                         * tracehook_report_syscall_entry() tells us
+                         * to prevent the syscall execution.  Skip
+                         * the syscall call and the syscall restart handling.
+                         *
+                         * Note that the tracer may also just change
+                         * regs->gr[20] to an invalid syscall number,
+                         * that is handled by tracesys_next.
+                         */
+                        regs->gr[20] = -1UL;
+                        return -1;
+                }
         }
 
         /* Do the secure computing check after ptrace. */
@@ -340,7 +354,6 @@ long do_syscall_trace_enter(struct pt_regs *regs)
                         regs->gr[24] & 0xffffffff,
                         regs->gr[23] & 0xffffffff);
 
-out:
         /*
          * Sign extend the syscall number to 64bit since it may have been
          * modified by a compat ptrace call
diff --git a/arch/sh/boot/dts/Makefile b/arch/sh/boot/dts/Makefile
index 01d0f7fb14cc..2563d1e532e2 100644
--- a/arch/sh/boot/dts/Makefile
+++ b/arch/sh/boot/dts/Makefile
@@ -1,3 +1,3 @@
 ifneq ($(CONFIG_BUILTIN_DTB_SOURCE),"")
-obj-y += $(patsubst "%",%,$(CONFIG_BUILTIN_DTB_SOURCE)).dtb.o
+obj-$(CONFIG_USE_BUILTIN_DTB) += $(patsubst "%",%,$(CONFIG_BUILTIN_DTB_SOURCE)).dtb.o
 endif
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 17eb09d222ff..ec78a04eb136 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -122,8 +122,10 @@ static void alg_do_release(const struct af_alg_type *type, void *private)
 
 int af_alg_release(struct socket *sock)
 {
-        if (sock->sk)
+        if (sock->sk) {
                 sock_put(sock->sk);
+                sock->sk = NULL;
+        }
         return 0;
 }
 EXPORT_SYMBOL_GPL(af_alg_release);
diff --git a/drivers/clk/at91/at91sam9x5.c b/drivers/clk/at91/at91sam9x5.c
index 2fe225a697df..3487e03d4bc6 100644
--- a/drivers/clk/at91/at91sam9x5.c
+++ b/drivers/clk/at91/at91sam9x5.c
@@ -144,8 +144,7 @@ static void __init at91sam9x5_pmc_setup(struct device_node *np,
                 return;
 
         at91sam9x5_pmc = pmc_data_allocate(PMC_MAIN + 1,
-                                           nck(at91sam9x5_systemck),
-                                           nck(at91sam9x35_periphck), 0);
+                                           nck(at91sam9x5_systemck), 31, 0);
         if (!at91sam9x5_pmc)
                 return;
 
@@ -210,7 +209,7 @@ static void __init at91sam9x5_pmc_setup(struct device_node *np,
         parent_names[1] = "mainck";
         parent_names[2] = "plladivck";
         parent_names[3] = "utmick";
-        parent_names[4] = "mck";
+        parent_names[4] = "masterck";
         for (i = 0; i < 2; i++) {
                 char name[6];
 
diff --git a/drivers/clk/at91/sama5d2.c b/drivers/clk/at91/sama5d2.c
index d69ad96fe988..cd0ef7274fdb 100644
--- a/drivers/clk/at91/sama5d2.c
+++ b/drivers/clk/at91/sama5d2.c
@@ -240,7 +240,7 @@ static void __init sama5d2_pmc_setup(struct device_node *np)
         parent_names[1] = "mainck";
         parent_names[2] = "plladivck";
         parent_names[3] = "utmick";
-        parent_names[4] = "mck";
+        parent_names[4] = "masterck";
         for (i = 0; i < 3; i++) {
                 char name[6];
 
@@ -291,7 +291,7 @@ static void __init sama5d2_pmc_setup(struct device_node *np)
         parent_names[1] = "mainck";
         parent_names[2] = "plladivck";
         parent_names[3] = "utmick";
-        parent_names[4] = "mck";
+        parent_names[4] = "masterck";
         parent_names[5] = "audiopll_pmcck";
         for (i = 0; i < ARRAY_SIZE(sama5d2_gck); i++) {
                 hw = at91_clk_register_generated(regmap, &pmc_pcr_lock,
diff --git a/drivers/clk/at91/sama5d4.c b/drivers/clk/at91/sama5d4.c
index e358be7f6c8d..b645a9d59cdb 100644
--- a/drivers/clk/at91/sama5d4.c
+++ b/drivers/clk/at91/sama5d4.c
@@ -207,7 +207,7 @@ static void __init sama5d4_pmc_setup(struct device_node *np)
         parent_names[1] = "mainck";
         parent_names[2] = "plladivck";
         parent_names[3] = "utmick";
-        parent_names[4] = "mck";
+        parent_names[4] = "masterck";
         for (i = 0; i < 3; i++) {
                 char name[6];
 
diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
index 3b97f60540ad..609970c0b666 100644
--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
@@ -264,9 +264,9 @@ static SUNXI_CCU_GATE(ahb1_mmc1_clk,	"ahb1-mmc1",	"ahb1",
 static SUNXI_CCU_GATE(ahb1_mmc2_clk,    "ahb1-mmc2",    "ahb1",
                       0x060, BIT(10), 0);
 static SUNXI_CCU_GATE(ahb1_mmc3_clk,    "ahb1-mmc3",    "ahb1",
-                      0x060, BIT(12), 0);
+                      0x060, BIT(11), 0);
 static SUNXI_CCU_GATE(ahb1_nand1_clk,   "ahb1-nand1",   "ahb1",
-                      0x060, BIT(13), 0);
+                      0x060, BIT(12), 0);
 static SUNXI_CCU_GATE(ahb1_nand0_clk,   "ahb1-nand0",   "ahb1",
                       0x060, BIT(13), 0);
 static SUNXI_CCU_GATE(ahb1_sdram_clk,   "ahb1-sdram",   "ahb1",
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
index 621b1cd996db..ac12f261f8ca 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
@@ -542,7 +542,7 @@ static struct ccu_reset_map sun8i_v3s_ccu_resets[] = {
         [RST_BUS_OHCI0]         =  { 0x2c0, BIT(29) },
 
         [RST_BUS_VE]            =  { 0x2c4, BIT(0) },
-        [RST_BUS_TCON0]         =  { 0x2c4, BIT(3) },
+        [RST_BUS_TCON0]         =  { 0x2c4, BIT(4) },
         [RST_BUS_CSI]           =  { 0x2c4, BIT(8) },
         [RST_BUS_DE]            =  { 0x2c4, BIT(12) },
         [RST_BUS_DBG]           =  { 0x2c4, BIT(31) },
diff --git a/drivers/gpio/gpio-mt7621.c b/drivers/gpio/gpio-mt7621.c
index 00e954f22bc9..74401e0adb29 100644
--- a/drivers/gpio/gpio-mt7621.c
+++ b/drivers/gpio/gpio-mt7621.c
@@ -30,6 +30,7 @@
 #define GPIO_REG_EDGE           0xA0
 
 struct mtk_gc {
+        struct irq_chip irq_chip;
         struct gpio_chip chip;
         spinlock_t lock;
         int bank;
@@ -189,13 +190,6 @@ mediatek_gpio_irq_type(struct irq_data *d, unsigned int type)
         return 0;
 }
 
-static struct irq_chip mediatek_gpio_irq_chip = {
-        .irq_unmask             = mediatek_gpio_irq_unmask,
-        .irq_mask               = mediatek_gpio_irq_mask,
-        .irq_mask_ack           = mediatek_gpio_irq_mask,
-        .irq_set_type           = mediatek_gpio_irq_type,
-};
-
 static int
 mediatek_gpio_xlate(struct gpio_chip *chip,
                     const struct of_phandle_args *spec, u32 *flags)
@@ -254,6 +248,13 @@ mediatek_gpio_bank_probe(struct device *dev,
                 return ret;
         }
 
+        rg->irq_chip.name = dev_name(dev);
+        rg->irq_chip.parent_device = dev;
+        rg->irq_chip.irq_unmask = mediatek_gpio_irq_unmask;
+        rg->irq_chip.irq_mask = mediatek_gpio_irq_mask;
+        rg->irq_chip.irq_mask_ack = mediatek_gpio_irq_mask;
+        rg->irq_chip.irq_set_type = mediatek_gpio_irq_type;
+
         if (mtk->gpio_irq) {
                 /*
                  * Manually request the irq here instead of passing
@@ -270,14 +271,14 @@ mediatek_gpio_bank_probe(struct device *dev,
                         return ret;
                 }
 
-                ret = gpiochip_irqchip_add(&rg->chip, &mediatek_gpio_irq_chip,
+                ret = gpiochip_irqchip_add(&rg->chip, &rg->irq_chip,
                                            0, handle_simple_irq, IRQ_TYPE_NONE);
                 if (ret) {
                         dev_err(dev, "failed to add gpiochip_irqchip\n");
                         return ret;
                 }
 
-                gpiochip_set_chained_irqchip(&rg->chip, &mediatek_gpio_irq_chip,
+                gpiochip_set_chained_irqchip(&rg->chip, &rg->irq_chip,
                                              mtk->gpio_irq, NULL);
         }
 
@@ -310,7 +311,6 @@ mediatek_gpio_probe(struct platform_device *pdev)
         mtk->gpio_irq = irq_of_parse_and_map(np, 0);
         mtk->dev = dev;
         platform_set_drvdata(pdev, mtk);
-        mediatek_gpio_irq_chip.name = dev_name(dev);
 
         for (i = 0; i < MTK_BANK_CNT; i++) {
                 ret = mediatek_gpio_bank_probe(dev, np, i);
diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
index e9600b556f39..bcc6be4a5cb2 100644
--- a/drivers/gpio/gpio-pxa.c
+++ b/drivers/gpio/gpio-pxa.c
@@ -245,6 +245,7 @@ static bool pxa_gpio_has_pinctrl(void)
 {
         switch (gpio_type) {
         case PXA3XX_GPIO:
+        case MMP2_GPIO:
                 return false;
 
         default:
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index bc62bf41b7e9..5dc349173e4f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -212,6 +212,7 @@ int amdgpu_driver_load_kms(struct drm_device *dev, unsigned long flags)
         }
 
         if (amdgpu_device_is_px(dev)) {
+                dev_pm_set_driver_flags(dev->dev, DPM_FLAG_NEVER_SKIP);
                 pm_runtime_use_autosuspend(dev->dev);
                 pm_runtime_set_autosuspend_delay(dev->dev, 5000);
                 pm_runtime_set_active(dev->dev);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 7c108e687683..698bcb8ce61d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -638,12 +638,14 @@ void amdgpu_vm_move_to_lru_tail(struct amdgpu_device *adev,
         struct ttm_bo_global *glob = adev->mman.bdev.glob;
         struct amdgpu_vm_bo_base *bo_base;
 
+#if 0
         if (vm->bulk_moveable) {
                 spin_lock(&glob->lru_lock);
                 ttm_bo_bulk_move_lru_tail(&vm->lru_bulk_move);
                 spin_unlock(&glob->lru_lock);
                 return;
         }
+#endif
 
         memset(&vm->lru_bulk_move, 0, sizeof(vm->lru_bulk_move));
 
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
index 6811a5d05b27..aa2f71cc1eba 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
@@ -128,7 +128,7 @@ static const struct soc15_reg_golden golden_settings_sdma0_4_2_init[] = {
 
 static const struct soc15_reg_golden golden_settings_sdma0_4_2[] =
 {
-        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_CHICKEN_BITS, 0xfe931f07, 0x02831d07),
+        SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_CHICKEN_BITS, 0xfe931f07, 0x02831f07),
         SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_CLK_CTRL, 0xffffffff, 0x3f000100),
         SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_GB_ADDR_CONFIG, 0x0000773f, 0x00004002),
         SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_GB_ADDR_CONFIG_READ, 0x0000773f, 0x00004002),
@@ -158,7 +158,7 @@ static const struct soc15_reg_golden golden_settings_sdma0_4_2[] =
 };
 
 static const struct soc15_reg_golden golden_settings_sdma1_4_2[] = {
-        SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_CHICKEN_BITS, 0xfe931f07, 0x02831d07),
+        SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_CHICKEN_BITS, 0xfe931f07, 0x02831f07),
         SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_CLK_CTRL, 0xffffffff, 0x3f000100),
         SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_GB_ADDR_CONFIG, 0x0000773f, 0x00004002),
         SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_GB_ADDR_CONFIG_READ, 0x0000773f, 0x00004002),
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 0b392bfca284..5296b8f3e0ab 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -786,12 +786,13 @@ static int dm_suspend(void *handle)
         struct amdgpu_display_manager *dm = &adev->dm;
         int ret = 0;
 
+        WARN_ON(adev->dm.cached_state);
+        adev->dm.cached_state = drm_atomic_helper_suspend(adev->ddev);
+
         s3_handle_mst(adev->ddev, true);
 
         amdgpu_dm_irq_suspend(adev);
 
-        WARN_ON(adev->dm.cached_state);
-        adev->dm.cached_state = drm_atomic_helper_suspend(adev->ddev);
 
         dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D3);
 
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c
index 19801bdba0d2..7a72ee46f14b 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c
@@ -662,6 +662,11 @@ static void dce11_update_clocks(struct clk_mgr *clk_mgr,
 {
         struct dce_clk_mgr *clk_mgr_dce = TO_DCE_CLK_MGR(clk_mgr);
         struct dm_pp_power_level_change_request level_change_req;
+        int patched_disp_clk = context->bw.dce.dispclk_khz;
+
+        /*TODO: W/A for dal3 linux, investigate why this works */
+        if (!clk_mgr_dce->dfs_bypass_active)
+                patched_disp_clk = patched_disp_clk * 115 / 100;
 
         level_change_req.power_level = dce_get_required_clocks_state(clk_mgr, context);
         /* get max clock state from PPLIB */
@@ -671,9 +676,9 @@ static void dce11_update_clocks(struct clk_mgr *clk_mgr,
                         clk_mgr_dce->cur_min_clks_state = level_change_req.power_level;
         }
 
-        if (should_set_clock(safe_to_lower, context->bw.dce.dispclk_khz, clk_mgr->clks.dispclk_khz)) {
-                context->bw.dce.dispclk_khz = dce_set_clock(clk_mgr, context->bw.dce.dispclk_khz);
-                clk_mgr->clks.dispclk_khz = context->bw.dce.dispclk_khz;
+        if (should_set_clock(safe_to_lower, patched_disp_clk, clk_mgr->clks.dispclk_khz)) {
+                context->bw.dce.dispclk_khz = dce_set_clock(clk_mgr, patched_disp_clk);
+                clk_mgr->clks.dispclk_khz = patched_disp_clk;
         }
         dce11_pplib_apply_display_requirements(clk_mgr->ctx->dc, context);
 }
diff --git a/drivers/gpu/drm/amd/display/dc/dce100/dce100_hw_sequencer.h b/drivers/gpu/drm/amd/display/dc/dce100/dce100_hw_sequencer.h
index acd418515346..a6b80fdaa666 100644
--- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_hw_sequencer.h
+++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_hw_sequencer.h
@@ -37,6 +37,10 @@ void dce100_prepare_bandwidth(
                 struct dc *dc,
                 struct dc_state *context);
 
+void dce100_optimize_bandwidth(
+                struct dc *dc,
+                struct dc_state *context);
+
 bool dce100_enable_display_power_gating(struct dc *dc, uint8_t controller_id,
                                         struct dc_bios *dcb,
                                         enum pipe_gating_control power_gating);
diff --git a/drivers/gpu/drm/amd/display/dc/dce80/dce80_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce80/dce80_hw_sequencer.c
index a60a90e68d91..c4543178ba20 100644
--- a/drivers/gpu/drm/amd/display/dc/dce80/dce80_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce80/dce80_hw_sequencer.c
@@ -77,6 +77,6 @@ void dce80_hw_sequencer_construct(struct dc *dc)
         dc->hwss.enable_display_power_gating = dce100_enable_display_power_gating;
         dc->hwss.pipe_control_lock = dce_pipe_control_lock;
         dc->hwss.prepare_bandwidth = dce100_prepare_bandwidth;
-        dc->hwss.optimize_bandwidth = dce100_prepare_bandwidth;
+        dc->hwss.optimize_bandwidth = dce100_optimize_bandwidth;
 }
 
diff --git a/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c b/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
index cdd1d6b7b9f2..4e9ea50141bd 100644
--- a/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
@@ -790,9 +790,22 @@ bool dce80_validate_bandwidth(
         struct dc *dc,
         struct dc_state *context)
 {
-        /* TODO implement when needed but for now hardcode max value*/
-        context->bw.dce.dispclk_khz = 681000;
-        context->bw.dce.yclk_khz = 250000 * MEMORY_TYPE_MULTIPLIER_CZ;
+        int i;
+        bool at_least_one_pipe = false;
+
+        for (i = 0; i < dc->res_pool->pipe_count; i++) {
+                if (context->res_ctx.pipe_ctx[i].stream)
+                        at_least_one_pipe = true;
+        }
+
+        if (at_least_one_pipe) {
+                /* TODO implement when needed but for now hardcode max value*/
+                context->bw.dce.dispclk_khz = 681000;
+                context->bw.dce.yclk_khz = 250000 * MEMORY_TYPE_MULTIPLIER_CZ;
+        } else {
+                context->bw.dce.dispclk_khz = 0;
+                context->bw.dce.yclk_khz = 0;
+        }
 
         return true;
 }
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 58a12ddf12f3..41883c981789 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -2658,8 +2658,8 @@ static void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
                 .mirror = pipe_ctx->plane_state->horizontal_mirror
         };
 
-        pos_cpy.x -= pipe_ctx->plane_state->dst_rect.x;
-        pos_cpy.y -= pipe_ctx->plane_state->dst_rect.y;
+        pos_cpy.x_hotspot += pipe_ctx->plane_state->dst_rect.x;
+        pos_cpy.y_hotspot += pipe_ctx->plane_state->dst_rect.y;
 
         if (pipe_ctx->plane_state->address.type
                         == PLN_ADDR_TYPE_VIDEO_PROGRESSIVE)
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 7f365ac0b549..4ee16b264dbe 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -336,8 +336,8 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
                                     bool *enabled, int width, int height)
 {
         struct drm_i915_private *dev_priv = to_i915(fb_helper->dev);
-        unsigned long conn_configured, conn_seq, mask;
         unsigned int count = min(fb_helper->connector_count, BITS_PER_LONG);
+        unsigned long conn_configured, conn_seq;
         int i, j;
         bool *save_enabled;
         bool fallback = true, ret = true;
@@ -355,10 +355,9 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
                 drm_modeset_backoff(&ctx);
 
         memcpy(save_enabled, enabled, count);
-        mask = GENMASK(count - 1, 0);
+        conn_seq = GENMASK(count - 1, 0);
         conn_configured = 0;
 retry:
-        conn_seq = conn_configured;
         for (i = 0; i < count; i++) {
                 struct drm_fb_helper_connector *fb_conn;
                 struct drm_connector *connector;
@@ -371,7 +370,8 @@ retry:
                 if (conn_configured & BIT(i))
                         continue;
 
-                if (conn_seq == 0 && !connector->has_tile)
+                /* First pass, only consider tiled connectors */
+                if (conn_seq == GENMASK(count - 1, 0) && !connector->has_tile)
                         continue;
 
                 if (connector->status == connector_status_connected)
@@ -475,8 +475,10 @@ retry:
                 conn_configured |= BIT(i);
         }
 
-        if ((conn_configured & mask) != mask && conn_configured != conn_seq)
+        if (conn_configured != conn_seq) { /* repeat until no more are found */
+                conn_seq = conn_configured;
                 goto retry;
+        }
 
         /*
          * If the BIOS didn't enable everything it could, fall back to have the
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index dec1e081f529..6a8fb6fd183c 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -172,6 +172,7 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
         }
 
         if (radeon_is_px(dev)) {
+                dev_pm_set_driver_flags(dev->dev, DPM_FLAG_NEVER_SKIP);
                 pm_runtime_use_autosuspend(dev->dev);
                 pm_runtime_set_autosuspend_delay(dev->dev, 5000);
                 pm_runtime_set_active(dev->dev);
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index c13c0ba30f63..d499cd61c0e8 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -783,6 +783,7 @@ void c4iw_init_dev_ucontext(struct c4iw_rdev *rdev,
 static int c4iw_rdev_open(struct c4iw_rdev *rdev)
 {
         int err;
+        unsigned int factor;
 
         c4iw_init_dev_ucontext(rdev, &rdev->uctx);
 
@@ -806,8 +807,18 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
                 return -EINVAL;
         }
 
-        rdev->qpmask = rdev->lldi.udb_density - 1;
-        rdev->cqmask = rdev->lldi.ucq_density - 1;
+        /* This implementation requires a sge_host_page_size <= PAGE_SIZE. */
+        if (rdev->lldi.sge_host_page_size > PAGE_SIZE) {
+                pr_err("%s: unsupported sge host page size %u\n",
+                       pci_name(rdev->lldi.pdev),
+                       rdev->lldi.sge_host_page_size);
+                return -EINVAL;
+        }
+
+        factor = PAGE_SIZE / rdev->lldi.sge_host_page_size;
+        rdev->qpmask = (rdev->lldi.udb_density * factor) - 1;
+        rdev->cqmask = (rdev->lldi.ucq_density * factor) - 1;
+
         pr_debug("dev %s stag start 0x%0x size 0x%0x num stags %d pbl start 0x%0x size 0x%0x rq start 0x%0x size 0x%0x qp qid start %u size %u cq qid start %u size %u srq size %u\n",
                  pci_name(rdev->lldi.pdev), rdev->lldi.vr->stag.start,
                  rdev->lldi.vr->stag.size, c4iw_num_stags(rdev),
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 31d91538bbf4..694324b37480 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -3032,7 +3032,6 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
 {
         struct srp_target_port *target = host_to_target(scmnd->device->host);
         struct srp_rdma_ch *ch;
-        int i, j;
         u8 status;
 
         shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");
@@ -3044,15 +3043,6 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
         if (status)
                 return FAILED;
 
-        for (i = 0; i < target->ch_count; i++) {
-                ch = &target->ch[i];
-                for (j = 0; j < target->req_ring_size; ++j) {
-                        struct srp_request *req = &ch->req_ring[j];
-
-                        srp_finish_req(ch, req, scmnd->device, DID_RESET << 16);
-                }
-        }
-
         return SUCCESS;
 }
 
diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c
index d713271ebf7c..a64116586b4c 100644
--- a/drivers/mailbox/bcm-flexrm-mailbox.c
+++ b/drivers/mailbox/bcm-flexrm-mailbox.c
@@ -1396,9 +1396,9 @@ static void flexrm_shutdown(struct mbox_chan *chan)
 
         /* Clear ring flush state */
         timeout = 1000; /* timeout of 1s */
-        writel_relaxed(0x0, ring + RING_CONTROL);
+        writel_relaxed(0x0, ring->regs + RING_CONTROL);
         do {
-                if (!(readl_relaxed(ring + RING_FLUSH_DONE) &
+                if (!(readl_relaxed(ring->regs + RING_FLUSH_DONE) &
                       FLUSH_DONE_MASK))
                         break;
                 mdelay(1);
diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
index c6a7d4582dc6..38d9df3fb199 100644
--- a/drivers/mailbox/mailbox.c
+++ b/drivers/mailbox/mailbox.c
@@ -310,6 +310,7 @@ int mbox_flush(struct mbox_chan *chan, unsigned long timeout)
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(mbox_flush);
 
 /**
  * mbox_request_channel - Request a mailbox channel.
diff --git a/drivers/mtd/devices/powernv_flash.c b/drivers/mtd/devices/powernv_flash.c
index 22f753e555ac..83f88b8b5d9f 100644
--- a/drivers/mtd/devices/powernv_flash.c
+++ b/drivers/mtd/devices/powernv_flash.c
@@ -212,7 +212,7 @@ static int powernv_flash_set_driver_info(struct device *dev,
          * Going to have to check what details I need to set and how to
          * get them
          */
-        mtd->name = devm_kasprintf(dev, GFP_KERNEL, "%pOFn", dev->of_node);
+        mtd->name = devm_kasprintf(dev, GFP_KERNEL, "%pOFP", dev->of_node);
         mtd->type = MTD_NORFLASH;
         mtd->flags = MTD_WRITEABLE;
         mtd->size = size;
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 999b705769a8..3ef01baef9b6 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -507,6 +507,7 @@ static int mtd_nvmem_add(struct mtd_info *mtd)
 {
         struct nvmem_config config = {};
 
+        config.id = -1;
         config.dev = &mtd->dev;
         config.name = mtd->name;
         config.owner = THIS_MODULE;
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 0e4bbdcc614f..c76892ac4e69 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -344,7 +344,8 @@ static void b53_set_forwarding(struct b53_device *dev, int enable)
         b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, mgmt);
 }
 
-static void b53_enable_vlan(struct b53_device *dev, bool enable)
+static void b53_enable_vlan(struct b53_device *dev, bool enable,
+                            bool enable_filtering)
 {
         u8 mgmt, vc0, vc1, vc4 = 0, vc5;
 
@@ -369,8 +370,13 @@ static void b53_enable_vlan(struct b53_device *dev, bool enable)
                 vc0 |= VC0_VLAN_EN | VC0_VID_CHK_EN | VC0_VID_HASH_VID;
                 vc1 |= VC1_RX_MCST_UNTAG_EN | VC1_RX_MCST_FWD_EN;
                 vc4 &= ~VC4_ING_VID_CHECK_MASK;
-                vc4 |= VC4_ING_VID_VIO_DROP << VC4_ING_VID_CHECK_S;
-                vc5 |= VC5_DROP_VTABLE_MISS;
+                if (enable_filtering) {
+                        vc4 |= VC4_ING_VID_VIO_DROP << VC4_ING_VID_CHECK_S;
+                        vc5 |= VC5_DROP_VTABLE_MISS;
+                } else {
+                        vc4 |= VC4_ING_VID_VIO_FWD << VC4_ING_VID_CHECK_S;
+                        vc5 &= ~VC5_DROP_VTABLE_MISS;
+                }
 
                 if (is5325(dev))
                         vc0 &= ~VC0_RESERVED_1;
@@ -420,6 +426,9 @@ static void b53_enable_vlan(struct b53_device *dev, bool enable)
         }
 
         b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_MODE, mgmt);
+
+        dev->vlan_enabled = enable;
+        dev->vlan_filtering_enabled = enable_filtering;
 }
 
 static int b53_set_jumbo(struct b53_device *dev, bool enable, bool allow_10_100)
@@ -632,25 +641,35 @@ static void b53_enable_mib(struct b53_device *dev)
         b53_write8(dev, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, gc);
 }
 
+static u16 b53_default_pvid(struct b53_device *dev)
+{
+        if (is5325(dev) || is5365(dev))
+                return 1;
+        else
+                return 0;
+}
+
 int b53_configure_vlan(struct dsa_switch *ds)
 {
         struct b53_device *dev = ds->priv;
         struct b53_vlan vl = { 0 };
-        int i;
+        int i, def_vid;
+
+        def_vid = b53_default_pvid(dev);
 
         /* clear all vlan entries */
         if (is5325(dev) || is5365(dev)) {
-                for (i = 1; i < dev->num_vlans; i++)
+                for (i = def_vid; i < dev->num_vlans; i++)
                         b53_set_vlan_entry(dev, i, &vl);
         } else {
                 b53_do_vlan_op(dev, VTA_CMD_CLEAR);
         }
 
-        b53_enable_vlan(dev, false);
+        b53_enable_vlan(dev, false, dev->vlan_filtering_enabled);
 
         b53_for_each_port(dev, i)
                 b53_write16(dev, B53_VLAN_PAGE,
-                            B53_VLAN_PORT_DEF_TAG(i), 1);
+                            B53_VLAN_PORT_DEF_TAG(i), def_vid);
 
         if (!is5325(dev) && !is5365(dev))
                 b53_set_jumbo(dev, dev->enable_jumbo, false);
@@ -1255,6 +1274,46 @@ EXPORT_SYMBOL(b53_phylink_mac_link_up);
 
 int b53_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering)
 {
+        struct b53_device *dev = ds->priv;
+        struct net_device *bridge_dev;
+        unsigned int i;
+        u16 pvid, new_pvid;
+
+        /* Handle the case were multiple bridges span the same switch device
+         * and one of them has a different setting than what is being requested
+         * which would be breaking filtering semantics for any of the other
+         * bridge devices.
+         */
+        b53_for_each_port(dev, i) {
+                bridge_dev = dsa_to_port(ds, i)->bridge_dev;
+                if (bridge_dev &&
+                    bridge_dev != dsa_to_port(ds, port)->bridge_dev &&
+                    br_vlan_enabled(bridge_dev) != vlan_filtering) {
+                        netdev_err(bridge_dev,
+                                   "VLAN filtering is global to the switch!\n");
+                        return -EINVAL;
+                }
+        }
+
+        b53_read16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port), &pvid);
+        new_pvid = pvid;
+        if (dev->vlan_filtering_enabled && !vlan_filtering) {
+                /* Filtering is currently enabled, use the default PVID since
+                 * the bridge does not expect tagging anymore
+                 */
+                dev->ports[port].pvid = pvid;
+                new_pvid = b53_default_pvid(dev);
+        } else if (!dev->vlan_filtering_enabled && vlan_filtering) {
+                /* Filtering is currently disabled, restore the previous PVID */
+                new_pvid = dev->ports[port].pvid;
+        }
+
+        if (pvid != new_pvid)
+                b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port),
+                            new_pvid);
+
+        b53_enable_vlan(dev, dev->vlan_enabled, vlan_filtering);
+
         return 0;
 }
 EXPORT_SYMBOL(b53_vlan_filtering);
@@ -1270,7 +1329,7 @@ int b53_vlan_prepare(struct dsa_switch *ds, int port,
         if (vlan->vid_end > dev->num_vlans)
                 return -ERANGE;
 
-        b53_enable_vlan(dev, true);
+        b53_enable_vlan(dev, true, dev->vlan_filtering_enabled);
 
         return 0;
 }
@@ -1300,7 +1359,7 @@ void b53_vlan_add(struct dsa_switch *ds, int port,
                 b53_fast_age_vlan(dev, vid);
         }
 
-        if (pvid) {
+        if (pvid && !dsa_is_cpu_port(ds, port)) {
                 b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port),
                             vlan->vid_end);
                 b53_fast_age_vlan(dev, vid);
@@ -1326,12 +1385,8 @@ int b53_vlan_del(struct dsa_switch *ds, int port,
 
                 vl->members &= ~BIT(port);
 
-                if (pvid == vid) {
-                        if (is5325(dev) || is5365(dev))
-                                pvid = 1;
-                        else
-                                pvid = 0;
-                }
+                if (pvid == vid)
+                        pvid = b53_default_pvid(dev);
 
                 if (untagged && !dsa_is_cpu_port(ds, port))
                         vl->untag &= ~(BIT(port));
@@ -1644,10 +1699,7 @@ void b53_br_leave(struct dsa_switch *ds, int port, struct net_device *br)
         b53_write16(dev, B53_PVLAN_PAGE, B53_PVLAN_PORT_MASK(port), pvlan);
         dev->ports[port].vlan_ctl_mask = pvlan;
 
-        if (is5325(dev) || is5365(dev))
-                pvid = 1;
-        else
-                pvid = 0;
+        pvid = b53_default_pvid(dev);
 
         /* Make this port join all VLANs without VLAN entries */
         if (is58xx(dev)) {
diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
index ec796482792d..4dc7ee38b258 100644
--- a/drivers/net/dsa/b53/b53_priv.h
+++ b/drivers/net/dsa/b53/b53_priv.h
@@ -91,6 +91,7 @@ enum {
 struct b53_port {
         u16             vlan_ctl_mask;
         struct ethtool_eee eee;
+        u16             pvid;
 };
 
 struct b53_vlan {
@@ -137,6 +138,8 @@ struct b53_device {
 
         unsigned int num_vlans;
         struct b53_vlan *vlans;
+        bool vlan_enabled;
+        bool vlan_filtering_enabled;
         unsigned int num_ports;
         struct b53_port *ports;
 };
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index 17ec32b0a1cc..14138d423cf1 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -726,10 +726,11 @@ static void bcm_sf2_sw_get_wol(struct dsa_switch *ds, int port,
 {
         struct net_device *p = ds->ports[port].cpu_dp->master;
         struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
-        struct ethtool_wolinfo pwol;
+        struct ethtool_wolinfo pwol = { };
 
         /* Get the parent device WoL settings */
-        p->ethtool_ops->get_wol(p, &pwol);
+        if (p->ethtool_ops->get_wol)
+                p->ethtool_ops->get_wol(p, &pwol);
 
         /* Advertise the parent device supported settings */
         wol->supported = pwol.supported;
@@ -750,9 +751,10 @@ static int bcm_sf2_sw_set_wol(struct dsa_switch *ds, int port,
         struct net_device *p = ds->ports[port].cpu_dp->master;
         struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
         s8 cpu_port = ds->ports[port].cpu_dp->index;
-        struct ethtool_wolinfo pwol;
+        struct ethtool_wolinfo pwol =  { };
 
-        p->ethtool_ops->get_wol(p, &pwol);
+        if (p->ethtool_ops->get_wol)
+                p->ethtool_ops->get_wol(p, &pwol);
         if (wol->wolopts & ~pwol.supported)
                 return -EINVAL;
 
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 28c9b0bdf2f6..bc3ac369cbe3 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -134,6 +134,10 @@ static void bcm_sysport_set_rx_csum(struct net_device *dev,
 
         priv->rx_chk_en = !!(wanted & NETIF_F_RXCSUM);
         reg = rxchk_readl(priv, RXCHK_CONTROL);
+        /* Clear L2 header checks, which would prevent BPDUs
+         * from being received.
+         */
+        reg &= ~RXCHK_L2_HDR_DIS;
         if (priv->rx_chk_en)
                 reg |= RXCHK_EN;
         else
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
index c041f44324db..b3654598a2d5 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
@@ -660,6 +660,7 @@ static void uld_init(struct adapter *adap, struct cxgb4_lld_info *lld)
         lld->cclk_ps = 1000000000 / adap->params.vpd.cclk;
         lld->udb_density = 1 << adap->params.sge.eq_qpp;
         lld->ucq_density = 1 << adap->params.sge.iq_qpp;
+        lld->sge_host_page_size = 1 << (adap->params.sge.hps + 10);
         lld->filt_mode = adap->params.tp.vlan_pri_map;
         /* MODQ_REQ_MAP sets queues 0-3 to chan 0-3 */
         for (i = 0; i < NCHAN; i++)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
index 5fa9a2d5fc4b..21da34a4ca24 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
@@ -336,6 +336,7 @@ struct cxgb4_lld_info {
         unsigned int cclk_ps;                /* Core clock period in psec */
         unsigned short udb_density;          /* # of user DB/page */
         unsigned short ucq_density;          /* # of user CQs/page */
+        unsigned int sge_host_page_size;     /* SGE host page size */
         unsigned short filt_mode;            /* filter optional components */
         unsigned short tx_modq[NCHAN];       /* maps each tx channel to a */
                                              /* scheduler queue */
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index b8155f5e71b4..ac55db065f16 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -3128,6 +3128,9 @@ int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset)
                 dsaf_set_bit(credit, DSAF_SBM_ROCEE_CFG_CRD_EN_B, 1);
                 dsaf_write_dev(dsaf_dev, DSAF_SBM_ROCEE_CFG_REG_REG, credit);
         }
+
+        put_device(&pdev->dev);
+
         return 0;
 }
 EXPORT_SYMBOL(hns_dsaf_roce_reset);
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 2f427271a793..292a668ce88e 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -2879,7 +2879,7 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev)
 
         ret = mv643xx_eth_shared_of_probe(pdev);
         if (ret)
-                return ret;
+                goto err_put_clk;
         pd = dev_get_platdata(&pdev->dev);
 
         msp->tx_csum_limit = (pd != NULL && pd->tx_csum_limit) ?
@@ -2887,6 +2887,11 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev)
         infer_hw_params(msp);
 
         return 0;
+
+err_put_clk:
+        if (!IS_ERR(msp->clk))
+                clk_disable_unprepare(msp->clk);
+        return ret;
 }
 
 static int mv643xx_eth_shared_remove(struct platform_device *pdev)
diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
index f3a5fa84860f..57727fe1501e 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -5073,7 +5073,7 @@ static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         INIT_WORK(&hw->restart_work, sky2_restart);
 
         pci_set_drvdata(pdev, hw);
-        pdev->d3_delay = 200;
+        pdev->d3_delay = 300;
 
         return 0;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 6b88881b8e35..c1438ae52a11 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -3360,7 +3360,7 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         dev->addr_len = ETH_ALEN;
         mlx4_en_u64_to_mac(dev->dev_addr, mdev->dev->caps.def_mac[priv->port]);
         if (!is_valid_ether_addr(dev->dev_addr)) {
-                en_err(priv, "Port: %d, invalid mac burned: %pM, quiting\n",
+                en_err(priv, "Port: %d, invalid mac burned: %pM, quitting\n",
                        priv->port, dev->dev_addr);
                 err = -EINVAL;
                 goto out;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 32519c93df17..b65e274b02e9 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -862,8 +862,9 @@ int __mlxsw_sp_port_headroom_set(struct mlxsw_sp_port *mlxsw_sp_port, int mtu,
         for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
                 bool configure = false;
                 bool pfc = false;
+                u16 thres_cells;
+                u16 delay_cells;
                 bool lossy;
-                u16 thres;
 
                 for (j = 0; j < IEEE_8021QAZ_MAX_TCS; j++) {
                         if (prio_tc[j] == i) {
@@ -877,10 +878,11 @@ int __mlxsw_sp_port_headroom_set(struct mlxsw_sp_port *mlxsw_sp_port, int mtu,
                         continue;
 
                 lossy = !(pfc || pause_en);
-                thres = mlxsw_sp_pg_buf_threshold_get(mlxsw_sp, mtu);
-                delay = mlxsw_sp_pg_buf_delay_get(mlxsw_sp, mtu, delay, pfc,
-                                                  pause_en);
-                mlxsw_sp_pg_buf_pack(pbmc_pl, i, thres + delay, thres, lossy);
+                thres_cells = mlxsw_sp_pg_buf_threshold_get(mlxsw_sp, mtu);
+                delay_cells = mlxsw_sp_pg_buf_delay_get(mlxsw_sp, mtu, delay,
+                                                        pfc, pause_en);
+                mlxsw_sp_pg_buf_pack(pbmc_pl, i, thres_cells + delay_cells,
+                                     thres_cells, lossy);
         }
 
         return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(pbmc), pbmc_pl);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
index beb8e5d6401a..ded556b7bab5 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
@@ -1688,6 +1688,15 @@ qed_iwarp_parse_rx_pkt(struct qed_hwfn *p_hwfn,
 
         eth_hlen = ETH_HLEN + (vlan_valid ? sizeof(u32) : 0);
 
+        if (!ether_addr_equal(ethh->h_dest,
+                              p_hwfn->p_rdma_info->iwarp.mac_addr)) {
+                DP_VERBOSE(p_hwfn,
+                           QED_MSG_RDMA,
+                           "Got unexpected mac %pM instead of %pM\n",
+                           ethh->h_dest, p_hwfn->p_rdma_info->iwarp.mac_addr);
+                return -EINVAL;
+        }
+
         ether_addr_copy(remote_mac_addr, ethh->h_source);
         ether_addr_copy(local_mac_addr, ethh->h_dest);
 
@@ -2605,7 +2614,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
         struct qed_iwarp_info *iwarp_info;
         struct qed_ll2_acquire_data data;
         struct qed_ll2_cbs cbs;
-        u32 mpa_buff_size;
+        u32 buff_size;
         u16 n_ooo_bufs;
         int rc = 0;
         int i;
@@ -2632,7 +2641,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
 
         memset(&data, 0, sizeof(data));
         data.input.conn_type = QED_LL2_TYPE_IWARP;
-        data.input.mtu = QED_IWARP_MAX_SYN_PKT_SIZE;
+        data.input.mtu = params->max_mtu;
         data.input.rx_num_desc = QED_IWARP_LL2_SYN_RX_SIZE;
         data.input.tx_num_desc = QED_IWARP_LL2_SYN_TX_SIZE;
         data.input.tx_max_bds_per_packet = 1;   /* will never be fragmented */
@@ -2654,9 +2663,10 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
                 goto err;
         }
 
+        buff_size = QED_IWARP_MAX_BUF_SIZE(params->max_mtu);
         rc = qed_iwarp_ll2_alloc_buffers(p_hwfn,
                                          QED_IWARP_LL2_SYN_RX_SIZE,
-                                         QED_IWARP_MAX_SYN_PKT_SIZE,
+                                         buff_size,
                                          iwarp_info->ll2_syn_handle);
         if (rc)
                 goto err;
@@ -2710,10 +2720,9 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
         if (rc)
                 goto err;
 
-        mpa_buff_size = QED_IWARP_MAX_BUF_SIZE(params->max_mtu);
         rc = qed_iwarp_ll2_alloc_buffers(p_hwfn,
                                          data.input.rx_num_desc,
-                                         mpa_buff_size,
+                                         buff_size,
                                          iwarp_info->ll2_mpa_handle);
         if (rc)
                 goto err;
@@ -2726,7 +2735,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
 
         iwarp_info->max_num_partial_fpdus = (u16)p_hwfn->p_rdma_info->num_qps;
 
-        iwarp_info->mpa_intermediate_buf = kzalloc(mpa_buff_size, GFP_KERNEL);
+        iwarp_info->mpa_intermediate_buf = kzalloc(buff_size, GFP_KERNEL);
         if (!iwarp_info->mpa_intermediate_buf)
                 goto err;
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.h b/drivers/net/ethernet/qlogic/qed/qed_iwarp.h
index b8f612d00241..7ac959038324 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.h
@@ -46,7 +46,6 @@ enum qed_iwarp_qp_state qed_roce2iwarp_state(enum qed_roce_qp_state state);
 
 #define QED_IWARP_LL2_SYN_TX_SIZE       (128)
 #define QED_IWARP_LL2_SYN_RX_SIZE       (256)
-#define QED_IWARP_MAX_SYN_PKT_SIZE      (128)
 
 #define QED_IWARP_LL2_OOO_DEF_TX_SIZE   (256)
 #define QED_IWARP_MAX_OOO               (16)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
index 20299f6f65fc..736e29635b77 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
@@ -241,15 +241,18 @@ static inline void dwmac4_get_timestamp(void *desc, u32 ats, u64 *ts)
 static int dwmac4_rx_check_timestamp(void *desc)
 {
         struct dma_desc *p = (struct dma_desc *)desc;
+        unsigned int rdes0 = le32_to_cpu(p->des0);
+        unsigned int rdes1 = le32_to_cpu(p->des1);
+        unsigned int rdes3 = le32_to_cpu(p->des3);
         u32 own, ctxt;
         int ret = 1;
 
-        own = p->des3 & RDES3_OWN;
-        ctxt = ((p->des3 & RDES3_CONTEXT_DESCRIPTOR)
+        own = rdes3 & RDES3_OWN;
+        ctxt = ((rdes3 & RDES3_CONTEXT_DESCRIPTOR)
                 >> RDES3_CONTEXT_DESCRIPTOR_SHIFT);
 
         if (likely(!own && ctxt)) {
-                if ((p->des0 == 0xffffffff) && (p->des1 == 0xffffffff))
+                if ((rdes0 == 0xffffffff) && (rdes1 == 0xffffffff))
                         /* Corrupted value */
                         ret = -EINVAL;
                 else
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
index 5d85742a2be0..3c749c327cbd 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
@@ -696,25 +696,27 @@ static int stmmac_ethtool_op_set_eee(struct net_device *dev,
                                      struct ethtool_eee *edata)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
+        int ret;
 
-        priv->eee_enabled = edata->eee_enabled;
-
-        if (!priv->eee_enabled)
+        if (!edata->eee_enabled) {
                 stmmac_disable_eee_mode(priv);
-        else {
+        } else {
                 /* We are asking for enabling the EEE but it is safe
                  * to verify all by invoking the eee_init function.
                  * In case of failure it will return an error.
                  */
-                priv->eee_enabled = stmmac_eee_init(priv);
-                if (!priv->eee_enabled)
+                edata->eee_enabled = stmmac_eee_init(priv);
+                if (!edata->eee_enabled)
                         return -EOPNOTSUPP;
-
-                /* Do not change tx_lpi_timer in case of failure */
-                priv->tx_lpi_timer = edata->tx_lpi_timer;
         }
 
-        return phy_ethtool_set_eee(dev->phydev, edata);
+        ret = phy_ethtool_set_eee(dev->phydev, edata);
+        if (ret)
+                return ret;
+
+        priv->eee_enabled = edata->eee_enabled;
+        priv->tx_lpi_timer = edata->tx_lpi_timer;
+        return 0;
 }
 
 static u32 stmmac_usec2riwt(u32 usec, struct stmmac_priv *priv)
diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
index 1f612268c998..d847f672a705 100644
--- a/drivers/net/ethernet/ti/netcp_core.c
+++ b/drivers/net/ethernet/ti/netcp_core.c
@@ -259,7 +259,7 @@ static int netcp_module_probe(struct netcp_device *netcp_device,
                 const char *name;
                 char node_name[32];
 
-                if (of_property_read_string(node, "label", &name) < 0) {
+                if (of_property_read_string(child, "label", &name) < 0) {
                         snprintf(node_name, sizeof(node_name), "%pOFn", child);
                         name = node_name;
                 }
diff --git a/drivers/net/phy/xilinx_gmii2rgmii.c b/drivers/net/phy/xilinx_gmii2rgmii.c
index 74a8782313cf..bd6084e315de 100644
--- a/drivers/net/phy/xilinx_gmii2rgmii.c
+++ b/drivers/net/phy/xilinx_gmii2rgmii.c
@@ -44,7 +44,10 @@ static int xgmiitorgmii_read_status(struct phy_device *phydev)
         u16 val = 0;
         int err;
 
-        err = priv->phy_drv->read_status(phydev);
+        if (priv->phy_drv->read_status)
+                err = priv->phy_drv->read_status(phydev);
+        else
+                err = genphy_read_status(phydev);
         if (err < 0)
                 return err;
 
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 735ad838e2ba..18af2f8eee96 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1201,8 +1201,8 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
         {QMI_FIXED_INTF(0x1199, 0x68a2, 8)},    /* Sierra Wireless MC7710 in QMI mode */
         {QMI_FIXED_INTF(0x1199, 0x68a2, 19)},   /* Sierra Wireless MC7710 in QMI mode */
-        {QMI_FIXED_INTF(0x1199, 0x68c0, 8)},    /* Sierra Wireless MC7304/MC7354 */
-        {QMI_FIXED_INTF(0x1199, 0x68c0, 10)},   /* Sierra Wireless MC7304/MC7354 */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x68c0, 8)}, /* Sierra Wireless MC7304/MC7354, WP76xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x68c0, 10)},/* Sierra Wireless MC7304/MC7354 */
         {QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
         {QMI_FIXED_INTF(0x1199, 0x901f, 8)},    /* Sierra Wireless EM7355 */
         {QMI_FIXED_INTF(0x1199, 0x9041, 8)},    /* Sierra Wireless MC7305/MC7355 */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 60dd1ec1665f..ada6baf8847a 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -557,6 +557,7 @@ enum spd_duplex {
 /* MAC PASSTHRU */
 #define AD_MASK                 0xfee0
 #define BND_MASK                0x0004
+#define BD_MASK                 0x0001
 #define EFUSE                   0xcfdb
 #define PASS_THRU_MASK          0x1
 
@@ -1176,9 +1177,9 @@ static int vendor_mac_passthru_addr_read(struct r8152 *tp, struct sockaddr *sa)
                         return -ENODEV;
                 }
         } else {
-                /* test for RTL8153-BND */
+                /* test for RTL8153-BND and RTL8153-BD */
                 ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_MISC_1);
-                if ((ocp_data & BND_MASK) == 0) {
+                if ((ocp_data & BND_MASK) == 0 && (ocp_data & BD_MASK)) {
                         netif_dbg(tp, probe, tp->netdev,
                                   "Invalid variant for MAC pass through\n");
                         return -ENODEV;
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
index 0e6b43bb4678..a5ea3ba495a4 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
@@ -158,39 +158,49 @@ static const struct ieee80211_ops mt76x0u_ops = {
         .get_txpower = mt76x02_get_txpower,
 };
 
-static int mt76x0u_register_device(struct mt76x02_dev *dev)
+static int mt76x0u_init_hardware(struct mt76x02_dev *dev)
 {
-        struct ieee80211_hw *hw = dev->mt76.hw;
         int err;
 
-        err = mt76u_alloc_queues(&dev->mt76);
-        if (err < 0)
-                goto out_err;
-
-        err = mt76u_mcu_init_rx(&dev->mt76);
-        if (err < 0)
-                goto out_err;
-
         mt76x0_chip_onoff(dev, true, true);
-        if (!mt76x02_wait_for_mac(&dev->mt76)) {
-                err = -ETIMEDOUT;
-                goto out_err;
-        }
+
+        if (!mt76x02_wait_for_mac(&dev->mt76))
+                return -ETIMEDOUT;
 
         err = mt76x0u_mcu_init(dev);
         if (err < 0)
-                goto out_err;
+                return err;
 
         mt76x0_init_usb_dma(dev);
         err = mt76x0_init_hardware(dev);
         if (err < 0)
-                goto out_err;
+                return err;
 
         mt76_rmw(dev, MT_US_CYC_CFG, MT_US_CYC_CNT, 0x1e);
         mt76_wr(dev, MT_TXOP_CTRL_CFG,
                 FIELD_PREP(MT_TXOP_TRUN_EN, 0x3f) |
                 FIELD_PREP(MT_TXOP_EXT_CCA_DLY, 0x58));
 
+        return 0;
+}
+
+static int mt76x0u_register_device(struct mt76x02_dev *dev)
+{
+        struct ieee80211_hw *hw = dev->mt76.hw;
+        int err;
+
+        err = mt76u_alloc_queues(&dev->mt76);
+        if (err < 0)
+                goto out_err;
+
+        err = mt76u_mcu_init_rx(&dev->mt76);
+        if (err < 0)
+                goto out_err;
+
+        err = mt76x0u_init_hardware(dev);
+        if (err < 0)
+                goto out_err;
+
         err = mt76x0_register_device(dev);
         if (err < 0)
                 goto out_err;
@@ -301,6 +311,8 @@ static int __maybe_unused mt76x0_suspend(struct usb_interface *usb_intf,
 
         mt76u_stop_queues(&dev->mt76);
         mt76x0u_mac_stop(dev);
+        clear_bit(MT76_STATE_MCU_RUNNING, &dev->mt76.state);
+        mt76x0_chip_onoff(dev, false, false);
         usb_kill_urb(usb->mcu.res.urb);
 
         return 0;
@@ -328,7 +340,7 @@ static int __maybe_unused mt76x0_resume(struct usb_interface *usb_intf)
         tasklet_enable(&usb->rx_tasklet);
         tasklet_enable(&usb->tx_tasklet);
 
-        ret = mt76x0_init_hardware(dev);
+        ret = mt76x0u_init_hardware(dev);
         if (ret)
                 goto err;
 
diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c
index c69ca95b1ad5..0f140a802137 100644
--- a/drivers/pinctrl/meson/pinctrl-meson8b.c
+++ b/drivers/pinctrl/meson/pinctrl-meson8b.c
@@ -693,7 +693,7 @@ static const char * const sd_a_groups[] = {
 
 static const char * const sdxc_a_groups[] = {
         "sdxc_d0_0_a", "sdxc_d13_0_a", "sdxc_d47_a", "sdxc_clk_a",
-        "sdxc_cmd_a", "sdxc_d0_1_a", "sdxc_d0_13_1_a"
+        "sdxc_cmd_a", "sdxc_d0_1_a", "sdxc_d13_1_a"
 };
 
 static const char * const pcm_a_groups[] = {
diff --git a/drivers/pinctrl/qcom/pinctrl-qcs404.c b/drivers/pinctrl/qcom/pinctrl-qcs404.c
index 7aae52a09ff0..4ffd56ff809e 100644
--- a/drivers/pinctrl/qcom/pinctrl-qcs404.c
+++ b/drivers/pinctrl/qcom/pinctrl-qcs404.c
@@ -79,7 +79,7 @@ enum {
                 .intr_cfg_reg = 0,                      \
                 .intr_status_reg = 0,                   \
                 .intr_target_reg = 0,                   \
-                .tile = NORTH,                          \
+                .tile = SOUTH,                          \
                 .mux_bit = -1,                          \
                 .pull_bit = pull,                       \
                 .drv_bit = drv,                         \
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 24a129fcdd61..a2e5dc7716e2 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1788,7 +1788,7 @@ static int log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len)
 
         ret = translate_desc(vq, (uintptr_t)vq->used + used_offset,
                              len, iov, 64, VHOST_ACCESS_WO);
-        if (ret)
+        if (ret < 0)
                 return ret;
 
         for (i = 0; i < ret; i++) {
diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
index 7cde3f46ad26..e996174cbfc0 100644
--- a/fs/binfmt_script.c
+++ b/fs/binfmt_script.c
@@ -14,13 +14,30 @@
 #include <linux/err.h>
 #include <linux/fs.h>
 
+static inline bool spacetab(char c) { return c == ' ' || c == '\t'; }
+static inline char *next_non_spacetab(char *first, const char *last)
+{
+        for (; first <= last; first++)
+                if (!spacetab(*first))
+                        return first;
+        return NULL;
+}
+static inline char *next_terminator(char *first, const char *last)
+{
+        for (; first <= last; first++)
+                if (spacetab(*first) || !*first)
+                        return first;
+        return NULL;
+}
+
 static int load_script(struct linux_binprm *bprm)
 {
         const char *i_arg, *i_name;
-        char *cp;
+        char *cp, *buf_end;
         struct file *file;
         int retval;
 
+        /* Not ours to exec if we don't start with "#!". */
         if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!'))
                 return -ENOEXEC;
 
@@ -33,18 +50,40 @@ static int load_script(struct linux_binprm *bprm)
         if (bprm->interp_flags & BINPRM_FLAGS_PATH_INACCESSIBLE)
                 return -ENOENT;
 
-        /*
-         * This section does the #! interpretation.
-         * Sorta complicated, but hopefully it will work.  -TYT
-         */
-
+        /* Release since we are not mapping a binary into memory. */
         allow_write_access(bprm->file);
         fput(bprm->file);
         bprm->file = NULL;
 
-        bprm->buf[BINPRM_BUF_SIZE - 1] = '\0';
-        if ((cp = strchr(bprm->buf, '\n')) == NULL)
-                cp = bprm->buf+BINPRM_BUF_SIZE-1;
+        /*
+         * This section handles parsing the #! line into separate
+         * interpreter path and argument strings. We must be careful
+         * because bprm->buf is not yet guaranteed to be NUL-terminated
+         * (though the buffer will have trailing NUL padding when the
+         * file size was smaller than the buffer size).
+         *
+         * We do not want to exec a truncated interpreter path, so either
+         * we find a newline (which indicates nothing is truncated), or
+         * we find a space/tab/NUL after the interpreter path (which
+         * itself may be preceded by spaces/tabs). Truncating the
+         * arguments is fine: the interpreter can re-read the script to
+         * parse them on its own.
+         */
+        buf_end = bprm->buf + sizeof(bprm->buf) - 1;
+        cp = strnchr(bprm->buf, sizeof(bprm->buf), '\n');
+        if (!cp) {
+                cp = next_non_spacetab(bprm->buf + 2, buf_end);
+                if (!cp)
+                        return -ENOEXEC; /* Entire buf is spaces/tabs */
+                /*
+                 * If there is no later space/tab/NUL we must assume the
+                 * interpreter path is truncated.
+                 */
+                if (!next_terminator(cp, buf_end))
+                        return -ENOEXEC;
+                cp = buf_end;
+        }
+        /* NUL-terminate the buffer and any trailing spaces/tabs. */
         *cp = '\0';
         while (cp > bprm->buf) {
                 cp--;
diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
index 041c27ea8de1..f74193da0e09 100644
--- a/fs/ceph/snap.c
+++ b/fs/ceph/snap.c
@@ -616,7 +616,8 @@ int __ceph_finish_cap_snap(struct ceph_inode_info *ci,
              capsnap->size);
 
         spin_lock(&mdsc->snap_flush_lock);
-        list_add_tail(&ci->i_snap_flush_item, &mdsc->snap_flush_list);
+        if (list_empty(&ci->i_snap_flush_item))
+                list_add_tail(&ci->i_snap_flush_item, &mdsc->snap_flush_list);
         spin_unlock(&mdsc->snap_flush_lock);
         return 1;  /* caller may want to ceph_flush_snaps */
 }
diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c
index 3f23b6840547..bf34ddaa2ad7 100644
--- a/fs/nfs/nfs4idmap.c
+++ b/fs/nfs/nfs4idmap.c
@@ -44,6 +44,7 @@
 #include <linux/keyctl.h>
 #include <linux/key-type.h>
 #include <keys/user-type.h>
+#include <keys/request_key_auth-type.h>
 #include <linux/module.h>
 
 #include "internal.h"
@@ -59,7 +60,7 @@ static struct key_type key_type_id_resolver_legacy;
 struct idmap_legacy_upcalldata {
         struct rpc_pipe_msg pipe_msg;
         struct idmap_msg idmap_msg;
-        struct key_construction *key_cons;
+        struct key      *authkey;
         struct idmap *idmap;
 };
 
@@ -384,7 +385,7 @@ static const match_table_t nfs_idmap_tokens = {
         { Opt_find_err, NULL }
 };
 
-static int nfs_idmap_legacy_upcall(struct key_construction *, const char *, void *);
+static int nfs_idmap_legacy_upcall(struct key *, void *);
 static ssize_t idmap_pipe_downcall(struct file *, const char __user *,
                                    size_t);
 static void idmap_release_pipe(struct inode *);
@@ -549,11 +550,12 @@ nfs_idmap_prepare_pipe_upcall(struct idmap *idmap,
 static void
 nfs_idmap_complete_pipe_upcall_locked(struct idmap *idmap, int ret)
 {
-        struct key_construction *cons = idmap->idmap_upcall_data->key_cons;
+        struct key *authkey = idmap->idmap_upcall_data->authkey;
 
         kfree(idmap->idmap_upcall_data);
         idmap->idmap_upcall_data = NULL;
-        complete_request_key(cons, ret);
+        complete_request_key(authkey, ret);
+        key_put(authkey);
 }
 
 static void
@@ -563,15 +565,14 @@ nfs_idmap_abort_pipe_upcall(struct idmap *idmap, int ret)
                 nfs_idmap_complete_pipe_upcall_locked(idmap, ret);
 }
 
-static int nfs_idmap_legacy_upcall(struct key_construction *cons,
-                                   const char *op,
-                                   void *aux)
+static int nfs_idmap_legacy_upcall(struct key *authkey, void *aux)
 {
         struct idmap_legacy_upcalldata *data;
+        struct request_key_auth *rka = get_request_key_auth(authkey);
         struct rpc_pipe_msg *msg;
         struct idmap_msg *im;
         struct idmap *idmap = (struct idmap *)aux;
-        struct key *key = cons->key;
+        struct key *key = rka->target_key;
         int ret = -ENOKEY;
 
         if (!aux)
@@ -586,7 +587,7 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons,
         msg = &data->pipe_msg;
         im = &data->idmap_msg;
         data->idmap = idmap;
-        data->key_cons = cons;
+        data->authkey = key_get(authkey);
 
         ret = nfs_idmap_prepare_message(key->description, idmap, im, msg);
         if (ret < 0)
@@ -604,7 +605,7 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons,
 out2:
         kfree(data);
 out1:
-        complete_request_key(cons, ret);
+        complete_request_key(authkey, ret);
         return ret;
 }
 
@@ -651,9 +652,10 @@ out:
 static ssize_t
 idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 {
+        struct request_key_auth *rka;
         struct rpc_inode *rpci = RPC_I(file_inode(filp));
         struct idmap *idmap = (struct idmap *)rpci->private;
-        struct key_construction *cons;
+        struct key *authkey;
         struct idmap_msg im;
         size_t namelen_in;
         int ret = -ENOKEY;
@@ -665,7 +667,8 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
         if (idmap->idmap_upcall_data == NULL)
                 goto out_noupcall;
 
-        cons = idmap->idmap_upcall_data->key_cons;
+        authkey = idmap->idmap_upcall_data->authkey;
+        rka = get_request_key_auth(authkey);
 
         if (mlen != sizeof(im)) {
                 ret = -ENOSPC;
@@ -690,9 +693,9 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 
         ret = nfs_idmap_read_and_verify_message(&im,
                         &idmap->idmap_upcall_data->idmap_msg,
-                        cons->key, cons->authkey);
+                        rka->target_key, authkey);
         if (ret >= 0) {
-                key_set_timeout(cons->key, nfs_idmap_cache_timeout);
+                key_set_timeout(rka->target_key, nfs_idmap_cache_timeout);
                 ret = mlen;
         }
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 633a63462573..f5ed9512d193 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1086,10 +1086,6 @@ static int __set_oom_adj(struct file *file, int oom_adj, bool legacy)
 
                         task_lock(p);
                         if (!p->vfork_done && process_shares_mm(p, mm)) {
-                                pr_info("updating oom_score_adj for %d (%s) from %d to %d because it shares mm with %d (%s). Report if this is unexpected.\n",
-                                                task_pid_nr(p), p->comm,
-                                                p->signal->oom_score_adj, oom_adj,
-                                                task_pid_nr(task), task->comm);
                                 p->signal->oom_score_adj = oom_adj;
                                 if (!legacy && has_capability_noaudit(current, CAP_SYS_RESOURCE))
                                         p->signal->oom_score_adj_min = (short)oom_adj;
diff --git a/include/keys/request_key_auth-type.h b/include/keys/request_key_auth-type.h
new file mode 100644
index 000000000000..a726dd3f1dc6
--- /dev/null
+++ b/include/keys/request_key_auth-type.h
@@ -0,0 +1,36 @@
+/* request_key authorisation token key type
+ *
+ * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#ifndef _KEYS_REQUEST_KEY_AUTH_TYPE_H
+#define _KEYS_REQUEST_KEY_AUTH_TYPE_H
+
+#include <linux/key.h>
+
+/*
+ * Authorisation record for request_key().
+ */
+struct request_key_auth {
+        struct key              *target_key;
+        struct key              *dest_keyring;
+        const struct cred       *cred;
+        void                    *callout_info;
+        size_t                  callout_len;
+        pid_t                   pid;
+        char                    op[8];
+} __randomize_layout;
+
+static inline struct request_key_auth *get_request_key_auth(const struct key *key)
+{
+        return key->payload.data[0];
+}
+
+
+#endif /* _KEYS_REQUEST_KEY_AUTH_TYPE_H */
diff --git a/include/linux/key-type.h b/include/linux/key-type.h
index bc9af551fc83..e49d1de0614e 100644
--- a/include/linux/key-type.h
+++ b/include/linux/key-type.h
@@ -21,15 +21,6 @@ struct kernel_pkey_query;
 struct kernel_pkey_params;
 
 /*
- * key under-construction record
- * - passed to the request_key actor if supplied
- */
-struct key_construction {
-        struct key      *key;   /* key being constructed */
-        struct key      *authkey;/* authorisation for key being constructed */
-};
-
-/*
  * Pre-parsed payload, used by key add, update and instantiate.
  *
  * This struct will be cleared and data and datalen will be set with the data
@@ -50,8 +41,7 @@ struct key_preparsed_payload {
         time64_t        expiry;         /* Expiry time of key */
 } __randomize_layout;
 
-typedef int (*request_key_actor_t)(struct key_construction *key,
-                                   const char *op, void *aux);
+typedef int (*request_key_actor_t)(struct key *auth_key, void *aux);
 
 /*
  * Preparsed matching criterion.
@@ -181,20 +171,20 @@ extern int key_instantiate_and_link(struct key *key,
                                     const void *data,
                                     size_t datalen,
                                     struct key *keyring,
-                                    struct key *instkey);
+                                    struct key *authkey);
 extern int key_reject_and_link(struct key *key,
                                unsigned timeout,
                                unsigned error,
                                struct key *keyring,
-                               struct key *instkey);
-extern void complete_request_key(struct key_construction *cons, int error);
+                               struct key *authkey);
+extern void complete_request_key(struct key *authkey, int error);
 
 static inline int key_negate_and_link(struct key *key,
                                       unsigned timeout,
                                       struct key *keyring,
-                                      struct key *instkey)
+                                      struct key *authkey)
 {
-        return key_reject_and_link(key, timeout, ENOKEY, keyring, instkey);
+        return key_reject_and_link(key, timeout, ENOKEY, keyring, authkey);
 }
 
 extern int generic_key_instantiate(struct key *key, struct key_preparsed_payload *prep);
diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
index 2b2a6dce1630..4c76fe2c8488 100644
--- a/include/linux/netdev_features.h
+++ b/include/linux/netdev_features.h
@@ -11,6 +11,8 @@
 #define _LINUX_NETDEV_FEATURES_H
 
 #include <linux/types.h>
+#include <linux/bitops.h>
+#include <asm/byteorder.h>
 
 typedef u64 netdev_features_t;
 
@@ -154,8 +156,26 @@ enum {
 #define NETIF_F_HW_TLS_TX       __NETIF_F(HW_TLS_TX)
 #define NETIF_F_HW_TLS_RX       __NETIF_F(HW_TLS_RX)
 
-#define for_each_netdev_feature(mask_addr, bit) \
-        for_each_set_bit(bit, (unsigned long *)mask_addr, NETDEV_FEATURE_COUNT)
+/* Finds the next feature with the highest number of the range of start till 0.
+ */
+static inline int find_next_netdev_feature(u64 feature, unsigned long start)
+{
+        /* like BITMAP_LAST_WORD_MASK() for u64
+         * this sets the most significant 64 - start to 0.
+         */
+        feature &= ~0ULL >> (-start & ((sizeof(feature) * 8) - 1));
+
+        return fls64(feature) - 1;
+}
+
+/* This goes for the MSB to the LSB through the set feature bits,
+ * mask_addr should be a u64 and bit an int
+ */
+#define for_each_netdev_feature(mask_addr, bit)                         \
+        for ((bit) = find_next_netdev_feature((mask_addr),              \
+                                              NETDEV_FEATURE_COUNT);    \
+             (bit) >= 0;                                                \
+             (bit) = find_next_netdev_feature((mask_addr), (bit) - 1))
 
 /* Features valid for ethtool to change */
 /* = all defined minus driver/device-class-related */
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 95d25b010a25..bdb9563c64a0 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2434,7 +2434,7 @@ static inline void skb_probe_transport_header(struct sk_buff *skb,
 
         if (skb_flow_dissect_flow_keys_basic(skb, &keys, NULL, 0, 0, 0, 0))
                 skb_set_transport_header(skb, keys.control.thoff);
-        else
+        else if (offset_hint >= 0)
                 skb_set_transport_header(skb, offset_hint);
 }
 
@@ -4212,6 +4212,12 @@ static inline bool skb_is_gso_sctp(const struct sk_buff *skb)
         return skb_shinfo(skb)->gso_type & SKB_GSO_SCTP;
 }
 
+static inline bool skb_is_gso_tcp(const struct sk_buff *skb)
+{
+        return skb_is_gso(skb) &&
+               skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6);
+}
+
 static inline void skb_gso_reset(struct sk_buff *skb)
 {
         skb_shinfo(skb)->gso_size = 0;
diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index cb462f9ab7dd..71f2394abbf7 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -57,6 +57,15 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
 
                 if (!skb_partial_csum_set(skb, start, off))
                         return -EINVAL;
+        } else {
+                /* gso packets without NEEDS_CSUM do not set transport_offset.
+                 * probe and drop if does not match one of the above types.
+                 */
+                if (gso_type) {
+                        skb_probe_transport_header(skb, -1);
+                        if (!skb_transport_header_was_set(skb))
+                                return -EINVAL;
+                }
         }
 
         if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
diff --git a/init/initramfs.c b/init/initramfs.c
index 7cea802d00ef..fca899622937 100644
--- a/init/initramfs.c
+++ b/init/initramfs.c
@@ -550,6 +550,7 @@ skip:
         initrd_end = 0;
 }
 
+#ifdef CONFIG_BLK_DEV_RAM
 #define BUF_SIZE 1024
 static void __init clean_rootfs(void)
 {
@@ -596,6 +597,7 @@ static void __init clean_rootfs(void)
         ksys_close(fd);
         kfree(buf);
 }
+#endif
 
 static int __init populate_rootfs(void)
 {
@@ -638,10 +640,8 @@ static int __init populate_rootfs(void)
                 printk(KERN_INFO "Unpacking initramfs...\n");
                 err = unpack_to_rootfs((char *)initrd_start,
                         initrd_end - initrd_start);
-                if (err) {
+                if (err)
                         printk(KERN_EMERG "Initramfs unpacking failed: %s\n", err);
-                        clean_rootfs();
-                }
                 free_initrd();
 #endif
         }
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index d43b14535827..950ab2f28922 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -44,7 +44,7 @@ static void do_up_read(struct irq_work *entry)
         struct stack_map_irq_work *work;
 
         work = container_of(entry, struct stack_map_irq_work, irq_work);
-        up_read(work->sem);
+        up_read_non_owner(work->sem);
         work->sem = NULL;
 }
 
@@ -338,6 +338,12 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
         } else {
                 work->sem = &current->mm->mmap_sem;
                 irq_work_queue(&work->irq_work);
+                /*
+                 * The irq_work will release the mmap_sem with
+                 * up_read_non_owner(). The rwsem_release() is called
+                 * here to release the lock from lockdep's perspective.
+                 */
+                rwsem_release(&current->mm->mmap_sem.dep_map, 1, _RET_IP_);
         }
 }
 
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 56674a7c3778..8f295b790297 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1617,12 +1617,13 @@ static int check_flow_keys_access(struct bpf_verifier_env *env, int off,
         return 0;
 }
 
-static int check_sock_access(struct bpf_verifier_env *env, u32 regno, int off,
-                             int size, enum bpf_access_type t)
+static int check_sock_access(struct bpf_verifier_env *env, int insn_idx,
+                             u32 regno, int off, int size,
+                             enum bpf_access_type t)
 {
         struct bpf_reg_state *regs = cur_regs(env);
         struct bpf_reg_state *reg = &regs[regno];
-        struct bpf_insn_access_aux info;
+        struct bpf_insn_access_aux info = {};
 
         if (reg->smin_value < 0) {
                 verbose(env, "R%d min value is negative, either use unsigned index or do a if (index >=0) check.\n",
@@ -1636,6 +1637,8 @@ static int check_sock_access(struct bpf_verifier_env *env, u32 regno, int off,
                 return -EACCES;
         }
 
+        env->insn_aux_data[insn_idx].ctx_field_size = info.ctx_field_size;
+
         return 0;
 }
 
@@ -2032,7 +2035,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
                         verbose(env, "cannot write into socket\n");
                         return -EACCES;
                 }
-                err = check_sock_access(env, regno, off, size, t);
+                err = check_sock_access(env, insn_idx, regno, off, size, t);
                 if (!err && value_regno >= 0)
                         mark_reg_unknown(env, regs, value_regno);
         } else {
diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
index c3484785b179..0e97ca9306ef 100644
--- a/kernel/sched/psi.c
+++ b/kernel/sched/psi.c
@@ -322,7 +322,7 @@ static bool update_stats(struct psi_group *group)
         expires = group->next_update;
         if (now < expires)
                 goto out;
-        if (now - expires > psi_period)
+        if (now - expires >= psi_period)
                 missed_periods = div_u64(now - expires, psi_period);
 
         /*
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index c521b7347482..c4238b441624 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3384,6 +3384,8 @@ static void print_func_help_header_irq(struct trace_buffer *buf, struct seq_file
         const char tgid_space[] = "          ";
         const char space[] = "  ";
 
+        print_event_info(buf, m);
+
         seq_printf(m, "#                          %s  _-----=> irqs-off\n",
                    tgid ? tgid_space : space);
         seq_printf(m, "#                          %s / _----=> need-resched\n",
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index d5fb09ebba8b..9eaf07f99212 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -861,22 +861,14 @@ static const struct file_operations kprobe_profile_ops = {
 static nokprobe_inline int
 fetch_store_strlen(unsigned long addr)
 {
-        mm_segment_t old_fs;
         int ret, len = 0;
         u8 c;
 
-        old_fs = get_fs();
-        set_fs(KERNEL_DS);
-        pagefault_disable();
-
         do {
-                ret = __copy_from_user_inatomic(&c, (u8 *)addr + len, 1);
+                ret = probe_mem_read(&c, (u8 *)addr + len, 1);
                 len++;
         } while (c && ret == 0 && len < MAX_STRING_SIZE);
 
-        pagefault_enable();
-        set_fs(old_fs);
-
         return (ret < 0) ? ret : len;
 }
 
diff --git a/lib/assoc_array.c b/lib/assoc_array.c
index c6659cb37033..59875eb278ea 100644
--- a/lib/assoc_array.c
+++ b/lib/assoc_array.c
@@ -768,9 +768,11 @@ all_leaves_cluster_together:
                 new_s0->index_key[i] =
                         ops->get_key_chunk(index_key, i * ASSOC_ARRAY_KEY_CHUNK_SIZE);
 
-        blank = ULONG_MAX << (level & ASSOC_ARRAY_KEY_CHUNK_MASK);
-        pr_devel("blank off [%zu] %d: %lx\n", keylen - 1, level, blank);
-        new_s0->index_key[keylen - 1] &= ~blank;
+        if (level & ASSOC_ARRAY_KEY_CHUNK_MASK) {
+                blank = ULONG_MAX << (level & ASSOC_ARRAY_KEY_CHUNK_MASK);
+                pr_devel("blank off [%zu] %d: %lx\n", keylen - 1, level, blank);
+                new_s0->index_key[keylen - 1] &= ~blank;
+        }
 
         /* This now reduces to a node splitting exercise for which we'll need
          * to regenerate the disparity table.
diff --git a/mm/debug.c b/mm/debug.c
index 0abb987dad9b..1611cf00a137 100644
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -44,7 +44,7 @@ const struct trace_print_flags vmaflag_names[] = {
 
 void __dump_page(struct page *page, const char *reason)
 {
-        struct address_space *mapping = page_mapping(page);
+        struct address_space *mapping;
         bool page_poisoned = PagePoisoned(page);
         int mapcount;
 
@@ -58,6 +58,8 @@ void __dump_page(struct page *page, const char *reason)
                 goto hex_only;
         }
 
+        mapping = page_mapping(page);
+
         /*
          * Avoid VM_BUG_ON() in page_mapcount().
          * page->_mapcount space in struct page is used by sl[aou]b pages to
diff --git a/mm/kasan/Makefile b/mm/kasan/Makefile
index e2bb06c1b45e..5d1065efbd47 100644
--- a/mm/kasan/Makefile
+++ b/mm/kasan/Makefile
@@ -7,6 +7,8 @@ KCOV_INSTRUMENT := n
 
 CFLAGS_REMOVE_common.o = -pg
 CFLAGS_REMOVE_generic.o = -pg
+CFLAGS_REMOVE_tags.o = -pg
+
 # Function splitter causes unnecessary splits in __asan_load1/__asan_store1
 # see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63533
 
diff --git a/mm/kasan/common.c b/mm/kasan/common.c
index 73c9cbfdedf4..09b534fbba17 100644
--- a/mm/kasan/common.c
+++ b/mm/kasan/common.c
@@ -361,10 +361,15 @@ void kasan_poison_object_data(struct kmem_cache *cache, void *object)
  *    get different tags.
  */
 static u8 assign_tag(struct kmem_cache *cache, const void *object,
-                        bool init, bool krealloc)
+                        bool init, bool keep_tag)
 {
-        /* Reuse the same tag for krealloc'ed objects. */
-        if (krealloc)
+        /*
+         * 1. When an object is kmalloc()'ed, two hooks are called:
+         *    kasan_slab_alloc() and kasan_kmalloc(). We assign the
+         *    tag only in the first one.
+         * 2. We reuse the same tag for krealloc'ed objects.
+         */
+        if (keep_tag)
                 return get_tag(object);
 
         /*
@@ -405,12 +410,6 @@ void * __must_check kasan_init_slab_obj(struct kmem_cache *cache,
         return (void *)object;
 }
 
-void * __must_check kasan_slab_alloc(struct kmem_cache *cache, void *object,
-                                        gfp_t flags)
-{
-        return kasan_kmalloc(cache, object, cache->object_size, flags);
-}
-
 static inline bool shadow_invalid(u8 tag, s8 shadow_byte)
 {
         if (IS_ENABLED(CONFIG_KASAN_GENERIC))
@@ -467,7 +466,7 @@ bool kasan_slab_free(struct kmem_cache *cache, void *object, unsigned long ip)
 }
 
 static void *__kasan_kmalloc(struct kmem_cache *cache, const void *object,
-                                size_t size, gfp_t flags, bool krealloc)
+                                size_t size, gfp_t flags, bool keep_tag)
 {
         unsigned long redzone_start;
         unsigned long redzone_end;
@@ -485,7 +484,7 @@ static void *__kasan_kmalloc(struct kmem_cache *cache, const void *object,
                                 KASAN_SHADOW_SCALE_SIZE);
 
         if (IS_ENABLED(CONFIG_KASAN_SW_TAGS))
-                tag = assign_tag(cache, object, false, krealloc);
+                tag = assign_tag(cache, object, false, keep_tag);
 
         /* Tag is ignored in set_tag without CONFIG_KASAN_SW_TAGS */
         kasan_unpoison_shadow(set_tag(object, tag), size);
@@ -498,10 +497,16 @@ static void *__kasan_kmalloc(struct kmem_cache *cache, const void *object,
         return set_tag(object, tag);
 }
 
+void * __must_check kasan_slab_alloc(struct kmem_cache *cache, void *object,
+                                        gfp_t flags)
+{
+        return __kasan_kmalloc(cache, object, cache->object_size, flags, false);
+}
+
 void * __must_check kasan_kmalloc(struct kmem_cache *cache, const void *object,
                                 size_t size, gfp_t flags)
 {
-        return __kasan_kmalloc(cache, object, size, flags, false);
+        return __kasan_kmalloc(cache, object, size, flags, true);
 }
 EXPORT_SYMBOL(kasan_kmalloc);
 
diff --git a/mm/kasan/tags.c b/mm/kasan/tags.c
index 0777649e07c4..63fca3172659 100644
--- a/mm/kasan/tags.c
+++ b/mm/kasan/tags.c
@@ -46,7 +46,7 @@ void kasan_init_tags(void)
         int cpu;
 
         for_each_possible_cpu(cpu)
-                per_cpu(prng_state, cpu) = get_random_u32();
+                per_cpu(prng_state, cpu) = (u32)get_cycles();
 }
 
 /*
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index f9d9dc250428..707fa5579f66 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -574,6 +574,7 @@ static struct kmemleak_object *create_object(unsigned long ptr, size_t size,
         unsigned long flags;
         struct kmemleak_object *object, *parent;
         struct rb_node **link, *rb_parent;
+        unsigned long untagged_ptr;
 
         object = kmem_cache_alloc(object_cache, gfp_kmemleak_mask(gfp));
         if (!object) {
@@ -619,8 +620,9 @@ static struct kmemleak_object *create_object(unsigned long ptr, size_t size,
 
         write_lock_irqsave(&kmemleak_lock, flags);
 
-        min_addr = min(min_addr, ptr);
-        max_addr = max(max_addr, ptr + size);
+        untagged_ptr = (unsigned long)kasan_reset_tag((void *)ptr);
+        min_addr = min(min_addr, untagged_ptr);
+        max_addr = max(max_addr, untagged_ptr + size);
         link = &object_tree_root.rb_node;
         rb_parent = NULL;
         while (*link) {
@@ -1333,6 +1335,7 @@ static void scan_block(void *_start, void *_end,
         unsigned long *start = PTR_ALIGN(_start, BYTES_PER_POINTER);
         unsigned long *end = _end - (BYTES_PER_POINTER - 1);
         unsigned long flags;
+        unsigned long untagged_ptr;
 
         read_lock_irqsave(&kmemleak_lock, flags);
         for (ptr = start; ptr < end; ptr++) {
@@ -1347,7 +1350,8 @@ static void scan_block(void *_start, void *_end,
                 pointer = *ptr;
                 kasan_enable_current();
 
-                if (pointer < min_addr || pointer >= max_addr)
+                untagged_ptr = (unsigned long)kasan_reset_tag((void *)pointer);
+                if (untagged_ptr < min_addr || untagged_ptr >= max_addr)
                         continue;
 
                 /*
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 124e794867c5..1ad28323fb9f 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1188,11 +1188,13 @@ static inline int pageblock_free(struct page *page)
         return PageBuddy(page) && page_order(page) >= pageblock_order;
 }
 
-/* Return the start of the next active pageblock after a given page */
-static struct page *next_active_pageblock(struct page *page)
+/* Return the pfn of the start of the next active pageblock after a given pfn */
+static unsigned long next_active_pageblock(unsigned long pfn)
 {
+        struct page *page = pfn_to_page(pfn);
+
         /* Ensure the starting page is pageblock-aligned */
-        BUG_ON(page_to_pfn(page) & (pageblock_nr_pages - 1));
+        BUG_ON(pfn & (pageblock_nr_pages - 1));
 
         /* If the entire pageblock is free, move to the end of free page */
         if (pageblock_free(page)) {
@@ -1200,16 +1202,16 @@ static struct page *next_active_pageblock(struct page *page)
                 /* be careful. we don't have locks, page_order can be changed.*/
                 order = page_order(page);
                 if ((order < MAX_ORDER) && (order >= pageblock_order))
-                        return page + (1 << order);
+                        return pfn + (1 << order);
         }
 
-        return page + pageblock_nr_pages;
+        return pfn + pageblock_nr_pages;
 }
 
-static bool is_pageblock_removable_nolock(struct page *page)
+static bool is_pageblock_removable_nolock(unsigned long pfn)
 {
+        struct page *page = pfn_to_page(pfn);
         struct zone *zone;
-        unsigned long pfn;
 
         /*
          * We have to be careful here because we are iterating over memory
@@ -1232,13 +1234,14 @@ static bool is_pageblock_removable_nolock(struct page *page)
 /* Checks if this range of memory is likely to be hot-removable. */
 bool is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages)
 {
-        struct page *page = pfn_to_page(start_pfn);
-        unsigned long end_pfn = min(start_pfn + nr_pages, zone_end_pfn(page_zone(page)));
-        struct page *end_page = pfn_to_page(end_pfn);
+        unsigned long end_pfn, pfn;
+
+        end_pfn = min(start_pfn + nr_pages,
+                        zone_end_pfn(page_zone(pfn_to_page(start_pfn))));
 
         /* Check the starting page of each pageblock within the range */
-        for (; page < end_page; page = next_active_pageblock(page)) {
-                if (!is_pageblock_removable_nolock(page))
+        for (pfn = start_pfn; pfn < end_pfn; pfn = next_active_pageblock(pfn)) {
+                if (!is_pageblock_removable_nolock(pfn))
                         return false;
                 cond_resched();
         }
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index d4496d9d34f5..ee2bce59d2bf 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1314,7 +1314,7 @@ static int copy_nodes_to_user(unsigned long __user *mask, unsigned long maxnode,
                               nodemask_t *nodes)
 {
         unsigned long copy = ALIGN(maxnode-1, 64) / 8;
-        const int nbytes = BITS_TO_LONGS(MAX_NUMNODES) * sizeof(long);
+        unsigned int nbytes = BITS_TO_LONGS(nr_node_ids) * sizeof(long);
 
         if (copy > nbytes) {
                 if (copy > PAGE_SIZE)
@@ -1491,7 +1491,7 @@ static int kernel_get_mempolicy(int __user *policy,
         int uninitialized_var(pval);
         nodemask_t nodes;
 
-        if (nmask != NULL && maxnode < MAX_NUMNODES)
+        if (nmask != NULL && maxnode < nr_node_ids)
                 return -EINVAL;
 
         err = do_get_mempolicy(&pval, &nodes, addr, flags);
@@ -1527,7 +1527,7 @@ COMPAT_SYSCALL_DEFINE5(get_mempolicy, int __user *, policy,
         unsigned long nr_bits, alloc_size;
         DECLARE_BITMAP(bm, MAX_NUMNODES);
 
-        nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES);
+        nr_bits = min_t(unsigned long, maxnode-1, nr_node_ids);
         alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
         if (nmask)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 46285d28e43b..0b9f577b1a2a 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2170,6 +2170,18 @@ static inline void boost_watermark(struct zone *zone)
 
         max_boost = mult_frac(zone->_watermark[WMARK_HIGH],
                         watermark_boost_factor, 10000);
+
+        /*
+         * high watermark may be uninitialised if fragmentation occurs
+         * very early in boot so do not boost. We do not fall
+         * through and boost by pageblock_nr_pages as failing
+         * allocations that early means that reclaim is not going
+         * to help and it may even be impossible to reclaim the
+         * boosted watermark resulting in a hang.
+         */
+        if (!max_boost)
+                return;
+
         max_boost = max(pageblock_nr_pages, max_boost);
 
         zone->watermark_boost = min(zone->watermark_boost + pageblock_nr_pages,
@@ -4675,11 +4687,11 @@ refill:
                 /* Even if we own the page, we do not use atomic_set().
                  * This would break get_page_unless_zero() users.
                  */
-                page_ref_add(page, size);
+                page_ref_add(page, PAGE_FRAG_CACHE_MAX_SIZE);
 
                 /* reset page count bias and offset to start of new frag */
                 nc->pfmemalloc = page_is_pfmemalloc(page);
-                nc->pagecnt_bias = size + 1;
+                nc->pagecnt_bias = PAGE_FRAG_CACHE_MAX_SIZE + 1;
                 nc->offset = size;
         }
 
@@ -4695,10 +4707,10 @@ refill:
                 size = nc->size;
 #endif
                 /* OK, page count is 0, we can safely set it */
-                set_page_count(page, size + 1);
+                set_page_count(page, PAGE_FRAG_CACHE_MAX_SIZE + 1);
 
                 /* reset page count bias and offset to start of new frag */
-                nc->pagecnt_bias = size + 1;
+                nc->pagecnt_bias = PAGE_FRAG_CACHE_MAX_SIZE + 1;
                 offset = size - fragsz;
         }
 
diff --git a/mm/shmem.c b/mm/shmem.c
index 6ece1e2fe76e..0905215fb016 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2854,10 +2854,14 @@ static int shmem_link(struct dentry *old_dentry, struct inode *dir, struct dentr
          * No ordinary (disk based) filesystem counts links as inodes;
          * but each new link needs a new dentry, pinning lowmem, and
          * tmpfs dentries cannot be pruned until they are unlinked.
+         * But if an O_TMPFILE file is linked into the tmpfs, the
+         * first link must skip that, to get the accounting right.
          */
-        ret = shmem_reserve_inode(inode->i_sb);
-        if (ret)
-                goto out;
+        if (inode->i_nlink) {
+                ret = shmem_reserve_inode(inode->i_sb);
+                if (ret)
+                        goto out;
+        }
 
         dir->i_size += BOGO_DIRENT_SIZE;
         inode->i_ctime = dir->i_ctime = dir->i_mtime = current_time(inode);
diff --git a/mm/slab.c b/mm/slab.c
index 78eb8c5bf4e4..91c1863df93d 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -2359,7 +2359,7 @@ static void *alloc_slabmgmt(struct kmem_cache *cachep,
         void *freelist;
         void *addr = page_address(page);
 
-        page->s_mem = kasan_reset_tag(addr) + colour_off;
+        page->s_mem = addr + colour_off;
         page->active = 0;
 
         if (OBJFREELIST_SLAB(cachep))
@@ -2368,6 +2368,7 @@ static void *alloc_slabmgmt(struct kmem_cache *cachep,
                 /* Slab management obj is off-slab. */
                 freelist = kmem_cache_alloc_node(cachep->freelist_cache,
                                               local_flags, nodeid);
+                freelist = kasan_reset_tag(freelist);
                 if (!freelist)
                         return NULL;
         } else {
@@ -2681,6 +2682,13 @@ static struct page *cache_grow_begin(struct kmem_cache *cachep,
 
         offset *= cachep->colour_off;
 
+        /*
+         * Call kasan_poison_slab() before calling alloc_slabmgmt(), so
+         * page_address() in the latter returns a non-tagged pointer,
+         * as it should be for slab pages.
+         */
+        kasan_poison_slab(page);
+
         /* Get slab management. */
         freelist = alloc_slabmgmt(cachep, page, offset,
                         local_flags & ~GFP_CONSTRAINT_MASK, page_node);
@@ -2689,7 +2697,6 @@ static struct page *cache_grow_begin(struct kmem_cache *cachep,
 
         slab_map_pages(cachep, page, freelist);
 
-        kasan_poison_slab(page);
         cache_init_objs(cachep, page);
 
         if (gfpflags_allow_blocking(local_flags))
@@ -3540,7 +3547,6 @@ void *kmem_cache_alloc(struct kmem_cache *cachep, gfp_t flags)
 {
         void *ret = slab_alloc(cachep, flags, _RET_IP_);
 
-        ret = kasan_slab_alloc(cachep, ret, flags);
         trace_kmem_cache_alloc(_RET_IP_, ret,
                                cachep->object_size, cachep->size, flags);
 
@@ -3630,7 +3636,6 @@ void *kmem_cache_alloc_node(struct kmem_cache *cachep, gfp_t flags, int nodeid)
 {
         void *ret = slab_alloc_node(cachep, flags, nodeid, _RET_IP_);
 
-        ret = kasan_slab_alloc(cachep, ret, flags);
         trace_kmem_cache_alloc_node(_RET_IP_, ret,
                                     cachep->object_size, cachep->size,
                                     flags, nodeid);
@@ -4408,6 +4413,8 @@ void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
         unsigned int objnr;
         unsigned long offset;
 
+        ptr = kasan_reset_tag(ptr);
+
         /* Find and validate object. */
         cachep = page->slab_cache;
         objnr = obj_to_index(cachep, page, (void *)ptr);
diff --git a/mm/slab.h b/mm/slab.h
index 4190c24ef0e9..384105318779 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -437,11 +437,10 @@ static inline void slab_post_alloc_hook(struct kmem_cache *s, gfp_t flags,
 
         flags &= gfp_allowed_mask;
         for (i = 0; i < size; i++) {
-                void *object = p[i];
-
-                kmemleak_alloc_recursive(object, s->object_size, 1,
+                p[i] = kasan_slab_alloc(s, p[i], flags);
+                /* As p[i] might get tagged, call kmemleak hook after KASAN. */
+                kmemleak_alloc_recursive(p[i], s->object_size, 1,
                                          s->flags, flags);
-                p[i] = kasan_slab_alloc(s, object, flags);
         }
 
         if (memcg_kmem_enabled())
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 81732d05e74a..f9d89c1b5977 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -1228,8 +1228,9 @@ void *kmalloc_order(size_t size, gfp_t flags, unsigned int order)
         flags |= __GFP_COMP;
         page = alloc_pages(flags, order);
         ret = page ? page_address(page) : NULL;
-        kmemleak_alloc(ret, size, 1, flags);
         ret = kasan_kmalloc_large(ret, size, flags);
+        /* As ret might get tagged, call kmemleak hook after KASAN. */
+        kmemleak_alloc(ret, size, 1, flags);
         return ret;
 }
 EXPORT_SYMBOL(kmalloc_order);
diff --git a/mm/slub.c b/mm/slub.c
index 1e3d0ec4e200..dc777761b6b7 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -249,7 +249,18 @@ static inline void *freelist_ptr(const struct kmem_cache *s, void *ptr,
                                  unsigned long ptr_addr)
 {
 #ifdef CONFIG_SLAB_FREELIST_HARDENED
-        return (void *)((unsigned long)ptr ^ s->random ^ ptr_addr);
+        /*
+         * When CONFIG_KASAN_SW_TAGS is enabled, ptr_addr might be tagged.
+         * Normally, this doesn't cause any issues, as both set_freepointer()
+         * and get_freepointer() are called with a pointer with the same tag.
+         * However, there are some issues with CONFIG_SLUB_DEBUG code. For
+         * example, when __free_slub() iterates over objects in a cache, it
+         * passes untagged pointers to check_object(). check_object() in turns
+         * calls get_freepointer() with an untagged pointer, which causes the
+         * freepointer to be restored incorrectly.
+         */
+        return (void *)((unsigned long)ptr ^ s->random ^
+                        (unsigned long)kasan_reset_tag((void *)ptr_addr));
 #else
         return ptr;
 #endif
@@ -303,15 +314,10 @@ static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp)
                 __p < (__addr) + (__objects) * (__s)->size; \
                 __p += (__s)->size)
 
-#define for_each_object_idx(__p, __idx, __s, __addr, __objects) \
-        for (__p = fixup_red_left(__s, __addr), __idx = 1; \
-                __idx <= __objects; \
-                __p += (__s)->size, __idx++)
-
 /* Determine object index from a given position */
 static inline unsigned int slab_index(void *p, struct kmem_cache *s, void *addr)
 {
-        return (p - addr) / s->size;
+        return (kasan_reset_tag(p) - addr) / s->size;
 }
 
 static inline unsigned int order_objects(unsigned int order, unsigned int size)
@@ -507,6 +513,7 @@ static inline int check_valid_pointer(struct kmem_cache *s,
                 return 1;
 
         base = page_address(page);
+        object = kasan_reset_tag(object);
         object = restore_red_left(s, object);
         if (object < base || object >= base + page->objects * s->size ||
                 (object - base) % s->size) {
@@ -1075,6 +1082,16 @@ static void setup_object_debug(struct kmem_cache *s, struct page *page,
         init_tracking(s, object);
 }
 
+static void setup_page_debug(struct kmem_cache *s, void *addr, int order)
+{
+        if (!(s->flags & SLAB_POISON))
+                return;
+
+        metadata_access_enable();
+        memset(addr, POISON_INUSE, PAGE_SIZE << order);
+        metadata_access_disable();
+}
+
 static inline int alloc_consistency_checks(struct kmem_cache *s,
                                         struct page *page,
                                         void *object, unsigned long addr)
@@ -1330,6 +1347,8 @@ slab_flags_t kmem_cache_flags(unsigned int object_size,
 #else /* !CONFIG_SLUB_DEBUG */
 static inline void setup_object_debug(struct kmem_cache *s,
                         struct page *page, void *object) {}
+static inline void setup_page_debug(struct kmem_cache *s,
+                        void *addr, int order) {}
 
 static inline int alloc_debug_processing(struct kmem_cache *s,
         struct page *page, void *object, unsigned long addr) { return 0; }
@@ -1374,8 +1393,10 @@ static inline void dec_slabs_node(struct kmem_cache *s, int node,
  */
 static inline void *kmalloc_large_node_hook(void *ptr, size_t size, gfp_t flags)
 {
+        ptr = kasan_kmalloc_large(ptr, size, flags);
+        /* As ptr might get tagged, call kmemleak hook after KASAN. */
         kmemleak_alloc(ptr, size, 1, flags);
-        return kasan_kmalloc_large(ptr, size, flags);
+        return ptr;
 }
 
 static __always_inline void kfree_hook(void *x)
@@ -1641,27 +1662,25 @@ static struct page *allocate_slab(struct kmem_cache *s, gfp_t flags, int node)
         if (page_is_pfmemalloc(page))
                 SetPageSlabPfmemalloc(page);
 
+        kasan_poison_slab(page);
+
         start = page_address(page);
 
-        if (unlikely(s->flags & SLAB_POISON))
-                memset(start, POISON_INUSE, PAGE_SIZE << order);
-
-        kasan_poison_slab(page);
+        setup_page_debug(s, start, order);
 
         shuffle = shuffle_freelist(s, page);
 
         if (!shuffle) {
-                for_each_object_idx(p, idx, s, start, page->objects) {
-                        if (likely(idx < page->objects)) {
-                                next = p + s->size;
-                                next = setup_object(s, page, next);
-                                set_freepointer(s, p, next);
-                        } else
-                                set_freepointer(s, p, NULL);
-                }
                 start = fixup_red_left(s, start);
                 start = setup_object(s, page, start);
                 page->freelist = start;
+                for (idx = 0, p = start; idx < page->objects - 1; idx++) {
+                        next = p + s->size;
+                        next = setup_object(s, page, next);
+                        set_freepointer(s, p, next);
+                        p = next;
+                }
+                set_freepointer(s, p, NULL);
         }
 
         page->inuse = page->objects;
diff --git a/mm/swap.c b/mm/swap.c
index 4929bc1be60e..4d7d37eb3c40 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -320,11 +320,6 @@ static inline void activate_page_drain(int cpu)
 {
 }
 
-static bool need_activate_page_drain(int cpu)
-{
-        return false;
-}
-
 void activate_page(struct page *page)
 {
         struct zone *zone = page_zone(page);
@@ -653,13 +648,15 @@ void lru_add_drain(void)
         put_cpu();
 }
 
+#ifdef CONFIG_SMP
+
+static DEFINE_PER_CPU(struct work_struct, lru_add_drain_work);
+
 static void lru_add_drain_per_cpu(struct work_struct *dummy)
 {
         lru_add_drain();
 }
 
-static DEFINE_PER_CPU(struct work_struct, lru_add_drain_work);
-
 /*
  * Doesn't need any cpu hotplug locking because we do rely on per-cpu
  * kworkers being shut down before our page_alloc_cpu_dead callback is
@@ -702,6 +699,12 @@ void lru_add_drain_all(void)
 
         mutex_unlock(&lock);
 }
+#else
+void lru_add_drain_all(void)
+{
+        lru_add_drain();
+}
+#endif
 
 /**
  * release_pages - batched put_page()
diff --git a/mm/util.c b/mm/util.c
index 1ea055138043..379319b1bcfd 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -150,7 +150,7 @@ void *memdup_user(const void __user *src, size_t len)
 {
         void *p;
 
-        p = kmalloc_track_caller(len, GFP_USER);
+        p = kmalloc_track_caller(len, GFP_USER | __GFP_NOWARN);
         if (!p)
                 return ERR_PTR(-ENOMEM);
 
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 3661cdd927f1..7e71b0df1fbc 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -2058,6 +2058,8 @@ static int process_connect(struct ceph_connection *con)
         dout("process_connect on %p tag %d\n", con, (int)con->in_tag);
 
         if (con->auth) {
+                int len = le32_to_cpu(con->in_reply.authorizer_len);
+
                 /*
                  * Any connection that defines ->get_authorizer()
                  * should also define ->add_authorizer_challenge() and
@@ -2067,8 +2069,7 @@ static int process_connect(struct ceph_connection *con)
                  */
                 if (con->in_reply.tag == CEPH_MSGR_TAG_CHALLENGE_AUTHORIZER) {
                         ret = con->ops->add_authorizer_challenge(
-                                    con, con->auth->authorizer_reply_buf,
-                                    le32_to_cpu(con->in_reply.authorizer_len));
+                                    con, con->auth->authorizer_reply_buf, len);
                         if (ret < 0)
                                 return ret;
 
@@ -2078,10 +2079,12 @@ static int process_connect(struct ceph_connection *con)
                         return 0;
                 }
 
-                ret = con->ops->verify_authorizer_reply(con);
-                if (ret < 0) {
-                        con->error_msg = "bad authorize reply";
-                        return ret;
+                if (len) {
+                        ret = con->ops->verify_authorizer_reply(con);
+                        if (ret < 0) {
+                                con->error_msg = "bad authorize reply";
+                                return ret;
+                        }
                 }
         }
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 8e276e0192a1..5d03889502eb 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -8152,7 +8152,7 @@ static netdev_features_t netdev_sync_upper_features(struct net_device *lower,
         netdev_features_t feature;
         int feature_bit;
 
-        for_each_netdev_feature(&upper_disables, feature_bit) {
+        for_each_netdev_feature(upper_disables, feature_bit) {
                 feature = __NETIF_F_BIT(feature_bit);
                 if (!(upper->wanted_features & feature)
                     && (features & feature)) {
@@ -8172,7 +8172,7 @@ static void netdev_sync_lower_features(struct net_device *upper,
         netdev_features_t feature;
         int feature_bit;
 
-        for_each_netdev_feature(&upper_disables, feature_bit) {
+        for_each_netdev_feature(upper_disables, feature_bit) {
                 feature = __NETIF_F_BIT(feature_bit);
                 if (!(features & feature) && (lower->features & feature)) {
                         netdev_dbg(upper, "Disabling feature %pNF on lower dev %s.\n",
diff --git a/net/core/filter.c b/net/core/filter.c
index 7a54dc11ac2d..f7d0004fc160 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2789,8 +2789,7 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb)
         u32 off = skb_mac_header_len(skb);
         int ret;
 
-        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
-        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+        if (!skb_is_gso_tcp(skb))
                 return -ENOTSUPP;
 
         ret = skb_cow(skb, len_diff);
@@ -2831,8 +2830,7 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb)
         u32 off = skb_mac_header_len(skb);
         int ret;
 
-        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
-        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+        if (!skb_is_gso_tcp(skb))
                 return -ENOTSUPP;
 
         ret = skb_unclone(skb, GFP_ATOMIC);
@@ -2957,8 +2955,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 len_diff)
         u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
         int ret;
 
-        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
-        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+        if (!skb_is_gso_tcp(skb))
                 return -ENOTSUPP;
 
         ret = skb_cow(skb, len_diff);
@@ -2987,8 +2984,7 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff)
         u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
         int ret;
 
-        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
-        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+        if (!skb_is_gso_tcp(skb))
                 return -ENOTSUPP;
 
         ret = skb_unclone(skb, GFP_ATOMIC);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 26d848484912..2415d9cb9b89 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -356,6 +356,8 @@ static void *__netdev_alloc_frag(unsigned int fragsz, gfp_t gfp_mask)
  */
 void *netdev_alloc_frag(unsigned int fragsz)
 {
+        fragsz = SKB_DATA_ALIGN(fragsz);
+
         return __netdev_alloc_frag(fragsz, GFP_ATOMIC);
 }
 EXPORT_SYMBOL(netdev_alloc_frag);
@@ -369,6 +371,8 @@ static void *__napi_alloc_frag(unsigned int fragsz, gfp_t gfp_mask)
 
 void *napi_alloc_frag(unsigned int fragsz)
 {
+        fragsz = SKB_DATA_ALIGN(fragsz);
+
         return __napi_alloc_frag(fragsz, GFP_ATOMIC);
 }
 EXPORT_SYMBOL(napi_alloc_frag);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 2079145a3b7c..cf3c5095c10e 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2528,6 +2528,7 @@ void tcp_write_queue_purge(struct sock *sk)
         sk_mem_reclaim(sk);
         tcp_clear_all_retrans_hints(tcp_sk(sk));
         tcp_sk(sk)->packets_out = 0;
+        inet_csk(sk)->icsk_backoff = 0;
 }
 
 int tcp_disconnect(struct sock *sk, int flags)
@@ -2576,7 +2577,6 @@ int tcp_disconnect(struct sock *sk, int flags)
         tp->write_seq += tp->max_window + 2;
         if (tp->write_seq == 0)
                 tp->write_seq = 1;
-        icsk->icsk_backoff = 0;
         tp->snd_cwnd = 2;
         icsk->icsk_probes_out = 0;
         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index efc6fef692ff..ec3cea9d6828 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -536,12 +536,15 @@ int tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                 if (sock_owned_by_user(sk))
                         break;
 
+                skb = tcp_rtx_queue_head(sk);
+                if (WARN_ON_ONCE(!skb))
+                        break;
+
                 icsk->icsk_backoff--;
                 icsk->icsk_rto = tp->srtt_us ? __tcp_set_rto(tp) :
                                                TCP_TIMEOUT_INIT;
                 icsk->icsk_rto = inet_csk_rto_backoff(icsk, TCP_RTO_MAX);
 
-                skb = tcp_rtx_queue_head(sk);
 
                 tcp_mstamp_refresh(tp);
                 delta_us = (u32)(tp->tcp_mstamp - tcp_skb_timestamp_us(skb));
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 801a9a0c217e..43890898b0b5 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1719,6 +1719,24 @@ static int ip6erspan_tap_validate(struct nlattr *tb[], struct nlattr *data[],
         return 0;
 }
 
+static void ip6erspan_set_version(struct nlattr *data[],
+                                  struct __ip6_tnl_parm *parms)
+{
+        parms->erspan_ver = 1;
+        if (data[IFLA_GRE_ERSPAN_VER])
+                parms->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]);
+
+        if (parms->erspan_ver == 1) {
+                if (data[IFLA_GRE_ERSPAN_INDEX])
+                        parms->index = nla_get_u32(data[IFLA_GRE_ERSPAN_INDEX]);
+        } else if (parms->erspan_ver == 2) {
+                if (data[IFLA_GRE_ERSPAN_DIR])
+                        parms->dir = nla_get_u8(data[IFLA_GRE_ERSPAN_DIR]);
+                if (data[IFLA_GRE_ERSPAN_HWID])
+                        parms->hwid = nla_get_u16(data[IFLA_GRE_ERSPAN_HWID]);
+        }
+}
+
 static void ip6gre_netlink_parms(struct nlattr *data[],
                                 struct __ip6_tnl_parm *parms)
 {
@@ -1767,20 +1785,6 @@ static void ip6gre_netlink_parms(struct nlattr *data[],
 
         if (data[IFLA_GRE_COLLECT_METADATA])
                 parms->collect_md = true;
-
-        parms->erspan_ver = 1;
-        if (data[IFLA_GRE_ERSPAN_VER])
-                parms->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]);
-
-        if (parms->erspan_ver == 1) {
-                if (data[IFLA_GRE_ERSPAN_INDEX])
-                        parms->index = nla_get_u32(data[IFLA_GRE_ERSPAN_INDEX]);
-        } else if (parms->erspan_ver == 2) {
-                if (data[IFLA_GRE_ERSPAN_DIR])
-                        parms->dir = nla_get_u8(data[IFLA_GRE_ERSPAN_DIR]);
-                if (data[IFLA_GRE_ERSPAN_HWID])
-                        parms->hwid = nla_get_u16(data[IFLA_GRE_ERSPAN_HWID]);
-        }
 }
 
 static int ip6gre_tap_init(struct net_device *dev)
@@ -2203,6 +2207,7 @@ static int ip6erspan_newlink(struct net *src_net, struct net_device *dev,
         int err;
 
         ip6gre_netlink_parms(data, &nt->parms);
+        ip6erspan_set_version(data, &nt->parms);
         ign = net_generic(net, ip6gre_net_id);
 
         if (nt->parms.collect_md) {
@@ -2248,6 +2253,7 @@ static int ip6erspan_changelink(struct net_device *dev, struct nlattr *tb[],
         if (IS_ERR(t))
                 return PTR_ERR(t);
 
+        ip6erspan_set_version(data, &p);
         ip6gre_tunnel_unlink_md(ign, t);
         ip6gre_tunnel_unlink(ign, t);
         ip6erspan_tnl_change(t, &p, !tb[IFLA_MTU]);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 2493c74c2d37..96496b2c1670 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -941,6 +941,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
                       BSS_CHANGED_P2P_PS |
                       BSS_CHANGED_TXPOWER;
         int err;
+        int prev_beacon_int;
 
         old = sdata_dereference(sdata->u.ap.beacon, sdata);
         if (old)
@@ -963,6 +964,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
 
         sdata->needed_rx_chains = sdata->local->rx_chains;
 
+        prev_beacon_int = sdata->vif.bss_conf.beacon_int;
         sdata->vif.bss_conf.beacon_int = params->beacon_interval;
 
         if (params->he_cap)
@@ -974,8 +976,10 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
         if (!err)
                 ieee80211_vif_copy_chanctx_to_vlans(sdata, false);
         mutex_unlock(&local->mtx);
-        if (err)
+        if (err) {
+                sdata->vif.bss_conf.beacon_int = prev_beacon_int;
                 return err;
+        }
 
         /*
          * Apply control port protocol, this allows us to
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index cad6592c52a1..2ec7011a4d07 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -70,6 +70,7 @@ enum mesh_deferred_task_flags {
  * @dst: mesh path destination mac address
  * @mpp: mesh proxy mac address
  * @rhash: rhashtable list pointer
+ * @walk_list: linked list containing all mesh_path objects.
  * @gate_list: list pointer for known gates list
  * @sdata: mesh subif
  * @next_hop: mesh neighbor to which frames for this destination will be
@@ -105,6 +106,7 @@ struct mesh_path {
         u8 dst[ETH_ALEN];
         u8 mpp[ETH_ALEN];       /* used for MPP or MAP */
         struct rhash_head rhash;
+        struct hlist_node walk_list;
         struct hlist_node gate_list;
         struct ieee80211_sub_if_data *sdata;
         struct sta_info __rcu *next_hop;
@@ -133,12 +135,16 @@ struct mesh_path {
  * gate's mpath may or may not be resolved and active.
  * @gates_lock: protects updates to known_gates
  * @rhead: the rhashtable containing struct mesh_paths, keyed by dest addr
+ * @walk_head: linked list containging all mesh_path objects
+ * @walk_lock: lock protecting walk_head
  * @entries: number of entries in the table
  */
 struct mesh_table {
         struct hlist_head known_gates;
         spinlock_t gates_lock;
         struct rhashtable rhead;
+        struct hlist_head walk_head;
+        spinlock_t walk_lock;
         atomic_t entries;               /* Up to MAX_MESH_NEIGHBOURS */
 };
 
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index a5125624a76d..88a6d5e18ccc 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -59,8 +59,10 @@ static struct mesh_table *mesh_table_alloc(void)
                 return NULL;
 
         INIT_HLIST_HEAD(&newtbl->known_gates);
+        INIT_HLIST_HEAD(&newtbl->walk_head);
         atomic_set(&newtbl->entries,  0);
         spin_lock_init(&newtbl->gates_lock);
+        spin_lock_init(&newtbl->walk_lock);
 
         return newtbl;
 }
@@ -249,28 +251,15 @@ mpp_path_lookup(struct ieee80211_sub_if_data *sdata, const u8 *dst)
 static struct mesh_path *
 __mesh_path_lookup_by_idx(struct mesh_table *tbl, int idx)
 {
-        int i = 0, ret;
-        struct mesh_path *mpath = NULL;
-        struct rhashtable_iter iter;
-
-        ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC);
-        if (ret)
-                return NULL;
-
-        rhashtable_walk_start(&iter);
+        int i = 0;
+        struct mesh_path *mpath;
 
-        while ((mpath = rhashtable_walk_next(&iter))) {
-                if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
-                        continue;
-                if (IS_ERR(mpath))
-                        break;
+        hlist_for_each_entry_rcu(mpath, &tbl->walk_head, walk_list) {
                 if (i++ == idx)
                         break;
         }
-        rhashtable_walk_stop(&iter);
-        rhashtable_walk_exit(&iter);
 
-        if (IS_ERR(mpath) || !mpath)
+        if (!mpath)
                 return NULL;
 
         if (mpath_expired(mpath)) {
@@ -432,6 +421,7 @@ struct mesh_path *mesh_path_add(struct ieee80211_sub_if_data *sdata,
                 return ERR_PTR(-ENOMEM);
 
         tbl = sdata->u.mesh.mesh_paths;
+        spin_lock_bh(&tbl->walk_lock);
         do {
                 ret = rhashtable_lookup_insert_fast(&tbl->rhead,
                                                     &new_mpath->rhash,
@@ -441,20 +431,20 @@ struct mesh_path *mesh_path_add(struct ieee80211_sub_if_data *sdata,
                         mpath = rhashtable_lookup_fast(&tbl->rhead,
                                                        dst,
                                                        mesh_rht_params);
-
+                else if (!ret)
+                        hlist_add_head(&new_mpath->walk_list, &tbl->walk_head);
         } while (unlikely(ret == -EEXIST && !mpath));
+        spin_unlock_bh(&tbl->walk_lock);
 
-        if (ret && ret != -EEXIST)
-                return ERR_PTR(ret);
-
-        /* At this point either new_mpath was added, or we found a
-         * matching entry already in the table; in the latter case
-         * free the unnecessary new entry.
-         */
-        if (ret == -EEXIST) {
+        if (ret) {
                 kfree(new_mpath);
+
+                if (ret != -EEXIST)
+                        return ERR_PTR(ret);
+
                 new_mpath = mpath;
         }
+
         sdata->u.mesh.mesh_paths_generation++;
         return new_mpath;
 }
@@ -480,9 +470,17 @@ int mpp_path_add(struct ieee80211_sub_if_data *sdata,
 
         memcpy(new_mpath->mpp, mpp, ETH_ALEN);
         tbl = sdata->u.mesh.mpp_paths;
+
+        spin_lock_bh(&tbl->walk_lock);
         ret = rhashtable_lookup_insert_fast(&tbl->rhead,
                                             &new_mpath->rhash,
                                             mesh_rht_params);
+        if (!ret)
+                hlist_add_head_rcu(&new_mpath->walk_list, &tbl->walk_head);
+        spin_unlock_bh(&tbl->walk_lock);
+
+        if (ret)
+                kfree(new_mpath);
 
         sdata->u.mesh.mpp_paths_generation++;
         return ret;
@@ -503,20 +501,9 @@ void mesh_plink_broken(struct sta_info *sta)
         struct mesh_table *tbl = sdata->u.mesh.mesh_paths;
         static const u8 bcast[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
         struct mesh_path *mpath;
-        struct rhashtable_iter iter;
-        int ret;
-
-        ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC);
-        if (ret)
-                return;
 
-        rhashtable_walk_start(&iter);
-
-        while ((mpath = rhashtable_walk_next(&iter))) {
-                if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
-                        continue;
-                if (IS_ERR(mpath))
-                        break;
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(mpath, &tbl->walk_head, walk_list) {
                 if (rcu_access_pointer(mpath->next_hop) == sta &&
                     mpath->flags & MESH_PATH_ACTIVE &&
                     !(mpath->flags & MESH_PATH_FIXED)) {
@@ -530,8 +517,7 @@ void mesh_plink_broken(struct sta_info *sta)
                                 WLAN_REASON_MESH_PATH_DEST_UNREACHABLE, bcast);
                 }
         }
-        rhashtable_walk_stop(&iter);
-        rhashtable_walk_exit(&iter);
+        rcu_read_unlock();
 }
 
 static void mesh_path_free_rcu(struct mesh_table *tbl,
@@ -551,6 +537,7 @@ static void mesh_path_free_rcu(struct mesh_table *tbl,
 
 static void __mesh_path_del(struct mesh_table *tbl, struct mesh_path *mpath)
 {
+        hlist_del_rcu(&mpath->walk_list);
         rhashtable_remove_fast(&tbl->rhead, &mpath->rhash, mesh_rht_params);
         mesh_path_free_rcu(tbl, mpath);
 }
@@ -571,27 +558,14 @@ void mesh_path_flush_by_nexthop(struct sta_info *sta)
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         struct mesh_table *tbl = sdata->u.mesh.mesh_paths;
         struct mesh_path *mpath;
-        struct rhashtable_iter iter;
-        int ret;
-
-        ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC);
-        if (ret)
-                return;
-
-        rhashtable_walk_start(&iter);
-
-        while ((mpath = rhashtable_walk_next(&iter))) {
-                if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
-                        continue;
-                if (IS_ERR(mpath))
-                        break;
+        struct hlist_node *n;
 
+        spin_lock_bh(&tbl->walk_lock);
+        hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
                 if (rcu_access_pointer(mpath->next_hop) == sta)
                         __mesh_path_del(tbl, mpath);
         }
-
-        rhashtable_walk_stop(&iter);
-        rhashtable_walk_exit(&iter);
+        spin_unlock_bh(&tbl->walk_lock);
 }
 
 static void mpp_flush_by_proxy(struct ieee80211_sub_if_data *sdata,
@@ -599,51 +573,26 @@ static void mpp_flush_by_proxy(struct ieee80211_sub_if_data *sdata,
 {
         struct mesh_table *tbl = sdata->u.mesh.mpp_paths;
         struct mesh_path *mpath;
-        struct rhashtable_iter iter;
-        int ret;
-
-        ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC);
-        if (ret)
-                return;
-
-        rhashtable_walk_start(&iter);
-
-        while ((mpath = rhashtable_walk_next(&iter))) {
-                if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
-                        continue;
-                if (IS_ERR(mpath))
-                        break;
+        struct hlist_node *n;
 
+        spin_lock_bh(&tbl->walk_lock);
+        hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
                 if (ether_addr_equal(mpath->mpp, proxy))
                         __mesh_path_del(tbl, mpath);
         }
-
-        rhashtable_walk_stop(&iter);
-        rhashtable_walk_exit(&iter);
+        spin_unlock_bh(&tbl->walk_lock);
 }
 
 static void table_flush_by_iface(struct mesh_table *tbl)
 {
         struct mesh_path *mpath;
-        struct rhashtable_iter iter;
-        int ret;
-
-        ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC);
-        if (ret)
-                return;
-
-        rhashtable_walk_start(&iter);
+        struct hlist_node *n;
 
-        while ((mpath = rhashtable_walk_next(&iter))) {
-                if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
-                        continue;
-                if (IS_ERR(mpath))
-                        break;
+        spin_lock_bh(&tbl->walk_lock);
+        hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
                 __mesh_path_del(tbl, mpath);
         }
-
-        rhashtable_walk_stop(&iter);
-        rhashtable_walk_exit(&iter);
+        spin_unlock_bh(&tbl->walk_lock);
 }
 
 /**
@@ -675,15 +624,15 @@ static int table_path_del(struct mesh_table *tbl,
 {
         struct mesh_path *mpath;
 
-        rcu_read_lock();
+        spin_lock_bh(&tbl->walk_lock);
         mpath = rhashtable_lookup_fast(&tbl->rhead, addr, mesh_rht_params);
         if (!mpath) {
-                rcu_read_unlock();
+                spin_unlock_bh(&tbl->walk_lock);
                 return -ENXIO;
         }
 
         __mesh_path_del(tbl, mpath);
-        rcu_read_unlock();
+        spin_unlock_bh(&tbl->walk_lock);
         return 0;
 }
 
@@ -854,28 +803,16 @@ void mesh_path_tbl_expire(struct ieee80211_sub_if_data *sdata,
                           struct mesh_table *tbl)
 {
         struct mesh_path *mpath;
-        struct rhashtable_iter iter;
-        int ret;
+        struct hlist_node *n;
 
-        ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_KERNEL);
-        if (ret)
-                return;
-
-        rhashtable_walk_start(&iter);
-
-        while ((mpath = rhashtable_walk_next(&iter))) {
-                if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
-                        continue;
-                if (IS_ERR(mpath))
-                        break;
+        spin_lock_bh(&tbl->walk_lock);
+        hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
                 if ((!(mpath->flags & MESH_PATH_RESOLVING)) &&
                     (!(mpath->flags & MESH_PATH_FIXED)) &&
                      time_after(jiffies, mpath->exp_time + MESH_PATH_EXPIRE))
                         __mesh_path_del(tbl, mpath);
         }
-
-        rhashtable_walk_stop(&iter);
-        rhashtable_walk_exit(&iter);
+        spin_unlock_bh(&tbl->walk_lock);
 }
 
 void mesh_path_expire(struct ieee80211_sub_if_data *sdata)
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 86afacb07e5f..ac8d848d7624 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -896,12 +896,13 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
 {
         struct ip_vs_dest *dest;
         unsigned int atype, i;
-        int ret = 0;
 
         EnterFunction(2);
 
 #ifdef CONFIG_IP_VS_IPV6
         if (udest->af == AF_INET6) {
+                int ret;
+
                 atype = ipv6_addr_type(&udest->addr.in6);
                 if ((!(atype & IPV6_ADDR_UNICAST) ||
                         atype & IPV6_ADDR_LINKLOCAL) &&
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 5a92f23f179f..4893f248dfdc 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -313,6 +313,9 @@ static int nft_delrule_by_chain(struct nft_ctx *ctx)
         int err;
 
         list_for_each_entry(rule, &ctx->chain->rules, list) {
+                if (!nft_is_active_next(ctx->net, rule))
+                        continue;
+
                 err = nft_delrule(ctx, rule);
                 if (err < 0)
                         return err;
diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index d4de871e7d4d..37e1fe180769 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -125,9 +125,10 @@ int xdp_umem_assign_dev(struct xdp_umem *umem, struct net_device *dev,
         return 0;
 
 err_unreg_umem:
-        xdp_clear_umem_at_qid(dev, queue_id);
         if (!force_zc)
                 err = 0; /* fallback to copy mode */
+        if (err)
+                xdp_clear_umem_at_qid(dev, queue_id);
 out_rtnl_unlock:
         rtnl_unlock();
         return err;
@@ -259,10 +260,10 @@ static int xdp_umem_pin_pages(struct xdp_umem *umem)
         if (!umem->pgs)
                 return -ENOMEM;
 
-        down_write(&current->mm->mmap_sem);
-        npgs = get_user_pages(umem->address, umem->npgs,
-                              gup_flags, &umem->pgs[0], NULL);
-        up_write(&current->mm->mmap_sem);
+        down_read(&current->mm->mmap_sem);
+        npgs = get_user_pages_longterm(umem->address, umem->npgs,
+                                       gup_flags, &umem->pgs[0], NULL);
+        up_read(&current->mm->mmap_sem);
 
         if (npgs != umem->npgs) {
                 if (npgs >= 0) {
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index a03268454a27..45f3b528dc09 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -669,6 +669,8 @@ static int xsk_mmap(struct file *file, struct socket *sock,
                 if (!umem)
                         return -EINVAL;
 
+                /* Matches the smp_wmb() in XDP_UMEM_REG */
+                smp_rmb();
                 if (offset == XDP_UMEM_PGOFF_FILL_RING)
                         q = READ_ONCE(umem->fq);
                 else if (offset == XDP_UMEM_PGOFF_COMPLETION_RING)
@@ -678,6 +680,8 @@ static int xsk_mmap(struct file *file, struct socket *sock,
         if (!q)
                 return -EINVAL;
 
+        /* Matches the smp_wmb() in xsk_init_queue */
+        smp_rmb();
         qpg = virt_to_head_page(q->ring);
         if (size > (PAGE_SIZE << compound_order(qpg)))
                 return -EINVAL;
diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index 77cebad0474e..f75e7bda4889 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -118,8 +118,8 @@ static int read_symbol(FILE *in, struct sym_entry *s)
                         fprintf(stderr, "Read error or end of file.\n");
                 return -1;
         }
-        if (strlen(sym) > KSYM_NAME_LEN) {
-                fprintf(stderr, "Symbol %s too long for kallsyms (%zu vs %d).\n"
+        if (strlen(sym) >= KSYM_NAME_LEN) {
+                fprintf(stderr, "Symbol %s too long for kallsyms (%zu >= %d).\n"
                                 "Please increase KSYM_NAME_LEN both in kernel and kallsyms.c\n",
                         sym, strlen(sym), KSYM_NAME_LEN);
                 return -1;
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 479909b858c7..8f533c81aa8d 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -186,20 +186,9 @@ static inline int key_permission(const key_ref_t key_ref, unsigned perm)
         return key_task_permission(key_ref, current_cred(), perm);
 }
 
-/*
- * Authorisation record for request_key().
- */
-struct request_key_auth {
-        struct key              *target_key;
-        struct key              *dest_keyring;
-        const struct cred       *cred;
-        void                    *callout_info;
-        size_t                  callout_len;
-        pid_t                   pid;
-} __randomize_layout;
-
 extern struct key_type key_type_request_key_auth;
 extern struct key *request_key_auth_new(struct key *target,
+                                        const char *op,
                                         const void *callout_info,
                                         size_t callout_len,
                                         struct key *dest_keyring);
diff --git a/security/keys/key.c b/security/keys/key.c
index 44a80d6741a1..696f1c092c50 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -265,8 +265,8 @@ struct key *key_alloc(struct key_type *type, const char *desc,
 
                 spin_lock(&user->lock);
                 if (!(flags & KEY_ALLOC_QUOTA_OVERRUN)) {
-                        if (user->qnkeys + 1 >= maxkeys ||
-                            user->qnbytes + quotalen >= maxbytes ||
+                        if (user->qnkeys + 1 > maxkeys ||
+                            user->qnbytes + quotalen > maxbytes ||
                             user->qnbytes + quotalen < user->qnbytes)
                                 goto no_quota;
                 }
@@ -297,6 +297,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
         key->gid = gid;
         key->perm = perm;
         key->restrict_link = restrict_link;
+        key->last_used_at = ktime_get_real_seconds();
 
         if (!(flags & KEY_ALLOC_NOT_IN_QUOTA))
                 key->flags |= 1 << KEY_FLAG_IN_QUOTA;
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index e8093d025966..7bbe03593e58 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -25,6 +25,7 @@
 #include <linux/security.h>
 #include <linux/uio.h>
 #include <linux/uaccess.h>
+#include <keys/request_key_auth-type.h>
 #include "internal.h"
 
 #define KEY_MAX_DESC_SIZE 4096
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 02c77e928f68..0e0b9ccad2f8 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -19,6 +19,7 @@
 #include <linux/security.h>
 #include <linux/user_namespace.h>
 #include <linux/uaccess.h>
+#include <keys/request_key_auth-type.h>
 #include "internal.h"
 
 /* Session keyring create vs join semaphore */
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 301f0e300dbd..3f56a312dd35 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -18,31 +18,30 @@
 #include <linux/keyctl.h>
 #include <linux/slab.h>
 #include "internal.h"
+#include <keys/request_key_auth-type.h>
 
 #define key_negative_timeout    60      /* default timeout on a negative key's existence */
 
 /**
  * complete_request_key - Complete the construction of a key.
- * @cons: The key construction record.
+ * @auth_key: The authorisation key.
  * @error: The success or failute of the construction.
  *
  * Complete the attempt to construct a key.  The key will be negated
  * if an error is indicated.  The authorisation key will be revoked
  * unconditionally.
  */
-void complete_request_key(struct key_construction *cons, int error)
+void complete_request_key(struct key *authkey, int error)
 {
-        kenter("{%d,%d},%d", cons->key->serial, cons->authkey->serial, error);
+        struct request_key_auth *rka = get_request_key_auth(authkey);
+        struct key *key = rka->target_key;
+
+        kenter("%d{%d},%d", authkey->serial, key->serial, error);
 
         if (error < 0)
-                key_negate_and_link(cons->key, key_negative_timeout, NULL,
-                                    cons->authkey);
+                key_negate_and_link(key, key_negative_timeout, NULL, authkey);
         else
-                key_revoke(cons->authkey);
-
-        key_put(cons->key);
-        key_put(cons->authkey);
-        kfree(cons);
+                key_revoke(authkey);
 }
 EXPORT_SYMBOL(complete_request_key);
 
@@ -91,21 +90,19 @@ static int call_usermodehelper_keys(const char *path, char **argv, char **envp,
  * Request userspace finish the construction of a key
  * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"
  */
-static int call_sbin_request_key(struct key_construction *cons,
-                                 const char *op,
-                                 void *aux)
+static int call_sbin_request_key(struct key *authkey, void *aux)
 {
         static char const request_key[] = "/sbin/request-key";
+        struct request_key_auth *rka = get_request_key_auth(authkey);
         const struct cred *cred = current_cred();
         key_serial_t prkey, sskey;
-        struct key *key = cons->key, *authkey = cons->authkey, *keyring,
-                *session;
+        struct key *key = rka->target_key, *keyring, *session;
         char *argv[9], *envp[3], uid_str[12], gid_str[12];
         char key_str[12], keyring_str[3][12];
         char desc[20];
         int ret, i;
 
-        kenter("{%d},{%d},%s", key->serial, authkey->serial, op);
+        kenter("{%d},{%d},%s", key->serial, authkey->serial, rka->op);
 
         ret = install_user_keyrings();
         if (ret < 0)
@@ -163,7 +160,7 @@ static int call_sbin_request_key(struct key_construction *cons,
         /* set up the argument list */
         i = 0;
         argv[i++] = (char *)request_key;
-        argv[i++] = (char *) op;
+        argv[i++] = (char *)rka->op;
         argv[i++] = key_str;
         argv[i++] = uid_str;
         argv[i++] = gid_str;
@@ -191,7 +188,7 @@ error_link:
         key_put(keyring);
 
 error_alloc:
-        complete_request_key(cons, ret);
+        complete_request_key(authkey, ret);
         kleave(" = %d", ret);
         return ret;
 }
@@ -205,42 +202,31 @@ static int construct_key(struct key *key, const void *callout_info,
                          size_t callout_len, void *aux,
                          struct key *dest_keyring)
 {
-        struct key_construction *cons;
         request_key_actor_t actor;
         struct key *authkey;
         int ret;
 
         kenter("%d,%p,%zu,%p", key->serial, callout_info, callout_len, aux);
 
-        cons = kmalloc(sizeof(*cons), GFP_KERNEL);
-        if (!cons)
-                return -ENOMEM;
-
         /* allocate an authorisation key */
-        authkey = request_key_auth_new(key, callout_info, callout_len,
+        authkey = request_key_auth_new(key, "create", callout_info, callout_len,
                                        dest_keyring);
-        if (IS_ERR(authkey)) {
-                kfree(cons);
-                ret = PTR_ERR(authkey);
-                authkey = NULL;
-        } else {
-                cons->authkey = key_get(authkey);
-                cons->key = key_get(key);
+        if (IS_ERR(authkey))
+                return PTR_ERR(authkey);
 
-                /* make the call */
-                actor = call_sbin_request_key;
-                if (key->type->request_key)
-                        actor = key->type->request_key;
+        /* Make the call */
+        actor = call_sbin_request_key;
+        if (key->type->request_key)
+                actor = key->type->request_key;
 
-                ret = actor(cons, "create", aux);
+        ret = actor(authkey, aux);
 
-                /* check that the actor called complete_request_key() prior to
-                 * returning an error */
-                WARN_ON(ret < 0 &&
-                        !test_bit(KEY_FLAG_REVOKED, &authkey->flags));
-                key_put(authkey);
-        }
+        /* check that the actor called complete_request_key() prior to
+         * returning an error */
+        WARN_ON(ret < 0 &&
+                !test_bit(KEY_FLAG_REVOKED, &authkey->flags));
 
+        key_put(authkey);
         kleave(" = %d", ret);
         return ret;
 }
@@ -275,7 +261,7 @@ static int construct_get_dest_keyring(struct key **_dest_keyring)
                         if (cred->request_key_auth) {
                                 authkey = cred->request_key_auth;
                                 down_read(&authkey->sem);
-                                rka = authkey->payload.data[0];
+                                rka = get_request_key_auth(authkey);
                                 if (!test_bit(KEY_FLAG_REVOKED,
                                               &authkey->flags))
                                         dest_keyring =
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index 87ea2f54dedc..afc304e8b61e 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -17,7 +17,7 @@
 #include <linux/slab.h>
 #include <linux/uaccess.h>
 #include "internal.h"
-#include <keys/user-type.h>
+#include <keys/request_key_auth-type.h>
 
 static int request_key_auth_preparse(struct key_preparsed_payload *);
 static void request_key_auth_free_preparse(struct key_preparsed_payload *);
@@ -68,7 +68,7 @@ static int request_key_auth_instantiate(struct key *key,
 static void request_key_auth_describe(const struct key *key,
                                       struct seq_file *m)
 {
-        struct request_key_auth *rka = key->payload.data[0];
+        struct request_key_auth *rka = get_request_key_auth(key);
 
         seq_puts(m, "key:");
         seq_puts(m, key->description);
@@ -83,7 +83,7 @@ static void request_key_auth_describe(const struct key *key,
 static long request_key_auth_read(const struct key *key,
                                   char __user *buffer, size_t buflen)
 {
-        struct request_key_auth *rka = key->payload.data[0];
+        struct request_key_auth *rka = get_request_key_auth(key);
         size_t datalen;
         long ret;
 
@@ -109,7 +109,7 @@ static long request_key_auth_read(const struct key *key,
  */
 static void request_key_auth_revoke(struct key *key)
 {
-        struct request_key_auth *rka = key->payload.data[0];
+        struct request_key_auth *rka = get_request_key_auth(key);
 
         kenter("{%d}", key->serial);
 
@@ -136,7 +136,7 @@ static void free_request_key_auth(struct request_key_auth *rka)
  */
 static void request_key_auth_destroy(struct key *key)
 {
-        struct request_key_auth *rka = key->payload.data[0];
+        struct request_key_auth *rka = get_request_key_auth(key);
 
         kenter("{%d}", key->serial);
 
@@ -147,8 +147,9 @@ static void request_key_auth_destroy(struct key *key)
  * Create an authorisation token for /sbin/request-key or whoever to gain
  * access to the caller's security data.
  */
-struct key *request_key_auth_new(struct key *target, const void *callout_info,
-                                 size_t callout_len, struct key *dest_keyring)
+struct key *request_key_auth_new(struct key *target, const char *op,
+                                 const void *callout_info, size_t callout_len,
+                                 struct key *dest_keyring)
 {
         struct request_key_auth *rka, *irka;
         const struct cred *cred = current->cred;
@@ -166,6 +167,7 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
         if (!rka->callout_info)
                 goto error_free_rka;
         rka->callout_len = callout_len;
+        strlcpy(rka->op, op, sizeof(rka->op));
 
         /* see if the calling process is already servicing the key request of
          * another process */
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 6df758adff84..1ffa36e987b4 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1855,6 +1855,8 @@ enum {
         ALC887_FIXUP_BASS_CHMAP,
         ALC1220_FIXUP_GB_DUAL_CODECS,
         ALC1220_FIXUP_CLEVO_P950,
+        ALC1220_FIXUP_SYSTEM76_ORYP5,
+        ALC1220_FIXUP_SYSTEM76_ORYP5_PINS,
 };
 
 static void alc889_fixup_coef(struct hda_codec *codec,
@@ -2056,6 +2058,17 @@ static void alc1220_fixup_clevo_p950(struct hda_codec *codec,
         snd_hda_override_conn_list(codec, 0x1b, 1, conn1);
 }
 
+static void alc_fixup_headset_mode_no_hp_mic(struct hda_codec *codec,
+                                const struct hda_fixup *fix, int action);
+
+static void alc1220_fixup_system76_oryp5(struct hda_codec *codec,
+                                     const struct hda_fixup *fix,
+                                     int action)
+{
+        alc1220_fixup_clevo_p950(codec, fix, action);
+        alc_fixup_headset_mode_no_hp_mic(codec, fix, action);
+}
+
 static const struct hda_fixup alc882_fixups[] = {
         [ALC882_FIXUP_ABIT_AW9D_MAX] = {
                 .type = HDA_FIXUP_PINS,
@@ -2300,6 +2313,19 @@ static const struct hda_fixup alc882_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc1220_fixup_clevo_p950,
         },
+        [ALC1220_FIXUP_SYSTEM76_ORYP5] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc1220_fixup_system76_oryp5,
+        },
+        [ALC1220_FIXUP_SYSTEM76_ORYP5_PINS] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+                        {}
+                },
+                .chained = true,
+                .chain_id = ALC1220_FIXUP_SYSTEM76_ORYP5,
+        },
 };
 
 static const struct snd_pci_quirk alc882_fixup_tbl[] = {
@@ -2376,6 +2402,8 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
         SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950),
         SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950),
+        SND_PCI_QUIRK(0x1558, 0x96e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_SYSTEM76_ORYP5_PINS),
+        SND_PCI_QUIRK(0x1558, 0x97e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_SYSTEM76_ORYP5_PINS),
         SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
         SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
         SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530),
@@ -5632,6 +5660,7 @@ enum {
         ALC294_FIXUP_ASUS_SPK,
         ALC225_FIXUP_HEADSET_JACK,
         ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
+        ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -6587,6 +6616,17 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
         },
+        [ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE] = {
+                .type = HDA_FIXUP_VERBS,
+                .v.verbs = (const struct hda_verb[]) {
+                        /* Disable PCBEEP-IN passthrough */
+                        { 0x20, AC_VERB_SET_COEF_INDEX, 0x36 },
+                        { 0x20, AC_VERB_SET_PROC_COEF, 0x57d7 },
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC285_FIXUP_LENOVO_HEADPHONE_NOISE
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -7272,7 +7312,7 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x12, 0x90a60130},
                 {0x19, 0x03a11020},
                 {0x21, 0x0321101f}),
-        SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_LENOVO_HEADPHONE_NOISE,
+        SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
                 {0x12, 0x90a60130},
                 {0x14, 0x90170110},
                 {0x19, 0x04a11040},
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index 37e001cf9cd1..3fe34417ec89 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -462,7 +462,7 @@ static int asoc_simple_card_parse_of(struct simple_card_data *priv)
         conf_idx        = 0;
         node = of_get_child_by_name(top, PREFIX "dai-link");
         if (!node) {
-                node = dev->of_node;
+                node = of_node_get(top);
                 loop = 0;
         }
 
diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
index ce00fe2f6aae..d4bde4834ce5 100644
--- a/sound/soc/samsung/i2s.c
+++ b/sound/soc/samsung/i2s.c
@@ -604,6 +604,7 @@ static int i2s_set_fmt(struct snd_soc_dai *dai,
         unsigned int fmt)
 {
         struct i2s_dai *i2s = to_info(dai);
+        struct i2s_dai *other = get_other_dai(i2s);
         int lrp_shift, sdf_shift, sdf_mask, lrp_rlow, mod_slave;
         u32 mod, tmp = 0;
         unsigned long flags;
@@ -661,7 +662,8 @@ static int i2s_set_fmt(struct snd_soc_dai *dai,
                  * CLK_I2S_RCLK_SRC clock is not exposed so we ensure any
                  * clock configuration assigned in DT is not overwritten.
                  */
-                if (i2s->rclk_srcrate == 0 && i2s->clk_data.clks == NULL)
+                if (i2s->rclk_srcrate == 0 && i2s->clk_data.clks == NULL &&
+                    other->clk_data.clks == NULL)
                         i2s_set_sysclk(dai, SAMSUNG_I2S_RCLKSRC_0,
                                                         0, SND_SOC_CLOCK_IN);
                 break;
@@ -699,6 +701,7 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
         struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
 {
         struct i2s_dai *i2s = to_info(dai);
+        struct i2s_dai *other = get_other_dai(i2s);
         u32 mod, mask = 0, val = 0;
         struct clk *rclksrc;
         unsigned long flags;
@@ -784,6 +787,9 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
         i2s->frmclk = params_rate(params);
 
         rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC];
+        if (!rclksrc || IS_ERR(rclksrc))
+                rclksrc = other->clk_table[CLK_I2S_RCLK_SRC];
+
         if (rclksrc && !IS_ERR(rclksrc))
                 i2s->rclk_srcrate = clk_get_rate(rclksrc);
 
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index fc79ec6927e3..731b963b6995 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -2487,6 +2487,7 @@ int snd_soc_tplg_component_load(struct snd_soc_component *comp,
         struct snd_soc_tplg_ops *ops, const struct firmware *fw, u32 id)
 {
         struct soc_tplg tplg;
+        int ret;
 
         /* setup parsing context */
         memset(&tplg, 0, sizeof(tplg));
@@ -2500,7 +2501,12 @@ int snd_soc_tplg_component_load(struct snd_soc_component *comp,
         tplg.bytes_ext_ops = ops->bytes_ext_ops;
         tplg.bytes_ext_ops_count = ops->bytes_ext_ops_count;
 
-        return soc_tplg_load(&tplg);
+        ret = soc_tplg_load(&tplg);
+        /* free the created components if fail to load topology */
+        if (ret)
+                snd_soc_tplg_component_remove(comp, SND_SOC_TPLG_INDEX_ALL);
+
+        return ret;
 }
 EXPORT_SYMBOL_GPL(snd_soc_tplg_component_load);